machine-bridge-mcp 2.0.0 → 3.0.0-beta.11

package/scripts/release-soak.mjs

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { readBoundedRegularFileSync } from "../src/local/secure-file.mjs";
+import { replaceFileAtomicallySync } from "../src/local/exclusive-file.mjs";
+import { readPrereleaseActivation } from "./prerelease-activation.mjs";
+import { computePromotionContentDigest } from "./promotion-digest.mjs";
+import {
+  SOAK_CONFIRMATION,
+  assertSoakEligiblePrerelease,
+  assertStablePromotion,
+  compareReleaseVersions,
+  formatSoakDuration,
+  minimumSoakSeconds,
+  parseReleaseVersion,
+  requiresSoakForStable,
+} from "./release-channel.mjs";
+import { verifyCurrentReleaseAcceptance } from "./release-acceptance.mjs";
+import { readGithubPrerelease, readPublishedNpmPrerelease } from "./published-release.mjs";
+
+export const SOAK_SCHEMA_VERSION = 1;
+const MAX_SOAK_RECORD_BYTES = 64 * 1024;
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const mode = process.argv[2] || "--verify";
+  try {
+    if (mode === "--record") recordCurrentPrereleaseSoak(root, { confirmation: argumentValue("--confirm"), stateRoot: argumentValue("--state-dir") || undefined });
+    else if (mode === "--verify") verifyCurrentStableSoak(root);
+    else if (mode === "--status") printStatus(root);
+    else throw new Error("usage: node scripts/release-soak.mjs [--record --confirm TEXT [--state-dir DIR]|--verify|--status]");
+  } catch (error) {
+    console.error(`release soak failed: ${error?.message || error}`);
+    process.exit(1);
+  }
+}
+
+export function soakRecordPath(repositoryRoot, stableVersion) {
+  const stable = parseReleaseVersion(stableVersion);
+  if (stable.prerelease) throw new Error("soak record path requires a stable version");
+  return join(repositoryRoot, "release-soak", `v${stable.raw}.json`);
+}
+
+export function recordCurrentPrereleaseSoak(repositoryRoot, options = {}) {
+  const pkg = readPackage(repositoryRoot);
+  const prerelease = assertSoakEligiblePrerelease(pkg.version);
+  const acceptance = verifyCurrentReleaseAcceptance(repositoryRoot);
+  if (!acceptance.required) throw new Error("prerelease package is missing local candidate acceptance policy");
+  const activation = readPrereleaseActivation(prerelease.raw, options.stateRoot);
+  if (activation.source !== "npm-prerelease") {
+    throw new Error("formal soak starts only after installing the published npm beta/rc; a local candidate activation is insufficient");
+  }
+  if (activation.integrity !== acceptance.metadata.integrity || activation.shasum !== acceptance.metadata.shasum) {
+    throw new Error("activated prerelease bytes do not match the locally accepted prerelease package");
+  }
+  const promotionDigest = computePromotionContentDigest(repositoryRoot);
+  if (activation.promotion_content_sha256 !== promotionDigest) {
+    throw new Error("activated prerelease promotion digest does not match the current source tree");
+  }
+  const previousStable = options.previousStableVersion || latestStableTag(repositoryRoot, prerelease.baseVersion);
+  const requiredSeconds = minimumSoakSeconds(prerelease.baseVersion, previousStable);
+  const activatedAt = Date.parse(activation.activated_at);
+  const acceptedAt = Number.isFinite(options.now) ? Number(options.now) : Date.now();
+  const observedSeconds = Math.floor((acceptedAt - activatedAt) / 1000);
+  if (observedSeconds < requiredSeconds) {
+    throw new Error(`prerelease soak is incomplete: observed ${formatSoakDuration(Math.max(0, observedSeconds))}, required ${formatSoakDuration(requiredSeconds)}`);
+  }
+  const expected = soakConfirmationPhrase(pkg.name, prerelease.raw, requiredSeconds);
+  if (options.confirmation !== expected) throw new Error(`soak confirmation must exactly match: ${expected}`);
+
+  const published = options.published || readPublishedNpmPrerelease(pkg.name, prerelease.raw, prerelease.npmTag);
+  if (
+    published.version !== prerelease.raw
+    || published.integrity !== acceptance.metadata.integrity
+    || published.shasum !== acceptance.metadata.shasum
+    || published.distTag !== prerelease.npmTag
+    || published.publishedAt !== activation.published_at
+  ) {
+    throw new Error("published npm prerelease metadata does not match the accepted and activated package");
+  }
+  const github = options.github || readGithubPrerelease(prerelease.raw);
+  if (github.tag !== `v${prerelease.raw}` || github.isPrerelease !== true) {
+    throw new Error("GitHub prerelease is missing or not marked as a prerelease");
+  }
+  const record = validateSoakRecord({
+    schema_version: SOAK_SCHEMA_VERSION,
+    result: "passed",
+    confirmation: SOAK_CONFIRMATION,
+    package_name: pkg.name,
+    stable_version: prerelease.baseVersion,
+    prerelease_version: prerelease.raw,
+    prerelease_channel: prerelease.channel,
+    prerelease_shasum: acceptance.metadata.shasum,
+    prerelease_integrity: acceptance.metadata.integrity,
+    promotion_content_sha256: promotionDigest,
+    activated_at: activation.activated_at,
+    published_at: published.publishedAt,
+    accepted_at: new Date(acceptedAt).toISOString(),
+    minimum_soak_seconds: requiredSeconds,
+    observed_soak_seconds: observedSeconds,
+    npm_dist_tag: prerelease.npmTag,
+    github_prerelease_tag: github.tag,
+    previous_stable_version: previousStable,
+    known_blocking_issues: 0,
+  });
+  const file = soakRecordPath(repositoryRoot, prerelease.baseVersion);
+  mkdirSync(dirname(file), { recursive: true });
+  replaceFileAtomicallySync(file, `${JSON.stringify(record, null, 2)}\n`, { mode: 0o644 });
+  console.log(`Published prerelease soak accepted: ${file}`);
+  console.log("Stable promotion may change only synchronized version metadata; any functional package change requires a new prerelease and a new soak window.");
+  return record;
+}
+
+export function verifyCurrentStableSoak(repositoryRoot, options = {}) {
+  const pkg = readPackage(repositoryRoot);
+  if (!requiresSoakForStable(pkg.version)) return { required: false, version: pkg.version };
+  const file = soakRecordPath(repositoryRoot, pkg.version);
+  if (!existsSync(file)) throw new Error(`stable release soak record is missing: ${file}`);
+  let parsed;
+  try { parsed = JSON.parse(readBoundedRegularFileSync(file, MAX_SOAK_RECORD_BYTES, "release soak record", { verifyPathIdentity: true }).toString("utf8")); }
+  catch (error) { throw new Error(`release soak record is unavailable or invalid: ${error.message}`); }
+  const promotionDigest = computePromotionContentDigest(repositoryRoot, options);
+  const record = validateSoakRecord(parsed, { stableVersion: pkg.version, promotionDigest });
+  return { required: true, version: pkg.version, record, promotionDigest };
+}
+
+export function validateSoakRecord(value, options = {}) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("release soak record must be an object");
+  const allowed = new Set([
+    "schema_version", "result", "confirmation", "package_name", "stable_version", "prerelease_version",
+    "prerelease_channel", "prerelease_shasum", "prerelease_integrity", "promotion_content_sha256",
+    "activated_at", "published_at", "accepted_at", "minimum_soak_seconds", "observed_soak_seconds",
+    "npm_dist_tag", "github_prerelease_tag", "previous_stable_version", "known_blocking_issues",
+  ]);
+  const unknown = Object.keys(value).filter((key) => !allowed.has(key));
+  if (unknown.length) throw new Error(`release soak record contains unsupported fields: ${unknown.join(", ")}`);
+  if (value.schema_version !== SOAK_SCHEMA_VERSION) throw new Error("unsupported release soak schema");
+  if (value.result !== "passed" || value.confirmation !== SOAK_CONFIRMATION) throw new Error("release soak is not accepted");
+  if (value.package_name !== "machine-bridge-mcp") throw new Error("release soak package name is invalid");
+  const { stable, prerelease } = assertStablePromotion(value.stable_version, value.prerelease_version);
+  if (value.prerelease_channel !== prerelease.channel) throw new Error("release soak prerelease channel is inconsistent");
+  if (value.npm_dist_tag !== prerelease.npmTag) throw new Error("release soak npm dist-tag is inconsistent");
+  if (value.github_prerelease_tag !== `v${prerelease.raw}`) throw new Error("release soak GitHub prerelease tag is inconsistent");
+  if (!/^[0-9a-f]{40}$/.test(String(value.prerelease_shasum || ""))) throw new Error("release soak prerelease SHA-1 is invalid");
+  if (!/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(String(value.prerelease_integrity || ""))) throw new Error("release soak prerelease integrity is invalid");
+  if (!/^[0-9a-f]{64}$/.test(String(value.promotion_content_sha256 || ""))) throw new Error("release soak promotion digest is invalid");
+  const activatedAt = Date.parse(String(value.activated_at || ""));
+  const publishedAt = Date.parse(String(value.published_at || ""));
+  const acceptedAt = Date.parse(String(value.accepted_at || ""));
+  if (![activatedAt, publishedAt, acceptedAt].every(Number.isFinite)) throw new Error("release soak timestamps are invalid");
+  if (publishedAt > activatedAt + 5 * 60 * 1000 || activatedAt > acceptedAt) throw new Error("release soak timestamp ordering is invalid");
+  if (!Number.isSafeInteger(value.minimum_soak_seconds) || value.minimum_soak_seconds < 60) throw new Error("release soak minimum duration is invalid");
+  if (!Number.isSafeInteger(value.observed_soak_seconds) || value.observed_soak_seconds < value.minimum_soak_seconds) throw new Error("release soak observed duration is insufficient");
+  const elapsed = Math.floor((acceptedAt - activatedAt) / 1000);
+  if (value.observed_soak_seconds > elapsed + 5 || value.observed_soak_seconds < elapsed - 5) throw new Error("release soak observed duration does not match its timestamps");
+  if (value.known_blocking_issues !== 0) throw new Error("stable release is blocked by known prerelease issues");
+  const previous = parseReleaseVersion(value.previous_stable_version);
+  if (previous.prerelease || compareReleaseVersions(stable, previous) <= 0) throw new Error("release soak previous stable version is invalid");
+  const expectedMinimum = minimumSoakSeconds(stable.raw, previous.raw);
+  if (value.minimum_soak_seconds < expectedMinimum) throw new Error("release soak duration is below the active policy minimum");
+  if (options.stableVersion && stable.raw !== parseReleaseVersion(options.stableVersion).raw) throw new Error("release soak record targets another stable version");
+  if (options.promotionDigest && value.promotion_content_sha256 !== options.promotionDigest) {
+    throw new Error("stable package content differs from the accepted prerelease; publish a new prerelease and restart soak");
+  }
+  return Object.freeze({
+    schema_version: SOAK_SCHEMA_VERSION,
+    result: "passed",
+    confirmation: SOAK_CONFIRMATION,
+    package_name: "machine-bridge-mcp",
+    stable_version: stable.raw,
+    prerelease_version: prerelease.raw,
+    prerelease_channel: prerelease.channel,
+    prerelease_shasum: String(value.prerelease_shasum),
+    prerelease_integrity: String(value.prerelease_integrity),
+    promotion_content_sha256: String(value.promotion_content_sha256),
+    activated_at: new Date(activatedAt).toISOString(),
+    published_at: new Date(publishedAt).toISOString(),
+    accepted_at: new Date(acceptedAt).toISOString(),
+    minimum_soak_seconds: Number(value.minimum_soak_seconds),
+    observed_soak_seconds: Number(value.observed_soak_seconds),
+    npm_dist_tag: prerelease.npmTag,
+    github_prerelease_tag: `v${prerelease.raw}`,
+    previous_stable_version: previous.raw,
+    known_blocking_issues: 0,
+  });
+}
+
+export function soakConfirmationPhrase(name, prereleaseVersion, requiredSeconds) {
+  return `I SOAK-TESTED ${name} ${prereleaseVersion} FOR AT LEAST ${formatSoakDuration(requiredSeconds)} WITH NO BLOCKING ISSUES`;
+}
+
+function latestStableTag(repositoryRoot, targetBaseVersion) {
+  const target = parseReleaseVersion(targetBaseVersion);
+  const result = run("git", ["tag", "--list", "v*"], { cwd: repositoryRoot });
+  const versions = result.stdout.split(/\r?\n/).map((tag) => tag.trim().replace(/^v/, "")).filter(Boolean)
+    .map((value) => { try { return parseReleaseVersion(value); } catch { return null; } })
+    .filter((value) => value && !value.prerelease && compareReleaseVersions(value, target) < 0)
+    .sort(compareReleaseVersions);
+  const previous = versions.at(-1);
+  if (!previous) throw new Error(`could not determine the previous stable version before ${target.raw}`);
+  return previous.raw;
+}
+
+function printStatus(repositoryRoot) {
+  const pkg = readPackage(repositoryRoot);
+  const parsed = parseReleaseVersion(pkg.version);
+  if (parsed.prerelease) {
+    console.log(JSON.stringify({ version: parsed.raw, channel: parsed.channel, stable_target: parsed.baseVersion, soak_record: soakRecordPath(repositoryRoot, parsed.baseVersion) }, null, 2));
+    return;
+  }
+  const result = verifyCurrentStableSoak(repositoryRoot);
+  console.log(JSON.stringify(result, null, 2));
+}
+
+function readPackage(repositoryRoot) {
+  const value = JSON.parse(readFileSync(join(repositoryRoot, "package.json"), "utf8"));
+  if (value.name !== "machine-bridge-mcp") throw new Error("unexpected package name");
+  parseReleaseVersion(value.version);
+  return value;
+}
+
+function run(file, args, options = {}) {
+  const result = spawnSync(file, args, { cwd: options.cwd || root, encoding: "utf8", env: process.env, windowsHide: true });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(`${file} ${args[0] || ""} failed: ${String(result.stderr || result.stdout).trim()}`);
+  return result;
+}
+
+function argumentValue(name) {
+  const exact = process.argv.find((value) => value.startsWith(`${name}=`));
+  if (exact) return exact.slice(name.length + 1);
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : "";
+}

package/scripts/start-release-candidate.mjs

@@ -1,22 +1,29 @@
 #!/usr/bin/env node
 
 import { spawn, spawnSync } from "node:child_process";
-import { mkdirSync, readFileSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, rmSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { defaultStateRoot, expandHome } from "../src/local/state.mjs";
+import { ensureOwnerOnlyDirectorySync } from "../src/local/secure-file.mjs";
+import { createCandidateRuntimePrefix, pruneInactiveCandidateRuntimes } from "./candidate-runtime-store.mjs";
+import { writePrereleaseActivation } from "./prerelease-activation.mjs";
 import { verifyTarball } from "./release-acceptance.mjs";
+import { parseReleaseVersion } from "./release-channel.mjs";
+import { validateCandidateManifest } from "./release-candidate-manifest.mjs";
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const candidateDirectory = join(root, ".release-candidate");
 const manifestPath = join(candidateDirectory, "manifest.json");
-const installPrefix = join(candidateDirectory, "runtime");
+const foregroundInstallPrefix = join(candidateDirectory, "runtime");
 const npmCli = process.env.npm_execpath;
 
 if (!npmCli) fail("candidate startup must run through npm so npm_execpath is available");
 
 try {
   const manifest = readJson(manifestPath, "release candidate manifest");
-  if (manifest.result !== "pending") throw new Error("release candidate manifest is not pending");
+  validateCandidateManifest(manifest);
   const tarball = join(candidateDirectory, String(manifest.filename || ""));
   verifyTarball(tarball, manifest);
 
@@ -25,8 +32,13 @@ try {
     throw new Error(`candidate startup requires npm 12 or newer; current ${npmVersion}`);
   }
 
-  rmSync(installPrefix, { recursive: true, force: true });
-  mkdirSync(installPrefix, { recursive: true });
+  const activateService = process.argv.includes("--activate-service");
+  const stateRoot = resolve(expandHome(argumentValue("--state-dir") || defaultStateRoot()));
+  const installPrefix = activateService
+    ? createCandidateRuntimePrefix({ stateRoot, version: manifest.package_version, shasum: manifest.shasum })
+    : foregroundInstallPrefix;
+  if (!activateService) rmSync(installPrefix, { recursive: true, force: true });
+  ensureOwnerOnlyDirectorySync(installPrefix);
   runNpm([
     "install",
     "--global",
@@ -53,10 +65,17 @@ try {
   }
 
   if (!allowWorkerDeploy) {
-    throw new Error("foreground candidate startup may update the configured same-name Worker; rerun with --allow-worker-deploy to authorize that live candidate deployment");
+    throw new Error("candidate activation may update the configured same-name Worker; rerun with --allow-worker-deploy to authorize that live candidate deployment");
+  }
+
+  const forwardedArgs = process.argv.slice(2).filter((value) => ![
+    "--install-only", "--allow-worker-deploy", "--activate-service",
+  ].includes(value));
+  if (activateService) {
+    activatePersistentCandidate({ manifest, installedPackage, installPrefix, stateRoot, forwardedArgs });
+    process.exit(0);
   }
 
-  const forwardedArgs = process.argv.slice(2).filter((value) => value !== "--install-only" && value !== "--allow-worker-deploy");
   const cli = join(installedPackage, "bin", "machine-mcp.mjs");
   console.log("Authorized live candidate deployment: startup may update the configured same-name Worker when its version or deployment hash differs.");
   console.log("Starting the exact candidate in the foreground. Leave this process running while the coding agent verifies the Worker, relay, and local runtime end to end.");
@@ -86,6 +105,93 @@ try {
   fail(error?.message || error);
 }
 
+function activatePersistentCandidate({ manifest, installedPackage, installPrefix, stateRoot, forwardedArgs }) {
+  const releaseVersion = parseReleaseVersion(manifest.package_version);
+  const cli = join(installedPackage, "bin", "machine-mcp.mjs");
+  const args = ["activate", ...withoutManagedFlags(forwardedArgs), "--state-dir", stateRoot, "--json"];
+  const previous = currentGlobalInstallation(manifest.package_name);
+  console.log("Activating the exact prerelease as the persistent login daemon. Portable-root startup does not prompt; a separately provisioned Secure Enclave broker may request one user-presence operation.");
+  const result = spawnSync(process.execPath, [cli, ...args], {
+    cwd: root,
+    env: process.env,
+    encoding: "utf8",
+    timeout: 300_000,
+    windowsHide: true,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(`persistent candidate activation failed: ${result.stderr || result.stdout}`);
+  let activation;
+  try { activation = JSON.parse(result.stdout); } catch { throw new Error("persistent candidate activation did not return valid JSON"); }
+  if (
+    activation.ok !== true
+    || activation.version !== manifest.package_version
+    || activation.daemon?.version !== manifest.package_version
+    || activation.worker?.health?.version !== manifest.package_version
+  ) {
+    throw new Error("persistent candidate activation did not converge on the exact candidate version");
+  }
+
+  let recordPath = "";
+  if (releaseVersion.prerelease) {
+    recordPath = writePrereleaseActivation({
+      schema_version: 1,
+      package_name: manifest.package_name,
+      package_version: manifest.package_version,
+      source: "local-candidate",
+      shasum: manifest.shasum,
+      integrity: manifest.integrity,
+      promotion_content_sha256: manifest.promotion_content_sha256,
+      activated_at: new Date().toISOString(),
+      workspace_hash: workspaceHash(activation.workspace),
+      runtime_entry: cli,
+      ...(previous ? { previous } : {}),
+    }, stateRoot);
+  }
+  const removedRuntimes = pruneInactiveCandidateRuntimes({ stateRoot, activePrefix: installPrefix });
+  console.log(`Persistent release candidate activated: ${manifest.package_version}`);
+  if (recordPath) console.log(`Activation record: ${recordPath}`);
+  if (removedRuntimes.length) console.log(`Removed ${removedRuntimes.length} inactive candidate runtime(s).`);
+  console.log("The Worker and login daemon now run the exact candidate. The terminal may close; the coding agent should verify the live deployment through Machine Bridge.");
+  if (previous?.version) console.log(`Rollback baseline retained: globally installed ${previous.version}.`);
+}
+
+function currentGlobalInstallation(packageName) {
+  try {
+    const globalRoot = runNpm(["root", "--global"], root).stdout.trim();
+    const packageRoot = join(globalRoot, packageName);
+    const packagePath = join(packageRoot, "package.json");
+    if (!existsSync(packagePath)) return null;
+    const pkg = readJson(packagePath, "globally installed package");
+    return { version: String(pkg.version || ""), entry: join(packageRoot, "bin", "machine-mcp.mjs") };
+  } catch {
+    return null;
+  }
+}
+
+function withoutManagedFlags(args) {
+  const out = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const value = args[index];
+    if (value === "--json" || value.startsWith("--json=")) continue;
+    if (value === "--state-dir") { index += 1; continue; }
+    if (value.startsWith("--state-dir=")) continue;
+    out.push(value);
+  }
+  return out;
+}
+
+function argumentValue(name) {
+  const exact = process.argv.find((value) => value.startsWith(`${name}=`));
+  if (exact) return exact.slice(name.length + 1);
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : "";
+}
+
+function workspaceHash(workspace) {
+  const value = process.platform === "win32" ? String(workspace).toLowerCase() : String(workspace);
+  return createHash("sha256").update(value).digest("hex").slice(0, 24);
+}
+
 function runNpm(args, cwd) {
   const result = spawnSync(process.execPath, [npmCli, ...args], {
     cwd,

package/src/local/account-access.mjs

@@ -1,5 +1,6 @@
 import accessContract from "../shared/access-contract.json" with { type: "json" };
 import { BridgeError } from "./errors.mjs";
+import { buildAuthorityContext } from "./authority-context.mjs";
 import { policyProfile, toolNamesForPolicy, assertToolAllowed } from "./policy.mjs";
 
 export const ACCOUNT_ACCESS_REVISION = Number(accessContract.revision);
@@ -32,6 +33,11 @@ export class AccountAccessGate {
     return normalized;
   }
 
+  authority(authorization, daemonPolicy, origin = "relay") {
+    const role = origin === "relay" ? normalizeAccountRole(authorization?.role) : "owner";
+    return buildAuthorityContext({ authorization: { ...authorization, role }, daemonPolicy, origin });
+  }
+
   names(role) {
     return accountRoleToolNames(role);
   }

package/src/local/account-admin.mjs

@@ -1,6 +1,7 @@
-import { createHash, createHmac, randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { ADMIN_AUTH_SCHEME, adminAuthTranscript } from "../shared/admin-auth.mjs";
 import { ACCOUNT_ROLES, normalizeAccountRole } from "./account-access.mjs";
+import { encodeDeviceSessionCertificate, signWithDeviceSessionIdentity, validateDeviceSessionIdentity } from "./device-identity.mjs";
 import { BridgeError } from "./errors.mjs";
 
 const REQUEST_TIMEOUT_MS = 15_000;
@@ -10,15 +11,18 @@ export function generateAccountPassword() {
 }
 
 export class AccountAdminClient {
-  constructor({ workerUrl, adminSecret, fetchImpl = fetch }) {
+  constructor({ workerUrl, sessionIdentity, fetchImpl = fetch }) {
     this.workerUrl = normalizeWorkerUrl(workerUrl);
-    if (typeof adminSecret !== "string" || adminSecret.length < 24) throw new BridgeError("invalid_request", "account administration secret is missing");
-    this.adminSecret = adminSecret;
+    this.sessionIdentity = validateDeviceSessionIdentity(sessionIdentity);
     this.fetchImpl = fetchImpl;
   }
 
-  list() {
-    return this.request("GET", "/admin/accounts");
+  list() { return this.request("GET", "/admin/accounts"); }
+  listClients() { return this.request("GET", "/admin/clients"); }
+
+  removeClient({ clientId }) {
+    if (!/^mcp_client_[A-Za-z0-9_-]{43}$/.test(String(clientId || ""))) throw new BridgeError("invalid_request", "OAuth client id is invalid");
+    return this.request("DELETE", "/admin/clients", { client_id: clientId });
   }
 
   create({ name, role, password, displayName = "" }) {
@@ -61,7 +65,7 @@ export class AccountAdminClient {
   async request(method, pathname, body) {
     const serializedBody = body === undefined ? "" : JSON.stringify(body);
     const headers = accountAdminRequestHeaders({
-      secret: this.adminSecret,
+      sessionIdentity: this.sessionIdentity,
       origin: this.workerUrl,
       method,
       pathname,
@@ -89,25 +93,39 @@ export class AccountAdminClient {
   }
 }
 
-
-export function accountAdminRequestHeaders({ secret, origin, method, pathname, body = "", now = Date.now(), nonce = randomBytes(24).toString("base64url") }) {
-  if (typeof secret !== "string" || secret.length < 24) throw new BridgeError("invalid_request", "account administration secret is missing");
+export function accountAdminRequestHeaders({
+  sessionIdentity,
+  origin,
+  method,
+  pathname,
+  body = "",
+  now = Date.now(),
+  nonce = randomBytes(24).toString("base64url"),
+}) {
+  validateDeviceSessionIdentity(sessionIdentity, now);
   const issuedAt = Math.floor(Number(now) / 1000);
   const bodyHash = createHash("sha256").update(String(body)).digest("hex");
-  const transcript = adminAuthTranscript({ origin, method: String(method).toUpperCase(), pathname, bodyHash, issuedAt, nonce });
-  const signature = createHmac("sha256", secret).update(transcript).digest("base64url");
+  const transcript = adminAuthTranscript({
+    origin,
+    method: String(method).toUpperCase(),
+    pathname,
+    bodyHash,
+    keyId: sessionIdentity.keyId,
+    issuedAt,
+    nonce,
+  });
   return {
     "X-Bridge-Admin-Scheme": ADMIN_AUTH_SCHEME,
     "X-Bridge-Admin-Time": String(issuedAt),
     "X-Bridge-Admin-Nonce": nonce,
     "X-Bridge-Admin-Body-SHA256": bodyHash,
-    "X-Bridge-Admin-Signature": signature,
+    "X-Bridge-Admin-Key": sessionIdentity.keyId,
+    "X-Bridge-Admin-Signature": signWithDeviceSessionIdentity(sessionIdentity, transcript),
+    "X-Bridge-Device-Certificate": encodeDeviceSessionCertificate(sessionIdentity),
   };
 }
 
-export function accountRoleNames() {
-  return Object.keys(ACCOUNT_ROLES);
-}
+export function accountRoleNames() { return Object.keys(ACCOUNT_ROLES); }
 
 function normalizeWorkerUrl(value) {
   const url = new URL(String(value || ""));