@rogatio/cli 6.16.5 → 6.17.0

package/dist/node/index.d.ts

@@ -0,0 +1 @@
+export declare function cli(args?: string[]): Promise<number>;

package/dist/node/index.js

@@ -22598,6 +22598,15 @@ function defaultTrustInstallRoot(platform) {
   }
   return join2(process.env.HOME ?? "", ".local", "share", "rogatio");
 }
+var MANIFEST_DIR_RECORD = "native-messaging-dirs.json";
+function isSafeManifestDir(dir) {
+  if (!isAbsolute2(dir) || dir.includes("\0")) return false;
+  const parts = dir.split(/[\\/]/).filter((part) => part.length > 0);
+  if (parts.includes("..") || parts.length < 2) return false;
+  const browser = parts[parts.length - 2];
+  const leaf = parts[parts.length - 1];
+  return leaf === "NativeMessagingHosts" && (browser === "google-chrome" || browser === "chromium");
+}
 function isWellFormedManifest(value) {
   if (typeof value !== "object" || value === null) return false;
   const m = value;
@@ -22754,12 +22763,110 @@ function createRequestBodyTrustController(options = {}) {
     installRoot,
     options.caCertFileName ?? ".rogatio-ca.crt"
   );
+  const storePendingPath = join2(
+    dirname2(caKeyFile),
+    ".rogatio-ca-store-pending"
+  );
   const caPreviousCertFile = join2(
     dirname2(caCertFile),
     ".rogatio-ca.previous.crt"
   );
-  const manifestPath = () => join2(manifestDir, `${hostName}.json`);
+  const configuredManifestDirs = options.manifestDirs && options.manifestDirs.length > 0 ? [...options.manifestDirs] : [manifestDir];
+  const recordsManifestDirs = options.manifestDirs !== void 0 && options.manifestDirs.length > 0;
+  const manifestRecordPath = join2(installRoot, MANIFEST_DIR_RECORD);
   let installerCalled = false;
+  function parseRecordedDirs(raw) {
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return void 0;
+    }
+    if (!Array.isArray(parsed) || parsed.length === 0 || parsed.length > 8) {
+      return void 0;
+    }
+    const dirs = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const entry of parsed) {
+      if (typeof entry !== "string" || seen.has(entry) || !isSafeManifestDir(entry)) {
+        return void 0;
+      }
+      seen.add(entry);
+      dirs.push(entry);
+    }
+    return dirs;
+  }
+  async function readRecordedDirs() {
+    if (!recordsManifestDirs) return void 0;
+    try {
+      return parseRecordedDirs(await readFile2(manifestRecordPath, "utf8"));
+    } catch {
+      return void 0;
+    }
+  }
+  async function activeManifestDirs() {
+    const recorded = await readRecordedDirs();
+    if (recorded) return recorded;
+    if (!recordsManifestDirs) return configuredManifestDirs;
+    const present = [];
+    for (const dir of configuredManifestDirs) {
+      if (await existsFile(join2(dir, `${hostName}.json`))) present.push(dir);
+    }
+    return present.length > 0 ? present : configuredManifestDirs;
+  }
+  async function snapshotFile(path2) {
+    let previous;
+    try {
+      previous = await readFile2(path2, "utf8");
+    } catch {
+      previous = void 0;
+    }
+    return { path: path2, previous, written: false };
+  }
+  async function restoreSnapshot(snap) {
+    if (!snap.written) return;
+    if (snap.previous !== void 0) {
+      await writeFileAtomic(snap.path, snap.previous);
+      return;
+    }
+    await rm(snap.path, { force: true });
+  }
+  async function rollbackWritten(snaps) {
+    for (const snap of snaps) {
+      try {
+        await restoreSnapshot(snap);
+      } catch {
+      }
+    }
+  }
+  async function writeManifestFiles(data) {
+    const snaps = [];
+    try {
+      for (const dir of configuredManifestDirs) {
+        if (recordsManifestDirs && !isSafeManifestDir(dir)) {
+          throw new Error("trust.write-failed");
+        }
+        const snap = await snapshotFile(join2(dir, `${hostName}.json`));
+        snaps.push(snap);
+        await writeFileAtomic(snap.path, data);
+        snap.written = true;
+      }
+      if (recordsManifestDirs) {
+        const recordSnap = await snapshotFile(manifestRecordPath);
+        snaps.push(recordSnap);
+        await writeFileAtomic(
+          manifestRecordPath,
+          `${JSON.stringify(configuredManifestDirs)}
+`
+        );
+        recordSnap.written = true;
+      }
+      return { ok: true, snaps };
+    } catch (error) {
+      await rollbackWritten(snaps);
+      return { ok: false, reason: codeOf(error, "trust.write-failed") };
+    }
+  }
   async function install(extensionId) {
     if (!extensionId || !/^[a-p]{32}$/.test(extensionId)) {
       return {
@@ -22794,21 +22901,17 @@ function createRequestBodyTrustController(options = {}) {
     }
     const caps = await detect();
     if (!caps.manifest) return unsupportedResult(caps);
-    try {
-      await writeFileAtomic(manifestPath(), data);
-    } catch (error) {
+    const written = await writeManifestFiles(data);
+    if (!written.ok) {
       return {
         ok: false,
         state: "unsupported",
-        reasons: [codeOf(error, "trust.write-failed")]
+        reasons: [written.reason]
       };
     }
     const caTrustCaps = await detect();
     if (!caTrustCaps.caTrust) {
-      try {
-        await rm(manifestPath(), { force: true });
-      } catch {
-      }
+      await rollbackWritten(written.snaps);
       return unsupportedResult(caTrustCaps);
     }
     const trustResult = await trust();
@@ -22817,13 +22920,11 @@ function createRequestBodyTrustController(options = {}) {
         await rollbackReplacedCa();
       } catch {
       }
-      try {
-        await rm(manifestPath(), { force: true });
-      } catch {
-      }
+      await rollbackWritten(written.snaps);
       installerCalled = false;
       return trustResult;
     }
+    await rm(storePendingPath, { force: true });
     return trustResult.reasons ? { ok: true, state: "installed", reasons: trustResult.reasons } : { ok: true, state: "installed" };
   }
   async function reusableCaMaterial() {
@@ -22953,8 +23054,8 @@ function createRequestBodyTrustController(options = {}) {
     }
     let installedNew = false;
     if (caTrustInstaller && !installerCalled) {
-      await caTrustInstaller(await readFile2(caCertFile, "utf8"));
       installerCalled = true;
+      await caTrustInstaller(await readFile2(caCertFile, "utf8"));
       installedNew = true;
     }
     if (reusable && siblingAnchor && (installedNew || !caTrustInstaller)) {
@@ -22979,11 +23080,15 @@ function createRequestBodyTrustController(options = {}) {
     const saved = await readPreviousRogatioCa(caPreviousCertFile);
     const live = await readPreviousRogatioCa(caCertFile);
     const caWasPresent = await existsFile(caKeyFile);
+    if (caWasPresent && caTrustRemover) {
+      await writeFileAtomic(storePendingPath, "1\n", 384);
+    }
     await rm(caKeyFile, { force: true });
     await rm(caPubFile, { force: true });
     await rm(caCertFile, { force: true });
-    if (caWasPresent && caTrustRemover) {
+    if (caTrustRemover && await existsFile(storePendingPath)) {
       await caTrustRemover();
+      await rm(storePendingPath, { force: true });
     }
     if (!saved) return;
     if (!caWasPresent || saved.fingerprint !== live?.fingerprint) {
@@ -22998,14 +23103,19 @@ function createRequestBodyTrustController(options = {}) {
   }
   async function uninstall() {
     try {
-      await rm(manifestPath(), { force: true });
+      const dirs = await activeManifestDirs();
+      for (const dir of dirs) {
+        await rm(join2(dir, `${hostName}.json`), { force: true });
+      }
+      if (recordsManifestDirs) await rm(manifestRecordPath, { force: true });
       await removeCa();
       installerCalled = false;
     } catch (error) {
+      const reason = error instanceof TrustError ? error.message : error instanceof Error ? error.message : String(error);
       return {
         ok: false,
         state: "unsupported",
-        reasons: [error instanceof Error ? error.message : String(error)]
+        reasons: [reason]
       };
     }
     return { ok: true, state: "uninstalled" };
@@ -23022,13 +23132,30 @@ function createRequestBodyTrustController(options = {}) {
     }
     return anchorRemovalWarning ? { ok: true, state: "trusted", reasons: [anchorRemovalWarning] } : { ok: true, state: "trusted" };
   }
+  function manifestAcceptable(parsed) {
+    if (!recordsManifestDirs) return true;
+    return parsed.name === hostName && parsed.path === hostPath && parsed.type === "stdio";
+  }
+  function sameOrigins(left, right) {
+    if (left.length !== right.length) return false;
+    for (let index = 0; index < left.length; index += 1) {
+      if (left[index] !== right[index]) return false;
+    }
+    return true;
+  }
   async function status() {
-    let installed = false;
-    try {
-      const raw = await readFile2(manifestPath(), "utf8");
-      installed = isWellFormedManifest(JSON.parse(raw));
-    } catch {
-      installed = false;
+    const dirs = await activeManifestDirs();
+    let installed = dirs.length > 0;
+    for (const dir of dirs) {
+      try {
+        const raw = await readFile2(join2(dir, `${hostName}.json`), "utf8");
+        const parsed = JSON.parse(raw);
+        if (!isWellFormedManifest(parsed) || !manifestAcceptable(parsed)) {
+          installed = false;
+        }
+      } catch {
+        installed = false;
+      }
     }
     const trusted = await existsFile(caKeyFile) && await existsFile(caCertFile);
     const caps = await detect();
@@ -23041,34 +23168,50 @@ function createRequestBodyTrustController(options = {}) {
   }
   async function verify2() {
     const reasons = [];
-    let manifestExists = false;
-    let manifestValid = false;
+    const pushReason = (reason) => {
+      if (!reasons.includes(reason)) reasons.push(reason);
+    };
+    const dirs = await activeManifestDirs();
+    let manifestExists = dirs.length > 0;
+    let manifestValid = dirs.length > 0;
     let binaryExists = false;
     let binaryExecutable = false;
     let allowedOrigins = [];
-    try {
-      const raw = await readFile2(manifestPath(), "utf8");
-      manifestExists = true;
-      const parsed = JSON.parse(raw);
-      if (isWellFormedManifest(parsed)) {
-        manifestValid = true;
-        allowedOrigins = [...parsed.allowed_origins];
-        try {
-          const fileStat = await stat(parsed.path);
-          binaryExists = fileStat.isFile();
-          binaryExecutable = platform === "win32" ? binaryExists : (fileStat.mode & 73) !== 0;
-          if (!binaryExists) reasons.push("binary-not-found");
-          if (!binaryExecutable) reasons.push("binary-not-executable");
-        } catch {
-          binaryExists = false;
-          reasons.push("binary-not-found");
+    let binaryPath;
+    for (const dir of dirs) {
+      try {
+        const raw = await readFile2(join2(dir, `${hostName}.json`), "utf8");
+        const parsed = JSON.parse(raw);
+        if (!isWellFormedManifest(parsed) || !manifestAcceptable(parsed)) {
+          manifestValid = false;
+          pushReason("manifest-invalid");
+          continue;
         }
-        if (allowedOrigins.length === 0) reasons.push("no-allowed-origins");
-      } else {
-        reasons.push("manifest-invalid");
+        if (binaryPath === void 0) {
+          binaryPath = parsed.path;
+          allowedOrigins = [...parsed.allowed_origins];
+        } else if (parsed.path !== binaryPath || !sameOrigins(parsed.allowed_origins, allowedOrigins)) {
+          manifestValid = false;
+          pushReason("manifest-invalid");
+        }
+      } catch {
+        manifestExists = false;
+        manifestValid = false;
+        pushReason("manifest-not-found");
       }
-    } catch {
-      reasons.push("manifest-not-found");
+    }
+    if (binaryPath !== void 0) {
+      try {
+        const fileStat = await stat(binaryPath);
+        binaryExists = fileStat.isFile();
+        binaryExecutable = platform === "win32" ? binaryExists : (fileStat.mode & 73) !== 0;
+        if (!binaryExists) pushReason("binary-not-found");
+        if (!binaryExecutable) pushReason("binary-not-executable");
+      } catch {
+        binaryExists = false;
+        pushReason("binary-not-found");
+      }
+      if (allowedOrigins.length === 0) pushReason("no-allowed-origins");
     }
     const caTrusted = await existsFile(caKeyFile) && await existsFile(caCertFile);
     if (!caTrusted) reasons.push("ca-not-trusted");
@@ -23261,10 +23404,99 @@ var darwinAdapter = {
 };
 var darwin_default = darwinAdapter;
 var CA_DIR = "/usr/local/share/ca-certificates";
-var CERT_PATH = posixJoin2(CA_DIR, "rogatio-ca.crt");
-function hasSudo() {
-  const result = spawnSync2("which", ["sudo"], { timeout: 1e3 });
-  return result.status === 0;
+var CERT_NAME = "rogatio-ca.crt";
+var DEBIAN_CERT = posixJoin2(CA_DIR, CERT_NAME);
+var ARCH_TRUST_SOURCE = "/etc/ca-certificates/trust-source";
+var FEDORA_TRUST_SOURCE = "/etc/pki/ca-trust/source";
+var ARCH_ANCHORS = "/etc/ca-certificates/trust-source/anchors";
+var FEDORA_ANCHORS = "/etc/pki/ca-trust/source/anchors";
+var P11_CERTS = [
+  posixJoin2(ARCH_ANCHORS, CERT_NAME),
+  posixJoin2(FEDORA_ANCHORS, CERT_NAME)
+];
+var BROWSERS = ["google-chrome", "chromium"];
+function nodeCode(err) {
+  const code = err?.code;
+  return typeof code === "string" && code.length > 0 ? code : "EACCES";
+}
+function exists(path2) {
+  try {
+    accessSync2(path2);
+    return true;
+  } catch (err) {
+    return nodeCode(err) !== "ENOENT";
+  }
+}
+function writable(path2) {
+  try {
+    accessSync2(path2, constants3.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function toolOnPath(name) {
+  const result = spawnSync2("which", [name], { timeout: 1e3 });
+  if (result.status === 0) return true;
+  const code = result.error?.code;
+  if (code !== "ENOENT") return false;
+  const pathEnv = process.env.PATH ?? "";
+  for (const dir of pathEnv.split(":")) {
+    if (dir.length === 0) continue;
+    try {
+      accessSync2(posixJoin2(dir, name));
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function caBackend() {
+  if (toolOnPath("update-ca-certificates")) return "debian";
+  if (toolOnPath("update-ca-trust")) return "p11kit";
+  return void 0;
+}
+function p11kitAnchorsDir() {
+  const arch = exists(ARCH_TRUST_SOURCE);
+  const fedora = exists(FEDORA_TRUST_SOURCE);
+  if (arch && !fedora) return ARCH_ANCHORS;
+  if (fedora && !arch) return FEDORA_ANCHORS;
+  return void 0;
+}
+function needsElevation(dir) {
+  if (writable(dir)) return false;
+  try {
+    accessSync2(dir, constants3.W_OK);
+  } catch (err) {
+    if (nodeCode(err) === "ENOENT" && writable(dirname4(dir))) return false;
+  }
+  return !toolOnPath("sudo");
+}
+function configHome() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  if (typeof xdg === "string" && xdg.startsWith("/")) return xdg;
+  const home = process.env.HOME ?? "";
+  return posixJoin2(home, ".config");
+}
+function manifestDirFor(browser) {
+  return posixJoin2(configHome(), browser, "NativeMessagingHosts");
+}
+function canHostManifest(dir) {
+  try {
+    accessSync2(dir, constants3.W_OK);
+    return true;
+  } catch (err) {
+    if (nodeCode(err) !== "ENOENT") return false;
+  }
+  try {
+    accessSync2(dirname4(dir), constants3.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function installableManifestDirs() {
+  return BROWSERS.map(manifestDirFor).filter(canHostManifest);
 }
 function installFailureReason(stderr) {
   const text = stderr.toLowerCase();
@@ -23306,44 +23538,36 @@ function runSudo(args, stdin) {
     input.end(stdin);
   });
 }
+async function sudoOrThrow(args, stdin) {
+  const result = await runSudo(args, stdin);
+  if (result.code === 0) return;
+  const reason = installFailureReason(result.stderr);
+  throw new TrustError("trust.internal", reason, [reason]);
+}
 var linuxAdapter = {
   platform: "linux",
   defaultManifestDir: () => {
     const home = process.env.HOME ?? "";
     return posixJoin2(home, ".config/google-chrome/NativeMessagingHosts");
   },
+  manifestDirs: () => installableManifestDirs(),
   defaultCaInstallPath: () => CA_DIR,
   detect() {
     const reasons = [];
-    const manifestDir = this.defaultManifestDir();
-    const updateCa = spawnSync2("which", ["update-ca-certificates"], {
-      timeout: 1e3
-    });
-    if (updateCa.status !== 0) {
-      reasons.push("tooling-missing");
-    }
-    try {
-      accessSync2(manifestDir, constants3.W_OK);
-    } catch {
+    const backend = caBackend();
+    if (!backend) reasons.push("tooling-missing");
+    if (installableManifestDirs().length === 0) {
       reasons.push("manifest-dir-unwritable");
     }
-    try {
-      accessSync2(CA_DIR, constants3.W_OK);
-    } catch (err) {
-      if (err?.code === "ENOENT") {
-        try {
-          accessSync2(dirname4(CA_DIR), constants3.W_OK);
-        } catch {
-          if (!hasSudo()) {
-            reasons.push("elevation-required");
-          }
-        }
-      } else if (!hasSudo()) {
-        reasons.push("elevation-required");
-      }
+    if (backend === "debian") {
+      if (needsElevation(CA_DIR)) reasons.push("elevation-required");
+    } else if (backend === "p11kit") {
+      const anchors = p11kitAnchorsDir();
+      if (!anchors) reasons.push("ca-store-unwritable");
+      else if (needsElevation(anchors)) reasons.push("elevation-required");
     }
     const manifest = !reasons.includes("tooling-missing") && !reasons.includes("manifest-dir-unwritable");
-    const caTrust = !reasons.includes("tooling-missing") && !reasons.includes("elevation-required");
+    const caTrust = !reasons.includes("tooling-missing") && !reasons.includes("elevation-required") && !reasons.includes("ca-store-unwritable");
     return {
       manifest,
       caTrust,
@@ -23356,29 +23580,55 @@ var linuxAdapter = {
         "invalid-ca-certificate"
       ]);
     }
-    try {
-      mkdirSync(CA_DIR, { recursive: true });
-    } catch {
+    if (caBackend() === "debian") {
+      try {
+        mkdirSync(CA_DIR, { recursive: true });
+      } catch {
+        throw new TrustError("trust.internal", "ca-store-unwritable", [
+          "ca-store-unwritable"
+        ]);
+      }
+      await sudoOrThrow(["tee", DEBIAN_CERT], certPem);
+      await sudoOrThrow(["update-ca-certificates"]);
+      return;
+    }
+    if (caBackend() !== "p11kit") {
+      throw new TrustError("trust.internal", "tooling-missing", [
+        "tooling-missing"
+      ]);
+    }
+    const anchors = p11kitAnchorsDir();
+    if (!anchors) {
       throw new TrustError("trust.internal", "ca-store-unwritable", [
         "ca-store-unwritable"
       ]);
     }
-    const certResult = await runSudo(["tee", CERT_PATH], certPem);
-    if (certResult.code !== 0) {
-      const reason = installFailureReason(certResult.stderr);
-      throw new TrustError("trust.internal", reason, [reason]);
-    }
-    const result = await runSudo(["update-ca-certificates"]);
-    if (result.code !== 0) {
-      const reason = installFailureReason(result.stderr);
-      throw new TrustError("trust.internal", reason, [reason]);
-    }
+    const certPath = posixJoin2(anchors, CERT_NAME);
+    await sudoOrThrow(["mkdir", "-p", anchors]);
+    await sudoOrThrow(["tee", certPath], certPem);
+    const refresh = await runSudo(["update-ca-trust"]);
+    if (refresh.code === 0) return;
+    await sudoOrThrow(["rm", "-f", certPath]);
+    const rebuilt = await runSudo(["update-ca-trust"]);
+    if (rebuilt.code !== 0) {
+      const reason2 = installFailureReason(rebuilt.stderr);
+      throw new TrustError("trust.internal", reason2, [reason2]);
+    }
+    const reason = installFailureReason(refresh.stderr);
+    throw new TrustError("trust.internal", reason, [reason]);
   },
   async caTrustRemover() {
     try {
-      unlinkSync2(CERT_PATH);
+      unlinkSync2(DEBIAN_CERT);
     } catch {
     }
+    if (!toolOnPath("update-ca-trust")) return;
+    const present = P11_CERTS.filter((path2) => exists(path2));
+    if (caBackend() !== "p11kit" && present.length === 0) return;
+    for (const certPath of present) {
+      await sudoOrThrow(["rm", "-f", certPath]);
+    }
+    await sudoOrThrow(["update-ca-trust"]);
   },
   async caTrustAnchorRemover(fingerprintSha1, certPem) {
     void fingerprintSha1;
@@ -23545,13 +23795,15 @@ function createInstalledTrustController() {
   const platform = process.platform;
   const adapter = selectTrustPlatformAdapter(platform);
   const installRoot = defaultTrustInstallRoot(platform);
+  const manifestDirs = adapter.manifestDirs?.() ?? [];
   return createRequestBodyTrustController({
     platform,
     installRoot,
     hostPath: join5(installRoot, "runtime-host"),
     hostName: "com.rogatio.runtime",
     allowedOrigins: [],
-    manifestDir: adapter.defaultManifestDir(),
+    manifestDir: manifestDirs[0] ?? adapter.defaultManifestDir(),
+    ...manifestDirs.length > 0 ? { manifestDirs } : {},
     detectCapabilities: () => adapter.detect(),
     caTrustInstaller: (cert) => adapter.caTrustInstaller(cert),
     caTrustRemover: () => adapter.caTrustRemover(),
@@ -33270,10 +33522,10 @@ function reportTrust(subcommand, result, okMessage) {
     const reasons = result.reasons ?? ["unknown"];
     console.error(`trust unsupported: ${reasons.join(", ")}`);
     const hints = {
-      "tooling-missing": "Hint: install required tooling (macOS: security; Linux: update-ca-certificates; Windows: certutil is built-in)",
-      "manifest-dir-unwritable": "Hint: check permissions on Chrome NativeMessagingHosts directory or run with appropriate access",
+      "tooling-missing": "Hint: install required tooling (macOS: security; Linux: update-ca-certificates or update-ca-trust; Windows: certutil is built-in)",
+      "manifest-dir-unwritable": "Hint: check permissions on the browser NativeMessagingHosts directory (Google Chrome or Chromium) or run with appropriate access",
       "keychain-unwritable": "Hint: macOS login keychain not writable; try running with appropriate keychain access or use sudo for system keychain",
-      "ca-store-unwritable": "Hint: /usr/local/share/ca-certificates not writable; check directory permissions",
+      "ca-store-unwritable": "Hint: the CA trust store is not writable, or this system has no supported anchors directory. Debian uses /usr/local/share/ca-certificates. Arch uses /etc/ca-certificates/trust-source/anchors. Fedora and RHEL use /etc/pki/ca-trust/source/anchors",
       "elevation-required": "Hint: device-local CA trust requires root (Linux: sudo, macOS: keychain password, Windows: Administrator). Re-run with elevated privileges"
     };
     for (const reason of reasons) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.16.5",
+  "version": "6.17.0",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",
@@ -20,9 +20,11 @@
   "files": [
     "dist"
   ],
+  "main": "./dist/node/index.js",
+  "types": "./dist/node/index.d.ts",
   "exports": {
     ".": {
-      "types": "./src/index.ts",
+      "types": "./dist/node/index.d.ts",
       "import": "./dist/node/index.js"
     }
   },