@rogatio/cli 6.20.5 → 6.20.7

package/README.md

@@ -107,7 +107,7 @@ rogatio ai test
 rogatio ai delete
 ```
 
-Configuration is stored at `~/.config/rogatio/provider.json` (Linux), `~/Library/Application Support/rogatio/provider.json` (macOS), or `%LOCALAPPDATA%\rogatio\provider.json` (Windows) with `600` permissions.
+Configuration is stored at `~/.config/rogatio/provider.json` (Linux), `~/Library/Application Support/rogatio/provider.json` (macOS), or `%LOCALAPPDATA%\rogatio\provider.json` (Windows). On POSIX the config directory mode is `700` and `provider.json` is `600`.
 
 When AI is configured, `rogatio edit` shows an **AI Assist** button on the project title row. Click it to:
 - Generate rules from natural language

package/dist/node/index.js

@@ -2270,11 +2270,12 @@ function sameOrigin(a, b) {
 }
 
 // packages/runtime/dist/node/index.js
+import { constants } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { isIP as isIP2 } from "node:net";
-import { constants, existsSync } from "node:fs";
-import { open, readlink, realpath } from "node:fs/promises";
+import { constants as constants2, existsSync } from "node:fs";
+import { open as open2, readlink, realpath } from "node:fs/promises";
 import { isAbsolute, relative } from "node:path";
 import { close, fstat, read } from "node:fs";
 import { createRequire } from "node:module";
@@ -2283,10 +2284,10 @@ import { join as join5 } from "node:path";
 import { createPrivateKey, sign, verify, X509Certificate as X509Certificate3 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import {
-  lstat,
+  lstat as lstat2,
   mkdir as mkdir2,
-  open as open2,
-  readFile as readFile2,
+  open as open3,
+  readFile,
   rename,
   rm,
   stat
@@ -2295,24 +2296,24 @@ import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join as join2
 import { X509Certificate } from "node:crypto";
 import { generateKeyPairSync, webcrypto } from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
-import { accessSync, constants as constants3 } from "node:fs";
+import { accessSync, constants as constants4 } from "node:fs";
 import { mkdtemp as mkdtemp2, rm as rm3 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname3, join as join4 } from "node:path";
 import { join as posixJoin } from "node:path/posix";
-import { constants as constants2 } from "node:fs";
-import { lstat as lstat2, mkdtemp, open as open3, rm as rm2 } from "node:fs/promises";
+import { constants as constants3 } from "node:fs";
+import { lstat as lstat3, mkdtemp, open as open4, rm as rm2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join as join3 } from "node:path";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants4, mkdirSync, unlinkSync } from "node:fs";
+import { accessSync as accessSync2, constants as constants5, mkdirSync, unlinkSync } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 import { join as posixJoin2 } from "node:path/posix";
 import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
-import { accessSync as accessSync3, constants as constants5 } from "node:fs";
+import { accessSync as accessSync3, constants as constants6 } from "node:fs";
 import { join as posixJoin3 } from "node:path/posix";
-import { constants as constants6 } from "node:fs";
-import { open as open4, realpath as realpath2 } from "node:fs/promises";
+import { constants as constants7 } from "node:fs";
+import { open as open5, realpath as realpath2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute3 } from "node:path";
 import { Buffer as Buffer2 } from "node:buffer";
 import { existsSync as existsSync2 } from "node:fs";
@@ -21147,8 +21148,24 @@ function sleep(ms) {
 function calculateRetryDelay(attempt) {
   return RETRY_DELAY_BASE * 2 ** attempt + Math.random() * 100;
 }
-function providerStatusError(status) {
-  return new Error(`HTTP ${status}`);
+function publicRequestUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return void 0;
+  }
+  parsed.username = "";
+  parsed.password = "";
+  parsed.search = "";
+  parsed.hash = "";
+  return parsed.href;
+}
+function providerStatusError(status, url) {
+  const requestUrl = publicRequestUrl(url);
+  return new Error(
+    requestUrl === void 0 ? `HTTP ${status}` : `HTTP ${status} for ${requestUrl}`
+  );
 }
 async function releaseResponse(response) {
   await response.body?.cancel().catch(() => void 0);
@@ -21203,7 +21220,7 @@ async function fetchProvider(url, init, timeoutMs, signal) {
       throw e;
     }
     if (terminalStatus !== void 0) {
-      throw providerStatusError(terminalStatus);
+      throw providerStatusError(terminalStatus, url);
     }
   }
   throw lastError;
@@ -21783,6 +21800,9 @@ async function runAIAssist(request, config, validate, dryRun, client) {
   }
   throw new Error(`Max fix attempts (${MAX_FIX_ATTEMPTS}) reached`);
 }
+var PRIVATE_DIR_MODE = 448;
+var PRIVATE_FILE_MODE = 384;
+var NOT_REGULAR_FILE = "provider config path is not a regular file";
 function getConfigDir() {
   const platform = process.platform;
   if (platform === "win32") {
@@ -21812,24 +21832,95 @@ function getConfigDir() {
 function getProviderConfigPath() {
   return path.join(getConfigDir(), "provider.json");
 }
+function optionalFlag(flag) {
+  return typeof flag === "number" ? flag : 0;
+}
+function writeFlags() {
+  return constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | optionalFlag(constants.O_NOFOLLOW) | optionalFlag(constants.O_NONBLOCK);
+}
+function readFlags() {
+  return constants.O_RDONLY | optionalFlag(constants.O_NOFOLLOW) | optionalFlag(constants.O_NONBLOCK);
+}
+function isRegularProviderFile(info) {
+  return info.isFile() && !info.isSymbolicLink() && !info.isFIFO();
+}
+function errnoCode(error) {
+  return error.code;
+}
+function isRejectedOpenError(error) {
+  const code = errnoCode(error);
+  return code === "ELOOP" || code === "ENXIO" || code === "EISDIR";
+}
+async function assertRegularProviderFile(configPath) {
+  const info = await fs.lstat(configPath);
+  if (!isRegularProviderFile(info)) {
+    throw new Error(NOT_REGULAR_FILE);
+  }
+}
+async function openProviderFile(configPath, flags, mode) {
+  let handle;
+  try {
+    handle = mode === void 0 ? await fs.open(configPath, flags) : await fs.open(configPath, flags, mode);
+  } catch (error) {
+    if (isRejectedOpenError(error)) throw new Error(NOT_REGULAR_FILE);
+    throw error;
+  }
+  try {
+    const opened = await handle.stat();
+    if (!isRegularProviderFile(opened)) {
+      throw new Error(NOT_REGULAR_FILE);
+    }
+    return handle;
+  } catch (error) {
+    await handle.close().catch(() => void 0);
+    throw error;
+  }
+}
 async function readProviderConfig() {
   const configPath = getProviderConfigPath();
   try {
-    const content = await fs.readFile(configPath, "utf8");
+    await assertRegularProviderFile(configPath);
+  } catch (error) {
+    if (errnoCode(error) === "ENOENT") return null;
+    throw error;
+  }
+  let handle;
+  try {
+    handle = await openProviderFile(configPath, readFlags());
+  } catch (error) {
+    if (errnoCode(error) === "ENOENT") return null;
+    throw error;
+  }
+  try {
+    const content = await handle.readFile({ encoding: "utf8" });
     return JSON.parse(content);
-  } catch (e) {
-    if (e.code === "ENOENT") {
-      return null;
-    }
-    throw e;
+  } finally {
+    await handle.close().catch(() => void 0);
   }
 }
 async function writeProviderConfig(config) {
   const configPath = getProviderConfigPath();
   const configDir = path.dirname(configPath);
-  await fs.mkdir(configDir, { recursive: true });
+  await fs.mkdir(configDir, { recursive: true, mode: PRIVATE_DIR_MODE });
+  await fs.chmod(configDir, PRIVATE_DIR_MODE);
+  try {
+    await assertRegularProviderFile(configPath);
+  } catch (error) {
+    if (errnoCode(error) !== "ENOENT") throw error;
+  }
   const content = JSON.stringify(config, null, 2);
-  await fs.writeFile(configPath, content, { mode: 384 });
+  const handle = await openProviderFile(
+    configPath,
+    writeFlags(),
+    PRIVATE_FILE_MODE
+  );
+  try {
+    await handle.chmod(PRIVATE_FILE_MODE);
+    await handle.writeFile(Buffer.from(content, "utf8"));
+    await handle.chmod(PRIVATE_FILE_MODE);
+  } finally {
+    await handle.close();
+  }
 }
 async function deleteProviderConfig() {
   const configPath = getProviderConfigPath();
@@ -22177,7 +22268,7 @@ async function darwinPathOf(fd) {
 }
 function isConfinedFileSupported() {
   if (process.platform === "linux") {
-    return typeof constants.O_NOFOLLOW === "number" && typeof constants.O_DIRECTORY === "number" && typeof constants.O_NONBLOCK === "number" && existsSync("/proc/self/fd");
+    return typeof constants2.O_NOFOLLOW === "number" && typeof constants2.O_DIRECTORY === "number" && typeof constants2.O_NONBLOCK === "number" && existsSync("/proc/self/fd");
   }
   return darwinConfinedAvailable();
 }
@@ -22198,7 +22289,7 @@ function fromNodeHandle(file) {
 }
 var linuxOps = {
   async openRelative(dirFd, component, flags) {
-    return fromNodeHandle(await open(fdRelativePath(dirFd, component), flags));
+    return fromNodeHandle(await open2(fdRelativePath(dirFd, component), flags));
   },
   async pathOf(fd) {
     try {
@@ -22231,9 +22322,9 @@ async function proveDescriptorWithinRoot(file, canonicalRoot, pathOf) {
 }
 function openFlags(directory) {
   if (directory) {
-    return constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
+    return constants2.O_RDONLY | constants2.O_DIRECTORY | constants2.O_NOFOLLOW;
   }
-  return constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+  return constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK;
 }
 async function openConfinedUsing(root, logicalPath, ops) {
   const normalized = normalizeLogicalPath(logicalPath);
@@ -22243,7 +22334,7 @@ async function openConfinedUsing(root, logicalPath, ops) {
   try {
     const canonicalRoot = await realpath(root);
     parent = fromNodeHandle(
-      await open(canonicalRoot, constants.O_RDONLY | constants.O_DIRECTORY)
+      await open2(canonicalRoot, constants2.O_RDONLY | constants2.O_DIRECTORY)
     );
     for (let index = 0; index < components.length - 1; index += 1) {
       const component = components[index] ?? "";
@@ -22561,7 +22652,7 @@ async function writeFileAtomic(path2, data, mode) {
   let created = false;
   let handle;
   try {
-    handle = await open2(tmp, flags, 384);
+    handle = await open3(tmp, flags, 384);
     created = true;
     await handle.writeFile(data, "utf8");
     await handle.chmod(mode ?? 420);
@@ -22602,9 +22693,9 @@ function caCertificateMatchesPrivateKey(certPem, keyPem) {
 async function readNoFollowRegularFile(path2) {
   let handle;
   try {
-    const info = await lstat(path2);
+    const info = await lstat2(path2);
     if (!info.isFile()) return void 0;
-    handle = await open2(path2, fsConstants.O_RDONLY | noFollowFlag());
+    handle = await open3(path2, fsConstants.O_RDONLY | noFollowFlag());
     const opened = await handle.stat();
     if (!opened.isFile()) return void 0;
     return await handle.readFile({ encoding: "utf8" });
@@ -22633,7 +22724,7 @@ async function readPreviousRogatioCa(caCertFile) {
 async function assertReadableIfRegular(path2, snapshot2) {
   if (snapshot2 !== void 0) return;
   try {
-    const info = await lstat(path2);
+    const info = await lstat2(path2);
     if (!info.isFile()) return;
   } catch {
     return;
@@ -22736,7 +22827,7 @@ function createRequestBodyTrustController(options = {}) {
   async function readRecordedDirs() {
     if (!recordsManifestDirs) return void 0;
     try {
-      return parseRecordedDirs(await readFile2(manifestRecordPath, "utf8"));
+      return parseRecordedDirs(await readFile(manifestRecordPath, "utf8"));
     } catch {
       return void 0;
     }
@@ -22754,7 +22845,7 @@ function createRequestBodyTrustController(options = {}) {
   async function snapshotFile(path2) {
     let previous;
     try {
-      previous = await readFile2(path2, "utf8");
+      previous = await readFile(path2, "utf8");
     } catch {
       previous = void 0;
     }
@@ -22867,8 +22958,8 @@ function createRequestBodyTrustController(options = {}) {
   async function reusableCaMaterial() {
     try {
       const [keyStat, certStat] = await Promise.all([
-        lstat(caKeyFile),
-        lstat(caCertFile)
+        lstat2(caKeyFile),
+        lstat2(caCertFile)
       ]);
       if (!keyStat.isFile() || !certStat.isFile()) return false;
       if (process.platform !== "win32") {
@@ -22877,8 +22968,8 @@ function createRequestBodyTrustController(options = {}) {
         if (uid !== void 0 && keyStat.uid !== uid) return false;
       }
       const [certPem, keyPem] = await Promise.all([
-        readFile2(caCertFile, "utf8"),
-        readFile2(caKeyFile, "utf8")
+        readFile(caCertFile, "utf8"),
+        readFile(caKeyFile, "utf8")
       ]);
       return caCertificateMatchesPrivateKey(certPem, keyPem);
     } catch {
@@ -22992,7 +23083,7 @@ function createRequestBodyTrustController(options = {}) {
     let installedNew = false;
     if (caTrustInstaller && !installerCalled) {
       installerCalled = true;
-      await caTrustInstaller(await readFile2(caCertFile, "utf8"));
+      await caTrustInstaller(await readFile(caCertFile, "utf8"));
       installedNew = true;
     }
     if (reusable && siblingAnchor && (installedNew || !caTrustInstaller)) {
@@ -23085,7 +23176,7 @@ function createRequestBodyTrustController(options = {}) {
     let installed = dirs.length > 0;
     for (const dir of dirs) {
       try {
-        const raw = await readFile2(join2(dir, `${hostName}.json`), "utf8");
+        const raw = await readFile(join2(dir, `${hostName}.json`), "utf8");
         const parsed = JSON.parse(raw);
         if (!isWellFormedManifest(parsed) || !manifestAcceptable(parsed)) {
           installed = false;
@@ -23117,7 +23208,7 @@ function createRequestBodyTrustController(options = {}) {
     let binaryPath;
     for (const dir of dirs) {
       try {
-        const raw = await readFile2(join2(dir, `${hostName}.json`), "utf8");
+        const raw = await readFile(join2(dir, `${hostName}.json`), "utf8");
         const parsed = JSON.parse(raw);
         if (!isWellFormedManifest(parsed) || !manifestAcceptable(parsed)) {
           manifestValid = false;
@@ -23168,14 +23259,14 @@ function createRequestBodyTrustController(options = {}) {
   return { install, uninstall, status, verify: verify2 };
 }
 var INSTALL_CERT_NAME = "ca.crt";
-function optionalFlag(flag) {
+function optionalFlag2(flag) {
   return typeof flag === "number" ? flag : 0;
 }
 function exclusiveWriteFlags() {
-  return constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_TRUNC | optionalFlag(constants2.O_NOFOLLOW);
+  return constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_TRUNC | optionalFlag2(constants3.O_NOFOLLOW);
 }
-function readFlags() {
-  return constants2.O_RDONLY | optionalFlag(constants2.O_NOFOLLOW) | optionalFlag(constants2.O_NONBLOCK);
+function readFlags2() {
+  return constants3.O_RDONLY | optionalFlag2(constants3.O_NOFOLLOW) | optionalFlag2(constants3.O_NONBLOCK);
 }
 function refuseCertificateFile(message) {
   throw new TrustError("trust.internal", message, [
@@ -23183,7 +23274,7 @@ function refuseCertificateFile(message) {
   ]);
 }
 async function writeExclusiveCertificate(certPath, pem) {
-  const handle = await open3(certPath, exclusiveWriteFlags(), 384);
+  const handle = await open4(certPath, exclusiveWriteFlags(), 384);
   try {
     await handle.writeFile(Buffer.from(pem, "utf8"));
     await handle.chmod(384);
@@ -23194,7 +23285,7 @@ async function writeExclusiveCertificate(certPath, pem) {
 async function assertCertificateReady(certPath, pem) {
   let info;
   try {
-    info = await lstat2(certPath);
+    info = await lstat3(certPath);
   } catch {
     refuseCertificateFile("certificate file is not a regular file");
   }
@@ -23203,7 +23294,7 @@ async function assertCertificateReady(certPath, pem) {
   }
   let handle;
   try {
-    handle = await open3(certPath, readFlags());
+    handle = await open4(certPath, readFlags2());
     const opened = await handle.stat();
     if (!opened.isFile() || opened.isFIFO() || opened.isSymbolicLink()) {
       refuseCertificateFile("certificate file is not a regular file");
@@ -23283,12 +23374,12 @@ var darwinAdapter = {
       reasons.push("tooling-missing");
     }
     try {
-      accessSync(manifestDir, constants3.W_OK);
+      accessSync(manifestDir, constants4.W_OK);
     } catch {
       reasons.push("manifest-dir-unwritable");
     }
     try {
-      accessSync(caDir, constants3.W_OK);
+      accessSync(caDir, constants4.W_OK);
     } catch {
       reasons.push("keychain-unwritable");
     }
@@ -23425,7 +23516,7 @@ function exists(path2) {
 }
 function writable(path2) {
   try {
-    accessSync2(path2, constants4.W_OK);
+    accessSync2(path2, constants5.W_OK);
     return true;
   } catch {
     return false;
@@ -23462,7 +23553,7 @@ function p11kitAnchorsDir() {
 function needsElevation(dir) {
   if (writable(dir)) return false;
   try {
-    accessSync2(dir, constants4.W_OK);
+    accessSync2(dir, constants5.W_OK);
   } catch (err) {
     if (nodeCode(err) === "ENOENT" && writable(dirname4(dir))) return false;
   }
@@ -23479,13 +23570,13 @@ function manifestDirFor(browser) {
 }
 function canHostManifest(dir) {
   try {
-    accessSync2(dir, constants4.W_OK);
+    accessSync2(dir, constants5.W_OK);
     return true;
   } catch (err) {
     if (nodeCode(err) !== "ENOENT") return false;
   }
   try {
-    accessSync2(dirname4(dir), constants4.W_OK);
+    accessSync2(dirname4(dir), constants5.W_OK);
     return true;
   } catch {
     return false;
@@ -23676,7 +23767,7 @@ var win32Adapter = {
       reasons.push("tooling-missing");
     }
     try {
-      accessSync3(manifestDir, constants5.W_OK);
+      accessSync3(manifestDir, constants6.W_OK);
     } catch {
       reasons.push("manifest-dir-unwritable");
     }
@@ -24667,7 +24758,7 @@ async function resolveConfinedRoot(value) {
   }
   let directory;
   try {
-    directory = await open4(value, constants6.O_RDONLY | constants6.O_DIRECTORY);
+    directory = await open5(value, constants7.O_RDONLY | constants7.O_DIRECTORY);
     const info = await directory.stat();
     if (!info.isDirectory()) return failure("runtime.root-invalid");
     return { ok: true, value: await realpath2(value) };
@@ -28805,11 +28896,11 @@ import {
   access,
   mkdir as mkdir3,
   readdir,
-  readFile as readFile3,
+  readFile as readFile2,
   rename as rename2,
   stat as stat2,
   unlink as unlink2,
-  writeFile as writeFile2
+  writeFile
 } from "node:fs/promises";
 import { basename as basename2, dirname as dirname5, join as join7 } from "node:path";
 var ProjectStorageError = class extends Error {
@@ -28907,7 +28998,7 @@ function isJsonFilename(name) {
 async function isDiscoverableProjectFile(id2) {
   let parsed;
   try {
-    parsed = JSON.parse(await readFile3(id2, "utf-8"));
+    parsed = JSON.parse(await readFile2(id2, "utf-8"));
   } catch {
     return false;
   }
@@ -28971,7 +29062,7 @@ function migrateLoadedProject(parsed) {
 }
 async function readDocument(id2) {
   try {
-    const content = await readFile3(id2, "utf-8");
+    const content = await readFile2(id2, "utf-8");
     const parsed = JSON.parse(content);
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
       throw new ProjectFileError(
@@ -29026,7 +29117,7 @@ async function writeDocument(id2, data) {
       );
     }
     await mkdir3(dirname5(id2), { recursive: true });
-    await writeFile2(tempPath, JSON.stringify(data, null, 2), "utf-8");
+    await writeFile(tempPath, JSON.stringify(data, null, 2), "utf-8");
     await rename2(tempPath, id2);
   } catch (e) {
     if (e instanceof ProjectFileError) throw e;
@@ -29702,7 +29793,7 @@ function createServer3(handler, options = {}) {
 
 // packages/cli/src/server/routes.ts
 import { randomBytes as randomBytes4, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { readFile as readFile5 } from "node:fs/promises";
+import { readFile as readFile4 } from "node:fs/promises";
 import { dirname as dirname9, isAbsolute as isAbsolute5, resolve as resolve5 } from "node:path";
 
 // packages/dry-run/dist/node/index.js
@@ -30075,7 +30166,7 @@ function previewRuleAction(operation, url) {
 }
 
 // packages/cli/src/mock-root-config.ts
-import { mkdir as mkdir4, readFile as readFile4, realpath as realpath3, rename as rename3, writeFile as writeFile3 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile3, realpath as realpath3, rename as rename3, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname as dirname8, isAbsolute as isAbsolute4, join as join8, resolve as resolve4 } from "node:path";
 function mockRootConfigPath(env = process.env) {
@@ -30093,7 +30184,7 @@ async function canonicalProjectPath(filePath) {
 async function readMap(env) {
   let raw;
   try {
-    raw = await readFile4(mockRootConfigPath(env), "utf8");
+    raw = await readFile3(mockRootConfigPath(env), "utf8");
   } catch {
     return {};
   }
@@ -30121,7 +30212,7 @@ async function writeMap(map, env) {
   const path2 = mockRootConfigPath(env);
   await mkdir4(dirname8(path2), { recursive: true });
   const temporary = `${path2}.${process.pid}.tmp`;
-  await writeFile3(
+  await writeFile2(
     temporary,
     `${JSON.stringify({ projects: map }, null, 2)}
 `,
@@ -30334,7 +30425,7 @@ function createRoutes(context) {
     }
     if (pathname === "/vendor/editor.js" && method === "GET") {
       try {
-        const bundle = await readFile5(context.editorBundlePath, "utf-8");
+        const bundle = await readFile4(context.editorBundlePath, "utf-8");
         res.writeHead(200, {
           "Content-Type": "text/javascript; charset=utf-8"
         });
@@ -30352,7 +30443,7 @@ function createRoutes(context) {
     }
     if (pathname === "/vendor/editor.css" && method === "GET") {
       try {
-        const css = await readFile5(context.editorCssPath, "utf-8");
+        const css = await readFile4(context.editorCssPath, "utf-8");
         res.writeHead(200, {
           "Content-Type": "text/css; charset=utf-8"
         });
@@ -30376,7 +30467,7 @@ function createRoutes(context) {
         return;
       }
       try {
-        const font = await readFile5(resolve5(context.editorFontsPath, fileName));
+        const font = await readFile4(resolve5(context.editorFontsPath, fileName));
         res.writeHead(200, {
           "Content-Type": "font/woff2"
         });
@@ -31506,7 +31597,7 @@ function generateEditorHtml(filePath, aiConfigured) {
 }
 
 // packages/cli/src/commands/import.ts
-import { access as access2, readFile as readFile6 } from "node:fs/promises";
+import { access as access2, readFile as readFile5 } from "node:fs/promises";
 import { resolve as resolve7 } from "node:path";
 
 // packages/requestly-import/dist/node/index.js
@@ -33362,7 +33453,7 @@ async function importCommand(args) {
   const flags = parsed.flags;
   let exportData;
   try {
-    exportData = JSON.parse(await readFile6(flags.sourcePath, "utf8"));
+    exportData = JSON.parse(await readFile5(flags.sourcePath, "utf8"));
   } catch (error) {
     console.error(`Error: ${errorMessage(error)}`);
     return 2;
@@ -33381,7 +33472,7 @@ async function importCommand(args) {
     }
     let existing;
     try {
-      existing = JSON.parse(await readFile6(flags.outputPath, "utf8"));
+      existing = JSON.parse(await readFile5(flags.outputPath, "utf8"));
     } catch (error) {
       console.error(`Error: ${errorMessage(error)}`);
       return 2;
@@ -33520,7 +33611,7 @@ function errorMessage(error) {
 }
 
 // packages/cli/src/commands/runtime.ts
-import { chmod, mkdir as mkdir5, rm as rm4, writeFile as writeFile4 } from "node:fs/promises";
+import { chmod as chmod2, mkdir as mkdir5, rm as rm4, writeFile as writeFile3 } from "node:fs/promises";
 import { dirname as dirname10, join as join9, resolve as resolve8 } from "node:path";
 function generateHostWrapper(rogatioCommand, logPath) {
   const parts = rogatioCommand.split(" ");
@@ -33541,8 +33632,8 @@ async function writeHostWrapper(hostPath, installRoot) {
     `${process.execPath} ${process.argv[1] ?? "rogatio"}`,
     logPath
   );
-  await writeFile4(hostPath, script, "utf8");
-  await chmod(hostPath, 493);
+  await writeFile3(hostPath, script, "utf8");
+  await chmod2(hostPath, 493);
 }
 function makeTrustController() {
   return createInstalledTrustController();
@@ -33834,7 +33925,7 @@ async function runRuntimeHostEntry() {
 }
 
 // packages/cli/src/commands/test.ts
-import { readFile as readFile7 } from "node:fs/promises";
+import { readFile as readFile6 } from "node:fs/promises";
 import { resolve as resolve9 } from "node:path";
 function usageError(message) {
   return `Error: ${message}
@@ -33992,7 +34083,7 @@ async function testCommandImpl(args, stdinInput, captureOutput, options = {}) {
   for (const url of positionalUrls) urlCases.push({ url });
   if (urlsFile) {
     try {
-      const content = urlsFile === "-" ? stdinInput ?? "" : await readFile7(urlsFile, "utf8");
+      const content = urlsFile === "-" ? stdinInput ?? "" : await readFile6(urlsFile, "utf8");
       const parsed = JSON.parse(content);
       if (!Array.isArray(parsed)) {
         const output = usageError(`${urlsFile} must contain a JSON array`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.20.5",
+  "version": "6.20.7",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",