@patchstack/connect 0.3.18 → 0.3.20

package/dist/cli.js

@@ -1464,1188 +1464,1291 @@ function injectMarker(html, snippet) {
 }
 
 // src/guide.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync5, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
 import path9 from "path";
 
-// src/widget.ts
-import { existsSync as existsSync2, readFileSync, writeFileSync } from "fs";
-import path8 from "path";
-var WIDGET_SCRIPT_URL = "https://cdn.patchstack.com/patchstack-widget.js";
-var WIDGET_MARKER_ATTR = "data-patchstack-connect-widget";
-var WIDGET_NEEDLE = "patchstack-widget";
-var SOURCE_SHELL_CANDIDATES = ["index.html", "public/index.html", "src/app.html"];
-function buildWidgetTag(siteUuid) {
-  return `<script src="${WIDGET_SCRIPT_URL}" data-site-uuid="${siteUuid}" defer ${WIDGET_MARKER_ATTR}="true"></script>`;
+// src/protect/install/util.ts
+import { readFileSync, existsSync as existsSync2, writeFileSync } from "fs";
+import { join as join2, dirname } from "path";
+import { fileURLToPath } from "url";
+var read = (p) => readFileSync(p, "utf8");
+var log = (msg) => console.log(`patchstack protect: ${msg}`);
+function hasDependency(cwd, name) {
+  try {
+    const pkg = JSON.parse(read(join2(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }[name]);
+  } catch {
+    return false;
+  }
 }
-var MANAGED_TAG_RE = new RegExp(
-  `<script[^>]*${WIDGET_MARKER_ATTR}[^>]*>\\s*</script>`,
-  "i"
-);
-function ensureWidgetInHtml(html, siteUuid) {
-  const tag = buildWidgetTag(siteUuid);
-  const managed = html.match(MANAGED_TAG_RE);
-  if (managed !== null) {
-    if (managed[0].includes(`data-site-uuid="${siteUuid}"`)) {
-      return { html, action: "unchanged" };
-    }
-    return { html: html.replace(MANAGED_TAG_RE, tag), action: "updated" };
+var SITE_UUID_PLACEHOLDER = "__PATCHSTACK_SITE_UUID__";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function bakeSiteUuid(cwd, guardRelPath) {
+  const rc = join2(cwd, ".patchstackrc.json");
+  if (!existsSync2(rc)) {
+    log("no .patchstackrc.json \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
+    return false;
   }
-  if (html.includes(WIDGET_NEEDLE)) {
-    return { html, action: "manual" };
+  let uuid;
+  try {
+    uuid = JSON.parse(read(rc)).siteUuid;
+  } catch {
+    log(".patchstackrc.json unreadable \u2014 skipping site-UUID bake");
+    return false;
   }
-  const bodyClose = html.match(/([ \t]*)<\/body>/i);
-  if (bodyClose === null || bodyClose.index === void 0) {
-    return { html, action: "no-body" };
+  if (typeof uuid !== "string" || !UUID_RE.test(uuid)) {
+    log(".patchstackrc.json siteUuid missing or malformed \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
+    return false;
   }
-  const indent = bodyClose[1] ?? "";
-  const insertion = `${indent}  ${tag}
-${indent}</body>`;
-  return {
-    html: html.slice(0, bodyClose.index) + insertion + html.slice(bodyClose.index + bodyClose[0].length),
-    action: "added"
-  };
-}
-function findSourceShell(cwd) {
-  for (const candidate of SOURCE_SHELL_CANDIDATES) {
-    if (existsSync2(path8.join(cwd, candidate))) {
-      return candidate;
-    }
+  const guardPath = join2(cwd, guardRelPath);
+  if (!existsSync2(guardPath)) return false;
+  const source = read(guardPath);
+  if (!source.includes(SITE_UUID_PLACEHOLDER)) {
+    log(`${guardRelPath} site UUID already baked`);
+    return false;
   }
-  return null;
+  writeFileSync(guardPath, source.replace(SITE_UUID_PLACEHOLDER, uuid));
+  log(`baked site UUID into ${guardRelPath} \u2014 live rules from the Patchstack API`);
+  return true;
 }
-function ensureSourceWidget(cwd, siteUuid) {
-  const shell = findSourceShell(cwd);
-  if (shell === null) {
-    return { shell: null, action: "no-shell" };
-  }
-  const file = path8.join(cwd, shell);
-  const before = readFileSync(file, "utf8");
-  const { html, action } = ensureWidgetInHtml(before, siteUuid);
-  if (html !== before) {
-    writeFileSync(file, html);
-  }
-  return { shell, action };
+var HERE = dirname(fileURLToPath(import.meta.url));
+function templatesDir() {
+  const builtLayout = join2(HERE, "protect", "templates");
+  const candidates = [
+    builtLayout,
+    join2(HERE, "..", "templates"),
+    // source: src/protect/install/ → src/protect/templates
+    join2(HERE, "templates")
+  ];
+  return candidates.find((p) => existsSync2(p)) ?? builtLayout;
 }
 
-// src/guide.ts
-var WIDGET_NEEDLE2 = "patchstack-widget";
-var INSTALL_COMMANDS = {
-  npm: "npm install --save-dev @patchstack/connect",
-  pnpm: "pnpm add -D @patchstack/connect",
-  yarn: "yarn add -D @patchstack/connect",
-  bun: "bun add -d @patchstack/connect"
-};
-var PM_BY_LOCKFILE = [
-  { filename: "bun.lock", pm: "bun" },
-  { filename: "bun.lockb", pm: "bun" },
-  { filename: "pnpm-lock.yaml", pm: "pnpm" },
-  { filename: "yarn.lock", pm: "yarn" },
-  { filename: "package-lock.json", pm: "npm" }
-];
-var WIDGET_FILE_CANDIDATES = {
-  next: [
-    "app/layout.tsx",
-    "app/layout.jsx",
-    "src/app/layout.tsx",
-    "src/app/layout.jsx",
-    "pages/_document.tsx",
-    "pages/_document.jsx",
-    "src/pages/_document.tsx"
-  ],
-  nuxt: ["app.vue", "src/app.vue", "app/app.vue"],
-  remix: ["app/root.tsx", "app/root.jsx"],
-  "react-router": ["app/root.tsx", "src/root.tsx"],
-  "tanstack-start": ["src/routes/__root.tsx", "app/routes/__root.tsx"],
-  sveltekit: ["src/app.html"],
-  astro: ["src/layouts/Layout.astro"],
-  gatsby: ["src/html.js"]
-};
-var GENERIC_WIDGET_FILES = ["index.html", "public/index.html"];
-var SKIPPED_DIRS = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".git",
-  "dist",
-  "build",
-  "out",
-  ".output",
-  ".next",
-  ".nuxt",
-  ".svelte-kit",
-  ".vercel",
-  ".netlify",
-  "coverage",
-  "vendor"
-]);
-var WIDGET_EXTENSIONS = /* @__PURE__ */ new Set([
-  ".html",
-  ".htm",
-  ".tsx",
-  ".jsx",
-  ".ts",
-  ".js",
-  ".mjs",
-  ".cjs",
-  ".vue",
-  ".svelte",
-  ".astro",
-  ".ejs",
-  ".hbs"
-]);
-var WIDGET_SCAN_MAX_FILES = 4e3;
-var WIDGET_SCAN_MAX_DEPTH = 6;
-var WIDGET_SCAN_MAX_BYTES = 512 * 1024;
-function detectPackageManager(cwd) {
-  const declared = readPackageJson(cwd)?.packageManager?.split("@")[0];
-  if (declared === "npm" || declared === "pnpm" || declared === "yarn" || declared === "bun") {
-    return declared;
-  }
-  for (const { filename, pm } of PM_BY_LOCKFILE) {
-    if (existsSync3(path9.join(cwd, filename))) {
-      return pm;
+// src/protect/install/adapters/tanstack-supabase.ts
+import { writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync, copyFileSync } from "fs";
+import { join as join3 } from "path";
+var CLIENT_TUNNEL = [
+  "",
+  "    // PATCHSTACK: in the browser, tunnel Supabase traffic through the app's own server guard",
+  "    // (same-origin) so payloads are inspected before they reach Supabase.",
+  "    if (typeof window !== 'undefined') {",
+  "      const target = typeof input === 'string' ? input : input instanceof Request ? input.url : String(input);",
+  "      const method = init?.method ?? (input instanceof Request ? input.method : 'GET');",
+  "      headers.set('x-ps-target', target);",
+  "      const guardUrl = new URL('/_patchstack/guard', window.location.origin).toString();",
+  "      return fetch(guardUrl, { ...init, method, headers });",
+  "    }",
+  ""
+].join("\n");
+var GUARD_IMPORT = 'import { GUARD_PATH, handleGuardRequest, inspectServerFn, screenResponse, guardRequest } from "@/integrations/patchstack/guard";';
+var GUARD_IMPORT_RE = /import \{[^}]*\} from "@\/integrations\/patchstack\/guard";/;
+var START_IMPORTS = ['import { getRequest } from "@tanstack/react-start/server";', GUARD_IMPORT].join("\n");
+var REQUEST_MIDDLEWARE_BLOCK = [
+  "// #region patchstack-guard (managed by patchstack-connect protect \u2014 do not edit)",
+  "// Browser\u2192Supabase tunnel + response screening; optional route WAF via PATCHSTACK_ROUTE_WAF=1.",
+  "const patchstackGuard = createMiddleware().server(async ({ next }) => {",
+  "  const request = getRequest();",
+  "  if (request) {",
+  "    const { pathname } = new URL(request.url);",
+  "    if (pathname === GUARD_PATH) return handleGuardRequest(request);",
+  '    if (process.env.PATCHSTACK_ROUTE_WAF === "1") {',
+  "      const blocked = await guardRequest(request);",
+  "      if (blocked) return blocked;",
+  "    }",
+  "  }",
+  "  return screenResponse(await next());",
+  "});",
+  "// #endregion patchstack-guard"
+].join("\n");
+var FUNCTION_MIDDLEWARE_BLOCK = [
+  "// #region patchstack-function-guard (managed by patchstack-connect protect \u2014 do not edit)",
+  "// Inspect server-function args before they reach the database.",
+  'const patchstackFunctionGuard = createMiddleware({ type: "function" }).server(async ({ next, data }) => {',
+  "  const blocked = await inspectServerFn(data);",
+  "  if (blocked) throw new Error(blocked.message);",
+  "  return next();",
+  "});",
+  "// #endregion patchstack-function-guard"
+].join("\n");
+function reconcileBlock(s, region, block, legacyConst, insertBefore) {
+  const lines = s.split("\n");
+  const startMarker = `// #region ${region} `;
+  const endMarker = `// #endregion ${region}`;
+  const si = lines.findIndex((l) => l.includes(startMarker));
+  if (si !== -1) {
+    const ei = lines.findIndex((l, i) => i > si && l.trim() === endMarker);
+    if (ei !== -1) {
+      lines.splice(si, ei - si + 1, ...block.split("\n"));
+      return lines.join("\n");
     }
   }
-  return "npm";
-}
-function installCommand(pm) {
-  return INSTALL_COMMANDS[pm];
-}
-function readPackageJson(cwd) {
-  try {
-    return JSON.parse(readFileSync2(path9.join(cwd, "package.json"), "utf8"));
-  } catch {
-    return null;
+  const ci = lines.findIndex((l) => l.includes(legacyConst));
+  if (ci !== -1) {
+    const close = lines.findIndex((l, i) => i >= ci && l.trim() === "});");
+    if (close !== -1) {
+      let start = ci;
+      while (start > 0 && (lines[start - 1] ?? "").trim().startsWith("//")) start--;
+      lines.splice(start, close - start + 1, ...block.split("\n"));
+      return lines.join("\n");
+    }
   }
+  return s.replace(insertBefore, block + "\n\n" + insertBefore);
 }
-function installedVersion(cwd, declaredRange) {
+function detect(cwd) {
+  const pkgPath = join3(cwd, "package.json");
+  if (!existsSync3(pkgPath)) return false;
+  let pkg;
   try {
-    const pkg = JSON.parse(
-      readFileSync2(path9.join(cwd, "node_modules", "@patchstack", "connect", "package.json"), "utf8")
-    );
-    if (typeof pkg.version === "string" && pkg.version.length > 0) {
-      return pkg.version;
-    }
+    pkg = JSON.parse(read(pkgPath));
   } catch {
+    return false;
   }
-  return declaredRange;
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  return Boolean(deps["@tanstack/react-start"]) && existsSync3(join3(cwd, "src/start.ts")) && existsSync3(join3(cwd, "src/integrations/supabase/client.ts"));
 }
-function findWidgetMarker(cwd, siteUuid) {
-  let budget = WIDGET_SCAN_MAX_FILES;
-  let sawWidget = false;
-  let sawTokenMatch = false;
-  const settled = () => sawTokenMatch || sawWidget && siteUuid == null;
-  const walk2 = (dir, depth) => {
-    if (depth > WIDGET_SCAN_MAX_DEPTH || budget <= 0) {
-      return;
-    }
-    let entries;
-    try {
-      entries = readdirSync2(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (budget <= 0 || settled()) {
-        return;
-      }
-      const full = path9.join(dir, entry.name);
-      if (entry.isDirectory()) {
-        if (SKIPPED_DIRS.has(entry.name) || entry.name.startsWith(".")) {
-          continue;
-        }
-        walk2(full, depth + 1);
-        continue;
-      }
-      if (!entry.isFile() || !WIDGET_EXTENSIONS.has(path9.extname(entry.name).toLowerCase())) {
-        continue;
-      }
-      budget -= 1;
-      try {
-        if (statSync2(full).size > WIDGET_SCAN_MAX_BYTES) {
-          continue;
-        }
-        const content = readFileSync2(full, "utf8");
-        if (!content.includes(WIDGET_NEEDLE2)) {
-          continue;
-        }
-        sawWidget = true;
-        if (siteUuid != null && content.includes(siteUuid)) {
-          sawTokenMatch = true;
-        }
-      } catch {
-      }
-    }
-  };
-  walk2(cwd, 0);
-  return {
-    found: sawWidget,
-    uuidMatches: sawWidget && siteUuid != null ? sawTokenMatch : null
-  };
-}
-function resolveWidgetFileHint(cwd, framework) {
-  const candidates = [
-    ...framework !== null ? WIDGET_FILE_CANDIDATES[framework] ?? [] : [],
-    ...GENERIC_WIDGET_FILES
-  ];
-  for (const candidate of candidates) {
-    if (existsSync3(path9.join(cwd, candidate))) {
-      return candidate;
-    }
+var GUARD_FILE = "src/integrations/patchstack/guard.ts";
+function scaffold(cwd, opts) {
+  const templates = templatesDir();
+  const dst = join3(cwd, "src/integrations/patchstack");
+  mkdirSync(dst, { recursive: true });
+  copyFileSync(join3(templates, "guard.ts"), join3(dst, "guard.ts"));
+  const changed = [GUARD_FILE];
+  const rulesDst = join3(dst, "rules.json");
+  if (opts.demo) {
+    copyFileSync(join3(templates, "demo-rules.json"), rulesDst);
+    changed.push("src/integrations/patchstack/rules.json");
+    log("scaffolded guard.ts + rules.json (demo sample rule set)");
+  } else if (!existsSync3(rulesDst)) {
+    copyFileSync(join3(templates, "rules.json"), rulesDst);
+    changed.push("src/integrations/patchstack/rules.json");
+    log("scaffolded guard.ts + rules.json (starter rules)");
+  } else {
+    log("scaffolded guard.ts (kept existing rules.json)");
   }
-  return null;
+  return changed;
 }
-async function collectGuideState(cwd) {
-  const pkg = readPackageJson(cwd);
-  const packageManager = detectPackageManager(cwd);
-  let installed = null;
-  if (pkg?.devDependencies?.["@patchstack/connect"] !== void 0) {
-    installed = {
-      version: installedVersion(cwd, pkg.devDependencies["@patchstack/connect"]),
-      section: "devDependencies"
-    };
-  } else if (pkg?.dependencies?.["@patchstack/connect"] !== void 0) {
-    installed = {
-      version: installedVersion(cwd, pkg.dependencies["@patchstack/connect"]),
-      section: "dependencies"
-    };
+function patchClient(cwd) {
+  const p = join3(cwd, "src/integrations/supabase/client.ts");
+  const s = read(p);
+  if (s.includes("x-ps-target")) {
+    log("client.ts already wired");
+    return false;
   }
-  let siteUuid = null;
-  let claimUrl = null;
-  let endpointOverride = null;
-  let widgetOptOut = false;
-  try {
-    const config = await resolveConfig({ cwd });
-    siteUuid = config.siteUuid;
-    if (siteUuid !== null) {
-      claimUrl = buildClaimUrl(config.endpoint, siteUuid);
-    }
-    if (config.endpoint !== DEFAULT_ENDPOINT) {
-      endpointOverride = config.endpoint;
-    }
-    widgetOptOut = !config.widget;
-  } catch {
+  const anchor = "headers.set('apikey', supabaseKey);";
+  if (!s.includes(anchor)) {
+    log("client.ts anchor not found \u2014 skipping (template changed?)");
+    return false;
   }
-  const declaredNames = Object.keys({ ...pkg?.dependencies, ...pkg?.devDependencies });
-  const stack = detectStack(
-    declaredNames.map((name) => ({ name, version: "" })),
-    {}
-  );
-  const widget = findWidgetMarker(cwd, siteUuid);
-  return {
-    projectName: pkg?.name ?? null,
-    hasPackageJson: pkg !== null,
-    packageManager,
-    installed,
-    siteUuid,
-    claimUrl,
-    endpointOverride,
-    // bun run doesn't execute npm-style pre/post scripts, so chaining inside
-    // the build script itself also counts as wired (and is what we suggest on bun).
-    prebuildWired: (pkg?.scripts?.prebuild ?? "").includes("patchstack-connect scan") || (pkg?.scripts?.build ?? "").includes("patchstack-connect scan"),
-    postbuildWired: (pkg?.scripts?.postbuild ?? "").includes("patchstack-connect mark-build") || (pkg?.scripts?.build ?? "").includes("patchstack-connect mark-build"),
-    widgetInstalled: widget.found,
-    widgetTokenMatches: widget.uuidMatches,
-    widgetOptOut,
-    framework: stack.framework,
-    widgetFileHint: resolveWidgetFileHint(cwd, stack.framework)
-  };
-}
-var ANSI = {
-  reset: "\x1B[0m",
-  bold: "\x1B[1m",
-  dim: "\x1B[2m",
-  green: "\x1B[32m",
-  yellow: "\x1B[33m",
-  cyan: "\x1B[36m"
-};
-function countRemainingSteps(state) {
-  return [
-    state.installed !== null,
-    state.siteUuid !== null,
-    state.prebuildWired && state.postbuildWired,
-    state.widgetOptOut || state.widgetInstalled && state.widgetTokenMatches !== false
-  ].filter((step) => !step).length;
+  writeFileSync2(p, s.replace(anchor, anchor + "\n" + CLIENT_TUNNEL));
+  log("patched client.ts (tunnel Supabase through the guard)");
+  return true;
 }
-function renderGuideChecklist(state, useColor) {
-  const paint = (code, text) => useColor ? `${code}${text}${ANSI.reset}` : text;
-  const done = (text) => ` ${paint(ANSI.green, "\u2714")} ${text}`;
-  const todo = (text) => ` ${paint(ANSI.yellow, "\u2716")} ${paint(ANSI.bold, text)}`;
-  const detail = (text) => `     ${paint(ANSI.dim, text)}`;
-  const lines = [];
-  const headerParts = [state.framework, state.packageManager].filter(
-    (part) => part !== null
-  );
-  const name = state.projectName ?? path9.basename(process.cwd());
-  lines.push(paint(ANSI.bold, `Patchstack setup status \u2014 ${name} (${headerParts.join(" \xB7 ")})`));
-  if (state.endpointOverride !== null) {
-    lines.push(
-      detail(
-        `endpoint override in effect: ${state.endpointOverride} (set via .patchstackrc.json, PATCHSTACK_ENDPOINT, or --endpoint)`
-      )
-    );
-  }
-  lines.push("");
-  if (!state.hasPackageJson) {
-    lines.push(todo("No package.json found in this directory."));
-    lines.push(detail("Run the guide from the project root."));
-    return lines.join("\n");
-  }
-  if (state.installed !== null) {
-    lines.push(done(`@patchstack/connect installed (${state.installed.version}, ${state.installed.section})`));
-  } else {
-    lines.push(todo("Install @patchstack/connect as a dev dependency"));
-    lines.push(detail(`Run \u2192 ${installCommand(state.packageManager)}`));
-    if (state.packageManager === "bun") {
-      lines.push(detail(`(if bun isn't available here, ${INSTALL_COMMANDS.npm} works too)`));
-    }
-  }
-  if (state.siteUuid !== null) {
-    lines.push(done(`Site provisioned (${state.siteUuid})`));
-  } else {
-    lines.push(todo("Provision the site \u2014 run the first scan"));
-    lines.push(detail("Run \u2192 npx @patchstack/connect scan"));
-    lines.push(detail("Reads the lockfile, registers the project, writes .patchstackrc.json,"));
-    lines.push(detail("and prints a dashboard link. The CLI prints the link but never opens it."));
+function patchStart(cwd) {
+  const p = join3(cwd, "src/start.ts");
+  let s = read(p);
+  const importAnchor = 'import { createStart, createMiddleware } from "@tanstack/react-start";';
+  const exportAnchor = "export const startInstance";
+  const rmAnchor = "requestMiddleware: [";
+  if (!s.includes(importAnchor) || !s.includes(exportAnchor)) {
+    log("start.ts anchors not found \u2014 skipping (template changed?)");
+    return false;
   }
-  if (state.prebuildWired && state.postbuildWired) {
-    lines.push(done("Build hooks wired (scan before builds, mark-build after)"));
-  } else if (state.packageManager === "bun") {
-    lines.push(todo('Wire the build hooks yourself \u2014 edit package.json (bun skips pre/post hooks, so chain inside "build")'));
-    lines.push(detail('Edit package.json \u2192 "build": "patchstack-connect scan && <existing build command> && patchstack-connect mark-build"'));
+  const original = s;
+  if (GUARD_IMPORT_RE.test(s)) {
+    s = s.replace(GUARD_IMPORT_RE, GUARD_IMPORT);
   } else {
-    lines.push(todo('Wire the build hooks yourself \u2014 edit package.json "scripts" (chain with && if a hook already exists)'));
-    if (!state.prebuildWired) {
-      lines.push(detail('Edit package.json \u2192 "prebuild": "patchstack-connect scan"'));
-    }
-    if (!state.postbuildWired) {
-      lines.push(detail('Edit package.json \u2192 "postbuild": "patchstack-connect mark-build"'));
-    }
+    s = s.replace(importAnchor, importAnchor + "\n" + START_IMPORTS);
   }
-  const widgetOk = state.widgetInstalled && state.widgetTokenMatches !== false;
-  if (state.widgetOptOut && !widgetOk) {
-    lines.push(done('Disclosure widget disabled by config ("widget": false in .patchstackrc.json)'));
-  } else if (widgetOk) {
-    lines.push(done("Disclosure widget installed"));
-  } else if (state.widgetInstalled) {
-    lines.push(todo("Fix the disclosure widget yourself \u2014 its site UUID doesn't match this project's"));
-    lines.push(detail(`Edit the widget tag \u2192 set data-site-uuid (or userToken) to '${state.siteUuid}' (a wrong UUID makes the widget silently no-op)`));
-  } else if (state.siteUuid === null) {
-    lines.push(todo('Add the "Report a vulnerability" widget \u2014 the first scan does this for you'));
-    lines.push(detail("Run \u2192 npx @patchstack/connect scan  (provisions the site and adds the widget tag"));
-    lines.push(detail("  to the root HTML shell: index.html / public/index.html / src/app.html)"));
-  } else {
-    lines.push(todo('Add the "Report a vulnerability" widget yourself \u2014 this root is code, not a plain HTML shell'));
-    lines.push(detail("Note \u2192 a normal `scan` adds this tag to a plain HTML shell automatically; add it by hand here:"));
-    const placement = state.widgetFileHint !== null ? `Edit ${state.widgetFileHint} \u2192 put it just before </body>:` : "Edit your root layout \u2192 put it just before </body> (the framework's HTML/layout mechanism, never a JS entry point):";
-    lines.push(detail(placement));
-    lines.push(detail(`  ${buildWidgetTag(state.siteUuid)}`));
-    lines.push(detail("The site UUID is public by design \u2014 it ships in client-side HTML."));
+  s = reconcileBlock(s, "patchstack-guard", REQUEST_MIDDLEWARE_BLOCK, "const patchstackGuard =", exportAnchor);
+  s = reconcileBlock(s, "patchstack-function-guard", FUNCTION_MIDDLEWARE_BLOCK, "const patchstackFunctionGuard =", exportAnchor);
+  if (s.includes(rmAnchor) && !s.includes("requestMiddleware: [patchstackGuard")) {
+    s = s.replace(rmAnchor, rmAnchor + "patchstackGuard, ");
   }
-  lines.push("");
-  if (state.claimUrl !== null) {
-    lines.push(` ${paint(ANSI.cyan, "\u279C")} ${paint(ANSI.bold, "Dashboard link (open to view reports):")}`);
-    lines.push(`   ${paint(ANSI.cyan, state.claimUrl)}`);
-    lines.push(detail("Open this link in a browser. The CLI never opens it."));
-    if (state.endpointOverride !== null) {
-      lines.push(detail("(this URL inherits the endpoint override above)"));
+  if (!s.includes("functionMiddleware: [patchstackFunctionGuard")) {
+    const fmAnchor = "functionMiddleware: [";
+    if (s.includes(fmAnchor)) {
+      s = s.replace(fmAnchor, fmAnchor + "patchstackFunctionGuard, ");
+    } else if (s.includes(rmAnchor)) {
+      s = s.replace(rmAnchor, "functionMiddleware: [patchstackFunctionGuard],\n    " + rmAnchor);
     }
-  } else {
-    lines.push(detail("The dashboard link appears after the first scan (re-print any time with `status`)."));
   }
-  const remaining = countRemainingSteps(state);
-  lines.push("");
-  if (remaining === 0) {
-    lines.push(
-      done(
-        paint(
-          ANSI.bold,
-          "All setup steps complete. Commit .patchstackrc.json, package.json, and the file carrying the widget snippet."
-        )
-      )
-    );
-    if (state.claimUrl !== null) {
-      lines.push(detail("The only manual action left is opening the dashboard link above (if not already connected)."));
-    }
-  } else {
-    lines.push(
-      ` ${paint(ANSI.yellow, String(remaining))} step(s) remaining \u2014 details in the reference guide below.`
-    );
+  if (s === original) {
+    log("start.ts already wired");
+    return false;
   }
-  return lines.join("\n");
+  writeFileSync2(p, s);
+  log("patched start.ts (guard registered as request + function middleware)");
+  return true;
+}
+function wire(cwd, opts) {
+  const changed = scaffold(cwd, opts);
+  if (!opts.demo && bakeSiteUuid(cwd, GUARD_FILE)) changed.push(GUARD_FILE);
+  if (patchClient(cwd)) changed.push("src/integrations/supabase/client.ts");
+  if (patchStart(cwd)) changed.push("src/start.ts");
+  log(
+    opts.demo ? "done \u2014 guard wired with the demo sample rules (blocks by default). Set PATCHSTACK_MODE=dry-run for log-only." : "done \u2014 guard wired and always-on (blocks by default). Set PATCHSTACK_MODE=dry-run for log-only."
+  );
+  return { ok: true, changed: [...new Set(changed)] };
 }
+function verify(cwd) {
+  const guardPath = join3(cwd, GUARD_FILE);
+  const clientPath = join3(cwd, "src/integrations/supabase/client.ts");
+  const startPath = join3(cwd, "src/start.ts");
+  const guard = existsSync3(guardPath) ? read(guardPath) : "";
+  const client = existsSync3(clientPath) ? read(clientPath) : "";
+  const start = existsSync3(startPath) ? read(startPath) : "";
+  const checks = [
+    { label: "guard.ts scaffolded", ok: guard.length > 0, hint: "run `patchstack-connect protect`" },
+    { label: "Supabase client tunnels through the guard", ok: client.includes("x-ps-target"), hint: "run `patchstack-connect protect` to re-patch src/integrations/supabase/client.ts" },
+    { label: "request middleware defined + registered", ok: start.includes("const patchstackGuard =") && start.includes("requestMiddleware: [patchstackGuard"), hint: "run `patchstack-connect protect` to re-patch src/start.ts" },
+    { label: "server-function middleware defined + registered", ok: start.includes("const patchstackFunctionGuard =") && start.includes("functionMiddleware: [patchstackFunctionGuard"), hint: "run `patchstack-connect protect` to re-patch src/start.ts" }
+  ];
+  return { wired: checks.every((c) => c.ok), checks };
+}
+var tanstackSupabaseAdapter = {
+  name: "tanstack-supabase",
+  label: "TanStack Start + Supabase",
+  detect,
+  wire,
+  verify
+};
 
-// src/protect/install/util.ts
-import { readFileSync as readFileSync3, existsSync as existsSync4, writeFileSync as writeFileSync2 } from "fs";
-import { join as join2, dirname } from "path";
-import { fileURLToPath } from "url";
-var read = (p) => readFileSync3(p, "utf8");
-var log = (msg) => console.log(`patchstack protect: ${msg}`);
-function hasDependency(cwd, name) {
+// src/protect/install/adapters/next.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, copyFileSync as copyFileSync2 } from "fs";
+import { join as join4 } from "path";
+function hasNextDep(cwd) {
   try {
-    const pkg = JSON.parse(read(join2(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }[name]);
+    const pkg = JSON.parse(read(join4(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.next);
   } catch {
     return false;
   }
 }
-var SITE_UUID_PLACEHOLDER = "__PATCHSTACK_SITE_UUID__";
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function bakeSiteUuid(cwd, guardRelPath) {
-  const rc = join2(cwd, ".patchstackrc.json");
-  if (!existsSync4(rc)) {
-    log("no .patchstackrc.json \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
-    return false;
-  }
-  let uuid;
-  try {
-    uuid = JSON.parse(read(rc)).siteUuid;
-  } catch {
-    log(".patchstackrc.json unreadable \u2014 skipping site-UUID bake");
-    return false;
-  }
-  if (typeof uuid !== "string" || !UUID_RE.test(uuid)) {
-    log(".patchstackrc.json siteUuid missing or malformed \u2014 guard uses PATCHSTACK_SITE_UUID env or the bundled fallback");
-    return false;
-  }
-  const guardPath = join2(cwd, guardRelPath);
-  if (!existsSync4(guardPath)) return false;
-  const source = read(guardPath);
-  if (!source.includes(SITE_UUID_PLACEHOLDER)) {
-    log(`${guardRelPath} site UUID already baked`);
-    return false;
+function middlewareInfo(cwd) {
+  const candidates = ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"];
+  for (const rel of candidates) {
+    if (existsSync4(join4(cwd, rel))) return { relDir: rel.includes("/") ? "src" : ".", relFile: rel, exists: true };
   }
-  writeFileSync2(guardPath, source.replace(SITE_UUID_PLACEHOLDER, uuid));
-  log(`baked site UUID into ${guardRelPath} \u2014 live rules from the Patchstack API`);
-  return true;
+  const useSrc = existsSync4(join4(cwd, "src"));
+  return { relDir: useSrc ? "src" : ".", relFile: useSrc ? "src/middleware.ts" : "middleware.ts", exists: false };
 }
-var HERE = dirname(fileURLToPath(import.meta.url));
-function templatesDir() {
-  const builtLayout = join2(HERE, "protect", "templates");
-  const candidates = [
-    builtLayout,
-    join2(HERE, "..", "templates"),
-    // source: src/protect/install/ → src/protect/templates
-    join2(HERE, "templates")
-  ];
-  return candidates.find((p) => existsSync4(p)) ?? builtLayout;
+function detect2(cwd) {
+  return hasNextDep(cwd);
 }
-
-// src/protect/install/adapters/tanstack-supabase.ts
-import { writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync, copyFileSync } from "fs";
-import { join as join3 } from "path";
-var CLIENT_TUNNEL = [
-  "",
-  "    // PATCHSTACK: in the browser, tunnel Supabase traffic through the app's own server guard",
-  "    // (same-origin) so payloads are inspected before they reach Supabase.",
-  "    if (typeof window !== 'undefined') {",
-  "      const target = typeof input === 'string' ? input : input instanceof Request ? input.url : String(input);",
-  "      const method = init?.method ?? (input instanceof Request ? input.method : 'GET');",
-  "      headers.set('x-ps-target', target);",
-  "      const guardUrl = new URL('/_patchstack/guard', window.location.origin).toString();",
-  "      return fetch(guardUrl, { ...init, method, headers });",
-  "    }",
-  ""
-].join("\n");
-var GUARD_IMPORT = 'import { GUARD_PATH, handleGuardRequest, inspectServerFn, screenResponse, guardRequest } from "@/integrations/patchstack/guard";';
-var GUARD_IMPORT_RE = /import \{[^}]*\} from "@\/integrations\/patchstack\/guard";/;
-var START_IMPORTS = ['import { getRequest } from "@tanstack/react-start/server";', GUARD_IMPORT].join("\n");
-var REQUEST_MIDDLEWARE_BLOCK = [
-  "// #region patchstack-guard (managed by patchstack-connect protect \u2014 do not edit)",
-  "// Browser\u2192Supabase tunnel + response screening; optional route WAF via PATCHSTACK_ROUTE_WAF=1.",
-  "const patchstackGuard = createMiddleware().server(async ({ next }) => {",
-  "  const request = getRequest();",
-  "  if (request) {",
-  "    const { pathname } = new URL(request.url);",
-  "    if (pathname === GUARD_PATH) return handleGuardRequest(request);",
-  '    if (process.env.PATCHSTACK_ROUTE_WAF === "1") {',
-  "      const blocked = await guardRequest(request);",
-  "      if (blocked) return blocked;",
-  "    }",
-  "  }",
-  "  return screenResponse(await next());",
-  "});",
-  "// #endregion patchstack-guard"
-].join("\n");
-var FUNCTION_MIDDLEWARE_BLOCK = [
-  "// #region patchstack-function-guard (managed by patchstack-connect protect \u2014 do not edit)",
-  "// Inspect server-function args before they reach the database.",
-  'const patchstackFunctionGuard = createMiddleware({ type: "function" }).server(async ({ next, data }) => {',
-  "  const blocked = await inspectServerFn(data);",
-  "  if (blocked) throw new Error(blocked.message);",
-  "  return next();",
-  "});",
-  "// #endregion patchstack-function-guard"
-].join("\n");
-function reconcileBlock(s, region, block, legacyConst, insertBefore) {
-  const lines = s.split("\n");
-  const startMarker = `// #region ${region} `;
-  const endMarker = `// #endregion ${region}`;
-  const si = lines.findIndex((l) => l.includes(startMarker));
-  if (si !== -1) {
-    const ei = lines.findIndex((l, i) => i > si && l.trim() === endMarker);
-    if (ei !== -1) {
-      lines.splice(si, ei - si + 1, ...block.split("\n"));
-      return lines.join("\n");
-    }
+function rulesFile(relDir) {
+  return relDir === "." ? "patchstack.rules.json" : `${relDir}/patchstack.rules.json`;
+}
+function wire2(cwd, opts) {
+  const templates = templatesDir();
+  const mw = middlewareInfo(cwd);
+  const dir = join4(cwd, mw.relDir === "." ? "" : mw.relDir);
+  mkdirSync2(dir, { recursive: true });
+  const rulesDst = join4(dir, "patchstack.rules.json");
+  const changed = [];
+  if (opts.demo || !existsSync4(rulesDst)) {
+    copyFileSync2(join4(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    changed.push(rulesFile(mw.relDir));
+  }
+  const mwPath = join4(cwd, mw.relFile);
+  const existing = mw.exists ? read(mwPath) : "";
+  if (mw.exists && existing.includes("patchstack-next")) {
+    log(`${mw.relFile} already has the Patchstack middleware \u2014 left as-is`);
+    return { ok: true, changed };
+  }
+  if (mw.exists) {
+    log(
+      `existing ${mw.relFile} left untouched \u2014 scaffolded ${rulesFile(mw.relDir)}; add the guard to your middleware: import { createProtection } from "@patchstack/connect/protect", run fetchGuard() on the request, and return the block Response. Then: npx patchstack-connect protect --check`
+    );
+    return { ok: true, changed };
   }
-  const ci = lines.findIndex((l) => l.includes(legacyConst));
-  if (ci !== -1) {
-    const close = lines.findIndex((l, i) => i >= ci && l.trim() === "});");
-    if (close !== -1) {
-      let start = ci;
-      while (start > 0 && (lines[start - 1] ?? "").trim().startsWith("//")) start--;
-      lines.splice(start, close - start + 1, ...block.split("\n"));
-      return lines.join("\n");
-    }
+  copyFileSync2(join4(templates, "next-middleware.ts"), mwPath);
+  if (!opts.demo) bakeSiteUuid(cwd, mw.relFile);
+  changed.push(mw.relFile);
+  log(`scaffolded ${mw.relFile} (Patchstack middleware)`);
+  return { ok: true, changed: [...new Set(changed)] };
+}
+function verify2(cwd) {
+  const mw = middlewareInfo(cwd);
+  const present = mw.exists && read(join4(cwd, mw.relFile)).includes("patchstack-next");
+  const rulesPresent = existsSync4(join4(cwd, rulesFile(mw.relDir)));
+  return {
+    wired: present && rulesPresent,
+    checks: [
+      { label: "Patchstack middleware present", ok: present, hint: `run \`patchstack-connect protect\` (writes ${mw.relFile})` },
+      { label: "rules co-located with the middleware", ok: rulesPresent, hint: "run `patchstack-connect protect`" }
+    ]
+  };
+}
+var nextAdapter = {
+  name: "nextjs",
+  label: "Next.js",
+  detect: detect2,
+  wire: wire2,
+  verify: verify2
+};
+
+// src/protect/install/adapters/sveltekit.ts
+import { join as join6 } from "path";
+
+// src/protect/install/seam.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, copyFileSync as copyFileSync3 } from "fs";
+import { join as join5, dirname as dirname2 } from "path";
+function rulesRel(seamRel) {
+  const d = dirname2(seamRel);
+  return (d === "." ? "patchstack.rules.json" : `${d}/patchstack.rules.json`).replace(/\\/g, "/");
+}
+function wireSeam(cwd, opts, spec) {
+  const templates = templatesDir();
+  const existing = spec.candidates.find((c) => existsSync5(join5(cwd, c)));
+  const seamRel = existing ?? spec.target;
+  mkdirSync3(dirname2(join5(cwd, seamRel)), { recursive: true });
+  const rulesDst = join5(cwd, rulesRel(seamRel));
+  const changed = [];
+  if (opts.demo || !existsSync5(rulesDst)) {
+    copyFileSync3(join5(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    changed.push(rulesRel(seamRel));
   }
-  return s.replace(insertBefore, block + "\n\n" + insertBefore);
+  const current = existing ? read(join5(cwd, existing)) : "";
+  if (existing && current.includes(spec.marker)) {
+    log(`${existing} already has the Patchstack guard \u2014 left as-is`);
+    return { ok: true, changed };
+  }
+  if (existing) {
+    log(`existing ${existing} left untouched \u2014 scaffolded ${rulesRel(seamRel)}; ${spec.planHint}`);
+    return { ok: true, changed };
+  }
+  copyFileSync3(join5(templates, spec.templateName), join5(cwd, seamRel));
+  if (!opts.demo) bakeSiteUuid(cwd, seamRel);
+  changed.push(seamRel);
+  log(`scaffolded ${seamRel}`);
+  return { ok: true, changed: [...new Set(changed)] };
 }
-function detect(cwd) {
-  const pkgPath = join3(cwd, "package.json");
-  if (!existsSync5(pkgPath)) return false;
-  let pkg;
+function verifySeam(cwd, spec) {
+  const existing = spec.candidates.find((c) => existsSync5(join5(cwd, c)));
+  const seamRel = existing ?? spec.target;
+  const present = existing ? read(join5(cwd, existing)).includes(spec.marker) : false;
+  const rulesPresent = existsSync5(join5(cwd, rulesRel(seamRel)));
+  return {
+    wired: present && rulesPresent,
+    checks: [
+      { label: `${spec.seamLabel} present`, ok: present, hint: `run \`patchstack-connect protect\` (writes ${spec.target})` },
+      { label: "rules co-located with the guard", ok: rulesPresent, hint: "run `patchstack-connect protect`" }
+    ]
+  };
+}
+
+// src/protect/install/adapters/sveltekit.ts
+var SPEC = {
+  templateName: "sveltekit-hooks.ts",
+  candidates: ["src/hooks.server.ts", "src/hooks.server.js"],
+  target: "src/hooks.server.ts",
+  marker: "patchstack-sveltekit",
+  planHint: 'add the guard to your `handle` (compose with `sequence()` from "@sveltejs/kit/hooks"), then: npx patchstack-connect protect --check',
+  seamLabel: "SvelteKit server hook"
+};
+function detect3(cwd) {
   try {
-    pkg = JSON.parse(read(pkgPath));
+    const pkg = JSON.parse(read(join6(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }["@sveltejs/kit"]);
   } catch {
     return false;
   }
-  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
-  return Boolean(deps["@tanstack/react-start"]) && existsSync5(join3(cwd, "src/start.ts")) && existsSync5(join3(cwd, "src/integrations/supabase/client.ts"));
 }
-var GUARD_FILE = "src/integrations/patchstack/guard.ts";
-function scaffold(cwd, opts) {
-  const templates = templatesDir();
-  const dst = join3(cwd, "src/integrations/patchstack");
-  mkdirSync(dst, { recursive: true });
-  copyFileSync(join3(templates, "guard.ts"), join3(dst, "guard.ts"));
-  const changed = [GUARD_FILE];
-  const rulesDst = join3(dst, "rules.json");
-  if (opts.demo) {
-    copyFileSync(join3(templates, "demo-rules.json"), rulesDst);
-    changed.push("src/integrations/patchstack/rules.json");
-    log("scaffolded guard.ts + rules.json (demo sample rule set)");
-  } else if (!existsSync5(rulesDst)) {
-    copyFileSync(join3(templates, "rules.json"), rulesDst);
-    changed.push("src/integrations/patchstack/rules.json");
-    log("scaffolded guard.ts + rules.json (starter rules)");
-  } else {
-    log("scaffolded guard.ts (kept existing rules.json)");
-  }
-  return changed;
+function wire3(cwd, opts) {
+  return wireSeam(cwd, opts, SPEC);
 }
-function patchClient(cwd) {
-  const p = join3(cwd, "src/integrations/supabase/client.ts");
-  const s = read(p);
-  if (s.includes("x-ps-target")) {
-    log("client.ts already wired");
-    return false;
-  }
-  const anchor = "headers.set('apikey', supabaseKey);";
-  if (!s.includes(anchor)) {
-    log("client.ts anchor not found \u2014 skipping (template changed?)");
-    return false;
-  }
-  writeFileSync3(p, s.replace(anchor, anchor + "\n" + CLIENT_TUNNEL));
-  log("patched client.ts (tunnel Supabase through the guard)");
-  return true;
+function verify3(cwd) {
+  return verifySeam(cwd, SPEC);
 }
-function patchStart(cwd) {
-  const p = join3(cwd, "src/start.ts");
-  let s = read(p);
-  const importAnchor = 'import { createStart, createMiddleware } from "@tanstack/react-start";';
-  const exportAnchor = "export const startInstance";
-  const rmAnchor = "requestMiddleware: [";
-  if (!s.includes(importAnchor) || !s.includes(exportAnchor)) {
-    log("start.ts anchors not found \u2014 skipping (template changed?)");
+var sveltekitAdapter = {
+  name: "sveltekit",
+  label: "SvelteKit",
+  detect: detect3,
+  wire: wire3,
+  verify: verify3
+};
+
+// src/protect/install/adapters/astro.ts
+import { join as join7 } from "path";
+var SPEC2 = {
+  templateName: "astro-middleware.ts",
+  candidates: ["src/middleware.ts", "src/middleware.js", "src/middleware/index.ts", "src/middleware/index.js"],
+  target: "src/middleware.ts",
+  marker: "patchstack-astro",
+  planHint: 'add the guard to your `onRequest` (compose with `sequence()` from "astro:middleware"), then: npx patchstack-connect protect --check',
+  seamLabel: "Astro middleware"
+};
+function detect4(cwd) {
+  try {
+    const pkg = JSON.parse(read(join7(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.astro);
+  } catch {
     return false;
   }
-  const original = s;
-  if (GUARD_IMPORT_RE.test(s)) {
-    s = s.replace(GUARD_IMPORT_RE, GUARD_IMPORT);
-  } else {
-    s = s.replace(importAnchor, importAnchor + "\n" + START_IMPORTS);
-  }
-  s = reconcileBlock(s, "patchstack-guard", REQUEST_MIDDLEWARE_BLOCK, "const patchstackGuard =", exportAnchor);
-  s = reconcileBlock(s, "patchstack-function-guard", FUNCTION_MIDDLEWARE_BLOCK, "const patchstackFunctionGuard =", exportAnchor);
-  if (s.includes(rmAnchor) && !s.includes("requestMiddleware: [patchstackGuard")) {
-    s = s.replace(rmAnchor, rmAnchor + "patchstackGuard, ");
-  }
-  if (!s.includes("functionMiddleware: [patchstackFunctionGuard")) {
-    const fmAnchor = "functionMiddleware: [";
-    if (s.includes(fmAnchor)) {
-      s = s.replace(fmAnchor, fmAnchor + "patchstackFunctionGuard, ");
-    } else if (s.includes(rmAnchor)) {
-      s = s.replace(rmAnchor, "functionMiddleware: [patchstackFunctionGuard],\n    " + rmAnchor);
+}
+function wire4(cwd, opts) {
+  return wireSeam(cwd, opts, SPEC2);
+}
+function verify4(cwd) {
+  return verifySeam(cwd, SPEC2);
+}
+var astroAdapter = {
+  name: "astro",
+  label: "Astro",
+  detect: detect4,
+  wire: wire4,
+  verify: verify4
+};
+
+// src/protect/install/adapters/nuxt.ts
+var SPEC3 = {
+  templateName: "nuxt-middleware.ts",
+  candidates: ["server/middleware/patchstack.ts", "server/middleware/patchstack.js"],
+  target: "server/middleware/patchstack.ts",
+  marker: "patchstack-nuxt",
+  planHint: "add a `server/middleware/` handler that runs the guard, then: npx patchstack-connect protect --check",
+  seamLabel: "Nuxt server middleware"
+};
+function detect5(cwd) {
+  return hasDependency(cwd, "nuxt");
+}
+function wire5(cwd, opts) {
+  return wireSeam(cwd, opts, SPEC3);
+}
+function verify5(cwd) {
+  return verifySeam(cwd, SPEC3);
+}
+var nuxtAdapter = {
+  name: "nuxt",
+  label: "Nuxt",
+  detect: detect5,
+  wire: wire5,
+  verify: verify5
+};
+
+// src/protect/install/find-app.ts
+import { readFileSync as readFileSync2, existsSync as existsSync6, readdirSync as readdirSync2, lstatSync } from "fs";
+import { join as join8, relative, dirname as dirname3 } from "path";
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  "patchstack",
+  "dist",
+  "build",
+  "out",
+  "coverage",
+  ".next",
+  ".output",
+  ".svelte-kit",
+  "test",
+  "tests",
+  "__tests__",
+  "e2e",
+  "examples",
+  "fixtures",
+  "__fixtures__"
+]);
+var MAX_DEPTH = 8;
+function findAppInstance(cwd, re) {
+  const root = existsSync6(join8(cwd, "src")) ? join8(cwd, "src") : cwd;
+  let hit = null;
+  const walk2 = (dir, depth) => {
+    if (hit || depth > MAX_DEPTH) return;
+    let entries;
+    try {
+      entries = readdirSync2(dir).sort();
+    } catch {
+      return;
     }
-  }
-  if (s === original) {
-    log("start.ts already wired");
-    return false;
-  }
-  writeFileSync3(p, s);
-  log("patched start.ts (guard registered as request + function middleware)");
-  return true;
+    for (const name of entries) {
+      if (hit) return;
+      if (SKIP_DIRS.has(name) || name.startsWith(".")) continue;
+      const p = join8(dir, name);
+      let st;
+      try {
+        st = lstatSync(p);
+      } catch {
+        continue;
+      }
+      if (st.isSymbolicLink()) continue;
+      if (st.isDirectory()) walk2(p, depth + 1);
+      else if (/\.(?:ts|js|mjs|cjs)$/.test(name)) {
+        let src;
+        try {
+          src = readFileSync2(p, "utf8");
+        } catch {
+          continue;
+        }
+        const m = re.exec(src);
+        if (m) hit = { relPath: relative(cwd, p).replace(/\\/g, "/"), appVar: m[1] };
+      }
+    }
+  };
+  walk2(root, 0);
+  return hit;
+}
+function importSpecifier(fromRel, toRel, preserveExtension = false) {
+  let spec = relative(dirname3(fromRel), toRel).replace(/\\/g, "/");
+  if (!preserveExtension) spec = spec.replace(/\.(?:ts|js)$/, "");
+  if (!spec.startsWith(".")) spec = `./${spec}`;
+  return spec;
+}
+
+// src/protect/install/register.ts
+import { writeFileSync as writeFileSync4, existsSync as existsSync8 } from "fs";
+import { join as join10 } from "path";
+
+// src/protect/install/generic.ts
+import { readFileSync as readFileSync3, existsSync as existsSync7, mkdirSync as mkdirSync4, copyFileSync as copyFileSync4, readdirSync as readdirSync3, lstatSync as lstatSync2 } from "fs";
+import { join as join9 } from "path";
+var GUARD_MARKER = "patchstack/guard";
+function genericDir(cwd) {
+  return existsSync7(join9(cwd, "src")) ? "src/patchstack" : "patchstack";
 }
-function wire(cwd, opts) {
-  const changed = scaffold(cwd, opts);
-  if (!opts.demo && bakeSiteUuid(cwd, GUARD_FILE)) changed.push(GUARD_FILE);
-  if (patchClient(cwd)) changed.push("src/integrations/supabase/client.ts");
-  if (patchStart(cwd)) changed.push("src/start.ts");
-  log(
-    opts.demo ? "done \u2014 guard wired with the demo sample rules (blocks by default). Set PATCHSTACK_MODE=dry-run for log-only." : "done \u2014 guard wired and always-on (blocks by default). Set PATCHSTACK_MODE=dry-run for log-only."
-  );
-  return { ok: true, changed: [...new Set(changed)] };
+function scaffoldGeneric(cwd, opts, guardTemplate = "generic-guard.ts", guardFile = "guard.ts") {
+  const templates = templatesDir();
+  const dir = genericDir(cwd);
+  const dst = join9(cwd, dir);
+  mkdirSync4(dst, { recursive: true });
+  copyFileSync4(join9(templates, guardTemplate), join9(dst, guardFile));
+  const guardRel = `${dir}/${guardFile}`;
+  const changed = [guardRel];
+  if (!opts.demo) bakeSiteUuid(cwd, guardRel);
+  const rulesDst = join9(dst, "rules.json");
+  if (opts.demo || !existsSync7(rulesDst)) {
+    copyFileSync4(join9(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    changed.push(`${dir}/rules.json`);
+  }
+  return { changed, dir };
 }
-function verify(cwd) {
-  const guardPath = join3(cwd, GUARD_FILE);
-  const clientPath = join3(cwd, "src/integrations/supabase/client.ts");
-  const startPath = join3(cwd, "src/start.ts");
-  const guard = existsSync5(guardPath) ? read(guardPath) : "";
-  const client = existsSync5(clientPath) ? read(clientPath) : "";
-  const start = existsSync5(startPath) ? read(startPath) : "";
-  const checks = [
-    { label: "guard.ts scaffolded", ok: guard.length > 0, hint: "run `patchstack-connect protect`" },
-    { label: "Supabase client tunnels through the guard", ok: client.includes("x-ps-target"), hint: "run `patchstack-connect protect` to re-patch src/integrations/supabase/client.ts" },
-    { label: "request middleware defined + registered", ok: start.includes("const patchstackGuard =") && start.includes("requestMiddleware: [patchstackGuard"), hint: "run `patchstack-connect protect` to re-patch src/start.ts" },
-    { label: "server-function middleware defined + registered", ok: start.includes("const patchstackFunctionGuard =") && start.includes("functionMiddleware: [patchstackFunctionGuard"), hint: "run `patchstack-connect protect` to re-patch src/start.ts" }
+function candidateEntries(cwd) {
+  const names = [
+    "src/server.ts",
+    "src/server.js",
+    "src/index.ts",
+    "src/index.js",
+    "src/app.ts",
+    "src/app.js",
+    "src/main.ts",
+    "server.ts",
+    "server.js",
+    "index.ts",
+    "index.js",
+    "app.ts",
+    "app.js"
   ];
-  return { wired: checks.every((c) => c.ok), checks };
-}
-var tanstackSupabaseAdapter = {
-  name: "tanstack-supabase",
-  label: "TanStack Start + Supabase",
-  detect,
-  wire,
-  verify
-};
-
-// src/protect/install/adapters/next.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync2, copyFileSync as copyFileSync2 } from "fs";
-import { join as join4 } from "path";
-function hasNextDep(cwd) {
+  const hits = names.filter((n) => existsSync7(join9(cwd, n)));
   try {
-    const pkg = JSON.parse(read(join4(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.next);
+    const pkg = JSON.parse(read(join9(cwd, "package.json")));
+    if (typeof pkg.main === "string" && existsSync7(join9(cwd, pkg.main))) hits.push(pkg.main);
   } catch {
-    return false;
   }
+  return [...new Set(hits)];
 }
-function middlewareInfo(cwd) {
-  const candidates = ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"];
-  for (const rel of candidates) {
-    if (existsSync6(join4(cwd, rel))) return { relDir: rel.includes("/") ? "src" : ".", relFile: rel, exists: true };
+function usesExpress(cwd) {
+  try {
+    const pkg = JSON.parse(read(join9(cwd, "package.json")));
+    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.express);
+  } catch {
+    return false;
   }
-  const useSrc = existsSync6(join4(cwd, "src"));
-  return { relDir: useSrc ? "src" : ".", relFile: useSrc ? "src/middleware.ts" : "middleware.ts", exists: false };
-}
-function detect2(cwd) {
-  return hasNextDep(cwd);
 }
-function rulesFile(relDir) {
-  return relDir === "." ? "patchstack.rules.json" : `${relDir}/patchstack.rules.json`;
-}
-function wire2(cwd, opts) {
-  const templates = templatesDir();
-  const mw = middlewareInfo(cwd);
-  const dir = join4(cwd, mw.relDir === "." ? "" : mw.relDir);
-  mkdirSync2(dir, { recursive: true });
-  const rulesDst = join4(dir, "patchstack.rules.json");
-  const changed = [];
-  if (opts.demo || !existsSync6(rulesDst)) {
-    copyFileSync2(join4(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
-    changed.push(rulesFile(mw.relDir));
-  }
-  const mwPath = join4(cwd, mw.relFile);
-  const existing = mw.exists ? read(mwPath) : "";
-  if (mw.exists && !existing.includes("patchstack-next")) {
-    log(
-      `existing ${mw.relFile} left untouched \u2014 scaffolded ${rulesFile(mw.relDir)}; add the guard to your middleware: import { createProtection } from "@patchstack/connect/protect", run fetchGuard() on the request, and return the block Response. Then: npx patchstack-connect protect --check`
-    );
-    return { ok: true, changed };
-  }
-  copyFileSync2(join4(templates, "next-middleware.ts"), mwPath);
-  if (!opts.demo) bakeSiteUuid(cwd, mw.relFile);
-  changed.push(mw.relFile);
-  log(mw.exists ? `refreshed ${mw.relFile} (Patchstack middleware)` : `scaffolded ${mw.relFile} (Patchstack middleware)`);
-  return { ok: true, changed: [...new Set(changed)] };
+function wiringPlan(cwd, dir) {
+  const entries = candidateEntries(cwd);
+  const express = usesExpress(cwd);
+  const lines = [
+    `no built-in adapter matched this stack \u2014 scaffolded a generic guard at ${dir}/guard.ts + ${dir}/rules.json.`,
+    "Finish by wiring it into your server (pick the one that fits):",
+    `  \u2022 Web-Fetch entry:  export default { fetch: protectFetch(yourHandler) }   // import from "${dir}/guard"`,
+    `  \u2022 Node / Express:   app.use(patchstackMiddleware)                          // add before your routes`,
+    entries.length ? `Likely server ${entries.length === 1 ? "entry" : "entries"}: ${entries.join(", ")}${express ? "  (Express detected)" : ""}.` : "Could not locate a server entry \u2014 wire it wherever requests enter your app.",
+    "Then confirm it is hooked up:  npx patchstack-connect protect --check"
+  ];
+  return lines.join("\n");
 }
-function verify2(cwd) {
-  const mw = middlewareInfo(cwd);
-  const present = mw.exists && read(join4(cwd, mw.relFile)).includes("patchstack-next");
-  const rulesPresent = existsSync6(join4(cwd, rulesFile(mw.relDir)));
+function genericVerify(cwd) {
+  const dir = genericDir(cwd);
+  const scaffolded = existsSync7(join9(cwd, dir, "guard.ts"));
+  const imported = scaffolded && guardIsImported(cwd, join9(cwd, dir, "guard.ts"));
   return {
-    wired: present && rulesPresent,
+    wired: scaffolded && imported,
     checks: [
-      { label: "Patchstack middleware present", ok: present, hint: `run \`patchstack-connect protect\` (writes ${mw.relFile})` },
-      { label: "rules co-located with the middleware", ok: rulesPresent, hint: "run `patchstack-connect protect`" }
+      { label: "generic guard scaffolded", ok: scaffolded, hint: "run `patchstack-connect protect`" },
+      {
+        label: "guard imported into a server entry",
+        ok: imported,
+        hint: `import { protectFetch } (or patchstackMiddleware) from "${dir}/guard" and wire it into your request path`
+      }
     ]
   };
 }
-var nextAdapter = {
-  name: "nextjs",
-  label: "Next.js",
-  detect: detect2,
-  wire: wire2,
-  verify: verify2
-};
-
-// src/protect/install/adapters/sveltekit.ts
-import { join as join6 } from "path";
+function guardIsImported(cwd, guardPath) {
+  const root = existsSync7(join9(cwd, "src")) ? join9(cwd, "src") : cwd;
+  let found = false;
+  const walk2 = (d, depth) => {
+    if (found || depth > 8) return;
+    let entries;
+    try {
+      entries = readdirSync3(d);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (found) return;
+      if (name === "node_modules" || name === "patchstack" || name.startsWith(".")) continue;
+      const p = join9(d, name);
+      let st;
+      try {
+        st = lstatSync2(p);
+      } catch {
+        continue;
+      }
+      if (st.isSymbolicLink()) continue;
+      if (st.isDirectory()) walk2(p, depth + 1);
+      else if (/\.(?:ts|tsx|js|jsx|mjs|cjs)$/.test(name) && p !== guardPath) {
+        try {
+          if (readFileSync3(p, "utf8").includes(GUARD_MARKER)) found = true;
+        } catch {
+        }
+      }
+    }
+  };
+  walk2(root, 0);
+  return found;
+}
 
-// src/protect/install/seam.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync3, copyFileSync as copyFileSync3 } from "fs";
-import { join as join5, dirname as dirname2 } from "path";
-function rulesRel(seamRel) {
-  const d = dirname2(seamRel);
-  return (d === "." ? "patchstack.rules.json" : `${d}/patchstack.rules.json`).replace(/\\/g, "/");
+// src/protect/install/register.ts
+var REGION = "// #region patchstack (managed by patchstack-connect protect \u2014 do not edit)";
+function guardTarget(cwd, entryRel, spec) {
+  if (/\.cjs$/.test(entryRel) || /\.js$/.test(entryRel) && packageType(cwd) !== "module") {
+    if (spec.guardTemplateCjs) {
+      return {
+        template: spec.guardTemplateCjs,
+        file: "guard.cjs",
+        importLine: (name, target) => `const { ${name} } = require("${target}");`,
+        preserveExtension: true
+      };
+    }
+  } else if (/\.(?:js|mjs)$/.test(entryRel) && spec.guardTemplateEsm) {
+    return {
+      template: spec.guardTemplateEsm,
+      file: entryRel.endsWith(".mjs") ? "guard.mjs" : "guard.js",
+      importLine: (name, target) => `import { ${name} } from "${target}";`,
+      preserveExtension: true
+    };
+  }
+  return {
+    template: spec.guardTemplate,
+    file: "guard.ts",
+    importLine: (name, target) => `import { ${name} } from "${target}";`,
+    preserveExtension: false
+  };
 }
-function wireSeam(cwd, opts, spec) {
-  const templates = templatesDir();
-  const existing = spec.candidates.find((c) => existsSync7(join5(cwd, c)));
-  const seamRel = existing ?? spec.target;
-  mkdirSync3(dirname2(join5(cwd, seamRel)), { recursive: true });
-  const rulesDst = join5(cwd, rulesRel(seamRel));
-  const changed = [];
-  if (opts.demo || !existsSync7(rulesDst)) {
-    copyFileSync3(join5(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
-    changed.push(rulesRel(seamRel));
+function packageType(cwd) {
+  try {
+    return JSON.parse(read(join10(cwd, "package.json"))).type;
+  } catch {
+    return void 0;
   }
-  const current = existing ? read(join5(cwd, existing)) : "";
-  if (existing && !current.includes(spec.marker)) {
-    log(`existing ${existing} left untouched \u2014 scaffolded ${rulesRel(seamRel)}; ${spec.planHint}`);
+}
+function wireRegister(cwd, opts, spec) {
+  const entry = findAppInstance(cwd, spec.appRe);
+  if (!entry) {
+    const { changed: changed2 } = scaffoldGeneric(cwd, opts, spec.guardTemplate);
+    log(`${spec.label} not located \u2014 scaffolded guard; ${spec.manualHint}`);
+    return { ok: true, changed: changed2 };
+  }
+  const target = guardTarget(cwd, entry.relPath, spec);
+  const { changed, dir } = scaffoldGeneric(cwd, opts, target.template, target.file);
+  const p = join10(cwd, entry.relPath);
+  const s = read(p);
+  if (s.includes(spec.importName)) {
+    log(`${entry.relPath} already wired`);
     return { ok: true, changed };
   }
-  copyFileSync3(join5(templates, spec.templateName), join5(cwd, seamRel));
-  if (!opts.demo) bakeSiteUuid(cwd, seamRel);
-  changed.push(seamRel);
-  log(existing ? `refreshed ${seamRel}` : `scaffolded ${seamRel}`);
+  const sourceLines = s.split("\n");
+  const sourceAppIdx = sourceLines.findIndex((line) => spec.appRe.test(line));
+  const requiredAnchor = spec.callAfter?.(entry.appVar);
+  if (spec.requireCallAfter && requiredAnchor && !sourceLines.some((line, index) => index > sourceAppIdx && requiredAnchor.test(line))) {
+    log(`${entry.relPath} body-parser anchor not found \u2014 scaffolded guard; ${spec.manualHint}`);
+    return { ok: true, changed };
+  }
+  const importLine = target.importLine(
+    spec.importName,
+    importSpecifier(entry.relPath, `${dir}/${target.file}`, target.preserveExtension)
+  );
+  const lines = s.split("\n");
+  let lastImport = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (/^\s*(?:import\b|(?:const|let|var)\s+.+?=\s*require\()/.test(lines[i] ?? "")) lastImport = i;
+  }
+  lines.splice(lastImport + 1, 0, importLine);
+  const appIdx = lines.findIndex((l) => spec.appRe.test(l));
+  if (appIdx !== -1) {
+    const preferred = spec.callAfter?.(entry.appVar);
+    const preferredIdx = preferred ? lines.findIndex((line, index) => index > appIdx && preferred.test(line)) : -1;
+    const callIdx = preferredIdx === -1 ? appIdx : preferredIdx;
+    lines.splice(callIdx + 1, 0, REGION, spec.call(entry.appVar), "// #endregion patchstack");
+  }
+  writeFileSync4(p, lines.join("\n"));
+  changed.push(entry.relPath);
+  log(`patched ${entry.relPath} (${spec.call(entry.appVar).trim()})`);
   return { ok: true, changed: [...new Set(changed)] };
 }
-function verifySeam(cwd, spec) {
-  const existing = spec.candidates.find((c) => existsSync7(join5(cwd, c)));
-  const seamRel = existing ?? spec.target;
-  const present = existing ? read(join5(cwd, existing)).includes(spec.marker) : false;
-  const rulesPresent = existsSync7(join5(cwd, rulesRel(seamRel)));
+function verifyRegister(cwd, spec) {
+  const dir = existsSync8(join10(cwd, "src")) ? "src/patchstack" : "patchstack";
+  const entry = findAppInstance(cwd, spec.appRe);
+  const target = entry ? guardTarget(cwd, entry.relPath, spec) : null;
+  const scaffolded = target ? existsSync8(join10(cwd, dir, target.file)) : false;
+  const entrySource = entry ? read(join10(cwd, entry.relPath)) : "";
+  const entryLines = entrySource.split("\n");
+  const anchor = entry && spec.callAfter ? spec.callAfter(entry.appVar) : null;
+  const anchorIndex = anchor ? entryLines.findIndex((line) => anchor.test(line)) : -1;
+  const callIndex = entry ? entryLines.findIndex((line) => line.includes(spec.call(entry.appVar))) : -1;
+  const ordered = anchor ? anchorIndex !== -1 && callIndex > anchorIndex : callIndex !== -1;
+  const wired = entrySource.includes(spec.importName) && ordered;
   return {
-    wired: present && rulesPresent,
+    wired: scaffolded && wired,
     checks: [
-      { label: `${spec.seamLabel} present`, ok: present, hint: `run \`patchstack-connect protect\` (writes ${spec.target})` },
-      { label: "rules co-located with the guard", ok: rulesPresent, hint: "run `patchstack-connect protect`" }
+      { label: `${spec.label} guard scaffolded`, ok: scaffolded, hint: "run `patchstack-connect protect`" },
+      { label: `guard registered on the ${spec.label}`, ok: wired, hint: spec.manualHint }
     ]
   };
 }
 
-// src/protect/install/adapters/sveltekit.ts
-var SPEC = {
-  templateName: "sveltekit-hooks.ts",
-  candidates: ["src/hooks.server.ts", "src/hooks.server.js"],
-  target: "src/hooks.server.ts",
-  marker: "patchstack-sveltekit",
-  planHint: 'add the guard to your `handle` (compose with `sequence()` from "@sveltejs/kit/hooks"), then: npx patchstack-connect protect --check',
-  seamLabel: "SvelteKit server hook"
+// src/protect/install/adapters/nestjs.ts
+var SPEC4 = {
+  appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*await\s+NestFactory\.create/,
+  guardTemplate: "generic-guard.ts",
+  guardTemplateEsm: "generic-guard.js",
+  guardTemplateCjs: "generic-guard.cjs",
+  importName: "patchstackMiddleware",
+  call: (v) => `${v}.use(patchstackMiddleware);`,
+  label: "NestJS app",
+  manualHint: "add `app.use(patchstackMiddleware)` right after your NestFactory.create(...) call"
 };
-function detect3(cwd) {
+var nestjsAdapter = {
+  name: "nestjs",
+  label: "NestJS",
+  detect: (cwd) => hasDependency(cwd, "@nestjs/core") && findAppInstance(cwd, SPEC4.appRe) !== null,
+  wire: (cwd, opts) => wireRegister(cwd, opts, SPEC4),
+  verify: (cwd) => verifyRegister(cwd, SPEC4)
+};
+
+// src/protect/install/adapters/fastify.ts
+var SPEC5 = {
+  appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:fastify|Fastify)\(/,
+  guardTemplate: "fastify-plugin.ts",
+  guardTemplateEsm: "fastify-plugin.js",
+  guardTemplateCjs: "fastify-plugin.cjs",
+  importName: "patchstackFastify",
+  call: (v) => `${v}.register(patchstackFastify);`,
+  label: "Fastify app",
+  manualHint: "add `app.register(patchstackFastify)` right after you create your fastify() app"
+};
+var fastifyAdapter = {
+  name: "fastify",
+  label: "Fastify (Node)",
+  detect: (cwd) => hasDependency(cwd, "fastify") && findAppInstance(cwd, SPEC5.appRe) !== null,
+  wire: (cwd, opts) => wireRegister(cwd, opts, SPEC5),
+  verify: (cwd) => verifyRegister(cwd, SPEC5)
+};
+
+// src/protect/install/adapters/express.ts
+var bodyParserRe = (appVar) => new RegExp(`^\\s*${appVar}\\.use\\(\\s*(?:[A-Za-z_$][\\w$]*\\.)?(?:json|urlencoded)\\(`, "m");
+var SPEC6 = {
+  appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*express\(\)/,
+  guardTemplate: "express-guard.ts",
+  guardTemplateEsm: "express-guard.js",
+  guardTemplateCjs: "express-guard.cjs",
+  importName: "patchstackMiddleware",
+  call: (v) => `${v}.use(patchstackMiddleware);`,
+  callAfter: bodyParserRe,
+  requireCallAfter: true,
+  label: "Express app",
+  manualHint: "add `app.use(patchstackMiddleware)` after your body parser (express.json/urlencoded or body-parser) and before the routes"
+};
+var expressAdapter = {
+  name: "express",
+  label: "Express (Node)",
+  detect: (cwd) => hasDependency(cwd, "express") && findAppInstance(cwd, SPEC6.appRe) !== null,
+  wire: (cwd, opts) => wireRegister(cwd, opts, SPEC6),
+  verify: (cwd) => verifyRegister(cwd, SPEC6)
+};
+
+// src/protect/install/index.ts
+var ADAPTERS = [
+  tanstackSupabaseAdapter,
+  nextAdapter,
+  sveltekitAdapter,
+  astroAdapter,
+  nuxtAdapter,
+  nestjsAdapter,
+  fastifyAdapter,
+  expressAdapter
+];
+function runProtect(cwd, opts = {}) {
+  let adapter;
   try {
-    const pkg = JSON.parse(read(join6(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }["@sveltejs/kit"]);
-  } catch {
-    return false;
+    adapter = ADAPTERS.find((a) => a.detect(cwd));
+    if (adapter) {
+      const result = adapter.wire(cwd, opts);
+      return { status: "wired", adapter: adapter.name, changed: result.changed };
+    }
+  } catch (err) {
+    log(`adapter ${adapter?.name ?? ""} failed (${err?.message ?? err}); falling back to a generic guard`);
+  }
+  try {
+    const { changed, dir } = scaffoldGeneric(cwd, opts);
+    const plan = wiringPlan(cwd, dir);
+    log(plan);
+    return { status: "scaffolded", adapter: "generic", changed, plan };
+  } catch (err) {
+    log(`could not scaffold the guard (${err?.message ?? err})`);
+    return { status: "scaffolded", adapter: "generic", changed: [], plan: "" };
   }
 }
-function wire3(cwd, opts) {
-  return wireSeam(cwd, opts, SPEC);
-}
-function verify3(cwd) {
-  return verifySeam(cwd, SPEC);
+function runVerify(cwd) {
+  try {
+    const adapter = ADAPTERS.find((a) => a.detect(cwd));
+    if (adapter) return { stack: adapter.label, ...adapter.verify(cwd) };
+    return { stack: "generic", ...genericVerify(cwd) };
+  } catch (err) {
+    return { stack: "unknown", wired: false, checks: [{ label: "verification failed", ok: false, hint: String(err?.message ?? err) }] };
+  }
 }
-var sveltekitAdapter = {
-  name: "sveltekit",
-  label: "SvelteKit",
-  detect: detect3,
-  wire: wire3,
-  verify: verify3
-};
 
-// src/protect/install/adapters/astro.ts
-import { join as join7 } from "path";
-var SPEC2 = {
-  templateName: "astro-middleware.ts",
-  candidates: ["src/middleware.ts", "src/middleware.js", "src/middleware/index.ts", "src/middleware/index.js"],
-  target: "src/middleware.ts",
-  marker: "patchstack-astro",
-  planHint: 'add the guard to your `onRequest` (compose with `sequence()` from "astro:middleware"), then: npx patchstack-connect protect --check',
-  seamLabel: "Astro middleware"
-};
-function detect4(cwd) {
-  try {
-    const pkg = JSON.parse(read(join7(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.astro);
-  } catch {
-    return false;
+// src/widget.ts
+import { existsSync as existsSync9, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import path8 from "path";
+var WIDGET_SCRIPT_URL = "https://cdn.patchstack.com/patchstack-widget.js";
+var WIDGET_MARKER_ATTR = "data-patchstack-connect-widget";
+var WIDGET_NEEDLE = "patchstack-widget";
+var SOURCE_SHELL_CANDIDATES = ["index.html", "public/index.html", "src/app.html"];
+function buildWidgetTag(siteUuid) {
+  return `<script src="${WIDGET_SCRIPT_URL}" data-site-uuid="${siteUuid}" defer ${WIDGET_MARKER_ATTR}="true"></script>`;
+}
+var MANAGED_TAG_RE = new RegExp(
+  `<script[^>]*${WIDGET_MARKER_ATTR}[^>]*>\\s*</script>`,
+  "i"
+);
+function ensureWidgetInHtml(html, siteUuid) {
+  const tag = buildWidgetTag(siteUuid);
+  const managed = html.match(MANAGED_TAG_RE);
+  if (managed !== null) {
+    if (managed[0].includes(`data-site-uuid="${siteUuid}"`)) {
+      return { html, action: "unchanged" };
+    }
+    return { html: html.replace(MANAGED_TAG_RE, tag), action: "updated" };
+  }
+  if (html.includes(WIDGET_NEEDLE)) {
+    return { html, action: "manual" };
+  }
+  const bodyClose = html.match(/([ \t]*)<\/body>/i);
+  if (bodyClose === null || bodyClose.index === void 0) {
+    return { html, action: "no-body" };
   }
+  const indent = bodyClose[1] ?? "";
+  const insertion = `${indent}  ${tag}
+${indent}</body>`;
+  return {
+    html: html.slice(0, bodyClose.index) + insertion + html.slice(bodyClose.index + bodyClose[0].length),
+    action: "added"
+  };
 }
-function wire4(cwd, opts) {
-  return wireSeam(cwd, opts, SPEC2);
+function findSourceShell(cwd) {
+  for (const candidate of SOURCE_SHELL_CANDIDATES) {
+    if (existsSync9(path8.join(cwd, candidate))) {
+      return candidate;
+    }
+  }
+  return null;
 }
-function verify4(cwd) {
-  return verifySeam(cwd, SPEC2);
+function ensureSourceWidget(cwd, siteUuid) {
+  const shell = findSourceShell(cwd);
+  if (shell === null) {
+    return { shell: null, action: "no-shell" };
+  }
+  const file = path8.join(cwd, shell);
+  const before = readFileSync4(file, "utf8");
+  const { html, action } = ensureWidgetInHtml(before, siteUuid);
+  if (html !== before) {
+    writeFileSync5(file, html);
+  }
+  return { shell, action };
 }
-var astroAdapter = {
-  name: "astro",
-  label: "Astro",
-  detect: detect4,
-  wire: wire4,
-  verify: verify4
-};
 
-// src/protect/install/find-app.ts
-import { readFileSync as readFileSync4, existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
-import { join as join8, relative, dirname as dirname3 } from "path";
-function findAppInstance(cwd, re) {
-  const root = existsSync8(join8(cwd, "src")) ? join8(cwd, "src") : cwd;
-  let hit = null;
-  const walk2 = (dir) => {
-    if (hit) return;
-    let entries;
-    try {
-      entries = readdirSync3(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      if (hit) return;
-      if (name === "node_modules" || name === "patchstack" || name.startsWith(".")) continue;
-      const p = join8(dir, name);
-      let st;
-      try {
-        st = statSync3(p);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) walk2(p);
-      else if (/\.(?:ts|js|mjs|cjs)$/.test(name)) {
-        let src;
-        try {
-          src = readFileSync4(p, "utf8");
-        } catch {
-          continue;
-        }
-        const m = re.exec(src);
-        if (m) hit = { relPath: relative(cwd, p).replace(/\\/g, "/"), appVar: m[1] };
-      }
+// src/guide.ts
+var WIDGET_NEEDLE2 = "patchstack-widget";
+var INSTALL_COMMANDS = {
+  npm: "npm install --save @patchstack/connect",
+  pnpm: "pnpm add @patchstack/connect",
+  yarn: "yarn add @patchstack/connect",
+  bun: "bun add @patchstack/connect"
+};
+var PM_BY_LOCKFILE = [
+  { filename: "bun.lock", pm: "bun" },
+  { filename: "bun.lockb", pm: "bun" },
+  { filename: "pnpm-lock.yaml", pm: "pnpm" },
+  { filename: "yarn.lock", pm: "yarn" },
+  { filename: "package-lock.json", pm: "npm" }
+];
+var WIDGET_FILE_CANDIDATES = {
+  next: [
+    "app/layout.tsx",
+    "app/layout.jsx",
+    "src/app/layout.tsx",
+    "src/app/layout.jsx",
+    "pages/_document.tsx",
+    "pages/_document.jsx",
+    "src/pages/_document.tsx"
+  ],
+  nuxt: ["app.vue", "src/app.vue", "app/app.vue"],
+  remix: ["app/root.tsx", "app/root.jsx"],
+  "react-router": ["app/root.tsx", "src/root.tsx"],
+  "tanstack-start": ["src/routes/__root.tsx", "app/routes/__root.tsx"],
+  sveltekit: ["src/app.html"],
+  astro: ["src/layouts/Layout.astro"],
+  gatsby: ["src/html.js"]
+};
+var GENERIC_WIDGET_FILES = ["index.html", "public/index.html"];
+var SKIPPED_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "out",
+  ".output",
+  ".next",
+  ".nuxt",
+  ".svelte-kit",
+  ".vercel",
+  ".netlify",
+  "coverage",
+  "vendor"
+]);
+var WIDGET_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".html",
+  ".htm",
+  ".tsx",
+  ".jsx",
+  ".ts",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".vue",
+  ".svelte",
+  ".astro",
+  ".ejs",
+  ".hbs"
+]);
+var WIDGET_SCAN_MAX_FILES = 4e3;
+var WIDGET_SCAN_MAX_DEPTH = 6;
+var WIDGET_SCAN_MAX_BYTES = 512 * 1024;
+function detectPackageManager(cwd) {
+  const declared = readPackageJson(cwd)?.packageManager?.split("@")[0];
+  if (declared === "npm" || declared === "pnpm" || declared === "yarn" || declared === "bun") {
+    return declared;
+  }
+  for (const { filename, pm } of PM_BY_LOCKFILE) {
+    if (existsSync10(path9.join(cwd, filename))) {
+      return pm;
     }
-  };
-  walk2(root);
-  return hit;
-}
-function importSpecifier(fromRel, toRel, preserveExtension = false) {
-  let spec = relative(dirname3(fromRel), toRel).replace(/\\/g, "/");
-  if (!preserveExtension) spec = spec.replace(/\.(?:ts|js)$/, "");
-  if (!spec.startsWith(".")) spec = `./${spec}`;
-  return spec;
-}
-
-// src/protect/install/register.ts
-import { writeFileSync as writeFileSync5, existsSync as existsSync10 } from "fs";
-import { join as join10 } from "path";
-
-// src/protect/install/generic.ts
-import { readFileSync as readFileSync5, existsSync as existsSync9, mkdirSync as mkdirSync4, copyFileSync as copyFileSync4, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
-import { join as join9 } from "path";
-var GUARD_MARKER = "patchstack/guard";
-function genericDir(cwd) {
-  return existsSync9(join9(cwd, "src")) ? "src/patchstack" : "patchstack";
-}
-function scaffoldGeneric(cwd, opts, guardTemplate = "generic-guard.ts", guardFile = "guard.ts") {
-  const templates = templatesDir();
-  const dir = genericDir(cwd);
-  const dst = join9(cwd, dir);
-  mkdirSync4(dst, { recursive: true });
-  copyFileSync4(join9(templates, guardTemplate), join9(dst, guardFile));
-  const guardRel = `${dir}/${guardFile}`;
-  const changed = [guardRel];
-  if (!opts.demo) bakeSiteUuid(cwd, guardRel);
-  const rulesDst = join9(dst, "rules.json");
-  if (opts.demo || !existsSync9(rulesDst)) {
-    copyFileSync4(join9(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
-    changed.push(`${dir}/rules.json`);
   }
-  return { changed, dir };
+  return "npm";
 }
-function candidateEntries(cwd) {
-  const names = [
-    "src/server.ts",
-    "src/server.js",
-    "src/index.ts",
-    "src/index.js",
-    "src/app.ts",
-    "src/app.js",
-    "src/main.ts",
-    "server.ts",
-    "server.js",
-    "index.ts",
-    "index.js",
-    "app.ts",
-    "app.js"
-  ];
-  const hits = names.filter((n) => existsSync9(join9(cwd, n)));
+function installCommand(pm) {
+  return INSTALL_COMMANDS[pm];
+}
+function readPackageJson(cwd) {
   try {
-    const pkg = JSON.parse(read(join9(cwd, "package.json")));
-    if (typeof pkg.main === "string" && existsSync9(join9(cwd, pkg.main))) hits.push(pkg.main);
+    return JSON.parse(readFileSync5(path9.join(cwd, "package.json"), "utf8"));
   } catch {
+    return null;
   }
-  return [...new Set(hits)];
 }
-function usesExpress(cwd) {
+function installedVersion(cwd, declaredRange) {
   try {
-    const pkg = JSON.parse(read(join9(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.express);
+    const pkg = JSON.parse(
+      readFileSync5(path9.join(cwd, "node_modules", "@patchstack", "connect", "package.json"), "utf8")
+    );
+    if (typeof pkg.version === "string" && pkg.version.length > 0) {
+      return pkg.version;
+    }
   } catch {
-    return false;
   }
+  return declaredRange;
 }
-function wiringPlan(cwd, dir) {
-  const entries = candidateEntries(cwd);
-  const express = usesExpress(cwd);
-  const lines = [
-    `no built-in adapter matched this stack \u2014 scaffolded a generic guard at ${dir}/guard.ts + ${dir}/rules.json.`,
-    "Finish by wiring it into your server (pick the one that fits):",
-    `  \u2022 Web-Fetch entry:  export default { fetch: protectFetch(yourHandler) }   // import from "${dir}/guard"`,
-    `  \u2022 Node / Express:   app.use(patchstackMiddleware)                          // add before your routes`,
-    entries.length ? `Likely server ${entries.length === 1 ? "entry" : "entries"}: ${entries.join(", ")}${express ? "  (Express detected)" : ""}.` : "Could not locate a server entry \u2014 wire it wherever requests enter your app.",
-    "Then confirm it is hooked up:  npx patchstack-connect protect --check"
-  ];
-  return lines.join("\n");
-}
-function genericVerify(cwd) {
-  const dir = genericDir(cwd);
-  const scaffolded = existsSync9(join9(cwd, dir, "guard.ts"));
-  const imported = scaffolded && guardIsImported(cwd, join9(cwd, dir, "guard.ts"));
-  return {
-    wired: scaffolded && imported,
-    checks: [
-      { label: "generic guard scaffolded", ok: scaffolded, hint: "run `patchstack-connect protect`" },
-      {
-        label: "guard imported into a server entry",
-        ok: imported,
-        hint: `import { protectFetch } (or patchstackMiddleware) from "${dir}/guard" and wire it into your request path`
-      }
-    ]
-  };
-}
-function guardIsImported(cwd, guardPath) {
-  const root = existsSync9(join9(cwd, "src")) ? join9(cwd, "src") : cwd;
-  let found = false;
-  const walk2 = (d) => {
-    if (found) return;
+function findWidgetMarker(cwd, siteUuid) {
+  let budget = WIDGET_SCAN_MAX_FILES;
+  let sawWidget = false;
+  let sawTokenMatch = false;
+  const settled = () => sawTokenMatch || sawWidget && siteUuid == null;
+  const walk2 = (dir, depth) => {
+    if (depth > WIDGET_SCAN_MAX_DEPTH || budget <= 0) {
+      return;
+    }
     let entries;
     try {
-      entries = readdirSync4(d);
+      entries = readdirSync4(dir, { withFileTypes: true });
     } catch {
       return;
     }
-    for (const name of entries) {
-      if (found) return;
-      if (name === "node_modules" || name.startsWith(".")) continue;
-      const p = join9(d, name);
-      let st;
-      try {
-        st = statSync4(p);
-      } catch {
+    for (const entry of entries) {
+      if (budget <= 0 || settled()) {
+        return;
+      }
+      const full = path9.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (SKIPPED_DIRS.has(entry.name) || entry.name.startsWith(".")) {
+          continue;
+        }
+        walk2(full, depth + 1);
         continue;
       }
-      if (st.isDirectory()) walk2(p);
-      else if (/\.(?:ts|tsx|js|jsx|mjs|cjs)$/.test(name) && p !== guardPath) {
-        try {
-          if (readFileSync5(p, "utf8").includes(GUARD_MARKER)) found = true;
-        } catch {
+      if (!entry.isFile() || !WIDGET_EXTENSIONS.has(path9.extname(entry.name).toLowerCase())) {
+        continue;
+      }
+      budget -= 1;
+      try {
+        if (statSync2(full).size > WIDGET_SCAN_MAX_BYTES) {
+          continue;
+        }
+        const content = readFileSync5(full, "utf8");
+        if (!content.includes(WIDGET_NEEDLE2)) {
+          continue;
+        }
+        sawWidget = true;
+        if (siteUuid != null && content.includes(siteUuid)) {
+          sawTokenMatch = true;
         }
+      } catch {
       }
     }
   };
-  walk2(root);
-  return found;
+  walk2(cwd, 0);
+  return {
+    found: sawWidget,
+    uuidMatches: sawWidget && siteUuid != null ? sawTokenMatch : null
+  };
 }
-
-// src/protect/install/register.ts
-var REGION = "// #region patchstack (managed by patchstack-connect protect \u2014 do not edit)";
-function guardTarget(cwd, entryRel, spec) {
-  if (/\.cjs$/.test(entryRel) || /\.js$/.test(entryRel) && packageType(cwd) !== "module") {
-    if (spec.guardTemplateCjs) {
-      return {
-        template: spec.guardTemplateCjs,
-        file: "guard.cjs",
-        importLine: (name, target) => `const { ${name} } = require("${target}");`,
-        preserveExtension: true
-      };
+function resolveWidgetFileHint(cwd, framework) {
+  const candidates = [
+    ...framework !== null ? WIDGET_FILE_CANDIDATES[framework] ?? [] : [],
+    ...GENERIC_WIDGET_FILES
+  ];
+  for (const candidate of candidates) {
+    if (existsSync10(path9.join(cwd, candidate))) {
+      return candidate;
     }
-  } else if (/\.(?:js|mjs)$/.test(entryRel) && spec.guardTemplateEsm) {
-    return {
-      template: spec.guardTemplateEsm,
-      file: entryRel.endsWith(".mjs") ? "guard.mjs" : "guard.js",
-      importLine: (name, target) => `import { ${name} } from "${target}";`,
-      preserveExtension: true
+  }
+  return null;
+}
+async function collectGuideState(cwd) {
+  const pkg = readPackageJson(cwd);
+  const packageManager = detectPackageManager(cwd);
+  let installed = null;
+  if (pkg?.devDependencies?.["@patchstack/connect"] !== void 0) {
+    installed = {
+      version: installedVersion(cwd, pkg.devDependencies["@patchstack/connect"]),
+      section: "devDependencies"
+    };
+  } else if (pkg?.dependencies?.["@patchstack/connect"] !== void 0) {
+    installed = {
+      version: installedVersion(cwd, pkg.dependencies["@patchstack/connect"]),
+      section: "dependencies"
     };
   }
+  let siteUuid = null;
+  let claimUrl = null;
+  let endpointOverride = null;
+  let widgetOptOut = false;
+  try {
+    const config = await resolveConfig({ cwd });
+    siteUuid = config.siteUuid;
+    if (siteUuid !== null) {
+      claimUrl = buildClaimUrl(config.endpoint, siteUuid);
+    }
+    if (config.endpoint !== DEFAULT_ENDPOINT) {
+      endpointOverride = config.endpoint;
+    }
+    widgetOptOut = !config.widget;
+  } catch {
+  }
+  const declaredNames = Object.keys({ ...pkg?.dependencies, ...pkg?.devDependencies });
+  const stack = detectStack(
+    declaredNames.map((name) => ({ name, version: "" })),
+    {}
+  );
+  const widget = findWidgetMarker(cwd, siteUuid);
+  const protection = runVerify(cwd);
   return {
-    template: spec.guardTemplate,
-    file: "guard.ts",
-    importLine: (name, target) => `import { ${name} } from "${target}";`,
-    preserveExtension: false
+    projectName: pkg?.name ?? null,
+    hasPackageJson: pkg !== null,
+    packageManager,
+    installed,
+    siteUuid,
+    claimUrl,
+    endpointOverride,
+    hasBuildScript: Boolean(pkg?.scripts?.build?.trim()),
+    installScanWired: (pkg?.scripts?.postinstall ?? "").includes("patchstack-connect scan"),
+    // bun run doesn't execute npm-style pre/post scripts, so chaining inside
+    // the build script itself also counts as wired (and is what we suggest on bun).
+    prebuildWired: (pkg?.scripts?.prebuild ?? "").includes("patchstack-connect scan") || (pkg?.scripts?.build ?? "").includes("patchstack-connect scan"),
+    postbuildWired: (pkg?.scripts?.postbuild ?? "").includes("patchstack-connect mark-build") || (pkg?.scripts?.build ?? "").includes("patchstack-connect mark-build"),
+    widgetInstalled: widget.found,
+    widgetTokenMatches: widget.uuidMatches,
+    widgetOptOut,
+    framework: stack.framework,
+    widgetFileHint: resolveWidgetFileHint(cwd, stack.framework),
+    protectionWired: protection.wired,
+    protectionStack: protection.stack,
+    protectionChecks: protection.checks
   };
 }
-function packageType(cwd) {
-  try {
-    return JSON.parse(read(join10(cwd, "package.json"))).type;
-  } catch {
-    return void 0;
-  }
+var ANSI = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  cyan: "\x1B[36m"
+};
+function countRemainingSteps(state) {
+  return [
+    state.installed?.section === "dependencies",
+    state.siteUuid !== null,
+    state.installScanWired,
+    !state.hasBuildScript || state.prebuildWired && state.postbuildWired,
+    state.widgetOptOut || state.widgetInstalled && state.widgetTokenMatches !== false,
+    state.protectionWired
+  ].filter((step) => !step).length;
 }
-function wireRegister(cwd, opts, spec) {
-  const entry = findAppInstance(cwd, spec.appRe);
-  if (!entry) {
-    const { changed: changed2 } = scaffoldGeneric(cwd, opts, spec.guardTemplate);
-    log(`${spec.label} not located \u2014 scaffolded guard; ${spec.manualHint}`);
-    return { ok: true, changed: changed2 };
+function renderGuideChecklist(state, useColor) {
+  const paint = (code, text) => useColor ? `${code}${text}${ANSI.reset}` : text;
+  const done = (text) => ` ${paint(ANSI.green, "\u2714")} ${text}`;
+  const todo = (text) => ` ${paint(ANSI.yellow, "\u2716")} ${paint(ANSI.bold, text)}`;
+  const detail = (text) => `     ${paint(ANSI.dim, text)}`;
+  const lines = [];
+  const headerParts = [state.framework, state.packageManager].filter(
+    (part) => part !== null
+  );
+  const name = state.projectName ?? path9.basename(process.cwd());
+  lines.push(paint(ANSI.bold, `Patchstack setup status \u2014 ${name} (${headerParts.join(" \xB7 ")})`));
+  if (state.endpointOverride !== null) {
+    lines.push(
+      detail(
+        `endpoint override in effect: ${state.endpointOverride} (set via .patchstackrc.json, PATCHSTACK_ENDPOINT, or --endpoint)`
+      )
+    );
   }
-  const target = guardTarget(cwd, entry.relPath, spec);
-  const { changed, dir } = scaffoldGeneric(cwd, opts, target.template, target.file);
-  const p = join10(cwd, entry.relPath);
-  const s = read(p);
-  if (s.includes(spec.importName)) {
-    log(`${entry.relPath} already wired`);
-    return { ok: true, changed };
+  lines.push("");
+  if (!state.hasPackageJson) {
+    lines.push(todo("No package.json found in this directory."));
+    lines.push(detail("Run the guide from the project root."));
+    return lines.join("\n");
   }
-  const sourceLines = s.split("\n");
-  const sourceAppIdx = sourceLines.findIndex((line) => spec.appRe.test(line));
-  const requiredAnchor = spec.callAfter?.(entry.appVar);
-  if (spec.requireCallAfter && requiredAnchor && !sourceLines.some((line, index) => index > sourceAppIdx && requiredAnchor.test(line))) {
-    log(`${entry.relPath} body-parser anchor not found \u2014 scaffolded guard; ${spec.manualHint}`);
-    return { ok: true, changed };
+  if (state.installed?.section === "dependencies") {
+    lines.push(done(`@patchstack/connect installed (${state.installed.version}, ${state.installed.section})`));
+  } else if (state.installed !== null) {
+    lines.push(todo(`Move @patchstack/connect to runtime dependencies (currently ${state.installed.section})`));
+    lines.push(detail(`Run \u2192 ${installCommand(state.packageManager)}`));
+    lines.push(detail("The generated guard imports @patchstack/connect/protect at runtime."));
+  } else {
+    lines.push(todo("Install @patchstack/connect as a runtime dependency"));
+    lines.push(detail(`Run \u2192 ${installCommand(state.packageManager)}`));
+    if (state.packageManager === "bun") {
+      lines.push(detail(`(if bun isn't available here, ${INSTALL_COMMANDS.npm} works too)`));
+    }
   }
-  const importLine = target.importLine(
-    spec.importName,
-    importSpecifier(entry.relPath, `${dir}/${target.file}`, target.preserveExtension)
-  );
-  const lines = s.split("\n");
-  let lastImport = -1;
-  for (let i = 0; i < lines.length; i++) {
-    if (/^\s*(?:import\b|(?:const|let|var)\s+.+?=\s*require\()/.test(lines[i] ?? "")) lastImport = i;
+  if (state.siteUuid !== null) {
+    lines.push(done(`Site provisioned (${state.siteUuid})`));
+  } else {
+    lines.push(todo("Provision the site \u2014 run the first scan"));
+    lines.push(detail("Run \u2192 npx @patchstack/connect scan"));
+    lines.push(detail("Reads the lockfile, registers the project, writes .patchstackrc.json,"));
+    lines.push(detail("and prints a dashboard link. The CLI prints the link but never opens it."));
   }
-  lines.splice(lastImport + 1, 0, importLine);
-  const appIdx = lines.findIndex((l) => spec.appRe.test(l));
-  if (appIdx !== -1) {
-    const preferred = spec.callAfter?.(entry.appVar);
-    const preferredIdx = preferred ? lines.findIndex((line, index) => index > appIdx && preferred.test(line)) : -1;
-    const callIdx = preferredIdx === -1 ? appIdx : preferredIdx;
-    lines.splice(callIdx + 1, 0, REGION, spec.call(entry.appVar), "// #endregion patchstack");
+  if (state.installScanWired) {
+    lines.push(done("Dependency-install scan wired (postinstall)"));
+  } else {
+    lines.push(todo("Scan again whenever dependencies are installed"));
+    lines.push(detail('Edit package.json \u2192 "postinstall": "patchstack-connect scan"'));
   }
-  writeFileSync5(p, lines.join("\n"));
-  changed.push(entry.relPath);
-  log(`patched ${entry.relPath} (${spec.call(entry.appVar).trim()})`);
-  return { ok: true, changed: [...new Set(changed)] };
-}
-function verifyRegister(cwd, spec) {
-  const dir = existsSync10(join10(cwd, "src")) ? "src/patchstack" : "patchstack";
-  const entry = findAppInstance(cwd, spec.appRe);
-  const target = entry ? guardTarget(cwd, entry.relPath, spec) : null;
-  const scaffolded = target ? existsSync10(join10(cwd, dir, target.file)) : false;
-  const entrySource = entry ? read(join10(cwd, entry.relPath)) : "";
-  const entryLines = entrySource.split("\n");
-  const anchor = entry && spec.callAfter ? spec.callAfter(entry.appVar) : null;
-  const anchorIndex = anchor ? entryLines.findIndex((line) => anchor.test(line)) : -1;
-  const callIndex = entry ? entryLines.findIndex((line) => line.includes(spec.call(entry.appVar))) : -1;
-  const ordered = anchor ? anchorIndex !== -1 && callIndex > anchorIndex : callIndex !== -1;
-  const wired = entrySource.includes(spec.importName) && ordered;
-  return {
-    wired: scaffolded && wired,
-    checks: [
-      { label: `${spec.label} guard scaffolded`, ok: scaffolded, hint: "run `patchstack-connect protect`" },
-      { label: `guard registered on the ${spec.label}`, ok: wired, hint: spec.manualHint }
-    ]
-  };
-}
-
-// src/protect/install/adapters/nestjs.ts
-var SPEC3 = {
-  appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*await\s+NestFactory\.create/,
-  guardTemplate: "generic-guard.ts",
-  importName: "patchstackMiddleware",
-  call: (v) => `${v}.use(patchstackMiddleware);`,
-  label: "NestJS app",
-  manualHint: "add `app.use(patchstackMiddleware)` right after your NestFactory.create(...) call"
-};
-var nestjsAdapter = {
-  name: "nestjs",
-  label: "NestJS",
-  detect: (cwd) => hasDependency(cwd, "@nestjs/core") && findAppInstance(cwd, SPEC3.appRe) !== null,
-  wire: (cwd, opts) => wireRegister(cwd, opts, SPEC3),
-  verify: (cwd) => verifyRegister(cwd, SPEC3)
-};
-
-// src/protect/install/adapters/fastify.ts
-var SPEC4 = {
-  appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:fastify|Fastify)\(/,
-  guardTemplate: "fastify-plugin.ts",
-  importName: "patchstackFastify",
-  call: (v) => `${v}.register(patchstackFastify);`,
-  label: "Fastify app",
-  manualHint: "add `app.register(patchstackFastify)` right after you create your fastify() app"
-};
-var fastifyAdapter = {
-  name: "fastify",
-  label: "Fastify (Node)",
-  detect: (cwd) => hasDependency(cwd, "fastify") && findAppInstance(cwd, SPEC4.appRe) !== null,
-  wire: (cwd, opts) => wireRegister(cwd, opts, SPEC4),
-  verify: (cwd) => verifyRegister(cwd, SPEC4)
-};
-
-// src/protect/install/adapters/express.ts
-var jsonParserRe = (appVar) => new RegExp(`^\\s*${appVar}\\.use\\(\\s*express\\.json\\(`, "m");
-var SPEC5 = {
-  appRe: /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*express\(\)/,
-  guardTemplate: "express-guard.ts",
-  guardTemplateEsm: "express-guard.js",
-  guardTemplateCjs: "express-guard.cjs",
-  importName: "patchstackMiddleware",
-  call: (v) => `${v}.use(patchstackMiddleware);`,
-  callAfter: jsonParserRe,
-  requireCallAfter: true,
-  label: "Express app",
-  manualHint: "add `app.use(patchstackMiddleware)` after your JSON body parser and before the routes"
-};
-var expressAdapter = {
-  name: "express",
-  label: "Express (Node)",
-  detect: (cwd) => hasDependency(cwd, "express") && findAppInstance(cwd, SPEC5.appRe) !== null,
-  wire: (cwd, opts) => wireRegister(cwd, opts, SPEC5),
-  verify: (cwd) => verifyRegister(cwd, SPEC5)
-};
-
-// src/protect/install/index.ts
-var ADAPTERS = [
-  tanstackSupabaseAdapter,
-  nextAdapter,
-  sveltekitAdapter,
-  astroAdapter,
-  nestjsAdapter,
-  fastifyAdapter,
-  expressAdapter
-];
-function runProtect(cwd, opts = {}) {
-  const adapter = ADAPTERS.find((a) => a.detect(cwd));
-  if (adapter) {
-    const result = adapter.wire(cwd, opts);
-    return { status: "wired", adapter: adapter.name, changed: result.changed };
+  if (!state.hasBuildScript) {
+    lines.push(done("No build script to integrate (postinstall covers dependency changes)"));
+  } else if (state.prebuildWired && state.postbuildWired) {
+    lines.push(done("Build hooks wired (scan before builds, mark-build after)"));
+  } else if (state.packageManager === "bun") {
+    lines.push(todo('Wire the build hooks yourself \u2014 edit package.json (bun skips pre/post hooks, so chain inside "build")'));
+    lines.push(detail('Edit package.json \u2192 "build": "patchstack-connect scan && <existing build command> && patchstack-connect mark-build"'));
+  } else {
+    lines.push(todo('Wire the build hooks yourself \u2014 edit package.json "scripts" (chain with && if a hook already exists)'));
+    if (!state.prebuildWired) {
+      lines.push(detail('Edit package.json \u2192 "prebuild": "patchstack-connect scan"'));
+    }
+    if (!state.postbuildWired) {
+      lines.push(detail('Edit package.json \u2192 "postbuild": "patchstack-connect mark-build"'));
+    }
   }
-  const { changed, dir } = scaffoldGeneric(cwd, opts);
-  const plan = wiringPlan(cwd, dir);
-  log(plan);
-  return { status: "scaffolded", adapter: "generic", changed, plan };
-}
-function runVerify(cwd) {
-  const adapter = ADAPTERS.find((a) => a.detect(cwd));
-  if (adapter) return { stack: adapter.label, ...adapter.verify(cwd) };
-  return { stack: "generic", ...genericVerify(cwd) };
+  const widgetOk = state.widgetInstalled && state.widgetTokenMatches !== false;
+  if (state.widgetOptOut && !widgetOk) {
+    lines.push(done('Disclosure widget disabled by config ("widget": false in .patchstackrc.json)'));
+  } else if (widgetOk) {
+    lines.push(done("Disclosure widget installed"));
+  } else if (state.widgetInstalled) {
+    lines.push(todo("Fix the disclosure widget yourself \u2014 its site UUID doesn't match this project's"));
+    lines.push(detail(`Edit the widget tag \u2192 set data-site-uuid (or userToken) to '${state.siteUuid}' (a wrong UUID makes the widget silently no-op)`));
+  } else if (state.siteUuid === null) {
+    lines.push(todo('Add the "Report a vulnerability" widget \u2014 the first scan does this for you'));
+    lines.push(detail("Run \u2192 npx @patchstack/connect scan  (provisions the site and adds the widget tag"));
+    lines.push(detail("  to the root HTML shell: index.html / public/index.html / src/app.html)"));
+  } else {
+    lines.push(todo('Add the "Report a vulnerability" widget yourself \u2014 this root is code, not a plain HTML shell'));
+    lines.push(detail("Note \u2192 a normal `scan` adds this tag to a plain HTML shell automatically; add it by hand here:"));
+    const placement = state.widgetFileHint !== null ? `Edit ${state.widgetFileHint} \u2192 put it just before </body>:` : "Edit your root layout \u2192 put it just before </body> (the framework's HTML/layout mechanism, never a JS entry point):";
+    lines.push(detail(placement));
+    lines.push(detail(`  ${buildWidgetTag(state.siteUuid)}`));
+    lines.push(detail("The site UUID is public by design \u2014 it ships in client-side HTML."));
+  }
+  if (state.protectionWired) {
+    lines.push(done(`Runtime protection wired (${state.protectionStack})`));
+  } else {
+    lines.push(todo(`Finish runtime protection (${state.protectionStack})`));
+    for (const check of state.protectionChecks.filter((item) => !item.ok)) {
+      lines.push(detail(`${check.label}${check.hint ? ` \u2014 ${check.hint}` : ""}`));
+    }
+    lines.push(detail("Verify \u2192 npx @patchstack/connect protect --check"));
+  }
+  lines.push("");
+  if (state.claimUrl !== null) {
+    lines.push(` ${paint(ANSI.cyan, "\u279C")} ${paint(ANSI.bold, "Dashboard link (open to view reports):")}`);
+    lines.push(`   ${paint(ANSI.cyan, state.claimUrl)}`);
+    lines.push(detail("Open this link in a browser. The CLI never opens it."));
+    if (state.endpointOverride !== null) {
+      lines.push(detail("(this URL inherits the endpoint override above)"));
+    }
+  } else {
+    lines.push(detail("The dashboard link appears after the first scan (re-print any time with `status`)."));
+  }
+  const remaining = countRemainingSteps(state);
+  lines.push("");
+  if (remaining === 0) {
+    lines.push(
+      done(
+        paint(
+          ANSI.bold,
+          "All setup steps complete. Commit .patchstackrc.json, package.json, the runtime guard changes, and the file carrying the widget snippet."
+        )
+      )
+    );
+    if (state.claimUrl !== null) {
+      lines.push(detail("The only manual action left is opening the dashboard link above (if not already connected)."));
+    }
+  } else {
+    lines.push(
+      ` ${paint(ANSI.yellow, String(remaining))} step(s) remaining \u2014 details in the reference guide below.`
+    );
+  }
+  return lines.join("\n");
 }
 
 // src/setup.ts
@@ -2653,6 +2756,11 @@ import { readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "
 import path10 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
+function setupProtection(cwd) {
+  const install = runProtect(cwd);
+  const verification = runVerify(cwd);
+  return { install, verification };
+}
 function appendHook(existing, command) {
   if (existing === void 0 || existing.trim().length === 0) {
     return command;
@@ -2668,14 +2776,17 @@ function wireBuildScripts(cwd, packageManager) {
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
   const build = scripts.build;
+  const postinstall = appendHook(scripts.postinstall, SCAN_COMMAND);
   if (build === void 0 || build.trim().length === 0) {
-    return {
-      changed: false,
-      strategy: "skipped",
-      detail: "package.json has no build script; no build integration was added."
-    };
-  }
-  if (packageManager === "bun") {
+    if (postinstall === scripts.postinstall) {
+      return {
+        changed: false,
+        strategy: "postinstall-only",
+        detail: "dependency-install scan already wired; no build script to integrate."
+      };
+    }
+    scripts.postinstall = postinstall;
+  } else if (packageManager === "bun") {
     let nextBuild = build;
     if (!nextBuild.includes(SCAN_COMMAND)) {
       nextBuild = `${SCAN_COMMAND} && ${nextBuild}`;
@@ -2683,24 +2794,26 @@ function wireBuildScripts(cwd, packageManager) {
     if (!nextBuild.includes(MARK_BUILD_COMMAND)) {
       nextBuild = `${nextBuild} && ${MARK_BUILD_COMMAND}`;
     }
-    if (nextBuild === build) {
+    if (nextBuild === build && postinstall === scripts.postinstall) {
       return {
         changed: false,
         strategy: "build-chain",
-        detail: "build script already runs scan and mark-build."
+        detail: "dependency-install scan and build chain already wired."
       };
     }
+    scripts.postinstall = postinstall;
     scripts.build = nextBuild;
   } else {
     const prebuild = appendHook(scripts.prebuild, SCAN_COMMAND);
     const postbuild = appendHook(scripts.postbuild, MARK_BUILD_COMMAND);
-    if (prebuild === scripts.prebuild && postbuild === scripts.postbuild) {
+    if (prebuild === scripts.prebuild && postbuild === scripts.postbuild && postinstall === scripts.postinstall) {
       return {
         changed: false,
         strategy: "lifecycle-hooks",
-        detail: "prebuild and postbuild hooks are already wired."
+        detail: "dependency-install, prebuild, and postbuild hooks are already wired."
       };
     }
+    scripts.postinstall = postinstall;
     scripts.prebuild = prebuild;
     scripts.postbuild = postbuild;
   }
@@ -2709,14 +2822,21 @@ function wireBuildScripts(cwd, packageManager) {
   const indent = indentMatch?.includes("	") ? "	" : indentMatch?.length ?? 2;
   const trailingNewline = raw.endsWith("\n") ? "\n" : "";
   writeFileSync6(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
+  if (build === void 0 || build.trim().length === 0) {
+    return {
+      changed: true,
+      strategy: "postinstall-only",
+      detail: "added a dependency-install scan; package.json has no build script."
+    };
+  }
   return packageManager === "bun" ? {
     changed: true,
     strategy: "build-chain",
-    detail: "chained scan and mark-build around the existing build command."
+    detail: "added a dependency-install scan and chained scan/mark-build around the build."
   } : {
     changed: true,
     strategy: "lifecycle-hooks",
-    detail: "added scan to prebuild and mark-build to postbuild."
+    detail: "added scans to postinstall/prebuild and mark-build to postbuild."
   };
 }
 
@@ -2733,8 +2853,9 @@ Usage:
                                                      or src/app.html) \u2014 opt out with
                                                      "widget": false in .patchstackrc.json
   patchstack-connect setup  [options]                Finish the bounded project setup: run scan,
-                                                     manage the widget, and wire package.json build
-                                                     scripts. Never runs a build or protect
+                                                     manage the widget, install + verify runtime
+                                                     protection, and wire dependency/build scans.
+                                                     Never runs the project build
   patchstack-connect init   <site-uuid>              Optional: pre-seed .patchstackrc.json
                                                      with an existing site UUID
   patchstack-connect status [options]                Show current configuration
@@ -3128,11 +3249,23 @@ Run: ${installCommand(before.packageManager)}`
     return scanCode;
   }
   console.log("");
-  console.log("  2. Wire scan and mark-build into package.json");
+  console.log("  2. Install and verify runtime protection");
+  const protection = setupProtection(process.cwd());
+  if (protection.verification.wired) {
+    console.log(`Runtime protection: wired (${protection.verification.stack}).`);
+  } else {
+    console.log(`Runtime protection: manual wiring remains (${protection.verification.stack}):`);
+    for (const check of protection.verification.checks) {
+      console.log(`  ${check.ok ? "\u2713" : "\u2717"} ${check.label}${!check.ok && check.hint ? ` \u2014 ${check.hint}` : ""}`);
+    }
+    console.log("Run `npx @patchstack/connect protect --check` after completing the failed checks.");
+  }
+  console.log("");
+  console.log("  3. Wire dependency-install and production-build scans into package.json");
   const wired = wireBuildScripts(process.cwd(), before.packageManager);
   console.log(`Build integration: ${wired.detail}`);
   console.log("");
-  console.log("  3. Verify setup status");
+  console.log("  4. Verify setup status");
   const after = await collectGuideState(process.cwd());
   const useColor = process.stdout.isTTY === true && process.env.NO_COLOR === void 0;
   console.log(renderGuideChecklist(after, useColor));