@rogatio/cli 6.20.2 → 6.20.3

package/dist/node/index.js

@@ -2283,21 +2283,23 @@ import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join as join2
 import { X509Certificate } from "node:crypto";
 import { generateKeyPairSync, webcrypto } from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
-import { accessSync, constants as constants2, unlinkSync, writeFileSync } from "node:fs";
-import { mkdtemp, open as open3, rm as rm2 } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname as dirname3, join as join3 } from "node:path";
+import { accessSync, constants as constants3 } from "node:fs";
+import { mkdtemp as mkdtemp2, rm as rm3 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname3, join as join4 } from "node:path";
 import { join as posixJoin } from "node:path/posix";
+import { constants as constants2 } from "node:fs";
+import { lstat as lstat2, mkdtemp, open as open3, rm as rm2 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join as join3 } from "node:path";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants3, mkdirSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { accessSync as accessSync2, constants as constants4, mkdirSync, unlinkSync } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 import { join as posixJoin2 } from "node:path/posix";
 import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
-import { accessSync as accessSync3, constants as constants4, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { join as join4 } from "node:path";
+import { accessSync as accessSync3, constants as constants5 } from "node:fs";
 import { join as posixJoin3 } from "node:path/posix";
-import { constants as constants5 } from "node:fs";
+import { constants as constants6 } from "node:fs";
 import { open as open4, realpath as realpath2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute3 } from "node:path";
 import { Buffer as Buffer2 } from "node:buffer";
@@ -23153,6 +23155,84 @@ function createRequestBodyTrustController(options = {}) {
   }
   return { install, uninstall, status, verify: verify2 };
 }
+var INSTALL_CERT_NAME = "ca.crt";
+function optionalFlag(flag) {
+  return typeof flag === "number" ? flag : 0;
+}
+function exclusiveWriteFlags() {
+  return constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_TRUNC | optionalFlag(constants2.O_NOFOLLOW);
+}
+function readFlags() {
+  return constants2.O_RDONLY | optionalFlag(constants2.O_NOFOLLOW) | optionalFlag(constants2.O_NONBLOCK);
+}
+function refuseCertificateFile(message) {
+  throw new TrustError("trust.internal", message, [
+    "certificate-file-rejected"
+  ]);
+}
+async function writeExclusiveCertificate(certPath, pem) {
+  const handle = await open3(certPath, exclusiveWriteFlags(), 384);
+  try {
+    await handle.writeFile(Buffer.from(pem, "utf8"));
+    await handle.chmod(384);
+  } finally {
+    await handle.close();
+  }
+}
+async function assertCertificateReady(certPath, pem) {
+  let info;
+  try {
+    info = await lstat2(certPath);
+  } catch {
+    refuseCertificateFile("certificate file is not a regular file");
+  }
+  if (!info.isFile() || info.isSymbolicLink() || info.isFIFO()) {
+    refuseCertificateFile("certificate file is not a regular file");
+  }
+  let handle;
+  try {
+    handle = await open3(certPath, readFlags());
+    const opened = await handle.stat();
+    if (!opened.isFile() || opened.isFIFO() || opened.isSymbolicLink()) {
+      refuseCertificateFile("certificate file is not a regular file");
+    }
+    const bytes = await handle.readFile();
+    if (!bytes.equals(Buffer.from(pem, "utf8"))) {
+      refuseCertificateFile(
+        "certificate file does not match the certificate to install"
+      );
+    }
+    if (!isInstallableCaCertificate(bytes.toString("utf8"))) {
+      throw new TrustError("trust.internal", "invalid-ca-certificate", [
+        "invalid-ca-certificate"
+      ]);
+    }
+  } catch (error) {
+    if (error instanceof TrustError) throw error;
+    refuseCertificateFile("certificate file is not a regular file");
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+async function withInstallCertificateFile(pem, use) {
+  if (!isInstallableCaCertificate(pem)) {
+    throw new TrustError("trust.internal", "invalid-ca-certificate", [
+      "invalid-ca-certificate"
+    ]);
+  }
+  const directory = await mkdtemp(join3(tmpdir(), "rogatio-ca-"));
+  try {
+    const certPath = join3(directory, INSTALL_CERT_NAME);
+    await writeExclusiveCertificate(certPath, pem);
+    await assertCertificateReady(certPath, pem);
+    await use(certPath);
+  } finally {
+    try {
+      await rm2(directory, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
 var PREVIOUS_CA_PEM_MAX_BYTES = 16 * 1024;
 function spawnSecurity(args) {
   return new Promise((resolve12) => {
@@ -23191,12 +23271,12 @@ var darwinAdapter = {
       reasons.push("tooling-missing");
     }
     try {
-      accessSync(manifestDir, constants2.W_OK);
+      accessSync(manifestDir, constants3.W_OK);
     } catch {
       reasons.push("manifest-dir-unwritable");
     }
     try {
-      accessSync(caDir, constants2.W_OK);
+      accessSync(caDir, constants3.W_OK);
     } catch {
       reasons.push("keychain-unwritable");
     }
@@ -23210,44 +23290,31 @@ var darwinAdapter = {
   },
   async caTrustInstaller(certPem) {
     const keychain = this.defaultCaInstallPath();
-    const tmpPath = join3(tmpdir(), `rogatio-ca-${Date.now()}.crt`);
     try {
-      writeFileSync(tmpPath, certPem, "utf8");
-    } catch {
-      throw new TrustError("trust.internal", "keychain-unwritable", [
-        "keychain-unwritable"
-      ]);
-    }
-    const result = await new Promise(
-      (resolve12) => {
-        const child = spawn("security", [
+      await withInstallCertificateFile(certPem, async (certPath) => {
+        const result = await spawnSecurity([
           "add-trusted-cert",
           "-d",
           "-r",
           "trustRoot",
           "-k",
           keychain,
-          tmpPath
+          certPath
         ]);
-        let stderr = "";
-        child.stderr?.on("data", (data) => {
-          stderr += data.toString();
-        });
-        child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
-        child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
-      }
-    );
-    try {
-      unlinkSync(tmpPath);
-    } catch {
-    }
-    if (result.code !== 0) {
-      const stderr = result.stderr.toLowerCase();
-      let reason = "keychain-unwritable";
-      if (stderr.includes("permission") || stderr.includes("auth")) {
-        reason = "keychain-unwritable";
-      }
-      throw new TrustError("trust.internal", reason, [reason]);
+        if (result.code !== 0) {
+          const stderr = result.stderr.toLowerCase();
+          let reason = "keychain-unwritable";
+          if (stderr.includes("permission") || stderr.includes("auth")) {
+            reason = "keychain-unwritable";
+          }
+          throw new TrustError("trust.internal", reason, [reason]);
+        }
+      });
+    } catch (error) {
+      if (error instanceof TrustError) throw error;
+      throw new TrustError("trust.internal", "keychain-unwritable", [
+        "keychain-unwritable"
+      ]);
     }
   },
   async caTrustRemover() {
@@ -23289,17 +23356,11 @@ var darwinAdapter = {
       ]);
     }
     const keychain = this.defaultCaInstallPath();
-    const dir = await mkdtemp(join3(tmpdir(), "rogatio-ca-"));
-    const tmpPath = join3(dir, "previous.crt");
+    const dir = await mkdtemp2(join4(tmpdir2(), "rogatio-ca-"));
+    const tmpPath = join4(dir, "previous.crt");
     let failed = false;
     try {
-      const handle = await open3(tmpPath, "wx", 384);
-      try {
-        await handle.writeFile(certPem, "utf8");
-        await handle.chmod(384);
-      } finally {
-        await handle.close();
-      }
+      await writeExclusiveCertificate(tmpPath, certPem);
       const trust = await spawnSecurity(["remove-trusted-cert", "-d", tmpPath]);
       if (trust.code !== 0 && !securityMiss(trust.stderr)) failed = true;
       const item = await spawnSecurity([
@@ -23314,7 +23375,7 @@ var darwinAdapter = {
       failed = true;
     } finally {
       try {
-        await rm2(dir, { recursive: true, force: true });
+        await rm3(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -23352,7 +23413,7 @@ function exists(path2) {
 }
 function writable(path2) {
   try {
-    accessSync2(path2, constants3.W_OK);
+    accessSync2(path2, constants4.W_OK);
     return true;
   } catch {
     return false;
@@ -23389,7 +23450,7 @@ function p11kitAnchorsDir() {
 function needsElevation(dir) {
   if (writable(dir)) return false;
   try {
-    accessSync2(dir, constants3.W_OK);
+    accessSync2(dir, constants4.W_OK);
   } catch (err) {
     if (nodeCode(err) === "ENOENT" && writable(dirname4(dir))) return false;
   }
@@ -23406,13 +23467,13 @@ function manifestDirFor(browser) {
 }
 function canHostManifest(dir) {
   try {
-    accessSync2(dir, constants3.W_OK);
+    accessSync2(dir, constants4.W_OK);
     return true;
   } catch (err) {
     if (nodeCode(err) !== "ENOENT") return false;
   }
   try {
-    accessSync2(dirname4(dir), constants3.W_OK);
+    accessSync2(dirname4(dir), constants4.W_OK);
     return true;
   } catch {
     return false;
@@ -23542,7 +23603,7 @@ var linuxAdapter = {
   },
   async caTrustRemover() {
     try {
-      unlinkSync2(DEBIAN_CERT);
+      unlinkSync(DEBIAN_CERT);
     } catch {
     }
     if (!toolOnPath("update-ca-trust")) return;
@@ -23603,7 +23664,7 @@ var win32Adapter = {
       reasons.push("tooling-missing");
     }
     try {
-      accessSync3(manifestDir, constants4.W_OK);
+      accessSync3(manifestDir, constants5.W_OK);
     } catch {
       reasons.push("manifest-dir-unwritable");
     }
@@ -23616,37 +23677,42 @@ var win32Adapter = {
     };
   },
   async caTrustInstaller(certPem) {
-    const tmpPath = join4(tmpdir2(), `rogatio-ca-${Date.now()}.crt`);
     try {
-      writeFileSync2(tmpPath, certPem, "utf8");
-    } catch {
+      await withInstallCertificateFile(certPem, async (certPath) => {
+        const result = await new Promise(
+          (resolve12) => {
+            const child = spawn3("certutil", [
+              "-addstore",
+              "-f",
+              "Root",
+              certPath
+            ]);
+            let stderr = "";
+            child.stderr?.on("data", (data) => {
+              stderr += data.toString();
+            });
+            child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
+            child.on(
+              "error",
+              (err) => resolve12({ code: 1, stderr: err.message })
+            );
+          }
+        );
+        if (result.code !== 0) {
+          const stderr = result.stderr.toLowerCase();
+          let reason = "elevation-required";
+          if (stderr.includes("access denied") || stderr.includes("permission")) {
+            reason = "elevation-required";
+          }
+          throw new TrustError("trust.internal", reason, [reason]);
+        }
+      });
+    } catch (error) {
+      if (error instanceof TrustError) throw error;
       throw new TrustError("trust.internal", "elevation-required", [
         "elevation-required"
       ]);
     }
-    const result = await new Promise(
-      (resolve12) => {
-        const child = spawn3("certutil", ["-addstore", "-f", "Root", tmpPath]);
-        let stderr = "";
-        child.stderr?.on("data", (data) => {
-          stderr += data.toString();
-        });
-        child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
-        child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
-      }
-    );
-    try {
-      unlinkSync3(tmpPath);
-    } catch {
-    }
-    if (result.code !== 0) {
-      const stderr = result.stderr.toLowerCase();
-      let reason = "elevation-required";
-      if (stderr.includes("access denied") || stderr.includes("permission")) {
-        reason = "elevation-required";
-      }
-      throw new TrustError("trust.internal", reason, [reason]);
-    }
   },
   async caTrustRemover() {
     const result = await new Promise(
@@ -24586,7 +24652,7 @@ async function resolveConfinedRoot(value) {
   }
   let directory;
   try {
-    directory = await open4(value, constants5.O_RDONLY | constants5.O_DIRECTORY);
+    directory = await open4(value, constants6.O_RDONLY | constants6.O_DIRECTORY);
     const info = await directory.stat();
     if (!info.isDirectory()) return failure("runtime.root-invalid");
     return { ok: true, value: await realpath2(value) };
@@ -33439,7 +33505,7 @@ function errorMessage(error) {
 }
 
 // packages/cli/src/commands/runtime.ts
-import { chmod, mkdir as mkdir5, rm as rm3, writeFile as writeFile4 } from "node:fs/promises";
+import { chmod, mkdir as mkdir5, rm as rm4, writeFile as writeFile4 } from "node:fs/promises";
 import { dirname as dirname10, join as join9, resolve as resolve8 } from "node:path";
 function generateHostWrapper(rogatioCommand, logPath) {
   const parts = rogatioCommand.split(" ");
@@ -33550,11 +33616,11 @@ Note: reload the extension at chrome://extensions for the native host to be dete
     case "uninstall": {
       const uninstallResult = await controller.uninstall();
       try {
-        await rm3(hostPath, { force: true });
+        await rm4(hostPath, { force: true });
       } catch {
       }
       try {
-        await rm3(join9(installRoot, "runtime-host.log"), { force: true });
+        await rm4(join9(installRoot, "runtime-host.log"), { force: true });
       } catch {
       }
       return reportTrust(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.20.2",
+  "version": "6.20.3",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",
@@ -41,7 +41,7 @@
   },
   "dependencies": {
     "ajv": "8.20.0",
-    "koffi": "3.3.2"
+    "koffi": "3.3.3"
   },
   "devDependencies": {
     "@rogatio/compiler": "workspace:*",
@@ -50,8 +50,8 @@
     "@rogatio/requestly-import": "workspace:*",
     "@rogatio/runtime": "workspace:*",
     "@rogatio/schema": "workspace:*",
-    "@types/node": "26.6.4",
+    "@types/node": "26.6.5",
     "typescript": "7.0.2",
-    "vitest": "5.0.3"
+    "vitest": "5.0.4"
   }
 }