@patchstack/connect 0.3.15 → 0.3.17

package/dist/protect.cjs

@@ -31,38 +31,48 @@ module.exports = __toCommonJS(runtime_exports);
 // src/protect/engine/client.js
 var DEFAULT_BASE_URL = "https://api.patchstack.com";
 var DEFAULT_CACHE_TTL = 3e5;
+var JITTER_FRACTION = 0.1;
 var PatchstackRuleClient = class {
   #token;
   #baseUrl;
   #cacheTtl;
   #cache = null;
   #cacheTime = null;
-  constructor({ token, baseUrl, cacheTtl } = {}) {
+  #ttlEffective = 0;
+  #etag;
+  constructor({ token, baseUrl, cacheTtl, etag } = {}) {
     this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN;
     this.#baseUrl = baseUrl ?? process.env.PATCHSTACK_WAF_API_URL ?? DEFAULT_BASE_URL;
     this.#cacheTtl = cacheTtl ?? DEFAULT_CACHE_TTL;
+    this.#etag = etag ?? null;
     if (!this.#token) {
       throw new Error("Patchstack WAF token is required. Pass { token } or set PATCHSTACK_WAF_TOKEN env var.");
     }
   }
   async getRules() {
     const now = Date.now();
-    if (this.#cache && this.#cacheTime && now - this.#cacheTime < this.#cacheTtl) {
+    if (this.#cache && this.#cacheTime !== null && now - this.#cacheTime < this.#ttlEffective) {
       return this.#cache;
     }
     const url = `${this.#baseUrl}/api/get-rules/3`;
     try {
+      const headers = {
+        "Content-Type": "application/json",
+        "Authorization": `Bearer ${this.#token}`,
+        "LicenseID": "1"
+        // Hard-coded, is never actually used but needed by the API
+      };
+      if (this.#etag) headers["If-None-Match"] = this.#etag;
       const response = await fetch(url, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "Authorization": `Bearer ${this.#token}`,
-          "LicenseID": "1"
-          // Hard-coded, is never actually used but needed by the API
-        },
+        headers,
         body: JSON.stringify({}),
         signal: AbortSignal.timeout(3e4)
       });
+      if (response.status === 304) {
+        this.#touch(now);
+        return this.#cache ?? { success: true, notModified: true, etag: this.#etag, firewall: [], whitelists: [], whitelist_keys: {} };
+      }
       if (!response.ok) {
         return {
           success: false,
@@ -75,12 +85,15 @@ var PatchstackRuleClient = class {
       const data = await response.json();
       const result = {
         success: true,
+        notModified: false,
+        etag: response.headers?.get?.("etag") ?? null,
         firewall: Array.isArray(data.firewall) ? data.firewall : [],
         whitelists: Array.isArray(data.whitelists) ? data.whitelists : [],
         whitelist_keys: data.whitelist_keys ?? {}
       };
       this.#cache = result;
-      this.#cacheTime = now;
+      this.#etag = result.etag;
+      this.#touch(now);
       return result;
     } catch (err) {
       return {
@@ -92,9 +105,14 @@ var PatchstackRuleClient = class {
       };
     }
   }
+  #touch(now) {
+    this.#cacheTime = now;
+    this.#ttlEffective = this.#cacheTtl - Math.floor(Math.random() * this.#cacheTtl * JITTER_FRACTION);
+  }
   clearCache() {
     this.#cache = null;
     this.#cacheTime = null;
+    this.#etag = null;
   }
 };
 
@@ -932,44 +950,53 @@ var RuleEngine = class {
 // src/protect/engine/pulse-client.js
 var DEFAULT_BASE_URL2 = "https://api.patchstack.com/monitor/pulse";
 var DEFAULT_CACHE_TTL2 = 3e5;
+var JITTER_FRACTION2 = 0.1;
 var PulseRuleClient = class {
   #siteUuid;
   #baseUrl;
   #cacheTtl;
   #cache = null;
   #cacheTime = null;
-  constructor({ siteUuid, baseUrl, cacheTtl } = {}) {
+  #ttlEffective = 0;
+  #etag;
+  constructor({ siteUuid, baseUrl, cacheTtl, etag } = {}) {
     this.#siteUuid = siteUuid ?? process.env.PATCHSTACK_SITE_UUID;
     this.#baseUrl = baseUrl ?? process.env.PATCHSTACK_PULSE_RULES_URL ?? DEFAULT_BASE_URL2;
     this.#cacheTtl = cacheTtl ?? DEFAULT_CACHE_TTL2;
+    this.#etag = etag ?? null;
     if (!this.#siteUuid) {
       throw new Error("Patchstack site UUID is required. Pass { siteUuid } or set PATCHSTACK_SITE_UUID.");
     }
   }
   async getRules() {
     const now = Date.now();
-    if (this.#cache && this.#cacheTime && now - this.#cacheTime < this.#cacheTtl) {
+    if (this.#cache && this.#cacheTime !== null && now - this.#cacheTime < this.#ttlEffective) {
       return this.#cache;
     }
     const url = `${this.#baseUrl}/rules/${encodeURIComponent(this.#siteUuid)}`;
     try {
-      const response = await fetch(url, {
-        method: "GET",
-        headers: { Accept: "application/json" },
-        signal: AbortSignal.timeout(3e4)
-      });
+      const headers = { Accept: "application/json" };
+      if (this.#etag) headers["If-None-Match"] = this.#etag;
+      const response = await fetch(url, { method: "GET", headers, signal: AbortSignal.timeout(3e4) });
+      if (response.status === 304) {
+        this.#touch(now);
+        return this.#cache ?? { success: true, notModified: true, etag: this.#etag, firewall: [], whitelists: [], whitelist_keys: {} };
+      }
       if (!response.ok) {
         return { success: false, error: `API returned ${response.status}`, firewall: [], whitelists: [], whitelist_keys: {} };
       }
       const data = await response.json();
       const result = {
         success: true,
+        notModified: false,
+        etag: response.headers?.get?.("etag") ?? null,
         firewall: Array.isArray(data.firewall) ? data.firewall : [],
         whitelists: Array.isArray(data.whitelists) ? data.whitelists : [],
         whitelist_keys: data.whitelist_keys ?? {}
       };
       this.#cache = result;
-      this.#cacheTime = now;
+      this.#etag = result.etag;
+      this.#touch(now);
       return result;
     } catch (err) {
       return {
@@ -981,14 +1008,21 @@ var PulseRuleClient = class {
       };
     }
   }
+  #touch(now) {
+    this.#cacheTime = now;
+    this.#ttlEffective = this.#cacheTtl - Math.floor(Math.random() * this.#cacheTtl * JITTER_FRACTION2);
+  }
   clearCache() {
     this.#cache = null;
     this.#cacheTime = null;
+    this.#etag = null;
   }
 };
 
 // src/protect/engine/fetch.js
-async function fromFetchRequest(request) {
+var MAX_BODY_BYTES = 1024 * 1024;
+async function fromFetchRequest(request, options = {}) {
+  const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;
   const url = new URL(request.url);
   const method = (request.method || "GET").toUpperCase();
   const headers = {};
@@ -1005,14 +1039,11 @@ async function fromFetchRequest(request) {
   }
   let rawBody = "";
   if (method !== "GET" && method !== "HEAD") {
-    try {
-      rawBody = await request.clone().text();
-    } catch {
-      rawBody = "";
-    }
+    rawBody = await readCappedText(request, maxBodyBytes);
   }
   const contentType = headers["content-type"] || "";
   let body = {};
+  let files;
   if (rawBody) {
     if (contentType.includes("application/json")) {
       try {
@@ -1025,6 +1056,13 @@ async function fromFetchRequest(request) {
       for (const [k, v] of new URLSearchParams(rawBody)) {
         body[k] = k in body ? [].concat(body[k], v) : v;
       }
+    } else if (contentType.includes("multipart/form-data")) {
+      const boundary = /boundary=("?)([^";]+)\1/i.exec(contentType)?.[2];
+      if (boundary) {
+        const parsed = parseMultipart(rawBody, boundary);
+        body = parsed.body;
+        files = parsed.files;
+      }
     }
   }
   const uri = url.pathname + url.search;
@@ -1035,6 +1073,7 @@ async function fromFetchRequest(request) {
     originalUrl: uri,
     query,
     body,
+    files,
     headers,
     ip: forwarded.split(",")[0].trim(),
     cookies: parseCookies(headers.cookie),
@@ -1043,6 +1082,44 @@ async function fromFetchRequest(request) {
     _rawBody: rawBody
   };
 }
+async function readCappedText(request, max) {
+  const ceiling = Math.max(max, max * 4);
+  const declared = Number(request.headers?.get?.("content-length") || 0);
+  if (declared && declared > ceiling) return "";
+  let clone;
+  try {
+    clone = request.clone();
+  } catch {
+    return "";
+  }
+  try {
+    const text = await clone.text();
+    return text.length > max ? text.slice(0, max) : text;
+  } catch {
+    return "";
+  }
+}
+function parseMultipart(rawBody, boundary) {
+  const body = {};
+  const files = {};
+  for (const part of rawBody.split("--" + boundary)) {
+    const sep = /\r?\n\r?\n/.exec(part);
+    if (!sep) continue;
+    const rawHeaders = part.slice(0, sep.index);
+    const disposition = /content-disposition:[^\r\n]*/i.exec(rawHeaders)?.[0];
+    if (!disposition) continue;
+    const name = /name="([^"]*)"/i.exec(disposition)?.[1];
+    if (name == null) continue;
+    const content = part.slice(sep.index + sep[0].length).replace(/\r?\n$/, "");
+    const filename = /filename="([^"]*)"/i.exec(disposition)?.[1];
+    if (filename !== void 0) {
+      files[name] = name in files ? [].concat(files[name], filename) : filename;
+    } else {
+      body[name] = name in body ? [].concat(body[name], content) : content;
+    }
+  }
+  return { body, files };
+}
 function parseCookies(header) {
   const cookies = {};
   if (!header) {
@@ -1122,35 +1199,124 @@ function parseCookies2(header) {
 }
 
 // src/protect/egress.js
-function installEgressGuard({ shouldBlock, onBlock } = {}) {
-  const original = globalThis.fetch;
-  if (typeof original !== "function" || original.__patchstackGuarded || typeof shouldBlock !== "function") {
-    return () => {
+async function installEgressGuard({ shouldBlock, onBlock } = {}) {
+  const restores = [];
+  if (typeof shouldBlock !== "function") return () => {
+  };
+  const block = (url, host, method) => {
+    if (!shouldBlock(url, host, method)) return false;
+    onBlock?.({ url, host, method });
+    return true;
+  };
+  const originalFetch = globalThis.fetch;
+  if (typeof originalFetch === "function" && !originalFetch.__patchstackGuarded) {
+    const guarded = async (input, init) => {
+      const url = typeof input === "string" ? input : input && input.url || String(input);
+      let host = null;
+      try {
+        host = new URL(url).hostname;
+      } catch {
+        host = null;
+      }
+      const method = init && init.method || input && input.method || "GET";
+      if (block(url, host, method)) {
+        throw new Error(`Patchstack blocked an outbound request to a disallowed address: ${host ?? url}`);
+      }
+      return originalFetch(input, init);
     };
+    guarded.__patchstackGuarded = true;
+    globalThis.fetch = guarded;
+    restores.push(() => {
+      if (globalThis.fetch === guarded) globalThis.fetch = originalFetch;
+    });
   }
-  const guarded = async (input, init) => {
-    const url = typeof input === "string" ? input : input && input.url || String(input);
-    let host = null;
+  for (const moduleName of ["node:http", "node:https"]) {
     try {
-      host = new URL(url).hostname;
+      const mod = await import(moduleName);
+      const restore = patchHttpModule(mod.default ?? mod, block);
+      if (restore) restores.push(restore);
     } catch {
-      host = null;
     }
-    const method = init && init.method || input && input.method || "GET";
-    if (shouldBlock(url, host, method)) {
-      onBlock?.({ url, host, method });
-      throw new Error(`Patchstack blocked an outbound request to a disallowed address: ${host ?? url}`);
+  }
+  const OriginalWS = globalThis.WebSocket;
+  if (typeof OriginalWS === "function" && !OriginalWS.__patchstackGuarded) {
+    const GuardedWS = new Proxy(OriginalWS, {
+      construct(target, args, newTarget) {
+        const url = String(args?.[0] ?? "");
+        let host = null;
+        try {
+          host = new URL(url).hostname;
+        } catch {
+          host = null;
+        }
+        if (block(url, host, "WEBSOCKET")) {
+          throw new Error(`Patchstack blocked an outbound WebSocket to a disallowed address: ${host ?? url}`);
+        }
+        return Reflect.construct(target, args, newTarget);
+      }
+    });
+    OriginalWS.__patchstackGuarded = true;
+    globalThis.WebSocket = GuardedWS;
+    restores.push(() => {
+      if (globalThis.WebSocket === GuardedWS) globalThis.WebSocket = OriginalWS;
+      delete OriginalWS.__patchstackGuarded;
+    });
+  }
+  return () => {
+    for (const restore of restores) {
+      try {
+        restore();
+      } catch {
+      }
     }
-    return original(input, init);
   };
-  guarded.__patchstackGuarded = true;
-  globalThis.fetch = guarded;
+}
+function patchHttpModule(http, block) {
+  if (!http || typeof http.request !== "function" || http.__patchstackGuarded) return null;
+  const originalRequest = http.request;
+  const originalGet = http.get;
+  const wrap = (original) => function(...args) {
+    const target = extractHttpTarget(args);
+    if (target && block(target.url, target.host, target.method)) {
+      throw new Error(`Patchstack blocked an outbound request to a disallowed address: ${target.host ?? target.url}`);
+    }
+    return original.apply(this, args);
+  };
+  http.request = wrap(originalRequest);
+  if (typeof originalGet === "function") http.get = wrap(originalGet);
+  http.__patchstackGuarded = true;
   return () => {
-    if (globalThis.fetch === guarded) {
-      globalThis.fetch = original;
-    }
+    http.request = originalRequest;
+    if (typeof originalGet === "function") http.get = originalGet;
+    delete http.__patchstackGuarded;
   };
 }
+function extractHttpTarget(args) {
+  const first = args[0];
+  try {
+    if (typeof first === "string" || first instanceof URL) {
+      const url = new URL(String(first));
+      const opts = args.find((a) => a && typeof a === "object" && !(a instanceof URL));
+      return { url: url.href, host: url.hostname, method: opts && opts.method || "GET" };
+    }
+    if (first && typeof first === "object") {
+      const host = normalizeHost(first.hostname || first.host);
+      const protocol = first.protocol || "http:";
+      const port = first.port ? `:${first.port}` : "";
+      const path = first.path || "/";
+      return { url: `${protocol}//${host}${port}${path}`, host, method: first.method || "GET" };
+    }
+  } catch {
+  }
+  return null;
+}
+function normalizeHost(raw) {
+  const host = String(raw || "").trim();
+  const bracketed = /^\[([^\]]+)\]/.exec(host);
+  if (bracketed) return bracketed[1];
+  if ((host.match(/:/g) || []).length > 1) return host;
+  return host.split(":")[0];
+}
 
 // src/protect/defaults.js
 var DEFAULT_RESPONSE_RULES = [
@@ -1201,6 +1367,25 @@ var DEFAULT_RESPONSE_RULES = [
     category: "info-exposure",
     action: "redact",
     rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\n\\s+at\\s+.+\\(.+:\\d+:\\d+\\)/" } }]
+  },
+  {
+    id: "resp-sql-error",
+    title: "SQL / ORM error disclosure in response body",
+    phase: "response",
+    category: "info-exposure",
+    action: "redact",
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/(SQLSTATE\\[[0-9A-Z]+\\]|SequelizeDatabaseError|ER_[A-Z_]+|ORA-\\d{5}|PG::[A-Za-z]+Error|SQLITE_ERROR|You have an error in your SQL syntax)/i" } }]
+  },
+  {
+    id: "resp-exception-trace",
+    title: "Backend exception / stack trace disclosure in response body",
+    phase: "response",
+    category: "info-exposure",
+    action: "redact",
+    // Multi-language exception/traceback signatures a normal API response never carries:
+    // Python traceback, Java "Exception in thread", .NET System.*Exception, JVM stack frames,
+    // Go goroutine dumps. (Node `at fn (file:line:col)` frames are handled by resp-stack-trace.)
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: '/(Traceback \\(most recent call last\\)|Exception in thread "|System\\.[A-Za-z.]+Exception|\\bat [\\w.$]+\\([\\w]+\\.(?:java|kt|scala|rb|py|cs):\\d+\\)|goroutine \\d+ \\[)/' } }]
   }
 ];
 var DEFAULT_EGRESS_RULES = [
@@ -1213,6 +1398,89 @@ var DEFAULT_EGRESS_RULES = [
   }
 ];
 
+// src/protect/block-page.js
+function escapeHtml(s) {
+  return String(s).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+function renderBlockPage({ url = "", code = "patchstack" } = {}) {
+  const safeUrl = escapeHtml(url);
+  const safeCode = escapeHtml(code || "patchstack");
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style type="text/css">
+		.access-denied,.site-url-text{letter-spacing:.01em;color:#fff}body{background:#111216}.main-container{display:flex;justify-content:center;flex-direction:column;align-items:center}.container{width:688px;height:456px;background:#1c1e22;border-radius:16px;margin-top:120px}.content{height:330px;margin:64px}.access-denied{font-family:Verdana;font-style:normal;font-weight:600;font-size:24px;line-height:32px;display:flex;align-items:center}.descp-text,.site-url{display:flex;align-items:center}.site-url{margin-top:32px;width:560px;height:64px;background:#26282c;border-radius:4px}.reason-code-text,.site-url-text{font-family:Verdana;font-style:normal;border:none;background:#26282c}.site-url-text{text-overflow: ellipsis;font-weight:400;font-size:16px;line-height:24px;margin-left:16px;width:85%}.copy-icon{width:19px;height:22px;margin-left:20px}.copy-icon:hover{cursor:pointer}.reason-code-text{font-weight:600;font-size:24px;line-height:32px;letter-spacing:.01em;color:#AFE614;margin-left:16px;width:85%}.descp-text,.return-text{font-size:16px;line-height:24px;letter-spacing:.01em;font-weight:400}.return-text:hover{color: #AFE614}.descp-text,.logoText,.return-text,.secured-text{font-family:Verdana;font-style:normal;color:#fff}.descp{margin-top:32px;width:560px}.bottom-second-containers,.bottom-text-containers{align-items:center;display:flex}.bottom-container{margin-top:40px;display:flex;width:688px}.bottom-second-containers{margin-left:auto}.arrow-vector{margin-left:20px}.return-text{text-align:center;margin-left:12.59px;text-decoration:none}.secured-text{font-weight:400;font-size:11.2px;line-height:16px;display:flex;align-items:center;letter-spacing:.02em;margin-right:8px}.logoText{font-weight:600;font-size:16px;line-height:24px;letter-spacing:.01em;flex:none;order:1;flex-grow:0}.patch-logo{width:120px}.mobile-bottom-container{margin-top:40px;width:372px;display:none}.mobile-bottom-second-containers{margin-top:64px;display:flex;margin-left:16.5px}@media only screen and (max-width:900px){.container{background:#111216;width:370px;height:auto;margin-top:0}.content{margin-left:16.5px}.descp,.site-url{width:340px}.site-url-text{font-weight:400;font-size:14.4px;line-height:20px;letter-spacing:.02em;width:80%}.copy-icon{margin-left:20px}.reason-code-text{font-size:16px;line-height:32px;letter-spacing:.02em;margin-left:16px;width:80%}.descp-text,.return-text{font-size:14.4px;line-height:20px}.descp-text{display:flex;align-items:center;letter-spacing:.02em}.bottom-container{display:none}.mobile-bottom-container{display:block}.return-text{text-align:center;letter-spacing:.01em;color:#fff;margin-left:9.73px}}
+    </style>
+    <title>Access Denied</title>
+</head>
+<body>
+    <div class="main-container">
+        <div class="container">
+            <div class="content">
+                <span class="access-denied">Access Denied</span>
+                <div class="site-url">
+                    <input id="url" class="site-url-text" type="text"
+                        value="${safeUrl}" readonly>
+                    <img class="copy-icon" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkiIGhlaWdodD0iMjMiIHZpZXdCb3g9IjAgMCAxOSAyMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0IDAuMDIzNDM3NUgwVjE2LjAyMzRIMlYyLjAyMzQ0SDE0VjAuMDIzNDM3NVpNMTkgNC4wMjM0NEg0VjIyLjAyMzRIMTlWNC4wMjM0NFpNMTcgMjAuMDIzNEg2VjYuMDIzNDRIMTdWMjAuMDIzNFoiIGZpbGw9IndoaXRlIi8+Cjwvc3ZnPgo=" alt="Copy Text" onmouseover="hover(this);" onmouseout="unhover(this);" onclick="copyText(id='url')">
+                </div>
+                <div class="site-url">
+                    <input id="response" class="reason-code-text" type="text" value="${safeCode}" readonly>
+                    <img class="copy-icon" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkiIGhlaWdodD0iMjMiIHZpZXdCb3g9IjAgMCAxOSAyMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0IDAuMDIzNDM3NUgwVjE2LjAyMzRIMlYyLjAyMzQ0SDE0VjAuMDIzNDM3NVpNMTkgNC4wMjM0NEg0VjIyLjAyMzRIMTlWNC4wMjM0NFpNMTcgMjAuMDIzNEg2VjYuMDIzNDRIMTdWMjAuMDIzNFoiIGZpbGw9IndoaXRlIi8+Cjwvc3ZnPgo=" alt="Copy Text" onmouseover="hover(this);" onmouseout="unhover(this);" onclick="copyText(id='response')">
+                </div>
+                <div class="descp">
+                    <span class="descp-text">This request has been blocked by Patchstack. If this message persists and you are a legitimate user, contact the site administrator with the reference above.</span>
+                </div>
+            </div>
+        </div>
+        <div class="bottom-container">
+            <div class="bottom-text-containers">
+                <img class="arrow-vector" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iOCIgaGVpZ2h0PSIxMyIgdmlld0JveD0iMCAwIDggMTMiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik03LjQxIDEuNDMzNDRMNiAwLjAyMzQzNzVMMCA2LjAyMzQ0TDYgMTIuMDIzNEw3LjQxIDEwLjYxMzRMMi44MyA2LjAyMzQ0TDcuNDEgMS40MzM0NFoiIGZpbGw9IiNBRkU2MTQiLz4KPC9zdmc+Cg==" alt="Arrow Left">
+                <a href="/" class="return-text">Return to homepage</a>
+            </div>
+            <div class="bottom-second-containers">
+                <span class="secured-text">This website is secured by</span>
+                <a href="https://patchstack.com" class="logoText">
+                    <img class="patch-logo" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTg0IiBoZWlnaHQ9IjIyIiB2aWV3Qm94PSIwIDAgMTg0IDIyIiBmaWxsPSJub25lIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTUwLjQwMDEgMTEuNTAwOEM1MC40MDAxIDkuMTAwNzggNDkuMzAwMSA4LjEwMDc4IDQ2LjYwMDEgOC4xMDA3OEM0NC4wMDAxIDguMTAwNzggNDIuNzAwMSA5LjIwMDc4IDQyLjcwMDEgMTEuNTAwOEM0Mi43MDAxIDEzLjgwMDggNDQuMDAwMSAxNC45MDA4IDQ2LjYwMDEgMTQuOTAwOEM0OS4zMDAxIDE0LjkwMDggNTAuNDAwMSAxMy44MDA4IDUwLjQwMDEgMTEuNTAwOFpNNTMuNDAwMSAxMS41MDA4QzUzLjQwMDEgMTUuMzAwOCA1MS4zMDAxIDE3LjYwMDggNDcuNDAwMSAxNy42MDA4QzQ1LjQwMDEgMTcuNjAwOCA0My42MDAxIDE2LjUwMDggNDIuNzAwMSAxNC41MDA4VjIxLjUwMDhIMzkuNjAwMVY1LjYwMDc4SDQyLjcwMDFWOC41MDA3OEM0My42MDAxIDYuNTAwNzggNDUuNDAwMSA1LjMwMDc4IDQ3LjUwMDEgNS4zMDA3OEM1MS40MDAxIDUuMzAwNzggNTMuNDAwMSA3LjcwMDc4IDUzLjQwMDEgMTEuNTAwOFoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNNjYuNDAwMSAxMS40OTg0QzY2LjQwMDEgOS4xOTg0NCA2NS4xMDAxIDguMDk4NDQgNjIuNTAwMSA4LjA5ODQ0QzU5LjgwMDEgOC4wOTg0NCA1OC43MDAxIDkuMDk4NDQgNTguNzAwMSAxMS40OTg0QzU4LjcwMDEgMTMuNzk4NCA1OS44MDAxIDE0Ljg5ODQgNjIuNTAwMSAxNC44OTg0QzY1LjEwMDEgMTQuODk4NCA2Ni40MDAxIDEzLjc5ODQgNjYuNDAwMSAxMS40OTg0Wk02Ni4zMDAxIDUuNTk4NDRINjkuNDAwMVYxNy4zOTg0SDY2LjMwMDFWMTQuNDk4NEM2NS40MDAxIDE2LjQ5ODQgNjMuNzAwMSAxNy42OTg0IDYxLjYwMDEgMTcuNjk4NEM1Ny43MDAxIDE3LjY5ODQgNTUuNjAwMSAxNS4yOTg0IDU1LjYwMDEgMTEuNTk4NEM1NS42MDAxIDcuNzk4NDQgNTcuNjAwMSA1LjM5ODQ0IDYxLjQwMDEgNS4zOTg0NEM2My41MDAxIDUuMzk4NDQgNjUuNDAwMSA2LjU5ODQ0IDY2LjIwMDEgOC41OTg0NFY1LjU5ODQ0SDY2LjMwMDFaIiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTgxLjM5OTkgOC4zSDc3LjM5OTlWMTQuN0g4MS4wOTk5VjE3LjRINzcuOTk5OUM3NS43OTk5IDE3LjQgNzQuMjk5OSAxNS45IDc0LjI5OTkgMTMuN1Y4LjNINzEuMzk5OVY1LjZINzQuMjk5OVYySDc3LjM5OTlWNS41SDgxLjM5OTlWOC4zWiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik05My42OTk5IDEyLjIwMDhMOTYuNjk5OSAxMi45MDA4Qzk1Ljk5OTkgMTYuMDAwOCA5My42OTk5IDE3LjYwMDggODkuOTk5OSAxNy42MDA4Qzg3Ljc5OTkgMTcuNjAwOCA4Ni4wOTk5IDE3LjAwMDggODQuNzk5OSAxNS45MDA4QzgzLjQ5OTkgMTQuODAwOCA4Mi44OTk5IDEzLjMwMDggODIuODk5OSAxMS41MDA4QzgyLjg5OTkgOS42MDA3OCA4My40OTk5IDguMTAwNzggODQuNzk5OSA3LjAwMDc4Qzg2LjA5OTkgNS45MDA3OCA4Ny43OTk5IDUuMzAwNzggODkuOTk5OSA1LjMwMDc4QzkzLjY5OTkgNS4zMDA3OCA5NS45OTk5IDYuOTAwNzggOTYuNjk5OSAxMC4wMDA4TDkzLjY5OTkgMTAuNzAwOEM5My4yOTk5IDguODAwNzggOTIuMjk5OSA4LjEwMDc4IDg5Ljg5OTkgOC4xMDA3OEM4Ni45OTk5IDguMTAwNzggODUuODk5OSA5LjIwMDc4IDg1Ljg5OTkgMTEuNTAwOEM4NS44OTk5IDEzLjgwMDggODYuOTk5OSAxNC45MDA4IDg5Ljg5OTkgMTQuOTAwOEM5Mi4yOTk5IDE0LjkwMDggOTMuMjk5OSAxNC4yMDA4IDkzLjY5OTkgMTIuMjAwOFoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTExLjggMTAuNlYxNy40SDEwOC43VjExLjJDMTA4LjcgOSAxMDcuOCA4LjEgMTA1LjkgOC4xQzEwMy42IDguMSAxMDIuNCA5LjMgMTAyLjQgMTEuN1YxNy4zSDk5LjI5OThWMC41SDEwMi40VjguM0MxMDMuMSA2LjMgMTA0LjYgNS4zIDEwNyA1LjNDMTEwLjIgNS4zIDExMS44IDcuMSAxMTEuOCAxMC42WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xMTQuMSAxNC4wOTg0TDExNy4xIDEzLjI5ODRDMTE3LjQgMTQuNzk4NCAxMTguMyAxNS4yOTg0IDEyMC4yIDE1LjI5ODRDMTIxLjggMTUuMjk4NCAxMjIuNyAxNC44OTg0IDEyMi43IDE0LjA5ODRDMTIyLjcgMTMuMjk4NCAxMjIuMiAxMi45OTg0IDEyMC42IDEyLjc5ODRMMTE4LjIgMTIuNDk4NEMxMTUuOSAxMi4xOTg0IDExNC41IDEwLjg5ODQgMTE0LjUgOC45OTg0NEMxMTQuNSA2Ljc5ODQ0IDExNi41IDUuMzk4NDQgMTE5LjggNS4zOTg0NEMxMjMuMSA1LjM5ODQ0IDEyNSA2LjY5ODQ0IDEyNS41IDguODk4NDRMMTIyLjUgOS41OTg0NEMxMjIuMyA4LjA5ODQ0IDEyMS41IDcuNjk4NDQgMTE5LjkgNy42OTg0NEMxMTguNCA3LjY5ODQ0IDExNy42IDguMDk4NDQgMTE3LjYgOC44OTg0NEMxMTcuNiA5LjU5ODQ0IDExOC4xIDkuOTk4NDQgMTE5LjMgMTAuMDk4NEwxMjIuMiAxMC40OTg0QzEyNC40IDEwLjc5ODQgMTI1LjggMTEuOTk4NCAxMjUuOCAxMy44OTg0QzEyNS44IDE2LjI5ODQgMTIzLjcgMTcuNzk4NCAxMjAuMSAxNy43OTg0QzExNi43IDE3LjU5ODQgMTE0LjUgMTYuMTk4NCAxMTQuMSAxNC4wOTg0WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xMzYuNyA4LjNIMTMyLjdWMTQuN0gxMzYuNFYxNy40SDEzMy4zQzEzMS4xIDE3LjQgMTI5LjYgMTUuOSAxMjkuNiAxMy43VjguM0gxMjYuN1Y1LjZIMTI5LjZWMkgxMzIuN1Y1LjVIMTM2LjdWOC4zWiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xNDkuMiAxMS40OTg0QzE0OS4yIDkuMTk4NDQgMTQ3LjkgOC4wOTg0NCAxNDUuMyA4LjA5ODQ0QzE0Mi42IDguMDk4NDQgMTQxLjUgOS4wOTg0NCAxNDEuNSAxMS40OTg0QzE0MS41IDEzLjc5ODQgMTQyLjYgMTQuODk4NCAxNDUuMyAxNC44OTg0QzE0Ny45IDE0Ljg5ODQgMTQ5LjIgMTMuNzk4NCAxNDkuMiAxMS40OTg0Wk0xNDkuMSA1LjU5ODQ0SDE1Mi4yVjE3LjM5ODRIMTQ5LjFWMTQuNDk4NEMxNDguMiAxNi40OTg0IDE0Ni41IDE3LjY5ODQgMTQ0LjQgMTcuNjk4NEMxNDAuNSAxNy42OTg0IDEzOC40IDE1LjI5ODQgMTM4LjQgMTEuNTk4NEMxMzguNCA3Ljc5ODQ0IDE0MC40IDUuMzk4NDQgMTQ0LjIgNS4zOTg0NEMxNDYuMyA1LjM5ODQ0IDE0OC4yIDYuNTk4NDQgMTQ5IDguNTk4NDRWNS41OTg0NEgxNDkuMVoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTY1LjYgMTIuMjAwOEwxNjguNiAxMi45MDA4QzE2Ny45IDE2LjAwMDggMTY1LjYgMTcuNjAwOCAxNjEuOSAxNy42MDA4QzE1OS43IDE3LjYwMDggMTU4IDE3LjAwMDggMTU2LjcgMTUuOTAwOEMxNTUuNCAxNC44MDA4IDE1NC44IDEzLjMwMDggMTU0LjggMTEuNTAwOEMxNTQuOCA5LjYwMDc4IDE1NS40IDguMTAwNzggMTU2LjcgNy4wMDA3OEMxNTggNS45MDA3OCAxNTkuNyA1LjMwMDc4IDE2MS45IDUuMzAwNzhDMTY1LjYgNS4zMDA3OCAxNjcuOSA2LjkwMDc4IDE2OC42IDEwLjAwMDhMMTY1LjYgMTAuNzAwOEMxNjUuMiA4LjgwMDc4IDE2NC4yIDguMTAwNzggMTYxLjggOC4xMDA3OEMxNTguOSA4LjEwMDc4IDE1Ny44IDkuMjAwNzggMTU3LjggMTEuNTAwOEMxNTcuOCAxMy44MDA4IDE1OC45IDE0LjkwMDggMTYxLjggMTQuOTAwOEMxNjQuMSAxNC45MDA4IDE2NS4xIDE0LjIwMDggMTY1LjYgMTIuMjAwOFoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTgwLjI1NyAxNy40TDE3Ni42NTcgMTIuM0wxNzQuMTU3IDE0LjZWMTcuNEgxNzEuMTU3VjAuNUgxNzQuMTU3VjExLjFMMTc5Ljg1NyA1LjZIMTgzLjc1N0wxNzguNTU3IDEwLjVMMTgzLjk1NyAxNy40SDE4MC4yNTdaIiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTAgMjEuNTAwOEg3LjNWMTYuMzAwOEgwVjIxLjUwMDhaIiBmaWxsPSIjQUZFNjE0Ii8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNNy4yOTk4IDIxLjUwMDhIMTQuNTk5OFYxNi4zMDA4SDcuMjk5OFYyMS41MDA4WiIgZmlsbD0iIzZFQkUwMCIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTE0LjYwMDEgMTYuM0gyOS4yMDAxVjAuNUgxNC42MDAxVjE2LjNaIiBmaWxsPSIjQUZFNjE0Ii8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMCAxMUgxNC42VjAuNUgwVjExWiIgZmlsbD0iIzZFQkUwMCIvPgo8L3N2Zz4K" alt="Patchstack Logo">
+				</a>
+            </div>
+        </div>
+    
+        <div class="mobile-bottom-container">
+            <div class="mobile-bottom-text-containers">
+                <img class="arrow-vector" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iOCIgaGVpZ2h0PSIxMyIgdmlld0JveD0iMCAwIDggMTMiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik03LjQxIDEuNDMzNDRMNiAwLjAyMzQzNzVMMCA2LjAyMzQ0TDYgMTIuMDIzNEw3LjQxIDEwLjYxMzRMMi44MyA2LjAyMzQ0TDcuNDEgMS40MzM0NFoiIGZpbGw9IiNBRkU2MTQiLz4KPC9zdmc+Cg==" alt="Arrow Left">
+                <a href="/" class="return-text">Return to homepage</a>
+            </div>
+            <div class="mobile-bottom-second-containers">
+                <span class="secured-text">This website is secured by</span>
+                <a href="https://patchstack.com" class="logoText">
+                    <img class="patch-logo" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTg0IiBoZWlnaHQ9IjIyIiB2aWV3Qm94PSIwIDAgMTg0IDIyIiBmaWxsPSJub25lIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTUwLjQwMDEgMTEuNTAwOEM1MC40MDAxIDkuMTAwNzggNDkuMzAwMSA4LjEwMDc4IDQ2LjYwMDEgOC4xMDA3OEM0NC4wMDAxIDguMTAwNzggNDIuNzAwMSA5LjIwMDc4IDQyLjcwMDEgMTEuNTAwOEM0Mi43MDAxIDEzLjgwMDggNDQuMDAwMSAxNC45MDA4IDQ2LjYwMDEgMTQuOTAwOEM0OS4zMDAxIDE0LjkwMDggNTAuNDAwMSAxMy44MDA4IDUwLjQwMDEgMTEuNTAwOFpNNTMuNDAwMSAxMS41MDA4QzUzLjQwMDEgMTUuMzAwOCA1MS4zMDAxIDE3LjYwMDggNDcuNDAwMSAxNy42MDA4QzQ1LjQwMDEgMTcuNjAwOCA0My42MDAxIDE2LjUwMDggNDIuNzAwMSAxNC41MDA4VjIxLjUwMDhIMzkuNjAwMVY1LjYwMDc4SDQyLjcwMDFWOC41MDA3OEM0My42MDAxIDYuNTAwNzggNDUuNDAwMSA1LjMwMDc4IDQ3LjUwMDEgNS4zMDA3OEM1MS40MDAxIDUuMzAwNzggNTMuNDAwMSA3LjcwMDc4IDUzLjQwMDEgMTEuNTAwOFoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNNjYuNDAwMSAxMS40OTg0QzY2LjQwMDEgOS4xOTg0NCA2NS4xMDAxIDguMDk4NDQgNjIuNTAwMSA4LjA5ODQ0QzU5LjgwMDEgOC4wOTg0NCA1OC43MDAxIDkuMDk4NDQgNTguNzAwMSAxMS40OTg0QzU4LjcwMDEgMTMuNzk4NCA1OS44MDAxIDE0Ljg5ODQgNjIuNTAwMSAxNC44OTg0QzY1LjEwMDEgMTQuODk4NCA2Ni40MDAxIDEzLjc5ODQgNjYuNDAwMSAxMS40OTg0Wk02Ni4zMDAxIDUuNTk4NDRINjkuNDAwMVYxNy4zOTg0SDY2LjMwMDFWMTQuNDk4NEM2NS40MDAxIDE2LjQ5ODQgNjMuNzAwMSAxNy42OTg0IDYxLjYwMDEgMTcuNjk4NEM1Ny43MDAxIDE3LjY5ODQgNTUuNjAwMSAxNS4yOTg0IDU1LjYwMDEgMTEuNTk4NEM1NS42MDAxIDcuNzk4NDQgNTcuNjAwMSA1LjM5ODQ0IDYxLjQwMDEgNS4zOTg0NEM2My41MDAxIDUuMzk4NDQgNjUuNDAwMSA2LjU5ODQ0IDY2LjIwMDEgOC41OTg0NFY1LjU5ODQ0SDY2LjMwMDFaIiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTgxLjM5OTkgOC4zSDc3LjM5OTlWMTQuN0g4MS4wOTk5VjE3LjRINzcuOTk5OUM3NS43OTk5IDE3LjQgNzQuMjk5OSAxNS45IDc0LjI5OTkgMTMuN1Y4LjNINzEuMzk5OVY1LjZINzQuMjk5OVYySDc3LjM5OTlWNS41SDgxLjM5OTlWOC4zWiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik05My42OTk5IDEyLjIwMDhMOTYuNjk5OSAxMi45MDA4Qzk1Ljk5OTkgMTYuMDAwOCA5My42OTk5IDE3LjYwMDggODkuOTk5OSAxNy42MDA4Qzg3Ljc5OTkgMTcuNjAwOCA4Ni4wOTk5IDE3LjAwMDggODQuNzk5OSAxNS45MDA4QzgzLjQ5OTkgMTQuODAwOCA4Mi44OTk5IDEzLjMwMDggODIuODk5OSAxMS41MDA4QzgyLjg5OTkgOS42MDA3OCA4My40OTk5IDguMTAwNzggODQuNzk5OSA3LjAwMDc4Qzg2LjA5OTkgNS45MDA3OCA4Ny43OTk5IDUuMzAwNzggODkuOTk5OSA1LjMwMDc4QzkzLjY5OTkgNS4zMDA3OCA5NS45OTk5IDYuOTAwNzggOTYuNjk5OSAxMC4wMDA4TDkzLjY5OTkgMTAuNzAwOEM5My4yOTk5IDguODAwNzggOTIuMjk5OSA4LjEwMDc4IDg5Ljg5OTkgOC4xMDA3OEM4Ni45OTk5IDguMTAwNzggODUuODk5OSA5LjIwMDc4IDg1Ljg5OTkgMTEuNTAwOEM4NS44OTk5IDEzLjgwMDggODYuOTk5OSAxNC45MDA4IDg5Ljg5OTkgMTQuOTAwOEM5Mi4yOTk5IDE0LjkwMDggOTMuMjk5OSAxNC4yMDA4IDkzLjY5OTkgMTIuMjAwOFoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTExLjggMTAuNlYxNy40SDEwOC43VjExLjJDMTA4LjcgOSAxMDcuOCA4LjEgMTA1LjkgOC4xQzEwMy42IDguMSAxMDIuNCA5LjMgMTAyLjQgMTEuN1YxNy4zSDk5LjI5OThWMC41SDEwMi40VjguM0MxMDMuMSA2LjMgMTA0LjYgNS4zIDEwNyA1LjNDMTEwLjIgNS4zIDExMS44IDcuMSAxMTEuOCAxMC42WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xMTQuMSAxNC4wOTg0TDExNy4xIDEzLjI5ODRDMTE3LjQgMTQuNzk4NCAxMTguMyAxNS4yOTg0IDEyMC4yIDE1LjI5ODRDMTIxLjggMTUuMjk4NCAxMjIuNyAxNC44OTg0IDEyMi43IDE0LjA5ODRDMTIyLjcgMTMuMjk4NCAxMjIuMiAxMi45OTg0IDEyMC42IDEyLjc5ODRMMTE4LjIgMTIuNDk4NEMxMTUuOSAxMi4xOTg0IDExNC41IDEwLjg5ODQgMTE0LjUgOC45OTg0NEMxMTQuNSA2Ljc5ODQ0IDExNi41IDUuMzk4NDQgMTE5LjggNS4zOTg0NEMxMjMuMSA1LjM5ODQ0IDEyNSA2LjY5ODQ0IDEyNS41IDguODk4NDRMMTIyLjUgOS41OTg0NEMxMjIuMyA4LjA5ODQ0IDEyMS41IDcuNjk4NDQgMTE5LjkgNy42OTg0NEMxMTguNCA3LjY5ODQ0IDExNy42IDguMDk4NDQgMTE3LjYgOC44OTg0NEMxMTcuNiA5LjU5ODQ0IDExOC4xIDkuOTk4NDQgMTE5LjMgMTAuMDk4NEwxMjIuMiAxMC40OTg0QzEyNC40IDEwLjc5ODQgMTI1LjggMTEuOTk4NCAxMjUuOCAxMy44OTg0QzEyNS44IDE2LjI5ODQgMTIzLjcgMTcuNzk4NCAxMjAuMSAxNy43OTg0QzExNi43IDE3LjU5ODQgMTE0LjUgMTYuMTk4NCAxMTQuMSAxNC4wOTg0WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xMzYuNyA4LjNIMTMyLjdWMTQuN0gxMzYuNFYxNy40SDEzMy4zQzEzMS4xIDE3LjQgMTI5LjYgMTUuOSAxMjkuNiAxMy43VjguM0gxMjYuN1Y1LjZIMTI5LjZWMkgxMzIuN1Y1LjVIMTM2LjdWOC4zWiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xNDkuMiAxMS40OTg0QzE0OS4yIDkuMTk4NDQgMTQ3LjkgOC4wOTg0NCAxNDUuMyA4LjA5ODQ0QzE0Mi42IDguMDk4NDQgMTQxLjUgOS4wOTg0NCAxNDEuNSAxMS40OTg0QzE0MS41IDEzLjc5ODQgMTQyLjYgMTQuODk4NCAxNDUuMyAxNC44OTg0QzE0Ny45IDE0Ljg5ODQgMTQ5LjIgMTMuNzk4NCAxNDkuMiAxMS40OTg0Wk0xNDkuMSA1LjU5ODQ0SDE1Mi4yVjE3LjM5ODRIMTQ5LjFWMTQuNDk4NEMxNDguMiAxNi40OTg0IDE0Ni41IDE3LjY5ODQgMTQ0LjQgMTcuNjk4NEMxNDAuNSAxNy42OTg0IDEzOC40IDE1LjI5ODQgMTM4LjQgMTEuNTk4NEMxMzguNCA3Ljc5ODQ0IDE0MC40IDUuMzk4NDQgMTQ0LjIgNS4zOTg0NEMxNDYuMyA1LjM5ODQ0IDE0OC4yIDYuNTk4NDQgMTQ5IDguNTk4NDRWNS41OTg0NEgxNDkuMVoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTY1LjYgMTIuMjAwOEwxNjguNiAxMi45MDA4QzE2Ny45IDE2LjAwMDggMTY1LjYgMTcuNjAwOCAxNjEuOSAxNy42MDA4QzE1OS43IDE3LjYwMDggMTU4IDE3LjAwMDggMTU2LjcgMTUuOTAwOEMxNTUuNCAxNC44MDA4IDE1NC44IDEzLjMwMDggMTU0LjggMTEuNTAwOEMxNTQuOCA5LjYwMDc4IDE1NS40IDguMTAwNzggMTU2LjcgNy4wMDA3OEMxNTggNS45MDA3OCAxNTkuNyA1LjMwMDc4IDE2MS45IDUuMzAwNzhDMTY1LjYgNS4zMDA3OCAxNjcuOSA2LjkwMDc4IDE2OC42IDEwLjAwMDhMMTY1LjYgMTAuNzAwOEMxNjUuMiA4LjgwMDc4IDE2NC4yIDguMTAwNzggMTYxLjggOC4xMDA3OEMxNTguOSA4LjEwMDc4IDE1Ny44IDkuMjAwNzggMTU3LjggMTEuNTAwOEMxNTcuOCAxMy44MDA4IDE1OC45IDE0LjkwMDggMTYxLjggMTQuOTAwOEMxNjQuMSAxNC45MDA4IDE2NS4xIDE0LjIwMDggMTY1LjYgMTIuMjAwOFoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTgwLjI1NyAxNy40TDE3Ni42NTcgMTIuM0wxNzQuMTU3IDE0LjZWMTcuNEgxNzEuMTU3VjAuNUgxNzQuMTU3VjExLjFMMTc5Ljg1NyA1LjZIMTgzLjc1N0wxNzguNTU3IDEwLjVMMTgzLjk1NyAxNy40SDE4MC4yNTdaIiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTAgMjEuNTAwOEg3LjNWMTYuMzAwOEgwVjIxLjUwMDhaIiBmaWxsPSIjQUZFNjE0Ii8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNNy4yOTk4IDIxLjUwMDhIMTQuNTk5OFYxNi4zMDA4SDcuMjk5OFYyMS41MDA4WiIgZmlsbD0iIzZFQkUwMCIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTE0LjYwMDEgMTYuM0gyOS4yMDAxVjAuNUgxNC42MDAxVjE2LjNaIiBmaWxsPSIjQUZFNjE0Ii8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMCAxMUgxNC42VjAuNUgwVjExWiIgZmlsbD0iIzZFQkUwMCIvPgo8L3N2Zz4K" alt="Patchstack Logo">
+				</a>
+            </div>
+        </div>
+    </div>
+</body>
+<script>
+    function copyText(id) {
+        var copyText = document.getElementById(id)
+        copyText.select();
+        copyText.setSelectionRange(0, 99999);
+        navigator.clipboard.writeText(copyText.value);
+    }
+
+    function hover(element) {
+        element.setAttribute('src', 'data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkiIGhlaWdodD0iMjMiIHZpZXdCb3g9IjAgMCAxOSAyMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0IDAuMDIzNDM3NUgwVjE2LjAyMzRIMlYyLjAyMzQ0SDE0VjAuMDIzNDM3NVpNMTkgNC4wMjM0NEg0VjIyLjAyMzRIMTlWNC4wMjM0NFpNMTcgMjAuMDIzNEg2VjYuMDIzNDRIMTdWMjAuMDIzNFoiIGZpbGw9IiNBRkU2MTQiLz4KPC9zdmc+Cg==');
+    }
+
+    function unhover(element) {
+        element.setAttribute('src', 'data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkiIGhlaWdodD0iMjMiIHZpZXdCb3g9IjAgMCAxOSAyMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0IDAuMDIzNDM3NUgwVjE2LjAyMzRIMlYyLjAyMzQ0SDE0VjAuMDIzNDM3NVpNMTkgNC4wMjM0NEg0VjIyLjAyMzRIMTlWNC4wMjM0NFpNMTcgMjAuMDIzNEg2VjYuMDIzNDRIMTdWMjAuMDIzNFoiIGZpbGw9IndoaXRlIi8+Cjwvc3ZnPgo=');
+    }
+</script>
+</html>`;
+}
+
 // src/protect/runtime.js
 var import_node_fs = require("fs");
 var import_node_path = require("path");
@@ -1338,15 +1606,27 @@ async function createProtection(options = {}) {
     if (mode !== "block" || !blockRule && !redactions.length) return { verdict: "pass" };
     if (blockRule) return { verdict: "block" };
     let body = text;
-    for (const { rule, redactors } of redactions) body = applyRedactors(body, redactors, maskFn(rule.category));
-    return { verdict: "redact", body };
+    const headers = { ...meta.headers || {} };
+    for (const { rule, redactors } of redactions) {
+      const mask = maskFn(rule.category);
+      body = applyRedactors(body, redactors, mask);
+      for (const name of Object.keys(headers)) {
+        const value = headers[name];
+        if (typeof value === "string") {
+          headers[name] = applyRedactors(value, redactors, mask);
+        } else if (Array.isArray(value)) {
+          headers[name] = value.map((item) => typeof item === "string" ? applyRedactors(item, redactors, mask) : item);
+        }
+      }
+    }
+    return { verdict: "redact", body, headers };
   };
   const screenResp = async (response) => {
     const text = await readTextResponse(response);
     if (text == null) return response;
     const r = screenText(text, { status: response.status, headers: headerObject(response.headers) });
     if (r.verdict === "block") return leakResponse();
-    if (r.verdict === "redact") return rebuildResponse(response, r.body);
+    if (r.verdict === "redact") return rebuildResponse(response, r.body, r.headers);
     return response;
   };
   const wrapNodeResponse = (res) => {
@@ -1396,7 +1676,7 @@ async function createProtection(options = {}) {
       }
       let r;
       try {
-        r = screenText(text, { status: res.statusCode, headers: {} });
+        r = screenText(text, { status: res.statusCode, headers: res.getHeaders ? res.getHeaders() : {} });
       } catch (err) {
         onError?.(err);
         for (const c of chunks) origWrite(c);
@@ -1415,6 +1695,22 @@ async function createProtection(options = {}) {
           res.removeHeader && res.removeHeader("content-length");
         } catch {
         }
+        if (r.headers && res.setHeader) {
+          const current = res.getHeaders ? res.getHeaders() : {};
+          for (const [name, value] of Object.entries(r.headers)) {
+            if (Array.isArray(value)) {
+              try {
+                res.setHeader(name, value);
+              } catch {
+              }
+            } else if (typeof value === "string" && current[name] !== value) {
+              try {
+                res.setHeader(name, value);
+              } catch {
+              }
+            }
+          }
+        }
         return origEnd(r.body, cb);
       }
       for (const c of chunks) origWrite(c);
@@ -1451,7 +1747,7 @@ async function createProtection(options = {}) {
           onError?.(err);
           return null;
         }
-        return decide("request", result, () => blockResponse(result), () => null);
+        return decide("request", result, () => blockResponse(result, request), () => null);
       };
     },
     // Wrap a fetch handler: screens the request, then the response (redact/block).
@@ -1479,7 +1775,13 @@ async function createProtection(options = {}) {
         decide(
           "request",
           result,
-          () => res.status(403).json(blockBody(result)),
+          () => {
+            if (isDocumentNavigation((n) => req.headers?.[n])) {
+              res.status(403).type("html").send(renderBlockPage({ url: req.originalUrl || req.url || "/", code: result?.rule?.id }));
+            } else {
+              res.status(403).json(blockBody(result));
+            }
+          },
           () => {
             if (exprOptions.screenResponses) wrapNodeResponse(res);
             next();
@@ -1523,8 +1825,13 @@ async function createProtection(options = {}) {
             result,
             () => {
               res.statusCode = 403;
-              res.setHeader("content-type", "application/json");
-              res.end(JSON.stringify(blockBody(result)));
+              if (isDocumentNavigation((n) => req.headers?.[n])) {
+                res.setHeader("content-type", "text/html; charset=utf-8");
+                res.end(renderBlockPage({ url: req.url || "/", code: result?.rule?.id }));
+              } else {
+                res.setHeader("content-type", "application/json");
+                res.end(JSON.stringify(blockBody(result)));
+              }
             },
             () => {
               if (req.body === void 0) req.body = shaped.body;
@@ -1537,7 +1844,7 @@ async function createProtection(options = {}) {
     }
   };
   if (options.egress) {
-    protection.uninstallEgress = installEgressGuard({ shouldBlock: egressShouldBlock, onBlock: options.onEgressBlock });
+    protection.uninstallEgress = await installEgressGuard({ shouldBlock: egressShouldBlock, onBlock: options.onEgressBlock });
   }
   return protection;
 }
@@ -1563,6 +1870,8 @@ function headerObject(headers) {
   headers?.forEach?.((v, k) => {
     out[k.toLowerCase()] = v;
   });
+  const setCookies = headers?.getSetCookie?.();
+  if (setCookies && setCookies.length) out["set-cookie"] = setCookies;
   return out;
 }
 function extractRedactors(rule) {
@@ -1597,9 +1906,27 @@ function applyRedactors(body, redactors, mask) {
   }
   return out;
 }
-function rebuildResponse(response, body) {
+function rebuildResponse(response, body, redactedHeaders) {
   const headers = new Headers(response.headers);
   headers.delete("content-length");
+  if (redactedHeaders) {
+    for (const [name, value] of Object.entries(redactedHeaders)) {
+      if (typeof value === "string") {
+        if (headers.get(name) !== value) {
+          try {
+            headers.set(name, value);
+          } catch {
+          }
+        }
+      } else if (Array.isArray(value)) {
+        try {
+          headers.delete(name);
+          for (const item of value) headers.append(name, String(item));
+        } catch {
+        }
+      }
+    }
+  }
   return new Response(body, { status: response.status, statusText: response.statusText, headers });
 }
 function leakResponse() {
@@ -1609,40 +1936,43 @@ function leakResponse() {
   });
 }
 async function resolveRules(options) {
+  const cache = makeCache(options);
   if (options.siteUuid) {
-    const client = new PulseRuleClient({ siteUuid: options.siteUuid, baseUrl: options.pulseRulesUrl });
+    const prior = await cache.read();
+    const client = new PulseRuleClient({ siteUuid: options.siteUuid, baseUrl: options.pulseRulesUrl, etag: prior?.etag });
     const res = await client.getRules();
-    if (res.success) {
+    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle);
+    if (res.success && !res.notModified) {
       const bundle = normalizeBundle(res);
-      cacheWrite(options.cacheDir, bundle);
+      await cache.write({ bundle, etag: res.etag ?? null });
       return bundle;
     }
-    const cached = cacheRead(options.cacheDir);
-    if (cached) {
-      options.onError?.(new Error(`pulse rule fetch failed (${res.error}); using cached bundle`));
-      return normalizeBundle(cached);
+    if (prior?.bundle) {
+      options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`));
+      return normalizeBundle(prior.bundle);
     }
     if (options.rules) {
-      options.onError?.(new Error(`pulse rule fetch failed (${res.error}); using bundled fallback`));
+      options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using bundled fallback`));
       return normalizeBundle(options.rules);
     }
-    options.onError?.(new Error(`pulse rule fetch failed (${res.error}); no cache \u2014 running with no rules`));
+    options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`));
     return emptyBundle();
   }
   if (options.token) {
-    const client = new PatchstackRuleClient({ token: options.token, baseUrl: options.baseUrl });
+    const prior = await cache.read();
+    const client = new PatchstackRuleClient({ token: options.token, baseUrl: options.baseUrl, etag: prior?.etag });
     const res = await client.getRules();
-    if (res.success) {
+    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle);
+    if (res.success && !res.notModified) {
       const bundle = normalizeBundle(res);
-      cacheWrite(options.cacheDir, bundle);
+      await cache.write({ bundle, etag: res.etag ?? null });
       return bundle;
     }
-    const cached = cacheRead(options.cacheDir);
-    if (cached) {
-      options.onError?.(new Error(`rule fetch failed (${res.error}); using cached bundle`));
-      return normalizeBundle(cached);
+    if (prior?.bundle) {
+      options.onError?.(new Error(`rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`));
+      return normalizeBundle(prior.bundle);
     }
-    options.onError?.(new Error(`rule fetch failed (${res.error}); no cache \u2014 running with no rules`));
+    options.onError?.(new Error(`rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`));
     return emptyBundle();
   }
   if (options.rules) {
@@ -1660,33 +1990,76 @@ function normalizeBundle(b) {
 function emptyBundle() {
   return { firewall: [], whitelists: [], whitelist_keys: {} };
 }
+function makeCache(options) {
+  const adapter = options.ruleCache;
+  if (adapter && typeof adapter.read === "function" && typeof adapter.write === "function") {
+    return {
+      read: async () => {
+        try {
+          return toEnvelope(await adapter.read());
+        } catch {
+          return null;
+        }
+      },
+      write: async (env) => {
+        try {
+          await adapter.write(env);
+        } catch {
+        }
+      }
+    };
+  }
+  const dir = options.cacheDir;
+  return {
+    read: async () => cacheRead(dir),
+    write: async (env) => cacheWrite(dir, env)
+  };
+}
 function cachePath(dir) {
   return (0, import_node_path.join)(dir, "patchstack-rules.json");
 }
-function cacheWrite(dir, bundle) {
+function cacheWrite(dir, env) {
   if (!dir) return;
   try {
     (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-    (0, import_node_fs.writeFileSync)(cachePath(dir), JSON.stringify(bundle));
+    (0, import_node_fs.writeFileSync)(cachePath(dir), JSON.stringify(env));
   } catch {
   }
 }
 function cacheRead(dir) {
   if (!dir) return null;
   try {
-    return JSON.parse((0, import_node_fs.readFileSync)(cachePath(dir), "utf8"));
+    return toEnvelope(JSON.parse((0, import_node_fs.readFileSync)(cachePath(dir), "utf8")));
   } catch {
     return null;
   }
 }
+function toEnvelope(value) {
+  if (!value || typeof value !== "object") return null;
+  if (value.bundle && typeof value.bundle === "object") {
+    return { bundle: value.bundle, etag: value.etag ?? null };
+  }
+  if (Array.isArray(value.firewall) || Array.isArray(value.whitelists)) {
+    return { bundle: value, etag: null };
+  }
+  return null;
+}
+var BLOCK_MESSAGE = "This request has been blocked by Patchstack.";
 function blockBody(result) {
-  return {
-    error: "Blocked by Patchstack",
-    rule: result.rule?.id,
-    message: result.message
-  };
+  return { error: BLOCK_MESSAGE, message: BLOCK_MESSAGE, rule: result?.rule?.id };
 }
-function blockResponse(result) {
+function isDocumentNavigation(getHeader) {
+  const dest = getHeader("sec-fetch-dest");
+  if (dest) return dest === "document";
+  return (getHeader("accept") || "").includes("text/html");
+}
+function blockResponse(result, request) {
+  if (request && isDocumentNavigation((n) => request.headers.get(n))) {
+    return new Response(renderBlockPage({ url: request.url, code: result?.rule?.id }), {
+      status: 403,
+      headers: { "content-type": "text/html; charset=utf-8" }
+    });
+  }
   return new Response(JSON.stringify(blockBody(result)), {
     status: 403,
     headers: { "content-type": "application/json" }