@rogatio/cli 1.1.0 → 1.2.0

package/dist/node/index.js

@@ -2,11 +2,11 @@
 
 // packages/cli/src/index.ts
 import { realpathSync } from "node:fs";
-import { dirname as dirname6, resolve as resolve6 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { dirname as dirname4, resolve as resolve6 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // packages/cli/src/commands/edit.ts
-import { dirname as dirname2, resolve } from "node:path";
+import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // packages/cli/src/server/http.ts
@@ -923,7 +923,6 @@ async function writeProject(path, data) {
 }
 
 // packages/cli/src/commands/edit.ts
-var __dirname = dirname2(fileURLToPath(import.meta.url));
 async function editCommand(args, options = {}) {
   const customLaunchBrowser = options.launchBrowser;
   const positionalArgs = [];
@@ -1183,50 +1182,47 @@ function generateEditorHtml(apiBase, csrfToken, filePath) {
 }
 
 // packages/cli/src/commands/runtime.ts
-import { dirname as dirname4, isAbsolute, join as join3, relative, resolve as resolve3, sep as sep2 } from "node:path";
+import { dirname as dirname3, isAbsolute, join as join3, relative, resolve as resolve3, sep as sep2 } from "node:path";
 import { compileProject as compileProject2 } from "@rogatio/compiler";
 
 // packages/runtime/dist/node/index.js
 import { HTTP_METHODS as HTTP_METHODS2 } from "@rogatio/schema";
+import { hasControl } from "@rogatio/schema";
 import { isIP as isIP2 } from "node:net";
-import { normalizeSiteOrigin } from "@rogatio/schema";
+import { hasControl as hasControl2, normalizeSiteOrigin } from "@rogatio/schema";
 import { normalizeSiteOrigin as normalizeSiteOrigin2 } from "@rogatio/schema";
 import {
   compileUrlRegex as compileUrlRegex2,
-  normalizeSiteOrigin as normalizeSiteOrigin3
-} from "@rogatio/schema";
-import { mkdir as mkdir2, readFile as readFile3, rename as rename2, rm, stat, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname3, isAbsolute as isAbsolute2, join as join2, relative as relative2 } from "node:path";
-import { generateKeyPairSync } from "node:crypto";
-import {
-  compileUrlRegex as compileUrlRegex22,
   HTTP_METHODS as HTTP_METHODS22,
+  hasControl as hasControl3,
   LIMITS,
-  normalizeSiteOrigin as normalizeSiteOrigin4,
+  normalizeSiteOrigin as normalizeSiteOrigin3,
   RESOURCE_TYPES as RESOURCE_TYPES2
 } from "@rogatio/schema";
 import { createHash as createHash2 } from "node:crypto";
+import { formatSha256 } from "@rogatio/schema";
 import { LIMITS as LIMITS2 } from "@rogatio/schema";
 import { LIMITS as LIMITS3 } from "@rogatio/schema";
+import {
+  compileUrlRegex as compileUrlRegex22,
+  normalizeSiteOrigin as normalizeSiteOrigin4
+} from "@rogatio/schema";
 import { createServer as createServer2 } from "node:http";
-import { isAbsolute as isAbsolute4 } from "node:path";
+import { isAbsolute as isAbsolute3 } from "node:path";
 import { createHash as createHash3, randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
+import { isSha256Digest } from "@rogatio/schema";
 import { randomBytes as randomBytes22 } from "node:crypto";
-import { readFile as readFile22, realpath as realpath2, stat as stat2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve2, sep } from "node:path";
+import { readFile as readFile3, realpath as realpath2, stat } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep } from "node:path";
+import { mkdir as mkdir2, readFile as readFile22, rename as rename2, rm, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
+import { basename as basename3, dirname as dirname2, isAbsolute as isAbsolute4, join as join2, relative as relative3 } from "node:path";
+import { generateKeyPairSync as generateKeyPairSync2 } from "node:crypto";
 function runtimeError(code) {
   return { code };
 }
 function failure(code) {
   return { ok: false, error: runtimeError(code) };
 }
-function hasControl(value) {
-  for (let index = 0; index < value.length; index += 1) {
-    const code = value.charCodeAt(index);
-    if (code <= 31 || code === 127) return true;
-  }
-  return false;
-}
 function normalizeLogicalPath(value) {
   if (typeof value !== "string" || value.length === 0) return null;
   if (value.includes("\\") || value.includes("%") || hasControl(value)) {
@@ -1311,13 +1307,6 @@ function hasOwn(value, key) {
   return Object.hasOwn(value, key);
 }
 var ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-function hasControl2(value) {
-  for (let index = 0; index < value.length; index += 1) {
-    const code = value.charCodeAt(index);
-    if (code <= 32 || code === 127) return true;
-  }
-  return false;
-}
 function hasValidPercentEncoding(value) {
   for (let index = 0; index < value.length; index += 1) {
     if (value[index] !== "%") continue;
@@ -1484,7 +1473,7 @@ var RUNTIME_LIMITS = Object.freeze({
   maxRegexDeadlineMs: 250,
   maxLocalOrigins: 32
 });
-var F14_ENVELOPE_MAX_BYTES = 64 * 1024;
+var ENVELOPE_MAX_BYTES = 64 * 1024;
 var registeredProvider = null;
 var currentSession = null;
 async function startInterception(activation, policyDigest, extensionId, pacOrigins, targetPolicy) {
@@ -1617,377 +1606,81 @@ function createNativeRuntimeController(options = {}) {
 function getCurrentSession2() {
   return null;
 }
-function createCertificate(_subjectName, _privateKey, _validityDays) {
-  const certPem = `-----BEGIN CERTIFICATE-----
-MIIDXTCCAkWgAwIBAgIJAKoK/heBjcOuMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
-BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
-aWRnaXRzIFB0eSBMdGQwHhcNMTkwNTEyMDAwMDAwWhcNMjAwNTEyMDAwMDAwWjBF
-MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
-ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEA
------END CERTIFICATE-----
-`;
-  const keyPem = `-----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQD
------END PRIVATE KEY-----
-`;
-  return { certPem, keyPem };
+var NATIVE_FRAME_MAX_BYTES = 64 * 1024;
+var NATIVE_POLICY_MAX_BYTES = 256 * 1024;
+function stringValue(value) {
+  const encoded = JSON.stringify(value);
+  if (encoded === void 0) throw new Error("invalid string");
+  return encoded;
 }
-function generateCaKeyPair(bits = 2048) {
-  return generateKeyPairSync("rsa", { modulusLength: bits });
+function arrayValue(values) {
+  return `[${values.map(stringValue).join(",")}]`;
 }
-function exportPrivateKey(key) {
-  return key.export({ type: "pkcs8", format: "pem" });
+function matcherValue(operation) {
+  const matcher = operation.matcher;
+  const method = matcher.method === void 0 ? "" : `,"method":${stringValue(matcher.method)}`;
+  return `{"kind":"matcher","groupId":${stringValue(operation.groupId)},"ruleId":${stringValue(operation.ruleId)},"matcher":{"urlRegex":{"source":${stringValue(matcher.urlRegex.source)},"flags":""},"origins":${arrayValue(matcher.origins)},"resourceTypes":${arrayValue(matcher.resourceTypes)},"priority":${String(matcher.priority)}${method}}}`;
 }
-function exportPublicKey(key) {
-  return key.export({ type: "spki", format: "pem" });
+function limitsValue(limits) {
+  const fields = [
+    ["maxPresetBytes", limits.maxPresetBytes],
+    ["maxRequestLineBytes", limits.maxRequestLineBytes],
+    ["maxHeaderCount", limits.maxHeaderCount],
+    ["maxRequestHeaderBytes", limits.maxRequestHeaderBytes],
+    ["maxControlBodyBytes", limits.maxControlBodyBytes],
+    ["maxResponseHeaderBytes", limits.maxResponseHeaderBytes],
+    ["maxResponseBodyBytes", limits.maxResponseBodyBytes],
+    ["maxFileBytes", limits.maxFileBytes],
+    ["maxConcurrentSessions", limits.maxConcurrentSessions],
+    ["maxConcurrentOperations", limits.maxConcurrentOperations],
+    ["maxOperationsPerSession", limits.maxOperationsPerSession],
+    ["maxDnsAddresses", limits.maxDnsAddresses],
+    ["bootstrapLifetimeMs", limits.bootstrapLifetimeMs],
+    ["sessionLifetimeMs", limits.sessionLifetimeMs],
+    ["connectTimeoutMs", limits.connectTimeoutMs],
+    ["responseHeaderTimeoutMs", limits.responseHeaderTimeoutMs],
+    ["bodyIdleTimeoutMs", limits.bodyIdleTimeoutMs],
+    ["operationTimeoutMs", limits.operationTimeoutMs],
+    ["maxRedirects", limits.maxRedirects]
+  ];
+  return `{${fields.map(([key, value]) => `${stringValue(key)}:${String(value)}`).join(",")}}`;
 }
-var F16_TRUST_LIMITS = {
-  manifestMaxBytes: 4096,
-  maxAllowedOrigins: 64,
-  caKeyBits: 2048,
-  caValidityDays: 3650
-};
-var TrustError = class extends Error {
-  code;
-  reasons;
-  constructor(code, message, reasons = []) {
-    super(message);
-    this.name = "TrustError";
-    this.code = code;
-    this.reasons = reasons;
-  }
-};
-var ORIGIN_RE = /^chrome-extension:\/\/[a-p]{32}\/?$/;
-var DEFAULT_CAPABILITIES = {
-  manifest: false,
-  caTrust: false,
-  reasons: ["no-capability-provider"]
-};
-function generateNativeMessagingManifest(hostPath, name, allowedOrigins, installRoot) {
-  if (typeof hostPath !== "string" || !isAbsolute2(hostPath)) {
-    throw new TrustError(
-      "trust.invalid-host-path",
-      "host path must be an absolute path"
-    );
-  }
-  const rel = relative2(installRoot, hostPath);
-  if (rel === "" || rel.startsWith("..") || isAbsolute2(rel)) {
-    throw new TrustError(
-      "trust.invalid-host-path",
-      "host path escapes the configured install root"
-    );
-  }
-  if (typeof name !== "string" || name.length === 0) {
-    throw new TrustError("trust.invalid-manifest", "host name is required");
-  }
-  if (!Array.isArray(allowedOrigins)) {
-    throw new TrustError(
-      "trust.invalid-manifest",
-      "allowed_origins must be an array"
-    );
-  }
-  if (allowedOrigins.length > F16_TRUST_LIMITS.maxAllowedOrigins) {
-    throw new TrustError(
-      "trust.invalid-manifest",
-      "allowed_origins exceeds the configured maximum"
-    );
-  }
-  const seen = /* @__PURE__ */ new Set();
-  for (const origin of allowedOrigins) {
-    if (typeof origin !== "string" || !ORIGIN_RE.test(origin)) {
-      throw new TrustError(
-        "trust.invalid-origin",
-        `invalid allowed origin: ${String(origin)}`
-      );
-    }
-    seen.add(origin.endsWith("/") ? origin : `${origin}/`);
-  }
-  return {
-    name,
-    description: "Rogatio request-body native runtime host",
-    path: hostPath,
-    type: "stdio",
-    allowed_origins: [...seen].sort()
-  };
+function grantValue(grant) {
+  return `{"groupId":${stringValue(grant.groupId)},"ruleId":${stringValue(grant.ruleId)},"operationId":${stringValue(grant.operationId)},"kind":${stringValue(grant.kind)},"target":${stringValue(grant.target)},"method":${stringValue(grant.method)}}`;
 }
-function detectTrustCapabilities(options = {}) {
-  void options;
-  return { ...DEFAULT_CAPABILITIES };
+function mockHeaderValue(header2) {
+  return `{"name":${stringValue(header2.name)},"value":${stringValue(header2.value)}}`;
 }
-function defaultTrustInstallRoot(platform) {
-  if (platform === "darwin") return "/Applications/Rogatio";
-  if (platform === "win32") {
-    return join2(process.env.LOCALAPPDATA ?? "", "Rogatio");
-  }
-  return join2(process.env.HOME ?? "", ".local", "share", "rogatio");
+function mockValue(mock) {
+  const headers = mock.headers === void 0 ? "" : `,"headers":[${mock.headers.map(mockHeaderValue).join(",")}]`;
+  const delay = mock.delayMs === void 0 ? "" : `,"delayMs":${String(mock.delayMs)}`;
+  const body = mock.body !== void 0 ? `,"body":${stringValue(mock.body)}` : "";
+  const file = mock.file !== void 0 ? `,"file":${stringValue(mock.file)}` : "";
+  return `{"ruleId":${stringValue(mock.ruleId)},"status":${String(mock.status)}${headers}${delay}${body}${file}}`;
 }
-function isWellFormedManifest(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const m = value;
-  return typeof m.name === "string" && typeof m.path === "string" && m.type === "stdio" && Array.isArray(m.allowed_origins) && m.allowed_origins.every((o) => typeof o === "string");
+function sortMocks(mocks) {
+  return [...mocks].sort(
+    (left, right) => compareStrings(left.ruleId, right.ruleId)
+  );
 }
-async function writeFileAtomic(path, data) {
-  const dir = dirname3(path);
-  await mkdir2(dir, { recursive: true });
-  const tmp = join2(dir, `.${basename3(path)}.${process.pid}.tmp`);
-  await writeFile2(tmp, data, "utf8");
-  await rename2(tmp, path);
+function compareStrings(left, right) {
+  if (left < right) return -1;
+  if (left > right) return 1;
+  return 0;
 }
-async function existsFile(path) {
-  try {
-    return (await stat(path)).isFile();
-  } catch {
-    return false;
-  }
+function sortGrants(grants) {
+  return [...grants].sort(
+    (left, right) => compareStrings(left.groupId, right.groupId) || compareStrings(left.ruleId, right.ruleId) || compareStrings(left.operationId, right.operationId) || compareStrings(left.kind, right.kind) || compareStrings(left.target, right.target) || compareStrings(left.method, right.method)
+  );
 }
-function codeOf(error, fallback) {
-  return error instanceof TrustError ? error.code : fallback;
+function canonicalPresetBytes(preset, grants = preset.grants) {
+  const matchers = preset.matchers.map(matcherValue).join(",");
+  const mocks = preset.mocks === void 0 || preset.mocks.length === 0 ? "" : `,"mocks":[${sortMocks(preset.mocks).map(mockValue).join(",")}]`;
+  const canonical = `{"version":1,"limits":${limitsValue(preset.limits)},"matchers":[${matchers}],"grants":[${sortGrants(grants).map(grantValue).join(",")}]${mocks}}`;
+  return new TextEncoder().encode(canonical);
 }
-function unsupportedResult(caps) {
-  return { ok: false, state: "unsupported", reasons: caps.reasons };
-}
-function createRequestBodyTrustController(options = {}) {
-  const platform = options.platform ?? process.platform;
-  const hostName = options.hostName ?? "com.rogatio.runtime";
-  const _allowedOrigins = options.allowedOrigins ?? [];
-  const installRoot = options.installRoot ?? defaultTrustInstallRoot(platform);
-  const hostPath = options.hostPath ?? join2(installRoot, "runtime-host");
-  const manifestDir = options.manifestDir ?? installRoot;
-  const caKeyFile = join2(
-    installRoot,
-    options.caKeyFileName ?? ".rogatio-ca.key"
-  );
-  const caPubFile = join2(
-    installRoot,
-    options.caPubFileName ?? ".rogatio-ca.pub"
-  );
-  const detect = options.detectCapabilities ?? detectTrustCapabilities;
-  const caTrustInstaller = options.caTrustInstaller;
-  const caTrustRemover = options.caTrustRemover;
-  const caCertFile = join2(
-    installRoot,
-    options.caCertFileName ?? ".rogatio-ca.crt"
-  );
-  const manifestPath = () => join2(manifestDir, `${hostName}.json`);
-  let installerCalled = false;
-  async function install(extensionId) {
-    if (!extensionId || !/^[a-p]{32}$/.test(extensionId)) {
-      return {
-        ok: false,
-        state: "unsupported",
-        reasons: ["invalid-extension-id"]
-      };
-    }
-    const allowedOrigins = [`chrome-extension://${extensionId}/`];
-    let manifest;
-    try {
-      manifest = generateNativeMessagingManifest(
-        hostPath,
-        hostName,
-        allowedOrigins,
-        installRoot
-      );
-    } catch (error) {
-      return {
-        ok: false,
-        state: "unsupported",
-        reasons: [codeOf(error, "trust.invalid-manifest")]
-      };
-    }
-    const data = JSON.stringify(manifest, null, 2);
-    if (data.length > F16_TRUST_LIMITS.manifestMaxBytes) {
-      return {
-        ok: false,
-        state: "unsupported",
-        reasons: ["manifest-too-large"]
-      };
-    }
-    const caps = await detect();
-    if (!caps.manifest) return unsupportedResult(caps);
-    try {
-      await writeFileAtomic(manifestPath(), data);
-    } catch (error) {
-      return {
-        ok: false,
-        state: "unsupported",
-        reasons: [codeOf(error, "trust.write-failed")]
-      };
-    }
-    return { ok: true, state: "installed" };
-  }
-  async function uninstall() {
-    try {
-      await rm(manifestPath(), { force: true });
-    } catch (error) {
-      return {
-        ok: false,
-        state: "unsupported",
-        reasons: [codeOf(error, "trust.write-failed")]
-      };
-    }
-    return { ok: true, state: "uninstalled" };
-  }
-  async function trust() {
-    const caps = await detect();
-    if (!caps.caTrust) return unsupportedResult(caps);
-    try {
-      if (!await existsFile(caKeyFile) || !await existsFile(caCertFile)) {
-        const { privateKey, publicKey } = generateCaKeyPair(
-          F16_TRUST_LIMITS.caKeyBits
-        );
-        const _privateKeyPem = exportPrivateKey(privateKey);
-        const _pubPem = exportPublicKey(publicKey);
-        const certResult = createCertificate(
-          "CN=Rogatio Request-Body CA",
-          privateKey,
-          F16_TRUST_LIMITS.caValidityDays
-        );
-        const certPem = certResult.certPem;
-        const certKeyPem = certResult.keyPem;
-        await writeFileAtomic(caKeyFile, certKeyPem);
-        await writeFileAtomic(caPubFile, certPem);
-        await writeFileAtomic(caCertFile, certPem);
-      }
-      if (caTrustInstaller && !installerCalled) {
-        await caTrustInstaller(await readFile3(caCertFile, "utf8"));
-        installerCalled = true;
-      }
-    } catch (error) {
-      return {
-        ok: false,
-        state: "unsupported",
-        reasons: [codeOf(error, "trust.internal")]
-      };
-    }
-    return { ok: true, state: "trusted" };
-  }
-  async function untrust() {
-    try {
-      if (await existsFile(caKeyFile) && caTrustRemover) {
-        await caTrustRemover();
-      }
-      await rm(caKeyFile, { force: true });
-      await rm(caPubFile, { force: true });
-      await rm(caCertFile, { force: true });
-      installerCalled = false;
-    } catch (error) {
-      return {
-        ok: false,
-        state: "unsupported",
-        reasons: [codeOf(error, "trust.internal")]
-      };
-    }
-    return { ok: true, state: "untrusted" };
-  }
-  async function status() {
-    let installed = false;
-    try {
-      const raw = await readFile3(manifestPath(), "utf8");
-      installed = isWellFormedManifest(JSON.parse(raw));
-    } catch {
-      installed = false;
-    }
-    const trusted = await existsFile(caKeyFile) && await existsFile(caCertFile);
-    const caps = await detect();
-    return {
-      installed,
-      trusted,
-      platform,
-      capabilityReasons: caps.reasons
-    };
-  }
-  return { install, uninstall, trust, untrust, status };
-}
-var NATIVE_FRAME_MAX_BYTES = 64 * 1024;
-var NATIVE_POLICY_MAX_BYTES = 256 * 1024;
-var PRIVATE_RANGES = [
-  { start: ipToInt("10.0.0.0"), end: ipToInt("10.255.255.255") },
-  { start: ipToInt("172.16.0.0"), end: ipToInt("172.31.255.255") },
-  { start: ipToInt("192.168.0.0"), end: ipToInt("192.168.255.255") },
-  { start: ipToInt("127.0.0.0"), end: ipToInt("127.255.255.255") },
-  { start: ipToInt("169.254.0.0"), end: ipToInt("169.254.255.255") },
-  { start: ipToInt("0.0.0.0"), end: ipToInt("0.255.255.255") },
-  { start: ipToInt("224.0.0.0"), end: ipToInt("239.255.255.255") },
-  { start: ipToInt("240.0.0.0"), end: ipToInt("255.255.255.255") }
-];
-function ipToInt(ip) {
-  const parts = ip.split(".").map(Number);
-  return parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];
-}
-function stringValue(value) {
-  const encoded = JSON.stringify(value);
-  if (encoded === void 0) throw new Error("invalid string");
-  return encoded;
-}
-function arrayValue(values) {
-  return `[${values.map(stringValue).join(",")}]`;
-}
-function matcherValue(operation) {
-  const matcher = operation.matcher;
-  const method = matcher.method === void 0 ? "" : `,"method":${stringValue(matcher.method)}`;
-  return `{"kind":"matcher","groupId":${stringValue(operation.groupId)},"ruleId":${stringValue(operation.ruleId)},"matcher":{"urlRegex":{"source":${stringValue(matcher.urlRegex.source)},"flags":""},"origins":${arrayValue(matcher.origins)},"resourceTypes":${arrayValue(matcher.resourceTypes)},"priority":${String(matcher.priority)}${method}}}`;
-}
-function limitsValue(limits) {
-  const fields = [
-    ["maxPresetBytes", limits.maxPresetBytes],
-    ["maxRequestLineBytes", limits.maxRequestLineBytes],
-    ["maxHeaderCount", limits.maxHeaderCount],
-    ["maxRequestHeaderBytes", limits.maxRequestHeaderBytes],
-    ["maxControlBodyBytes", limits.maxControlBodyBytes],
-    ["maxResponseHeaderBytes", limits.maxResponseHeaderBytes],
-    ["maxResponseBodyBytes", limits.maxResponseBodyBytes],
-    ["maxFileBytes", limits.maxFileBytes],
-    ["maxConcurrentSessions", limits.maxConcurrentSessions],
-    ["maxConcurrentOperations", limits.maxConcurrentOperations],
-    ["maxOperationsPerSession", limits.maxOperationsPerSession],
-    ["maxDnsAddresses", limits.maxDnsAddresses],
-    ["bootstrapLifetimeMs", limits.bootstrapLifetimeMs],
-    ["sessionLifetimeMs", limits.sessionLifetimeMs],
-    ["connectTimeoutMs", limits.connectTimeoutMs],
-    ["responseHeaderTimeoutMs", limits.responseHeaderTimeoutMs],
-    ["bodyIdleTimeoutMs", limits.bodyIdleTimeoutMs],
-    ["operationTimeoutMs", limits.operationTimeoutMs],
-    ["maxRedirects", limits.maxRedirects]
-  ];
-  return `{${fields.map(([key, value]) => `${stringValue(key)}:${String(value)}`).join(",")}}`;
-}
-function grantValue(grant) {
-  return `{"groupId":${stringValue(grant.groupId)},"ruleId":${stringValue(grant.ruleId)},"operationId":${stringValue(grant.operationId)},"kind":${stringValue(grant.kind)},"target":${stringValue(grant.target)},"method":${stringValue(grant.method)}}`;
-}
-function mockHeaderValue(header2) {
-  return `{"name":${stringValue(header2.name)},"value":${stringValue(header2.value)}}`;
-}
-function mockValue(mock) {
-  const headers = mock.headers === void 0 ? "" : `,"headers":[${mock.headers.map(mockHeaderValue).join(",")}]`;
-  const delay = mock.delayMs === void 0 ? "" : `,"delayMs":${String(mock.delayMs)}`;
-  const body = mock.body !== void 0 ? `,"body":${stringValue(mock.body)}` : "";
-  const file = mock.file !== void 0 ? `,"file":${stringValue(mock.file)}` : "";
-  return `{"ruleId":${stringValue(mock.ruleId)},"status":${String(mock.status)}${headers}${delay}${body}${file}}`;
-}
-function sortMocks(mocks) {
-  return [...mocks].sort(
-    (left, right) => compareStrings(left.ruleId, right.ruleId)
-  );
-}
-function compareStrings(left, right) {
-  if (left < right) return -1;
-  if (left > right) return 1;
-  return 0;
-}
-function sortGrants(grants) {
-  return [...grants].sort(
-    (left, right) => compareStrings(left.groupId, right.groupId) || compareStrings(left.ruleId, right.ruleId) || compareStrings(left.operationId, right.operationId) || compareStrings(left.kind, right.kind) || compareStrings(left.target, right.target) || compareStrings(left.method, right.method)
-  );
-}
-function canonicalPresetBytes(preset, grants = preset.grants) {
-  const matchers = preset.matchers.map(matcherValue).join(",");
-  const mocks = preset.mocks === void 0 || preset.mocks.length === 0 ? "" : `,"mocks":[${sortMocks(preset.mocks).map(mockValue).join(",")}]`;
-  const canonical = `{"version":1,"limits":${limitsValue(preset.limits)},"matchers":[${matchers}],"grants":[${sortGrants(grants).map(grantValue).join(",")}]${mocks}}`;
-  return new TextEncoder().encode(canonical);
-}
-function digestBytes(bytes) {
-  return `sha256:${createHash2("sha256").update(bytes).digest("hex")}`;
+function digestBytes(bytes) {
+  return formatSha256(createHash2("sha256").update(bytes).digest("hex"));
 }
 function canonicalDescriptor(value) {
   return `{"groupId":${stringValue(value.groupId)},"ruleId":${stringValue(value.ruleId)},"operationId":${stringValue(value.operationId)},"kind":${stringValue(value.kind)},"target":${stringValue(value.target)},"method":${stringValue(value.method)}}`;
@@ -2003,13 +1696,6 @@ function validId2(value) {
 function validMethod2(value) {
   return typeof value === "string" && HTTP_METHODS22.includes(value);
 }
-function hasControl3(value) {
-  for (let index = 0; index < value.length; index += 1) {
-    const code = value.charCodeAt(index);
-    if (code <= 31 || code === 127) return true;
-  }
-  return false;
-}
 function normalizeMockHeader(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     return null;
@@ -2128,14 +1814,14 @@ function normalizeMatcher(value) {
     return null;
   }
   const regex = regexValue;
-  if (typeof regex.source !== "string" || regex.source.length > LIMITS.maxUrlRegexLength || regex.flags !== "" || compileUrlRegex22(regex.source) === null) {
+  if (typeof regex.source !== "string" || regex.source.length > LIMITS.maxUrlRegexLength || regex.flags !== "" || compileUrlRegex2(regex.source) === null) {
     return null;
   }
   if (!Array.isArray(matcher.origins) || matcher.origins.length === 0 || matcher.origins.length > LIMITS.maxOriginsPerScope)
     return null;
   const origins = [];
   for (const value2 of matcher.origins) {
-    const normalized = normalizeSiteOrigin4(value2);
+    const normalized = normalizeSiteOrigin3(value2);
     if (normalized === null || origins.includes(normalized)) return null;
     origins.push(normalized);
   }
@@ -2286,6 +1972,20 @@ function normalizeRuntimePreset(value) {
   });
   return { ok: true, value: normalized };
 }
+var PRIVATE_RANGES = [
+  { start: ipToInt("10.0.0.0"), end: ipToInt("10.255.255.255") },
+  { start: ipToInt("172.16.0.0"), end: ipToInt("172.31.255.255") },
+  { start: ipToInt("192.168.0.0"), end: ipToInt("192.168.255.255") },
+  { start: ipToInt("127.0.0.0"), end: ipToInt("127.255.255.255") },
+  { start: ipToInt("169.254.0.0"), end: ipToInt("169.254.255.255") },
+  { start: ipToInt("0.0.0.0"), end: ipToInt("0.255.255.255") },
+  { start: ipToInt("224.0.0.0"), end: ipToInt("239.255.255.255") },
+  { start: ipToInt("240.0.0.0"), end: ipToInt("255.255.255.255") }
+];
+function ipToInt(ip) {
+  const parts = ip.split(".").map(Number);
+  return parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];
+}
 var TOKEN_BYTES = 32;
 var TOKEN_LENGTH = 43;
 function createCapabilityState(preset, now) {
@@ -2317,8 +2017,7 @@ function sameToken(value, expectedDigest) {
   return actual.length === expectedDigest.length && timingSafeEqual(actual, expectedDigest);
 }
 function sameDigest(value, expected) {
-  if (!/^sha256:[0-9a-f]{64}$/.test(value) || value.length !== expected.length)
-    return false;
+  if (!isSha256Digest(value) || value.length !== expected.length) return false;
   const actual = Buffer.from(value, "ascii");
   const wanted = Buffer.from(expected, "ascii");
   return timingSafeEqual(actual, wanted);
@@ -2386,8 +2085,8 @@ function closeCapabilityState(state) {
   state.bootstrapDigest.fill(0);
 }
 function withinRoot2(root, candidate) {
-  const rest = relative3(root, candidate);
-  return rest.length > 0 && rest !== ".." && !rest.startsWith(`..${sep}`) && !isAbsolute3(rest);
+  const rest = relative2(root, candidate);
+  return rest.length > 0 && rest !== ".." && !rest.startsWith(`..${sep}`) && !isAbsolute2(rest);
 }
 async function readMockFile(root, logicalPath) {
   const normalized = normalizeLogicalPath(logicalPath);
@@ -2398,11 +2097,11 @@ async function readMockFile(root, logicalPath) {
     const actualPath = await realpath2(candidate);
     if (!withinRoot2(canonicalRoot, actualPath))
       return failure("runtime.file-denied");
-    const metadata = await stat2(actualPath);
+    const metadata = await stat(actualPath);
     if (!metadata.isFile()) return failure("runtime.file-denied");
     if (metadata.size > RUNTIME_LIMITS.maxFileBytes)
       return failure("runtime.size-limit");
-    const bytes = await readFile22(actualPath);
+    const bytes = await readFile3(actualPath);
     if (bytes.byteLength > RUNTIME_LIMITS.maxFileBytes)
       return failure("runtime.size-limit");
     new TextDecoder("utf-8", { fatal: true }).decode(bytes);
@@ -2663,9 +2362,9 @@ function statusForError(code) {
 var PAIR_PATH = "/v1/pair";
 var AUTHORIZE_PATH = "/v1/authorize";
 var CONNECTION_PATH = "/v1/connection";
-var MOCK_PROTOCOL = "f13-v1";
+var MOCK_PROTOCOL = "v1";
 function isTrustedRoot(value) {
-  if (typeof value !== "string" || !isAbsolute4(value)) return false;
+  if (typeof value !== "string" || !isAbsolute3(value)) return false;
   for (let index = 0; index < value.length; index += 1) {
     if (value.charCodeAt(index) <= 31 || value.charCodeAt(index) === 127)
       return false;
@@ -2827,7 +2526,7 @@ async function createRuntimeServer(options) {
         }
         sendJson(response, 200, {
           ok: true,
-          protocol: "f6-v1",
+          protocol: "v1",
           sessionCapability: result.value.sessionCapability,
           expiresInMs: result.value.expiresInMs
         });
@@ -2936,6 +2635,277 @@ async function createRuntimeServer(options) {
     return failure("runtime.local-bind-denied");
   }
 }
+function createCertificate(_subjectName, _privateKey, _validityDays) {
+  const certPem = `-----BEGIN CERTIFICATE-----
+MIIDXTCCAkWgAwIBAgIJAKoK/heBjcOuMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
+BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQwHhcNMTkwNTEyMDAwMDAwWhcNMjAwNTEyMDAwMDAwWjBF
+MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
+ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA
+-----END CERTIFICATE-----
+`;
+  const keyPem = `-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQD
+-----END PRIVATE KEY-----
+`;
+  return { certPem, keyPem };
+}
+function generateCaKeyPair(bits = 2048) {
+  return generateKeyPairSync2("rsa", { modulusLength: bits });
+}
+var TRUST_LIMITS = {
+  manifestMaxBytes: 4096,
+  maxAllowedOrigins: 64,
+  caKeyBits: 2048,
+  caValidityDays: 3650
+};
+var TrustError = class extends Error {
+  code;
+  reasons;
+  constructor(code, message, reasons = []) {
+    super(message);
+    this.name = "TrustError";
+    this.code = code;
+    this.reasons = reasons;
+  }
+};
+var ORIGIN_RE = /^chrome-extension:\/\/[a-p]{32}\/?$/;
+var DEFAULT_CAPABILITIES = {
+  manifest: false,
+  caTrust: false,
+  reasons: ["no-capability-provider"]
+};
+function generateNativeMessagingManifest(hostPath, name, allowedOrigins, installRoot) {
+  if (typeof hostPath !== "string" || !isAbsolute4(hostPath)) {
+    throw new TrustError(
+      "trust.invalid-host-path",
+      "host path must be an absolute path"
+    );
+  }
+  const rel = relative3(installRoot, hostPath);
+  if (rel === "" || rel.startsWith("..") || isAbsolute4(rel)) {
+    throw new TrustError(
+      "trust.invalid-host-path",
+      "host path escapes the configured install root"
+    );
+  }
+  if (typeof name !== "string" || name.length === 0) {
+    throw new TrustError("trust.invalid-manifest", "host name is required");
+  }
+  if (!Array.isArray(allowedOrigins)) {
+    throw new TrustError(
+      "trust.invalid-manifest",
+      "allowed_origins must be an array"
+    );
+  }
+  if (allowedOrigins.length > TRUST_LIMITS.maxAllowedOrigins) {
+    throw new TrustError(
+      "trust.invalid-manifest",
+      "allowed_origins exceeds the configured maximum"
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const origin of allowedOrigins) {
+    if (typeof origin !== "string" || !ORIGIN_RE.test(origin)) {
+      throw new TrustError(
+        "trust.invalid-origin",
+        `invalid allowed origin: ${String(origin)}`
+      );
+    }
+    seen.add(origin.endsWith("/") ? origin : `${origin}/`);
+  }
+  return {
+    name,
+    description: "Rogatio request-body native runtime host",
+    path: hostPath,
+    type: "stdio",
+    allowed_origins: [...seen].sort()
+  };
+}
+function detectTrustCapabilities(options = {}) {
+  void options;
+  return { ...DEFAULT_CAPABILITIES };
+}
+function defaultTrustInstallRoot(platform) {
+  if (platform === "darwin") return "/Applications/Rogatio";
+  if (platform === "win32") {
+    return join2(process.env.LOCALAPPDATA ?? "", "Rogatio");
+  }
+  return join2(process.env.HOME ?? "", ".local", "share", "rogatio");
+}
+function isWellFormedManifest(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const m = value;
+  return typeof m.name === "string" && typeof m.path === "string" && m.type === "stdio" && Array.isArray(m.allowed_origins) && m.allowed_origins.every((o) => typeof o === "string");
+}
+async function writeFileAtomic(path, data) {
+  const dir = dirname2(path);
+  await mkdir2(dir, { recursive: true });
+  const tmp = join2(dir, `.${basename3(path)}.${process.pid}.tmp`);
+  await writeFile2(tmp, data, "utf8");
+  await rename2(tmp, path);
+}
+async function existsFile(path) {
+  try {
+    return (await stat2(path)).isFile();
+  } catch {
+    return false;
+  }
+}
+function codeOf(error, fallback) {
+  return error instanceof TrustError ? error.code : fallback;
+}
+function unsupportedResult(caps) {
+  return { ok: false, state: "unsupported", reasons: caps.reasons };
+}
+function createRequestBodyTrustController(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const hostName = options.hostName ?? "com.rogatio.runtime";
+  const installRoot = options.installRoot ?? defaultTrustInstallRoot(platform);
+  const hostPath = options.hostPath ?? join2(installRoot, "runtime-host");
+  const manifestDir = options.manifestDir ?? installRoot;
+  const caKeyFile = join2(
+    installRoot,
+    options.caKeyFileName ?? ".rogatio-ca.key"
+  );
+  const caPubFile = join2(
+    installRoot,
+    options.caPubFileName ?? ".rogatio-ca.pub"
+  );
+  const detect = options.detectCapabilities ?? detectTrustCapabilities;
+  const caTrustInstaller = options.caTrustInstaller;
+  const caTrustRemover = options.caTrustRemover;
+  const caCertFile = join2(
+    installRoot,
+    options.caCertFileName ?? ".rogatio-ca.crt"
+  );
+  const manifestPath = () => join2(manifestDir, `${hostName}.json`);
+  let installerCalled = false;
+  async function install(extensionId) {
+    if (!extensionId || !/^[a-p]{32}$/.test(extensionId)) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: ["invalid-extension-id"]
+      };
+    }
+    const allowedOrigins = [`chrome-extension://${extensionId}/`];
+    let manifest;
+    try {
+      manifest = generateNativeMessagingManifest(
+        hostPath,
+        hostName,
+        allowedOrigins,
+        installRoot
+      );
+    } catch (error) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: [codeOf(error, "trust.invalid-manifest")]
+      };
+    }
+    const data = JSON.stringify(manifest, null, 2);
+    if (data.length > TRUST_LIMITS.manifestMaxBytes) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: ["manifest-too-large"]
+      };
+    }
+    const caps = await detect();
+    if (!caps.manifest) return unsupportedResult(caps);
+    try {
+      await writeFileAtomic(manifestPath(), data);
+    } catch (error) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: [codeOf(error, "trust.write-failed")]
+      };
+    }
+    return { ok: true, state: "installed" };
+  }
+  async function uninstall() {
+    try {
+      await rm(manifestPath(), { force: true });
+    } catch (error) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: [codeOf(error, "trust.write-failed")]
+      };
+    }
+    return { ok: true, state: "uninstalled" };
+  }
+  async function trust() {
+    const caps = await detect();
+    if (!caps.caTrust) return unsupportedResult(caps);
+    try {
+      if (!await existsFile(caKeyFile) || !await existsFile(caCertFile)) {
+        const { privateKey } = generateCaKeyPair(TRUST_LIMITS.caKeyBits);
+        const certResult = createCertificate(
+          "CN=Rogatio Request-Body CA",
+          privateKey,
+          TRUST_LIMITS.caValidityDays
+        );
+        const certPem = certResult.certPem;
+        const certKeyPem = certResult.keyPem;
+        await writeFileAtomic(caKeyFile, certKeyPem);
+        await writeFileAtomic(caPubFile, certPem);
+        await writeFileAtomic(caCertFile, certPem);
+      }
+      if (caTrustInstaller && !installerCalled) {
+        await caTrustInstaller(await readFile22(caCertFile, "utf8"));
+        installerCalled = true;
+      }
+    } catch (error) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: [codeOf(error, "trust.internal")]
+      };
+    }
+    return { ok: true, state: "trusted" };
+  }
+  async function untrust() {
+    try {
+      if (await existsFile(caKeyFile) && caTrustRemover) {
+        await caTrustRemover();
+      }
+      await rm(caKeyFile, { force: true });
+      await rm(caPubFile, { force: true });
+      await rm(caCertFile, { force: true });
+      installerCalled = false;
+    } catch (error) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: [codeOf(error, "trust.internal")]
+      };
+    }
+    return { ok: true, state: "untrusted" };
+  }
+  async function status() {
+    let installed = false;
+    try {
+      const raw = await readFile22(manifestPath(), "utf8");
+      installed = isWellFormedManifest(JSON.parse(raw));
+    } catch {
+      installed = false;
+    }
+    const trusted = await existsFile(caKeyFile) && await existsFile(caCertFile);
+    const caps = await detect();
+    return {
+      installed,
+      trusted,
+      platform,
+      capabilityReasons: caps.reasons
+    };
+  }
+  return { install, uninstall, trust, untrust, status };
+}
 
 // packages/cli/src/commands/runtime.ts
 import { validateProjectDetailed as validateProjectDetailed2 } from "@rogatio/schema";
@@ -2947,7 +2917,7 @@ function showRuntimeHelp() {
        rogatio runtime [options] [path]
 
 Native messaging runtime control for response-body and request-body rules, or
-start the local mock runtime for F13 mock rules.
+start the local mock runtime for  mock rules.
 
 Native runtime commands:
   start     Start the runtime (capability-gated; explicit, no auto-start)
@@ -3224,7 +3194,7 @@ async function runtimeCommand(args, options = {}) {
     }
     return { exitCode: Promise.resolve(1), shutdown: noopShutdown };
   }
-  const rootDir = root ?? (inputPath === "-" ? process.cwd() : dirname4(filePath));
+  const rootDir = root ?? (inputPath === "-" ? process.cwd() : dirname3(filePath));
   const mocksResult = buildMockConfigs(compileResult.operations, rootDir);
   if (!mocksResult.ok) {
     console.error(`Error: ${mocksResult.message}`);
@@ -3614,11 +3584,9 @@ async function testCommand(args, stdinInput, captureOutput = false) {
 }
 
 // packages/cli/src/commands/verify.ts
-import { dirname as dirname5, resolve as resolve5 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { resolve as resolve5 } from "node:path";
 import { compileProject as compileProject4 } from "@rogatio/compiler";
 import { validateProjectDetailed as validateProjectDetailed4 } from "@rogatio/schema";
-var __dirname2 = dirname5(fileURLToPath2(import.meta.url));
 async function verifyCommandImpl(args, stdinInput, captureOutput) {
   let filePath;
   let jsonOutput2 = false;
@@ -3714,10 +3682,10 @@ async function verifyCommand(args, stdinInput, captureOutput = false) {
 }
 
 // packages/cli/src/index.ts
-var __dirname3 = dirname6(fileURLToPath3(import.meta.url));
-var isDist = __dirname3.includes("/dist/") || __dirname3.includes("\\dist\\");
+var __dirname = dirname4(fileURLToPath2(import.meta.url));
+var isDist = __dirname.includes("/dist/") || __dirname.includes("\\dist\\");
 var packageJsonPath = resolve6(
-  __dirname3,
+  __dirname,
   isDist ? "../../package.json" : "../package.json"
 );
 var packageJson = JSON.parse(
@@ -3811,7 +3779,7 @@ Commands:
   test [path] [url...]  Run offline dry-run tests against .rogatio.json
   verify [path]   Validate .rogatio.json file
   runtime <start|stop|status|install|trust|untrust|uninstall>  Native messaging runtime and request-body trust control
-  runtime [path]  Start the mock runtime server (F13)
+  runtime [path]  Start the mock runtime server ()
 
 Global Options:
   --help, -h      Show help
@@ -3858,7 +3826,7 @@ function showRuntimeHelp2() {
        rogatio runtime [options] [path]
 
 Native messaging runtime control for response-body and request-body rules, or
-start the local mock runtime for F13 mock rules.
+start the local mock runtime for  mock rules.
 
 Native runtime commands:
   start     Start the runtime (capability-gated; explicit, no auto-start)
@@ -3917,7 +3885,7 @@ Exit codes:
   1  Validation/compile/test errors
   2  Usage error (invalid arguments, missing input)`);
 }
-if (process.argv[1] !== void 0 && realpathSync.native(fileURLToPath3(import.meta.url)) === realpathSync.native(resolve6(process.argv[1]))) {
+if (process.argv[1] !== void 0 && realpathSync.native(fileURLToPath2(import.meta.url)) === realpathSync.native(resolve6(process.argv[1]))) {
   cli().catch((err) => {
     console.error(err);
     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",