@patchstack/connect 0.2.6 → 0.2.7

package/dist/cli.js

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 
+// src/cli.ts
+import { readFileSync, writeFileSync } from "fs";
+
 // src/parsers/index.ts
 import { access } from "fs/promises";
 import path4 from "path";
@@ -653,54 +656,32 @@ async function readDirectDepNames(cwd) {
 }
 
 // src/parsers/index.ts
+var LOCKFILE_CANDIDATES = [
+  { filename: "package-lock.json", strategy: "npm-lockfile" },
+  { filename: "bun.lock", strategy: "node-modules-walk" },
+  { filename: "bun.lockb", strategy: "node-modules-walk" },
+  { filename: "pnpm-lock.yaml", strategy: "pnpm-lockfile" },
+  { filename: "yarn.lock", strategy: "yarn-lockfile" }
+];
 async function detectLockfile(cwd) {
-  const npmLock = path4.join(cwd, "package-lock.json");
-  if (await exists(npmLock)) {
-    return {
-      ecosystem: "npm",
-      filePath: npmLock,
-      filename: "package-lock.json",
-      strategy: "npm-lockfile"
-    };
-  }
-  const bunLock = path4.join(cwd, "bun.lock");
-  if (await exists(bunLock)) {
-    return {
-      ecosystem: "npm",
-      filePath: bunLock,
-      filename: "bun.lock",
-      strategy: "node-modules-walk"
-    };
-  }
-  const bunLockB = path4.join(cwd, "bun.lockb");
-  if (await exists(bunLockB)) {
-    return {
-      ecosystem: "npm",
-      filePath: bunLockB,
-      filename: "bun.lockb",
-      strategy: "node-modules-walk"
-    };
-  }
-  const pnpmLock = path4.join(cwd, "pnpm-lock.yaml");
-  if (await exists(pnpmLock)) {
-    return {
-      ecosystem: "npm",
-      filePath: pnpmLock,
-      filename: "pnpm-lock.yaml",
-      strategy: "pnpm-lockfile"
-    };
-  }
-  const yarnLock = path4.join(cwd, "yarn.lock");
-  if (await exists(yarnLock)) {
+  const probed = await Promise.all(
+    LOCKFILE_CANDIDATES.map(async (candidate) => {
+      const filePath = path4.join(cwd, candidate.filename);
+      return { ...candidate, filePath, present: await exists(filePath) };
+    })
+  );
+  const match = probed.find((candidate) => candidate.present);
+  if (match) {
     return {
       ecosystem: "npm",
-      filePath: yarnLock,
-      filename: "yarn.lock",
-      strategy: "yarn-lockfile"
+      filePath: match.filePath,
+      filename: match.filename,
+      strategy: match.strategy
     };
   }
+  const expected = LOCKFILE_CANDIDATES.map((candidate) => candidate.filename).join(", ");
   throw new PatchstackError(
-    `No lockfile found in ${cwd}. Expected one of: package-lock.json, bun.lock, bun.lockb, yarn.lock, pnpm-lock.yaml.`,
+    `No lockfile found in ${cwd}. Expected one of: ${expected}.`,
     "LOCKFILE_NOT_FOUND"
   );
 }
@@ -832,86 +813,19 @@ function compareSegments(a, b) {
   return 0;
 }
 
-// src/buildFlag.ts
-import { promises as fs } from "fs";
-import path5 from "path";
-var FLAG_MARKER = "__PATCHSTACK_PROD__";
-var SNIPPET = "<script>window.__PATCHSTACK_PROD__=true;/*patchstack:production*/</script>";
-var DEFAULT_DIRS = ["dist", "build", "out", ".output/public"];
-async function pathExists(target) {
-  try {
-    await fs.access(target);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function resolveBuildDir(cwd, override) {
-  if (override !== void 0 && override.length > 0) {
-    const dir = path5.resolve(cwd, override);
-    return await pathExists(dir) ? dir : null;
-  }
-  for (const candidate of DEFAULT_DIRS) {
-    const dir = path5.resolve(cwd, candidate);
-    if (await pathExists(dir)) {
-      return dir;
-    }
-  }
-  return null;
-}
-async function findHtmlFiles(dir, depth = 3) {
-  const found = [];
-  let entries;
-  try {
-    entries = await fs.readdir(dir, { withFileTypes: true });
-  } catch {
-    return found;
-  }
-  for (const entry of entries) {
-    const full = path5.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (depth > 0) {
-        found.push(...await findHtmlFiles(full, depth - 1));
-      }
-    } else if (entry.isFile() && entry.name.toLowerCase().endsWith(".html")) {
-      found.push(full);
+// src/checksum.ts
+import { createHash } from "crypto";
+function computeManifestChecksum(packages) {
+  const canonical = packages.map((pkg) => ({ name: pkg.name, version: pkg.version })).sort((a, b) => {
+    if (a.name !== b.name) {
+      return a.name < b.name ? -1 : 1;
     }
-  }
-  return found;
-}
-function injectFlag(html) {
-  if (html.includes(FLAG_MARKER)) {
-    return null;
-  }
-  const headOpen = /<head[^>]*>/i;
-  if (headOpen.test(html)) {
-    return html.replace(headOpen, (match) => `${match}${SNIPPET}`);
-  }
-  const bodyOpen = /<body[^>]*>/i;
-  if (bodyOpen.test(html)) {
-    return html.replace(bodyOpen, (match) => `${match}${SNIPPET}`);
-  }
-  return `${SNIPPET}${html}`;
-}
-async function markProductionBuild(cwd, override) {
-  const dir = await resolveBuildDir(cwd, override);
-  if (dir === null) {
-    return { dir: null, patched: [], skipped: [] };
-  }
-  const files = await findHtmlFiles(dir);
-  const patched = [];
-  const skipped = [];
-  for (const file of files) {
-    const html = await fs.readFile(file, "utf8");
-    const next = injectFlag(html);
-    if (next === null) {
-      skipped.push(file);
-      continue;
+    if (a.version !== b.version) {
+      return a.version < b.version ? -1 : 1;
     }
-    await fs.writeFile(file, next, "utf8");
-    patched.push(file);
-  }
-  return { dir, patched, skipped };
+    return 0;
+  });
+  return createHash("sha256").update(JSON.stringify(canonical)).digest("hex").slice(0, 12);
 }
 
 // src/client.ts
@@ -937,7 +851,7 @@ async function postManifest(config, payload) {
         Accept: "application/json",
         "User-Agent": "@patchstack/connect"
       },
-      body: JSON.stringify(payload),
+      body: JSON.stringify({ ...payload, environment: config.environment }),
       signal: AbortSignal.timeout(timeoutMs)
     });
   } catch (cause) {
@@ -993,14 +907,23 @@ function isTimeoutError(cause) {
 
 // src/config.ts
 import { readFile as readFile5, writeFile } from "fs/promises";
-import path6 from "path";
+import path5 from "path";
 var CONFIG_FILENAME = ".patchstackrc.json";
+var DEFAULT_ENVIRONMENT = "production";
 async function resolveConfig(options) {
   const fromFile = await readConfigFile(options.cwd);
   const fromEnv = readEnv();
   const siteUuid = options.cliSiteUuid ?? fromEnv.siteUuid ?? fromFile.siteUuid ?? null;
   const endpoint = options.cliEndpoint ?? fromEnv.endpoint ?? fromFile.endpoint ?? DEFAULT_ENDPOINT;
   const timeoutMs = fromEnv.timeoutMs ?? fromFile.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const environmentRaw = fromEnv.environment ?? fromFile.environment;
+  if (environmentRaw !== void 0 && !isEnvironment(environmentRaw)) {
+    throw new PatchstackError(
+      `Environment must be "production" or "sandbox"; got "${environmentRaw}".`,
+      "CONFIG_INVALID"
+    );
+  }
+  const environment = environmentRaw ?? DEFAULT_ENVIRONMENT;
   if (siteUuid !== null && siteUuid.length > 0 && !isUuid(siteUuid)) {
     throw new PatchstackError(
       `Site UUID "${siteUuid}" does not look like a valid UUID.`,
@@ -1016,11 +939,12 @@ async function resolveConfig(options) {
   return {
     siteUuid: siteUuid === null || siteUuid.length === 0 ? null : siteUuid,
     endpoint,
-    timeoutMs
+    timeoutMs,
+    environment
   };
 }
 async function writeConfigFile(cwd, config) {
-  const target = path6.join(cwd, CONFIG_FILENAME);
+  const target = path5.join(cwd, CONFIG_FILENAME);
   const content = JSON.stringify(config, null, 2) + "\n";
   await writeFile(target, content, "utf8");
   return target;
@@ -1030,7 +954,7 @@ async function persistSiteUuid(cwd, siteUuid) {
   return writeConfigFile(cwd, { ...existing, siteUuid });
 }
 async function readConfigFile(cwd) {
-  const target = path6.join(cwd, CONFIG_FILENAME);
+  const target = path5.join(cwd, CONFIG_FILENAME);
   let raw;
   try {
     raw = await readFile5(target, "utf8");
@@ -1067,15 +991,74 @@ function readEnv() {
     }
     timeoutMs = parsed;
   }
+  const environmentRaw = process.env.PATCHSTACK_ENVIRONMENT;
   return {
     siteUuid: process.env.PATCHSTACK_SITE_UUID ?? void 0,
     endpoint: process.env.PATCHSTACK_ENDPOINT ?? void 0,
-    timeoutMs
+    timeoutMs,
+    environment: environmentRaw !== void 0 && environmentRaw.length > 0 ? environmentRaw : void 0
   };
 }
 function isUuid(value) {
   return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
 }
+function isEnvironment(value) {
+  return value === "production" || value === "sandbox";
+}
+
+// src/mark-build.ts
+import { existsSync, readdirSync, statSync } from "fs";
+import path6 from "path";
+var MARKER_ATTR = "data-patchstack-build";
+var BUILD_DIR_CANDIDATES = ["dist", "build", "out", ".output/public"];
+function resolveBuildDir(cwd, override) {
+  if (override !== void 0 && override !== "") {
+    const abs = path6.resolve(cwd, override);
+    return existsSync(abs) && statSync(abs).isDirectory() ? abs : null;
+  }
+  for (const candidate of BUILD_DIR_CANDIDATES) {
+    const abs = path6.resolve(cwd, candidate);
+    if (existsSync(abs) && statSync(abs).isDirectory()) {
+      return abs;
+    }
+  }
+  return null;
+}
+function findHtmlFiles(dir) {
+  const out = [];
+  const walk2 = (current) => {
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const full = path6.join(current, entry.name);
+      if (entry.isDirectory()) {
+        walk2(full);
+      } else if (entry.isFile() && entry.name.toLowerCase().endsWith(".html")) {
+        out.push(full);
+      }
+    }
+  };
+  walk2(dir);
+  return out;
+}
+function buildInjectionSnippet(checksum) {
+  const statements = ["window.__PATCHSTACK_PROD__=true;"];
+  if (checksum !== null && checksum !== "") {
+    statements.push(`window.__PATCHSTACK_BUILD__=${JSON.stringify(checksum)};`);
+  }
+  return `<script ${MARKER_ATTR}>${statements.join("")}</script>`;
+}
+function injectMarker(html, snippet) {
+  const stripped = html.replace(
+    new RegExp(`\\s*<script ${MARKER_ATTR}[^>]*>[\\s\\S]*?</script>`, "gi"),
+    ""
+  );
+  if (/<\/head>/i.test(stripped)) {
+    return stripped.replace(/<\/head>/i, `${snippet}</head>`);
+  }
+  if (/<\/body>/i.test(stripped)) {
+    return stripped.replace(/<\/body>/i, `${snippet}</body>`);
+  }
+  return stripped + snippet;
+}
 
 // src/cli.ts
 var HELP = `@patchstack/connect \u2014 scan your lockfile and report packages to Patchstack.
@@ -1087,10 +1070,8 @@ Usage:
   patchstack-connect init   <site-uuid>              Optional: pre-seed .patchstackrc.json
                                                      with an existing site UUID
   patchstack-connect status [options]                Show current configuration
-  patchstack-connect mark-build [--dir <path>]       Inject the production flag into
-                                                     the built HTML (run as a postbuild
-                                                     step). Tells the widget it's live so
-                                                     it hides the claim flow.
+  patchstack-connect mark-build [options]            Stamp built HTML with a production flag +
+                                                     build fingerprint (run as a postbuild step)
   patchstack-connect help                            Print this message
 
 Options (for scan and status):
@@ -1099,13 +1080,14 @@ Options (for scan and status):
   --dry-run               (scan only) Show the payload without posting
 
 Options (for mark-build):
-  --dir <path>            Build output dir (default: auto-detect dist/, build/,
-                          out/, .output/public)
+  --dir <path>            Build output directory (default: auto-detect
+                          dist/ build/ out/ .output/public)
 
 Environment:
   PATCHSTACK_SITE_UUID    Site UUID
   PATCHSTACK_ENDPOINT     API endpoint (default: https://api.patchstack.com/monitor/pulse/manifest)
   PATCHSTACK_TIMEOUT_MS   Request timeout in ms (default: 30000)
+  PATCHSTACK_ENVIRONMENT  Manifest environment: production | sandbox (default: production)
 
 Precedence: CLI flag > environment variable > .patchstackrc.json.
 
@@ -1179,6 +1161,7 @@ async function runScan(args) {
   console.log(
     `Found ${payload.packages.length} unique package versions across ${stats.uniqueNames} package names in ${manifest.ecosystem} lockfile.`
   );
+  console.log(`Reporting under the ${config.environment} environment.`);
   if (stats.duplicateNames.length > 0) {
     console.log(`${stats.duplicateNames.length} package(s) appear at multiple versions:`);
     if (stats.duplicateNames.length <= 10) {
@@ -1229,29 +1212,51 @@ async function runStatus(args) {
     cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
     cliEndpoint: getStringFlag(args.flags, "endpoint")
   });
-  console.log(`Site UUID:  ${config.siteUuid ?? "(none yet \u2014 the next `scan` will provision one)"}`);
-  console.log(`Endpoint:   ${config.endpoint}`);
-  console.log(`Timeout:    ${config.timeoutMs}ms`);
+  console.log(`Site UUID:   ${config.siteUuid ?? "(none yet \u2014 the next `scan` will provision one)"}`);
+  console.log(`Endpoint:    ${config.endpoint}`);
+  console.log(`Timeout:     ${config.timeoutMs}ms`);
+  console.log(`Environment: ${config.environment}`);
   if (config.siteUuid !== null) {
     console.log(`Claim URL:  ${buildClaimUrl(config.endpoint, config.siteUuid)}`);
   }
   return 0;
 }
 async function runMarkBuild(args) {
-  const result = await markProductionBuild(process.cwd(), getStringFlag(args.flags, "dir"));
-  if (result.dir === null) {
+  const cwd = process.cwd();
+  let checksum = null;
+  try {
+    const manifest = await scanLockfile(cwd);
+    const { payload } = buildWirePayload(manifest);
+    checksum = computeManifestChecksum(payload.packages);
+  } catch (err) {
+    console.warn(
+      `mark-build: could not compute the build fingerprint (${err.message}). Stamping the production flag only.`
+    );
+  }
+  const dir = resolveBuildDir(cwd, getStringFlag(args.flags, "dir"));
+  if (dir === null) {
     console.warn(
-      "patchstack: no build output found (looked for dist/, build/, out/, .output/public). Pass --dir <path> if your build outputs elsewhere. Skipping production flag."
+      "mark-build: no build output directory found (looked for dist/, build/, out/, .output/public). Pass --dir <path> if it is elsewhere. Nothing to mark."
     );
     return 0;
   }
-  if (result.patched.length === 0 && result.skipped.length === 0) {
-    console.warn(`patchstack: no HTML files found under ${result.dir}; skipping production flag.`);
+  const files = findHtmlFiles(dir);
+  if (files.length === 0) {
+    console.warn(`mark-build: no HTML files found under ${dir}. Nothing to mark.`);
     return 0;
   }
-  const already = result.skipped.length > 0 ? ` (${result.skipped.length} already marked)` : "";
+  const snippet = buildInjectionSnippet(checksum);
+  let marked = 0;
+  for (const file of files) {
+    const before = readFileSync(file, "utf8");
+    const after = injectMarker(before, snippet);
+    if (after !== before) {
+      writeFileSync(file, after);
+      marked += 1;
+    }
+  }
   console.log(
-    `patchstack: marked ${result.patched.length} HTML file(s) as a production build in ${result.dir}${already}.`
+    `mark-build: marked ${marked} HTML file(s) in ${dir}${checksum !== null ? ` (build ${checksum})` : ""}.`
   );
   return 0;
 }