@1mcp/agent 0.34.4 → 0.35.0-beta.2

package/build/transport/http/routes/adminRoutes.js

@@ -0,0 +1,1475 @@
+import { createHmac } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseTemplateConnectionKey } from '../../../core/server/templateIdentity.js';
+import { AdminConfiguredServerApplyError, AdminConfiguredServerNotFoundError, } from '../../../domains/admin/adminConfiguredServerService.js';
+import { ADMIN_SESSION_COOKIE_NAME, AdminIdentityError, } from '../../../domains/admin/adminIdentityService.js';
+import { AdminPresetConflictError, AdminPresetNotFoundError, } from '../../../domains/admin/adminPresetService.js';
+import { sensitiveOperationLimiter } from '../../../transport/http/middlewares/securityMiddleware.js';
+import { sanitizeErrorMessage } from '../../../utils/validation/sanitization.js';
+import express, { Router } from 'express';
+import rateLimit from 'express-rate-limit';
+import { createRequire } from 'node:module';
+import { z } from 'zod';
+const FAILED_LOGIN_LIMIT = 5;
+const FAILED_LOGIN_WINDOW_MS = 15 * 60 * 1000;
+const FAILED_LOGIN_MAX_ACTIVE_KEYS = 10_000;
+const ADMIN_AUTH_RATE_LIMIT = 30;
+const ADMIN_AUTH_RATE_LIMIT_WINDOW_MS = 15 * 60 * 1000;
+const ADMIN_STATUS_RATE_LIMIT = 120;
+const ADMIN_STATUS_RATE_LIMIT_WINDOW_MS = 60 * 1000;
+const ADMIN_USERNAME_MAX_LENGTH = 256;
+const ADMIN_PASSWORD_MAX_LENGTH = 4096;
+const CLI_ADMIN_PROTOCOL_VERSION = '1';
+const CLI_ADMIN_RESPONSE_MAX_BYTES = 256 * 1024;
+const CLI_ADMIN_RESPONSE_TOO_LARGE_MESSAGE = 'CLI Admin response exceeded the maximum supported size; use a narrower or paginated request.';
+const CLI_SESSION_OPERATIONS = ['admin.login', 'admin.status', 'admin.logout'];
+const ADMIN_API_PROTOCOL_VERSION = '1';
+const TEMPLATE_INSTANCE_ID_DISPLAY_LENGTH = 12;
+const packageMetadata = createRequire(import.meta.url)('../../../../package.json');
+const CLI_CONFIGURED_SERVER_OPERATIONS = ['mcp.enable', 'mcp.disable'];
+const CLI_BACKEND_RESTART_OPERATION = 'mcp.restart';
+const adminLoginBodySchema = z.object({
+    username: z.string().trim().min(1).max(ADMIN_USERNAME_MAX_LENGTH),
+    password: z.string().min(1).max(ADMIN_PASSWORD_MAX_LENGTH),
+});
+const adminOAuthServiceParamsSchema = z.object({
+    serviceId: z.string().trim().min(1).max(256),
+});
+const cliConfiguredServerMutationBodySchema = z.object({
+    targetName: z.string().trim().min(1).max(256),
+    dryRun: z.boolean().optional(),
+});
+const cliBackendRestartBodySchema = z
+    .object({
+    targetName: z.string().trim().min(1).max(256),
+    instance: z.string().trim().min(1).max(64).optional(),
+    allInstances: z.boolean().optional(),
+})
+    .refine((value) => !(value.instance !== undefined && value.allInstances === true), {
+    message: 'instance and allInstances are mutually exclusive',
+});
+export function createAdminRoutes(options) {
+    if (!options.adminEnabled) {
+        options.adminService.revokeAllSessions();
+        return null;
+    }
+    const router = Router();
+    const failedLoginLimiter = new FailedLoginLimiter();
+    const authenticationLimiter = rateLimit({
+        windowMs: ADMIN_AUTH_RATE_LIMIT_WINDOW_MS,
+        max: ADMIN_AUTH_RATE_LIMIT,
+        standardHeaders: true,
+        legacyHeaders: false,
+    });
+    const statusLimiter = rateLimit({
+        windowMs: ADMIN_STATUS_RATE_LIMIT_WINDOW_MS,
+        max: ADMIN_STATUS_RATE_LIMIT,
+        standardHeaders: true,
+        legacyHeaders: false,
+    });
+    const adminConsoleAssets = resolveAdminConsoleAssets(options.adminConsoleAssetsDir);
+    options.adminService.bootstrapFirstAdminFromEnvironment();
+    router.get('/cli/v1/capabilities', (req, res) => {
+        const identity = options.getRuntimeIdentity();
+        const setupRequired = !options.adminService.hasAdminAccount();
+        const mutationAvailability = cliMutationAvailability(options, setupRequired);
+        const configuredServerOperationsSupported = Boolean(options.configuredServerService);
+        const backendRestartSupported = Boolean(options.backendRestartService);
+        const mcpMutationsReady = (configuredServerOperationsSupported || backendRestartSupported) && mutationAvailability.available;
+        const mcpOperations = [
+            ...(configuredServerOperationsSupported ? [...CLI_CONFIGURED_SERVER_OPERATIONS] : []),
+            ...(backendRestartSupported ? [CLI_BACKEND_RESTART_OPERATION] : []),
+        ];
+        const mcpMutationOperations = mutationAvailability.available
+            ? [
+                ...(configuredServerOperationsSupported ? ['enable', 'disable'] : []),
+                ...(backendRestartSupported ? ['restart'] : []),
+            ]
+            : [];
+        const mcpReadinessStatus = cliMcpReadinessStatus(mutationAvailability);
+        sendCliSuccess(req, res, {
+            runtime: toCliRuntimeIdentity(identity),
+            supportedOperations: [...CLI_SESSION_OPERATIONS, ...mcpOperations],
+            adminSurface: {
+                enabled: true,
+                status: setupRequired ? 'setupRequired' : 'loginRequired',
+            },
+            mutationReadiness: {
+                mcp: {
+                    enabled: mcpMutationsReady,
+                    status: mcpReadinessStatus,
+                    operations: mcpMutationOperations,
+                },
+            },
+            adminMutationsAvailable: mutationAvailability.available,
+            ...(mutationAvailability.reason ? { adminMutationsUnavailableReason: mutationAvailability.reason } : {}),
+            features: {
+                adminSessions: true,
+                bearerSessionAuth: true,
+                csrfTokens: true,
+                mcpEnableDisable: configuredServerOperationsSupported && mutationAvailability.available,
+                mcpRestart: backendRestartSupported && mutationAvailability.available,
+            },
+        });
+    });
+    router.post('/cli/v1/session/login', authenticationLimiter, async (req, res) => {
+        const parsedBody = adminLoginBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            sendCliError(req, res, {
+                status: 400,
+                code: 'admin_login_request_invalid',
+                message: 'Admin username and password are required and must be valid strings',
+                retryable: false,
+            });
+            return;
+        }
+        const { username, password } = parsedBody.data;
+        const source = getLoginSource(req);
+        if (failedLoginLimiter.isLimited(username, source)) {
+            sendCliError(req, res, {
+                status: 429,
+                code: 'admin_login_rate_limited',
+                message: 'Too many failed admin login attempts',
+                retryable: true,
+            });
+            return;
+        }
+        try {
+            const login = await options.adminService.login({
+                username,
+                password,
+            });
+            failedLoginLimiter.reset(username, source);
+            sendCliSuccess(req, res, {
+                sessionToken: login.sessionToken,
+                csrfToken: login.csrfToken,
+                expiresAt: login.expiresAt,
+                account: toCliAdminAccount(login.account),
+            });
+        }
+        catch (error) {
+            failedLoginLimiter.recordFailure(username, source);
+            sendCliAdminError(req, res, error);
+        }
+    });
+    router.get('/cli/v1/session/status', (req, res) => {
+        const sessionToken = getBearerSessionToken(req);
+        const session = options.adminService.validateSession(sessionToken);
+        const runtime = toCliRuntimeIdentity(options.getRuntimeIdentity());
+        if (!session) {
+            sendCliSuccess(req, res, {
+                authenticated: false,
+                runtime,
+            });
+            return;
+        }
+        sendCliSuccess(req, res, {
+            authenticated: true,
+            runtime,
+            account: toCliAdminAccount(session.account),
+            expiresAt: session.expiresAt,
+        });
+    });
+    router.post('/cli/v1/session/logout', (req, res) => {
+        const sessionToken = getBearerSessionToken(req);
+        const session = options.adminService.validateSession(sessionToken);
+        options.adminService.revokeSession(sessionToken);
+        sendCliSuccess(req, res, {
+            revoked: Boolean(session),
+        });
+    });
+    router.post('/cli/v1/operations/enable-server', async (req, res) => {
+        await handleCliConfiguredServerMutation(req, res, options, 'enableConfiguredServer');
+    });
+    router.post('/cli/v1/operations/disable-server', async (req, res) => {
+        await handleCliConfiguredServerMutation(req, res, options, 'disableConfiguredServer');
+    });
+    router.post('/cli/v1/operations/restart-server', async (req, res) => {
+        await handleCliBackendRestart(req, res, options);
+    });
+    router.post('/api/session/login', authenticationLimiter, async (req, res) => {
+        const parsedBody = adminLoginBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            res.status(400).json({ error: 'admin_login_request_invalid' });
+            return;
+        }
+        const { username, password } = parsedBody.data;
+        const source = getLoginSource(req);
+        if (failedLoginLimiter.isLimited(username, source)) {
+            res.status(429).json({ error: 'admin_login_rate_limited' });
+            return;
+        }
+        try {
+            const login = await options.adminService.login({
+                username,
+                password,
+            });
+            failedLoginLimiter.reset(username, source);
+            setAdminSessionCookie(res, options.getRuntimeIdentity().externalUrl, login.sessionToken, login.expiresAt);
+            res.status(200).json({
+                authenticated: true,
+                account: login.account,
+                csrfToken: login.csrfToken,
+                expiresAt: login.expiresAt,
+            });
+        }
+        catch (error) {
+            failedLoginLimiter.recordFailure(username, source);
+            sendAdminError(res, error);
+        }
+    });
+    router.use('/api', (req, res, next) => {
+        const sessionToken = getAdminSessionCookie(req);
+        const session = options.adminService.validateSession(sessionToken);
+        if (!session) {
+            res.status(401).json(unauthenticatedAdminApiResponse(options));
+            return;
+        }
+        if (isUnsafeMethod(req.method) && !options.adminService.validateCsrf(sessionToken, req.header('X-CSRF-Token'))) {
+            res.status(403).json({ error: 'csrf_required' });
+            return;
+        }
+        next();
+    });
+    router.get('/api/session', (req, res) => {
+        const session = options.adminService.validateSession(getAdminSessionCookie(req));
+        if (!session) {
+            res.status(401).json({ authenticated: false });
+            return;
+        }
+        res.status(200).json({
+            authenticated: true,
+            account: session.account,
+            csrfToken: session.csrfToken,
+            expiresAt: session.expiresAt,
+        });
+    });
+    router.post('/api/session/logout', (req, res) => {
+        options.adminService.revokeSession(getAdminSessionCookie(req));
+        clearAdminSessionCookie(res, options.getRuntimeIdentity().externalUrl);
+        res.status(200).json({ ok: true });
+    });
+    router.get('/api/status', statusLimiter, (req, res) => {
+        const session = options.adminService.validateSession(getAdminSessionCookie(req));
+        if (!session) {
+            res.status(401).json({ authenticated: false });
+            return;
+        }
+        res.status(200).json({
+            ok: true,
+            runtime: options.getRuntimeIdentity(),
+            session: {
+                authenticated: true,
+                account: toAdminConsoleAccount(session.account),
+                expiresAt: session.expiresAt,
+            },
+            oauth: sanitizeOAuthDashboard(options.getOAuthDashboard?.() ?? { status: 'ready', services: [] }),
+            audit: {
+                facts: options.configuredServerService?.getRecentAuditFacts({ limit: 10 }) ??
+                    options.presetService?.getRecentAuditFacts({ limit: 10 }) ??
+                    [],
+            },
+            about: buildAboutMetadata(options.getRuntimeIdentity(), {
+                buildVersion: req.header('X-Admin-UI-Build-Version'),
+                protocolVersion: req.header('X-Admin-UI-Protocol-Version'),
+            }),
+        });
+    });
+    router.post('/api/oauth/:serviceId/authorize', sensitiveOperationLimiter, async (req, res) => {
+        if (!options.oauthService) {
+            res.status(503).json({ error: 'backend_oauth_runtime_unavailable' });
+            return;
+        }
+        const serviceId = parseAdminOAuthServiceId(req, res);
+        if (!serviceId)
+            return;
+        const result = await options.oauthService.authorizeService({
+            context: buildAdminOperationContext(req, options, { type: 'backend_oauth_service', id: serviceId }),
+            serviceId,
+        });
+        sendAdminOAuthOperationResult(res, result);
+    });
+    router.post('/api/oauth/:serviceId/restart', sensitiveOperationLimiter, async (req, res) => {
+        if (!options.oauthService) {
+            res.status(503).json({ error: 'backend_oauth_runtime_unavailable' });
+            return;
+        }
+        const serviceId = parseAdminOAuthServiceId(req, res);
+        if (!serviceId)
+            return;
+        const result = await options.oauthService.restartService({
+            context: buildAdminOperationContext(req, options, { type: 'backend_oauth_service', id: serviceId }),
+            serviceId,
+        });
+        sendAdminOAuthOperationResult(res, result);
+    });
+    router.get('/api/presets', async (req, res) => {
+        if (!options.presetService)
+            return void res.status(404).json({ error: 'admin_presets_unavailable' });
+        const result = await options.presetService.listPresets({
+            context: buildAdminOperationContext(req, options, { type: 'preset_collection' }),
+        });
+        sendAdminOperationResult(res, result);
+    });
+    router.get('/api/presets/:name', async (req, res) => {
+        if (!options.presetService)
+            return void res.status(404).json({ error: 'admin_presets_unavailable' });
+        try {
+            sendAdminOperationResult(res, await options.presetService.getPreset({
+                context: buildAdminOperationContext(req, options, { type: 'preset', id: req.params.name }),
+                name: req.params.name,
+            }));
+        }
+        catch (error) {
+            sendPresetError(res, error);
+        }
+    });
+    router.post('/api/presets/preview', async (req, res) => {
+        if (!options.presetService)
+            return void res.status(404).json({ error: 'admin_presets_unavailable' });
+        try {
+            sendAdminOperationResult(res, await options.presetService.previewPreset({
+                context: buildAdminOperationContext(req, options, {
+                    type: 'preset',
+                    id: getBodyString(req.body, 'sourceName') || getBodyString(getBodyValue(req.body, 'draft'), 'name'),
+                }),
+                draft: getPresetDraft(req.body),
+                sourceName: getBodyString(req.body, 'sourceName') || undefined,
+            }));
+        }
+        catch (error) {
+            sendPresetError(res, error);
+        }
+    });
+    router.post('/api/presets', async (req, res) => {
+        await handlePresetMutation(req, res, options, 'create');
+    });
+    router.post('/api/presets/:name/update', async (req, res) => {
+        await handlePresetMutation(req, res, options, 'update');
+    });
+    router.post('/api/presets/:name/duplicate', async (req, res) => {
+        await handlePresetMutation(req, res, options, 'duplicate');
+    });
+    router.post('/api/presets/:name/delete-preview', async (req, res) => {
+        if (!options.presetService)
+            return void res.status(404).json({ error: 'admin_presets_unavailable' });
+        try {
+            sendAdminOperationResult(res, await options.presetService.previewDeletePreset({
+                context: buildAdminOperationContext(req, options, { type: 'preset', id: req.params.name }),
+                name: req.params.name,
+                revision: getBodyString(req.body, 'revision'),
+            }));
+        }
+        catch (error) {
+            sendPresetError(res, error);
+        }
+    });
+    router.delete('/api/presets/:name', async (req, res) => {
+        if (!options.presetService)
+            return void res.status(404).json({ error: 'admin_presets_unavailable' });
+        try {
+            sendAdminOperationResult(res, await options.presetService.deletePreset({
+                context: buildAdminOperationContext(req, options, { type: 'preset', id: req.params.name }),
+                name: req.params.name,
+                revision: getBodyString(req.body, 'revision'),
+                previewFingerprint: getBodyString(req.body, 'previewFingerprint'),
+            }));
+        }
+        catch (error) {
+            sendPresetError(res, error);
+        }
+    });
+    router.get('/api/configured-servers', async (req, res) => {
+        if (!options.configuredServerService) {
+            res.status(404).json({ error: 'admin_configured_servers_unavailable' });
+            return;
+        }
+        const result = await options.configuredServerService.listConfiguredServers({
+            context: buildAdminOperationContext(req, options, { type: 'configured_server_collection' }),
+        });
+        if (!result.ok) {
+            sendAdminOperationResult(res, result);
+            return;
+        }
+        res.status(200).json({
+            ok: true,
+            operationId: result.operationId,
+            servers: result.result.servers,
+        });
+    });
+    router.get('/api/configured-servers/:name', async (req, res) => {
+        await handleConfiguredServerDetail(req, res, options);
+    });
+    router.post('/api/configured-servers/:name/preview', async (req, res) => {
+        await handleConfiguredServerPreview(req, res, options);
+    });
+    router.post('/api/configured-servers/:name/apply', async (req, res) => {
+        await handleConfiguredServerApply(req, res, options);
+    });
+    router.post('/api/configured-servers/:name/enable', async (req, res) => {
+        await handleConfiguredServerMutation(req, res, options, 'enableConfiguredServer');
+    });
+    router.post('/api/configured-servers/:name/disable', async (req, res) => {
+        await handleConfiguredServerMutation(req, res, options, 'disableConfiguredServer');
+    });
+    router.use('/assets', express.static(path.join(adminConsoleAssets.rootDir, 'assets'), {
+        immutable: true,
+        maxAge: '1y',
+    }));
+    router.use('/assets', (_req, res) => {
+        res.status(404).type('text/plain').send('Admin Console asset not found');
+    });
+    router.get(['/', '/*splat'], (req, res, next) => {
+        if (isAdminApiPath(req.path)) {
+            next();
+            return;
+        }
+        sendAdminConsoleIndex(res, adminConsoleAssets.indexPath);
+    });
+    return router;
+}
+function resolveAdminConsoleAssets(configuredDir) {
+    const rootDir = configuredDir ?? resolveDefaultAdminConsoleAssetsDir();
+    return {
+        rootDir,
+        indexPath: path.join(rootDir, 'index.html'),
+    };
+}
+export function resolveDefaultAdminConsoleAssetsDir() {
+    return fileURLToPath(new URL('../../../admin', import.meta.url));
+}
+function isAdminApiPath(pathname) {
+    return (pathname === '/api' || pathname.startsWith('/api/') || pathname === '/cli/v1' || pathname.startsWith('/cli/v1/'));
+}
+function sendAdminConsoleIndex(res, indexPath) {
+    if (!fs.existsSync(indexPath)) {
+        res.status(503).type('text/plain').send('Admin Console assets are not available. Run the package build first.');
+        return;
+    }
+    res.status(200).sendFile(indexPath, { dotfiles: 'allow' });
+}
+function unauthenticatedAdminApiResponse(options) {
+    return options.adminService.hasAdminAccount()
+        ? { authenticated: false }
+        : { authenticated: false, adminStatus: 'setupRequired' };
+}
+async function handleCliConfiguredServerMutation(req, res, options, operationName) {
+    if (!options.configuredServerService) {
+        sendCliError(req, res, {
+            status: 404,
+            code: 'admin_configured_servers_unavailable',
+            message: 'Configured server administration is unavailable',
+            retryable: false,
+        });
+        return;
+    }
+    if (isMutationLocked(options)) {
+        sendCliError(req, res, {
+            status: 409,
+            code: 'runtime_scope_locked',
+            message: 'Runtime scope admin mutations are locked by another writer',
+            retryable: true,
+            details: {
+                operationName,
+                reason: 'writer_lock_unavailable',
+            },
+        });
+        return;
+    }
+    const sessionToken = getBearerSessionToken(req);
+    if (!sessionToken) {
+        sendCliError(req, res, {
+            status: 401,
+            code: 'admin_session_required',
+            message: 'A valid admin session bearer token is required',
+            retryable: false,
+        });
+        return;
+    }
+    const session = options.adminService.validateSession(sessionToken);
+    if (!session) {
+        sendCliError(req, res, {
+            status: 401,
+            code: 'admin_session_required',
+            message: 'A valid admin session bearer token is required',
+            retryable: false,
+        });
+        return;
+    }
+    const parsedBody = cliConfiguredServerMutationBodySchema.safeParse(req.body);
+    if (!parsedBody.success) {
+        sendCliError(req, res, {
+            status: 400,
+            code: 'validation_request_invalid',
+            message: 'Configured server targetName and dryRun must have valid types',
+            retryable: false,
+        });
+        return;
+    }
+    const { targetName, dryRun = false } = parsedBody.data;
+    const context = buildCliAdminOperationContext(req, options, session.account, sessionToken, {
+        type: 'configured_server',
+        id: targetName,
+    });
+    const input = {
+        context,
+        targetName,
+        ...(dryRun ? { dryRun: true } : {}),
+        confirmationRequirements: dryRun
+            ? []
+            : cliConfiguredServerConfirmationRequirements(options, targetName, operationName),
+    };
+    const result = operationName === 'enableConfiguredServer'
+        ? await options.configuredServerService.enableConfiguredServer(input)
+        : await options.configuredServerService.disableConfiguredServer(input);
+    sendCliAdminOperationResult(req, res, result);
+}
+async function handleCliBackendRestart(req, res, options) {
+    if (!options.backendRestartService) {
+        sendCliError(req, res, {
+            status: 404,
+            code: 'backend_restart_unavailable',
+            message: 'Backend restart administration is unavailable',
+            retryable: false,
+        });
+        return;
+    }
+    if (isMutationLocked(options)) {
+        sendCliError(req, res, {
+            status: 409,
+            code: 'runtime_scope_locked',
+            message: 'Runtime scope admin mutations are locked by another writer',
+            retryable: true,
+            details: { operationName: 'restartBackend', reason: 'writer_lock_unavailable' },
+        });
+        return;
+    }
+    const sessionToken = getBearerSessionToken(req);
+    const session = sessionToken ? options.adminService.validateSession(sessionToken) : null;
+    if (!sessionToken || !session) {
+        sendCliError(req, res, {
+            status: 401,
+            code: 'admin_session_required',
+            message: 'A valid admin session bearer token is required',
+            retryable: false,
+        });
+        return;
+    }
+    const parsedBody = cliBackendRestartBodySchema.safeParse(req.body);
+    if (!parsedBody.success) {
+        sendCliError(req, res, {
+            status: 400,
+            code: 'validation_request_invalid',
+            message: 'Backend targetName and restart selectors must have valid, mutually exclusive values',
+            retryable: false,
+        });
+        return;
+    }
+    const { targetName, instance, allInstances = false } = parsedBody.data;
+    const selection = instance
+        ? { mode: 'instance', instanceIdOrPrefix: instance }
+        : allInstances
+            ? { mode: 'all_instances' }
+            : { mode: 'target_default' };
+    const context = buildCliAdminOperationContext(req, options, session.account, sessionToken, {
+        type: 'backend',
+        id: targetName,
+    });
+    const result = await options.backendRestartService.restartBackend({
+        context,
+        targetName,
+        selection,
+        confirmationRequirements: cliBackendRestartConfirmationRequirements(options, targetName),
+    });
+    if (result.ok && isBackendRestartFailureResult(result.result)) {
+        sendCliBackendRestartOutcome(req, res, result.result);
+        return;
+    }
+    sendCliAdminOperationResult(req, res, result);
+}
+function sendCliBackendRestartOutcome(req, res, result) {
+    const response = backendRestartFailure(result.outcome);
+    sendCliError(req, res, {
+        status: response.status,
+        code: response.code,
+        message: response.message,
+        retryable: false,
+        details: {
+            targetName: result.targetName,
+            ...(result.candidateInstanceIds ? { candidateInstanceIds: result.candidateInstanceIds } : {}),
+        },
+    });
+}
+function isBackendRestartFailureResult(result) {
+    return result.outcome !== 'restarted';
+}
+function backendRestartFailure(outcome) {
+    switch (outcome) {
+        case 'target_not_found':
+            return { status: 404, code: 'backend_not_found', message: 'Backend target was not found' };
+        case 'target_disabled':
+            return { status: 409, code: 'backend_disabled', message: 'Backend target is disabled' };
+        case 'instance_not_found':
+            return { status: 404, code: 'backend_instance_not_found', message: 'Backend instance was not found' };
+        case 'instance_ambiguous':
+            return { status: 409, code: 'backend_instance_ambiguous', message: 'Backend instance prefix is ambiguous' };
+        case 'no_active_instances':
+            return {
+                status: 409,
+                code: 'backend_no_active_instances',
+                message: 'Backend has no active instances to restart',
+            };
+        case 'no_unhealthy_instances':
+            return {
+                status: 409,
+                code: 'backend_no_unhealthy_instances',
+                message: 'Backend has no unhealthy active instances to restart by default',
+            };
+    }
+}
+async function handleConfiguredServerDetail(req, res, options) {
+    if (!options.configuredServerService) {
+        res.status(404).json({ error: 'admin_configured_servers_unavailable' });
+        return;
+    }
+    const targetName = req.params.name;
+    try {
+        const result = await options.configuredServerService.getConfiguredServerDetail({
+            context: buildAdminOperationContext(req, options, { type: 'configured_server', id: targetName }),
+            targetName,
+        });
+        if (!result.ok) {
+            sendAdminOperationResult(res, result);
+            return;
+        }
+        res.status(200).json({
+            ok: true,
+            operationId: result.operationId,
+            server: result.result.server,
+            editContract: result.result.editContract,
+        });
+    }
+    catch (error) {
+        if (error instanceof AdminConfiguredServerNotFoundError) {
+            res.status(404).json({
+                ok: false,
+                error: error.code,
+                code: error.code,
+                message: 'Configured server target was not found',
+                target: { type: 'configured_server', id: error.targetName },
+            });
+            return;
+        }
+        throw error;
+    }
+}
+async function handleConfiguredServerPreview(req, res, options) {
+    if (!options.configuredServerService) {
+        res.status(404).json({ error: 'admin_configured_servers_unavailable' });
+        return;
+    }
+    const targetName = req.params.name;
+    const edit = getBodyValue(req.body, 'edit');
+    try {
+        const result = await options.configuredServerService.previewConfiguredServerEdit({
+            context: buildAdminOperationContext(req, options, { type: 'configured_server', id: targetName }),
+            targetName,
+            edit: edit === undefined ? {} : edit,
+            connectivityCheck: getBodyString(req.body, 'connectivityCheck') === 'manual' ? 'manual' : 'auto',
+        });
+        if (!result.ok) {
+            sendAdminOperationResult(res, result);
+            return;
+        }
+        res.status(200).json({
+            ok: true,
+            operationId: result.operationId,
+            preview: result.result,
+        });
+    }
+    catch (error) {
+        if (error instanceof AdminConfiguredServerNotFoundError) {
+            res.status(404).json({
+                ok: false,
+                error: error.code,
+                code: error.code,
+                message: 'Configured server target was not found',
+                target: { type: 'configured_server', id: error.targetName },
+            });
+            return;
+        }
+        throw error;
+    }
+}
+async function handleConfiguredServerApply(req, res, options) {
+    if (!options.configuredServerService) {
+        res.status(404).json({ error: 'admin_configured_servers_unavailable' });
+        return;
+    }
+    if (isMutationLocked(options)) {
+        sendAdminOperationResult(res, {
+            ok: false,
+            status: 'runtime_scope_locked',
+            code: 'runtime_scope_locked',
+            retryable: true,
+            operationName: 'applyConfiguredServerEdit',
+            reason: 'writer_lock_unavailable',
+        });
+        return;
+    }
+    const targetName = req.params.name;
+    try {
+        const result = await options.configuredServerService.applyConfiguredServerEdit({
+            context: buildAdminOperationContext(req, options, { type: 'configured_server', id: targetName }),
+            targetName,
+            edit: getBodyValue(req.body, 'edit') ?? {},
+            previewFingerprint: getBodyString(req.body, 'previewFingerprint'),
+        });
+        if (!result.ok && result.status === 'mutation_failed' && isConfiguredServerApplyErrorCode(result.error)) {
+            sendConfiguredServerApplyError(res, result.error);
+            return;
+        }
+        sendAdminOperationResult(res, result);
+    }
+    catch (error) {
+        if (error instanceof AdminConfiguredServerNotFoundError) {
+            sendConfiguredServerApplyError(res, error.code);
+            return;
+        }
+        if (error instanceof AdminConfiguredServerApplyError) {
+            sendConfiguredServerApplyError(res, error.code);
+            return;
+        }
+        throw error;
+    }
+}
+function isConfiguredServerApplyErrorCode(value) {
+    return value.startsWith('configured_server_');
+}
+function sendConfiguredServerApplyError(res, code) {
+    const status = code === 'configured_server_not_found' ? 404 : 409;
+    res.status(status).json({
+        ok: false,
+        error: code,
+        code,
+        message: configuredServerApplyErrorMessage(code),
+    });
+}
+function configuredServerApplyErrorMessage(code) {
+    switch (code) {
+        case 'configured_server_stale_preview':
+            return 'The configured server changed after preview. Preview the edit again.';
+        case 'configured_server_destination_conflict':
+            return 'The requested configured server target name is already in use.';
+        case 'configured_server_connectivity_blocked':
+            return 'Connectivity validation did not pass for the enabled remote server.';
+        case 'configured_server_edit_invalid':
+            return 'The configured server edit is invalid.';
+        case 'configured_server_edit_unchanged':
+            return 'The configured server edit does not contain any changes.';
+        case 'configured_server_not_found':
+            return 'Configured server target was not found.';
+        default:
+            return 'The configured server edit could not be applied.';
+    }
+}
+async function handleConfiguredServerMutation(req, res, options, operationName) {
+    if (!options.configuredServerService) {
+        res.status(404).json({ error: 'admin_configured_servers_unavailable' });
+        return;
+    }
+    if (isMutationLocked(options)) {
+        sendAdminOperationResult(res, {
+            ok: false,
+            status: 'runtime_scope_locked',
+            code: 'runtime_scope_locked',
+            retryable: true,
+            operationName,
+            reason: 'writer_lock_unavailable',
+        });
+        return;
+    }
+    const targetName = req.params.name;
+    const context = buildAdminOperationContext(req, options, { type: 'configured_server', id: targetName });
+    const input = { context, targetName };
+    const result = operationName === 'enableConfiguredServer'
+        ? await options.configuredServerService.enableConfiguredServer(input)
+        : await options.configuredServerService.disableConfiguredServer(input);
+    sendAdminOperationResult(res, result);
+}
+function cliMutationAvailability(options, setupRequired) {
+    if (!options.configuredServerService && !options.backendRestartService) {
+        return {
+            available: false,
+            reason: 'mutation_service_unavailable',
+        };
+    }
+    if (setupRequired) {
+        return {
+            available: false,
+            reason: 'setup_required',
+        };
+    }
+    return options.adminMutationAvailability ?? { available: true };
+}
+function isMutationLocked(options) {
+    return (options.adminMutationAvailability?.available === false &&
+        options.adminMutationAvailability.reason === 'writer_lock_unavailable');
+}
+function cliMcpReadinessStatus(mutationAvailability) {
+    if (mutationAvailability.available) {
+        return 'ready';
+    }
+    return mutationAvailability.reason === 'mutation_service_unavailable'
+        ? 'unavailable'
+        : (mutationAvailability.reason ?? 'unavailable');
+}
+export class FailedLoginLimiter {
+    now;
+    maxActiveKeys;
+    windowMs;
+    attempts = new Map();
+    constructor(now = Date.now, maxActiveKeys = FAILED_LOGIN_MAX_ACTIVE_KEYS, windowMs = FAILED_LOGIN_WINDOW_MS) {
+        this.now = now;
+        this.maxActiveKeys = maxActiveKeys;
+        this.windowMs = windowMs;
+    }
+    isLimited(username, origin) {
+        this.pruneExpired();
+        const attempt = this.getAttempt(username, origin);
+        if (attempt) {
+            return attempt.count >= FAILED_LOGIN_LIMIT;
+        }
+        return this.attempts.size >= this.maxActiveKeys;
+    }
+    recordFailure(username, origin) {
+        const key = this.key(username, origin);
+        this.pruneExpired();
+        const now = this.now();
+        const attempt = this.getAttempt(username, origin);
+        if (!attempt && this.attempts.size >= this.maxActiveKeys) {
+            return;
+        }
+        this.attempts.set(key, attempt ? { ...attempt, count: attempt.count + 1 } : { count: 1, firstFailureAt: now });
+    }
+    reset(username, origin) {
+        this.attempts.delete(this.key(username, origin));
+    }
+    getAttempt(username, origin) {
+        const key = this.key(username, origin);
+        const attempt = this.attempts.get(key);
+        if (!attempt) {
+            return null;
+        }
+        if (this.now() - attempt.firstFailureAt > this.windowMs) {
+            this.attempts.delete(key);
+            return null;
+        }
+        return attempt;
+    }
+    key(username, origin) {
+        return `${username.trim() || '<missing>'}\0${origin}`;
+    }
+    pruneExpired() {
+        const now = this.now();
+        for (const [key, attempt] of this.attempts) {
+            if (now - attempt.firstFailureAt > this.windowMs) {
+                this.attempts.delete(key);
+            }
+        }
+    }
+}
+function isUnsafeMethod(method) {
+    return method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS';
+}
+function getLoginSource(req) {
+    return req.ip ?? req.socket.remoteAddress ?? req.header('origin') ?? 'unknown';
+}
+function setAdminSessionCookie(res, externalUrl, sessionToken, expiresAt) {
+    res.cookie(ADMIN_SESSION_COOKIE_NAME, sessionToken, {
+        httpOnly: true,
+        sameSite: 'strict',
+        secure: isHttpsRuntime(externalUrl),
+        path: '/admin',
+        expires: new Date(expiresAt),
+    });
+}
+function clearAdminSessionCookie(res, externalUrl) {
+    res.clearCookie(ADMIN_SESSION_COOKIE_NAME, {
+        httpOnly: true,
+        sameSite: 'strict',
+        secure: isHttpsRuntime(externalUrl),
+        path: '/admin',
+    });
+}
+function getAdminSessionCookie(req) {
+    const cookieHeader = req.header('cookie');
+    if (!cookieHeader) {
+        return undefined;
+    }
+    for (const cookie of cookieHeader.split(';')) {
+        const [name, ...valueParts] = cookie.trim().split('=');
+        if (name === ADMIN_SESSION_COOKIE_NAME) {
+            return valueParts.join('=');
+        }
+    }
+    return undefined;
+}
+function getBearerSessionToken(req) {
+    const authorization = req.header('authorization')?.trim();
+    if (!authorization) {
+        return undefined;
+    }
+    const bearerScheme = 'Bearer';
+    if (authorization.length <= bearerScheme.length ||
+        authorization.slice(0, bearerScheme.length).toLowerCase() !== bearerScheme.toLowerCase()) {
+        return undefined;
+    }
+    let tokenStart = bearerScheme.length;
+    if (authorization.charCodeAt(tokenStart) !== 0x20) {
+        return undefined;
+    }
+    while (authorization.charCodeAt(tokenStart) === 0x20) {
+        tokenStart += 1;
+    }
+    const token = authorization.slice(tokenStart);
+    return token && !/\s/u.test(token) ? token : undefined;
+}
+function isHttpsRuntime(externalUrl) {
+    try {
+        return new URL(externalUrl).protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+function sendCliSuccess(req, res, result) {
+    const requestId = getRequestId(req);
+    sendBoundedCliEnvelope(res, 200, {
+        ok: true,
+        cliProtocolVersion: CLI_ADMIN_PROTOCOL_VERSION,
+        requestId,
+        warnings: [],
+        result,
+    });
+}
+function sendCliAdminError(req, res, error) {
+    if (error instanceof AdminIdentityError) {
+        const status = error.code === 'invalid_credentials' ? 401 : error.code === 'admin_account_not_found' ? 404 : 400;
+        sendCliError(req, res, {
+            status,
+            code: error.code,
+            message: error.message,
+            retryable: false,
+        });
+        return;
+    }
+    sendCliError(req, res, {
+        status: 500,
+        code: 'admin_cli_request_failed',
+        message: 'Admin CLI request failed',
+        retryable: false,
+    });
+}
+function sendCliError(req, res, error) {
+    const requestId = getRequestId(req);
+    sendBoundedCliEnvelope(res, error.status, {
+        ok: false,
+        cliProtocolVersion: CLI_ADMIN_PROTOCOL_VERSION,
+        requestId,
+        error: {
+            code: error.code,
+            message: error.message,
+            retryable: error.retryable,
+            requestId,
+            ...(error.retryAfterMs === undefined ? {} : { retryAfterMs: error.retryAfterMs }),
+            ...(error.recoveryCommand ? { recoveryCommand: error.recoveryCommand } : {}),
+            ...(error.details === undefined ? {} : { details: error.details }),
+        },
+        warnings: [],
+    });
+}
+function sendBoundedCliEnvelope(res, status, envelope) {
+    if (Buffer.byteLength(JSON.stringify(envelope), 'utf8') > CLI_ADMIN_RESPONSE_MAX_BYTES) {
+        res.status(422).json({
+            ok: false,
+            cliProtocolVersion: CLI_ADMIN_PROTOCOL_VERSION,
+            requestId: envelope.requestId,
+            error: {
+                code: 'validation_response_too_large',
+                message: CLI_ADMIN_RESPONSE_TOO_LARGE_MESSAGE,
+                retryable: false,
+                requestId: envelope.requestId,
+                details: {
+                    maxBytes: CLI_ADMIN_RESPONSE_MAX_BYTES,
+                },
+            },
+            warnings: [],
+        });
+        return;
+    }
+    res.status(status).json(envelope);
+}
+function sendCliAdminOperationResult(req, res, result) {
+    if (result.ok) {
+        sendCliSuccess(req, res, {
+            operationId: result.operationId,
+            operationName: result.operationName,
+            replayed: result.replayed,
+            ...(typeof result.result === 'object' && result.result !== null ? result.result : { value: result.result }),
+        });
+        return;
+    }
+    sendCliError(req, res, {
+        status: cliOperationErrorStatus(result.status),
+        code: result.code,
+        message: cliOperationErrorMessage(result.status),
+        retryable: result.retryable,
+        retryAfterMs: result.status === 'operation_in_progress' ? result.retryAfterMs : undefined,
+        details: cliOperationErrorDetails(result),
+    });
+}
+function sendAdminError(res, error) {
+    if (error instanceof AdminIdentityError) {
+        const status = error.code === 'invalid_credentials' ? 401 : error.code === 'admin_account_not_found' ? 404 : 400;
+        res.status(status).json({ error: error.code });
+        return;
+    }
+    throw error;
+}
+function sendAdminOperationResult(res, result) {
+    if (result.ok) {
+        res.status(200).json({
+            ok: true,
+            operationId: result.operationId,
+            replayed: result.replayed,
+            result: result.result,
+        });
+        return;
+    }
+    const status = result.status === 'idempotency_key_required' ? 400 : result.status === 'mutation_failed' ? 409 : 409;
+    res.status(status).json(result);
+}
+function sendAdminOAuthOperationResult(res, result) {
+    if (!result.ok && result.status === 'mutation_failed') {
+        const status = result.error === 'backend_oauth_service_not_found'
+            ? 404
+            : result.error === 'backend_oauth_runtime_unavailable'
+                ? 503
+                : 502;
+        res.status(status).json({ ok: false, error: result.error });
+        return;
+    }
+    sendAdminOperationResult(res, result);
+}
+function parseAdminOAuthServiceId(req, res) {
+    const parsed = adminOAuthServiceParamsSchema.safeParse(req.params);
+    if (!parsed.success) {
+        res.status(400).json({ error: 'backend_oauth_service_id_invalid' });
+        return null;
+    }
+    return parsed.data.serviceId;
+}
+async function handlePresetMutation(req, res, options, action) {
+    if (!options.presetService) {
+        res.status(404).json({ error: 'admin_presets_unavailable' });
+        return;
+    }
+    const draft = getPresetDraft(req.body);
+    const common = {
+        context: buildAdminOperationContext(req, options, { type: 'preset', id: req.params.name || draft.name }),
+        draft,
+        revision: getBodyString(req.body, 'revision'),
+        previewFingerprint: getBodyString(req.body, 'previewFingerprint'),
+    };
+    try {
+        const result = action === 'create'
+            ? await options.presetService.createPreset(common)
+            : action === 'update'
+                ? await options.presetService.updatePreset({ ...common, sourceName: req.params.name })
+                : await options.presetService.duplicatePreset({ ...common, sourceName: req.params.name });
+        if (!result.ok && result.status === 'mutation_failed' && result.error === 'preset_revision_conflict') {
+            res.status(409).json({ error: 'preset_revision_conflict' });
+            return;
+        }
+        sendAdminOperationResult(res, result);
+    }
+    catch (error) {
+        sendPresetError(res, error);
+    }
+}
+function sendPresetError(res, error) {
+    if (error instanceof AdminPresetNotFoundError) {
+        res.status(404).json({ error: error.code });
+        return;
+    }
+    if (error instanceof AdminPresetConflictError) {
+        res.status(409).json({ error: error.code });
+        return;
+    }
+    if (error instanceof Error) {
+        res.status(400).json({ error: 'preset_validation_failed', message: sanitizeErrorMessage(error.message) });
+        return;
+    }
+    throw error;
+}
+function getPresetDraft(body) {
+    const value = getBodyValue(body, 'draft');
+    const record = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+    const strategy = record.strategy;
+    return {
+        name: typeof record.name === 'string' ? record.name : '',
+        description: typeof record.description === 'string' ? record.description : undefined,
+        strategy: strategy === 'and' || strategy === 'advanced' ? strategy : 'or',
+        tagQuery: record.tagQuery && typeof record.tagQuery === 'object' && !Array.isArray(record.tagQuery)
+            ? record.tagQuery
+            : {},
+    };
+}
+function buildAboutMetadata(runtime, ui) {
+    return {
+        productName: '1MCP Agent',
+        runtimeVersion: runtime.runtimeVersion,
+        adminUiBuildVersion: ui.buildVersion || undefined,
+        adminApiProtocolVersion: ADMIN_API_PROTOCOL_VERSION,
+        adminUiProtocolVersion: ui.protocolVersion || undefined,
+        protocolCompatible: ui.protocolVersion === ADMIN_API_PROTOCOL_VERSION,
+        runtime: {
+            runtimeScopeId: runtime.runtimeScopeId,
+            externalUrl: runtime.externalUrl || undefined,
+        },
+        build: {
+            commit: process.env.ADMIN_UI_BUILD_COMMIT || undefined,
+            timestamp: process.env.ADMIN_UI_BUILD_TIMESTAMP || undefined,
+        },
+        project: {
+            repository: normalizeRepositoryUrl(packageMetadata.repository?.url) ?? packageMetadata.homepage,
+            documentation: packageMetadata.documentation,
+            issues: packageMetadata.bugs?.url,
+            license: packageMetadata.license,
+        },
+    };
+}
+function normalizeRepositoryUrl(value) {
+    return value?.replace(/^git\+/u, '').replace(/\.git$/u, '');
+}
+function buildAdminOperationContext(req, options, target) {
+    const sessionToken = getAdminSessionCookie(req);
+    const session = options.adminService.validateSession(sessionToken);
+    if (!session) {
+        throw new Error('Admin operation context requested without a valid session');
+    }
+    const runtimeIdentity = options.getRuntimeIdentity();
+    const operationName = operationNameForRequest(req);
+    return {
+        actor: {
+            type: 'admin_session',
+            accountId: session.account.id,
+            sessionId: sessionToken,
+        },
+        origin: 'browser',
+        target,
+        runtimeIdentity: {
+            runtimeScopeId: runtimeIdentity.runtimeScopeId,
+            runtimeVersion: runtimeIdentity.runtimeVersion,
+        },
+        request: {
+            requestId: getRequestId(req),
+            jsonMode: true,
+        },
+        idempotencyKey: req.header('Idempotency-Key'),
+        requestFingerprint: target.type === 'backend_oauth_service'
+            ? backendOAuthRequestFingerprint(operationName, target.id)
+            : configuredServerRequestFingerprint(operationName, target.id, req.body),
+        confirmationFacts: getBodyRecord(req.body, 'confirmationFacts'),
+    };
+}
+function cliConfiguredServerConfirmationRequirements(options, targetName, operationName) {
+    const identity = options.getRuntimeIdentity();
+    if (isLoopbackRuntimeUrl(identity.externalUrl)) {
+        return [];
+    }
+    return [
+        {
+            code: 'confirm_non_loopback_runtime',
+            expected: true,
+            target: {
+                type: 'configured_server',
+                id: targetName,
+            },
+        },
+        {
+            code: 'confirmedOperation',
+            expected: operationName === 'enableConfiguredServer' ? 'mcp.enable' : 'mcp.disable',
+            target: {
+                type: 'configured_server',
+                id: targetName,
+            },
+        },
+        {
+            code: 'confirmedRuntimeScopeId',
+            expected: identity.runtimeScopeId,
+            target: {
+                type: 'configured_server',
+                id: targetName,
+            },
+        },
+        {
+            code: 'confirmationSource',
+            expected: 'cli_flag',
+            target: {
+                type: 'configured_server',
+                id: targetName,
+            },
+        },
+    ];
+}
+function cliBackendRestartConfirmationRequirements(options, targetName) {
+    const identity = options.getRuntimeIdentity();
+    if (isLoopbackRuntimeUrl(identity.externalUrl)) {
+        return [];
+    }
+    const target = { type: 'backend', id: targetName };
+    return [
+        { code: 'confirm_non_loopback_runtime', expected: true, target },
+        { code: 'confirmedOperation', expected: 'mcp.restart', target },
+        { code: 'confirmedRuntimeScopeId', expected: identity.runtimeScopeId, target },
+        { code: 'confirmationSource', expected: 'cli_flag', target },
+    ];
+}
+function buildCliAdminOperationContext(req, options, account, sessionToken, target) {
+    const runtimeIdentity = options.getRuntimeIdentity();
+    const operationName = operationNameForRequest(req);
+    return {
+        actor: {
+            type: 'admin_session',
+            accountId: account.id,
+            sessionId: sessionToken,
+        },
+        origin: 'cli',
+        target,
+        runtimeIdentity: {
+            runtimeScopeId: runtimeIdentity.runtimeScopeId,
+            runtimeVersion: runtimeIdentity.runtimeVersion,
+        },
+        request: {
+            requestId: getRequestId(req),
+            jsonMode: true,
+        },
+        idempotencyKey: req.header('Idempotency-Key'),
+        requestFingerprint: configuredServerRequestFingerprint(operationName, target.id, req.body),
+        confirmationFacts: getBodyRecord(req.body, 'confirmationFacts'),
+    };
+}
+function configuredServerRequestFingerprint(operationName, targetName, body) {
+    const previewFingerprint = getBodyString(body, 'previewFingerprint');
+    const normalized = stableJsonStringify({
+        schemaVersion: 1,
+        operationName,
+        target: {
+            type: operationName === 'restartBackend' ? 'backend' : 'configured_server',
+            id: targetName ?? '',
+        },
+        ...(operationName === 'applyConfiguredServerEdit'
+            ? {
+                previewFingerprint,
+                editDigest: keyedRequestFingerprint(previewFingerprint, 'configured-server-edit', stableJsonStringify(getBodyValue(body, 'edit') ?? {})),
+            }
+            : {}),
+        ...(operationName === 'restartBackend'
+            ? {
+                restartSelection: {
+                    instance: getBodyString(body, 'instance'),
+                    allInstances: getBodyValue(body, 'allInstances') === true,
+                },
+            }
+            : {}),
+    });
+    return operationName === 'applyConfiguredServerEdit'
+        ? `configured_server_apply_${keyedRequestFingerprint(previewFingerprint, 'configured-server-apply', normalized)}`
+        : normalized;
+}
+function keyedRequestFingerprint(key, domain, value) {
+    return createHmac('sha256', key).update(domain).update('\0').update(value).digest('hex');
+}
+function backendOAuthRequestFingerprint(operationName, serviceId) {
+    return stableJsonStringify({
+        schemaVersion: 1,
+        operationName,
+        target: {
+            type: 'backend_oauth_service',
+            id: serviceId ?? '',
+        },
+    });
+}
+function stableJsonStringify(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => stableJsonStringify(item)).join(',')}]`;
+    }
+    if (value && typeof value === 'object') {
+        const entries = Object.entries(value)
+            .filter(([, entryValue]) => entryValue !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right));
+        return `{${entries
+            .map(([key, entryValue]) => `${JSON.stringify(key)}:${stableJsonStringify(entryValue)}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+function cliOperationErrorStatus(status) {
+    switch (status) {
+        case 'idempotency_key_required':
+            return 400;
+        case 'admin_operation_journal_unavailable':
+            return 503;
+        default:
+            return 409;
+    }
+}
+function cliOperationErrorMessage(status) {
+    switch (status) {
+        case 'idempotency_key_required':
+            return 'Idempotency key is required';
+        case 'idempotency_conflict':
+            return 'Idempotency key conflicts with another request';
+        case 'operation_in_progress':
+            return 'Admin operation is still in progress';
+        case 'operation_state_unknown':
+            return 'Admin operation state is unknown';
+        case 'mutation_confirmation_required':
+            return 'Additional mutation confirmation is required';
+        case 'mutation_failed':
+            return 'Configured server mutation failed';
+        case 'admin_operation_journal_unavailable':
+            return 'Admin operation journal is unavailable';
+        case 'runtime_scope_mismatch':
+            return 'Runtime scope mismatch';
+        case 'runtime_scope_locked':
+            return 'Runtime scope admin mutations are locked by another writer';
+        default:
+            return 'Admin operation failed';
+    }
+}
+function cliOperationErrorDetails(result) {
+    const details = {
+        operationName: result.operationName,
+    };
+    if (result.status === 'operation_state_unknown') {
+        details.target = result.target;
+        details.reservedAt = result.reservedAt;
+        details.recovery = result.recovery;
+    }
+    if (result.status === 'runtime_scope_locked') {
+        details.reason = result.reason;
+    }
+    if (result.status === 'mutation_confirmation_required') {
+        details.confirmationRequirements = result.confirmationRequirements;
+    }
+    if (result.status === 'mutation_failed') {
+        details.error = result.error;
+    }
+    return details;
+}
+function operationNameForRequest(req) {
+    if (req.path.startsWith('/api/oauth/')) {
+        return req.path.endsWith('/restart') ? 'restartBackendOAuth' : 'authorizeBackendOAuth';
+    }
+    if (req.path.endsWith('/restart-server')) {
+        return 'restartBackend';
+    }
+    if (req.path.endsWith('/enable') || req.path.endsWith('/enable-server')) {
+        return 'enableConfiguredServer';
+    }
+    if (req.path.endsWith('/disable') || req.path.endsWith('/disable-server')) {
+        return 'disableConfiguredServer';
+    }
+    if (req.path.endsWith('/preview')) {
+        return 'previewConfiguredServerEdit';
+    }
+    if (req.path.endsWith('/apply')) {
+        return 'applyConfiguredServerEdit';
+    }
+    if (req.method === 'GET' && req.path.startsWith('/api/configured-servers/')) {
+        return 'getConfiguredServerDetail';
+    }
+    return 'listConfiguredServers';
+}
+function getRequestId(req) {
+    const requestId = req.header('X-Request-Id');
+    return requestId?.trim() || `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+function toAdminConsoleAccount(account) {
+    return {
+        id: account.id,
+        username: account.username,
+        role: account.role,
+    };
+}
+function toCliAdminAccount(account) {
+    return {
+        username: account.username,
+        role: account.role,
+    };
+}
+function toCliRuntimeIdentity(identity) {
+    return {
+        identityProtocolVersion: identity.identityProtocolVersion,
+        runtimeScopeId: identity.runtimeScopeId,
+        runtimeVersion: identity.runtimeVersion,
+    };
+}
+function sanitizeOAuthDashboard(dashboard) {
+    if (dashboard.status !== 'ready') {
+        return dashboard;
+    }
+    return {
+        ...dashboard,
+        services: dashboard.services.map((service) => ({
+            ...service,
+            id: service.name,
+            displayName: backendOAuthServiceDisplayName(service.name),
+            lastError: service.lastError ? sanitizeErrorMessage(service.lastError) : undefined,
+        })),
+    };
+}
+function backendOAuthServiceDisplayName(serviceId) {
+    const identity = parseTemplateConnectionKey(serviceId);
+    if (identity.kind !== 'rendered' || identity.renderedHash.length <= TEMPLATE_INSTANCE_ID_DISPLAY_LENGTH) {
+        return serviceId;
+    }
+    return `${identity.templateName}:${identity.renderedHash.slice(0, TEMPLATE_INSTANCE_ID_DISPLAY_LENGTH)}`;
+}
+function getBodyValue(body, key) {
+    if (!body || typeof body !== 'object') {
+        return undefined;
+    }
+    return body[key];
+}
+function getBodyString(body, key) {
+    if (!body || typeof body !== 'object') {
+        return '';
+    }
+    const value = body[key];
+    return typeof value === 'string' ? value : '';
+}
+function getBodyRecord(body, key) {
+    if (!body || typeof body !== 'object') {
+        return undefined;
+    }
+    const value = body[key];
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? { ...value }
+        : undefined;
+}
+function isLoopbackRuntimeUrl(value) {
+    try {
+        const hostname = new URL(value).hostname.toLowerCase();
+        return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === '[::1]';
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=adminRoutes.js.map