@rogatio/cli 6.15.0 → 6.16.1

package/dist/node/index.js

@@ -602,6 +602,25 @@ function migrateOwned(input) {
   }
   return { ok: true, project, notices };
 }
+function normalizeLogicalPath(value) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  if (value.includes("\\") || value.includes("%") || hasControl(value)) {
+    return null;
+  }
+  if (value.startsWith("/") || value.endsWith("/") || value.includes("//")) {
+    return null;
+  }
+  const parts = value.split("/");
+  if (parts.some(
+    (part) => part.length === 0 || part === "." || part === ".." || part.includes(":") || /[*?[\]]/.test(part)
+  )) {
+    return null;
+  }
+  return parts.join("/");
+}
+function isValidMockLogicalPath(value) {
+  return normalizeLogicalPath(value) !== null;
+}
 function compileUrlRegex(value) {
   if (typeof value !== "string" || value.length === 0 || value.length > LIMITS.maxUrlRegexLength)
     return null;
@@ -1062,6 +1081,109 @@ function hasLoneSurrogate(value) {
   }
   return false;
 }
+function countCapturingGroups2(urlRegex) {
+  let count = 0;
+  let index = 0;
+  const length = urlRegex.length;
+  while (index < length) {
+    const char = urlRegex[index];
+    if (char === "\\") {
+      index += 2;
+      continue;
+    }
+    if (char === "(") {
+      if (urlRegex[index + 1] === "?") {
+        index = skipBalancedGroup2(urlRegex, index);
+        continue;
+      }
+      count += 1;
+    }
+    index += 1;
+  }
+  return count;
+}
+function skipBalancedGroup2(source, start) {
+  let depth = 0;
+  let index = start;
+  const length = source.length;
+  while (index < length) {
+    const char = source[index];
+    if (char === "\\") {
+      index += 2;
+      continue;
+    }
+    if (char === "(") {
+      depth += 1;
+    } else if (char === ")") {
+      depth -= 1;
+      if (depth === 0) return index;
+    }
+    index += 1;
+  }
+  return length;
+}
+function validateRedirectDestination(destination, urlRegex) {
+  const issues = [];
+  if (typeof destination !== "string" || destination.length === 0) {
+    issues.push({
+      code: "schema.required",
+      message: "Redirect destination must be a non-empty string."
+    });
+    return issues;
+  }
+  if (destination.length > LIMITS.maxRedirectDestinationLength) {
+    issues.push({
+      code: "schema.out-of-range",
+      message: `Redirect destination must be at most ${LIMITS.maxRedirectDestinationLength} characters.`
+    });
+    return issues;
+  }
+  let url;
+  try {
+    url = new URL(destination);
+  } catch {
+    issues.push({
+      code: "schema.invalid-format",
+      message: "Redirect destination must be an absolute URL."
+    });
+    return issues;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    issues.push({
+      code: "schema.invalid-value",
+      message: "Redirect destination must use the http or https scheme."
+    });
+    return issues;
+  }
+  if (url.username.length > 0 || url.password.length > 0) {
+    issues.push({
+      code: "schema.invalid-value",
+      message: "Redirect destination must not contain credentials."
+    });
+    return issues;
+  }
+  if (url.hostname.length === 0 || url.hostname.includes("*")) {
+    issues.push({
+      code: "schema.invalid-format",
+      message: "Redirect destination must have a valid host."
+    });
+    return issues;
+  }
+  const groups = countCapturingGroups2(urlRegex);
+  const backreference = /\\([1-9])/g;
+  let match = backreference.exec(destination);
+  while (match !== null) {
+    const referenced = Number(match[1]);
+    if (referenced > groups) {
+      issues.push({
+        code: "schema.invalid-value",
+        message: `Redirect destination references capture group ${referenced} but the URL pattern defines ${groups}.`
+      });
+    }
+    match = backreference.exec(destination);
+  }
+  return issues;
+}
 var ajv = new Ajv2020({
   allErrors: true,
   coerceTypes: false,
@@ -1686,22 +1808,6 @@ function semanticIssues(project) {
   }
   return issues;
 }
-function isValidMockLogicalPath(value) {
-  if (value.length === 0) return false;
-  if (value.includes("\\") || value.includes("%") || hasControl(value)) {
-    return false;
-  }
-  if (value.startsWith("/") || value.endsWith("/") || value.includes("//")) {
-    return false;
-  }
-  const parts = value.split("/");
-  if (parts.some(
-    (part) => part.length === 0 || part === "." || part === ".." || part.includes(":") || /[*?[\]]/.test(part)
-  )) {
-    return false;
-  }
-  return true;
-}
 function captureValidationIssues(value, urlRegex, instancePath) {
   return validateCaptureTemplate(value, urlRegex).map((issue) => ({
     instancePath,
@@ -1714,109 +1820,6 @@ function captureValidationIssues(value, urlRegex, instancePath) {
     }
   }));
 }
-function skipBalancedGroup2(source, start) {
-  let depth = 0;
-  let index = start;
-  const length = source.length;
-  while (index < length) {
-    const char = source[index];
-    if (char === "\\") {
-      index += 2;
-      continue;
-    }
-    if (char === "(") {
-      depth += 1;
-    } else if (char === ")") {
-      depth -= 1;
-      if (depth === 0) return index;
-    }
-    index += 1;
-  }
-  return length;
-}
-function countCapturingGroups2(urlRegex) {
-  let count = 0;
-  let index = 0;
-  const length = urlRegex.length;
-  while (index < length) {
-    const char = urlRegex[index];
-    if (char === "\\") {
-      index += 2;
-      continue;
-    }
-    if (char === "(") {
-      if (urlRegex[index + 1] === "?") {
-        index = skipBalancedGroup2(urlRegex, index);
-        continue;
-      }
-      count += 1;
-    }
-    index += 1;
-  }
-  return count;
-}
-function validateRedirectDestination(destination, urlRegex) {
-  const issues = [];
-  if (typeof destination !== "string" || destination.length === 0) {
-    issues.push({
-      code: "schema.required",
-      message: "Redirect destination must be a non-empty string."
-    });
-    return issues;
-  }
-  if (destination.length > LIMITS.maxRedirectDestinationLength) {
-    issues.push({
-      code: "schema.out-of-range",
-      message: `Redirect destination must be at most ${LIMITS.maxRedirectDestinationLength} characters.`
-    });
-    return issues;
-  }
-  let url;
-  try {
-    url = new URL(destination);
-  } catch {
-    issues.push({
-      code: "schema.invalid-format",
-      message: "Redirect destination must be an absolute URL."
-    });
-    return issues;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    issues.push({
-      code: "schema.invalid-value",
-      message: "Redirect destination must use the http or https scheme."
-    });
-    return issues;
-  }
-  if (url.username.length > 0 || url.password.length > 0) {
-    issues.push({
-      code: "schema.invalid-value",
-      message: "Redirect destination must not contain credentials."
-    });
-    return issues;
-  }
-  if (url.hostname.length === 0 || url.hostname.includes("*")) {
-    issues.push({
-      code: "schema.invalid-format",
-      message: "Redirect destination must have a valid host."
-    });
-    return issues;
-  }
-  const groups = countCapturingGroups2(urlRegex);
-  const backreference = /\\([1-9])/g;
-  let match = backreference.exec(destination);
-  while (match !== null) {
-    const referenced = Number(match[1]);
-    if (referenced > groups) {
-      issues.push({
-        code: "schema.invalid-value",
-        message: `Redirect destination references capture group ${referenced} but the URL pattern defines ${groups}.`
-      });
-    }
-    match = backreference.exec(destination);
-  }
-  return issues;
-}
 function validateProjectDetailed(value) {
   const snapshot2 = snapshotOwnData(value);
   if (!snapshot2.valid) {
@@ -2263,11 +2266,23 @@ import { close, fstat, read } from "node:fs";
 import { createRequire } from "node:module";
 import { createServer, request as httpRequest } from "node:http";
 import { join as join5 } from "node:path";
-import { mkdir as mkdir2, readFile as readFile2, rename, rm, stat, writeFile as writeFile2 } from "node:fs/promises";
+import { createPrivateKey, sign, verify, X509Certificate as X509Certificate3 } from "node:crypto";
+import { constants as fsConstants } from "node:fs";
+import {
+  lstat,
+  mkdir as mkdir2,
+  open as open2,
+  readFile as readFile2,
+  rename,
+  rm,
+  stat
+} from "node:fs/promises";
 import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative2 } from "node:path";
+import { X509Certificate } from "node:crypto";
 import { generateKeyPairSync, webcrypto } from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
 import { accessSync, constants as constants2, unlinkSync, writeFileSync } from "node:fs";
+import { mkdtemp, open as open3, rm as rm2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname as dirname3, join as join3 } from "node:path";
 import { join as posixJoin } from "node:path/posix";
@@ -2281,7 +2296,7 @@ import { tmpdir as tmpdir2 } from "node:os";
 import { join as join4 } from "node:path";
 import { join as posixJoin3 } from "node:path/posix";
 import { constants as constants5 } from "node:fs";
-import { open as open2, realpath as realpath2 } from "node:fs/promises";
+import { open as open4, realpath as realpath2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute3 } from "node:path";
 import { Buffer as Buffer2 } from "node:buffer";
 import { existsSync as existsSync2 } from "node:fs";
@@ -20057,7 +20072,7 @@ var require_x509_cjs = __commonJS({
     var _X509Certificate_signature;
     var _X509Certificate_extensions;
     var _X509Certificate_publicKey;
-    var X509Certificate3 = class extends PemData {
+    var X509Certificate5 = class extends PemData {
       get publicKey() {
         if (!tslib.__classPrivateFieldGet(this, _X509Certificate_publicKey, "f")) {
           tslib.__classPrivateFieldSet(this, _X509Certificate_publicKey, new PublicKey(this.asn.tbsCertificate.subjectPublicKeyInfo, this.parseOptions), "f");
@@ -20300,7 +20315,7 @@ var require_x509_cjs = __commonJS({
       }
     };
     _X509Certificate_tbs = /* @__PURE__ */ new WeakMap(), _X509Certificate_serialNumber = /* @__PURE__ */ new WeakMap(), _X509Certificate_subjectName = /* @__PURE__ */ new WeakMap(), _X509Certificate_subject = /* @__PURE__ */ new WeakMap(), _X509Certificate_issuerName = /* @__PURE__ */ new WeakMap(), _X509Certificate_issuer = /* @__PURE__ */ new WeakMap(), _X509Certificate_notBefore = /* @__PURE__ */ new WeakMap(), _X509Certificate_notAfter = /* @__PURE__ */ new WeakMap(), _X509Certificate_signatureAlgorithm = /* @__PURE__ */ new WeakMap(), _X509Certificate_signature = /* @__PURE__ */ new WeakMap(), _X509Certificate_extensions = /* @__PURE__ */ new WeakMap(), _X509Certificate_publicKey = /* @__PURE__ */ new WeakMap();
-    X509Certificate3.NAME = "Certificate";
+    X509Certificate5.NAME = "Certificate";
     var _X509Certificates_options;
     var X509Certificates = class extends Array {
       constructor(param, options) {
@@ -20308,7 +20323,7 @@ var require_x509_cjs = __commonJS({
         _X509Certificates_options.set(this, void 0);
         if (PemData.isAsnEncoded(param)) {
           this.import(param, options);
-        } else if (param instanceof X509Certificate3) {
+        } else if (param instanceof X509Certificate5) {
           this.push(param);
         } else if (Array.isArray(param)) {
           for (const item of param) {
@@ -20346,7 +20361,7 @@ var require_x509_cjs = __commonJS({
         const certificates = [];
         for (const item of signedData.certificates || []) {
           if (item.certificate) {
-            certificates.push(new X509Certificate3(item.certificate, options));
+            certificates.push(new X509Certificate5(item.certificate, options));
           }
         }
         this.clear();
@@ -20538,7 +20553,7 @@ var require_x509_cjs = __commonJS({
           throw Error("Cannot convert ASN.1 signature value to WebCrypto format");
         }
         asnX509.signatureValue = asnSignature;
-        return new X509Certificate3(asn1Schema.AsnConvert.serialize(asnX509));
+        return new X509Certificate5(asn1Schema.AsnConvert.serialize(asnX509));
       }
     };
     var _X509CrlEntry_serialNumber;
@@ -20759,7 +20774,7 @@ var require_x509_cjs = __commonJS({
         let publicKey;
         const paramsKey = params.publicKey;
         try {
-          if (paramsKey instanceof X509Certificate3) {
+          if (paramsKey instanceof X509Certificate5) {
             keyAlgorithm = {
               ...paramsKey.publicKey.algorithm,
               ...paramsKey.signatureAlgorithm
@@ -20963,7 +20978,7 @@ var require_x509_cjs = __commonJS({
     exports.TextObject = TextObject;
     exports.UPN = UPN;
     exports.URL = URL2;
-    exports.X509Certificate = X509Certificate3;
+    exports.X509Certificate = X509Certificate5;
     exports.X509CertificateGenerator = X509CertificateGenerator2;
     exports.X509Certificates = X509Certificates;
     exports.X509ChainBuilder = X509ChainBuilder;
@@ -21892,27 +21907,11 @@ function runtimeError(code) {
 function failure(code) {
   return { ok: false, error: runtimeError(code) };
 }
-function normalizeLogicalPath(value) {
-  if (typeof value !== "string" || value.length === 0) return null;
-  if (value.includes("\\") || value.includes("%") || hasControl(value)) {
-    return null;
-  }
-  if (value.startsWith("/") || value.endsWith("/") || value.includes("//")) {
-    return null;
-  }
-  const parts = value.split("/");
-  if (parts.some(
-    (part) => part.length === 0 || part === "." || part === ".." || part.includes(":") || /[*?[\]]/.test(part)
-  )) {
-    return null;
-  }
-  return parts.join("/");
-}
-var MAX_ARRAY_LENGTH = 4096;
-var MAX_OBJECT_PROPERTIES = 256;
-function snapshotOwnData3(value, ancestors = /* @__PURE__ */ new WeakSet()) {
-  if (value === null || typeof value !== "object") {
-    return { valid: true, value };
+var MAX_ARRAY_LENGTH = 4096;
+var MAX_OBJECT_PROPERTIES = 256;
+function snapshotOwnData3(value, ancestors = /* @__PURE__ */ new WeakSet()) {
+  if (value === null || typeof value !== "object") {
+    return { valid: true, value };
   }
   if (ancestors.has(value)) return { valid: false };
   ancestors.add(value);
@@ -22443,6 +22442,42 @@ function describeExtensionIdMismatch(expectedExtensionId, allowedOrigins) {
     `Run: ${command}`
   ].join("\n");
 }
+var MAX_CERTIFICATE_PEM_LENGTH = 16 * 1024;
+var BEGIN_CERTIFICATE = "-----BEGIN CERTIFICATE-----";
+var END_CERTIFICATE = "-----END CERTIFICATE-----";
+var BODY_LINE = /^[A-Za-z0-9+/]{1,64}={0,2}$/;
+function isInstallableCaCertificate(pem) {
+  if (typeof pem !== "string" || pem.length === 0 || pem.length > MAX_CERTIFICATE_PEM_LENGTH || pem.includes("\0")) {
+    return false;
+  }
+  const normalized = pem.replaceAll("\r\n", "\n").replaceAll("\r", "\n");
+  const lines = normalized.split("\n");
+  if (lines[lines.length - 1] === "") lines.pop();
+  if (lines.some((line) => line.trim() === "EOF")) return false;
+  if (lines.length < 3 || lines[0] !== BEGIN_CERTIFICATE || lines[lines.length - 1] !== END_CERTIFICATE) {
+    return false;
+  }
+  if (lines.filter((line) => line === BEGIN_CERTIFICATE).length !== 1) {
+    return false;
+  }
+  if (lines.filter((line) => line === END_CERTIFICATE).length !== 1) {
+    return false;
+  }
+  const body = lines.slice(1, -1);
+  for (let index = 0; index < body.length; index += 1) {
+    const line = body[index] ?? "";
+    if (!BODY_LINE.test(line)) return false;
+    if (line.includes("=") && index !== body.length - 1) return false;
+  }
+  if (body.join("").length % 4 !== 0) return false;
+  try {
+    const certificate = new X509Certificate(`${lines.join("\n")}
+`);
+    return certificate.ca;
+  } catch {
+    return false;
+  }
+}
 var import_reflect_metadata = __toESM(require_Reflect(), 1);
 var import_x509 = __toESM(require_x509_cjs(), 1);
 var crypto2 = webcrypto.subtle;
@@ -22565,12 +22600,100 @@ function isWellFormedManifest(value) {
   const m = value;
   return typeof m.name === "string" && typeof m.path === "string" && m.type === "stdio" && Array.isArray(m.allowed_origins) && m.allowed_origins.every((o) => typeof o === "string");
 }
-async function writeFileAtomic(path2, data) {
+function noFollowFlag() {
+  const flag = fsConstants.O_NOFOLLOW;
+  return typeof flag === "number" ? flag : 0;
+}
+async function writeFileAtomic(path2, data, mode) {
   const dir = dirname2(path2);
   await mkdir2(dir, { recursive: true });
   const tmp = join2(dir, `.${basename(path2)}.${process.pid}.tmp`);
-  await writeFile2(tmp, data, "utf8");
-  await rename(tmp, path2);
+  const flags = fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag();
+  let created = false;
+  let handle;
+  try {
+    handle = await open2(tmp, flags, 384);
+    created = true;
+    await handle.writeFile(data, "utf8");
+    await handle.chmod(mode ?? 420);
+    await handle.close();
+    handle = void 0;
+    await rename(tmp, path2);
+  } catch (error) {
+    await handle?.close().catch(() => void 0);
+    if (created) {
+      try {
+        await rm(tmp, { force: true });
+      } catch {
+      }
+    }
+    throw error;
+  }
+}
+var CA_POSSESSION_PAYLOAD = Buffer.from("rogatio-ca-possession");
+var ROGATIO_REQUEST_BODY_CA_SUBJECT = "CN=CN=Rogatio Request-Body CA";
+function caCertificateMatchesPrivateKey(certPem, keyPem) {
+  try {
+    if (!isInstallableCaCertificate(certPem)) return false;
+    const certificate = new X509Certificate3(certPem);
+    if (!certificate.ca) return false;
+    const privateKey = createPrivateKey(keyPem);
+    if (privateKey.type !== "private") return false;
+    const signature = sign("sha256", CA_POSSESSION_PAYLOAD, privateKey);
+    return verify(
+      "sha256",
+      CA_POSSESSION_PAYLOAD,
+      certificate.publicKey,
+      signature
+    );
+  } catch {
+    return false;
+  }
+}
+async function readNoFollowRegularFile(path2) {
+  let handle;
+  try {
+    const info = await lstat(path2);
+    if (!info.isFile()) return void 0;
+    handle = await open2(path2, fsConstants.O_RDONLY | noFollowFlag());
+    const opened = await handle.stat();
+    if (!opened.isFile()) return void 0;
+    return await handle.readFile({ encoding: "utf8" });
+  } catch {
+    return void 0;
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+async function readPreviousRogatioCa(caCertFile) {
+  const pem = await readNoFollowRegularFile(caCertFile);
+  if (pem === void 0) return void 0;
+  try {
+    const certificate = new X509Certificate3(pem);
+    if (!certificate.ca) return void 0;
+    if (certificate.subject !== ROGATIO_REQUEST_BODY_CA_SUBJECT) {
+      return void 0;
+    }
+    const fingerprint = sha1Fingerprint(pem);
+    if (!fingerprint) return void 0;
+    return { fingerprint, pem };
+  } catch {
+    return void 0;
+  }
+}
+async function discardPreviousCa(caPreviousCertFile) {
+  try {
+    await rm(caPreviousCertFile, { force: true });
+  } catch {
+  }
+}
+function sha1Fingerprint(certPem) {
+  try {
+    const hex = new X509Certificate3(certPem).fingerprint.replaceAll(":", "").toLowerCase();
+    return /^[0-9a-f]{40}$/.test(hex) ? hex : void 0;
+  } catch {
+    return void 0;
+  }
 }
 async function existsFile(path2) {
   try {
@@ -22602,10 +22725,21 @@ function createRequestBodyTrustController(options = {}) {
   const detect = options.detectCapabilities ?? detectTrustCapabilities;
   const caTrustInstaller = options.caTrustInstaller;
   const caTrustRemover = options.caTrustRemover;
+  const caTrustAnchorRemover = options.caTrustAnchorRemover;
+  let anchorRemovalWarning;
+  let rememberedFingerprint;
+  let replacingPrevious = false;
+  let reusedExisting = false;
+  let previousKeyPem;
+  let previousPubPem;
   const caCertFile = join2(
     installRoot,
     options.caCertFileName ?? ".rogatio-ca.crt"
   );
+  const caPreviousCertFile = join2(
+    dirname2(caCertFile),
+    ".rogatio-ca.previous.crt"
+  );
   const manifestPath = () => join2(manifestDir, `${hostName}.json`);
   let installerCalled = false;
   async function install(extensionId) {
@@ -22662,9 +22796,7 @@ function createRequestBodyTrustController(options = {}) {
     const trustResult = await trust();
     if (!trustResult.ok) {
       try {
-        await rm(caKeyFile, { force: true });
-        await rm(caPubFile, { force: true });
-        await rm(caCertFile, { force: true });
+        await rollbackReplacedCa();
       } catch {
       }
       try {
@@ -22674,7 +22806,65 @@ function createRequestBodyTrustController(options = {}) {
       installerCalled = false;
       return trustResult;
     }
-    return { ok: true, state: "installed" };
+    return trustResult.reasons ? { ok: true, state: "installed", reasons: trustResult.reasons } : { ok: true, state: "installed" };
+  }
+  async function reusableCaMaterial() {
+    try {
+      const [keyStat, certStat] = await Promise.all([
+        lstat(caKeyFile),
+        lstat(caCertFile)
+      ]);
+      if (!keyStat.isFile() || !certStat.isFile()) return false;
+      if (process.platform !== "win32") {
+        if ((keyStat.mode & 511) !== 384) return false;
+        const uid = process.getuid?.();
+        if (uid !== void 0 && keyStat.uid !== uid) return false;
+      }
+      const [certPem, keyPem] = await Promise.all([
+        readFile2(caCertFile, "utf8"),
+        readFile2(caKeyFile, "utf8")
+      ]);
+      return caCertificateMatchesPrivateKey(certPem, keyPem);
+    } catch {
+      return false;
+    }
+  }
+  async function retireAnchor(anchor) {
+    if (!caTrustAnchorRemover) return;
+    try {
+      await caTrustAnchorRemover(anchor.fingerprint, anchor.pem);
+    } catch {
+      anchorRemovalWarning = "previous-anchor-not-removed";
+      console.error("[rogatio] previous CA trust anchor was not removed");
+    }
+  }
+  async function removeLiveCaFiles() {
+    await rm(caKeyFile, { force: true });
+    await rm(caPubFile, { force: true });
+    await rm(caCertFile, { force: true });
+  }
+  async function rollbackReplacedCa() {
+    if (reusedExisting) return;
+    if (!replacingPrevious) {
+      await removeLiveCaFiles();
+      return;
+    }
+    const saved = await readPreviousRogatioCa(caPreviousCertFile);
+    const live = await readPreviousRogatioCa(caCertFile);
+    const copyKept = rememberedFingerprint !== void 0 && saved?.fingerprint === rememberedFingerprint;
+    const liveDiffers = live?.fingerprint !== rememberedFingerprint;
+    if (copyKept && liveDiffers) {
+      await removeLiveCaFiles();
+      return;
+    }
+    if (copyKept && !liveDiffers) {
+      if (previousKeyPem !== void 0) {
+        await writeFileAtomic(caKeyFile, previousKeyPem, 384);
+      }
+      if (previousPubPem !== void 0) {
+        await writeFileAtomic(caPubFile, previousPubPem);
+      }
+    }
   }
   async function runCaTrust() {
     const caps = await detect();
@@ -22685,25 +22875,78 @@ function createRequestBodyTrustController(options = {}) {
         caps.reasons
       );
     }
-    if (!await existsFile(caKeyFile) || !await existsFile(caCertFile)) {
+    anchorRemovalWarning = void 0;
+    rememberedFingerprint = void 0;
+    replacingPrevious = false;
+    reusedExisting = false;
+    previousKeyPem = void 0;
+    previousPubPem = void 0;
+    const reusable = await reusableCaMaterial();
+    reusedExisting = reusable;
+    const liveAnchor = await readPreviousRogatioCa(caCertFile);
+    const siblingAnchor = await readPreviousRogatioCa(caPreviousCertFile);
+    let preserved;
+    if (!reusable) {
+      replacingPrevious = liveAnchor !== void 0 || siblingAnchor !== void 0;
       const { privateKey } = generateCaKeyPair(TRUST_LIMITS.caKeyBits);
       const certResult = await createCertificate(
         "CN=Rogatio Request-Body CA",
         privateKey,
         TRUST_LIMITS.caValidityDays
       );
-      const certPem = certResult.certPem;
-      const certKeyPem = certResult.keyPem;
-      await writeFileAtomic(caKeyFile, certKeyPem);
-      await writeFileAtomic(caPubFile, certPem);
-      await writeFileAtomic(caCertFile, certPem);
-    }
+      const nextFingerprint = sha1Fingerprint(certResult.certPem);
+      if (liveAnchor && siblingAnchor && siblingAnchor.fingerprint !== liveAnchor.fingerprint && siblingAnchor.fingerprint !== nextFingerprint) {
+        await retireAnchor(siblingAnchor);
+      }
+      if (liveAnchor) {
+        await writeFileAtomic(caPreviousCertFile, liveAnchor.pem, 384);
+        const accepted = await readPreviousRogatioCa(caPreviousCertFile);
+        if (!accepted || accepted.fingerprint !== liveAnchor.fingerprint) {
+          throw new TrustError("trust.internal", "invalid-ca-certificate", [
+            "invalid-ca-certificate"
+          ]);
+        }
+        rememberedFingerprint = accepted.fingerprint;
+        preserved = accepted;
+      } else if (siblingAnchor && siblingAnchor.fingerprint !== nextFingerprint) {
+        rememberedFingerprint = siblingAnchor.fingerprint;
+        preserved = siblingAnchor;
+      } else if (siblingAnchor) {
+        await discardPreviousCa(caPreviousCertFile);
+      }
+      previousKeyPem = await readNoFollowRegularFile(caKeyFile);
+      previousPubPem = await readNoFollowRegularFile(caPubFile);
+      await writeFileAtomic(caKeyFile, certResult.keyPem, 384);
+      await writeFileAtomic(caPubFile, certResult.certPem);
+      await writeFileAtomic(caCertFile, certResult.certPem);
+    }
+    let installedNew = false;
     if (caTrustInstaller && !installerCalled) {
       await caTrustInstaller(await readFile2(caCertFile, "utf8"));
       installerCalled = true;
+      installedNew = true;
+    }
+    if (reusable && siblingAnchor && (installedNew || !caTrustInstaller)) {
+      if (liveAnchor && siblingAnchor.fingerprint === liveAnchor.fingerprint) {
+        await discardPreviousCa(caPreviousCertFile);
+      } else {
+        await retireAnchor(siblingAnchor);
+        await discardPreviousCa(caPreviousCertFile);
+      }
+    }
+    if (!reusable && installedNew && preserved) {
+      const current = await readPreviousRogatioCa(caCertFile);
+      if (current && current.fingerprint === preserved.fingerprint) {
+        await discardPreviousCa(caPreviousCertFile);
+      } else if (current && current.fingerprint !== preserved.fingerprint) {
+        await retireAnchor(preserved);
+        await discardPreviousCa(caPreviousCertFile);
+      }
     }
   }
   async function removeCa() {
+    const saved = await readPreviousRogatioCa(caPreviousCertFile);
+    const live = await readPreviousRogatioCa(caCertFile);
     const caWasPresent = await existsFile(caKeyFile);
     await rm(caKeyFile, { force: true });
     await rm(caPubFile, { force: true });
@@ -22711,6 +22954,16 @@ function createRequestBodyTrustController(options = {}) {
     if (caWasPresent && caTrustRemover) {
       await caTrustRemover();
     }
+    if (!saved) return;
+    if (!caWasPresent || saved.fingerprint !== live?.fingerprint) {
+      if (!caTrustAnchorRemover) {
+        throw new TrustError("trust.internal", "previous-anchor-not-removed", [
+          "previous-anchor-not-removed"
+        ]);
+      }
+      await caTrustAnchorRemover(saved.fingerprint, saved.pem);
+    }
+    await rm(caPreviousCertFile, { force: true });
   }
   async function uninstall() {
     try {
@@ -22736,7 +22989,7 @@ function createRequestBodyTrustController(options = {}) {
         reasons: [codeOf(error, "trust.internal")]
       };
     }
-    return { ok: true, state: "trusted" };
+    return anchorRemovalWarning ? { ok: true, state: "trusted", reasons: [anchorRemovalWarning] } : { ok: true, state: "trusted" };
   }
   async function status() {
     let installed = false;
@@ -22755,7 +23008,7 @@ function createRequestBodyTrustController(options = {}) {
       capabilityReasons: caps.reasons
     };
   }
-  async function verify() {
+  async function verify2() {
     const reasons = [];
     let manifestExists = false;
     let manifestValid = false;
@@ -22801,7 +23054,23 @@ function createRequestBodyTrustController(options = {}) {
       reasons
     };
   }
-  return { install, uninstall, status, verify };
+  return { install, uninstall, status, verify: verify2 };
+}
+var PREVIOUS_CA_PEM_MAX_BYTES = 16 * 1024;
+function spawnSecurity(args) {
+  return new Promise((resolve12) => {
+    const child = spawn("security", [...args]);
+    let stderr = "";
+    child.stderr?.on("data", (data) => {
+      stderr += data.toString();
+    });
+    child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
+    child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
+  });
+}
+function securityMiss(stderr) {
+  const text = stderr.toLowerCase();
+  return text.includes("not found") || text.includes("does not exist");
 }
 var darwinAdapter = {
   platform: "darwin",
@@ -22910,6 +23179,53 @@ var darwinAdapter = {
         ]);
       }
     }
+  },
+  async caTrustAnchorRemover(fingerprintSha1, certPem) {
+    if (!/^[0-9a-f]{40}$/.test(fingerprintSha1)) {
+      throw new TrustError("trust.internal", "invalid-ca-certificate", [
+        "invalid-ca-certificate"
+      ]);
+    }
+    if (typeof certPem !== "string" || certPem.length === 0 || certPem.length > PREVIOUS_CA_PEM_MAX_BYTES) {
+      throw new TrustError("trust.internal", "invalid-ca-certificate", [
+        "invalid-ca-certificate"
+      ]);
+    }
+    const keychain = this.defaultCaInstallPath();
+    const dir = await mkdtemp(join3(tmpdir(), "rogatio-ca-"));
+    const tmpPath = join3(dir, "previous.crt");
+    let failed = false;
+    try {
+      const handle = await open3(tmpPath, "wx", 384);
+      try {
+        await handle.writeFile(certPem, "utf8");
+        await handle.chmod(384);
+      } finally {
+        await handle.close();
+      }
+      const trust = await spawnSecurity(["remove-trusted-cert", "-d", tmpPath]);
+      if (trust.code !== 0 && !securityMiss(trust.stderr)) failed = true;
+      const item = await spawnSecurity([
+        "delete-certificate",
+        "-Z",
+        fingerprintSha1,
+        keychain
+      ]);
+      if (item.code !== 0 && !securityMiss(item.stderr)) failed = true;
+    } catch (error) {
+      if (error instanceof TrustError) throw error;
+      failed = true;
+    } finally {
+      try {
+        await rm2(dir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    if (failed) {
+      throw new TrustError("trust.internal", "keychain-unwritable", [
+        "keychain-unwritable"
+      ]);
+    }
   }
 };
 var darwin_default = darwinAdapter;
@@ -22919,6 +23235,46 @@ function hasSudo() {
   const result = spawnSync2("which", ["sudo"], { timeout: 1e3 });
   return result.status === 0;
 }
+function installFailureReason(stderr) {
+  const text = stderr.toLowerCase();
+  if (text.includes("permission") || text.includes("not permitted") || text.includes("no tty") || text.includes("terminal")) {
+    return "elevation-required";
+  }
+  return "ca-store-unwritable";
+}
+function runSudo(args, stdin) {
+  return new Promise((resolve12) => {
+    let stderr = "";
+    let settled = false;
+    const finish2 = (code) => {
+      if (settled) return;
+      settled = true;
+      resolve12({ code, stderr });
+    };
+    const child = spawn2("sudo", [...args], {
+      stdio: [stdin === void 0 ? "ignore" : "pipe", "ignore", "pipe"]
+    });
+    child.stderr?.on("data", (data) => {
+      stderr += data.toString();
+    });
+    child.on("error", (err) => {
+      stderr += err.message;
+      finish2(1);
+    });
+    child.on("close", (code) => {
+      finish2(code ?? 1);
+    });
+    if (stdin === void 0) return;
+    const input = child.stdin;
+    if (!input) {
+      finish2(1);
+      return;
+    }
+    input.on("error", () => {
+    });
+    input.end(stdin);
+  });
+}
 var linuxAdapter = {
   platform: "linux",
   defaultManifestDir: () => {
@@ -22964,6 +23320,11 @@ var linuxAdapter = {
     };
   },
   async caTrustInstaller(certPem) {
+    if (!isInstallableCaCertificate(certPem)) {
+      throw new TrustError("trust.internal", "invalid-ca-certificate", [
+        "invalid-ca-certificate"
+      ]);
+    }
     try {
       mkdirSync(CA_DIR, { recursive: true });
     } catch {
@@ -22971,48 +23332,14 @@ var linuxAdapter = {
         "ca-store-unwritable"
       ]);
     }
-    const certResult = await new Promise(
-      (resolve12) => {
-        const child = spawn2("sudo", [
-          "sh",
-          "-c",
-          `cat > "${CERT_PATH}" << 'EOF'
-${certPem}
-EOF`
-        ]);
-        let stderr = "";
-        child.stderr?.on("data", (data) => {
-          stderr += data.toString();
-        });
-        child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
-        child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
-      }
-    );
+    const certResult = await runSudo(["tee", CERT_PATH], certPem);
     if (certResult.code !== 0) {
-      const stderr = certResult.stderr.toLowerCase();
-      let reason = "ca-store-unwritable";
-      if (stderr.includes("permission") || stderr.includes("not permitted") || stderr.includes("no tty") || stderr.includes("terminal")) {
-        reason = "elevation-required";
-      }
+      const reason = installFailureReason(certResult.stderr);
       throw new TrustError("trust.internal", reason, [reason]);
     }
-    const result = await new Promise(
-      (resolve12) => {
-        const child = spawn2("sudo", ["update-ca-certificates"]);
-        let stderr = "";
-        child.stderr?.on("data", (data) => {
-          stderr += data.toString();
-        });
-        child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
-        child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
-      }
-    );
+    const result = await runSudo(["update-ca-certificates"]);
     if (result.code !== 0) {
-      const stderr = result.stderr.toLowerCase();
-      let reason = "ca-store-unwritable";
-      if (stderr.includes("permission") || stderr.includes("not permitted") || stderr.includes("no tty") || stderr.includes("terminal")) {
-        reason = "elevation-required";
-      }
+      const reason = installFailureReason(result.stderr);
       throw new TrustError("trust.internal", reason, [reason]);
     }
   },
@@ -23021,6 +23348,10 @@ EOF`
       unlinkSync2(CERT_PATH);
     } catch {
     }
+  },
+  async caTrustAnchorRemover(fingerprintSha1, certPem) {
+    void fingerprintSha1;
+    void certPem;
   }
 };
 var linux_default = linuxAdapter;
@@ -23044,6 +23375,11 @@ var unsupportedAdapter = {
     throw new TrustError("trust.internal", "unsupported-platform", [
       "no-capability-provider"
     ]);
+  },
+  async caTrustAnchorRemover() {
+    throw new TrustError("trust.internal", "unsupported-platform", [
+      "no-capability-provider"
+    ]);
   }
 };
 var win32Adapter = {
@@ -23132,6 +23468,33 @@ var win32Adapter = {
         ]);
       }
     }
+  },
+  async caTrustAnchorRemover(fingerprintSha1, certPem) {
+    void certPem;
+    if (!/^[0-9a-f]{40}$/.test(fingerprintSha1)) {
+      throw new TrustError("trust.internal", "invalid-ca-certificate", [
+        "invalid-ca-certificate"
+      ]);
+    }
+    const result = await new Promise(
+      (resolve12) => {
+        const child = spawn3("certutil", ["-delstore", "Root", fingerprintSha1]);
+        let stderr = "";
+        child.stderr?.on("data", (data) => {
+          stderr += data.toString();
+        });
+        child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
+        child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
+      }
+    );
+    if (result.code !== 0) {
+      const stderr = result.stderr.toLowerCase();
+      if (!stderr.includes("not found") && !stderr.includes("does not exist") && !stderr.includes("cannot find")) {
+        throw new TrustError("trust.internal", "elevation-required", [
+          "elevation-required"
+        ]);
+      }
+    }
   }
 };
 var win32_default = win32Adapter;
@@ -23160,7 +23523,8 @@ function createInstalledTrustController() {
     manifestDir: adapter.defaultManifestDir(),
     detectCapabilities: () => adapter.detect(),
     caTrustInstaller: (cert) => adapter.caTrustInstaller(cert),
-    caTrustRemover: () => adapter.caTrustRemover()
+    caTrustRemover: () => adapter.caTrustRemover(),
+    caTrustAnchorRemover: (fingerprint, certPem) => adapter.caTrustAnchorRemover(fingerprint, certPem)
   });
 }
 var PROTOCOL = "v1";
@@ -23225,9 +23589,9 @@ function generatePacScript(routes, endpoint, options) {
   }
   const checksByKey = /* @__PURE__ */ new Map();
   for (const route of routes) {
-    const check2 = pacCheck(route);
-    if (check2 === null) continue;
-    checksByKey.set(check2.key, check2.line);
+    const check22 = pacCheck(route);
+    if (check22 === null) continue;
+    checksByKey.set(check22.key, check22.line);
   }
   const sorted = [...checksByKey.entries()].sort(
     ([left], [right]) => left.localeCompare(right)
@@ -23325,6 +23689,9 @@ function exactRegistryVersion(value) {
   const match = REGISTRY_VERSION_RE.exec(value);
   return match === null ? null : match[0];
 }
+function exactDoctorVersion(value) {
+  return exactRegistryVersion(value);
+}
 function doctorFixCliUpdate(version) {
   return `npm install -g @rogatio/cli@${version}`;
 }
@@ -24013,7 +24380,7 @@ async function resolveConfinedRoot(value) {
   }
   let directory;
   try {
-    directory = await open2(value, constants5.O_RDONLY | constants5.O_DIRECTORY);
+    directory = await open4(value, constants5.O_RDONLY | constants5.O_DIRECTORY);
     const info = await directory.stat();
     if (!info.isDirectory()) return failure("runtime.root-invalid");
     return { ok: true, value: await realpath2(value) };
@@ -24371,13 +24738,13 @@ async function fetchAuthorized(operation, options = {}) {
   const protocol = url.protocol === "https:" ? "https:" : "http:";
   const port = protocol === "https:" ? 443 : 80;
   const timeoutMs = options.operationTimeoutMs ?? RUNTIME_LIMITS.operationTimeoutMs;
-  const combined = combineSignals(
+  const combined2 = combineSignals(
     options.signal,
     Math.max(1, Math.min(timeoutMs, RUNTIME_LIMITS.operationTimeoutMs))
   );
   try {
     const resolver = options.resolver ?? defaultResolver;
-    const resolved = await resolver.lookup(url.hostname, combined.signal);
+    const resolved = await resolver.lookup(url.hostname, combined2.signal);
     const addresses = validateResolvedAddresses(
       resolved,
       RUNTIME_LIMITS.maxDnsAddresses
@@ -24397,12 +24764,12 @@ async function fetchAuthorized(operation, options = {}) {
         method: operation.method,
         headers: { host: url.host, "accept-encoding": "identity" },
         ...protocol === "https:" ? { servername: url.hostname } : {},
-        signal: combined.signal
+        signal: combined2.signal
       });
     } catch {
-      return combined.signal.aborted ? failure("runtime.timeout") : failure("runtime.internal");
+      return combined2.signal.aborted ? failure("runtime.timeout") : failure("runtime.internal");
     }
-    if (combined.signal.aborted) return failure("runtime.timeout");
+    if (combined2.signal.aborted) return failure("runtime.timeout");
     if (response.status >= 300 && response.status <= 399)
       return failure("runtime.redirect-rejected");
     if (responseHeaderBytes(response.headers) > RUNTIME_LIMITS.maxResponseHeaderBytes)
@@ -24414,7 +24781,7 @@ async function fetchAuthorized(operation, options = {}) {
     let total = 0;
     try {
       for await (const chunk of response.body) {
-        if (combined.signal.aborted) return failure("runtime.timeout");
+        if (combined2.signal.aborted) return failure("runtime.timeout");
         const bytes = chunk instanceof Uint8Array ? Uint8Array.from(chunk) : Uint8Array.from(chunk);
         total += bytes.byteLength;
         if (total > RUNTIME_LIMITS.maxResponseBodyBytes)
@@ -24422,7 +24789,7 @@ async function fetchAuthorized(operation, options = {}) {
         chunks.push(bytes);
       }
     } catch {
-      return combined.signal.aborted ? failure("runtime.timeout") : failure("runtime.internal");
+      return combined2.signal.aborted ? failure("runtime.timeout") : failure("runtime.internal");
     }
     const body = new Uint8Array(total);
     let offset = 0;
@@ -24435,9 +24802,9 @@ async function fetchAuthorized(operation, options = {}) {
       value: { status: response.status, headers: response.headers, body }
     };
   } catch {
-    return combined.signal.aborted ? failure("runtime.timeout") : failure("runtime.dns-failed");
+    return combined2.signal.aborted ? failure("runtime.timeout") : failure("runtime.dns-failed");
   } finally {
-    combined.dispose();
+    combined2.dispose();
   }
 }
 function supportedContentType2(value) {
@@ -27003,6 +27370,13 @@ function decodeEnvelopeFrame(buffer) {
 function defaultTrustRoot() {
   return defaultTrustInstallRoot(process.platform);
 }
+function doctorReplyMetadata(report2, cliVersion) {
+  const version = typeof cliVersion === "string" ? exactDoctorVersion(cliVersion) : null;
+  return {
+    report: doctorReportValue(report2),
+    ...version !== null ? { cliVersion: version } : {}
+  };
+}
 function createNativeHost(options) {
   const controller = createNativeRuntimeController({
     preset: options.preset,
@@ -27248,7 +27622,7 @@ function createNativeHost(options) {
             type: "runtime.doctor",
             ...envelope.requestId !== void 0 ? { requestId: envelope.requestId } : {},
             timestamp: Date.now(),
-            metadata: { report: doctorReportValue(doctorReport) }
+            metadata: doctorReplyMetadata(doctorReport, options.cliVersion)
           });
         } catch {
           return encodeEnvelopeFrame({
@@ -27256,7 +27630,10 @@ function createNativeHost(options) {
             type: "runtime.doctor",
             ...envelope.requestId !== void 0 ? { requestId: envelope.requestId } : {},
             timestamp: Date.now(),
-            metadata: { report: doctorReportValue(doctorInterruptedReport()) }
+            metadata: doctorReplyMetadata(
+              doctorInterruptedReport(),
+              options.cliVersion
+            )
           });
         }
       }
@@ -27830,7 +28207,7 @@ import {
   rename as rename2,
   stat as stat2,
   unlink as unlink2,
-  writeFile as writeFile3
+  writeFile as writeFile2
 } from "node:fs/promises";
 import { basename as basename2, dirname as dirname5, join as join7 } from "node:path";
 var ProjectStorageError = class extends Error {
@@ -28047,7 +28424,7 @@ async function writeDocument(id2, data) {
       );
     }
     await mkdir3(dirname5(id2), { recursive: true });
-    await writeFile3(tempPath, JSON.stringify(data, null, 2), "utf-8");
+    await writeFile2(tempPath, JSON.stringify(data, null, 2), "utf-8");
     await rename2(tempPath, id2);
   } catch (e) {
     if (e instanceof ProjectFileError) throw e;
@@ -28327,6 +28704,319 @@ async function doctorCommand(args, options = {}) {
 // packages/cli/src/commands/edit.ts
 import { resolve as resolve6 } from "node:path";
 
+// packages/cli/src/editor-doctor.ts
+var EDITOR_CHECK_TITLES = {
+  "editor.server": "Editor server",
+  "editor.session": "Editor session",
+  "editor.project": "Draft",
+  "editor.ai": "AI Assist",
+  "editor.mockRoot": "Mock file root"
+};
+var EDITOR_SERVER_STOPPED_SUMMARY = "The editor server stopped.";
+var EDITOR_SERVER_PASS_SUMMARY = "The editor server answered.";
+var EDITOR_SERVER_REJECTED_SUMMARY = "The editor server could not finish doctor.";
+var EDITOR_SERVER_REJECTED_FIX = "rogatio doctor";
+var EDITOR_SESSION_STALE_SUMMARY = "This tab is stale. Its editor token was rejected.";
+var EDITOR_SESSION_STALE_FIX = "Reload this tab";
+var EDITOR_SESSION_PASS_SUMMARY = "The editor token was accepted.";
+var EDITOR_PROJECT_INVALID_SUMMARY = "The draft is invalid.";
+var EDITOR_PROJECT_NOT_JSON_SUMMARY = "The draft is not JSON.";
+var EDITOR_PROJECT_VALID_SUMMARY = "The draft is valid.";
+var EDITOR_AI_NONE_SUMMARY = "Optional. No AI provider is configured.";
+var EDITOR_AI_NONE_FIX = "rogatio ai setup";
+var EDITOR_AI_AFTER_START_SUMMARY = "AI Assist was configured after this editor started.";
+var EDITOR_AI_AFTER_START_FIX = "Restart rogatio edit";
+var EDITOR_AI_PASS_SUMMARY = "AI Assist is available in this page.";
+var EDITOR_AI_REMOVED_SUMMARY = "AI Assist is no longer configured.";
+var EDITOR_MOCK_SAVED_SUMMARY = "A mock file root is saved.";
+var EDITOR_MOCK_MISSING_SUMMARY = "Mock rules have no saved mock file root.";
+var EDITOR_MOCK_MISSING_FIX = "Set mock file root";
+var MAX_DIAGNOSTICS2 = 20;
+var MAX_DIAGNOSTIC_FIELD = 200;
+function check2(id2, status, optional, summary, fix) {
+  return { id: id2, status, optional, summary, fix };
+}
+function combined(checks, host) {
+  const uiFailed = checks.some(
+    (item) => item.status === "fail" && item.optional === false
+  );
+  return {
+    version: 1,
+    surface: "editor",
+    ok: !uiFailed && (host === null || host.ok),
+    ui: { checks },
+    host
+  };
+}
+function quoteEditorArg(value, platform = process.platform) {
+  if (platform !== "win32") return quoteDoctorArg(value);
+  return `"${value.replaceAll("%", "%%").replaceAll('"', '""')}"`;
+}
+function editorEditFix(filePath, platform = process.platform) {
+  return `rogatio edit ${quoteEditorArg(filePath, platform)}`;
+}
+function editorVerifyFix(filePath, platform = process.platform) {
+  return `rogatio verify ${quoteEditorArg(filePath, platform)}`;
+}
+function editorServerStoppedReport(filePath) {
+  return combined(
+    [
+      check2(
+        "editor.server",
+        "fail",
+        false,
+        EDITOR_SERVER_STOPPED_SUMMARY,
+        editorEditFix(filePath)
+      )
+    ],
+    null
+  );
+}
+function editorSessionStaleReport() {
+  return combined(
+    [
+      check2("editor.server", "pass", false, EDITOR_SERVER_PASS_SUMMARY, null),
+      check2(
+        "editor.session",
+        "fail",
+        false,
+        EDITOR_SESSION_STALE_SUMMARY,
+        EDITOR_SESSION_STALE_FIX
+      )
+    ],
+    null
+  );
+}
+function editorServerRejectedReport() {
+  return combined(
+    [
+      check2(
+        "editor.server",
+        "fail",
+        false,
+        EDITOR_SERVER_REJECTED_SUMMARY,
+        EDITOR_SERVER_REJECTED_FIX
+      )
+    ],
+    null
+  );
+}
+function scrubField(value) {
+  let scrubbed = "";
+  for (const char of value) {
+    const code = char.codePointAt(0) ?? 0;
+    scrubbed += code <= 31 || code === 127 ? " " : char;
+    if (scrubbed.length >= MAX_DIAGNOSTIC_FIELD) break;
+  }
+  return scrubbed.slice(0, MAX_DIAGNOSTIC_FIELD);
+}
+function diagnosticLines(diagnostics) {
+  const shown = diagnostics.slice(0, MAX_DIAGNOSTICS2).map((item) => {
+    return `${scrubField(item.path)}: ${scrubField(item.message)} (${scrubField(item.code)})`;
+  });
+  const text = shown.join("\n");
+  if (diagnostics.length <= MAX_DIAGNOSTICS2) return text;
+  return `${text}
+${diagnostics.length - MAX_DIAGNOSTICS2} more`;
+}
+function projectCheck2(draft, parsed, filePath) {
+  const fix = editorVerifyFix(filePath);
+  if (!parsed) {
+    return check2(
+      "editor.project",
+      "fail",
+      false,
+      EDITOR_PROJECT_NOT_JSON_SUMMARY,
+      fix
+    );
+  }
+  try {
+    const diagnosis = diagnoseProjectData(draft);
+    if (diagnosis.diagnostics.length === 0) {
+      return check2(
+        "editor.project",
+        "pass",
+        false,
+        EDITOR_PROJECT_VALID_SUMMARY,
+        null
+      );
+    }
+    const lines = diagnosticLines(diagnosis.diagnostics);
+    return check2(
+      "editor.project",
+      "fail",
+      false,
+      lines.length > 0 ? `${EDITOR_PROJECT_INVALID_SUMMARY}
+${lines}` : EDITOR_PROJECT_INVALID_SUMMARY,
+      fix
+    );
+  } catch {
+    return check2(
+      "editor.project",
+      "fail",
+      false,
+      EDITOR_PROJECT_INVALID_SUMMARY,
+      fix
+    );
+  }
+}
+function aiCheck2(assistInPage, configuredNow) {
+  if (!assistInPage && !configuredNow) {
+    return check2(
+      "editor.ai",
+      "warn",
+      true,
+      EDITOR_AI_NONE_SUMMARY,
+      EDITOR_AI_NONE_FIX
+    );
+  }
+  if (!assistInPage && configuredNow) {
+    return check2(
+      "editor.ai",
+      "warn",
+      true,
+      EDITOR_AI_AFTER_START_SUMMARY,
+      EDITOR_AI_AFTER_START_FIX
+    );
+  }
+  if (assistInPage && configuredNow) {
+    return check2("editor.ai", "pass", true, EDITOR_AI_PASS_SUMMARY, null);
+  }
+  return check2(
+    "editor.ai",
+    "warn",
+    true,
+    EDITOR_AI_REMOVED_SUMMARY,
+    EDITOR_AI_NONE_FIX
+  );
+}
+function draftHasMockRule(draft) {
+  if (draft === null || typeof draft !== "object" || Array.isArray(draft)) {
+    return false;
+  }
+  const groups = draft.groups;
+  if (!Array.isArray(groups)) return false;
+  for (const group of groups) {
+    if (group === null || typeof group !== "object" || Array.isArray(group)) {
+      continue;
+    }
+    const rules = group.rules;
+    if (!Array.isArray(rules)) continue;
+    for (const rule of rules) {
+      if (rule === null || typeof rule !== "object" || Array.isArray(rule)) {
+        continue;
+      }
+      if (rule.type === "mock") return true;
+    }
+  }
+  return false;
+}
+function mockRootCheck(saved) {
+  if (saved) {
+    return check2(
+      "editor.mockRoot",
+      "pass",
+      true,
+      EDITOR_MOCK_SAVED_SUMMARY,
+      null
+    );
+  }
+  return check2(
+    "editor.mockRoot",
+    "warn",
+    true,
+    EDITOR_MOCK_MISSING_SUMMARY,
+    EDITOR_MOCK_MISSING_FIX
+  );
+}
+function buildEditorDoctor(input) {
+  const checks = [
+    check2("editor.server", "pass", false, EDITOR_SERVER_PASS_SUMMARY, null),
+    check2("editor.session", "pass", false, EDITOR_SESSION_PASS_SUMMARY, null),
+    projectCheck2(input.draft, input.draftParsed, input.filePath),
+    aiCheck2(input.assistInPage, input.configuredNow)
+  ];
+  if (input.draftParsed && draftHasMockRule(input.draft)) {
+    checks.push(mockRootCheck(input.mockRootSaved));
+  }
+  return combined(checks, input.host);
+}
+function mapReadError2(error) {
+  if (error instanceof ProjectStorageError) {
+    if (error.code === "not-found") return { ok: false, reason: "missing" };
+    if (error.code === "invalid-json" || error.code === "invalid-format") {
+      return { ok: false, reason: "parse" };
+    }
+  }
+  return { ok: false, reason: "unreadable" };
+}
+function editorFileDoctorOptions(input) {
+  return {
+    cliVersion: input.cliVersion,
+    checkUpdates: false,
+    project: {
+      source: "file",
+      path: input.filePath,
+      read: input.read
+    }
+  };
+}
+async function runEditorFileDoctor(input) {
+  try {
+    return await runInstalledDoctor(
+      editorFileDoctorOptions({
+        filePath: input.filePath,
+        cliVersion: input.cliVersion,
+        read: async () => {
+          try {
+            return { ok: true, data: await input.storageGet(input.filePath) };
+          } catch (error) {
+            return mapReadError2(error);
+          }
+        }
+      })
+    );
+  } catch {
+    return doctorInterruptedReport();
+  }
+}
+function serializeEditorDiagnostics(report2) {
+  return `${JSON.stringify(
+    {
+      version: 1,
+      surface: "editor",
+      ok: report2.ok,
+      ui: {
+        checks: report2.ui.checks.map((item) => ({
+          id: item.id,
+          status: item.status,
+          optional: item.optional,
+          summary: item.summary,
+          fix: item.fix
+        }))
+      },
+      host: report2.host === null ? null : doctorReportValue(report2.host)
+    },
+    null,
+    2
+  )}
+`;
+}
+function embedJson(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+function editorPageTitles() {
+  return {
+    ...EDITOR_CHECK_TITLES,
+    node: "Node and CLI",
+    project: "Project file",
+    host: "Native host",
+    ca: "Device CA",
+    pac: "Runtime PAC",
+    ai: "AI Assist"
+  };
+}
+
 // packages/cli/src/server/http.ts
 import {
   createServer as createHttpServer
@@ -28783,7 +29473,7 @@ function previewRuleAction(operation, url) {
 }
 
 // packages/cli/src/mock-root-config.ts
-import { mkdir as mkdir4, readFile as readFile4, realpath as realpath3, rename as rename3, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile4, realpath as realpath3, rename as rename3, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname as dirname8, isAbsolute as isAbsolute4, join as join8, resolve as resolve4 } from "node:path";
 function mockRootConfigPath(env = process.env) {
@@ -28829,7 +29519,7 @@ async function writeMap(map, env) {
   const path2 = mockRootConfigPath(env);
   await mkdir4(dirname8(path2), { recursive: true });
   const temporary = `${path2}.${process.pid}.tmp`;
-  await writeFile4(
+  await writeFile3(
     temporary,
     `${JSON.stringify({ projects: map }, null, 2)}
 `,
@@ -29093,6 +29783,67 @@ function createRoutes(context) {
       res.end(JSON.stringify({ diagnostics: diagnosis.diagnostics }));
       return;
     }
+    if (pathname === "/api/doctor" && method === "POST") {
+      if (!validateCsrf(req, context.csrfToken)) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "csrf-invalid",
+            message: "Invalid CSRF token"
+          })
+        );
+        return;
+      }
+      let draft = context.project;
+      let draftParsed = true;
+      try {
+        const bodyText = await getRequestBody(req);
+        if (bodyText.length > 0) draft = JSON.parse(bodyText);
+      } catch (error) {
+        if (error instanceof RequestBodyError) {
+          const failure2 = bodyErrorResponse(error);
+          res.writeHead(failure2.status, { "Content-Type": "application/json" });
+          res.end(JSON.stringify(failure2.body));
+          return;
+        }
+        draftParsed = false;
+      }
+      let host2;
+      try {
+        host2 = context.runFileDoctor ? await context.runFileDoctor() : await runEditorFileDoctor({
+          filePath: context.filePath,
+          cliVersion: readCliVersion(),
+          storageGet: (path2) => context.storage.get(path2)
+        });
+      } catch {
+        host2 = doctorInterruptedReport();
+      }
+      let configuredNow = false;
+      try {
+        const config = await (context.readProviderConfig ?? (async () => null))();
+        configuredNow = config !== null && config !== void 0;
+      } catch {
+        configuredNow = false;
+      }
+      let mockRootSaved = false;
+      try {
+        mockRootSaved = await readSavedMockRoot(context.filePath) !== void 0;
+      } catch {
+        mockRootSaved = false;
+      }
+      const report2 = buildEditorDoctor({
+        filePath: context.filePath,
+        draft,
+        draftParsed,
+        assistInPage: context.aiClient !== void 0,
+        configuredNow,
+        mockRootSaved,
+        host: host2
+      });
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(serializeEditorDiagnostics(report2));
+      return;
+    }
     if (pathname === "/api/mock-root" && method === "GET") {
       const saved = await readSavedMockRoot(context.filePath);
       res.writeHead(200, { "Content-Type": "application/json" });
@@ -29669,7 +30420,8 @@ async function editCommand(args, options = {}) {
     editorCssPath: "",
     editorFontsPath: "",
     aiClient,
-    aiProviderConfig: providerConfig ?? void 0
+    aiProviderConfig: providerConfig ?? void 0,
+    readProviderConfig
   };
   let server;
   try {
@@ -29799,9 +30551,23 @@ function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
       background-size: 24px 24px;
     }
     #editor-root { min-height: 100vh; }
+    #editor-doctor {
+      position: sticky;
+      top: 0;
+      z-index: 2;
+      background: #1c1f24;
+      color: #e7eaf0;
+      padding: 12px 16px;
+      font: 13px/1.45 ui-monospace, monospace;
+      white-space: pre-wrap;
+    }
+    #editor-doctor[hidden] { display: none; }
+    #editor-doctor p { margin: 0 0 0.35rem; }
+    #editor-doctor button { margin-top: 0.5rem; }
   </style>
 </head>
 <body>
+   <div id="editor-doctor" hidden></div>
    <div id="editor-root"></div>
    <script type="importmap">
      { "imports": { "@rogatio/editor": "/vendor/editor.js" } }
@@ -29812,7 +30578,11 @@ function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
     const root = document.getElementById('editor-root');
     const apiBase = ${JSON.stringify(apiBase)};
     const csrfToken = ${JSON.stringify(csrfToken)};
-    const filePath = ${JSON.stringify(filePath)};
+    const filePath = ${embedJson(filePath)};
+    const doctorTitles = ${embedJson(editorPageTitles())};
+    const serverStoppedJson = ${embedJson(serializeEditorDiagnostics(editorServerStoppedReport(filePath)))};
+    const sessionStaleJson = ${embedJson(serializeEditorDiagnostics(editorSessionStaleReport()))};
+    const serverRejectedJson = ${embedJson(serializeEditorDiagnostics(editorServerRejectedReport()))};
     
     async function fetchProject() {
       const res = await fetch(apiBase + '/api/project');
@@ -29961,15 +30731,110 @@ function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
           cancel();
         },
         projectActions: [
+          { command: 'run-doctor', label: 'Run checks' },
           { command: 'set-mock-root', label: 'Set mock file root' },
           { command: 'clear-mock-root', label: 'Clear mock file root' },
         ],
         ${aiAssistHandler}
       });
+      let lastDoctorJson = '';
+      let doctorRunning = false;
+      function renderDoctor(report, rawJson) {
+        const panel = document.getElementById('editor-doctor');
+        if (!panel) return;
+        panel.replaceChildren();
+        panel.hidden = false;
+        lastDoctorJson = rawJson;
+        const ui = report && report.ui && Array.isArray(report.ui.checks)
+          ? report.ui.checks
+          : [];
+        const host = report && report.host && Array.isArray(report.host.checks)
+          ? report.host.checks
+          : [];
+        for (const item of ui.concat(host)) {
+          if (!item || typeof item.summary !== 'string' || typeof item.status !== 'string') {
+            continue;
+          }
+          const id = typeof item.id === 'string' ? item.id : '';
+          const title = Object.prototype.hasOwnProperty.call(doctorTitles, id)
+            ? doctorTitles[id]
+            : id;
+          const line = document.createElement('p');
+          line.dataset.check = id;
+          const fix = typeof item.fix === 'string' ? item.fix : null;
+          line.textContent = fix === null
+            ? item.status + '  ' + title + '  ' + item.summary
+            : item.status + '  ' + title + '  ' + item.summary + '\\nFix: ' + fix;
+          panel.append(line);
+        }
+        const copy = document.createElement('button');
+        copy.type = 'button';
+        copy.textContent = 'Copy diagnostics';
+        copy.addEventListener('click', () => {
+          if (navigator.clipboard && navigator.clipboard.writeText) {
+            void navigator.clipboard.writeText(lastDoctorJson);
+          }
+        });
+        panel.append(copy);
+      }
+      async function runEditorDoctor() {
+        if (doctorRunning) return;
+        doctorRunning = true;
+        try {
+          let body;
+          try {
+            body = JSON.stringify(editor.getDraft());
+          } catch (error) {
+            renderDoctor(JSON.parse(serverRejectedJson), serverRejectedJson);
+            return;
+          }
+          let res;
+          try {
+            res = await fetch(apiBase + '/api/doctor', {
+              method: 'POST',
+              headers: {
+                'Content-Type': 'application/json',
+                'X-CSRF-Token': csrfToken,
+              },
+              body,
+            });
+          } catch (error) {
+            renderDoctor(JSON.parse(serverStoppedJson), serverStoppedJson);
+            return;
+          }
+          const text = await res.text();
+          if (res.status === 403) {
+            let payload = null;
+            try { payload = JSON.parse(text); } catch (error) { payload = null; }
+            if (payload && payload.code === 'csrf-invalid') {
+              renderDoctor(JSON.parse(sessionStaleJson), sessionStaleJson);
+              return;
+            }
+          }
+          if (!res.ok) {
+            renderDoctor(JSON.parse(serverRejectedJson), serverRejectedJson);
+            return;
+          }
+          let report;
+          try {
+            report = JSON.parse(text);
+          } catch (error) {
+            renderDoctor(JSON.parse(serverRejectedJson), serverRejectedJson);
+            return;
+          }
+          renderDoctor(report, text);
+        } finally {
+          doctorRunning = false;
+        }
+      }
       document.addEventListener('click', (event) => {
         const target = event.target;
         if (!(target instanceof Element)) return;
         const command = target.closest('[data-command]')?.getAttribute('data-command');
+        if (command === 'run-doctor') {
+          void runEditorDoctor();
+          return;
+        }
         if (command !== 'set-mock-root' && command !== 'clear-mock-root') return;
         const root = command === 'clear-mock-root'
           ? null
@@ -32023,7 +32888,7 @@ function errorMessage(error) {
 }
 
 // packages/cli/src/commands/runtime.ts
-import { chmod, mkdir as mkdir5, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
+import { chmod, mkdir as mkdir5, rm as rm3, writeFile as writeFile4 } from "node:fs/promises";
 import { dirname as dirname10, join as join9, resolve as resolve8 } from "node:path";
 function generateHostWrapper(rogatioCommand, logPath) {
   const parts = rogatioCommand.split(" ");
@@ -32044,7 +32909,7 @@ async function writeHostWrapper(hostPath, installRoot) {
     `${process.execPath} ${process.argv[1] ?? "rogatio"}`,
     logPath
   );
-  await writeFile5(hostPath, script, "utf8");
+  await writeFile4(hostPath, script, "utf8");
   await chmod(hostPath, 493);
 }
 function makeTrustController() {
@@ -32134,11 +32999,11 @@ Note: reload the extension at chrome://extensions for the native host to be dete
     case "uninstall": {
       const uninstallResult = await controller.uninstall();
       try {
-        await rm2(hostPath, { force: true });
+        await rm3(hostPath, { force: true });
       } catch {
       }
       try {
-        await rm2(join9(installRoot, "runtime-host.log"), { force: true });
+        await rm3(join9(installRoot, "runtime-host.log"), { force: true });
       } catch {
       }
       return reportTrust(