@rogatio/cli 6.16.3 → 6.16.5

package/dist/editor/index.js

@@ -531,7 +531,11 @@ function createAIAssistPanel(_container, _editor, onApply, onClose, onSend) {
       `;
       const addDetail = (label, value) => {
         const detail = document.createElement("div");
-        detail.innerHTML = `<span style="color:#666;">${label}:</span> ${value}`;
+        const labelEl = document.createElement("span");
+        labelEl.style.color = "#666";
+        labelEl.textContent = `${label}:`;
+        detail.appendChild(labelEl);
+        detail.appendChild(document.createTextNode(` ${value}`));
         ruleDetails.appendChild(detail);
       };
       if (rule.source) {

package/dist/node/index.js

@@ -2200,19 +2200,21 @@ function compileProject(value) {
     };
   }
 }
-function sourceMatches(source, url) {
-  const regex = compileUrlRegex(source.value);
-  if (regex === null) return false;
-  if (source.key === "url") {
-    return regex.test(url);
-  }
+function sourceMatchText(source, url) {
+  if (source.key === "url") return url;
   try {
-    const hostname = new URL(url).hostname;
-    return regex.test(hostname);
+    return new URL(url).hostname;
   } catch {
-    return false;
+    return null;
   }
 }
+function sourceMatches(source, url) {
+  const regex = compileUrlRegex(source.value);
+  if (regex === null) return false;
+  const text = sourceMatchText(source, url);
+  if (text === null) return false;
+  return regex.test(text);
+}
 var PAC_STEER_MARKER = "steer:";
 function decodePacSteer(entry) {
   if (!entry.startsWith(PAC_STEER_MARKER)) return null;
@@ -20073,7 +20075,7 @@ var require_x509_cjs = __commonJS({
     var _X509Certificate_signature;
     var _X509Certificate_extensions;
     var _X509Certificate_publicKey;
-    var X509Certificate5 = class extends PemData {
+    var X509Certificate4 = class extends PemData {
       get publicKey() {
         if (!tslib.__classPrivateFieldGet(this, _X509Certificate_publicKey, "f")) {
           tslib.__classPrivateFieldSet(this, _X509Certificate_publicKey, new PublicKey(this.asn.tbsCertificate.subjectPublicKeyInfo, this.parseOptions), "f");
@@ -20316,7 +20318,7 @@ var require_x509_cjs = __commonJS({
       }
     };
     _X509Certificate_tbs = /* @__PURE__ */ new WeakMap(), _X509Certificate_serialNumber = /* @__PURE__ */ new WeakMap(), _X509Certificate_subjectName = /* @__PURE__ */ new WeakMap(), _X509Certificate_subject = /* @__PURE__ */ new WeakMap(), _X509Certificate_issuerName = /* @__PURE__ */ new WeakMap(), _X509Certificate_issuer = /* @__PURE__ */ new WeakMap(), _X509Certificate_notBefore = /* @__PURE__ */ new WeakMap(), _X509Certificate_notAfter = /* @__PURE__ */ new WeakMap(), _X509Certificate_signatureAlgorithm = /* @__PURE__ */ new WeakMap(), _X509Certificate_signature = /* @__PURE__ */ new WeakMap(), _X509Certificate_extensions = /* @__PURE__ */ new WeakMap(), _X509Certificate_publicKey = /* @__PURE__ */ new WeakMap();
-    X509Certificate5.NAME = "Certificate";
+    X509Certificate4.NAME = "Certificate";
     var _X509Certificates_options;
     var X509Certificates = class extends Array {
       constructor(param, options) {
@@ -20324,7 +20326,7 @@ var require_x509_cjs = __commonJS({
         _X509Certificates_options.set(this, void 0);
         if (PemData.isAsnEncoded(param)) {
           this.import(param, options);
-        } else if (param instanceof X509Certificate5) {
+        } else if (param instanceof X509Certificate4) {
           this.push(param);
         } else if (Array.isArray(param)) {
           for (const item of param) {
@@ -20362,7 +20364,7 @@ var require_x509_cjs = __commonJS({
         const certificates = [];
         for (const item of signedData.certificates || []) {
           if (item.certificate) {
-            certificates.push(new X509Certificate5(item.certificate, options));
+            certificates.push(new X509Certificate4(item.certificate, options));
           }
         }
         this.clear();
@@ -20554,7 +20556,7 @@ var require_x509_cjs = __commonJS({
           throw Error("Cannot convert ASN.1 signature value to WebCrypto format");
         }
         asnX509.signatureValue = asnSignature;
-        return new X509Certificate5(asn1Schema.AsnConvert.serialize(asnX509));
+        return new X509Certificate4(asn1Schema.AsnConvert.serialize(asnX509));
       }
     };
     var _X509CrlEntry_serialNumber;
@@ -20775,7 +20777,7 @@ var require_x509_cjs = __commonJS({
         let publicKey;
         const paramsKey = params.publicKey;
         try {
-          if (paramsKey instanceof X509Certificate5) {
+          if (paramsKey instanceof X509Certificate4) {
             keyAlgorithm = {
               ...paramsKey.publicKey.algorithm,
               ...paramsKey.signatureAlgorithm
@@ -20979,7 +20981,7 @@ var require_x509_cjs = __commonJS({
     exports.TextObject = TextObject;
     exports.UPN = UPN;
     exports.URL = URL2;
-    exports.X509Certificate = X509Certificate5;
+    exports.X509Certificate = X509Certificate4;
     exports.X509CertificateGenerator = X509CertificateGenerator2;
     exports.X509Certificates = X509Certificates;
     exports.X509ChainBuilder = X509ChainBuilder;
@@ -24419,34 +24421,6 @@ async function resolveConfinedRoot(value) {
     await directory?.close().catch(() => void 0);
   }
 }
-var MOCK_LISTENER_PREFIX = "/.rogatio/mock/";
-function isSingleSegment(value) {
-  return value.length > 0 && value.length <= 2048 && value !== "." && value !== ".." && !value.includes("/") && !value.includes("\\") && !value.includes("?") && !hasControl(value);
-}
-function parseMockRedirect(rawUrl) {
-  const queryAt = rawUrl.indexOf("?");
-  const path2 = queryAt === -1 ? rawUrl : rawUrl.slice(0, queryAt);
-  if (!path2.startsWith(MOCK_LISTENER_PREFIX)) return null;
-  const rest = path2.slice(MOCK_LISTENER_PREFIX.length);
-  const slash = rest.indexOf("/");
-  if (slash <= 0) return null;
-  if (rest.indexOf("/", slash + 1) !== -1) return null;
-  let token;
-  let digest;
-  try {
-    token = decodeURIComponent(rest.slice(0, slash));
-    digest = decodeURIComponent(rest.slice(slash + 1));
-  } catch {
-    return null;
-  }
-  if (!isSingleSegment(token) || !isSingleSegment(digest)) return null;
-  return { token, digest };
-}
-function supportedContentType(value) {
-  if (value === void 0) return false;
-  const mediaType = value.split(";", 1)[0]?.trim().toLowerCase() ?? "";
-  return mediaType === "application/json" || mediaType.startsWith("application/") && mediaType.endsWith("+json") || mediaType === "application/x-www-form-urlencoded" || mediaType.startsWith("text/");
-}
 var REGEX_WORKER_SOURCE = `
 const workerThreads =
   typeof process.getBuiltinModule === "function"
@@ -24455,11 +24429,35 @@ const workerThreads =
 const { parentPort } = workerThreads;
 parentPort.postMessage({ type: "ready" });
 parentPort.on("message", (msg) => {
-  if (msg.type !== "replace") return;
+  if (msg.type !== "replace" && msg.type !== "test" && msg.type !== "exec") return;
   parentPort.postMessage({ id: msg.id, type: "ack" });
   try {
-    const out = msg.text.replace(new RegExp(msg.pattern, "gu"), msg.replacement);
-    parentPort.postMessage({ id: msg.id, type: "result", ok: true, out });
+    if (msg.type === "replace") {
+      const out = msg.text.replace(new RegExp(msg.pattern, "gu"), msg.replacement);
+      parentPort.postMessage({ id: msg.id, type: "result", ok: true, out });
+      return;
+    }
+    const regex = new RegExp(msg.pattern);
+    if (msg.type === "test") {
+      parentPort.postMessage({
+        id: msg.id,
+        type: "result",
+        ok: true,
+        matched: regex.test(msg.text),
+      });
+      return;
+    }
+    const match = regex.exec(msg.text);
+    const captures =
+      match === null
+        ? null
+        : match.slice(1).map((part) => (part === undefined ? null : part));
+    parentPort.postMessage({
+      id: msg.id,
+      type: "result",
+      ok: true,
+      captures,
+    });
   } catch (err) {
     parentPort.postMessage({
       id: msg.id,
@@ -24475,6 +24473,7 @@ var regexWorker = null;
 var regexWorkerBoot = null;
 var nextRegexJobId = 1;
 var regexWorkerBootDelayForTestsMs = 0;
+var failNextRegexWorkerBootForTests = false;
 function discardRegexWorker(worker) {
   if (regexWorker === worker) {
     regexWorker = null;
@@ -24484,6 +24483,10 @@ function discardRegexWorker(worker) {
   });
 }
 function bootRegexWorker() {
+  if (failNextRegexWorkerBootForTests) {
+    failNextRegexWorkerBootForTests = false;
+    return Promise.reject(new Error("regex-worker-boot-failed"));
+  }
   if (regexWorker !== null) return Promise.resolve(regexWorker);
   if (regexWorkerBoot !== null) return regexWorkerBoot;
   const boot = new Promise((resolve12, reject) => {
@@ -24551,7 +24554,7 @@ function bootRegexWorker() {
   });
   return boot;
 }
-function runOnRegexWorker(worker, id2, text, pattern, replacement, deadlineMs) {
+function runOnRegexWorker(worker, id2, type, text, pattern, replacement, deadlineMs) {
   return new Promise((resolve12, reject) => {
     let timer = null;
     const cleanup = () => {
@@ -24572,8 +24575,15 @@ function runOnRegexWorker(worker, id2, text, pattern, replacement, deadlineMs) {
       }
       if (msg.type === "result") {
         cleanup();
-        if (msg.ok && typeof msg.out === "string") resolve12(msg.out);
-        else reject(new Error(msg.error || "regex-invalid"));
+        if (!msg.ok) {
+          reject(new Error(msg.error || "regex-invalid"));
+          return;
+        }
+        resolve12({
+          ...typeof msg.out === "string" ? { out: msg.out } : {},
+          ...typeof msg.matched === "boolean" ? { matched: msg.matched } : {},
+          ...msg.captures !== void 0 ? { captures: msg.captures } : {}
+        });
       }
     };
     const onError = (error) => {
@@ -24587,23 +24597,114 @@ function runOnRegexWorker(worker, id2, text, pattern, replacement, deadlineMs) {
     worker.on("message", onMessage);
     worker.once("error", onError);
     worker.once("exit", onExit);
-    worker.postMessage({ id: id2, type: "replace", text, pattern, replacement });
+    worker.postMessage({
+      id: id2,
+      type,
+      text,
+      pattern,
+      ...replacement !== void 0 ? { replacement } : {}
+    });
   });
 }
-function runRegexReplace(text, pattern, replacement, deadlineMs) {
+function nextJobId() {
   const id2 = nextRegexJobId;
   nextRegexJobId += 1;
+  return id2;
+}
+function runRegexReplace(text, pattern, replacement, deadlineMs) {
+  const id2 = nextJobId();
   return bootRegexWorker().then(
-    (worker) => runOnRegexWorker(worker, id2, text, pattern, replacement, deadlineMs),
-    () => {
-      try {
-        return text.replace(new RegExp(pattern, "gu"), replacement);
-      } catch {
-        throw new Error("regex-invalid");
-      }
-    }
+    (worker) => runOnRegexWorker(
+      worker,
+      id2,
+      "replace",
+      text,
+      pattern,
+      replacement,
+      deadlineMs
+    ).then((result) => {
+      if (typeof result.out !== "string") throw new Error("regex-invalid");
+      return result.out;
+    })
+  );
+}
+function capturesFromWorker(captures) {
+  if (captures === null || captures === void 0) return null;
+  return captures.map((part) => part === null ? void 0 : part);
+}
+function runRegexTest(text, pattern, deadlineMs) {
+  const id2 = nextJobId();
+  return bootRegexWorker().then(
+    (worker) => runOnRegexWorker(
+      worker,
+      id2,
+      "test",
+      text,
+      pattern,
+      void 0,
+      deadlineMs
+    ).then(
+      (result) => result.matched === true,
+      () => false
+    ),
+    () => false
   );
 }
+function runRegexExec(text, pattern, deadlineMs) {
+  const id2 = nextJobId();
+  return bootRegexWorker().then(
+    (worker) => runOnRegexWorker(
+      worker,
+      id2,
+      "exec",
+      text,
+      pattern,
+      void 0,
+      deadlineMs
+    ).then(
+      (result) => capturesFromWorker(result.captures),
+      () => null
+    ),
+    () => null
+  );
+}
+async function sourceMatchesWithinDeadline(source, url) {
+  if (compileUrlRegex(source.value) === null) return false;
+  const text = sourceMatchText(source, url);
+  if (text === null) return false;
+  return runRegexTest(text, source.value, RUNTIME_LIMITS.maxRegexDeadlineMs);
+}
+function matchUrlCapturesWithinDeadline(urlRegex, url) {
+  return runRegexExec(url, urlRegex, RUNTIME_LIMITS.maxRegexDeadlineMs);
+}
+var MOCK_LISTENER_PREFIX = "/.rogatio/mock/";
+function isSingleSegment(value) {
+  return value.length > 0 && value.length <= 2048 && value !== "." && value !== ".." && !value.includes("/") && !value.includes("\\") && !value.includes("?") && !hasControl(value);
+}
+function parseMockRedirect(rawUrl) {
+  const queryAt = rawUrl.indexOf("?");
+  const path2 = queryAt === -1 ? rawUrl : rawUrl.slice(0, queryAt);
+  if (!path2.startsWith(MOCK_LISTENER_PREFIX)) return null;
+  const rest = path2.slice(MOCK_LISTENER_PREFIX.length);
+  const slash = rest.indexOf("/");
+  if (slash <= 0) return null;
+  if (rest.indexOf("/", slash + 1) !== -1) return null;
+  let token;
+  let digest;
+  try {
+    token = decodeURIComponent(rest.slice(0, slash));
+    digest = decodeURIComponent(rest.slice(slash + 1));
+  } catch {
+    return null;
+  }
+  if (!isSingleSegment(token) || !isSingleSegment(digest)) return null;
+  return { token, digest };
+}
+function supportedContentType(value) {
+  if (value === void 0) return false;
+  const mediaType = value.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+  return mediaType === "application/json" || mediaType.startsWith("application/") && mediaType.endsWith("+json") || mediaType === "application/x-www-form-urlencoded" || mediaType.startsWith("text/");
+}
 async function rewriteRequestBody(input, action, captureContext) {
   if (!supportedContentType(input.contentType)) {
     return failure("runtime.request-body-unsupported-mime-type");
@@ -24630,7 +24731,7 @@ async function rewriteRequestBody(input, action, captureContext) {
     }
     outputText = action.body;
     if (captureContext !== void 0) {
-      const captures = matchUrlCaptures(
+      const captures = await matchUrlCapturesWithinDeadline(
         captureContext.urlRegex,
         captureContext.url
       );
@@ -24870,7 +24971,7 @@ async function rewriteResponseBody(input, replacements, replaceAction, captureCo
     if (captureContext === void 0) {
       text = replaceAction.body;
     } else {
-      const captures = matchUrlCaptures(
+      const captures = await matchUrlCapturesWithinDeadline(
         captureContext.urlRegex,
         captureContext.url
       );
@@ -24882,8 +24983,12 @@ async function rewriteResponseBody(input, replacements, replaceAction, captureCo
     for (const entry of replacements) {
       if (entry.pattern.length === 0 || entry.pattern.length > LIMITS.maxResponseBodyPatternLength || entry.replacement.length > LIMITS.maxResponseBodyReplacementLength)
         return failure("runtime.size-limit");
-      const regex = new RegExp(entry.pattern, "gu");
-      text = text.replace(regex, entry.replacement);
+      text = await runRegexReplace(
+        text,
+        entry.pattern,
+        entry.replacement,
+        RUNTIME_LIMITS.maxRegexDeadlineMs
+      );
       if (new TextEncoder().encode(text).byteLength > RUNTIME_LIMITS.maxResponseBodyBytes)
         return failure("runtime.size-limit");
     }
@@ -24898,8 +25003,11 @@ async function rewriteResponseBody(input, replacements, replaceAction, captureCo
     }
   };
 }
-function replaceResponseBody(body, contentType, captureContext) {
-  const captures = captureContext === void 0 ? [] : matchUrlCaptures(captureContext.urlRegex, captureContext.url);
+async function replaceResponseBody(body, contentType, captureContext) {
+  const captures = captureContext === void 0 ? [] : await matchUrlCapturesWithinDeadline(
+    captureContext.urlRegex,
+    captureContext.url
+  );
   if (captureContext !== void 0 && captures === null) {
     return failure("runtime.url-capture-mismatch");
   }
@@ -24921,7 +25029,7 @@ async function fetchAndRewriteAuthorizedResponse(operation, action, options = {}
   const response = await fetchAuthorized(operation, options);
   if (!response.ok) return response;
   const contentType = responseHeader(response.value.headers, "content-type");
-  const transformed = isReplaceAction(action) ? replaceResponseBody(
+  const transformed = isReplaceAction(action) ? await replaceResponseBody(
     action.body,
     contentType,
     operation.sourceValue === void 0 ? void 0 : { url: operation.target, urlRegex: operation.sourceValue }
@@ -24991,7 +25099,7 @@ function projectHasRule(project, groupId, ruleId) {
 function isBodyOperation(operation) {
   return operation.kind === "request-body" || operation.kind === "response-body";
 }
-function revalidateAuthority(project, operations, request) {
+async function revalidateAuthority(project, operations, request) {
   const projectSnap = snapshotOwnData3(project);
   if (!projectSnap.valid) return { allowed: false, reason: "project-invalid" };
   const opsSnap = snapshotOwnData3(operations);
@@ -25012,7 +25120,7 @@ function revalidateAuthority(project, operations, request) {
     return { allowed: false, reason: "project-inconsistent" };
   }
   const matcher = operation.matcher;
-  if (!sourceMatches(matcher.source, request.url)) {
+  if (!await sourceMatchesWithinDeadline(matcher.source, request.url)) {
     return { allowed: false, reason: "url-mismatch" };
   }
   const requestOrigin = originOf(request.url);
@@ -25052,18 +25160,19 @@ function revalidateAuthority(project, operations, request) {
 function isBodyOp(op) {
   return op.kind === "request-body" || op.kind === "response-body";
 }
-function matcherMatches(op, url, method) {
-  if (!sourceMatches(op.matcher.source, url)) return false;
+async function matcherMatches(op, url, method) {
+  if (!await sourceMatchesWithinDeadline(op.matcher.source, url))
+    return false;
   if (op.matcher.method !== void 0 && op.matcher.method !== method.toUpperCase()) {
     return false;
   }
   return true;
 }
-function pickHighest(operations, kind, url, method) {
+async function pickHighest(operations, kind, url, method) {
   let best = null;
   for (const op of operations) {
     if (!isBodyOp(op) || op.kind !== kind) continue;
-    if (!matcherMatches(op, url, method)) continue;
+    if (!await matcherMatches(op, url, method)) continue;
     if (best === null || op.matcher.priority > best.matcher.priority || op.matcher.priority === best.matcher.priority && op.ruleId.localeCompare(best.ruleId) < 0) {
       best = op;
     }
@@ -25432,17 +25541,21 @@ function initiatorFromHeaders(headers, targetUrl) {
     return void 0;
   }
 }
-function authorizeOp(policy, op, url, method, headers) {
+async function authorizeOp(policy, op, url, method, headers) {
   const resourceType = op.matcher.resourceTypes[0];
   const initiator = initiatorFromHeaders(headers, url);
-  const decision = revalidateAuthority(policy.project, policy.operations, {
-    groupId: op.groupId,
-    ruleId: op.ruleId,
-    url,
-    method,
-    ...initiator !== void 0 ? { initiator } : {},
-    ...resourceType !== void 0 ? { resourceType } : {}
-  });
+  const decision = await revalidateAuthority(
+    policy.project,
+    policy.operations,
+    {
+      groupId: op.groupId,
+      ruleId: op.ruleId,
+      url,
+      method,
+      ...initiator !== void 0 ? { initiator } : {},
+      ...resourceType !== void 0 ? { resourceType } : {}
+    }
+  );
   return decision.allowed;
 }
 async function startInterceptProxy(options = {}) {
@@ -25490,13 +25603,13 @@ async function startInterceptProxy(options = {}) {
       }
       const method = (req.method ?? "GET").toUpperCase();
       const active = policy;
-      const requestOp = active === null ? null : pickHighest(
+      const requestOp = active === null ? null : await pickHighest(
         active.operations,
         "request-body",
         targetUrl,
         method
       );
-      const responseOp = active === null ? null : pickHighest(
+      const responseOp = active === null ? null : await pickHighest(
         active.operations,
         "response-body",
         targetUrl,
@@ -25516,7 +25629,13 @@ async function startInterceptProxy(options = {}) {
       }
       let requestBody = bodyResult.body;
       if (needsRequestBody && requestOp !== null && active !== null) {
-        if (!authorizeOp(active, requestOp, targetUrl, method, req.headers)) {
+        if (!await authorizeOp(
+          active,
+          requestOp,
+          targetUrl,
+          method,
+          req.headers
+        )) {
         } else {
           const rewritten = await rewriteRequestBody(
             {
@@ -25565,7 +25684,13 @@ async function startInterceptProxy(options = {}) {
       let responseBody = upstream.body;
       if (responseOp !== null && active !== null) {
         if (responseBody.byteLength > RUNTIME_LIMITS.maxResponseBodyBytes) {
-        } else if (!authorizeOp(active, responseOp, targetUrl, method, req.headers)) {
+        } else if (!await authorizeOp(
+          active,
+          responseOp,
+          targetUrl,
+          method,
+          req.headers
+        )) {
         } else {
           const action = responseOp.responseBody;
           const isReplace = "mode" in action && action.mode === "replace";
@@ -25689,7 +25814,10 @@ async function startInterceptProxy(options = {}) {
     const operation = active.operations.find(
       (op) => op.kind === "response-body" && op.ruleId === parsed.ruleId
     );
-    if (operation === void 0 || !sourceMatches(operation.matcher.source, parsed.originalUrl)) {
+    if (operation === void 0 || !await sourceMatchesWithinDeadline(
+      operation.matcher.source,
+      parsed.originalUrl
+    )) {
       res.writeHead(404);
       res.end();
       return;
@@ -25705,15 +25833,19 @@ async function startInterceptProxy(options = {}) {
       res.end();
       return;
     }
-    const allowed = revalidateAuthority(active.project, active.operations, {
-      groupId: operation.groupId,
-      ruleId: operation.ruleId,
-      url: parsed.originalUrl,
-      target,
-      method: "GET",
-      initiator: initiatorFromHeaders(req.headers, parsed.originalUrl) ?? new URL(target).origin,
-      resourceType: operation.matcher.resourceTypes[0]
-    });
+    const allowed = await revalidateAuthority(
+      active.project,
+      active.operations,
+      {
+        groupId: operation.groupId,
+        ruleId: operation.ruleId,
+        url: parsed.originalUrl,
+        target,
+        method: "GET",
+        initiator: initiatorFromHeaders(req.headers, parsed.originalUrl) ?? new URL(target).origin,
+        resourceType: operation.matcher.resourceTypes[0]
+      }
+    );
     if (!allowed.allowed) {
       res.writeHead(403);
       res.end();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.16.3",
+  "version": "6.16.5",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",