rovloom 0.5.0 → 0.6.1

package/dist/src/{chunk-5s2emvww.js → chunk-j6svdqr8.js}

@@ -6,12 +6,7 @@ import {
   object2,
   fields2,
   id2,
-  sha2,
   boundedJson2,
-  hash2,
-  validateTarget2,
-  validateProvider2,
-  validateContractSource2,
   contractRef2,
   assertBinding2
 } from "./chunk-qt9m2kg2.js";
@@ -19,9 +14,6 @@ import {
   compileBundle2,
   createNativeValidator2
 } from "./chunk-mqyq5jh6.js";
-import {
-  LuvusAdapterError2
-} from "./chunk-57ayxqnb.js";
 import {
   macosProcessState,
   macosProcessUid,
@@ -30,7 +22,7 @@ import {
   windowsInspectPath,
   windowsProcessFacts,
   windowsProcessState
-} from "./chunk-09f9q26d.js";
+} from "./chunk-vdwzb63d.js";
 import {
   WINDOWS_PIPE,
   LUVUS_ENDPOINT_TRANSPORT,
@@ -50,27 +42,23 @@ import {
   readWindowsLuvusPeer2,
   readMacosLuvusPeer2,
   readLuvusPeer2
-} from "./chunk-0xgpxdgc.js";
-import {
-  LUVUS_OPERATION_METHODS2,
-  luvusOperationDescriptor2,
-  luvusOperationValidation2,
-  validateLuvusOperationParams2,
-  createLuvusRequestPreflight
-} from "./chunk-zj48jvfe.js";
+} from "./chunk-bbdtsg4b.js";
 import {
   LUVUS_CLAIMS_LOCK_FORMAT
-} from "./chunk-gbsbwssz.js";
+} from "./chunk-sf4ztxba.js";
+import {
+  LuvusAdapterError2
+} from "./chunk-pksaqt9a.js";
 import {
   lockOwnerFields,
   recordedProcess,
   ownedFile,
   recoverStaleLock
-} from "./chunk-zdxww7ms.js";
+} from "./chunk-h3xyq7zk.js";
 import {
   listening,
   ownerIsDead
-} from "./chunk-0pewfj89.js";
+} from "./chunk-qp8tgms2.js";
 import {
   syncParentDirectory
 } from "./chunk-0y5542k8.js";
@@ -1345,286 +1333,6 @@ async function startManagedLuvus2(root) {
   }
 }
 
-// src/runtime/luvus-operations-authority.ts
-import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
-function assertLuvusOperationsContract(contract) {
-  const source = contract.wire.source;
-  const capabilities = object2(object2(contract.capabilities).result);
-  if (contract.wire.support_status !== "validated" || source.provider_kind !== "luvus" || source.protocol_family !== "uhp" || source.schema_origin !== "installed_cli" || source.schema_command !== "luvus uhp schema" || !/^1\.\d+$/u.test(source.native_protocol_version ?? "") || source.support_basis !== "live_catalog" || source.adapter_revision !== MANAGED_LUVUS_REVISION2 || source.classification_revision !== MANAGED_LUVUS_CLASSIFICATION2 || typeof source.runtime_generation !== "string" || !source.runtime_generation.length || source.runtime_generation !== capabilities.server_generation || contract.compiled.identity.binary_sha256 !== source.binary_sha256 || contract.compiled.identity.schema_sha256 !== source.schema_sha256 || contract.compiled.identity.revision !== source.adapter_revision || !Array.isArray(capabilities.method_contracts)) {
-    throw new LuvusAdapterError2("luvus_operations_source_mismatch");
-  }
-}
-function createLuvusOperationsAuthority(contract, current, rawAllowed) {
-  assertLuvusOperationsContract(contract);
-  const methods = object2(object2(contract.capabilities).result).method_contracts;
-  return (attempt, native) => {
-    const proven = current(attempt.binding);
-    const descriptor = luvusOperationDescriptor2(attempt.method);
-    if (proven.authenticated !== true || proven.source_verified !== true || !descriptor || attempt.native_request.method !== attempt.method || attempt.mode !== luvusOperationValidation2(attempt.method) || !isDeepStrictEqual4(proven.binding, native)) {
-      throw new LuvusAdapterError2("luvus_operation_unreviewed");
-    }
-    const live = methods.filter((row) => row.method === attempt.method);
-    if (live.length !== 1 || !isDeepStrictEqual4({
-      method: live[0].method,
-      access: live[0].access,
-      scope: live[0].scope,
-      idempotent: live[0].idempotent
-    }, descriptor.native)) {
-      throw new LuvusAdapterError2("luvus_operations_contract_mismatch");
-    }
-    validateLuvusOperationParams2(attempt.method, attempt.native_request.params);
-    const raw = attempt.mode === "raw-contract";
-    const allowed = raw && rawAllowed(attempt) === true;
-    return {
-      owner: allowed,
-      raw_requested: raw,
-      ...allowed ? {
-        raw_grant: {
-          id: attempt.binding.call_id,
-          source_verified: true,
-          principal_id: attempt.principal_id,
-          binding: native,
-          methods: [attempt.method],
-          expires_at: attempt.binding.registration.deadline
-        }
-      } : {}
-    };
-  };
-}
-
-// src/runtime/remote-luvus.ts
-function checkedRemoteLuvusConfig(reference, input) {
-  const config = object2(JSON.parse(boundedJson2(input)));
-  fields2(config, ["kind", "authentication", "binding", "target", "contract", "peer_policy_revision"], ["raw_grant"]);
-  validateProvider2(config.binding);
-  validateTarget2(config.target);
-  id2(config.peer_policy_revision);
-  const pin = object2(config.contract);
-  fields2(pin, [
-    "binary_version",
-    "binary_sha256",
-    "schema_sha256",
-    "adapter_revision",
-    "classification_revision",
-    "schema_bundle"
-  ]);
-  sha2(pin.binary_sha256);
-  sha2(pin.schema_sha256);
-  if (config.kind !== "luvus" || config.authentication !== "remote_connector" || config.binding.kind !== "luvus" || config.target.profile !== "session" || config.binding.machine_id !== config.target.machine_id || config.binding.provider_id !== config.target.provider_id || config.binding.config_ref !== reference || typeof pin.binary_version !== "string" || !pin.binary_version.length || pin.binary_version.length > 128 || pin.adapter_revision !== MANAGED_LUVUS_REVISION2 || pin.classification_revision !== MANAGED_LUVUS_CLASSIFICATION2 || typeof pin.schema_bundle !== "string" || hash2(pin.schema_bundle) !== pin.schema_sha256) {
-    throw new LuvusAdapterError2("remote_luvus_pin_invalid");
-  }
-  if (config.raw_grant !== undefined) {
-    const grant = object2(config.raw_grant);
-    fields2(grant, ["principal_id", "methods"]);
-    id2(grant.principal_id);
-    if (!Array.isArray(grant.methods) || grant.methods.length > LUVUS_OPERATION_METHODS2.length || new Set(grant.methods).size !== grant.methods.length || grant.methods.some((method) => !LUVUS_OPERATION_METHODS2.includes(method))) {
-      throw new LuvusAdapterError2("remote_luvus_raw_grant_invalid");
-    }
-    Object.freeze(grant.methods);
-    Object.freeze(grant);
-  }
-  Object.freeze(config.binding);
-  Object.freeze(config.target);
-  Object.freeze(pin);
-  return Object.freeze(config);
-}
-async function createPinnedRemoteLuvus(config) {
-  const pin = config.contract;
-  const compiled = await compileBundle2(Buffer.from(pin.schema_bundle), {
-    identity: { binary_sha256: pin.binary_sha256, schema_sha256: pin.schema_sha256, revision: pin.adapter_revision }
-  });
-  if (!compiled.ok) {
-    throw new LuvusAdapterError2(compiled.error.code);
-  }
-  const contractHandle = compiled.value;
-  const target = config.target;
-  if (target.profile !== "session") {
-    throw new LuvusAdapterError2("remote_luvus_pin_invalid");
-  }
-  const validator = createNativeValidator2(contractHandle);
-  let closed = false;
-  let active;
-  function assertEpoch(epoch) {
-    if (closed || epoch.closed || active !== epoch) {
-      throw new LuvusAdapterError2("remote_luvus_epoch_unavailable");
-    }
-    const checked = epoch.assertCurrent();
-    if (checked !== undefined) {
-      Promise.resolve(checked).catch(() => {});
-      throw new LuvusAdapterError2("synchronous_remote_source_required");
-    }
-    if (closed || epoch.closed || active !== epoch) {
-      throw new LuvusAdapterError2("remote_luvus_epoch_unavailable");
-    }
-  }
-  function closeEpoch(epoch) {
-    epoch.closed = true;
-    epoch.record = undefined;
-    epoch.provider = undefined;
-    if (active === epoch) {
-      active = undefined;
-    }
-  }
-  function nativeBinding(epoch, policies) {
-    assertEpoch(epoch);
-    const record = epoch.record;
-    if (!record) {
-      throw new LuvusAdapterError2("remote_luvus_snapshot_required");
-    }
-    id2(policies.caller_policy_revision);
-    id2(policies.local_policy_revision);
-    const target = config.target;
-    if (target.profile !== "session") {
-      throw new LuvusAdapterError2("remote_luvus_pin_invalid");
-    }
-    const binding = Object.freeze({
-      kind: "luvus",
-      provider_id: target.provider_id,
-      binding_revision: config.binding.binding_revision,
-      contract_source_ref: contractRef2(record.wire.source),
-      target: Object.freeze({ machine_id: target.machine_id, profile: "session", session: target.session }),
-      server_generation: record.wire.source.runtime_generation,
-      connection_epoch: epoch.connection.connection_epoch,
-      recovery_generation: epoch.connection.recovery_generation,
-      capability_revision: record.capability_revision,
-      caller_policy_revision: policies.caller_policy_revision,
-      local_policy_revision: policies.local_policy_revision,
-      classification_revision: pin.classification_revision,
-      contract: contractHandle.identity
-    });
-    assertEpoch(epoch);
-    return Object.freeze({ binding, authenticated: true, source_verified: true });
-  }
-  function ready() {
-    try {
-      if (!active?.record) {
-        return false;
-      }
-      assertEpoch(active);
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  const provider = Object.freeze({
-    remote_luvus: true,
-    binding: config.binding,
-    target: config.target,
-    peer_policy_revision: config.peer_policy_revision,
-    preflightRequest: createLuvusRequestPreflight(contractHandle),
-    ready,
-    open(connection, assertCurrent) {
-      if (closed || active || !connection.authenticated || !connection.active || connection.machine_id !== config.target.machine_id || !connection.negotiated.capabilities.includes("provider_snapshot")) {
-        throw new LuvusAdapterError2("remote_luvus_epoch_unavailable");
-      }
-      const epoch = { connection: structuredClone(connection), assertCurrent, closed: false };
-      active = epoch;
-      try {
-        assertEpoch(epoch);
-      } catch (error) {
-        closeEpoch(epoch);
-        throw error;
-      }
-      return Object.freeze({
-        accept(input) {
-          assertEpoch(epoch);
-          const copied = parseNativeJson2(boundedJson2(input));
-          if (!copied.ok) {
-            throw new LuvusAdapterError2(copied.error.code);
-          }
-          const snapshot = copied.value;
-          fields2(object2(snapshot), ["binding", "target", "source", "capabilities", "capability_revision"]);
-          validateProvider2(snapshot.binding);
-          validateTarget2(snapshot.target);
-          validateContractSource2(snapshot.source);
-          sha2(snapshot.capability_revision);
-          if (boundedJson2(snapshot.binding) !== boundedJson2(config.binding) || boundedJson2(snapshot.target) !== boundedJson2(config.target)) {
-            throw new LuvusAdapterError2("remote_luvus_binding_mismatch");
-          }
-          const source = snapshot.source;
-          if (source.binary_sha256 !== pin.binary_sha256 || source.schema_sha256 !== pin.schema_sha256 || source.adapter_revision !== pin.adapter_revision || source.classification_revision !== pin.classification_revision || typeof source.runtime_generation !== "string" || !source.runtime_generation.length) {
-            throw new LuvusAdapterError2("remote_luvus_contract_mismatch");
-          }
-          const capabilities = object2(snapshot.capabilities);
-          const value = object2(capabilities.result);
-          if (hash2(boundedJson2(value)) !== snapshot.capability_revision) {
-            throw new LuvusAdapterError2("remote_luvus_capability_mismatch");
-          }
-          const shape = validator.checkCapabilitiesShape(capabilities, {
-            target: { machine_id: target.machine_id, profile: "session", session: target.session },
-            server_generation: source.runtime_generation
-          });
-          if (!shape.ok) {
-            throw new LuvusAdapterError2(shape.error.code);
-          }
-          const record = Object.freeze({
-            wire: Object.freeze({ source: Object.freeze(source), support_status: "validated" }),
-            compiled: contractHandle,
-            capabilities,
-            capability_revision: snapshot.capability_revision
-          });
-          assertLuvusOperationsContract(record);
-          const fingerprint = hash2(boundedJson2(snapshot));
-          if (epoch.fingerprint !== undefined) {
-            if (epoch.fingerprint !== fingerprint) {
-              throw new LuvusAdapterError2("remote_luvus_snapshot_changed");
-            }
-            assertEpoch(epoch);
-            return epoch.provider;
-          }
-          function sourceFor(binding) {
-            assertEpoch(epoch);
-            assertBinding2(binding, binding);
-            if (binding.machine_id !== epoch.connection.machine_id || binding.recovery_generation !== epoch.connection.recovery_generation || binding.connection_epoch !== epoch.connection.connection_epoch || binding.provider_kind !== "luvus" || binding.binding_revision !== config.binding.binding_revision || boundedJson2(binding.target) !== boundedJson2(config.target) || binding.contract_ref !== contractRef2(record.wire.source)) {
-              throw new LuvusAdapterError2("remote_luvus_binding_mismatch");
-            }
-            return nativeBinding(epoch, binding.registration);
-          }
-          const live = Object.freeze({
-            binding: config.binding,
-            target: config.target,
-            peer_policy_revision: config.peer_policy_revision,
-            contract: record,
-            source: sourceFor,
-            catalogSource(current, policies) {
-              if (boundedJson2(current) !== boundedJson2(epoch.connection)) {
-                throw new LuvusAdapterError2("remote_luvus_epoch_unavailable");
-              }
-              return nativeBinding(epoch, policies);
-            },
-            authority: createLuvusOperationsAuthority(record, sourceFor, (attempt) => config.raw_grant?.principal_id === attempt.principal_id && config.raw_grant.methods.includes(attempt.method)),
-            ready() {
-              try {
-                assertEpoch(epoch);
-                return !!epoch.record;
-              } catch {
-                return false;
-              }
-            }
-          });
-          assertEpoch(epoch);
-          epoch.record = record;
-          epoch.fingerprint = fingerprint;
-          epoch.provider = live;
-          return live;
-        },
-        close() {
-          closeEpoch(epoch);
-        }
-      });
-    }
-  });
-  return Object.freeze({
-    provider,
-    close() {
-      closed = true;
-      if (active) {
-        closeEpoch(active);
-      }
-    }
-  });
-}
-
-export { OwnedProcessShutdownError, observeLuvusProcess, nativeRecordStamp, readNativeRecord, createNativeRecord, removeNativeRecord, recoverLuvusClaimsLock, recoverLuvusOwnerLock, assertManagedControlDirectory, initializeManagedLuvusRoot2, openManagedLuvusRoot2, assertManagedRoot, NativeInstanceContext, discoverLuvusInstallation, MANAGED_LUVUS_REVISION2, MANAGED_LUVUS_CLASSIFICATION2, registerLocalOwnerLuvus, assertLocalOwnerLuvus, observedLuvusContract, startManagedLuvus2, assertLuvusOperationsContract, createLuvusOperationsAuthority, checkedRemoteLuvusConfig, createPinnedRemoteLuvus };
+export { OwnedProcessShutdownError, observeLuvusProcess, nativeRecordStamp, readNativeRecord, createNativeRecord, removeNativeRecord, recoverLuvusClaimsLock, recoverLuvusOwnerLock, assertManagedControlDirectory, initializeManagedLuvusRoot2, openManagedLuvusRoot2, assertManagedRoot, NativeInstanceContext, discoverLuvusInstallation, MANAGED_LUVUS_REVISION2, MANAGED_LUVUS_CLASSIFICATION2, registerLocalOwnerLuvus, assertLocalOwnerLuvus, observedLuvusContract, startManagedLuvus2 };
 
-//# debugId=38EA45B552DA108E64756E2164756E21
+//# debugId=23AB0591A85323DB64756E2164756E21

package/dist/src/{chunk-9y36gntb.js → chunk-jkzfck98.js}

@@ -3,6 +3,9 @@ import {
   canonical2,
   digest2
 } from "./chunk-d71r315c.js";
+import {
+  cliMessages2
+} from "./chunk-pgs9jp6t.js";
 import {
   MAX_MCP_BYTES2,
   TOOLS_PAGE_SIZE,
@@ -13,13 +16,13 @@ import {
   SERVICE_ERROR_CODES,
   FacadeServiceError2,
   NativeRequestNotDispatchedError
-} from "./chunk-smpevv7n.js";
+} from "./chunk-73aq2qkz.js";
 import {
   parseNativeJson2
 } from "./chunk-7crhmqn2.js";
 import {
   PRODUCT_VERSION2
-} from "./chunk-r0nfthsf.js";
+} from "./chunk-j59ac0xs.js";
 import {
   canonicalLoopbackHost
 } from "./chunk-6n9s7nfe.js";
@@ -109,9 +112,10 @@ function toolOffset(cursor) {
   return offset;
 }
 function createMcpFacade2(options) {
+  const language = options.language ?? "en";
   const server = new Server({ name: "rovloom", version: PRODUCT_VERSION2 }, {
     capabilities: { tools: {} },
-    instructions: "\u5DE5\u5177\u5B58\u5728\u4E0D\u8868\u793A\u540E\u7AEF\u53EF\u7528\uFF1B\u6267\u884C\u3001\u6388\u6743\u3001\u786E\u8BA4\u3001\u53BB\u91CD\u4E0E\u7ED3\u679C\u4FDD\u7559\u7531\u53D7\u4FE1\u670D\u52A1\u8D1F\u8D23\u3002"
+    instructions: cliMessages2(language)["mcp.instructions"]
   });
   let initialized = false;
   let inflight = 0;
@@ -140,7 +144,7 @@ function createMcpFacade2(options) {
     const names = toolNames2();
     const next = offset + TOOLS_PAGE_SIZE;
     return {
-      tools: names.slice(offset, next).map(toolDefinition2),
+      tools: names.slice(offset, next).map((name) => toolDefinition2(name, language)),
       ...next < names.length ? { nextCursor: Buffer.from(`rovloom-tools-v1:${next}`).toString("base64url") } : {}
     };
   });
@@ -504,6 +508,7 @@ function createHttpFacade2(options) {
     const server = createMcpFacade2({
       service: options.service,
       diagnostic: options.diagnostic,
+      ...options.language ? { language: options.language } : {},
       context: {
         resolve: (signal) => {
           const context = scope.getStore();
@@ -764,4 +769,4 @@ function startHttpFacade2(options) {
 
 export { createMcpFacade2, HTTP_BODY_BYTES2, createHttpFacade2, startHttpFacade2 };
 
-//# debugId=7CD2FDC41059ADFA64756E2164756E21
+//# debugId=69C1DCB6911C499664756E2164756E21

package/dist/src/{chunk-sj24fpz3.js → chunk-m76cmkfy.js}

@@ -7,8 +7,10 @@ import {
 import"./chunk-9tt13dm0.js";
 import"./chunk-g7pnjzkk.js";
 import {
-  setupFileStamp,
-  writeSetupFile,
+  cliMessages2,
+  formatMessage2
+} from "./chunk-pgs9jp6t.js";
+import {
   REGISTRY_MAX_BYTES,
   parseRegistry,
   createCaller,
@@ -18,7 +20,11 @@ import {
   revokeCaller,
   summarize,
   isAdminPlaceholder
-} from "./chunk-ebm3kvnq.js";
+} from "./chunk-pnep7yhj.js";
+import {
+  setupFileStamp,
+  writeSetupFile
+} from "./chunk-1xer1ent.js";
 import {
   resolveRoleConfigPath2
 } from "./chunk-1bf0wmgk.js";
@@ -35,21 +41,6 @@ import"./chunk-3nnahj0j.js";
 import"./chunk-0y5542k8.js";
 
 // src/cli/token-command.ts
-var TOKEN_HELP = `\u7528\u6CD5\uFF1A
-  rovloom token list [--config /absolute/path/gateway.json]
-  rovloom token create --principal ID --like EXISTING_ID [--ttl-days N]
-  rovloom token renew --principal ID [--ttl-days N]
-  rovloom token rotate --principal ID [--ttl-days N] [--grace-minutes M]
-  rovloom token revoke --principal ID
-  rovloom token permissions --principal ID --discard-response true|false
-
-\u4EE4\u724C\u6CE8\u518C\u8868\u4F4D\u4E8E Gateway \u72B6\u6001\u76EE\u5F55\uFF1BGateway \u6BCF\u6B21\u8BA4\u8BC1\u91CD\u8BFB\uFF0C\u4FEE\u6539\u7ACB\u5373\u751F\u6548\u3001\u65E0\u9700\u91CD\u542F\u3002
-create/rotate \u628A\u65B0\u4EE4\u724C\u539F\u503C\u53EA\u5199\u5230 stdout \u4E00\u6B21\uFF08\u6CE8\u518C\u8868\u53EA\u4FDD\u5B58 SHA-256 \u6458\u8981\uFF09\uFF1B\u5176\u4F59\u4FE1\u606F\u5199\u5230 stderr\u3002
-create \u7684\u65B0\u4E3B\u4F53\u6743\u9650\u514B\u9686\u81EA --like \u6307\u5B9A\u7684\u73B0\u6709\u4E3B\u4F53\uFF0C\u4E0D\u6269\u5927\u6743\u9650\u3002renew \u5EF6\u957F\u5230\u671F\u65F6\u95F4\u3001\u4EE4\u724C\u4E0D\u53D8\u3002
-rotate \u7B7E\u53D1\u65B0\u4EE4\u724C\uFF1B--grace-minutes \u5185\u65E7\u4EE4\u724C\u7EE7\u7EED\u6709\u6548\uFF08\u9ED8\u8BA4 0\uFF0C\u7ACB\u5373\u5931\u6548\uFF09\u3002revoke \u5220\u9664\u4E3B\u4F53\u3002
-permissions \u663E\u5F0F\u7BA1\u7406\u7ED3\u679C\u5220\u9664\u6743\u9650\uFF0C\u70ED\u751F\u6548\uFF1B\u9ED8\u8BA4\u5173\u95ED\u3002\u5220\u9664\u7ED3\u679C\u524D\u5E94\u5148\u8BFB\u53D6\u5E76\u4FDD\u5B58\u6240\u9700\u5185\u5BB9\u3002
-ttl \u9ED8\u8BA4 30 \u5929\uFF081-365\uFF09\u3002
-`;
 function parse(args) {
   const sub = args[1];
   if (!sub || !["list", "create", "renew", "rotate", "revoke", "permissions"].includes(sub)) {
@@ -129,7 +120,7 @@ function syncClientFile(stateDir, principal, token, issued, expires) {
 async function handleTokenCommand(args, io, environment, now = Date.now) {
   try {
     if (args.length === 2 && args[1] === "--help") {
-      io.stderr.write(TOKEN_HELP);
+      io.stderr.write(cliMessages2(io.language)["help.token"]);
       return 0;
     }
     const flags = parse(args);
@@ -154,31 +145,38 @@ async function handleTokenCommand(args, io, environment, now = Date.now) {
     if (flags.sub === "create") {
       const made = createCaller(registry, flags.principal, flags.like, at, flags.days);
       next = made.registry;
-      io.stderr.write("created " + flags.principal + " expires " + new Date(made.expires_at).toISOString() + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.created"], {
+        principal: flags.principal,
+        expires: new Date(made.expires_at).toISOString()
+      }));
       io.stdout.write(made.token + `
 `);
     } else if (flags.sub === "renew") {
       const renewed = renewCaller(registry, flags.principal, at, flags.days);
       next = renewed.registry;
-      io.stderr.write("renewed " + flags.principal + " expires " + new Date(renewed.expires_at).toISOString() + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.renewed"], {
+        principal: flags.principal,
+        expires: new Date(renewed.expires_at).toISOString()
+      }));
     } else if (flags.sub === "rotate") {
       const rotated = rotateCaller(registry, flags.principal, at, { days: flags.days, graceMinutes: flags.grace });
       next = rotated.registry;
-      io.stderr.write("rotated " + flags.principal + " expires " + new Date(rotated.expires_at).toISOString() + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.rotated"], {
+        principal: flags.principal,
+        expires: new Date(rotated.expires_at).toISOString()
+      }));
       issued = rotated.token;
       io.stdout.write(rotated.token + `
 `);
     } else if (flags.sub === "permissions") {
       next = setDiscardPermission(registry, flags.principal, flags.discard);
-      io.stderr.write("permissions " + flags.principal + " discard_response=" + String(flags.discard) + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.permissions"], {
+        principal: flags.principal,
+        discard: String(flags.discard)
+      }));
     } else {
       next = revokeCaller(registry, flags.principal);
-      io.stderr.write("revoked " + flags.principal + `
-`);
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["token.revoked"], { principal: flags.principal }));
     }
     writeSetupFile(path, boundedJson2(next, REGISTRY_MAX_BYTES), true, stamp);
     if (flags.sub === "renew" || flags.sub === "rotate") {
@@ -201,4 +199,4 @@ export {
   handleTokenCommand
 };
 
-//# debugId=FA979FCCD381000964756E2164756E21
+//# debugId=4D3B6508C39A168F64756E2164756E21