@patchstack/connect 0.3.14 → 0.3.16

package/dist/protect/templates/guard.ts

@@ -20,6 +20,9 @@ import {
 } from "@patchstack/connect/protect";
 import fallbackRules from "./rules.json";
 
+// Baked by `patchstack-connect protect` from .patchstackrc.json (empty if the app isn't scanned yet).
+const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
+
 export { GUARD_PATH };
 
 // One shared protection policy for both guards (rules load once).
@@ -27,8 +30,9 @@ let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
 async function getProtection() {
   if (!_protection) {
     // Always-on: block by default. An explicit PATCHSTACK_MODE=dry-run downgrades to log-only.
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+    const mode: "block" | "dry-run" = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
     const token = process.env.PATCHSTACK_WAF_TOKEN;
+    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
     // Egress SSRF screening: block the app's outbound calls to internal / metadata addresses,
     // but never its own Supabase project.
     let allowHosts: string[] = [];
@@ -39,9 +43,11 @@ async function getProtection() {
     }
     const common = { mode, egress: true, allowHosts };
     _protection = await createProtection(
-      token
-        ? { ...common, token, cacheDir: ".patchstack" } // live per-site rules from the Patchstack API (cached)
-        : { ...common, rules: fallbackRules as never }, // demo fallback until a token is set
+      siteUuid
+        ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" } // live per-site rules; bundled = offline fallback
+        : token
+          ? { ...common, token, cacheDir: ".patchstack" } // live per-site WAF rules from the Patchstack API (cached)
+          : { ...common, rules: fallbackRules as never }, // demo fallback until a site UUID / token is set
     );
   }
   return _protection;
@@ -74,11 +80,11 @@ export async function inspectServerFn(data: unknown): Promise<{ rule?: string; m
 // src/start.ts (the browser→Supabase tunnel screens its own forwarded response). Only acts on a
 // web Response (text/JSON/HTML) — anything else, or any error, passes through untouched (fail-open,
 // never breaks a response).
-export async function screenResponse(response: unknown): Promise<unknown> {
+export async function screenResponse<T>(response: T): Promise<T> {
   try {
     if (!(response instanceof Response)) return response;
     const protection = await getProtection();
-    return protection.screenResponse ? await protection.screenResponse(response) : response;
+    return (protection.screenResponse ? await protection.screenResponse(response) : response) as T;
   } catch {
     return response; // fail open
   }

package/dist/protect.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var runtime_exports = {};
 __export(runtime_exports, {
   GUARD_PATH: () => GUARD_PATH,
+  PulseRuleClient: () => PulseRuleClient,
   createProtection: () => createProtection,
   createServerFnGuard: () => createServerFnGuard,
   createSupabaseGuard: () => createSupabaseGuard
@@ -928,6 +929,64 @@ var RuleEngine = class {
   }
 };
 
+// src/protect/engine/pulse-client.js
+var DEFAULT_BASE_URL2 = "https://api.patchstack.com/monitor/pulse";
+var DEFAULT_CACHE_TTL2 = 3e5;
+var PulseRuleClient = class {
+  #siteUuid;
+  #baseUrl;
+  #cacheTtl;
+  #cache = null;
+  #cacheTime = null;
+  constructor({ siteUuid, baseUrl, cacheTtl } = {}) {
+    this.#siteUuid = siteUuid ?? process.env.PATCHSTACK_SITE_UUID;
+    this.#baseUrl = baseUrl ?? process.env.PATCHSTACK_PULSE_RULES_URL ?? DEFAULT_BASE_URL2;
+    this.#cacheTtl = cacheTtl ?? DEFAULT_CACHE_TTL2;
+    if (!this.#siteUuid) {
+      throw new Error("Patchstack site UUID is required. Pass { siteUuid } or set PATCHSTACK_SITE_UUID.");
+    }
+  }
+  async getRules() {
+    const now = Date.now();
+    if (this.#cache && this.#cacheTime && now - this.#cacheTime < this.#cacheTtl) {
+      return this.#cache;
+    }
+    const url = `${this.#baseUrl}/rules/${encodeURIComponent(this.#siteUuid)}`;
+    try {
+      const response = await fetch(url, {
+        method: "GET",
+        headers: { Accept: "application/json" },
+        signal: AbortSignal.timeout(3e4)
+      });
+      if (!response.ok) {
+        return { success: false, error: `API returned ${response.status}`, firewall: [], whitelists: [], whitelist_keys: {} };
+      }
+      const data = await response.json();
+      const result = {
+        success: true,
+        firewall: Array.isArray(data.firewall) ? data.firewall : [],
+        whitelists: Array.isArray(data.whitelists) ? data.whitelists : [],
+        whitelist_keys: data.whitelist_keys ?? {}
+      };
+      this.#cache = result;
+      this.#cacheTime = now;
+      return result;
+    } catch (err) {
+      return {
+        success: false,
+        error: err.name === "TimeoutError" ? "Request timed out" : err.message,
+        firewall: [],
+        whitelists: [],
+        whitelist_keys: {}
+      };
+    }
+  }
+  clearCache() {
+    this.#cache = null;
+    this.#cacheTime = null;
+  }
+};
+
 // src/protect/engine/fetch.js
 async function fromFetchRequest(request) {
   const url = new URL(request.url);
@@ -1550,8 +1609,25 @@ function leakResponse() {
   });
 }
 async function resolveRules(options) {
-  if (options.rules) {
-    return normalizeBundle(options.rules);
+  if (options.siteUuid) {
+    const client = new PulseRuleClient({ siteUuid: options.siteUuid, baseUrl: options.pulseRulesUrl });
+    const res = await client.getRules();
+    if (res.success) {
+      const bundle = normalizeBundle(res);
+      cacheWrite(options.cacheDir, bundle);
+      return bundle;
+    }
+    const cached = cacheRead(options.cacheDir);
+    if (cached) {
+      options.onError?.(new Error(`pulse rule fetch failed (${res.error}); using cached bundle`));
+      return normalizeBundle(cached);
+    }
+    if (options.rules) {
+      options.onError?.(new Error(`pulse rule fetch failed (${res.error}); using bundled fallback`));
+      return normalizeBundle(options.rules);
+    }
+    options.onError?.(new Error(`pulse rule fetch failed (${res.error}); no cache \u2014 running with no rules`));
+    return emptyBundle();
   }
   if (options.token) {
     const client = new PatchstackRuleClient({ token: options.token, baseUrl: options.baseUrl });
@@ -1569,6 +1645,9 @@ async function resolveRules(options) {
     options.onError?.(new Error(`rule fetch failed (${res.error}); no cache \u2014 running with no rules`));
     return emptyBundle();
   }
+  if (options.rules) {
+    return normalizeBundle(options.rules);
+  }
   return emptyBundle();
 }
 function normalizeBundle(b) {
@@ -1620,6 +1699,7 @@ function defaultOnDetect({ phase, mode, category, rule, message }) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   GUARD_PATH,
+  PulseRuleClient,
   createProtection,
   createServerFnGuard,
   createSupabaseGuard