apifm-admin-mcp 26.5.4 → 26.5.5

package/README.md

@@ -1,32 +1,26 @@
 # apifm-admin-mcp
 
-`apifm-admin-mcp` is a stdio MCP server for AI agents that need to operate APIFM admin APIs through the [`apifm-admin`](https://www.npmjs.com/package/apifm-admin) SDK.
+`apifm-admin-mcp` 是一个通过 `apifm-admin` SDK 调用 APIFM 后台接口的 MCP Server，可用于 Kiro、Cursor、Claude Code、Codex、Windsurf、Trae、Qoder 等支持 MCP 的 Agent。
 
-It is designed for Kiro, Cursor, Claude Code, Codex, Windsurf, Trae, Qoder, and other MCP-compatible agents.
+## 安全原则
 
-## Security Model
+密码、商户秘钥、X-Token 等敏感信息不要粘贴到聊天窗口。
 
-Secrets must not be pasted into model chat.
+本 MCP 通过 `apifm_admin_start_auth` 返回一个本机 `127.0.0.1` 授权页面。用户在浏览器里填写敏感信息，信息只保存在当前 MCP 进程内存中，不会作为工具参数发送给大模型。
 
-This MCP exposes `apifm_admin_start_auth`, which returns a one-time localhost URL. The user enters Basic Authentication credentials, an existing `X-Token`, username/password login details, email/password login details, email signup details, or mobile signup details in that local browser page. Those secrets stay in the local MCP process memory and are never part of MCP tool arguments.
+如果尚未授权就调用后台 API，`apifm_admin_call` 和 `apifm_admin_find_and_call` 会直接返回 `authUrl`，Agent 应该立即把这个 URL 展示给用户打开。
 
-If an API call is attempted before authorization, `apifm_admin_call` and `apifm_admin_find_and_call` return the authorization URL directly in both visible text and structured content as `authUrl`. The agent should show that URL immediately instead of asking the user to call another tool.
-
-The API callers reject payloads and headers containing sensitive field names such as `pwd`, `password`, `token`, `x-token`, `authorization`, `secret`, or `key`.
-
-Accounts are in-memory only. Restarting the MCP server clears all tokens and credentials.
-
-## Install
+## 安装
 
 ```bash
 npm install -g apifm-admin-mcp
 ```
 
-The package depends on `apifm-admin` as a normal npm dependency. It does not bundle SDK source code, so newer compatible `apifm-admin` releases can add methods without requiring this MCP package to be regenerated.
+本包依赖 `apifm-admin`，但不会把 SDK 源码打包进 MCP。`apifm-admin` 后续升级新增的方法，会在运行时动态发现。
 
-## MCP Configuration
+## MCP 配置
 
-Use stdio:
+使用 `npx`：
 
 ```json
 {
@@ -39,7 +33,7 @@ Use stdio:
 }
 ```
 
-If installed globally:
+全局安装后：
 
 ```json
 {
@@ -51,28 +45,43 @@ If installed globally:
 }
 ```
 
-## Tools
+## 授权方式
+
+授权页面分为“登录现有账号”和“注册新账号”。
+
+登录现有账号：
+
+- 手机号登录：调用 `loginAdminMobile`，也就是“手机号码登录”方法，成功后取返回的 X-Token 作为后续 API 凭证。
+- 邮箱登录：调用 `loginAdminEmail`，也就是“邮箱登录获取X-TOKEN”方法，成功后取返回的 X-Token 作为后续 API 凭证。
+- 直接填写 X-Token：不调用登录接口，直接把填写的 X-Token 作为后续 API 凭证。
+- Basic Authentication：填写商户号和商户秘钥，后续请求同时写入 `Authentication` 和 `Authorization` 请求头。
+
+注册新账号：
+
+- 邮箱注册：调用邮箱注册保存接口，成功后尝试邮箱登录获取 X-Token。
+- 手机号注册：调用手机号注册保存接口，成功后尝试手机号登录获取 X-Token。
 
-- `apifm_admin_start_auth`: Starts a local secure authorization page. The page separates "Log in" from "Register", supports username login, email login, Basic Auth, X-Token, email registration, and mobile registration. Basic Auth fields are merchant number and merchant key. The page supports Simplified Chinese, Traditional Chinese, and English.
-- `apifm_admin_accounts`: Lists local account aliases without revealing secrets.
-- `apifm_admin_switch_account`: Switches the active account alias.
-- `apifm_admin_remove_account`: Clears an account alias and its in-memory secrets.
-- `apifm_admin_find_and_call`: Searches for the best matching SDK method, calls it, and returns the live backend response in `apiResult`.
-- `apifm_admin_call`: Calls an exact SDK method using the selected local account and returns the live backend response in `apiResult`.
-- `apifm_admin_search_methods`: Planning helper only. Searches methods dynamically from the installed `apifm-admin` SDK, but does not call the API.
-- `apifm_admin_method_info`: Planning helper only. Shows route, method, parameters, and usage for one SDK method, but does not call the API.
+## 工具
 
-For real backend data, agents should call `apifm_admin_find_and_call` or `apifm_admin_call`. The final API response is returned under `apiResult`.
+- `apifm_admin_start_auth`：启动本机授权页面，支持简体中文、繁体中文、英文。
+- `apifm_admin_accounts`：查看当前 MCP 进程内已授权账号，不返回密钥。
+- `apifm_admin_switch_account`：切换当前使用的账号别名。
+- `apifm_admin_remove_account`：删除当前 MCP 进程内保存的账号凭证。
+- `apifm_admin_find_and_call`：按自然语言搜索 SDK 方法并调用，真实接口返回在 `apiResult`。
+- `apifm_admin_call`：按指定 SDK 方法名调用后台 API，真实接口返回在 `apiResult`。
+- `apifm_admin_search_methods`：只搜索 SDK 方法和参数说明，不会调用 API。
+- `apifm_admin_method_info`：只查看某个 SDK 方法说明，不会调用 API。
 
-## Example Agent Flow
+## 使用流程
 
-1. User: "Log in to my admin account and read the user list."
-2. Agent calls `apifm_admin_find_and_call` with `query: "user list"` and a non-sensitive payload such as `{ "page": 1, "pageSize": 20 }`.
-3. If not authorized yet, the tool returns `authUrl` immediately. The user opens that URL and chooses a login method or a registration method.
-4. User completes authorization in the local browser page.
-5. Agent retries the same API call and answers from the returned `apiResult`, not from method documentation.
+1. 用户让 Agent 读取或操作后台数据。
+2. Agent 调用 `apifm_admin_find_and_call` 或 `apifm_admin_call`。
+3. 如果还没授权，工具返回 `authUrl`。
+4. 用户打开 `authUrl`，选择手机号登录、邮箱登录、X-Token 或 Basic Authentication。
+5. 授权成功后，Agent 重新调用刚才的 API。
+6. Agent 使用 `apiResult` 中的真实接口返回回答用户。
 
-## Local Check
+## 本地检查
 
 ```bash
 npm run check

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apifm-admin-mcp",
-  "version": "26.5.4",
+  "version": "26.5.5",
   "description": "MCP server for safely operating APIFM admin APIs through the apifm-admin SDK.",
   "type": "module",
   "bin": {

package/src/browser-auth.js

@@ -10,7 +10,8 @@ const AUTH_TYPES = new Set([
   'all',
   'basic',
   'x-token',
-  'username-password',
+  'password',
+  'mobile-password',
   'email-password',
   'register-email',
   'register-mobile'
@@ -18,7 +19,6 @@ const AUTH_TYPES = new Set([
 
 const OPTIONAL_FIELDS = new Set([
   'alias',
-  'pdomain',
   'imgcode',
   'k',
   'registerName',
@@ -26,9 +26,7 @@ const OPTIONAL_FIELDS = new Set([
   'referrer',
   'agentKey',
   'mailCode',
-  'smsCode',
-  'smsImgCode',
-  'smsK'
+  'smsCode'
 ])
 
 const I18N = {
@@ -46,8 +44,8 @@ const I18N = {
     aliasPh: 'default-admin',
     tabLogin: '登录现有账号',
     tabRegister: '注册新账号',
-    methodUsername: '用户名登录',
-    methodUsernameSub: '用户名 + 密码',
+    methodMobile: '手机号登录',
+    methodMobileSub: '手机号码 + 密码',
     methodEmail: '邮箱登录',
     methodEmailSub: '邮箱 + 密码',
     methodBasic: 'Basic Auth',
@@ -58,18 +56,14 @@ const I18N = {
     methodRegisterEmailSub: '邮箱验证码',
     methodRegisterMobile: '手机号注册',
     methodRegisterMobileSub: '短信验证码',
-    usernameHint: '使用后台用户名和密码登录，MCP 会通过 SDK 换取 X-Token。',
-    emailHint: '使用后台邮箱和密码登录，MCP 会通过 SDK 换取 X-Token。',
-    basicHint: '填写 Basic Authentication 信息，将作为 Authorization 请求头调用后台接口。',
-    tokenHint: '直接填写管理员登录后的 X-Token，用于后续所有后台接口调用。',
-    registerEmailHint: '使用邮箱注册开通新后台账号，提交成功后 MCP 会尝试自动登录。',
-    registerMobileHint: '使用手机号注册开通新后台账号，提交成功后 MCP 会尝试自动登录。',
-    username: '用户名',
-    usernamePh: '请输入后台用户名',
+    mobileHint: '使用后台手机号码和密码登录，MCP 会调用 loginAdminMobile 手机号码登录方法获取 X-Token。',
+    emailHint: '使用后台邮箱和密码登录，MCP 会调用 loginAdminEmail 邮箱登录获取 X-TOKEN 方法。',
+    basicHint: '填写 Basic Authentication 信息，后续请求会写入 Authentication 和 Authorization 请求头。',
+    tokenHint: '直接填写管理员登录后的 X-Token，MCP 会把它作为后续调用后台 API 的凭证。',
+    registerEmailHint: '使用邮箱注册开通新后台账号，提交成功后 MCP 会尝试邮箱登录获取 X-Token。',
+    registerMobileHint: '使用手机号注册开通新后台账号，提交成功后 MCP 会尝试手机号登录获取 X-Token。',
     password: '密码',
     passwordPh: '请输入登录密码',
-    pdomain: '专属域名，可选',
-    pdomainPh: '例如 yourdomain',
     imgcode: '图形验证码，可选',
     imgcodePh: '请输入图形验证码',
     k: '验证码随机数，可选',
@@ -116,8 +110,8 @@ const I18N = {
     aliasPh: 'default-admin',
     tabLogin: '登入現有帳號',
     tabRegister: '註冊新帳號',
-    methodUsername: '使用者名稱登入',
-    methodUsernameSub: '使用者名稱 + 密碼',
+    methodMobile: '手機號登入',
+    methodMobileSub: '手機號碼 + 密碼',
     methodEmail: '郵箱登入',
     methodEmailSub: '郵箱 + 密碼',
     methodBasic: 'Basic Auth',
@@ -128,18 +122,14 @@ const I18N = {
     methodRegisterEmailSub: '郵箱驗證碼',
     methodRegisterMobile: '手機號註冊',
     methodRegisterMobileSub: '簡訊驗證碼',
-    usernameHint: '使用後台使用者名稱和密碼登入，MCP 會透過 SDK 換取 X-Token。',
-    emailHint: '使用後台郵箱和密碼登入，MCP 會透過 SDK 換取 X-Token。',
-    basicHint: '填寫 Basic Authentication 資訊，將作為 Authorization 請求頭呼叫後台介面。',
-    tokenHint: '直接填寫管理員登入後的 X-Token，用於後續所有後台介面呼叫。',
-    registerEmailHint: '使用郵箱註冊開通新後台帳號，提交成功後 MCP 會嘗試自動登入。',
-    registerMobileHint: '使用手機號註冊開通新後台帳號，提交成功後 MCP 會嘗試自動登入。',
-    username: '使用者名稱',
-    usernamePh: '請輸入後台使用者名稱',
+    mobileHint: '使用後台手機號碼和密碼登入，MCP 會呼叫 loginAdminMobile 手機號碼登入方法取得 X-Token。',
+    emailHint: '使用後台郵箱和密碼登入，MCP 會呼叫 loginAdminEmail 郵箱登入取得 X-TOKEN 方法。',
+    basicHint: '填寫 Basic Authentication 資訊，後續請求會寫入 Authentication 和 Authorization 請求頭。',
+    tokenHint: '直接填寫管理員登入後的 X-Token，MCP 會把它作為後續呼叫後台 API 的憑證。',
+    registerEmailHint: '使用郵箱註冊開通新後台帳號，提交成功後 MCP 會嘗試郵箱登入取得 X-Token。',
+    registerMobileHint: '使用手機號註冊開通新後台帳號，提交成功後 MCP 會嘗試手機號登入取得 X-Token。',
     password: '密碼',
     passwordPh: '請輸入登入密碼',
-    pdomain: '專屬網域，可選',
-    pdomainPh: '例如 yourdomain',
     imgcode: '圖形驗證碼，可選',
     imgcodePh: '請輸入圖形驗證碼',
     k: '驗證碼隨機數，可選',
@@ -186,8 +176,8 @@ const I18N = {
     aliasPh: 'default-admin',
     tabLogin: 'Log in',
     tabRegister: 'Register',
-    methodUsername: 'Username login',
-    methodUsernameSub: 'Username + password',
+    methodMobile: 'Mobile login',
+    methodMobileSub: 'Mobile + password',
     methodEmail: 'Email login',
     methodEmailSub: 'Email + password',
     methodBasic: 'Basic Auth',
@@ -198,18 +188,14 @@ const I18N = {
     methodRegisterEmailSub: 'Email code',
     methodRegisterMobile: 'Mobile signup',
     methodRegisterMobileSub: 'SMS code',
-    usernameHint: 'Log in with an admin username and password. The MCP will exchange them for an X-Token through the SDK.',
-    emailHint: 'Log in with an admin email and password. The MCP will exchange them for an X-Token through the SDK.',
-    basicHint: 'Enter Basic Authentication credentials. They will be sent as the Authorization header for API calls.',
-    tokenHint: 'Enter an existing admin X-Token for later backend API calls.',
-    registerEmailHint: 'Create a new admin account by email. After signup, the MCP will try to log in automatically.',
-    registerMobileHint: 'Create a new admin account by mobile. After signup, the MCP will try to log in automatically.',
-    username: 'Username',
-    usernamePh: 'Enter admin username',
+    mobileHint: 'Log in with an admin mobile number and password. The MCP calls the mobile login SDK method to get X-Token.',
+    emailHint: 'Log in with an admin email and password. The MCP calls the email login SDK method to get X-Token.',
+    basicHint: 'Enter Basic Authentication credentials. API calls will include both Authentication and Authorization headers.',
+    tokenHint: 'Enter an existing admin X-Token. The MCP will use it as the credential for later admin API calls.',
+    registerEmailHint: 'Create a new admin account by email. After signup, the MCP will try email login to get X-Token.',
+    registerMobileHint: 'Create a new admin account by mobile. After signup, the MCP will try mobile login to get X-Token.',
     password: 'Password',
     passwordPh: 'Enter login password',
-    pdomain: 'Private domain, optional',
-    pdomainPh: 'Example: yourdomain',
     imgcode: 'Image code, optional',
     imgcodePh: 'Enter image code',
     k: 'Captcha nonce, optional',
@@ -327,7 +313,7 @@ async function finishAuth({ authType, alias, domains, fields }) {
     })
   }
 
-  if (selectedAuthType === 'username-password' || selectedAuthType === 'email-password') {
+  if (selectedAuthType === 'mobile-password' || selectedAuthType === 'email-password') {
     const token = await loginAndExtractToken({ authType: selectedAuthType, domains, fields })
     return upsertAccount({
       alias: fields.alias || alias,
@@ -386,17 +372,6 @@ async function finishAuth({ authType, alias, domains, fields }) {
 
 async function loginAndExtractToken({ authType, domains, fields }) {
   const loginConfig = {
-    'username-password': {
-      methodName: 'loginAdminUserName',
-      payload: {
-        userName: required(fields.loginUsername, 'username'),
-        pwd: required(fields.loginPassword, 'password'),
-        rememberMe: true,
-        pdomain: fields.pdomain || undefined,
-        imgcode: fields.imgcode || undefined,
-        k: fields.k || undefined
-      }
-    },
     'email-password': {
       methodName: 'loginAdminEmail',
       payload: {
@@ -410,11 +385,11 @@ async function loginAndExtractToken({ authType, domains, fields }) {
     'mobile-password': {
       methodName: 'loginAdminMobile',
       payload: {
-        mobile: required(fields.registerMobile, 'mobile'),
-        pwd: required(fields.registerPassword, 'password'),
+        mobile: required(fields.loginMobile || fields.registerMobile, 'mobile'),
+        pwd: required(fields.loginPassword || fields.registerPassword, 'password'),
         rememberMe: true,
-        imgcode: fields.smsImgCode || fields.imgcode || undefined,
-        k: fields.smsK || fields.k || undefined
+        imgcode: fields.imgcode || undefined,
+        k: fields.k || undefined
       }
     }
   }[authType]
@@ -450,7 +425,7 @@ function compactObject(input) {
 }
 
 function normalizeAuthType(authType) {
-  if (authType === 'password') return 'username-password'
+  if (authType === 'password' || authType === 'username-password') return 'mobile-password'
   if (AUTH_TYPES.has(authType)) return authType
   return 'all'
 }
@@ -478,8 +453,7 @@ function extractToken(response) {
     if (typeof value === 'string' && value.trim()) return value.trim()
   }
 
-  const found = findTokenDeep(response)
-  return found || ''
+  return findTokenDeep(response) || ''
 }
 
 function getPath(value, path) {
@@ -500,7 +474,7 @@ function findTokenDeep(value, depth = 0) {
     if (
       typeof child === 'string' &&
       child.trim() &&
-      ['token', 'xtoken', 'xToken', 'xstoken', 'admintoken', 'logintoken'].map((item) => item.toLowerCase()).includes(compactKey)
+      ['token', 'xtoken', 'xstoken', 'admintoken', 'logintoken'].includes(compactKey)
     ) {
       return child.trim()
     }
@@ -563,7 +537,7 @@ function escapeHtml(value) {
 }
 
 function renderForm({ authType, alias, expiresAt }) {
-  const initialType = authType === 'all' ? 'username-password' : authType
+  const initialType = authType === 'all' ? 'mobile-password' : authType
   const initialGroup = initialType.startsWith('register-') ? 'register' : 'login'
   return `<!doctype html>
 <html lang="zh-CN">
@@ -583,7 +557,6 @@ function renderForm({ authType, alias, expiresAt }) {
       --accent: oklch(0.56 0.19 255);
       --accent-ink: oklch(1 0 0);
       --accent-soft: oklch(0.94 0.035 255);
-      --success: oklch(0.58 0.15 155);
     }
     * { box-sizing: border-box; }
     body {
@@ -595,44 +568,11 @@ function renderForm({ authType, alias, expiresAt }) {
         linear-gradient(135deg, var(--bg), oklch(0.955 0.011 230));
       color: var(--ink);
     }
-    .shell {
-      width: min(1120px, calc(100vw - 32px));
-      min-height: 100vh;
-      margin: 0 auto;
-      display: grid;
-      place-items: center;
-      padding: 28px 0;
-    }
-    .panel {
-      width: 100%;
-      display: grid;
-      grid-template-columns: minmax(280px, 0.78fr) minmax(340px, 1.22fr);
-      background: var(--surface);
-      border: 1px solid var(--line);
-      border-radius: 16px;
-      overflow: hidden;
-      box-shadow: 0 8px 28px oklch(0.25 0.02 255 / 0.12);
-    }
-    .aside {
-      padding: 34px;
-      background: linear-gradient(180deg, oklch(0.26 0.07 255), oklch(0.19 0.04 255));
-      color: white;
-      display: flex;
-      flex-direction: column;
-      justify-content: space-between;
-      gap: 32px;
-    }
+    .shell { width: min(1120px, calc(100vw - 32px)); min-height: 100vh; margin: 0 auto; display: grid; place-items: center; padding: 28px 0; }
+    .panel { width: 100%; display: grid; grid-template-columns: minmax(280px, 0.78fr) minmax(340px, 1.22fr); background: var(--surface); border: 1px solid var(--line); border-radius: 16px; overflow: hidden; box-shadow: 0 8px 28px oklch(0.25 0.02 255 / 0.12); }
+    .aside { padding: 34px; background: linear-gradient(180deg, oklch(0.26 0.07 255), oklch(0.19 0.04 255)); color: white; display: flex; flex-direction: column; justify-content: space-between; gap: 32px; }
     .brand { display: flex; align-items: center; gap: 12px; font-weight: 760; }
-    .mark {
-      width: 38px;
-      height: 38px;
-      display: grid;
-      place-items: center;
-      border-radius: 10px;
-      background: oklch(0.74 0.16 210);
-      color: oklch(0.18 0.04 255);
-      font-weight: 850;
-    }
+    .mark { width: 38px; height: 38px; display: grid; place-items: center; border-radius: 10px; background: oklch(0.74 0.16 210); color: oklch(0.18 0.04 255); font-weight: 850; }
     h1 { margin: 28px 0 12px; font-size: 2rem; line-height: 1.12; text-wrap: balance; letter-spacing: 0; }
     .lead { margin: 0; color: oklch(0.88 0.018 250); max-width: 48ch; }
     .trust { display: grid; gap: 10px; margin: 28px 0 0; padding: 0; list-style: none; }
@@ -641,41 +581,14 @@ function renderForm({ authType, alias, expiresAt }) {
     .content { padding: 30px; }
     .topbar { display: flex; justify-content: space-between; align-items: center; gap: 16px; margin-bottom: 20px; }
     .meta { color: var(--muted); font-size: 0.92rem; }
-    .lang, .tabs {
-      display: inline-grid;
-      grid-auto-flow: column;
-      gap: 4px;
-      padding: 4px;
-      background: var(--surface-2);
-      border: 1px solid var(--line);
-      border-radius: 999px;
-    }
-    .lang button, .tabs button, .method button {
-      appearance: none;
-      border: 0;
-      font: inherit;
-      cursor: pointer;
-    }
+    .lang, .tabs { display: inline-grid; grid-auto-flow: column; gap: 4px; padding: 4px; background: var(--surface-2); border: 1px solid var(--line); border-radius: 999px; }
+    .lang button, .tabs button, .method button { appearance: none; border: 0; font: inherit; cursor: pointer; }
     .lang button, .tabs button { padding: 7px 12px; border-radius: 999px; color: var(--muted); background: transparent; }
     .lang button[aria-pressed="true"], .tabs button[aria-pressed="true"] { background: var(--ink); color: white; }
     .tabs { margin-bottom: 14px; }
-    .method {
-      display: grid;
-      grid-template-columns: repeat(4, minmax(0, 1fr));
-      gap: 8px;
-      margin-bottom: 22px;
-    }
+    .method { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 8px; margin-bottom: 22px; }
     .method[data-group="register"] { grid-template-columns: repeat(2, minmax(0, 1fr)); }
-    .method button {
-      min-height: 62px;
-      padding: 10px;
-      border: 1px solid var(--line);
-      border-radius: 10px;
-      background: var(--surface-2);
-      color: var(--ink);
-      text-align: left;
-      transition: border-color 160ms ease, background 160ms ease, transform 160ms ease;
-    }
+    .method button { min-height: 62px; padding: 10px; border: 1px solid var(--line); border-radius: 10px; background: var(--surface-2); color: var(--ink); text-align: left; transition: border-color 160ms ease, background 160ms ease, transform 160ms ease; }
     .method button:hover { border-color: oklch(0.72 0.04 255); transform: translateY(-1px); }
     .method button[aria-pressed="true"] { border-color: var(--accent); background: var(--accent-soft); }
     .method strong { display: block; font-size: 0.92rem; line-height: 1.2; }
@@ -684,67 +597,20 @@ function renderForm({ authType, alias, expiresAt }) {
     .grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 14px; }
     .field { display: grid; gap: 7px; }
     label { color: var(--ink); font-weight: 660; }
-    input {
-      width: 100%;
-      min-height: 44px;
-      padding: 10px 12px;
-      border: 1px solid var(--line);
-      border-radius: 8px;
-      background: white;
-      color: var(--ink);
-      font: inherit;
-      outline: none;
-      transition: border-color 160ms ease, box-shadow 160ms ease;
-    }
+    input { width: 100%; min-height: 44px; padding: 10px 12px; border: 1px solid var(--line); border-radius: 8px; background: white; color: var(--ink); font: inherit; outline: none; transition: border-color 160ms ease, box-shadow 160ms ease; }
     input::placeholder { color: oklch(0.48 0.025 255); }
     input:focus { border-color: var(--accent); box-shadow: 0 0 0 3px oklch(0.62 0.16 255 / 0.18); }
-    .section {
-      display: none;
-      padding: 18px;
-      border: 1px solid var(--line);
-      border-radius: 12px;
-      background: var(--surface-2);
-    }
+    .section { display: none; padding: 18px; border: 1px solid var(--line); border-radius: 12px; background: var(--surface-2); }
     .section.active { display: block; }
     .section-head { margin: 0 0 14px; color: var(--muted); }
-    .submit {
-      min-height: 46px;
-      border: 0;
-      border-radius: 8px;
-      background: var(--accent);
-      color: var(--accent-ink);
-      font: inherit;
-      font-weight: 760;
-      cursor: pointer;
-      transition: transform 160ms ease, filter 160ms ease;
-    }
+    .submit { min-height: 46px; border: 0; border-radius: 8px; background: var(--accent); color: var(--accent-ink); font: inherit; font-weight: 760; cursor: pointer; transition: transform 160ms ease, filter 160ms ease; }
     .submit:hover { filter: brightness(1.03); transform: translateY(-1px); }
     .note { margin: 12px 0 0; color: var(--muted); font-size: 0.9rem; }
-    .security {
-      margin-top: 20px;
-      padding: 12px 14px;
-      border-radius: 10px;
-      background: oklch(0.96 0.025 155);
-      color: oklch(0.31 0.07 155);
-      font-size: 0.9rem;
-    }
+    .security { margin-top: 20px; padding: 12px 14px; border-radius: 10px; background: oklch(0.96 0.025 155); color: oklch(0.31 0.07 155); font-size: 0.9rem; }
     [hidden] { display: none !important; }
-    @media (max-width: 900px) {
-      .panel { grid-template-columns: 1fr; }
-      .aside { padding: 26px; }
-      .method { grid-template-columns: repeat(2, minmax(0, 1fr)); }
-      .grid { grid-template-columns: 1fr; }
-    }
-    @media (max-width: 520px) {
-      .shell { width: min(100vw - 20px, 1120px); padding: 10px 0; }
-      .content { padding: 20px; }
-      .topbar { align-items: flex-start; flex-direction: column; }
-      .method, .method[data-group="register"] { grid-template-columns: 1fr; }
-      h1 { font-size: 1.55rem; }
-    }
-    @media (prefers-reduced-motion: reduce) {
-      *, *::before, *::after { transition-duration: 0.01ms !important; animation-duration: 0.01ms !important; }
-    }
+    @media (max-width: 900px) { .panel { grid-template-columns: 1fr; } .aside { padding: 26px; } .method { grid-template-columns: repeat(2, minmax(0, 1fr)); } .grid { grid-template-columns: 1fr; } }
+    @media (max-width: 520px) { .shell { width: min(100vw - 20px, 1120px); padding: 10px 0; } .content { padding: 20px; } .topbar { align-items: flex-start; flex-direction: column; } .method, .method[data-group="register"] { grid-template-columns: 1fr; } h1 { font-size: 1.55rem; } }
+    @media (prefers-reduced-motion: reduce) { *, *::before, *::after { transition-duration: 0.01ms !important; animation-duration: 0.01ms !important; } }
   </style>
 </head>
 <body>
@@ -775,14 +641,12 @@ function renderForm({ authType, alias, expiresAt }) {
           <button type="button" data-lang="en" aria-pressed="false">EN</button>
         </div>
       </div>
-
       <div class="tabs" role="tablist" aria-label="Account mode">
         <button type="button" data-group-tab="login" aria-pressed="${initialGroup === 'login'}" data-i18n="tabLogin"></button>
         <button type="button" data-group-tab="register" aria-pressed="${initialGroup === 'register'}" data-i18n="tabRegister"></button>
       </div>
-
       <div class="method" data-group="login">
-        ${renderMethodButton('username-password', initialType)}
+        ${renderMethodButton('mobile-password', initialType)}
         ${renderMethodButton('email-password', initialType)}
         ${renderMethodButton('basic', initialType)}
         ${renderMethodButton('x-token', initialType)}
@@ -791,16 +655,13 @@ function renderForm({ authType, alias, expiresAt }) {
         ${renderMethodButton('register-email', initialType)}
         ${renderMethodButton('register-mobile', initialType)}
       </div>
-
       <form method="post" autocomplete="off" id="authForm">
         <input type="hidden" id="authType" name="authType" value="${escapeHtml(initialType)}">
         <div class="field">
           <label for="alias" data-i18n="alias"></label>
           <input id="alias" name="alias" value="${escapeHtml(alias)}" data-i18n-placeholder="aliasPh">
         </div>
-
         ${renderSections()}
-
         <button class="submit" type="submit" data-i18n="submit"></button>
       </form>
       <div class="security" data-i18n="security"></div>
@@ -812,7 +673,7 @@ function renderForm({ authType, alias, expiresAt }) {
   const messages = ${JSON.stringify(I18N)}
   const initialType = ${JSON.stringify(initialType)}
   const methodGroups = {
-    'username-password': 'login',
+    'mobile-password': 'login',
     'email-password': 'login',
     basic: 'login',
     'x-token': 'login',
@@ -821,53 +682,36 @@ function renderForm({ authType, alias, expiresAt }) {
   }
   const optionalFields = new Set(${JSON.stringify([...OPTIONAL_FIELDS])})
   let activeLang = localStorage.getItem('apifm-auth-lang') || 'zh-CN'
-
   const authTypeInput = document.querySelector('#authType')
   const sections = [...document.querySelectorAll('[data-section]')]
   const methodButtons = [...document.querySelectorAll('[data-method]')]
   const groupTabs = [...document.querySelectorAll('[data-group-tab]')]
   const methodGroupsEl = [...document.querySelectorAll('.method[data-group]')]
   const langButtons = [...document.querySelectorAll('[data-lang]')]
-
-  function t(key) {
-    return messages[activeLang][key] || messages['zh-CN'][key] || key
-  }
-
+  function t(key) { return messages[activeLang][key] || messages['zh-CN'][key] || key }
   function setLang(lang) {
     activeLang = messages[lang] ? lang : 'zh-CN'
     localStorage.setItem('apifm-auth-lang', activeLang)
     document.documentElement.lang = activeLang
-    document.querySelectorAll('[data-i18n]').forEach((node) => {
-      node.textContent = t(node.dataset.i18n)
-    })
-    document.querySelectorAll('[data-i18n-placeholder]').forEach((node) => {
-      node.placeholder = t(node.dataset.i18nPlaceholder)
-    })
-    langButtons.forEach((button) => {
-      button.setAttribute('aria-pressed', String(button.dataset.lang === activeLang))
-    })
+    document.querySelectorAll('[data-i18n]').forEach((node) => { node.textContent = t(node.dataset.i18n) })
+    document.querySelectorAll('[data-i18n-placeholder]').forEach((node) => { node.placeholder = t(node.dataset.i18nPlaceholder) })
+    langButtons.forEach((button) => button.setAttribute('aria-pressed', String(button.dataset.lang === activeLang)))
   }
-
   function setGroup(group) {
     groupTabs.forEach((button) => button.setAttribute('aria-pressed', String(button.dataset.groupTab === group)))
-    methodGroupsEl.forEach((node) => {
-      node.hidden = node.dataset.group !== group
-    })
+    methodGroupsEl.forEach((node) => { node.hidden = node.dataset.group !== group })
     const currentMethod = authTypeInput.value
     if (methodGroups[currentMethod] !== group) {
       const firstMethod = methodButtons.find((button) => methodGroups[button.dataset.method] === group)?.dataset.method
       setMethod(firstMethod)
     }
   }
-
   function setMethod(method) {
     if (!method) return
     authTypeInput.value = method
     const group = methodGroups[method]
     groupTabs.forEach((button) => button.setAttribute('aria-pressed', String(button.dataset.groupTab === group)))
-    methodGroupsEl.forEach((node) => {
-      node.hidden = node.dataset.group !== group
-    })
+    methodGroupsEl.forEach((node) => { node.hidden = node.dataset.group !== group })
     sections.forEach((section) => {
       const active = section.dataset.section === method
       section.classList.toggle('active', active)
@@ -876,11 +720,8 @@ function renderForm({ authType, alias, expiresAt }) {
         input.required = active && !optionalFields.has(input.name)
       })
     })
-    methodButtons.forEach((button) => {
-      button.setAttribute('aria-pressed', String(button.dataset.method === method))
-    })
+    methodButtons.forEach((button) => button.setAttribute('aria-pressed', String(button.dataset.method === method)))
   }
-
   methodButtons.forEach((button) => button.addEventListener('click', () => setMethod(button.dataset.method)))
   groupTabs.forEach((button) => button.addEventListener('click', () => setGroup(button.dataset.groupTab)))
   langButtons.forEach((button) => button.addEventListener('click', () => setLang(button.dataset.lang)))
@@ -893,17 +734,15 @@ function renderForm({ authType, alias, expiresAt }) {
 
 function renderSections() {
   return `
-    <section class="section" data-section="username-password">
-      <p class="section-head" data-i18n="usernameHint"></p>
+    <section class="section" data-section="mobile-password">
+      <p class="section-head" data-i18n="mobileHint"></p>
       <div class="grid">
-        ${field('loginUsername', 'loginUsername', 'username', 'usernamePh')}
-        ${field('loginPasswordUser', 'loginPassword', 'password', 'passwordPh', 'password')}
-        ${field('pdomain', 'pdomain', 'pdomain', 'pdomainPh')}
-        ${field('imgcode', 'imgcode', 'imgcode', 'imgcodePh')}
-        ${field('k', 'k', 'k', 'kPh')}
+        ${field('loginMobile', 'loginMobile', 'mobile', 'mobilePh', 'tel')}
+        ${field('loginPasswordMobile', 'loginPassword', 'password', 'passwordPh', 'password')}
+        ${field('imgcodeMobile', 'imgcode', 'imgcode', 'imgcodePh')}
+        ${field('kMobile', 'k', 'k', 'kPh')}
       </div>
     </section>
-
     <section class="section" data-section="email-password">
       <p class="section-head" data-i18n="emailHint"></p>
       <div class="grid">
@@ -913,7 +752,6 @@ function renderSections() {
         ${field('kEmail', 'k', 'k', 'kPh')}
       </div>
     </section>
-
     <section class="section" data-section="basic">
       <p class="section-head" data-i18n="basicHint"></p>
       <div class="grid">
@@ -921,12 +759,10 @@ function renderSections() {
         ${field('basicPassword', 'basicPassword', 'merchantKey', 'merchantKeyPh', 'password')}
       </div>
     </section>
-
     <section class="section" data-section="x-token">
       <p class="section-head" data-i18n="tokenHint"></p>
       ${field('xToken', 'xToken', 'xToken', 'xTokenPh', 'password')}
     </section>
-
     <section class="section" data-section="register-email">
       <p class="section-head" data-i18n="registerEmailHint"></p>
       <div class="grid">
@@ -937,7 +773,6 @@ function renderSections() {
         ${field('referrerEmail', 'referrer', 'referrer', 'referrerPh')}
       </div>
     </section>
-
     <section class="section" data-section="register-mobile">
       <p class="section-head" data-i18n="registerMobileHint"></p>
       <div class="grid">
@@ -948,8 +783,6 @@ function renderSections() {
         ${field('registerType', 'registerType', 'type', 'typePh')}
         ${field('referrerMobile', 'referrer', 'referrer', 'referrerPh')}
         ${field('agentKey', 'agentKey', 'agentKey', 'agentKeyPh')}
-        ${field('smsImgCode', 'smsImgCode', 'imgcode', 'imgcodePh')}
-        ${field('smsK', 'smsK', 'k', 'kPh')}
       </div>
     </section>`
 }
@@ -963,7 +796,7 @@ function field(id, name, labelKey, placeholderKey, type = 'text') {
 
 function renderMethodButton(method, activeType) {
   const keys = {
-    'username-password': ['methodUsername', 'methodUsernameSub'],
+    'mobile-password': ['methodMobile', 'methodMobileSub'],
     'email-password': ['methodEmail', 'methodEmailSub'],
     basic: ['methodBasic', 'methodBasicSub'],
     'x-token': ['methodToken', 'methodTokenSub'],

package/src/index.js

@@ -21,7 +21,7 @@ import {
   summarizeMetadata
 } from './sdk.js'
 
-const VERSION = '26.5.4'
+const VERSION = '26.5.5'
 
 const server = new McpServer(
   {
@@ -44,13 +44,13 @@ server.registerTool(
   {
     title: 'Start secure APIFM admin authorization',
     description:
-      'Creates a localhost browser page for login, Basic Auth, X-Token, email registration, or mobile registration. Secrets are stored only in this MCP process memory and must not be pasted into chat.',
+      'Creates a localhost browser page for mobile login, email login, Basic Auth, X-Token, email registration, or mobile registration. Secrets are stored only in this MCP process memory and must not be pasted into chat.',
     inputSchema: z.object({
       authType: z
-        .enum(['all', 'basic', 'x-token', 'password', 'username-password', 'email-password', 'register-email', 'register-mobile'])
+        .enum(['all', 'basic', 'x-token', 'password', 'mobile-password', 'email-password', 'register-email', 'register-mobile'])
         .optional()
         .describe(
-          'Optional initial auth method. all shows every method in one browser page. basic = Basic Authentication, x-token = existing admin X-Token, username-password/email-password = SDK login, register-email/register-mobile = create admin account.'
+          'Optional initial auth method. all shows every method in one browser page. basic = Basic Authentication, x-token = existing admin X-Token, mobile-password/email-password = SDK login, register-email/register-mobile = create admin account.'
         ),
       alias: z.string().optional().describe('Friendly local account alias, for example prod or test-shop.'),
       domains: z
@@ -304,6 +304,7 @@ async function callToolResult({
   const sdkHeaders = { ...headers }
   if (account.basicAuth) {
     sdkHeaders.Authorization = account.basicAuth
+    sdkHeaders.Authentication = account.basicAuth
   }
 
   sdk.setConfig({

package/src/self-check.js

@@ -47,16 +47,22 @@ try {
     'data-lang="en"',
     'data-group-tab="login"',
     'data-group-tab="register"',
+    'data-method="mobile-password"',
     'data-method="basic"',
     'data-method="x-token"',
     'data-method="register-mobile"',
     'merchantNo',
-    'merchantKey'
+    'merchantKey',
+    'loginAdminMobile',
+    'Authentication'
   ]) {
     if (!authPage.includes(expected)) {
       throw new Error(`Authorization page is missing ${expected}.`)
     }
   }
+  if (authPage.includes('data-method="username-password"')) {
+    throw new Error('Authorization page must not expose username-password login.')
+  }
 
   const mobileAuth = await client.callTool({
     name: 'apifm_admin_start_auth',