@rogatio/cli 6.16.1 → 6.16.2

package/dist/node/index.js

@@ -22681,6 +22681,18 @@ async function readPreviousRogatioCa(caCertFile) {
     return void 0;
   }
 }
+async function assertReadableIfRegular(path2, snapshot2) {
+  if (snapshot2 !== void 0) return;
+  try {
+    const info = await lstat(path2);
+    if (!info.isFile()) return;
+  } catch {
+    return;
+  }
+  throw new TrustError("trust.write-failed", "CA file could not be read", [
+    "trust.write-failed"
+  ]);
+}
 async function discardPreviousCa(caPreviousCertFile) {
   try {
     await rm(caPreviousCertFile, { force: true });
@@ -22732,6 +22744,9 @@ function createRequestBodyTrustController(options = {}) {
   let reusedExisting = false;
   let previousKeyPem;
   let previousPubPem;
+  let replacedKey = false;
+  let replacedPub = false;
+  let replacedCert = false;
   const caCertFile = join2(
     installRoot,
     options.caCertFileName ?? ".rogatio-ca.crt"
@@ -22838,32 +22853,35 @@ function createRequestBodyTrustController(options = {}) {
       console.error("[rogatio] previous CA trust anchor was not removed");
     }
   }
-  async function removeLiveCaFiles() {
-    await rm(caKeyFile, { force: true });
-    await rm(caPubFile, { force: true });
-    await rm(caCertFile, { force: true });
+  async function removeReplacedCaFiles() {
+    if (replacedKey) await rm(caKeyFile, { force: true });
+    if (replacedPub) await rm(caPubFile, { force: true });
+    if (replacedCert) await rm(caCertFile, { force: true });
+  }
+  async function restoreOrDrop(path2, snapshot2, replaced, mode) {
+    if (snapshot2 !== void 0) {
+      await writeFileAtomic(path2, snapshot2, mode);
+      return;
+    }
+    if (replaced) await rm(path2, { force: true });
   }
   async function rollbackReplacedCa() {
     if (reusedExisting) return;
     if (!replacingPrevious) {
-      await removeLiveCaFiles();
+      await removeReplacedCaFiles();
       return;
     }
     const saved = await readPreviousRogatioCa(caPreviousCertFile);
     const live = await readPreviousRogatioCa(caCertFile);
     const copyKept = rememberedFingerprint !== void 0 && saved?.fingerprint === rememberedFingerprint;
     const liveDiffers = live?.fingerprint !== rememberedFingerprint;
-    if (copyKept && liveDiffers) {
-      await removeLiveCaFiles();
+    if (copyKept && replacedCert && liveDiffers) {
+      await removeReplacedCaFiles();
       return;
     }
-    if (copyKept && !liveDiffers) {
-      if (previousKeyPem !== void 0) {
-        await writeFileAtomic(caKeyFile, previousKeyPem, 384);
-      }
-      if (previousPubPem !== void 0) {
-        await writeFileAtomic(caPubFile, previousPubPem);
-      }
+    if (copyKept && !replacedCert) {
+      await restoreOrDrop(caKeyFile, previousKeyPem, replacedKey, 384);
+      await restoreOrDrop(caPubFile, previousPubPem, replacedPub);
     }
   }
   async function runCaTrust() {
@@ -22881,12 +22899,21 @@ function createRequestBodyTrustController(options = {}) {
     reusedExisting = false;
     previousKeyPem = void 0;
     previousPubPem = void 0;
+    replacedKey = false;
+    replacedPub = false;
+    replacedCert = false;
     const reusable = await reusableCaMaterial();
     reusedExisting = reusable;
     const liveAnchor = await readPreviousRogatioCa(caCertFile);
     const siblingAnchor = await readPreviousRogatioCa(caPreviousCertFile);
     let preserved;
     if (!reusable) {
+      const rawCert = await readNoFollowRegularFile(caCertFile);
+      previousKeyPem = await readNoFollowRegularFile(caKeyFile);
+      previousPubPem = await readNoFollowRegularFile(caPubFile);
+      await assertReadableIfRegular(caCertFile, rawCert);
+      await assertReadableIfRegular(caKeyFile, previousKeyPem);
+      await assertReadableIfRegular(caPubFile, previousPubPem);
       replacingPrevious = liveAnchor !== void 0 || siblingAnchor !== void 0;
       const { privateKey } = generateCaKeyPair(TRUST_LIMITS.caKeyBits);
       const certResult = await createCertificate(
@@ -22914,11 +22941,12 @@ function createRequestBodyTrustController(options = {}) {
       } else if (siblingAnchor) {
         await discardPreviousCa(caPreviousCertFile);
       }
-      previousKeyPem = await readNoFollowRegularFile(caKeyFile);
-      previousPubPem = await readNoFollowRegularFile(caPubFile);
       await writeFileAtomic(caKeyFile, certResult.keyPem, 384);
+      replacedKey = true;
       await writeFileAtomic(caPubFile, certResult.certPem);
+      replacedPub = true;
       await writeFileAtomic(caCertFile, certResult.certPem);
+      replacedCert = true;
     }
     let installedNew = false;
     if (caTrustInstaller && !installerCalled) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.16.1",
+  "version": "6.16.2",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",