// Task 619 — admin-identity-authenticate tool.
//
// The agent-callable PIN-submit surface for native-CC admin sessions. The
// PreToolUse identity gate validates the PIN, writes per-session auth state, and
// only then allows this tool to run; the tool itself re-asks the same loopback
// endpoint solely to fetch and return the authenticated operator's profile to
// the agent. It never touches users.json or Neo4j directly — the endpoint is the
// single resolution surface, so `loadUserProfile` is not duplicated here.
export async function runAuthenticate(pin, deps = {}) {
    const f = deps.fetchImpl ?? fetch;
    const port = deps.uiPort ?? process.env.MAXY_UI_INTERNAL_PORT ?? "";
    const url = `http://127.0.0.1:${port}/api/admin/identity/validate`;
    let data;
    try {
        const r = await f(url, {
            method: "POST",
            headers: { "content-type": "application/json" },
            body: JSON.stringify({ pin }),
        });
        data = (await r.json());
    }
    catch {
        return "Identity service unavailable; could not load your profile.";
    }
    if (data.kind !== "match")
        return "Invalid PIN.";
    const name = data.userName ?? "operator";
    const profile = data.aboutOwner?.ok ? (data.aboutOwner.body ?? "") : "";
    console.error(`[admin-identity] op=about-owner-loaded userId=${(data.userId ?? "").slice(0, 8)}`);
    return `Authenticated as ${name}.\n\n${profile}`.trim();
}
//# sourceMappingURL=admin-identity-authenticate.js.map