rovloom 0.5.0 → 0.6.0

package/dist/src/{chunk-7q96e161.js → chunk-x0td5wn4.js}

@@ -1,4 +1,7 @@
 // @bun
+import {
+  cliMessages2
+} from "./chunk-5b8g62kw.js";
 import {
   isRole,
   servicePlatform,
@@ -10,15 +13,6 @@ import {
 
 // src/service/command.ts
 var actions = new Set(["install", "uninstall", "start", "restart", "stop"]);
-var SERVICE_HELP2 = `service install --role gateway|connector [--executable ABS] [--config ABS] --workdir ABS --user ACCOUNT
-service uninstall|start|restart|stop --role gateway|connector
-install registers boot startup without starting; uninstall only revokes future boot startup and preserves running instances and their control records.
-Omitted --executable uses the current standalone binary; a different binary is rejected.
-Omitted --config uses the same current-user role file as foreground startup. Installation fixes its absolute path; background startup does not select another home.
-Linux uses systemd system units; macOS uses system LaunchDaemons; Windows uses boot-triggered tasks, not SCM services or login tasks.
-Gateway services support Linux systemd, macOS system LaunchDaemons and Windows boot-triggered tasks; the local native Connector service supports Linux x64, Windows x64 and macOS (x64 / arm64).
-Windows uses the explicitly selected existing user with S4U, without storing a password or requiring login. It does not provide an interactive desktop or Windows network credentials/EFS access. Running services receive a local shutdown request; queued/start-racing tasks return service_busy without forced termination; uninstall never stops it.
-`;
 function parseServiceCommand2(args, platform, resolveDefaultConfig, executable) {
   if (args[0] !== "service") {
     return;
@@ -64,7 +58,7 @@ async function handleServiceCommand2(args, host) {
   }
   try {
     if (args.length === 2 && args[1] === "--help") {
-      host.diagnostic(SERVICE_HELP2);
+      host.diagnostic(cliMessages2(host.language)["help.service"]);
       return 0;
     }
     const request = parseServiceCommand2(args, servicePlatform(host.platform), host.resolveDefaultConfig, host.executable);
@@ -79,6 +73,6 @@ async function handleServiceCommand2(args, host) {
   }
 }
 
-export { SERVICE_HELP2, parseServiceCommand2, handleServiceCommand2 };
+export { parseServiceCommand2, handleServiceCommand2 };
 
-//# debugId=48AFF39224DEDE2664756E2164756E21
+//# debugId=D7F60C51F033ABF664756E2164756E21

package/dist/src/{chunk-9yg6x3gt.js → chunk-ytpfmcp1.js}

@@ -3,11 +3,12 @@ import {
   writeAdminFiles2,
   managementSourceExists2,
   handleAdminCommand2
-} from "./chunk-fnakrk0a.js";
-import"./chunk-ebm3kvnq.js";
+} from "./chunk-yv9px0f5.js";
+import"./chunk-wxqhscsw.js";
 import"./chunk-1bf0wmgk.js";
 import"./chunk-z7kkfrgz.js";
 import"./chunk-hpzr94hm.js";
+import"./chunk-5b8g62kw.js";
 import"./chunk-3nnahj0j.js";
 import"./chunk-0y5542k8.js";
 import"./chunk-g7pnjzkk.js";
@@ -21,4 +22,4 @@ export {
   writeAdminFiles2 as writeAdminFiles
 };
 
-//# debugId=214EC0FC923A8CDE64756E2164756E21
+//# debugId=989933E8EAB2EB1A64756E2164756E21

package/dist/src/{chunk-fnakrk0a.js → chunk-yv9px0f5.js}

@@ -4,6 +4,10 @@ import {
   fields2,
   boundedJson2
 } from "./chunk-qt9m2kg2.js";
+import {
+  cliMessages2,
+  formatMessage2
+} from "./chunk-5b8g62kw.js";
 import {
   setupFileStamp,
   writeSetupFile,
@@ -15,13 +19,12 @@ import {
   issueAdmin,
   revokeAdmin,
   summarizeAdmins
-} from "./chunk-ebm3kvnq.js";
+} from "./chunk-wxqhscsw.js";
 import {
   resolveRoleConfigPath2
 } from "./chunk-1bf0wmgk.js";
 import {
-  runtimeReference,
-  readRuntimeJson
+  runtimeReference
 } from "./chunk-z7kkfrgz.js";
 import {
   CLI_ERROR_CODES,
@@ -33,18 +36,8 @@ import {
 } from "./chunk-6n9s7nfe.js";
 
 // src/cli/admin-command.ts
-var ADMIN_HELP = `\u7528\u6CD5\uFF1A
-  rovloom admin list [--config /absolute/path/gateway.json]
-  rovloom admin create [--principal ID] [--ttl-days N] [--config /absolute/path/gateway.json]
-  rovloom admin revoke [--principal ID] [--config /absolute/path/gateway.json]
-
-\u7BA1\u7406\u9875\uFF08\u9ED8\u8BA4 http://127.0.0.1:9445/\uFF09\u7528 HTTP Basic \u767B\u5F55\uFF1A\u7528\u6237\u540D\u662F\u7BA1\u7406\u5458 ID\uFF08\u9ED8\u8BA4 admin\uFF09\uFF0C\u5BC6\u7801\u662F create \u8F93\u51FA\u7684\u53E3\u4EE4\u3002
-\u53E3\u4EE4\u539F\u503C\u53EA\u5728 create \u65F6\u5199\u5230 stdout \u4E00\u6B21\uFF08Gateway \u53EA\u4FDD\u5B58 SHA-256 \u6458\u8981\uFF09\uFF1B\u5176\u4F59\u4FE1\u606F\u5199\u5230 stderr\u3002\u4E22\u5931\u53E3\u4EE4\u5C31\u518D create \u4E00\u6B21\uFF1A
-\u540C\u540D\u7BA1\u7406\u5458\u88AB\u91CD\u65B0\u7B7E\u53D1\uFF0C\u65E7\u53E3\u4EE4\u4E0E\u5DF2\u767B\u5F55\u7684\u6D4F\u89C8\u5668\u4F1A\u8BDD\u7ACB\u5373\u5931\u6548\u3002revoke \u5220\u9664\u7BA1\u7406\u5458\uFF0C\u540C\u6837\u7ACB\u5373\u751F\u6548\u3002\u4FEE\u6539\u65E0\u9700\u91CD\u542F Gateway\u3002
-\u7BA1\u7406\u5458\u4E0D\u80FD\u8C03\u7528 MCP\uFF0C\u4E5F\u4E0E MCP \u4EE4\u724C\u3001\u8BBE\u5907\u51ED\u636E\u4E92\u4E0D\u901A\u7528\uFF1B\u6709\u6548\u671F\u9ED8\u8BA4 ${DEFAULT_ADMIN_TTL_DAYS} \u5929\uFF081-365\uFF09\u3002
-\u53EF\u5728\u9996\u6B21\u914D\u5BF9\u524D\u521B\u5EFA\uFF1A\u5168\u65B0 Gateway \u4F1A\u81EA\u884C\u521D\u59CB\u5316\u7A7A\u7684 MCP \u8C03\u7528\u65B9\u6CE8\u518C\u8868\uFF0C\u968F\u540E\u5373\u53EF\u5728\u7BA1\u7406\u9875
-\u5728\u7EBF\u914D\u5BF9\u9996\u53F0 Connector\uFF08\u65B0\u5EFA\u7533\u8BF7\uFF0C\u8BBE\u5907\u8FD0\u884C rovloom connector --claim\uFF09\u3002
-`;
+import { mkdirSync } from "fs";
+import { dirname } from "path";
 function parse(args) {
   const sub = args[1];
   if (!sub || !["list", "create", "revoke"].includes(sub)) {
@@ -117,6 +110,7 @@ function callersStamp(path) {
 function writeAdminFiles2(config, principal, at, days) {
   const callersPath = runtimeReference(config.state_dir, "mcp-callers");
   const managementPath = runtimeReference(config.state_dir, "management");
+  mkdirSync(dirname(managementPath), { recursive: true, mode: 448 });
   const stamp = callersStamp(callersPath);
   const callers = parseRegistry(readSetupJson(callersPath, REGISTRY_MAX_BYTES) ?? emptyCallerRegistry(callerResource(config)));
   const { file, exists } = loadManagement(managementPath, config.management_port);
@@ -136,7 +130,7 @@ function managementSourceExists2(config) {
 async function handleAdminCommand2(args, io, environment, now = Date.now) {
   try {
     if (args.length === 2 && args[1] === "--help") {
-      io.stderr.write(ADMIN_HELP);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["help.admin"], { ttlDays: DEFAULT_ADMIN_TTL_DAYS }));
       return 0;
     }
     const flags = parse(args);
@@ -150,15 +144,19 @@ async function handleAdminCommand2(args, io, environment, now = Date.now) {
     const principal = flags.principal ?? "admin";
     if (flags.sub === "create") {
       const issued = writeAdminFiles2(config, principal, at, flags.days);
-      io.stderr.write("created administrator " + principal + " expires " + new Date(issued.expires_at).toISOString() + `
-login at http://127.0.0.1:` + config.management_port + '/ with user "' + principal + `" and the password below (shown once)
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["admin.create.created"], {
+        principal,
+        expires: new Date(issued.expires_at).toISOString()
+      }) + formatMessage2(cliMessages2(io.language)["admin.create.login"], {
+        url: "http://127.0.0.1:" + config.management_port + "/",
+        user: principal
+      }));
       io.stdout.write(issued.secret + `
 `);
       return 0;
     }
-    const callersStamp = setupFileStamp(callersPath);
-    const callers = parseRegistry(readRuntimeJson(callersPath, REGISTRY_MAX_BYTES));
+    const registryStamp = callersStamp(callersPath);
+    const callers = parseRegistry(readSetupJson(callersPath, REGISTRY_MAX_BYTES) ?? emptyCallerRegistry(callerResource(config)));
     const { file, exists } = loadManagement(managementPath, config.management_port);
     if (flags.sub === "list") {
       for (const row of summarizeAdmins(file, at)) {
@@ -170,9 +168,8 @@ login at http://127.0.0.1:` + config.management_port + '/ with user "' + princip
     const stamp = exists ? setupFileStamp(managementPath) : undefined;
     const revoked = revokeAdmin(callers, file, principal);
     writeSetupFile(managementPath, boundedJson2(revoked.management, 65536), true, stamp);
-    writeSetupFile(callersPath, boundedJson2(revoked.callers, REGISTRY_MAX_BYTES), true, callersStamp);
-    io.stderr.write("revoked administrator " + principal + `
-`);
+    writeSetupFile(callersPath, boundedJson2(revoked.callers, REGISTRY_MAX_BYTES), true, registryStamp);
+    io.stderr.write(formatMessage2(cliMessages2(io.language)["admin.revoked"], { principal }));
     return 0;
   } catch (error) {
     if (error instanceof CliError2 && CLI_ERROR_CODES.includes(error.code)) {
@@ -188,4 +185,4 @@ login at http://127.0.0.1:` + config.management_port + '/ with user "' + princip
 
 export { writeAdminFiles2, managementSourceExists2, handleAdminCommand2 };
 
-//# debugId=B65D75D1FF47247C64756E2164756E21
+//# debugId=0EB59DEAE24D22AB64756E2164756E21

package/dist/src/{chunk-n073xnr1.js → chunk-zjkjjm81.js}

@@ -30,10 +30,14 @@ import {
   checkedRemoteLuvusConfig,
   createPinnedRemoteLuvus
 } from "./chunk-5s2emvww.js";
+import {
+  cliMessages2,
+  formatMessage2
+} from "./chunk-5b8g62kw.js";
 import {
   writeAdminFiles2,
   managementSourceExists2
-} from "./chunk-fnakrk0a.js";
+} from "./chunk-yv9px0f5.js";
 import {
   setupFileStamp,
   writeSetupFile,
@@ -42,7 +46,7 @@ import {
   REGISTRY_MAX_BYTES,
   parseRegistry,
   isAdminPlaceholder
-} from "./chunk-ebm3kvnq.js";
+} from "./chunk-wxqhscsw.js";
 import {
   readRuntimeConfig2
 } from "./chunk-bspzg8er.js";
@@ -608,12 +612,12 @@ class SetupApproval {
       if (!["issued", "paired", "native_approved"].includes(previous.phase) || previous.phase === "issued" && Date.now() >= previous.expires_at) {
         throw new CliError2("configuration_required");
       }
-      if (!await this.terminal.confirm("Resume the existing device setup? / \u7EE7\u7EED\u539F\u8BBE\u5907\u8BBE\u7F6E\uFF1F")) {
+      if (!await this.terminal.confirm(cliMessages2(this.terminal.io.language)["setup.approval.resumeConfirm"])) {
         throw new CliError2("configuration_required");
       }
       return { plan: previous };
     }
-    if (!await this.terminal.confirm("Pair one Connector with this Gateway? / \u5141\u8BB8\u914D\u5BF9\u4E00\u4E2A Connector\uFF1F")) {
+    if (!await this.terminal.confirm(cliMessages2(this.terminal.io.language)["setup.approval.pairConfirm"])) {
       return { declined: true };
     }
     const now = Date.now();
@@ -669,7 +673,10 @@ class SetupApproval {
     if (device.status === "revoked") {
       throw new CliError2("configuration_required");
     }
-    if (!await this.terminal.confirm("Re-pair the existing Connector device " + device.name + " (" + machine + ")? The credential it holds stops working now and in-flight calls become unknown. / \u91CD\u65B0\u914D\u5BF9\u5DF2\u6709\u8BBE\u5907 " + device.name + "\uFF08" + machine + "\uFF09\uFF1F\u8BE5\u8BBE\u5907\u5F53\u524D\u51ED\u636E\u7ACB\u5373\u5931\u6548\uFF0C\u8FDB\u884C\u4E2D\u7684\u8C03\u7528\u7ED3\u679C\u53D8\u4E3A\u672A\u77E5\u3002")) {
+    if (!await this.terminal.confirm(formatMessage2(cliMessages2(this.terminal.io.language)["setup.approval.repairDeviceConfirm"], {
+      name: device.name,
+      machine
+    }))) {
       throw new CliError2("configuration_required");
     }
     for (let attempt = 0;; attempt++) {
@@ -836,7 +843,7 @@ function publishFirstCallers(path, resource, authorization, caller) {
     return;
   }
   const registry = parseRegistry(previous, resource);
-  const kept = registry.callers.filter((entry) => isAdminPlaceholder(entry) || boundedJson2(entry, REGISTRY_MAX_BYTES) === boundedJson2(caller, REGISTRY_MAX_BYTES));
+  const kept = registry.callers.filter((entry) => isAdminPlaceholder(entry) || entry.scope === "gateway" || boundedJson2(entry, REGISTRY_MAX_BYTES) === boundedJson2(caller, REGISTRY_MAX_BYTES));
   if (kept.length !== registry.callers.length) {
     throw new CliError2("configuration_required");
   }
@@ -880,43 +887,34 @@ class GatewaySetup {
       this.#begun = true;
       const active = this.approval.active();
       if (active?.repair && active.phase === "configured") {
-        this.terminal.show(`Resuming the device re-pairing; waiting for the Connector to reconnect. / \u7EE7\u7EED\u539F\u91CD\u65B0\u914D\u5BF9\uFF0C\u7B49\u5F85 Connector \u91CD\u8FDE\u3002
-`);
+        this.terminal.show(cliMessages2(this.terminal.io.language)["setup.gateway.resumeRePairing"]);
       } else {
         const issued = await this.approval.issueRepair();
-        this.terminal.show("Gateway MCP: " + mcpUrl + `
-Connector endpoint: ` + gateway.transport.url.replace(/\/connector$/, "") + `
-One-time re-pairing code for the existing device (5 minutes; keep private) / \u5DF2\u6709\u8BBE\u5907\u7684\u4E00\u6B21\u6027\u91CD\u65B0\u914D\u5BF9\u7801\uFF085\u5206\u949F\uFF0C\u8BF7\u4FDD\u5BC6\uFF09:
-` + issued.code + `
-Stop that Connector, then run rovloom connector --repair on its machine and enter the code. The old credential no longer works.
-\u5728\u8BE5\u8BBE\u5907\u4E0A\u505C\u6B62 Connector\uFF0C\u8FD0\u884C rovloom connector --repair \u5E76\u8F93\u5165\u6B64\u7801\uFF1B\u65E7\u51ED\u636E\u5DF2\u5931\u6548\u3002
-`);
+        this.terminal.show(formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.repairCodeBlock"], {
+          mcpUrl,
+          endpoint: gateway.transport.url.replace(/\/connector$/, ""),
+          code: issued.code
+        }));
       }
     }
     const current = this.approval.active();
     if (!this.#begun && (current?.phase === "ready" ? this.options.addDevice === true : current?.phase !== "configured")) {
       this.#begun = true;
-      this.terminal.show("Gateway MCP: " + mcpUrl + `
-Connector endpoint: ` + gateway.transport.url.replace(/\/connector$/, "") + `
-`);
+      this.terminal.show(formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.endpoints"], {
+        mcpUrl,
+        endpoint: gateway.transport.url.replace(/\/connector$/, "")
+      }));
       const issued = await this.approval.issue();
       if (issued.declined) {
         const page = this.config.management_enabled ? "http://127.0.0.1:" + this.config.management_port + "/" : "";
-        this.terminal.show(`Gateway stays unpaired and running; no enrollment or credential is issued. / Gateway \u4FDD\u6301\u672A\u914D\u5BF9\u5E76\u7EE7\u7EED\u8FD0\u884C\uFF0C\u4E0D\u7B7E\u53D1\u51ED\u636E\u3002
-` + (page ? "Finish first pairing from the management page: create the administrator with `rovloom admin create`, sign in at " + page + ", create a pairing application, then run `rovloom connector --claim` on the device. / \u5728\u7BA1\u7406\u9875\u5B8C\u6210\u9996\u6B21\u914D\u5BF9\uFF1A\u5148\u7528 `rovloom admin create` \u521B\u5EFA\u7BA1\u7406\u5458\uFF0C\u767B\u5F55 " + page + " \u65B0\u5EFA\u914D\u5BF9\u7533\u8BF7\uFF0C\u518D\u5728\u8BBE\u5907\u4E0A\u8FD0\u884C `rovloom connector --claim`\u3002\n" : `Management is disabled; enable it or rerun to pair from this terminal. / \u7BA1\u7406\u9875\u672A\u542F\u7528\uFF1B\u8BF7\u542F\u7528\u540E\u91CD\u8BD5\u6216\u5728\u672C\u7EC8\u7AEF\u5B8C\u6210\u914D\u5BF9\u3002
-`));
+        this.terminal.show(cliMessages2(this.terminal.io.language)["setup.gateway.unpairedRunning"] + (page ? formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.managementFirstPairing"], { page }) : cliMessages2(this.terminal.io.language)["setup.gateway.managementDisabled"]));
         this.terminal.finishQuestions();
         return;
       }
       if (issued.code) {
-        this.terminal.show(`One-time pairing code (5 minutes; keep private) / \u4E00\u6B21\u6027\u914D\u5BF9\u7801\uFF085\u5206\u949F\uFF0C\u8BF7\u4FDD\u5BC6\uFF09:
-` + issued.code + `
-Run rovloom connector in another local terminal and enter the Gateway address and code.
-\u5728 Connector \u7684\u672C\u5730\u7EC8\u7AEF\u8F93\u5165 Gateway \u5730\u5740\u4E0E\u8BE5\u7801\uFF1B\u968F\u540E\u56DE\u5230\u6B64\u7EC8\u7AEF\u6279\u51C6\u5B9E\u6D4B\u5B89\u88C5\u3002
-`);
+        this.terminal.show(formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.pairingCodeBlock"], { code: issued.code }));
       } else {
-        this.terminal.show(`Resuming the existing setup; no new enrollment or credential is issued. / \u7EE7\u7EED\u539F\u8BBE\u7F6E\uFF0C\u4E0D\u91CD\u65B0\u7B7E\u53D1\u3002
-`);
+        this.terminal.show(cliMessages2(this.terminal.io.language)["setup.gateway.resumingExisting"]);
       }
     }
     const plan = this.approval.active();
@@ -938,8 +936,7 @@ Run rovloom connector in another local terminal and enter the Gateway address an
           }
           if (device?.authenticated && device.ready && (plan.providers ?? ["luvus"]).every((kind) => device.providers.some((entry) => entry.provider_id === kind && entry.ready))) {
             this.approval.finishReady(plan.attempt_id);
-            this.terminal.show(`connector_ready / Connector \u5DF2\u901A\u8FC7\u771F\u5B9E\u8BA4\u8BC1\u4E14\u5168\u90E8\u6240\u9009\u539F\u751F provider \u5C31\u7EEA\u3002
-`);
+            this.terminal.show(cliMessages2(this.terminal.io.language)["setup.gateway.connectorReady"]);
             clearInterval(this.#timer);
             this.#timer = undefined;
           }
@@ -971,7 +968,9 @@ Run rovloom connector in another local terminal and enter the Gateway address an
     })) {
       throw new CliError2("configuration_required");
     }
-    await this.approval.approveNative(request.plan.attempt_id, kinds, fingerprint, "Allow this paired device's measured native installations (" + reviewed.map((entry) => entry.kind + " " + entry.label + ", Target " + boundedJson2(entry.target) + ", binary SHA-256 " + entry.binary_sha256).join("; ") + `) for reviewed workspace/Agent operations and one local MCP caller? Terminal execution is controlled by the Connector machine owner's local configuration. / \u6279\u51C6\u8FD9\u4E9B\u5B9E\u6D4B\u539F\u751F\u6765\u6E90\u3001\u5404\u81EA\u7A97\u53E3/Agent \u64CD\u4F5C\u53CA\u4E00\u4E2A\u672C\u673A MCP caller\uFF08\u7EC8\u7AEF\u6267\u884C\u7531 Connector \u672C\u673A\u6240\u6709\u8005\u914D\u7F6E\u51B3\u5B9A\uFF09\uFF1F`, request.signal);
+    await this.approval.approveNative(request.plan.attempt_id, kinds, fingerprint, formatMessage2(cliMessages2(this.terminal.io.language)["setup.prompt.gatewayNativeInstallations"], {
+      entries: reviewed.map((entry) => entry.kind + " " + entry.label + ", Target " + boundedJson2(entry.target) + ", binary SHA-256 " + entry.binary_sha256).join("; ")
+    }), request.signal);
     this.terminal.assertOwner();
     if (request.signal.aborted) {
       throw new CliError2("configuration_required");
@@ -1040,23 +1039,21 @@ Run rovloom connector in another local terminal and enter the Gateway address an
       const page = "http://127.0.0.1:" + this.config.management_port + "/";
       try {
         const admin = writeAdminFiles2(this.config, "admin", Date.now());
-        adminNote = `
-Management page / \u7BA1\u7406\u9875: ` + page + `
-Management user / \u7BA1\u7406\u5458: admin` + `
-Management password (private) / \u7BA1\u7406\u5458\u5BC6\u7801: ` + admin.secret + `
-(Shown once; run rovloom admin create to re-issue. / \u53EA\u663E\u793A\u4E00\u6B21\uFF1B\u4E22\u5931\u540E\u8FD0\u884C rovloom admin create \u91CD\u65B0\u7B7E\u53D1\u3002)`;
+        adminNote = formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.adminBlock"], {
+          page,
+          secret: admin.secret
+        });
       } catch {
-        adminNote = `
-Management administrator was not created; run rovloom admin create. / \u672A\u80FD\u521B\u5EFA\u7BA1\u7406\u9875\u7BA1\u7406\u5458\uFF0C\u8BF7\u7A0D\u540E\u8FD0\u884C rovloom admin create\u3002`;
+        adminNote = cliMessages2(this.terminal.io.language)["setup.gateway.adminNotCreated"];
       }
     }
-    this.terminal.show(`Native configuration saved; Gateway will reopen its real providers. / \u539F\u751F\u914D\u7F6E\u5DF2\u4FDD\u5B58\uFF0CGateway \u5C06\u91CD\u5F00\u5B9E\u9645 provider\u3002
-MCP credential file / MCP \u51ED\u636E\u6587\u4EF6: ` + clientPath + `
-MCP URL: ` + (this.config.mcp_public_url ?? resource) + `
-Targets: ` + boundedJson2(reviewed.map((entry) => entry.target)) + `
-Binding revision: 1` + (additional ? `
-Existing MCP Bearer now also covers this device (not shown again; tokens made with rovloom token create --like need re-creating). / \u73B0\u6709 MCP Bearer \u5DF2\u8986\u76D6\u6B64\u8BBE\u5907\uFF08\u4E0D\u518D\u663E\u793A\uFF1B\u7528 token create --like \u514B\u9686\u7684\u4EE4\u724C\u9700\u8981\u91CD\u65B0\u514B\u9686\uFF09\u3002` : `
-Bearer (private): ` + client.token) + adminNote + `
+    this.terminal.show(formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.nativeSaved"], {
+      clientPath,
+      url: this.config.mcp_public_url ?? resource,
+      targets: boundedJson2(reviewed.map((entry) => entry.target))
+    }) + (additional ? cliMessages2(this.terminal.io.language)["setup.gateway.bearerAdditional"] : formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.bearerSecret"], {
+      token: client.token
+    })) + adminNote + `
 `);
     setImmediate(() => this.#reload?.());
     return { state: "configured", fingerprint };
@@ -1114,4 +1111,4 @@ function mergeSetupProviders(path, entries) {
 
 export { setupSessions, setupTarget, setupProviderKinds, selectedSetupPolicies, setupReference, setupSessionsFor, setupReply, requestJson, device, reviewSetupManifest, publishSetupSchemas, publish, publishFirstCallers, GatewaySetup, mergeSetupCallers, mergeSetupProviders };
 
-//# debugId=3920190CFC3283A264756E2164756E21
+//# debugId=0EFB955908D6EDF264756E2164756E21

package/dist/src/cli/index.js

@@ -5,18 +5,23 @@ import"../chunk-qt9m2kg2.js";
 import"../chunk-9tt13dm0.js";
 import"../chunk-g7pnjzkk.js";
 import {
-  HELP2,
+  resolveCliLanguage2,
+  cliMessages2,
+  formatMessage2
+} from "../chunk-5b8g62kw.js";
+import {
+  cliHelp2,
   parseCommand2,
   runCli2
-} from "../chunk-abd4envz.js";
+} from "../chunk-gyvqqnjb.js";
 import {
   Store2
-} from "../chunk-nyn75b8v.js";
+} from "../chunk-qjh9x872.js";
 import"../chunk-09f9q26d.js";
 import {
   FacadeServiceError2
-} from "../chunk-smpevv7n.js";
-import"../chunk-9y36gntb.js";
+} from "../chunk-0dqx2mmz.js";
+import"../chunk-9zkq0kc8.js";
 import {
   Router2
 } from "../chunk-y4hksha9.js";
@@ -27,7 +32,7 @@ import"../chunk-0xgpxdgc.js";
 import {
   resolveGatewayPrincipal,
   StoreGatewayService2
-} from "../chunk-7k9g0x5e.js";
+} from "../chunk-mg0fd6ph.js";
 import"../chunk-zj48jvfe.js";
 import"../chunk-8nv79bhy.js";
 import"../chunk-zxsz6g14.js";
@@ -38,28 +43,28 @@ import {
 } from "../chunk-zjzrcc59.js";
 import"../chunk-d4ejrtjq.js";
 import"../chunk-5s2emvww.js";
-import"../chunk-4etdq0cp.js";
-import"../chunk-ympzv86c.js";
+import"../chunk-jka7v3wb.js";
+import"../chunk-ez7d5dac.js";
 import"../chunk-5h82060k.js";
 import"../chunk-863tk45b.js";
 import"../chunk-zb641qa3.js";
 import"../chunk-ttsrctxg.js";
 import"../chunk-5svt6rwr.js";
 import"../chunk-2tn0r64b.js";
-import"../chunk-fnakrk0a.js";
-import"../chunk-n073xnr1.js";
+import"../chunk-yv9px0f5.js";
+import"../chunk-zjkjjm81.js";
 import {
   createRuntimeCliRuntime2,
   MANAGEMENT_COOKIE_NAME2,
   MANAGEMENT_BOOTSTRAP_META2,
   createManagementPageInitializer2,
   createProductionCliRuntime2
-} from "../chunk-5n8csngz.js";
-import"../chunk-ebm3kvnq.js";
+} from "../chunk-d2kz25f2.js";
+import"../chunk-wxqhscsw.js";
 import {
   readRuntimeConfig2
 } from "../chunk-bspzg8er.js";
-import"../chunk-64ftwe9b.js";
+import"../chunk-8ykrqhxh.js";
 import {
   resolveRoleConfigPath2
 } from "../chunk-1bf0wmgk.js";
@@ -206,9 +211,10 @@ function createTransportCliRuntime(host) {
 }
 export {
   CliError2 as CliError,
-  HELP2 as HELP,
   MANAGEMENT_BOOTSTRAP_META2 as MANAGEMENT_BOOTSTRAP_META,
   MANAGEMENT_COOKIE_NAME2 as MANAGEMENT_COOKIE_NAME,
+  cliHelp2 as cliHelp,
+  cliMessages2 as cliMessages,
   configDocument2 as configDocument,
   configTemplate2 as configTemplate,
   createManagementPageInitializer2 as createManagementPageInitializer,
@@ -216,12 +222,14 @@ export {
   createRuntimeCliRuntime2 as createRuntimeCliRuntime,
   createStoreCliRuntime,
   createTransportCliRuntime,
+  formatMessage2 as formatMessage,
   parseCommand2 as parseCommand,
   parseConfig2 as parseConfig,
   readConfig2 as readConfig,
   readRuntimeConfig2 as readRuntimeConfig,
+  resolveCliLanguage2 as resolveCliLanguage,
   resolveRoleConfigPath2 as resolveRoleConfigPath,
   runCli2 as runCli
 };
 
-//# debugId=1B7BA4593951588264756E2164756E21
+//# debugId=E0A8FE0C7070424764756E2164756E21

package/dist/src/cli/main.js

@@ -1,5 +1,10 @@
 #!/usr/bin/env bun
 // @bun
+import {
+  resolveCliLanguage2,
+  cliMessages2,
+  formatMessage2
+} from "../chunk-5b8g62kw.js";
 import"../chunk-d71r315c.js";
 import {
   parseNativeJson2
@@ -10,13 +15,13 @@ import"../chunk-g7pnjzkk.js";
 import {
   parseCommand2,
   runCli2
-} from "../chunk-abd4envz.js";
+} from "../chunk-gyvqqnjb.js";
 import {
   createNativeServiceBackend2,
   ServiceManager2
 } from "../chunk-ttm3c0jh.js";
 import"../chunk-bspzg8er.js";
-import"../chunk-64ftwe9b.js";
+import"../chunk-8ykrqhxh.js";
 import {
   resolveRoleConfigPath2
 } from "../chunk-1bf0wmgk.js";
@@ -53,8 +58,7 @@ function bunSupported(version, minimum = MINIMUM_BUN) {
   return true;
 }
 if (!bunSupported(process.versions.bun)) {
-  process.stderr.write(`Rovloom requires Bun ${MINIMUM_BUN} or newer (https://bun.sh); this runtime is not supported.
-`);
+  process.stderr.write(formatMessage2(cliMessages2(resolveCliLanguage2(process.env))["guard.bunUnsupported"], { minimum: MINIMUM_BUN }));
   process.exit(1);
 }
 
@@ -300,10 +304,10 @@ async function control(role) {
 }
 async function product() {
   if (!runtime) {
-    const { createProductSources } = await import("../chunk-e7x51y0t.js");
-    const { CliSetup } = await import("../chunk-erdq0rn8.js");
+    const { createProductSources } = await import("../chunk-jf4r0r44.js");
+    const { CliSetup } = await import("../chunk-3dvn33c4.js");
     setup = new CliSetup;
-    runtime = (await import("../chunk-rwpynx2j.js")).createProductionCliRuntime(createProductSources(), setup);
+    runtime = (await import("../chunk-0qgk7mhz.js")).createProductionCliRuntime(createProductSources(), setup);
   }
   return runtime;
 }
@@ -312,7 +316,8 @@ try {
     stdin: process.stdin,
     stdout: process.stdout,
     stderr: process.stderr,
-    signal: stop.signal
+    signal: stop.signal,
+    language: resolveCliLanguage2(process.env)
   }, {
     ...process.argv[2] === "service" && process.argv[3] !== "--help" ? { service: createProductServiceHost() } : {},
     prepare: async (config, path, io, options) => (await product()).prepare(config, path, io, options),
@@ -343,4 +348,4 @@ try {
   }
 }
 
-//# debugId=91A2754E6B663B1964756E2164756E21
+//# debugId=80EA4F16E6397DC764756E2164756E21

package/dist/src/mcp/index.js

@@ -5,11 +5,11 @@ import {
   HTTP_BODY_BYTES2,
   createHttpFacade2,
   startHttpFacade2
-} from "../chunk-9y36gntb.js";
+} from "../chunk-9zkq0kc8.js";
 import {
   StoreGatewayService2,
   RuntimeGatewayService2
-} from "../chunk-7k9g0x5e.js";
+} from "../chunk-mg0fd6ph.js";
 import {
   MAX_MCP_BYTES2,
   MAX_RESULT_BYTES2,
@@ -18,11 +18,12 @@ import {
   toolDefinition2,
   parseToolArguments2,
   FacadeServiceError2
-} from "../chunk-smpevv7n.js";
+} from "../chunk-0dqx2mmz.js";
 import {
   MCP_REVISION2,
   PRODUCT_VERSION2
-} from "../chunk-r0nfthsf.js";
+} from "../chunk-s3ydr65k.js";
+import"../chunk-5b8g62kw.js";
 import"../chunk-zj48jvfe.js";
 import"../chunk-0xgpxdgc.js";
 import"../chunk-gbsbwssz.js";
@@ -57,4 +58,4 @@ export {
   toolNames2 as toolNames
 };
 
-//# debugId=82387112B1AB3AD564756E2164756E21
+//# debugId=000CCA32D906A2E664756E2164756E21

package/dist/src/runtime/index.js

@@ -15,7 +15,7 @@ import {
   attachExistingLuvus2,
   LuvusProductionStartupError2,
   createLuvusProductionSources2
-} from "../chunk-4etdq0cp.js";
+} from "../chunk-jka7v3wb.js";
 import {
   initializeManagedLuvusRoot2,
   openManagedLuvusRoot2,
@@ -43,7 +43,7 @@ import"../chunk-gbsbwssz.js";
 import"../chunk-q5pgbwb3.js";
 import"../chunk-57ayxqnb.js";
 import"../chunk-3nnahj0j.js";
-import"../chunk-nyn75b8v.js";
+import"../chunk-qjh9x872.js";
 import"../chunk-zdxww7ms.js";
 import"../chunk-0pewfj89.js";
 import"../chunk-0y5542k8.js";

package/dist/src/service/index.js

@@ -1,9 +1,9 @@
 // @bun
+import"../chunk-5b8g62kw.js";
 import {
-  SERVICE_HELP2,
   parseServiceCommand2,
   handleServiceCommand2
-} from "../chunk-7q96e161.js";
+} from "../chunk-x0td5wn4.js";
 import {
   createNativeServiceBackend2,
   ServiceManager2
@@ -12,7 +12,6 @@ import {
   ServiceError2
 } from "../chunk-wqknkynm.js";
 export {
-  SERVICE_HELP2 as SERVICE_HELP,
   ServiceError2 as ServiceError,
   ServiceManager2 as ServiceManager,
   createNativeServiceBackend2 as createNativeServiceBackend,
@@ -20,4 +19,4 @@ export {
   parseServiceCommand2 as parseServiceCommand
 };
 
-//# debugId=B84154E5700C2C6B64756E2164756E21
+//# debugId=89E2AB8CB22A102364756E2164756E21

package/dist/src/store.js

@@ -3,7 +3,7 @@ import {
   DEFAULT_RETENTION2,
   GATEWAY_LOCK_FORMAT2,
   Store2
-} from "./chunk-nyn75b8v.js";
+} from "./chunk-qjh9x872.js";
 import"./chunk-zdxww7ms.js";
 import"./chunk-0pewfj89.js";
 import"./chunk-0y5542k8.js";