@rogatio/cli 6.16.4 → 6.17.0

package/dist/node/index.d.ts

@@ -0,0 +1 @@
+export declare function cli(args?: string[]): Promise<number>;

package/dist/node/index.js

@@ -2200,19 +2200,21 @@ function compileProject(value) {
     };
   }
 }
-function sourceMatches(source, url) {
-  const regex = compileUrlRegex(source.value);
-  if (regex === null) return false;
-  if (source.key === "url") {
-    return regex.test(url);
-  }
+function sourceMatchText(source, url) {
+  if (source.key === "url") return url;
   try {
-    const hostname = new URL(url).hostname;
-    return regex.test(hostname);
+    return new URL(url).hostname;
   } catch {
-    return false;
+    return null;
   }
 }
+function sourceMatches(source, url) {
+  const regex = compileUrlRegex(source.value);
+  if (regex === null) return false;
+  const text = sourceMatchText(source, url);
+  if (text === null) return false;
+  return regex.test(text);
+}
 var PAC_STEER_MARKER = "steer:";
 function decodePacSteer(entry) {
   if (!entry.startsWith(PAC_STEER_MARKER)) return null;
@@ -22596,6 +22598,15 @@ function defaultTrustInstallRoot(platform) {
   }
   return join2(process.env.HOME ?? "", ".local", "share", "rogatio");
 }
+var MANIFEST_DIR_RECORD = "native-messaging-dirs.json";
+function isSafeManifestDir(dir) {
+  if (!isAbsolute2(dir) || dir.includes("\0")) return false;
+  const parts = dir.split(/[\\/]/).filter((part) => part.length > 0);
+  if (parts.includes("..") || parts.length < 2) return false;
+  const browser = parts[parts.length - 2];
+  const leaf = parts[parts.length - 1];
+  return leaf === "NativeMessagingHosts" && (browser === "google-chrome" || browser === "chromium");
+}
 function isWellFormedManifest(value) {
   if (typeof value !== "object" || value === null) return false;
   const m = value;
@@ -22752,12 +22763,110 @@ function createRequestBodyTrustController(options = {}) {
     installRoot,
     options.caCertFileName ?? ".rogatio-ca.crt"
   );
+  const storePendingPath = join2(
+    dirname2(caKeyFile),
+    ".rogatio-ca-store-pending"
+  );
   const caPreviousCertFile = join2(
     dirname2(caCertFile),
     ".rogatio-ca.previous.crt"
   );
-  const manifestPath = () => join2(manifestDir, `${hostName}.json`);
+  const configuredManifestDirs = options.manifestDirs && options.manifestDirs.length > 0 ? [...options.manifestDirs] : [manifestDir];
+  const recordsManifestDirs = options.manifestDirs !== void 0 && options.manifestDirs.length > 0;
+  const manifestRecordPath = join2(installRoot, MANIFEST_DIR_RECORD);
   let installerCalled = false;
+  function parseRecordedDirs(raw) {
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return void 0;
+    }
+    if (!Array.isArray(parsed) || parsed.length === 0 || parsed.length > 8) {
+      return void 0;
+    }
+    const dirs = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const entry of parsed) {
+      if (typeof entry !== "string" || seen.has(entry) || !isSafeManifestDir(entry)) {
+        return void 0;
+      }
+      seen.add(entry);
+      dirs.push(entry);
+    }
+    return dirs;
+  }
+  async function readRecordedDirs() {
+    if (!recordsManifestDirs) return void 0;
+    try {
+      return parseRecordedDirs(await readFile2(manifestRecordPath, "utf8"));
+    } catch {
+      return void 0;
+    }
+  }
+  async function activeManifestDirs() {
+    const recorded = await readRecordedDirs();
+    if (recorded) return recorded;
+    if (!recordsManifestDirs) return configuredManifestDirs;
+    const present = [];
+    for (const dir of configuredManifestDirs) {
+      if (await existsFile(join2(dir, `${hostName}.json`))) present.push(dir);
+    }
+    return present.length > 0 ? present : configuredManifestDirs;
+  }
+  async function snapshotFile(path2) {
+    let previous;
+    try {
+      previous = await readFile2(path2, "utf8");
+    } catch {
+      previous = void 0;
+    }
+    return { path: path2, previous, written: false };
+  }
+  async function restoreSnapshot(snap) {
+    if (!snap.written) return;
+    if (snap.previous !== void 0) {
+      await writeFileAtomic(snap.path, snap.previous);
+      return;
+    }
+    await rm(snap.path, { force: true });
+  }
+  async function rollbackWritten(snaps) {
+    for (const snap of snaps) {
+      try {
+        await restoreSnapshot(snap);
+      } catch {
+      }
+    }
+  }
+  async function writeManifestFiles(data) {
+    const snaps = [];
+    try {
+      for (const dir of configuredManifestDirs) {
+        if (recordsManifestDirs && !isSafeManifestDir(dir)) {
+          throw new Error("trust.write-failed");
+        }
+        const snap = await snapshotFile(join2(dir, `${hostName}.json`));
+        snaps.push(snap);
+        await writeFileAtomic(snap.path, data);
+        snap.written = true;
+      }
+      if (recordsManifestDirs) {
+        const recordSnap = await snapshotFile(manifestRecordPath);
+        snaps.push(recordSnap);
+        await writeFileAtomic(
+          manifestRecordPath,
+          `${JSON.stringify(configuredManifestDirs)}
+`
+        );
+        recordSnap.written = true;
+      }
+      return { ok: true, snaps };
+    } catch (error) {
+      await rollbackWritten(snaps);
+      return { ok: false, reason: codeOf(error, "trust.write-failed") };
+    }
+  }
   async function install(extensionId) {
     if (!extensionId || !/^[a-p]{32}$/.test(extensionId)) {
       return {
@@ -22792,21 +22901,17 @@ function createRequestBodyTrustController(options = {}) {
     }
     const caps = await detect();
     if (!caps.manifest) return unsupportedResult(caps);
-    try {
-      await writeFileAtomic(manifestPath(), data);
-    } catch (error) {
+    const written = await writeManifestFiles(data);
+    if (!written.ok) {
       return {
         ok: false,
         state: "unsupported",
-        reasons: [codeOf(error, "trust.write-failed")]
+        reasons: [written.reason]
       };
     }
     const caTrustCaps = await detect();
     if (!caTrustCaps.caTrust) {
-      try {
-        await rm(manifestPath(), { force: true });
-      } catch {
-      }
+      await rollbackWritten(written.snaps);
       return unsupportedResult(caTrustCaps);
     }
     const trustResult = await trust();
@@ -22815,13 +22920,11 @@ function createRequestBodyTrustController(options = {}) {
         await rollbackReplacedCa();
       } catch {
       }
-      try {
-        await rm(manifestPath(), { force: true });
-      } catch {
-      }
+      await rollbackWritten(written.snaps);
       installerCalled = false;
       return trustResult;
     }
+    await rm(storePendingPath, { force: true });
     return trustResult.reasons ? { ok: true, state: "installed", reasons: trustResult.reasons } : { ok: true, state: "installed" };
   }
   async function reusableCaMaterial() {
@@ -22951,8 +23054,8 @@ function createRequestBodyTrustController(options = {}) {
     }
     let installedNew = false;
     if (caTrustInstaller && !installerCalled) {
-      await caTrustInstaller(await readFile2(caCertFile, "utf8"));
       installerCalled = true;
+      await caTrustInstaller(await readFile2(caCertFile, "utf8"));
       installedNew = true;
     }
     if (reusable && siblingAnchor && (installedNew || !caTrustInstaller)) {
@@ -22977,11 +23080,15 @@ function createRequestBodyTrustController(options = {}) {
     const saved = await readPreviousRogatioCa(caPreviousCertFile);
     const live = await readPreviousRogatioCa(caCertFile);
     const caWasPresent = await existsFile(caKeyFile);
+    if (caWasPresent && caTrustRemover) {
+      await writeFileAtomic(storePendingPath, "1\n", 384);
+    }
     await rm(caKeyFile, { force: true });
     await rm(caPubFile, { force: true });
     await rm(caCertFile, { force: true });
-    if (caWasPresent && caTrustRemover) {
+    if (caTrustRemover && await existsFile(storePendingPath)) {
       await caTrustRemover();
+      await rm(storePendingPath, { force: true });
     }
     if (!saved) return;
     if (!caWasPresent || saved.fingerprint !== live?.fingerprint) {
@@ -22996,14 +23103,19 @@ function createRequestBodyTrustController(options = {}) {
   }
   async function uninstall() {
     try {
-      await rm(manifestPath(), { force: true });
+      const dirs = await activeManifestDirs();
+      for (const dir of dirs) {
+        await rm(join2(dir, `${hostName}.json`), { force: true });
+      }
+      if (recordsManifestDirs) await rm(manifestRecordPath, { force: true });
       await removeCa();
       installerCalled = false;
     } catch (error) {
+      const reason = error instanceof TrustError ? error.message : error instanceof Error ? error.message : String(error);
       return {
         ok: false,
         state: "unsupported",
-        reasons: [error instanceof Error ? error.message : String(error)]
+        reasons: [reason]
       };
     }
     return { ok: true, state: "uninstalled" };
@@ -23020,13 +23132,30 @@ function createRequestBodyTrustController(options = {}) {
     }
     return anchorRemovalWarning ? { ok: true, state: "trusted", reasons: [anchorRemovalWarning] } : { ok: true, state: "trusted" };
   }
+  function manifestAcceptable(parsed) {
+    if (!recordsManifestDirs) return true;
+    return parsed.name === hostName && parsed.path === hostPath && parsed.type === "stdio";
+  }
+  function sameOrigins(left, right) {
+    if (left.length !== right.length) return false;
+    for (let index = 0; index < left.length; index += 1) {
+      if (left[index] !== right[index]) return false;
+    }
+    return true;
+  }
   async function status() {
-    let installed = false;
-    try {
-      const raw = await readFile2(manifestPath(), "utf8");
-      installed = isWellFormedManifest(JSON.parse(raw));
-    } catch {
-      installed = false;
+    const dirs = await activeManifestDirs();
+    let installed = dirs.length > 0;
+    for (const dir of dirs) {
+      try {
+        const raw = await readFile2(join2(dir, `${hostName}.json`), "utf8");
+        const parsed = JSON.parse(raw);
+        if (!isWellFormedManifest(parsed) || !manifestAcceptable(parsed)) {
+          installed = false;
+        }
+      } catch {
+        installed = false;
+      }
     }
     const trusted = await existsFile(caKeyFile) && await existsFile(caCertFile);
     const caps = await detect();
@@ -23039,34 +23168,50 @@ function createRequestBodyTrustController(options = {}) {
   }
   async function verify2() {
     const reasons = [];
-    let manifestExists = false;
-    let manifestValid = false;
+    const pushReason = (reason) => {
+      if (!reasons.includes(reason)) reasons.push(reason);
+    };
+    const dirs = await activeManifestDirs();
+    let manifestExists = dirs.length > 0;
+    let manifestValid = dirs.length > 0;
     let binaryExists = false;
     let binaryExecutable = false;
     let allowedOrigins = [];
-    try {
-      const raw = await readFile2(manifestPath(), "utf8");
-      manifestExists = true;
-      const parsed = JSON.parse(raw);
-      if (isWellFormedManifest(parsed)) {
-        manifestValid = true;
-        allowedOrigins = [...parsed.allowed_origins];
-        try {
-          const fileStat = await stat(parsed.path);
-          binaryExists = fileStat.isFile();
-          binaryExecutable = platform === "win32" ? binaryExists : (fileStat.mode & 73) !== 0;
-          if (!binaryExists) reasons.push("binary-not-found");
-          if (!binaryExecutable) reasons.push("binary-not-executable");
-        } catch {
-          binaryExists = false;
-          reasons.push("binary-not-found");
+    let binaryPath;
+    for (const dir of dirs) {
+      try {
+        const raw = await readFile2(join2(dir, `${hostName}.json`), "utf8");
+        const parsed = JSON.parse(raw);
+        if (!isWellFormedManifest(parsed) || !manifestAcceptable(parsed)) {
+          manifestValid = false;
+          pushReason("manifest-invalid");
+          continue;
         }
-        if (allowedOrigins.length === 0) reasons.push("no-allowed-origins");
-      } else {
-        reasons.push("manifest-invalid");
+        if (binaryPath === void 0) {
+          binaryPath = parsed.path;
+          allowedOrigins = [...parsed.allowed_origins];
+        } else if (parsed.path !== binaryPath || !sameOrigins(parsed.allowed_origins, allowedOrigins)) {
+          manifestValid = false;
+          pushReason("manifest-invalid");
+        }
+      } catch {
+        manifestExists = false;
+        manifestValid = false;
+        pushReason("manifest-not-found");
       }
-    } catch {
-      reasons.push("manifest-not-found");
+    }
+    if (binaryPath !== void 0) {
+      try {
+        const fileStat = await stat(binaryPath);
+        binaryExists = fileStat.isFile();
+        binaryExecutable = platform === "win32" ? binaryExists : (fileStat.mode & 73) !== 0;
+        if (!binaryExists) pushReason("binary-not-found");
+        if (!binaryExecutable) pushReason("binary-not-executable");
+      } catch {
+        binaryExists = false;
+        pushReason("binary-not-found");
+      }
+      if (allowedOrigins.length === 0) pushReason("no-allowed-origins");
     }
     const caTrusted = await existsFile(caKeyFile) && await existsFile(caCertFile);
     if (!caTrusted) reasons.push("ca-not-trusted");
@@ -23259,10 +23404,99 @@ var darwinAdapter = {
 };
 var darwin_default = darwinAdapter;
 var CA_DIR = "/usr/local/share/ca-certificates";
-var CERT_PATH = posixJoin2(CA_DIR, "rogatio-ca.crt");
-function hasSudo() {
-  const result = spawnSync2("which", ["sudo"], { timeout: 1e3 });
-  return result.status === 0;
+var CERT_NAME = "rogatio-ca.crt";
+var DEBIAN_CERT = posixJoin2(CA_DIR, CERT_NAME);
+var ARCH_TRUST_SOURCE = "/etc/ca-certificates/trust-source";
+var FEDORA_TRUST_SOURCE = "/etc/pki/ca-trust/source";
+var ARCH_ANCHORS = "/etc/ca-certificates/trust-source/anchors";
+var FEDORA_ANCHORS = "/etc/pki/ca-trust/source/anchors";
+var P11_CERTS = [
+  posixJoin2(ARCH_ANCHORS, CERT_NAME),
+  posixJoin2(FEDORA_ANCHORS, CERT_NAME)
+];
+var BROWSERS = ["google-chrome", "chromium"];
+function nodeCode(err) {
+  const code = err?.code;
+  return typeof code === "string" && code.length > 0 ? code : "EACCES";
+}
+function exists(path2) {
+  try {
+    accessSync2(path2);
+    return true;
+  } catch (err) {
+    return nodeCode(err) !== "ENOENT";
+  }
+}
+function writable(path2) {
+  try {
+    accessSync2(path2, constants3.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function toolOnPath(name) {
+  const result = spawnSync2("which", [name], { timeout: 1e3 });
+  if (result.status === 0) return true;
+  const code = result.error?.code;
+  if (code !== "ENOENT") return false;
+  const pathEnv = process.env.PATH ?? "";
+  for (const dir of pathEnv.split(":")) {
+    if (dir.length === 0) continue;
+    try {
+      accessSync2(posixJoin2(dir, name));
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function caBackend() {
+  if (toolOnPath("update-ca-certificates")) return "debian";
+  if (toolOnPath("update-ca-trust")) return "p11kit";
+  return void 0;
+}
+function p11kitAnchorsDir() {
+  const arch = exists(ARCH_TRUST_SOURCE);
+  const fedora = exists(FEDORA_TRUST_SOURCE);
+  if (arch && !fedora) return ARCH_ANCHORS;
+  if (fedora && !arch) return FEDORA_ANCHORS;
+  return void 0;
+}
+function needsElevation(dir) {
+  if (writable(dir)) return false;
+  try {
+    accessSync2(dir, constants3.W_OK);
+  } catch (err) {
+    if (nodeCode(err) === "ENOENT" && writable(dirname4(dir))) return false;
+  }
+  return !toolOnPath("sudo");
+}
+function configHome() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  if (typeof xdg === "string" && xdg.startsWith("/")) return xdg;
+  const home = process.env.HOME ?? "";
+  return posixJoin2(home, ".config");
+}
+function manifestDirFor(browser) {
+  return posixJoin2(configHome(), browser, "NativeMessagingHosts");
+}
+function canHostManifest(dir) {
+  try {
+    accessSync2(dir, constants3.W_OK);
+    return true;
+  } catch (err) {
+    if (nodeCode(err) !== "ENOENT") return false;
+  }
+  try {
+    accessSync2(dirname4(dir), constants3.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function installableManifestDirs() {
+  return BROWSERS.map(manifestDirFor).filter(canHostManifest);
 }
 function installFailureReason(stderr) {
   const text = stderr.toLowerCase();
@@ -23304,44 +23538,36 @@ function runSudo(args, stdin) {
     input.end(stdin);
   });
 }
+async function sudoOrThrow(args, stdin) {
+  const result = await runSudo(args, stdin);
+  if (result.code === 0) return;
+  const reason = installFailureReason(result.stderr);
+  throw new TrustError("trust.internal", reason, [reason]);
+}
 var linuxAdapter = {
   platform: "linux",
   defaultManifestDir: () => {
     const home = process.env.HOME ?? "";
     return posixJoin2(home, ".config/google-chrome/NativeMessagingHosts");
   },
+  manifestDirs: () => installableManifestDirs(),
   defaultCaInstallPath: () => CA_DIR,
   detect() {
     const reasons = [];
-    const manifestDir = this.defaultManifestDir();
-    const updateCa = spawnSync2("which", ["update-ca-certificates"], {
-      timeout: 1e3
-    });
-    if (updateCa.status !== 0) {
-      reasons.push("tooling-missing");
-    }
-    try {
-      accessSync2(manifestDir, constants3.W_OK);
-    } catch {
+    const backend = caBackend();
+    if (!backend) reasons.push("tooling-missing");
+    if (installableManifestDirs().length === 0) {
       reasons.push("manifest-dir-unwritable");
     }
-    try {
-      accessSync2(CA_DIR, constants3.W_OK);
-    } catch (err) {
-      if (err?.code === "ENOENT") {
-        try {
-          accessSync2(dirname4(CA_DIR), constants3.W_OK);
-        } catch {
-          if (!hasSudo()) {
-            reasons.push("elevation-required");
-          }
-        }
-      } else if (!hasSudo()) {
-        reasons.push("elevation-required");
-      }
+    if (backend === "debian") {
+      if (needsElevation(CA_DIR)) reasons.push("elevation-required");
+    } else if (backend === "p11kit") {
+      const anchors = p11kitAnchorsDir();
+      if (!anchors) reasons.push("ca-store-unwritable");
+      else if (needsElevation(anchors)) reasons.push("elevation-required");
     }
     const manifest = !reasons.includes("tooling-missing") && !reasons.includes("manifest-dir-unwritable");
-    const caTrust = !reasons.includes("tooling-missing") && !reasons.includes("elevation-required");
+    const caTrust = !reasons.includes("tooling-missing") && !reasons.includes("elevation-required") && !reasons.includes("ca-store-unwritable");
     return {
       manifest,
       caTrust,
@@ -23354,29 +23580,55 @@ var linuxAdapter = {
         "invalid-ca-certificate"
       ]);
     }
-    try {
-      mkdirSync(CA_DIR, { recursive: true });
-    } catch {
+    if (caBackend() === "debian") {
+      try {
+        mkdirSync(CA_DIR, { recursive: true });
+      } catch {
+        throw new TrustError("trust.internal", "ca-store-unwritable", [
+          "ca-store-unwritable"
+        ]);
+      }
+      await sudoOrThrow(["tee", DEBIAN_CERT], certPem);
+      await sudoOrThrow(["update-ca-certificates"]);
+      return;
+    }
+    if (caBackend() !== "p11kit") {
+      throw new TrustError("trust.internal", "tooling-missing", [
+        "tooling-missing"
+      ]);
+    }
+    const anchors = p11kitAnchorsDir();
+    if (!anchors) {
       throw new TrustError("trust.internal", "ca-store-unwritable", [
         "ca-store-unwritable"
       ]);
     }
-    const certResult = await runSudo(["tee", CERT_PATH], certPem);
-    if (certResult.code !== 0) {
-      const reason = installFailureReason(certResult.stderr);
-      throw new TrustError("trust.internal", reason, [reason]);
-    }
-    const result = await runSudo(["update-ca-certificates"]);
-    if (result.code !== 0) {
-      const reason = installFailureReason(result.stderr);
-      throw new TrustError("trust.internal", reason, [reason]);
-    }
+    const certPath = posixJoin2(anchors, CERT_NAME);
+    await sudoOrThrow(["mkdir", "-p", anchors]);
+    await sudoOrThrow(["tee", certPath], certPem);
+    const refresh = await runSudo(["update-ca-trust"]);
+    if (refresh.code === 0) return;
+    await sudoOrThrow(["rm", "-f", certPath]);
+    const rebuilt = await runSudo(["update-ca-trust"]);
+    if (rebuilt.code !== 0) {
+      const reason2 = installFailureReason(rebuilt.stderr);
+      throw new TrustError("trust.internal", reason2, [reason2]);
+    }
+    const reason = installFailureReason(refresh.stderr);
+    throw new TrustError("trust.internal", reason, [reason]);
   },
   async caTrustRemover() {
     try {
-      unlinkSync2(CERT_PATH);
+      unlinkSync2(DEBIAN_CERT);
     } catch {
     }
+    if (!toolOnPath("update-ca-trust")) return;
+    const present = P11_CERTS.filter((path2) => exists(path2));
+    if (caBackend() !== "p11kit" && present.length === 0) return;
+    for (const certPath of present) {
+      await sudoOrThrow(["rm", "-f", certPath]);
+    }
+    await sudoOrThrow(["update-ca-trust"]);
   },
   async caTrustAnchorRemover(fingerprintSha1, certPem) {
     void fingerprintSha1;
@@ -23543,13 +23795,15 @@ function createInstalledTrustController() {
   const platform = process.platform;
   const adapter = selectTrustPlatformAdapter(platform);
   const installRoot = defaultTrustInstallRoot(platform);
+  const manifestDirs = adapter.manifestDirs?.() ?? [];
   return createRequestBodyTrustController({
     platform,
     installRoot,
     hostPath: join5(installRoot, "runtime-host"),
     hostName: "com.rogatio.runtime",
     allowedOrigins: [],
-    manifestDir: adapter.defaultManifestDir(),
+    manifestDir: manifestDirs[0] ?? adapter.defaultManifestDir(),
+    ...manifestDirs.length > 0 ? { manifestDirs } : {},
     detectCapabilities: () => adapter.detect(),
     caTrustInstaller: (cert) => adapter.caTrustInstaller(cert),
     caTrustRemover: () => adapter.caTrustRemover(),
@@ -24419,29 +24673,6 @@ async function resolveConfinedRoot(value) {
     await directory?.close().catch(() => void 0);
   }
 }
-var MOCK_LISTENER_PREFIX = "/.rogatio/mock/";
-function isSingleSegment(value) {
-  return value.length > 0 && value.length <= 2048 && value !== "." && value !== ".." && !value.includes("/") && !value.includes("\\") && !value.includes("?") && !hasControl(value);
-}
-function parseMockRedirect(rawUrl) {
-  const queryAt = rawUrl.indexOf("?");
-  const path2 = queryAt === -1 ? rawUrl : rawUrl.slice(0, queryAt);
-  if (!path2.startsWith(MOCK_LISTENER_PREFIX)) return null;
-  const rest = path2.slice(MOCK_LISTENER_PREFIX.length);
-  const slash = rest.indexOf("/");
-  if (slash <= 0) return null;
-  if (rest.indexOf("/", slash + 1) !== -1) return null;
-  let token;
-  let digest;
-  try {
-    token = decodeURIComponent(rest.slice(0, slash));
-    digest = decodeURIComponent(rest.slice(slash + 1));
-  } catch {
-    return null;
-  }
-  if (!isSingleSegment(token) || !isSingleSegment(digest)) return null;
-  return { token, digest };
-}
 var REGEX_WORKER_SOURCE = `
 const workerThreads =
   typeof process.getBuiltinModule === "function"
@@ -24450,11 +24681,35 @@ const workerThreads =
 const { parentPort } = workerThreads;
 parentPort.postMessage({ type: "ready" });
 parentPort.on("message", (msg) => {
-  if (msg.type !== "replace") return;
+  if (msg.type !== "replace" && msg.type !== "test" && msg.type !== "exec") return;
   parentPort.postMessage({ id: msg.id, type: "ack" });
   try {
-    const out = msg.text.replace(new RegExp(msg.pattern, "gu"), msg.replacement);
-    parentPort.postMessage({ id: msg.id, type: "result", ok: true, out });
+    if (msg.type === "replace") {
+      const out = msg.text.replace(new RegExp(msg.pattern, "gu"), msg.replacement);
+      parentPort.postMessage({ id: msg.id, type: "result", ok: true, out });
+      return;
+    }
+    const regex = new RegExp(msg.pattern);
+    if (msg.type === "test") {
+      parentPort.postMessage({
+        id: msg.id,
+        type: "result",
+        ok: true,
+        matched: regex.test(msg.text),
+      });
+      return;
+    }
+    const match = regex.exec(msg.text);
+    const captures =
+      match === null
+        ? null
+        : match.slice(1).map((part) => (part === undefined ? null : part));
+    parentPort.postMessage({
+      id: msg.id,
+      type: "result",
+      ok: true,
+      captures,
+    });
   } catch (err) {
     parentPort.postMessage({
       id: msg.id,
@@ -24470,6 +24725,7 @@ var regexWorker = null;
 var regexWorkerBoot = null;
 var nextRegexJobId = 1;
 var regexWorkerBootDelayForTestsMs = 0;
+var failNextRegexWorkerBootForTests = false;
 function discardRegexWorker(worker) {
   if (regexWorker === worker) {
     regexWorker = null;
@@ -24479,6 +24735,10 @@ function discardRegexWorker(worker) {
   });
 }
 function bootRegexWorker() {
+  if (failNextRegexWorkerBootForTests) {
+    failNextRegexWorkerBootForTests = false;
+    return Promise.reject(new Error("regex-worker-boot-failed"));
+  }
   if (regexWorker !== null) return Promise.resolve(regexWorker);
   if (regexWorkerBoot !== null) return regexWorkerBoot;
   const boot = new Promise((resolve12, reject) => {
@@ -24546,7 +24806,7 @@ function bootRegexWorker() {
   });
   return boot;
 }
-function runOnRegexWorker(worker, id2, text, pattern, replacement, deadlineMs) {
+function runOnRegexWorker(worker, id2, type, text, pattern, replacement, deadlineMs) {
   return new Promise((resolve12, reject) => {
     let timer = null;
     const cleanup = () => {
@@ -24567,8 +24827,15 @@ function runOnRegexWorker(worker, id2, text, pattern, replacement, deadlineMs) {
       }
       if (msg.type === "result") {
         cleanup();
-        if (msg.ok && typeof msg.out === "string") resolve12(msg.out);
-        else reject(new Error(msg.error || "regex-invalid"));
+        if (!msg.ok) {
+          reject(new Error(msg.error || "regex-invalid"));
+          return;
+        }
+        resolve12({
+          ...typeof msg.out === "string" ? { out: msg.out } : {},
+          ...typeof msg.matched === "boolean" ? { matched: msg.matched } : {},
+          ...msg.captures !== void 0 ? { captures: msg.captures } : {}
+        });
       }
     };
     const onError = (error) => {
@@ -24582,23 +24849,109 @@ function runOnRegexWorker(worker, id2, text, pattern, replacement, deadlineMs) {
     worker.on("message", onMessage);
     worker.once("error", onError);
     worker.once("exit", onExit);
-    worker.postMessage({ id: id2, type: "replace", text, pattern, replacement });
+    worker.postMessage({
+      id: id2,
+      type,
+      text,
+      pattern,
+      ...replacement !== void 0 ? { replacement } : {}
+    });
   });
 }
-function runRegexReplace(text, pattern, replacement, deadlineMs) {
+function nextJobId() {
   const id2 = nextRegexJobId;
   nextRegexJobId += 1;
+  return id2;
+}
+function runRegexReplace(text, pattern, replacement, deadlineMs) {
+  const id2 = nextJobId();
   return bootRegexWorker().then(
-    (worker) => runOnRegexWorker(worker, id2, text, pattern, replacement, deadlineMs),
-    () => {
-      try {
-        return text.replace(new RegExp(pattern, "gu"), replacement);
-      } catch {
-        throw new Error("regex-invalid");
-      }
-    }
+    (worker) => runOnRegexWorker(
+      worker,
+      id2,
+      "replace",
+      text,
+      pattern,
+      replacement,
+      deadlineMs
+    ).then((result) => {
+      if (typeof result.out !== "string") throw new Error("regex-invalid");
+      return result.out;
+    })
+  );
+}
+function capturesFromWorker(captures) {
+  if (captures === null || captures === void 0) return null;
+  return captures.map((part) => part === null ? void 0 : part);
+}
+function runRegexTest(text, pattern, deadlineMs) {
+  const id2 = nextJobId();
+  return bootRegexWorker().then(
+    (worker) => runOnRegexWorker(
+      worker,
+      id2,
+      "test",
+      text,
+      pattern,
+      void 0,
+      deadlineMs
+    ).then(
+      (result) => result.matched === true,
+      () => false
+    ),
+    () => false
   );
 }
+function runRegexExec(text, pattern, deadlineMs) {
+  const id2 = nextJobId();
+  return bootRegexWorker().then(
+    (worker) => runOnRegexWorker(
+      worker,
+      id2,
+      "exec",
+      text,
+      pattern,
+      void 0,
+      deadlineMs
+    ).then(
+      (result) => capturesFromWorker(result.captures),
+      () => null
+    ),
+    () => null
+  );
+}
+async function sourceMatchesWithinDeadline(source, url) {
+  if (compileUrlRegex(source.value) === null) return false;
+  const text = sourceMatchText(source, url);
+  if (text === null) return false;
+  return runRegexTest(text, source.value, RUNTIME_LIMITS.maxRegexDeadlineMs);
+}
+function matchUrlCapturesWithinDeadline(urlRegex, url) {
+  return runRegexExec(url, urlRegex, RUNTIME_LIMITS.maxRegexDeadlineMs);
+}
+var MOCK_LISTENER_PREFIX = "/.rogatio/mock/";
+function isSingleSegment(value) {
+  return value.length > 0 && value.length <= 2048 && value !== "." && value !== ".." && !value.includes("/") && !value.includes("\\") && !value.includes("?") && !hasControl(value);
+}
+function parseMockRedirect(rawUrl) {
+  const queryAt = rawUrl.indexOf("?");
+  const path2 = queryAt === -1 ? rawUrl : rawUrl.slice(0, queryAt);
+  if (!path2.startsWith(MOCK_LISTENER_PREFIX)) return null;
+  const rest = path2.slice(MOCK_LISTENER_PREFIX.length);
+  const slash = rest.indexOf("/");
+  if (slash <= 0) return null;
+  if (rest.indexOf("/", slash + 1) !== -1) return null;
+  let token;
+  let digest;
+  try {
+    token = decodeURIComponent(rest.slice(0, slash));
+    digest = decodeURIComponent(rest.slice(slash + 1));
+  } catch {
+    return null;
+  }
+  if (!isSingleSegment(token) || !isSingleSegment(digest)) return null;
+  return { token, digest };
+}
 function supportedContentType(value) {
   if (value === void 0) return false;
   const mediaType = value.split(";", 1)[0]?.trim().toLowerCase() ?? "";
@@ -24630,7 +24983,7 @@ async function rewriteRequestBody(input, action, captureContext) {
     }
     outputText = action.body;
     if (captureContext !== void 0) {
-      const captures = matchUrlCaptures(
+      const captures = await matchUrlCapturesWithinDeadline(
         captureContext.urlRegex,
         captureContext.url
       );
@@ -24870,7 +25223,7 @@ async function rewriteResponseBody(input, replacements, replaceAction, captureCo
     if (captureContext === void 0) {
       text = replaceAction.body;
     } else {
-      const captures = matchUrlCaptures(
+      const captures = await matchUrlCapturesWithinDeadline(
         captureContext.urlRegex,
         captureContext.url
       );
@@ -24902,8 +25255,11 @@ async function rewriteResponseBody(input, replacements, replaceAction, captureCo
     }
   };
 }
-function replaceResponseBody(body, contentType, captureContext) {
-  const captures = captureContext === void 0 ? [] : matchUrlCaptures(captureContext.urlRegex, captureContext.url);
+async function replaceResponseBody(body, contentType, captureContext) {
+  const captures = captureContext === void 0 ? [] : await matchUrlCapturesWithinDeadline(
+    captureContext.urlRegex,
+    captureContext.url
+  );
   if (captureContext !== void 0 && captures === null) {
     return failure("runtime.url-capture-mismatch");
   }
@@ -24925,7 +25281,7 @@ async function fetchAndRewriteAuthorizedResponse(operation, action, options = {}
   const response = await fetchAuthorized(operation, options);
   if (!response.ok) return response;
   const contentType = responseHeader(response.value.headers, "content-type");
-  const transformed = isReplaceAction(action) ? replaceResponseBody(
+  const transformed = isReplaceAction(action) ? await replaceResponseBody(
     action.body,
     contentType,
     operation.sourceValue === void 0 ? void 0 : { url: operation.target, urlRegex: operation.sourceValue }
@@ -24995,7 +25351,7 @@ function projectHasRule(project, groupId, ruleId) {
 function isBodyOperation(operation) {
   return operation.kind === "request-body" || operation.kind === "response-body";
 }
-function revalidateAuthority(project, operations, request) {
+async function revalidateAuthority(project, operations, request) {
   const projectSnap = snapshotOwnData3(project);
   if (!projectSnap.valid) return { allowed: false, reason: "project-invalid" };
   const opsSnap = snapshotOwnData3(operations);
@@ -25016,7 +25372,7 @@ function revalidateAuthority(project, operations, request) {
     return { allowed: false, reason: "project-inconsistent" };
   }
   const matcher = operation.matcher;
-  if (!sourceMatches(matcher.source, request.url)) {
+  if (!await sourceMatchesWithinDeadline(matcher.source, request.url)) {
     return { allowed: false, reason: "url-mismatch" };
   }
   const requestOrigin = originOf(request.url);
@@ -25056,18 +25412,19 @@ function revalidateAuthority(project, operations, request) {
 function isBodyOp(op) {
   return op.kind === "request-body" || op.kind === "response-body";
 }
-function matcherMatches(op, url, method) {
-  if (!sourceMatches(op.matcher.source, url)) return false;
+async function matcherMatches(op, url, method) {
+  if (!await sourceMatchesWithinDeadline(op.matcher.source, url))
+    return false;
   if (op.matcher.method !== void 0 && op.matcher.method !== method.toUpperCase()) {
     return false;
   }
   return true;
 }
-function pickHighest(operations, kind, url, method) {
+async function pickHighest(operations, kind, url, method) {
   let best = null;
   for (const op of operations) {
     if (!isBodyOp(op) || op.kind !== kind) continue;
-    if (!matcherMatches(op, url, method)) continue;
+    if (!await matcherMatches(op, url, method)) continue;
     if (best === null || op.matcher.priority > best.matcher.priority || op.matcher.priority === best.matcher.priority && op.ruleId.localeCompare(best.ruleId) < 0) {
       best = op;
     }
@@ -25436,17 +25793,21 @@ function initiatorFromHeaders(headers, targetUrl) {
     return void 0;
   }
 }
-function authorizeOp(policy, op, url, method, headers) {
+async function authorizeOp(policy, op, url, method, headers) {
   const resourceType = op.matcher.resourceTypes[0];
   const initiator = initiatorFromHeaders(headers, url);
-  const decision = revalidateAuthority(policy.project, policy.operations, {
-    groupId: op.groupId,
-    ruleId: op.ruleId,
-    url,
-    method,
-    ...initiator !== void 0 ? { initiator } : {},
-    ...resourceType !== void 0 ? { resourceType } : {}
-  });
+  const decision = await revalidateAuthority(
+    policy.project,
+    policy.operations,
+    {
+      groupId: op.groupId,
+      ruleId: op.ruleId,
+      url,
+      method,
+      ...initiator !== void 0 ? { initiator } : {},
+      ...resourceType !== void 0 ? { resourceType } : {}
+    }
+  );
   return decision.allowed;
 }
 async function startInterceptProxy(options = {}) {
@@ -25494,13 +25855,13 @@ async function startInterceptProxy(options = {}) {
       }
       const method = (req.method ?? "GET").toUpperCase();
       const active = policy;
-      const requestOp = active === null ? null : pickHighest(
+      const requestOp = active === null ? null : await pickHighest(
         active.operations,
         "request-body",
         targetUrl,
         method
       );
-      const responseOp = active === null ? null : pickHighest(
+      const responseOp = active === null ? null : await pickHighest(
         active.operations,
         "response-body",
         targetUrl,
@@ -25520,7 +25881,13 @@ async function startInterceptProxy(options = {}) {
       }
       let requestBody = bodyResult.body;
       if (needsRequestBody && requestOp !== null && active !== null) {
-        if (!authorizeOp(active, requestOp, targetUrl, method, req.headers)) {
+        if (!await authorizeOp(
+          active,
+          requestOp,
+          targetUrl,
+          method,
+          req.headers
+        )) {
         } else {
           const rewritten = await rewriteRequestBody(
             {
@@ -25569,7 +25936,13 @@ async function startInterceptProxy(options = {}) {
       let responseBody = upstream.body;
       if (responseOp !== null && active !== null) {
         if (responseBody.byteLength > RUNTIME_LIMITS.maxResponseBodyBytes) {
-        } else if (!authorizeOp(active, responseOp, targetUrl, method, req.headers)) {
+        } else if (!await authorizeOp(
+          active,
+          responseOp,
+          targetUrl,
+          method,
+          req.headers
+        )) {
         } else {
           const action = responseOp.responseBody;
           const isReplace = "mode" in action && action.mode === "replace";
@@ -25693,7 +26066,10 @@ async function startInterceptProxy(options = {}) {
     const operation = active.operations.find(
       (op) => op.kind === "response-body" && op.ruleId === parsed.ruleId
     );
-    if (operation === void 0 || !sourceMatches(operation.matcher.source, parsed.originalUrl)) {
+    if (operation === void 0 || !await sourceMatchesWithinDeadline(
+      operation.matcher.source,
+      parsed.originalUrl
+    )) {
       res.writeHead(404);
       res.end();
       return;
@@ -25709,15 +26085,19 @@ async function startInterceptProxy(options = {}) {
       res.end();
       return;
     }
-    const allowed = revalidateAuthority(active.project, active.operations, {
-      groupId: operation.groupId,
-      ruleId: operation.ruleId,
-      url: parsed.originalUrl,
-      target,
-      method: "GET",
-      initiator: initiatorFromHeaders(req.headers, parsed.originalUrl) ?? new URL(target).origin,
-      resourceType: operation.matcher.resourceTypes[0]
-    });
+    const allowed = await revalidateAuthority(
+      active.project,
+      active.operations,
+      {
+        groupId: operation.groupId,
+        ruleId: operation.ruleId,
+        url: parsed.originalUrl,
+        target,
+        method: "GET",
+        initiator: initiatorFromHeaders(req.headers, parsed.originalUrl) ?? new URL(target).origin,
+        resourceType: operation.matcher.resourceTypes[0]
+      }
+    );
     if (!allowed.allowed) {
       res.writeHead(403);
       res.end();
@@ -33142,10 +33522,10 @@ function reportTrust(subcommand, result, okMessage) {
     const reasons = result.reasons ?? ["unknown"];
     console.error(`trust unsupported: ${reasons.join(", ")}`);
     const hints = {
-      "tooling-missing": "Hint: install required tooling (macOS: security; Linux: update-ca-certificates; Windows: certutil is built-in)",
-      "manifest-dir-unwritable": "Hint: check permissions on Chrome NativeMessagingHosts directory or run with appropriate access",
+      "tooling-missing": "Hint: install required tooling (macOS: security; Linux: update-ca-certificates or update-ca-trust; Windows: certutil is built-in)",
+      "manifest-dir-unwritable": "Hint: check permissions on the browser NativeMessagingHosts directory (Google Chrome or Chromium) or run with appropriate access",
       "keychain-unwritable": "Hint: macOS login keychain not writable; try running with appropriate keychain access or use sudo for system keychain",
-      "ca-store-unwritable": "Hint: /usr/local/share/ca-certificates not writable; check directory permissions",
+      "ca-store-unwritable": "Hint: the CA trust store is not writable, or this system has no supported anchors directory. Debian uses /usr/local/share/ca-certificates. Arch uses /etc/ca-certificates/trust-source/anchors. Fedora and RHEL use /etc/pki/ca-trust/source/anchors",
       "elevation-required": "Hint: device-local CA trust requires root (Linux: sudo, macOS: keychain password, Windows: Administrator). Re-run with elevated privileges"
     };
     for (const reason of reasons) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.16.4",
+  "version": "6.17.0",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",
@@ -20,9 +20,11 @@
   "files": [
     "dist"
   ],
+  "main": "./dist/node/index.js",
+  "types": "./dist/node/index.d.ts",
   "exports": {
     ".": {
-      "types": "./src/index.ts",
+      "types": "./dist/node/index.d.ts",
       "import": "./dist/node/index.js"
     }
   },