@rogatio/cli 6.16.0 → 6.16.1

package/dist/node/index.js

@@ -602,6 +602,25 @@ function migrateOwned(input) {
   }
   return { ok: true, project, notices };
 }
+function normalizeLogicalPath(value) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  if (value.includes("\\") || value.includes("%") || hasControl(value)) {
+    return null;
+  }
+  if (value.startsWith("/") || value.endsWith("/") || value.includes("//")) {
+    return null;
+  }
+  const parts = value.split("/");
+  if (parts.some(
+    (part) => part.length === 0 || part === "." || part === ".." || part.includes(":") || /[*?[\]]/.test(part)
+  )) {
+    return null;
+  }
+  return parts.join("/");
+}
+function isValidMockLogicalPath(value) {
+  return normalizeLogicalPath(value) !== null;
+}
 function compileUrlRegex(value) {
   if (typeof value !== "string" || value.length === 0 || value.length > LIMITS.maxUrlRegexLength)
     return null;
@@ -1062,6 +1081,109 @@ function hasLoneSurrogate(value) {
   }
   return false;
 }
+function countCapturingGroups2(urlRegex) {
+  let count = 0;
+  let index = 0;
+  const length = urlRegex.length;
+  while (index < length) {
+    const char = urlRegex[index];
+    if (char === "\\") {
+      index += 2;
+      continue;
+    }
+    if (char === "(") {
+      if (urlRegex[index + 1] === "?") {
+        index = skipBalancedGroup2(urlRegex, index);
+        continue;
+      }
+      count += 1;
+    }
+    index += 1;
+  }
+  return count;
+}
+function skipBalancedGroup2(source, start) {
+  let depth = 0;
+  let index = start;
+  const length = source.length;
+  while (index < length) {
+    const char = source[index];
+    if (char === "\\") {
+      index += 2;
+      continue;
+    }
+    if (char === "(") {
+      depth += 1;
+    } else if (char === ")") {
+      depth -= 1;
+      if (depth === 0) return index;
+    }
+    index += 1;
+  }
+  return length;
+}
+function validateRedirectDestination(destination, urlRegex) {
+  const issues = [];
+  if (typeof destination !== "string" || destination.length === 0) {
+    issues.push({
+      code: "schema.required",
+      message: "Redirect destination must be a non-empty string."
+    });
+    return issues;
+  }
+  if (destination.length > LIMITS.maxRedirectDestinationLength) {
+    issues.push({
+      code: "schema.out-of-range",
+      message: `Redirect destination must be at most ${LIMITS.maxRedirectDestinationLength} characters.`
+    });
+    return issues;
+  }
+  let url;
+  try {
+    url = new URL(destination);
+  } catch {
+    issues.push({
+      code: "schema.invalid-format",
+      message: "Redirect destination must be an absolute URL."
+    });
+    return issues;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    issues.push({
+      code: "schema.invalid-value",
+      message: "Redirect destination must use the http or https scheme."
+    });
+    return issues;
+  }
+  if (url.username.length > 0 || url.password.length > 0) {
+    issues.push({
+      code: "schema.invalid-value",
+      message: "Redirect destination must not contain credentials."
+    });
+    return issues;
+  }
+  if (url.hostname.length === 0 || url.hostname.includes("*")) {
+    issues.push({
+      code: "schema.invalid-format",
+      message: "Redirect destination must have a valid host."
+    });
+    return issues;
+  }
+  const groups = countCapturingGroups2(urlRegex);
+  const backreference = /\\([1-9])/g;
+  let match = backreference.exec(destination);
+  while (match !== null) {
+    const referenced = Number(match[1]);
+    if (referenced > groups) {
+      issues.push({
+        code: "schema.invalid-value",
+        message: `Redirect destination references capture group ${referenced} but the URL pattern defines ${groups}.`
+      });
+    }
+    match = backreference.exec(destination);
+  }
+  return issues;
+}
 var ajv = new Ajv2020({
   allErrors: true,
   coerceTypes: false,
@@ -1686,22 +1808,6 @@ function semanticIssues(project) {
   }
   return issues;
 }
-function isValidMockLogicalPath(value) {
-  if (value.length === 0) return false;
-  if (value.includes("\\") || value.includes("%") || hasControl(value)) {
-    return false;
-  }
-  if (value.startsWith("/") || value.endsWith("/") || value.includes("//")) {
-    return false;
-  }
-  const parts = value.split("/");
-  if (parts.some(
-    (part) => part.length === 0 || part === "." || part === ".." || part.includes(":") || /[*?[\]]/.test(part)
-  )) {
-    return false;
-  }
-  return true;
-}
 function captureValidationIssues(value, urlRegex, instancePath) {
   return validateCaptureTemplate(value, urlRegex).map((issue) => ({
     instancePath,
@@ -1714,109 +1820,6 @@ function captureValidationIssues(value, urlRegex, instancePath) {
     }
   }));
 }
-function skipBalancedGroup2(source, start) {
-  let depth = 0;
-  let index = start;
-  const length = source.length;
-  while (index < length) {
-    const char = source[index];
-    if (char === "\\") {
-      index += 2;
-      continue;
-    }
-    if (char === "(") {
-      depth += 1;
-    } else if (char === ")") {
-      depth -= 1;
-      if (depth === 0) return index;
-    }
-    index += 1;
-  }
-  return length;
-}
-function countCapturingGroups2(urlRegex) {
-  let count = 0;
-  let index = 0;
-  const length = urlRegex.length;
-  while (index < length) {
-    const char = urlRegex[index];
-    if (char === "\\") {
-      index += 2;
-      continue;
-    }
-    if (char === "(") {
-      if (urlRegex[index + 1] === "?") {
-        index = skipBalancedGroup2(urlRegex, index);
-        continue;
-      }
-      count += 1;
-    }
-    index += 1;
-  }
-  return count;
-}
-function validateRedirectDestination(destination, urlRegex) {
-  const issues = [];
-  if (typeof destination !== "string" || destination.length === 0) {
-    issues.push({
-      code: "schema.required",
-      message: "Redirect destination must be a non-empty string."
-    });
-    return issues;
-  }
-  if (destination.length > LIMITS.maxRedirectDestinationLength) {
-    issues.push({
-      code: "schema.out-of-range",
-      message: `Redirect destination must be at most ${LIMITS.maxRedirectDestinationLength} characters.`
-    });
-    return issues;
-  }
-  let url;
-  try {
-    url = new URL(destination);
-  } catch {
-    issues.push({
-      code: "schema.invalid-format",
-      message: "Redirect destination must be an absolute URL."
-    });
-    return issues;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    issues.push({
-      code: "schema.invalid-value",
-      message: "Redirect destination must use the http or https scheme."
-    });
-    return issues;
-  }
-  if (url.username.length > 0 || url.password.length > 0) {
-    issues.push({
-      code: "schema.invalid-value",
-      message: "Redirect destination must not contain credentials."
-    });
-    return issues;
-  }
-  if (url.hostname.length === 0 || url.hostname.includes("*")) {
-    issues.push({
-      code: "schema.invalid-format",
-      message: "Redirect destination must have a valid host."
-    });
-    return issues;
-  }
-  const groups = countCapturingGroups2(urlRegex);
-  const backreference = /\\([1-9])/g;
-  let match = backreference.exec(destination);
-  while (match !== null) {
-    const referenced = Number(match[1]);
-    if (referenced > groups) {
-      issues.push({
-        code: "schema.invalid-value",
-        message: `Redirect destination references capture group ${referenced} but the URL pattern defines ${groups}.`
-      });
-    }
-    match = backreference.exec(destination);
-  }
-  return issues;
-}
 function validateProjectDetailed(value) {
   const snapshot2 = snapshotOwnData(value);
   if (!snapshot2.valid) {
@@ -2263,11 +2266,23 @@ import { close, fstat, read } from "node:fs";
 import { createRequire } from "node:module";
 import { createServer, request as httpRequest } from "node:http";
 import { join as join5 } from "node:path";
-import { mkdir as mkdir2, readFile as readFile2, rename, rm, stat, writeFile as writeFile2 } from "node:fs/promises";
+import { createPrivateKey, sign, verify, X509Certificate as X509Certificate3 } from "node:crypto";
+import { constants as fsConstants } from "node:fs";
+import {
+  lstat,
+  mkdir as mkdir2,
+  open as open2,
+  readFile as readFile2,
+  rename,
+  rm,
+  stat
+} from "node:fs/promises";
 import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative2 } from "node:path";
+import { X509Certificate } from "node:crypto";
 import { generateKeyPairSync, webcrypto } from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
 import { accessSync, constants as constants2, unlinkSync, writeFileSync } from "node:fs";
+import { mkdtemp, open as open3, rm as rm2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname as dirname3, join as join3 } from "node:path";
 import { join as posixJoin } from "node:path/posix";
@@ -2281,7 +2296,7 @@ import { tmpdir as tmpdir2 } from "node:os";
 import { join as join4 } from "node:path";
 import { join as posixJoin3 } from "node:path/posix";
 import { constants as constants5 } from "node:fs";
-import { open as open2, realpath as realpath2 } from "node:fs/promises";
+import { open as open4, realpath as realpath2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute3 } from "node:path";
 import { Buffer as Buffer2 } from "node:buffer";
 import { existsSync as existsSync2 } from "node:fs";
@@ -20057,7 +20072,7 @@ var require_x509_cjs = __commonJS({
     var _X509Certificate_signature;
     var _X509Certificate_extensions;
     var _X509Certificate_publicKey;
-    var X509Certificate3 = class extends PemData {
+    var X509Certificate5 = class extends PemData {
       get publicKey() {
         if (!tslib.__classPrivateFieldGet(this, _X509Certificate_publicKey, "f")) {
           tslib.__classPrivateFieldSet(this, _X509Certificate_publicKey, new PublicKey(this.asn.tbsCertificate.subjectPublicKeyInfo, this.parseOptions), "f");
@@ -20300,7 +20315,7 @@ var require_x509_cjs = __commonJS({
       }
     };
     _X509Certificate_tbs = /* @__PURE__ */ new WeakMap(), _X509Certificate_serialNumber = /* @__PURE__ */ new WeakMap(), _X509Certificate_subjectName = /* @__PURE__ */ new WeakMap(), _X509Certificate_subject = /* @__PURE__ */ new WeakMap(), _X509Certificate_issuerName = /* @__PURE__ */ new WeakMap(), _X509Certificate_issuer = /* @__PURE__ */ new WeakMap(), _X509Certificate_notBefore = /* @__PURE__ */ new WeakMap(), _X509Certificate_notAfter = /* @__PURE__ */ new WeakMap(), _X509Certificate_signatureAlgorithm = /* @__PURE__ */ new WeakMap(), _X509Certificate_signature = /* @__PURE__ */ new WeakMap(), _X509Certificate_extensions = /* @__PURE__ */ new WeakMap(), _X509Certificate_publicKey = /* @__PURE__ */ new WeakMap();
-    X509Certificate3.NAME = "Certificate";
+    X509Certificate5.NAME = "Certificate";
     var _X509Certificates_options;
     var X509Certificates = class extends Array {
       constructor(param, options) {
@@ -20308,7 +20323,7 @@ var require_x509_cjs = __commonJS({
         _X509Certificates_options.set(this, void 0);
         if (PemData.isAsnEncoded(param)) {
           this.import(param, options);
-        } else if (param instanceof X509Certificate3) {
+        } else if (param instanceof X509Certificate5) {
           this.push(param);
         } else if (Array.isArray(param)) {
           for (const item of param) {
@@ -20346,7 +20361,7 @@ var require_x509_cjs = __commonJS({
         const certificates = [];
         for (const item of signedData.certificates || []) {
           if (item.certificate) {
-            certificates.push(new X509Certificate3(item.certificate, options));
+            certificates.push(new X509Certificate5(item.certificate, options));
           }
         }
         this.clear();
@@ -20538,7 +20553,7 @@ var require_x509_cjs = __commonJS({
           throw Error("Cannot convert ASN.1 signature value to WebCrypto format");
         }
         asnX509.signatureValue = asnSignature;
-        return new X509Certificate3(asn1Schema.AsnConvert.serialize(asnX509));
+        return new X509Certificate5(asn1Schema.AsnConvert.serialize(asnX509));
       }
     };
     var _X509CrlEntry_serialNumber;
@@ -20759,7 +20774,7 @@ var require_x509_cjs = __commonJS({
         let publicKey;
         const paramsKey = params.publicKey;
         try {
-          if (paramsKey instanceof X509Certificate3) {
+          if (paramsKey instanceof X509Certificate5) {
             keyAlgorithm = {
               ...paramsKey.publicKey.algorithm,
               ...paramsKey.signatureAlgorithm
@@ -20963,7 +20978,7 @@ var require_x509_cjs = __commonJS({
     exports.TextObject = TextObject;
     exports.UPN = UPN;
     exports.URL = URL2;
-    exports.X509Certificate = X509Certificate3;
+    exports.X509Certificate = X509Certificate5;
     exports.X509CertificateGenerator = X509CertificateGenerator2;
     exports.X509Certificates = X509Certificates;
     exports.X509ChainBuilder = X509ChainBuilder;
@@ -21892,22 +21907,6 @@ function runtimeError(code) {
 function failure(code) {
   return { ok: false, error: runtimeError(code) };
 }
-function normalizeLogicalPath(value) {
-  if (typeof value !== "string" || value.length === 0) return null;
-  if (value.includes("\\") || value.includes("%") || hasControl(value)) {
-    return null;
-  }
-  if (value.startsWith("/") || value.endsWith("/") || value.includes("//")) {
-    return null;
-  }
-  const parts = value.split("/");
-  if (parts.some(
-    (part) => part.length === 0 || part === "." || part === ".." || part.includes(":") || /[*?[\]]/.test(part)
-  )) {
-    return null;
-  }
-  return parts.join("/");
-}
 var MAX_ARRAY_LENGTH = 4096;
 var MAX_OBJECT_PROPERTIES = 256;
 function snapshotOwnData3(value, ancestors = /* @__PURE__ */ new WeakSet()) {
@@ -22443,6 +22442,42 @@ function describeExtensionIdMismatch(expectedExtensionId, allowedOrigins) {
     `Run: ${command}`
   ].join("\n");
 }
+var MAX_CERTIFICATE_PEM_LENGTH = 16 * 1024;
+var BEGIN_CERTIFICATE = "-----BEGIN CERTIFICATE-----";
+var END_CERTIFICATE = "-----END CERTIFICATE-----";
+var BODY_LINE = /^[A-Za-z0-9+/]{1,64}={0,2}$/;
+function isInstallableCaCertificate(pem) {
+  if (typeof pem !== "string" || pem.length === 0 || pem.length > MAX_CERTIFICATE_PEM_LENGTH || pem.includes("\0")) {
+    return false;
+  }
+  const normalized = pem.replaceAll("\r\n", "\n").replaceAll("\r", "\n");
+  const lines = normalized.split("\n");
+  if (lines[lines.length - 1] === "") lines.pop();
+  if (lines.some((line) => line.trim() === "EOF")) return false;
+  if (lines.length < 3 || lines[0] !== BEGIN_CERTIFICATE || lines[lines.length - 1] !== END_CERTIFICATE) {
+    return false;
+  }
+  if (lines.filter((line) => line === BEGIN_CERTIFICATE).length !== 1) {
+    return false;
+  }
+  if (lines.filter((line) => line === END_CERTIFICATE).length !== 1) {
+    return false;
+  }
+  const body = lines.slice(1, -1);
+  for (let index = 0; index < body.length; index += 1) {
+    const line = body[index] ?? "";
+    if (!BODY_LINE.test(line)) return false;
+    if (line.includes("=") && index !== body.length - 1) return false;
+  }
+  if (body.join("").length % 4 !== 0) return false;
+  try {
+    const certificate = new X509Certificate(`${lines.join("\n")}
+`);
+    return certificate.ca;
+  } catch {
+    return false;
+  }
+}
 var import_reflect_metadata = __toESM(require_Reflect(), 1);
 var import_x509 = __toESM(require_x509_cjs(), 1);
 var crypto2 = webcrypto.subtle;
@@ -22565,12 +22600,100 @@ function isWellFormedManifest(value) {
   const m = value;
   return typeof m.name === "string" && typeof m.path === "string" && m.type === "stdio" && Array.isArray(m.allowed_origins) && m.allowed_origins.every((o) => typeof o === "string");
 }
-async function writeFileAtomic(path2, data) {
+function noFollowFlag() {
+  const flag = fsConstants.O_NOFOLLOW;
+  return typeof flag === "number" ? flag : 0;
+}
+async function writeFileAtomic(path2, data, mode) {
   const dir = dirname2(path2);
   await mkdir2(dir, { recursive: true });
   const tmp = join2(dir, `.${basename(path2)}.${process.pid}.tmp`);
-  await writeFile2(tmp, data, "utf8");
-  await rename(tmp, path2);
+  const flags = fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag();
+  let created = false;
+  let handle;
+  try {
+    handle = await open2(tmp, flags, 384);
+    created = true;
+    await handle.writeFile(data, "utf8");
+    await handle.chmod(mode ?? 420);
+    await handle.close();
+    handle = void 0;
+    await rename(tmp, path2);
+  } catch (error) {
+    await handle?.close().catch(() => void 0);
+    if (created) {
+      try {
+        await rm(tmp, { force: true });
+      } catch {
+      }
+    }
+    throw error;
+  }
+}
+var CA_POSSESSION_PAYLOAD = Buffer.from("rogatio-ca-possession");
+var ROGATIO_REQUEST_BODY_CA_SUBJECT = "CN=CN=Rogatio Request-Body CA";
+function caCertificateMatchesPrivateKey(certPem, keyPem) {
+  try {
+    if (!isInstallableCaCertificate(certPem)) return false;
+    const certificate = new X509Certificate3(certPem);
+    if (!certificate.ca) return false;
+    const privateKey = createPrivateKey(keyPem);
+    if (privateKey.type !== "private") return false;
+    const signature = sign("sha256", CA_POSSESSION_PAYLOAD, privateKey);
+    return verify(
+      "sha256",
+      CA_POSSESSION_PAYLOAD,
+      certificate.publicKey,
+      signature
+    );
+  } catch {
+    return false;
+  }
+}
+async function readNoFollowRegularFile(path2) {
+  let handle;
+  try {
+    const info = await lstat(path2);
+    if (!info.isFile()) return void 0;
+    handle = await open2(path2, fsConstants.O_RDONLY | noFollowFlag());
+    const opened = await handle.stat();
+    if (!opened.isFile()) return void 0;
+    return await handle.readFile({ encoding: "utf8" });
+  } catch {
+    return void 0;
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+async function readPreviousRogatioCa(caCertFile) {
+  const pem = await readNoFollowRegularFile(caCertFile);
+  if (pem === void 0) return void 0;
+  try {
+    const certificate = new X509Certificate3(pem);
+    if (!certificate.ca) return void 0;
+    if (certificate.subject !== ROGATIO_REQUEST_BODY_CA_SUBJECT) {
+      return void 0;
+    }
+    const fingerprint = sha1Fingerprint(pem);
+    if (!fingerprint) return void 0;
+    return { fingerprint, pem };
+  } catch {
+    return void 0;
+  }
+}
+async function discardPreviousCa(caPreviousCertFile) {
+  try {
+    await rm(caPreviousCertFile, { force: true });
+  } catch {
+  }
+}
+function sha1Fingerprint(certPem) {
+  try {
+    const hex = new X509Certificate3(certPem).fingerprint.replaceAll(":", "").toLowerCase();
+    return /^[0-9a-f]{40}$/.test(hex) ? hex : void 0;
+  } catch {
+    return void 0;
+  }
 }
 async function existsFile(path2) {
   try {
@@ -22602,10 +22725,21 @@ function createRequestBodyTrustController(options = {}) {
   const detect = options.detectCapabilities ?? detectTrustCapabilities;
   const caTrustInstaller = options.caTrustInstaller;
   const caTrustRemover = options.caTrustRemover;
+  const caTrustAnchorRemover = options.caTrustAnchorRemover;
+  let anchorRemovalWarning;
+  let rememberedFingerprint;
+  let replacingPrevious = false;
+  let reusedExisting = false;
+  let previousKeyPem;
+  let previousPubPem;
   const caCertFile = join2(
     installRoot,
     options.caCertFileName ?? ".rogatio-ca.crt"
   );
+  const caPreviousCertFile = join2(
+    dirname2(caCertFile),
+    ".rogatio-ca.previous.crt"
+  );
   const manifestPath = () => join2(manifestDir, `${hostName}.json`);
   let installerCalled = false;
   async function install(extensionId) {
@@ -22662,9 +22796,7 @@ function createRequestBodyTrustController(options = {}) {
     const trustResult = await trust();
     if (!trustResult.ok) {
       try {
-        await rm(caKeyFile, { force: true });
-        await rm(caPubFile, { force: true });
-        await rm(caCertFile, { force: true });
+        await rollbackReplacedCa();
       } catch {
       }
       try {
@@ -22674,7 +22806,65 @@ function createRequestBodyTrustController(options = {}) {
       installerCalled = false;
       return trustResult;
     }
-    return { ok: true, state: "installed" };
+    return trustResult.reasons ? { ok: true, state: "installed", reasons: trustResult.reasons } : { ok: true, state: "installed" };
+  }
+  async function reusableCaMaterial() {
+    try {
+      const [keyStat, certStat] = await Promise.all([
+        lstat(caKeyFile),
+        lstat(caCertFile)
+      ]);
+      if (!keyStat.isFile() || !certStat.isFile()) return false;
+      if (process.platform !== "win32") {
+        if ((keyStat.mode & 511) !== 384) return false;
+        const uid = process.getuid?.();
+        if (uid !== void 0 && keyStat.uid !== uid) return false;
+      }
+      const [certPem, keyPem] = await Promise.all([
+        readFile2(caCertFile, "utf8"),
+        readFile2(caKeyFile, "utf8")
+      ]);
+      return caCertificateMatchesPrivateKey(certPem, keyPem);
+    } catch {
+      return false;
+    }
+  }
+  async function retireAnchor(anchor) {
+    if (!caTrustAnchorRemover) return;
+    try {
+      await caTrustAnchorRemover(anchor.fingerprint, anchor.pem);
+    } catch {
+      anchorRemovalWarning = "previous-anchor-not-removed";
+      console.error("[rogatio] previous CA trust anchor was not removed");
+    }
+  }
+  async function removeLiveCaFiles() {
+    await rm(caKeyFile, { force: true });
+    await rm(caPubFile, { force: true });
+    await rm(caCertFile, { force: true });
+  }
+  async function rollbackReplacedCa() {
+    if (reusedExisting) return;
+    if (!replacingPrevious) {
+      await removeLiveCaFiles();
+      return;
+    }
+    const saved = await readPreviousRogatioCa(caPreviousCertFile);
+    const live = await readPreviousRogatioCa(caCertFile);
+    const copyKept = rememberedFingerprint !== void 0 && saved?.fingerprint === rememberedFingerprint;
+    const liveDiffers = live?.fingerprint !== rememberedFingerprint;
+    if (copyKept && liveDiffers) {
+      await removeLiveCaFiles();
+      return;
+    }
+    if (copyKept && !liveDiffers) {
+      if (previousKeyPem !== void 0) {
+        await writeFileAtomic(caKeyFile, previousKeyPem, 384);
+      }
+      if (previousPubPem !== void 0) {
+        await writeFileAtomic(caPubFile, previousPubPem);
+      }
+    }
   }
   async function runCaTrust() {
     const caps = await detect();
@@ -22685,25 +22875,78 @@ function createRequestBodyTrustController(options = {}) {
         caps.reasons
       );
     }
-    if (!await existsFile(caKeyFile) || !await existsFile(caCertFile)) {
+    anchorRemovalWarning = void 0;
+    rememberedFingerprint = void 0;
+    replacingPrevious = false;
+    reusedExisting = false;
+    previousKeyPem = void 0;
+    previousPubPem = void 0;
+    const reusable = await reusableCaMaterial();
+    reusedExisting = reusable;
+    const liveAnchor = await readPreviousRogatioCa(caCertFile);
+    const siblingAnchor = await readPreviousRogatioCa(caPreviousCertFile);
+    let preserved;
+    if (!reusable) {
+      replacingPrevious = liveAnchor !== void 0 || siblingAnchor !== void 0;
       const { privateKey } = generateCaKeyPair(TRUST_LIMITS.caKeyBits);
       const certResult = await createCertificate(
         "CN=Rogatio Request-Body CA",
         privateKey,
         TRUST_LIMITS.caValidityDays
       );
-      const certPem = certResult.certPem;
-      const certKeyPem = certResult.keyPem;
-      await writeFileAtomic(caKeyFile, certKeyPem);
-      await writeFileAtomic(caPubFile, certPem);
-      await writeFileAtomic(caCertFile, certPem);
-    }
+      const nextFingerprint = sha1Fingerprint(certResult.certPem);
+      if (liveAnchor && siblingAnchor && siblingAnchor.fingerprint !== liveAnchor.fingerprint && siblingAnchor.fingerprint !== nextFingerprint) {
+        await retireAnchor(siblingAnchor);
+      }
+      if (liveAnchor) {
+        await writeFileAtomic(caPreviousCertFile, liveAnchor.pem, 384);
+        const accepted = await readPreviousRogatioCa(caPreviousCertFile);
+        if (!accepted || accepted.fingerprint !== liveAnchor.fingerprint) {
+          throw new TrustError("trust.internal", "invalid-ca-certificate", [
+            "invalid-ca-certificate"
+          ]);
+        }
+        rememberedFingerprint = accepted.fingerprint;
+        preserved = accepted;
+      } else if (siblingAnchor && siblingAnchor.fingerprint !== nextFingerprint) {
+        rememberedFingerprint = siblingAnchor.fingerprint;
+        preserved = siblingAnchor;
+      } else if (siblingAnchor) {
+        await discardPreviousCa(caPreviousCertFile);
+      }
+      previousKeyPem = await readNoFollowRegularFile(caKeyFile);
+      previousPubPem = await readNoFollowRegularFile(caPubFile);
+      await writeFileAtomic(caKeyFile, certResult.keyPem, 384);
+      await writeFileAtomic(caPubFile, certResult.certPem);
+      await writeFileAtomic(caCertFile, certResult.certPem);
+    }
+    let installedNew = false;
     if (caTrustInstaller && !installerCalled) {
       await caTrustInstaller(await readFile2(caCertFile, "utf8"));
       installerCalled = true;
+      installedNew = true;
+    }
+    if (reusable && siblingAnchor && (installedNew || !caTrustInstaller)) {
+      if (liveAnchor && siblingAnchor.fingerprint === liveAnchor.fingerprint) {
+        await discardPreviousCa(caPreviousCertFile);
+      } else {
+        await retireAnchor(siblingAnchor);
+        await discardPreviousCa(caPreviousCertFile);
+      }
+    }
+    if (!reusable && installedNew && preserved) {
+      const current = await readPreviousRogatioCa(caCertFile);
+      if (current && current.fingerprint === preserved.fingerprint) {
+        await discardPreviousCa(caPreviousCertFile);
+      } else if (current && current.fingerprint !== preserved.fingerprint) {
+        await retireAnchor(preserved);
+        await discardPreviousCa(caPreviousCertFile);
+      }
     }
   }
   async function removeCa() {
+    const saved = await readPreviousRogatioCa(caPreviousCertFile);
+    const live = await readPreviousRogatioCa(caCertFile);
     const caWasPresent = await existsFile(caKeyFile);
     await rm(caKeyFile, { force: true });
     await rm(caPubFile, { force: true });
@@ -22711,6 +22954,16 @@ function createRequestBodyTrustController(options = {}) {
     if (caWasPresent && caTrustRemover) {
       await caTrustRemover();
     }
+    if (!saved) return;
+    if (!caWasPresent || saved.fingerprint !== live?.fingerprint) {
+      if (!caTrustAnchorRemover) {
+        throw new TrustError("trust.internal", "previous-anchor-not-removed", [
+          "previous-anchor-not-removed"
+        ]);
+      }
+      await caTrustAnchorRemover(saved.fingerprint, saved.pem);
+    }
+    await rm(caPreviousCertFile, { force: true });
   }
   async function uninstall() {
     try {
@@ -22736,7 +22989,7 @@ function createRequestBodyTrustController(options = {}) {
         reasons: [codeOf(error, "trust.internal")]
       };
     }
-    return { ok: true, state: "trusted" };
+    return anchorRemovalWarning ? { ok: true, state: "trusted", reasons: [anchorRemovalWarning] } : { ok: true, state: "trusted" };
   }
   async function status() {
     let installed = false;
@@ -22755,7 +23008,7 @@ function createRequestBodyTrustController(options = {}) {
       capabilityReasons: caps.reasons
     };
   }
-  async function verify() {
+  async function verify2() {
     const reasons = [];
     let manifestExists = false;
     let manifestValid = false;
@@ -22801,7 +23054,23 @@ function createRequestBodyTrustController(options = {}) {
       reasons
     };
   }
-  return { install, uninstall, status, verify };
+  return { install, uninstall, status, verify: verify2 };
+}
+var PREVIOUS_CA_PEM_MAX_BYTES = 16 * 1024;
+function spawnSecurity(args) {
+  return new Promise((resolve12) => {
+    const child = spawn("security", [...args]);
+    let stderr = "";
+    child.stderr?.on("data", (data) => {
+      stderr += data.toString();
+    });
+    child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
+    child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
+  });
+}
+function securityMiss(stderr) {
+  const text = stderr.toLowerCase();
+  return text.includes("not found") || text.includes("does not exist");
 }
 var darwinAdapter = {
   platform: "darwin",
@@ -22910,6 +23179,53 @@ var darwinAdapter = {
         ]);
       }
     }
+  },
+  async caTrustAnchorRemover(fingerprintSha1, certPem) {
+    if (!/^[0-9a-f]{40}$/.test(fingerprintSha1)) {
+      throw new TrustError("trust.internal", "invalid-ca-certificate", [
+        "invalid-ca-certificate"
+      ]);
+    }
+    if (typeof certPem !== "string" || certPem.length === 0 || certPem.length > PREVIOUS_CA_PEM_MAX_BYTES) {
+      throw new TrustError("trust.internal", "invalid-ca-certificate", [
+        "invalid-ca-certificate"
+      ]);
+    }
+    const keychain = this.defaultCaInstallPath();
+    const dir = await mkdtemp(join3(tmpdir(), "rogatio-ca-"));
+    const tmpPath = join3(dir, "previous.crt");
+    let failed = false;
+    try {
+      const handle = await open3(tmpPath, "wx", 384);
+      try {
+        await handle.writeFile(certPem, "utf8");
+        await handle.chmod(384);
+      } finally {
+        await handle.close();
+      }
+      const trust = await spawnSecurity(["remove-trusted-cert", "-d", tmpPath]);
+      if (trust.code !== 0 && !securityMiss(trust.stderr)) failed = true;
+      const item = await spawnSecurity([
+        "delete-certificate",
+        "-Z",
+        fingerprintSha1,
+        keychain
+      ]);
+      if (item.code !== 0 && !securityMiss(item.stderr)) failed = true;
+    } catch (error) {
+      if (error instanceof TrustError) throw error;
+      failed = true;
+    } finally {
+      try {
+        await rm2(dir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    if (failed) {
+      throw new TrustError("trust.internal", "keychain-unwritable", [
+        "keychain-unwritable"
+      ]);
+    }
   }
 };
 var darwin_default = darwinAdapter;
@@ -22919,6 +23235,46 @@ function hasSudo() {
   const result = spawnSync2("which", ["sudo"], { timeout: 1e3 });
   return result.status === 0;
 }
+function installFailureReason(stderr) {
+  const text = stderr.toLowerCase();
+  if (text.includes("permission") || text.includes("not permitted") || text.includes("no tty") || text.includes("terminal")) {
+    return "elevation-required";
+  }
+  return "ca-store-unwritable";
+}
+function runSudo(args, stdin) {
+  return new Promise((resolve12) => {
+    let stderr = "";
+    let settled = false;
+    const finish2 = (code) => {
+      if (settled) return;
+      settled = true;
+      resolve12({ code, stderr });
+    };
+    const child = spawn2("sudo", [...args], {
+      stdio: [stdin === void 0 ? "ignore" : "pipe", "ignore", "pipe"]
+    });
+    child.stderr?.on("data", (data) => {
+      stderr += data.toString();
+    });
+    child.on("error", (err) => {
+      stderr += err.message;
+      finish2(1);
+    });
+    child.on("close", (code) => {
+      finish2(code ?? 1);
+    });
+    if (stdin === void 0) return;
+    const input = child.stdin;
+    if (!input) {
+      finish2(1);
+      return;
+    }
+    input.on("error", () => {
+    });
+    input.end(stdin);
+  });
+}
 var linuxAdapter = {
   platform: "linux",
   defaultManifestDir: () => {
@@ -22964,6 +23320,11 @@ var linuxAdapter = {
     };
   },
   async caTrustInstaller(certPem) {
+    if (!isInstallableCaCertificate(certPem)) {
+      throw new TrustError("trust.internal", "invalid-ca-certificate", [
+        "invalid-ca-certificate"
+      ]);
+    }
     try {
       mkdirSync(CA_DIR, { recursive: true });
     } catch {
@@ -22971,48 +23332,14 @@ var linuxAdapter = {
         "ca-store-unwritable"
       ]);
     }
-    const certResult = await new Promise(
-      (resolve12) => {
-        const child = spawn2("sudo", [
-          "sh",
-          "-c",
-          `cat > "${CERT_PATH}" << 'EOF'
-${certPem}
-EOF`
-        ]);
-        let stderr = "";
-        child.stderr?.on("data", (data) => {
-          stderr += data.toString();
-        });
-        child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
-        child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
-      }
-    );
+    const certResult = await runSudo(["tee", CERT_PATH], certPem);
     if (certResult.code !== 0) {
-      const stderr = certResult.stderr.toLowerCase();
-      let reason = "ca-store-unwritable";
-      if (stderr.includes("permission") || stderr.includes("not permitted") || stderr.includes("no tty") || stderr.includes("terminal")) {
-        reason = "elevation-required";
-      }
+      const reason = installFailureReason(certResult.stderr);
       throw new TrustError("trust.internal", reason, [reason]);
     }
-    const result = await new Promise(
-      (resolve12) => {
-        const child = spawn2("sudo", ["update-ca-certificates"]);
-        let stderr = "";
-        child.stderr?.on("data", (data) => {
-          stderr += data.toString();
-        });
-        child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
-        child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
-      }
-    );
+    const result = await runSudo(["update-ca-certificates"]);
     if (result.code !== 0) {
-      const stderr = result.stderr.toLowerCase();
-      let reason = "ca-store-unwritable";
-      if (stderr.includes("permission") || stderr.includes("not permitted") || stderr.includes("no tty") || stderr.includes("terminal")) {
-        reason = "elevation-required";
-      }
+      const reason = installFailureReason(result.stderr);
       throw new TrustError("trust.internal", reason, [reason]);
     }
   },
@@ -23021,6 +23348,10 @@ EOF`
       unlinkSync2(CERT_PATH);
     } catch {
     }
+  },
+  async caTrustAnchorRemover(fingerprintSha1, certPem) {
+    void fingerprintSha1;
+    void certPem;
   }
 };
 var linux_default = linuxAdapter;
@@ -23044,6 +23375,11 @@ var unsupportedAdapter = {
     throw new TrustError("trust.internal", "unsupported-platform", [
       "no-capability-provider"
     ]);
+  },
+  async caTrustAnchorRemover() {
+    throw new TrustError("trust.internal", "unsupported-platform", [
+      "no-capability-provider"
+    ]);
   }
 };
 var win32Adapter = {
@@ -23132,6 +23468,33 @@ var win32Adapter = {
         ]);
       }
     }
+  },
+  async caTrustAnchorRemover(fingerprintSha1, certPem) {
+    void certPem;
+    if (!/^[0-9a-f]{40}$/.test(fingerprintSha1)) {
+      throw new TrustError("trust.internal", "invalid-ca-certificate", [
+        "invalid-ca-certificate"
+      ]);
+    }
+    const result = await new Promise(
+      (resolve12) => {
+        const child = spawn3("certutil", ["-delstore", "Root", fingerprintSha1]);
+        let stderr = "";
+        child.stderr?.on("data", (data) => {
+          stderr += data.toString();
+        });
+        child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
+        child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
+      }
+    );
+    if (result.code !== 0) {
+      const stderr = result.stderr.toLowerCase();
+      if (!stderr.includes("not found") && !stderr.includes("does not exist") && !stderr.includes("cannot find")) {
+        throw new TrustError("trust.internal", "elevation-required", [
+          "elevation-required"
+        ]);
+      }
+    }
   }
 };
 var win32_default = win32Adapter;
@@ -23160,7 +23523,8 @@ function createInstalledTrustController() {
     manifestDir: adapter.defaultManifestDir(),
     detectCapabilities: () => adapter.detect(),
     caTrustInstaller: (cert) => adapter.caTrustInstaller(cert),
-    caTrustRemover: () => adapter.caTrustRemover()
+    caTrustRemover: () => adapter.caTrustRemover(),
+    caTrustAnchorRemover: (fingerprint, certPem) => adapter.caTrustAnchorRemover(fingerprint, certPem)
   });
 }
 var PROTOCOL = "v1";
@@ -24016,7 +24380,7 @@ async function resolveConfinedRoot(value) {
   }
   let directory;
   try {
-    directory = await open2(value, constants5.O_RDONLY | constants5.O_DIRECTORY);
+    directory = await open4(value, constants5.O_RDONLY | constants5.O_DIRECTORY);
     const info = await directory.stat();
     if (!info.isDirectory()) return failure("runtime.root-invalid");
     return { ok: true, value: await realpath2(value) };
@@ -27843,7 +28207,7 @@ import {
   rename as rename2,
   stat as stat2,
   unlink as unlink2,
-  writeFile as writeFile3
+  writeFile as writeFile2
 } from "node:fs/promises";
 import { basename as basename2, dirname as dirname5, join as join7 } from "node:path";
 var ProjectStorageError = class extends Error {
@@ -28060,7 +28424,7 @@ async function writeDocument(id2, data) {
       );
     }
     await mkdir3(dirname5(id2), { recursive: true });
-    await writeFile3(tempPath, JSON.stringify(data, null, 2), "utf-8");
+    await writeFile2(tempPath, JSON.stringify(data, null, 2), "utf-8");
     await rename2(tempPath, id2);
   } catch (e) {
     if (e instanceof ProjectFileError) throw e;
@@ -29109,7 +29473,7 @@ function previewRuleAction(operation, url) {
 }
 
 // packages/cli/src/mock-root-config.ts
-import { mkdir as mkdir4, readFile as readFile4, realpath as realpath3, rename as rename3, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile4, realpath as realpath3, rename as rename3, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname as dirname8, isAbsolute as isAbsolute4, join as join8, resolve as resolve4 } from "node:path";
 function mockRootConfigPath(env = process.env) {
@@ -29155,7 +29519,7 @@ async function writeMap(map, env) {
   const path2 = mockRootConfigPath(env);
   await mkdir4(dirname8(path2), { recursive: true });
   const temporary = `${path2}.${process.pid}.tmp`;
-  await writeFile4(
+  await writeFile3(
     temporary,
     `${JSON.stringify({ projects: map }, null, 2)}
 `,
@@ -32524,7 +32888,7 @@ function errorMessage(error) {
 }
 
 // packages/cli/src/commands/runtime.ts
-import { chmod, mkdir as mkdir5, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
+import { chmod, mkdir as mkdir5, rm as rm3, writeFile as writeFile4 } from "node:fs/promises";
 import { dirname as dirname10, join as join9, resolve as resolve8 } from "node:path";
 function generateHostWrapper(rogatioCommand, logPath) {
   const parts = rogatioCommand.split(" ");
@@ -32545,7 +32909,7 @@ async function writeHostWrapper(hostPath, installRoot) {
     `${process.execPath} ${process.argv[1] ?? "rogatio"}`,
     logPath
   );
-  await writeFile5(hostPath, script, "utf8");
+  await writeFile4(hostPath, script, "utf8");
   await chmod(hostPath, 493);
 }
 function makeTrustController() {
@@ -32635,11 +32999,11 @@ Note: reload the extension at chrome://extensions for the native host to be dete
     case "uninstall": {
       const uninstallResult = await controller.uninstall();
       try {
-        await rm2(hostPath, { force: true });
+        await rm3(hostPath, { force: true });
       } catch {
       }
       try {
-        await rm2(join9(installRoot, "runtime-host.log"), { force: true });
+        await rm3(join9(installRoot, "runtime-host.log"), { force: true });
       } catch {
       }
       return reportTrust(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.16.0",
+  "version": "6.16.1",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",
@@ -48,8 +48,8 @@
     "@rogatio/requestly-import": "workspace:*",
     "@rogatio/runtime": "workspace:*",
     "@rogatio/schema": "workspace:*",
-    "@types/node": "26.6.3",
+    "@types/node": "26.6.4",
     "typescript": "7.0.2",
-    "vitest": "5.0.2"
+    "vitest": "5.0.3"
   }
 }