@kb-labs/mcp-app 2.119.1-canary.ee03bc25d → 2.120.0

package/dist/bin.cjs

@@ -87235,7 +87235,7 @@ var SignJWT = class extends ProduceJWT {
 };
 
 // ../../gateway/auth/dist/index.js
-__toESM(require_bcryptjs());
+var import_bcryptjs = __toESM(require_bcryptjs());
 init_zod();
 
 // ../../../core/contracts/dist/index.js
@@ -87784,6 +87784,549 @@ var AuthService = class {
     };
   }
 };
+var COLLECTION = "users";
+var canonicalizeEmail = (raw) => raw.trim().toLowerCase();
+var docToUser = (doc) => ({
+  userId: doc.userId,
+  tenantId: doc.tenantId,
+  email: doc.email,
+  displayName: doc.displayName,
+  status: doc.status,
+  createdAt: doc.createdAt,
+  updatedAt: doc.updatedAt
+});
+var UsersStore = class {
+  constructor(docs) {
+    this.docs = docs;
+  }
+  docs;
+  initialised = null;
+  async ensureSchema() {
+    if (!this.initialised) {
+      this.initialised = (async () => {
+        await this.docs.ensureCollection(COLLECTION, {
+          indexes: [
+            // Logical primary key for "user inside tenant" lookups.
+            { path: ["tenantId", "email"], unique: true },
+            // userId is the surrogate key callers reference everywhere.
+            { path: "userId", unique: true },
+            { path: "tenantId" }
+          ]
+        });
+      })();
+    }
+    await this.initialised;
+  }
+  async create(input) {
+    await this.ensureSchema();
+    const email3 = canonicalizeEmail(input.email);
+    await this.docs.insertOne(COLLECTION, {
+      userId: input.userId,
+      tenantId: input.tenantId,
+      email: email3,
+      displayName: input.displayName,
+      status: input.status
+    });
+    const created = await this.getById(input.userId);
+    if (!created) {
+      throw new Error(`users-store: inserted user ${input.userId} but read-back returned null`);
+    }
+    return created;
+  }
+  async getById(userId) {
+    await this.ensureSchema();
+    const doc = await this.docs.findById(COLLECTION, userId);
+    if (doc && doc.userId === userId) {
+      return docToUser(doc);
+    }
+    const [byField] = await this.docs.find(
+      COLLECTION,
+      { userId: { $eq: userId } },
+      { limit: 1 }
+    );
+    return byField ? docToUser(byField) : null;
+  }
+  async findByEmailTenant(email3, tenantId) {
+    await this.ensureSchema();
+    const normalised = canonicalizeEmail(email3);
+    const [doc] = await this.docs.find(
+      COLLECTION,
+      { $and: [{ tenantId: { $eq: tenantId } }, { email: { $eq: normalised } }] },
+      { limit: 1 }
+    );
+    return doc ? docToUser(doc) : null;
+  }
+  async setStatus(userId, status) {
+    await this.ensureSchema();
+    const existing = await this.getById(userId);
+    if (!existing) {
+      throw new Error(`users-store: setStatus on unknown userId=${userId}`);
+    }
+    await this.docs.updateMany(
+      COLLECTION,
+      { userId: { $eq: userId } },
+      { $set: { status } }
+    );
+  }
+  /** List all users for a given tenant. */
+  async listByTenant(tenantId) {
+    await this.ensureSchema();
+    const docs = await this.docs.find(
+      COLLECTION,
+      { tenantId: { $eq: tenantId } }
+    );
+    return docs.map(docToUser);
+  }
+  async delete(userId) {
+    await this.ensureSchema();
+    await this.docs.deleteMany(COLLECTION, { userId: { $eq: userId } });
+  }
+};
+var COLLECTION2 = "credentials";
+var docToCredential = (doc) => ({
+  userId: doc.userId,
+  providerId: doc.providerId,
+  hash: doc.hash,
+  createdAt: doc.createdAt,
+  updatedAt: doc.updatedAt
+});
+var CredentialsStore = class {
+  constructor(docs) {
+    this.docs = docs;
+  }
+  docs;
+  initialised = null;
+  async ensureSchema() {
+    if (!this.initialised) {
+      this.initialised = (async () => {
+        await this.docs.ensureCollection(COLLECTION2, {
+          indexes: [
+            // Logical primary key.
+            { path: ["userId", "providerId"], unique: true },
+            // Cascade delete needs userId alone.
+            { path: "userId" }
+          ]
+        });
+      })();
+    }
+    await this.initialised;
+  }
+  async setCredential(input) {
+    await this.ensureSchema();
+    await this.docs.updateOne(
+      COLLECTION2,
+      {
+        $and: [
+          { userId: { $eq: input.userId } },
+          { providerId: { $eq: input.providerId } }
+        ]
+      },
+      {
+        $set: {
+          userId: input.userId,
+          providerId: input.providerId,
+          hash: input.hash
+        }
+      },
+      { upsert: true }
+    );
+  }
+  async getCredential(userId, providerId) {
+    await this.ensureSchema();
+    const [doc] = await this.docs.find(
+      COLLECTION2,
+      {
+        $and: [
+          { userId: { $eq: userId } },
+          { providerId: { $eq: providerId } }
+        ]
+      },
+      { limit: 1 }
+    );
+    return doc ? docToCredential(doc) : null;
+  }
+  async deleteCredential(userId, providerId) {
+    await this.ensureSchema();
+    await this.docs.deleteMany(COLLECTION2, {
+      $and: [
+        { userId: { $eq: userId } },
+        { providerId: { $eq: providerId } }
+      ]
+    });
+  }
+  /**
+   * Cascade removal helper — call from the parent flow when a `User` is
+   * deleted so we never leave dangling credentials in the store.
+   */
+  async deleteAllForUser(userId) {
+    await this.ensureSchema();
+    await this.docs.deleteMany(COLLECTION2, {
+      userId: { $eq: userId }
+    });
+  }
+};
+var COLLECTION3 = "memberships";
+var docToMembership = (doc) => ({
+  userId: doc.userId,
+  tenantId: doc.tenantId,
+  groupId: doc.groupId,
+  createdAt: doc.createdAt,
+  updatedAt: doc.updatedAt
+});
+var MembershipsStore = class {
+  constructor(docs) {
+    this.docs = docs;
+  }
+  docs;
+  initialised = null;
+  async ensureSchema() {
+    if (!this.initialised) {
+      this.initialised = (async () => {
+        await this.docs.ensureCollection(COLLECTION3, {
+          indexes: [
+            { path: ["userId", "tenantId"], unique: true },
+            { path: "userId" },
+            { path: "tenantId" }
+          ]
+        });
+      })();
+    }
+    await this.initialised;
+  }
+  async addMembership(input) {
+    await this.ensureSchema();
+    await this.docs.insertOne(COLLECTION3, {
+      userId: input.userId,
+      tenantId: input.tenantId,
+      groupId: input.groupId
+    });
+  }
+  async setGroup(userId, tenantId, groupId) {
+    await this.ensureSchema();
+    const [existing] = await this.docs.find(
+      COLLECTION3,
+      { $and: [{ userId: { $eq: userId } }, { tenantId: { $eq: tenantId } }] },
+      { limit: 1 }
+    );
+    if (!existing) {
+      throw new Error(
+        `memberships-store: setGroup on missing membership userId=${userId} tenantId=${tenantId}`
+      );
+    }
+    await this.docs.updateMany(
+      COLLECTION3,
+      { $and: [{ userId: { $eq: userId } }, { tenantId: { $eq: tenantId } }] },
+      { $set: { groupId } }
+    );
+  }
+  async listByUser(userId) {
+    await this.ensureSchema();
+    const docs = await this.docs.find(
+      COLLECTION3,
+      { userId: { $eq: userId } },
+      { sort: { tenantId: 1 } }
+    );
+    return docs.map(docToMembership);
+  }
+  async listByTenant(tenantId) {
+    await this.ensureSchema();
+    const docs = await this.docs.find(
+      COLLECTION3,
+      { tenantId: { $eq: tenantId } },
+      { sort: { userId: 1 } }
+    );
+    return docs.map(docToMembership);
+  }
+  async removeMembership(userId, tenantId) {
+    await this.ensureSchema();
+    await this.docs.deleteMany(
+      COLLECTION3,
+      { $and: [{ userId: { $eq: userId } }, { tenantId: { $eq: tenantId } }] }
+    );
+  }
+  /** Cascade hook — call when a `User` is deleted. */
+  async removeAllForUser(userId) {
+    await this.ensureSchema();
+    await this.docs.deleteMany(COLLECTION3, { userId: { $eq: userId } });
+  }
+};
+var FAMILIES = "session_families";
+var REFRESHES = "refresh_tokens";
+var RefreshNotFoundError = class extends Error {
+  constructor() {
+    super("refresh token not found");
+    this.name = "RefreshNotFoundError";
+  }
+};
+var RefreshExpiredError = class extends Error {
+  constructor() {
+    super("refresh token expired");
+    this.name = "RefreshExpiredError";
+  }
+};
+var RefreshReuseDetectedError = class extends Error {
+  constructor(familyId) {
+    super(`refresh token reuse detected (family ${familyId} killed)`);
+    this.familyId = familyId;
+    this.name = "RefreshReuseDetectedError";
+  }
+  familyId;
+};
+var newId = (bytes = 16) => crypto4.randomBytes(bytes).toString("base64url");
+var SessionsStore = class {
+  constructor(docs, opts) {
+    this.docs = docs;
+    this.now = opts.now ?? Date.now;
+    this.refreshTtlMs = opts.refreshTtlMs;
+    this.graceWindowMs = opts.graceWindowMs;
+  }
+  docs;
+  initialised = null;
+  now;
+  refreshTtlMs;
+  graceWindowMs;
+  async ensureSchema() {
+    if (!this.initialised) {
+      this.initialised = (async () => {
+        await this.docs.ensureCollection(FAMILIES, {
+          indexes: [
+            { path: "familyId", unique: true },
+            { path: "userId" }
+          ]
+        });
+        await this.docs.ensureCollection(REFRESHES, {
+          indexes: [
+            { path: "jti", unique: true },
+            { path: "familyId" },
+            { path: "userId" },
+            // Best-effort sweep; `rotateRefresh` checks expiresAt > now (CD-9).
+            { path: "expiresAt", ttl: 0 }
+          ]
+        });
+      })();
+    }
+    await this.initialised;
+  }
+  async createSession(input) {
+    await this.ensureSchema();
+    const familyId = newId();
+    const refreshJti = newId();
+    const now = this.now();
+    const refreshExpiresAt = now + this.refreshTtlMs;
+    await this.docs.transaction(async (tx) => {
+      await tx.insertOne(FAMILIES, {
+        familyId,
+        userId: input.userId,
+        tenantId: input.tenantId,
+        lastUsedAt: now,
+        userAgent: input.deviceCtx.userAgent,
+        ipFirst: input.deviceCtx.ip
+      });
+      await tx.insertOne(REFRESHES, {
+        jti: refreshJti,
+        familyId,
+        userId: input.userId,
+        expiresAt: refreshExpiresAt
+      });
+    });
+    return { familyId, refreshJti, refreshExpiresAt };
+  }
+  /**
+   * Consume `oldJti` and issue a new refresh in the same family.
+   *
+   * Throws:
+   * - `RefreshNotFoundError` if jti is unknown or its family was revoked.
+   * - `RefreshExpiredError` if jti is past `expiresAt` (family stays alive).
+   * - `RefreshReuseDetectedError` if jti was already consumed and the
+   *   grace window has passed — family is killed before throwing.
+   *
+   * On grace-window retry (same already-consumed jti within
+   * `graceWindowMs`) the previously-issued replacement is returned and
+   * no new refresh is created.
+   */
+  async rotateRefresh(oldJti) {
+    await this.ensureSchema();
+    const now = this.now();
+    const newJti = newId();
+    const newExpiresAt = now + this.refreshTtlMs;
+    const outcome = await this.docs.transaction(async (tx) => {
+      const [current] = await tx.find(
+        REFRESHES,
+        { jti: { $eq: oldJti } },
+        { limit: 1 }
+      );
+      if (!current) {
+        return { tag: "not-found" };
+      }
+      if (current.consumedAt !== void 0) {
+        const elapsed = now - current.consumedAt;
+        if (elapsed <= this.graceWindowMs && current.replacedBy) {
+          const [replacement] = await tx.find(
+            REFRESHES,
+            { jti: { $eq: current.replacedBy } },
+            { limit: 1 }
+          );
+          if (replacement) {
+            return {
+              tag: "ok",
+              result: {
+                newJti: replacement.jti,
+                familyId: current.familyId,
+                newRefreshExpiresAt: replacement.expiresAt
+              }
+            };
+          }
+        }
+        if (current.expiresAt <= now) {
+          return { tag: "expired" };
+        }
+        return { tag: "reuse", familyId: current.familyId };
+      }
+      if (current.expiresAt <= now) {
+        return { tag: "expired" };
+      }
+      await tx.updateMany(
+        REFRESHES,
+        { jti: { $eq: oldJti } },
+        { $set: { consumedAt: now, replacedBy: newJti } }
+      );
+      await tx.insertOne(REFRESHES, {
+        jti: newJti,
+        familyId: current.familyId,
+        userId: current.userId,
+        expiresAt: newExpiresAt
+      });
+      await tx.updateMany(
+        FAMILIES,
+        { familyId: { $eq: current.familyId } },
+        { $set: { lastUsedAt: now } }
+      );
+      return {
+        tag: "ok",
+        result: { newJti, familyId: current.familyId, newRefreshExpiresAt: newExpiresAt }
+      };
+    });
+    switch (outcome.tag) {
+      case "ok":
+        return outcome.result;
+      case "not-found":
+        throw new RefreshNotFoundError();
+      case "expired":
+        throw new RefreshExpiredError();
+      case "reuse":
+        await this.revokeFamily(outcome.familyId);
+        throw new RefreshReuseDetectedError(outcome.familyId);
+    }
+  }
+  async revokeFamily(familyId) {
+    await this.ensureSchema();
+    await this.docs.transaction(async (tx) => {
+      await tx.deleteMany(REFRESHES, { familyId: { $eq: familyId } });
+      await tx.deleteMany(FAMILIES, { familyId: { $eq: familyId } });
+    });
+  }
+  async revokeAllUserSessions(userId) {
+    await this.ensureSchema();
+    await this.docs.transaction(async (tx) => {
+      await tx.deleteMany(REFRESHES, { userId: { $eq: userId } });
+      await tx.deleteMany(FAMILIES, { userId: { $eq: userId } });
+    });
+  }
+  async revokeAllUserSessionsExcept(userId, exceptFamilyId) {
+    await this.ensureSchema();
+    await this.docs.transaction(async (tx) => {
+      const families = await tx.find(FAMILIES, { userId: { $eq: userId } });
+      const targets = families.filter((f) => f.familyId !== exceptFamilyId).map((f) => f.familyId);
+      if (targets.length === 0) {
+        return;
+      }
+      await tx.deleteMany(
+        REFRESHES,
+        { $and: [{ userId: { $eq: userId } }, { familyId: { $in: targets } }] }
+      );
+      await tx.deleteMany(
+        FAMILIES,
+        { $and: [{ userId: { $eq: userId } }, { familyId: { $in: targets } }] }
+      );
+    });
+  }
+  async listFamiliesByUser(userId) {
+    await this.ensureSchema();
+    const docs = await this.docs.find(
+      FAMILIES,
+      { userId: { $eq: userId } },
+      { sort: { lastUsedAt: -1 } }
+    );
+    return docs.map((d) => ({
+      familyId: d.familyId,
+      userId: d.userId,
+      tenantId: d.tenantId,
+      createdAt: d.createdAt,
+      lastUsedAt: d.lastUsedAt,
+      userAgent: d.userAgent,
+      ipFirst: d.ipFirst
+    }));
+  }
+};
+var noopLogger = {
+  warn: () => void 0,
+  info: () => void 0,
+  error: () => void 0
+};
+var sha1Hex = (input) => crypto4.createHash("sha1").update(input).digest("hex").toUpperCase();
+var queryHibp = async (plain, doFetch) => {
+  const hash2 = sha1Hex(plain);
+  const prefix = hash2.slice(0, 5);
+  const wantedSuffix = hash2.slice(5);
+  const resp = await doFetch(`https://api.pwnedpasswords.com/range/${prefix}`);
+  if (!resp.ok) {
+    throw new Error(`HIBP ${resp.status}`);
+  }
+  const text = await resp.text();
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    const sepIdx = trimmed.indexOf(":");
+    if (sepIdx < 0) {
+      continue;
+    }
+    const suffix = trimmed.slice(0, sepIdx).toUpperCase();
+    if (suffix === wantedSuffix) {
+      const count = Number.parseInt(trimmed.slice(sepIdx + 1), 10);
+      return Number.isFinite(count) ? count : 1;
+    }
+  }
+  return 0;
+};
+var createPasswordPolicy = (opts) => {
+  const log3 = opts.logger ?? noopLogger;
+  const doFetch = opts.fetch ?? fetch;
+  return {
+    async validate(plain) {
+      if (plain.length < opts.minLength) {
+        return { ok: false, reason: "too_short" };
+      }
+      if (plain.length > opts.maxLength) {
+        return { ok: false, reason: "too_long" };
+      }
+      if (!opts.hibpEnabled) {
+        return { ok: true };
+      }
+      try {
+        const count = await queryHibp(plain, doFetch);
+        if (count > 0) {
+          return { ok: false, reason: "pwned" };
+        }
+        return { ok: true };
+      } catch (err) {
+        log3.warn("password-policy: HIBP unavailable, accepting password", { err: String(err) });
+        return { ok: true, warning: "hibp_unavailable" };
+      }
+    }
+  };
+};
 external_exports.object({
   type: external_exports.literal("oidc"),
   id: external_exports.string().min(1),
@@ -87802,6 +88345,54 @@ external_exports.object({
 }).passthrough();
 Object.freeze(Object.values(PERMISSIONS));
 Object.freeze([PERMISSIONS.MACHINE_REGISTER]);
+var ResetAdminError = class extends Error {
+  constructor(code, message2) {
+    super(message2);
+    this.code = code;
+    this.name = "ResetAdminError";
+  }
+  code;
+};
+var resetAdmin = async (opts) => {
+  const { users, credentials, memberships, sessions, tenantId, logger: logger2 } = opts;
+  const email3 = canonicalizeEmail(opts.email);
+  if (!email3 || !tenantId) {
+    throw new ResetAdminError("invalid_input", "resetAdmin: email and tenantId are required");
+  }
+  const policy = await opts.passwordPolicy.validate(opts.password);
+  if (!policy.ok) {
+    throw new ResetAdminError("weak_password", `password rejected by policy: ${policy.reason}`);
+  }
+  const repairs = [];
+  const existing = await users.findByEmailTenant(email3, tenantId);
+  let userId;
+  if (!existing) {
+    userId = crypto4.randomUUID();
+    await users.create({ userId, tenantId, email: email3, status: "active" });
+    repairs.push("user-created");
+  } else {
+    userId = existing.userId;
+    if (existing.status !== "active") {
+      await users.setStatus(userId, "active");
+      repairs.push("user-reactivated");
+    }
+  }
+  const hash2 = await import_bcryptjs.default.hash(opts.password, opts.bcryptCost);
+  await credentials.setCredential({ userId, providerId: "email-password", hash: hash2 });
+  repairs.push("credential-set");
+  const membership = (await memberships.listByUser(userId)).find((m) => m.tenantId === tenantId);
+  if (!membership) {
+    await memberships.addMembership({ userId, tenantId, groupId: "tenant-admin" });
+    repairs.push("membership-created");
+  } else if (membership.groupId !== "tenant-admin") {
+    await memberships.setGroup(userId, tenantId, "tenant-admin");
+    repairs.push("membership-promoted");
+  }
+  await sessions.revokeAllUserSessions(userId);
+  const outcome = existing ? "reset" : "created";
+  logger2.info("reset-admin: admin account restored", { userId, tenantId, outcome, repairs });
+  return { userId, tenantId, email: email3, outcome, repairs };
+};
 
 // src/mcp/auth.ts
 var DEV_JWT_SECRET = "dev-insecure-secret-change-me";
@@ -110578,7 +111169,7 @@ function validateSegments(segs) {
   }
   return null;
 }
-var noopLogger = {
+var noopLogger2 = {
   debug: () => {
   },
   info: () => {
@@ -110587,13 +111178,13 @@ var noopLogger = {
   },
   error: () => {
   },
-  child: () => noopLogger
+  child: () => noopLogger2
 };
 var TrieBackedRegistry = class {
   systemRouter = new TrieRouter();
   pluginRouter = new TrieRouter();
   partial = false;
-  logger = noopLogger;
+  logger = noopLogger2;
   // ─── Logger ────────────────────────────────────────────────────────────────
   setLogger(logger2) {
     this.logger = logger2;
@@ -110777,31 +111368,31 @@ defineSystemCommand({
     const cliCtx = ctx.hostContext?.host === "cli" ? ctx.hostContext : void 0;
     const cliVersion = cliCtx?.cliVersion ?? process.env.CLI_VERSION ?? "0.0.0";
     const nodeVersion = process.version;
-    const platform11 = `${process.platform} ${process.arch}`;
+    const platform12 = `${process.platform} ${process.arch}`;
     ctx.platform?.logger?.info("Version command executed", {
       version: cliVersion,
       nodeVersion,
-      platform: platform11
+      platform: platform12
     });
     if (!flags.json) {
       ctx.ui?.write(`KB Labs CLI v${cliVersion}
 `);
       ctx.ui?.write(`Node: ${nodeVersion}
 `);
-      ctx.ui?.write(`Platform: ${platform11}
+      ctx.ui?.write(`Platform: ${platform12}
 `);
     } else {
       ctx.ui?.json({
         version: cliVersion,
         nodeVersion,
-        platform: platform11
+        platform: platform12
       });
     }
     return {
       ok: true,
       version: cliVersion,
       nodeVersion,
-      platform: platform11
+      platform: platform12
     };
   }
 });
@@ -113176,6 +113767,210 @@ defineSystemCommand({
     return { ok: true, clientId: data.clientId, clientSecret: data.clientSecret, hostId: data.hostId };
   }
 });
+var DEFAULT_TENANT = "kblabs-cloud";
+var DEFAULT_GATEWAY_HOST = "127.0.0.1";
+var DEFAULT_GATEWAY_PORT = 4e3;
+var PROBE_TIMEOUT_MS = 500;
+function isRecord3(v) {
+  return typeof v === "object" && v !== null;
+}
+function gatewaySlice(config2) {
+  const gw = config2?.gateway;
+  return isRecord3(gw) ? gw : {};
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf-8").replace(/\r?\n$/, "");
+}
+function isPortListening(host, port) {
+  return new Promise((resolve9) => {
+    const socket = net.connect({ host, port });
+    const done = (listening) => {
+      socket.destroy();
+      resolve9(listening);
+    };
+    socket.setTimeout(PROBE_TIMEOUT_MS, () => done(false));
+    socket.once("connect", () => done(true));
+    socket.once("error", () => done(false));
+  });
+}
+async function planRepairs(existing, tenantId, memberships) {
+  if (!existing) {
+    return ["user-created", "credential-set", "membership-created"];
+  }
+  const repairs = [];
+  if (existing.status !== "active") {
+    repairs.push("user-reactivated");
+  }
+  repairs.push("credential-set");
+  const membership = (await memberships.listByUser(existing.userId)).find((m) => m.tenantId === tenantId);
+  if (!membership) {
+    repairs.push("membership-created");
+  } else if (membership.groupId !== "tenant-admin") {
+    repairs.push("membership-promoted");
+  }
+  return repairs;
+}
+function printDryRun(ctx, existing, dry) {
+  ctx.ui?.write?.(`Dry run \u2014 nothing changed.
+  Admin:  ${dry.email} (tenant ${dry.tenantId})
+`);
+  ctx.ui?.write?.(existing ? `  State:  exists, status=${existing.status}
+` : "  State:  does not exist\n");
+  ctx.ui?.write?.(`  Would:  ${dry.repairs?.join(", ")}, revoke all sessions
+`);
+  ctx.ui?.write?.("Re-run with --yes and --password-stdin or --generate to apply.\n");
+}
+function printApplied(ctx, out) {
+  ctx.ui?.write?.(`Admin ${out.outcome === "created" ? "created" : "restored"}: ${out.email} (tenant ${out.tenantId})
+`);
+  ctx.ui?.write?.(`  Changes: ${out.repairs?.join(", ")}; all sessions revoked
+`);
+  if (out.generatedPassword) {
+    ctx.ui?.write?.(`  Password: ${out.generatedPassword}
+  Save it now \u2014 it is not shown again.
+`);
+  }
+}
+defineSystemCommand({
+  name: "reset-admin",
+  description: "Recover the tenant admin account (reset password, reactivate, restore role)",
+  longDescription: "Offline recovery of the tenant admin against the platform database: creates the admin if missing, reactivates it, sets a new password, restores the tenant-admin membership and revokes all its sessions. Dry run unless --yes is given. The password is read from stdin (--password-stdin) or generated (--generate); it is never accepted as an argument.",
+  category: "auth",
+  examples: [
+    "kb auth reset-admin",
+    "kb auth reset-admin --generate --yes",
+    'printf %s "$NEW_PASSWORD" | kb auth reset-admin --password-stdin --yes',
+    "kb auth reset-admin --email admin@example.com --tenant acme --generate --yes --json"
+  ],
+  flags: {
+    email: { type: "string", description: "Admin email (default: GATEWAY_BOOTSTRAP_ADMIN_EMAIL or gateway.auth.bootstrap.adminEmail)" },
+    tenant: { type: "string", description: `Tenant id (default: gateway.auth.bootstrap.tenantId, then GATEWAY_BOOTSTRAP_TENANT_ID, else ${DEFAULT_TENANT} \u2014 the gateway's own order)` },
+    "password-stdin": { type: "boolean", description: "Read the new password from stdin" },
+    generate: { type: "boolean", description: "Generate a random password and print it once" },
+    yes: { type: "boolean", description: "Apply the changes (without it this is a dry run)" },
+    force: { type: "boolean", description: "Run even if a gateway is listening on the configured port" },
+    json: { type: "boolean", description: "Output in JSON format" }
+  },
+  async handler(ctx, _argv, flags) {
+    const fail2 = (msg) => {
+      if (flags.json) {
+        ctx.ui?.json({ ok: false, error: msg });
+      } else {
+        ctx.ui?.error?.(msg);
+      }
+      return { ok: false, error: msg };
+    };
+    if (flags["password-stdin"] && flags.generate) {
+      return fail2("Use either --password-stdin or --generate, not both.");
+    }
+    if (flags.yes && !flags["password-stdin"] && !flags.generate) {
+      return fail2("A password source is required to apply: pass --password-stdin or --generate.");
+    }
+    const loaded = await loadPlatformConfig({ startDir: getContextCwd(ctx), loadEnvFile: true });
+    const gw = gatewaySlice(loaded.effectiveConfig ?? loaded.rawConfig ?? loaded.rawPlatformConfig);
+    const email3 = canonicalizeEmail(
+      flags.email ?? process.env.GATEWAY_BOOTSTRAP_ADMIN_EMAIL ?? gw.auth?.bootstrap?.adminEmail ?? ""
+    );
+    if (!email3) {
+      return fail2("Admin email is unknown: pass --email, or set GATEWAY_BOOTSTRAP_ADMIN_EMAIL / gateway.auth.bootstrap.adminEmail.");
+    }
+    const tenantId = flags.tenant ?? gw.auth?.bootstrap?.tenantId ?? process.env.GATEWAY_BOOTSTRAP_TENANT_ID ?? DEFAULT_TENANT;
+    if (!platform.isReal("documentDatabase")) {
+      return fail2(
+        "No persistent documentDatabase is configured for this project, so there is no admin account on disk to recover. Check `adapters.documentDatabase` in .kb/kb.config.json."
+      );
+    }
+    if (!flags.force) {
+      const host = gw.host ?? DEFAULT_GATEWAY_HOST;
+      const port = gw.port ?? DEFAULT_GATEWAY_PORT;
+      if (await isPortListening(host, port)) {
+        return fail2(
+          `A gateway appears to be running on ${host}:${port}. Stop it first (kb-dev stop gateway) so the database is not written concurrently, or pass --force if that is not the gateway.`
+        );
+      }
+    }
+    const docs = platform.documentDatabase;
+    const users = new UsersStore(docs);
+    const credentials = new CredentialsStore(docs);
+    const memberships = new MembershipsStore(docs);
+    const sessions = new SessionsStore(docs, {
+      refreshTtlMs: 0,
+      graceWindowMs: 0
+    });
+    const existing = await users.findByEmailTenant(email3, tenantId);
+    if (!flags.yes) {
+      const repairs = await planRepairs(existing, tenantId, memberships);
+      const dry = {
+        ok: true,
+        dryRun: true,
+        email: email3,
+        tenantId,
+        userId: existing?.userId,
+        outcome: existing ? "reset" : "created",
+        repairs
+      };
+      if (flags.json) {
+        ctx.ui?.json(dry);
+      } else {
+        printDryRun(ctx, existing, dry);
+      }
+      return dry;
+    }
+    const generated = flags.generate ? crypto4.randomBytes(18).toString("base64url") : void 0;
+    const password = generated ?? await readStdin();
+    if (!password) {
+      return fail2("Empty password on stdin.");
+    }
+    const policy = gw.auth?.passwordPolicy;
+    const bcryptCost = gw.auth?.bcryptCost ?? 12;
+    try {
+      const result = await resetAdmin({
+        users,
+        credentials,
+        memberships,
+        sessions,
+        passwordPolicy: createPasswordPolicy({
+          minLength: policy?.minLength ?? 8,
+          maxLength: policy?.maxLength ?? 256,
+          hibpEnabled: policy?.hibpEnabled ?? true
+        }),
+        bcryptCost,
+        tenantId,
+        email: email3,
+        password,
+        logger: {
+          info: (...args) => platform.logger.info(String(args[0]), isRecord3(args[1]) ? args[1] : void 0),
+          warn: (...args) => platform.logger.warn(String(args[0]), isRecord3(args[1]) ? args[1] : void 0)
+        }
+      });
+      const out = {
+        ok: true,
+        dryRun: false,
+        email: result.email,
+        tenantId: result.tenantId,
+        userId: result.userId,
+        outcome: result.outcome,
+        repairs: result.repairs,
+        ...generated ? { generatedPassword: generated } : {}
+      };
+      if (flags.json) {
+        ctx.ui?.json(out);
+      } else {
+        printApplied(ctx, out);
+      }
+      return out;
+    } catch (err) {
+      if (err instanceof ResetAdminError) {
+        return fail2(err.message);
+      }
+      throw err;
+    }
+  }
+});
 function isMode(value) {
   return value === "validate" || value === "reconcile" || value === "auto";
 }