rovloom 0.4.0 → 0.6.0

package/dist/src/{chunk-khmgp03q.js → chunk-ez7d5dac.js}

@@ -14,6 +14,7 @@ import {
   parseManagementReadPath
 } from "./chunk-gav2y5y9.js";
 import {
+  isWildcardHostname,
   canonicalLoopbackHost
 } from "./chunk-6n9s7nfe.js";
 
@@ -37,6 +38,30 @@ var statuses = {
   invalid_response: 502,
   timeout: 504
 };
+function lanAwareOrigin(request, loopback, lan) {
+  const raw = request.headers.get("host");
+  if (!raw || Buffer.byteLength(raw) > 2048) {
+    return null;
+  }
+  const expected = new URL(loopback);
+  const host = raw.toLowerCase();
+  if (host === expected.host.toLowerCase()) {
+    return expected.origin;
+  }
+  if (!lan) {
+    return null;
+  }
+  try {
+    const url = new URL(request.url);
+    const candidate = "http://" + host;
+    if (new URL(candidate).origin !== candidate) {
+      return null;
+    }
+    return url.host.toLowerCase() === host && url.protocol === "http:" ? candidate : null;
+  } catch {
+    return null;
+  }
+}
 function failure(code, status) {
   return new Response(JSON.stringify({ error: code }), {
     status,
@@ -77,6 +102,9 @@ function assets(input) {
   return result;
 }
 function allowed(request, expected) {
+  if (expected === null) {
+    return null;
+  }
   if (new TextEncoder().encode(request.url).byteLength > MANAGEMENT_URL_BYTES) {
     return null;
   }
@@ -118,7 +146,7 @@ function context(identity, signal) {
 async function initialize(implementation, request, body, signal) {
   return implementation(request, new Response(body.slice().buffer, { headers: { ...headers, "content-type": managementAssetType("/") } }), signal);
 }
-function prepare(options, origin) {
+function prepare(options, origin, lan = () => false) {
   if (!options || typeof options.authenticate !== "function") {
     throw new Error("management_authentication_required");
   }
@@ -174,7 +202,7 @@ function prepare(options, origin) {
     }
     let url;
     try {
-      url = allowed(request, origin());
+      url = allowed(request, lanAwareOrigin(request, origin(), lan()));
     } catch {
       url = null;
     }
@@ -264,24 +292,27 @@ function prepare(options, origin) {
 }
 function createManagementReadHandler2(options) {
   const url = new URL(options.origin);
-  if (url.origin !== options.origin || url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.username || url.password) {
+  if (url.origin !== options.origin || url.protocol !== "http:" || !["127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password) {
     throw new Error("management_listener_invalid");
   }
-  return prepare(options, () => options.origin);
+  return prepare(options, () => options.origin, () => options.lan === true);
 }
 function startManagementReadListener2(options) {
   if (!options) {
     throw new Error("management_listener_invalid");
   }
   let origin = "";
-  const handler = prepare(options, () => origin);
+  let lan = false;
+  const handler = prepare(options, () => origin, () => lan);
   try {
     return startManagementListener2({
       port: options.port,
       hostname: options.hostname,
+      lan: options.lan === true,
       maxRequestBodySize: 1,
-      handler: (actualOrigin) => {
+      handler: (actualOrigin, actualLan) => {
         origin = actualOrigin;
+        lan = actualLan;
         return handler;
       }
     });
@@ -307,7 +338,7 @@ function startManagementListener2(options) {
   });
   const url = new URL(`http://${canonicalLoopbackHost(options.hostname)}:${server.port}`).origin;
   try {
-    handler = options.handler(url);
+    handler = options.handler(url, options.lan === true && isWildcardHostname(options.hostname));
     if (typeof handler?.fetch !== "function" || typeof handler.stop !== "function") {
       throw new Error("management_listener_invalid");
     }
@@ -844,7 +875,7 @@ function createManagementHandler2(options) {
     throw new Error("management_csrf_required");
   }
   const reads = createManagementReadHandler2(options);
-  const origin = new URL(options.origin);
+  const expected = (request) => lanAwareOrigin(request, options.origin, options.lan === true);
   const pending = new Set;
   let stopped = false;
   let tokens = 16;
@@ -900,7 +931,7 @@ function createManagementHandler2(options) {
       return failure2("invalid_arguments", 400);
     }
     const context = { ...identity, wait_signal: controller.signal };
-    const reply = await options.service.execute(operation, args, context);
+    const reply = operation.startsWith("resources/") ? await options.resources.execute(operation.slice("resources/".length), args, identity, controller.signal) : await options.service.execute(operation, args, context);
     if (controller.signal.aborted) {
       return failure2("outcome_unconfirmed", 503);
     }
@@ -921,7 +952,7 @@ function createManagementHandler2(options) {
       } catch {
         return failure2("forbidden", 403);
       }
-      if (!url.pathname.startsWith("/admin/v1/actions/")) {
+      if (!url.pathname.startsWith("/admin/v1/actions/") && !url.pathname.startsWith("/admin/v1/resources/")) {
         return reads.fetch(request);
       }
       let size = 0;
@@ -930,13 +961,22 @@ function createManagementHandler2(options) {
         size += Buffer.byteLength(name + value);
         count++;
       }
-      if (request.url.length > 2048 || size > 16384 || count > 48 || url.origin !== options.origin || request.headers.get("host") !== origin.host || request.headers.get("origin") !== options.origin || url.username || url.password || url.search || url.hash || request.headers.has("sec-fetch-site") && request.headers.get("sec-fetch-site") !== "same-origin") {
+      if (request.url.length > 2048 || size > 16384 || count > 48 || url.origin !== expected(request) || request.headers.get("origin") !== url.origin || url.username || url.password || url.search || url.hash || request.headers.has("sec-fetch-site") && request.headers.get("sec-fetch-site") !== "same-origin") {
         return failure2("forbidden", 403);
       }
       if (request.method !== "POST") {
         return failure2("method_not_allowed", 405);
       }
-      const operation = routes.get(url.pathname);
+      const resource = url.pathname.startsWith("/admin/v1/resources/") ? url.pathname.slice("/admin/v1/resources/".length) : null;
+      const operation = resource !== null && options.resources && [
+        "tokens_list",
+        "tokens_create",
+        "tokens_delete",
+        "tokens_rotate",
+        "pairings_list",
+        "pairings_delete",
+        "devices_delete"
+      ].includes(resource) ? `resources/${resource}` : routes.get(url.pathname);
       if (!operation) {
         return failure2("not_found", 404);
       }
@@ -1025,16 +1065,37 @@ function createManagementSessionAdapter2(options) {
     throw new Error("management_cookie_name_invalid");
   }
   const origin = new URL(options.origin);
-  if (origin.origin !== options.origin || origin.protocol !== "http:" || origin.hostname !== "127.0.0.1" || origin.username || origin.password) {
+  if (origin.origin !== options.origin || origin.protocol !== "http:" || !["127.0.0.1", "[::1]"].includes(origin.hostname) || origin.username || origin.password) {
     throw new Error("management_listener_invalid");
   }
   const identities = options.identities;
   const sessions = options.sessions;
   const now = options.now ?? Date.now;
   let observed = 0;
+  function expected(request) {
+    const raw = request.headers.get("host");
+    if (!raw || Buffer.byteLength(raw) > 2048) {
+      return null;
+    }
+    const host = raw.toLowerCase();
+    if (host === origin.host.toLowerCase()) {
+      return origin.origin;
+    }
+    if (!options.lan) {
+      return null;
+    }
+    try {
+      const url = new URL(request.url);
+      const candidate = "http://" + host;
+      return new URL(candidate).origin === candidate && url.host.toLowerCase() === host && url.protocol === "http:" ? candidate : null;
+    } catch {
+      return null;
+    }
+  }
   function cookie(request) {
     const url = new URL(request.url);
-    if (url.origin !== origin.origin || request.headers.get("host") !== origin.host || request.headers.has("origin") && request.headers.get("origin") !== origin.origin) {
+    const trusted = expected(request);
+    if (trusted === null || url.origin !== trusted || request.headers.has("origin") && request.headers.get("origin") !== trusted) {
       return null;
     }
     const site = request.headers.get("sec-fetch-site");
@@ -1115,7 +1176,7 @@ function createManagementSessionAdapter2(options) {
       if (request.method !== "POST") {
         return false;
       }
-      if (request.headers.get("origin") !== origin.origin || request.headers.has("sec-fetch-site") && request.headers.get("sec-fetch-site") !== "same-origin") {
+      if (request.headers.get("origin") !== expected(request) || request.headers.has("sec-fetch-site") && request.headers.get("sec-fetch-site") !== "same-origin") {
         return false;
       }
       const candidate = request.headers.get("x-rovloom-csrf");
@@ -1132,4 +1193,4 @@ function createManagementSessionAdapter2(options) {
 }
 export { createManagementReadHandler2, startManagementReadListener2, startManagementListener2, loadManagementAssets2, ManagementServiceError2, StoreManagementWriteService2, createManagementHandler2, createManagementSessionAdapter2 };
 
-//# debugId=FD715A6C580CBDB864756E2164756E21
+//# debugId=4BCF3E6652F2586E64756E2164756E21

package/dist/src/{chunk-emcefrc1.js → chunk-g27b2gmx.js}

@@ -1,13 +1,12 @@
 // @bun
 import {
-  SERVICE_HELP2,
   parseServiceCommand2,
   handleServiceCommand2
-} from "./chunk-7q96e161.js";
+} from "./chunk-x0td5wn4.js";
+import"./chunk-5b8g62kw.js";
 export {
-  SERVICE_HELP2 as SERVICE_HELP,
   handleServiceCommand2 as handleServiceCommand,
   parseServiceCommand2 as parseServiceCommand
 };
 
-//# debugId=C3691EFE843F735764756E2164756E21
+//# debugId=2172CFBA81B35CDA64756E2164756E21

package/dist/src/{chunk-keg92d31.js → chunk-gyvqqnjb.js}

@@ -1,13 +1,17 @@
 // @bun
+import {
+  cliMessages2,
+  formatMessage2
+} from "./chunk-5b8g62kw.js";
 import {
   readRuntimeConfig2
-} from "./chunk-6hxy1fcg.js";
+} from "./chunk-bspzg8er.js";
 import {
   readOrCreateRoleConfig
-} from "./chunk-v1httsp6.js";
+} from "./chunk-8ykrqhxh.js";
 import {
   resolveRoleConfigPath2
-} from "./chunk-qfyefed3.js";
+} from "./chunk-1bf0wmgk.js";
 import {
   CLI_ERROR_CODES,
   CliError2,
@@ -15,10 +19,10 @@ import {
   configDocument2,
   configTemplate2,
   readConfig2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import {
   PRODUCT_VERSION2
-} from "./chunk-xmkgq3nh.js";
+} from "./chunk-s3ydr65k.js";
 import {
   isWildcardHostname
 } from "./chunk-6n9s7nfe.js";
@@ -62,43 +66,9 @@ function serviceDiagnostic(text) {
 }
 
 // src/cli/run.ts
-var WILDCARD_LISTEN_WARNING = `wildcard_listener
-MCP/management listen on all interfaces over plain HTTP; protect them with a firewall or a TLS reverse proxy.
-MCP/\u7BA1\u7406\u9875\u76D1\u542C\u6240\u6709\u7F51\u5361\u4E14\u4E3A\u660E\u6587 HTTP\uFF1B\u8BF7\u7528\u9632\u706B\u5899\u6216 TLS \u53CD\u5411\u4EE3\u7406\u6536\u53E3\u3002
-`;
-var HELP2 = `Rovloom ${PRODUCT_VERSION2}
-
-\u7528\u6CD5\uFF1A
-  rovloom --help
-  rovloom --version
-  rovloom config template gateway|connector
-  rovloom config init connector [--provider luvus|herdr|mixed] [--config /absolute/path/config.json]
-  rovloom config init gateway [--container] [--config /absolute/path/config.json]
-  rovloom config check [--role gateway|connector] [--config /absolute/path/config.json]
-  rovloom config check-runtime [--role gateway|connector] [--config /absolute/path/config.json]
-  rovloom gateway [--add-device | --repair-device] [--config /absolute/path/config.json] [--non-interactive]
-  rovloom connector [--repair | --claim] [--config /absolute/path/config.json] [--non-interactive]
-  rovloom service --help
-  rovloom token --help
-  rovloom doctor --help
-  rovloom storage --help
-  rovloom admin --help
-
-gateway / connector \u542F\u52A8\u5BF9\u5E94\u89D2\u8272\u3002\u9996\u6B21\u8FD0\u884C\u65F6\u5728\u771F\u5B9E\u672C\u5730\u7EC8\u7AEF\u5B8C\u6210\u4E00\u6B21\u6027\u914D\u5BF9\u4E0E\u539F\u751F\u5B89\u88C5\u6279\u51C6\uFF1B
---add-device \u5728\u5DF2\u5B8C\u6210\u7684\u5F15\u5BFC\u4E4B\u4E0A\u518D\u914D\u5BF9\u4E00\u53F0 Connector\uFF08\u6CBF\u7528\u540C\u4E00 MCP \u51ED\u636E\uFF0C\u6388\u6743\u968F\u4E4B\u6269\u5927\u5230\u65B0\u8BBE\u5907\uFF09\uFF1B
---repair-device / --repair \u91CD\u65B0\u914D\u5BF9\u5DF2\u914D\u5BF9\u7684\u540C\u4E00\u8BBE\u5907\uFF08\u51ED\u636E\u4E22\u5931\u6216\u6CC4\u6F0F\uFF09\uFF0C\u4FDD\u7559\u539F\u751F\u8BBE\u7F6E\u4E0E MCP \u6388\u6743\u3002
---claim \u8BA9\u672A\u914D\u5BF9\u7684 Connector \u5411\u8FD0\u884C\u4E2D\u7684 Gateway \u5728\u7EBF\u8BA4\u9886\u7BA1\u7406\u5458\u521B\u5EFA\u7684\u914D\u5BF9\u7533\u8BF7\uFF08\u7BA1\u7406\u9875\u6838\u5BF9\u7801\u6279\u51C6\uFF0CGateway \u4E0D\u505C\u673A\uFF09\u3002
-\u8FD9\u56DB\u4E2A\u9009\u9879\u9700\u8981\u771F\u5B9E\u672C\u5730\u7EC8\u7AEF\uFF0C\u4E0D\u53EF\u4E0E --non-interactive \u5408\u7528\u3002--non-interactive \u5173\u95ED\u672C\u5730\u4EA4\u4E92\u5F15\u5BFC\uFF08\u670D\u52A1\u4EE5\u6B64\u8FD0\u884C\uFF09\u3002
-token \u7BA1\u7406 MCP Bearer \u4EE4\u724C\uFF0Cadmin \u7BA1\u7406\u7BA1\u7406\u9875\u7BA1\u7406\u5458\uFF0Cservice \u7BA1\u7406\u5F00\u673A\u670D\u52A1\uFF1B\u8BE6\u89C1\u5404\u81EA\u7684 --help\u3002
-config check \u53EA\u8BFB\u68C0\u67E5\u914D\u7F6E\u6587\u4EF6\uFF1Bcheck-runtime \u53E6\u6838\u5BF9\u7A0B\u5E8F\u7BA1\u7406\u7684\u72B6\u6001\uFF0C\u4E0D\u8BFB\u53D6\u51ED\u636E\u3002
-
-\u7701\u7565 --config \u65F6\u8BFB\u53D6 ~/.config/rovloom/gateway.json \u6216 connector.json\uFF08Windows \u540C\u6837\u4F7F\u7528\u7528\u6237 home\uFF09\u3002
-\u6587\u4EF6\u7F3A\u5931\u65F6\u9996\u6B21\u8FD0\u884C\u4F1A\u751F\u6210\u9ED8\u8BA4\u914D\u7F6E\uFF0C\u5DF2\u6709\u6587\u4EF6\u4E0D\u4F1A\u88AB\u8986\u76D6\u6216\u91CD\u7F6E\u3002
-Gateway \u652F\u6301 Linux/macOS/Windows\uFF1BConnector \u652F\u6301 Linux x64\u3001Windows x64 \u4E0E macOS\uFF08x64 / arm64\uFF0C\u4EC5\u9644\u7740\u5DF2\u8FD0\u884C\u7684 Herdr / Luvus\uFF09\u3002
-\u9996\u6B21\u5F15\u5BFC\u6309 Connector \u7684 native.provider \u9009\u62E9 luvus\uFF08\u9ED8\u8BA4\uFF09\u3001herdr \u6216 mixed\u3002
-Agent \u4E0E\u6A21\u578B\u767B\u5F55\u9700\u72EC\u7ACB\u51C6\u5907\uFF1B\u539F\u751F ready \u4E0D\u4EE3\u8868\u6A21\u578B\u5DF2\u56DE\u590D\u3002
-\u9000\u51FA\u7801\uFF1A0 \u6210\u529F/\u6B63\u5E38\u5173\u95ED\uFF0C2 \u53C2\u6570\u6216\u914D\u7F6E\u9519\u8BEF\uFF0C3 \u540E\u7AEF\u4E0D\u53EF\u7528\uFF0C1 \u8FD0\u884C\u6216\u5173\u95ED\u5931\u8D25\u3002
-`;
+function cliHelp2(language = "en") {
+  return formatMessage2(cliMessages2(language)["help.main"], { version: PRODUCT_VERSION2 });
+}
 function parseCommand2(args, environment) {
   if (args.length === 0 || args.length === 1 && ["--help", "-h", "help"].includes(args[0])) {
     return { action: "help" };
@@ -182,9 +152,9 @@ async function untilStopped(running, signal) {
 async function runCli2(args, io, runtime = {}, environment) {
   try {
     if (args[0] === "service") {
-      const { SERVICE_HELP, handleServiceCommand } = await import("./chunk-emcefrc1.js");
+      const { handleServiceCommand } = await import("./chunk-g27b2gmx.js");
       if (args.length === 2 && args[1] === "--help") {
-        io.stderr.write(SERVICE_HELP);
+        io.stderr.write(cliMessages2(io.language)["help.service"]);
         return 0;
       }
       if (!runtime.service) {
@@ -193,6 +163,7 @@ async function runCli2(args, io, runtime = {}, environment) {
       const host = runtime.service;
       const code = await handleServiceCommand(args, {
         ...host,
+        language: io.language ?? "en",
         resolveDefaultConfig: host.resolveDefaultConfig ? (role, account) => {
           try {
             return host.resolveDefaultConfig(role, account);
@@ -211,19 +182,19 @@ async function runCli2(args, io, runtime = {}, environment) {
       throw new CliError2("invalid_arguments");
     }
     if (args[0] === "admin") {
-      const { handleAdminCommand } = await import("./chunk-ydmabg5t.js");
+      const { handleAdminCommand } = await import("./chunk-ytpfmcp1.js");
       return await handleAdminCommand(args, io, environment);
     }
     if (args[0] === "doctor" || args[0] === "storage") {
-      const { handleStorageCommand } = await import("./chunk-1fyfrgte.js");
+      const { handleStorageCommand } = await import("./chunk-n6wtjyfb.js");
       return await handleStorageCommand(args, io, environment);
     }
     if (args[0] === "token") {
-      const { handleTokenCommand } = await import("./chunk-8x6ygvhh.js");
+      const { handleTokenCommand } = await import("./chunk-ssp57p43.js");
       return await handleTokenCommand(args, io, environment);
     }
     if (args[0] === "config" && args[1] === "init") {
-      const { initializeRoleConfig } = await import("./chunk-5vx1b9z8.js");
+      const { initializeRoleConfig } = await import("./chunk-m9c1pnv9.js");
       initializeRoleConfig(args, environment);
       io.stderr.write(`config_ready
 `);
@@ -231,7 +202,7 @@ async function runCli2(args, io, runtime = {}, environment) {
     }
     const command = parseCommand2(args, environment);
     if (command.action === "help") {
-      io.stderr.write(HELP2);
+      io.stderr.write(cliHelp2(io.language));
       return 0;
     }
     if (command.action === "version") {
@@ -305,32 +276,38 @@ async function runCli2(args, io, runtime = {}, environment) {
     }
     let reload = false;
     let warnedWildcard = false;
+    let shownDashboard = false;
     do {
       reload = false;
       const gateway = await runtime.gateway(config);
       if (!warnedWildcard && (isWildcardHostname(config.mcp_hostname) || config.management_enabled && isWildcardHostname(config.management_hostname))) {
         warnedWildcard = true;
-        io.stderr.write(WILDCARD_LISTEN_WARNING);
+        io.stderr.write(cliMessages2(io.language)["run.wildcardListenWarning"]);
       }
       try {
-        const { startHttpFacade } = await import("./chunk-4af38z2b.js");
+        const { startHttpFacade } = await import("./chunk-srfbjwtk.js");
         const http = startHttpFacade({
           service: gateway.service,
           authentication: gateway.authentication,
           hostname: config.mcp_hostname,
           port: config.mcp_port,
           ...config.mcp_public_url ? { publicUrl: config.mcp_public_url } : {},
+          ...config.mcp_lan ? { lan: true } : {},
+          ...io.language ? { language: io.language } : {},
           diagnostic: (code) => io.stderr.write(code + `
 `)
         });
         try {
           await gateway.listening?.(http.url);
+          if (!shownDashboard && gateway.managementUrl) {
+            shownDashboard = true;
+            io.stderr.write("dashboard_listening " + new URL(gateway.managementUrl).href + `
+`);
+          }
           if (gateway.setupRequired) {
             io.stderr.write("gateway_listening " + http.url + `
 pairing_required
-Gateway is running; complete local pairing and native setup before using an Agent.
-Gateway \u5DF2\u542F\u52A8\uFF1B\u4F7F\u7528 Agent \u524D\u4ECD\u9700\u5B8C\u6210\u672C\u5730\u914D\u5BF9\u548C\u539F\u751F\u521D\u59CB\u5316\u3002
-`);
+` + cliMessages2(io.language)["run.pairingRequiredHint"]);
           }
           await untilStopped({
             closed: Promise.race([
@@ -360,9 +337,7 @@ Gateway \u5DF2\u542F\u52A8\uFF1B\u4F7F\u7528 Agent \u524D\u4ECD\u9700\u5B8C\u621
       io.stderr.write(error.code + `
 `);
       if (error.code === "configuration_required") {
-        io.stderr.write(`Setup requires a local terminal, a reachable Gateway, completed pairing and a compatible installed Luvus. Preserve uncertain setup state for owner review.
-\u521D\u59CB\u5316\u9700\u672C\u5730\u7EC8\u7AEF\u3001\u53EF\u8FBE Gateway\u3001\u5B8C\u6574\u914D\u5BF9\u53CA\u517C\u5BB9 Luvus \u5B89\u88C5\uFF1B\u7ED3\u679C\u4E0D\u786E\u5B9A\u65F6\u4FDD\u7559\u539F\u72B6\u6001\u5E76\u7531\u6240\u6709\u8005\u6838\u67E5\u3002
-`);
+        io.stderr.write(cliMessages2(io.language)["run.configurationRequiredHint"]);
       }
       return error.exitCode;
     }
@@ -372,6 +347,6 @@ Gateway \u5DF2\u542F\u52A8\uFF1B\u4F7F\u7528 Agent \u524D\u4ECD\u9700\u5B8C\u621
   }
 }
 
-export { HELP2, parseCommand2, runCli2 };
+export { cliHelp2, parseCommand2, runCli2 };
 
-//# debugId=D32F2D6B4ECB1A3C64756E2164756E21
+//# debugId=618C67B77D8D88C964756E2164756E21

package/dist/src/{chunk-bjdqj43d.js → chunk-hpzr94hm.js}

@@ -5,6 +5,9 @@ import {
 import {
   parseNativeJson2
 } from "./chunk-7crhmqn2.js";
+import {
+  isWildcardHostname
+} from "./chunk-6n9s7nfe.js";
 import {
   binDirectories
 } from "./chunk-3nnahj0j.js";
@@ -107,10 +110,14 @@ function parseConfig2(value, platform = process.platform) {
       if (!hosts.includes(row.hostname)) {
         return fail();
       }
+      if (row.lan !== undefined && row.lan !== true) {
+        return fail();
+      }
       return {
         hostname: row.hostname,
         port: port(row.port),
-        public_url: row.public_url
+        public_url: row.public_url,
+        ...row.lan === true ? { lan: true } : {}
       };
     };
     if (input.schema_version !== 1 || !["gateway", "connector"].includes(input.role)) {
@@ -122,12 +129,15 @@ function parseConfig2(value, platform = process.platform) {
     }
     if (input.role === "gateway") {
       exact(input, ["schema_version", "role", "data", "mcp", "devices", "management"]);
-      const mcp = listener(input.mcp, ["public_url"]);
+      const mcp = listener(input.mcp, ["public_url", "lan"]);
       if (mcp.public_url !== undefined && !publicMcpUrl(mcp.public_url)) {
         return fail();
       }
+      if (mcp.lan !== undefined && (mcp.lan !== true || !isWildcardHostname(mcp.hostname))) {
+        return fail();
+      }
       const devices = listener(input.devices);
-      const management = exact(input.management, ["enabled", "port"], ["hostname"]);
+      const management = exact(input.management, ["enabled", "port"], ["hostname", "lan"]);
       if (typeof management.enabled !== "boolean") {
         return fail();
       }
@@ -136,6 +146,9 @@ function parseConfig2(value, platform = process.platform) {
       }
       const managementHostname = management.hostname ?? "127.0.0.1";
       const managementPort = port(management.port);
+      if (management.lan !== undefined && (management.lan !== true || managementHostname !== "0.0.0.0")) {
+        return fail();
+      }
       if (new Set([mcp.port, devices.port, ...management.enabled ? [managementPort] : []]).size !== (management.enabled ? 3 : 2)) {
         return fail();
       }
@@ -147,11 +160,13 @@ function parseConfig2(value, platform = process.platform) {
         mcp_hostname: mcp.hostname,
         mcp_port: mcp.port,
         ...mcp.public_url !== undefined ? { mcp_public_url: mcp.public_url } : {},
+        ...mcp.lan === true ? { mcp_lan: true } : {},
         device_hostname: devices.hostname,
         device_port: devices.port,
         management_enabled: management.enabled,
         management_hostname: managementHostname,
         management_port: managementPort,
+        ...management.lan === true ? { management_lan: true } : {},
         authentication_ref: "mcp-callers"
       });
     }
@@ -219,13 +234,15 @@ function configDocument2(config) {
     mcp: {
       hostname: config.mcp_hostname,
       port: config.mcp_port,
-      ...config.mcp_public_url !== undefined ? { public_url: config.mcp_public_url } : {}
+      ...config.mcp_public_url !== undefined ? { public_url: config.mcp_public_url } : {},
+      ...config.mcp_lan === true ? { lan: true } : {}
     },
     devices: { hostname: config.device_hostname, port: config.device_port },
     management: {
       enabled: config.management_enabled,
       ...config.management_hostname !== "127.0.0.1" ? { hostname: config.management_hostname } : {},
-      port: config.management_port
+      port: config.management_port,
+      ...config.management_lan === true ? { lan: true } : {}
     }
   } : {
     ...common,
@@ -286,4 +303,4 @@ function readConfig2(path) {
 
 export { herdrMode, luvusMode, selectedNativeProviders, CLI_ERROR_CODES, CliError2, CliCancelled, parseConfig2, configDocument2, configTemplate2, readConfig2 };
 
-//# debugId=8E2FBD65A09D61EC64756E2164756E21
+//# debugId=75790FE78402A30364756E2164756E21

package/dist/src/{chunk-t3pn1435.js → chunk-jf4r0r44.js}

@@ -38,7 +38,7 @@ import {
   closeSession
 } from "./chunk-zjzrcc59.js";
 import"./chunk-zj48jvfe.js";
-import"./chunk-nyn75b8v.js";
+import"./chunk-qjh9x872.js";
 import"./chunk-0xgpxdgc.js";
 import"./chunk-d4ejrtjq.js";
 import {
@@ -52,7 +52,7 @@ import {
   composeConnectorSessions2,
   createLuvusConnectorSessions2,
   createLuvusProductionSources2
-} from "./chunk-4etdq0cp.js";
+} from "./chunk-jka7v3wb.js";
 import"./chunk-5h82060k.js";
 import {
   herdrDeadline,
@@ -69,10 +69,10 @@ import {
 } from "./chunk-2tn0r64b.js";
 import {
   readRuntimeFile
-} from "./chunk-se5daacy.js";
+} from "./chunk-z7kkfrgz.js";
 import {
   CliError2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import"./chunk-vwcntax3.js";
 import"./chunk-gbsbwssz.js";
 import"./chunk-3nnahj0j.js";

package/dist/src/{chunk-4etdq0cp.js → chunk-jka7v3wb.js}

@@ -55,7 +55,7 @@ import {
 import {
   configuredSnapshotDirectory,
   Store2
-} from "./chunk-nyn75b8v.js";
+} from "./chunk-qjh9x872.js";
 import {
   createProviderResultAccess2,
   LUVUS_ENDPOINT_TRANSPORT,
@@ -2030,10 +2030,7 @@ function createManagementSessionAuthority2(source, options = {}) {
           if (lease.revoked && !lease.expiry_only || at < lease.session.expires_at || input.issued_at !== lease.upstream.issued_at || input.expires_at !== lease.upstream.expires_at) {
             throw new GatewayError2("unauthenticated");
           }
-          const session = Object.freeze({
-            ...lease.upstream,
-            expires_at: Math.min(lease.upstream.expires_at, at + 300000)
-          });
+          const session = lease.upstream;
           try {
             base(session, lease.policy);
           } catch {
@@ -2054,7 +2051,7 @@ function createManagementSessionAuthority2(source, options = {}) {
             caller,
             management_session_ref: sessionRef,
             issued_at: input.issued_at,
-            expires_at: Math.min(input.expires_at, at + 300000)
+            expires_at: input.expires_at
           });
           const current = base(session);
           if (leases.has(name) || leases.size >= capacity) {
@@ -2872,4 +2869,4 @@ function createLuvusProductionSources2() {
 }
 export { createTrustedRequestScope2, composeGatewaySessions2, composeConnectorSessions2, createGatewayRuntime2, createProviderGatewayRuntime2, openGatewayState2, createLuvusConnectorSessions2, createConnectorRuntime2, ConnectorHostStartupError2, createProviderConnectorRuntime2, createManagementSessionAuthority2, createLuvusOperationsProvider2, attachExistingLuvus2, LuvusProductionStartupError2, createLuvusProductionSources2 };
 
-//# debugId=785921E4C40CA8AB64756E2164756E21
+//# debugId=8FAF80F854C0B57664756E2164756E21

package/dist/src/{chunk-5vx1b9z8.js → chunk-m9c1pnv9.js}

@@ -6,13 +6,13 @@ import"./chunk-9tt13dm0.js";
 import"./chunk-g7pnjzkk.js";
 import {
   readOrCreateRoleConfig
-} from "./chunk-v1httsp6.js";
+} from "./chunk-8ykrqhxh.js";
 import {
   resolveRoleConfigPath2
-} from "./chunk-qfyefed3.js";
+} from "./chunk-1bf0wmgk.js";
 import {
   CliError2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import"./chunk-3nnahj0j.js";
 import"./chunk-0y5542k8.js";
 
@@ -50,7 +50,7 @@ function initializeRoleConfig(args, environment) {
   if (config.role === "connector" && provider && (config.native?.provider ?? "luvus") !== provider) {
     throw new CliError2("config_exists");
   }
-  if (config.role === "gateway" && container && [config.mcp_hostname, config.device_hostname, config.management_hostname].some((host) => host !== "0.0.0.0")) {
+  if (config.role === "gateway" && container && (config.management_lan !== true || [config.mcp_hostname, config.device_hostname, config.management_hostname].some((host) => host !== "0.0.0.0"))) {
     throw new CliError2("config_exists");
   }
   return config;
@@ -59,4 +59,4 @@ export {
   initializeRoleConfig
 };
 
-//# debugId=130364AF0AAC3C8064756E2164756E21
+//# debugId=5FE0BCD7E52AF87B64756E2164756E21

package/dist/src/{chunk-7k9g0x5e.js → chunk-mg0fd6ph.js}

@@ -22,7 +22,7 @@ import {
   SERVICE_ERROR_CODES,
   FacadeServiceError2,
   NativeRequestNotDispatchedError
-} from "./chunk-smpevv7n.js";
+} from "./chunk-0dqx2mmz.js";
 import {
   LuvusAdapterError2,
   terminalExecutionCatalog