@patchstack/connect 0.3.17 → 0.3.18

package/dist/cli.js

@@ -934,6 +934,14 @@ function buildEndpointUrl(base, siteUuid) {
   const trimmed = base.replace(/\/$/, "");
   return siteUuid !== void 0 && siteUuid !== null && siteUuid.length > 0 ? `${trimmed}/${encodeURIComponent(siteUuid)}` : trimmed;
 }
+function buildRulesUrl(manifestEndpoint, siteUuid) {
+  const url = new URL(manifestEndpoint);
+  const path11 = url.pathname.replace(/\/$/, "");
+  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
 function buildClaimUrl(endpoint, siteUuid) {
   const origin = new URL(endpoint).origin;
   return `${origin}/monitor/claim?site=${encodeURIComponent(siteUuid)}`;
@@ -1004,8 +1012,212 @@ function isTimeoutError(cause) {
   return false;
 }
 
+// src/demo.ts
+import { readFile as readFile6 } from "fs/promises";
+import { join } from "path";
+var NODE_SERIALIZE_DEMO = {
+  name: "node-serialize",
+  packageName: "node-serialize",
+  packageVersion: "0.0.4",
+  ruleId: 18843,
+  maliciousBody: {
+    text: "_$$ND_FUNC$$_function(){require('child_process').exec('id')}()"
+  },
+  benignBody: { text: "buy milk" }
+};
+var SCENARIOS = /* @__PURE__ */ new Map([[NODE_SERIALIZE_DEMO.name, NODE_SERIALIZE_DEMO]]);
+var DemoError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DemoError";
+  }
+};
+var DEMO_INSTALL_COMMANDS = {
+  npm: "npm install --save-exact node-serialize@0.0.4",
+  pnpm: "pnpm add --save-exact node-serialize@0.0.4",
+  yarn: "yarn add --exact node-serialize@0.0.4",
+  bun: "bun add --exact node-serialize@0.0.4"
+};
+var DEMO_REMOVE_COMMANDS = {
+  npm: "npm uninstall node-serialize",
+  pnpm: "pnpm remove node-serialize",
+  yarn: "yarn remove node-serialize",
+  bun: "bun remove node-serialize"
+};
+function resolveDemoScenario(name) {
+  if (!name) {
+    throw new DemoError(
+      "A demo scenario is required. Available scenario: node-serialize.\nUsage: patchstack-connect demo node-serialize"
+    );
+  }
+  const scenario = SCENARIOS.get(name);
+  if (!scenario) {
+    throw new DemoError(`Unknown demo scenario "${name}". Available scenario: node-serialize.`);
+  }
+  return scenario;
+}
+async function collectDemoDependency(cwd, scenario) {
+  const manifest = await scanLockfile(cwd);
+  const versions = [
+    ...new Set(
+      manifest.packages.filter((entry) => entry.name === scenario.packageName).map((entry) => entry.version)
+    )
+  ].sort();
+  return { ready: versions.includes(scenario.packageVersion), versions };
+}
+async function inspectDemoDependency(cwd, scenario) {
+  try {
+    return await collectDemoDependency(cwd, scenario);
+  } catch {
+    return { ready: false, versions: [] };
+  }
+}
+async function assertDemoDependency(cwd, scenario) {
+  const { ready, versions } = await collectDemoDependency(cwd, scenario);
+  if (ready) return;
+  const found = versions.length > 0 ? ` Found: ${versions.join(", ")}.` : "";
+  throw new DemoError(
+    `${scenario.packageName}@${scenario.packageVersion} is not installed in the lockfile.${found}
+Add this deliberately vulnerable package first: npm install --save-exact ${scenario.packageName}@${scenario.packageVersion}`
+  );
+}
+async function readPersistedSiteUuid(cwd) {
+  try {
+    const value = JSON.parse(await readFile6(join(cwd, ".patchstackrc.json"), "utf8")).siteUuid;
+    return typeof value === "string" && value.length > 0 ? value : null;
+  } catch {
+    return null;
+  }
+}
+async function assertPersistedSiteUuid(cwd, expectedUuid) {
+  const persisted = await readPersistedSiteUuid(cwd);
+  if (persisted === null) {
+    throw new DemoError(
+      "The demo requires the Host-connected .patchstackrc.json. Connect Patchstack in Bolt first, then try again."
+    );
+  }
+  if (persisted !== expectedUuid) {
+    throw new DemoError(
+      `The active site UUID (${expectedUuid}) does not match .patchstackrc.json (${String(persisted)}). Remove the UUID override or reconnect this Bolt project before running the demo.`
+    );
+  }
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function renderDemoGuide(state) {
+  const { scenario } = state;
+  const install = DEMO_INSTALL_COMMANDS[state.packageManager].replace(
+    "node-serialize@0.0.4",
+    `${scenario.packageName}@${scenario.packageVersion}`
+  );
+  const remove = DEMO_REMOVE_COMMANDS[state.packageManager].replace(
+    "node-serialize",
+    scenario.packageName
+  );
+  const demo = state.url === "http://localhost:3000/api/tasks" ? `npx @patchstack/connect demo ${scenario.name}` : `npx @patchstack/connect demo ${scenario.name} --url ${shellQuote(state.url)}`;
+  const siteReady = state.siteUuid !== null;
+  const envReady = state.environment === "production";
+  const dependencyDetail = state.dependency.ready ? `${scenario.packageName}@${scenario.packageVersion} is in the lockfile` : state.dependency.versions.length > 0 ? `found ${scenario.packageName}@${state.dependency.versions.join(", ")}; ${scenario.packageVersion} is required` : `${scenario.packageName}@${scenario.packageVersion} is not in the lockfile`;
+  let next;
+  if (!siteReady) {
+    next = "Click \u201CConnect Patchstack\u201D in Bolt, then run this guide again.";
+  } else if (!envReady) {
+    next = "Unset PATCHSTACK_ENVIRONMENT (or set it to production), then run this guide again.";
+  } else if (!state.dependency.ready) {
+    next = install;
+  } else {
+    next = demo;
+  }
+  return [
+    `Patchstack demo guide \u2014 ${scenario.name}`,
+    "",
+    "Goal: prove that a live Patchstack virtual patch blocks the vulnerable payload while normal traffic still succeeds.",
+    "Deployment required: no. Keep the app running locally; the connector and generated guard contact Patchstack\u2019s production API.",
+    "",
+    `1. ${siteReady ? "\u2713" : "\u25CB"} Connect this project from Bolt\u2019s Host account dropdown`,
+    siteReady ? `   Ready \u2014 .patchstackrc.json contains site ${state.siteUuid}.` : "   Click \u201CConnect Patchstack\u201D in Bolt. This creates .patchstackrc.json; no separate CLI login is needed.",
+    "",
+    `2. ${state.dependency.ready ? "\u2713" : "\u25CB"} Add the deliberately vulnerable demo dependency`,
+    `   ${dependencyDetail}.`,
+    `   ${install}`,
+    "   Do not import or execute this package; its lockfile entry is enough for detection.",
+    "",
+    "3. \u25CB Run the production-backed demo setup",
+    `   ${demo}`,
+    ...envReady ? [] : ["   Blocked for now: this walkthrough needs PATCHSTACK_ENVIRONMENT=production."],
+    `   This scans the npm manifest, waits for live rule ${scenario.ruleId}, installs the server guard, verifies its wiring, and prints two test requests.`,
+    "   It does not start the server or send the requests.",
+    "",
+    "4. \u25CB Restart the local dev server",
+    "   Restart after the demo command so the application loads the generated guard.",
+    "",
+    "5. \u25CB Run both requests printed by the demo command",
+    `   Exploit: expect HTTP 403 with Patchstack rule ${scenario.ruleId}.`,
+    "   Control (\u201Cbuy milk\u201D): expect HTTP 201. This proves normal traffic is not blocked.",
+    "",
+    "6. \u25CB Clean up the throwaway vulnerability after the demonstration",
+    `   ${remove}`,
+    "   Re-run `npx @patchstack/connect scan` so the clean manifest is reported.",
+    "",
+    `Next: ${next}`
+  ].join("\n");
+}
+async function waitForDemoRule(manifestEndpoint, siteUuid, scenario, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 3e4;
+  const pollIntervalMs = options.pollIntervalMs ?? 1e3;
+  const requestTimeoutMs = options.requestTimeoutMs ?? 1e4;
+  const fetchFn = options.fetchFn ?? fetch;
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const now = options.now ?? Date.now;
+  const started = now();
+  const rulesUrl = buildRulesUrl(manifestEndpoint, siteUuid);
+  let lastDetail = "the rule list was empty";
+  do {
+    try {
+      const response = await fetchFn(rulesUrl, {
+        headers: { Accept: "application/json", "User-Agent": "@patchstack/connect" },
+        signal: AbortSignal.timeout(requestTimeoutMs)
+      });
+      if (response.ok) {
+        const data = await response.json();
+        const rules = Array.isArray(data.firewall) ? data.firewall : [];
+        const matched = rules.find((rule) => String(rule.id) === String(scenario.ruleId));
+        if (matched) return matched;
+        lastDetail = `${rules.length} firewall rule(s) returned without rule ${scenario.ruleId}`;
+      } else {
+        lastDetail = `the rules API returned HTTP ${response.status}`;
+      }
+    } catch (error) {
+      lastDetail = `the rules request failed: ${error.message}`;
+    }
+    const remaining = timeoutMs - (now() - started);
+    if (remaining <= 0) break;
+    await sleep(Math.min(pollIntervalMs, remaining));
+  } while (now() - started <= timeoutMs);
+  throw new DemoError(
+    `Timed out waiting for Patchstack rule ${scenario.ruleId} for site ${siteUuid}; ${lastDetail}.`
+  );
+}
+function renderDemoTestCommands(url, scenario) {
+  const shellUrl = shellQuote(url);
+  const command = (body) => {
+    const encoded = Buffer.from(JSON.stringify(body)).toString("base64");
+    return `node -e "process.stdout.write(Buffer.from('${encoded}','base64'))" | curl -i -X POST --url ${shellUrl} -H "Content-Type: application/json" --data-binary @-`;
+  };
+  return [
+    "Restart the dev server so it loads the generated guard, then run:",
+    "",
+    `Blocked exploit (expect HTTP 403 and rule ${scenario.ruleId}):`,
+    command(scenario.maliciousBody),
+    "",
+    "Benign request (expect HTTP 201):",
+    command(scenario.benignBody)
+  ].join("\n");
+}
+
 // src/config.ts
-import { readFile as readFile6, writeFile } from "fs/promises";
+import { readFile as readFile7, writeFile } from "fs/promises";
 import path6 from "path";
 var CONFIG_FILENAME = ".patchstackrc.json";
 var DEFAULT_ENVIRONMENT = "production";
@@ -1057,7 +1269,7 @@ async function readConfigFile(cwd) {
   const target = path6.join(cwd, CONFIG_FILENAME);
   let raw;
   try {
-    raw = await readFile6(target, "utf8");
+    raw = await readFile7(target, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return {};
@@ -1663,13 +1875,13 @@ function renderGuideChecklist(state, useColor) {
 
 // src/protect/install/util.ts
 import { readFileSync as readFileSync3, existsSync as existsSync4, writeFileSync as writeFileSync2 } from "fs";
-import { join, dirname } from "path";
+import { join as join2, dirname } from "path";
 import { fileURLToPath } from "url";
 var read = (p) => readFileSync3(p, "utf8");
 var log = (msg) => console.log(`patchstack protect: ${msg}`);
 function hasDependency(cwd, name) {
   try {
-    const pkg = JSON.parse(read(join(cwd, "package.json")));
+    const pkg = JSON.parse(read(join2(cwd, "package.json")));
     return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }[name]);
   } catch {
     return false;
@@ -1678,7 +1890,7 @@ function hasDependency(cwd, name) {
 var SITE_UUID_PLACEHOLDER = "__PATCHSTACK_SITE_UUID__";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function bakeSiteUuid(cwd, guardRelPath) {
-  const rc = join(cwd, ".patchstackrc.json");
+  const rc = join2(cwd, ".patchstackrc.json");
   if (!existsSync4(rc)) {
     log("no .patchstackrc.json \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
     return false;
@@ -1694,7 +1906,7 @@ function bakeSiteUuid(cwd, guardRelPath) {
     log(".patchstackrc.json siteUuid missing or malformed \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
     return false;
   }
-  const guardPath = join(cwd, guardRelPath);
+  const guardPath = join2(cwd, guardRelPath);
   if (!existsSync4(guardPath)) return false;
   const source = read(guardPath);
   if (!source.includes(SITE_UUID_PLACEHOLDER)) {
@@ -1707,19 +1919,19 @@ function bakeSiteUuid(cwd, guardRelPath) {
 }
 var HERE = dirname(fileURLToPath(import.meta.url));
 function templatesDir() {
-  const builtLayout = join(HERE, "protect", "templates");
+  const builtLayout = join2(HERE, "protect", "templates");
   const candidates = [
     builtLayout,
-    join(HERE, "..", "templates"),
+    join2(HERE, "..", "templates"),
     // source: src/protect/install/ → src/protect/templates
-    join(HERE, "templates")
+    join2(HERE, "templates")
   ];
   return candidates.find((p) => existsSync4(p)) ?? builtLayout;
 }
 
 // src/protect/install/adapters/tanstack-supabase.ts
 import { writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync, copyFileSync } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 var CLIENT_TUNNEL = [
   "",
   "    // PATCHSTACK: in the browser, tunnel Supabase traffic through the app's own server guard",
@@ -1788,7 +2000,7 @@ function reconcileBlock(s, region, block, legacyConst, insertBefore) {
   return s.replace(insertBefore, block + "\n\n" + insertBefore);
 }
 function detect(cwd) {
-  const pkgPath = join2(cwd, "package.json");
+  const pkgPath = join3(cwd, "package.json");
   if (!existsSync5(pkgPath)) return false;
   let pkg;
   try {
@@ -1797,22 +2009,22 @@ function detect(cwd) {
     return false;
   }
   const deps = { ...pkg.dependencies, ...pkg.devDependencies };
-  return Boolean(deps["@tanstack/react-start"]) && existsSync5(join2(cwd, "src/start.ts")) && existsSync5(join2(cwd, "src/integrations/supabase/client.ts"));
+  return Boolean(deps["@tanstack/react-start"]) && existsSync5(join3(cwd, "src/start.ts")) && existsSync5(join3(cwd, "src/integrations/supabase/client.ts"));
 }
 var GUARD_FILE = "src/integrations/patchstack/guard.ts";
 function scaffold(cwd, opts) {
   const templates = templatesDir();
-  const dst = join2(cwd, "src/integrations/patchstack");
+  const dst = join3(cwd, "src/integrations/patchstack");
   mkdirSync(dst, { recursive: true });
-  copyFileSync(join2(templates, "guard.ts"), join2(dst, "guard.ts"));
+  copyFileSync(join3(templates, "guard.ts"), join3(dst, "guard.ts"));
   const changed = [GUARD_FILE];
-  const rulesDst = join2(dst, "rules.json");
+  const rulesDst = join3(dst, "rules.json");
   if (opts.demo) {
-    copyFileSync(join2(templates, "demo-rules.json"), rulesDst);
+    copyFileSync(join3(templates, "demo-rules.json"), rulesDst);
     changed.push("src/integrations/patchstack/rules.json");
     log("scaffolded guard.ts + rules.json (demo sample rule set)");
   } else if (!existsSync5(rulesDst)) {
-    copyFileSync(join2(templates, "rules.json"), rulesDst);
+    copyFileSync(join3(templates, "rules.json"), rulesDst);
     changed.push("src/integrations/patchstack/rules.json");
     log("scaffolded guard.ts + rules.json (starter rules)");
   } else {
@@ -1821,7 +2033,7 @@ function scaffold(cwd, opts) {
   return changed;
 }
 function patchClient(cwd) {
-  const p = join2(cwd, "src/integrations/supabase/client.ts");
+  const p = join3(cwd, "src/integrations/supabase/client.ts");
   const s = read(p);
   if (s.includes("x-ps-target")) {
     log("client.ts already wired");
@@ -1837,7 +2049,7 @@ function patchClient(cwd) {
   return true;
 }
 function patchStart(cwd) {
-  const p = join2(cwd, "src/start.ts");
+  const p = join3(cwd, "src/start.ts");
   let s = read(p);
   const importAnchor = 'import { createStart, createMiddleware } from "@tanstack/react-start";';
   const exportAnchor = "export const startInstance";
@@ -1884,9 +2096,9 @@ function wire(cwd, opts) {
   return { ok: true, changed: [...new Set(changed)] };
 }
 function verify(cwd) {
-  const guardPath = join2(cwd, GUARD_FILE);
-  const clientPath = join2(cwd, "src/integrations/supabase/client.ts");
-  const startPath = join2(cwd, "src/start.ts");
+  const guardPath = join3(cwd, GUARD_FILE);
+  const clientPath = join3(cwd, "src/integrations/supabase/client.ts");
+  const startPath = join3(cwd, "src/start.ts");
   const guard = existsSync5(guardPath) ? read(guardPath) : "";
   const client = existsSync5(clientPath) ? read(clientPath) : "";
   const start = existsSync5(startPath) ? read(startPath) : "";
@@ -1908,10 +2120,10 @@ var tanstackSupabaseAdapter = {
 
 // src/protect/install/adapters/next.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync2, copyFileSync as copyFileSync2 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function hasNextDep(cwd) {
   try {
-    const pkg = JSON.parse(read(join3(cwd, "package.json")));
+    const pkg = JSON.parse(read(join4(cwd, "package.json")));
     return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.next);
   } catch {
     return false;
@@ -1920,9 +2132,9 @@ function hasNextDep(cwd) {
 function middlewareInfo(cwd) {
   const candidates = ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"];
   for (const rel of candidates) {
-    if (existsSync6(join3(cwd, rel))) return { relDir: rel.includes("/") ? "src" : ".", relFile: rel, exists: true };
+    if (existsSync6(join4(cwd, rel))) return { relDir: rel.includes("/") ? "src" : ".", relFile: rel, exists: true };
   }
-  const useSrc = existsSync6(join3(cwd, "src"));
+  const useSrc = existsSync6(join4(cwd, "src"));
   return { relDir: useSrc ? "src" : ".", relFile: useSrc ? "src/middleware.ts" : "middleware.ts", exists: false };
 }
 function detect2(cwd) {
@@ -1934,15 +2146,15 @@ function rulesFile(relDir) {
 function wire2(cwd, opts) {
   const templates = templatesDir();
   const mw = middlewareInfo(cwd);
-  const dir = join3(cwd, mw.relDir === "." ? "" : mw.relDir);
+  const dir = join4(cwd, mw.relDir === "." ? "" : mw.relDir);
   mkdirSync2(dir, { recursive: true });
-  const rulesDst = join3(dir, "patchstack.rules.json");
+  const rulesDst = join4(dir, "patchstack.rules.json");
   const changed = [];
   if (opts.demo || !existsSync6(rulesDst)) {
-    copyFileSync2(join3(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    copyFileSync2(join4(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
     changed.push(rulesFile(mw.relDir));
   }
-  const mwPath = join3(cwd, mw.relFile);
+  const mwPath = join4(cwd, mw.relFile);
   const existing = mw.exists ? read(mwPath) : "";
   if (mw.exists && !existing.includes("patchstack-next")) {
     log(
@@ -1950,7 +2162,7 @@ function wire2(cwd, opts) {
     );
     return { ok: true, changed };
   }
-  copyFileSync2(join3(templates, "next-middleware.ts"), mwPath);
+  copyFileSync2(join4(templates, "next-middleware.ts"), mwPath);
   if (!opts.demo) bakeSiteUuid(cwd, mw.relFile);
   changed.push(mw.relFile);
   log(mw.exists ? `refreshed ${mw.relFile} (Patchstack middleware)` : `scaffolded ${mw.relFile} (Patchstack middleware)`);
@@ -1958,8 +2170,8 @@ function wire2(cwd, opts) {
 }
 function verify2(cwd) {
   const mw = middlewareInfo(cwd);
-  const present = mw.exists && read(join3(cwd, mw.relFile)).includes("patchstack-next");
-  const rulesPresent = existsSync6(join3(cwd, rulesFile(mw.relDir)));
+  const present = mw.exists && read(join4(cwd, mw.relFile)).includes("patchstack-next");
+  const rulesPresent = existsSync6(join4(cwd, rulesFile(mw.relDir)));
   return {
     wired: present && rulesPresent,
     checks: [
@@ -1977,42 +2189,42 @@ var nextAdapter = {
 };
 
 // src/protect/install/adapters/sveltekit.ts
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // src/protect/install/seam.ts
 import { existsSync as existsSync7, mkdirSync as mkdirSync3, copyFileSync as copyFileSync3 } from "fs";
-import { join as join4, dirname as dirname2 } from "path";
+import { join as join5, dirname as dirname2 } from "path";
 function rulesRel(seamRel) {
   const d = dirname2(seamRel);
   return (d === "." ? "patchstack.rules.json" : `${d}/patchstack.rules.json`).replace(/\\/g, "/");
 }
 function wireSeam(cwd, opts, spec) {
   const templates = templatesDir();
-  const existing = spec.candidates.find((c) => existsSync7(join4(cwd, c)));
+  const existing = spec.candidates.find((c) => existsSync7(join5(cwd, c)));
   const seamRel = existing ?? spec.target;
-  mkdirSync3(dirname2(join4(cwd, seamRel)), { recursive: true });
-  const rulesDst = join4(cwd, rulesRel(seamRel));
+  mkdirSync3(dirname2(join5(cwd, seamRel)), { recursive: true });
+  const rulesDst = join5(cwd, rulesRel(seamRel));
   const changed = [];
   if (opts.demo || !existsSync7(rulesDst)) {
-    copyFileSync3(join4(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    copyFileSync3(join5(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
     changed.push(rulesRel(seamRel));
   }
-  const current = existing ? read(join4(cwd, existing)) : "";
+  const current = existing ? read(join5(cwd, existing)) : "";
   if (existing && !current.includes(spec.marker)) {
     log(`existing ${existing} left untouched \u2014 scaffolded ${rulesRel(seamRel)}; ${spec.planHint}`);
     return { ok: true, changed };
   }
-  copyFileSync3(join4(templates, spec.templateName), join4(cwd, seamRel));
+  copyFileSync3(join5(templates, spec.templateName), join5(cwd, seamRel));
   if (!opts.demo) bakeSiteUuid(cwd, seamRel);
   changed.push(seamRel);
   log(existing ? `refreshed ${seamRel}` : `scaffolded ${seamRel}`);
   return { ok: true, changed: [...new Set(changed)] };
 }
 function verifySeam(cwd, spec) {
-  const existing = spec.candidates.find((c) => existsSync7(join4(cwd, c)));
+  const existing = spec.candidates.find((c) => existsSync7(join5(cwd, c)));
   const seamRel = existing ?? spec.target;
-  const present = existing ? read(join4(cwd, existing)).includes(spec.marker) : false;
-  const rulesPresent = existsSync7(join4(cwd, rulesRel(seamRel)));
+  const present = existing ? read(join5(cwd, existing)).includes(spec.marker) : false;
+  const rulesPresent = existsSync7(join5(cwd, rulesRel(seamRel)));
   return {
     wired: present && rulesPresent,
     checks: [
@@ -2033,7 +2245,7 @@ var SPEC = {
 };
 function detect3(cwd) {
   try {
-    const pkg = JSON.parse(read(join5(cwd, "package.json")));
+    const pkg = JSON.parse(read(join6(cwd, "package.json")));
     return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }["@sveltejs/kit"]);
   } catch {
     return false;
@@ -2054,7 +2266,7 @@ var sveltekitAdapter = {
 };
 
 // src/protect/install/adapters/astro.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var SPEC2 = {
   templateName: "astro-middleware.ts",
   candidates: ["src/middleware.ts", "src/middleware.js", "src/middleware/index.ts", "src/middleware/index.js"],
@@ -2065,7 +2277,7 @@ var SPEC2 = {
 };
 function detect4(cwd) {
   try {
-    const pkg = JSON.parse(read(join6(cwd, "package.json")));
+    const pkg = JSON.parse(read(join7(cwd, "package.json")));
     return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.astro);
   } catch {
     return false;
@@ -2087,9 +2299,9 @@ var astroAdapter = {
 
 // src/protect/install/find-app.ts
 import { readFileSync as readFileSync4, existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
-import { join as join7, relative, dirname as dirname3 } from "path";
+import { join as join8, relative, dirname as dirname3 } from "path";
 function findAppInstance(cwd, re) {
-  const root = existsSync8(join7(cwd, "src")) ? join7(cwd, "src") : cwd;
+  const root = existsSync8(join8(cwd, "src")) ? join8(cwd, "src") : cwd;
   let hit = null;
   const walk2 = (dir) => {
     if (hit) return;
@@ -2102,7 +2314,7 @@ function findAppInstance(cwd, re) {
     for (const name of entries) {
       if (hit) return;
       if (name === "node_modules" || name === "patchstack" || name.startsWith(".")) continue;
-      const p = join7(dir, name);
+      const p = join8(dir, name);
       let st;
       try {
         st = statSync3(p);
@@ -2125,34 +2337,36 @@ function findAppInstance(cwd, re) {
   walk2(root);
   return hit;
 }
-function importSpecifier(fromRel, toRel) {
-  let spec = relative(dirname3(fromRel), toRel).replace(/\\/g, "/").replace(/\.(?:ts|js)$/, "");
+function importSpecifier(fromRel, toRel, preserveExtension = false) {
+  let spec = relative(dirname3(fromRel), toRel).replace(/\\/g, "/");
+  if (!preserveExtension) spec = spec.replace(/\.(?:ts|js)$/, "");
   if (!spec.startsWith(".")) spec = `./${spec}`;
   return spec;
 }
 
 // src/protect/install/register.ts
 import { writeFileSync as writeFileSync5, existsSync as existsSync10 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 
 // src/protect/install/generic.ts
 import { readFileSync as readFileSync5, existsSync as existsSync9, mkdirSync as mkdirSync4, copyFileSync as copyFileSync4, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var GUARD_MARKER = "patchstack/guard";
 function genericDir(cwd) {
-  return existsSync9(join8(cwd, "src")) ? "src/patchstack" : "patchstack";
+  return existsSync9(join9(cwd, "src")) ? "src/patchstack" : "patchstack";
 }
-function scaffoldGeneric(cwd, opts, guardTemplate = "generic-guard.ts") {
+function scaffoldGeneric(cwd, opts, guardTemplate = "generic-guard.ts", guardFile = "guard.ts") {
   const templates = templatesDir();
   const dir = genericDir(cwd);
-  const dst = join8(cwd, dir);
+  const dst = join9(cwd, dir);
   mkdirSync4(dst, { recursive: true });
-  copyFileSync4(join8(templates, guardTemplate), join8(dst, "guard.ts"));
-  const changed = [`${dir}/guard.ts`];
-  if (!opts.demo) bakeSiteUuid(cwd, `${dir}/guard.ts`);
-  const rulesDst = join8(dst, "rules.json");
+  copyFileSync4(join9(templates, guardTemplate), join9(dst, guardFile));
+  const guardRel = `${dir}/${guardFile}`;
+  const changed = [guardRel];
+  if (!opts.demo) bakeSiteUuid(cwd, guardRel);
+  const rulesDst = join9(dst, "rules.json");
   if (opts.demo || !existsSync9(rulesDst)) {
-    copyFileSync4(join8(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    copyFileSync4(join9(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
     changed.push(`${dir}/rules.json`);
   }
   return { changed, dir };
@@ -2173,17 +2387,17 @@ function candidateEntries(cwd) {
     "app.ts",
     "app.js"
   ];
-  const hits = names.filter((n) => existsSync9(join8(cwd, n)));
+  const hits = names.filter((n) => existsSync9(join9(cwd, n)));
   try {
-    const pkg = JSON.parse(read(join8(cwd, "package.json")));
-    if (typeof pkg.main === "string" && existsSync9(join8(cwd, pkg.main))) hits.push(pkg.main);
+    const pkg = JSON.parse(read(join9(cwd, "package.json")));
+    if (typeof pkg.main === "string" && existsSync9(join9(cwd, pkg.main))) hits.push(pkg.main);
   } catch {
   }
   return [...new Set(hits)];
 }
 function usesExpress(cwd) {
   try {
-    const pkg = JSON.parse(read(join8(cwd, "package.json")));
+    const pkg = JSON.parse(read(join9(cwd, "package.json")));
     return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.express);
   } catch {
     return false;
@@ -2204,8 +2418,8 @@ function wiringPlan(cwd, dir) {
 }
 function genericVerify(cwd) {
   const dir = genericDir(cwd);
-  const scaffolded = existsSync9(join8(cwd, dir, "guard.ts"));
-  const imported = scaffolded && guardIsImported(cwd, join8(cwd, dir, "guard.ts"));
+  const scaffolded = existsSync9(join9(cwd, dir, "guard.ts"));
+  const imported = scaffolded && guardIsImported(cwd, join9(cwd, dir, "guard.ts"));
   return {
     wired: scaffolded && imported,
     checks: [
@@ -2219,7 +2433,7 @@ function genericVerify(cwd) {
   };
 }
 function guardIsImported(cwd, guardPath) {
-  const root = existsSync9(join8(cwd, "src")) ? join8(cwd, "src") : cwd;
+  const root = existsSync9(join9(cwd, "src")) ? join9(cwd, "src") : cwd;
   let found = false;
   const walk2 = (d) => {
     if (found) return;
@@ -2232,7 +2446,7 @@ function guardIsImported(cwd, guardPath) {
     for (const name of entries) {
       if (found) return;
       if (name === "node_modules" || name.startsWith(".")) continue;
-      const p = join8(d, name);
+      const p = join9(d, name);
       let st;
       try {
         st = statSync4(p);
@@ -2254,27 +2468,76 @@ function guardIsImported(cwd, guardPath) {
 
 // src/protect/install/register.ts
 var REGION = "// #region patchstack (managed by patchstack-connect protect \u2014 do not edit)";
+function guardTarget(cwd, entryRel, spec) {
+  if (/\.cjs$/.test(entryRel) || /\.js$/.test(entryRel) && packageType(cwd) !== "module") {
+    if (spec.guardTemplateCjs) {
+      return {
+        template: spec.guardTemplateCjs,
+        file: "guard.cjs",
+        importLine: (name, target) => `const { ${name} } = require("${target}");`,
+        preserveExtension: true
+      };
+    }
+  } else if (/\.(?:js|mjs)$/.test(entryRel) && spec.guardTemplateEsm) {
+    return {
+      template: spec.guardTemplateEsm,
+      file: entryRel.endsWith(".mjs") ? "guard.mjs" : "guard.js",
+      importLine: (name, target) => `import { ${name} } from "${target}";`,
+      preserveExtension: true
+    };
+  }
+  return {
+    template: spec.guardTemplate,
+    file: "guard.ts",
+    importLine: (name, target) => `import { ${name} } from "${target}";`,
+    preserveExtension: false
+  };
+}
+function packageType(cwd) {
+  try {
+    return JSON.parse(read(join10(cwd, "package.json"))).type;
+  } catch {
+    return void 0;
+  }
+}
 function wireRegister(cwd, opts, spec) {
-  const { changed, dir } = scaffoldGeneric(cwd, opts, spec.guardTemplate);
   const entry = findAppInstance(cwd, spec.appRe);
   if (!entry) {
+    const { changed: changed2 } = scaffoldGeneric(cwd, opts, spec.guardTemplate);
     log(`${spec.label} not located \u2014 scaffolded guard; ${spec.manualHint}`);
-    return { ok: true, changed };
+    return { ok: true, changed: changed2 };
   }
-  const p = join9(cwd, entry.relPath);
+  const target = guardTarget(cwd, entry.relPath, spec);
+  const { changed, dir } = scaffoldGeneric(cwd, opts, target.template, target.file);
+  const p = join10(cwd, entry.relPath);
   const s = read(p);
   if (s.includes(spec.importName)) {
     log(`${entry.relPath} already wired`);
     return { ok: true, changed };
   }
-  const importLine = `import { ${spec.importName} } from "${importSpecifier(entry.relPath, `${dir}/guard`)}";`;
+  const sourceLines = s.split("\n");
+  const sourceAppIdx = sourceLines.findIndex((line) => spec.appRe.test(line));
+  const requiredAnchor = spec.callAfter?.(entry.appVar);
+  if (spec.requireCallAfter && requiredAnchor && !sourceLines.some((line, index) => index > sourceAppIdx && requiredAnchor.test(line))) {
+    log(`${entry.relPath} body-parser anchor not found \u2014 scaffolded guard; ${spec.manualHint}`);
+    return { ok: true, changed };
+  }
+  const importLine = target.importLine(
+    spec.importName,
+    importSpecifier(entry.relPath, `${dir}/${target.file}`, target.preserveExtension)
+  );
   const lines = s.split("\n");
   let lastImport = -1;
-  for (let i = 0; i < lines.length; i++) if (/^\s*import\b/.test(lines[i] ?? "")) lastImport = i;
+  for (let i = 0; i < lines.length; i++) {
+    if (/^\s*(?:import\b|(?:const|let|var)\s+.+?=\s*require\()/.test(lines[i] ?? "")) lastImport = i;
+  }
   lines.splice(lastImport + 1, 0, importLine);
   const appIdx = lines.findIndex((l) => spec.appRe.test(l));
   if (appIdx !== -1) {
-    lines.splice(appIdx + 1, 0, REGION, spec.call(entry.appVar), "// #endregion patchstack");
+    const preferred = spec.callAfter?.(entry.appVar);
+    const preferredIdx = preferred ? lines.findIndex((line, index) => index > appIdx && preferred.test(line)) : -1;
+    const callIdx = preferredIdx === -1 ? appIdx : preferredIdx;
+    lines.splice(callIdx + 1, 0, REGION, spec.call(entry.appVar), "// #endregion patchstack");
   }
   writeFileSync5(p, lines.join("\n"));
   changed.push(entry.relPath);
@@ -2282,10 +2545,17 @@ function wireRegister(cwd, opts, spec) {
   return { ok: true, changed: [...new Set(changed)] };
 }
 function verifyRegister(cwd, spec) {
-  const dir = existsSync10(join9(cwd, "src")) ? "src/patchstack" : "patchstack";
-  const scaffolded = existsSync10(join9(cwd, dir, "guard.ts"));
+  const dir = existsSync10(join10(cwd, "src")) ? "src/patchstack" : "patchstack";
   const entry = findAppInstance(cwd, spec.appRe);
-  const wired = entry ? read(join9(cwd, entry.relPath)).includes(spec.importName) : false;
+  const target = entry ? guardTarget(cwd, entry.relPath, spec) : null;
+  const scaffolded = target ? existsSync10(join10(cwd, dir, target.file)) : false;
+  const entrySource = entry ? read(join10(cwd, entry.relPath)) : "";
+  const entryLines = entrySource.split("\n");
+  const anchor = entry && spec.callAfter ? spec.callAfter(entry.appVar) : null;
+  const anchorIndex = anchor ? entryLines.findIndex((line) => anchor.test(line)) : -1;
+  const callIndex = entry ? entryLines.findIndex((line) => line.includes(spec.call(entry.appVar))) : -1;
+  const ordered = anchor ? anchorIndex !== -1 && callIndex > anchorIndex : callIndex !== -1;
+  const wired = entrySource.includes(spec.importName) && ordered;
   return {
     wired: scaffolded && wired,
     checks: [
@@ -2330,13 +2600,18 @@ var fastifyAdapter = {
 };
 
 // src/protect/install/adapters/express.ts
+var jsonParserRe = (appVar) => new RegExp(`^\\s*${appVar}\\.use\\(\\s*express\\.json\\(`, "m");
 var SPEC5 = {
   appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*express\(\)/,
-  guardTemplate: "generic-guard.ts",
+  guardTemplate: "express-guard.ts",
+  guardTemplateEsm: "express-guard.js",
+  guardTemplateCjs: "express-guard.cjs",
   importName: "patchstackMiddleware",
   call: (v) => `${v}.use(patchstackMiddleware);`,
+  callAfter: jsonParserRe,
+  requireCallAfter: true,
   label: "Express app",
-  manualHint: "add `app.use(patchstackMiddleware)` right after you create your express() app"
+  manualHint: "add `app.use(patchstackMiddleware)` after your JSON body parser and before the routes"
 };
 var expressAdapter = {
   name: "express",
@@ -2467,13 +2742,21 @@ Usage:
                                                      build fingerprint, and ensure the widget
                                                      tag in built pages (run as a postbuild step)
   patchstack-connect protect [--demo|--check]        Install always-on runtime protection (the
-                                                     guard). Auto-wires known stacks (TanStack
-                                                     Start + Supabase); for others it scaffolds a
+                                                     guard). Auto-wires supported server stacks;
+                                                     for others it scaffolds a
                                                      generic guard + prints a wiring plan.
                                                      --demo seeds a broad sample rule set (for
                                                      demonstrations, not production).
                                                      --check verifies the guard is wired (exit 1
                                                      if not) \u2014 for the wire-then-verify loop.
+  patchstack-connect demo node-serialize [--url URL] Run the production-backed node-serialize
+                                                     walkthrough: verify the vulnerable package,
+                                                     scan it, wait for live rule 18843, install +
+                                                     verify the guard, and print test requests.
+                                                     Does not install vulnerable dependencies.
+  patchstack-connect demo-guide node-serialize       Show a read-only, state-aware walkthrough for
+                                                     preparing, running, proving, and cleaning up
+                                                     the production-backed local demo.
   patchstack-connect guide [--full]                  Show this project's setup status (what's done,
                                                      what's missing, with tailored commands), then
                                                      print the full setup guide. --full prints the
@@ -2489,6 +2772,10 @@ Options (for mark-build):
   --dir <path>            Build output directory (default: auto-detect
                           dist/ build/ out/ .output/public)
 
+Options (for demo and demo-guide):
+  --url <url>             Test endpoint printed at the end
+                          (default: http://localhost:3000/api/tasks)
+
 Environment:
   PATCHSTACK_SITE_UUID    Site UUID
   PATCHSTACK_ENDPOINT     API endpoint (default: https://api.patchstack.com/monitor/pulse/manifest)
@@ -2505,8 +2792,10 @@ Examples:
   npx @patchstack/connect scan --dry-run
   npx @patchstack/connect init 550e8400-e29b-41d4-a716-446655440000
   npx @patchstack/connect scan --site-uuid 550e8400-...-446655440000
+  npx @patchstack/connect demo node-serialize
+  npx @patchstack/connect demo-guide node-serialize
 `;
-var VALUE_FLAGS = /* @__PURE__ */ new Set(["site-uuid", "endpoint", "dir"]);
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["site-uuid", "endpoint", "dir", "url"]);
 function parseArgs(argv) {
   const args = argv.slice(2);
   const positional = [];
@@ -2699,6 +2988,99 @@ async function runProtectCommand(args) {
   }
   return 0;
 }
+async function runDemoCommand(args) {
+  try {
+    const scenario = resolveDemoScenario(args.positional[0]);
+    const cwd = process.cwd();
+    const config = await resolveConfig({
+      cwd,
+      cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
+      cliEndpoint: getStringFlag(args.flags, "endpoint"),
+      requireSiteUuid: true
+    });
+    if (config.environment !== "production") {
+      throw new DemoError(
+        "The production-backed demo requires PATCHSTACK_ENVIRONMENT=production. Unset the sandbox override and try again."
+      );
+    }
+    await assertPersistedSiteUuid(cwd, config.siteUuid);
+    await assertDemoDependency(cwd, scenario);
+    console.log(`Patchstack production demo \u2014 ${scenario.packageName}@${scenario.packageVersion}`);
+    console.log(`  Site: ${config.siteUuid}`);
+    console.log("");
+    console.log("1. Report the current npm manifest");
+    const scanCode = await runScan(args, { showRemainingSetup: false });
+    if (scanCode !== 0) return scanCode;
+    console.log("");
+    console.log(`2. Wait for live virtual-patch rule ${scenario.ruleId}`);
+    const rule = await waitForDemoRule(config.endpoint, config.siteUuid, scenario, {
+      requestTimeoutMs: config.timeoutMs
+    });
+    console.log(`Rule ready: ${rule.id}${rule.title ? ` \u2014 ${rule.title}` : ""}`);
+    console.log("");
+    console.log("3. Install and verify the runtime guard");
+    const result = runProtect(cwd);
+    if (result.status === "unsupported") {
+      throw new DemoError(
+        `Runtime protection is not supported for this stack. Supported: ${result.supported.join(", ")}.`
+      );
+    }
+    console.log(`Guard installer: ${result.adapter} (${result.status})`);
+    const report = runVerify(cwd);
+    for (const check of report.checks) {
+      console.log(`  ${check.ok ? "\u2713" : "\u2717"} ${check.label}${!check.ok && check.hint ? ` \u2014 ${check.hint}` : ""}`);
+    }
+    if (!report.wired) {
+      throw new DemoError(
+        `The ${report.stack} guard is not fully wired. Complete the failed check above, then run this command again.`
+      );
+    }
+    console.log("");
+    console.log("Production virtual patch is ready.");
+    console.log("");
+    console.log(
+      renderDemoTestCommands(
+        getStringFlag(args.flags, "url") ?? "http://localhost:3000/api/tasks",
+        scenario
+      )
+    );
+    return 0;
+  } catch (error) {
+    if (error instanceof DemoError) {
+      console.error(`Demo error: ${error.message}`);
+      return 1;
+    }
+    throw error;
+  }
+}
+async function runDemoGuideCommand(args) {
+  try {
+    const scenario = resolveDemoScenario(args.positional[0]);
+    const cwd = process.cwd();
+    const config = await resolveConfig({ cwd });
+    const [siteUuid, dependency] = await Promise.all([
+      readPersistedSiteUuid(cwd),
+      inspectDemoDependency(cwd, scenario)
+    ]);
+    console.log(
+      renderDemoGuide({
+        scenario,
+        packageManager: detectPackageManager(cwd),
+        siteUuid,
+        dependency,
+        environment: config.environment,
+        url: getStringFlag(args.flags, "url") ?? "http://localhost:3000/api/tasks"
+      })
+    );
+    return 0;
+  } catch (error) {
+    if (error instanceof DemoError) {
+      console.error(`Demo guide error: ${error.message}`);
+      return 1;
+    }
+    throw error;
+  }
+}
 async function runGuide(args) {
   let allDone = false;
   try {
@@ -2871,6 +3253,10 @@ async function main() {
       return runMarkBuild(args);
     case "protect":
       return runProtectCommand(args);
+    case "demo":
+      return runDemoCommand(args);
+    case "demo-guide":
+      return runDemoGuideCommand(args);
     case "guide":
       return runGuide(args);
     case "setup":