@patchstack/connect 0.3.16 → 0.3.18

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
 
 // src/parsers/index.ts
 import { access } from "fs/promises";
@@ -934,6 +934,14 @@ function buildEndpointUrl(base, siteUuid) {
   const trimmed = base.replace(/\/$/, "");
   return siteUuid !== void 0 && siteUuid !== null && siteUuid.length > 0 ? `${trimmed}/${encodeURIComponent(siteUuid)}` : trimmed;
 }
+function buildRulesUrl(manifestEndpoint, siteUuid) {
+  const url = new URL(manifestEndpoint);
+  const path11 = url.pathname.replace(/\/$/, "");
+  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
 function buildClaimUrl(endpoint, siteUuid) {
   const origin = new URL(endpoint).origin;
   return `${origin}/monitor/claim?site=${encodeURIComponent(siteUuid)}`;
@@ -1004,8 +1012,212 @@ function isTimeoutError(cause) {
   return false;
 }
 
+// src/demo.ts
+import { readFile as readFile6 } from "fs/promises";
+import { join } from "path";
+var NODE_SERIALIZE_DEMO = {
+  name: "node-serialize",
+  packageName: "node-serialize",
+  packageVersion: "0.0.4",
+  ruleId: 18843,
+  maliciousBody: {
+    text: "_$$ND_FUNC$$_function(){require('child_process').exec('id')}()"
+  },
+  benignBody: { text: "buy milk" }
+};
+var SCENARIOS = /* @__PURE__ */ new Map([[NODE_SERIALIZE_DEMO.name, NODE_SERIALIZE_DEMO]]);
+var DemoError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DemoError";
+  }
+};
+var DEMO_INSTALL_COMMANDS = {
+  npm: "npm install --save-exact node-serialize@0.0.4",
+  pnpm: "pnpm add --save-exact node-serialize@0.0.4",
+  yarn: "yarn add --exact node-serialize@0.0.4",
+  bun: "bun add --exact node-serialize@0.0.4"
+};
+var DEMO_REMOVE_COMMANDS = {
+  npm: "npm uninstall node-serialize",
+  pnpm: "pnpm remove node-serialize",
+  yarn: "yarn remove node-serialize",
+  bun: "bun remove node-serialize"
+};
+function resolveDemoScenario(name) {
+  if (!name) {
+    throw new DemoError(
+      "A demo scenario is required. Available scenario: node-serialize.\nUsage: patchstack-connect demo node-serialize"
+    );
+  }
+  const scenario = SCENARIOS.get(name);
+  if (!scenario) {
+    throw new DemoError(`Unknown demo scenario "${name}". Available scenario: node-serialize.`);
+  }
+  return scenario;
+}
+async function collectDemoDependency(cwd, scenario) {
+  const manifest = await scanLockfile(cwd);
+  const versions = [
+    ...new Set(
+      manifest.packages.filter((entry) => entry.name === scenario.packageName).map((entry) => entry.version)
+    )
+  ].sort();
+  return { ready: versions.includes(scenario.packageVersion), versions };
+}
+async function inspectDemoDependency(cwd, scenario) {
+  try {
+    return await collectDemoDependency(cwd, scenario);
+  } catch {
+    return { ready: false, versions: [] };
+  }
+}
+async function assertDemoDependency(cwd, scenario) {
+  const { ready, versions } = await collectDemoDependency(cwd, scenario);
+  if (ready) return;
+  const found = versions.length > 0 ? ` Found: ${versions.join(", ")}.` : "";
+  throw new DemoError(
+    `${scenario.packageName}@${scenario.packageVersion} is not installed in the lockfile.${found}
+Add this deliberately vulnerable package first: npm install --save-exact ${scenario.packageName}@${scenario.packageVersion}`
+  );
+}
+async function readPersistedSiteUuid(cwd) {
+  try {
+    const value = JSON.parse(await readFile6(join(cwd, ".patchstackrc.json"), "utf8")).siteUuid;
+    return typeof value === "string" && value.length > 0 ? value : null;
+  } catch {
+    return null;
+  }
+}
+async function assertPersistedSiteUuid(cwd, expectedUuid) {
+  const persisted = await readPersistedSiteUuid(cwd);
+  if (persisted === null) {
+    throw new DemoError(
+      "The demo requires the Host-connected .patchstackrc.json. Connect Patchstack in Bolt first, then try again."
+    );
+  }
+  if (persisted !== expectedUuid) {
+    throw new DemoError(
+      `The active site UUID (${expectedUuid}) does not match .patchstackrc.json (${String(persisted)}). Remove the UUID override or reconnect this Bolt project before running the demo.`
+    );
+  }
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function renderDemoGuide(state) {
+  const { scenario } = state;
+  const install = DEMO_INSTALL_COMMANDS[state.packageManager].replace(
+    "node-serialize@0.0.4",
+    `${scenario.packageName}@${scenario.packageVersion}`
+  );
+  const remove = DEMO_REMOVE_COMMANDS[state.packageManager].replace(
+    "node-serialize",
+    scenario.packageName
+  );
+  const demo = state.url === "http://localhost:3000/api/tasks" ? `npx @patchstack/connect demo ${scenario.name}` : `npx @patchstack/connect demo ${scenario.name} --url ${shellQuote(state.url)}`;
+  const siteReady = state.siteUuid !== null;
+  const envReady = state.environment === "production";
+  const dependencyDetail = state.dependency.ready ? `${scenario.packageName}@${scenario.packageVersion} is in the lockfile` : state.dependency.versions.length > 0 ? `found ${scenario.packageName}@${state.dependency.versions.join(", ")}; ${scenario.packageVersion} is required` : `${scenario.packageName}@${scenario.packageVersion} is not in the lockfile`;
+  let next;
+  if (!siteReady) {
+    next = "Click \u201CConnect Patchstack\u201D in Bolt, then run this guide again.";
+  } else if (!envReady) {
+    next = "Unset PATCHSTACK_ENVIRONMENT (or set it to production), then run this guide again.";
+  } else if (!state.dependency.ready) {
+    next = install;
+  } else {
+    next = demo;
+  }
+  return [
+    `Patchstack demo guide \u2014 ${scenario.name}`,
+    "",
+    "Goal: prove that a live Patchstack virtual patch blocks the vulnerable payload while normal traffic still succeeds.",
+    "Deployment required: no. Keep the app running locally; the connector and generated guard contact Patchstack\u2019s production API.",
+    "",
+    `1. ${siteReady ? "\u2713" : "\u25CB"} Connect this project from Bolt\u2019s Host account dropdown`,
+    siteReady ? `   Ready \u2014 .patchstackrc.json contains site ${state.siteUuid}.` : "   Click \u201CConnect Patchstack\u201D in Bolt. This creates .patchstackrc.json; no separate CLI login is needed.",
+    "",
+    `2. ${state.dependency.ready ? "\u2713" : "\u25CB"} Add the deliberately vulnerable demo dependency`,
+    `   ${dependencyDetail}.`,
+    `   ${install}`,
+    "   Do not import or execute this package; its lockfile entry is enough for detection.",
+    "",
+    "3. \u25CB Run the production-backed demo setup",
+    `   ${demo}`,
+    ...envReady ? [] : ["   Blocked for now: this walkthrough needs PATCHSTACK_ENVIRONMENT=production."],
+    `   This scans the npm manifest, waits for live rule ${scenario.ruleId}, installs the server guard, verifies its wiring, and prints two test requests.`,
+    "   It does not start the server or send the requests.",
+    "",
+    "4. \u25CB Restart the local dev server",
+    "   Restart after the demo command so the application loads the generated guard.",
+    "",
+    "5. \u25CB Run both requests printed by the demo command",
+    `   Exploit: expect HTTP 403 with Patchstack rule ${scenario.ruleId}.`,
+    "   Control (\u201Cbuy milk\u201D): expect HTTP 201. This proves normal traffic is not blocked.",
+    "",
+    "6. \u25CB Clean up the throwaway vulnerability after the demonstration",
+    `   ${remove}`,
+    "   Re-run `npx @patchstack/connect scan` so the clean manifest is reported.",
+    "",
+    `Next: ${next}`
+  ].join("\n");
+}
+async function waitForDemoRule(manifestEndpoint, siteUuid, scenario, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 3e4;
+  const pollIntervalMs = options.pollIntervalMs ?? 1e3;
+  const requestTimeoutMs = options.requestTimeoutMs ?? 1e4;
+  const fetchFn = options.fetchFn ?? fetch;
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const now = options.now ?? Date.now;
+  const started = now();
+  const rulesUrl = buildRulesUrl(manifestEndpoint, siteUuid);
+  let lastDetail = "the rule list was empty";
+  do {
+    try {
+      const response = await fetchFn(rulesUrl, {
+        headers: { Accept: "application/json", "User-Agent": "@patchstack/connect" },
+        signal: AbortSignal.timeout(requestTimeoutMs)
+      });
+      if (response.ok) {
+        const data = await response.json();
+        const rules = Array.isArray(data.firewall) ? data.firewall : [];
+        const matched = rules.find((rule) => String(rule.id) === String(scenario.ruleId));
+        if (matched) return matched;
+        lastDetail = `${rules.length} firewall rule(s) returned without rule ${scenario.ruleId}`;
+      } else {
+        lastDetail = `the rules API returned HTTP ${response.status}`;
+      }
+    } catch (error) {
+      lastDetail = `the rules request failed: ${error.message}`;
+    }
+    const remaining = timeoutMs - (now() - started);
+    if (remaining <= 0) break;
+    await sleep(Math.min(pollIntervalMs, remaining));
+  } while (now() - started <= timeoutMs);
+  throw new DemoError(
+    `Timed out waiting for Patchstack rule ${scenario.ruleId} for site ${siteUuid}; ${lastDetail}.`
+  );
+}
+function renderDemoTestCommands(url, scenario) {
+  const shellUrl = shellQuote(url);
+  const command = (body) => {
+    const encoded = Buffer.from(JSON.stringify(body)).toString("base64");
+    return `node -e "process.stdout.write(Buffer.from('${encoded}','base64'))" | curl -i -X POST --url ${shellUrl} -H "Content-Type: application/json" --data-binary @-`;
+  };
+  return [
+    "Restart the dev server so it loads the generated guard, then run:",
+    "",
+    `Blocked exploit (expect HTTP 403 and rule ${scenario.ruleId}):`,
+    command(scenario.maliciousBody),
+    "",
+    "Benign request (expect HTTP 201):",
+    command(scenario.benignBody)
+  ].join("\n");
+}
+
 // src/config.ts
-import { readFile as readFile6, writeFile } from "fs/promises";
+import { readFile as readFile7, writeFile } from "fs/promises";
 import path6 from "path";
 var CONFIG_FILENAME = ".patchstackrc.json";
 var DEFAULT_ENVIRONMENT = "production";
@@ -1057,7 +1269,7 @@ async function readConfigFile(cwd) {
   const target = path6.join(cwd, CONFIG_FILENAME);
   let raw;
   try {
-    raw = await readFile6(target, "utf8");
+    raw = await readFile7(target, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return {};
@@ -1661,16 +1873,65 @@ function renderGuideChecklist(state, useColor) {
   return lines.join("\n");
 }
 
-// src/protect/install.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync4, mkdirSync, copyFileSync } from "fs";
-import { join, dirname } from "path";
+// src/protect/install/util.ts
+import { readFileSync as readFileSync3, existsSync as existsSync4, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2, dirname } from "path";
 import { fileURLToPath } from "url";
-var HERE = dirname(fileURLToPath(import.meta.url));
-var TEMPLATES = [join(HERE, "protect", "templates"), join(HERE, "templates")].find((p) => existsSync4(p)) ?? join(HERE, "protect", "templates");
-var APP = process.cwd();
-var PS_DIR = join(APP, "src/integrations/patchstack");
 var read = (p) => readFileSync3(p, "utf8");
 var log = (msg) => console.log(`patchstack protect: ${msg}`);
+function hasDependency(cwd, name) {
+  try {
+    const pkg = JSON.parse(read(join2(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }[name]);
+  } catch {
+    return false;
+  }
+}
+var SITE_UUID_PLACEHOLDER = "__PATCHSTACK_SITE_UUID__";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function bakeSiteUuid(cwd, guardRelPath) {
+  const rc = join2(cwd, ".patchstackrc.json");
+  if (!existsSync4(rc)) {
+    log("no .patchstackrc.json \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
+    return false;
+  }
+  let uuid;
+  try {
+    uuid = JSON.parse(read(rc)).siteUuid;
+  } catch {
+    log(".patchstackrc.json unreadable \u2014 skipping site-UUID bake");
+    return false;
+  }
+  if (typeof uuid !== "string" || !UUID_RE.test(uuid)) {
+    log(".patchstackrc.json siteUuid missing or malformed \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
+    return false;
+  }
+  const guardPath = join2(cwd, guardRelPath);
+  if (!existsSync4(guardPath)) return false;
+  const source = read(guardPath);
+  if (!source.includes(SITE_UUID_PLACEHOLDER)) {
+    log(`${guardRelPath} site UUID already baked`);
+    return false;
+  }
+  writeFileSync2(guardPath, source.replace(SITE_UUID_PLACEHOLDER, uuid));
+  log(`baked site UUID into ${guardRelPath} \u2014 live rules from the Patchstack API`);
+  return true;
+}
+var HERE = dirname(fileURLToPath(import.meta.url));
+function templatesDir() {
+  const builtLayout = join2(HERE, "protect", "templates");
+  const candidates = [
+    builtLayout,
+    join2(HERE, "..", "templates"),
+    // source: src/protect/install/ → src/protect/templates
+    join2(HERE, "templates")
+  ];
+  return candidates.find((p) => existsSync4(p)) ?? builtLayout;
+}
+
+// src/protect/install/adapters/tanstack-supabase.ts
+import { writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync, copyFileSync } from "fs";
+import { join as join3 } from "path";
 var CLIENT_TUNNEL = [
   "",
   "    // PATCHSTACK: in the browser, tunnel Supabase traffic through the app's own server guard",
@@ -1684,101 +1945,127 @@ var CLIENT_TUNNEL = [
   "    }",
   ""
 ].join("\n");
-var START_IMPORTS = [
-  'import { getRequest } from "@tanstack/react-start/server";',
-  'import { GUARD_PATH, handleGuardRequest, inspectServerFn, screenResponse } from "@/integrations/patchstack/guard";'
-].join("\n");
-var REQUEST_MIDDLEWARE_DEF = [
-  "",
-  "// Patchstack guard (browser tunnel): intercept tunneled Supabase traffic before anything else,",
-  "// then screen the outgoing response (SSR HTML / data) for leaked secrets & PII.",
+var GUARD_IMPORT = 'import { GUARD_PATH, handleGuardRequest, inspectServerFn, screenResponse, guardRequest } from "@/integrations/patchstack/guard";';
+var GUARD_IMPORT_RE = /import \{[^}]*\} from "@\/integrations\/patchstack\/guard";/;
+var START_IMPORTS = ['import { getRequest } from "@tanstack/react-start/server";', GUARD_IMPORT].join("\n");
+var REQUEST_MIDDLEWARE_BLOCK = [
+  "// #region patchstack-guard (managed by patchstack-connect protect \u2014 do not edit)",
+  "// Browser\u2192Supabase tunnel + response screening; optional route WAF via PATCHSTACK_ROUTE_WAF=1.",
   "const patchstackGuard = createMiddleware().server(async ({ next }) => {",
   "  const request = getRequest();",
   "  if (request) {",
   "    const { pathname } = new URL(request.url);",
   "    if (pathname === GUARD_PATH) return handleGuardRequest(request);",
+  '    if (process.env.PATCHSTACK_ROUTE_WAF === "1") {',
+  "      const blocked = await guardRequest(request);",
+  "      if (blocked) return blocked;",
+  "    }",
   "  }",
   "  return screenResponse(await next());",
   "});",
-  ""
+  "// #endregion patchstack-guard"
 ].join("\n");
-var FUNCTION_MIDDLEWARE_DEF = [
-  "",
-  "// Patchstack guard (server functions): inspect server-fn args before they reach the database,",
-  "// covering apps that mutate via TanStack server functions (which bypass the browser tunnel).",
+var FUNCTION_MIDDLEWARE_BLOCK = [
+  "// #region patchstack-function-guard (managed by patchstack-connect protect \u2014 do not edit)",
+  "// Inspect server-function args before they reach the database.",
   'const patchstackFunctionGuard = createMiddleware({ type: "function" }).server(async ({ next, data }) => {',
   "  const blocked = await inspectServerFn(data);",
   "  if (blocked) throw new Error(blocked.message);",
   "  return next();",
   "});",
-  ""
+  "// #endregion patchstack-function-guard"
 ].join("\n");
-function detectSupportedStack(cwd) {
-  const pkgPath = join(cwd, "package.json");
-  if (!existsSync4(pkgPath)) return false;
-  const pkg = JSON.parse(read(pkgPath));
-  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
-  return Boolean(deps["@tanstack/react-start"]) && existsSync4(join(cwd, "src/start.ts")) && existsSync4(join(cwd, "src/integrations/supabase/client.ts"));
-}
-function scaffold(cwd) {
-  const dst = join(cwd, "src/integrations/patchstack");
-  mkdirSync(dst, { recursive: true });
-  copyFileSync(join(TEMPLATES, "guard.ts"), join(dst, "guard.ts"));
-  copyFileSync(join(TEMPLATES, "rules.json"), join(dst, "rules.json"));
-  log("scaffolded guard.ts + rules.json");
-}
-function bakeSiteUuid(cwd) {
-  const rc = join(cwd, ".patchstackrc.json");
-  if (!existsSync4(rc)) return log("no .patchstackrc.json \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
-  let uuid;
+function reconcileBlock(s, region, block, legacyConst, insertBefore) {
+  const lines = s.split("\n");
+  const startMarker = `// #region ${region} `;
+  const endMarker = `// #endregion ${region}`;
+  const si = lines.findIndex((l) => l.includes(startMarker));
+  if (si !== -1) {
+    const ei = lines.findIndex((l, i) => i > si && l.trim() === endMarker);
+    if (ei !== -1) {
+      lines.splice(si, ei - si + 1, ...block.split("\n"));
+      return lines.join("\n");
+    }
+  }
+  const ci = lines.findIndex((l) => l.includes(legacyConst));
+  if (ci !== -1) {
+    const close = lines.findIndex((l, i) => i >= ci && l.trim() === "});");
+    if (close !== -1) {
+      let start = ci;
+      while (start > 0 && (lines[start - 1] ?? "").trim().startsWith("//")) start--;
+      lines.splice(start, close - start + 1, ...block.split("\n"));
+      return lines.join("\n");
+    }
+  }
+  return s.replace(insertBefore, block + "\n\n" + insertBefore);
+}
+function detect(cwd) {
+  const pkgPath = join3(cwd, "package.json");
+  if (!existsSync5(pkgPath)) return false;
+  let pkg;
   try {
-    uuid = JSON.parse(read(rc)).siteUuid;
+    pkg = JSON.parse(read(pkgPath));
   } catch {
-    return log(".patchstackrc.json unreadable \u2014 skipping site-UUID bake");
+    return false;
   }
-  if (!uuid || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(uuid)) {
-    return log(".patchstackrc.json siteUuid missing or malformed \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  return Boolean(deps["@tanstack/react-start"]) && existsSync5(join3(cwd, "src/start.ts")) && existsSync5(join3(cwd, "src/integrations/supabase/client.ts"));
+}
+var GUARD_FILE = "src/integrations/patchstack/guard.ts";
+function scaffold(cwd, opts) {
+  const templates = templatesDir();
+  const dst = join3(cwd, "src/integrations/patchstack");
+  mkdirSync(dst, { recursive: true });
+  copyFileSync(join3(templates, "guard.ts"), join3(dst, "guard.ts"));
+  const changed = [GUARD_FILE];
+  const rulesDst = join3(dst, "rules.json");
+  if (opts.demo) {
+    copyFileSync(join3(templates, "demo-rules.json"), rulesDst);
+    changed.push("src/integrations/patchstack/rules.json");
+    log("scaffolded guard.ts + rules.json (demo sample rule set)");
+  } else if (!existsSync5(rulesDst)) {
+    copyFileSync(join3(templates, "rules.json"), rulesDst);
+    changed.push("src/integrations/patchstack/rules.json");
+    log("scaffolded guard.ts + rules.json (starter rules)");
+  } else {
+    log("scaffolded guard.ts (kept existing rules.json)");
   }
-  const p = join(cwd, "src/integrations/patchstack/guard.ts");
-  if (!existsSync4(p)) return;
-  const s = read(p);
-  if (!s.includes("__PATCHSTACK_SITE_UUID__")) return log("guard.ts site UUID already baked");
-  writeFileSync2(p, s.replace("__PATCHSTACK_SITE_UUID__", uuid));
-  log("baked site UUID into guard.ts \u2014 live rules from the Patchstack API");
+  return changed;
 }
 function patchClient(cwd) {
-  const p = join(cwd, "src/integrations/supabase/client.ts");
-  let s = read(p);
-  if (s.includes("x-ps-target")) return log("client.ts already wired");
+  const p = join3(cwd, "src/integrations/supabase/client.ts");
+  const s = read(p);
+  if (s.includes("x-ps-target")) {
+    log("client.ts already wired");
+    return false;
+  }
   const anchor = "headers.set('apikey', supabaseKey);";
-  if (!s.includes(anchor)) return log("client.ts anchor not found \u2014 skipping (template changed?)");
-  writeFileSync2(p, s.replace(anchor, anchor + "\n" + CLIENT_TUNNEL));
+  if (!s.includes(anchor)) {
+    log("client.ts anchor not found \u2014 skipping (template changed?)");
+    return false;
+  }
+  writeFileSync3(p, s.replace(anchor, anchor + "\n" + CLIENT_TUNNEL));
   log("patched client.ts (tunnel Supabase through the guard)");
+  return true;
 }
 function patchStart(cwd) {
-  const p = join(cwd, "src/start.ts");
+  const p = join3(cwd, "src/start.ts");
   let s = read(p);
   const importAnchor = 'import { createStart, createMiddleware } from "@tanstack/react-start";';
   const exportAnchor = "export const startInstance";
   const rmAnchor = "requestMiddleware: [";
   if (!s.includes(importAnchor) || !s.includes(exportAnchor)) {
-    return log("start.ts anchors not found \u2014 skipping (template changed?)");
+    log("start.ts anchors not found \u2014 skipping (template changed?)");
+    return false;
   }
   const original = s;
-  if (!s.includes("@/integrations/patchstack/guard")) {
+  if (GUARD_IMPORT_RE.test(s)) {
+    s = s.replace(GUARD_IMPORT_RE, GUARD_IMPORT);
+  } else {
     s = s.replace(importAnchor, importAnchor + "\n" + START_IMPORTS);
-  } else if (!s.includes("inspectServerFn")) {
-    s = s.replace(
-      'import { GUARD_PATH, handleGuardRequest } from "@/integrations/patchstack/guard";',
-      'import { GUARD_PATH, handleGuardRequest, inspectServerFn } from "@/integrations/patchstack/guard";'
-    );
-  }
-  if (!s.includes("const patchstackGuard =")) {
-    s = s.replace(exportAnchor, REQUEST_MIDDLEWARE_DEF + "\n" + exportAnchor);
-  }
-  if (!s.includes("const patchstackFunctionGuard =")) {
-    s = s.replace(exportAnchor, FUNCTION_MIDDLEWARE_DEF + "\n" + exportAnchor);
   }
+  s = reconcileBlock(s, "patchstack-guard", REQUEST_MIDDLEWARE_BLOCK, "const patchstackGuard =", exportAnchor);
+  s = reconcileBlock(s, "patchstack-function-guard", FUNCTION_MIDDLEWARE_BLOCK, "const patchstackFunctionGuard =", exportAnchor);
   if (s.includes(rmAnchor) && !s.includes("requestMiddleware: [patchstackGuard")) {
     s = s.replace(rmAnchor, rmAnchor + "patchstackGuard, ");
   }
@@ -1790,24 +2077,579 @@ function patchStart(cwd) {
       s = s.replace(rmAnchor, "functionMiddleware: [patchstackFunctionGuard],\n    " + rmAnchor);
     }
   }
-  if (s === original) return log("start.ts already wired");
-  writeFileSync2(p, s);
+  if (s === original) {
+    log("start.ts already wired");
+    return false;
+  }
+  writeFileSync3(p, s);
   log("patched start.ts (guard registered as request + function middleware)");
+  return true;
+}
+function wire(cwd, opts) {
+  const changed = scaffold(cwd, opts);
+  if (!opts.demo && bakeSiteUuid(cwd, GUARD_FILE)) changed.push(GUARD_FILE);
+  if (patchClient(cwd)) changed.push("src/integrations/supabase/client.ts");
+  if (patchStart(cwd)) changed.push("src/start.ts");
+  log(
+    opts.demo ? "done \u2014 guard wired with the demo sample rules (blocks by default). Set PATCHSTACK_MODE=dry-run for log-only." : "done \u2014 guard wired and always-on (blocks by default). Set PATCHSTACK_MODE=dry-run for log-only."
+  );
+  return { ok: true, changed: [...new Set(changed)] };
+}
+function verify(cwd) {
+  const guardPath = join3(cwd, GUARD_FILE);
+  const clientPath = join3(cwd, "src/integrations/supabase/client.ts");
+  const startPath = join3(cwd, "src/start.ts");
+  const guard = existsSync5(guardPath) ? read(guardPath) : "";
+  const client = existsSync5(clientPath) ? read(clientPath) : "";
+  const start = existsSync5(startPath) ? read(startPath) : "";
+  const checks = [
+    { label: "guard.ts scaffolded", ok: guard.length > 0, hint: "run `patchstack-connect protect`" },
+    { label: "Supabase client tunnels through the guard", ok: client.includes("x-ps-target"), hint: "run `patchstack-connect protect` to re-patch src/integrations/supabase/client.ts" },
+    { label: "request middleware defined + registered", ok: start.includes("const patchstackGuard =") && start.includes("requestMiddleware: [patchstackGuard"), hint: "run `patchstack-connect protect` to re-patch src/start.ts" },
+    { label: "server-function middleware defined + registered", ok: start.includes("const patchstackFunctionGuard =") && start.includes("functionMiddleware: [patchstackFunctionGuard"), hint: "run `patchstack-connect protect` to re-patch src/start.ts" }
+  ];
+  return { wired: checks.every((c) => c.ok), checks };
+}
+var tanstackSupabaseAdapter = {
+  name: "tanstack-supabase",
+  label: "TanStack Start + Supabase",
+  detect,
+  wire,
+  verify
+};
+
+// src/protect/install/adapters/next.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, copyFileSync as copyFileSync2 } from "fs";
+import { join as join4 } from "path";
+function hasNextDep(cwd) {
+  try {
+    const pkg = JSON.parse(read(join4(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.next);
+  } catch {
+    return false;
+  }
 }
-function runProtect(cwd) {
-  if (!detectSupportedStack(cwd)) {
-    log("runtime protection currently supports TanStack Start + Supabase apps; stack not detected \u2014 skipping.");
-    return;
+function middlewareInfo(cwd) {
+  const candidates = ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"];
+  for (const rel of candidates) {
+    if (existsSync6(join4(cwd, rel))) return { relDir: rel.includes("/") ? "src" : ".", relFile: rel, exists: true };
+  }
+  const useSrc = existsSync6(join4(cwd, "src"));
+  return { relDir: useSrc ? "src" : ".", relFile: useSrc ? "src/middleware.ts" : "middleware.ts", exists: false };
+}
+function detect2(cwd) {
+  return hasNextDep(cwd);
+}
+function rulesFile(relDir) {
+  return relDir === "." ? "patchstack.rules.json" : `${relDir}/patchstack.rules.json`;
+}
+function wire2(cwd, opts) {
+  const templates = templatesDir();
+  const mw = middlewareInfo(cwd);
+  const dir = join4(cwd, mw.relDir === "." ? "" : mw.relDir);
+  mkdirSync2(dir, { recursive: true });
+  const rulesDst = join4(dir, "patchstack.rules.json");
+  const changed = [];
+  if (opts.demo || !existsSync6(rulesDst)) {
+    copyFileSync2(join4(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    changed.push(rulesFile(mw.relDir));
+  }
+  const mwPath = join4(cwd, mw.relFile);
+  const existing = mw.exists ? read(mwPath) : "";
+  if (mw.exists && !existing.includes("patchstack-next")) {
+    log(
+      `existing ${mw.relFile} left untouched \u2014 scaffolded ${rulesFile(mw.relDir)}; add the guard to your middleware: import { createProtection } from "@patchstack/connect/protect", run fetchGuard() on the request, and return the block Response. Then: npx patchstack-connect protect --check`
+    );
+    return { ok: true, changed };
+  }
+  copyFileSync2(join4(templates, "next-middleware.ts"), mwPath);
+  if (!opts.demo) bakeSiteUuid(cwd, mw.relFile);
+  changed.push(mw.relFile);
+  log(mw.exists ? `refreshed ${mw.relFile} (Patchstack middleware)` : `scaffolded ${mw.relFile} (Patchstack middleware)`);
+  return { ok: true, changed: [...new Set(changed)] };
+}
+function verify2(cwd) {
+  const mw = middlewareInfo(cwd);
+  const present = mw.exists && read(join4(cwd, mw.relFile)).includes("patchstack-next");
+  const rulesPresent = existsSync6(join4(cwd, rulesFile(mw.relDir)));
+  return {
+    wired: present && rulesPresent,
+    checks: [
+      { label: "Patchstack middleware present", ok: present, hint: `run \`patchstack-connect protect\` (writes ${mw.relFile})` },
+      { label: "rules co-located with the middleware", ok: rulesPresent, hint: "run `patchstack-connect protect`" }
+    ]
+  };
+}
+var nextAdapter = {
+  name: "nextjs",
+  label: "Next.js",
+  detect: detect2,
+  wire: wire2,
+  verify: verify2
+};
+
+// src/protect/install/adapters/sveltekit.ts
+import { join as join6 } from "path";
+
+// src/protect/install/seam.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, copyFileSync as copyFileSync3 } from "fs";
+import { join as join5, dirname as dirname2 } from "path";
+function rulesRel(seamRel) {
+  const d = dirname2(seamRel);
+  return (d === "." ? "patchstack.rules.json" : `${d}/patchstack.rules.json`).replace(/\\/g, "/");
+}
+function wireSeam(cwd, opts, spec) {
+  const templates = templatesDir();
+  const existing = spec.candidates.find((c) => existsSync7(join5(cwd, c)));
+  const seamRel = existing ?? spec.target;
+  mkdirSync3(dirname2(join5(cwd, seamRel)), { recursive: true });
+  const rulesDst = join5(cwd, rulesRel(seamRel));
+  const changed = [];
+  if (opts.demo || !existsSync7(rulesDst)) {
+    copyFileSync3(join5(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    changed.push(rulesRel(seamRel));
+  }
+  const current = existing ? read(join5(cwd, existing)) : "";
+  if (existing && !current.includes(spec.marker)) {
+    log(`existing ${existing} left untouched \u2014 scaffolded ${rulesRel(seamRel)}; ${spec.planHint}`);
+    return { ok: true, changed };
+  }
+  copyFileSync3(join5(templates, spec.templateName), join5(cwd, seamRel));
+  if (!opts.demo) bakeSiteUuid(cwd, seamRel);
+  changed.push(seamRel);
+  log(existing ? `refreshed ${seamRel}` : `scaffolded ${seamRel}`);
+  return { ok: true, changed: [...new Set(changed)] };
+}
+function verifySeam(cwd, spec) {
+  const existing = spec.candidates.find((c) => existsSync7(join5(cwd, c)));
+  const seamRel = existing ?? spec.target;
+  const present = existing ? read(join5(cwd, existing)).includes(spec.marker) : false;
+  const rulesPresent = existsSync7(join5(cwd, rulesRel(seamRel)));
+  return {
+    wired: present && rulesPresent,
+    checks: [
+      { label: `${spec.seamLabel} present`, ok: present, hint: `run \`patchstack-connect protect\` (writes ${spec.target})` },
+      { label: "rules co-located with the guard", ok: rulesPresent, hint: "run `patchstack-connect protect`" }
+    ]
+  };
+}
+
+// src/protect/install/adapters/sveltekit.ts
+var SPEC = {
+  templateName: "sveltekit-hooks.ts",
+  candidates: ["src/hooks.server.ts", "src/hooks.server.js"],
+  target: "src/hooks.server.ts",
+  marker: "patchstack-sveltekit",
+  planHint: 'add the guard to your `handle` (compose with `sequence()` from "@sveltejs/kit/hooks"), then: npx patchstack-connect protect --check',
+  seamLabel: "SvelteKit server hook"
+};
+function detect3(cwd) {
+  try {
+    const pkg = JSON.parse(read(join6(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }["@sveltejs/kit"]);
+  } catch {
+    return false;
+  }
+}
+function wire3(cwd, opts) {
+  return wireSeam(cwd, opts, SPEC);
+}
+function verify3(cwd) {
+  return verifySeam(cwd, SPEC);
+}
+var sveltekitAdapter = {
+  name: "sveltekit",
+  label: "SvelteKit",
+  detect: detect3,
+  wire: wire3,
+  verify: verify3
+};
+
+// src/protect/install/adapters/astro.ts
+import { join as join7 } from "path";
+var SPEC2 = {
+  templateName: "astro-middleware.ts",
+  candidates: ["src/middleware.ts", "src/middleware.js", "src/middleware/index.ts", "src/middleware/index.js"],
+  target: "src/middleware.ts",
+  marker: "patchstack-astro",
+  planHint: 'add the guard to your `onRequest` (compose with `sequence()` from "astro:middleware"), then: npx patchstack-connect protect --check',
+  seamLabel: "Astro middleware"
+};
+function detect4(cwd) {
+  try {
+    const pkg = JSON.parse(read(join7(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.astro);
+  } catch {
+    return false;
+  }
+}
+function wire4(cwd, opts) {
+  return wireSeam(cwd, opts, SPEC2);
+}
+function verify4(cwd) {
+  return verifySeam(cwd, SPEC2);
+}
+var astroAdapter = {
+  name: "astro",
+  label: "Astro",
+  detect: detect4,
+  wire: wire4,
+  verify: verify4
+};
+
+// src/protect/install/find-app.ts
+import { readFileSync as readFileSync4, existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
+import { join as join8, relative, dirname as dirname3 } from "path";
+function findAppInstance(cwd, re) {
+  const root = existsSync8(join8(cwd, "src")) ? join8(cwd, "src") : cwd;
+  let hit = null;
+  const walk2 = (dir) => {
+    if (hit) return;
+    let entries;
+    try {
+      entries = readdirSync3(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (hit) return;
+      if (name === "node_modules" || name === "patchstack" || name.startsWith(".")) continue;
+      const p = join8(dir, name);
+      let st;
+      try {
+        st = statSync3(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) walk2(p);
+      else if (/\.(?:ts|js|mjs|cjs)$/.test(name)) {
+        let src;
+        try {
+          src = readFileSync4(p, "utf8");
+        } catch {
+          continue;
+        }
+        const m = re.exec(src);
+        if (m) hit = { relPath: relative(cwd, p).replace(/\\/g, "/"), appVar: m[1] };
+      }
+    }
+  };
+  walk2(root);
+  return hit;
+}
+function importSpecifier(fromRel, toRel, preserveExtension = false) {
+  let spec = relative(dirname3(fromRel), toRel).replace(/\\/g, "/");
+  if (!preserveExtension) spec = spec.replace(/\.(?:ts|js)$/, "");
+  if (!spec.startsWith(".")) spec = `./${spec}`;
+  return spec;
+}
+
+// src/protect/install/register.ts
+import { writeFileSync as writeFileSync5, existsSync as existsSync10 } from "fs";
+import { join as join10 } from "path";
+
+// src/protect/install/generic.ts
+import { readFileSync as readFileSync5, existsSync as existsSync9, mkdirSync as mkdirSync4, copyFileSync as copyFileSync4, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
+import { join as join9 } from "path";
+var GUARD_MARKER = "patchstack/guard";
+function genericDir(cwd) {
+  return existsSync9(join9(cwd, "src")) ? "src/patchstack" : "patchstack";
+}
+function scaffoldGeneric(cwd, opts, guardTemplate = "generic-guard.ts", guardFile = "guard.ts") {
+  const templates = templatesDir();
+  const dir = genericDir(cwd);
+  const dst = join9(cwd, dir);
+  mkdirSync4(dst, { recursive: true });
+  copyFileSync4(join9(templates, guardTemplate), join9(dst, guardFile));
+  const guardRel = `${dir}/${guardFile}`;
+  const changed = [guardRel];
+  if (!opts.demo) bakeSiteUuid(cwd, guardRel);
+  const rulesDst = join9(dst, "rules.json");
+  if (opts.demo || !existsSync9(rulesDst)) {
+    copyFileSync4(join9(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    changed.push(`${dir}/rules.json`);
+  }
+  return { changed, dir };
+}
+function candidateEntries(cwd) {
+  const names = [
+    "src/server.ts",
+    "src/server.js",
+    "src/index.ts",
+    "src/index.js",
+    "src/app.ts",
+    "src/app.js",
+    "src/main.ts",
+    "server.ts",
+    "server.js",
+    "index.ts",
+    "index.js",
+    "app.ts",
+    "app.js"
+  ];
+  const hits = names.filter((n) => existsSync9(join9(cwd, n)));
+  try {
+    const pkg = JSON.parse(read(join9(cwd, "package.json")));
+    if (typeof pkg.main === "string" && existsSync9(join9(cwd, pkg.main))) hits.push(pkg.main);
+  } catch {
   }
-  scaffold(cwd);
-  bakeSiteUuid(cwd);
-  patchClient(cwd);
-  patchStart(cwd);
-  log("done \u2014 guard wired and always-on (blocks by default). Set PATCHSTACK_MODE=dry-run for log-only.");
+  return [...new Set(hits)];
+}
+function usesExpress(cwd) {
+  try {
+    const pkg = JSON.parse(read(join9(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.express);
+  } catch {
+    return false;
+  }
+}
+function wiringPlan(cwd, dir) {
+  const entries = candidateEntries(cwd);
+  const express = usesExpress(cwd);
+  const lines = [
+    `no built-in adapter matched this stack \u2014 scaffolded a generic guard at ${dir}/guard.ts + ${dir}/rules.json.`,
+    "Finish by wiring it into your server (pick the one that fits):",
+    `  \u2022 Web-Fetch entry:  export default { fetch: protectFetch(yourHandler) }   // import from "${dir}/guard"`,
+    `  \u2022 Node / Express:   app.use(patchstackMiddleware)                          // add before your routes`,
+    entries.length ? `Likely server ${entries.length === 1 ? "entry" : "entries"}: ${entries.join(", ")}${express ? "  (Express detected)" : ""}.` : "Could not locate a server entry \u2014 wire it wherever requests enter your app.",
+    "Then confirm it is hooked up:  npx patchstack-connect protect --check"
+  ];
+  return lines.join("\n");
+}
+function genericVerify(cwd) {
+  const dir = genericDir(cwd);
+  const scaffolded = existsSync9(join9(cwd, dir, "guard.ts"));
+  const imported = scaffolded && guardIsImported(cwd, join9(cwd, dir, "guard.ts"));
+  return {
+    wired: scaffolded && imported,
+    checks: [
+      { label: "generic guard scaffolded", ok: scaffolded, hint: "run `patchstack-connect protect`" },
+      {
+        label: "guard imported into a server entry",
+        ok: imported,
+        hint: `import { protectFetch } (or patchstackMiddleware) from "${dir}/guard" and wire it into your request path`
+      }
+    ]
+  };
+}
+function guardIsImported(cwd, guardPath) {
+  const root = existsSync9(join9(cwd, "src")) ? join9(cwd, "src") : cwd;
+  let found = false;
+  const walk2 = (d) => {
+    if (found) return;
+    let entries;
+    try {
+      entries = readdirSync4(d);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (found) return;
+      if (name === "node_modules" || name.startsWith(".")) continue;
+      const p = join9(d, name);
+      let st;
+      try {
+        st = statSync4(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) walk2(p);
+      else if (/\.(?:ts|tsx|js|jsx|mjs|cjs)$/.test(name) && p !== guardPath) {
+        try {
+          if (readFileSync5(p, "utf8").includes(GUARD_MARKER)) found = true;
+        } catch {
+        }
+      }
+    }
+  };
+  walk2(root);
+  return found;
+}
+
+// src/protect/install/register.ts
+var REGION = "// #region patchstack (managed by patchstack-connect protect \u2014 do not edit)";
+function guardTarget(cwd, entryRel, spec) {
+  if (/\.cjs$/.test(entryRel) || /\.js$/.test(entryRel) && packageType(cwd) !== "module") {
+    if (spec.guardTemplateCjs) {
+      return {
+        template: spec.guardTemplateCjs,
+        file: "guard.cjs",
+        importLine: (name, target) => `const { ${name} } = require("${target}");`,
+        preserveExtension: true
+      };
+    }
+  } else if (/\.(?:js|mjs)$/.test(entryRel) && spec.guardTemplateEsm) {
+    return {
+      template: spec.guardTemplateEsm,
+      file: entryRel.endsWith(".mjs") ? "guard.mjs" : "guard.js",
+      importLine: (name, target) => `import { ${name} } from "${target}";`,
+      preserveExtension: true
+    };
+  }
+  return {
+    template: spec.guardTemplate,
+    file: "guard.ts",
+    importLine: (name, target) => `import { ${name} } from "${target}";`,
+    preserveExtension: false
+  };
+}
+function packageType(cwd) {
+  try {
+    return JSON.parse(read(join10(cwd, "package.json"))).type;
+  } catch {
+    return void 0;
+  }
+}
+function wireRegister(cwd, opts, spec) {
+  const entry = findAppInstance(cwd, spec.appRe);
+  if (!entry) {
+    const { changed: changed2 } = scaffoldGeneric(cwd, opts, spec.guardTemplate);
+    log(`${spec.label} not located \u2014 scaffolded guard; ${spec.manualHint}`);
+    return { ok: true, changed: changed2 };
+  }
+  const target = guardTarget(cwd, entry.relPath, spec);
+  const { changed, dir } = scaffoldGeneric(cwd, opts, target.template, target.file);
+  const p = join10(cwd, entry.relPath);
+  const s = read(p);
+  if (s.includes(spec.importName)) {
+    log(`${entry.relPath} already wired`);
+    return { ok: true, changed };
+  }
+  const sourceLines = s.split("\n");
+  const sourceAppIdx = sourceLines.findIndex((line) => spec.appRe.test(line));
+  const requiredAnchor = spec.callAfter?.(entry.appVar);
+  if (spec.requireCallAfter && requiredAnchor && !sourceLines.some((line, index) => index > sourceAppIdx && requiredAnchor.test(line))) {
+    log(`${entry.relPath} body-parser anchor not found \u2014 scaffolded guard; ${spec.manualHint}`);
+    return { ok: true, changed };
+  }
+  const importLine = target.importLine(
+    spec.importName,
+    importSpecifier(entry.relPath, `${dir}/${target.file}`, target.preserveExtension)
+  );
+  const lines = s.split("\n");
+  let lastImport = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (/^\s*(?:import\b|(?:const|let|var)\s+.+?=\s*require\()/.test(lines[i] ?? "")) lastImport = i;
+  }
+  lines.splice(lastImport + 1, 0, importLine);
+  const appIdx = lines.findIndex((l) => spec.appRe.test(l));
+  if (appIdx !== -1) {
+    const preferred = spec.callAfter?.(entry.appVar);
+    const preferredIdx = preferred ? lines.findIndex((line, index) => index > appIdx && preferred.test(line)) : -1;
+    const callIdx = preferredIdx === -1 ? appIdx : preferredIdx;
+    lines.splice(callIdx + 1, 0, REGION, spec.call(entry.appVar), "// #endregion patchstack");
+  }
+  writeFileSync5(p, lines.join("\n"));
+  changed.push(entry.relPath);
+  log(`patched ${entry.relPath} (${spec.call(entry.appVar).trim()})`);
+  return { ok: true, changed: [...new Set(changed)] };
+}
+function verifyRegister(cwd, spec) {
+  const dir = existsSync10(join10(cwd, "src")) ? "src/patchstack" : "patchstack";
+  const entry = findAppInstance(cwd, spec.appRe);
+  const target = entry ? guardTarget(cwd, entry.relPath, spec) : null;
+  const scaffolded = target ? existsSync10(join10(cwd, dir, target.file)) : false;
+  const entrySource = entry ? read(join10(cwd, entry.relPath)) : "";
+  const entryLines = entrySource.split("\n");
+  const anchor = entry && spec.callAfter ? spec.callAfter(entry.appVar) : null;
+  const anchorIndex = anchor ? entryLines.findIndex((line) => anchor.test(line)) : -1;
+  const callIndex = entry ? entryLines.findIndex((line) => line.includes(spec.call(entry.appVar))) : -1;
+  const ordered = anchor ? anchorIndex !== -1 && callIndex > anchorIndex : callIndex !== -1;
+  const wired = entrySource.includes(spec.importName) && ordered;
+  return {
+    wired: scaffolded && wired,
+    checks: [
+      { label: `${spec.label} guard scaffolded`, ok: scaffolded, hint: "run `patchstack-connect protect`" },
+      { label: `guard registered on the ${spec.label}`, ok: wired, hint: spec.manualHint }
+    ]
+  };
+}
+
+// src/protect/install/adapters/nestjs.ts
+var SPEC3 = {
+  appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*await\s+NestFactory\.create/,
+  guardTemplate: "generic-guard.ts",
+  importName: "patchstackMiddleware",
+  call: (v) => `${v}.use(patchstackMiddleware);`,
+  label: "NestJS app",
+  manualHint: "add `app.use(patchstackMiddleware)` right after your NestFactory.create(...) call"
+};
+var nestjsAdapter = {
+  name: "nestjs",
+  label: "NestJS",
+  detect: (cwd) => hasDependency(cwd, "@nestjs/core") && findAppInstance(cwd, SPEC3.appRe) !== null,
+  wire: (cwd, opts) => wireRegister(cwd, opts, SPEC3),
+  verify: (cwd) => verifyRegister(cwd, SPEC3)
+};
+
+// src/protect/install/adapters/fastify.ts
+var SPEC4 = {
+  appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:fastify|Fastify)\(/,
+  guardTemplate: "fastify-plugin.ts",
+  importName: "patchstackFastify",
+  call: (v) => `${v}.register(patchstackFastify);`,
+  label: "Fastify app",
+  manualHint: "add `app.register(patchstackFastify)` right after you create your fastify() app"
+};
+var fastifyAdapter = {
+  name: "fastify",
+  label: "Fastify (Node)",
+  detect: (cwd) => hasDependency(cwd, "fastify") && findAppInstance(cwd, SPEC4.appRe) !== null,
+  wire: (cwd, opts) => wireRegister(cwd, opts, SPEC4),
+  verify: (cwd) => verifyRegister(cwd, SPEC4)
+};
+
+// src/protect/install/adapters/express.ts
+var jsonParserRe = (appVar) => new RegExp(`^\\s*${appVar}\\.use\\(\\s*express\\.json\\(`, "m");
+var SPEC5 = {
+  appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*express\(\)/,
+  guardTemplate: "express-guard.ts",
+  guardTemplateEsm: "express-guard.js",
+  guardTemplateCjs: "express-guard.cjs",
+  importName: "patchstackMiddleware",
+  call: (v) => `${v}.use(patchstackMiddleware);`,
+  callAfter: jsonParserRe,
+  requireCallAfter: true,
+  label: "Express app",
+  manualHint: "add `app.use(patchstackMiddleware)` after your JSON body parser and before the routes"
+};
+var expressAdapter = {
+  name: "express",
+  label: "Express (Node)",
+  detect: (cwd) => hasDependency(cwd, "express") && findAppInstance(cwd, SPEC5.appRe) !== null,
+  wire: (cwd, opts) => wireRegister(cwd, opts, SPEC5),
+  verify: (cwd) => verifyRegister(cwd, SPEC5)
+};
+
+// src/protect/install/index.ts
+var ADAPTERS = [
+  tanstackSupabaseAdapter,
+  nextAdapter,
+  sveltekitAdapter,
+  astroAdapter,
+  nestjsAdapter,
+  fastifyAdapter,
+  expressAdapter
+];
+function runProtect(cwd, opts = {}) {
+  const adapter = ADAPTERS.find((a) => a.detect(cwd));
+  if (adapter) {
+    const result = adapter.wire(cwd, opts);
+    return { status: "wired", adapter: adapter.name, changed: result.changed };
+  }
+  const { changed, dir } = scaffoldGeneric(cwd, opts);
+  const plan = wiringPlan(cwd, dir);
+  log(plan);
+  return { status: "scaffolded", adapter: "generic", changed, plan };
+}
+function runVerify(cwd) {
+  const adapter = ADAPTERS.find((a) => a.detect(cwd));
+  if (adapter) return { stack: adapter.label, ...adapter.verify(cwd) };
+  return { stack: "generic", ...genericVerify(cwd) };
 }
 
 // src/setup.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
 import path10 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
@@ -1822,7 +2664,7 @@ function appendHook(existing, command) {
 }
 function wireBuildScripts(cwd, packageManager) {
   const target = path10.join(cwd, "package.json");
-  const raw = readFileSync4(target, "utf8");
+  const raw = readFileSync6(target, "utf8");
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
   const build = scripts.build;
@@ -1866,7 +2708,7 @@ function wireBuildScripts(cwd, packageManager) {
   const indentMatch = raw.match(/^[\t ]+(?=")/m)?.[0];
   const indent = indentMatch?.includes("	") ? "	" : indentMatch?.length ?? 2;
   const trailingNewline = raw.endsWith("\n") ? "\n" : "";
-  writeFileSync3(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
+  writeFileSync6(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
   return packageManager === "bun" ? {
     changed: true,
     strategy: "build-chain",
@@ -1899,9 +2741,22 @@ Usage:
   patchstack-connect mark-build [options]            Stamp built HTML with a production flag +
                                                      build fingerprint, and ensure the widget
                                                      tag in built pages (run as a postbuild step)
-  patchstack-connect protect                         Install always-on runtime protection (the
-                                                     guard) into a TanStack Start + Supabase app.
-                                                     Covers the browser + server-function paths.
+  patchstack-connect protect [--demo|--check]        Install always-on runtime protection (the
+                                                     guard). Auto-wires supported server stacks;
+                                                     for others it scaffolds a
+                                                     generic guard + prints a wiring plan.
+                                                     --demo seeds a broad sample rule set (for
+                                                     demonstrations, not production).
+                                                     --check verifies the guard is wired (exit 1
+                                                     if not) \u2014 for the wire-then-verify loop.
+  patchstack-connect demo node-serialize [--url URL] Run the production-backed node-serialize
+                                                     walkthrough: verify the vulnerable package,
+                                                     scan it, wait for live rule 18843, install +
+                                                     verify the guard, and print test requests.
+                                                     Does not install vulnerable dependencies.
+  patchstack-connect demo-guide node-serialize       Show a read-only, state-aware walkthrough for
+                                                     preparing, running, proving, and cleaning up
+                                                     the production-backed local demo.
   patchstack-connect guide [--full]                  Show this project's setup status (what's done,
                                                      what's missing, with tailored commands), then
                                                      print the full setup guide. --full prints the
@@ -1917,11 +2772,17 @@ Options (for mark-build):
   --dir <path>            Build output directory (default: auto-detect
                           dist/ build/ out/ .output/public)
 
+Options (for demo and demo-guide):
+  --url <url>             Test endpoint printed at the end
+                          (default: http://localhost:3000/api/tasks)
+
 Environment:
   PATCHSTACK_SITE_UUID    Site UUID
   PATCHSTACK_ENDPOINT     API endpoint (default: https://api.patchstack.com/monitor/pulse/manifest)
   PATCHSTACK_TIMEOUT_MS   Request timeout in ms (default: 30000)
   PATCHSTACK_ENVIRONMENT  Manifest environment: production | sandbox (default: production)
+  PATCHSTACK_MODE         (protect) Runtime guard mode: block (default) | dry-run
+  PATCHSTACK_ROUTE_WAF    (protect) Set to 1 to also screen every request at the route level (opt-in)
 
 Precedence: CLI flag > environment variable > .patchstackrc.json.
 
@@ -1931,8 +2792,10 @@ Examples:
   npx @patchstack/connect scan --dry-run
   npx @patchstack/connect init 550e8400-e29b-41d4-a716-446655440000
   npx @patchstack/connect scan --site-uuid 550e8400-...-446655440000
+  npx @patchstack/connect demo node-serialize
+  npx @patchstack/connect demo-guide node-serialize
 `;
-var VALUE_FLAGS = /* @__PURE__ */ new Set(["site-uuid", "endpoint", "dir"]);
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["site-uuid", "endpoint", "dir", "url"]);
 function parseArgs(argv) {
   const args = argv.slice(2);
   const positional = [];
@@ -2107,14 +2970,117 @@ function reportSourceWidget(siteUuid) {
     console.warn(`Widget: skipped (${err.message}).`);
   }
 }
-async function runProtectCommand(_args) {
+async function runProtectCommand(args) {
+  if (args.flags.get("check") === true) {
+    const report = runVerify(process.cwd());
+    console.log(`patchstack protect --check (${report.stack}):`);
+    for (const c of report.checks) {
+      console.log(`  ${c.ok ? "\u2713" : "\u2717"} ${c.label}${!c.ok && c.hint ? ` \u2014 ${c.hint}` : ""}`);
+    }
+    console.log(report.wired ? "guard is wired \u2713" : "guard is NOT fully wired \u2717");
+    return report.wired ? 0 : 1;
+  }
+  const demo = args.flags.get("demo") === true;
   try {
-    runProtect(process.cwd());
+    runProtect(process.cwd(), { demo });
   } catch (err) {
     console.warn(`patchstack protect: skipped (${err.message}).`);
   }
   return 0;
 }
+async function runDemoCommand(args) {
+  try {
+    const scenario = resolveDemoScenario(args.positional[0]);
+    const cwd = process.cwd();
+    const config = await resolveConfig({
+      cwd,
+      cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
+      cliEndpoint: getStringFlag(args.flags, "endpoint"),
+      requireSiteUuid: true
+    });
+    if (config.environment !== "production") {
+      throw new DemoError(
+        "The production-backed demo requires PATCHSTACK_ENVIRONMENT=production. Unset the sandbox override and try again."
+      );
+    }
+    await assertPersistedSiteUuid(cwd, config.siteUuid);
+    await assertDemoDependency(cwd, scenario);
+    console.log(`Patchstack production demo \u2014 ${scenario.packageName}@${scenario.packageVersion}`);
+    console.log(`  Site: ${config.siteUuid}`);
+    console.log("");
+    console.log("1. Report the current npm manifest");
+    const scanCode = await runScan(args, { showRemainingSetup: false });
+    if (scanCode !== 0) return scanCode;
+    console.log("");
+    console.log(`2. Wait for live virtual-patch rule ${scenario.ruleId}`);
+    const rule = await waitForDemoRule(config.endpoint, config.siteUuid, scenario, {
+      requestTimeoutMs: config.timeoutMs
+    });
+    console.log(`Rule ready: ${rule.id}${rule.title ? ` \u2014 ${rule.title}` : ""}`);
+    console.log("");
+    console.log("3. Install and verify the runtime guard");
+    const result = runProtect(cwd);
+    if (result.status === "unsupported") {
+      throw new DemoError(
+        `Runtime protection is not supported for this stack. Supported: ${result.supported.join(", ")}.`
+      );
+    }
+    console.log(`Guard installer: ${result.adapter} (${result.status})`);
+    const report = runVerify(cwd);
+    for (const check of report.checks) {
+      console.log(`  ${check.ok ? "\u2713" : "\u2717"} ${check.label}${!check.ok && check.hint ? ` \u2014 ${check.hint}` : ""}`);
+    }
+    if (!report.wired) {
+      throw new DemoError(
+        `The ${report.stack} guard is not fully wired. Complete the failed check above, then run this command again.`
+      );
+    }
+    console.log("");
+    console.log("Production virtual patch is ready.");
+    console.log("");
+    console.log(
+      renderDemoTestCommands(
+        getStringFlag(args.flags, "url") ?? "http://localhost:3000/api/tasks",
+        scenario
+      )
+    );
+    return 0;
+  } catch (error) {
+    if (error instanceof DemoError) {
+      console.error(`Demo error: ${error.message}`);
+      return 1;
+    }
+    throw error;
+  }
+}
+async function runDemoGuideCommand(args) {
+  try {
+    const scenario = resolveDemoScenario(args.positional[0]);
+    const cwd = process.cwd();
+    const config = await resolveConfig({ cwd });
+    const [siteUuid, dependency] = await Promise.all([
+      readPersistedSiteUuid(cwd),
+      inspectDemoDependency(cwd, scenario)
+    ]);
+    console.log(
+      renderDemoGuide({
+        scenario,
+        packageManager: detectPackageManager(cwd),
+        siteUuid,
+        dependency,
+        environment: config.environment,
+        url: getStringFlag(args.flags, "url") ?? "http://localhost:3000/api/tasks"
+      })
+    );
+    return 0;
+  } catch (error) {
+    if (error instanceof DemoError) {
+      console.error(`Demo guide error: ${error.message}`);
+      return 1;
+    }
+    throw error;
+  }
+}
 async function runGuide(args) {
   let allDone = false;
   try {
@@ -2135,7 +3101,7 @@ async function runGuide(args) {
   console.log("\u2014\u2014\u2014\u2014 Full reference guide (ships as AGENT-INSTALL.md) \u2014\u2014\u2014\u2014");
   console.log("");
   const guidePath = new URL("../AGENT-INSTALL.md", import.meta.url);
-  console.log(readFileSync5(guidePath, "utf8"));
+  console.log(readFileSync7(guidePath, "utf8"));
   return 0;
 }
 async function runSetup(args) {
@@ -2250,7 +3216,7 @@ async function runMarkBuild(args) {
   let marked = 0;
   let widgetTouched = 0;
   for (const file of files) {
-    const before = readFileSync5(file, "utf8");
+    const before = readFileSync7(file, "utf8");
     let after = injectMarker(before, snippet);
     if (widgetUuid !== null) {
       const ensured = ensureWidgetInHtml(after, widgetUuid);
@@ -2260,7 +3226,7 @@ async function runMarkBuild(args) {
       after = ensured.html;
     }
     if (after !== before) {
-      writeFileSync4(file, after);
+      writeFileSync7(file, after);
       marked += 1;
     }
   }
@@ -2287,6 +3253,10 @@ async function main() {
       return runMarkBuild(args);
     case "protect":
       return runProtectCommand(args);
+    case "demo":
+      return runDemoCommand(args);
+    case "demo-guide":
+      return runDemoGuideCommand(args);
     case "guide":
       return runGuide(args);
     case "setup":