creatorverse-cli 0.0.0-stage → 1.0.1

package/dist/creatorverse-admin.js

@@ -0,0 +1,678 @@
+#!/usr/bin/env node
+/**
+ * CreatorVerse Admin CLI — Stage E1.2 & E1.3 Controlled Admin CLI Integration
+ *
+ * Secure Administrative Command-Line Interface connecting to:
+ * - /api/admin/cli-session (POST)
+ * - /api/admin/cli-session/verify (GET)
+ * - /api/admin/cli-session/revoke (POST)
+ * - /api/admin/cli-session/audit-logs (GET)
+ * - /api/cli/auth/exchange (POST)
+ *
+ * Security Guardrails:
+ * 1. ADMIN_CLI_PRODUCTION_ENABLED = false: Disables live production execution pending verified browser auth.
+ * 2. Mandatory MFA interactive masking / Browser MFA: TOTP codes are entered privately without exposure in shell history, argv, or process listings.
+ * 3. Server-authoritative privilege checks: Local tokens/roles/permissions are never trusted; backend enforces RBAC, device binding, and revocation.
+ * 4. AES-256-GCM encrypted credential vault with strict 0o600 file / 0o700 directory permissions.
+ * 5. Safe network timeouts (5000ms AbortController) and fail-closed handling on network or authentication failure.
+ * 6. Total isolation between production and offline test mode (retaining 100% backward compatibility for existing suites).
+ */
+import path from 'path';
+import os from 'os';
+import readline from 'readline';
+import { saveSecureSession, loadSecureSession, clearSecureSession, redactSensitiveData } from './credentialManager.js';
+import { startLoopbackListener, generatePkcePair } from './loopbackListener.js';
+export const VERSION = '1.0.1';
+export const CONFIG_DIR = path.join(os.homedir(), '.creatorverse');
+export const ADMIN_CONFIG_FILE = path.join(CONFIG_DIR, 'admin-auth-secure.enc');
+// Production Gate: CLI disabled for live production access pending verified browser auth flow
+export const ADMIN_CLI_PRODUCTION_ENABLED = false;
+export function getStoredAdminSession() {
+    const session = loadSecureSession(ADMIN_CONFIG_FILE);
+    if (session && session.expiresAt && Date.now() > session.expiresAt) {
+        return null;
+    }
+    return session;
+}
+export async function fetchWithTimeout(url, options, timeoutMs = 5000) {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(url, { ...options, signal: controller.signal });
+        clearTimeout(timeoutId);
+        return res;
+    }
+    catch (err) {
+        clearTimeout(timeoutId);
+        if (err.name === 'AbortError') {
+            const timeoutErr = new Error(`Network timeout: server failed to respond within ${timeoutMs}ms.`);
+            timeoutErr.code = 'NETWORK_TIMEOUT';
+            throw timeoutErr;
+        }
+        const netErr = new Error(`Network error connecting to administrative endpoint: ${err.message}`);
+        netErr.code = 'SERVICE_UNAVAILABLE';
+        throw netErr;
+    }
+}
+export async function promptMfaInteractive(providedCode, isTestMode = false) {
+    if (providedCode) {
+        if (!isTestMode) {
+            throw new Error('MFA_ARGV_DISALLOWED: Passing MFA codes via command line flags outside explicit test mode is prohibited to prevent exposure in shell history and process tables.');
+        }
+        return providedCode.trim();
+    }
+    return new Promise((resolve, reject) => {
+        if (!process.stdin.isTTY) {
+            let input = '';
+            process.stdin.setEncoding('utf-8');
+            process.stdin.on('data', (chunk) => {
+                input += chunk;
+            });
+            process.stdin.on('end', () => {
+                resolve(input.trim());
+            });
+            process.stdin.on('error', reject);
+            return;
+        }
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+            terminal: true,
+        });
+        process.stdout.write('Enter Multi-Factor Authentication (TOTP) code: ');
+        rl._writeToOutput = function _writeToOutput(stringToWrite) {
+            if (stringToWrite.charCodeAt(0) === 13 || stringToWrite.charCodeAt(0) === 10) {
+                process.stdout.write('\n');
+            }
+            else {
+                process.stdout.write('*');
+            }
+        };
+        rl.question('', (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+export function validateEnvironmentSecurity(options) {
+    const effectiveApiUrl = options.apiUrl || process.env.CREATORVERSE_API_URL || 'http://localhost:3000';
+    const isProdEnv = process.env.CREATORVERSE_PRODUCTION === 'true' ||
+        process.env.NODE_ENV === 'production' ||
+        effectiveApiUrl.includes('api.creatorverse.network') ||
+        effectiveApiUrl.includes('creatorverse.network');
+    if (isProdEnv) {
+        if (options.isOffline) {
+            const err = new Error('Offline test mode and mock credentials cannot be used in production environments.');
+            err.code = 'OFFLINE_MODE_PROHIBITED_IN_PRODUCTION';
+            throw err;
+        }
+        if (options.token) {
+            const err = new Error('Direct-token authentication is strictly prohibited in production mode. Interactive browser-based authentication with MFA is required.');
+            err.code = 'DIRECT_TOKEN_LOGIN_PROHIBITED';
+            throw err;
+        }
+        if (!ADMIN_CLI_PRODUCTION_ENABLED) {
+            const err = new Error('CreatorVerse Admin CLI production access is disabled pending verified browser-based authentication flow. Use local or staging development environment.');
+            err.code = 'PRODUCTION_ACCESS_PENDING';
+            throw err;
+        }
+        if (effectiveApiUrl.startsWith('http://')) {
+            const err = new Error('Insecure HTTP connection is strictly forbidden in production mode. Use verified HTTPS.');
+            err.code = 'INSECURE_PROTOCOL_REJECTED';
+            throw err;
+        }
+        if (options.mfaCode === '123456' || options.mfaCode === 'valid-mfa') {
+            const err = new Error('Mock tokens and hardcoded test MFA codes are strictly forbidden in production-facing execution paths.');
+            err.code = 'TEST_CREDENTIALS_REJECTED_IN_PRODUCTION';
+            throw err;
+        }
+    }
+}
+export async function executeAdminLogin(options) {
+    validateEnvironmentSecurity(options);
+    const effectiveApiUrl = options.apiUrl || process.env.CREATORVERSE_API_URL || 'http://localhost:3000';
+    const isTestMode = options.isTestMode ?? (process.env.CREATORVERSE_TEST_MODE === '1' || process.env.NODE_ENV === 'test');
+    const isRemote = options.isRemote || Boolean(options.apiUrl) || Boolean(process.env.CREATORVERSE_API_URL) || process.env.CREATORVERSE_REMOTE === '1' || Boolean(options.isBrowser);
+    const isOffline = options.isOffline || (!isRemote && !options.isBrowser);
+    const timeoutMs = options.timeoutMs || 5000;
+    const token = options.token || 'mock-admin-token-secure';
+    const email = options.email || 'admin@creatorverse.local';
+    const uid = 'admin-uid-999';
+    const role = options.role || 'admin';
+    const deviceId = options.deviceId !== undefined ? options.deviceId : 'default-device-id';
+    const deviceName = options.deviceName || 'Admin Workstation';
+    // 1. Browser-Assisted PKCE Login Flow
+    if (options.isBrowser) {
+        const { codeVerifier, codeChallenge, state } = generatePkcePair();
+        const listener = await startLoopbackListener(state, 120000);
+        const authUrl = `${effectiveApiUrl}/cli-auth?port=${listener.port}&state=${state}&code_challenge=${codeChallenge}&client_type=admin&device_id=${encodeURIComponent(deviceId)}`;
+        let ticket = '';
+        try {
+            if (process.stdout.isTTY) {
+                console.log(`\nOpen the following URL in your browser to complete administrator authentication & MFA:\n\n  ${authUrl}\n`);
+                console.log(`Waiting for browser callback on 127.0.0.1:${listener.port} (timeout: 120s)...`);
+            }
+            ticket = await listener.waitForCallback();
+        }
+        catch (err) {
+            listener.shutdown();
+            throw err;
+        }
+        const exchangeRes = await fetchWithTimeout(`${effectiveApiUrl}/api/cli/auth/exchange`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'User-Agent': `CreatorVerse-Admin-CLI/${VERSION}`
+            },
+            body: JSON.stringify({ ticket, codeVerifier, state }),
+        }, timeoutMs);
+        const resJson = await exchangeRes.json();
+        if (!exchangeRes.ok || !resJson.success) {
+            const err = new Error(resJson.error || 'Administrative ticket exchange failed.');
+            err.code = resJson.code || 'EXCHANGE_FAILED';
+            throw err;
+        }
+        const sessionRecord = {
+            sessionId: resJson.sessionId,
+            sessionToken: resJson.sessionToken,
+            token: resJson.sessionToken,
+            uid: resJson.uid,
+            email: resJson.email,
+            role: resJson.role,
+            permissions: resJson.permissions,
+            deviceId: resJson.deviceId,
+            apiUrl: effectiveApiUrl,
+            mfaVerified: true,
+            expiresAt: Date.now() + (resJson.expiresInSeconds * 1000)
+        };
+        saveSecureSession(ADMIN_CONFIG_FILE, sessionRecord);
+        return redactSensitiveData({
+            status: 'SUCCESS',
+            message: 'Admin session authenticated and registered via browser PKCE authorization.',
+            sessionId: resJson.sessionId,
+            uid: resJson.uid,
+            email: resJson.email,
+            role: resJson.role,
+            mfaVerified: true,
+            token: resJson.sessionToken,
+            expiresInSeconds: resJson.expiresInSeconds
+        });
+    }
+    // 2. Direct Remote Session Issuance
+    if (isRemote && !isOffline) {
+        let mfaCode = '';
+        mfaCode = await promptMfaInteractive(options.mfaCode, isTestMode);
+        if (!mfaCode) {
+            const err = new Error('Administrative authentication requires valid Multi-Factor Authentication.');
+            err.code = 'MFA_REQUIRED';
+            throw err;
+        }
+        const response = await fetchWithTimeout(`${effectiveApiUrl}/api/admin/cli-session`, {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${token}`,
+                'Content-Type': 'application/json',
+                'User-Agent': `CreatorVerse-Admin-CLI/${VERSION}`
+            },
+            body: JSON.stringify({ mfaCode, deviceId, deviceName }),
+        }, timeoutMs);
+        const resJson = await response.json();
+        if (!response.ok || !resJson.success) {
+            const err = new Error(resJson.error || 'Administrative session issuance failed.');
+            err.code = resJson.code || 'AUTHENTICATION_FAILED';
+            throw err;
+        }
+        const sessionRecord = {
+            sessionId: resJson.sessionId,
+            sessionToken: resJson.sessionToken,
+            token: resJson.sessionToken,
+            uid: resJson.uid,
+            email: resJson.email,
+            role: resJson.role,
+            permissions: resJson.permissions,
+            deviceId: resJson.deviceId,
+            apiUrl: effectiveApiUrl,
+            mfaVerified: true,
+            expiresAt: Date.now() + (resJson.expiresInSeconds * 1000)
+        };
+        saveSecureSession(ADMIN_CONFIG_FILE, sessionRecord);
+        return redactSensitiveData({
+            status: 'SUCCESS',
+            message: 'Admin session authenticated and registered via secure administrative session service.',
+            sessionId: resJson.sessionId,
+            uid: resJson.uid,
+            email: resJson.email,
+            role: resJson.role,
+            mfaVerified: true,
+            token: resJson.sessionToken,
+            expiresInSeconds: resJson.expiresInSeconds
+        });
+    }
+    else {
+        // 3. Offline / Sandbox mode
+        let mfaProvided = false;
+        if (options.mfaCode) {
+            if (isTestMode && (options.mfaCode === '123456' || options.mfaCode === 'valid-mfa')) {
+                mfaProvided = true;
+            }
+            else {
+                mfaProvided = false;
+            }
+        }
+        if (!mfaProvided) {
+            const err = new Error('Administrative authentication requires valid Multi-Factor Authentication. Hardcoded test codes are disabled outside explicit test mode.');
+            err.code = 'MFA_REQUIRED';
+            throw err;
+        }
+        if (role !== 'admin' && role !== 'platform-owner' && role !== 'approved-developer') {
+            const err = new Error('Insufficient privileges. Admin role verification failed.');
+            err.code = 'FORBIDDEN';
+            throw err;
+        }
+        const session = {
+            token,
+            uid,
+            email,
+            role,
+            mfaVerified: true,
+            deviceId,
+            expiresAt: Date.now() + 1800 * 1000
+        };
+        saveSecureSession(ADMIN_CONFIG_FILE, session);
+        return redactSensitiveData({
+            status: 'SUCCESS',
+            message: 'Admin session authenticated with strict MFA verification and encrypted vault storage.',
+            uid: session.uid,
+            email: session.email,
+            role: session.role,
+            mfaVerified: true,
+            token: session.token,
+            expiresInSeconds: 1800
+        });
+    }
+}
+export async function executeAdminLogout(options = {}) {
+    const session = loadSecureSession(ADMIN_CONFIG_FILE);
+    const effectiveApiUrl = options.apiUrl || session?.apiUrl || process.env.CREATORVERSE_API_URL || 'http://localhost:3000';
+    const isRemote = options.isRemote || Boolean(options.apiUrl) || Boolean(session?.apiUrl);
+    const timeoutMs = options.timeoutMs || 5000;
+    if (session && (session.sessionToken || session.token) && isRemote && !options.isOffline) {
+        try {
+            await fetchWithTimeout(`${effectiveApiUrl}/api/admin/cli-session/revoke`, {
+                method: 'POST',
+                headers: {
+                    'Authorization': `Bearer ${session.sessionToken || session.token}`,
+                    'Content-Type': 'application/json',
+                    'User-Agent': `CreatorVerse-Admin-CLI/${VERSION}`
+                },
+                body: JSON.stringify({ sessionToken: session.sessionToken || session.token })
+            }, timeoutMs);
+        }
+        catch {
+            // Local vault is always cleared regardless of remote network status
+        }
+    }
+    clearSecureSession(ADMIN_CONFIG_FILE);
+    return {
+        status: 'SUCCESS',
+        message: 'Admin session revoked and encrypted vault cleared.'
+    };
+}
+export async function executeAdminWhoami(options = {}) {
+    const session = getStoredAdminSession();
+    if (!session || !session.mfaVerified) {
+        const err = new Error('Active admin session with MFA verification required. Run "creatorverse-admin login".');
+        err.code = 'UNAUTHORIZED';
+        throw err;
+    }
+    const effectiveApiUrl = options.apiUrl || session.apiUrl || process.env.CREATORVERSE_API_URL || 'http://localhost:3000';
+    const isRemote = options.isRemote || Boolean(options.apiUrl) || Boolean(session.apiUrl);
+    const timeoutMs = options.timeoutMs || 5000;
+    if (isRemote && !options.isOffline) {
+        const response = await fetchWithTimeout(`${effectiveApiUrl}/api/admin/cli-session/verify`, {
+            method: 'GET',
+            headers: {
+                'Authorization': `Bearer ${session.sessionToken || session.token}`,
+                'User-Agent': `CreatorVerse-Admin-CLI/${VERSION}`
+            }
+        }, timeoutMs);
+        const data = await response.json();
+        if (!response.ok || !data.valid) {
+            clearSecureSession(ADMIN_CONFIG_FILE);
+            const err = new Error(data.error || 'Admin session is invalid, expired or revoked on the server.');
+            err.code = data.code || 'UNAUTHORIZED_SESSION_REVOKED';
+            throw err;
+        }
+        return redactSensitiveData({
+            authenticated: true,
+            sessionId: data.sessionId,
+            uid: data.uid,
+            email: data.email,
+            role: data.role,
+            mfaVerified: true,
+            deviceId: data.deviceId,
+            token: session.sessionToken || session.token,
+            expiresAt: new Date(Date.now() + (data.expiresInSeconds * 1000)).toISOString()
+        });
+    }
+    // Offline mode
+    return redactSensitiveData({
+        authenticated: true,
+        uid: session.uid,
+        email: session.email,
+        role: session.role,
+        mfaVerified: session.mfaVerified,
+        deviceId: session.deviceId,
+        token: session.token,
+        expiresAt: new Date(session.expiresAt).toISOString()
+    });
+}
+export async function executeAdminPermissions(options = {}) {
+    const session = getStoredAdminSession();
+    if (!session || !session.mfaVerified) {
+        const err = new Error('Admin authentication required to inspect permissions.');
+        err.code = 'UNAUTHORIZED';
+        throw err;
+    }
+    const effectiveApiUrl = options.apiUrl || session.apiUrl || process.env.CREATORVERSE_API_URL || 'http://localhost:3000';
+    const isRemote = options.isRemote || Boolean(options.apiUrl) || Boolean(session.apiUrl);
+    const timeoutMs = options.timeoutMs || 5000;
+    if (isRemote && !options.isOffline) {
+        const response = await fetchWithTimeout(`${effectiveApiUrl}/api/admin/cli-session/verify`, {
+            method: 'GET',
+            headers: {
+                'Authorization': `Bearer ${session.sessionToken || session.token}`,
+                'User-Agent': `CreatorVerse-Admin-CLI/${VERSION}`
+            }
+        }, timeoutMs);
+        const data = await response.json();
+        if (!response.ok || !data.valid) {
+            clearSecureSession(ADMIN_CONFIG_FILE);
+            const err = new Error(data.error || 'Admin session has expired or been revoked.');
+            err.code = data.code || 'UNAUTHORIZED_SESSION_REVOKED';
+            throw err;
+        }
+        return {
+            role: data.role,
+            explicitPermissions: data.permissions || []
+        };
+    }
+    // Offline mode
+    const permissionsMap = {
+        'admin': ['audit-logs:read', 'system-status:read', 'user-moderation:write', 'content-moderation:write'],
+        'platform-owner': ['audit-logs:read', 'system-status:read', 'user-moderation:write', 'content-moderation:write', 'billing:manage', 'platform-config:write'],
+        'approved-developer': ['system-status:read', 'diagnostics:read', 'security-tests:run']
+    };
+    return {
+        role: session.role,
+        explicitPermissions: permissionsMap[session.role] || []
+    };
+}
+export async function executeAdminSessionStatus(options = {}) {
+    const session = getStoredAdminSession();
+    if (!session) {
+        return { active: false, message: 'No active secure admin session found.' };
+    }
+    const effectiveApiUrl = options.apiUrl || session.apiUrl || process.env.CREATORVERSE_API_URL || 'http://localhost:3000';
+    const isRemote = options.isRemote || Boolean(options.apiUrl) || Boolean(session.apiUrl);
+    const timeoutMs = options.timeoutMs || 5000;
+    if (isRemote && !options.isOffline) {
+        const response = await fetchWithTimeout(`${effectiveApiUrl}/api/admin/cli-session/verify`, {
+            method: 'GET',
+            headers: {
+                'Authorization': `Bearer ${session.sessionToken || session.token}`,
+                'User-Agent': `CreatorVerse-Admin-CLI/${VERSION}`
+            }
+        }, timeoutMs);
+        const data = await response.json();
+        if (!response.ok || !data.valid) {
+            return {
+                active: false,
+                error: data.code || 'SESSION_REVOKED',
+                message: data.error || 'Admin session is invalid, expired or revoked on the server.'
+            };
+        }
+        return redactSensitiveData({
+            active: true,
+            sessionId: data.sessionId,
+            uid: data.uid,
+            email: data.email,
+            role: data.role,
+            mfaVerified: true,
+            token: session.sessionToken || session.token,
+            expiresInSeconds: data.expiresInSeconds
+        });
+    }
+    const isValid = Date.now() <= session.expiresAt && session.mfaVerified;
+    return redactSensitiveData({
+        active: isValid,
+        uid: session.uid,
+        email: session.email,
+        role: session.role,
+        mfaVerified: session.mfaVerified,
+        token: session.token,
+        expiresInSeconds: Math.max(0, Math.floor((session.expiresAt - Date.now()) / 1000))
+    });
+}
+export async function executeAdminAuditLogs(options = {}) {
+    const session = getStoredAdminSession();
+    if (!session || !session.mfaVerified) {
+        if (options.isRemote && !options.isOffline) {
+            const err = new Error('Admin authentication required.');
+            err.code = 'UNAUTHORIZED';
+            throw err;
+        }
+        return {
+            mode: 'offline-stage-b-simulated',
+            logs: [
+                { timestamp: new Date().toISOString(), action: 'SYSTEM_BOOT', status: 'SUCCESS' },
+                { timestamp: new Date().toISOString(), action: 'SECURITY_CHECK_STAGE_B', status: 'PASSED' }
+            ]
+        };
+    }
+    const effectiveApiUrl = options.apiUrl || session.apiUrl || process.env.CREATORVERSE_API_URL || 'http://localhost:3000';
+    const isRemote = options.isRemote || Boolean(options.apiUrl) || Boolean(session.apiUrl);
+    const timeoutMs = options.timeoutMs || 5000;
+    if (isRemote && !options.isOffline) {
+        const response = await fetchWithTimeout(`${effectiveApiUrl}/api/admin/cli-session/audit-logs`, {
+            method: 'GET',
+            headers: {
+                'Authorization': `Bearer ${session.sessionToken || session.token}`,
+                'User-Agent': `CreatorVerse-Admin-CLI/${VERSION}`
+            }
+        }, timeoutMs);
+        const data = await response.json();
+        if (!response.ok) {
+            const err = new Error(data.error || 'Failed to access audit logs.');
+            err.code = data.code || 'FORBIDDEN';
+            throw err;
+        }
+        return redactSensitiveData(data);
+    }
+    // Offline mode
+    return redactSensitiveData({
+        mode: 'secure-stage-c',
+        adminUid: session.uid,
+        logs: [
+            { timestamp: new Date().toISOString(), action: 'ADMIN_LOGIN_SUCCESS', admin: session.email, mfa: true, device: session.deviceId },
+            { timestamp: new Date().toISOString(), action: 'AUDIT_LOGS_ACCESSED', status: 'AUTHORIZED' }
+        ]
+    });
+}
+export function printHelp() {
+    console.log(`
+CreatorVerse Admin CLI (v${VERSION})
+
+USAGE:
+  creatorverse-admin <command> [options]
+
+COMMANDS:
+  --version, -v          Display Admin CLI version
+  --help, -h             Display this help message
+  login                  Authenticate admin session (browser PKCE or encrypted vault)
+  logout                 Revoke admin session on server and clear local vault
+  whoami                 Display authenticated admin identity (verified with backend)
+  permissions            Display server-authoritative RBAC permission matrix
+  session status         Check admin session freshness and server validity
+  audit-logs             Display server audit logs (requires audit-logs:read permission)
+  system-status          Show system health status
+  verify-mfa-mock        Simulate MFA verification check
+
+OPTIONS:
+  --browser              Launch interactive browser-assisted PKCE authorization flow
+  --api-url <url>        Target backend API endpoint URL
+  --remote               Execute against backend API instead of local offline sandbox
+  --offline              Explicit offline test mode
+  --token <token>        Firebase ID token or test token
+  --mfa-code <code>      TOTP code (allowed strictly in test mode; interactive prompt required otherwise)
+  --device-id <id>       Unique workstation device identifier
+  --device-name <name>   Friendly workstation device name
+  --timeout <ms>         Network request timeout in milliseconds (default: 5000)
+`);
+}
+export async function main() {
+    const args = process.argv.slice(2);
+    const command = args[0];
+    const subCommand = args[1];
+    if (!command || command === '--help' || command === '-h' || command === 'help') {
+        printHelp();
+        process.exit(0);
+    }
+    if (command === '--version' || command === '-v' || command === 'version') {
+        console.log(`creatorverse-admin v${VERSION}`);
+        process.exit(0);
+    }
+    const options = {};
+    for (let i = 1; i < args.length; i++) {
+        if (args[i] === '--api-url' && args[i + 1]) {
+            options.apiUrl = args[i + 1];
+            options.isRemote = true;
+            i++;
+        }
+        else if (args[i] === '--remote') {
+            options.isRemote = true;
+        }
+        else if (args[i] === '--browser') {
+            options.isBrowser = true;
+            options.isRemote = true;
+        }
+        else if (args[i] === '--offline') {
+            options.isOffline = true;
+        }
+        else if (args[i] === '--token' && args[i + 1]) {
+            options.token = args[i + 1];
+            i++;
+        }
+        else if (args[i] === '--email' && args[i + 1]) {
+            options.email = args[i + 1];
+            i++;
+        }
+        else if (args[i] === '--role' && args[i + 1]) {
+            options.role = args[i + 1];
+            i++;
+        }
+        else if (args[i] === '--mfa-code' && args[i + 1]) {
+            options.mfaCode = args[i + 1];
+            i++;
+        }
+        else if (args[i] === '--device-id' && args[i + 1]) {
+            options.deviceId = args[i + 1];
+            i++;
+        }
+        else if (args[i] === '--device-name' && args[i + 1]) {
+            options.deviceName = args[i + 1];
+            i++;
+        }
+        else if (args[i] === '--timeout' && args[i + 1]) {
+            options.timeoutMs = parseInt(args[i + 1], 10) || 5000;
+            i++;
+        }
+    }
+    try {
+        switch (command) {
+            case 'login': {
+                const res = await executeAdminLogin(options);
+                console.log(JSON.stringify(res, null, 2));
+                break;
+            }
+            case 'logout': {
+                const res = await executeAdminLogout(options);
+                console.log(JSON.stringify(res, null, 2));
+                break;
+            }
+            case 'whoami': {
+                const res = await executeAdminWhoami(options);
+                console.log(JSON.stringify(res, null, 2));
+                break;
+            }
+            case 'permissions': {
+                const res = await executeAdminPermissions(options);
+                console.log(JSON.stringify(res, null, 2));
+                break;
+            }
+            case 'session': {
+                if (subCommand === 'status') {
+                    const res = await executeAdminSessionStatus(options);
+                    console.log(JSON.stringify(res, null, 2));
+                }
+                else {
+                    console.error(`Error: Unknown session subcommand "${subCommand}".`);
+                    process.exit(1);
+                }
+                break;
+            }
+            case 'audit-logs': {
+                const res = await executeAdminAuditLogs(options);
+                console.log(JSON.stringify(res, null, 2));
+                break;
+            }
+            case 'system-status': {
+                const session = getStoredAdminSession();
+                if (!session || !session.mfaVerified) {
+                    console.log(JSON.stringify({
+                        environment: 'sandbox',
+                        database: 'isolated',
+                        emulators: 'offline',
+                        status: 'HEALTHY'
+                    }, null, 2));
+                    break;
+                }
+                console.log(JSON.stringify({
+                    environment: 'secure-sandbox',
+                    database: 'connected',
+                    authService: 'firebase-secure',
+                    mfaEnforced: true,
+                    status: 'HEALTHY'
+                }, null, 2));
+                break;
+            }
+            case 'verify-mfa-mock': {
+                console.log(JSON.stringify({
+                    mfaStatus: 'verified-mock',
+                    deviceAuthorized: true
+                }, null, 2));
+                break;
+            }
+            default:
+                console.error(`Error: Unknown admin command "${command}". Run "creatorverse-admin help" for usage.`);
+                process.exit(1);
+        }
+    }
+    catch (err) {
+        console.error(JSON.stringify({
+            error: err.code || 'ERROR',
+            message: err.message
+        }, null, 2));
+        process.exit(1);
+    }
+}
+const isMain = process.argv[1] && (process.argv[1].endsWith('creatorverse-admin.ts') ||
+    process.argv[1].endsWith('creatorverse-admin.js') ||
+    (process.argv[1].includes('creatorverse-admin') && !process.argv[1].includes('.test.')));
+if (isMain) {
+    main().catch((err) => {
+        console.error(JSON.stringify({ error: 'UNHANDLED_ERROR', message: err.message }, null, 2));
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=creatorverse-admin.js.map