rovloom 0.4.0 → 0.6.0

package/dist/src/{chunk-1fyfrgte.js → chunk-n6wtjyfb.js}

@@ -14,22 +14,25 @@ import {
   assertUsage,
   GATEWAY_LOCK_FORMAT2,
   Store2
-} from "./chunk-nyn75b8v.js";
+} from "./chunk-qjh9x872.js";
 import"./chunk-09f9q26d.js";
+import {
+  cliMessages2
+} from "./chunk-5b8g62kw.js";
 import {
   readRuntimeConfig2
-} from "./chunk-6hxy1fcg.js";
+} from "./chunk-bspzg8er.js";
 import {
   resolveRoleConfigPath2
-} from "./chunk-qfyefed3.js";
+} from "./chunk-1bf0wmgk.js";
 import {
   runtimeReference
-} from "./chunk-se5daacy.js";
+} from "./chunk-z7kkfrgz.js";
 import {
   CLI_ERROR_CODES,
   CliError2,
   readConfig2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import"./chunk-3nnahj0j.js";
 import {
   lockContent
@@ -131,17 +134,6 @@ function inspectStorage(input) {
 }
 
 // src/cli/storage-command.ts
-var STORAGE_HELP = `\u7528\u6CD5\uFF1A
-  rovloom doctor --role gateway|connector [--config /absolute/config.json] [--json]
-  rovloom storage check --role gateway [--config /absolute/config.json] [--json]
-  rovloom storage backup --role gateway --output /path/to/gateway.backups/snapshot.db [--config /absolute/config.json] [--json]
-  rovloom storage resume --role gateway [--config /absolute/config.json] [--json]
-
-Gateway \u547D\u4EE4\u987B\u5148\u505C\u6B62\u670D\u52A1\uFF1B\u6CBF\u7528\u540C\u4E00\u5199\u9501\uFF0C\u62D2\u7EDD\u6D3B\u52A8\u6216\u65E0\u6CD5\u5224\u5B9A\u7684\u6301\u6709\u8005\u3002
-check \u53EA\u8BFB\uFF1Bbackup \u4EC5\u4F7F\u7528\u771F\u5B9E\u72B6\u6001\u76EE\u5F55\u540C\u7EA7\u7684 <state>.backups \u666E\u901A\u76EE\u5F55\uFF0C\u5BFC\u51FA\u8131\u654F\u5FEB\u7167\uFF08\u4E0D\u542B\u539F\u6587\u53CA\u6709\u6548\u51ED\u636E\uFF09\uFF0C\u5B8C\u6574\u72B6\u6001\u9700\u53E6\u884C\u79BB\u7EBF\u5907\u4EFD\u3002
-resume \u662F\u672C\u673A\u64CD\u4F5C\u5458\u663E\u5F0F\u6279\u51C6\u7684\u89E3\u9664\u964D\u7EA7\uFF0C\u5B8C\u6574\u6027\u3001\u65F6\u949F\u6216\u9884\u7B97\u4E0D\u6B63\u5E38\u65F6\u4ECD\u62D2\u7EDD\u3002
-Connector doctor \u53EA\u68C0\u67E5\u914D\u7F6E\u53CA managed \u72B6\u6001\uFF0C\u4E0D\u542F\u52A8 native\uFF0C\u4E5F\u4E0D\u58F0\u660E native \u5C31\u7EEA\u3002
-`;
 function parse(args) {
   const action = args[0] === "doctor" ? "doctor" : args[1];
   if (!["doctor", "check", "backup", "resume"].includes(action ?? "")) {
@@ -201,7 +193,7 @@ async function handleStorageCommand(args, io, environment) {
   let json = args.includes("--json");
   try {
     if (args.length === 2 && args[1] === "--help") {
-      io.stderr.write(STORAGE_HELP);
+      io.stderr.write(cliMessages2(io.language)["help.storage"]);
       return 0;
     }
     const flags = parse(args);
@@ -318,4 +310,4 @@ export {
   handleStorageCommand
 };
 
-//# debugId=007190958BDB411E64756E2164756E21
+//# debugId=2C436BD5D6042D5D64756E2164756E21

package/dist/src/{chunk-nyn75b8v.js → chunk-qjh9x872.js}

@@ -1636,6 +1636,35 @@ class Store2 {
   revoke(machine) {
     this.devices.revoke(machine);
   }
+  deleteDevice(machine, actor) {
+    this.transaction((now) => {
+      this.devices.applyRevoke(machine, now);
+      for (const table of ["pairing_claims", "enrollments", "admin_pairings", "providers", "calls", "machines"]) {
+        this.db.prepare(`DELETE FROM ${table} WHERE machine_id=?`).run(machine);
+      }
+      this.audit("machine_deleted", actor, now, undefined, { machine_id: machine });
+    }, false);
+  }
+  listPairings(offset = 0) {
+    return this.db.prepare(`SELECT p.pairing_id,p.machine_id,m.name,
+      CASE WHEN p.status='pending' AND p.expires<=? THEN 'expired' ELSE p.status END AS status,p.expires
+      FROM admin_pairings p JOIN machines m ON m.machine_id=p.machine_id ORDER BY p.expires DESC,p.pairing_id LIMIT 51 OFFSET ?`).all(this.clock(), offset);
+  }
+  deletePairing(pairing, actor) {
+    return this.transaction((now) => {
+      const application = this.devices.pairingApplication(pairing);
+      if (!application) {
+        throw new GatewayError2("pairing_not_found");
+      }
+      const unfinished = this.db.prepare("SELECT claim_id FROM pairing_claims WHERE pairing_id=? AND status IN ('approved','delivered')").get(pairing);
+      if (unfinished) {
+        this.devices.applyRevoke(application.machine_id, now);
+      }
+      this.db.prepare("DELETE FROM admin_pairings WHERE pairing_id=?").run(pairing);
+      this.audit("pairing_deleted", actor, now, undefined, { pairing_id: pairing, machine_id: application.machine_id });
+      return unfinished ? application.machine_id : null;
+    }, false);
+  }
   defineProvider(binding) {
     validateProvider2(binding);
     return this.transaction((now) => {
@@ -2275,4 +2304,4 @@ class Store2 {
 
 export { DEFAULT_RETENTION2, configuredSnapshotDirectory, SCHEMA_VERSION, assertBudget, assertUsage, GATEWAY_LOCK_FORMAT2, Store2 };
 
-//# debugId=14A43F12EAAA7BD364756E2164756E21
+//# debugId=B8B3ABA270E159D964756E2164756E21

package/dist/src/{chunk-xmkgq3nh.js → chunk-s3ydr65k.js}

@@ -1,8 +1,8 @@
 // @bun
 // src/mcp/version.ts
 var MCP_REVISION2 = "2025-11-25";
-var PRODUCT_VERSION2 = "0.4.0";
+var PRODUCT_VERSION2 = "0.6.0";
 
 export { MCP_REVISION2, PRODUCT_VERSION2 };
 
-//# debugId=37FCDB7BED42DE7D64756E2164756E21
+//# debugId=F89FEF5D3124887164756E2164756E21

package/dist/src/{chunk-4af38z2b.js → chunk-srfbjwtk.js}

@@ -3,8 +3,9 @@ import {
   HTTP_BODY_BYTES2,
   createHttpFacade2,
   startHttpFacade2
-} from "./chunk-76wgt2g5.js";
-import"./chunk-smpevv7n.js";
+} from "./chunk-9zkq0kc8.js";
+import"./chunk-0dqx2mmz.js";
+import"./chunk-5b8g62kw.js";
 import"./chunk-7crhmqn2.js";
 import"./chunk-d71r315c.js";
 export {
@@ -13,4 +14,4 @@ export {
   startHttpFacade2 as startHttpFacade
 };
 
-//# debugId=A0A48728336CC35C64756E2164756E21
+//# debugId=7DE436763985B0CD64756E2164756E21

package/dist/src/{chunk-8x6ygvhh.js → chunk-ssp57p43.js}

@@ -6,6 +6,10 @@ import {
 } from "./chunk-qt9m2kg2.js";
 import"./chunk-9tt13dm0.js";
 import"./chunk-g7pnjzkk.js";
+import {
+  cliMessages2,
+  formatMessage2
+} from "./chunk-5b8g62kw.js";
 import {
   setupFileStamp,
   writeSetupFile,
@@ -18,38 +22,23 @@ import {
   revokeCaller,
   summarize,
   isAdminPlaceholder
-} from "./chunk-qab3m6nh.js";
+} from "./chunk-wxqhscsw.js";
 import {
   resolveRoleConfigPath2
-} from "./chunk-qfyefed3.js";
+} from "./chunk-1bf0wmgk.js";
 import {
   runtimeReference,
   readRuntimeJson
-} from "./chunk-se5daacy.js";
+} from "./chunk-z7kkfrgz.js";
 import {
   CLI_ERROR_CODES,
   CliError2,
   readConfig2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import"./chunk-3nnahj0j.js";
 import"./chunk-0y5542k8.js";
 
 // src/cli/token-command.ts
-var TOKEN_HELP = `\u7528\u6CD5\uFF1A
-  rovloom token list [--config /absolute/path/gateway.json]
-  rovloom token create --principal ID --like EXISTING_ID [--ttl-days N]
-  rovloom token renew --principal ID [--ttl-days N]
-  rovloom token rotate --principal ID [--ttl-days N] [--grace-minutes M]
-  rovloom token revoke --principal ID
-  rovloom token permissions --principal ID --discard-response true|false
-
-\u4EE4\u724C\u6CE8\u518C\u8868\u4F4D\u4E8E Gateway \u72B6\u6001\u76EE\u5F55\uFF1BGateway \u6BCF\u6B21\u8BA4\u8BC1\u91CD\u8BFB\uFF0C\u4FEE\u6539\u7ACB\u5373\u751F\u6548\u3001\u65E0\u9700\u91CD\u542F\u3002
-create/rotate \u628A\u65B0\u4EE4\u724C\u539F\u503C\u53EA\u5199\u5230 stdout \u4E00\u6B21\uFF08\u6CE8\u518C\u8868\u53EA\u4FDD\u5B58 SHA-256 \u6458\u8981\uFF09\uFF1B\u5176\u4F59\u4FE1\u606F\u5199\u5230 stderr\u3002
-create \u7684\u65B0\u4E3B\u4F53\u6743\u9650\u514B\u9686\u81EA --like \u6307\u5B9A\u7684\u73B0\u6709\u4E3B\u4F53\uFF0C\u4E0D\u6269\u5927\u6743\u9650\u3002renew \u5EF6\u957F\u5230\u671F\u65F6\u95F4\u3001\u4EE4\u724C\u4E0D\u53D8\u3002
-rotate \u7B7E\u53D1\u65B0\u4EE4\u724C\uFF1B--grace-minutes \u5185\u65E7\u4EE4\u724C\u7EE7\u7EED\u6709\u6548\uFF08\u9ED8\u8BA4 0\uFF0C\u7ACB\u5373\u5931\u6548\uFF09\u3002revoke \u5220\u9664\u4E3B\u4F53\u3002
-permissions \u663E\u5F0F\u7BA1\u7406\u7ED3\u679C\u5220\u9664\u6743\u9650\uFF0C\u70ED\u751F\u6548\uFF1B\u9ED8\u8BA4\u5173\u95ED\u3002\u5220\u9664\u7ED3\u679C\u524D\u5E94\u5148\u8BFB\u53D6\u5E76\u4FDD\u5B58\u6240\u9700\u5185\u5BB9\u3002
-ttl \u9ED8\u8BA4 30 \u5929\uFF081-365\uFF09\u3002
-`;
 function parse(args) {
   const sub = args[1];
   if (!sub || !["list", "create", "renew", "rotate", "revoke", "permissions"].includes(sub)) {
@@ -129,7 +118,7 @@ function syncClientFile(stateDir, principal, token, issued, expires) {
 async function handleTokenCommand(args, io, environment, now = Date.now) {
   try {
     if (args.length === 2 && args[1] === "--help") {
-      io.stderr.write(TOKEN_HELP);
+      io.stderr.write(cliMessages2(io.language)["help.token"]);
       return 0;
     }
     const flags = parse(args);
@@ -154,31 +143,38 @@ async function handleTokenCommand(args, io, environment, now = Date.now) {
     if (flags.sub === "create") {
       const made = createCaller(registry, flags.principal, flags.like, at, flags.days);
       next = made.registry;
-      io.stderr.write("created " + flags.principal + " expires " + new Date(made.expires_at).toISOString() + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.created"], {
+        principal: flags.principal,
+        expires: new Date(made.expires_at).toISOString()
+      }));
       io.stdout.write(made.token + `
 `);
     } else if (flags.sub === "renew") {
       const renewed = renewCaller(registry, flags.principal, at, flags.days);
       next = renewed.registry;
-      io.stderr.write("renewed " + flags.principal + " expires " + new Date(renewed.expires_at).toISOString() + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.renewed"], {
+        principal: flags.principal,
+        expires: new Date(renewed.expires_at).toISOString()
+      }));
     } else if (flags.sub === "rotate") {
       const rotated = rotateCaller(registry, flags.principal, at, { days: flags.days, graceMinutes: flags.grace });
       next = rotated.registry;
-      io.stderr.write("rotated " + flags.principal + " expires " + new Date(rotated.expires_at).toISOString() + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.rotated"], {
+        principal: flags.principal,
+        expires: new Date(rotated.expires_at).toISOString()
+      }));
       issued = rotated.token;
       io.stdout.write(rotated.token + `
 `);
     } else if (flags.sub === "permissions") {
       next = setDiscardPermission(registry, flags.principal, flags.discard);
-      io.stderr.write("permissions " + flags.principal + " discard_response=" + String(flags.discard) + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.permissions"], {
+        principal: flags.principal,
+        discard: String(flags.discard)
+      }));
     } else {
       next = revokeCaller(registry, flags.principal);
-      io.stderr.write("revoked " + flags.principal + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.revoked"], { principal: flags.principal }));
     }
     writeSetupFile(path, boundedJson2(next, REGISTRY_MAX_BYTES), true, stamp);
     if (flags.sub === "renew" || flags.sub === "rotate") {
@@ -201,4 +197,4 @@ export {
   handleTokenCommand
 };
 
-//# debugId=FA979FCCD381000964756E2164756E21
+//# debugId=97EFCC7F7ABCF40164756E2164756E21

package/dist/src/{chunk-qab3m6nh.js → chunk-wxqhscsw.js}

@@ -6,12 +6,15 @@ import {
   boundedJson2,
   validatePolicies2
 } from "./chunk-qt9m2kg2.js";
+import {
+  DEFAULT_PAIRING_POLICY_REF
+} from "./chunk-5j0gj6w2.js";
 import {
   readRuntimeJson
-} from "./chunk-se5daacy.js";
+} from "./chunk-z7kkfrgz.js";
 import {
   CliError2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import {
   privatePath,
   readPrivateBytes
@@ -130,7 +133,10 @@ function parseRegistry(value, resource) {
     const digests = new Set;
     for (const input of source.callers) {
       const caller = object2(input);
-      fields2(caller, ["principal", "token_sha256", "issued_at", "expires_at"], ["previous"]);
+      fields2(caller, ["principal", "token_sha256", "issued_at", "expires_at"], ["previous", "token", "scope"]);
+      if (caller.scope !== undefined && caller.scope !== "gateway" || caller.token !== undefined && (typeof caller.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(caller.token) || digestToken(caller.token) !== caller.token_sha256)) {
+        invalid();
+      }
       const principal = object2(caller.principal);
       fields2(principal, ["id", "policy"], ["permissions"]);
       if (principal.permissions !== undefined) {
@@ -187,7 +193,9 @@ function createCaller(registry, principal, like, now, days) {
   const expires_at = now + ttl(days);
   const entry = {
     principal: { ...structuredClone(template.principal), id: principal },
+    ...template.scope ? { scope: template.scope } : {},
     token_sha256: digestToken(token),
+    token,
     issued_at: now,
     expires_at
   };
@@ -220,7 +228,9 @@ function rotateCaller(registry, principal, now, options = {}) {
   const expires_at = now + ttl(options.days);
   const entry = {
     principal: old.principal,
+    ...old.scope ? { scope: old.scope } : {},
     token_sha256: digestToken(token),
+    token,
     issued_at: now,
     expires_at,
     ...grace > 0 ? { previous: { token_sha256: old.token_sha256, expires_at: Math.min(now + grace * 60000, old.expires_at) } } : {}
@@ -247,6 +257,22 @@ function summarize(registry, now) {
     rotating: entry.previous !== undefined && now < entry.previous.expires_at
   }));
 }
+function createGatewayCaller(registry, principal, now, days = 365) {
+  if (!PRINCIPAL.test(principal) || registry.callers.some((entry) => entry.principal.id === principal) || registry.callers.length >= MAX_CALLERS) {
+    throw new CliError2("invalid_arguments");
+  }
+  const token = newToken();
+  const expires_at = now + ttl(days);
+  const entry = {
+    principal: { id: principal, policy: structuredClone(registry.local_policy) },
+    scope: "gateway",
+    token,
+    token_sha256: digestToken(token),
+    issued_at: now,
+    expires_at
+  };
+  return { registry: { ...registry, callers: [...registry.callers, entry] }, token, expires_at };
+}
 
 // src/cli/admin-registry.ts
 var ADMIN_POLICY_REVISION = "rovloom_admin_v1";
@@ -255,7 +281,13 @@ var DEFAULT_ADMIN_TTL_DAYS = 30;
 var DAY2 = 86400000;
 var PRINCIPAL2 = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
 function emptyManagement(port) {
-  return { schema_version: 1, kind: "management-session-source", port, sessions: [], pairing_policy_refs: [] };
+  return {
+    schema_version: 1,
+    kind: "management-session-source",
+    port,
+    sessions: [],
+    pairing_policy_refs: [DEFAULT_PAIRING_POLICY_REF]
+  };
 }
 function isAdminPlaceholder(entry) {
   return entry.principal.policy.revision === ADMIN_POLICY_REVISION && entry.principal.policy.grants.length === 0;
@@ -309,7 +341,11 @@ function issueAdmin(callers, management, principal, now, days) {
         placeholder
       ]
     },
-    management: { ...management, sessions: [...others, session] },
+    management: {
+      ...management,
+      sessions: [...others, session],
+      pairing_policy_refs: management.pairing_policy_refs.length ? management.pairing_policy_refs : [DEFAULT_PAIRING_POLICY_REF]
+    },
     secret,
     expires_at
   };
@@ -338,6 +374,6 @@ function summarizeAdmins(management, now) {
   }));
 }
 
-export { setupFileStamp, writeSetupFile, readSetupJson, writeSetupJson, REGISTRY_MAX_BYTES, parseRegistry, createCaller, setDiscardPermission, renewCaller, rotateCaller, revokeCaller, summarize, DEFAULT_ADMIN_TTL_DAYS, emptyManagement, isAdminPlaceholder, issueAdmin, revokeAdmin, summarizeAdmins };
+export { setupFileStamp, writeSetupFile, readSetupJson, writeSetupJson, REGISTRY_MAX_BYTES, digestToken, parseRegistry, createCaller, setDiscardPermission, renewCaller, rotateCaller, revokeCaller, summarize, createGatewayCaller, DEFAULT_ADMIN_TTL_DAYS, emptyManagement, isAdminPlaceholder, issueAdmin, revokeAdmin, summarizeAdmins };
 
-//# debugId=AF7C6D3D6A23BCC764756E2164756E21
+//# debugId=69610EBBA61A8B4564756E2164756E21

package/dist/src/{chunk-7q96e161.js → chunk-x0td5wn4.js}

@@ -1,4 +1,7 @@
 // @bun
+import {
+  cliMessages2
+} from "./chunk-5b8g62kw.js";
 import {
   isRole,
   servicePlatform,
@@ -10,15 +13,6 @@ import {
 
 // src/service/command.ts
 var actions = new Set(["install", "uninstall", "start", "restart", "stop"]);
-var SERVICE_HELP2 = `service install --role gateway|connector [--executable ABS] [--config ABS] --workdir ABS --user ACCOUNT
-service uninstall|start|restart|stop --role gateway|connector
-install registers boot startup without starting; uninstall only revokes future boot startup and preserves running instances and their control records.
-Omitted --executable uses the current standalone binary; a different binary is rejected.
-Omitted --config uses the same current-user role file as foreground startup. Installation fixes its absolute path; background startup does not select another home.
-Linux uses systemd system units; macOS uses system LaunchDaemons; Windows uses boot-triggered tasks, not SCM services or login tasks.
-Gateway services support Linux systemd, macOS system LaunchDaemons and Windows boot-triggered tasks; the local native Connector service supports Linux x64, Windows x64 and macOS (x64 / arm64).
-Windows uses the explicitly selected existing user with S4U, without storing a password or requiring login. It does not provide an interactive desktop or Windows network credentials/EFS access. Running services receive a local shutdown request; queued/start-racing tasks return service_busy without forced termination; uninstall never stops it.
-`;
 function parseServiceCommand2(args, platform, resolveDefaultConfig, executable) {
   if (args[0] !== "service") {
     return;
@@ -64,7 +58,7 @@ async function handleServiceCommand2(args, host) {
   }
   try {
     if (args.length === 2 && args[1] === "--help") {
-      host.diagnostic(SERVICE_HELP2);
+      host.diagnostic(cliMessages2(host.language)["help.service"]);
       return 0;
     }
     const request = parseServiceCommand2(args, servicePlatform(host.platform), host.resolveDefaultConfig, host.executable);
@@ -79,6 +73,6 @@ async function handleServiceCommand2(args, host) {
   }
 }
 
-export { SERVICE_HELP2, parseServiceCommand2, handleServiceCommand2 };
+export { parseServiceCommand2, handleServiceCommand2 };
 
-//# debugId=48AFF39224DEDE2664756E2164756E21
+//# debugId=D7F60C51F033ABF664756E2164756E21

package/dist/src/{chunk-ydmabg5t.js → chunk-ytpfmcp1.js}

@@ -3,11 +3,12 @@ import {
   writeAdminFiles2,
   managementSourceExists2,
   handleAdminCommand2
-} from "./chunk-wdr3sdsm.js";
-import"./chunk-qab3m6nh.js";
-import"./chunk-qfyefed3.js";
-import"./chunk-se5daacy.js";
-import"./chunk-bjdqj43d.js";
+} from "./chunk-yv9px0f5.js";
+import"./chunk-wxqhscsw.js";
+import"./chunk-1bf0wmgk.js";
+import"./chunk-z7kkfrgz.js";
+import"./chunk-hpzr94hm.js";
+import"./chunk-5b8g62kw.js";
 import"./chunk-3nnahj0j.js";
 import"./chunk-0y5542k8.js";
 import"./chunk-g7pnjzkk.js";
@@ -21,4 +22,4 @@ export {
   writeAdminFiles2 as writeAdminFiles
 };
 
-//# debugId=214EC0FC923A8CDE64756E2164756E21
+//# debugId=989933E8EAB2EB1A64756E2164756E21

package/dist/src/{chunk-wdr3sdsm.js → chunk-yv9px0f5.js}

@@ -4,6 +4,10 @@ import {
   fields2,
   boundedJson2
 } from "./chunk-qt9m2kg2.js";
+import {
+  cliMessages2,
+  formatMessage2
+} from "./chunk-5b8g62kw.js";
 import {
   setupFileStamp,
   writeSetupFile,
@@ -15,32 +19,25 @@ import {
   issueAdmin,
   revokeAdmin,
   summarizeAdmins
-} from "./chunk-qab3m6nh.js";
+} from "./chunk-wxqhscsw.js";
 import {
   resolveRoleConfigPath2
-} from "./chunk-qfyefed3.js";
+} from "./chunk-1bf0wmgk.js";
 import {
-  runtimeReference,
-  readRuntimeJson
-} from "./chunk-se5daacy.js";
+  runtimeReference
+} from "./chunk-z7kkfrgz.js";
 import {
   CLI_ERROR_CODES,
   CliError2,
   readConfig2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
+import {
+  canonicalLoopbackHost
+} from "./chunk-6n9s7nfe.js";
 
 // src/cli/admin-command.ts
-var ADMIN_HELP = `\u7528\u6CD5\uFF1A
-  rovloom admin list [--config /absolute/path/gateway.json]
-  rovloom admin create [--principal ID] [--ttl-days N] [--config /absolute/path/gateway.json]
-  rovloom admin revoke [--principal ID] [--config /absolute/path/gateway.json]
-
-\u7BA1\u7406\u9875\uFF08\u9ED8\u8BA4 http://127.0.0.1:9445/\uFF09\u7528 HTTP Basic \u767B\u5F55\uFF1A\u7528\u6237\u540D\u662F\u7BA1\u7406\u5458 ID\uFF08\u9ED8\u8BA4 admin\uFF09\uFF0C\u5BC6\u7801\u662F create \u8F93\u51FA\u7684\u53E3\u4EE4\u3002
-\u53E3\u4EE4\u539F\u503C\u53EA\u5728 create \u65F6\u5199\u5230 stdout \u4E00\u6B21\uFF08Gateway \u53EA\u4FDD\u5B58 SHA-256 \u6458\u8981\uFF09\uFF1B\u5176\u4F59\u4FE1\u606F\u5199\u5230 stderr\u3002\u4E22\u5931\u53E3\u4EE4\u5C31\u518D create \u4E00\u6B21\uFF1A
-\u540C\u540D\u7BA1\u7406\u5458\u88AB\u91CD\u65B0\u7B7E\u53D1\uFF0C\u65E7\u53E3\u4EE4\u4E0E\u5DF2\u767B\u5F55\u7684\u6D4F\u89C8\u5668\u4F1A\u8BDD\u7ACB\u5373\u5931\u6548\u3002revoke \u5220\u9664\u7BA1\u7406\u5458\uFF0C\u540C\u6837\u7ACB\u5373\u751F\u6548\u3002\u4FEE\u6539\u65E0\u9700\u91CD\u542F Gateway\u3002
-\u7BA1\u7406\u5458\u4E0D\u80FD\u8C03\u7528 MCP\uFF0C\u4E5F\u4E0E MCP \u4EE4\u724C\u3001\u8BBE\u5907\u51ED\u636E\u4E92\u4E0D\u901A\u7528\uFF1B\u6709\u6548\u671F\u9ED8\u8BA4 ${DEFAULT_ADMIN_TTL_DAYS} \u5929\uFF081-365\uFF09\u3002
-\u9700\u8981\u5148\u5B8C\u6210 Gateway \u9996\u6B21\u914D\u5BF9\uFF08\u6B64\u65F6\u624D\u5B58\u5728 MCP \u8C03\u7528\u65B9\u6CE8\u518C\u8868\uFF09\u3002
-`;
+import { mkdirSync } from "fs";
+import { dirname } from "path";
 function parse(args) {
   const sub = args[1];
   if (!sub || !["list", "create", "revoke"].includes(sub)) {
@@ -87,16 +84,44 @@ function loadManagement(path, port) {
   }
   return { file: value, exists: true };
 }
+function callerResource(config) {
+  const hostname = canonicalLoopbackHost(config.mcp_hostname);
+  return new URL("http://" + hostname + ":" + config.mcp_port + "/mcp").href;
+}
+function emptyCallerRegistry(resource) {
+  return {
+    schema_version: 1,
+    kind: "mcp-caller-source",
+    resource,
+    local_policy: { revision: "rovloom_unpaired", grants: [] },
+    callers: []
+  };
+}
+function callersStamp(path) {
+  try {
+    return setupFileStamp(path);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return;
+    }
+    throw error;
+  }
+}
 function writeAdminFiles2(config, principal, at, days) {
   const callersPath = runtimeReference(config.state_dir, "mcp-callers");
   const managementPath = runtimeReference(config.state_dir, "management");
-  const callersStamp = setupFileStamp(callersPath);
-  const callers = parseRegistry(readRuntimeJson(callersPath, REGISTRY_MAX_BYTES));
+  mkdirSync(dirname(managementPath), { recursive: true, mode: 448 });
+  const stamp = callersStamp(callersPath);
+  const callers = parseRegistry(readSetupJson(callersPath, REGISTRY_MAX_BYTES) ?? emptyCallerRegistry(callerResource(config)));
   const { file, exists } = loadManagement(managementPath, config.management_port);
-  const stamp = exists ? setupFileStamp(managementPath) : undefined;
+  const managementStamp = exists ? setupFileStamp(managementPath) : undefined;
   const issued = issueAdmin(callers, file, principal, at, days);
-  writeSetupFile(callersPath, boundedJson2(issued.callers, REGISTRY_MAX_BYTES), true, callersStamp);
-  writeSetupFile(managementPath, boundedJson2(issued.management, 65536), exists, stamp);
+  if (stamp === undefined) {
+    writeSetupFile(callersPath, boundedJson2(issued.callers, REGISTRY_MAX_BYTES), false);
+  } else {
+    writeSetupFile(callersPath, boundedJson2(issued.callers, REGISTRY_MAX_BYTES), true, stamp);
+  }
+  writeSetupFile(managementPath, boundedJson2(issued.management, 65536), exists, managementStamp);
   return { secret: issued.secret, expires_at: issued.expires_at };
 }
 function managementSourceExists2(config) {
@@ -105,7 +130,7 @@ function managementSourceExists2(config) {
 async function handleAdminCommand2(args, io, environment, now = Date.now) {
   try {
     if (args.length === 2 && args[1] === "--help") {
-      io.stderr.write(ADMIN_HELP);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["help.admin"], { ttlDays: DEFAULT_ADMIN_TTL_DAYS }));
       return 0;
     }
     const flags = parse(args);
@@ -119,15 +144,19 @@ async function handleAdminCommand2(args, io, environment, now = Date.now) {
     const principal = flags.principal ?? "admin";
     if (flags.sub === "create") {
       const issued = writeAdminFiles2(config, principal, at, flags.days);
-      io.stderr.write("created administrator " + principal + " expires " + new Date(issued.expires_at).toISOString() + `
-login at http://127.0.0.1:` + config.management_port + '/ with user "' + principal + `" and the password below (shown once)
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["admin.create.created"], {
+        principal,
+        expires: new Date(issued.expires_at).toISOString()
+      }) + formatMessage2(cliMessages2(io.language)["admin.create.login"], {
+        url: "http://127.0.0.1:" + config.management_port + "/",
+        user: principal
+      }));
       io.stdout.write(issued.secret + `
 `);
       return 0;
     }
-    const callersStamp = setupFileStamp(callersPath);
-    const callers = parseRegistry(readRuntimeJson(callersPath, REGISTRY_MAX_BYTES));
+    const registryStamp = callersStamp(callersPath);
+    const callers = parseRegistry(readSetupJson(callersPath, REGISTRY_MAX_BYTES) ?? emptyCallerRegistry(callerResource(config)));
     const { file, exists } = loadManagement(managementPath, config.management_port);
     if (flags.sub === "list") {
       for (const row of summarizeAdmins(file, at)) {
@@ -139,9 +168,8 @@ login at http://127.0.0.1:` + config.management_port + '/ with user "' + princip
     const stamp = exists ? setupFileStamp(managementPath) : undefined;
     const revoked = revokeAdmin(callers, file, principal);
     writeSetupFile(managementPath, boundedJson2(revoked.management, 65536), true, stamp);
-    writeSetupFile(callersPath, boundedJson2(revoked.callers, REGISTRY_MAX_BYTES), true, callersStamp);
-    io.stderr.write("revoked administrator " + principal + `
-`);
+    writeSetupFile(callersPath, boundedJson2(revoked.callers, REGISTRY_MAX_BYTES), true, registryStamp);
+    io.stderr.write(formatMessage2(cliMessages2(io.language)["admin.revoked"], { principal }));
     return 0;
   } catch (error) {
     if (error instanceof CliError2 && CLI_ERROR_CODES.includes(error.code)) {
@@ -157,4 +185,4 @@ login at http://127.0.0.1:` + config.management_port + '/ with user "' + princip
 
 export { writeAdminFiles2, managementSourceExists2, handleAdminCommand2 };
 
-//# debugId=DF62A5BEF1087BFE64756E2164756E21
+//# debugId=0EB59DEAE24D22AB64756E2164756E21

package/dist/src/{chunk-se5daacy.js → chunk-z7kkfrgz.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-7crhmqn2.js";
 import {
   CliError2
-} from "./chunk-bjdqj43d.js";
+} from "./chunk-hpzr94hm.js";
 import {
   readPrivateBytes
 } from "./chunk-0y5542k8.js";