@1mcp/agent 0.34.3 → 0.35.0-beta.1

package/build/admin/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>1MCP Admin Console</title>
+    <script type="module" crossorigin src="/admin/assets/admin-console-CkZ5lBKg.js"></script>
+    <link rel="stylesheet" crossorigin href="/admin/assets/admin-console-CX5GzncA.css">
+  </head>
+  <body>
+    <div id="admin-root"></div>
+  </body>
+</html>

package/build/commands/admin/admin.d.ts

@@ -0,0 +1,90 @@
+import { type ServeConfigPaths } from '../../commands/serve/runtimeScope.js';
+import { type ResolvableServeTargetOptions, type ResolvedServeTarget } from '../../commands/shared/serveTargetResolver.js';
+import { RuntimeIdentityService } from '../../core/runtime/runtimeIdentityService.js';
+import { AdminIdentityService } from '../../domains/admin/adminIdentityService.js';
+import { type RuntimeTargetListEntry } from '../../domains/runtime-targets/runtimeTargetStore.js';
+import type { GlobalOptions } from '../../globalOptions.js';
+interface AdminJsonOption {
+    json?: boolean;
+}
+interface AdminContextOption {
+    context?: string;
+    url?: string;
+}
+export interface AdminLoginOptions extends GlobalOptions, AdminJsonOption, AdminContextOption {
+    username?: string;
+    password?: string;
+}
+export interface AdminBootstrapOptions extends GlobalOptions, AdminJsonOption {
+    username?: string;
+    password?: string;
+}
+export interface AdminStatusOptions extends GlobalOptions, AdminJsonOption, AdminContextOption {
+}
+export interface AdminLogoutOptions extends GlobalOptions, AdminJsonOption, AdminContextOption {
+    forget?: boolean;
+    allLocal?: boolean;
+    'all-local'?: boolean;
+}
+interface AdminSessionReference {
+    sessionToken: string;
+    csrfToken?: string;
+    expiresAt?: string;
+}
+interface AdminCredentials {
+    username?: string;
+    password?: string;
+    cancelled?: boolean;
+}
+interface AdminCredentialStore {
+    current(): Pick<RuntimeTargetListEntry, 'name'>;
+    inspect(name: string): Pick<RuntimeTargetListEntry, 'name' | 'observedIdentity'>;
+    setAdminSessionReference(name: string, runtimeScopeId: string, adminSession: AdminSessionReference): void;
+    getAdminSessionReference(name: string, runtimeScopeId: string): unknown | undefined;
+    clearAdminSessionReference(name: string, runtimeScopeId: string): void;
+    clearLocalAdminSessionReferences(): number;
+}
+interface AdminApiClient {
+    get<T>(path: string): Promise<{
+        ok: boolean;
+        status: number;
+        data?: T;
+        error?: string;
+    }>;
+    post<T>(path: string, body: unknown): Promise<{
+        ok: boolean;
+        status: number;
+        data?: T;
+        error?: string;
+    }>;
+}
+export interface AdminCommandDependencies {
+    store?: AdminCredentialStore;
+    resolveTarget?: (options: ResolvableServeTargetOptions & {
+        context: string;
+    }) => Promise<ResolvedServeTarget<ResolvableServeTargetOptions & {
+        context: string;
+    }>>;
+    createApiClient?: (baseUrl: string, bearerToken?: string) => AdminApiClient;
+    promptForCredentials?: (context: string, existing: Pick<AdminCredentials, 'username' | 'password'>) => Promise<AdminCredentials>;
+}
+export interface AdminBootstrapDependencies {
+    resolveConfigPaths?: (options: Pick<AdminBootstrapOptions, 'config' | 'config-dir'>) => ServeConfigPaths;
+    createRuntimeIdentityService?: (storageDir: string) => Pick<RuntimeIdentityService, 'getRuntimeIdentity'>;
+    createAdminIdentityService?: (options: {
+        runtimeScopeId: string;
+        storageDir: string;
+    }) => Pick<AdminIdentityService, 'bootstrapFirstAdmin'>;
+}
+export declare class AdminCommandError extends Error {
+    readonly code: string;
+    readonly recoveryCommand?: string | undefined;
+    readonly details?: unknown | undefined;
+    constructor(code: string, message: string, recoveryCommand?: string | undefined, details?: unknown | undefined);
+}
+export declare function adminBootstrapCommand(options: AdminBootstrapOptions, dependencies?: AdminBootstrapDependencies): Promise<void>;
+export declare function adminLoginCommand(options: AdminLoginOptions, dependencies?: AdminCommandDependencies): Promise<void>;
+export declare function adminStatusCommand(options: AdminStatusOptions, dependencies?: AdminCommandDependencies): Promise<void>;
+export declare function adminLogoutCommand(options: AdminLogoutOptions, dependencies?: AdminCommandDependencies): Promise<void>;
+export {};
+//# sourceMappingURL=admin.d.ts.map

package/build/commands/admin/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAErG,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,mBAAmB,EAEzB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAwB,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC3G,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EAAE,KAAK,sBAAsB,EAAsB,MAAM,oDAAoD,CAAC;AACrH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAK3D,UAAU,eAAe;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,kBAAkB;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAkB,SAAQ,aAAa,EAAE,eAAe,EAAE,kBAAkB;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAsB,SAAQ,aAAa,EAAE,eAAe;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,aAAa,EAAE,eAAe,EAAE,kBAAkB;CAAG;AAEjG,MAAM,WAAW,kBAAmB,SAAQ,aAAa,EAAE,eAAe,EAAE,kBAAkB;IAC5F,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,UAAU,qBAAqB;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,UAAU,oBAAoB;IAC5B,OAAO,IAAI,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,MAAM,GAAG,kBAAkB,CAAC,CAAC;IACjF,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC1G,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IACpF,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvE,gCAAgC,IAAI,MAAM,CAAC;CAC5C;AAED,UAAU,cAAc;IACtB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1G;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,aAAa,CAAC,EAAE,CACd,OAAO,EAAE,4BAA4B,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,KACxD,OAAO,CAAC,mBAAmB,CAAC,4BAA4B,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACtF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,cAAc,CAAC;IAC5E,oBAAoB,CAAC,EAAE,CACrB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,UAAU,CAAC,KACtD,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,0BAA0B;IACzC,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,YAAY,CAAC,KAAK,gBAAgB,CAAC;IACzG,4BAA4B,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;IAC1G,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;KACpB,KAAK,IAAI,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAAC;CACzD;AA4CD,qBAAa,iBAAkB,SAAQ,KAAK;aAExB,IAAI,EAAE,MAAM;aAEZ,eAAe,CAAC,EAAE,MAAM;aACxB,OAAO,CAAC,EAAE,OAAO;gBAHjB,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,eAAe,CAAC,EAAE,MAAM,YAAA,EACxB,OAAO,CAAC,EAAE,OAAO,YAAA;CAKpC;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,qBAAqB,EAC9B,YAAY,GAAE,0BAA+B,GAC5C,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,iBAAiB,EAC1B,YAAY,GAAE,wBAA6B,GAC1C,OAAO,CAAC,IAAI,CAAC,CA6Cf;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,wBAA6B,GAC1C,OAAO,CAAC,IAAI,CAAC,CAuIf;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,wBAA6B,GAC1C,OAAO,CAAC,IAAI,CAAC,CA+Ff"}

package/build/commands/admin/admin.js

@@ -0,0 +1,545 @@
+import { resolveServeConfigPaths } from '../../commands/serve/runtimeScope.js';
+import { ApiClient } from '../../commands/shared/apiClient.js';
+import { resolveServeTarget, } from '../../commands/shared/serveTargetResolver.js';
+import { MCP_SERVER_VERSION } from '../../constants.js';
+import { RuntimeIdentityService } from '../../core/runtime/runtimeIdentityService.js';
+import { AdminIdentityService } from '../../domains/admin/adminIdentityService.js';
+import { RuntimeTargetStore } from '../../domains/runtime-targets/runtimeTargetStore.js';
+import { stripMcpSuffix } from '../../utils/urlUtils.js';
+import prompts from 'prompts';
+export class AdminCommandError extends Error {
+    code;
+    recoveryCommand;
+    details;
+    constructor(code, message, recoveryCommand, details) {
+        super(message);
+        this.code = code;
+        this.recoveryCommand = recoveryCommand;
+        this.details = details;
+        this.name = 'AdminCommandError';
+    }
+}
+export async function adminBootstrapCommand(options, dependencies = {}) {
+    const username = requireOption(options.username, 'admin username');
+    const password = requireOption(options.password, 'admin password');
+    const paths = (dependencies.resolveConfigPaths ?? resolveServeConfigPaths)({
+        config: options.config,
+        'config-dir': options['config-dir'],
+    });
+    const runtimeIdentity = getBootstrapRuntimeIdentity(paths.runtimeScope, dependencies);
+    const adminService = dependencies.createAdminIdentityService?.({
+        runtimeScopeId: runtimeIdentity.runtimeScopeId,
+        storageDir: paths.runtimeScope,
+    }) ??
+        new AdminIdentityService({
+            runtimeScopeId: runtimeIdentity.runtimeScopeId,
+            storageDir: paths.runtimeScope,
+        });
+    const account = await adminService.bootstrapFirstAdmin({ username, password });
+    writeAdminSuccess(options, {
+        operation: 'admin.bootstrap',
+        target: {
+            runtimeScopeId: runtimeIdentity.runtimeScopeId,
+            runtimeScope: paths.runtimeScope,
+            configFilePath: paths.configFilePath,
+        },
+        result: { account },
+        human: `Admin bootstrap created first Admin Account for ${account.username}.\n`,
+    });
+}
+export async function adminLoginCommand(options, dependencies = {}) {
+    const context = requireCredentialContext(options, dependencies, 'login');
+    const target = await resolveAdminTarget(context, options, dependencies);
+    const baseUrl = stripMcpSuffix(target.discoveredUrl);
+    const client = createClient(dependencies, baseUrl);
+    const capabilities = await fetchCapabilities(client, 'admin.login');
+    const runtimeScopeId = requireRuntimeScopeId(capabilities);
+    const { username, password } = await resolveAdminLoginCredentials(options, context, dependencies);
+    const loginEnvelope = await postEnvelope(client, '/admin/cli/v1/session/login', {
+        username,
+        password,
+    });
+    if (!loginEnvelope.ok) {
+        throw envelopeError(loginEnvelope, 'admin login failed');
+    }
+    const sessionToken = loginEnvelope.result?.sessionToken;
+    if (!sessionToken) {
+        throw new AdminCommandError('protocol_invalid_response', 'CLI Admin login response did not include a session');
+    }
+    const reference = {
+        sessionToken,
+        csrfToken: loginEnvelope.result?.csrfToken,
+        expiresAt: loginEnvelope.result?.expiresAt,
+    };
+    try {
+        (dependencies.store ?? new RuntimeTargetStore()).setAdminSessionReference(context, runtimeScopeId, reference);
+    }
+    catch (error) {
+        await revokeCreatedAdminSession(dependencies, baseUrl, sessionToken);
+        throw error;
+    }
+    const warnings = [...(loginEnvelope.warnings ?? []), ...mutationReadinessWarnings(capabilities)];
+    writeAdminSuccess(options, {
+        operation: 'admin.login',
+        target: targetJson(context, runtimeScopeId, baseUrl),
+        warnings,
+        result: {
+            authenticated: true,
+            account: loginEnvelope.result?.account,
+            expiresAt: reference.expiresAt,
+        },
+        human: `Admin login succeeded for ${context}.\n${warnings.map((warning) => `Warning: ${warning.message}\n`).join('')}`,
+    });
+}
+export async function adminStatusCommand(options, dependencies = {}) {
+    const context = requireCredentialContext(options, dependencies, 'status');
+    const store = dependencies.store ?? new RuntimeTargetStore();
+    const localRuntimeScopeId = observedRuntimeScopeId(store, context);
+    const localReference = localRuntimeScopeId ? store.getAdminSessionReference(context, localRuntimeScopeId) : undefined;
+    let target;
+    let capabilities;
+    let baseUrl;
+    try {
+        target = await resolveAdminTarget(context, options, dependencies);
+        baseUrl = stripMcpSuffix(target.discoveredUrl);
+        capabilities = await fetchCapabilities(createClient(dependencies, baseUrl), 'admin.status');
+    }
+    catch (error) {
+        if (isDisabledAdminAdapterError(error) && localRuntimeScopeId) {
+            store.clearAdminSessionReference(context, localRuntimeScopeId);
+            writeAdminSuccess(options, {
+                operation: 'admin.status',
+                target: targetJson(context, localRuntimeScopeId, undefined),
+                warnings: [],
+                result: {
+                    authenticated: false,
+                    status: 'unauthenticated',
+                    localReference: { present: false, runtimeScopeId: localRuntimeScopeId },
+                },
+                human: `Admin status for ${context}: not authenticated.\n`,
+            });
+            return;
+        }
+        if (isProtocolOrCapabilityError(error)) {
+            throw error;
+        }
+        writeAdminSuccess(options, {
+            operation: 'admin.status',
+            target: targetJson(context, localRuntimeScopeId, undefined),
+            warnings: [],
+            result: {
+                authenticated: false,
+                status: 'unknown',
+                localReference: { present: localReference !== undefined, runtimeScopeId: localRuntimeScopeId },
+            },
+            human: `Admin status for ${context}: unknown (runtime could not be verified).\n`,
+        });
+        return;
+    }
+    const runtimeScopeId = requireRuntimeScopeId(capabilities);
+    const rawReference = store.getAdminSessionReference(context, runtimeScopeId);
+    const reference = toAdminSessionReference(rawReference);
+    if (!reference?.sessionToken) {
+        if (rawReference !== undefined) {
+            store.clearAdminSessionReference(context, runtimeScopeId);
+        }
+        writeAdminSuccess(options, {
+            operation: 'admin.status',
+            target: targetJson(context, runtimeScopeId, baseUrl),
+            warnings: [],
+            result: {
+                authenticated: false,
+                status: 'unauthenticated',
+                localReference: { present: false, runtimeScopeId },
+            },
+            human: `Admin status for ${context}: not logged in.\n`,
+        });
+        return;
+    }
+    const client = createClient(dependencies, baseUrl, reference.sessionToken);
+    let statusEnvelope;
+    try {
+        statusEnvelope = await getEnvelope(client, '/admin/cli/v1/session/status');
+    }
+    catch {
+        writeAdminSuccess(options, {
+            operation: 'admin.status',
+            target: targetJson(context, runtimeScopeId, baseUrl),
+            warnings: [],
+            result: {
+                authenticated: false,
+                status: 'unknown',
+                localReference: { present: true, runtimeScopeId },
+            },
+            human: `Admin status for ${context}: unknown (runtime could not be verified).\n`,
+        });
+        return;
+    }
+    if (statusEnvelope.ok && statusEnvelope.result?.authenticated) {
+        writeAdminSuccess(options, {
+            operation: 'admin.status',
+            target: targetJson(context, runtimeScopeId, baseUrl),
+            warnings: statusEnvelope.warnings,
+            result: {
+                authenticated: true,
+                status: 'authenticated',
+                account: statusEnvelope.result.account,
+                localReference: { present: true, runtimeScopeId },
+            },
+            human: `Admin status for ${context}: authenticated.\n`,
+        });
+        return;
+    }
+    if (!statusEnvelope.ok && !shouldClearAdminSessionReference(statusEnvelope.error?.code)) {
+        const error = envelopeError(statusEnvelope, 'admin status failed');
+        if (isProtocolOrCapabilityError(error)) {
+            throw error;
+        }
+        writeAdminSuccess(options, {
+            operation: 'admin.status',
+            target: targetJson(context, runtimeScopeId, baseUrl),
+            warnings: statusEnvelope.warnings,
+            result: {
+                authenticated: false,
+                status: 'unknown',
+                localReference: { present: true, runtimeScopeId },
+            },
+            human: `Admin status for ${context}: unknown (runtime could not be verified).\n`,
+        });
+        return;
+    }
+    store.clearAdminSessionReference(context, runtimeScopeId);
+    writeAdminSuccess(options, {
+        operation: 'admin.status',
+        target: targetJson(context, runtimeScopeId, baseUrl),
+        warnings: statusEnvelope.warnings,
+        result: {
+            authenticated: false,
+            status: 'unauthenticated',
+            localReference: { present: false, runtimeScopeId },
+        },
+        human: `Admin status for ${context}: not authenticated.\n`,
+    });
+}
+export async function adminLogoutCommand(options, dependencies = {}) {
+    const context = requireCredentialContext(options, dependencies, 'logout');
+    const store = dependencies.store ?? new RuntimeTargetStore();
+    if (options.allLocal || options['all-local']) {
+        if (context !== 'local') {
+            throw new AdminCommandError('credential_all_local_context_required', 'admin logout --all-local can only be used with --context local', '1mcp admin logout --context local --all-local');
+        }
+        const cleared = store.clearLocalAdminSessionReferences();
+        writeAdminSuccess(options, {
+            operation: 'admin.logout',
+            target: targetJson(context, undefined, undefined),
+            warnings: [],
+            result: {
+                revoked: false,
+                forgotLocalReferences: cleared,
+            },
+            human: cleared === 0
+                ? 'No local Admin Session references were found; server-side revocation was not confirmed.\n'
+                : `Forgot ${cleared} local Admin Session reference${cleared !== 1 ? 's' : ''}; server-side revocation was not confirmed.\n`,
+        });
+        return;
+    }
+    if (options.forget) {
+        const runtimeScopeId = observedRuntimeScopeId(store, context);
+        if (!runtimeScopeId) {
+            throw new AdminCommandError('protocol_invalid_response', 'Cannot forget Admin Session without observed runtime identity');
+        }
+        store.clearAdminSessionReference(context, runtimeScopeId);
+        writeAdminSuccess(options, {
+            operation: 'admin.logout',
+            target: targetJson(context, runtimeScopeId, undefined),
+            warnings: [],
+            result: {
+                revoked: false,
+                forgotLocalReference: true,
+            },
+            human: `Forgot local Admin Session reference for ${context}; server-side revocation was not confirmed.\n`,
+        });
+        return;
+    }
+    const localRuntimeScopeId = observedRuntimeScopeId(store, context);
+    const target = await resolveAdminTarget(context, options, dependencies);
+    const baseUrl = stripMcpSuffix(target.discoveredUrl);
+    let capabilities;
+    try {
+        capabilities = await fetchCapabilities(createClient(dependencies, baseUrl), 'admin.logout');
+    }
+    catch (error) {
+        if (isDisabledAdminAdapterError(error) && localRuntimeScopeId) {
+            store.clearAdminSessionReference(context, localRuntimeScopeId);
+            writeAdminSuccess(options, {
+                operation: 'admin.logout',
+                target: targetJson(context, localRuntimeScopeId, baseUrl),
+                warnings: [],
+                result: {
+                    revoked: false,
+                    forgotLocalReference: true,
+                },
+                human: `Forgot local Admin Session reference for ${context}; server-side revocation was not confirmed.\n`,
+            });
+            return;
+        }
+        throw error;
+    }
+    const runtimeScopeId = requireRuntimeScopeId(capabilities);
+    const reference = toAdminSessionReference(store.getAdminSessionReference(context, runtimeScopeId));
+    if (reference?.sessionToken) {
+        const client = createClient(dependencies, baseUrl, reference.sessionToken);
+        const logoutEnvelope = await postEnvelope(client, '/admin/cli/v1/session/logout', {});
+        if (!logoutEnvelope.ok) {
+            throw envelopeError(logoutEnvelope, 'admin logout failed');
+        }
+    }
+    store.clearAdminSessionReference(context, runtimeScopeId);
+    writeAdminSuccess(options, {
+        operation: 'admin.logout',
+        target: targetJson(context, runtimeScopeId, baseUrl),
+        warnings: [],
+        result: {
+            revoked: Boolean(reference?.sessionToken),
+            forgotLocalReference: true,
+        },
+        human: `Admin logout completed for ${context}.\n`,
+    });
+}
+function getBootstrapRuntimeIdentity(runtimeScope, dependencies) {
+    const runtimeIdentityService = dependencies.createRuntimeIdentityService?.(runtimeScope) ??
+        new RuntimeIdentityService({ storageDir: runtimeScope });
+    return runtimeIdentityService.getRuntimeIdentity({
+        externalUrl: 'http://127.0.0.1',
+        runtimeVersion: MCP_SERVER_VERSION,
+        includeServerTime: false,
+    });
+}
+function requireCredentialContext(options, dependencies, command) {
+    if (options.url) {
+        throw new AdminCommandError('credential_url_unsupported', 'Admin credential commands require a named Runtime Target Context and do not accept --url');
+    }
+    if (options.context) {
+        return options.context;
+    }
+    const currentName = safeCurrentName(dependencies.store);
+    throw new AdminCommandError('credential_context_required', 'Admin credential commands require --context <name>', currentName ? `1mcp admin ${command} --context ${currentName}` : `1mcp admin ${command} --context <name>`);
+}
+function safeCurrentName(store) {
+    try {
+        return (store ?? new RuntimeTargetStore()).current().name;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function resolveAdminTarget(context, options, dependencies) {
+    const resolver = dependencies.resolveTarget ?? ((input) => resolveServeTarget(input));
+    return resolver({ context, 'config-dir': options['config-dir'] });
+}
+function createClient(dependencies, baseUrl, bearerToken) {
+    return dependencies.createApiClient?.(baseUrl, bearerToken) ?? new ApiClient({ baseUrl, bearerToken });
+}
+async function fetchCapabilities(client, requiredOperation) {
+    const envelope = await getEnvelope(client, '/admin/cli/v1/capabilities');
+    if (!envelope.ok) {
+        throw envelopeError(envelope, 'CLI Admin capabilities check failed');
+    }
+    if (envelope.cliProtocolVersion !== '1') {
+        throw new AdminCommandError('protocol_incompatible', 'CLI Admin protocol is not compatible');
+    }
+    if (!envelope.result) {
+        throw new AdminCommandError('protocol_invalid_response', 'CLI Admin capabilities omitted result');
+    }
+    requireAdminCapability(envelope.result, requiredOperation);
+    return envelope.result;
+}
+async function getEnvelope(client, path) {
+    const response = await client.get(path);
+    if (response.data) {
+        return response.data;
+    }
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new AdminCommandError('capability_admin_disabled', 'CLI Admin adapter is not enabled on this runtime');
+        }
+        throw new AdminCommandError('runtime_unreachable', response.error ?? `Runtime returned HTTP ${response.status}`);
+    }
+    throw new AdminCommandError('protocol_invalid_response', 'Runtime returned an empty CLI Admin response');
+}
+async function postEnvelope(client, path, body) {
+    const response = await client.post(path, body);
+    if (response.data) {
+        return response.data;
+    }
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new AdminCommandError('capability_admin_disabled', 'CLI Admin adapter is not enabled on this runtime');
+        }
+        throw new AdminCommandError('runtime_unreachable', response.error ?? `Runtime returned HTTP ${response.status}`);
+    }
+    throw new AdminCommandError('protocol_invalid_response', 'Runtime returned an empty CLI Admin response');
+}
+async function revokeCreatedAdminSession(dependencies, baseUrl, sessionToken) {
+    try {
+        await postEnvelope(createClient(dependencies, baseUrl, sessionToken), '/admin/cli/v1/session/logout', {});
+    }
+    catch {
+        // The original local persistence failure is more actionable for the operator.
+    }
+}
+function envelopeError(envelope, fallbackMessage) {
+    return new AdminCommandError(envelope.error?.code ?? 'internal_error', envelope.error?.message ?? fallbackMessage, envelope.error?.recoveryCommand, envelope.error?.details);
+}
+function requireRuntimeScopeId(capabilities) {
+    const runtimeScopeId = (capabilities.runtime ?? capabilities.runtimeIdentity)?.runtimeScopeId;
+    if (!runtimeScopeId) {
+        throw new AdminCommandError('protocol_invalid_response', 'CLI Admin capabilities omitted runtime identity');
+    }
+    return runtimeScopeId;
+}
+function requireAdminCapability(capabilities, requiredOperation) {
+    if (capabilities.adminSurface?.enabled === false) {
+        throw new AdminCommandError('capability_admin_disabled', 'CLI Admin adapter is disabled on this runtime');
+    }
+    if (requiredOperation === 'admin.login' && capabilities.adminSurface?.status === 'setupRequired') {
+        throw new AdminCommandError('capability_admin_setup_required', 'Admin setup is required before CLI Admin login can run');
+    }
+    if (!capabilities.supportedOperations?.includes(requiredOperation)) {
+        throw new AdminCommandError('capability_operation_unsupported', `CLI Admin operation "${requiredOperation}" is not supported by this runtime`);
+    }
+}
+function mutationReadinessWarnings(capabilities) {
+    if (capabilities.adminMutationsAvailable !== false) {
+        return [];
+    }
+    return [
+        {
+            code: 'warning_admin_mutations_unavailable',
+            message: 'Admin login succeeded, but mutation commands are currently unavailable',
+            details: {
+                reason: capabilities.adminMutationsUnavailableReason ?? 'unavailable',
+            },
+        },
+    ];
+}
+function isDisabledAdminAdapterError(error) {
+    return error instanceof AdminCommandError && error.code === 'capability_admin_disabled';
+}
+function isProtocolOrCapabilityError(error) {
+    return (error instanceof AdminCommandError && (error.code.startsWith('protocol_') || error.code.startsWith('capability_')));
+}
+function shouldClearAdminSessionReference(code) {
+    return (code === undefined ||
+        code.startsWith('auth_session_') ||
+        code === 'auth_admin_disabled' ||
+        code === 'auth_account_deleted' ||
+        code === 'admin_account_not_found' ||
+        code === 'capability_admin_disabled');
+}
+function requireOption(value, label) {
+    if (!value) {
+        throw new AdminCommandError('validation_missing_input', `Missing ${label}`);
+    }
+    return value;
+}
+async function resolveAdminLoginCredentials(options, context, dependencies) {
+    if (options.username && options.password) {
+        return {
+            username: options.username,
+            password: options.password,
+        };
+    }
+    if (options.json || (!dependencies.promptForCredentials && !process.stdin.isTTY)) {
+        return {
+            username: requireOption(options.username, 'admin username'),
+            password: requireOption(options.password, 'admin password'),
+        };
+    }
+    const prompted = await promptForCredentials(context, options, dependencies);
+    if (prompted.cancelled) {
+        throw new AdminCommandError('validation_missing_input', 'Missing admin credentials');
+    }
+    return {
+        username: requireOption(prompted.username, 'admin username'),
+        password: requireOption(prompted.password, 'admin password'),
+    };
+}
+async function promptForCredentials(context, options, dependencies) {
+    const existing = {
+        username: options.username,
+        password: options.password,
+    };
+    if (dependencies.promptForCredentials) {
+        return dependencies.promptForCredentials(context, existing);
+    }
+    const questions = [];
+    if (!options.username) {
+        questions.push({
+            type: 'text',
+            name: 'username',
+            message: `Admin username for ${context}`,
+        });
+    }
+    if (!options.password) {
+        questions.push({
+            type: 'password',
+            name: 'password',
+            message: `Admin password for ${context}`,
+        });
+    }
+    const result = await prompts(questions);
+    return {
+        username: options.username ?? (typeof result.username === 'string' ? result.username : undefined),
+        password: options.password ?? (typeof result.password === 'string' ? result.password : undefined),
+        cancelled: (!options.username && result.username === undefined) || (!options.password && result.password === undefined),
+    };
+}
+function observedRuntimeScopeId(store, context) {
+    try {
+        return store.inspect(context).observedIdentity?.runtimeScopeId;
+    }
+    catch {
+        return undefined;
+    }
+}
+function toAdminSessionReference(value) {
+    if (typeof value !== 'object' || value === null) {
+        return undefined;
+    }
+    const candidate = value;
+    if (typeof candidate.sessionToken !== 'string' || candidate.sessionToken.length === 0) {
+        return undefined;
+    }
+    return {
+        sessionToken: candidate.sessionToken,
+        ...(typeof candidate.csrfToken === 'string' ? { csrfToken: candidate.csrfToken } : {}),
+        ...(typeof candidate.expiresAt === 'string' ? { expiresAt: candidate.expiresAt } : {}),
+    };
+}
+function writeAdminSuccess(options, input) {
+    if (!options.json) {
+        process.stdout.write(input.human);
+        return;
+    }
+    process.stdout.write(`${JSON.stringify({
+        ok: true,
+        cliProtocolVersion: '1',
+        requestId: createCliRequestId(),
+        target: input.target,
+        operation: input.operation,
+        warnings: input.warnings ?? [],
+        result: input.result,
+    })}\n`);
+}
+function targetJson(context, runtimeScopeId, baseUrl) {
+    return {
+        context,
+        ...(runtimeScopeId ? { runtimeScopeId } : {}),
+        ...(baseUrl ? { url: baseUrl } : {}),
+    };
+}
+function createCliRequestId() {
+    return `cli_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
+}
+//# sourceMappingURL=admin.js.map