// admin — a WordPress-admin-style operator home for a JSS deployment, as a
// #206 loader plugin. The capstone: ONE page (plus a JSON API) that shows
// everything about the server and its installed plugins that the plugin api
// lets an operator SEE — and a "not possible yet" strip naming everything a
// wp-admin/Nextcloud-style admin would also DO, each with the seam that
// blocks it.
//
//   plugins: [{ id: 'admin', module: 'admin/plugin.js', prefix: '/admin',
//               config: {                                    // all optional
//                 podsRoot: '/srv/jss/data/pods',            // enables pod stats
//                 adminAgents: ['https://…/card.jsonld#me'], // gate the surface
//                 probes: { relay: { kind: 'ws' } },         // refine a plugin row
//               } }]
//
// The plugin list is auto-discovered (api.plugins, #610) and the origin comes
// from api.serverInfo (#601) — no hand-copied inventory, no loopbackUrl.
//
//   GET <prefix>/            → self-contained HTML admin page (server-side
//                              rendered from a live snapshot, then polled
//                              client-side every ~10s)
//   GET <prefix>/status.json → the same snapshot as JSON, probed live per
//                              request (concurrent, ~3s timeout each, no
//                              caching)
//
// THE POINT (the README headline): measure how much of wp-admin the plugin
// api can express today. The read side works — liveness, per-plugin probes,
// user/storage stats — and now runs on real seams: the plugin list is
// api.plugins (#610, auto-discovered, no drift), the origin is api.serverInfo
// (#601). What's still re-declared: podsRoot (the api mediates no data-root
// access) and the operator gate (adminAgents — no api.isOperator yet). The
// WRITE side is architecturally absent: no install (#200), no runtime
// enable/disable (boot-time loader; `deactivate()` exists but nothing calls
// it at runtime), no settings panels (no contribute-a-panel affordance — the
// `adminPage` link convention here is the workaround), no log viewer
// (api.log is write-only). Those absences are the finding, not TODOs.
//
// AUTH: if config.adminAgents (array of agent id strings) is present, BOTH
// the page and the JSON require a Bearer token that api.auth.getAgent
// resolves to a listed agent — 401 anonymous, 403 non-admin, JSON errors
// either way. If absent, the surface is served OPEN with a loud warn at
// activate. "Who is an operator?" has no api answer — every plugin invents
// its own (metrics: a shared token; terminal: a token; this one: an agent
// allowlist); see README findings.
//
// PROBES are dashboard/'s machinery verbatim in spirit: anonymous, loopback
// only, local paths validated at activate ('/' prefix, no '://', never under
// this plugin's own prefix — a probe of status.json from status.json would
// recurse). <500 is alive by default; `expect: [..]` narrows; kind: 'ws'
// accepts 400/426 (upgrade refusal IS the healthy answer to a plain GET).
//
// PODS WALK: if config.podsRoot is given (an absolute path), the pod count,
// total disk usage and newest-pod mtime are computed by a recursive stat
// walk. Containment: the root is fs.realpath'd once and symlinks are never
// followed below it, so the walk cannot escape podsRoot; the walk is capped
// (default 50k entries, truncation reported); only counts and sizes are
// read — never file contents, and nothing from the walk is served as data.

import fsp from 'node:fs/promises';
import path from 'node:path';

const DEFAULT_TIMEOUT_MS = 3000;
const DEFAULT_REFRESH_MS = 10000;
const DEFAULT_MAX_WALK = 50000;

const ESC = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
const esc = (s) => String(s).replace(/[&<>"']/g, (c) => ESC[c]);

/** 1234567 → "1.2 MB" (client script carries its own copy). */
function fmtBytes(n) {
  if (typeof n !== 'number' || !Number.isFinite(n)) return '—';
  const units = ['B', 'KB', 'MB', 'GB', 'TB'];
  let i = 0; let v = n;
  while (v >= 1024 && i < units.length - 1) { v /= 1024; i += 1; }
  return `${i ? v.toFixed(1) : v} ${units[i]}`;
}

/** 93784.2 → "1d 2h 3m" (client script carries its own copy). */
function fmtDur(s) {
  if (typeof s !== 'number' || !Number.isFinite(s)) return '—';
  const d = Math.floor(s / 86400); const h = Math.floor((s % 86400) / 3600);
  const m = Math.floor((s % 3600) / 60); const sec = Math.floor(s % 60);
  if (d) return `${d}d ${h}h ${m}m`;
  if (h) return `${h}h ${m}m`;
  if (m) return `${m}m ${sec}s`;
  return `${sec}s`;
}

// What wp-admin has that this page architecturally can't do, each with the
// seam behind it. Rendered as the "not possible yet" strip and exported so
// the README/tests stay honest about the list.
export const NOT_POSSIBLE = [
  ['Install / marketplace', 'plugins arrive by editing the createServer config and rebooting; there is no runtime install, no package source, no marketplace (#200).'],
  ['Enable / disable', 'the loader activates plugins at boot only; deactivate() exists in the contract but nothing calls it at runtime — no toggle without a restart.'],
  ['Plugin settings panels', 'no contribute-a-panel affordance in the api; the adminPage link convention used on this page is the workaround (each plugin hand-rolls its own page and this one merely links to it).'],
  ['Log viewer', 'api.log is write-only — there is no tailing/reading seam, so "recent server logs" cannot be shown here at all.'],
  ['Gated by default', 'without config.adminAgents this page serves OPEN — the api has no operator concept, so an on-by-default admin can\'t be safely gated without one (the api.isOperator seam).'],
];

export async function activate(api) {
  const prefix = api.prefix || '/admin';
  const cfg = api.config || {};

  // The origin the admin page reaches the host on (loopback) and displays
  // (public) both come from api.serverInfo (#601) unless overridden — no more
  // loopbackUrl/baseUrl required in config. Resolved per request: with port 0
  // the real port exists only once the server is listening.
  function loopbackOrigin() {
    if (cfg.loopbackUrl) return String(cfg.loopbackUrl).replace(/\/$/, '');
    const { protocol, host, port } = api.serverInfo();
    const h = host.includes(':') ? `[${host}]` : host;
    return `${protocol}://${h}:${port}`;
  }
  function publicOrigin() {
    if (cfg.baseUrl) return String(cfg.baseUrl).replace(/\/$/, '');
    return api.serverInfo().baseUrl;
  }

  const timeoutMs = cfg.timeoutMs ?? DEFAULT_TIMEOUT_MS;
  const refreshMs = cfg.refreshMs ?? DEFAULT_REFRESH_MS;
  const maxWalk = cfg.maxWalkEntries ?? DEFAULT_MAX_WALK;

  // ----------------------------------------------------------- podsRoot
  const podsRoot = cfg.podsRoot ?? null;
  if (podsRoot !== null && (typeof podsRoot !== 'string' || !path.isAbsolute(podsRoot))) {
    throw new Error('admin: config.podsRoot must be an absolute path to the pods data root');
  }

  // -------------------------------------------------------- adminAgents
  const adminAgents = cfg.adminAgents ?? null;
  if (adminAgents !== null) {
    if (!Array.isArray(adminAgents) || adminAgents.length === 0
        || !adminAgents.every((a) => typeof a === 'string' && a)) {
      throw new Error(
        'admin: config.adminAgents must be a non-empty array of agent id '
        + 'strings (WebIDs / did:nostr) — an empty list would lock everyone '
        + 'out; omit the key entirely to serve the admin surface open',
      );
    }
  }

  // ------------------------------------------ discovered plugins + probes
  // The plugin list is api.plugins (#610) — auto-discovered, not hand-copied,
  // so it can't drift from the real createServer list. config.probes
  // optionally refines a single plugin's row by id:
  //   { <id>: { probe?, expect?, kind?, description?, adminPage? } }
  // Paths are validated so a refinement can't leave loopback or recurse into
  // this page. (The roster carries no health hints, so ws endpoints and odd
  // prefixes still want a refinement — same residual as dashboard/.)
  const overrides = cfg.probes ?? {};
  if (!overrides || typeof overrides !== 'object' || Array.isArray(overrides)) {
    throw new Error('admin: config.probes must be an object keyed by plugin id');
  }
  const localPath = (where, key, value) => {
    if (typeof value !== 'string' || !value.startsWith('/') || value.includes('://')) {
      throw new Error(
        `${where}: ${key} must be a local path starting with '/' and containing no '://' `
        + `— got ${JSON.stringify(value)}`,
      );
    }
    return value;
  };
  for (const [id, ov] of Object.entries(overrides)) {
    const where = `admin: config.probes[${JSON.stringify(id)}]`;
    if (!ov || typeof ov !== 'object') throw new Error(`${where} must be an object`);
    if (ov.probe !== undefined) {
      localPath(where, 'probe', ov.probe);
      if (ov.probe === prefix || ov.probe.startsWith(`${prefix}/`)) {
        throw new Error(
          `${where}: probe ${JSON.stringify(ov.probe)} targets the admin page itself — `
          + 'probing status.json from status.json would recurse; point probes at other plugins',
        );
      }
    }
    if (ov.adminPage !== undefined) localPath(where, 'adminPage', ov.adminPage);
    if (ov.description !== undefined && typeof ov.description !== 'string') {
      throw new Error(`${where}: description must be a string`);
    }
    if (ov.expect !== undefined
        && (!Array.isArray(ov.expect) || ov.expect.length === 0 || !ov.expect.every(Number.isInteger))) {
      throw new Error(`${where}: expect must be a non-empty array of integer HTTP statuses`);
    }
    if (ov.kind !== undefined && ov.kind !== 'http' && ov.kind !== 'ws') {
      throw new Error(`${where}: kind must be 'http' or 'ws'`);
    }
  }
  // Every co-loaded plugin except this admin (identified by its own prefix);
  // default probe is the plugin's own prefix.
  const targets = api.plugins
    .filter((p) => p.id && p.prefix !== prefix)
    .map((p) => {
      const ov = overrides[p.id] ?? {};
      return {
        id: p.id,
        prefix: p.prefix || null,
        description: ov.description ?? '',
        probe: ov.probe ?? (p.prefix || null),
        expect: ov.expect ?? null,
        kind: ov.kind ?? 'http',
        adminPage: ov.adminPage ?? null,
      };
    });

  // ---------------------------------------------------------------- auth
  // Agent-allowlist guard (after shortlink/'s getAgent pattern). Applied to
  // BOTH the HTML page and the JSON API. There is no operator/role concept
  // in the api — this allowlist is one more plugin-invented answer to "who
  // is an operator?" (metrics invented a shared token, terminal a token,
  // this one an agent list). See README findings.
  async function requireAdmin(request, reply) {
    if (!adminAgents) return true;
    const agent = await api.auth.getAgent(request);
    if (!agent) {
      reply.code(401)
        .header('www-authenticate', 'Bearer realm="admin"')
        .send({ error: 'authentication required — this admin surface is restricted to config.adminAgents' });
      return false;
    }
    if (!adminAgents.includes(agent)) {
      reply.code(403).send({ error: `agent ${agent} is not an admin (not listed in config.adminAgents)` });
      return false;
    }
    return true;
  }

  // -------------------------------------------------------------- probes
  // dashboard/'s machinery: anonymous loopback GET, per-probe timeout.
  async function hit(p) {
    const started = performance.now();
    let status = null;
    try {
      const res = await fetch(loopbackOrigin() + p, {
        redirect: 'manual',
        signal: AbortSignal.timeout(timeoutMs),
        headers: { accept: '*/*' }, // deliberately NO authorization
      });
      status = res.status;
      try { await res.body?.cancel(); } catch { /* drained */ }
    } catch { /* timeout / refused → status stays null */ }
    return { status, latency_ms: Math.round(performance.now() - started) };
  }

  function classify(target, status) {
    if (status === null || status >= 500) return 'down';
    if (target.expect) return target.expect.includes(status) ? 'up' : 'down';
    if (status < 400) return 'up';
    if (target.kind === 'ws' && (status === 400 || status === 426)) return 'up';
    return 'degraded';
  }

  // ------------------------------------------------------------ pods walk
  /** Recursive stat walk under podsRoot — counts and sizes only, capped. */
  async function podStats() {
    if (!podsRoot) return null;
    let rootReal;
    try {
      rootReal = await fsp.realpath(podsRoot);
    } catch (err) {
      return { error: `cannot resolve podsRoot: ${err.message}` };
    }
    // Top level: pod directories are the non-dot dirs (dot dirs are the
    // host's own — .idp, the pluginDir guard, .well-known …).
    let count = 0;
    let newestMs = 0;
    try {
      for (const d of await fsp.readdir(rootReal, { withFileTypes: true })) {
        if (!d.isDirectory() || d.name.startsWith('.')) continue;
        count += 1;
        try {
          const st = await fsp.stat(path.join(rootReal, d.name));
          if (st.mtimeMs > newestMs) newestMs = st.mtimeMs;
        } catch { /* raced away */ }
      }
    } catch (err) {
      return { error: `cannot read podsRoot: ${err.message}` };
    }
    // Full walk for disk usage. Symlinks are skipped entirely (never
    // followed — the containment guard), so the walk stays under rootReal.
    let entries = 0;
    let bytes = 0;
    let truncated = false;
    const stack = [rootReal];
    while (stack.length && !truncated) {
      const dir = stack.pop();
      let dirents;
      try { dirents = await fsp.readdir(dir, { withFileTypes: true }); } catch { continue; }
      for (const d of dirents) {
        if (entries >= maxWalk) { truncated = true; break; }
        entries += 1;
        if (d.isSymbolicLink()) continue;
        const p = path.join(dir, d.name);
        if (d.isDirectory()) stack.push(p);
        else if (d.isFile()) {
          try { bytes += (await fsp.lstat(p)).size; } catch { /* raced away */ }
        }
      }
    }
    return {
      count,
      storageBytes: bytes,
      entriesWalked: entries,
      truncated,
      newestPodModified: newestMs ? new Date(newestMs).toISOString() : null,
    };
  }

  // ------------------------------------------------------------ snapshot
  const probed = targets.filter((t) => t.probe);
  async function snapshot() {
    const [host, pods, ...results] = await Promise.all([
      hit('/'), // host front door: any non-5xx answer is a living server
      podStats(),
      ...probed.map((t) => hit(t.probe)),
    ]);
    const byId = new Map(probed.map((t, i) => [t, results[i]]));
    const plugins = targets.map((t) => {
      const r = byId.get(t);
      const state = r ? classify(t, r.status) : 'unprobed';
      return {
        id: t.id,
        ...(t.prefix ? { prefix: t.prefix } : {}),
        ...(t.description ? { description: t.description } : {}),
        ...(t.probe ? { probe: t.probe } : {}),
        ...(t.expect ? { expect: t.expect } : {}),
        kind: t.kind,
        ...(t.adminPage ? { adminPage: t.adminPage } : {}),
        state,
        alive: state === 'up' || state === 'degraded',
        status: r ? r.status : null,
        latency_ms: r ? r.latency_ms : null,
      };
    });
    const tally = (s) => plugins.filter((p) => p.state === s).length;
    return {
      generated: new Date().toISOString(),
      server: {
        baseUrl: publicOrigin(),
        alive: host.status !== null && host.status < 500,
        status: host.status,
        latency_ms: host.latency_ms,
        node: process.version,
        platform: `${process.platform} ${process.arch}`,
        uptime_seconds: Math.round(process.uptime()),
      },
      plugins,
      pods, // null when no podsRoot configured
      meta: {
        declared: plugins.length,
        up: tally('up'),
        degraded: tally('degraded'),
        down: tally('down'),
        unprobed: tally('unprobed'),
        guarded: !!adminAgents,
      },
    };
  }

  // ------------------------------------------------------------ the page
  // Self-contained (inline CSS, no external assets), dark-mode via
  // prefers-color-scheme, server-side rendered from a live snapshot so curl
  // shows real content; a small inline script re-polls status.json every
  // ~10s. When adminAgents guards the surface, the script needs the bearer
  // too — append `#token=<bearer>` to the URL (the api has no session
  // concept a plugin page could ride; see README findings).
  function renderPage(snap) {
    const badge = (state) => `<span class="state badge ${esc(state)}">${esc(state)}</span>`;
    const srvState = snap.server.alive ? 'up' : 'down';
    const rows = snap.plugins.map((p, i) => `
      <tr id="p-${i}">
        <td class="id">${esc(p.id)}</td>
        <td class="desc">${esc(p.description || '')}</td>
        <td>${p.prefix ? `<a href="${esc(p.prefix)}"><code>${esc(p.prefix)}</code></a>` : '—'}</td>
        <td>${badge(p.state)}</td>
        <td class="code">${p.status ?? '—'}</td>
        <td class="latency">${p.latency_ms === null ? '—' : `${p.latency_ms} ms`}</td>
        <td>${p.adminPage ? `<a href="${esc(p.adminPage)}">settings</a>` : '—'}</td>
      </tr>`).join('');

    const podsSection = !podsRoot ? `
    <p class="note">No <code>podsRoot</code> configured — user/storage stats need
    filesystem access the api doesn't mediate (the plugin can only see what the
    operator re-declares; cousin of the <code>api.serverInfo</code> finding).</p>`
      : snap.pods && snap.pods.error ? `
    <p class="note">podsRoot error: ${esc(snap.pods.error)}</p>`
        : `
    <table>
      <tbody>
        <tr><th>pods</th><td id="pods-count">${snap.pods.count}</td></tr>
        <tr><th>disk usage</th><td><span id="pods-bytes">${esc(fmtBytes(snap.pods.storageBytes))}</span>
          <span class="muted">(<span id="pods-raw">${snap.pods.storageBytes}</span> bytes,
          <span id="pods-entries">${snap.pods.entriesWalked}</span> entries walked${snap.pods.truncated ? ', TRUNCATED at the walk cap' : ''})</span></td></tr>
        <tr><th>newest pod modified</th><td id="pods-newest">${esc(snap.pods.newestPodModified ?? '—')}</td></tr>
      </tbody>
    </table>
    ${snap.pods.truncated ? '<p class="note">Walk capped — disk usage is a lower bound.</p>' : ''}`;

    return `<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>server admin</title>
<style>
  :root { color-scheme: light dark;
    --fg: #1a1a1a; --bg: #ffffff; --muted: #666; --line: #ddd; --card: #f7f7f7;
    --up: #1a7f37; --up-bg: #e6f4ea; --deg: #7a5d00; --deg-bg: #fdf3d0;
    --down: #b3261e; --down-bg: #fbe9e7; --unk: #555; --unk-bg: #ececec;
    --warn-bg: #fff3e0; --warn-line: #e0a960; }
  @media (prefers-color-scheme: dark) { :root {
    --fg: #e6e6e6; --bg: #121212; --muted: #999; --line: #333; --card: #1c1c1c;
    --up: #6fdb8b; --up-bg: #10331a; --deg: #e8c96a; --deg-bg: #33290d;
    --down: #ff8a80; --down-bg: #38120f; --unk: #aaa; --unk-bg: #262626;
    --warn-bg: #2b1f10; --warn-line: #7a5d2a; } }
  body { margin: 2rem auto; max-width: 56rem; padding: 0 1rem;
    font: 15px/1.5 system-ui, sans-serif; color: var(--fg); background: var(--bg); }
  h1 { font-size: 1.3rem; margin: 0 0 .25rem; }
  h2 { font-size: 1rem; margin: 1.6rem 0 .5rem; text-transform: uppercase;
    letter-spacing: .05em; color: var(--muted); }
  a { color: inherit; }
  table { border-collapse: collapse; width: 100%; }
  th, td { text-align: left; padding: .4rem .6rem; border-bottom: 1px solid var(--line);
    vertical-align: top; }
  thead th { font-size: .8rem; text-transform: uppercase; letter-spacing: .04em; color: var(--muted); }
  tbody th { font-weight: 600; white-space: nowrap; width: 12rem; }
  code { font-size: .9em; }
  .badge { display: inline-block; min-width: 4.5em; text-align: center;
    border-radius: 999px; padding: .05em .6em; font-size: .85em; }
  .badge.up { color: var(--up); background: var(--up-bg); }
  .badge.degraded { color: var(--deg); background: var(--deg-bg); }
  .badge.down { color: var(--down); background: var(--down-bg); }
  .badge.unprobed { color: var(--unk); background: var(--unk-bg); }
  .latency, .code { font-variant-numeric: tabular-nums; white-space: nowrap; }
  .note, .muted { color: var(--muted); font-size: .9rem; }
  #meta { color: var(--muted); font-size: .85rem; margin: 1.2rem 0 0; }
  .strip { background: var(--warn-bg); border: 1px solid var(--warn-line);
    border-radius: 6px; padding: .8rem 1rem; margin-top: .5rem; }
  .strip ul { margin: .4rem 0 0; padding-left: 1.2rem; }
  .strip li { margin: .3rem 0; }
</style>
</head>
<body>
  <h1>server admin</h1>
  <p class="note">${esc(snap.server.baseUrl)} — ${adminAgents
    ? `guarded: ${adminAgents.length} admin agent${adminAgents.length === 1 ? '' : 's'}`
    : 'OPEN: no adminAgents configured — anyone can read this page'}</p>

  <h2>Server</h2>
  <table>
    <tbody>
      <tr><th>base URL</th><td><a href="${esc(snap.server.baseUrl)}/">${esc(snap.server.baseUrl)}</a></td></tr>
      <tr><th>host liveness</th><td><span id="srv-state">${badge(srvState)}</span>
        <span class="muted">http <span id="srv-status" class="code">${snap.server.status ?? '—'}</span>,
        <span id="srv-latency" class="latency">${snap.server.latency_ms} ms</span> over loopback</span></td></tr>
      <tr><th>process uptime</th><td id="srv-uptime">${esc(fmtDur(snap.server.uptime_seconds))}</td></tr>
      <tr><th>node</th><td>${esc(snap.server.node)}</td></tr>
      <tr><th>platform</th><td>${esc(snap.server.platform)}</td></tr>
    </tbody>
  </table>

  <h2>Plugins</h2>
${targets.length === 0 ? `  <p class="note">No other plugins are loaded. This page
  auto-discovers its co-loaded siblings via <code>api.plugins</code> (#610);
  load another plugin and it appears here — no hand-maintained list.</p>` : `  <table>
    <thead><tr><th>plugin</th><th>description</th><th>prefix</th><th>status</th><th>http</th><th>latency</th><th>admin</th></tr></thead>
    <tbody>${rows}
    </tbody>
  </table>
  <p class="note">Auto-discovered via <code>api.plugins</code> (#610) — no
  hand-copied list to drift. Probes are anonymous loopback GETs at each
  plugin's prefix; <code>config.probes</code> refines individual rows.</p>`}

  <h2>Pods / Users</h2>${podsSection}

  <h2>Not possible yet</h2>
  <div class="strip">
    <strong>What wp-admin has that this page can't do</strong> — each absence is a
    measured api gap, not a TODO:
    <ul>
${NOT_POSSIBLE.map(([what, why]) => `      <li><strong>${esc(what)}</strong> — ${esc(why)}</li>`).join('\n')}
    </ul>
  </div>

  <h2>Meta</h2>
  <p id="meta"><span id="meta-counts">${snap.meta.declared} declared —
    ${snap.meta.up} up, ${snap.meta.degraded} degraded, ${snap.meta.down} down, ${snap.meta.unprobed} unprobed</span>
    · generated <span id="meta-generated">${esc(snap.generated)}</span>
    · polls <code>status.json</code> every ${Math.round(refreshMs / 1000)}s</p>

  <script>
    (function () {
      var url = ${JSON.stringify(`${prefix}/status.json`)};
      var guarded = ${JSON.stringify(!!adminAgents)};
      var token = null;
      try { token = new URLSearchParams(location.hash.replace(/^#/, '')).get('token'); } catch (e) {}
      function fmtBytes(n) {
        if (typeof n !== 'number' || !isFinite(n)) return '—';
        var u = ['B', 'KB', 'MB', 'GB', 'TB']; var i = 0; var v = n;
        while (v >= 1024 && i < u.length - 1) { v /= 1024; i += 1; }
        return (i ? v.toFixed(1) : v) + ' ' + u[i];
      }
      function fmtDur(s) {
        var d = Math.floor(s / 86400), h = Math.floor((s % 86400) / 3600),
            m = Math.floor((s % 3600) / 60), sec = Math.floor(s % 60);
        if (d) return d + 'd ' + h + 'h ' + m + 'm';
        if (h) return h + 'h ' + m + 'm';
        if (m) return m + 'm ' + sec + 's';
        return sec + 's';
      }
      function setText(id, text) {
        var el = document.getElementById(id);
        if (el) el.textContent = text;
      }
      function setBadge(container, state) {
        var el = document.querySelector(container + ' .state') || document.querySelector(container);
        if (!el) return;
        el.textContent = state;
        el.className = 'state badge ' + state;
      }
      async function tick() {
        try {
          var res = await fetch(url, {
            cache: 'no-store',
            headers: token ? { authorization: 'Bearer ' + token } : {},
          });
          if (res.status === 401 || res.status === 403) {
            setText('meta-generated', 'poll ' + res.status + (guarded
              ? ' — append #token=<your bearer> to the URL to poll live'
              : ''));
            return;
          }
          var data = await res.json();
          setBadge('#srv-state', data.server.alive ? 'up' : 'down');
          setText('srv-status', data.server.status === null ? '—' : data.server.status);
          setText('srv-latency', data.server.latency_ms + ' ms');
          setText('srv-uptime', fmtDur(data.server.uptime_seconds));
          data.plugins.forEach(function (p, i) {
            var row = document.getElementById('p-' + i);
            if (!row) return;
            setBadge('#p-' + i, p.state);
            row.querySelector('.code').textContent = (p.status === null || p.status === undefined) ? '—' : p.status;
            row.querySelector('.latency').textContent = p.latency_ms === null ? '—' : p.latency_ms + ' ms';
          });
          if (data.pods && !data.pods.error) {
            setText('pods-count', data.pods.count);
            setText('pods-bytes', fmtBytes(data.pods.storageBytes));
            setText('pods-raw', data.pods.storageBytes);
            setText('pods-entries', data.pods.entriesWalked);
            if (data.pods.newestPodModified) setText('pods-newest', data.pods.newestPodModified);
          }
          setText('meta-counts', data.meta.declared + ' declared — ' + data.meta.up + ' up, '
            + data.meta.degraded + ' degraded, ' + data.meta.down + ' down, '
            + data.meta.unprobed + ' unprobed');
          setText('meta-generated', data.generated);
        } catch (err) {
          setText('meta-generated', 'poll failed: ' + err);
        }
      }
      setInterval(tick, ${JSON.stringify(refreshMs)});
      tick();
    })();
  </script>
</body>
</html>
`;
  }

  // -------------------------------------------------------------- routes
  const servePage = async (request, reply) => {
    if (!(await requireAdmin(request, reply))) return reply;
    const snap = await snapshot();
    return reply
      .header('cache-control', 'no-store')
      .type('text/html; charset=utf-8')
      .send(renderPage(snap));
  };
  api.fastify.get(`${prefix}/`, servePage);
  api.fastify.get(prefix, servePage);

  api.fastify.get(`${prefix}/status.json`, async (request, reply) => {
    if (!(await requireAdmin(request, reply))) return reply;
    reply.header('cache-control', 'no-store');
    return snapshot();
  });

  // Cheap, ungated liveness — no snapshot, no auth (conventional for a
  // healthz, like metrics/). It lets another prober (e.g. dashboard/) confirm
  // the admin plugin is alive WITHOUT triggering a full page-snapshot render,
  // which probes every sibling and would otherwise blow the prober's timeout
  // and read as 'down' — and, when two ops consoles probe each other, storm.
  api.fastify.get(`${prefix}/healthz`, async (request, reply) => {
    reply.header('cache-control', 'no-store');
    return { status: 'ok', uptime_seconds: Math.round(process.uptime()) };
  });

  if (!adminAgents) {
    api.log.warn(
      `admin: the admin surface at ${prefix}/ is OPEN — no config.adminAgents set, `
      + 'so ANYONE can read the server/plugin/pod overview. The plugin api has no '
      + 'operator concept; pass adminAgents (agent id allowlist) to guard it.',
    );
  }
  api.log.info(
    `admin: operator home at ${prefix}/ — ${targets.length} plugin(s) auto-discovered `
    + `(api.plugins), ${podsRoot ? `pods stats from ${podsRoot}` : 'no podsRoot (no pod stats)'}, `
    + `${adminAgents ? `${adminAgents.length} admin agent(s)` : 'OPEN'}`,
  );

  // Stateless: probes and the pods walk run per request; the refresh timer
  // lives in the client page. Nothing to tear down.
}

export default activate;