@patchstack/connect 0.3.1 → 0.3.3

package/dist/protect.cjs

@@ -1,1240 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/protect/runtime.js
-var runtime_exports = {};
-__export(runtime_exports, {
-  GUARD_PATH: () => GUARD_PATH,
-  createProtection: () => createProtection,
-  createServerFnGuard: () => createServerFnGuard,
-  createSupabaseGuard: () => createSupabaseGuard
-});
-module.exports = __toCommonJS(runtime_exports);
-
-// src/protect/engine/client.js
-var DEFAULT_BASE_URL = "https://api.patchstack.com";
-var DEFAULT_CACHE_TTL = 3e5;
-var PatchstackRuleClient = class {
-  #token;
-  #baseUrl;
-  #cacheTtl;
-  #cache = null;
-  #cacheTime = null;
-  constructor({ token, baseUrl, cacheTtl } = {}) {
-    this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN;
-    this.#baseUrl = baseUrl ?? process.env.PATCHSTACK_WAF_API_URL ?? DEFAULT_BASE_URL;
-    this.#cacheTtl = cacheTtl ?? DEFAULT_CACHE_TTL;
-    if (!this.#token) {
-      throw new Error("Patchstack WAF token is required. Pass { token } or set PATCHSTACK_WAF_TOKEN env var.");
-    }
-  }
-  async getRules() {
-    const now = Date.now();
-    if (this.#cache && this.#cacheTime && now - this.#cacheTime < this.#cacheTtl) {
-      return this.#cache;
-    }
-    const url = `${this.#baseUrl}/api/get-rules/3`;
-    try {
-      const response = await fetch(url, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "Authorization": `Bearer ${this.#token}`,
-          "LicenseID": "1"
-          // Hard-coded, is never actually used but needed by the API
-        },
-        body: JSON.stringify({}),
-        signal: AbortSignal.timeout(3e4)
-      });
-      if (!response.ok) {
-        return {
-          success: false,
-          error: `API returned ${response.status}: ${response.statusText}`,
-          firewall: [],
-          whitelists: [],
-          whitelist_keys: {}
-        };
-      }
-      const data = await response.json();
-      const result = {
-        success: true,
-        firewall: Array.isArray(data.firewall) ? data.firewall : [],
-        whitelists: Array.isArray(data.whitelists) ? data.whitelists : [],
-        whitelist_keys: data.whitelist_keys ?? {}
-      };
-      this.#cache = result;
-      this.#cacheTime = now;
-      return result;
-    } catch (err) {
-      return {
-        success: false,
-        error: err.name === "TimeoutError" ? "Request timed out" : err.message,
-        firewall: [],
-        whitelists: [],
-        whitelist_keys: {}
-      };
-    }
-  }
-  clearCache() {
-    this.#cache = null;
-    this.#cacheTime = null;
-  }
-};
-
-// src/protect/engine/request.js
-function base64DecodeUtf8(value) {
-  const str = String(value);
-  if (typeof Buffer !== "undefined") {
-    return Buffer.from(str, "base64").toString("utf-8");
-  }
-  const binary = atob(str);
-  const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
-  return new TextDecoder().decode(bytes);
-}
-var RequestResolver = class {
-  #req;
-  #cookies;
-  constructor(req) {
-    this.#req = req;
-    this.#cookies = null;
-  }
-  resolve(parameter) {
-    if (!parameter || parameter === "false") {
-      return [null];
-    }
-    if (parameter === "rules") {
-      return [null];
-    }
-    if (parameter === "raw") {
-      return this.#resolveRaw();
-    }
-    if (parameter === "all") {
-      return this.#resolveAll();
-    }
-    const dotIndex = parameter.indexOf(".");
-    if (dotIndex === -1) {
-      return [];
-    }
-    const source = parameter.substring(0, dotIndex);
-    const key = parameter.substring(dotIndex + 1);
-    switch (source) {
-      case "get":
-        return this.#resolveGet(key);
-      case "post":
-        return this.#resolvePost(key);
-      case "request":
-        return this.#resolveRequest(key);
-      case "cookie":
-        return this.#resolveCookie(key);
-      case "server":
-        return this.#resolveServer(key);
-      case "files":
-        return this.#resolveFiles(key);
-      default:
-        return [];
-    }
-  }
-  applyMutations(mutations, value) {
-    if (!mutations || !Array.isArray(mutations)) {
-      return value;
-    }
-    let result = value;
-    for (const mutation of mutations) {
-      result = this.#applyMutation(mutation, result);
-    }
-    return result;
-  }
-  #applyMutation(mutation, value) {
-    if (value === null || value === void 0) {
-      return value;
-    }
-    switch (mutation) {
-      case "base64_decode":
-        try {
-          return base64DecodeUtf8(value);
-        } catch {
-          return value;
-        }
-      case "json_decode":
-        try {
-          return JSON.parse(String(value));
-        } catch {
-          return value;
-        }
-      case "json_encode":
-        try {
-          return JSON.stringify(value);
-        } catch {
-          return value;
-        }
-      case "urldecode":
-        try {
-          return decodeURIComponent(String(value));
-        } catch {
-          return value;
-        }
-      case "intval":
-        return parseInt(String(value), 10) || 0;
-      case "getArrayValues":
-        if (typeof value === "object" && value !== null) {
-          return Object.values(value);
-        }
-        return value;
-      default:
-        return value;
-    }
-  }
-  #resolveGet(key) {
-    const query = this.#req.query ?? {};
-    if (key.endsWith("*")) {
-      return this.#resolveWildcard(query, key);
-    }
-    const value = this.#getNestedValue(query, key);
-    return value !== void 0 ? [value] : [];
-  }
-  #resolvePost(key) {
-    const body = this.#req.body ?? {};
-    if (key.endsWith("*")) {
-      return this.#resolveWildcard(body, key);
-    }
-    const value = this.#getNestedValue(body, key);
-    return value !== void 0 ? [value] : [];
-  }
-  #resolveRequest(key) {
-    const query = this.#req.query ?? {};
-    const body = this.#req.body ?? {};
-    const cookies = this.#parseCookies();
-    if (key.endsWith("*")) {
-      return [
-        ...this.#resolveWildcard(query, key),
-        ...this.#resolveWildcard(body, key),
-        ...this.#resolveWildcard(cookies, key)
-      ];
-    }
-    const value = this.#getNestedValue(query, key) ?? this.#getNestedValue(body, key) ?? cookies[key];
-    return value !== void 0 ? [value] : [];
-  }
-  #resolveCookie(key) {
-    const cookies = this.#parseCookies();
-    if (key.endsWith("*")) {
-      return this.#resolveWildcard(cookies, key);
-    }
-    const value = cookies[key];
-    return value !== void 0 ? [value] : [];
-  }
-  #resolveServer(key) {
-    const req = this.#req;
-    switch (key) {
-      case "REQUEST_URI":
-        return [req.originalUrl ?? req.url ?? "/"];
-      case "REQUEST_METHOD":
-        return [req.method ?? "GET"];
-      case "HTTP_USER_AGENT":
-        return req.headers?.["user-agent"] ? [req.headers["user-agent"]] : [];
-      case "HTTP_REFERER":
-        return req.headers?.referer ? [req.headers.referer] : [];
-      case "HTTP_HOST":
-        return req.headers?.host ? [req.headers.host] : [];
-      case "REMOTE_ADDR":
-      case "ip":
-        return [req.ip ?? req.socket?.remoteAddress ?? ""];
-      case "CONTENT_TYPE":
-        return req.headers?.["content-type"] ? [req.headers["content-type"]] : [];
-      case "CONTENT_LENGTH":
-        return req.headers?.["content-length"] ? [req.headers["content-length"]] : [];
-      default: {
-        if (key.startsWith("HTTP_")) {
-          const headerName = key.substring(5).toLowerCase().replace(/_/g, "-");
-          return req.headers?.[headerName] ? [req.headers[headerName]] : [];
-        }
-        return [];
-      }
-    }
-  }
-  #resolveFiles(key) {
-    const files = this.#req.files;
-    if (!files) {
-      return [];
-    }
-    if (key.endsWith("*")) {
-      return this.#resolveWildcard(files, key);
-    }
-    const value = files[key];
-    return value !== void 0 ? [value] : [];
-  }
-  #resolveRaw() {
-    if (typeof this.#req._rawBody === "string") {
-      return this.#req._rawBody ? [this.#req._rawBody] : [];
-    }
-    const body = this.#req.body;
-    if (body === void 0 || body === null) {
-      return [];
-    }
-    if (typeof body === "string") {
-      return [body];
-    }
-    try {
-      return [JSON.stringify(body)];
-    } catch {
-      return [String(body)];
-    }
-  }
-  #resolveAll() {
-    const parts = [];
-    const uri = this.#req.originalUrl ?? this.#req.url ?? "/";
-    parts.push(uri);
-    const queryString = uri.includes("?") ? uri.split("?")[1] : "";
-    if (queryString) {
-      parts.push(queryString);
-    }
-    const body = this.#req.body;
-    if (body) {
-      parts.push(typeof body === "string" ? body : JSON.stringify(body));
-    }
-    const headers = this.#req.headers ?? {};
-    const excludedHeaders = /* @__PURE__ */ new Set([
-      "host",
-      "connection",
-      "cache-control",
-      "accept",
-      "accept-encoding",
-      "accept-language",
-      "priority",
-      "sec-ch-ua",
-      "sec-ch-ua-mobile",
-      "sec-ch-ua-platform",
-      "sec-fetch-dest",
-      "sec-fetch-mode",
-      "sec-fetch-site",
-      "sec-fetch-user",
-      "upgrade-insecure-requests"
-    ]);
-    for (const [name, value] of Object.entries(headers)) {
-      if (!excludedHeaders.has(name)) {
-        parts.push(`${name}: ${value}`);
-      }
-    }
-    const cookies = this.#parseCookies();
-    const cookieStr = Object.entries(cookies).map(([k, v]) => `${k}=${v}`).join("; ");
-    if (cookieStr) {
-      parts.push(cookieStr);
-    }
-    return [parts.join(" ")];
-  }
-  #resolveWildcard(obj, pattern) {
-    if (typeof obj !== "object" || obj === null) {
-      return [];
-    }
-    const prefix = pattern.slice(0, -1);
-    const values = [];
-    for (const [key, value] of Object.entries(obj)) {
-      if (key.startsWith(prefix)) {
-        values.push(value);
-      }
-    }
-    return values;
-  }
-  #getNestedValue(obj, key) {
-    if (typeof obj !== "object" || obj === null) {
-      return void 0;
-    }
-    if (key in obj) {
-      return obj[key];
-    }
-    const parts = key.split(".");
-    let current = obj;
-    for (const part of parts) {
-      if (current === null || current === void 0 || typeof current !== "object") {
-        return void 0;
-      }
-      current = current[part];
-    }
-    return current;
-  }
-  #parseCookies() {
-    if (this.#cookies !== null) {
-      return this.#cookies;
-    }
-    if (this.#req.cookies) {
-      this.#cookies = this.#req.cookies;
-      return this.#cookies;
-    }
-    const header = this.#req.headers?.cookie;
-    if (!header) {
-      this.#cookies = {};
-      return this.#cookies;
-    }
-    const cookies = {};
-    for (const pair of header.split(";")) {
-      const eqIndex = pair.indexOf("=");
-      if (eqIndex === -1) {
-        continue;
-      }
-      const name = pair.substring(0, eqIndex).trim();
-      const value = pair.substring(eqIndex + 1).trim();
-      cookies[name] = value;
-    }
-    this.#cookies = cookies;
-    return this.#cookies;
-  }
-};
-
-// src/protect/engine/normalizer.js
-var HTML_ENTITIES = {
-  "&amp;": "&",
-  "&lt;": "<",
-  "&gt;": ">",
-  "&quot;": '"',
-  "&#39;": "'",
-  "&apos;": "'",
-  "&nbsp;": " ",
-  "&#x27;": "'",
-  "&#x22;": '"',
-  "&#x3C;": "<",
-  "&#x3E;": ">",
-  "&#x26;": "&",
-  "&#34;": '"',
-  "&#60;": "<",
-  "&#62;": ">",
-  "&#38;": "&"
-};
-var MAX_DECODE_ITERATIONS = 5;
-function normalize(value, options = {}) {
-  if (typeof value !== "string") {
-    return value;
-  }
-  const opts = {
-    urlDecode: true,
-    htmlDecode: true,
-    sqlComments: true,
-    nullBytes: true,
-    whitespace: true,
-    ...options
-  };
-  let result = value;
-  if (opts.nullBytes) {
-    result = removeNullBytes(result);
-  }
-  if (opts.urlDecode) {
-    result = urlDecode(result);
-  }
-  if (opts.htmlDecode) {
-    result = htmlEntityDecode(result);
-  }
-  if (opts.sqlComments) {
-    result = removeSqlComments(result);
-  }
-  if (opts.whitespace) {
-    result = normalizeWhitespace(result);
-  }
-  return result;
-}
-function urlDecode(value) {
-  if (typeof value !== "string") {
-    return value;
-  }
-  let result = value;
-  let previous = "";
-  let iterations = 0;
-  while (result !== previous && iterations < MAX_DECODE_ITERATIONS) {
-    previous = result;
-    iterations++;
-    try {
-      result = decodeURIComponent(result);
-    } catch {
-      result = safeUrlDecode(result);
-      break;
-    }
-  }
-  return result;
-}
-function safeUrlDecode(value) {
-  return value.replace(/%([0-9A-Fa-f]{2})/g, (match, hex) => {
-    try {
-      return String.fromCharCode(parseInt(hex, 16));
-    } catch {
-      return match;
-    }
-  });
-}
-function htmlEntityDecode(value) {
-  if (typeof value !== "string") {
-    return value;
-  }
-  let result = value;
-  for (const [entity, char] of Object.entries(HTML_ENTITIES)) {
-    result = result.split(entity).join(char);
-  }
-  result = result.replace(/&#(\d+);/g, (match, code) => {
-    const num = parseInt(code, 10);
-    return num > 0 && num < 65536 ? String.fromCharCode(num) : match;
-  });
-  result = result.replace(/&#x([0-9A-Fa-f]+);/g, (match, hex) => {
-    const num = parseInt(hex, 16);
-    return num > 0 && num < 65536 ? String.fromCharCode(num) : match;
-  });
-  return result;
-}
-function removeSqlComments(value) {
-  if (typeof value !== "string") {
-    return value;
-  }
-  let result = value;
-  result = result.replace(/\/\*[\s\S]*?\*\//g, " ");
-  result = result.replace(/\/\*![\s\S]*?\*\//g, " ");
-  result = result.replace(/--[^\r\n]*/g, "");
-  result = result.replace(/#[^\r\n]*/g, "");
-  return result;
-}
-function removeNullBytes(value) {
-  if (typeof value !== "string") {
-    return value;
-  }
-  let result = value.replace(/\x00/g, "");
-  result = result.replace(/[\x01-\x08\x0B\x0C\x0E-\x1F]/g, "");
-  return result;
-}
-function normalizeWhitespace(value) {
-  if (typeof value !== "string") {
-    return value;
-  }
-  let result = value.replace(/[\t\r\n\f\v]+/g, " ");
-  result = result.replace(/ {2,}/g, " ");
-  return result;
-}
-function serializeForRawDetection(body, visited = /* @__PURE__ */ new Set(), isRoot = true) {
-  if (body === null || body === void 0) {
-    return isRoot ? "" : "null";
-  }
-  if (typeof body === "string") {
-    return isRoot ? body : JSON.stringify(body);
-  }
-  if (typeof body !== "object") {
-    return String(body);
-  }
-  if (visited.has(body)) {
-    return "[Circular]";
-  }
-  visited.add(body);
-  if (Array.isArray(body)) {
-    const items = body.map((item) => serializeForRawDetection(item, visited, false));
-    return "[" + items.join(",") + "]";
-  }
-  const keys = Object.getOwnPropertyNames(body);
-  const parts = keys.map((key) => {
-    const val = serializeForRawDetection(body[key], visited, false);
-    return JSON.stringify(key) + ":" + val;
-  });
-  return "{" + parts.join(",") + "}";
-}
-function normalizeRequest(req, options = {}) {
-  const rawBody = typeof req._rawBody === "string" ? req._rawBody : serializeForRawDetection(req.body ?? null);
-  return {
-    query: normalizeObject(req.query || {}, options),
-    body: normalizeObject(req.body || {}, options),
-    headers: normalizeObject(req.headers || {}, options),
-    url: normalize(req.url || "", options),
-    originalUrl: normalize(req.originalUrl || req.url || "", options),
-    _rawBody: rawBody
-  };
-}
-function normalizeObject(value, options = {}) {
-  if (typeof value === "string") {
-    return normalize(value, options);
-  }
-  if (Array.isArray(value)) {
-    return value.map((item) => normalizeObject(item, options));
-  }
-  if (typeof value === "object" && value !== null) {
-    const result = {};
-    for (const [key, val] of Object.entries(value)) {
-      result[key] = normalizeObject(val, options);
-    }
-    return result;
-  }
-  return value;
-}
-
-// src/protect/engine/engine.js
-var REDOS_PATTERNS = [
-  /\(\w\+\)\+/,
-  /\(\w\*\)\+/,
-  /\(\w\+\)\*/,
-  /\(\w\*\)\*/,
-  /\(\w\|\w\)\+/
-];
-function safeRegExp(pattern) {
-  if (!pattern) {
-    return null;
-  }
-  for (const dangerous of REDOS_PATTERNS) {
-    if (dangerous.test(pattern)) {
-      return null;
-    }
-  }
-  const match = pattern.match(/^\/(.+?)\/([gimsuy]*)$/s);
-  if (!match) {
-    return null;
-  }
-  try {
-    return new RegExp(match[1], match[2]);
-  } catch {
-    return null;
-  }
-}
-function ctypeResult(strValue, isClass, matchVal) {
-  if (strValue === "") {
-    return false;
-  }
-  const expected = typeof matchVal === "boolean" ? matchVal : true;
-  return isClass === expected;
-}
-function arrayKeyValue(value, matchObj) {
-  if (!matchObj || !matchObj.match || value === null || typeof value !== "object") {
-    return false;
-  }
-  const keys = Array.isArray(matchObj.key) ? matchObj.key : [matchObj.key];
-  const sub = matchObj.match;
-  for (const key of keys) {
-    let node = value;
-    for (const part of String(key).split(".")) {
-      if (node === null || typeof node !== "object") {
-        node = void 0;
-        break;
-      }
-      node = node[part];
-    }
-    if (node === void 0) {
-      continue;
-    }
-    const candidates = Array.isArray(node) ? node : [node];
-    for (const candidate of candidates) {
-      if (matchValue(sub.type, candidate, sub.value, sub)) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-var warnedMatchTypes = /* @__PURE__ */ new Set();
-function warnUnsupportedMatchType(type) {
-  if (type == null || warnedMatchTypes.has(type)) {
-    return;
-  }
-  warnedMatchTypes.add(type);
-  console.warn(
-    `[patchstack] Unsupported rule_v2 match type "${type}" \u2014 condition treated as no-match. Rules relying on it are not enforced by this engine.`
-  );
-}
-function matchValue(type, value, matchVal, matchObj) {
-  if (value === null || value === void 0) {
-    if (type === "isset") {
-      return false;
-    }
-    return false;
-  }
-  const strValue = typeof value === "string" ? value : String(value);
-  switch (type) {
-    case "equals":
-      return strValue == matchVal;
-    case "equals_strict":
-      return strValue === matchVal;
-    case "contains":
-    // engine-php exposes `stripos` as an alias of `contains`.
-    case "stripos": {
-      const lower = strValue.toLowerCase();
-      const target = String(matchVal).toLowerCase();
-      return lower.includes(target);
-    }
-    case "not_contains": {
-      const lower = strValue.toLowerCase();
-      const target = String(matchVal).toLowerCase();
-      return !lower.includes(target);
-    }
-    case "regex": {
-      const regex = safeRegExp(matchVal);
-      if (!regex) {
-        return false;
-      }
-      return regex.test(strValue);
-    }
-    case "more_than":
-      return Number(strValue) > Number(matchVal);
-    case "less_than":
-      return Number(strValue) < Number(matchVal);
-    case "ctype_digit":
-      return ctypeResult(strValue, /^\d+$/.test(strValue), matchVal);
-    case "ctype_alnum":
-      return ctypeResult(strValue, /^[\w$\u0080-\uFFFF]+$/.test(strValue), matchVal);
-    case "is_numeric":
-      return ctypeResult(strValue, !isNaN(strValue) && strValue.trim() !== "", matchVal);
-    case "isset":
-      return true;
-    case "in_array": {
-      const arr = Array.isArray(matchVal) ? matchVal : [matchVal];
-      return arr.includes(strValue);
-    }
-    case "not_in_array": {
-      const arr = Array.isArray(matchVal) ? matchVal : [matchVal];
-      return !arr.includes(strValue);
-    }
-    case "array_in_array": {
-      if (!Array.isArray(value) || !Array.isArray(matchVal)) {
-        return false;
-      }
-      return value.some((v) => matchVal.includes(v));
-    }
-    case "hostname": {
-      try {
-        const url = new URL(strValue);
-        return url.hostname === matchVal;
-      } catch {
-        return false;
-      }
-    }
-    case "quotes":
-    // engine-php exposes `inline_js_xss` as an alias of `quotes`.
-    case "inline_js_xss":
-      return /['"]/.test(strValue);
-    case "inline_xss":
-      return /['"]/.test(strValue) && /[>=]/.test(strValue);
-    case "ctype_special": {
-      const stripped = strValue.replace(/[ _\-,]/g, "");
-      return ctypeResult(strValue, /^[\w$€-￿]*$/.test(stripped), matchVal);
-    }
-    case "array_key_value":
-      return arrayKeyValue(value, matchObj);
-    // file_contains (uploaded-file content scanning) is NOT WordPress-specific, but is
-    // not yet implemented in the JS engine (needs multipart body access). Kept as an
-    // explicit, documented no-match rather than silently hitting `default`.
-    case "file_contains":
-      return false;
-    // WordPress-only match types (current_user_cannot, general_xss, getShortcodeAtts,
-    // getBlockAtts) have been removed: they depend on WP capabilities, wp_kses_post, and
-    // the shortcode/block parsers, and have no meaning in a JS app. They now fall through
-    // here and are reported once instead of pretending to be a no-match.
-    default:
-      warnUnsupportedMatchType(type);
-      return false;
-  }
-}
-var RuleEngine = class {
-  #rules;
-  #whitelists;
-  #whitelistKeys;
-  #onError;
-  #reportedErrors = /* @__PURE__ */ new Set();
-  constructor({ firewall = [], whitelists = [], whitelist_keys = {}, onError } = {}) {
-    this.#rules = firewall;
-    this.#whitelists = whitelists;
-    this.#whitelistKeys = whitelist_keys;
-    this.#onError = onError;
-  }
-  // A mitigation engine must never take down the app it protects: any error while
-  // evaluating a rule is reported and the request is allowed through (fail open). A
-  // malformed rule is skipped without aborting the rest of the ruleset.
-  #reportError(err) {
-    if (this.#onError) {
-      this.#onError(err);
-      return;
-    }
-    const key = err && err.message ? err.message : String(err);
-    if (this.#reportedErrors.has(key)) {
-      return;
-    }
-    this.#reportedErrors.add(key);
-    console.error("[patchstack] rule evaluation error (rule skipped, request allowed):", err);
-  }
-  evaluate(req) {
-    let normalizedReq;
-    let resolver;
-    try {
-      normalizedReq = { ...req, ...normalizeRequest(req) };
-      resolver = new RequestResolver(normalizedReq);
-    } catch (err) {
-      this.#reportError(err);
-      return { blocked: false, rule: null, message: null };
-    }
-    for (const rule of this.#rules) {
-      try {
-        const conditions = rule.rule_v2;
-        if (!Array.isArray(conditions) || conditions.length === 0) {
-          continue;
-        }
-        if (this.#evaluateRule(conditions, resolver)) {
-          if (this.#isWhitelisted(normalizedReq, rule)) {
-            continue;
-          }
-          return {
-            blocked: true,
-            rule,
-            message: rule.message ?? `Blocked by Patchstack WAF rule: ${rule.title ?? rule.id}`
-          };
-        }
-      } catch (err) {
-        this.#reportError(err);
-      }
-    }
-    return { blocked: false, rule: null, message: null };
-  }
-  #evaluateRule(conditions, resolver) {
-    const inclusiveConditions = conditions.filter((c) => c.inclusive);
-    const nonInclusiveConditions = conditions.filter((c) => !c.inclusive);
-    if (inclusiveConditions.length > 0) {
-      let inclusiveHits = 0;
-      for (const condition of inclusiveConditions) {
-        if (this.#evaluateCondition(condition, resolver)) {
-          inclusiveHits++;
-        }
-      }
-      if (inclusiveHits === inclusiveConditions.length) {
-        return true;
-      }
-    }
-    for (const condition of nonInclusiveConditions) {
-      if (this.#evaluateCondition(condition, resolver)) {
-        return true;
-      }
-    }
-    return false;
-  }
-  #evaluateCondition(condition, resolver) {
-    const { parameter, match, mutations } = condition;
-    if (parameter === "rules" && Array.isArray(condition.rules)) {
-      return this.#evaluateRule(condition.rules, resolver);
-    }
-    const values = resolver.resolve(parameter);
-    if (values.length === 0) {
-      return false;
-    }
-    for (let value of values) {
-      if (mutations) {
-        value = resolver.applyMutations(mutations, value);
-      }
-      if (match.type === "array_key_value") {
-        if (matchValue(match.type, value, match.value, match)) {
-          return true;
-        }
-        continue;
-      }
-      if (typeof value === "object" && value !== null && !Array.isArray(value)) {
-        for (const v of Object.values(value)) {
-          if (matchValue(match.type, v, match.value, match)) {
-            return true;
-          }
-        }
-        continue;
-      }
-      if (matchValue(match.type, value, match.value, match)) {
-        return true;
-      }
-    }
-    return false;
-  }
-  #isWhitelisted(req, rule) {
-    if (!this.#whitelists || this.#whitelists.length === 0) {
-      return false;
-    }
-    for (const whitelist of this.#whitelists) {
-      if (!Array.isArray(whitelist.rule_v2)) {
-        continue;
-      }
-      if (whitelist.rule_id && whitelist.rule_id !== rule.id) {
-        continue;
-      }
-      const resolver = new RequestResolver(req);
-      if (this.#evaluateRule(whitelist.rule_v2, resolver)) {
-        return true;
-      }
-    }
-    return false;
-  }
-};
-
-// src/protect/engine/fetch.js
-async function fromFetchRequest(request) {
-  const url = new URL(request.url);
-  const method = (request.method || "GET").toUpperCase();
-  const headers = {};
-  request.headers.forEach((value, key) => {
-    headers[key.toLowerCase()] = value;
-  });
-  const query = {};
-  for (const [key, value] of url.searchParams) {
-    if (key in query) {
-      query[key] = Array.isArray(query[key]) ? [...query[key], value] : [query[key], value];
-    } else {
-      query[key] = value;
-    }
-  }
-  let rawBody = "";
-  if (method !== "GET" && method !== "HEAD") {
-    try {
-      rawBody = await request.clone().text();
-    } catch {
-      rawBody = "";
-    }
-  }
-  const contentType = headers["content-type"] || "";
-  let body = {};
-  if (rawBody) {
-    if (contentType.includes("application/json")) {
-      try {
-        body = JSON.parse(rawBody);
-      } catch {
-        body = {};
-      }
-    } else if (contentType.includes("application/x-www-form-urlencoded")) {
-      body = {};
-      for (const [k, v] of new URLSearchParams(rawBody)) {
-        body[k] = k in body ? [].concat(body[k], v) : v;
-      }
-    }
-  }
-  const uri = url.pathname + url.search;
-  const forwarded = headers["cf-connecting-ip"] || headers["x-forwarded-for"] || headers["x-real-ip"] || "";
-  return {
-    method,
-    url: uri,
-    originalUrl: uri,
-    query,
-    body,
-    headers,
-    ip: forwarded.split(",")[0].trim(),
-    cookies: parseCookies(headers.cookie),
-    // Verbatim body text: preserves literal keys (e.g. `__proto__`) that JSON.stringify
-    // drops, so prototype-pollution rules on `raw` are robust.
-    _rawBody: rawBody
-  };
-}
-function parseCookies(header) {
-  const cookies = {};
-  if (!header) {
-    return cookies;
-  }
-  for (const pair of header.split(";")) {
-    const idx = pair.indexOf("=");
-    if (idx === -1) {
-      continue;
-    }
-    cookies[pair.slice(0, idx).trim()] = pair.slice(idx + 1).trim();
-  }
-  return cookies;
-}
-
-// src/protect/engine/node.js
-function fromNodeRequest(req, rawBody = "") {
-  const method = (req.method || "GET").toUpperCase();
-  const headers = {};
-  for (const [key, value] of Object.entries(req.headers || {})) {
-    headers[key.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;
-  }
-  const host = headers.host || "localhost";
-  const url = new URL(req.url || "/", `http://${host}`);
-  const query = {};
-  for (const [key, value] of url.searchParams) {
-    if (key in query) {
-      query[key] = Array.isArray(query[key]) ? [...query[key], value] : [query[key], value];
-    } else {
-      query[key] = value;
-    }
-  }
-  const contentType = headers["content-type"] || "";
-  let body = {};
-  if (rawBody) {
-    if (contentType.includes("application/json")) {
-      try {
-        body = JSON.parse(rawBody);
-      } catch {
-        body = {};
-      }
-    } else if (contentType.includes("application/x-www-form-urlencoded")) {
-      body = {};
-      for (const [k, v] of new URLSearchParams(rawBody)) {
-        body[k] = k in body ? [].concat(body[k], v) : v;
-      }
-    }
-  }
-  const uri = url.pathname + url.search;
-  const forwarded = headers["cf-connecting-ip"] || headers["x-forwarded-for"] || headers["x-real-ip"] || "";
-  return {
-    method,
-    url: uri,
-    originalUrl: uri,
-    query,
-    body,
-    headers,
-    ip: forwarded.split(",")[0].trim() || req.socket && req.socket.remoteAddress || "",
-    cookies: parseCookies2(headers.cookie),
-    // Verbatim body text: preserves literal keys (e.g. `__proto__`) that JSON.stringify drops.
-    _rawBody: rawBody
-  };
-}
-function parseCookies2(header) {
-  const cookies = {};
-  if (!header) {
-    return cookies;
-  }
-  for (const pair of header.split(";")) {
-    const idx = pair.indexOf("=");
-    if (idx === -1) {
-      continue;
-    }
-    cookies[pair.slice(0, idx).trim()] = pair.slice(idx + 1).trim();
-  }
-  return cookies;
-}
-
-// src/protect/runtime.js
-var import_node_fs = require("fs");
-var import_node_path = require("path");
-
-// src/protect/supabase-guard.js
-var GUARD_PATH = "/_patchstack/guard";
-var HOP_BY_HOP = /* @__PURE__ */ new Set(["content-encoding", "content-length", "transfer-encoding", "connection"]);
-function createSupabaseGuard({ protection, supabaseUrl, fetchImpl = fetch }) {
-  const guard = protection.fetchGuard();
-  const allowedOrigin = supabaseUrl ? new URL(supabaseUrl).origin : null;
-  return async function handleGuardRequest(request) {
-    const target = request.headers.get("x-ps-target");
-    if (!target) return new Response("patchstack: missing x-ps-target", { status: 400 });
-    let targetUrl;
-    try {
-      targetUrl = new URL(target);
-    } catch {
-      return new Response("patchstack: invalid target", { status: 400 });
-    }
-    if (!allowedOrigin || targetUrl.protocol !== "https:" || targetUrl.origin !== allowedOrigin) {
-      return new Response("patchstack: target not allowed", { status: 403 });
-    }
-    const hasBody = request.method !== "GET" && request.method !== "HEAD";
-    const bodyText = hasBody ? await request.text() : "";
-    const evalReq = new Request(targetUrl.toString(), {
-      method: request.method,
-      headers: request.headers,
-      body: hasBody ? bodyText : void 0
-    });
-    const blocked = await guard(evalReq);
-    if (blocked) return blocked;
-    const forwardHeaders = new Headers(request.headers);
-    forwardHeaders.delete("x-ps-target");
-    forwardHeaders.delete("host");
-    const upstream = await fetchImpl(targetUrl.toString(), {
-      method: request.method,
-      headers: forwardHeaders,
-      body: hasBody ? bodyText : void 0,
-      redirect: "manual"
-    });
-    const outHeaders = new Headers();
-    upstream.headers.forEach((value, key) => {
-      if (!HOP_BY_HOP.has(key.toLowerCase())) outHeaders.set(key, value);
-    });
-    const buf = await upstream.arrayBuffer();
-    return new Response(buf, { status: upstream.status, statusText: upstream.statusText, headers: outHeaders });
-  };
-}
-
-// src/protect/runtime.js
-function createServerFnGuard({ protection }) {
-  const guard = protection.fetchGuard();
-  return async (data) => {
-    let res;
-    try {
-      const req = new Request("https://patchstack.local/_serverfn", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify(data ?? {})
-      });
-      res = await guard(req);
-    } catch {
-      return null;
-    }
-    if (!res) return null;
-    let body = {};
-    try {
-      body = await res.clone().json();
-    } catch {
-    }
-    return { rule: body.rule, message: body.message || "Blocked by Patchstack" };
-  };
-}
-async function createProtection(options = {}) {
-  const mode = options.mode === "block" ? "block" : "dry-run";
-  const onError = options.onError;
-  const onDetect = options.onDetect ?? defaultOnDetect;
-  const bundle = await resolveRules(options);
-  const engine = new RuleEngine({ ...bundle, onError });
-  const decide = (result, block, allow) => {
-    if (!result || !result.blocked) return allow();
-    onDetect({ mode, rule: result.rule, message: result.message });
-    return mode === "block" ? block() : allow();
-  };
-  const protection = {
-    mode,
-    rules: bundle,
-    // (request) => Response | null   (null = allow, caller proceeds)
-    fetchGuard() {
-      return async (request) => {
-        let result;
-        try {
-          result = engine.evaluate(await fromFetchRequest(request));
-        } catch (err) {
-          onError?.(err);
-          return null;
-        }
-        return decide(result, () => blockResponse(result), () => null);
-      };
-    },
-    // Wrap a fetch handler: export default { fetch: protection.fetch(app.fetch) }
-    fetch(handler) {
-      const guard = protection.fetchGuard();
-      return async (request, ...rest) => await guard(request) ?? handler(request, ...rest);
-    },
-    // Express middleware (expects express-parsed req.query/req.body).
-    express() {
-      return (req, res, next) => {
-        let result;
-        try {
-          result = engine.evaluate(req);
-        } catch (err) {
-          onError?.(err);
-          return next();
-        }
-        decide(result, () => res.status(403).json(blockBody(result)), () => next());
-      };
-    },
-    // Node / Connect middleware — buffers the body itself (no body-parser needed).
-    node(nodeOptions = {}) {
-      const maxBytes = nodeOptions.maxBodyBytes ?? 1024 * 1024;
-      return (req, res, next) => {
-        const chunks = [];
-        let size = 0;
-        let overflow = false;
-        req.on("data", (chunk) => {
-          size += chunk.length;
-          if (size > maxBytes) {
-            overflow = true;
-            return;
-          }
-          chunks.push(chunk);
-        });
-        req.on("error", (err) => {
-          onError?.(err);
-          next();
-        });
-        req.on("end", () => {
-          const rawBody = overflow ? "" : Buffer.concat(chunks).toString("utf8");
-          let result;
-          try {
-            result = engine.evaluate(fromNodeRequest(req, rawBody));
-          } catch (err) {
-            onError?.(err);
-            return next();
-          }
-          decide(
-            result,
-            () => {
-              res.statusCode = 403;
-              res.setHeader("content-type", "application/json");
-              res.end(JSON.stringify(blockBody(result)));
-            },
-            () => next()
-          );
-        });
-      };
-    }
-  };
-  return protection;
-}
-async function resolveRules(options) {
-  if (options.rules) {
-    return normalizeBundle(options.rules);
-  }
-  if (options.token) {
-    const client = new PatchstackRuleClient({ token: options.token, baseUrl: options.baseUrl });
-    const res = await client.getRules();
-    if (res.success) {
-      const bundle = normalizeBundle(res);
-      cacheWrite(options.cacheDir, bundle);
-      return bundle;
-    }
-    const cached = cacheRead(options.cacheDir);
-    if (cached) {
-      options.onError?.(new Error(`rule fetch failed (${res.error}); using cached bundle`));
-      return normalizeBundle(cached);
-    }
-    options.onError?.(new Error(`rule fetch failed (${res.error}); no cache \u2014 running with no rules`));
-    return emptyBundle();
-  }
-  return emptyBundle();
-}
-function normalizeBundle(b) {
-  return {
-    firewall: Array.isArray(b.firewall) ? b.firewall : [],
-    whitelists: Array.isArray(b.whitelists) ? b.whitelists : [],
-    whitelist_keys: b.whitelist_keys ?? {}
-  };
-}
-function emptyBundle() {
-  return { firewall: [], whitelists: [], whitelist_keys: {} };
-}
-function cachePath(dir) {
-  return (0, import_node_path.join)(dir, "patchstack-rules.json");
-}
-function cacheWrite(dir, bundle) {
-  if (!dir) return;
-  try {
-    (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-    (0, import_node_fs.writeFileSync)(cachePath(dir), JSON.stringify(bundle));
-  } catch {
-  }
-}
-function cacheRead(dir) {
-  if (!dir) return null;
-  try {
-    return JSON.parse((0, import_node_fs.readFileSync)(cachePath(dir), "utf8"));
-  } catch {
-    return null;
-  }
-}
-function blockBody(result) {
-  return {
-    error: "Blocked by Patchstack",
-    rule: result.rule?.id,
-    message: result.message
-  };
-}
-function blockResponse(result) {
-  return new Response(JSON.stringify(blockBody(result)), {
-    status: 403,
-    headers: { "content-type": "application/json" }
-  });
-}
-function defaultOnDetect({ mode, rule, message }) {
-  const tag = mode === "block" ? "BLOCK" : "DETECT (dry-run)";
-  console.warn(`[patchstack] ${tag} rule=${rule?.id ?? "?"} ${message ?? ""}`.trim());
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  GUARD_PATH,
-  createProtection,
-  createServerFnGuard,
-  createSupabaseGuard
-});
-//# sourceMappingURL=protect.cjs.map