@patchstack/connect 0.2.11 → 0.3.1

package/dist/cli.js

@@ -1108,94 +1108,6 @@ function isEnvironment(value) {
 // src/mark-build.ts
 import { existsSync, readdirSync, statSync } from "fs";
 import path7 from "path";
-
-// src/stack.ts
-var STACK_RULES = [
-  // Meta-frameworks (most specific first).
-  { category: "framework", pkg: "@tanstack/react-start", label: "tanstack-start" },
-  { category: "framework", pkg: "@tanstack/start", label: "tanstack-start" },
-  { category: "framework", pkg: "next", label: "next" },
-  { category: "framework", pkg: "nuxt", label: "nuxt" },
-  { category: "framework", pkg: "@remix-run/react", label: "remix" },
-  { category: "framework", pkg: "@remix-run/node", label: "remix" },
-  { category: "framework", pkg: "react-router", label: "react-router" },
-  { category: "framework", pkg: "astro", label: "astro" },
-  { category: "framework", pkg: "@sveltejs/kit", label: "sveltekit" },
-  { category: "framework", pkg: "@builder.io/qwik-city", label: "qwik-city" },
-  { category: "framework", pkg: "gatsby", label: "gatsby" },
-  { category: "framework", pkg: "express", label: "express" },
-  { category: "framework", pkg: "fastify", label: "fastify" },
-  // UI runtimes.
-  { category: "ui", pkg: "@angular/core", label: "angular" },
-  { category: "ui", pkg: "react-dom", label: "react" },
-  { category: "ui", pkg: "react", label: "react" },
-  { category: "ui", pkg: "vue", label: "vue" },
-  { category: "ui", pkg: "svelte", label: "svelte" },
-  { category: "ui", pkg: "solid-js", label: "solid" },
-  { category: "ui", pkg: "preact", label: "preact" },
-  // Bundlers / build tools.
-  { category: "bundler", pkg: "vite", label: "vite" },
-  { category: "bundler", pkg: "@rspack/core", label: "rspack" },
-  { category: "bundler", pkg: "webpack", label: "webpack" },
-  { category: "bundler", pkg: "parcel", label: "parcel" },
-  { category: "bundler", pkg: "rollup", label: "rollup" },
-  { category: "bundler", pkg: "esbuild", label: "esbuild" },
-  // Deployment-runtime hints from build deps.
-  { category: "runtime", pkg: "wrangler", label: "cloudflare-workers" },
-  { category: "runtime", pkg: "@cloudflare/workers-types", label: "cloudflare-workers" },
-  { category: "runtime", pkg: "@cloudflare/vite-plugin", label: "cloudflare-workers" },
-  { category: "runtime", pkg: "@vercel/node", label: "vercel" },
-  { category: "runtime", pkg: "@netlify/functions", label: "netlify" },
-  { category: "runtime", pkg: "@netlify/blobs", label: "netlify" },
-  // Vibe / builder platforms — the "learn from each platform" signal.
-  { category: "builder", pkg: "lovable-tagger", label: "lovable" },
-  { category: "builder", pkg: "@replit/vite-plugin-runtime-error-modal", label: "replit" },
-  { category: "builder", pkg: "@replit/vite-plugin-cartographer", label: "replit" }
-];
-var HOSTING_ENV_PATTERNS = [
-  /^CF_/,
-  /^CLOUDFLARE_/,
-  /^VERCEL/,
-  /^NETLIFY/,
-  /^AWS_(LAMBDA|REGION|EXECUTION)/,
-  /^FLY_/,
-  /^RENDER/,
-  /^RAILWAY_/,
-  /^DENO_/,
-  /^EDGE_RUNTIME/,
-  /^DYNO$/,
-  /^K_SERVICE$/,
-  /^GAE_/,
-  /^FUNCTION_/
-];
-function collectHostingEnvKeys(env = process.env) {
-  return Object.keys(env).filter((key) => HOSTING_ENV_PATTERNS.some((pattern) => pattern.test(key))).sort();
-}
-function detectStack(packages, env = process.env) {
-  const present = new Set(packages.map((pkg) => pkg.name));
-  const firstMatch = (category) => {
-    for (const rule of STACK_RULES) {
-      if (rule.category === category && present.has(rule.pkg)) {
-        return rule.label;
-      }
-    }
-    return null;
-  };
-  return {
-    framework: firstMatch("framework"),
-    ui: firstMatch("ui"),
-    bundler: firstMatch("bundler"),
-    runtime: firstMatch("runtime"),
-    builder: firstMatch("builder"),
-    ecosystem: "npm",
-    hostingEnvKeys: collectHostingEnvKeys(env)
-  };
-}
-function isEmptyStack(stack) {
-  return stack.framework === null && stack.ui === null && stack.bundler === null && stack.runtime === null && stack.builder === null && stack.hostingEnvKeys.length === 0;
-}
-
-// src/mark-build.ts
 var MARKER_ATTR = "data-patchstack-build";
 var BUILD_DIR_CANDIDATES = ["dist", "build", "out", ".output/public"];
 function resolveBuildDir(cwd, override) {
@@ -1226,14 +1138,11 @@ function findHtmlFiles(dir) {
   walk2(dir);
   return out;
 }
-function buildInjectionSnippet(checksum, stack) {
+function buildInjectionSnippet(checksum) {
   const statements = ["window.__PATCHSTACK_PROD__=true;"];
   if (checksum !== null && checksum !== "") {
     statements.push(`window.__PATCHSTACK_BUILD__=${JSON.stringify(checksum)};`);
   }
-  if (stack != null && !isEmptyStack(stack)) {
-    statements.push(`window.__PATCHSTACK_STACK__=${JSON.stringify(stack)};`);
-  }
   return `<script ${MARKER_ATTR}>${statements.join("")}</script>`;
 }
 function injectMarker(html, snippet) {
@@ -1252,13 +1161,17 @@ function injectMarker(html, snippet) {
 
 // src/protect/install.ts
 import { readFileSync, writeFileSync, existsSync as existsSync2, mkdirSync, copyFileSync } from "fs";
-import { join } from "path";
+import { join, dirname } from "path";
 import { fileURLToPath } from "url";
-var TEMPLATES = fileURLToPath(new URL("./protect/templates/", import.meta.url));
+var TEMPLATES = join(dirname(fileURLToPath(import.meta.url)), "protect", "templates");
+var APP = process.cwd();
+var PS_DIR = join(APP, "src/integrations/patchstack");
+var read = (p) => readFileSync(p, "utf8");
+var log = (msg) => console.log(`patchstack protect: ${msg}`);
 var CLIENT_TUNNEL = [
   "",
-  "    // PATCHSTACK auto-guard: in the browser, tunnel Supabase traffic through the app's own",
-  "    // server guard (same-origin) so payloads are inspected before they reach Supabase.",
+  "    // PATCHSTACK: in the browser, tunnel Supabase traffic through the app's own server guard",
+  "    // (same-origin) so payloads are inspected before they reach Supabase.",
   "    if (typeof window !== 'undefined') {",
   "      const target = typeof input === 'string' ? input : input instanceof Request ? input.url : String(input);",
   "      const method = init?.method ?? (input instanceof Request ? input.method : 'GET');",
@@ -1270,11 +1183,11 @@ var CLIENT_TUNNEL = [
 ].join("\n");
 var START_IMPORTS = [
   'import { getRequest } from "@tanstack/react-start/server";',
-  'import { GUARD_PATH, handleGuardRequest } from "@/integrations/patchstack/guard";'
+  'import { GUARD_PATH, handleGuardRequest, inspectServerFn } from "@/integrations/patchstack/guard";'
 ].join("\n");
 var START_MIDDLEWARE = [
   "",
-  "// Patchstack auto-guard: intercept the tunneled data traffic before anything else runs.",
+  "// Patchstack guard (browser tunnel): intercept tunneled Supabase traffic before anything else.",
   "const patchstackGuard = createMiddleware().server(async ({ next }) => {",
   "  const request = getRequest();",
   "  if (request) {",
@@ -1283,115 +1196,69 @@ var START_MIDDLEWARE = [
   "  }",
   "  return next();",
   "});",
+  "",
+  "// Patchstack guard (server functions): inspect server-fn args before they reach the database,",
+  "// covering apps that mutate via TanStack server functions (which bypass the browser tunnel).",
+  'const patchstackFunctionGuard = createMiddleware({ type: "function" }).server(async ({ next, data }) => {',
+  "  const blocked = await inspectServerFn(data);",
+  "  if (blocked) throw new Error(blocked.message);",
+  "  return next();",
+  "});",
   ""
 ].join("\n");
-var PS_DIR_REL = "src/integrations/patchstack";
-function log(msg) {
-  console.log(`patchstack protect: ${msg}`);
-}
 function detectSupportedStack(cwd) {
   const pkgPath = join(cwd, "package.json");
   if (!existsSync2(pkgPath)) return false;
-  const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+  const pkg = JSON.parse(read(pkgPath));
   const deps = { ...pkg.dependencies, ...pkg.devDependencies };
   return Boolean(deps["@tanstack/react-start"]) && existsSync2(join(cwd, "src/start.ts")) && existsSync2(join(cwd, "src/integrations/supabase/client.ts"));
 }
-function generateManifest(cwd) {
-  const pkg = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
-  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
-  const packages = {};
-  for (const name of Object.keys(deps)) {
-    let version = String(deps[name]).replace(/^[^\d]*/, "");
-    const installed = join(cwd, "node_modules", name, "package.json");
-    if (existsSync2(installed)) {
-      try {
-        version = JSON.parse(readFileSync(installed, "utf8")).version;
-      } catch {
-      }
-    }
-    packages[name] = version;
-  }
-  mkdirSync(join(cwd, PS_DIR_REL), { recursive: true });
-  const body = "// Patchstack auto-guard manifest \u2014 generated from the lockfile.\n// Do not edit; regenerated by `patchstack-connect protect --manifest` (wired into prebuild).\nexport const manifest = " + JSON.stringify({ packages }, null, 2) + ";\n";
-  writeFileSync(join(cwd, PS_DIR_REL, "manifest.js"), body);
-  log(`wrote manifest.js (${Object.keys(packages).length} packages)`);
-}
 function scaffold(cwd) {
-  const dst = join(cwd, PS_DIR_REL);
+  const dst = join(cwd, "src/integrations/patchstack");
   mkdirSync(dst, { recursive: true });
-  copyFileSync(join(TEMPLATES, "engine.js"), join(dst, "engine.js"));
-  copyFileSync(join(TEMPLATES, "engine.d.ts"), join(dst, "engine.d.ts"));
-  copyFileSync(join(TEMPLATES, "manifest.d.ts"), join(dst, "manifest.d.ts"));
-  copyFileSync(join(TEMPLATES, "rules.json"), join(dst, "rules.json"));
   copyFileSync(join(TEMPLATES, "guard.ts"), join(dst, "guard.ts"));
-  log("scaffolded engine.js (+types), rules.json, guard.ts");
+  copyFileSync(join(TEMPLATES, "rules.json"), join(dst, "rules.json"));
+  log("scaffolded guard.ts + rules.json");
 }
 function patchClient(cwd) {
   const p = join(cwd, "src/integrations/supabase/client.ts");
-  let s = readFileSync(p, "utf8");
-  if (s.includes("x-ps-target")) {
-    log("client.ts already wired");
-    return;
-  }
+  let s = read(p);
+  if (s.includes("x-ps-target")) return log("client.ts already wired");
   const anchor = "headers.set('apikey', supabaseKey);";
-  if (!s.includes(anchor)) {
-    log("client.ts anchor not found (template changed?) \u2014 skipping client patch");
-    return;
-  }
-  s = s.replace(anchor, anchor + "\n" + CLIENT_TUNNEL);
-  writeFileSync(p, s);
+  if (!s.includes(anchor)) return log("client.ts anchor not found \u2014 skipping (template changed?)");
+  writeFileSync(p, s.replace(anchor, anchor + "\n" + CLIENT_TUNNEL));
   log("patched client.ts (tunnel Supabase through the guard)");
 }
 function patchStart(cwd) {
   const p = join(cwd, "src/start.ts");
-  let s = readFileSync(p, "utf8");
-  if (s.includes("patchstackGuard")) {
-    log("start.ts already wired");
-    return;
-  }
+  let s = read(p);
+  if (s.includes("patchstackGuard")) return log("start.ts already wired");
   const importAnchor = 'import { createStart, createMiddleware } from "@tanstack/react-start";';
   const exportAnchor = "export const startInstance";
   const rmAnchor = "requestMiddleware: [";
   if (!s.includes(importAnchor) || !s.includes(exportAnchor) || !s.includes(rmAnchor)) {
-    log("start.ts anchors not found (template changed?) \u2014 skipping start patch");
-    return;
+    return log("start.ts anchors not found \u2014 skipping (template changed?)");
   }
   s = s.replace(importAnchor, importAnchor + "\n" + START_IMPORTS);
   s = s.replace(exportAnchor, START_MIDDLEWARE + "\n" + exportAnchor);
   s = s.replace(rmAnchor, rmAnchor + "patchstackGuard, ");
-  writeFileSync(p, s);
-  log("patched start.ts (registered the guard as request middleware)");
-}
-function wirePrebuild(cwd) {
-  const p = join(cwd, "package.json");
-  const pkg = JSON.parse(readFileSync(p, "utf8"));
-  pkg.scripts = pkg.scripts || {};
-  const step = "patchstack-connect protect --manifest";
-  const prebuild = pkg.scripts.prebuild || "";
-  if (prebuild.includes(step)) {
-    log("prebuild already refreshes the manifest");
-    return;
+  const fmAnchor = "functionMiddleware: [";
+  if (s.includes(fmAnchor)) {
+    s = s.replace(fmAnchor, fmAnchor + "patchstackFunctionGuard, ");
+  } else {
+    s = s.replace(rmAnchor, "functionMiddleware: [patchstackFunctionGuard],\n    " + rmAnchor);
   }
-  pkg.scripts.prebuild = prebuild ? prebuild + " && " + step : step;
-  writeFileSync(p, JSON.stringify(pkg, null, 2) + "\n");
-  log("wired manifest refresh into prebuild");
+  writeFileSync(p, s);
+  log("patched start.ts (guard registered as request + function middleware)");
 }
-function runProtect(cwd, opts = {}) {
-  if (opts.manifestOnly) {
-    generateManifest(cwd);
-    return;
-  }
+function runProtect(cwd) {
   if (!detectSupportedStack(cwd)) {
-    log(
-      "runtime protection currently supports TanStack Start + Supabase apps; stack not detected \u2014 skipping."
-    );
+    log("runtime protection currently supports TanStack Start + Supabase apps; stack not detected \u2014 skipping.");
     return;
   }
   scaffold(cwd);
   patchClient(cwd);
   patchStart(cwd);
-  generateManifest(cwd);
-  wirePrebuild(cwd);
   log("done \u2014 guard wired and always-on (blocks by default). Set PATCHSTACK_MODE=dry-run for log-only.");
 }
 
@@ -1407,9 +1274,8 @@ Usage:
   patchstack-connect status [options]                Show current configuration
   patchstack-connect mark-build [options]            Stamp built HTML with a production flag +
                                                      build fingerprint (run as a postbuild step)
-  patchstack-connect protect [--manifest]            Install runtime protection (the guard) into
-                                                     a server-side JS app. --manifest only
-                                                     regenerates the package manifest (prebuild).
+  patchstack-connect protect                         Install always-on runtime protection (the
+                                                     guard) into a TanStack Start + Supabase app.
   patchstack-connect help                            Print this message
 
 Options (for scan and status):
@@ -1547,9 +1413,9 @@ async function runScan(args) {
   }
   return 0;
 }
-async function runProtectCommand(args) {
+async function runProtectCommand(_args) {
   try {
-    runProtect(process.cwd(), { manifestOnly: args.flags.get("manifest") === true });
+    runProtect(process.cwd());
   } catch (err) {
     console.warn(`patchstack protect: skipped (${err.message}).`);
   }
@@ -1570,19 +1436,9 @@ async function runStatus(args) {
   }
   return 0;
 }
-function describeStack(stack) {
-  const parts = [stack.builder, stack.framework, stack.ui, stack.runtime].filter(
-    (part) => part !== null
-  );
-  if (stack.hostingEnvKeys.length > 0) {
-    parts.push(`${stack.hostingEnvKeys.length} hosting env key(s)`);
-  }
-  return parts.length > 0 ? parts.join(" \xB7 ") : null;
-}
 async function runMarkBuild(args) {
   const cwd = process.cwd();
   let checksum = null;
-  let stack = null;
   try {
     const manifest = await scanLockfile(cwd);
     for (const warning of manifest.warnings ?? []) {
@@ -1590,7 +1446,6 @@ async function runMarkBuild(args) {
     }
     const { payload } = buildWirePayload(manifest);
     checksum = computeManifestChecksum(payload.packages);
-    stack = detectStack(payload.packages);
   } catch (err) {
     console.warn(
       `mark-build: could not compute the build fingerprint (${err.message}). Stamping the production flag only.`
@@ -1608,7 +1463,7 @@ async function runMarkBuild(args) {
     console.warn(`mark-build: no HTML files found under ${dir}. Nothing to mark.`);
     return 0;
   }
-  const snippet = buildInjectionSnippet(checksum, stack);
+  const snippet = buildInjectionSnippet(checksum);
   let marked = 0;
   for (const file of files) {
     const before = readFileSync2(file, "utf8");
@@ -1618,9 +1473,8 @@ async function runMarkBuild(args) {
       marked += 1;
     }
   }
-  const stackSummary = stack !== null ? describeStack(stack) : null;
   console.log(
-    `mark-build: marked ${marked} HTML file(s) in ${dir}${checksum !== null ? ` (build ${checksum})` : ""}${stackSummary !== null ? ` [${stackSummary}]` : ""}.`
+    `mark-build: marked ${marked} HTML file(s) in ${dir}${checksum !== null ? ` (build ${checksum})` : ""}.`
   );
   return 0;
 }