rovloom 0.4.0 → 0.5.0

package/dist/src/{chunk-v1httsp6.js → chunk-64ftwe9b.js}

@@ -1,14 +1,14 @@
 // @bun
 import {
   resolveRoleConfigPath2
-} from "./chunk-qfyefed3.js";
+} from "./chunk-1bf0wmgk.js";
 import {
   CliError2,
   parseConfig2,
   configDocument2,
   configTemplate2,
   readConfig2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import {
   ensurePrivateDirectory
 } from "./chunk-0y5542k8.js";

package/dist/src/{chunk-76wgt2g5.js → chunk-9y36gntb.js}

@@ -19,7 +19,7 @@ import {
 } from "./chunk-7crhmqn2.js";
 import {
   PRODUCT_VERSION2
-} from "./chunk-xmkgq3nh.js";
+} from "./chunk-r0nfthsf.js";
 import {
   canonicalLoopbackHost
 } from "./chunk-6n9s7nfe.js";
@@ -539,13 +539,14 @@ function createHttpFacade2(options) {
       return denied(503);
     }
     const host = request.headers.get("host");
-    const loopback = url.origin === origin.origin && host === origin.host;
+    const lanOrigin = options.lan === true && host !== null && Buffer.byteLength(host) <= 2048 && url.protocol === "http:" && host.toLowerCase() !== origin.host.toLowerCase() && host.toLowerCase() !== publicUrl?.host.toLowerCase() ? "http://" + host.toLowerCase() : undefined;
+    const loopback = url.origin === origin.origin && host !== null && host.toLowerCase() === origin.host.toLowerCase();
     const proxied = publicUrl !== undefined && host === publicUrl.host && url.host === publicUrl.host;
-    if (!loopback && !proxied || url.pathname !== "/mcp" || url.search || url.hash) {
+    if (!loopback && !proxied && lanOrigin === undefined || url.pathname !== "/mcp" || url.search || url.hash) {
       return denied(403);
     }
     const requestOrigin = request.headers.get("origin");
-    if (requestOrigin !== null && !allowedOrigins.has(requestOrigin)) {
+    if (requestOrigin !== null && !allowedOrigins.has(requestOrigin) && requestOrigin !== lanOrigin) {
       return denied(403);
     }
     if (!["GET", "POST", "DELETE"].includes(request.method)) {
@@ -763,4 +764,4 @@ function startHttpFacade2(options) {
 
 export { createMcpFacade2, HTTP_BODY_BYTES2, createHttpFacade2, startHttpFacade2 };
 
-//# debugId=70BAA7C73CB4FDA064756E2164756E21
+//# debugId=7CD2FDC41059ADFA64756E2164756E21

package/dist/src/{chunk-ydmabg5t.js → chunk-9yg6x3gt.js}

@@ -3,11 +3,11 @@ import {
   writeAdminFiles2,
   managementSourceExists2,
   handleAdminCommand2
-} from "./chunk-wdr3sdsm.js";
-import"./chunk-qab3m6nh.js";
-import"./chunk-qfyefed3.js";
-import"./chunk-se5daacy.js";
-import"./chunk-bjdqj43d.js";
+} from "./chunk-fnakrk0a.js";
+import"./chunk-ebm3kvnq.js";
+import"./chunk-1bf0wmgk.js";
+import"./chunk-z7kkfrgz.js";
+import"./chunk-hpzr94hm.js";
 import"./chunk-3nnahj0j.js";
 import"./chunk-0y5542k8.js";
 import"./chunk-g7pnjzkk.js";

package/dist/src/{chunk-keg92d31.js → chunk-abd4envz.js}

@@ -1,13 +1,13 @@
 // @bun
 import {
   readRuntimeConfig2
-} from "./chunk-6hxy1fcg.js";
+} from "./chunk-bspzg8er.js";
 import {
   readOrCreateRoleConfig
-} from "./chunk-v1httsp6.js";
+} from "./chunk-64ftwe9b.js";
 import {
   resolveRoleConfigPath2
-} from "./chunk-qfyefed3.js";
+} from "./chunk-1bf0wmgk.js";
 import {
   CLI_ERROR_CODES,
   CliError2,
@@ -15,10 +15,10 @@ import {
   configDocument2,
   configTemplate2,
   readConfig2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import {
   PRODUCT_VERSION2
-} from "./chunk-xmkgq3nh.js";
+} from "./chunk-r0nfthsf.js";
 import {
   isWildcardHostname
 } from "./chunk-6n9s7nfe.js";
@@ -85,6 +85,7 @@ var HELP2 = `Rovloom ${PRODUCT_VERSION2}
   rovloom admin --help
 
 gateway / connector \u542F\u52A8\u5BF9\u5E94\u89D2\u8272\u3002\u9996\u6B21\u8FD0\u884C\u65F6\u5728\u771F\u5B9E\u672C\u5730\u7EC8\u7AEF\u5B8C\u6210\u4E00\u6B21\u6027\u914D\u5BF9\u4E0E\u539F\u751F\u5B89\u88C5\u6279\u51C6\uFF1B
+\u5728\u7EC8\u7AEF\u62D2\u7EDD\u914D\u5BF9\u63D0\u793A\u65F6\uFF0CGateway \u4FDD\u6301\u672A\u914D\u5BF9\u8FD0\u884C\uFF0C\u53EF\u5148\u8FD0\u884C rovloom admin create \u518D\u4ECE\u7BA1\u7406\u9875\u5B8C\u6210\u9996\u53F0\u914D\u5BF9\uFF1B
 --add-device \u5728\u5DF2\u5B8C\u6210\u7684\u5F15\u5BFC\u4E4B\u4E0A\u518D\u914D\u5BF9\u4E00\u53F0 Connector\uFF08\u6CBF\u7528\u540C\u4E00 MCP \u51ED\u636E\uFF0C\u6388\u6743\u968F\u4E4B\u6269\u5927\u5230\u65B0\u8BBE\u5907\uFF09\uFF1B
 --repair-device / --repair \u91CD\u65B0\u914D\u5BF9\u5DF2\u914D\u5BF9\u7684\u540C\u4E00\u8BBE\u5907\uFF08\u51ED\u636E\u4E22\u5931\u6216\u6CC4\u6F0F\uFF09\uFF0C\u4FDD\u7559\u539F\u751F\u8BBE\u7F6E\u4E0E MCP \u6388\u6743\u3002
 --claim \u8BA9\u672A\u914D\u5BF9\u7684 Connector \u5411\u8FD0\u884C\u4E2D\u7684 Gateway \u5728\u7EBF\u8BA4\u9886\u7BA1\u7406\u5458\u521B\u5EFA\u7684\u914D\u5BF9\u7533\u8BF7\uFF08\u7BA1\u7406\u9875\u6838\u5BF9\u7801\u6279\u51C6\uFF0CGateway \u4E0D\u505C\u673A\uFF09\u3002
@@ -211,19 +212,19 @@ async function runCli2(args, io, runtime = {}, environment) {
       throw new CliError2("invalid_arguments");
     }
     if (args[0] === "admin") {
-      const { handleAdminCommand } = await import("./chunk-ydmabg5t.js");
+      const { handleAdminCommand } = await import("./chunk-9yg6x3gt.js");
       return await handleAdminCommand(args, io, environment);
     }
     if (args[0] === "doctor" || args[0] === "storage") {
-      const { handleStorageCommand } = await import("./chunk-1fyfrgte.js");
+      const { handleStorageCommand } = await import("./chunk-0ake7e4r.js");
       return await handleStorageCommand(args, io, environment);
     }
     if (args[0] === "token") {
-      const { handleTokenCommand } = await import("./chunk-8x6ygvhh.js");
+      const { handleTokenCommand } = await import("./chunk-sj24fpz3.js");
       return await handleTokenCommand(args, io, environment);
     }
     if (args[0] === "config" && args[1] === "init") {
-      const { initializeRoleConfig } = await import("./chunk-5vx1b9z8.js");
+      const { initializeRoleConfig } = await import("./chunk-xhq21g24.js");
       initializeRoleConfig(args, environment);
       io.stderr.write(`config_ready
 `);
@@ -313,13 +314,14 @@ async function runCli2(args, io, runtime = {}, environment) {
         io.stderr.write(WILDCARD_LISTEN_WARNING);
       }
       try {
-        const { startHttpFacade } = await import("./chunk-4af38z2b.js");
+        const { startHttpFacade } = await import("./chunk-ybte82d3.js");
         const http = startHttpFacade({
           service: gateway.service,
           authentication: gateway.authentication,
           hostname: config.mcp_hostname,
           port: config.mcp_port,
           ...config.mcp_public_url ? { publicUrl: config.mcp_public_url } : {},
+          ...config.mcp_lan ? { lan: true } : {},
           diagnostic: (code) => io.stderr.write(code + `
 `)
         });
@@ -374,4 +376,4 @@ Gateway \u5DF2\u542F\u52A8\uFF1B\u4F7F\u7528 Agent \u524D\u4ECD\u9700\u5B8C\u621
 
 export { HELP2, parseCommand2, runCli2 };
 
-//# debugId=D32F2D6B4ECB1A3C64756E2164756E21
+//# debugId=EDE27C0F1768E16864756E2164756E21

package/dist/src/{chunk-6hxy1fcg.js → chunk-bspzg8er.js}

@@ -8,10 +8,10 @@ import {
 import {
   runtimeReference,
   readRuntimeJson
-} from "./chunk-se5daacy.js";
+} from "./chunk-z7kkfrgz.js";
 import {
   CliError2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 
 // src/cli/runtime-config.ts
 function providers(config) {

package/dist/src/{chunk-t3pn1435.js → chunk-e7x51y0t.js}

@@ -69,10 +69,10 @@ import {
 } from "./chunk-2tn0r64b.js";
 import {
   readRuntimeFile
-} from "./chunk-se5daacy.js";
+} from "./chunk-z7kkfrgz.js";
 import {
   CliError2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import"./chunk-vwcntax3.js";
 import"./chunk-gbsbwssz.js";
 import"./chunk-3nnahj0j.js";

package/dist/src/{chunk-qab3m6nh.js → chunk-ebm3kvnq.js}

@@ -6,12 +6,15 @@ import {
   boundedJson2,
   validatePolicies2
 } from "./chunk-qt9m2kg2.js";
+import {
+  DEFAULT_PAIRING_POLICY_REF
+} from "./chunk-5j0gj6w2.js";
 import {
   readRuntimeJson
-} from "./chunk-se5daacy.js";
+} from "./chunk-z7kkfrgz.js";
 import {
   CliError2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import {
   privatePath,
   readPrivateBytes
@@ -255,7 +258,13 @@ var DEFAULT_ADMIN_TTL_DAYS = 30;
 var DAY2 = 86400000;
 var PRINCIPAL2 = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
 function emptyManagement(port) {
-  return { schema_version: 1, kind: "management-session-source", port, sessions: [], pairing_policy_refs: [] };
+  return {
+    schema_version: 1,
+    kind: "management-session-source",
+    port,
+    sessions: [],
+    pairing_policy_refs: [DEFAULT_PAIRING_POLICY_REF]
+  };
 }
 function isAdminPlaceholder(entry) {
   return entry.principal.policy.revision === ADMIN_POLICY_REVISION && entry.principal.policy.grants.length === 0;
@@ -309,7 +318,11 @@ function issueAdmin(callers, management, principal, now, days) {
         placeholder
       ]
     },
-    management: { ...management, sessions: [...others, session] },
+    management: {
+      ...management,
+      sessions: [...others, session],
+      pairing_policy_refs: management.pairing_policy_refs.length ? management.pairing_policy_refs : [DEFAULT_PAIRING_POLICY_REF]
+    },
     secret,
     expires_at
   };
@@ -340,4 +353,4 @@ function summarizeAdmins(management, now) {
 
 export { setupFileStamp, writeSetupFile, readSetupJson, writeSetupJson, REGISTRY_MAX_BYTES, parseRegistry, createCaller, setDiscardPermission, renewCaller, rotateCaller, revokeCaller, summarize, DEFAULT_ADMIN_TTL_DAYS, emptyManagement, isAdminPlaceholder, issueAdmin, revokeAdmin, summarizeAdmins };
 
-//# debugId=AF7C6D3D6A23BCC764756E2164756E21
+//# debugId=3023B85F5DE2326664756E2164756E21

package/dist/src/{chunk-ymsx7hhd.js → chunk-erdq0rn8.js}

@@ -21,7 +21,7 @@ import {
   observedHerdrSource
 } from "./chunk-9tt13dm0.js";
 import"./chunk-g7pnjzkk.js";
-import"./chunk-wdr3sdsm.js";
+import"./chunk-fnakrk0a.js";
 import"./chunk-mqyq5jh6.js";
 import"./chunk-zj48jvfe.js";
 import {
@@ -30,7 +30,7 @@ import {
   setupReference,
   setupSessionsFor,
   GatewaySetup
-} from "./chunk-fd9n51mc.js";
+} from "./chunk-n073xnr1.js";
 import {
   compileHerdrSchemas2
 } from "./chunk-5h82060k.js";
@@ -72,17 +72,17 @@ import {
   writeSetupFile,
   readSetupJson,
   writeSetupJson
-} from "./chunk-qab3m6nh.js";
+} from "./chunk-ebm3kvnq.js";
 import {
   readRuntimeConfig2
-} from "./chunk-6hxy1fcg.js";
+} from "./chunk-bspzg8er.js";
 import {
   privateDirectory
-} from "./chunk-v1httsp6.js";
-import"./chunk-qfyefed3.js";
+} from "./chunk-64ftwe9b.js";
+import"./chunk-1bf0wmgk.js";
 import {
   runtimeReference
-} from "./chunk-se5daacy.js";
+} from "./chunk-z7kkfrgz.js";
 import {
   herdrMode,
   luvusMode,
@@ -92,7 +92,7 @@ import {
   parseConfig2,
   configDocument2,
   readConfig2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import {
   createFileCredentialSink2,
   loadCredential2

package/dist/src/{chunk-wdr3sdsm.js → chunk-fnakrk0a.js}

@@ -15,19 +15,22 @@ import {
   issueAdmin,
   revokeAdmin,
   summarizeAdmins
-} from "./chunk-qab3m6nh.js";
+} from "./chunk-ebm3kvnq.js";
 import {
   resolveRoleConfigPath2
-} from "./chunk-qfyefed3.js";
+} from "./chunk-1bf0wmgk.js";
 import {
   runtimeReference,
   readRuntimeJson
-} from "./chunk-se5daacy.js";
+} from "./chunk-z7kkfrgz.js";
 import {
   CLI_ERROR_CODES,
   CliError2,
   readConfig2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
+import {
+  canonicalLoopbackHost
+} from "./chunk-6n9s7nfe.js";
 
 // src/cli/admin-command.ts
 var ADMIN_HELP = `\u7528\u6CD5\uFF1A
@@ -39,7 +42,8 @@ var ADMIN_HELP = `\u7528\u6CD5\uFF1A
 \u53E3\u4EE4\u539F\u503C\u53EA\u5728 create \u65F6\u5199\u5230 stdout \u4E00\u6B21\uFF08Gateway \u53EA\u4FDD\u5B58 SHA-256 \u6458\u8981\uFF09\uFF1B\u5176\u4F59\u4FE1\u606F\u5199\u5230 stderr\u3002\u4E22\u5931\u53E3\u4EE4\u5C31\u518D create \u4E00\u6B21\uFF1A
 \u540C\u540D\u7BA1\u7406\u5458\u88AB\u91CD\u65B0\u7B7E\u53D1\uFF0C\u65E7\u53E3\u4EE4\u4E0E\u5DF2\u767B\u5F55\u7684\u6D4F\u89C8\u5668\u4F1A\u8BDD\u7ACB\u5373\u5931\u6548\u3002revoke \u5220\u9664\u7BA1\u7406\u5458\uFF0C\u540C\u6837\u7ACB\u5373\u751F\u6548\u3002\u4FEE\u6539\u65E0\u9700\u91CD\u542F Gateway\u3002
 \u7BA1\u7406\u5458\u4E0D\u80FD\u8C03\u7528 MCP\uFF0C\u4E5F\u4E0E MCP \u4EE4\u724C\u3001\u8BBE\u5907\u51ED\u636E\u4E92\u4E0D\u901A\u7528\uFF1B\u6709\u6548\u671F\u9ED8\u8BA4 ${DEFAULT_ADMIN_TTL_DAYS} \u5929\uFF081-365\uFF09\u3002
-\u9700\u8981\u5148\u5B8C\u6210 Gateway \u9996\u6B21\u914D\u5BF9\uFF08\u6B64\u65F6\u624D\u5B58\u5728 MCP \u8C03\u7528\u65B9\u6CE8\u518C\u8868\uFF09\u3002
+\u53EF\u5728\u9996\u6B21\u914D\u5BF9\u524D\u521B\u5EFA\uFF1A\u5168\u65B0 Gateway \u4F1A\u81EA\u884C\u521D\u59CB\u5316\u7A7A\u7684 MCP \u8C03\u7528\u65B9\u6CE8\u518C\u8868\uFF0C\u968F\u540E\u5373\u53EF\u5728\u7BA1\u7406\u9875
+\u5728\u7EBF\u914D\u5BF9\u9996\u53F0 Connector\uFF08\u65B0\u5EFA\u7533\u8BF7\uFF0C\u8BBE\u5907\u8FD0\u884C rovloom connector --claim\uFF09\u3002
 `;
 function parse(args) {
   const sub = args[1];
@@ -87,16 +91,43 @@ function loadManagement(path, port) {
   }
   return { file: value, exists: true };
 }
+function callerResource(config) {
+  const hostname = canonicalLoopbackHost(config.mcp_hostname);
+  return new URL("http://" + hostname + ":" + config.mcp_port + "/mcp").href;
+}
+function emptyCallerRegistry(resource) {
+  return {
+    schema_version: 1,
+    kind: "mcp-caller-source",
+    resource,
+    local_policy: { revision: "rovloom_unpaired", grants: [] },
+    callers: []
+  };
+}
+function callersStamp(path) {
+  try {
+    return setupFileStamp(path);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return;
+    }
+    throw error;
+  }
+}
 function writeAdminFiles2(config, principal, at, days) {
   const callersPath = runtimeReference(config.state_dir, "mcp-callers");
   const managementPath = runtimeReference(config.state_dir, "management");
-  const callersStamp = setupFileStamp(callersPath);
-  const callers = parseRegistry(readRuntimeJson(callersPath, REGISTRY_MAX_BYTES));
+  const stamp = callersStamp(callersPath);
+  const callers = parseRegistry(readSetupJson(callersPath, REGISTRY_MAX_BYTES) ?? emptyCallerRegistry(callerResource(config)));
   const { file, exists } = loadManagement(managementPath, config.management_port);
-  const stamp = exists ? setupFileStamp(managementPath) : undefined;
+  const managementStamp = exists ? setupFileStamp(managementPath) : undefined;
   const issued = issueAdmin(callers, file, principal, at, days);
-  writeSetupFile(callersPath, boundedJson2(issued.callers, REGISTRY_MAX_BYTES), true, callersStamp);
-  writeSetupFile(managementPath, boundedJson2(issued.management, 65536), exists, stamp);
+  if (stamp === undefined) {
+    writeSetupFile(callersPath, boundedJson2(issued.callers, REGISTRY_MAX_BYTES), false);
+  } else {
+    writeSetupFile(callersPath, boundedJson2(issued.callers, REGISTRY_MAX_BYTES), true, stamp);
+  }
+  writeSetupFile(managementPath, boundedJson2(issued.management, 65536), exists, managementStamp);
   return { secret: issued.secret, expires_at: issued.expires_at };
 }
 function managementSourceExists2(config) {
@@ -157,4 +188,4 @@ login at http://127.0.0.1:` + config.management_port + '/ with user "' + princip
 
 export { writeAdminFiles2, managementSourceExists2, handleAdminCommand2 };
 
-//# debugId=DF62A5BEF1087BFE64756E2164756E21
+//# debugId=B65D75D1FF47247C64756E2164756E21

package/dist/src/{chunk-bjdqj43d.js → chunk-hpzr94hm.js}

@@ -5,6 +5,9 @@ import {
 import {
   parseNativeJson2
 } from "./chunk-7crhmqn2.js";
+import {
+  isWildcardHostname
+} from "./chunk-6n9s7nfe.js";
 import {
   binDirectories
 } from "./chunk-3nnahj0j.js";
@@ -107,10 +110,14 @@ function parseConfig2(value, platform = process.platform) {
       if (!hosts.includes(row.hostname)) {
         return fail();
       }
+      if (row.lan !== undefined && row.lan !== true) {
+        return fail();
+      }
       return {
         hostname: row.hostname,
         port: port(row.port),
-        public_url: row.public_url
+        public_url: row.public_url,
+        ...row.lan === true ? { lan: true } : {}
       };
     };
     if (input.schema_version !== 1 || !["gateway", "connector"].includes(input.role)) {
@@ -122,12 +129,15 @@ function parseConfig2(value, platform = process.platform) {
     }
     if (input.role === "gateway") {
       exact(input, ["schema_version", "role", "data", "mcp", "devices", "management"]);
-      const mcp = listener(input.mcp, ["public_url"]);
+      const mcp = listener(input.mcp, ["public_url", "lan"]);
       if (mcp.public_url !== undefined && !publicMcpUrl(mcp.public_url)) {
         return fail();
       }
+      if (mcp.lan !== undefined && (mcp.lan !== true || !isWildcardHostname(mcp.hostname))) {
+        return fail();
+      }
       const devices = listener(input.devices);
-      const management = exact(input.management, ["enabled", "port"], ["hostname"]);
+      const management = exact(input.management, ["enabled", "port"], ["hostname", "lan"]);
       if (typeof management.enabled !== "boolean") {
         return fail();
       }
@@ -136,6 +146,9 @@ function parseConfig2(value, platform = process.platform) {
       }
       const managementHostname = management.hostname ?? "127.0.0.1";
       const managementPort = port(management.port);
+      if (management.lan !== undefined && (management.lan !== true || managementHostname !== "0.0.0.0")) {
+        return fail();
+      }
       if (new Set([mcp.port, devices.port, ...management.enabled ? [managementPort] : []]).size !== (management.enabled ? 3 : 2)) {
         return fail();
       }
@@ -147,11 +160,13 @@ function parseConfig2(value, platform = process.platform) {
         mcp_hostname: mcp.hostname,
         mcp_port: mcp.port,
         ...mcp.public_url !== undefined ? { mcp_public_url: mcp.public_url } : {},
+        ...mcp.lan === true ? { mcp_lan: true } : {},
         device_hostname: devices.hostname,
         device_port: devices.port,
         management_enabled: management.enabled,
         management_hostname: managementHostname,
         management_port: managementPort,
+        ...management.lan === true ? { management_lan: true } : {},
         authentication_ref: "mcp-callers"
       });
     }
@@ -219,13 +234,15 @@ function configDocument2(config) {
     mcp: {
       hostname: config.mcp_hostname,
       port: config.mcp_port,
-      ...config.mcp_public_url !== undefined ? { public_url: config.mcp_public_url } : {}
+      ...config.mcp_public_url !== undefined ? { public_url: config.mcp_public_url } : {},
+      ...config.mcp_lan === true ? { lan: true } : {}
     },
     devices: { hostname: config.device_hostname, port: config.device_port },
     management: {
       enabled: config.management_enabled,
       ...config.management_hostname !== "127.0.0.1" ? { hostname: config.management_hostname } : {},
-      port: config.management_port
+      port: config.management_port,
+      ...config.management_lan === true ? { lan: true } : {}
     }
   } : {
     ...common,
@@ -286,4 +303,4 @@ function readConfig2(path) {
 
 export { herdrMode, luvusMode, selectedNativeProviders, CLI_ERROR_CODES, CliError2, CliCancelled, parseConfig2, configDocument2, configTemplate2, readConfig2 };
 
-//# debugId=8E2FBD65A09D61EC64756E2164756E21
+//# debugId=75790FE78402A30364756E2164756E21

package/dist/src/{chunk-fd9n51mc.js → chunk-n073xnr1.js}

@@ -33,27 +33,28 @@ import {
 import {
   writeAdminFiles2,
   managementSourceExists2
-} from "./chunk-wdr3sdsm.js";
+} from "./chunk-fnakrk0a.js";
 import {
   setupFileStamp,
   writeSetupFile,
   readSetupJson,
   writeSetupJson,
   REGISTRY_MAX_BYTES,
-  parseRegistry
-} from "./chunk-qab3m6nh.js";
+  parseRegistry,
+  isAdminPlaceholder
+} from "./chunk-ebm3kvnq.js";
 import {
   readRuntimeConfig2
-} from "./chunk-6hxy1fcg.js";
+} from "./chunk-bspzg8er.js";
 import {
   runtimeReference,
   readRuntimeFile,
   readRuntimeJson
-} from "./chunk-se5daacy.js";
+} from "./chunk-z7kkfrgz.js";
 import {
   luvusMode,
   CliError2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import {
   canonicalLoopbackHost
 } from "./chunk-6n9s7nfe.js";
@@ -613,7 +614,7 @@ class SetupApproval {
       return { plan: previous };
     }
     if (!await this.terminal.confirm("Pair one Connector with this Gateway? / \u5141\u8BB8\u914D\u5BF9\u4E00\u4E2A Connector\uFF1F")) {
-      throw new CliError2("configuration_required");
+      return { declined: true };
     }
     const now = Date.now();
     const attempt = randomUUID();
@@ -820,6 +821,34 @@ function unionGrants(existing, added) {
   }
   return merged;
 }
+function publishFirstCallers(path, resource, authorization, caller) {
+  const previous = readSetupJson(path, REGISTRY_MAX_BYTES);
+  const created = {
+    schema_version: 1,
+    kind: "mcp-caller-source",
+    resource,
+    local_policy: authorization.policies.local,
+    callers: [caller]
+  };
+  if (previous === undefined) {
+    parseRegistry(JSON.parse(boundedJson2(created, REGISTRY_MAX_BYTES)));
+    writeSetupFile(path, boundedJson2(created, REGISTRY_MAX_BYTES), false);
+    return;
+  }
+  const registry = parseRegistry(previous, resource);
+  const kept = registry.callers.filter((entry) => isAdminPlaceholder(entry) || boundedJson2(entry, REGISTRY_MAX_BYTES) === boundedJson2(caller, REGISTRY_MAX_BYTES));
+  if (kept.length !== registry.callers.length) {
+    throw new CliError2("configuration_required");
+  }
+  const callers = [...kept];
+  if (!callers.some((entry) => boundedJson2(entry, REGISTRY_MAX_BYTES) === boundedJson2(caller, REGISTRY_MAX_BYTES))) {
+    callers.push(caller);
+  }
+  const merged = { ...created, callers };
+  parseRegistry(JSON.parse(boundedJson2(merged, REGISTRY_MAX_BYTES)), resource);
+  const stamp = setupFileStamp(path);
+  writeSetupFile(path, boundedJson2(merged, REGISTRY_MAX_BYTES), true, stamp);
+}
 
 class GatewaySetup {
   config;
@@ -871,6 +900,14 @@ Stop that Connector, then run rovloom connector --repair on its machine and ente
 Connector endpoint: ` + gateway.transport.url.replace(/\/connector$/, "") + `
 `);
       const issued = await this.approval.issue();
+      if (issued.declined) {
+        const page = this.config.management_enabled ? "http://127.0.0.1:" + this.config.management_port + "/" : "";
+        this.terminal.show(`Gateway stays unpaired and running; no enrollment or credential is issued. / Gateway \u4FDD\u6301\u672A\u914D\u5BF9\u5E76\u7EE7\u7EED\u8FD0\u884C\uFF0C\u4E0D\u7B7E\u53D1\u51ED\u636E\u3002
+` + (page ? "Finish first pairing from the management page: create the administrator with `rovloom admin create`, sign in at " + page + ", create a pairing application, then run `rovloom connector --claim` on the device. / \u5728\u7BA1\u7406\u9875\u5B8C\u6210\u9996\u6B21\u914D\u5BF9\uFF1A\u5148\u7528 `rovloom admin create` \u521B\u5EFA\u7BA1\u7406\u5458\uFF0C\u767B\u5F55 " + page + " \u65B0\u5EFA\u914D\u5BF9\u7533\u8BF7\uFF0C\u518D\u5728\u8BBE\u5907\u4E0A\u8FD0\u884C `rovloom connector --claim`\u3002\n" : `Management is disabled; enable it or rerun to pair from this terminal. / \u7BA1\u7406\u9875\u672A\u542F\u7528\uFF1B\u8BF7\u542F\u7528\u540E\u91CD\u8BD5\u6216\u5728\u672C\u7EC8\u7AEF\u5B8C\u6210\u914D\u5BF9\u3002
+`));
+        this.terminal.finishQuestions();
+        return;
+      }
       if (issued.code) {
         this.terminal.show(`One-time pairing code (5 minutes; keep private) / \u4E00\u6B21\u6027\u914D\u5BF9\u7801\uFF085\u5206\u949F\uFF0C\u8BF7\u4FDD\u5BC6\uFF09:
 ` + issued.code + `
@@ -978,19 +1015,11 @@ Run rovloom connector in another local terminal and enter the Gateway address an
       value: entry.value
     }));
     if (!additional) {
-      publish(callersPath, {
-        schema_version: 1,
-        kind: "mcp-caller-source",
-        resource,
-        local_policy: authorization.policies.local,
-        callers: [
-          {
-            principal: { id: authorization.principal_id, policy: authorization.policies.caller },
-            token_sha256: createHash3("sha256").update(client.token).digest("hex"),
-            issued_at: client.issued_at,
-            expires_at: client.expires_at
-          }
-        ]
+      publishFirstCallers(callersPath, resource, authorization, {
+        principal: { id: authorization.principal_id, policy: authorization.policies.caller },
+        token_sha256: createHash3("sha256").update(client.token).digest("hex"),
+        issued_at: client.issued_at,
+        expires_at: client.expires_at
       });
       publish(providersPath, { schema_version: 1, role: "gateway", providers: reviewedEntries }, 1048576);
     } else {
@@ -1083,6 +1112,6 @@ function mergeSetupProviders(path, entries) {
   writeSetupFile(path, boundedJson2({ ...document, providers: merged }, 1048576), true, stamp);
 }
 
-export { setupSessions, setupTarget, setupProviderKinds, selectedSetupPolicies, setupReference, setupSessionsFor, setupReply, requestJson, device, reviewSetupManifest, publishSetupSchemas, publish, GatewaySetup, mergeSetupCallers, mergeSetupProviders };
+export { setupSessions, setupTarget, setupProviderKinds, selectedSetupPolicies, setupReference, setupSessionsFor, setupReply, requestJson, device, reviewSetupManifest, publishSetupSchemas, publish, publishFirstCallers, GatewaySetup, mergeSetupCallers, mergeSetupProviders };
 
-//# debugId=0617AAABC9378C6D64756E2164756E21
+//# debugId=3920190CFC3283A264756E2164756E21

package/dist/src/{chunk-xmkgq3nh.js → chunk-r0nfthsf.js}

@@ -1,8 +1,8 @@
 // @bun
 // src/mcp/version.ts
 var MCP_REVISION2 = "2025-11-25";
-var PRODUCT_VERSION2 = "0.4.0";
+var PRODUCT_VERSION2 = "0.5.0";
 
 export { MCP_REVISION2, PRODUCT_VERSION2 };
 
-//# debugId=37FCDB7BED42DE7D64756E2164756E21
+//# debugId=1479A7639E360A6A64756E2164756E21

package/dist/src/{chunk-z1vhdr3c.js → chunk-rwpynx2j.js}

@@ -1,19 +1,19 @@
 // @bun
 import {
   createProductionCliRuntime2
-} from "./chunk-dtj9y82v.js";
-import"./chunk-fd9n51mc.js";
-import"./chunk-wdr3sdsm.js";
-import"./chunk-qab3m6nh.js";
+} from "./chunk-5n8csngz.js";
+import"./chunk-n073xnr1.js";
+import"./chunk-fnakrk0a.js";
+import"./chunk-ebm3kvnq.js";
 import"./chunk-2tn0r64b.js";
-import"./chunk-khmgp03q.js";
+import"./chunk-ympzv86c.js";
 import"./chunk-7k9g0x5e.js";
 import"./chunk-smpevv7n.js";
-import"./chunk-6hxy1fcg.js";
-import"./chunk-v1httsp6.js";
-import"./chunk-qfyefed3.js";
-import"./chunk-se5daacy.js";
-import"./chunk-bjdqj43d.js";
+import"./chunk-bspzg8er.js";
+import"./chunk-64ftwe9b.js";
+import"./chunk-1bf0wmgk.js";
+import"./chunk-z7kkfrgz.js";
+import"./chunk-hpzr94hm.js";
 import"./chunk-4etdq0cp.js";
 import"./chunk-5s2emvww.js";
 import"./chunk-d4ejrtjq.js";

package/dist/src/{chunk-8x6ygvhh.js → chunk-sj24fpz3.js}

@@ -18,19 +18,19 @@ import {
   revokeCaller,
   summarize,
   isAdminPlaceholder
-} from "./chunk-qab3m6nh.js";
+} from "./chunk-ebm3kvnq.js";
 import {
   resolveRoleConfigPath2
-} from "./chunk-qfyefed3.js";
+} from "./chunk-1bf0wmgk.js";
 import {
   runtimeReference,
   readRuntimeJson
-} from "./chunk-se5daacy.js";
+} from "./chunk-z7kkfrgz.js";
 import {
   CLI_ERROR_CODES,
   CliError2,
   readConfig2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import"./chunk-3nnahj0j.js";
 import"./chunk-0y5542k8.js";