@1mcp/agent 0.34.3 → 0.35.0-beta.1

package/build/domains/runtime-targets/runtimeTargetStore.js

@@ -0,0 +1,1456 @@
+import fs from 'node:fs';
+import net from 'node:net';
+import path from 'node:path';
+import { getGlobalConfigDir } from '../../constants.js';
+const METADATA_FILE = 'runtime-targets.json';
+const SECRETS_FILE = 'runtime-target-secrets.json';
+const LOCK_FILE = '.runtime-targets.lock';
+const STORE_SCHEMA_VERSION = 1;
+const TARGET_NAME_PATTERN = /^[a-z0-9][a-z0-9._-]{0,62}$/;
+const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;
+export class RuntimeTargetStoreError extends Error {
+    code;
+    details;
+    recoveryCommand;
+    constructor(code, message, details, recoveryCommand) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.recoveryCommand = recoveryCommand;
+        this.name = 'RuntimeTargetStoreError';
+    }
+}
+export class RuntimeTargetStore {
+    static activeLocks = new Set();
+    storeDir;
+    now;
+    static defaultStoreDir() {
+        return getGlobalConfigDir();
+    }
+    constructor(options = {}) {
+        this.storeDir = options.storeDir ?? RuntimeTargetStore.defaultStoreDir();
+        this.now = options.now ?? (() => new Date());
+    }
+    current() {
+        const metadata = this.readMetadata();
+        const currentName = metadata.current && metadata.targets[metadata.current] ? metadata.current : 'local';
+        return currentName === 'local' ? this.localEntry(true) : this.toListEntry(metadata.targets[currentName], true);
+    }
+    resolveForConnection(name) {
+        const metadata = this.readMetadata();
+        const currentName = metadata.current && metadata.targets[metadata.current] ? metadata.current : 'local';
+        const targetName = name ?? currentName;
+        if (targetName === 'local') {
+            return this.localEntry(targetName === currentName);
+        }
+        const target = metadata.targets[targetName];
+        if (!target) {
+            throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${targetName}" was not found`);
+        }
+        return this.toListEntry(target, metadata.current === targetName, undefined, true);
+    }
+    list() {
+        const metadata = this.readMetadata();
+        const secrets = this.readSecretsForMetadataOnly();
+        const currentName = metadata.current && metadata.targets[metadata.current] ? metadata.current : 'local';
+        const local = this.localEntry(currentName === 'local', secrets);
+        const remotes = Object.values(metadata.targets)
+            .sort((left, right) => left.name.localeCompare(right.name))
+            .map((target) => this.toListEntry(target, target.name === currentName, secrets));
+        return [local, ...remotes];
+    }
+    inspect(name) {
+        if (name === 'local') {
+            return this.localEntry(this.current().name === 'local');
+        }
+        const metadata = this.readMetadata();
+        const target = metadata.targets[name];
+        if (!target) {
+            throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${name}" was not found`);
+        }
+        return this.toListEntry(target, metadata.current === name);
+    }
+    useTarget(name, options = {}) {
+        if (name === 'local') {
+            return this.withLock(() => {
+                const metadata = this.readMetadata();
+                this.writeMetadata({ ...metadata, current: undefined });
+                return { target: this.localEntry(true), warnings: [] };
+            });
+        }
+        return this.withLock(() => {
+            const metadata = this.readMetadata();
+            const target = metadata.targets[name];
+            if (!target) {
+                throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${name}" was not found`);
+            }
+            const nextTarget = this.confirmInsecureTlsIfRequired(target, 'use', options.acceptInsecureTls);
+            this.writeMetadata({
+                ...metadata,
+                current: name,
+                targets: {
+                    ...metadata.targets,
+                    [name]: nextTarget,
+                },
+            });
+            const entry = this.toListEntry(nextTarget, true);
+            return {
+                target: entry,
+                warnings: verificationWarnings(entry),
+            };
+        });
+    }
+    requireInsecureTlsConfirmation(input) {
+        if (input.name === 'local') {
+            return this.localEntry(this.current().name === 'local');
+        }
+        return this.withLock(() => {
+            const metadata = this.readMetadata();
+            const target = metadata.targets[input.name];
+            if (!target) {
+                throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${input.name}" was not found`);
+            }
+            const nextTarget = this.confirmInsecureTlsIfRequired(target, input.operation, input.acceptInsecureTls);
+            if (nextTarget !== target) {
+                this.writeMetadata({
+                    ...metadata,
+                    targets: {
+                        ...metadata.targets,
+                        [input.name]: nextTarget,
+                    },
+                });
+            }
+            return this.toListEntry(nextTarget, metadata.current === input.name);
+        });
+    }
+    deleteTarget(name, options = {}) {
+        if (name === 'local') {
+            throw new RuntimeTargetStoreError('target_local_reserved', 'The built-in local target cannot be deleted');
+        }
+        this.withLock(() => {
+            const metadata = this.readMetadata();
+            if (!metadata.targets[name]) {
+                throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${name}" was not found`);
+            }
+            if (metadata.current === name && !options.force) {
+                throw new RuntimeTargetStoreError('target_is_current', 'Cannot delete the current runtime target without force');
+            }
+            const { [name]: _deleted, ...targets } = metadata.targets;
+            const secrets = this.readSecretsForCredentialUse();
+            const hadSecrets = secrets.credentials[name] !== undefined;
+            const { [name]: _deletedSecrets, ...credentials } = secrets.credentials;
+            const nextMetadata = {
+                ...metadata,
+                current: metadata.current === name ? undefined : metadata.current,
+                targets,
+            };
+            if (hadSecrets) {
+                this.writeSecretsThenMetadata(secrets, { ...secrets, credentials }, nextMetadata);
+                return;
+            }
+            this.writeMetadata(nextMetadata);
+        });
+    }
+    renameTarget(sourceName, destinationName) {
+        if (sourceName === 'local') {
+            throw new RuntimeTargetStoreError('target_local_reserved', 'The built-in local target cannot be renamed');
+        }
+        const normalizedDestinationName = validateRuntimeTargetName(destinationName);
+        return this.withLock(() => {
+            const metadata = this.readMetadata();
+            const source = metadata.targets[sourceName];
+            if (!source) {
+                throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${sourceName}" was not found`);
+            }
+            if (metadata.targets[normalizedDestinationName]) {
+                throw new RuntimeTargetStoreError('target_already_exists', `Runtime target "${normalizedDestinationName}" already exists`);
+            }
+            const renamed = {
+                ...source,
+                name: normalizedDestinationName,
+                updatedAt: this.now().toISOString(),
+            };
+            const { [sourceName]: _removed, ...remainingTargets } = metadata.targets;
+            const secrets = this.readSecretsForCredentialUse();
+            const sourceSecrets = secrets.credentials[sourceName];
+            const { [sourceName]: _removedSecrets, ...remainingCredentials } = secrets.credentials;
+            const nextMetadata = {
+                ...metadata,
+                current: metadata.current === sourceName ? normalizedDestinationName : metadata.current,
+                targets: {
+                    ...remainingTargets,
+                    [normalizedDestinationName]: renamed,
+                },
+            };
+            if (sourceSecrets !== undefined) {
+                this.writeSecretsThenMetadata(secrets, {
+                    ...secrets,
+                    credentials: {
+                        ...remainingCredentials,
+                        [normalizedDestinationName]: sourceSecrets,
+                    },
+                }, nextMetadata);
+            }
+            else {
+                this.writeMetadata(nextMetadata);
+            }
+            return this.toListEntry(renamed, metadata.current === sourceName);
+        });
+    }
+    setCredentialReferences(name, runtimeScopeId, references) {
+        if (!runtimeScopeId) {
+            throw new RuntimeTargetStoreError('identity_invalid', 'Runtime scope id is required for credential references');
+        }
+        this.withLock(() => {
+            const metadata = this.readMetadata();
+            if (name !== 'local' && !metadata.targets[name]) {
+                throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${name}" was not found`);
+            }
+            const secrets = this.readSecretsForCredentialUse();
+            const byScope = secrets.credentials[name] ?? {};
+            this.writeSecrets({
+                ...secrets,
+                credentials: {
+                    ...secrets.credentials,
+                    [name]: {
+                        ...byScope,
+                        [runtimeScopeId]: compactCredentialReferences(references),
+                    },
+                },
+            });
+        });
+    }
+    setOAuthTokenReference(name, runtimeScopeId, oauth) {
+        if (!runtimeScopeId) {
+            throw new RuntimeTargetStoreError('identity_invalid', 'Runtime scope id is required for credential references');
+        }
+        this.withLock(() => {
+            const metadata = this.readMetadata();
+            if (name !== 'local' && !metadata.targets[name]) {
+                throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${name}" was not found`);
+            }
+            const secrets = this.readSecretsForCredentialUse();
+            const byScope = secrets.credentials[name] ?? {};
+            const bucket = byScope[runtimeScopeId] ?? {};
+            this.writeSecrets({
+                ...secrets,
+                credentials: {
+                    ...secrets.credentials,
+                    [name]: {
+                        ...byScope,
+                        [runtimeScopeId]: {
+                            ...bucket,
+                            oauth,
+                        },
+                    },
+                },
+            });
+        });
+    }
+    getOAuthTokenReference(name, runtimeScopeId) {
+        if (!runtimeScopeId) {
+            throw new RuntimeTargetStoreError('identity_invalid', 'Runtime scope id is required for credential references');
+        }
+        const metadata = this.readMetadata();
+        if (name !== 'local' && !metadata.targets[name]) {
+            throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${name}" was not found`);
+        }
+        const secrets = this.readSecretsForCredentialUse();
+        return secrets.credentials[name]?.[runtimeScopeId]?.oauth;
+    }
+    clearOAuthTokenReference(name, runtimeScopeId) {
+        if (!runtimeScopeId) {
+            throw new RuntimeTargetStoreError('identity_invalid', 'Runtime scope id is required for credential references');
+        }
+        this.withLock(() => {
+            const metadata = this.readMetadata();
+            if (name !== 'local' && !metadata.targets[name]) {
+                throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${name}" was not found`);
+            }
+            const secrets = this.readSecretsForCredentialUse();
+            const byScope = secrets.credentials[name];
+            const bucket = byScope?.[runtimeScopeId];
+            if (!bucket || bucket.oauth === undefined) {
+                return;
+            }
+            const { oauth: _oauth, ...nextBucket } = bucket;
+            const nextScopes = { ...byScope };
+            if (Object.keys(nextBucket).length === 0) {
+                delete nextScopes[runtimeScopeId];
+            }
+            else {
+                nextScopes[runtimeScopeId] = nextBucket;
+            }
+            const nextCredentials = { ...secrets.credentials };
+            if (Object.keys(nextScopes).length === 0) {
+                delete nextCredentials[name];
+            }
+            else {
+                nextCredentials[name] = nextScopes;
+            }
+            this.writeSecrets({ ...secrets, credentials: nextCredentials });
+        });
+    }
+    clearLocalOAuthTokenReferences() {
+        return this.clearLocalCredentialReferences('oauth');
+    }
+    clearLocalAdminSessionReferences() {
+        return this.clearLocalCredentialReferences('adminSession');
+    }
+    setAdminSessionReference(name, runtimeScopeId, adminSession) {
+        if (!runtimeScopeId) {
+            throw new RuntimeTargetStoreError('identity_invalid', 'Runtime scope id is required for credential references');
+        }
+        this.withLock(() => {
+            const metadata = this.readMetadata();
+            if (name !== 'local' && !metadata.targets[name]) {
+                throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${name}" was not found`);
+            }
+            const secrets = this.readSecretsForCredentialUse();
+            const byScope = secrets.credentials[name] ?? {};
+            const bucket = byScope[runtimeScopeId] ?? {};
+            this.writeSecrets({
+                ...secrets,
+                credentials: {
+                    ...secrets.credentials,
+                    [name]: {
+                        ...byScope,
+                        [runtimeScopeId]: {
+                            ...bucket,
+                            adminSession,
+                        },
+                    },
+                },
+            });
+        });
+    }
+    getAdminSessionReference(name, runtimeScopeId) {
+        if (!runtimeScopeId) {
+            throw new RuntimeTargetStoreError('identity_invalid', 'Runtime scope id is required for credential references');
+        }
+        const metadata = this.readMetadata();
+        if (name !== 'local' && !metadata.targets[name]) {
+            throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${name}" was not found`);
+        }
+        const secrets = this.readSecretsForCredentialUse();
+        return secrets.credentials[name]?.[runtimeScopeId]?.adminSession;
+    }
+    clearAdminSessionReference(name, runtimeScopeId) {
+        if (!runtimeScopeId) {
+            throw new RuntimeTargetStoreError('identity_invalid', 'Runtime scope id is required for credential references');
+        }
+        this.withLock(() => {
+            const metadata = this.readMetadata();
+            if (name !== 'local' && !metadata.targets[name]) {
+                throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${name}" was not found`);
+            }
+            const secrets = this.readSecretsForCredentialUse();
+            const byScope = secrets.credentials[name];
+            const bucket = byScope?.[runtimeScopeId];
+            if (!bucket || bucket.adminSession === undefined) {
+                return;
+            }
+            const { adminSession: _adminSession, ...nextBucket } = bucket;
+            const nextScopes = { ...byScope };
+            if (Object.keys(nextBucket).length === 0) {
+                delete nextScopes[runtimeScopeId];
+            }
+            else {
+                nextScopes[runtimeScopeId] = nextBucket;
+            }
+            const nextCredentials = { ...secrets.credentials };
+            if (Object.keys(nextScopes).length === 0) {
+                delete nextCredentials[name];
+            }
+            else {
+                nextCredentials[name] = nextScopes;
+            }
+            this.writeSecrets({ ...secrets, credentials: nextCredentials });
+        });
+    }
+    replaceVerifiedTarget(input) {
+        const name = validateRuntimeTargetName(input.name);
+        const hasDisplayNameInput = Object.prototype.hasOwnProperty.call(input, 'displayName');
+        const nextDisplayName = hasDisplayNameInput ? normalizeDisplayName(input.displayName) : undefined;
+        const tlsMetadata = normalizeTlsMetadata({
+            caFile: input.caFile,
+            insecureSkipVerify: input.insecureSkipVerify,
+        });
+        const url = normalizeRuntimeTargetUrl(input.url, {
+            allowInsecureHttp: tlsMetadata.insecureSkipVerify === true,
+        });
+        validateRuntimeIdentity(input.observedIdentity);
+        return this.withLock(() => {
+            const metadata = this.readMetadata();
+            const existing = metadata.targets[name];
+            if (!existing) {
+                throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${name}" was not found`);
+            }
+            const previousRuntimeScopeId = existing.observedIdentity?.runtimeScopeId;
+            const nextRuntimeScopeId = input.observedIdentity.runtimeScopeId;
+            const identityChanged = previousRuntimeScopeId !== undefined && previousRuntimeScopeId !== nextRuntimeScopeId;
+            if (identityChanged && !input.acceptNewIdentity) {
+                throw new RuntimeTargetStoreError('identity_runtime_scope_mismatch', 'Runtime target identity changed; accept the new identity before replacing metadata');
+            }
+            const now = this.now().toISOString();
+            const updated = {
+                ...existing,
+                url,
+                displayName: hasDisplayNameInput ? nextDisplayName : existing.displayName,
+                caFile: tlsMetadata.caFile,
+                insecureSkipVerify: tlsMetadata.insecureSkipVerify,
+                insecureTlsConfirmationRequired: undefined,
+                observedIdentity: input.observedIdentity,
+                lastVerifiedAt: now,
+                updatedAt: now,
+            };
+            const secrets = this.readSecretsForCredentialUse();
+            const shouldClearCredentials = identityChanged || existing.url !== url;
+            const { [name]: _removedSecrets, ...credentials } = secrets.credentials;
+            const nextSecrets = shouldClearCredentials ? { ...secrets, credentials } : secrets;
+            const nextMetadata = {
+                ...metadata,
+                targets: {
+                    ...metadata.targets,
+                    [name]: updated,
+                },
+            };
+            if (shouldClearCredentials && secrets.credentials[name] !== undefined) {
+                this.writeSecretsThenMetadata(secrets, nextSecrets, nextMetadata);
+            }
+            else {
+                this.writeMetadata(nextMetadata);
+            }
+            return this.toListEntry(updated, metadata.current === name, nextSecrets);
+        });
+    }
+    updateObservedIdentityMetadata(name, observedIdentity) {
+        if (name === 'local') {
+            throw new RuntimeTargetStoreError('target_local_reserved', 'The built-in local target has no stored metadata');
+        }
+        validateRuntimeIdentity(observedIdentity);
+        return this.withLock(() => {
+            const metadata = this.readMetadata();
+            const existing = metadata.targets[name];
+            if (!existing) {
+                throw new RuntimeTargetStoreError('target_not_found', `Runtime target "${name}" was not found`);
+            }
+            if (existing.observedIdentity?.runtimeScopeId &&
+                existing.observedIdentity.runtimeScopeId !== observedIdentity.runtimeScopeId) {
+                throw new RuntimeTargetStoreError('identity_runtime_scope_mismatch', 'Runtime target identity changed; stored credentials cannot be used until identity replacement is accepted');
+            }
+            const now = this.now().toISOString();
+            const updated = {
+                ...existing,
+                observedIdentity,
+                lastVerifiedAt: now,
+                updatedAt: now,
+            };
+            this.writeMetadata({
+                ...metadata,
+                targets: {
+                    ...metadata.targets,
+                    [name]: updated,
+                },
+            });
+            const entry = this.toListEntry(updated, metadata.current === name);
+            return {
+                target: entry,
+                warnings: externalUrlWarnings(existing.url, observedIdentity),
+            };
+        });
+    }
+    prepareAddTarget(input) {
+        const name = validateRuntimeTargetName(input.name);
+        const displayName = normalizeDisplayName(input.displayName);
+        const tlsMetadata = normalizeTlsMetadata({
+            caFile: input.caFile,
+            insecureSkipVerify: input.insecureSkipVerify,
+        });
+        const url = normalizeRuntimeTargetUrl(input.url, {
+            allowInsecureHttp: tlsMetadata.insecureSkipVerify === true,
+        });
+        this.withLock(() => {
+            const metadata = this.readMetadata();
+            if (metadata.targets[name]) {
+                throw new RuntimeTargetStoreError('target_already_exists', `Runtime target "${name}" already exists`);
+            }
+        });
+        return {
+            name,
+            url,
+            displayName,
+            caFile: tlsMetadata.caFile,
+            insecureSkipVerify: tlsMetadata.insecureSkipVerify,
+            use: input.use ?? false,
+        };
+    }
+    commitVerifiedAdd(prepared, observedIdentity) {
+        validateRuntimeIdentity(observedIdentity);
+        return this.withLock(() => {
+            const metadata = this.readMetadata();
+            if (metadata.targets[prepared.name]) {
+                throw new RuntimeTargetStoreError('target_already_exists', `Runtime target "${prepared.name}" already exists`);
+            }
+            const now = this.now().toISOString();
+            const target = {
+                name: prepared.name,
+                url: prepared.url,
+                displayName: prepared.displayName,
+                caFile: prepared.caFile,
+                insecureSkipVerify: prepared.insecureSkipVerify,
+                observedIdentity,
+                lastVerifiedAt: now,
+                createdAt: now,
+                updatedAt: now,
+            };
+            this.writeMetadata({
+                ...metadata,
+                current: prepared.use ? prepared.name : metadata.current,
+                targets: {
+                    ...metadata.targets,
+                    [prepared.name]: target,
+                },
+            });
+            return this.toListEntry(target, prepared.use);
+        });
+    }
+    async addVerifiedTarget(input, verifier) {
+        const prepared = this.prepareAddTarget(input);
+        const observedIdentity = await verifier({
+            targetName: prepared.name,
+            url: prepared.url,
+            caFile: prepared.caFile,
+            insecureSkipVerify: prepared.insecureSkipVerify,
+            storeLocked: this.isLockedInThisProcess(),
+        });
+        return this.commitVerifiedAdd(prepared, observedIdentity);
+    }
+    exportTargetBundle() {
+        const metadata = this.readMetadata();
+        return {
+            targetBundleVersion: 1,
+            targets: Object.values(metadata.targets)
+                .sort((left, right) => left.name.localeCompare(right.name))
+                .map((target) => targetToBundleEntry(target)),
+        };
+    }
+    previewImportTargetBundle(bundle, options = {}) {
+        const metadata = this.readMetadata();
+        return this.validateImportBundle(bundle, metadata, options);
+    }
+    importTargetBundle(bundle, options = {}) {
+        return this.withLock(() => {
+            const metadata = this.readMetadata();
+            const result = this.validateImportBundle(bundle, metadata, options);
+            const now = this.now().toISOString();
+            const importedTargets = Object.fromEntries(result.additions.map((addition) => [
+                addition.name,
+                {
+                    name: addition.name,
+                    url: addition.url,
+                    displayName: addition.displayName,
+                    caFile: addition.caFile,
+                    insecureSkipVerify: addition.insecureSkipVerify,
+                    insecureTlsConfirmationRequired: addition.insecureSkipVerify === true ? true : undefined,
+                    observedIdentity: addition.observedIdentity,
+                    lastVerifiedAt: addition.lastVerifiedAt,
+                    createdAt: now,
+                    updatedAt: now,
+                },
+            ]));
+            this.writeMetadata({
+                ...metadata,
+                targets: {
+                    ...metadata.targets,
+                    ...importedTargets,
+                },
+            });
+            return result;
+        });
+    }
+    doctor(options = {}) {
+        return this.withLock(() => {
+            const issues = [];
+            const repairs = [];
+            const metadataInspection = this.inspectMetadataFileForDoctor(issues);
+            const secretsInspection = this.inspectSecretsFileForDoctor(issues);
+            const hasInsecureSecretPermissions = secretsInspection.fileExists && !isOwnerOnly(this.secretsPath());
+            if (hasInsecureSecretPermissions) {
+                issues.push({
+                    code: 'secret_store_insecure_permissions',
+                    message: 'Runtime target secret store is readable or writable by non-owners',
+                });
+                if (options.fixSecrets) {
+                    fs.chmodSync(this.secretsPath(), 0o600);
+                    repairs.push({
+                        code: 'fixed_secret_store_permissions',
+                        message: 'Runtime target secret store permissions were repaired',
+                    });
+                }
+            }
+            if (metadataInspection.metadata) {
+                const currentName = metadataInspection.metadata.current;
+                if (currentName && currentName !== 'local' && !metadataInspection.metadata.targets[currentName]) {
+                    issues.push({
+                        code: 'current_context_missing',
+                        targetName: currentName,
+                        message: `Current runtime target "${currentName}" does not exist`,
+                    });
+                }
+                if (metadataInspection.metadata.targets.local) {
+                    issues.push({
+                        code: 'reserved_local_stored_target',
+                        targetName: 'local',
+                        message: 'The reserved local target is stored as remote metadata',
+                    });
+                }
+            }
+            if (metadataInspection.metadata && secretsInspection.secrets) {
+                const orphanNames = Object.keys(secretsInspection.secrets.credentials).filter((targetName) => targetName !== 'local' && !metadataInspection.metadata?.targets[targetName]);
+                for (const targetName of orphanNames) {
+                    issues.push({
+                        code: 'orphaned_credentials',
+                        targetName,
+                        message: `Credential references exist for missing runtime target "${targetName}"`,
+                    });
+                }
+                if (options.pruneOrphans && orphanNames.length > 0 && (!hasInsecureSecretPermissions || options.fixSecrets)) {
+                    const credentials = { ...secretsInspection.secrets.credentials };
+                    for (const targetName of orphanNames) {
+                        delete credentials[targetName];
+                        repairs.push({
+                            code: 'pruned_orphaned_credentials',
+                            targetName,
+                            message: `Removed orphaned credential references for "${targetName}"`,
+                        });
+                    }
+                    this.writeSecrets({ ...secretsInspection.secrets, credentials });
+                }
+            }
+            return { issues, repairs };
+        });
+    }
+    validateImportBundle(bundle, metadata, options) {
+        const validationFacts = [];
+        const warnings = [];
+        const additions = [];
+        const caFileExists = options.caFileExists ?? ((caFile) => fs.existsSync(caFile));
+        if (!isRecord(bundle)) {
+            validationFacts.push({
+                code: 'invalid_bundle_schema',
+                message: 'Runtime target import bundle must be an object',
+            });
+            throwImportValidationFailed(validationFacts);
+        }
+        if (bundle.targetBundleVersion !== 1) {
+            validationFacts.push({
+                code: 'invalid_bundle_version',
+                message: 'Runtime target import bundle version must be 1',
+            });
+        }
+        if (!Array.isArray(bundle.targets)) {
+            validationFacts.push({
+                code: 'invalid_bundle_schema',
+                message: 'Runtime target import bundle targets must be an array',
+            });
+            throwImportValidationFailed(validationFacts);
+        }
+        const seenNames = new Set();
+        for (const rawEntry of bundle.targets) {
+            if (!isRecord(rawEntry)) {
+                validationFacts.push({
+                    code: 'invalid_target_entry',
+                    message: 'Runtime target import entry must be an object',
+                });
+                continue;
+            }
+            const rawName = rawEntry.name;
+            const targetName = typeof rawName === 'string' ? rawName : undefined;
+            let normalizedName;
+            if (!targetName) {
+                validationFacts.push({
+                    code: 'invalid_target_name',
+                    message: 'Runtime target import entry name must be a string',
+                });
+            }
+            else if (seenNames.has(targetName)) {
+                validationFacts.push({
+                    code: 'duplicate_bundle_entry',
+                    targetName,
+                    message: `Runtime target "${targetName}" is duplicated in the import bundle`,
+                });
+            }
+            else {
+                seenNames.add(targetName);
+            }
+            if (targetName) {
+                try {
+                    normalizedName = validateRuntimeTargetName(targetName);
+                }
+                catch (error) {
+                    const code = error instanceof RuntimeTargetStoreError && error.code === 'target_name_reserved'
+                        ? 'reserved_local_target'
+                        : 'invalid_target_name';
+                    validationFacts.push({
+                        code,
+                        targetName,
+                        message: code === 'reserved_local_target'
+                            ? 'The built-in local target cannot be imported as stored metadata'
+                            : 'Runtime target import entry name is invalid',
+                    });
+                }
+            }
+            if (normalizedName && metadata.targets[normalizedName]) {
+                validationFacts.push({
+                    code: 'target_name_conflict',
+                    targetName: normalizedName,
+                    message: `Runtime target "${normalizedName}" already exists`,
+                });
+            }
+            let displayName;
+            if (Object.prototype.hasOwnProperty.call(rawEntry, 'displayName')) {
+                if (typeof rawEntry.displayName !== 'string' && rawEntry.displayName !== undefined) {
+                    validationFacts.push({
+                        code: 'invalid_display_name',
+                        targetName,
+                        message: 'Runtime target import displayName must be a string',
+                    });
+                }
+                else {
+                    try {
+                        displayName = normalizeDisplayName(rawEntry.displayName);
+                    }
+                    catch {
+                        validationFacts.push({
+                            code: 'invalid_display_name',
+                            targetName,
+                            message: 'Runtime target import displayName is invalid',
+                        });
+                    }
+                }
+            }
+            let tlsMetadata;
+            try {
+                tlsMetadata = normalizeTlsMetadata({
+                    caFile: rawEntry.caFile,
+                    insecureSkipVerify: rawEntry.insecureSkipVerify,
+                });
+            }
+            catch {
+                validationFacts.push({
+                    code: 'invalid_tls_metadata',
+                    targetName,
+                    message: 'Runtime target import TLS metadata is invalid',
+                });
+            }
+            let normalizedUrl;
+            if (typeof rawEntry.url !== 'string') {
+                validationFacts.push({
+                    code: 'invalid_url',
+                    targetName,
+                    message: 'Runtime target import entry URL must be a string',
+                });
+            }
+            else {
+                try {
+                    normalizedUrl = normalizeRuntimeTargetUrl(rawEntry.url, {
+                        allowInsecureHttp: tlsMetadata?.insecureSkipVerify === true,
+                    });
+                }
+                catch {
+                    validationFacts.push({
+                        code: 'invalid_url',
+                        targetName,
+                        message: 'Runtime target import entry URL is invalid',
+                    });
+                }
+            }
+            let observedIdentity;
+            if (Object.prototype.hasOwnProperty.call(rawEntry, 'observedIdentity')) {
+                if (!isRecord(rawEntry.observedIdentity)) {
+                    validationFacts.push({
+                        code: 'invalid_observed_identity',
+                        targetName,
+                        message: 'Runtime target import observedIdentity must be an object',
+                    });
+                }
+                else {
+                    observedIdentity = {
+                        identityProtocolVersion: rawEntry.observedIdentity.identityProtocolVersion,
+                        runtimeScopeId: rawEntry.observedIdentity.runtimeScopeId,
+                        externalUrl: rawEntry.observedIdentity.externalUrl,
+                        runtimeVersion: rawEntry.observedIdentity.runtimeVersion,
+                        serverTime: rawEntry.observedIdentity.serverTime,
+                    };
+                    try {
+                        validateRuntimeIdentity(observedIdentity);
+                    }
+                    catch {
+                        validationFacts.push({
+                            code: 'invalid_observed_identity',
+                            targetName,
+                            message: 'Runtime target import observedIdentity is invalid',
+                        });
+                    }
+                }
+            }
+            let lastVerifiedAt;
+            if (Object.prototype.hasOwnProperty.call(rawEntry, 'lastVerifiedAt')) {
+                if (typeof rawEntry.lastVerifiedAt !== 'string' || Number.isNaN(Date.parse(rawEntry.lastVerifiedAt))) {
+                    validationFacts.push({
+                        code: 'invalid_last_verified_at',
+                        targetName,
+                        message: 'Runtime target import lastVerifiedAt must be an ISO-like timestamp string',
+                    });
+                }
+                else {
+                    lastVerifiedAt = rawEntry.lastVerifiedAt;
+                }
+            }
+            if (normalizedName && normalizedUrl && tlsMetadata) {
+                const addition = omitUndefined({
+                    name: normalizedName,
+                    url: normalizedUrl,
+                    displayName,
+                    caFile: tlsMetadata.caFile,
+                    insecureSkipVerify: tlsMetadata.insecureSkipVerify,
+                    observedIdentity,
+                    lastVerifiedAt,
+                });
+                additions.push(addition);
+                if (addition.caFile && !caFileExists(addition.caFile)) {
+                    warnings.push({
+                        code: 'warning_missing_ca_file',
+                        targetName: addition.name,
+                        message: `CA bundle path "${addition.caFile}" does not exist on this machine`,
+                    });
+                }
+                if (addition.insecureSkipVerify) {
+                    warnings.push({
+                        code: 'warning_insecure_tls_confirmation_required',
+                        targetName: addition.name,
+                        message: `Runtime target "${addition.name}" will require insecure TLS confirmation before first use`,
+                    });
+                }
+            }
+        }
+        if (validationFacts.length > 0) {
+            throwImportValidationFailed(validationFacts);
+        }
+        return {
+            additions: additions.sort((left, right) => left.name.localeCompare(right.name)),
+            validationFacts,
+            warnings: warnings.sort((left, right) => left.targetName.localeCompare(right.targetName)),
+        };
+    }
+    confirmInsecureTlsIfRequired(target, operation, acceptInsecureTls) {
+        if (!target.insecureTlsConfirmationRequired) {
+            return target;
+        }
+        if (!acceptInsecureTls) {
+            throw new RuntimeTargetStoreError('target_insecure_tls_confirmation_required', `Runtime target "${target.name}" uses imported insecure TLS metadata and requires confirmation`, { operation, targetName: target.name }, insecureTlsRecoveryCommand(target.name, operation));
+        }
+        return {
+            ...target,
+            insecureTlsConfirmationRequired: false,
+            updatedAt: this.now().toISOString(),
+        };
+    }
+    inspectMetadataFileForDoctor(issues) {
+        const filePath = this.metadataPath();
+        if (!fs.existsSync(filePath)) {
+            return { metadata: { schemaVersion: STORE_SCHEMA_VERSION, targets: {} } };
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        }
+        catch {
+            issues.push({
+                code: 'metadata_parse_failed',
+                message: 'Runtime target metadata file is not valid JSON',
+            });
+            return {};
+        }
+        if (!isRecord(parsed) || parsed.schemaVersion !== STORE_SCHEMA_VERSION || !isRecord(parsed.targets)) {
+            issues.push({
+                code: 'metadata_schema_invalid',
+                message: 'Runtime target metadata file does not match schema version 1',
+            });
+            return {};
+        }
+        if (parsed.current !== undefined && typeof parsed.current !== 'string') {
+            issues.push({
+                code: 'metadata_schema_invalid',
+                message: 'Runtime target metadata current pointer must be a string',
+            });
+        }
+        for (const [targetName, rawTarget] of Object.entries(parsed.targets)) {
+            inspectStoredTargetForDoctor(targetName, rawTarget, issues);
+        }
+        return {
+            metadata: {
+                schemaVersion: STORE_SCHEMA_VERSION,
+                current: typeof parsed.current === 'string' ? parsed.current : undefined,
+                targets: parsed.targets,
+            },
+        };
+    }
+    inspectSecretsFileForDoctor(issues) {
+        const filePath = this.secretsPath();
+        if (!fs.existsSync(filePath)) {
+            return { fileExists: false, secrets: { schemaVersion: STORE_SCHEMA_VERSION, credentials: {} } };
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        }
+        catch {
+            issues.push({
+                code: 'secrets_parse_failed',
+                message: 'Runtime target secrets file is not valid JSON',
+            });
+            return { fileExists: true };
+        }
+        if (!isRecord(parsed) || parsed.schemaVersion !== STORE_SCHEMA_VERSION || !isRecord(parsed.credentials)) {
+            issues.push({
+                code: 'secrets_schema_invalid',
+                message: 'Runtime target secrets file does not match schema version 1',
+            });
+            return { fileExists: true };
+        }
+        for (const [targetName, rawScopes] of Object.entries(parsed.credentials)) {
+            inspectCredentialScopesForDoctor(targetName, rawScopes, issues);
+        }
+        return {
+            fileExists: true,
+            secrets: {
+                schemaVersion: STORE_SCHEMA_VERSION,
+                credentials: parsed.credentials,
+            },
+        };
+    }
+    localEntry(current, secrets = this.readSecretsForMetadataOnly()) {
+        return {
+            name: 'local',
+            kind: 'local',
+            synthetic: true,
+            current,
+            verificationStatus: 'synthetic',
+            credentialReferences: credentialReferencePresence(secrets.credentials.local),
+        };
+    }
+    toListEntry(target, current, secrets = this.readSecretsForMetadataOnly(), includeEmbeddedCredentials = false) {
+        return {
+            name: target.name,
+            kind: 'remote',
+            synthetic: false,
+            current,
+            url: includeEmbeddedCredentials ? target.url : redactRuntimeTargetUrlUserinfo(target.url),
+            displayName: target.displayName,
+            caFile: target.caFile,
+            insecureSkipVerify: target.insecureSkipVerify,
+            insecureTlsConfirmationRequired: target.insecureTlsConfirmationRequired ?? false,
+            observedIdentity: target.observedIdentity
+                ? {
+                    ...target.observedIdentity,
+                    externalUrl: redactRuntimeTargetUrlUserinfo(target.observedIdentity.externalUrl),
+                }
+                : undefined,
+            lastVerifiedAt: target.lastVerifiedAt,
+            verificationStatus: this.verificationStatus(target),
+            credentialReferences: credentialReferencePresence(secrets.credentials[target.name]),
+        };
+    }
+    verificationStatus(target) {
+        if (!target.lastVerifiedAt) {
+            return 'never-verified';
+        }
+        const ageMs = this.now().getTime() - new Date(target.lastVerifiedAt).getTime();
+        return ageMs > THIRTY_DAYS_MS ? 'stale' : 'verified';
+    }
+    readMetadata() {
+        const filePath = this.metadataPath();
+        if (!fs.existsSync(filePath)) {
+            return { schemaVersion: STORE_SCHEMA_VERSION, targets: {} };
+        }
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        return {
+            schemaVersion: STORE_SCHEMA_VERSION,
+            current: typeof parsed.current === 'string' ? parsed.current : undefined,
+            targets: isRecord(parsed.targets) ? parsed.targets : {},
+        };
+    }
+    readSecretsForMetadataOnly() {
+        const filePath = this.secretsPath();
+        if (!fs.existsSync(filePath)) {
+            return { schemaVersion: STORE_SCHEMA_VERSION, credentials: {} };
+        }
+        if (!isOwnerOnly(filePath)) {
+            return { schemaVersion: STORE_SCHEMA_VERSION, credentials: {} };
+        }
+        return this.readSecretsUnchecked();
+    }
+    readSecretsForCredentialUse() {
+        const filePath = this.secretsPath();
+        if (!fs.existsSync(filePath)) {
+            return { schemaVersion: STORE_SCHEMA_VERSION, credentials: {} };
+        }
+        if (!isOwnerOnly(filePath)) {
+            throw new RuntimeTargetStoreError('target_secret_store_insecure', 'Runtime target secret store is too permissive');
+        }
+        return this.readSecretsUnchecked();
+    }
+    readSecretsUnchecked() {
+        const filePath = this.secretsPath();
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        return {
+            schemaVersion: STORE_SCHEMA_VERSION,
+            credentials: isRecord(parsed.credentials)
+                ? parsed.credentials
+                : {},
+        };
+    }
+    writeMetadata(metadata) {
+        writeJsonAtomic(this.metadataPath(), metadata);
+    }
+    writeSecrets(secrets) {
+        writeJsonAtomic(this.secretsPath(), secrets, 0o600);
+    }
+    writeSecretsThenMetadata(previousSecrets, nextSecrets, nextMetadata) {
+        this.writeSecrets(nextSecrets);
+        try {
+            this.writeMetadata(nextMetadata);
+        }
+        catch (error) {
+            try {
+                this.writeSecrets(previousSecrets);
+            }
+            catch {
+                // Keep the original metadata-write error as the reported failure.
+            }
+            throw error;
+        }
+    }
+    withLock(fn) {
+        const release = this.acquireLock();
+        try {
+            return fn();
+        }
+        finally {
+            release();
+        }
+    }
+    acquireLock() {
+        fs.mkdirSync(this.storeDir, { recursive: true });
+        const lockPath = this.lockPath();
+        if (RuntimeTargetStore.activeLocks.has(lockPath)) {
+            throw new RuntimeTargetStoreError('lock_unavailable', 'Another 1mcp command is editing runtime targets');
+        }
+        RuntimeTargetStore.activeLocks.add(lockPath);
+        let fd = null;
+        try {
+            fd = fs.openSync(lockPath, 'wx', 0o600);
+        }
+        catch (error) {
+            RuntimeTargetStore.activeLocks.delete(lockPath);
+            if (isFileExistsError(error)) {
+                throw new RuntimeTargetStoreError('lock_unavailable', 'Another 1mcp command is editing runtime targets');
+            }
+            throw error;
+        }
+        return () => {
+            if (fd !== null) {
+                fs.closeSync(fd);
+            }
+            fs.rmSync(lockPath, { force: true });
+            RuntimeTargetStore.activeLocks.delete(lockPath);
+        };
+    }
+    metadataPath() {
+        return path.join(this.storeDir, METADATA_FILE);
+    }
+    secretsPath() {
+        return path.join(this.storeDir, SECRETS_FILE);
+    }
+    lockPath() {
+        return path.join(this.storeDir, LOCK_FILE);
+    }
+    isLockedInThisProcess() {
+        return RuntimeTargetStore.activeLocks.has(this.lockPath());
+    }
+    clearLocalCredentialReferences(kind) {
+        return this.withLock(() => {
+            const secrets = this.readSecretsForCredentialUse();
+            const localScopes = secrets.credentials.local;
+            if (!localScopes) {
+                return 0;
+            }
+            let cleared = 0;
+            const nextLocalScopes = {};
+            for (const [runtimeScopeId, bucket] of Object.entries(localScopes)) {
+                if (bucket[kind] === undefined) {
+                    nextLocalScopes[runtimeScopeId] = bucket;
+                    continue;
+                }
+                cleared += 1;
+                const nextBucket = { ...bucket };
+                delete nextBucket[kind];
+                if (Object.keys(nextBucket).length > 0) {
+                    nextLocalScopes[runtimeScopeId] = nextBucket;
+                }
+            }
+            if (cleared === 0) {
+                return 0;
+            }
+            const nextCredentials = { ...secrets.credentials };
+            if (Object.keys(nextLocalScopes).length === 0) {
+                delete nextCredentials.local;
+            }
+            else {
+                nextCredentials.local = nextLocalScopes;
+            }
+            this.writeSecrets({ ...secrets, credentials: nextCredentials });
+            return cleared;
+        });
+    }
+}
+export function validateRuntimeTargetName(name) {
+    if (!TARGET_NAME_PATTERN.test(name) || name.includes('/') || name.includes('\\')) {
+        throw new RuntimeTargetStoreError('target_name_invalid', 'Runtime target name is invalid');
+    }
+    if (name === 'local') {
+        throw new RuntimeTargetStoreError('target_name_reserved', 'Runtime target name "local" is reserved');
+    }
+    return name;
+}
+export function normalizeDisplayName(displayName) {
+    if (displayName === undefined) {
+        return undefined;
+    }
+    const normalized = displayName.trim();
+    if (normalized === '') {
+        return undefined;
+    }
+    const codePoints = Array.from(normalized);
+    if (codePoints.length > 80) {
+        throw new RuntimeTargetStoreError('target_display_name_invalid', 'Runtime target display name is too long');
+    }
+    for (const char of codePoints) {
+        const codePoint = char.codePointAt(0);
+        if (codePoint === undefined || isControlCodePoint(codePoint) || isSurrogateCodePoint(codePoint)) {
+            throw new RuntimeTargetStoreError('target_display_name_invalid', 'Runtime target display name is invalid');
+        }
+    }
+    return normalized;
+}
+export function assertRuntimeTargetConfigDirAllowed(input) {
+    if (!input.configDir) {
+        return;
+    }
+    if (input.command === 'verify' && input.targetName === 'local') {
+        return;
+    }
+    if (input.command === 'verify') {
+        throw new RuntimeTargetStoreError('target_config_dir_remote_unsupported', '--config-dir selects only a local Runtime Scope and cannot scope a remote target');
+    }
+    throw new RuntimeTargetStoreError('target_store_config_dir_unsupported', 'Runtime target store commands are user-global and do not accept --config-dir');
+}
+export function normalizeRuntimeTargetUrl(url, options = {}) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new RuntimeTargetStoreError('target_url_invalid', 'Runtime target URL is invalid');
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new RuntimeTargetStoreError('target_url_invalid', 'Runtime target URL must use http or https');
+    }
+    if (parsed.username || parsed.password) {
+        throw new RuntimeTargetStoreError('target_url_credentials_unsupported', 'Runtime target URLs must not contain embedded credentials');
+    }
+    if (parsed.protocol === 'http:' && !isLoopbackHostname(parsed.hostname) && !options.allowInsecureHttp) {
+        throw new RuntimeTargetStoreError('target_url_invalid', 'Runtime target URL must use https unless non-loopback HTTP is explicitly accepted with --insecure-skip-verify');
+    }
+    parsed.search = '';
+    parsed.hash = '';
+    return parsed.toString().replace(/\/$/, '');
+}
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (normalized === 'localhost' || normalized === '::1' || normalized === '0:0:0:0:0:0:0:1') {
+        return true;
+    }
+    if (net.isIP(normalized) === 4) {
+        return normalized.split('.')[0] === '127';
+    }
+    return false;
+}
+function normalizeTlsMetadata(input) {
+    let caFile;
+    if (input.caFile !== undefined) {
+        if (typeof input.caFile !== 'string') {
+            throw new RuntimeTargetStoreError('target_tls_metadata_invalid', 'Runtime target CA file must be a string');
+        }
+        caFile = input.caFile.trim();
+        if (caFile === '' || hasControlCodePoint(caFile)) {
+            throw new RuntimeTargetStoreError('target_tls_metadata_invalid', 'Runtime target CA file is invalid');
+        }
+    }
+    let insecureSkipVerify;
+    if (input.insecureSkipVerify !== undefined) {
+        if (typeof input.insecureSkipVerify !== 'boolean') {
+            throw new RuntimeTargetStoreError('target_tls_metadata_invalid', 'Runtime target insecureSkipVerify must be a boolean');
+        }
+        insecureSkipVerify = input.insecureSkipVerify === true ? true : undefined;
+    }
+    return omitUndefined({ caFile, insecureSkipVerify });
+}
+function targetToBundleEntry(target) {
+    return omitUndefined({
+        name: target.name,
+        url: redactRuntimeTargetUrlUserinfo(target.url),
+        displayName: target.displayName,
+        caFile: target.caFile,
+        insecureSkipVerify: target.insecureSkipVerify,
+        observedIdentity: target.observedIdentity
+            ? {
+                ...target.observedIdentity,
+                externalUrl: redactRuntimeTargetUrlUserinfo(target.observedIdentity.externalUrl),
+            }
+            : undefined,
+        lastVerifiedAt: target.lastVerifiedAt,
+    });
+}
+function redactRuntimeTargetUrlUserinfo(url) {
+    try {
+        const parsed = new URL(url);
+        parsed.username = '';
+        parsed.password = '';
+        return parsed.toString().replace(/\/$/, '');
+    }
+    catch {
+        return '';
+    }
+}
+function throwImportValidationFailed(validationFacts) {
+    throw new RuntimeTargetStoreError('target_import_validation_failed', 'Runtime target import bundle failed validation', { validationFacts });
+}
+function inspectStoredTargetForDoctor(targetName, rawTarget, issues) {
+    const addIssue = (message) => {
+        issues.push({ code: 'metadata_schema_invalid', targetName, message });
+    };
+    if (!isRecord(rawTarget)) {
+        addIssue(`Runtime target "${targetName}" metadata must be an object`);
+        return;
+    }
+    if (rawTarget.name !== targetName) {
+        addIssue(`Runtime target "${targetName}" metadata name does not match its key`);
+    }
+    try {
+        validateRuntimeTargetName(targetName);
+    }
+    catch {
+        addIssue(`Runtime target "${targetName}" has an invalid or reserved name`);
+    }
+    let tlsMetadata;
+    try {
+        tlsMetadata = normalizeTlsMetadata({
+            caFile: rawTarget.caFile,
+            insecureSkipVerify: rawTarget.insecureSkipVerify,
+        });
+    }
+    catch {
+        addIssue(`Runtime target "${targetName}" TLS metadata is invalid`);
+    }
+    if (typeof rawTarget.url !== 'string') {
+        addIssue(`Runtime target "${targetName}" URL must be a string`);
+    }
+    else {
+        try {
+            normalizeRuntimeTargetUrl(rawTarget.url, {
+                allowInsecureHttp: tlsMetadata?.insecureSkipVerify === true,
+            });
+        }
+        catch {
+            addIssue(`Runtime target "${targetName}" URL is invalid`);
+        }
+    }
+    if (Object.prototype.hasOwnProperty.call(rawTarget, 'displayName')) {
+        if (typeof rawTarget.displayName !== 'string' && rawTarget.displayName !== undefined) {
+            addIssue(`Runtime target "${targetName}" displayName must be a string`);
+        }
+        else {
+            try {
+                normalizeDisplayName(rawTarget.displayName);
+            }
+            catch {
+                addIssue(`Runtime target "${targetName}" displayName is invalid`);
+            }
+        }
+    }
+    if (Object.prototype.hasOwnProperty.call(rawTarget, 'insecureTlsConfirmationRequired')) {
+        if (typeof rawTarget.insecureTlsConfirmationRequired !== 'boolean') {
+            addIssue(`Runtime target "${targetName}" insecure TLS confirmation marker must be a boolean`);
+        }
+    }
+    if (Object.prototype.hasOwnProperty.call(rawTarget, 'observedIdentity')) {
+        if (!isRecord(rawTarget.observedIdentity)) {
+            addIssue(`Runtime target "${targetName}" observed identity must be an object`);
+        }
+        else {
+            try {
+                validateRuntimeIdentity(rawTarget.observedIdentity);
+            }
+            catch {
+                addIssue(`Runtime target "${targetName}" observed identity is invalid`);
+            }
+        }
+    }
+    inspectTimestampForDoctor(targetName, rawTarget, 'lastVerifiedAt', issues);
+    inspectTimestampForDoctor(targetName, rawTarget, 'createdAt', issues);
+    inspectTimestampForDoctor(targetName, rawTarget, 'updatedAt', issues);
+}
+function inspectTimestampForDoctor(targetName, target, field, issues) {
+    if (!Object.prototype.hasOwnProperty.call(target, field)) {
+        if (field === 'createdAt' || field === 'updatedAt') {
+            issues.push({
+                code: 'metadata_schema_invalid',
+                targetName,
+                message: `Runtime target "${targetName}" ${field} timestamp is missing`,
+            });
+        }
+        return;
+    }
+    if (typeof target[field] !== 'string' || Number.isNaN(Date.parse(target[field]))) {
+        issues.push({
+            code: 'metadata_schema_invalid',
+            targetName,
+            message: `Runtime target "${targetName}" ${field} timestamp is invalid`,
+        });
+    }
+}
+function inspectCredentialScopesForDoctor(targetName, rawScopes, issues) {
+    if (!isRecord(rawScopes)) {
+        issues.push({
+            code: 'secrets_schema_invalid',
+            targetName,
+            message: `Runtime target "${targetName}" credential scopes must be an object`,
+        });
+        return;
+    }
+    for (const [runtimeScopeId, rawBucket] of Object.entries(rawScopes)) {
+        if (!runtimeScopeId) {
+            issues.push({
+                code: 'secrets_schema_invalid',
+                targetName,
+                message: `Runtime target "${targetName}" credential scope id must be non-empty`,
+            });
+        }
+        if (!isRecord(rawBucket)) {
+            issues.push({
+                code: 'secrets_schema_invalid',
+                targetName,
+                message: `Runtime target "${targetName}" credential bucket for scope "${runtimeScopeId}" must be an object`,
+            });
+        }
+    }
+}
+function insecureTlsRecoveryCommand(name, operation) {
+    if (operation === 'use') {
+        return `1mcp target use ${name} --accept-insecure-tls`;
+    }
+    return `1mcp target verify ${name} --accept-insecure-tls`;
+}
+function omitUndefined(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, entryValue]) => entryValue !== undefined));
+}
+function compactCredentialReferences(references) {
+    const bucket = {};
+    if (references.oauth !== undefined) {
+        bucket.oauth = references.oauth;
+    }
+    if (references.adminSession !== undefined) {
+        bucket.adminSession = references.adminSession;
+    }
+    return bucket;
+}
+function externalUrlWarnings(configuredUrl, observedIdentity) {
+    return normalizeUrlForComparison(configuredUrl) === normalizeUrlForComparison(observedIdentity.externalUrl)
+        ? []
+        : [
+            {
+                code: 'warning_external_url_mismatch',
+                message: `Runtime target externalUrl differs from configured URL for "${configuredUrl}"`,
+            },
+        ];
+}
+function normalizeUrlForComparison(url) {
+    return url.replace(/\/$/, '');
+}
+function validateRuntimeIdentity(identity) {
+    if (identity.identityProtocolVersion !== '1' ||
+        typeof identity.runtimeScopeId !== 'string' ||
+        identity.runtimeScopeId.length === 0 ||
+        typeof identity.externalUrl !== 'string' ||
+        identity.externalUrl.length === 0 ||
+        typeof identity.runtimeVersion !== 'string' ||
+        identity.runtimeVersion.length === 0 ||
+        (identity.serverTime !== undefined && typeof identity.serverTime !== 'string')) {
+        throw new RuntimeTargetStoreError('identity_invalid', 'Runtime identity response is missing required fields');
+    }
+}
+function credentialReferencePresence(byScope) {
+    const buckets = Object.values(byScope ?? {});
+    return {
+        oauth: buckets.some((bucket) => bucket.oauth !== undefined),
+        adminSession: buckets.some((bucket) => bucket.adminSession !== undefined),
+    };
+}
+function verificationWarnings(entry) {
+    if (entry.verificationStatus === 'stale') {
+        return [{ code: 'warning_target_stale', message: `Runtime target "${entry.name}" has stale verification` }];
+    }
+    if (entry.verificationStatus === 'never-verified') {
+        return [
+            { code: 'warning_target_never_verified', message: `Runtime target "${entry.name}" has never been verified` },
+        ];
+    }
+    return [];
+}
+function writeJsonAtomic(filePath, value, mode) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tempPath, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode });
+    fs.renameSync(tempPath, filePath);
+    if (mode !== undefined) {
+        fs.chmodSync(filePath, mode);
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isFileExistsError(error) {
+    return typeof error === 'object' && error !== null && 'code' in error && error.code === 'EEXIST';
+}
+function isOwnerOnly(filePath) {
+    if (process.platform === 'win32') {
+        return true;
+    }
+    return (fs.statSync(filePath).mode & 0o077) === 0;
+}
+function isControlCodePoint(codePoint) {
+    return codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f);
+}
+function hasControlCodePoint(value) {
+    return Array.from(value).some((char) => {
+        const codePoint = char.codePointAt(0);
+        return codePoint === undefined || isControlCodePoint(codePoint);
+    });
+}
+function isSurrogateCodePoint(codePoint) {
+    return codePoint >= 0xd800 && codePoint <= 0xdfff;
+}
+//# sourceMappingURL=runtimeTargetStore.js.map