rovloom 0.5.0 → 0.6.0

package/dist/src/{chunk-ympzv86c.js → chunk-ez7d5dac.js}

@@ -931,7 +931,7 @@ function createManagementHandler2(options) {
       return failure2("invalid_arguments", 400);
     }
     const context = { ...identity, wait_signal: controller.signal };
-    const reply = await options.service.execute(operation, args, context);
+    const reply = operation.startsWith("resources/") ? await options.resources.execute(operation.slice("resources/".length), args, identity, controller.signal) : await options.service.execute(operation, args, context);
     if (controller.signal.aborted) {
       return failure2("outcome_unconfirmed", 503);
     }
@@ -952,7 +952,7 @@ function createManagementHandler2(options) {
       } catch {
         return failure2("forbidden", 403);
       }
-      if (!url.pathname.startsWith("/admin/v1/actions/")) {
+      if (!url.pathname.startsWith("/admin/v1/actions/") && !url.pathname.startsWith("/admin/v1/resources/")) {
         return reads.fetch(request);
       }
       let size = 0;
@@ -967,7 +967,16 @@ function createManagementHandler2(options) {
       if (request.method !== "POST") {
         return failure2("method_not_allowed", 405);
       }
-      const operation = routes.get(url.pathname);
+      const resource = url.pathname.startsWith("/admin/v1/resources/") ? url.pathname.slice("/admin/v1/resources/".length) : null;
+      const operation = resource !== null && options.resources && [
+        "tokens_list",
+        "tokens_create",
+        "tokens_delete",
+        "tokens_rotate",
+        "pairings_list",
+        "pairings_delete",
+        "devices_delete"
+      ].includes(resource) ? `resources/${resource}` : routes.get(url.pathname);
       if (!operation) {
         return failure2("not_found", 404);
       }
@@ -1184,4 +1193,4 @@ function createManagementSessionAdapter2(options) {
 }
 export { createManagementReadHandler2, startManagementReadListener2, startManagementListener2, loadManagementAssets2, ManagementServiceError2, StoreManagementWriteService2, createManagementHandler2, createManagementSessionAdapter2 };
 
-//# debugId=5F343A955701396E64756E2164756E21
+//# debugId=4BCF3E6652F2586E64756E2164756E21

package/dist/src/{chunk-emcefrc1.js → chunk-g27b2gmx.js}

@@ -1,13 +1,12 @@
 // @bun
 import {
-  SERVICE_HELP2,
   parseServiceCommand2,
   handleServiceCommand2
-} from "./chunk-7q96e161.js";
+} from "./chunk-x0td5wn4.js";
+import"./chunk-5b8g62kw.js";
 export {
-  SERVICE_HELP2 as SERVICE_HELP,
   handleServiceCommand2 as handleServiceCommand,
   parseServiceCommand2 as parseServiceCommand
 };
 
-//# debugId=C3691EFE843F735764756E2164756E21
+//# debugId=2172CFBA81B35CDA64756E2164756E21

package/dist/src/{chunk-abd4envz.js → chunk-gyvqqnjb.js}

@@ -1,10 +1,14 @@
 // @bun
+import {
+  cliMessages2,
+  formatMessage2
+} from "./chunk-5b8g62kw.js";
 import {
   readRuntimeConfig2
 } from "./chunk-bspzg8er.js";
 import {
   readOrCreateRoleConfig
-} from "./chunk-64ftwe9b.js";
+} from "./chunk-8ykrqhxh.js";
 import {
   resolveRoleConfigPath2
 } from "./chunk-1bf0wmgk.js";
@@ -18,7 +22,7 @@ import {
 } from "./chunk-hpzr94hm.js";
 import {
   PRODUCT_VERSION2
-} from "./chunk-r0nfthsf.js";
+} from "./chunk-s3ydr65k.js";
 import {
   isWildcardHostname
 } from "./chunk-6n9s7nfe.js";
@@ -62,44 +66,9 @@ function serviceDiagnostic(text) {
 }
 
 // src/cli/run.ts
-var WILDCARD_LISTEN_WARNING = `wildcard_listener
-MCP/management listen on all interfaces over plain HTTP; protect them with a firewall or a TLS reverse proxy.
-MCP/\u7BA1\u7406\u9875\u76D1\u542C\u6240\u6709\u7F51\u5361\u4E14\u4E3A\u660E\u6587 HTTP\uFF1B\u8BF7\u7528\u9632\u706B\u5899\u6216 TLS \u53CD\u5411\u4EE3\u7406\u6536\u53E3\u3002
-`;
-var HELP2 = `Rovloom ${PRODUCT_VERSION2}
-
-\u7528\u6CD5\uFF1A
-  rovloom --help
-  rovloom --version
-  rovloom config template gateway|connector
-  rovloom config init connector [--provider luvus|herdr|mixed] [--config /absolute/path/config.json]
-  rovloom config init gateway [--container] [--config /absolute/path/config.json]
-  rovloom config check [--role gateway|connector] [--config /absolute/path/config.json]
-  rovloom config check-runtime [--role gateway|connector] [--config /absolute/path/config.json]
-  rovloom gateway [--add-device | --repair-device] [--config /absolute/path/config.json] [--non-interactive]
-  rovloom connector [--repair | --claim] [--config /absolute/path/config.json] [--non-interactive]
-  rovloom service --help
-  rovloom token --help
-  rovloom doctor --help
-  rovloom storage --help
-  rovloom admin --help
-
-gateway / connector \u542F\u52A8\u5BF9\u5E94\u89D2\u8272\u3002\u9996\u6B21\u8FD0\u884C\u65F6\u5728\u771F\u5B9E\u672C\u5730\u7EC8\u7AEF\u5B8C\u6210\u4E00\u6B21\u6027\u914D\u5BF9\u4E0E\u539F\u751F\u5B89\u88C5\u6279\u51C6\uFF1B
-\u5728\u7EC8\u7AEF\u62D2\u7EDD\u914D\u5BF9\u63D0\u793A\u65F6\uFF0CGateway \u4FDD\u6301\u672A\u914D\u5BF9\u8FD0\u884C\uFF0C\u53EF\u5148\u8FD0\u884C rovloom admin create \u518D\u4ECE\u7BA1\u7406\u9875\u5B8C\u6210\u9996\u53F0\u914D\u5BF9\uFF1B
---add-device \u5728\u5DF2\u5B8C\u6210\u7684\u5F15\u5BFC\u4E4B\u4E0A\u518D\u914D\u5BF9\u4E00\u53F0 Connector\uFF08\u6CBF\u7528\u540C\u4E00 MCP \u51ED\u636E\uFF0C\u6388\u6743\u968F\u4E4B\u6269\u5927\u5230\u65B0\u8BBE\u5907\uFF09\uFF1B
---repair-device / --repair \u91CD\u65B0\u914D\u5BF9\u5DF2\u914D\u5BF9\u7684\u540C\u4E00\u8BBE\u5907\uFF08\u51ED\u636E\u4E22\u5931\u6216\u6CC4\u6F0F\uFF09\uFF0C\u4FDD\u7559\u539F\u751F\u8BBE\u7F6E\u4E0E MCP \u6388\u6743\u3002
---claim \u8BA9\u672A\u914D\u5BF9\u7684 Connector \u5411\u8FD0\u884C\u4E2D\u7684 Gateway \u5728\u7EBF\u8BA4\u9886\u7BA1\u7406\u5458\u521B\u5EFA\u7684\u914D\u5BF9\u7533\u8BF7\uFF08\u7BA1\u7406\u9875\u6838\u5BF9\u7801\u6279\u51C6\uFF0CGateway \u4E0D\u505C\u673A\uFF09\u3002
-\u8FD9\u56DB\u4E2A\u9009\u9879\u9700\u8981\u771F\u5B9E\u672C\u5730\u7EC8\u7AEF\uFF0C\u4E0D\u53EF\u4E0E --non-interactive \u5408\u7528\u3002--non-interactive \u5173\u95ED\u672C\u5730\u4EA4\u4E92\u5F15\u5BFC\uFF08\u670D\u52A1\u4EE5\u6B64\u8FD0\u884C\uFF09\u3002
-token \u7BA1\u7406 MCP Bearer \u4EE4\u724C\uFF0Cadmin \u7BA1\u7406\u7BA1\u7406\u9875\u7BA1\u7406\u5458\uFF0Cservice \u7BA1\u7406\u5F00\u673A\u670D\u52A1\uFF1B\u8BE6\u89C1\u5404\u81EA\u7684 --help\u3002
-config check \u53EA\u8BFB\u68C0\u67E5\u914D\u7F6E\u6587\u4EF6\uFF1Bcheck-runtime \u53E6\u6838\u5BF9\u7A0B\u5E8F\u7BA1\u7406\u7684\u72B6\u6001\uFF0C\u4E0D\u8BFB\u53D6\u51ED\u636E\u3002
-
-\u7701\u7565 --config \u65F6\u8BFB\u53D6 ~/.config/rovloom/gateway.json \u6216 connector.json\uFF08Windows \u540C\u6837\u4F7F\u7528\u7528\u6237 home\uFF09\u3002
-\u6587\u4EF6\u7F3A\u5931\u65F6\u9996\u6B21\u8FD0\u884C\u4F1A\u751F\u6210\u9ED8\u8BA4\u914D\u7F6E\uFF0C\u5DF2\u6709\u6587\u4EF6\u4E0D\u4F1A\u88AB\u8986\u76D6\u6216\u91CD\u7F6E\u3002
-Gateway \u652F\u6301 Linux/macOS/Windows\uFF1BConnector \u652F\u6301 Linux x64\u3001Windows x64 \u4E0E macOS\uFF08x64 / arm64\uFF0C\u4EC5\u9644\u7740\u5DF2\u8FD0\u884C\u7684 Herdr / Luvus\uFF09\u3002
-\u9996\u6B21\u5F15\u5BFC\u6309 Connector \u7684 native.provider \u9009\u62E9 luvus\uFF08\u9ED8\u8BA4\uFF09\u3001herdr \u6216 mixed\u3002
-Agent \u4E0E\u6A21\u578B\u767B\u5F55\u9700\u72EC\u7ACB\u51C6\u5907\uFF1B\u539F\u751F ready \u4E0D\u4EE3\u8868\u6A21\u578B\u5DF2\u56DE\u590D\u3002
-\u9000\u51FA\u7801\uFF1A0 \u6210\u529F/\u6B63\u5E38\u5173\u95ED\uFF0C2 \u53C2\u6570\u6216\u914D\u7F6E\u9519\u8BEF\uFF0C3 \u540E\u7AEF\u4E0D\u53EF\u7528\uFF0C1 \u8FD0\u884C\u6216\u5173\u95ED\u5931\u8D25\u3002
-`;
+function cliHelp2(language = "en") {
+  return formatMessage2(cliMessages2(language)["help.main"], { version: PRODUCT_VERSION2 });
+}
 function parseCommand2(args, environment) {
   if (args.length === 0 || args.length === 1 && ["--help", "-h", "help"].includes(args[0])) {
     return { action: "help" };
@@ -183,9 +152,9 @@ async function untilStopped(running, signal) {
 async function runCli2(args, io, runtime = {}, environment) {
   try {
     if (args[0] === "service") {
-      const { SERVICE_HELP, handleServiceCommand } = await import("./chunk-emcefrc1.js");
+      const { handleServiceCommand } = await import("./chunk-g27b2gmx.js");
       if (args.length === 2 && args[1] === "--help") {
-        io.stderr.write(SERVICE_HELP);
+        io.stderr.write(cliMessages2(io.language)["help.service"]);
         return 0;
       }
       if (!runtime.service) {
@@ -194,6 +163,7 @@ async function runCli2(args, io, runtime = {}, environment) {
       const host = runtime.service;
       const code = await handleServiceCommand(args, {
         ...host,
+        language: io.language ?? "en",
         resolveDefaultConfig: host.resolveDefaultConfig ? (role, account) => {
           try {
             return host.resolveDefaultConfig(role, account);
@@ -212,19 +182,19 @@ async function runCli2(args, io, runtime = {}, environment) {
       throw new CliError2("invalid_arguments");
     }
     if (args[0] === "admin") {
-      const { handleAdminCommand } = await import("./chunk-9yg6x3gt.js");
+      const { handleAdminCommand } = await import("./chunk-ytpfmcp1.js");
       return await handleAdminCommand(args, io, environment);
     }
     if (args[0] === "doctor" || args[0] === "storage") {
-      const { handleStorageCommand } = await import("./chunk-0ake7e4r.js");
+      const { handleStorageCommand } = await import("./chunk-n6wtjyfb.js");
       return await handleStorageCommand(args, io, environment);
     }
     if (args[0] === "token") {
-      const { handleTokenCommand } = await import("./chunk-sj24fpz3.js");
+      const { handleTokenCommand } = await import("./chunk-ssp57p43.js");
       return await handleTokenCommand(args, io, environment);
     }
     if (args[0] === "config" && args[1] === "init") {
-      const { initializeRoleConfig } = await import("./chunk-xhq21g24.js");
+      const { initializeRoleConfig } = await import("./chunk-m9c1pnv9.js");
       initializeRoleConfig(args, environment);
       io.stderr.write(`config_ready
 `);
@@ -232,7 +202,7 @@ async function runCli2(args, io, runtime = {}, environment) {
     }
     const command = parseCommand2(args, environment);
     if (command.action === "help") {
-      io.stderr.write(HELP2);
+      io.stderr.write(cliHelp2(io.language));
       return 0;
     }
     if (command.action === "version") {
@@ -306,15 +276,16 @@ async function runCli2(args, io, runtime = {}, environment) {
     }
     let reload = false;
     let warnedWildcard = false;
+    let shownDashboard = false;
     do {
       reload = false;
       const gateway = await runtime.gateway(config);
       if (!warnedWildcard && (isWildcardHostname(config.mcp_hostname) || config.management_enabled && isWildcardHostname(config.management_hostname))) {
         warnedWildcard = true;
-        io.stderr.write(WILDCARD_LISTEN_WARNING);
+        io.stderr.write(cliMessages2(io.language)["run.wildcardListenWarning"]);
       }
       try {
-        const { startHttpFacade } = await import("./chunk-ybte82d3.js");
+        const { startHttpFacade } = await import("./chunk-srfbjwtk.js");
         const http = startHttpFacade({
           service: gateway.service,
           authentication: gateway.authentication,
@@ -322,17 +293,21 @@ async function runCli2(args, io, runtime = {}, environment) {
           port: config.mcp_port,
           ...config.mcp_public_url ? { publicUrl: config.mcp_public_url } : {},
           ...config.mcp_lan ? { lan: true } : {},
+          ...io.language ? { language: io.language } : {},
           diagnostic: (code) => io.stderr.write(code + `
 `)
         });
         try {
           await gateway.listening?.(http.url);
+          if (!shownDashboard && gateway.managementUrl) {
+            shownDashboard = true;
+            io.stderr.write("dashboard_listening " + new URL(gateway.managementUrl).href + `
+`);
+          }
           if (gateway.setupRequired) {
             io.stderr.write("gateway_listening " + http.url + `
 pairing_required
-Gateway is running; complete local pairing and native setup before using an Agent.
-Gateway \u5DF2\u542F\u52A8\uFF1B\u4F7F\u7528 Agent \u524D\u4ECD\u9700\u5B8C\u6210\u672C\u5730\u914D\u5BF9\u548C\u539F\u751F\u521D\u59CB\u5316\u3002
-`);
+` + cliMessages2(io.language)["run.pairingRequiredHint"]);
           }
           await untilStopped({
             closed: Promise.race([
@@ -362,9 +337,7 @@ Gateway \u5DF2\u542F\u52A8\uFF1B\u4F7F\u7528 Agent \u524D\u4ECD\u9700\u5B8C\u621
       io.stderr.write(error.code + `
 `);
       if (error.code === "configuration_required") {
-        io.stderr.write(`Setup requires a local terminal, a reachable Gateway, completed pairing and a compatible installed Luvus. Preserve uncertain setup state for owner review.
-\u521D\u59CB\u5316\u9700\u672C\u5730\u7EC8\u7AEF\u3001\u53EF\u8FBE Gateway\u3001\u5B8C\u6574\u914D\u5BF9\u53CA\u517C\u5BB9 Luvus \u5B89\u88C5\uFF1B\u7ED3\u679C\u4E0D\u786E\u5B9A\u65F6\u4FDD\u7559\u539F\u72B6\u6001\u5E76\u7531\u6240\u6709\u8005\u6838\u67E5\u3002
-`);
+        io.stderr.write(cliMessages2(io.language)["run.configurationRequiredHint"]);
       }
       return error.exitCode;
     }
@@ -374,6 +347,6 @@ Gateway \u5DF2\u542F\u52A8\uFF1B\u4F7F\u7528 Agent \u524D\u4ECD\u9700\u5B8C\u621
   }
 }
 
-export { HELP2, parseCommand2, runCli2 };
+export { cliHelp2, parseCommand2, runCli2 };
 
-//# debugId=EDE27C0F1768E16864756E2164756E21
+//# debugId=618C67B77D8D88C964756E2164756E21

package/dist/src/{chunk-e7x51y0t.js → chunk-jf4r0r44.js}

@@ -38,7 +38,7 @@ import {
   closeSession
 } from "./chunk-zjzrcc59.js";
 import"./chunk-zj48jvfe.js";
-import"./chunk-nyn75b8v.js";
+import"./chunk-qjh9x872.js";
 import"./chunk-0xgpxdgc.js";
 import"./chunk-d4ejrtjq.js";
 import {
@@ -52,7 +52,7 @@ import {
   composeConnectorSessions2,
   createLuvusConnectorSessions2,
   createLuvusProductionSources2
-} from "./chunk-4etdq0cp.js";
+} from "./chunk-jka7v3wb.js";
 import"./chunk-5h82060k.js";
 import {
   herdrDeadline,

package/dist/src/{chunk-4etdq0cp.js → chunk-jka7v3wb.js}

@@ -55,7 +55,7 @@ import {
 import {
   configuredSnapshotDirectory,
   Store2
-} from "./chunk-nyn75b8v.js";
+} from "./chunk-qjh9x872.js";
 import {
   createProviderResultAccess2,
   LUVUS_ENDPOINT_TRANSPORT,
@@ -2030,10 +2030,7 @@ function createManagementSessionAuthority2(source, options = {}) {
           if (lease.revoked && !lease.expiry_only || at < lease.session.expires_at || input.issued_at !== lease.upstream.issued_at || input.expires_at !== lease.upstream.expires_at) {
             throw new GatewayError2("unauthenticated");
           }
-          const session = Object.freeze({
-            ...lease.upstream,
-            expires_at: Math.min(lease.upstream.expires_at, at + 300000)
-          });
+          const session = lease.upstream;
           try {
             base(session, lease.policy);
           } catch {
@@ -2054,7 +2051,7 @@ function createManagementSessionAuthority2(source, options = {}) {
             caller,
             management_session_ref: sessionRef,
             issued_at: input.issued_at,
-            expires_at: Math.min(input.expires_at, at + 300000)
+            expires_at: input.expires_at
           });
           const current = base(session);
           if (leases.has(name) || leases.size >= capacity) {
@@ -2872,4 +2869,4 @@ function createLuvusProductionSources2() {
 }
 export { createTrustedRequestScope2, composeGatewaySessions2, composeConnectorSessions2, createGatewayRuntime2, createProviderGatewayRuntime2, openGatewayState2, createLuvusConnectorSessions2, createConnectorRuntime2, ConnectorHostStartupError2, createProviderConnectorRuntime2, createManagementSessionAuthority2, createLuvusOperationsProvider2, attachExistingLuvus2, LuvusProductionStartupError2, createLuvusProductionSources2 };
 
-//# debugId=785921E4C40CA8AB64756E2164756E21
+//# debugId=8FAF80F854C0B57664756E2164756E21

package/dist/src/{chunk-xhq21g24.js → chunk-m9c1pnv9.js}

@@ -6,7 +6,7 @@ import"./chunk-9tt13dm0.js";
 import"./chunk-g7pnjzkk.js";
 import {
   readOrCreateRoleConfig
-} from "./chunk-64ftwe9b.js";
+} from "./chunk-8ykrqhxh.js";
 import {
   resolveRoleConfigPath2
 } from "./chunk-1bf0wmgk.js";
@@ -50,7 +50,7 @@ function initializeRoleConfig(args, environment) {
   if (config.role === "connector" && provider && (config.native?.provider ?? "luvus") !== provider) {
     throw new CliError2("config_exists");
   }
-  if (config.role === "gateway" && container && [config.mcp_hostname, config.device_hostname, config.management_hostname].some((host) => host !== "0.0.0.0")) {
+  if (config.role === "gateway" && container && (config.management_lan !== true || [config.mcp_hostname, config.device_hostname, config.management_hostname].some((host) => host !== "0.0.0.0"))) {
     throw new CliError2("config_exists");
   }
   return config;
@@ -59,4 +59,4 @@ export {
   initializeRoleConfig
 };
 
-//# debugId=130364AF0AAC3C8064756E2164756E21
+//# debugId=5FE0BCD7E52AF87B64756E2164756E21

package/dist/src/{chunk-7k9g0x5e.js → chunk-mg0fd6ph.js}

@@ -22,7 +22,7 @@ import {
   SERVICE_ERROR_CODES,
   FacadeServiceError2,
   NativeRequestNotDispatchedError
-} from "./chunk-smpevv7n.js";
+} from "./chunk-0dqx2mmz.js";
 import {
   LuvusAdapterError2,
   terminalExecutionCatalog

package/dist/src/{chunk-0ake7e4r.js → chunk-n6wtjyfb.js}

@@ -14,8 +14,11 @@ import {
   assertUsage,
   GATEWAY_LOCK_FORMAT2,
   Store2
-} from "./chunk-nyn75b8v.js";
+} from "./chunk-qjh9x872.js";
 import"./chunk-09f9q26d.js";
+import {
+  cliMessages2
+} from "./chunk-5b8g62kw.js";
 import {
   readRuntimeConfig2
 } from "./chunk-bspzg8er.js";
@@ -131,17 +134,6 @@ function inspectStorage(input) {
 }
 
 // src/cli/storage-command.ts
-var STORAGE_HELP = `\u7528\u6CD5\uFF1A
-  rovloom doctor --role gateway|connector [--config /absolute/config.json] [--json]
-  rovloom storage check --role gateway [--config /absolute/config.json] [--json]
-  rovloom storage backup --role gateway --output /path/to/gateway.backups/snapshot.db [--config /absolute/config.json] [--json]
-  rovloom storage resume --role gateway [--config /absolute/config.json] [--json]
-
-Gateway \u547D\u4EE4\u987B\u5148\u505C\u6B62\u670D\u52A1\uFF1B\u6CBF\u7528\u540C\u4E00\u5199\u9501\uFF0C\u62D2\u7EDD\u6D3B\u52A8\u6216\u65E0\u6CD5\u5224\u5B9A\u7684\u6301\u6709\u8005\u3002
-check \u53EA\u8BFB\uFF1Bbackup \u4EC5\u4F7F\u7528\u771F\u5B9E\u72B6\u6001\u76EE\u5F55\u540C\u7EA7\u7684 <state>.backups \u666E\u901A\u76EE\u5F55\uFF0C\u5BFC\u51FA\u8131\u654F\u5FEB\u7167\uFF08\u4E0D\u542B\u539F\u6587\u53CA\u6709\u6548\u51ED\u636E\uFF09\uFF0C\u5B8C\u6574\u72B6\u6001\u9700\u53E6\u884C\u79BB\u7EBF\u5907\u4EFD\u3002
-resume \u662F\u672C\u673A\u64CD\u4F5C\u5458\u663E\u5F0F\u6279\u51C6\u7684\u89E3\u9664\u964D\u7EA7\uFF0C\u5B8C\u6574\u6027\u3001\u65F6\u949F\u6216\u9884\u7B97\u4E0D\u6B63\u5E38\u65F6\u4ECD\u62D2\u7EDD\u3002
-Connector doctor \u53EA\u68C0\u67E5\u914D\u7F6E\u53CA managed \u72B6\u6001\uFF0C\u4E0D\u542F\u52A8 native\uFF0C\u4E5F\u4E0D\u58F0\u660E native \u5C31\u7EEA\u3002
-`;
 function parse(args) {
   const action = args[0] === "doctor" ? "doctor" : args[1];
   if (!["doctor", "check", "backup", "resume"].includes(action ?? "")) {
@@ -201,7 +193,7 @@ async function handleStorageCommand(args, io, environment) {
   let json = args.includes("--json");
   try {
     if (args.length === 2 && args[1] === "--help") {
-      io.stderr.write(STORAGE_HELP);
+      io.stderr.write(cliMessages2(io.language)["help.storage"]);
       return 0;
     }
     const flags = parse(args);
@@ -318,4 +310,4 @@ export {
   handleStorageCommand
 };
 
-//# debugId=007190958BDB411E64756E2164756E21
+//# debugId=2C436BD5D6042D5D64756E2164756E21

package/dist/src/{chunk-nyn75b8v.js → chunk-qjh9x872.js}

@@ -1636,6 +1636,35 @@ class Store2 {
   revoke(machine) {
     this.devices.revoke(machine);
   }
+  deleteDevice(machine, actor) {
+    this.transaction((now) => {
+      this.devices.applyRevoke(machine, now);
+      for (const table of ["pairing_claims", "enrollments", "admin_pairings", "providers", "calls", "machines"]) {
+        this.db.prepare(`DELETE FROM ${table} WHERE machine_id=?`).run(machine);
+      }
+      this.audit("machine_deleted", actor, now, undefined, { machine_id: machine });
+    }, false);
+  }
+  listPairings(offset = 0) {
+    return this.db.prepare(`SELECT p.pairing_id,p.machine_id,m.name,
+      CASE WHEN p.status='pending' AND p.expires<=? THEN 'expired' ELSE p.status END AS status,p.expires
+      FROM admin_pairings p JOIN machines m ON m.machine_id=p.machine_id ORDER BY p.expires DESC,p.pairing_id LIMIT 51 OFFSET ?`).all(this.clock(), offset);
+  }
+  deletePairing(pairing, actor) {
+    return this.transaction((now) => {
+      const application = this.devices.pairingApplication(pairing);
+      if (!application) {
+        throw new GatewayError2("pairing_not_found");
+      }
+      const unfinished = this.db.prepare("SELECT claim_id FROM pairing_claims WHERE pairing_id=? AND status IN ('approved','delivered')").get(pairing);
+      if (unfinished) {
+        this.devices.applyRevoke(application.machine_id, now);
+      }
+      this.db.prepare("DELETE FROM admin_pairings WHERE pairing_id=?").run(pairing);
+      this.audit("pairing_deleted", actor, now, undefined, { pairing_id: pairing, machine_id: application.machine_id });
+      return unfinished ? application.machine_id : null;
+    }, false);
+  }
   defineProvider(binding) {
     validateProvider2(binding);
     return this.transaction((now) => {
@@ -2275,4 +2304,4 @@ class Store2 {
 
 export { DEFAULT_RETENTION2, configuredSnapshotDirectory, SCHEMA_VERSION, assertBudget, assertUsage, GATEWAY_LOCK_FORMAT2, Store2 };
 
-//# debugId=14A43F12EAAA7BD364756E2164756E21
+//# debugId=B8B3ABA270E159D964756E2164756E21

package/dist/src/{chunk-r0nfthsf.js → chunk-s3ydr65k.js}

@@ -1,8 +1,8 @@
 // @bun
 // src/mcp/version.ts
 var MCP_REVISION2 = "2025-11-25";
-var PRODUCT_VERSION2 = "0.5.0";
+var PRODUCT_VERSION2 = "0.6.0";
 
 export { MCP_REVISION2, PRODUCT_VERSION2 };
 
-//# debugId=1479A7639E360A6A64756E2164756E21
+//# debugId=F89FEF5D3124887164756E2164756E21

package/dist/src/{chunk-ybte82d3.js → chunk-srfbjwtk.js}

@@ -3,8 +3,9 @@ import {
   HTTP_BODY_BYTES2,
   createHttpFacade2,
   startHttpFacade2
-} from "./chunk-9y36gntb.js";
-import"./chunk-smpevv7n.js";
+} from "./chunk-9zkq0kc8.js";
+import"./chunk-0dqx2mmz.js";
+import"./chunk-5b8g62kw.js";
 import"./chunk-7crhmqn2.js";
 import"./chunk-d71r315c.js";
 export {
@@ -13,4 +14,4 @@ export {
   startHttpFacade2 as startHttpFacade
 };
 
-//# debugId=A0A48728336CC35C64756E2164756E21
+//# debugId=7DE436763985B0CD64756E2164756E21

package/dist/src/{chunk-sj24fpz3.js → chunk-ssp57p43.js}

@@ -6,6 +6,10 @@ import {
 } from "./chunk-qt9m2kg2.js";
 import"./chunk-9tt13dm0.js";
 import"./chunk-g7pnjzkk.js";
+import {
+  cliMessages2,
+  formatMessage2
+} from "./chunk-5b8g62kw.js";
 import {
   setupFileStamp,
   writeSetupFile,
@@ -18,7 +22,7 @@ import {
   revokeCaller,
   summarize,
   isAdminPlaceholder
-} from "./chunk-ebm3kvnq.js";
+} from "./chunk-wxqhscsw.js";
 import {
   resolveRoleConfigPath2
 } from "./chunk-1bf0wmgk.js";
@@ -35,21 +39,6 @@ import"./chunk-3nnahj0j.js";
 import"./chunk-0y5542k8.js";
 
 // src/cli/token-command.ts
-var TOKEN_HELP = `\u7528\u6CD5\uFF1A
-  rovloom token list [--config /absolute/path/gateway.json]
-  rovloom token create --principal ID --like EXISTING_ID [--ttl-days N]
-  rovloom token renew --principal ID [--ttl-days N]
-  rovloom token rotate --principal ID [--ttl-days N] [--grace-minutes M]
-  rovloom token revoke --principal ID
-  rovloom token permissions --principal ID --discard-response true|false
-
-\u4EE4\u724C\u6CE8\u518C\u8868\u4F4D\u4E8E Gateway \u72B6\u6001\u76EE\u5F55\uFF1BGateway \u6BCF\u6B21\u8BA4\u8BC1\u91CD\u8BFB\uFF0C\u4FEE\u6539\u7ACB\u5373\u751F\u6548\u3001\u65E0\u9700\u91CD\u542F\u3002
-create/rotate \u628A\u65B0\u4EE4\u724C\u539F\u503C\u53EA\u5199\u5230 stdout \u4E00\u6B21\uFF08\u6CE8\u518C\u8868\u53EA\u4FDD\u5B58 SHA-256 \u6458\u8981\uFF09\uFF1B\u5176\u4F59\u4FE1\u606F\u5199\u5230 stderr\u3002
-create \u7684\u65B0\u4E3B\u4F53\u6743\u9650\u514B\u9686\u81EA --like \u6307\u5B9A\u7684\u73B0\u6709\u4E3B\u4F53\uFF0C\u4E0D\u6269\u5927\u6743\u9650\u3002renew \u5EF6\u957F\u5230\u671F\u65F6\u95F4\u3001\u4EE4\u724C\u4E0D\u53D8\u3002
-rotate \u7B7E\u53D1\u65B0\u4EE4\u724C\uFF1B--grace-minutes \u5185\u65E7\u4EE4\u724C\u7EE7\u7EED\u6709\u6548\uFF08\u9ED8\u8BA4 0\uFF0C\u7ACB\u5373\u5931\u6548\uFF09\u3002revoke \u5220\u9664\u4E3B\u4F53\u3002
-permissions \u663E\u5F0F\u7BA1\u7406\u7ED3\u679C\u5220\u9664\u6743\u9650\uFF0C\u70ED\u751F\u6548\uFF1B\u9ED8\u8BA4\u5173\u95ED\u3002\u5220\u9664\u7ED3\u679C\u524D\u5E94\u5148\u8BFB\u53D6\u5E76\u4FDD\u5B58\u6240\u9700\u5185\u5BB9\u3002
-ttl \u9ED8\u8BA4 30 \u5929\uFF081-365\uFF09\u3002
-`;
 function parse(args) {
   const sub = args[1];
   if (!sub || !["list", "create", "renew", "rotate", "revoke", "permissions"].includes(sub)) {
@@ -129,7 +118,7 @@ function syncClientFile(stateDir, principal, token, issued, expires) {
 async function handleTokenCommand(args, io, environment, now = Date.now) {
   try {
     if (args.length === 2 && args[1] === "--help") {
-      io.stderr.write(TOKEN_HELP);
+      io.stderr.write(cliMessages2(io.language)["help.token"]);
       return 0;
     }
     const flags = parse(args);
@@ -154,31 +143,38 @@ async function handleTokenCommand(args, io, environment, now = Date.now) {
     if (flags.sub === "create") {
       const made = createCaller(registry, flags.principal, flags.like, at, flags.days);
       next = made.registry;
-      io.stderr.write("created " + flags.principal + " expires " + new Date(made.expires_at).toISOString() + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.created"], {
+        principal: flags.principal,
+        expires: new Date(made.expires_at).toISOString()
+      }));
       io.stdout.write(made.token + `
 `);
     } else if (flags.sub === "renew") {
       const renewed = renewCaller(registry, flags.principal, at, flags.days);
       next = renewed.registry;
-      io.stderr.write("renewed " + flags.principal + " expires " + new Date(renewed.expires_at).toISOString() + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.renewed"], {
+        principal: flags.principal,
+        expires: new Date(renewed.expires_at).toISOString()
+      }));
     } else if (flags.sub === "rotate") {
       const rotated = rotateCaller(registry, flags.principal, at, { days: flags.days, graceMinutes: flags.grace });
       next = rotated.registry;
-      io.stderr.write("rotated " + flags.principal + " expires " + new Date(rotated.expires_at).toISOString() + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.rotated"], {
+        principal: flags.principal,
+        expires: new Date(rotated.expires_at).toISOString()
+      }));
       issued = rotated.token;
       io.stdout.write(rotated.token + `
 `);
     } else if (flags.sub === "permissions") {
       next = setDiscardPermission(registry, flags.principal, flags.discard);
-      io.stderr.write("permissions " + flags.principal + " discard_response=" + String(flags.discard) + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.permissions"], {
+        principal: flags.principal,
+        discard: String(flags.discard)
+      }));
     } else {
       next = revokeCaller(registry, flags.principal);
-      io.stderr.write("revoked " + flags.principal + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.revoked"], { principal: flags.principal }));
     }
     writeSetupFile(path, boundedJson2(next, REGISTRY_MAX_BYTES), true, stamp);
     if (flags.sub === "renew" || flags.sub === "rotate") {
@@ -201,4 +197,4 @@ export {
   handleTokenCommand
 };
 
-//# debugId=FA979FCCD381000964756E2164756E21
+//# debugId=97EFCC7F7ABCF40164756E2164756E21

package/dist/src/{chunk-ebm3kvnq.js → chunk-wxqhscsw.js}

@@ -133,7 +133,10 @@ function parseRegistry(value, resource) {
     const digests = new Set;
     for (const input of source.callers) {
       const caller = object2(input);
-      fields2(caller, ["principal", "token_sha256", "issued_at", "expires_at"], ["previous"]);
+      fields2(caller, ["principal", "token_sha256", "issued_at", "expires_at"], ["previous", "token", "scope"]);
+      if (caller.scope !== undefined && caller.scope !== "gateway" || caller.token !== undefined && (typeof caller.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(caller.token) || digestToken(caller.token) !== caller.token_sha256)) {
+        invalid();
+      }
       const principal = object2(caller.principal);
       fields2(principal, ["id", "policy"], ["permissions"]);
       if (principal.permissions !== undefined) {
@@ -190,7 +193,9 @@ function createCaller(registry, principal, like, now, days) {
   const expires_at = now + ttl(days);
   const entry = {
     principal: { ...structuredClone(template.principal), id: principal },
+    ...template.scope ? { scope: template.scope } : {},
     token_sha256: digestToken(token),
+    token,
     issued_at: now,
     expires_at
   };
@@ -223,7 +228,9 @@ function rotateCaller(registry, principal, now, options = {}) {
   const expires_at = now + ttl(options.days);
   const entry = {
     principal: old.principal,
+    ...old.scope ? { scope: old.scope } : {},
     token_sha256: digestToken(token),
+    token,
     issued_at: now,
     expires_at,
     ...grace > 0 ? { previous: { token_sha256: old.token_sha256, expires_at: Math.min(now + grace * 60000, old.expires_at) } } : {}
@@ -250,6 +257,22 @@ function summarize(registry, now) {
     rotating: entry.previous !== undefined && now < entry.previous.expires_at
   }));
 }
+function createGatewayCaller(registry, principal, now, days = 365) {
+  if (!PRINCIPAL.test(principal) || registry.callers.some((entry) => entry.principal.id === principal) || registry.callers.length >= MAX_CALLERS) {
+    throw new CliError2("invalid_arguments");
+  }
+  const token = newToken();
+  const expires_at = now + ttl(days);
+  const entry = {
+    principal: { id: principal, policy: structuredClone(registry.local_policy) },
+    scope: "gateway",
+    token,
+    token_sha256: digestToken(token),
+    issued_at: now,
+    expires_at
+  };
+  return { registry: { ...registry, callers: [...registry.callers, entry] }, token, expires_at };
+}
 
 // src/cli/admin-registry.ts
 var ADMIN_POLICY_REVISION = "rovloom_admin_v1";
@@ -351,6 +374,6 @@ function summarizeAdmins(management, now) {
   }));
 }
 
-export { setupFileStamp, writeSetupFile, readSetupJson, writeSetupJson, REGISTRY_MAX_BYTES, parseRegistry, createCaller, setDiscardPermission, renewCaller, rotateCaller, revokeCaller, summarize, DEFAULT_ADMIN_TTL_DAYS, emptyManagement, isAdminPlaceholder, issueAdmin, revokeAdmin, summarizeAdmins };
+export { setupFileStamp, writeSetupFile, readSetupJson, writeSetupJson, REGISTRY_MAX_BYTES, digestToken, parseRegistry, createCaller, setDiscardPermission, renewCaller, rotateCaller, revokeCaller, summarize, createGatewayCaller, DEFAULT_ADMIN_TTL_DAYS, emptyManagement, isAdminPlaceholder, issueAdmin, revokeAdmin, summarizeAdmins };
 
-//# debugId=3023B85F5DE2326664756E2164756E21
+//# debugId=69610EBBA61A8B4564756E2164756E21