@rogatio/cli 3.0.0 → 4.0.0

package/README.md

@@ -39,7 +39,7 @@ rogatio <command> [options]
 | `rogatio edit [path]` | Launch the browser editor for `.rogatio.json`. |
 | `rogatio verify [path]` | Validate a `.rogatio.json` file (schema + compiler). |
 | `rogatio test [path] [url...]` | Run offline dry-run tests against `.rogatio.json`. |
-| `rogatio runtime <install\|trust\|untrust\|uninstall>` | Manage the native-messaging host manifest and request-body trust lifecycle. |
+| `rogatio runtime <install\|untrust\|uninstall>` | Register the native-messaging host (and, on capable platforms, the device-local CA) in one transactional install; `untrust` removes CA trust; `uninstall` removes the host. |
 | `rogatio runtime host <path>` | Run the consolidated native-messaging host for the project (mock/pair/authorize over stdio). Normally launched by the browser; run manually only for debugging. |
 
 Global options: `--help, -h` and `--version, -v`. Run `rogatio <command> --help`

package/dist/node/index.js

@@ -4309,8 +4309,58 @@ function createRequestBodyTrustController(options = {}) {
         reasons: [codeOf(error, "trust.write-failed")]
       };
     }
+    const caTrustCaps = await detect();
+    if (!caTrustCaps.caTrust) {
+      try {
+        await rm(manifestPath(), { force: true });
+      } catch {
+      }
+      return unsupportedResult(caTrustCaps);
+    }
+    const trustResult = await trust();
+    if (!trustResult.ok) {
+      try {
+        await rm(caKeyFile, { force: true });
+        await rm(caPubFile, { force: true });
+        await rm(caCertFile, { force: true });
+      } catch {
+      }
+      try {
+        await rm(manifestPath(), { force: true });
+      } catch {
+      }
+      installerCalled = false;
+      return trustResult;
+    }
     return { ok: true, state: "installed" };
   }
+  async function runCaTrust() {
+    const caps = await detect();
+    if (!caps.caTrust) {
+      throw new TrustError(
+        "trust.unsupported",
+        "caTrust capability absent",
+        caps.reasons
+      );
+    }
+    if (!await existsFile(caKeyFile) || !await existsFile(caCertFile)) {
+      const { privateKey } = generateCaKeyPair(TRUST_LIMITS.caKeyBits);
+      const certResult = createCertificate(
+        "CN=Rogatio Request-Body CA",
+        privateKey,
+        TRUST_LIMITS.caValidityDays
+      );
+      const certPem = certResult.certPem;
+      const certKeyPem = certResult.keyPem;
+      await writeFileAtomic(caKeyFile, certKeyPem);
+      await writeFileAtomic(caPubFile, certPem);
+      await writeFileAtomic(caCertFile, certPem);
+    }
+    if (caTrustInstaller && !installerCalled) {
+      await caTrustInstaller(await readFile22(caCertFile, "utf8"));
+      installerCalled = true;
+    }
+  }
   async function uninstall() {
     try {
       await rm(manifestPath(), { force: true });
@@ -4324,26 +4374,8 @@ function createRequestBodyTrustController(options = {}) {
     return { ok: true, state: "uninstalled" };
   }
   async function trust() {
-    const caps = await detect();
-    if (!caps.caTrust) return unsupportedResult(caps);
     try {
-      if (!await existsFile(caKeyFile) || !await existsFile(caCertFile)) {
-        const { privateKey } = generateCaKeyPair(TRUST_LIMITS.caKeyBits);
-        const certResult = createCertificate(
-          "CN=Rogatio Request-Body CA",
-          privateKey,
-          TRUST_LIMITS.caValidityDays
-        );
-        const certPem = certResult.certPem;
-        const certKeyPem = certResult.keyPem;
-        await writeFileAtomic(caKeyFile, certKeyPem);
-        await writeFileAtomic(caPubFile, certPem);
-        await writeFileAtomic(caCertFile, certPem);
-      }
-      if (caTrustInstaller && !installerCalled) {
-        await caTrustInstaller(await readFile22(caCertFile, "utf8"));
-        installerCalled = true;
-      }
+      await runCaTrust();
     } catch (error) {
       return {
         ok: false,
@@ -4388,7 +4420,7 @@ function createRequestBodyTrustController(options = {}) {
       capabilityReasons: caps.reasons
     };
   }
-  return { install, uninstall, trust, untrust, status };
+  return { install, uninstall, untrust, status };
 }
 
 // packages/cli/src/commands/runtime.ts
@@ -4401,8 +4433,8 @@ runtime no longer serves an HTTP mock server; mock delivery happens in the
 consolidated native-messaging host (spec REQ-001..REQ-005).
 
 Request-body trust commands:
-  install   Install the native-messaging host manifest (requires --extension-id)
-  trust     Provision and trust the device-local CA
+  install   Install the native-messaging host manifest and (on capable
+            platforms) provision the device-local CA (requires --extension-id)
   untrust   Remove the device-local CA trust (idempotent)
   uninstall Uninstall the native-messaging host manifest (idempotent)
 
@@ -4421,8 +4453,8 @@ Options:
   --root <dir>      Root for confined file mocks (default: project directory)
   --help, -h        Show this help
 
-The device-local CA / PAC routing capability only affects request-body
-interception, not the host control plane.`);
+The device-local CA / PAC routing capability is invoked from the unified
+install command on capable platforms; it does not have a separate verb.`);
 }
 function toMatcherOperations2(operations) {
   return operations.map(({ groupId, ruleId, matcher }) => ({
@@ -4518,13 +4550,7 @@ async function trustRuntimeCommand(args) {
       return reportTrust(
         "install",
         await controller.install(extensionId ?? ""),
-        "trust installed"
-      );
-    case "trust":
-      return reportTrust(
-        "trust",
-        await controller.trust(),
-        "trust established"
+        "runtime install complete: manifest + device-local CA trusted"
       );
     case "untrust":
       return reportTrust(
@@ -4647,7 +4673,7 @@ async function runtimeCommand(args, _options = {}) {
     return trustRuntimeCommand(args);
   if (first === "host") return runtimeHostCommand(args.slice(1));
   console.error(
-    `Error: 'rogatio runtime' no longer starts or stops the runtime. Use 'rogatio runtime install|trust|untrust|uninstall' to manage the host manifest and request-body trust, or 'rogatio runtime host [path]' to run the native-messaging host. Start/stop is driven from the extension's controls.`
+    `Error: 'rogatio runtime' no longer starts or stops the runtime. Use 'rogatio runtime install|untrust|uninstall' to manage the host manifest and request-body trust, or 'rogatio runtime host [path]' to run the native-messaging host. Start/stop is driven from the extension's controls.`
   );
   showRuntimeHelp();
   return 2;
@@ -5173,7 +5199,7 @@ Commands:
   edit [path]     Launch browser editor for .rogatio.json
   test [path] [url...]  Run offline dry-run tests against .rogatio.json
   verify [path]   Validate .rogatio.json file
-  runtime <install|trust|untrust|uninstall|host>  Native messaging runtime control and request-body trust management
+  runtime <install|untrust|uninstall|host>  Native messaging runtime control and request-body trust management
   runtime host [path]  Run the consolidated native-messaging runtime host
 
 Global Options:
@@ -5225,8 +5251,8 @@ runtime no longer serves an HTTP mock server; mock delivery happens in the
 consolidated native-messaging host (spec REQ-001..REQ-005).
 
 Request-body trust commands:
-  install   Install the native-messaging host manifest (requires --extension-id)
-  trust     Provision and trust the device-local CA
+  install   Install the native-messaging host manifest and (on capable
+            platforms) provision the device-local CA (requires --extension-id)
   untrust   Remove the device-local CA trust (idempotent)
   uninstall Uninstall the native-messaging host manifest (idempotent)
 
@@ -5245,8 +5271,8 @@ Options:
   --extension-id  Extension ID for native messaging manifest (required for install)
   --help, -h      Show this help
 
-The device-local CA / PAC routing capability only affects request-body
-interception, not the host control plane.
+The device-local CA / PAC routing capability is invoked from the unified
+install command on capable platforms; it does not have a separate verb.
 
 Exit codes:
   0  Stopped cleanly / success

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",