miravo 0.5.0 → 0.6.0

package/src/commands/start.test.ts

@@ -27,7 +27,6 @@ const BUILTIN_TEMPLATE_PATHS = [
   resolve(stressTemplatesDir, "stress-10k.miravo.yaml"),
   resolve(stressTemplatesDir, "stress-50k.miravo.yaml"),
   resolve(stressTemplatesDir, "stress-100k.miravo.yaml"),
-  resolve(stressTemplatesDir, "stress-200k.miravo.yaml"),
 ];
 
 beforeEach(resetExitCode);
@@ -157,7 +156,7 @@ function createTemplateWithNamespace(namespace?: MiravoTemplate["namespace"]): M
 
 describe("resolveSimulationName", () => {
   test("priority: --name > MIRAVO_NAME > namespace", async () => {
-    const { resolveSimulationName } = await import("./start.ts");
+    const { resolveSimulationName } = await import("./start/index.ts");
     const template = createTemplateWithNamespace({ enterprise: "acme", site: "site-a" });
 
     expect(
@@ -172,20 +171,20 @@ describe("resolveSimulationName", () => {
   });
 
   test("uses flat namespace prefix when ISA-95 site is not present", async () => {
-    const { resolveSimulationName } = await import("./start.ts");
+    const { resolveSimulationName } = await import("./start/index.ts");
     const template = createTemplateWithNamespace({ prefix: "flat-prefix" });
     expect(resolveSimulationName({ template })).toBe("flat-prefix");
   });
 
   test("throws when template has no namespace and no explicit name", async () => {
-    const { resolveSimulationName } = await import("./start.ts");
+    const { resolveSimulationName } = await import("./start/index.ts");
     const template = createTemplateWithNamespace();
 
     expect(() => resolveSimulationName({ template })).toThrow("Template has no namespace.");
   });
 
   test("rejects invalid names with special characters", async () => {
-    const { resolveSimulationName } = await import("./start.ts");
+    const { resolveSimulationName } = await import("./start/index.ts");
     const template = createTemplateWithNamespace({ prefix: "valid" });
 
     expect(() => resolveSimulationName({ template, cliName: "UPPER-CASE" })).toThrow(
@@ -202,7 +201,7 @@ describe("resolveSimulationName", () => {
   });
 
   test("accepts single-character name", async () => {
-    const { resolveSimulationName } = await import("./start.ts");
+    const { resolveSimulationName } = await import("./start/index.ts");
     const template = createTemplateWithNamespace({ prefix: "x" });
     expect(resolveSimulationName({ template })).toBe("x");
   });
@@ -210,7 +209,7 @@ describe("resolveSimulationName", () => {
 
 describe("resolveProtocolBootPlans", () => {
   test("preserves restored adapter state when no explicit protocol overrides are provided", async () => {
-    const { resolveProtocolBootPlans } = await import("./start.ts");
+    const { resolveProtocolBootPlans } = await import("./start/index.ts");
 
     expect(
       resolveProtocolBootPlans({
@@ -226,7 +225,7 @@ describe("resolveProtocolBootPlans", () => {
   });
 
   test("applies boot defaults when no persisted snapshot was restored", async () => {
-    const { resolveProtocolBootPlans } = await import("./start.ts");
+    const { resolveProtocolBootPlans } = await import("./start/index.ts");
 
     expect(
       resolveProtocolBootPlans({
@@ -242,7 +241,7 @@ describe("resolveProtocolBootPlans", () => {
   });
 
   test("treats explicit MQTT disable as authoritative over persisted state", async () => {
-    const { resolveProtocolBootPlans } = await import("./start.ts");
+    const { resolveProtocolBootPlans } = await import("./start/index.ts");
 
     expect(
       resolveProtocolBootPlans({
@@ -254,7 +253,7 @@ describe("resolveProtocolBootPlans", () => {
   });
 
   test("treats explicit CLI MQTT config overrides as authoritative over persisted config", async () => {
-    const { resolveProtocolBootPlans } = await import("./start.ts");
+    const { resolveProtocolBootPlans } = await import("./start/index.ts");
 
     expect(
       resolveProtocolBootPlans({
@@ -266,7 +265,7 @@ describe("resolveProtocolBootPlans", () => {
   });
 
   test("does not treat env fallback config as authoritative over persisted MQTT state", async () => {
-    const { resolveProtocolBootPlans } = await import("./start.ts");
+    const { resolveProtocolBootPlans } = await import("./start/index.ts");
 
     expect(
       resolveProtocolBootPlans({
@@ -278,7 +277,7 @@ describe("resolveProtocolBootPlans", () => {
   });
 
   test("treats explicit OPC UA enable as authoritative over persisted state", async () => {
-    const { resolveProtocolBootPlans } = await import("./start.ts");
+    const { resolveProtocolBootPlans } = await import("./start/index.ts");
 
     expect(
       resolveProtocolBootPlans({
@@ -290,7 +289,7 @@ describe("resolveProtocolBootPlans", () => {
   });
 
   test("does not treat ignored OPC UA config flags as persisted-state overrides", async () => {
-    const { resolveProtocolBootPlans } = await import("./start.ts");
+    const { resolveProtocolBootPlans } = await import("./start/index.ts");
 
     expect(
       resolveProtocolBootPlans({
@@ -304,7 +303,7 @@ describe("resolveProtocolBootPlans", () => {
 
 describe("resolveDetachAdapterConfigs", () => {
   test("uses template adapter configs when no CLI/env overrides are provided", async () => {
-    const { resolveDetachAdapterConfigs } = await import("./start.ts");
+    const { resolveDetachAdapterConfigs } = await import("./start/index.ts");
 
     const template = createTemplateWithNamespace({ prefix: "factory" });
     const withProtocols: MiravoTemplate = {
@@ -330,14 +329,14 @@ describe("resolveDetachAdapterConfigs", () => {
         modbus: { enabled: true, portOverride: undefined, hostOverride: undefined },
       }),
     ).toEqual({
-      mqtt: { port: 1889, host: "127.0.0.1", embedded: true },
+      mqtt: { port: 1889, host: "0.0.0.0", embedded: true },
       opcua: { port: 4851, host: "127.0.0.1" },
       modbus: { port: 1602, host: "127.0.0.1" },
     });
   });
 
   test("CLI/env overrides take precedence over template values", async () => {
-    const { resolveDetachAdapterConfigs } = await import("./start.ts");
+    const { resolveDetachAdapterConfigs } = await import("./start/index.ts");
 
     const template = createTemplateWithNamespace({ prefix: "factory" });
     const withProtocols: MiravoTemplate = {
@@ -374,7 +373,7 @@ describe("resolveDetachAdapterConfigs", () => {
   });
 
   test("returns disabled placeholders when adapters are disabled", async () => {
-    const { resolveDetachAdapterConfigs } = await import("./start.ts");
+    const { resolveDetachAdapterConfigs } = await import("./start/index.ts");
     const template = createTemplateWithNamespace({ prefix: "factory" });
 
     expect(
@@ -398,7 +397,7 @@ describe("resolveDetachAdapterConfigs", () => {
   });
 
   test("marks external MQTT mode as non-embedded for detach conflict checks", async () => {
-    const { resolveDetachAdapterConfigs } = await import("./start.ts");
+    const { resolveDetachAdapterConfigs } = await import("./start/index.ts");
     const template = createTemplateWithNamespace({ prefix: "factory" });
 
     expect(
@@ -424,7 +423,7 @@ describe("resolveDetachAdapterConfigs", () => {
 
 describe("error context aggregation", () => {
   test("normalizeErrorContext redacts high-cardinality fragments", async () => {
-    const { normalizeErrorContext } = await import("./start.ts");
+    const { normalizeErrorContext } = await import("./start/index.ts");
 
     expect(normalizeErrorContext('generator="rpm" instance="pump-001" tick=42')).toBe(
       'generator="rpm" instance="*" tick=*',
@@ -435,7 +434,7 @@ describe("error context aggregation", () => {
   });
 
   test("incrementErrorContextCount caps unique keys and accumulates in overflow bucket", async () => {
-    const { incrementErrorContextCount } = await import("./start.ts");
+    const { incrementErrorContextCount } = await import("./start/index.ts");
     const counts = new Map<string, number>();
 
     for (let i = 0; i < 256; i++) {
@@ -453,7 +452,7 @@ describe("error context aggregation", () => {
 
 describe("template picker choices", () => {
   test("buildBuiltinTemplateChoices renders tree labels directly in select options", async () => {
-    const { buildBuiltinTemplateChoices } = await import("./start.ts");
+    const { buildBuiltinTemplateChoices } = await import("./start/index.ts");
     const choices = buildBuiltinTemplateChoices([
       discoveredTemplate("stress-50k", "Stress Benchmark 50K"),
       discoveredTemplate("water-treatment", "Water Treatment Plant"),

package/src/commands/status.ts

@@ -45,7 +45,7 @@ export function registerStatusCommand(program: Command): void {
     .option("-w, --watch", "Poll the admin server and re-render on updates")
     .option("--instance <id>", "Show detailed status for one instance")
     .option("--json", "Machine-readable JSON output")
-    .option("--admin-url <url>", "Miravo admin server URL (env: MIRAVO_ADMIN_URL)")
+    .option("--admin-url <url>", "Admin API URL (env: MIRAVO_ADMIN_URL)")
     .option(
       "--template <path>",
       "Path to .miravo.yaml for MQTT discovery connection info (env: MIRAVO_TEMPLATE)",

package/src/commands/stop.ts

@@ -81,15 +81,26 @@ async function stopAction(name: string, options: StopOptions): Promise<void> {
   let shutdownSent = false;
   let canForceKill = true;
   try {
-    const adminUrl = `http://${entry.adminHost}:${entry.adminPort}/shutdown`;
-    const headers: Record<string, string> = { "content-type": "application/json" };
-    const adminToken = Bun.env["MIRAVO_ADMIN_TOKEN"];
-    if (adminToken) {
-      headers["authorization"] = `Bearer ${adminToken}`;
-    }
-    const response = await fetch(adminUrl, {
+    const adminBase = `http://${entry.adminHost}:${entry.adminPort}`;
+    // Authenticate with session-based login
+    // Resolve password: env > default.
+    // If credential file exists, we can't reverse the hash — use "admin" as default.
+    // The server will verify against the stored hash. If the user changed their password,
+    // they need to set MIRAVO_ADMIN_PASSWORD env var for CLI access.
+    const envPassword = Bun.env["MIRAVO_ADMIN_PASSWORD"];
+    const password = envPassword && envPassword.trim().length > 0 ? envPassword : "admin";
+    const loginResponse = await fetch(`${adminBase}/auth/login`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ username: "admin", password }),
+      signal: AbortSignal.timeout(2_000),
+    });
+    const setCookie = loginResponse.ok ? loginResponse.headers.get("set-cookie") : null;
+    const cookie = setCookie ? (setCookie.split(";")[0] ?? "") : "";
+
+    const response = await fetch(`${adminBase}/shutdown`, {
       method: "POST",
-      headers,
+      headers: { "content-type": "application/json", ...(cookie ? { cookie } : {}) },
       body: JSON.stringify({ reason: "miravo stop" }),
       signal: AbortSignal.timeout(2_000),
     });

package/src/commands/templates.test.ts

@@ -36,7 +36,7 @@ describe("formatTemplateInspect", () => {
     expect(output).toContain("Namespace:");
     expect(output).toContain("Twin assignments:");
     expect(output).toContain("Areas:");
-    expect(output).toContain("production");
+    expect(output).toContain("machining");
   });
 });
 

package/src/commands/templates.ts

@@ -19,7 +19,7 @@ export function registerTemplatesCommand(program: Command): void {
   templates
     .command("list")
     .description("Discover and list available templates")
-    .option("--dir <path>", "Additional directory to search for templates")
+    .option("--dir <path>", "Additional directory to search for .miravo.yaml templates")
     .addHelpText(
       "after",
       `
@@ -275,5 +275,3 @@ export function formatTemplateInspect(
 
   return lines.join("\n");
 }
-
-export type { DiscoveredTemplate };

package/src/index.ts

@@ -2,19 +2,23 @@
 import { MIRAVO_VERSION } from "@miravo/shared";
 import { Command, InvalidOptionArgumentError } from "commander";
 import { registerAdapterCommand } from "./commands/adapter.ts";
+import { registerApplyCommand } from "./commands/apply.ts";
+import { registerCleanupCommand } from "./commands/cleanup.ts";
+import { registerExportCommand } from "./commands/export.ts";
 import { registerForkCommand } from "./commands/fork.ts";
 import { registerInjectCommand } from "./commands/inject.ts";
 import { registerLoadCommand } from "./commands/load.ts";
 import { registerLogsCommand } from "./commands/logs.ts";
 import { registerModelsCommand } from "./commands/models.ts";
 import { registerPauseCommand, registerResumeCommand } from "./commands/pause.ts";
+import { registerEnvironmentsCommand } from "./commands/platforms.ts";
 import { registerPsCommand } from "./commands/ps.ts";
 import { registerRemoveCommand } from "./commands/remove.ts";
 import { registerResetCommand } from "./commands/reset.ts";
 import { registerRmCommand } from "./commands/rm.ts";
 import { registerSpawnCommand } from "./commands/spawn.ts";
 import { registerSpeedCommand } from "./commands/speed.ts";
-import { registerStartCommand } from "./commands/start.ts";
+import { registerStartCommand } from "./commands/start/index.ts";
 import { registerStatusCommand } from "./commands/status.ts";
 import { registerStopCommand } from "./commands/stop.ts";
 import { registerTemplatesCommand } from "./commands/templates.ts";
@@ -57,7 +61,7 @@ export function createProgram(): Command {
       },
       "pretty",
     )
-    .addHelpText("afterAll", "\nDocs: https://github.com/amine-amaach/miravo")
+    .addHelpText("afterAll", "\nDocs: https://miravo.dev/docs")
     .action(() => {
       writeOutput(`miravo v${MIRAVO_VERSION} — Industrial environment platform
 
@@ -67,7 +71,7 @@ Quick start:
   $ miravo ps                       List background simulations
 
 Run miravo --help for all commands.
-Docs: https://github.com/amine-amaach/miravo`);
+Docs: https://miravo.dev/docs`);
     })
     .hook("preAction", (_thisCommand, actionCommand) => {
       const rootOpts = program.opts<{
@@ -111,6 +115,10 @@ Docs: https://github.com/amine-amaach/miravo`);
   registerResetCommand(program);
   registerInjectCommand(program);
   registerAdapterCommand(program);
+  registerExportCommand(program);
+  registerApplyCommand(program);
+  registerCleanupCommand(program);
+  registerEnvironmentsCommand(program);
 
   // Content discovery
   registerModelsCommand(program);

package/src/lib/admin-auth.ts

@@ -0,0 +1,157 @@
+/**
+ * Auth route handlers for the Miravo admin server.
+ *
+ * Each exported function handles a single auth endpoint and returns a Response.
+ */
+
+import { ChangePasswordRequestSchema, LoginRequestSchema } from "@miravo/shared";
+import { checkContentType, jsonResponse } from "./admin-responses.ts";
+import type { SessionStore } from "./session-store.ts";
+import { buildClearCookie, buildSessionCookie, extractSessionId } from "./session-store.ts";
+
+/** Minimal auth configuration needed by auth handlers. */
+interface AuthConfig {
+  readonly verifyPassword: (password: string) => Promise<boolean>;
+  readonly isDefaultPassword: boolean;
+  readonly sessionStore: SessionStore;
+  readonly changePassword: (oldPassword: string, newPassword: string) => Promise<void>;
+  readonly anonymousMode?: boolean;
+}
+
+/**
+ * POST /auth/login
+ * Validates credentials and sets a session cookie on success.
+ */
+export async function handleLogin(request: Request, auth: AuthConfig): Promise<Response> {
+  if (auth.anonymousMode) {
+    const session = auth.sessionStore.create("anonymous");
+    return new Response(JSON.stringify({ ok: true, changePassword: false }), {
+      status: 200,
+      headers: {
+        "content-type": "application/json; charset=utf-8",
+        "set-cookie": buildSessionCookie(session.id),
+        "cache-control": "no-store",
+      },
+    });
+  }
+
+  const ctBlock = checkContentType(request);
+  if (ctBlock) return ctBlock;
+
+  let payload: unknown;
+  try {
+    payload = await request.json();
+  } catch {
+    return jsonResponse({ message: "Invalid JSON.", error: "Send valid JSON." }, 400);
+  }
+
+  const validation = LoginRequestSchema.safeParse(payload);
+  if (!validation.success) {
+    return jsonResponse(
+      { message: "Invalid login request.", error: "Provide username and password." },
+      400,
+    );
+  }
+  if (validation.data.username !== "admin") {
+    return jsonResponse(
+      { message: "Invalid credentials.", error: "Check username and password." },
+      401,
+    );
+  }
+  const passwordValid = await auth.verifyPassword(validation.data.password);
+  if (!passwordValid) {
+    return jsonResponse(
+      { message: "Invalid credentials.", error: "Check username and password." },
+      401,
+    );
+  }
+
+  const session = auth.sessionStore.create("admin");
+  return new Response(JSON.stringify({ ok: true, changePassword: auth.isDefaultPassword }), {
+    status: 200,
+    headers: {
+      "content-type": "application/json; charset=utf-8",
+      "set-cookie": buildSessionCookie(session.id),
+      "cache-control": "no-store",
+    },
+  });
+}
+
+/**
+ * POST /auth/logout
+ * Destroys the current session and clears the session cookie.
+ */
+export function handleLogout(request: Request, auth: AuthConfig): Response {
+  const sessionId = extractSessionId(request);
+  if (sessionId) auth.sessionStore.destroy(sessionId);
+  return new Response(JSON.stringify({ ok: true }), {
+    status: 200,
+    headers: {
+      "content-type": "application/json; charset=utf-8",
+      "set-cookie": buildClearCookie(),
+      "cache-control": "no-store",
+    },
+  });
+}
+
+/**
+ * PUT /auth/password
+ * Changes the admin password. Requires an active session.
+ * The caller is responsible for verifying the session before calling this handler.
+ */
+export async function handlePasswordChange(request: Request, auth: AuthConfig): Promise<Response> {
+  const ctBlock = checkContentType(request);
+  if (ctBlock) return ctBlock;
+
+  let payload: unknown;
+  try {
+    payload = await request.json();
+  } catch {
+    return jsonResponse({ message: "Invalid JSON.", error: "Send valid JSON." }, 400);
+  }
+
+  const validation = ChangePasswordRequestSchema.safeParse(payload);
+  if (!validation.success) {
+    return jsonResponse(
+      {
+        message: "Invalid request.",
+        error: "Provide oldPassword and newPassword (min 6 chars).",
+      },
+      400,
+    );
+  }
+
+  try {
+    await auth.changePassword(validation.data.oldPassword, validation.data.newPassword);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "Password change failed";
+    return jsonResponse({ message: msg, error: "Check old password." }, 400);
+  }
+
+  // Invalidate all existing sessions, then issue a fresh one for the caller
+  auth.sessionStore.clear();
+  const session = auth.sessionStore.create("admin");
+  return new Response(JSON.stringify({ ok: true }), {
+    status: 200,
+    headers: {
+      "content-type": "application/json",
+      "set-cookie": buildSessionCookie(session.id),
+    },
+  });
+}
+
+/**
+ * GET /auth/status
+ * Returns authentication state for the current session cookie.
+ */
+export function handleAuthStatus(request: Request, auth: AuthConfig): Response {
+  if (auth.anonymousMode) {
+    return jsonResponse({ authenticated: true, username: "anonymous" }, 200);
+  }
+  const sessionId = extractSessionId(request);
+  const session = sessionId ? auth.sessionStore.validate(sessionId) : null;
+  if (session) {
+    return jsonResponse({ authenticated: true, username: session.username }, 200);
+  }
+  return jsonResponse({ authenticated: false }, 200);
+}

package/src/lib/admin-client.test.ts

@@ -6,29 +6,45 @@ const originalFetch = globalThis.fetch;
 
 afterEach(() => {
   globalThis.fetch = originalFetch;
-  delete Bun.env["MIRAVO_ADMIN_TOKEN"];
+  delete Bun.env["MIRAVO_ADMIN_PASSWORD"];
 });
 
 describe("admin-client", () => {
-  test("forwards MIRAVO_ADMIN_TOKEN on command requests", async () => {
-    Bun.env["MIRAVO_ADMIN_TOKEN"] = "secret-token";
-
-    globalThis.fetch = (async (_input, init) => {
-      expect(init?.headers).toEqual({
-        "content-type": "application/json",
-        authorization: "Bearer secret-token",
-      });
-      return Response.json({
-        success: true,
-        command: "pause",
-        correlationId: "req-1",
-        message: "paused",
-      });
+  test("authenticates via session login and sends cookie on command requests", async () => {
+    let loginCalled = false;
+    let commandCookie = "";
+
+    globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+
+      // Login request
+      if (url.endsWith("/auth/login")) {
+        loginCalled = true;
+        return new Response(JSON.stringify({ ok: true, changePassword: false }), {
+          status: 200,
+          headers: { "set-cookie": "miravo_session=test-session-id; HttpOnly; Path=/" },
+        });
+      }
+
+      // Command request — verify session cookie is sent
+      if (url.endsWith("/commands")) {
+        commandCookie = (init?.headers as Record<string, string>)?.["cookie"] ?? "";
+        return Response.json({
+          success: true,
+          command: "pause",
+          correlationId: "req-1",
+          message: "paused",
+        });
+      }
+
+      return Response.json({ message: "Not found" }, { status: 404 });
     }) as typeof fetch;
 
     const command: EngineCommand = { type: "pause", correlationId: "req-1" };
     const result = await executeAdminCommand("http://127.0.0.1:8080", command, 1_000);
 
+    expect(loginCalled).toBe(true);
+    expect(commandCookie).toBe("miravo_session=test-session-id");
     expect(result.success).toBe(true);
     expect(result.command).toBe("pause");
   });

package/src/lib/admin-client.ts

@@ -10,6 +10,7 @@ import {
   EngineStateSnapshotSchema,
   MiravoError,
 } from "@miravo/shared";
+import { loadCredential } from "./auth-store.ts";
 
 const DEFAULT_ADMIN_HOST = "127.0.0.1";
 const DEFAULT_ADMIN_PORT = 8080;
@@ -87,19 +88,67 @@ function parseAdminUrl(input: string): string {
   return url.toString().replace(/\/$/, "");
 }
 
-function buildRequestHeaders(body?: string): Record<string, string> | undefined {
+// ---------------------------------------------------------------------------
+// Session-based auth for CLI client
+// ---------------------------------------------------------------------------
+
+let sessionCookie: string | null = null;
+
+async function loginToAdmin(adminUrl: string): Promise<void> {
+  // Resolve password: env > file > default
+  const envPassword = Bun.env["MIRAVO_ADMIN_PASSWORD"];
+  let password = "admin";
+  if (envPassword && envPassword.trim().length > 0) {
+    password = envPassword;
+  } else {
+    const credential = await loadCredential();
+    // If credential file exists, we can't reverse the hash — use "admin" as default.
+    // The server will verify against the stored hash. If the user changed their password,
+    // they need to set MIRAVO_ADMIN_PASSWORD env var for CLI access.
+    if (!credential) {
+      password = "admin";
+    }
+  }
+
+  const response = await fetch(`${adminUrl}/auth/login`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ username: "admin", password }),
+    signal: AbortSignal.timeout(10_000),
+  });
+
+  if (!response.ok) {
+    throw new MiravoError(
+      "CLI authentication failed.",
+      "Set MIRAVO_ADMIN_PASSWORD or log in with default credentials (admin/admin).",
+    );
+  }
+
+  const setCookie = response.headers.get("set-cookie");
+  if (setCookie) {
+    // Extract just the cookie value (before first ;)
+    sessionCookie = setCookie.split(";")[0] ?? null;
+  }
+}
+
+async function ensureAuthenticated(adminUrl: string): Promise<void> {
+  if (sessionCookie) return;
+  await loginToAdmin(adminUrl);
+}
+
+function buildRequestHeaders(body?: string): Record<string, string> {
   const headers: Record<string, string> = {};
   if (body) {
     headers["content-type"] = "application/json";
   }
-  const adminToken = Bun.env["MIRAVO_ADMIN_TOKEN"];
-  if (adminToken && adminToken.trim().length > 0) {
-    headers["authorization"] = `Bearer ${adminToken}`;
+  if (sessionCookie) {
+    headers["cookie"] = sessionCookie;
   }
-  return Object.keys(headers).length > 0 ? headers : undefined;
+  return headers;
 }
 
 async function requestJson<T>(options: RequestJsonOptions<T>): Promise<T> {
+  await ensureAuthenticated(options.baseUrl);
   const requestUrl = new URL(options.path, `${options.baseUrl}/`).toString();
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), options.timeoutMs);
@@ -128,6 +177,18 @@ async function requestJson<T>(options: RequestJsonOptions<T>): Promise<T> {
       );
     }
 
+    // Re-authenticate on session expiry and retry once
+    if (response.status === 401) {
+      sessionCookie = null;
+      await loginToAdmin(options.baseUrl);
+      response = await fetch(requestUrl, {
+        method: options.method ?? "GET",
+        headers: buildRequestHeaders(options.body),
+        body: options.body,
+        signal: controller.signal,
+      });
+    }
+
     const text = await response.text();
     let parsedJson: unknown;
     if (text.length > 0) {
@@ -223,4 +284,43 @@ async function executeAdminCommand(
   });
 }
 
-export { executeAdminCommand, getAdminMetrics, getAdminSnapshot, getAdminState, resolveAdminUrl };
+/** Schema that accepts any JSON object — used for adapter introspection (protocol-specific shape). */
+const AnyObjectSchema = {
+  safeParse(value: unknown): SafeParseResult<Record<string, unknown>> {
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+      return { success: true, data: value as Record<string, unknown> };
+    }
+    return { success: false };
+  },
+};
+
+async function getManifest(adminUrl: string, timeoutMs: number): Promise<Record<string, unknown>> {
+  return requestJson({
+    baseUrl: adminUrl,
+    path: "/manifest",
+    timeoutMs,
+    schema: AnyObjectSchema,
+  });
+}
+
+async function getLeDtJson(
+  adminUrl: string,
+  modelName: string,
+  timeoutMs: number,
+): Promise<Record<string, unknown>> {
+  return requestJson({
+    baseUrl: adminUrl,
+    path: `/catalog/models/${encodeURIComponent(modelName)}/le-dt.json`,
+    timeoutMs,
+    schema: AnyObjectSchema,
+  });
+}
+
+export {
+  executeAdminCommand,
+  getAdminSnapshot,
+  getAdminState,
+  getLeDtJson,
+  getManifest,
+  resolveAdminUrl,
+};