@patchstack/connect 0.2.6 → 0.2.8

package/README.md

@@ -17,9 +17,11 @@ npm install --save-dev @patchstack/connect
 npx @patchstack/connect scan
 ```
 
+> **Use your project's own package manager.** On bun-managed projects (Lovable, Bolt, most vibe-coding platforms) install with `bun add -d @patchstack/connect` instead — running `npm install` there plants a `package-lock.json` that the platform's native dependency flow never updates again, leaving a stale lockfile next to the live one. The connector detects and works around that (see *Stale lockfiles* below), but not creating the fossil is better.
+
 That's it. The first `scan`:
 
-1. Reads your `package-lock.json`.
+1. Reads your lockfile (see *Supported lockfiles*).
 2. POSTs the package list to Patchstack with **no** UUID.
 3. Patchstack provisions a fresh site and returns its UUID.
 4. The connector writes the UUID to `.patchstackrc.json` so the next `scan` targets the same site.
@@ -123,6 +125,10 @@ That's the entire payload. No source code, no environment variables, no file pat
 
 If both a Bun lockfile and `node_modules/` are present, the connector walks `node_modules/` to enumerate the installed packages. Run `bun install` (or `npm install`) before scanning so the directory is populated.
 
+### Stale lockfiles
+
+Every scanned source is validated against `package.json`: if the chosen lockfile is missing dependencies that `package.json` declares, it is treated as a fossil (e.g. a `package-lock.json` created by a one-off `npm install` in a bun-managed project) and the connector falls through to the next source — ultimately walking `node_modules/`, the installed truth — and prints a warning naming the stale file. Delete the stale lockfile to silence the warning. Without this, the manifest and the build fingerprint would silently freeze while the real dependency set drifts.
+
 ## Development
 
 ```bash

package/dist/cli.js

@@ -1,8 +1,11 @@
 #!/usr/bin/env node
 
+// src/cli.ts
+import { readFileSync, writeFileSync } from "fs";
+
 // src/parsers/index.ts
 import { access } from "fs/promises";
-import path4 from "path";
+import path5 from "path";
 
 // src/types.ts
 var PatchstackError = class extends Error {
@@ -16,13 +19,52 @@ var PatchstackError = class extends Error {
   cause;
 };
 
-// src/parsers/npm.ts
+// src/parsers/consistency.ts
 import { readFile } from "fs/promises";
 import path from "path";
+async function readDeclaredDependencyNames(cwd) {
+  let raw;
+  try {
+    raw = await readFile(path.join(cwd, "package.json"), "utf8");
+  } catch {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return [];
+  }
+  const names = /* @__PURE__ */ new Set();
+  for (const group of ["dependencies", "devDependencies"]) {
+    const deps = parsed[group];
+    if (typeof deps !== "object" || deps === null) {
+      continue;
+    }
+    for (const [name, spec] of Object.entries(deps)) {
+      if (typeof spec === "string" && /^(file|link|workspace|portal):/.test(spec)) {
+        continue;
+      }
+      names.add(name);
+    }
+  }
+  return [...names];
+}
+function missingDependencies(declared, packages) {
+  const present = new Set(packages.map((entry) => entry.name));
+  return declared.filter((name) => !present.has(name));
+}
+
+// src/parsers/npm.ts
+import { readFile as readFile2 } from "fs/promises";
+import path2 from "path";
 async function parseNpmLockfile(lockfilePath) {
   let raw;
   try {
-    raw = await readFile(lockfilePath, "utf8");
+    raw = await readFile2(lockfilePath, "utf8");
   } catch (cause) {
     throw new PatchstackError(`Could not read lockfile at ${lockfilePath}`, "LOCKFILE_NOT_FOUND", cause);
   }
@@ -80,7 +122,7 @@ function extractFromV1(deps, acc = [], depth = 0) {
   return acc;
 }
 function extractNameFromPath(pkgPath) {
-  const segments = pkgPath.split("node_modules" + path.sep === pkgPath ? path.sep : "/");
+  const segments = pkgPath.split("node_modules" + path2.sep === pkgPath ? path2.sep : "/");
   const parts = pkgPath.split("/");
   const nmIndex = parts.lastIndexOf("node_modules");
   if (nmIndex === -1 || nmIndex >= parts.length - 1) {
@@ -103,10 +145,10 @@ function isDirectV2(pkgPath) {
 }
 
 // src/parsers/node_modules.ts
-import { lstat, readFile as readFile2, readdir, stat } from "fs/promises";
-import path2 from "path";
+import { lstat, readFile as readFile3, readdir, stat } from "fs/promises";
+import path3 from "path";
 async function walkNodeModules(cwd) {
-  const root = path2.join(cwd, "node_modules");
+  const root = path3.join(cwd, "node_modules");
   try {
     const info = await stat(root);
     if (!info.isDirectory()) {
@@ -140,7 +182,7 @@ async function walk(dir, acc, depth) {
     if (name.startsWith(".")) {
       continue;
     }
-    const fullPath = path2.join(dir, name);
+    const fullPath = path3.join(dir, name);
     if (!await isPlainDirectory(fullPath)) {
       continue;
     }
@@ -155,7 +197,7 @@ async function walk(dir, acc, depth) {
         if (sub.startsWith(".")) {
           continue;
         }
-        const scopedDir = path2.join(fullPath, sub);
+        const scopedDir = path3.join(fullPath, sub);
         if (!await isPlainDirectory(scopedDir)) {
           continue;
         }
@@ -171,7 +213,7 @@ async function walk(dir, acc, depth) {
 async function readPackage(pkgDir, depth, acc) {
   let raw;
   try {
-    raw = await readFile2(path2.join(pkgDir, "package.json"), "utf8");
+    raw = await readFile3(path3.join(pkgDir, "package.json"), "utf8");
   } catch {
     return;
   }
@@ -194,7 +236,7 @@ async function readPackage(pkgDir, depth, acc) {
   });
 }
 async function walkNested(pkgDir, acc, depth) {
-  const nested = path2.join(pkgDir, "node_modules");
+  const nested = path3.join(pkgDir, "node_modules");
   if (!await isPlainDirectory(nested)) {
     return;
   }
@@ -210,11 +252,11 @@ async function isPlainDirectory(dir) {
 }
 
 // src/parsers/pnpm.ts
-import { readFile as readFile3 } from "fs/promises";
+import { readFile as readFile4 } from "fs/promises";
 async function parsePnpmLockfile(lockfilePath) {
   let raw;
   try {
-    raw = await readFile3(lockfilePath, "utf8");
+    raw = await readFile4(lockfilePath, "utf8");
   } catch (cause) {
     throw new PatchstackError(
       `Could not read lockfile at ${lockfilePath}`,
@@ -462,12 +504,12 @@ function extractLeafName(trimmed) {
 }
 
 // src/parsers/yarn.ts
-import { readFile as readFile4 } from "fs/promises";
-import path3 from "path";
+import { readFile as readFile5 } from "fs/promises";
+import path4 from "path";
 async function parseYarnLockfile(lockfilePath) {
   let raw;
   try {
-    raw = await readFile4(lockfilePath, "utf8");
+    raw = await readFile5(lockfilePath, "utf8");
   } catch (cause) {
     throw new PatchstackError(
       `Could not read lockfile at ${lockfilePath}`,
@@ -482,7 +524,7 @@ async function parseYarnLockfile(lockfilePath) {
       "LOCKFILE_PARSE_ERROR"
     );
   }
-  const directNames = await readDirectDepNames(path3.dirname(lockfilePath));
+  const directNames = await readDirectDepNames(path4.dirname(lockfilePath));
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   for (const block of blocks) {
@@ -626,7 +668,7 @@ async function readDirectDepNames(cwd) {
   const names = /* @__PURE__ */ new Set();
   let raw;
   try {
-    raw = await readFile4(path3.join(cwd, "package.json"), "utf8");
+    raw = await readFile5(path4.join(cwd, "package.json"), "utf8");
   } catch {
     return names;
   }
@@ -653,61 +695,99 @@ async function readDirectDepNames(cwd) {
 }
 
 // src/parsers/index.ts
+var LOCKFILE_CANDIDATES = [
+  { filename: "package-lock.json", strategy: "npm-lockfile" },
+  { filename: "bun.lock", strategy: "node-modules-walk" },
+  { filename: "bun.lockb", strategy: "node-modules-walk" },
+  { filename: "pnpm-lock.yaml", strategy: "pnpm-lockfile" },
+  { filename: "yarn.lock", strategy: "yarn-lockfile" }
+];
 async function detectLockfile(cwd) {
-  const npmLock = path4.join(cwd, "package-lock.json");
-  if (await exists(npmLock)) {
-    return {
-      ecosystem: "npm",
-      filePath: npmLock,
-      filename: "package-lock.json",
-      strategy: "npm-lockfile"
-    };
-  }
-  const bunLock = path4.join(cwd, "bun.lock");
-  if (await exists(bunLock)) {
-    return {
-      ecosystem: "npm",
-      filePath: bunLock,
-      filename: "bun.lock",
-      strategy: "node-modules-walk"
-    };
-  }
-  const bunLockB = path4.join(cwd, "bun.lockb");
-  if (await exists(bunLockB)) {
-    return {
-      ecosystem: "npm",
-      filePath: bunLockB,
-      filename: "bun.lockb",
-      strategy: "node-modules-walk"
-    };
-  }
-  const pnpmLock = path4.join(cwd, "pnpm-lock.yaml");
-  if (await exists(pnpmLock)) {
-    return {
-      ecosystem: "npm",
-      filePath: pnpmLock,
-      filename: "pnpm-lock.yaml",
-      strategy: "pnpm-lockfile"
-    };
-  }
-  const yarnLock = path4.join(cwd, "yarn.lock");
-  if (await exists(yarnLock)) {
+  const probed = await Promise.all(
+    LOCKFILE_CANDIDATES.map(async (candidate) => {
+      const filePath = path5.join(cwd, candidate.filename);
+      return { ...candidate, filePath, present: await exists(filePath) };
+    })
+  );
+  const match = probed.find((candidate) => candidate.present);
+  if (match) {
     return {
       ecosystem: "npm",
-      filePath: yarnLock,
-      filename: "yarn.lock",
-      strategy: "yarn-lockfile"
+      filePath: match.filePath,
+      filename: match.filename,
+      strategy: match.strategy
     };
   }
+  const expected = LOCKFILE_CANDIDATES.map((candidate) => candidate.filename).join(", ");
   throw new PatchstackError(
-    `No lockfile found in ${cwd}. Expected one of: package-lock.json, bun.lock, bun.lockb, yarn.lock, pnpm-lock.yaml.`,
+    `No lockfile found in ${cwd}. Expected one of: ${expected}.`,
     "LOCKFILE_NOT_FOUND"
   );
 }
 async function scanLockfile(cwd) {
-  const detected = await detectLockfile(cwd);
-  const packages = await runStrategy(detected, cwd);
-  return { ecosystem: detected.ecosystem, packages };
+  const candidates = await presentLockfiles(cwd);
+  if (candidates.length === 0) {
+    await detectLockfile(cwd);
+  }
+  const declared = await readDeclaredDependencyNames(cwd);
+  const warnings = [];
+  let firstParsed = null;
+  let walkTried = false;
+  for (const candidate of candidates) {
+    let packages;
+    try {
+      packages = await runStrategy(candidate, cwd);
+    } catch {
+      continue;
+    }
+    walkTried ||= candidate.strategy === "node-modules-walk";
+    firstParsed ??= { packages, filename: candidate.filename };
+    const missing = missingDependencies(declared, packages);
+    if (missing.length === 0) {
+      return manifestWith(packages, warnings);
+    }
+    warnings.push(staleWarning(candidate.filename, missing));
+  }
+  if (!walkTried) {
+    try {
+      const packages = await walkNodeModules(cwd);
+      const missing = missingDependencies(declared, packages);
+      if (missing.length > 0) {
+        warnings.push(staleWarning("node_modules/", missing));
+      }
+      warnings.push("Scanned node_modules/ instead. Delete the stale lockfile to silence this warning.");
+      return manifestWith(packages, warnings);
+    } catch {
+    }
+  }
+  if (firstParsed === null) {
+    const expected = LOCKFILE_CANDIDATES.map((candidate) => candidate.filename).join(", ");
+    throw new PatchstackError(
+      `No readable lockfile found in ${cwd}. Expected one of: ${expected}.`,
+      "LOCKFILE_NOT_FOUND"
+    );
+  }
+  warnings.push(
+    `No fully-consistent source found; reporting ${firstParsed.filename}. The manifest may understate the real dependency set.`
+  );
+  return manifestWith(firstParsed.packages, warnings);
+}
+function manifestWith(packages, warnings) {
+  return warnings.length > 0 ? { ecosystem: "npm", packages, warnings } : { ecosystem: "npm", packages };
+}
+function staleWarning(source, missing) {
+  const sample = missing.slice(0, 3).join(", ");
+  const suffix = missing.length > 3 ? `, +${missing.length - 3} more` : "";
+  return `${source} looks stale: package.json declares ${missing.length} dependenc${missing.length === 1 ? "y" : "ies"} it does not contain (${sample}${suffix}).`;
+}
+async function presentLockfiles(cwd) {
+  const probed = await Promise.all(
+    LOCKFILE_CANDIDATES.map(async (candidate) => {
+      const filePath = path5.join(cwd, candidate.filename);
+      return { ...candidate, filePath, present: await exists(filePath) };
+    })
+  );
+  return probed.filter((candidate) => candidate.present).map(({ filename, strategy, filePath }) => ({ ecosystem: "npm", filename, strategy, filePath }));
 }
 async function runStrategy(detected, cwd) {
   switch (detected.strategy) {
@@ -832,86 +912,19 @@ function compareSegments(a, b) {
   return 0;
 }
 
-// src/buildFlag.ts
-import { promises as fs } from "fs";
-import path5 from "path";
-var FLAG_MARKER = "__PATCHSTACK_PROD__";
-var SNIPPET = "<script>window.__PATCHSTACK_PROD__=true;/*patchstack:production*/</script>";
-var DEFAULT_DIRS = ["dist", "build", "out", ".output/public"];
-async function pathExists(target) {
-  try {
-    await fs.access(target);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function resolveBuildDir(cwd, override) {
-  if (override !== void 0 && override.length > 0) {
-    const dir = path5.resolve(cwd, override);
-    return await pathExists(dir) ? dir : null;
-  }
-  for (const candidate of DEFAULT_DIRS) {
-    const dir = path5.resolve(cwd, candidate);
-    if (await pathExists(dir)) {
-      return dir;
+// src/checksum.ts
+import { createHash } from "crypto";
+function computeManifestChecksum(packages) {
+  const canonical = packages.map((pkg) => ({ name: pkg.name, version: pkg.version })).sort((a, b) => {
+    if (a.name !== b.name) {
+      return a.name < b.name ? -1 : 1;
     }
-  }
-  return null;
-}
-async function findHtmlFiles(dir, depth = 3) {
-  const found = [];
-  let entries;
-  try {
-    entries = await fs.readdir(dir, { withFileTypes: true });
-  } catch {
-    return found;
-  }
-  for (const entry of entries) {
-    const full = path5.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (depth > 0) {
-        found.push(...await findHtmlFiles(full, depth - 1));
-      }
-    } else if (entry.isFile() && entry.name.toLowerCase().endsWith(".html")) {
-      found.push(full);
-    }
-  }
-  return found;
-}
-function injectFlag(html) {
-  if (html.includes(FLAG_MARKER)) {
-    return null;
-  }
-  const headOpen = /<head[^>]*>/i;
-  if (headOpen.test(html)) {
-    return html.replace(headOpen, (match) => `${match}${SNIPPET}`);
-  }
-  const bodyOpen = /<body[^>]*>/i;
-  if (bodyOpen.test(html)) {
-    return html.replace(bodyOpen, (match) => `${match}${SNIPPET}`);
-  }
-  return `${SNIPPET}${html}`;
-}
-async function markProductionBuild(cwd, override) {
-  const dir = await resolveBuildDir(cwd, override);
-  if (dir === null) {
-    return { dir: null, patched: [], skipped: [] };
-  }
-  const files = await findHtmlFiles(dir);
-  const patched = [];
-  const skipped = [];
-  for (const file of files) {
-    const html = await fs.readFile(file, "utf8");
-    const next = injectFlag(html);
-    if (next === null) {
-      skipped.push(file);
-      continue;
+    if (a.version !== b.version) {
+      return a.version < b.version ? -1 : 1;
     }
-    await fs.writeFile(file, next, "utf8");
-    patched.push(file);
-  }
-  return { dir, patched, skipped };
+    return 0;
+  });
+  return createHash("sha256").update(JSON.stringify(canonical)).digest("hex").slice(0, 12);
 }
 
 // src/client.ts
@@ -937,7 +950,7 @@ async function postManifest(config, payload) {
         Accept: "application/json",
         "User-Agent": "@patchstack/connect"
       },
-      body: JSON.stringify(payload),
+      body: JSON.stringify({ ...payload, environment: config.environment }),
       signal: AbortSignal.timeout(timeoutMs)
     });
   } catch (cause) {
@@ -992,15 +1005,24 @@ function isTimeoutError(cause) {
 }
 
 // src/config.ts
-import { readFile as readFile5, writeFile } from "fs/promises";
+import { readFile as readFile6, writeFile } from "fs/promises";
 import path6 from "path";
 var CONFIG_FILENAME = ".patchstackrc.json";
+var DEFAULT_ENVIRONMENT = "production";
 async function resolveConfig(options) {
   const fromFile = await readConfigFile(options.cwd);
   const fromEnv = readEnv();
   const siteUuid = options.cliSiteUuid ?? fromEnv.siteUuid ?? fromFile.siteUuid ?? null;
   const endpoint = options.cliEndpoint ?? fromEnv.endpoint ?? fromFile.endpoint ?? DEFAULT_ENDPOINT;
   const timeoutMs = fromEnv.timeoutMs ?? fromFile.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const environmentRaw = fromEnv.environment ?? fromFile.environment;
+  if (environmentRaw !== void 0 && !isEnvironment(environmentRaw)) {
+    throw new PatchstackError(
+      `Environment must be "production" or "sandbox"; got "${environmentRaw}".`,
+      "CONFIG_INVALID"
+    );
+  }
+  const environment = environmentRaw ?? DEFAULT_ENVIRONMENT;
   if (siteUuid !== null && siteUuid.length > 0 && !isUuid(siteUuid)) {
     throw new PatchstackError(
       `Site UUID "${siteUuid}" does not look like a valid UUID.`,
@@ -1016,7 +1038,8 @@ async function resolveConfig(options) {
   return {
     siteUuid: siteUuid === null || siteUuid.length === 0 ? null : siteUuid,
     endpoint,
-    timeoutMs
+    timeoutMs,
+    environment
   };
 }
 async function writeConfigFile(cwd, config) {
@@ -1033,7 +1056,7 @@ async function readConfigFile(cwd) {
   const target = path6.join(cwd, CONFIG_FILENAME);
   let raw;
   try {
-    raw = await readFile5(target, "utf8");
+    raw = await readFile6(target, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return {};
@@ -1067,15 +1090,74 @@ function readEnv() {
     }
     timeoutMs = parsed;
   }
+  const environmentRaw = process.env.PATCHSTACK_ENVIRONMENT;
   return {
     siteUuid: process.env.PATCHSTACK_SITE_UUID ?? void 0,
     endpoint: process.env.PATCHSTACK_ENDPOINT ?? void 0,
-    timeoutMs
+    timeoutMs,
+    environment: environmentRaw !== void 0 && environmentRaw.length > 0 ? environmentRaw : void 0
   };
 }
 function isUuid(value) {
   return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
 }
+function isEnvironment(value) {
+  return value === "production" || value === "sandbox";
+}
+
+// src/mark-build.ts
+import { existsSync, readdirSync, statSync } from "fs";
+import path7 from "path";
+var MARKER_ATTR = "data-patchstack-build";
+var BUILD_DIR_CANDIDATES = ["dist", "build", "out", ".output/public"];
+function resolveBuildDir(cwd, override) {
+  if (override !== void 0 && override !== "") {
+    const abs = path7.resolve(cwd, override);
+    return existsSync(abs) && statSync(abs).isDirectory() ? abs : null;
+  }
+  for (const candidate of BUILD_DIR_CANDIDATES) {
+    const abs = path7.resolve(cwd, candidate);
+    if (existsSync(abs) && statSync(abs).isDirectory()) {
+      return abs;
+    }
+  }
+  return null;
+}
+function findHtmlFiles(dir) {
+  const out = [];
+  const walk2 = (current) => {
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const full = path7.join(current, entry.name);
+      if (entry.isDirectory()) {
+        walk2(full);
+      } else if (entry.isFile() && entry.name.toLowerCase().endsWith(".html")) {
+        out.push(full);
+      }
+    }
+  };
+  walk2(dir);
+  return out;
+}
+function buildInjectionSnippet(checksum) {
+  const statements = ["window.__PATCHSTACK_PROD__=true;"];
+  if (checksum !== null && checksum !== "") {
+    statements.push(`window.__PATCHSTACK_BUILD__=${JSON.stringify(checksum)};`);
+  }
+  return `<script ${MARKER_ATTR}>${statements.join("")}</script>`;
+}
+function injectMarker(html, snippet) {
+  const stripped = html.replace(
+    new RegExp(`\\s*<script ${MARKER_ATTR}[^>]*>[\\s\\S]*?</script>`, "gi"),
+    ""
+  );
+  if (/<\/head>/i.test(stripped)) {
+    return stripped.replace(/<\/head>/i, `${snippet}</head>`);
+  }
+  if (/<\/body>/i.test(stripped)) {
+    return stripped.replace(/<\/body>/i, `${snippet}</body>`);
+  }
+  return stripped + snippet;
+}
 
 // src/cli.ts
 var HELP = `@patchstack/connect \u2014 scan your lockfile and report packages to Patchstack.
@@ -1087,10 +1169,8 @@ Usage:
   patchstack-connect init   <site-uuid>              Optional: pre-seed .patchstackrc.json
                                                      with an existing site UUID
   patchstack-connect status [options]                Show current configuration
-  patchstack-connect mark-build [--dir <path>]       Inject the production flag into
-                                                     the built HTML (run as a postbuild
-                                                     step). Tells the widget it's live so
-                                                     it hides the claim flow.
+  patchstack-connect mark-build [options]            Stamp built HTML with a production flag +
+                                                     build fingerprint (run as a postbuild step)
   patchstack-connect help                            Print this message
 
 Options (for scan and status):
@@ -1099,13 +1179,14 @@ Options (for scan and status):
   --dry-run               (scan only) Show the payload without posting
 
 Options (for mark-build):
-  --dir <path>            Build output dir (default: auto-detect dist/, build/,
-                          out/, .output/public)
+  --dir <path>            Build output directory (default: auto-detect
+                          dist/ build/ out/ .output/public)
 
 Environment:
   PATCHSTACK_SITE_UUID    Site UUID
   PATCHSTACK_ENDPOINT     API endpoint (default: https://api.patchstack.com/monitor/pulse/manifest)
   PATCHSTACK_TIMEOUT_MS   Request timeout in ms (default: 30000)
+  PATCHSTACK_ENVIRONMENT  Manifest environment: production | sandbox (default: production)
 
 Precedence: CLI flag > environment variable > .patchstackrc.json.
 
@@ -1175,10 +1256,14 @@ async function runScan(args) {
     cliEndpoint: getStringFlag(args.flags, "endpoint")
   });
   const manifest = await scanLockfile(process.cwd());
+  for (const warning of manifest.warnings ?? []) {
+    console.warn(`patchstack: ${warning}`);
+  }
   const { payload, stats } = buildWirePayload(manifest);
   console.log(
     `Found ${payload.packages.length} unique package versions across ${stats.uniqueNames} package names in ${manifest.ecosystem} lockfile.`
   );
+  console.log(`Reporting under the ${config.environment} environment.`);
   if (stats.duplicateNames.length > 0) {
     console.log(`${stats.duplicateNames.length} package(s) appear at multiple versions:`);
     if (stats.duplicateNames.length <= 10) {
@@ -1229,29 +1314,54 @@ async function runStatus(args) {
     cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
     cliEndpoint: getStringFlag(args.flags, "endpoint")
   });
-  console.log(`Site UUID:  ${config.siteUuid ?? "(none yet \u2014 the next `scan` will provision one)"}`);
-  console.log(`Endpoint:   ${config.endpoint}`);
-  console.log(`Timeout:    ${config.timeoutMs}ms`);
+  console.log(`Site UUID:   ${config.siteUuid ?? "(none yet \u2014 the next `scan` will provision one)"}`);
+  console.log(`Endpoint:    ${config.endpoint}`);
+  console.log(`Timeout:     ${config.timeoutMs}ms`);
+  console.log(`Environment: ${config.environment}`);
   if (config.siteUuid !== null) {
     console.log(`Claim URL:  ${buildClaimUrl(config.endpoint, config.siteUuid)}`);
   }
   return 0;
 }
 async function runMarkBuild(args) {
-  const result = await markProductionBuild(process.cwd(), getStringFlag(args.flags, "dir"));
-  if (result.dir === null) {
+  const cwd = process.cwd();
+  let checksum = null;
+  try {
+    const manifest = await scanLockfile(cwd);
+    for (const warning of manifest.warnings ?? []) {
+      console.warn(`mark-build: ${warning}`);
+    }
+    const { payload } = buildWirePayload(manifest);
+    checksum = computeManifestChecksum(payload.packages);
+  } catch (err) {
+    console.warn(
+      `mark-build: could not compute the build fingerprint (${err.message}). Stamping the production flag only.`
+    );
+  }
+  const dir = resolveBuildDir(cwd, getStringFlag(args.flags, "dir"));
+  if (dir === null) {
     console.warn(
-      "patchstack: no build output found (looked for dist/, build/, out/, .output/public). Pass --dir <path> if your build outputs elsewhere. Skipping production flag."
+      "mark-build: no build output directory found (looked for dist/, build/, out/, .output/public). Pass --dir <path> if it is elsewhere. Nothing to mark."
     );
     return 0;
   }
-  if (result.patched.length === 0 && result.skipped.length === 0) {
-    console.warn(`patchstack: no HTML files found under ${result.dir}; skipping production flag.`);
+  const files = findHtmlFiles(dir);
+  if (files.length === 0) {
+    console.warn(`mark-build: no HTML files found under ${dir}. Nothing to mark.`);
     return 0;
   }
-  const already = result.skipped.length > 0 ? ` (${result.skipped.length} already marked)` : "";
+  const snippet = buildInjectionSnippet(checksum);
+  let marked = 0;
+  for (const file of files) {
+    const before = readFileSync(file, "utf8");
+    const after = injectMarker(before, snippet);
+    if (after !== before) {
+      writeFileSync(file, after);
+      marked += 1;
+    }
+  }
   console.log(
-    `patchstack: marked ${result.patched.length} HTML file(s) as a production build in ${result.dir}${already}.`
+    `mark-build: marked ${marked} HTML file(s) in ${dir}${checksum !== null ? ` (build ${checksum})` : ""}.`
   );
   return 0;
 }