@patchstack/connect 0.2.4 → 0.2.6

package/dist/cli.js

@@ -2,7 +2,7 @@
 
 // src/parsers/index.ts
 import { access } from "fs/promises";
-import path3 from "path";
+import path4 from "path";
 
 // src/types.ts
 var PatchstackError = class extends Error {
@@ -209,9 +209,452 @@ async function isPlainDirectory(dir) {
   }
 }
 
+// src/parsers/pnpm.ts
+import { readFile as readFile3 } from "fs/promises";
+async function parsePnpmLockfile(lockfilePath) {
+  let raw;
+  try {
+    raw = await readFile3(lockfilePath, "utf8");
+  } catch (cause) {
+    throw new PatchstackError(
+      `Could not read lockfile at ${lockfilePath}`,
+      "LOCKFILE_NOT_FOUND",
+      cause
+    );
+  }
+  const lines = raw.split(/\r?\n/);
+  const directNames = collectDirectDepNames(lines);
+  const packageKeys = collectPackagesBlockKeys(lines);
+  if (packageKeys.length === 0) {
+    throw new PatchstackError(
+      `Lockfile at ${lockfilePath} has no "packages" entries`,
+      "LOCKFILE_PARSE_ERROR"
+    );
+  }
+  const entries = [];
+  for (const key of packageKeys) {
+    const parsed = parsePackageKey(key);
+    if (parsed === null) {
+      continue;
+    }
+    entries.push({
+      name: parsed.name,
+      version: parsed.version,
+      direct: directNames.has(parsed.name)
+    });
+  }
+  return entries;
+}
+function parsePackageKey(rawKey) {
+  let k = rawKey.trim();
+  if (k.length === 0) {
+    return null;
+  }
+  if (k.startsWith("'") && k.endsWith("'") || k.startsWith('"') && k.endsWith('"')) {
+    k = k.slice(1, -1);
+  }
+  if (k.startsWith("/")) {
+    k = k.slice(1);
+  }
+  const parenIdx = k.indexOf("(");
+  if (parenIdx >= 0) {
+    k = k.slice(0, parenIdx);
+  }
+  let scopePrefix = "";
+  let body = k;
+  if (k.startsWith("@")) {
+    const firstSlash = k.indexOf("/");
+    if (firstSlash <= 0) {
+      return null;
+    }
+    scopePrefix = k.slice(0, firstSlash + 1);
+    body = k.slice(firstSlash + 1);
+  }
+  const slashIdx = body.indexOf("/");
+  const atIdx = body.indexOf("@");
+  let sepIdx;
+  if (slashIdx < 0 && atIdx < 0) {
+    return null;
+  } else if (slashIdx < 0) {
+    sepIdx = atIdx;
+  } else if (atIdx < 0) {
+    sepIdx = slashIdx;
+  } else {
+    sepIdx = Math.min(slashIdx, atIdx);
+  }
+  const name = scopePrefix + body.slice(0, sepIdx);
+  let version = body.slice(sepIdx + 1);
+  const underscoreIdx = version.indexOf("_");
+  if (underscoreIdx >= 0) {
+    version = version.slice(0, underscoreIdx);
+  }
+  if (name.length === 0 || version.length === 0) {
+    return null;
+  }
+  return { name, version };
+}
+function indentOf(line) {
+  let i = 0;
+  while (i < line.length && line[i] === " ") {
+    i++;
+  }
+  return i;
+}
+function isBlankOrComment(line) {
+  const trimmed = line.trim();
+  return trimmed.length === 0 || trimmed.startsWith("#");
+}
+function collectPackagesBlockKeys(lines) {
+  const keys = [];
+  let inBlock = false;
+  let childIndent = null;
+  for (const line of lines) {
+    if (isBlankOrComment(line)) {
+      continue;
+    }
+    const indent = indentOf(line);
+    if (!inBlock) {
+      if (indent === 0 && line.trim() === "packages:") {
+        inBlock = true;
+      }
+      continue;
+    }
+    if (indent === 0) {
+      break;
+    }
+    if (childIndent === null) {
+      childIndent = indent;
+    }
+    if (indent !== childIndent) {
+      continue;
+    }
+    const content = line.slice(indent);
+    if (!content.endsWith(":")) {
+      continue;
+    }
+    keys.push(content.slice(0, -1));
+  }
+  return keys;
+}
+function collectDirectDepNames(lines) {
+  const names = /* @__PURE__ */ new Set();
+  collectFromImporters(lines, names);
+  for (const section of ["dependencies", "devDependencies", "optionalDependencies"]) {
+    collectFromTopLevelSection(lines, section, names);
+  }
+  return names;
+}
+var DEP_SECTIONS = /* @__PURE__ */ new Set([
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies"
+]);
+function collectFromImporters(lines, out) {
+  let inImporters = false;
+  let importerIndent = null;
+  let inDepSection = false;
+  let depSectionIndent = null;
+  let leafIndent = null;
+  for (const line of lines) {
+    if (isBlankOrComment(line)) {
+      continue;
+    }
+    const indent = indentOf(line);
+    const trimmed = line.trim();
+    if (!inImporters) {
+      if (indent === 0 && trimmed === "importers:") {
+        inImporters = true;
+      }
+      continue;
+    }
+    if (indent === 0) {
+      break;
+    }
+    if (importerIndent === null) {
+      importerIndent = indent;
+    }
+    if (indent === importerIndent) {
+      inDepSection = false;
+      depSectionIndent = null;
+      leafIndent = null;
+      continue;
+    }
+    if (!inDepSection) {
+      const key = stripTrailingColon(trimmed);
+      if (key !== null && DEP_SECTIONS.has(key)) {
+        inDepSection = true;
+        depSectionIndent = indent;
+      }
+      continue;
+    }
+    if (depSectionIndent !== null && indent <= depSectionIndent) {
+      inDepSection = false;
+      depSectionIndent = null;
+      leafIndent = null;
+      const key = stripTrailingColon(trimmed);
+      if (key !== null && DEP_SECTIONS.has(key)) {
+        inDepSection = true;
+        depSectionIndent = indent;
+      }
+      continue;
+    }
+    if (leafIndent === null) {
+      leafIndent = indent;
+    }
+    if (indent !== leafIndent) {
+      continue;
+    }
+    const name = extractLeafName(trimmed);
+    if (name !== null) {
+      out.add(name);
+    }
+  }
+}
+function collectFromTopLevelSection(lines, section, out) {
+  let inSection = false;
+  let leafIndent = null;
+  for (const line of lines) {
+    if (isBlankOrComment(line)) {
+      continue;
+    }
+    const indent = indentOf(line);
+    const trimmed = line.trim();
+    if (!inSection) {
+      if (indent === 0 && trimmed === `${section}:`) {
+        inSection = true;
+      }
+      continue;
+    }
+    if (indent === 0) {
+      break;
+    }
+    if (leafIndent === null) {
+      leafIndent = indent;
+    }
+    if (indent !== leafIndent) {
+      continue;
+    }
+    const name = extractLeafName(trimmed);
+    if (name !== null) {
+      out.add(name);
+    }
+  }
+}
+function stripTrailingColon(s) {
+  if (!s.endsWith(":")) {
+    return null;
+  }
+  return s.slice(0, -1).trim();
+}
+function extractLeafName(trimmed) {
+  const colonIdx = trimmed.indexOf(":");
+  if (colonIdx < 0) {
+    return null;
+  }
+  let name = trimmed.slice(0, colonIdx).trim();
+  if (name.length === 0) {
+    return null;
+  }
+  if (name.startsWith("'") && name.endsWith("'") || name.startsWith('"') && name.endsWith('"')) {
+    name = name.slice(1, -1);
+  }
+  return name.length > 0 ? name : null;
+}
+
+// src/parsers/yarn.ts
+import { readFile as readFile4 } from "fs/promises";
+import path3 from "path";
+async function parseYarnLockfile(lockfilePath) {
+  let raw;
+  try {
+    raw = await readFile4(lockfilePath, "utf8");
+  } catch (cause) {
+    throw new PatchstackError(
+      `Could not read lockfile at ${lockfilePath}`,
+      "LOCKFILE_NOT_FOUND",
+      cause
+    );
+  }
+  const blocks = parseBlocks(raw);
+  if (blocks.length === 0) {
+    throw new PatchstackError(
+      `Lockfile at ${lockfilePath} contains no package entries`,
+      "LOCKFILE_PARSE_ERROR"
+    );
+  }
+  const directNames = await readDirectDepNames(path3.dirname(lockfilePath));
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const block of blocks) {
+    if (block.version.length === 0 || block.names.size === 0) {
+      continue;
+    }
+    for (const name of block.names) {
+      const dedupKey = `${name}@${block.version}`;
+      if (seen.has(dedupKey)) {
+        continue;
+      }
+      seen.add(dedupKey);
+      entries.push({
+        name,
+        version: block.version,
+        direct: directNames.has(name)
+      });
+    }
+  }
+  return entries;
+}
+function parseBlocks(raw) {
+  const lines = raw.split(/\r?\n/);
+  const blocks = [];
+  let current = null;
+  const finalize = () => {
+    if (current !== null && current.version.length > 0 && current.names.size > 0) {
+      blocks.push(current);
+    }
+    current = null;
+  };
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0 || trimmed.startsWith("#")) {
+      continue;
+    }
+    const indent = countLeadingSpaces(line);
+    if (indent === 0) {
+      finalize();
+      if (!trimmed.endsWith(":")) {
+        continue;
+      }
+      const keyLine = trimmed.slice(0, -1);
+      const names = /* @__PURE__ */ new Set();
+      for (const spec of splitDescriptors(keyLine)) {
+        const name = extractName(spec);
+        if (name !== null) {
+          names.add(name);
+        }
+      }
+      current = { names, version: "" };
+      continue;
+    }
+    if (current === null) {
+      continue;
+    }
+    const version = parseVersionField(trimmed);
+    if (version !== null) {
+      current.version = version;
+    }
+  }
+  finalize();
+  return blocks;
+}
+function countLeadingSpaces(line) {
+  let i = 0;
+  while (i < line.length && line[i] === " ") {
+    i++;
+  }
+  return i;
+}
+function splitDescriptors(keyLine) {
+  const parts = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < keyLine.length; i++) {
+    const c = keyLine[i];
+    if (quote !== null) {
+      current += c;
+      if (c === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      current += c;
+      continue;
+    }
+    if (c === ",") {
+      const piece = current.trim();
+      if (piece.length > 0) {
+        parts.push(piece);
+      }
+      current = "";
+      continue;
+    }
+    current += c;
+  }
+  const tail = current.trim();
+  if (tail.length > 0) {
+    parts.push(tail);
+  }
+  return parts;
+}
+function extractName(rawSpec) {
+  let s = rawSpec.trim();
+  if (s.length === 0) {
+    return null;
+  }
+  if (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'")) {
+    s = s.slice(1, -1);
+  }
+  const atIdx = s.lastIndexOf("@");
+  if (atIdx <= 0) {
+    return null;
+  }
+  const name = s.slice(0, atIdx);
+  return name.length > 0 ? name : null;
+}
+function parseVersionField(content) {
+  if (!content.startsWith("version")) {
+    return null;
+  }
+  const after = content.slice("version".length);
+  const firstChar = after.charAt(0);
+  if (firstChar !== " " && firstChar !== "	" && firstChar !== ":") {
+    return null;
+  }
+  let rest = firstChar === ":" ? after.slice(1) : after;
+  rest = rest.trim();
+  if (rest.length === 0) {
+    return null;
+  }
+  if (rest.startsWith('"') && rest.endsWith('"') || rest.startsWith("'") && rest.endsWith("'")) {
+    rest = rest.slice(1, -1);
+  }
+  return rest.length > 0 ? rest : null;
+}
+async function readDirectDepNames(cwd) {
+  const names = /* @__PURE__ */ new Set();
+  let raw;
+  try {
+    raw = await readFile4(path3.join(cwd, "package.json"), "utf8");
+  } catch {
+    return names;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return names;
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return names;
+  }
+  const obj = parsed;
+  for (const field of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
+    const section = obj[field];
+    if (typeof section !== "object" || section === null) {
+      continue;
+    }
+    for (const name of Object.keys(section)) {
+      names.add(name);
+    }
+  }
+  return names;
+}
+
 // src/parsers/index.ts
 async function detectLockfile(cwd) {
-  const npmLock = path3.join(cwd, "package-lock.json");
+  const npmLock = path4.join(cwd, "package-lock.json");
   if (await exists(npmLock)) {
     return {
       ecosystem: "npm",
@@ -220,7 +663,7 @@ async function detectLockfile(cwd) {
       strategy: "npm-lockfile"
     };
   }
-  const bunLock = path3.join(cwd, "bun.lock");
+  const bunLock = path4.join(cwd, "bun.lock");
   if (await exists(bunLock)) {
     return {
       ecosystem: "npm",
@@ -229,7 +672,7 @@ async function detectLockfile(cwd) {
       strategy: "node-modules-walk"
     };
   }
-  const bunLockB = path3.join(cwd, "bun.lockb");
+  const bunLockB = path4.join(cwd, "bun.lockb");
   if (await exists(bunLockB)) {
     return {
       ecosystem: "npm",
@@ -238,19 +681,23 @@ async function detectLockfile(cwd) {
       strategy: "node-modules-walk"
     };
   }
-  const yarnLock = path3.join(cwd, "yarn.lock");
-  if (await exists(yarnLock)) {
-    throw new PatchstackError(
-      "yarn.lock detected but not yet supported. Run `npm install` to generate a package-lock.json, or open an issue at github.com/patchstack/connect.",
-      "LOCKFILE_UNSUPPORTED"
-    );
-  }
-  const pnpmLock = path3.join(cwd, "pnpm-lock.yaml");
+  const pnpmLock = path4.join(cwd, "pnpm-lock.yaml");
   if (await exists(pnpmLock)) {
-    throw new PatchstackError(
-      "pnpm-lock.yaml detected but not yet supported. Open an issue at github.com/patchstack/connect to request support.",
-      "LOCKFILE_UNSUPPORTED"
-    );
+    return {
+      ecosystem: "npm",
+      filePath: pnpmLock,
+      filename: "pnpm-lock.yaml",
+      strategy: "pnpm-lockfile"
+    };
+  }
+  const yarnLock = path4.join(cwd, "yarn.lock");
+  if (await exists(yarnLock)) {
+    return {
+      ecosystem: "npm",
+      filePath: yarnLock,
+      filename: "yarn.lock",
+      strategy: "yarn-lockfile"
+    };
   }
   throw new PatchstackError(
     `No lockfile found in ${cwd}. Expected one of: package-lock.json, bun.lock, bun.lockb, yarn.lock, pnpm-lock.yaml.`,
@@ -266,6 +713,10 @@ async function runStrategy(detected, cwd) {
   switch (detected.strategy) {
     case "npm-lockfile":
       return parseNpmLockfile(detected.filePath);
+    case "pnpm-lockfile":
+      return parsePnpmLockfile(detected.filePath);
+    case "yarn-lockfile":
+      return parseYarnLockfile(detected.filePath);
     case "node-modules-walk":
       return walkNodeModules(cwd);
   }
@@ -381,13 +832,99 @@ function compareSegments(a, b) {
   return 0;
 }
 
+// src/buildFlag.ts
+import { promises as fs } from "fs";
+import path5 from "path";
+var FLAG_MARKER = "__PATCHSTACK_PROD__";
+var SNIPPET = "<script>window.__PATCHSTACK_PROD__=true;/*patchstack:production*/</script>";
+var DEFAULT_DIRS = ["dist", "build", "out", ".output/public"];
+async function pathExists(target) {
+  try {
+    await fs.access(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function resolveBuildDir(cwd, override) {
+  if (override !== void 0 && override.length > 0) {
+    const dir = path5.resolve(cwd, override);
+    return await pathExists(dir) ? dir : null;
+  }
+  for (const candidate of DEFAULT_DIRS) {
+    const dir = path5.resolve(cwd, candidate);
+    if (await pathExists(dir)) {
+      return dir;
+    }
+  }
+  return null;
+}
+async function findHtmlFiles(dir, depth = 3) {
+  const found = [];
+  let entries;
+  try {
+    entries = await fs.readdir(dir, { withFileTypes: true });
+  } catch {
+    return found;
+  }
+  for (const entry of entries) {
+    const full = path5.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (depth > 0) {
+        found.push(...await findHtmlFiles(full, depth - 1));
+      }
+    } else if (entry.isFile() && entry.name.toLowerCase().endsWith(".html")) {
+      found.push(full);
+    }
+  }
+  return found;
+}
+function injectFlag(html) {
+  if (html.includes(FLAG_MARKER)) {
+    return null;
+  }
+  const headOpen = /<head[^>]*>/i;
+  if (headOpen.test(html)) {
+    return html.replace(headOpen, (match) => `${match}${SNIPPET}`);
+  }
+  const bodyOpen = /<body[^>]*>/i;
+  if (bodyOpen.test(html)) {
+    return html.replace(bodyOpen, (match) => `${match}${SNIPPET}`);
+  }
+  return `${SNIPPET}${html}`;
+}
+async function markProductionBuild(cwd, override) {
+  const dir = await resolveBuildDir(cwd, override);
+  if (dir === null) {
+    return { dir: null, patched: [], skipped: [] };
+  }
+  const files = await findHtmlFiles(dir);
+  const patched = [];
+  const skipped = [];
+  for (const file of files) {
+    const html = await fs.readFile(file, "utf8");
+    const next = injectFlag(html);
+    if (next === null) {
+      skipped.push(file);
+      continue;
+    }
+    await fs.writeFile(file, next, "utf8");
+    patched.push(file);
+  }
+  return { dir, patched, skipped };
+}
+
 // src/client.ts
-var DEFAULT_ENDPOINT = "http://api.patchstack.com/monitor/pulse/manifest";
+var DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
 var DEFAULT_TIMEOUT_MS = 3e4;
 function buildEndpointUrl(base, siteUuid) {
   const trimmed = base.replace(/\/$/, "");
   return siteUuid !== void 0 && siteUuid !== null && siteUuid.length > 0 ? `${trimmed}/${encodeURIComponent(siteUuid)}` : trimmed;
 }
+function buildClaimUrl(endpoint, siteUuid) {
+  const origin = new URL(endpoint).origin;
+  return `${origin}/monitor/claim?site=${encodeURIComponent(siteUuid)}`;
+}
 async function postManifest(config, payload) {
   const url = buildEndpointUrl(config.endpoint, config.siteUuid);
   const timeoutMs = config.timeoutMs;
@@ -455,8 +992,8 @@ function isTimeoutError(cause) {
 }
 
 // src/config.ts
-import { readFile as readFile3, writeFile } from "fs/promises";
-import path4 from "path";
+import { readFile as readFile5, writeFile } from "fs/promises";
+import path6 from "path";
 var CONFIG_FILENAME = ".patchstackrc.json";
 async function resolveConfig(options) {
   const fromFile = await readConfigFile(options.cwd);
@@ -483,7 +1020,7 @@ async function resolveConfig(options) {
   };
 }
 async function writeConfigFile(cwd, config) {
-  const target = path4.join(cwd, CONFIG_FILENAME);
+  const target = path6.join(cwd, CONFIG_FILENAME);
   const content = JSON.stringify(config, null, 2) + "\n";
   await writeFile(target, content, "utf8");
   return target;
@@ -493,10 +1030,10 @@ async function persistSiteUuid(cwd, siteUuid) {
   return writeConfigFile(cwd, { ...existing, siteUuid });
 }
 async function readConfigFile(cwd) {
-  const target = path4.join(cwd, CONFIG_FILENAME);
+  const target = path6.join(cwd, CONFIG_FILENAME);
   let raw;
   try {
-    raw = await readFile3(target, "utf8");
+    raw = await readFile5(target, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return {};
@@ -550,6 +1087,10 @@ Usage:
   patchstack-connect init   <site-uuid>              Optional: pre-seed .patchstackrc.json
                                                      with an existing site UUID
   patchstack-connect status [options]                Show current configuration
+  patchstack-connect mark-build [--dir <path>]       Inject the production flag into
+                                                     the built HTML (run as a postbuild
+                                                     step). Tells the widget it's live so
+                                                     it hides the claim flow.
   patchstack-connect help                            Print this message
 
 Options (for scan and status):
@@ -557,9 +1098,13 @@ Options (for scan and status):
   --endpoint <url>        Override the API endpoint
   --dry-run               (scan only) Show the payload without posting
 
+Options (for mark-build):
+  --dir <path>            Build output dir (default: auto-detect dist/, build/,
+                          out/, .output/public)
+
 Environment:
   PATCHSTACK_SITE_UUID    Site UUID
-  PATCHSTACK_ENDPOINT     API endpoint (default: http://api.patchstack.com/monitor/pulse/manifest)
+  PATCHSTACK_ENDPOINT     API endpoint (default: https://api.patchstack.com/monitor/pulse/manifest)
   PATCHSTACK_TIMEOUT_MS   Request timeout in ms (default: 30000)
 
 Precedence: CLI flag > environment variable > .patchstackrc.json.
@@ -570,7 +1115,7 @@ Examples:
   npx @patchstack/connect init 550e8400-e29b-41d4-a716-446655440000
   npx @patchstack/connect scan --site-uuid 550e8400-...-446655440000
 `;
-var VALUE_FLAGS = /* @__PURE__ */ new Set(["site-uuid", "endpoint"]);
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["site-uuid", "endpoint", "dir"]);
 function parseArgs(argv) {
   const args = argv.slice(2);
   const positional = [];
@@ -671,6 +1216,11 @@ async function runScan(args) {
   } else {
     console.log(`Server response: ${response.message ?? JSON.stringify(response)}`);
   }
+  if (provisioning && response.uuid !== void 0 && response.uuid.length > 0) {
+    console.log("");
+    console.log("Claim this site to view vulnerability reports in your Patchstack dashboard:");
+    console.log(`  ${buildClaimUrl(config.endpoint, response.uuid)}`);
+  }
   return 0;
 }
 async function runStatus(args) {
@@ -682,6 +1232,27 @@ async function runStatus(args) {
   console.log(`Site UUID:  ${config.siteUuid ?? "(none yet \u2014 the next `scan` will provision one)"}`);
   console.log(`Endpoint:   ${config.endpoint}`);
   console.log(`Timeout:    ${config.timeoutMs}ms`);
+  if (config.siteUuid !== null) {
+    console.log(`Claim URL:  ${buildClaimUrl(config.endpoint, config.siteUuid)}`);
+  }
+  return 0;
+}
+async function runMarkBuild(args) {
+  const result = await markProductionBuild(process.cwd(), getStringFlag(args.flags, "dir"));
+  if (result.dir === null) {
+    console.warn(
+      "patchstack: no build output found (looked for dist/, build/, out/, .output/public). Pass --dir <path> if your build outputs elsewhere. Skipping production flag."
+    );
+    return 0;
+  }
+  if (result.patched.length === 0 && result.skipped.length === 0) {
+    console.warn(`patchstack: no HTML files found under ${result.dir}; skipping production flag.`);
+    return 0;
+  }
+  const already = result.skipped.length > 0 ? ` (${result.skipped.length} already marked)` : "";
+  console.log(
+    `patchstack: marked ${result.patched.length} HTML file(s) as a production build in ${result.dir}${already}.`
+  );
   return 0;
 }
 async function main() {
@@ -697,6 +1268,8 @@ async function main() {
       return runScan(args);
     case "status":
       return runStatus(args);
+    case "mark-build":
+      return runMarkBuild(args);
     default:
       console.error(`Unknown command: ${args.command}
 `);