[prk-Jr]

Summary

• Add ts ec show <ec-id> and ts ec eids [--ts-eids] [--shared-id], which wrap GET /_ts/admin/ec/{id} and GET /_ts/admin/eids. Operators no longer pass the shared admin password to curl, where it lands in shell history and ps, and no longer build a Cookie header by hand.
• Move the admin transport out of ts cache purge into a shared admin_client module and switch purge to it. The module handles service URL checks, the password from TRUSTED_SERVER_ADMIN_PASSWORD only, no redirects, a 30s timeout and the 401 hint. Add ts keys rotate and ts keys deactivate commands #1430 has no PR yet; its ts keys commands can reuse this client instead of copying it.
• Responses carry raw consent strings and partner UIDs. They go to standard output only: nothing is written to disk, and no response data goes through the logger.

Changes

File	Change
crates/trusted-server-cli/src/admin_client.rs	New shared admin client: base-URL validation, password from the environment, basic auth, redirects off, error_text() for refusals; URL tests moved here from purge
crates/trusted-server-cli/src/commands/cache/{mod,purge}.rs	Purge uses the shared client; request bodies, acknowledgment checks and hints unchanged
crates/trusted-server-cli/src/commands/ec/mod.rs	ts ec subcommands, args (a clap group requires at least one cookie), shared helpers
crates/trusted-server-cli/src/commands/ec/show.rs	Validates the EC ID with core's is_valid_ec_id before sending; summary of tombstone state, auction EIDs and skipped IDs with reasons; --json passthrough; 404/501/401 hints
crates/trusted-server-cli/src/commands/ec/eids.rs	Builds the Cookie header; refuses ;, whitespace, control and non-ASCII characters without echoing the value; matched/unmatched summary; --json
crates/trusted-server-cli/src/{lib,run}.rs, commands/mod.rs	Wire up ts ec
crates/trusted-server-cli/tests/ec_admin.rs	Both commands against the local fixture server
docs/guide/api-reference.md	Admin Diagnostic Endpoints section shows both commands ahead of the curl fallback
docs/guide/cli.md	Command index rows
docs/superpowers/specs/2026-11-05-1432-ts-ec-admin-commands-design.md	Design spec with review log

Behavior notes for reviewers:

• --json validates the body's shape. The body is parsed against the expected shape before printing, so a 200 login page from a proxy is refused rather than printed as the record. A parse failure reports only the line and column, because serde_json's message can quote a UID and CLI errors are logged.
• The 501 hint names both causes. It says that only Fastly holds the identity graph, and only when an EC store is configured. Fastly also returns 501 without ec.ec_store.
• Purge's body-read error is reworded. One purge message changes: a failure to read the response body now reads "could not read the response from {endpoint}".
• Two per-line URL-host lint suppressions need review. They cover the RFC 5737/3849 documentation addresses (192.0.2.1, 2001:db8::1) in the loopback test moved from purge.rs into admin_client.rs. Those lines were already in purge.rs; moving them made the linter treat them as new.
• Cookie values still reach shell history and ps. --ts-eids and --shared-id are flags, as the issue specifies. These are cookie values from the operator's own browser, not the admin password.

Closes

Closes #1432

Spec

Spec: docs/superpowers/specs/2026-11-05-1432-ts-ec-admin-commands-design.md. It has two agent review rounds in its review log; neither found anything blocking.

Test plan

• cargo test-fastly && cargo test-axum: not run; no adapter or core code changed
• cargo clippy-fastly && cargo clippy-axum: not run; no adapter or core code changed
• cargo fmt --all -- --check
• JS tests: not applicable
• JS format: not applicable
• Docs format: cd docs && npm run format, plus the repo-wide Markdown prettier check
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1, used for the runtime check
• Manual testing via fastly compute serve
• Other:
  • cargo clippy-cli is clean on aarch64-apple-darwin. CI runs the Linux triple.
  • cargo test --package trusted-server-cli --target aarch64-apple-darwin: 962 passed, 0 failed. This includes the new tests/ec_admin.rs (13 tests) and the unchanged tests/cache_purge.rs (9).
  • ts dev lint domains --changed-vs origin/main is clean.
  • Negative controls: joining cookies with , instead of ; fails the cookie-header test, and skipping EC ID validation fails the malformed-ID test.
  • Runtime: a scripted run against fastly compute serve (Fastly CLI 15.1.0 with its managed Viceroy 0.22.0; the repo pins 16.0.0 / 0.21.0) with seeded EC records, and against the Axum binary. It passed 31/31:
    • show covers a live record (auction EIDs, plus bidstream_disabled and not_in_registry skips), a tombstone, a corrupt entry, 404, 401, and a malformed ID that sends no request.
    • --json output is byte-identical to curl's body.
    • eids covers matched and unmatched sources, a cookie-injection refusal and a bad base64 value.
    • cache purge --all agrees with curl.
    • On Axum, show returns the 501 explanation, eids works, and purge is refused.

Checklist

• Feature PRs: spec linked above, ending in a review log of two or more agent review rounds
• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses log macros (not println!)
• New code has tests
• No secrets or credentials committed