@patchstack/connect 0.3.16 → 0.3.17

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
 
 // src/parsers/index.ts
 import { access } from "fs/promises";
@@ -1661,16 +1661,65 @@ function renderGuideChecklist(state, useColor) {
   return lines.join("\n");
 }
 
-// src/protect/install.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync4, mkdirSync, copyFileSync } from "fs";
+// src/protect/install/util.ts
+import { readFileSync as readFileSync3, existsSync as existsSync4, writeFileSync as writeFileSync2 } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
-var HERE = dirname(fileURLToPath(import.meta.url));
-var TEMPLATES = [join(HERE, "protect", "templates"), join(HERE, "templates")].find((p) => existsSync4(p)) ?? join(HERE, "protect", "templates");
-var APP = process.cwd();
-var PS_DIR = join(APP, "src/integrations/patchstack");
 var read = (p) => readFileSync3(p, "utf8");
 var log = (msg) => console.log(`patchstack protect: ${msg}`);
+function hasDependency(cwd, name) {
+  try {
+    const pkg = JSON.parse(read(join(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }[name]);
+  } catch {
+    return false;
+  }
+}
+var SITE_UUID_PLACEHOLDER = "__PATCHSTACK_SITE_UUID__";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function bakeSiteUuid(cwd, guardRelPath) {
+  const rc = join(cwd, ".patchstackrc.json");
+  if (!existsSync4(rc)) {
+    log("no .patchstackrc.json \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
+    return false;
+  }
+  let uuid;
+  try {
+    uuid = JSON.parse(read(rc)).siteUuid;
+  } catch {
+    log(".patchstackrc.json unreadable \u2014 skipping site-UUID bake");
+    return false;
+  }
+  if (typeof uuid !== "string" || !UUID_RE.test(uuid)) {
+    log(".patchstackrc.json siteUuid missing or malformed \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
+    return false;
+  }
+  const guardPath = join(cwd, guardRelPath);
+  if (!existsSync4(guardPath)) return false;
+  const source = read(guardPath);
+  if (!source.includes(SITE_UUID_PLACEHOLDER)) {
+    log(`${guardRelPath} site UUID already baked`);
+    return false;
+  }
+  writeFileSync2(guardPath, source.replace(SITE_UUID_PLACEHOLDER, uuid));
+  log(`baked site UUID into ${guardRelPath} \u2014 live rules from the Patchstack API`);
+  return true;
+}
+var HERE = dirname(fileURLToPath(import.meta.url));
+function templatesDir() {
+  const builtLayout = join(HERE, "protect", "templates");
+  const candidates = [
+    builtLayout,
+    join(HERE, "..", "templates"),
+    // source: src/protect/install/ → src/protect/templates
+    join(HERE, "templates")
+  ];
+  return candidates.find((p) => existsSync4(p)) ?? builtLayout;
+}
+
+// src/protect/install/adapters/tanstack-supabase.ts
+import { writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync, copyFileSync } from "fs";
+import { join as join2 } from "path";
 var CLIENT_TUNNEL = [
   "",
   "    // PATCHSTACK: in the browser, tunnel Supabase traffic through the app's own server guard",
@@ -1684,101 +1733,127 @@ var CLIENT_TUNNEL = [
   "    }",
   ""
 ].join("\n");
-var START_IMPORTS = [
-  'import { getRequest } from "@tanstack/react-start/server";',
-  'import { GUARD_PATH, handleGuardRequest, inspectServerFn, screenResponse } from "@/integrations/patchstack/guard";'
-].join("\n");
-var REQUEST_MIDDLEWARE_DEF = [
-  "",
-  "// Patchstack guard (browser tunnel): intercept tunneled Supabase traffic before anything else,",
-  "// then screen the outgoing response (SSR HTML / data) for leaked secrets & PII.",
+var GUARD_IMPORT = 'import { GUARD_PATH, handleGuardRequest, inspectServerFn, screenResponse, guardRequest } from "@/integrations/patchstack/guard";';
+var GUARD_IMPORT_RE = /import \{[^}]*\} from "@\/integrations\/patchstack\/guard";/;
+var START_IMPORTS = ['import { getRequest } from "@tanstack/react-start/server";', GUARD_IMPORT].join("\n");
+var REQUEST_MIDDLEWARE_BLOCK = [
+  "// #region patchstack-guard (managed by patchstack-connect protect \u2014 do not edit)",
+  "// Browser\u2192Supabase tunnel + response screening; optional route WAF via PATCHSTACK_ROUTE_WAF=1.",
   "const patchstackGuard = createMiddleware().server(async ({ next }) => {",
   "  const request = getRequest();",
   "  if (request) {",
   "    const { pathname } = new URL(request.url);",
   "    if (pathname === GUARD_PATH) return handleGuardRequest(request);",
+  '    if (process.env.PATCHSTACK_ROUTE_WAF === "1") {',
+  "      const blocked = await guardRequest(request);",
+  "      if (blocked) return blocked;",
+  "    }",
   "  }",
   "  return screenResponse(await next());",
   "});",
-  ""
+  "// #endregion patchstack-guard"
 ].join("\n");
-var FUNCTION_MIDDLEWARE_DEF = [
-  "",
-  "// Patchstack guard (server functions): inspect server-fn args before they reach the database,",
-  "// covering apps that mutate via TanStack server functions (which bypass the browser tunnel).",
+var FUNCTION_MIDDLEWARE_BLOCK = [
+  "// #region patchstack-function-guard (managed by patchstack-connect protect \u2014 do not edit)",
+  "// Inspect server-function args before they reach the database.",
   'const patchstackFunctionGuard = createMiddleware({ type: "function" }).server(async ({ next, data }) => {',
   "  const blocked = await inspectServerFn(data);",
   "  if (blocked) throw new Error(blocked.message);",
   "  return next();",
   "});",
-  ""
+  "// #endregion patchstack-function-guard"
 ].join("\n");
-function detectSupportedStack(cwd) {
-  const pkgPath = join(cwd, "package.json");
-  if (!existsSync4(pkgPath)) return false;
-  const pkg = JSON.parse(read(pkgPath));
-  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
-  return Boolean(deps["@tanstack/react-start"]) && existsSync4(join(cwd, "src/start.ts")) && existsSync4(join(cwd, "src/integrations/supabase/client.ts"));
-}
-function scaffold(cwd) {
-  const dst = join(cwd, "src/integrations/patchstack");
-  mkdirSync(dst, { recursive: true });
-  copyFileSync(join(TEMPLATES, "guard.ts"), join(dst, "guard.ts"));
-  copyFileSync(join(TEMPLATES, "rules.json"), join(dst, "rules.json"));
-  log("scaffolded guard.ts + rules.json");
-}
-function bakeSiteUuid(cwd) {
-  const rc = join(cwd, ".patchstackrc.json");
-  if (!existsSync4(rc)) return log("no .patchstackrc.json \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
-  let uuid;
+function reconcileBlock(s, region, block, legacyConst, insertBefore) {
+  const lines = s.split("\n");
+  const startMarker = `// #region ${region} `;
+  const endMarker = `// #endregion ${region}`;
+  const si = lines.findIndex((l) => l.includes(startMarker));
+  if (si !== -1) {
+    const ei = lines.findIndex((l, i) => i > si && l.trim() === endMarker);
+    if (ei !== -1) {
+      lines.splice(si, ei - si + 1, ...block.split("\n"));
+      return lines.join("\n");
+    }
+  }
+  const ci = lines.findIndex((l) => l.includes(legacyConst));
+  if (ci !== -1) {
+    const close = lines.findIndex((l, i) => i >= ci && l.trim() === "});");
+    if (close !== -1) {
+      let start = ci;
+      while (start > 0 && (lines[start - 1] ?? "").trim().startsWith("//")) start--;
+      lines.splice(start, close - start + 1, ...block.split("\n"));
+      return lines.join("\n");
+    }
+  }
+  return s.replace(insertBefore, block + "\n\n" + insertBefore);
+}
+function detect(cwd) {
+  const pkgPath = join2(cwd, "package.json");
+  if (!existsSync5(pkgPath)) return false;
+  let pkg;
   try {
-    uuid = JSON.parse(read(rc)).siteUuid;
+    pkg = JSON.parse(read(pkgPath));
   } catch {
-    return log(".patchstackrc.json unreadable \u2014 skipping site-UUID bake");
+    return false;
   }
-  if (!uuid || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(uuid)) {
-    return log(".patchstackrc.json siteUuid missing or malformed \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  return Boolean(deps["@tanstack/react-start"]) && existsSync5(join2(cwd, "src/start.ts")) && existsSync5(join2(cwd, "src/integrations/supabase/client.ts"));
+}
+var GUARD_FILE = "src/integrations/patchstack/guard.ts";
+function scaffold(cwd, opts) {
+  const templates = templatesDir();
+  const dst = join2(cwd, "src/integrations/patchstack");
+  mkdirSync(dst, { recursive: true });
+  copyFileSync(join2(templates, "guard.ts"), join2(dst, "guard.ts"));
+  const changed = [GUARD_FILE];
+  const rulesDst = join2(dst, "rules.json");
+  if (opts.demo) {
+    copyFileSync(join2(templates, "demo-rules.json"), rulesDst);
+    changed.push("src/integrations/patchstack/rules.json");
+    log("scaffolded guard.ts + rules.json (demo sample rule set)");
+  } else if (!existsSync5(rulesDst)) {
+    copyFileSync(join2(templates, "rules.json"), rulesDst);
+    changed.push("src/integrations/patchstack/rules.json");
+    log("scaffolded guard.ts + rules.json (starter rules)");
+  } else {
+    log("scaffolded guard.ts (kept existing rules.json)");
   }
-  const p = join(cwd, "src/integrations/patchstack/guard.ts");
-  if (!existsSync4(p)) return;
-  const s = read(p);
-  if (!s.includes("__PATCHSTACK_SITE_UUID__")) return log("guard.ts site UUID already baked");
-  writeFileSync2(p, s.replace("__PATCHSTACK_SITE_UUID__", uuid));
-  log("baked site UUID into guard.ts \u2014 live rules from the Patchstack API");
+  return changed;
 }
 function patchClient(cwd) {
-  const p = join(cwd, "src/integrations/supabase/client.ts");
-  let s = read(p);
-  if (s.includes("x-ps-target")) return log("client.ts already wired");
+  const p = join2(cwd, "src/integrations/supabase/client.ts");
+  const s = read(p);
+  if (s.includes("x-ps-target")) {
+    log("client.ts already wired");
+    return false;
+  }
   const anchor = "headers.set('apikey', supabaseKey);";
-  if (!s.includes(anchor)) return log("client.ts anchor not found \u2014 skipping (template changed?)");
-  writeFileSync2(p, s.replace(anchor, anchor + "\n" + CLIENT_TUNNEL));
+  if (!s.includes(anchor)) {
+    log("client.ts anchor not found \u2014 skipping (template changed?)");
+    return false;
+  }
+  writeFileSync3(p, s.replace(anchor, anchor + "\n" + CLIENT_TUNNEL));
   log("patched client.ts (tunnel Supabase through the guard)");
+  return true;
 }
 function patchStart(cwd) {
-  const p = join(cwd, "src/start.ts");
+  const p = join2(cwd, "src/start.ts");
   let s = read(p);
   const importAnchor = 'import { createStart, createMiddleware } from "@tanstack/react-start";';
   const exportAnchor = "export const startInstance";
   const rmAnchor = "requestMiddleware: [";
   if (!s.includes(importAnchor) || !s.includes(exportAnchor)) {
-    return log("start.ts anchors not found \u2014 skipping (template changed?)");
+    log("start.ts anchors not found \u2014 skipping (template changed?)");
+    return false;
   }
   const original = s;
-  if (!s.includes("@/integrations/patchstack/guard")) {
+  if (GUARD_IMPORT_RE.test(s)) {
+    s = s.replace(GUARD_IMPORT_RE, GUARD_IMPORT);
+  } else {
     s = s.replace(importAnchor, importAnchor + "\n" + START_IMPORTS);
-  } else if (!s.includes("inspectServerFn")) {
-    s = s.replace(
-      'import { GUARD_PATH, handleGuardRequest } from "@/integrations/patchstack/guard";',
-      'import { GUARD_PATH, handleGuardRequest, inspectServerFn } from "@/integrations/patchstack/guard";'
-    );
-  }
-  if (!s.includes("const patchstackGuard =")) {
-    s = s.replace(exportAnchor, REQUEST_MIDDLEWARE_DEF + "\n" + exportAnchor);
-  }
-  if (!s.includes("const patchstackFunctionGuard =")) {
-    s = s.replace(exportAnchor, FUNCTION_MIDDLEWARE_DEF + "\n" + exportAnchor);
   }
+  s = reconcileBlock(s, "patchstack-guard", REQUEST_MIDDLEWARE_BLOCK, "const patchstackGuard =", exportAnchor);
+  s = reconcileBlock(s, "patchstack-function-guard", FUNCTION_MIDDLEWARE_BLOCK, "const patchstackFunctionGuard =", exportAnchor);
   if (s.includes(rmAnchor) && !s.includes("requestMiddleware: [patchstackGuard")) {
     s = s.replace(rmAnchor, rmAnchor + "patchstackGuard, ");
   }
@@ -1790,24 +1865,516 @@ function patchStart(cwd) {
       s = s.replace(rmAnchor, "functionMiddleware: [patchstackFunctionGuard],\n    " + rmAnchor);
     }
   }
-  if (s === original) return log("start.ts already wired");
-  writeFileSync2(p, s);
+  if (s === original) {
+    log("start.ts already wired");
+    return false;
+  }
+  writeFileSync3(p, s);
   log("patched start.ts (guard registered as request + function middleware)");
+  return true;
+}
+function wire(cwd, opts) {
+  const changed = scaffold(cwd, opts);
+  if (!opts.demo && bakeSiteUuid(cwd, GUARD_FILE)) changed.push(GUARD_FILE);
+  if (patchClient(cwd)) changed.push("src/integrations/supabase/client.ts");
+  if (patchStart(cwd)) changed.push("src/start.ts");
+  log(
+    opts.demo ? "done \u2014 guard wired with the demo sample rules (blocks by default). Set PATCHSTACK_MODE=dry-run for log-only." : "done \u2014 guard wired and always-on (blocks by default). Set PATCHSTACK_MODE=dry-run for log-only."
+  );
+  return { ok: true, changed: [...new Set(changed)] };
+}
+function verify(cwd) {
+  const guardPath = join2(cwd, GUARD_FILE);
+  const clientPath = join2(cwd, "src/integrations/supabase/client.ts");
+  const startPath = join2(cwd, "src/start.ts");
+  const guard = existsSync5(guardPath) ? read(guardPath) : "";
+  const client = existsSync5(clientPath) ? read(clientPath) : "";
+  const start = existsSync5(startPath) ? read(startPath) : "";
+  const checks = [
+    { label: "guard.ts scaffolded", ok: guard.length > 0, hint: "run `patchstack-connect protect`" },
+    { label: "Supabase client tunnels through the guard", ok: client.includes("x-ps-target"), hint: "run `patchstack-connect protect` to re-patch src/integrations/supabase/client.ts" },
+    { label: "request middleware defined + registered", ok: start.includes("const patchstackGuard =") && start.includes("requestMiddleware: [patchstackGuard"), hint: "run `patchstack-connect protect` to re-patch src/start.ts" },
+    { label: "server-function middleware defined + registered", ok: start.includes("const patchstackFunctionGuard =") && start.includes("functionMiddleware: [patchstackFunctionGuard"), hint: "run `patchstack-connect protect` to re-patch src/start.ts" }
+  ];
+  return { wired: checks.every((c) => c.ok), checks };
+}
+var tanstackSupabaseAdapter = {
+  name: "tanstack-supabase",
+  label: "TanStack Start + Supabase",
+  detect,
+  wire,
+  verify
+};
+
+// src/protect/install/adapters/next.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, copyFileSync as copyFileSync2 } from "fs";
+import { join as join3 } from "path";
+function hasNextDep(cwd) {
+  try {
+    const pkg = JSON.parse(read(join3(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.next);
+  } catch {
+    return false;
+  }
 }
-function runProtect(cwd) {
-  if (!detectSupportedStack(cwd)) {
-    log("runtime protection currently supports TanStack Start + Supabase apps; stack not detected \u2014 skipping.");
-    return;
+function middlewareInfo(cwd) {
+  const candidates = ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"];
+  for (const rel of candidates) {
+    if (existsSync6(join3(cwd, rel))) return { relDir: rel.includes("/") ? "src" : ".", relFile: rel, exists: true };
+  }
+  const useSrc = existsSync6(join3(cwd, "src"));
+  return { relDir: useSrc ? "src" : ".", relFile: useSrc ? "src/middleware.ts" : "middleware.ts", exists: false };
+}
+function detect2(cwd) {
+  return hasNextDep(cwd);
+}
+function rulesFile(relDir) {
+  return relDir === "." ? "patchstack.rules.json" : `${relDir}/patchstack.rules.json`;
+}
+function wire2(cwd, opts) {
+  const templates = templatesDir();
+  const mw = middlewareInfo(cwd);
+  const dir = join3(cwd, mw.relDir === "." ? "" : mw.relDir);
+  mkdirSync2(dir, { recursive: true });
+  const rulesDst = join3(dir, "patchstack.rules.json");
+  const changed = [];
+  if (opts.demo || !existsSync6(rulesDst)) {
+    copyFileSync2(join3(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    changed.push(rulesFile(mw.relDir));
+  }
+  const mwPath = join3(cwd, mw.relFile);
+  const existing = mw.exists ? read(mwPath) : "";
+  if (mw.exists && !existing.includes("patchstack-next")) {
+    log(
+      `existing ${mw.relFile} left untouched \u2014 scaffolded ${rulesFile(mw.relDir)}; add the guard to your middleware: import { createProtection } from "@patchstack/connect/protect", run fetchGuard() on the request, and return the block Response. Then: npx patchstack-connect protect --check`
+    );
+    return { ok: true, changed };
+  }
+  copyFileSync2(join3(templates, "next-middleware.ts"), mwPath);
+  if (!opts.demo) bakeSiteUuid(cwd, mw.relFile);
+  changed.push(mw.relFile);
+  log(mw.exists ? `refreshed ${mw.relFile} (Patchstack middleware)` : `scaffolded ${mw.relFile} (Patchstack middleware)`);
+  return { ok: true, changed: [...new Set(changed)] };
+}
+function verify2(cwd) {
+  const mw = middlewareInfo(cwd);
+  const present = mw.exists && read(join3(cwd, mw.relFile)).includes("patchstack-next");
+  const rulesPresent = existsSync6(join3(cwd, rulesFile(mw.relDir)));
+  return {
+    wired: present && rulesPresent,
+    checks: [
+      { label: "Patchstack middleware present", ok: present, hint: `run \`patchstack-connect protect\` (writes ${mw.relFile})` },
+      { label: "rules co-located with the middleware", ok: rulesPresent, hint: "run `patchstack-connect protect`" }
+    ]
+  };
+}
+var nextAdapter = {
+  name: "nextjs",
+  label: "Next.js",
+  detect: detect2,
+  wire: wire2,
+  verify: verify2
+};
+
+// src/protect/install/adapters/sveltekit.ts
+import { join as join5 } from "path";
+
+// src/protect/install/seam.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, copyFileSync as copyFileSync3 } from "fs";
+import { join as join4, dirname as dirname2 } from "path";
+function rulesRel(seamRel) {
+  const d = dirname2(seamRel);
+  return (d === "." ? "patchstack.rules.json" : `${d}/patchstack.rules.json`).replace(/\\/g, "/");
+}
+function wireSeam(cwd, opts, spec) {
+  const templates = templatesDir();
+  const existing = spec.candidates.find((c) => existsSync7(join4(cwd, c)));
+  const seamRel = existing ?? spec.target;
+  mkdirSync3(dirname2(join4(cwd, seamRel)), { recursive: true });
+  const rulesDst = join4(cwd, rulesRel(seamRel));
+  const changed = [];
+  if (opts.demo || !existsSync7(rulesDst)) {
+    copyFileSync3(join4(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    changed.push(rulesRel(seamRel));
+  }
+  const current = existing ? read(join4(cwd, existing)) : "";
+  if (existing && !current.includes(spec.marker)) {
+    log(`existing ${existing} left untouched \u2014 scaffolded ${rulesRel(seamRel)}; ${spec.planHint}`);
+    return { ok: true, changed };
+  }
+  copyFileSync3(join4(templates, spec.templateName), join4(cwd, seamRel));
+  if (!opts.demo) bakeSiteUuid(cwd, seamRel);
+  changed.push(seamRel);
+  log(existing ? `refreshed ${seamRel}` : `scaffolded ${seamRel}`);
+  return { ok: true, changed: [...new Set(changed)] };
+}
+function verifySeam(cwd, spec) {
+  const existing = spec.candidates.find((c) => existsSync7(join4(cwd, c)));
+  const seamRel = existing ?? spec.target;
+  const present = existing ? read(join4(cwd, existing)).includes(spec.marker) : false;
+  const rulesPresent = existsSync7(join4(cwd, rulesRel(seamRel)));
+  return {
+    wired: present && rulesPresent,
+    checks: [
+      { label: `${spec.seamLabel} present`, ok: present, hint: `run \`patchstack-connect protect\` (writes ${spec.target})` },
+      { label: "rules co-located with the guard", ok: rulesPresent, hint: "run `patchstack-connect protect`" }
+    ]
+  };
+}
+
+// src/protect/install/adapters/sveltekit.ts
+var SPEC = {
+  templateName: "sveltekit-hooks.ts",
+  candidates: ["src/hooks.server.ts", "src/hooks.server.js"],
+  target: "src/hooks.server.ts",
+  marker: "patchstack-sveltekit",
+  planHint: 'add the guard to your `handle` (compose with `sequence()` from "@sveltejs/kit/hooks"), then: npx patchstack-connect protect --check',
+  seamLabel: "SvelteKit server hook"
+};
+function detect3(cwd) {
+  try {
+    const pkg = JSON.parse(read(join5(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }["@sveltejs/kit"]);
+  } catch {
+    return false;
   }
-  scaffold(cwd);
-  bakeSiteUuid(cwd);
-  patchClient(cwd);
-  patchStart(cwd);
-  log("done \u2014 guard wired and always-on (blocks by default). Set PATCHSTACK_MODE=dry-run for log-only.");
+}
+function wire3(cwd, opts) {
+  return wireSeam(cwd, opts, SPEC);
+}
+function verify3(cwd) {
+  return verifySeam(cwd, SPEC);
+}
+var sveltekitAdapter = {
+  name: "sveltekit",
+  label: "SvelteKit",
+  detect: detect3,
+  wire: wire3,
+  verify: verify3
+};
+
+// src/protect/install/adapters/astro.ts
+import { join as join6 } from "path";
+var SPEC2 = {
+  templateName: "astro-middleware.ts",
+  candidates: ["src/middleware.ts", "src/middleware.js", "src/middleware/index.ts", "src/middleware/index.js"],
+  target: "src/middleware.ts",
+  marker: "patchstack-astro",
+  planHint: 'add the guard to your `onRequest` (compose with `sequence()` from "astro:middleware"), then: npx patchstack-connect protect --check',
+  seamLabel: "Astro middleware"
+};
+function detect4(cwd) {
+  try {
+    const pkg = JSON.parse(read(join6(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.astro);
+  } catch {
+    return false;
+  }
+}
+function wire4(cwd, opts) {
+  return wireSeam(cwd, opts, SPEC2);
+}
+function verify4(cwd) {
+  return verifySeam(cwd, SPEC2);
+}
+var astroAdapter = {
+  name: "astro",
+  label: "Astro",
+  detect: detect4,
+  wire: wire4,
+  verify: verify4
+};
+
+// src/protect/install/find-app.ts
+import { readFileSync as readFileSync4, existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
+import { join as join7, relative, dirname as dirname3 } from "path";
+function findAppInstance(cwd, re) {
+  const root = existsSync8(join7(cwd, "src")) ? join7(cwd, "src") : cwd;
+  let hit = null;
+  const walk2 = (dir) => {
+    if (hit) return;
+    let entries;
+    try {
+      entries = readdirSync3(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (hit) return;
+      if (name === "node_modules" || name === "patchstack" || name.startsWith(".")) continue;
+      const p = join7(dir, name);
+      let st;
+      try {
+        st = statSync3(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) walk2(p);
+      else if (/\.(?:ts|js|mjs|cjs)$/.test(name)) {
+        let src;
+        try {
+          src = readFileSync4(p, "utf8");
+        } catch {
+          continue;
+        }
+        const m = re.exec(src);
+        if (m) hit = { relPath: relative(cwd, p).replace(/\\/g, "/"), appVar: m[1] };
+      }
+    }
+  };
+  walk2(root);
+  return hit;
+}
+function importSpecifier(fromRel, toRel) {
+  let spec = relative(dirname3(fromRel), toRel).replace(/\\/g, "/").replace(/\.(?:ts|js)$/, "");
+  if (!spec.startsWith(".")) spec = `./${spec}`;
+  return spec;
+}
+
+// src/protect/install/register.ts
+import { writeFileSync as writeFileSync5, existsSync as existsSync10 } from "fs";
+import { join as join9 } from "path";
+
+// src/protect/install/generic.ts
+import { readFileSync as readFileSync5, existsSync as existsSync9, mkdirSync as mkdirSync4, copyFileSync as copyFileSync4, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
+import { join as join8 } from "path";
+var GUARD_MARKER = "patchstack/guard";
+function genericDir(cwd) {
+  return existsSync9(join8(cwd, "src")) ? "src/patchstack" : "patchstack";
+}
+function scaffoldGeneric(cwd, opts, guardTemplate = "generic-guard.ts") {
+  const templates = templatesDir();
+  const dir = genericDir(cwd);
+  const dst = join8(cwd, dir);
+  mkdirSync4(dst, { recursive: true });
+  copyFileSync4(join8(templates, guardTemplate), join8(dst, "guard.ts"));
+  const changed = [`${dir}/guard.ts`];
+  if (!opts.demo) bakeSiteUuid(cwd, `${dir}/guard.ts`);
+  const rulesDst = join8(dst, "rules.json");
+  if (opts.demo || !existsSync9(rulesDst)) {
+    copyFileSync4(join8(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    changed.push(`${dir}/rules.json`);
+  }
+  return { changed, dir };
+}
+function candidateEntries(cwd) {
+  const names = [
+    "src/server.ts",
+    "src/server.js",
+    "src/index.ts",
+    "src/index.js",
+    "src/app.ts",
+    "src/app.js",
+    "src/main.ts",
+    "server.ts",
+    "server.js",
+    "index.ts",
+    "index.js",
+    "app.ts",
+    "app.js"
+  ];
+  const hits = names.filter((n) => existsSync9(join8(cwd, n)));
+  try {
+    const pkg = JSON.parse(read(join8(cwd, "package.json")));
+    if (typeof pkg.main === "string" && existsSync9(join8(cwd, pkg.main))) hits.push(pkg.main);
+  } catch {
+  }
+  return [...new Set(hits)];
+}
+function usesExpress(cwd) {
+  try {
+    const pkg = JSON.parse(read(join8(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.express);
+  } catch {
+    return false;
+  }
+}
+function wiringPlan(cwd, dir) {
+  const entries = candidateEntries(cwd);
+  const express = usesExpress(cwd);
+  const lines = [
+    `no built-in adapter matched this stack \u2014 scaffolded a generic guard at ${dir}/guard.ts + ${dir}/rules.json.`,
+    "Finish by wiring it into your server (pick the one that fits):",
+    `  \u2022 Web-Fetch entry:  export default { fetch: protectFetch(yourHandler) }   // import from "${dir}/guard"`,
+    `  \u2022 Node / Express:   app.use(patchstackMiddleware)                          // add before your routes`,
+    entries.length ? `Likely server ${entries.length === 1 ? "entry" : "entries"}: ${entries.join(", ")}${express ? "  (Express detected)" : ""}.` : "Could not locate a server entry \u2014 wire it wherever requests enter your app.",
+    "Then confirm it is hooked up:  npx patchstack-connect protect --check"
+  ];
+  return lines.join("\n");
+}
+function genericVerify(cwd) {
+  const dir = genericDir(cwd);
+  const scaffolded = existsSync9(join8(cwd, dir, "guard.ts"));
+  const imported = scaffolded && guardIsImported(cwd, join8(cwd, dir, "guard.ts"));
+  return {
+    wired: scaffolded && imported,
+    checks: [
+      { label: "generic guard scaffolded", ok: scaffolded, hint: "run `patchstack-connect protect`" },
+      {
+        label: "guard imported into a server entry",
+        ok: imported,
+        hint: `import { protectFetch } (or patchstackMiddleware) from "${dir}/guard" and wire it into your request path`
+      }
+    ]
+  };
+}
+function guardIsImported(cwd, guardPath) {
+  const root = existsSync9(join8(cwd, "src")) ? join8(cwd, "src") : cwd;
+  let found = false;
+  const walk2 = (d) => {
+    if (found) return;
+    let entries;
+    try {
+      entries = readdirSync4(d);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (found) return;
+      if (name === "node_modules" || name.startsWith(".")) continue;
+      const p = join8(d, name);
+      let st;
+      try {
+        st = statSync4(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) walk2(p);
+      else if (/\.(?:ts|tsx|js|jsx|mjs|cjs)$/.test(name) && p !== guardPath) {
+        try {
+          if (readFileSync5(p, "utf8").includes(GUARD_MARKER)) found = true;
+        } catch {
+        }
+      }
+    }
+  };
+  walk2(root);
+  return found;
+}
+
+// src/protect/install/register.ts
+var REGION = "// #region patchstack (managed by patchstack-connect protect \u2014 do not edit)";
+function wireRegister(cwd, opts, spec) {
+  const { changed, dir } = scaffoldGeneric(cwd, opts, spec.guardTemplate);
+  const entry = findAppInstance(cwd, spec.appRe);
+  if (!entry) {
+    log(`${spec.label} not located \u2014 scaffolded guard; ${spec.manualHint}`);
+    return { ok: true, changed };
+  }
+  const p = join9(cwd, entry.relPath);
+  const s = read(p);
+  if (s.includes(spec.importName)) {
+    log(`${entry.relPath} already wired`);
+    return { ok: true, changed };
+  }
+  const importLine = `import { ${spec.importName} } from "${importSpecifier(entry.relPath, `${dir}/guard`)}";`;
+  const lines = s.split("\n");
+  let lastImport = -1;
+  for (let i = 0; i < lines.length; i++) if (/^\s*import\b/.test(lines[i] ?? "")) lastImport = i;
+  lines.splice(lastImport + 1, 0, importLine);
+  const appIdx = lines.findIndex((l) => spec.appRe.test(l));
+  if (appIdx !== -1) {
+    lines.splice(appIdx + 1, 0, REGION, spec.call(entry.appVar), "// #endregion patchstack");
+  }
+  writeFileSync5(p, lines.join("\n"));
+  changed.push(entry.relPath);
+  log(`patched ${entry.relPath} (${spec.call(entry.appVar).trim()})`);
+  return { ok: true, changed: [...new Set(changed)] };
+}
+function verifyRegister(cwd, spec) {
+  const dir = existsSync10(join9(cwd, "src")) ? "src/patchstack" : "patchstack";
+  const scaffolded = existsSync10(join9(cwd, dir, "guard.ts"));
+  const entry = findAppInstance(cwd, spec.appRe);
+  const wired = entry ? read(join9(cwd, entry.relPath)).includes(spec.importName) : false;
+  return {
+    wired: scaffolded && wired,
+    checks: [
+      { label: `${spec.label} guard scaffolded`, ok: scaffolded, hint: "run `patchstack-connect protect`" },
+      { label: `guard registered on the ${spec.label}`, ok: wired, hint: spec.manualHint }
+    ]
+  };
+}
+
+// src/protect/install/adapters/nestjs.ts
+var SPEC3 = {
+  appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*await\s+NestFactory\.create/,
+  guardTemplate: "generic-guard.ts",
+  importName: "patchstackMiddleware",
+  call: (v) => `${v}.use(patchstackMiddleware);`,
+  label: "NestJS app",
+  manualHint: "add `app.use(patchstackMiddleware)` right after your NestFactory.create(...) call"
+};
+var nestjsAdapter = {
+  name: "nestjs",
+  label: "NestJS",
+  detect: (cwd) => hasDependency(cwd, "@nestjs/core") && findAppInstance(cwd, SPEC3.appRe) !== null,
+  wire: (cwd, opts) => wireRegister(cwd, opts, SPEC3),
+  verify: (cwd) => verifyRegister(cwd, SPEC3)
+};
+
+// src/protect/install/adapters/fastify.ts
+var SPEC4 = {
+  appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:fastify|Fastify)\(/,
+  guardTemplate: "fastify-plugin.ts",
+  importName: "patchstackFastify",
+  call: (v) => `${v}.register(patchstackFastify);`,
+  label: "Fastify app",
+  manualHint: "add `app.register(patchstackFastify)` right after you create your fastify() app"
+};
+var fastifyAdapter = {
+  name: "fastify",
+  label: "Fastify (Node)",
+  detect: (cwd) => hasDependency(cwd, "fastify") && findAppInstance(cwd, SPEC4.appRe) !== null,
+  wire: (cwd, opts) => wireRegister(cwd, opts, SPEC4),
+  verify: (cwd) => verifyRegister(cwd, SPEC4)
+};
+
+// src/protect/install/adapters/express.ts
+var SPEC5 = {
+  appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*express\(\)/,
+  guardTemplate: "generic-guard.ts",
+  importName: "patchstackMiddleware",
+  call: (v) => `${v}.use(patchstackMiddleware);`,
+  label: "Express app",
+  manualHint: "add `app.use(patchstackMiddleware)` right after you create your express() app"
+};
+var expressAdapter = {
+  name: "express",
+  label: "Express (Node)",
+  detect: (cwd) => hasDependency(cwd, "express") && findAppInstance(cwd, SPEC5.appRe) !== null,
+  wire: (cwd, opts) => wireRegister(cwd, opts, SPEC5),
+  verify: (cwd) => verifyRegister(cwd, SPEC5)
+};
+
+// src/protect/install/index.ts
+var ADAPTERS = [
+  tanstackSupabaseAdapter,
+  nextAdapter,
+  sveltekitAdapter,
+  astroAdapter,
+  nestjsAdapter,
+  fastifyAdapter,
+  expressAdapter
+];
+function runProtect(cwd, opts = {}) {
+  const adapter = ADAPTERS.find((a) => a.detect(cwd));
+  if (adapter) {
+    const result = adapter.wire(cwd, opts);
+    return { status: "wired", adapter: adapter.name, changed: result.changed };
+  }
+  const { changed, dir } = scaffoldGeneric(cwd, opts);
+  const plan = wiringPlan(cwd, dir);
+  log(plan);
+  return { status: "scaffolded", adapter: "generic", changed, plan };
+}
+function runVerify(cwd) {
+  const adapter = ADAPTERS.find((a) => a.detect(cwd));
+  if (adapter) return { stack: adapter.label, ...adapter.verify(cwd) };
+  return { stack: "generic", ...genericVerify(cwd) };
 }
 
 // src/setup.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
 import path10 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
@@ -1822,7 +2389,7 @@ function appendHook(existing, command) {
 }
 function wireBuildScripts(cwd, packageManager) {
   const target = path10.join(cwd, "package.json");
-  const raw = readFileSync4(target, "utf8");
+  const raw = readFileSync6(target, "utf8");
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
   const build = scripts.build;
@@ -1866,7 +2433,7 @@ function wireBuildScripts(cwd, packageManager) {
   const indentMatch = raw.match(/^[\t ]+(?=")/m)?.[0];
   const indent = indentMatch?.includes("	") ? "	" : indentMatch?.length ?? 2;
   const trailingNewline = raw.endsWith("\n") ? "\n" : "";
-  writeFileSync3(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
+  writeFileSync6(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
   return packageManager === "bun" ? {
     changed: true,
     strategy: "build-chain",
@@ -1899,9 +2466,14 @@ Usage:
   patchstack-connect mark-build [options]            Stamp built HTML with a production flag +
                                                      build fingerprint, and ensure the widget
                                                      tag in built pages (run as a postbuild step)
-  patchstack-connect protect                         Install always-on runtime protection (the
-                                                     guard) into a TanStack Start + Supabase app.
-                                                     Covers the browser + server-function paths.
+  patchstack-connect protect [--demo|--check]        Install always-on runtime protection (the
+                                                     guard). Auto-wires known stacks (TanStack
+                                                     Start + Supabase); for others it scaffolds a
+                                                     generic guard + prints a wiring plan.
+                                                     --demo seeds a broad sample rule set (for
+                                                     demonstrations, not production).
+                                                     --check verifies the guard is wired (exit 1
+                                                     if not) \u2014 for the wire-then-verify loop.
   patchstack-connect guide [--full]                  Show this project's setup status (what's done,
                                                      what's missing, with tailored commands), then
                                                      print the full setup guide. --full prints the
@@ -1922,6 +2494,8 @@ Environment:
   PATCHSTACK_ENDPOINT     API endpoint (default: https://api.patchstack.com/monitor/pulse/manifest)
   PATCHSTACK_TIMEOUT_MS   Request timeout in ms (default: 30000)
   PATCHSTACK_ENVIRONMENT  Manifest environment: production | sandbox (default: production)
+  PATCHSTACK_MODE         (protect) Runtime guard mode: block (default) | dry-run
+  PATCHSTACK_ROUTE_WAF    (protect) Set to 1 to also screen every request at the route level (opt-in)
 
 Precedence: CLI flag > environment variable > .patchstackrc.json.
 
@@ -2107,9 +2681,19 @@ function reportSourceWidget(siteUuid) {
     console.warn(`Widget: skipped (${err.message}).`);
   }
 }
-async function runProtectCommand(_args) {
+async function runProtectCommand(args) {
+  if (args.flags.get("check") === true) {
+    const report = runVerify(process.cwd());
+    console.log(`patchstack protect --check (${report.stack}):`);
+    for (const c of report.checks) {
+      console.log(`  ${c.ok ? "\u2713" : "\u2717"} ${c.label}${!c.ok && c.hint ? ` \u2014 ${c.hint}` : ""}`);
+    }
+    console.log(report.wired ? "guard is wired \u2713" : "guard is NOT fully wired \u2717");
+    return report.wired ? 0 : 1;
+  }
+  const demo = args.flags.get("demo") === true;
   try {
-    runProtect(process.cwd());
+    runProtect(process.cwd(), { demo });
   } catch (err) {
     console.warn(`patchstack protect: skipped (${err.message}).`);
   }
@@ -2135,7 +2719,7 @@ async function runGuide(args) {
   console.log("\u2014\u2014\u2014\u2014 Full reference guide (ships as AGENT-INSTALL.md) \u2014\u2014\u2014\u2014");
   console.log("");
   const guidePath = new URL("../AGENT-INSTALL.md", import.meta.url);
-  console.log(readFileSync5(guidePath, "utf8"));
+  console.log(readFileSync7(guidePath, "utf8"));
   return 0;
 }
 async function runSetup(args) {
@@ -2250,7 +2834,7 @@ async function runMarkBuild(args) {
   let marked = 0;
   let widgetTouched = 0;
   for (const file of files) {
-    const before = readFileSync5(file, "utf8");
+    const before = readFileSync7(file, "utf8");
     let after = injectMarker(before, snippet);
     if (widgetUuid !== null) {
       const ensured = ensureWidgetInHtml(after, widgetUuid);
@@ -2260,7 +2844,7 @@ async function runMarkBuild(args) {
       after = ensured.html;
     }
     if (after !== before) {
-      writeFileSync4(file, after);
+      writeFileSync7(file, after);
       marked += 1;
     }
   }