@patchstack/connect 0.3.19 → 0.3.21

package/dist/protect.cjs

@@ -1,8 +1,13 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -13,9 +18,1185 @@ var __copyProps = (to, from, except, desc) => {
       if (!__hasOwnProp.call(to, key) && key !== except)
         __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
   }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/types.ts
+var PatchstackError;
+var init_types = __esm({
+  "src/types.ts"() {
+    "use strict";
+    PatchstackError = class extends Error {
+      constructor(message, code, cause) {
+        super(message);
+        this.code = code;
+        this.cause = cause;
+        this.name = "PatchstackError";
+      }
+      code;
+      cause;
+    };
+  }
+});
+
+// src/client.ts
+function buildEndpointUrl(base, siteUuid) {
+  const trimmed = base.replace(/\/$/, "");
+  return siteUuid !== void 0 && siteUuid !== null && siteUuid.length > 0 ? `${trimmed}/${encodeURIComponent(siteUuid)}` : trimmed;
+}
+async function postManifest(config, payload) {
+  const url = buildEndpointUrl(config.endpoint, config.siteUuid);
+  const timeoutMs = config.timeoutMs;
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "User-Agent": "@patchstack/connect"
+      },
+      body: JSON.stringify({ ...payload, environment: config.environment }),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (cause) {
+    if (isTimeoutError(cause)) {
+      throw new PatchstackError(
+        `Patchstack request to ${url} timed out after ${timeoutMs}ms. Override with PATCHSTACK_TIMEOUT_MS.`,
+        "NETWORK_TIMEOUT",
+        cause
+      );
+    }
+    throw new PatchstackError(
+      `Could not reach Patchstack at ${url}. Check your network connection.`,
+      "NETWORK_ERROR",
+      cause
+    );
+  }
+  const text = await response.text();
+  let body = null;
+  try {
+    body = text.length > 0 ? JSON.parse(text) : null;
+  } catch {
+    body = null;
+  }
+  if (response.status === 404) {
+    throw new PatchstackError(
+      body?.error ?? "Site not found. Check that your site UUID is correct and that the app is registered as a Pulse app in your Patchstack dashboard.",
+      "SITE_NOT_FOUND"
+    );
+  }
+  if (response.status === 422) {
+    throw new PatchstackError(
+      body?.message ?? "Patchstack rejected the manifest payload (validation failed).",
+      "VALIDATION_ERROR"
+    );
+  }
+  if (response.status < 200 || response.status >= 300) {
+    throw new PatchstackError(
+      `Patchstack returned ${response.status}: ${text.slice(0, 200)}`,
+      "SERVER_ERROR"
+    );
+  }
+  if (body === null) {
+    throw new PatchstackError("Patchstack returned an empty response.", "SERVER_ERROR");
+  }
+  return body;
+}
+function isTimeoutError(cause) {
+  if (cause instanceof Error) {
+    return cause.name === "TimeoutError" || cause.name === "AbortError";
+  }
+  return false;
+}
+var DEFAULT_ENDPOINT, DEFAULT_TIMEOUT_MS;
+var init_client = __esm({
+  "src/client.ts"() {
+    "use strict";
+    init_types();
+    DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
+    DEFAULT_TIMEOUT_MS = 3e4;
+  }
+});
+
+// src/config.ts
+async function resolveConfig(options) {
+  const fromFile = await readConfigFile(options.cwd);
+  const fromEnv = readEnv();
+  const siteUuid = options.cliSiteUuid ?? fromEnv.siteUuid ?? fromFile.siteUuid ?? null;
+  const endpoint = options.cliEndpoint ?? fromEnv.endpoint ?? fromFile.endpoint ?? DEFAULT_ENDPOINT;
+  const timeoutMs = fromEnv.timeoutMs ?? fromFile.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const environmentRaw = fromEnv.environment ?? fromFile.environment;
+  if (environmentRaw !== void 0 && !isEnvironment(environmentRaw)) {
+    throw new PatchstackError(
+      `Environment must be "production" or "sandbox"; got "${environmentRaw}".`,
+      "CONFIG_INVALID"
+    );
+  }
+  const environment = environmentRaw ?? DEFAULT_ENVIRONMENT;
+  if (siteUuid !== null && siteUuid.length > 0 && !isUuid(siteUuid)) {
+    throw new PatchstackError(
+      `Site UUID "${siteUuid}" does not look like a valid UUID.`,
+      "CONFIG_INVALID"
+    );
+  }
+  if (options.requireSiteUuid && (siteUuid === null || siteUuid.length === 0)) {
+    throw new PatchstackError(
+      "No site UUID configured. Run `patchstack-connect scan` to provision one, or set PATCHSTACK_SITE_UUID.",
+      "CONFIG_MISSING"
+    );
+  }
+  return {
+    siteUuid: siteUuid === null || siteUuid.length === 0 ? null : siteUuid,
+    endpoint,
+    timeoutMs,
+    environment,
+    widget: fromFile.widget !== false
+  };
+}
+async function readConfigFile(cwd) {
+  const target = import_node_path2.default.join(cwd, CONFIG_FILENAME);
+  let raw;
+  try {
+    raw = await (0, import_promises.readFile)(target, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return {};
+    }
+    throw new PatchstackError(
+      `Could not read ${target}: ${err.message}`,
+      "CONFIG_INVALID",
+      err
+    );
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new PatchstackError(
+      `Config file ${target} contains invalid JSON.`,
+      "CONFIG_INVALID",
+      err
+    );
+  }
+}
+function readEnv() {
+  const timeoutRaw = process.env.PATCHSTACK_TIMEOUT_MS;
+  let timeoutMs;
+  if (timeoutRaw !== void 0 && timeoutRaw.length > 0) {
+    const parsed = Number(timeoutRaw);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+      throw new PatchstackError(
+        `PATCHSTACK_TIMEOUT_MS must be a positive number; got "${timeoutRaw}".`,
+        "CONFIG_INVALID"
+      );
+    }
+    timeoutMs = parsed;
+  }
+  const environmentRaw = process.env.PATCHSTACK_ENVIRONMENT;
+  return {
+    siteUuid: process.env.PATCHSTACK_SITE_UUID ?? void 0,
+    endpoint: process.env.PATCHSTACK_ENDPOINT ?? void 0,
+    timeoutMs,
+    environment: environmentRaw !== void 0 && environmentRaw.length > 0 ? environmentRaw : void 0
+  };
+}
+function isUuid(value) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}
+function isEnvironment(value) {
+  return value === "production" || value === "sandbox";
+}
+var import_promises, import_node_path2, CONFIG_FILENAME, DEFAULT_ENVIRONMENT;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    import_promises = require("fs/promises");
+    import_node_path2 = __toESM(require("path"), 1);
+    init_types();
+    init_client();
+    CONFIG_FILENAME = ".patchstackrc.json";
+    DEFAULT_ENVIRONMENT = "production";
+  }
+});
+
+// src/parsers/consistency.ts
+async function readDeclaredDependencyNames(cwd) {
+  let raw;
+  try {
+    raw = await (0, import_promises2.readFile)(import_node_path3.default.join(cwd, "package.json"), "utf8");
+  } catch {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return [];
+  }
+  const names = /* @__PURE__ */ new Set();
+  for (const group of ["dependencies", "devDependencies"]) {
+    const deps = parsed[group];
+    if (typeof deps !== "object" || deps === null) {
+      continue;
+    }
+    for (const [name, spec] of Object.entries(deps)) {
+      if (typeof spec === "string" && /^(file|link|workspace|portal):/.test(spec)) {
+        continue;
+      }
+      names.add(name);
+    }
+  }
+  return [...names];
+}
+function missingDependencies(declared, packages) {
+  const present = new Set(packages.map((entry) => entry.name));
+  return declared.filter((name) => !present.has(name));
+}
+var import_promises2, import_node_path3;
+var init_consistency = __esm({
+  "src/parsers/consistency.ts"() {
+    "use strict";
+    import_promises2 = require("fs/promises");
+    import_node_path3 = __toESM(require("path"), 1);
+  }
+});
+
+// src/parsers/npm.ts
+async function parseNpmLockfile(lockfilePath) {
+  let raw;
+  try {
+    raw = await (0, import_promises3.readFile)(lockfilePath, "utf8");
+  } catch (cause) {
+    throw new PatchstackError(`Could not read lockfile at ${lockfilePath}`, "LOCKFILE_NOT_FOUND", cause);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (cause) {
+    throw new PatchstackError(`Lockfile at ${lockfilePath} is not valid JSON`, "LOCKFILE_PARSE_ERROR", cause);
+  }
+  if (parsed.packages) {
+    return extractFromV2(parsed.packages);
+  }
+  if (parsed.dependencies) {
+    return extractFromV1(parsed.dependencies);
+  }
+  throw new PatchstackError(
+    `Lockfile at ${lockfilePath} has no "packages" or "dependencies" key`,
+    "LOCKFILE_PARSE_ERROR"
+  );
+}
+function extractFromV2(packages) {
+  const entries = [];
+  for (const [pkgPath, pkg] of Object.entries(packages)) {
+    if (pkgPath === "") {
+      continue;
+    }
+    if (pkg.link === true) {
+      continue;
+    }
+    if (typeof pkg.version !== "string" || pkg.version.length === 0) {
+      continue;
+    }
+    const name = pkg.name ?? extractNameFromPath(pkgPath);
+    if (name === null) {
+      continue;
+    }
+    entries.push({
+      name,
+      version: pkg.version,
+      path: pkgPath,
+      direct: isDirectV2(pkgPath)
+    });
+  }
+  return entries;
+}
+function extractFromV1(deps, acc = [], depth = 0) {
+  for (const [name, dep] of Object.entries(deps)) {
+    if (typeof dep.version === "string" && dep.version.length > 0) {
+      acc.push({ name, version: dep.version, direct: depth === 0 });
+    }
+    if (dep.dependencies) {
+      extractFromV1(dep.dependencies, acc, depth + 1);
+    }
+  }
+  return acc;
+}
+function extractNameFromPath(pkgPath) {
+  const segments = pkgPath.split("node_modules" + import_node_path4.default.sep === pkgPath ? import_node_path4.default.sep : "/");
+  const parts = pkgPath.split("/");
+  const nmIndex = parts.lastIndexOf("node_modules");
+  if (nmIndex === -1 || nmIndex >= parts.length - 1) {
+    return segments[segments.length - 1] ?? null;
+  }
+  const tail = parts.slice(nmIndex + 1);
+  if (tail.length === 0) {
+    return null;
+  }
+  const first = tail[0];
+  if (first !== void 0 && first.startsWith("@") && tail.length >= 2) {
+    return `${first}/${tail[1]}`;
+  }
+  return first ?? null;
+}
+function isDirectV2(pkgPath) {
+  const parts = pkgPath.split("/");
+  const nmCount = parts.filter((p) => p === "node_modules").length;
+  return nmCount === 1;
+}
+var import_promises3, import_node_path4;
+var init_npm = __esm({
+  "src/parsers/npm.ts"() {
+    "use strict";
+    import_promises3 = require("fs/promises");
+    import_node_path4 = __toESM(require("path"), 1);
+    init_types();
+  }
+});
+
+// src/parsers/node_modules.ts
+async function walkNodeModules(cwd) {
+  const root = import_node_path5.default.join(cwd, "node_modules");
+  try {
+    const info = await (0, import_promises4.stat)(root);
+    if (!info.isDirectory()) {
+      throw new PatchstackError(
+        `${root} exists but is not a directory.`,
+        "LOCKFILE_NOT_FOUND"
+      );
+    }
+  } catch (cause) {
+    if (cause instanceof PatchstackError) {
+      throw cause;
+    }
+    throw new PatchstackError(
+      `node_modules/ not found at ${cwd}. Install dependencies first (e.g. \`bun install\` or \`npm install\`).`,
+      "LOCKFILE_NOT_FOUND",
+      cause
+    );
+  }
+  const entries = [];
+  await walk(root, entries, 0);
+  return entries;
+}
+async function walk(dir, acc, depth) {
+  let names;
+  try {
+    names = await (0, import_promises4.readdir)(dir);
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    if (name.startsWith(".")) {
+      continue;
+    }
+    const fullPath = import_node_path5.default.join(dir, name);
+    if (!await isPlainDirectory(fullPath)) {
+      continue;
+    }
+    if (name.startsWith("@")) {
+      let subNames;
+      try {
+        subNames = await (0, import_promises4.readdir)(fullPath);
+      } catch {
+        continue;
+      }
+      for (const sub of subNames) {
+        if (sub.startsWith(".")) {
+          continue;
+        }
+        const scopedDir = import_node_path5.default.join(fullPath, sub);
+        if (!await isPlainDirectory(scopedDir)) {
+          continue;
+        }
+        await readPackage(scopedDir, depth, acc);
+        await walkNested(scopedDir, acc, depth);
+      }
+      continue;
+    }
+    await readPackage(fullPath, depth, acc);
+    await walkNested(fullPath, acc, depth);
+  }
+}
+async function readPackage(pkgDir, depth, acc) {
+  let raw;
+  try {
+    raw = await (0, import_promises4.readFile)(import_node_path5.default.join(pkgDir, "package.json"), "utf8");
+  } catch {
+    return;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  if (typeof parsed.name !== "string" || parsed.name.length === 0) {
+    return;
+  }
+  if (typeof parsed.version !== "string" || parsed.version.length === 0) {
+    return;
+  }
+  acc.push({
+    name: parsed.name,
+    version: parsed.version,
+    direct: depth === 0
+  });
+}
+async function walkNested(pkgDir, acc, depth) {
+  const nested = import_node_path5.default.join(pkgDir, "node_modules");
+  if (!await isPlainDirectory(nested)) {
+    return;
+  }
+  await walk(nested, acc, depth + 1);
+}
+async function isPlainDirectory(dir) {
+  try {
+    const info = await (0, import_promises4.lstat)(dir);
+    return info.isDirectory() && !info.isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+var import_promises4, import_node_path5;
+var init_node_modules = __esm({
+  "src/parsers/node_modules.ts"() {
+    "use strict";
+    import_promises4 = require("fs/promises");
+    import_node_path5 = __toESM(require("path"), 1);
+    init_types();
+  }
+});
+
+// src/parsers/pnpm.ts
+async function parsePnpmLockfile(lockfilePath) {
+  let raw;
+  try {
+    raw = await (0, import_promises5.readFile)(lockfilePath, "utf8");
+  } catch (cause) {
+    throw new PatchstackError(
+      `Could not read lockfile at ${lockfilePath}`,
+      "LOCKFILE_NOT_FOUND",
+      cause
+    );
+  }
+  const lines = raw.split(/\r?\n/);
+  const directNames = collectDirectDepNames(lines);
+  const packageKeys = collectPackagesBlockKeys(lines);
+  if (packageKeys.length === 0) {
+    throw new PatchstackError(
+      `Lockfile at ${lockfilePath} has no "packages" entries`,
+      "LOCKFILE_PARSE_ERROR"
+    );
+  }
+  const entries = [];
+  for (const key of packageKeys) {
+    const parsed = parsePackageKey(key);
+    if (parsed === null) {
+      continue;
+    }
+    entries.push({
+      name: parsed.name,
+      version: parsed.version,
+      direct: directNames.has(parsed.name)
+    });
+  }
+  return entries;
+}
+function parsePackageKey(rawKey) {
+  let k = rawKey.trim();
+  if (k.length === 0) {
+    return null;
+  }
+  if (k.startsWith("'") && k.endsWith("'") || k.startsWith('"') && k.endsWith('"')) {
+    k = k.slice(1, -1);
+  }
+  if (k.startsWith("/")) {
+    k = k.slice(1);
+  }
+  const parenIdx = k.indexOf("(");
+  if (parenIdx >= 0) {
+    k = k.slice(0, parenIdx);
+  }
+  let scopePrefix = "";
+  let body = k;
+  if (k.startsWith("@")) {
+    const firstSlash = k.indexOf("/");
+    if (firstSlash <= 0) {
+      return null;
+    }
+    scopePrefix = k.slice(0, firstSlash + 1);
+    body = k.slice(firstSlash + 1);
+  }
+  const slashIdx = body.indexOf("/");
+  const atIdx = body.indexOf("@");
+  let sepIdx;
+  if (slashIdx < 0 && atIdx < 0) {
+    return null;
+  } else if (slashIdx < 0) {
+    sepIdx = atIdx;
+  } else if (atIdx < 0) {
+    sepIdx = slashIdx;
+  } else {
+    sepIdx = Math.min(slashIdx, atIdx);
+  }
+  const name = scopePrefix + body.slice(0, sepIdx);
+  let version = body.slice(sepIdx + 1);
+  const underscoreIdx = version.indexOf("_");
+  if (underscoreIdx >= 0) {
+    version = version.slice(0, underscoreIdx);
+  }
+  if (name.length === 0 || version.length === 0) {
+    return null;
+  }
+  return { name, version };
+}
+function indentOf(line) {
+  let i = 0;
+  while (i < line.length && line[i] === " ") {
+    i++;
+  }
+  return i;
+}
+function isBlankOrComment(line) {
+  const trimmed = line.trim();
+  return trimmed.length === 0 || trimmed.startsWith("#");
+}
+function collectPackagesBlockKeys(lines) {
+  const keys = [];
+  let inBlock = false;
+  let childIndent = null;
+  for (const line of lines) {
+    if (isBlankOrComment(line)) {
+      continue;
+    }
+    const indent = indentOf(line);
+    if (!inBlock) {
+      if (indent === 0 && line.trim() === "packages:") {
+        inBlock = true;
+      }
+      continue;
+    }
+    if (indent === 0) {
+      break;
+    }
+    if (childIndent === null) {
+      childIndent = indent;
+    }
+    if (indent !== childIndent) {
+      continue;
+    }
+    const content = line.slice(indent);
+    if (!content.endsWith(":")) {
+      continue;
+    }
+    keys.push(content.slice(0, -1));
+  }
+  return keys;
+}
+function collectDirectDepNames(lines) {
+  const names = /* @__PURE__ */ new Set();
+  collectFromImporters(lines, names);
+  for (const section of ["dependencies", "devDependencies", "optionalDependencies"]) {
+    collectFromTopLevelSection(lines, section, names);
+  }
+  return names;
+}
+function collectFromImporters(lines, out) {
+  let inImporters = false;
+  let importerIndent = null;
+  let inDepSection = false;
+  let depSectionIndent = null;
+  let leafIndent = null;
+  for (const line of lines) {
+    if (isBlankOrComment(line)) {
+      continue;
+    }
+    const indent = indentOf(line);
+    const trimmed = line.trim();
+    if (!inImporters) {
+      if (indent === 0 && trimmed === "importers:") {
+        inImporters = true;
+      }
+      continue;
+    }
+    if (indent === 0) {
+      break;
+    }
+    if (importerIndent === null) {
+      importerIndent = indent;
+    }
+    if (indent === importerIndent) {
+      inDepSection = false;
+      depSectionIndent = null;
+      leafIndent = null;
+      continue;
+    }
+    if (!inDepSection) {
+      const key = stripTrailingColon(trimmed);
+      if (key !== null && DEP_SECTIONS.has(key)) {
+        inDepSection = true;
+        depSectionIndent = indent;
+      }
+      continue;
+    }
+    if (depSectionIndent !== null && indent <= depSectionIndent) {
+      inDepSection = false;
+      depSectionIndent = null;
+      leafIndent = null;
+      const key = stripTrailingColon(trimmed);
+      if (key !== null && DEP_SECTIONS.has(key)) {
+        inDepSection = true;
+        depSectionIndent = indent;
+      }
+      continue;
+    }
+    if (leafIndent === null) {
+      leafIndent = indent;
+    }
+    if (indent !== leafIndent) {
+      continue;
+    }
+    const name = extractLeafName(trimmed);
+    if (name !== null) {
+      out.add(name);
+    }
+  }
+}
+function collectFromTopLevelSection(lines, section, out) {
+  let inSection = false;
+  let leafIndent = null;
+  for (const line of lines) {
+    if (isBlankOrComment(line)) {
+      continue;
+    }
+    const indent = indentOf(line);
+    const trimmed = line.trim();
+    if (!inSection) {
+      if (indent === 0 && trimmed === `${section}:`) {
+        inSection = true;
+      }
+      continue;
+    }
+    if (indent === 0) {
+      break;
+    }
+    if (leafIndent === null) {
+      leafIndent = indent;
+    }
+    if (indent !== leafIndent) {
+      continue;
+    }
+    const name = extractLeafName(trimmed);
+    if (name !== null) {
+      out.add(name);
+    }
+  }
+}
+function stripTrailingColon(s) {
+  if (!s.endsWith(":")) {
+    return null;
+  }
+  return s.slice(0, -1).trim();
+}
+function extractLeafName(trimmed) {
+  const colonIdx = trimmed.indexOf(":");
+  if (colonIdx < 0) {
+    return null;
+  }
+  let name = trimmed.slice(0, colonIdx).trim();
+  if (name.length === 0) {
+    return null;
+  }
+  if (name.startsWith("'") && name.endsWith("'") || name.startsWith('"') && name.endsWith('"')) {
+    name = name.slice(1, -1);
+  }
+  return name.length > 0 ? name : null;
+}
+var import_promises5, DEP_SECTIONS;
+var init_pnpm = __esm({
+  "src/parsers/pnpm.ts"() {
+    "use strict";
+    import_promises5 = require("fs/promises");
+    init_types();
+    DEP_SECTIONS = /* @__PURE__ */ new Set([
+      "dependencies",
+      "devDependencies",
+      "optionalDependencies"
+    ]);
+  }
+});
+
+// src/parsers/yarn.ts
+async function parseYarnLockfile(lockfilePath) {
+  let raw;
+  try {
+    raw = await (0, import_promises6.readFile)(lockfilePath, "utf8");
+  } catch (cause) {
+    throw new PatchstackError(
+      `Could not read lockfile at ${lockfilePath}`,
+      "LOCKFILE_NOT_FOUND",
+      cause
+    );
+  }
+  const blocks = parseBlocks(raw);
+  if (blocks.length === 0) {
+    throw new PatchstackError(
+      `Lockfile at ${lockfilePath} contains no package entries`,
+      "LOCKFILE_PARSE_ERROR"
+    );
+  }
+  const directNames = await readDirectDepNames(import_node_path6.default.dirname(lockfilePath));
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const block of blocks) {
+    if (block.version.length === 0 || block.names.size === 0) {
+      continue;
+    }
+    for (const name of block.names) {
+      const dedupKey = `${name}@${block.version}`;
+      if (seen.has(dedupKey)) {
+        continue;
+      }
+      seen.add(dedupKey);
+      entries.push({
+        name,
+        version: block.version,
+        direct: directNames.has(name)
+      });
+    }
+  }
+  return entries;
+}
+function parseBlocks(raw) {
+  const lines = raw.split(/\r?\n/);
+  const blocks = [];
+  let current = null;
+  const finalize = () => {
+    if (current !== null && current.version.length > 0 && current.names.size > 0) {
+      blocks.push(current);
+    }
+    current = null;
+  };
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0 || trimmed.startsWith("#")) {
+      continue;
+    }
+    const indent = countLeadingSpaces(line);
+    if (indent === 0) {
+      finalize();
+      if (!trimmed.endsWith(":")) {
+        continue;
+      }
+      const keyLine = trimmed.slice(0, -1);
+      const names = /* @__PURE__ */ new Set();
+      for (const spec of splitDescriptors(keyLine)) {
+        const name = extractName(spec);
+        if (name !== null) {
+          names.add(name);
+        }
+      }
+      current = { names, version: "" };
+      continue;
+    }
+    if (current === null) {
+      continue;
+    }
+    const version = parseVersionField(trimmed);
+    if (version !== null) {
+      current.version = version;
+    }
+  }
+  finalize();
+  return blocks;
+}
+function countLeadingSpaces(line) {
+  let i = 0;
+  while (i < line.length && line[i] === " ") {
+    i++;
+  }
+  return i;
+}
+function splitDescriptors(keyLine) {
+  const parts = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < keyLine.length; i++) {
+    const c = keyLine[i];
+    if (quote !== null) {
+      current += c;
+      if (c === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      current += c;
+      continue;
+    }
+    if (c === ",") {
+      const piece = current.trim();
+      if (piece.length > 0) {
+        parts.push(piece);
+      }
+      current = "";
+      continue;
+    }
+    current += c;
+  }
+  const tail = current.trim();
+  if (tail.length > 0) {
+    parts.push(tail);
+  }
+  return parts;
+}
+function extractName(rawSpec) {
+  let s = rawSpec.trim();
+  if (s.length === 0) {
+    return null;
+  }
+  if (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'")) {
+    s = s.slice(1, -1);
+  }
+  const atIdx = s.lastIndexOf("@");
+  if (atIdx <= 0) {
+    return null;
+  }
+  const name = s.slice(0, atIdx);
+  return name.length > 0 ? name : null;
+}
+function parseVersionField(content) {
+  if (!content.startsWith("version")) {
+    return null;
+  }
+  const after = content.slice("version".length);
+  const firstChar = after.charAt(0);
+  if (firstChar !== " " && firstChar !== "	" && firstChar !== ":") {
+    return null;
+  }
+  let rest = firstChar === ":" ? after.slice(1) : after;
+  rest = rest.trim();
+  if (rest.length === 0) {
+    return null;
+  }
+  if (rest.startsWith('"') && rest.endsWith('"') || rest.startsWith("'") && rest.endsWith("'")) {
+    rest = rest.slice(1, -1);
+  }
+  return rest.length > 0 ? rest : null;
+}
+async function readDirectDepNames(cwd) {
+  const names = /* @__PURE__ */ new Set();
+  let raw;
+  try {
+    raw = await (0, import_promises6.readFile)(import_node_path6.default.join(cwd, "package.json"), "utf8");
+  } catch {
+    return names;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return names;
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return names;
+  }
+  const obj = parsed;
+  for (const field of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
+    const section = obj[field];
+    if (typeof section !== "object" || section === null) {
+      continue;
+    }
+    for (const name of Object.keys(section)) {
+      names.add(name);
+    }
+  }
+  return names;
+}
+var import_promises6, import_node_path6;
+var init_yarn = __esm({
+  "src/parsers/yarn.ts"() {
+    "use strict";
+    import_promises6 = require("fs/promises");
+    import_node_path6 = __toESM(require("path"), 1);
+    init_types();
+  }
+});
+
+// src/parsers/index.ts
+async function detectLockfile(cwd) {
+  const probed = await Promise.all(
+    LOCKFILE_CANDIDATES.map(async (candidate) => {
+      const filePath = import_node_path7.default.join(cwd, candidate.filename);
+      return { ...candidate, filePath, present: await exists(filePath) };
+    })
+  );
+  const match = probed.find((candidate) => candidate.present);
+  if (match) {
+    return {
+      ecosystem: "npm",
+      filePath: match.filePath,
+      filename: match.filename,
+      strategy: match.strategy
+    };
+  }
+  const expected = LOCKFILE_CANDIDATES.map((candidate) => candidate.filename).join(", ");
+  throw new PatchstackError(
+    `No lockfile found in ${cwd}. Expected one of: ${expected}.`,
+    "LOCKFILE_NOT_FOUND"
+  );
+}
+async function scanLockfile(cwd) {
+  const candidates = await presentLockfiles(cwd);
+  if (candidates.length === 0) {
+    await detectLockfile(cwd);
+  }
+  const declared = await readDeclaredDependencyNames(cwd);
+  const warnings = [];
+  let firstParsed = null;
+  let walkTried = false;
+  for (const candidate of candidates) {
+    let packages;
+    try {
+      packages = await runStrategy(candidate, cwd);
+    } catch {
+      continue;
+    }
+    walkTried ||= candidate.strategy === "node-modules-walk";
+    firstParsed ??= { packages, filename: candidate.filename };
+    const missing = missingDependencies(declared, packages);
+    if (missing.length === 0) {
+      return manifestWith(packages, warnings);
+    }
+    warnings.push(staleWarning(candidate.filename, missing));
+  }
+  if (!walkTried) {
+    try {
+      const packages = await walkNodeModules(cwd);
+      const missing = missingDependencies(declared, packages);
+      if (missing.length > 0) {
+        warnings.push(staleWarning("node_modules/", missing));
+      }
+      warnings.push("Scanned node_modules/ instead. Delete the stale lockfile to silence this warning.");
+      return manifestWith(packages, warnings);
+    } catch {
+    }
+  }
+  if (firstParsed === null) {
+    const expected = LOCKFILE_CANDIDATES.map((candidate) => candidate.filename).join(", ");
+    throw new PatchstackError(
+      `No readable lockfile found in ${cwd}. Expected one of: ${expected}.`,
+      "LOCKFILE_NOT_FOUND"
+    );
+  }
+  warnings.push(
+    `No fully-consistent source found; reporting ${firstParsed.filename}. The manifest may understate the real dependency set.`
+  );
+  return manifestWith(firstParsed.packages, warnings);
+}
+function manifestWith(packages, warnings) {
+  return warnings.length > 0 ? { ecosystem: "npm", packages, warnings } : { ecosystem: "npm", packages };
+}
+function staleWarning(source, missing) {
+  const sample = missing.slice(0, 3).join(", ");
+  const suffix = missing.length > 3 ? `, +${missing.length - 3} more` : "";
+  return `${source} looks stale: package.json declares ${missing.length} dependenc${missing.length === 1 ? "y" : "ies"} it does not contain (${sample}${suffix}).`;
+}
+async function presentLockfiles(cwd) {
+  const probed = await Promise.all(
+    LOCKFILE_CANDIDATES.map(async (candidate) => {
+      const filePath = import_node_path7.default.join(cwd, candidate.filename);
+      return { ...candidate, filePath, present: await exists(filePath) };
+    })
+  );
+  return probed.filter((candidate) => candidate.present).map(({ filename, strategy, filePath }) => ({ ecosystem: "npm", filename, strategy, filePath }));
+}
+async function runStrategy(detected, cwd) {
+  switch (detected.strategy) {
+    case "npm-lockfile":
+      return parseNpmLockfile(detected.filePath);
+    case "pnpm-lockfile":
+      return parsePnpmLockfile(detected.filePath);
+    case "yarn-lockfile":
+      return parseYarnLockfile(detected.filePath);
+    case "node-modules-walk":
+      return walkNodeModules(cwd);
+  }
+}
+async function exists(filePath) {
+  try {
+    await (0, import_promises7.access)(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var import_promises7, import_node_path7, LOCKFILE_CANDIDATES;
+var init_parsers = __esm({
+  "src/parsers/index.ts"() {
+    "use strict";
+    import_promises7 = require("fs/promises");
+    import_node_path7 = __toESM(require("path"), 1);
+    init_types();
+    init_consistency();
+    init_npm();
+    init_node_modules();
+    init_pnpm();
+    init_yarn();
+    LOCKFILE_CANDIDATES = [
+      { filename: "package-lock.json", strategy: "npm-lockfile" },
+      { filename: "bun.lock", strategy: "node-modules-walk" },
+      { filename: "bun.lockb", strategy: "node-modules-walk" },
+      { filename: "pnpm-lock.yaml", strategy: "pnpm-lockfile" },
+      { filename: "yarn.lock", strategy: "yarn-lockfile" }
+    ];
+  }
+});
+
+// src/normalize.ts
+function buildWirePayload(manifest) {
+  const seen = /* @__PURE__ */ new Map();
+  const wirePackages = [];
+  for (const entry of manifest.packages) {
+    const versions = seen.get(entry.name);
+    if (versions) {
+      if (versions.has(entry.version)) {
+        continue;
+      }
+      versions.add(entry.version);
+    } else {
+      seen.set(entry.name, /* @__PURE__ */ new Set([entry.version]));
+    }
+    wirePackages.push({ name: entry.name, version: entry.version });
+  }
+  wirePackages.sort((a, b) => {
+    if (a.name === b.name) {
+      return compareVersions(a.version, b.version);
+    }
+    return a.name < b.name ? -1 : 1;
+  });
+  const duplicateNames = [];
+  for (const [name, versions] of seen) {
+    if (versions.size > 1) {
+      duplicateNames.push(name);
+    }
+  }
+  return {
+    payload: { ecosystem: manifest.ecosystem, packages: wirePackages },
+    stats: {
+      uniqueNames: seen.size,
+      duplicateNames,
+      totalEntries: manifest.packages.length
+    }
+  };
+}
+function compareVersions(a, b) {
+  if (a === b) {
+    return 0;
+  }
+  const [aBase, aPre] = splitPrerelease(a);
+  const [bBase, bPre] = splitPrerelease(b);
+  const baseCmp = compareSegments(aBase.split("."), bBase.split("."));
+  if (baseCmp !== 0) {
+    return baseCmp;
+  }
+  if (aPre === null && bPre === null) {
+    return 0;
+  }
+  if (aPre === null) {
+    return 1;
+  }
+  if (bPre === null) {
+    return -1;
+  }
+  return compareSegments(aPre.split("."), bPre.split("."));
+}
+function splitPrerelease(version) {
+  const cleaned = version.replace(/^[v=]+/, "").split("+")[0];
+  const dashIndex = cleaned.indexOf("-");
+  if (dashIndex === -1) {
+    return [cleaned, null];
+  }
+  return [cleaned.slice(0, dashIndex), cleaned.slice(dashIndex + 1)];
+}
+function compareSegments(a, b) {
+  const max = Math.max(a.length, b.length);
+  for (let i = 0; i < max; i++) {
+    const aPart = a[i];
+    const bPart = b[i];
+    if (aPart === void 0) {
+      return -1;
+    }
+    if (bPart === void 0) {
+      return 1;
+    }
+    const aNum = /^\d+$/.test(aPart);
+    const bNum = /^\d+$/.test(bPart);
+    if (aNum && bNum) {
+      const diff = Number(aPart) - Number(bPart);
+      if (diff !== 0) {
+        return diff < 0 ? -1 : 1;
+      }
+      continue;
+    }
+    if (aNum) {
+      return -1;
+    }
+    if (bNum) {
+      return 1;
+    }
+    if (aPart < bPart) {
+      return -1;
+    }
+    if (aPart > bPart) {
+      return 1;
+    }
+  }
+  return 0;
+}
+var init_normalize = __esm({
+  "src/normalize.ts"() {
+    "use strict";
+  }
+});
+
+// src/protect/refresh-manifest.ts
+var refresh_manifest_exports = {};
+__export(refresh_manifest_exports, {
+  reportManifest: () => reportManifest
+});
+async function reportManifest(cwd) {
+  const config = await resolveConfig({ cwd });
+  if (config.siteUuid === null || config.siteUuid.length === 0) {
+    return;
+  }
+  const manifest = await scanLockfile(cwd);
+  const { payload } = buildWirePayload(manifest);
+  await postManifest(config, payload);
+}
+var init_refresh_manifest = __esm({
+  "src/protect/refresh-manifest.ts"() {
+    "use strict";
+    init_config();
+    init_parsers();
+    init_normalize();
+    init_client();
+  }
+});
 
 // src/protect/runtime.js
 var runtime_exports = {};
@@ -43,7 +1224,7 @@ var PatchstackRuleClient = class {
   constructor({ token, baseUrl, cacheTtl, etag } = {}) {
     this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN;
     this.#baseUrl = baseUrl ?? process.env.PATCHSTACK_WAF_API_URL ?? DEFAULT_BASE_URL;
-    this.#cacheTtl = cacheTtl ?? DEFAULT_CACHE_TTL;
+    this.#cacheTtl = Number.isFinite(cacheTtl) && cacheTtl > 0 ? cacheTtl : DEFAULT_CACHE_TTL;
     this.#etag = etag ?? null;
     if (!this.#token) {
       throw new Error("Patchstack WAF token is required. Pass { token } or set PATCHSTACK_WAF_TOKEN env var.");
@@ -83,11 +1264,14 @@ var PatchstackRuleClient = class {
         };
       }
       const data = await response.json();
+      if (!data || !Array.isArray(data.firewall)) {
+        return { success: false, error: "unexpected response shape (no firewall array)", firewall: [], whitelists: [], whitelist_keys: {} };
+      }
       const result = {
         success: true,
         notModified: false,
         etag: response.headers?.get?.("etag") ?? null,
-        firewall: Array.isArray(data.firewall) ? data.firewall : [],
+        firewall: data.firewall,
         whitelists: Array.isArray(data.whitelists) ? data.whitelists : [],
         whitelist_keys: data.whitelist_keys ?? {}
       };
@@ -413,13 +1597,14 @@ var RequestResolver = class {
     if (typeof obj !== "object" || obj === null) {
       return void 0;
     }
-    if (key in obj) {
+    const own = (o, k) => o !== null && typeof o === "object" && Object.prototype.hasOwnProperty.call(o, k);
+    if (own(obj, key)) {
       return obj[key];
     }
     const parts = key.split(".");
     let current = obj;
     for (const part of parts) {
-      if (current === null || current === void 0 || typeof current !== "object") {
+      if (!own(current, part)) {
         return void 0;
       }
       current = current[part];
@@ -632,11 +1817,8 @@ function normalizeObject(value, options = {}) {
 
 // src/protect/engine/engine.js
 var REDOS_PATTERNS = [
-  /\(\w\+\)\+/,
-  /\(\w\*\)\+/,
-  /\(\w\+\)\*/,
-  /\(\w\*\)\*/,
-  /\(\w\|\w\)\+/
+  /\([^)]*[+*}][^)]*\)\s*[+*]/,
+  /\([^)]*\|[^)]*\)\s*[+*]/
 ];
 function safeRegExp(pattern) {
   if (!pattern) {
@@ -664,6 +1846,25 @@ function ctypeResult(strValue, isClass, matchVal) {
   const expected = typeof matchVal === "boolean" ? matchVal : true;
   return isClass === expected;
 }
+function walkLeaves(node, segments, cb) {
+  if (node === null || typeof node !== "object") return;
+  if (Array.isArray(node)) {
+    for (const el of node) walkLeaves(el, segments, cb);
+    return;
+  }
+  const [head, ...rest] = segments;
+  if (head === void 0 || !Object.prototype.hasOwnProperty.call(node, head)) return;
+  if (rest.length === 0) {
+    const leaf = node[head];
+    if (Array.isArray(leaf)) {
+      for (let i = 0; i < leaf.length; i++) cb({ parent: leaf, key: i, value: leaf[i] });
+    } else {
+      cb({ parent: node, key: head, value: leaf });
+    }
+  } else {
+    walkLeaves(node[head], rest, cb);
+  }
+}
 function arrayKeyValue(value, matchObj) {
   if (!matchObj || !matchObj.match || value === null || typeof value !== "object") {
     return false;
@@ -671,23 +1872,11 @@ function arrayKeyValue(value, matchObj) {
   const keys = Array.isArray(matchObj.key) ? matchObj.key : [matchObj.key];
   const sub = matchObj.match;
   for (const key of keys) {
-    let node = value;
-    for (const part of String(key).split(".")) {
-      if (node === null || typeof node !== "object") {
-        node = void 0;
-        break;
-      }
-      node = node[part];
-    }
-    if (node === void 0) {
-      continue;
-    }
-    const candidates = Array.isArray(node) ? node : [node];
-    for (const candidate of candidates) {
-      if (matchValue(sub.type, candidate, sub.value, sub)) {
-        return true;
-      }
-    }
+    let matched = false;
+    walkLeaves(value, String(key).split("."), ({ value: leaf }) => {
+      if (!matched && matchValue(sub.type, leaf, sub.value, sub)) matched = true;
+    });
+    if (matched) return true;
   }
   return false;
 }
@@ -709,16 +1898,68 @@ function isInternalHost(hostname) {
   if (host === "::1" || host === "::") return true;
   if (host.startsWith("fe80:") || host.startsWith("fc") || host.startsWith("fd")) return true;
   const v4 = host.match(/(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (v4) {
-    const a = Number(v4[1]);
-    const b = Number(v4[2]);
-    if (a === 127 || a === 10 || a === 0) return true;
-    if (a === 169 && b === 254) return true;
-    if (a === 172 && b >= 16 && b <= 31) return true;
-    if (a === 192 && b === 168) return true;
+  if (v4 && isPrivateV4(Number(v4[1]), Number(v4[2]))) return true;
+  const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (mapped) {
+    const g1 = parseInt(mapped[1], 16);
+    const g2 = parseInt(mapped[2], 16);
+    if (isPrivateV4(g1 >> 8 & 255, g1 & 255)) return true;
   }
   return false;
 }
+function isPrivateV4(a, b) {
+  if (a === 127 || a === 10 || a === 0) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  return false;
+}
+function ruleAppliesTo(when, resolver) {
+  try {
+    if (when.method) {
+      const methods = (Array.isArray(when.method) ? when.method : [when.method]).map((m) => String(m).toUpperCase());
+      const actual = String(resolver.resolve("server.REQUEST_METHOD")[0] ?? "GET").toUpperCase();
+      if (!methods.includes(actual)) return false;
+    }
+    if (when.path) {
+      const uri = String(resolver.resolve("server.REQUEST_URI")[0] ?? "/");
+      if (!pathMatches(String(when.path), uri.split("?")[0])) return false;
+    }
+    return true;
+  } catch {
+    return true;
+  }
+}
+function pathMatches(pattern, path7) {
+  if (pattern.length > 2 && pattern.startsWith("/") && pattern.endsWith("/")) {
+    const re = safeRegExp(pattern);
+    return re ? re.test(path7) : false;
+  }
+  if (pattern.includes("*")) {
+    const re = safeRegExp("/^" + pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^?]*") + "$/");
+    return re ? re.test(path7) : false;
+  }
+  return path7 === pattern;
+}
+function isCrossOrigin(resolver) {
+  try {
+    const host = String(resolver.resolve("server.HTTP_HOST")[0] ?? "").toLowerCase();
+    if (!host) return false;
+    const src = resolver.resolve("server.HTTP_ORIGIN")[0] ?? resolver.resolve("server.HTTP_REFERER")[0];
+    if (!src) return false;
+    const srcHost = hostFromUrl(String(src));
+    return srcHost !== null && srcHost !== host;
+  } catch {
+    return false;
+  }
+}
+function hostFromUrl(value) {
+  try {
+    return new URL(value).host.toLowerCase();
+  } catch {
+    return null;
+  }
+}
 function matchValue(type, value, matchVal, matchObj) {
   if (value === null || value === void 0) {
     if (type === "isset") {
@@ -764,18 +2005,19 @@ function matchValue(type, value, matchVal, matchObj) {
     case "isset":
       return true;
     case "in_array": {
-      const arr = Array.isArray(matchVal) ? matchVal : [matchVal];
+      const arr = (Array.isArray(matchVal) ? matchVal : [matchVal]).map((x) => String(x));
       return arr.includes(strValue);
     }
     case "not_in_array": {
-      const arr = Array.isArray(matchVal) ? matchVal : [matchVal];
+      const arr = (Array.isArray(matchVal) ? matchVal : [matchVal]).map((x) => String(x));
       return !arr.includes(strValue);
     }
     case "array_in_array": {
       if (!Array.isArray(value) || !Array.isArray(matchVal)) {
         return false;
       }
-      return value.some((v) => matchVal.includes(v));
+      const target = matchVal.map((x) => String(x));
+      return value.some((v) => target.includes(String(v)));
     }
     case "hostname": {
       try {
@@ -852,6 +2094,9 @@ var RuleEngine = class {
     }
     for (const rule of this.#rules) {
       try {
+        if (rule.when && !ruleAppliesTo(rule.when, resolver)) {
+          continue;
+        }
         const conditions = rule.rule_v2;
         if (!Array.isArray(conditions) || conditions.length === 0) {
           continue;
@@ -898,6 +2143,9 @@ var RuleEngine = class {
     if (parameter === "rules" && Array.isArray(condition.rules)) {
       return this.#evaluateRule(condition.rules, resolver);
     }
+    if (match && match.type === "cross_origin") {
+      return isCrossOrigin(resolver);
+    }
     const params = Array.isArray(parameter) ? parameter : [parameter];
     const values = params.flatMap((p) => resolver.resolve(p));
     if (values.length === 0) {
@@ -962,7 +2210,7 @@ var PulseRuleClient = class {
   constructor({ siteUuid, baseUrl, cacheTtl, etag } = {}) {
     this.#siteUuid = siteUuid ?? process.env.PATCHSTACK_SITE_UUID;
     this.#baseUrl = baseUrl ?? process.env.PATCHSTACK_PULSE_RULES_URL ?? DEFAULT_BASE_URL2;
-    this.#cacheTtl = cacheTtl ?? DEFAULT_CACHE_TTL2;
+    this.#cacheTtl = Number.isFinite(cacheTtl) && cacheTtl > 0 ? cacheTtl : DEFAULT_CACHE_TTL2;
     this.#etag = etag ?? null;
     if (!this.#siteUuid) {
       throw new Error("Patchstack site UUID is required. Pass { siteUuid } or set PATCHSTACK_SITE_UUID.");
@@ -986,11 +2234,14 @@ var PulseRuleClient = class {
         return { success: false, error: `API returned ${response.status}`, firewall: [], whitelists: [], whitelist_keys: {} };
       }
       const data = await response.json();
+      if (!data || !Array.isArray(data.firewall)) {
+        return { success: false, error: "unexpected response shape (no firewall array)", firewall: [], whitelists: [], whitelist_keys: {} };
+      }
       const result = {
         success: true,
         notModified: false,
         etag: response.headers?.get?.("etag") ?? null,
-        firewall: Array.isArray(data.firewall) ? data.firewall : [],
+        firewall: data.firewall,
         whitelists: Array.isArray(data.whitelists) ? data.whitelists : [],
         whitelist_keys: data.whitelist_keys ?? {}
       };
@@ -1092,6 +2343,29 @@ async function readCappedText(request, max) {
   } catch {
     return "";
   }
+  const body = clone.body;
+  if (body && typeof body.getReader === "function") {
+    const reader = body.getReader();
+    const chunks = [];
+    let buffered = 0;
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        if (!value || buffered >= max) continue;
+        const take = Math.min(value.byteLength, max - buffered);
+        chunks.push(take === value.byteLength ? value : value.subarray(0, take));
+        buffered += take;
+      }
+    } catch {
+      return "";
+    }
+    try {
+      return new TextDecoder().decode(concatChunks(chunks, buffered));
+    } catch {
+      return "";
+    }
+  }
   try {
     const text = await clone.text();
     return text.length > max ? text.slice(0, max) : text;
@@ -1099,6 +2373,15 @@ async function readCappedText(request, max) {
     return "";
   }
 }
+function concatChunks(chunks, total) {
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    out.set(c, offset);
+    offset += c.byteLength;
+  }
+  return out;
+}
 function parseMultipart(rawBody, boundary) {
   const body = {};
   const files = {};
@@ -1143,7 +2426,16 @@ function fromNodeRequest(req, rawBody = "") {
     headers[key.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;
   }
   const host = headers.host || "localhost";
-  const url = new URL(req.url || "/", `http://${host}`);
+  let url;
+  try {
+    url = new URL(req.url || "/", `http://${host}`);
+  } catch {
+    try {
+      url = new URL(req.url || "/", "http://localhost");
+    } catch {
+      url = new URL("http://localhost/");
+    }
+  }
   const query = {};
   for (const [key, value] of url.searchParams) {
     if (key in query) {
@@ -1154,6 +2446,7 @@ function fromNodeRequest(req, rawBody = "") {
   }
   const contentType = headers["content-type"] || "";
   let body = {};
+  let files;
   if (rawBody) {
     if (contentType.includes("application/json")) {
       try {
@@ -1166,6 +2459,13 @@ function fromNodeRequest(req, rawBody = "") {
       for (const [k, v] of new URLSearchParams(rawBody)) {
         body[k] = k in body ? [].concat(body[k], v) : v;
       }
+    } else if (contentType.includes("multipart/form-data")) {
+      const boundary = /boundary=("?)([^";]+)\1/i.exec(contentType)?.[2];
+      if (boundary) {
+        const parsed = parseMultipart(rawBody, boundary);
+        body = parsed.body;
+        files = parsed.files;
+      }
     }
   }
   const uri = url.pathname + url.search;
@@ -1176,6 +2476,7 @@ function fromNodeRequest(req, rawBody = "") {
     originalUrl: uri,
     query,
     body,
+    files,
     headers,
     ip: forwarded.split(",")[0].trim() || req.socket && req.socket.remoteAddress || "",
     cookies: parseCookies2(headers.cookie),
@@ -1199,15 +2500,43 @@ function parseCookies2(header) {
 }
 
 // src/protect/egress.js
-async function installEgressGuard({ shouldBlock, onBlock } = {}) {
+async function installEgressGuard({ shouldBlock, onBlock, dnsScreen = true, lookup, allowHosts } = {}) {
   const restores = [];
   if (typeof shouldBlock !== "function") return () => {
   };
+  const exempt = new Set((allowHosts ?? []).map((h) => String(h).toLowerCase()));
   const block = (url, host, method) => {
     if (!shouldBlock(url, host, method)) return false;
     onBlock?.({ url, host, method });
     return true;
   };
+  let screen = null;
+  if (dnsScreen) {
+    try {
+      const resolveLookup = lookup ?? (await import("dns")).lookup;
+      const { isIP } = await import("net");
+      if (typeof resolveLookup === "function" && typeof isIP === "function") {
+        screen = { lookup: resolveLookup, isIP, isExempt: (h) => exempt.has(String(h).toLowerCase()) };
+      }
+    } catch {
+      screen = null;
+    }
+  }
+  const resolvesToDisallowed = (url, host, method) => new Promise((resolve) => {
+    if (!screen || !host || screen.isIP(host) !== 0 || screen.isExempt(host)) return resolve(false);
+    try {
+      screen.lookup(host, { all: true }, (err, addresses) => {
+        if (err || !Array.isArray(addresses)) return resolve(false);
+        for (const a of addresses) {
+          const ip = a && typeof a === "object" ? a.address : a;
+          if (ip && block(url, ip, method)) return resolve(true);
+        }
+        resolve(false);
+      });
+    } catch {
+      resolve(false);
+    }
+  });
   const originalFetch = globalThis.fetch;
   if (typeof originalFetch === "function" && !originalFetch.__patchstackGuarded) {
     const guarded = async (input, init) => {
@@ -1219,7 +2548,7 @@ async function installEgressGuard({ shouldBlock, onBlock } = {}) {
         host = null;
       }
       const method = init && init.method || input && input.method || "GET";
-      if (block(url, host, method)) {
+      if (block(url, host, method) || await resolvesToDisallowed(url, host, method)) {
         throw new Error(`Patchstack blocked an outbound request to a disallowed address: ${host ?? url}`);
       }
       return originalFetch(input, init);
@@ -1233,7 +2562,7 @@ async function installEgressGuard({ shouldBlock, onBlock } = {}) {
   for (const moduleName of ["node:http", "node:https"]) {
     try {
       const mod = await import(moduleName);
-      const restore = patchHttpModule(mod.default ?? mod, block);
+      const restore = patchHttpModule(mod.default ?? mod, block, screen);
       if (restore) restores.push(restore);
     } catch {
     }
@@ -1271,7 +2600,7 @@ async function installEgressGuard({ shouldBlock, onBlock } = {}) {
     }
   };
 }
-function patchHttpModule(http, block) {
+function patchHttpModule(http, block, screen) {
   if (!http || typeof http.request !== "function" || http.__patchstackGuarded) return null;
   const originalRequest = http.request;
   const originalGet = http.get;
@@ -1280,14 +2609,25 @@ function patchHttpModule(http, block) {
     if (target && block(target.url, target.host, target.method)) {
       throw new Error(`Patchstack blocked an outbound request to a disallowed address: ${target.host ?? target.url}`);
     }
+    if (target && screen && target.host && screen.isIP(target.host) === 0 && !screen.isExempt(target.host)) {
+      try {
+        args = withScreeningLookup(args, target, block, screen.lookup);
+      } catch {
+      }
+    }
     return original.apply(this, args);
   };
-  http.request = wrap(originalRequest);
-  if (typeof originalGet === "function") http.get = wrap(originalGet);
+  const guardedRequest = wrap(originalRequest);
+  http.request = guardedRequest;
+  let guardedGet;
+  if (typeof originalGet === "function") {
+    guardedGet = wrap(originalGet);
+    http.get = guardedGet;
+  }
   http.__patchstackGuarded = true;
   return () => {
-    http.request = originalRequest;
-    if (typeof originalGet === "function") http.get = originalGet;
+    if (http.request === guardedRequest) http.request = originalRequest;
+    if (guardedGet && http.get === guardedGet) http.get = originalGet;
     delete http.__patchstackGuarded;
   };
 }
@@ -1300,11 +2640,11 @@ function extractHttpTarget(args) {
       return { url: url.href, host: url.hostname, method: opts && opts.method || "GET" };
     }
     if (first && typeof first === "object") {
-      const host = normalizeHost(first.hostname || first.host);
+      const host = normalizeHost(first.hostname || first.host) || "localhost";
       const protocol = first.protocol || "http:";
       const port = first.port ? `:${first.port}` : "";
-      const path = first.path || "/";
-      return { url: `${protocol}//${host}${port}${path}`, host, method: first.method || "GET" };
+      const path7 = first.path || "/";
+      return { url: `${protocol}//${host}${port}${path7}`, host, method: first.method || "GET" };
     }
   } catch {
   }
@@ -1317,6 +2657,61 @@ function normalizeHost(raw) {
   if ((host.match(/:/g) || []).length > 1) return host;
   return host.split(":")[0];
 }
+function screenResolved(addresses, target, block) {
+  for (const a of addresses || []) {
+    const ip = a && typeof a === "object" ? a.address : a;
+    if (ip && block(target.url, ip, target.method)) return ip;
+  }
+  return null;
+}
+function withScreeningLookup(args, target, block, lookup) {
+  const screeningLookup = (hostname, options, callback) => {
+    let opts = options;
+    let cb = callback;
+    if (typeof opts === "function") {
+      cb = opts;
+      opts = {};
+    }
+    if (!opts || typeof opts !== "object") opts = {};
+    try {
+      lookup(hostname, { ...opts, all: true }, (err, addresses) => {
+        if (err) return cb(err);
+        const list = Array.isArray(addresses) ? addresses : [];
+        const blocked = screenResolved(list, target, block);
+        if (blocked) {
+          return cb(new Error(`Patchstack blocked an outbound request to a disallowed address: ${target.host} resolved to ${blocked}`));
+        }
+        if (opts.all) return cb(null, list);
+        const first = list[0];
+        if (!first) return cb(new Error(`Patchstack: could not resolve ${hostname}`));
+        return cb(null, first.address, first.family);
+      });
+    } catch {
+      try {
+        lookup(hostname, opts, cb);
+      } catch {
+        cb(new Error(`Patchstack: lookup failed for ${hostname}`));
+      }
+    }
+  };
+  return injectLookupOption(args, screeningLookup);
+}
+function injectLookupOption(args, lookup) {
+  const first = args[0];
+  if (first && typeof first === "object" && !(first instanceof URL)) {
+    return [{ ...first, lookup }, ...args.slice(1)];
+  }
+  const rest = args.slice(1);
+  const optIdx = rest.findIndex((a) => a && typeof a === "object" && !(a instanceof URL));
+  if (optIdx !== -1) {
+    const next = [...rest];
+    next[optIdx] = { ...rest[optIdx], lookup };
+    return [first, ...next];
+  }
+  const cbIdx = rest.findIndex((a) => typeof a === "function");
+  if (cbIdx === -1) return [first, { lookup }, ...rest];
+  return [first, ...rest.slice(0, cbIdx), { lookup }, ...rest.slice(cbIdx)];
+}
 
 // src/protect/defaults.js
 var DEFAULT_RESPONSE_RULES = [
@@ -1470,20 +2865,200 @@ function renderBlockPage({ url = "", code = "patchstack" } = {}) {
         navigator.clipboard.writeText(copyText.value);
     }
 
-    function hover(element) {
-        element.setAttribute('src', 'data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkiIGhlaWdodD0iMjMiIHZpZXdCb3g9IjAgMCAxOSAyMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0IDAuMDIzNDM3NUgwVjE2LjAyMzRIMlYyLjAyMzQ0SDE0VjAuMDIzNDM3NVpNMTkgNC4wMjM0NEg0VjIyLjAyMzRIMTlWNC4wMjM0NFpNMTcgMjAuMDIzNEg2VjYuMDIzNDRIMTdWMjAuMDIzNFoiIGZpbGw9IiNBRkU2MTQiLz4KPC9zdmc+Cg==');
+    function hover(element) {
+        element.setAttribute('src', 'data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkiIGhlaWdodD0iMjMiIHZpZXdCb3g9IjAgMCAxOSAyMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0IDAuMDIzNDM3NUgwVjE2LjAyMzRIMlYyLjAyMzQ0SDE0VjAuMDIzNDM3NVpNMTkgNC4wMjM0NEg0VjIyLjAyMzRIMTlWNC4wMjM0NFpNMTcgMjAuMDIzNEg2VjYuMDIzNDRIMTdWMjAuMDIzNFoiIGZpbGw9IiNBRkU2MTQiLz4KPC9zdmc+Cg==');
+    }
+
+    function unhover(element) {
+        element.setAttribute('src', 'data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkiIGhlaWdodD0iMjMiIHZpZXdCb3g9IjAgMCAxOSAyMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0IDAuMDIzNDM3NUgwVjE2LjAyMzRIMlYyLjAyMzQ0SDE0VjAuMDIzNDM3NVpNMTkgNC4wMjM0NEg0VjIyLjAyMzRIMTlWNC4wMjM0NFpNMTcgMjAuMDIzNEg2VjYuMDIzNDRIMTdWMjAuMDIzNFoiIGZpbGw9IndoaXRlIi8+Cjwvc3ZnPgo=');
+    }
+</script>
+</html>`;
+}
+
+// src/protect/rules/store.js
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+function makeStore(options = {}) {
+  let mem = null;
+  const durable = durableTier(options);
+  return {
+    async read() {
+      if (mem) return mem;
+      const env = await durable.read();
+      if (env) mem = env;
+      return env;
+    },
+    async write(env) {
+      if (env) mem = env;
+      await durable.write(env);
+    }
+  };
+}
+function durableTier(options) {
+  const adapter = options.ruleCache;
+  if (adapter && typeof adapter.read === "function" && typeof adapter.write === "function") {
+    return {
+      read: async () => {
+        try {
+          return toEnvelope(await adapter.read());
+        } catch {
+          return null;
+        }
+      },
+      write: async (env) => {
+        try {
+          await adapter.write(env);
+        } catch {
+        }
+      }
+    };
+  }
+  const dir = options.cacheDir;
+  return {
+    read: async () => cacheRead(dir),
+    write: async (env) => cacheWrite(dir, env)
+  };
+}
+function cachePath(dir) {
+  return (0, import_node_path.join)(dir, "patchstack-rules.json");
+}
+function cacheWrite(dir, env) {
+  if (!dir) return;
+  try {
+    (0, import_node_fs.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs.writeFileSync)(cachePath(dir), JSON.stringify(env));
+  } catch {
+  }
+}
+function cacheRead(dir) {
+  if (!dir) return null;
+  try {
+    return toEnvelope(JSON.parse((0, import_node_fs.readFileSync)(cachePath(dir), "utf8")));
+  } catch {
+    return null;
+  }
+}
+function toEnvelope(value) {
+  if (!value || typeof value !== "object") return null;
+  if (value.bundle && typeof value.bundle === "object") {
+    return { bundle: value.bundle, etag: value.etag ?? null };
+  }
+  if (Array.isArray(value.firewall) || Array.isArray(value.whitelists)) {
+    return { bundle: value, etag: null };
+  }
+  return null;
+}
+
+// src/protect/rules/source.js
+async function resolveRules(options, store) {
+  if (options.siteUuid) {
+    const prior = await store.read();
+    const client = new PulseRuleClient({ siteUuid: options.siteUuid, baseUrl: options.pulseRulesUrl, etag: prior?.etag });
+    const res = await client.getRules();
+    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle);
+    if (res.success && !res.notModified) {
+      const bundle = normalizeBundle(res);
+      await store.write({ bundle, etag: res.etag ?? null });
+      return bundle;
     }
-
-    function unhover(element) {
-        element.setAttribute('src', 'data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkiIGhlaWdodD0iMjMiIHZpZXdCb3g9IjAgMCAxOSAyMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0IDAuMDIzNDM3NUgwVjE2LjAyMzRIMlYyLjAyMzQ0SDE0VjAuMDIzNDM3NVpNMTkgNC4wMjM0NEg0VjIyLjAyMzRIMTlWNC4wMjM0NFpNMTcgMjAuMDIzNEg2VjYuMDIzNDRIMTdWMjAuMDIzNFoiIGZpbGw9IndoaXRlIi8+Cjwvc3ZnPgo=');
+    if (prior?.bundle) {
+      options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`));
+      return normalizeBundle(prior.bundle);
     }
-</script>
-</html>`;
+    if (options.rules) {
+      options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using bundled fallback`));
+      return normalizeBundle(options.rules);
+    }
+    options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`));
+    return emptyBundle();
+  }
+  if (options.token) {
+    const prior = await store.read();
+    const client = new PatchstackRuleClient({ token: options.token, baseUrl: options.baseUrl, etag: prior?.etag });
+    const res = await client.getRules();
+    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle);
+    if (res.success && !res.notModified) {
+      const bundle = normalizeBundle(res);
+      await store.write({ bundle, etag: res.etag ?? null });
+      return bundle;
+    }
+    if (prior?.bundle) {
+      options.onError?.(new Error(`rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`));
+      return normalizeBundle(prior.bundle);
+    }
+    options.onError?.(new Error(`rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`));
+    return emptyBundle();
+  }
+  if (options.rules) {
+    return normalizeBundle(options.rules);
+  }
+  return emptyBundle();
+}
+function normalizeBundle(b) {
+  return {
+    firewall: Array.isArray(b.firewall) ? b.firewall : [],
+    whitelists: Array.isArray(b.whitelists) ? b.whitelists : [],
+    whitelist_keys: b.whitelist_keys ?? {}
+  };
+}
+function emptyBundle() {
+  return { firewall: [], whitelists: [], whitelist_keys: {} };
 }
 
-// src/protect/runtime.js
-var import_node_fs = require("fs");
-var import_node_path = require("path");
+// src/protect/rules/refresh.js
+var JITTER_FRACTION3 = 0.1;
+var MAX_BACKOFF_MULTIPLIER = 8;
+function startRefresh(tick, { refreshMs, onError } = {}) {
+  let stopped = false;
+  let failures = 0;
+  let timer = null;
+  const schedule = () => {
+    if (stopped) return;
+    const backoff = Math.min(2 ** failures, MAX_BACKOFF_MULTIPLIER);
+    const jitter = 1 - Math.random() * JITTER_FRACTION3;
+    const delay = refreshMs * backoff * jitter;
+    timer = setTimeout(run, delay);
+    timer?.unref?.();
+  };
+  const run = async () => {
+    if (stopped) return;
+    try {
+      await tick();
+      failures = 0;
+    } catch (err) {
+      failures++;
+      onError?.(err);
+    }
+    schedule();
+  };
+  schedule();
+  return {
+    stop() {
+      stopped = true;
+      if (timer) clearTimeout(timer);
+    }
+  };
+}
+function makeRefreshHandler(tick, secret) {
+  return async (request) => {
+    if (!secret) return new Response("not found", { status: 404 });
+    let provided = null;
+    try {
+      provided = request?.headers?.get?.("x-patchstack-refresh") ?? new URL(request.url).searchParams.get("token");
+    } catch {
+      provided = null;
+    }
+    if (provided !== secret) return new Response("forbidden", { status: 403 });
+    let refreshed = true;
+    try {
+      await tick();
+    } catch {
+      refreshed = false;
+    }
+    return new Response(JSON.stringify({ refreshed }), { status: 200, headers: { "content-type": "application/json" } });
+  };
+}
 
 // src/protect/supabase-guard.js
 var GUARD_PATH = "/_patchstack/guard";
@@ -1559,23 +3134,35 @@ async function createProtection(options = {}) {
   const mode = options.mode === "block" ? "block" : "dry-run";
   const onError = options.onError;
   const onDetect = options.onDetect ?? defaultOnDetect;
-  const bundle = await resolveRules(options);
-  const incoming = bundle.firewall ?? [];
-  const requestRules = byPhase(incoming, "request");
-  const responseRules = [...options.responseRules ?? DEFAULT_RESPONSE_RULES, ...byPhase(incoming, "response")];
-  const egressRules = [...options.egressRules ?? DEFAULT_EGRESS_RULES, ...byPhase(incoming, "egress")];
-  const engine = new RuleEngine({
-    firewall: requestRules,
-    whitelists: bundle.whitelists,
-    whitelist_keys: bundle.whitelist_keys,
-    onError
-  });
-  const responseRuleSet = responseRules.map((rule) => ({
-    rule,
-    engine: new RuleEngine({ firewall: [rule], onError }),
-    redactors: rule.action === "redact" ? extractRedactors(rule) : null
-  }));
-  const egressEngine = new RuleEngine({ firewall: egressRules, onError });
+  const store = makeStore(options);
+  const bundle = await resolveRules(options, store);
+  let requestRules;
+  let responseRules;
+  let egressRules;
+  let screenCap;
+  let engine;
+  let responseRuleSet;
+  let egressEngine;
+  const applyBundle = (delivered) => {
+    const incoming = delivered.firewall ?? [];
+    requestRules = byPhase(incoming, "request");
+    responseRules = [...options.responseRules ?? DEFAULT_RESPONSE_RULES, ...byPhase(incoming, "response")];
+    screenCap = responseScreenCap(responseRules);
+    egressRules = [...options.egressRules ?? DEFAULT_EGRESS_RULES, ...byPhase(incoming, "egress")];
+    engine = new RuleEngine({
+      firewall: requestRules,
+      whitelists: delivered.whitelists,
+      whitelist_keys: delivered.whitelist_keys,
+      onError
+    });
+    responseRuleSet = responseRules.map((rule) => ({
+      rule,
+      engine: new RuleEngine({ firewall: [rule], onError }),
+      redactors: rule.action === "redact" || rule.action === "encode" ? extractRedactors(rule) : null
+    }));
+    egressEngine = new RuleEngine({ firewall: egressRules, onError });
+  };
+  applyBundle(bundle);
   const maskFn = typeof options.maskWith === "function" ? options.maskWith : () => typeof options.maskWith === "string" ? options.maskWith : "[REDACTED]";
   const decide = (phase, result, block, allow2) => {
     if (!result || !result.blocked) return allow2();
@@ -1609,20 +3196,26 @@ async function createProtection(options = {}) {
     const headers = { ...meta.headers || {} };
     for (const { rule, redactors } of redactions) {
       const mask = maskFn(rule.category);
-      body = applyRedactors(body, redactors, mask);
+      const transform = rule.action === "encode" ? htmlEscape : null;
+      const pathRedactors = redactors.filter((r) => r.jsonPath);
+      const spanRedactors = redactors.filter((r) => !r.jsonPath);
+      if (pathRedactors.length) body = applyPathRedactors(body, pathRedactors, mask, screenCap, transform);
+      if (!spanRedactors.length) continue;
+      body = applyRedactors(body, spanRedactors, mask, transform);
+      if (transform) continue;
       for (const name of Object.keys(headers)) {
         const value = headers[name];
         if (typeof value === "string") {
-          headers[name] = applyRedactors(value, redactors, mask);
+          headers[name] = applyRedactors(value, spanRedactors, mask);
         } else if (Array.isArray(value)) {
-          headers[name] = value.map((item) => typeof item === "string" ? applyRedactors(item, redactors, mask) : item);
+          headers[name] = value.map((item) => typeof item === "string" ? applyRedactors(item, spanRedactors, mask) : item);
         }
       }
     }
     return { verdict: "redact", body, headers };
   };
   const screenResp = async (response) => {
-    const text = await readTextResponse(response);
+    const text = await readTextResponse(response, screenCap);
     if (text == null) return response;
     const r = screenText(text, { status: response.status, headers: headerObject(response.headers) });
     if (r.verdict === "block") return leakResponse();
@@ -1635,12 +3228,15 @@ async function createProtection(options = {}) {
     const chunks = [];
     let size = 0;
     let overflow = false;
-    const MAX = 512 * 1024;
+    const MAX = screenCap;
     const collect = (chunk, enc) => {
       if (chunk == null) return;
       const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, typeof enc === "string" ? enc : "utf8");
       size += buf.length;
       if (size > MAX) {
+        for (const c of chunks) origWrite(c);
+        chunks.length = 0;
+        origWrite(buf);
         overflow = true;
         return;
       }
@@ -1667,6 +3263,7 @@ async function createProtection(options = {}) {
         return origEnd(cb);
       }
       collect(chunk, enc);
+      if (overflow) return origEnd(cb);
       const text = Buffer.concat(chunks).toString("utf8");
       let ct = res.getHeader ? res.getHeader("content-type") : void 0;
       if (Array.isArray(ct)) ct = ct[0];
@@ -1698,6 +3295,7 @@ async function createProtection(options = {}) {
         if (r.headers && res.setHeader) {
           const current = res.getHeaders ? res.getHeaders() : {};
           for (const [name, value] of Object.entries(r.headers)) {
+            if (name.toLowerCase() === "content-length") continue;
             if (Array.isArray(value)) {
               try {
                 res.setHeader(name, value);
@@ -1733,7 +3331,9 @@ async function createProtection(options = {}) {
   };
   const protection = {
     mode,
-    rules: { request: requestRules, response: responseRules, egress: egressRules },
+    get rules() {
+      return { request: requestRules, response: responseRules, egress: egressRules };
+    },
     // Screen a fetch Response through the response-phase rules (redact/block). Used by
     // .fetch(), and by the Supabase guard on its forwarded upstream response.
     screenResponse: (response) => screenResp(response),
@@ -1844,27 +3444,106 @@ async function createProtection(options = {}) {
     }
   };
   if (options.egress) {
-    protection.uninstallEgress = await installEgressGuard({ shouldBlock: egressShouldBlock, onBlock: options.onEgressBlock });
+    protection.uninstallEgress = await installEgressGuard({
+      shouldBlock: egressShouldBlock,
+      onBlock: options.onEgressBlock,
+      dnsScreen: options.screenDns !== false,
+      allowHosts: options.allowHosts
+    });
+  }
+  const cwd = options.cwd ?? (typeof process !== "undefined" ? process.cwd() : void 0);
+  const live = Boolean(options.siteUuid || options.token);
+  const refreshSecret = options.refreshSecret ?? (typeof process !== "undefined" ? process.env.PATCHSTACK_REFRESH_SECRET : void 0);
+  const refreshable = live && (options.refreshMs > 0 || Boolean(refreshSecret));
+  let reporter = null;
+  if (refreshable && options.siteUuid && options.reportManifest !== false && cwd) {
+    try {
+      ({ reportManifest: reporter } = await Promise.resolve().then(() => (init_refresh_manifest(), refresh_manifest_exports)));
+    } catch (err) {
+      onError?.(err);
+    }
+  }
+  const runRefreshTick = async () => {
+    if (reporter) {
+      try {
+        await reporter(cwd);
+      } catch (err) {
+        onError?.(err);
+      }
+    }
+    applyBundle(await resolveRules(options, store));
+  };
+  if (live) {
+    protection.refresh = () => runRefreshTick();
+    protection.refreshHandler = () => makeRefreshHandler(runRefreshTick, refreshSecret);
+  }
+  if (options.refreshMs > 0 && live) {
+    const loop = startRefresh(runRefreshTick, { refreshMs: options.refreshMs, onError });
+    protection.stopRefresh = loop.stop;
   }
   return protection;
 }
 function byPhase(rules, phase) {
   return (rules ?? []).filter((r) => (r.phase ?? "request") === phase);
 }
-async function readTextResponse(response) {
+async function readTextResponse(response, cap = DEFAULT_SCREEN_CAP) {
   if (!response || typeof response.clone !== "function") return null;
   const ct = (response.headers?.get?.("content-type") || "").toLowerCase();
   const isText = ct === "" || /(json|text|xml|html|javascript|csv|yaml|x-www-form-urlencoded)/.test(ct);
   if (!isText) return null;
   const len = Number(response.headers?.get?.("content-length") || 0);
-  if (len && len > 512 * 1024) return null;
+  if (len && len > cap) return null;
+  let clone;
+  try {
+    clone = response.clone();
+  } catch {
+    return null;
+  }
+  const body = clone.body;
+  if (body && typeof body.getReader === "function") {
+    const reader = body.getReader();
+    const chunks = [];
+    let size = 0;
+    let over = false;
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        if (!value) continue;
+        size += value.byteLength;
+        if (over) continue;
+        if (size > cap) {
+          over = true;
+          continue;
+        }
+        chunks.push(value);
+      }
+    } catch {
+      return null;
+    }
+    if (over) return null;
+    try {
+      return new TextDecoder().decode(concatBytes(chunks, size));
+    } catch {
+      return null;
+    }
+  }
   try {
-    const text = await response.clone().text();
-    return text.length > 512 * 1024 ? null : text;
+    const text = await clone.text();
+    return text.length > cap ? null : text;
   } catch {
     return null;
   }
 }
+function concatBytes(chunks, total) {
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    out.set(c, offset);
+    offset += c.byteLength;
+  }
+  return out;
+}
 function headerObject(headers) {
   const out = {};
   headers?.forEach?.((v, k) => {
@@ -1876,36 +3555,143 @@ function headerObject(headers) {
 }
 function extractRedactors(rule) {
   const out = [];
-  const walk = (conds) => {
+  const walk2 = (conds) => {
     for (const c of conds ?? []) {
-      if (Array.isArray(c.rules)) walk(c.rules);
+      if (Array.isArray(c.rules)) walk2(c.rules);
       const m = c.match;
       if (!m) continue;
       if (m.type === "regex" && typeof m.value === "string") {
-        const parsed = m.value.match(/^\/(.+)\/([a-z]*)$/is);
-        if (parsed) {
-          const flags = parsed[2].includes("g") ? parsed[2] : parsed[2] + "g";
+        const safe = safeRegExp(m.value);
+        if (safe) {
+          const flags = safe.flags.includes("g") ? safe.flags : safe.flags + "g";
           try {
-            out.push({ re: new RegExp(parsed[1], flags) });
+            out.push({ re: new RegExp(safe.source, flags) });
           } catch {
           }
         }
       } else if ((m.type === "contains" || m.type === "stripos") && m.value != null) {
         out.push({ literal: String(m.value) });
+      } else if (m.type === "array_key_value" && m.match && isBodyParam(c.parameter)) {
+        const keys = Array.isArray(m.key) ? m.key : [m.key];
+        for (const key of keys) {
+          out.push({ jsonPath: String(key).split("."), condition: m.match });
+        }
       }
     }
   };
-  walk(rule.rule_v2);
+  walk2(rule.rule_v2);
   return out;
 }
-function applyRedactors(body, redactors, mask) {
+function htmlEscape(str) {
+  return String(str).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+function applyRedactors(body, redactors, mask, transform) {
   let out = body;
   for (const r of redactors) {
-    if (r.re) out = out.replace(r.re, mask);
-    else if (r.literal) out = out.split(r.literal).join(mask);
+    if (r.re) out = out.replace(r.re, transform ? (m) => transform(m) : mask);
+    else if (r.literal) out = out.split(r.literal).join(transform ? transform(r.literal) : mask);
+  }
+  return out;
+}
+function isBodyParam(parameter) {
+  return parameter == null || parameter === "response.body" || parameter === "raw" || parameter === "response.raw";
+}
+function conditionPredicate(condition) {
+  if (!condition || !condition.type) return () => true;
+  return (value) => {
+    try {
+      return matchValue(condition.type, value, condition.value, condition);
+    } catch {
+      return false;
+    }
+  };
+}
+var DEFAULT_SCREEN_CAP = 512 * 1024;
+function responseScreenCap(rules) {
+  let cap = DEFAULT_SCREEN_CAP;
+  for (const r of rules ?? []) {
+    if (r && r.bypass_limit === true) return Infinity;
+    const n = Number(r && r.max_bytes);
+    if (Number.isFinite(n) && n > cap) cap = n;
+  }
+  return cap;
+}
+function applyPathRedactors(text, pathRedactors, mask, cap, transform) {
+  if (!pathRedactors.length || typeof text !== "string" || text.length > cap) return text;
+  const head = text.trimStart()[0];
+  if (head !== "{" && head !== "[") return text;
+  const preserved = preserveBigInts(text);
+  let obj;
+  try {
+    obj = JSON.parse(preserved);
+  } catch {
+    return text;
+  }
+  let changed = false;
+  for (const r of pathRedactors) {
+    const pred = conditionPredicate(r.condition);
+    walkLeaves(obj, r.jsonPath, (loc) => {
+      try {
+        if (pred(loc.value)) {
+          loc.parent[loc.key] = transform ? transform(String(loc.value)) : mask;
+          changed = true;
+        }
+      } catch {
+      }
+    });
+  }
+  return changed ? restoreBigInts(JSON.stringify(obj)) : text;
+}
+var BIGINT_OPEN = "__PSBIGINT_9c2f__";
+var BIGINT_CLOSE = "__DNEGIB__";
+function preserveBigInts(text) {
+  let out = "";
+  let inStr = false;
+  for (let i = 0; i < text.length; ) {
+    const ch = text[i];
+    if (inStr) {
+      out += ch;
+      if (ch === "\\") {
+        out += text[i + 1] ?? "";
+        i += 2;
+        continue;
+      }
+      if (ch === '"') inStr = false;
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      inStr = true;
+      out += ch;
+      i++;
+      continue;
+    }
+    if (ch === "-" || ch >= "0" && ch <= "9") {
+      let j = ch === "-" ? i + 1 : i;
+      let digits = 0;
+      while (j < text.length && text[j] >= "0" && text[j] <= "9") {
+        digits++;
+        j++;
+      }
+      const next = text[j];
+      const isIntToken = digits > 0 && next !== "." && next !== "e" && next !== "E";
+      if (isIntToken && digits >= 16) {
+        out += `"${BIGINT_OPEN}${text.slice(i, j)}${BIGINT_CLOSE}"`;
+      } else {
+        out += text.slice(i, j || i + 1);
+      }
+      i = j > i ? j : i + 1;
+      continue;
+    }
+    out += ch;
+    i++;
   }
   return out;
 }
+function restoreBigInts(text) {
+  if (!text.includes(BIGINT_OPEN)) return text;
+  return text.replace(new RegExp(`"${BIGINT_OPEN}(-?\\d+)${BIGINT_CLOSE}"`, "g"), "$1");
+}
 function rebuildResponse(response, body, redactedHeaders) {
   const headers = new Headers(response.headers);
   headers.delete("content-length");
@@ -1935,115 +3721,6 @@ function leakResponse() {
     headers: { "content-type": "application/json" }
   });
 }
-async function resolveRules(options) {
-  const cache = makeCache(options);
-  if (options.siteUuid) {
-    const prior = await cache.read();
-    const client = new PulseRuleClient({ siteUuid: options.siteUuid, baseUrl: options.pulseRulesUrl, etag: prior?.etag });
-    const res = await client.getRules();
-    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle);
-    if (res.success && !res.notModified) {
-      const bundle = normalizeBundle(res);
-      await cache.write({ bundle, etag: res.etag ?? null });
-      return bundle;
-    }
-    if (prior?.bundle) {
-      options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`));
-      return normalizeBundle(prior.bundle);
-    }
-    if (options.rules) {
-      options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using bundled fallback`));
-      return normalizeBundle(options.rules);
-    }
-    options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`));
-    return emptyBundle();
-  }
-  if (options.token) {
-    const prior = await cache.read();
-    const client = new PatchstackRuleClient({ token: options.token, baseUrl: options.baseUrl, etag: prior?.etag });
-    const res = await client.getRules();
-    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle);
-    if (res.success && !res.notModified) {
-      const bundle = normalizeBundle(res);
-      await cache.write({ bundle, etag: res.etag ?? null });
-      return bundle;
-    }
-    if (prior?.bundle) {
-      options.onError?.(new Error(`rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`));
-      return normalizeBundle(prior.bundle);
-    }
-    options.onError?.(new Error(`rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`));
-    return emptyBundle();
-  }
-  if (options.rules) {
-    return normalizeBundle(options.rules);
-  }
-  return emptyBundle();
-}
-function normalizeBundle(b) {
-  return {
-    firewall: Array.isArray(b.firewall) ? b.firewall : [],
-    whitelists: Array.isArray(b.whitelists) ? b.whitelists : [],
-    whitelist_keys: b.whitelist_keys ?? {}
-  };
-}
-function emptyBundle() {
-  return { firewall: [], whitelists: [], whitelist_keys: {} };
-}
-function makeCache(options) {
-  const adapter = options.ruleCache;
-  if (adapter && typeof adapter.read === "function" && typeof adapter.write === "function") {
-    return {
-      read: async () => {
-        try {
-          return toEnvelope(await adapter.read());
-        } catch {
-          return null;
-        }
-      },
-      write: async (env) => {
-        try {
-          await adapter.write(env);
-        } catch {
-        }
-      }
-    };
-  }
-  const dir = options.cacheDir;
-  return {
-    read: async () => cacheRead(dir),
-    write: async (env) => cacheWrite(dir, env)
-  };
-}
-function cachePath(dir) {
-  return (0, import_node_path.join)(dir, "patchstack-rules.json");
-}
-function cacheWrite(dir, env) {
-  if (!dir) return;
-  try {
-    (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-    (0, import_node_fs.writeFileSync)(cachePath(dir), JSON.stringify(env));
-  } catch {
-  }
-}
-function cacheRead(dir) {
-  if (!dir) return null;
-  try {
-    return toEnvelope(JSON.parse((0, import_node_fs.readFileSync)(cachePath(dir), "utf8")));
-  } catch {
-    return null;
-  }
-}
-function toEnvelope(value) {
-  if (!value || typeof value !== "object") return null;
-  if (value.bundle && typeof value.bundle === "object") {
-    return { bundle: value.bundle, etag: value.etag ?? null };
-  }
-  if (Array.isArray(value.firewall) || Array.isArray(value.whitelists)) {
-    return { bundle: value, etag: null };
-  }
-  return null;
-}
 var BLOCK_MESSAGE = "This request has been blocked by Patchstack.";
 function blockBody(result) {
   return { error: BLOCK_MESSAGE, message: BLOCK_MESSAGE, rule: result?.rule?.id };