@patchstack/connect 0.3.20 → 0.3.22

package/dist/protect.cjs

@@ -164,7 +164,7 @@ async function resolveConfig(options) {
   };
 }
 async function readConfigFile(cwd) {
-  const target = import_node_path.default.join(cwd, CONFIG_FILENAME);
+  const target = import_node_path2.default.join(cwd, CONFIG_FILENAME);
   let raw;
   try {
     raw = await (0, import_promises.readFile)(target, "utf8");
@@ -215,12 +215,12 @@ function isUuid(value) {
 function isEnvironment(value) {
   return value === "production" || value === "sandbox";
 }
-var import_promises, import_node_path, CONFIG_FILENAME, DEFAULT_ENVIRONMENT;
+var import_promises, import_node_path2, CONFIG_FILENAME, DEFAULT_ENVIRONMENT;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     import_promises = require("fs/promises");
-    import_node_path = __toESM(require("path"), 1);
+    import_node_path2 = __toESM(require("path"), 1);
     init_types();
     init_client();
     CONFIG_FILENAME = ".patchstackrc.json";
@@ -232,7 +232,7 @@ var init_config = __esm({
 async function readDeclaredDependencyNames(cwd) {
   let raw;
   try {
-    raw = await (0, import_promises2.readFile)(import_node_path2.default.join(cwd, "package.json"), "utf8");
+    raw = await (0, import_promises2.readFile)(import_node_path3.default.join(cwd, "package.json"), "utf8");
   } catch {
     return [];
   }
@@ -264,12 +264,12 @@ function missingDependencies(declared, packages) {
   const present = new Set(packages.map((entry) => entry.name));
   return declared.filter((name) => !present.has(name));
 }
-var import_promises2, import_node_path2;
+var import_promises2, import_node_path3;
 var init_consistency = __esm({
   "src/parsers/consistency.ts"() {
     "use strict";
     import_promises2 = require("fs/promises");
-    import_node_path2 = __toESM(require("path"), 1);
+    import_node_path3 = __toESM(require("path"), 1);
   }
 });
 
@@ -335,7 +335,7 @@ function extractFromV1(deps, acc = [], depth = 0) {
   return acc;
 }
 function extractNameFromPath(pkgPath) {
-  const segments = pkgPath.split("node_modules" + import_node_path3.default.sep === pkgPath ? import_node_path3.default.sep : "/");
+  const segments = pkgPath.split("node_modules" + import_node_path4.default.sep === pkgPath ? import_node_path4.default.sep : "/");
   const parts = pkgPath.split("/");
   const nmIndex = parts.lastIndexOf("node_modules");
   if (nmIndex === -1 || nmIndex >= parts.length - 1) {
@@ -356,19 +356,19 @@ function isDirectV2(pkgPath) {
   const nmCount = parts.filter((p) => p === "node_modules").length;
   return nmCount === 1;
 }
-var import_promises3, import_node_path3;
+var import_promises3, import_node_path4;
 var init_npm = __esm({
   "src/parsers/npm.ts"() {
     "use strict";
     import_promises3 = require("fs/promises");
-    import_node_path3 = __toESM(require("path"), 1);
+    import_node_path4 = __toESM(require("path"), 1);
     init_types();
   }
 });
 
 // src/parsers/node_modules.ts
 async function walkNodeModules(cwd) {
-  const root = import_node_path4.default.join(cwd, "node_modules");
+  const root = import_node_path5.default.join(cwd, "node_modules");
   try {
     const info = await (0, import_promises4.stat)(root);
     if (!info.isDirectory()) {
@@ -402,7 +402,7 @@ async function walk(dir, acc, depth) {
     if (name.startsWith(".")) {
       continue;
     }
-    const fullPath = import_node_path4.default.join(dir, name);
+    const fullPath = import_node_path5.default.join(dir, name);
     if (!await isPlainDirectory(fullPath)) {
       continue;
     }
@@ -417,7 +417,7 @@ async function walk(dir, acc, depth) {
         if (sub.startsWith(".")) {
           continue;
         }
-        const scopedDir = import_node_path4.default.join(fullPath, sub);
+        const scopedDir = import_node_path5.default.join(fullPath, sub);
         if (!await isPlainDirectory(scopedDir)) {
           continue;
         }
@@ -433,7 +433,7 @@ async function walk(dir, acc, depth) {
 async function readPackage(pkgDir, depth, acc) {
   let raw;
   try {
-    raw = await (0, import_promises4.readFile)(import_node_path4.default.join(pkgDir, "package.json"), "utf8");
+    raw = await (0, import_promises4.readFile)(import_node_path5.default.join(pkgDir, "package.json"), "utf8");
   } catch {
     return;
   }
@@ -456,7 +456,7 @@ async function readPackage(pkgDir, depth, acc) {
   });
 }
 async function walkNested(pkgDir, acc, depth) {
-  const nested = import_node_path4.default.join(pkgDir, "node_modules");
+  const nested = import_node_path5.default.join(pkgDir, "node_modules");
   if (!await isPlainDirectory(nested)) {
     return;
   }
@@ -470,12 +470,12 @@ async function isPlainDirectory(dir) {
     return false;
   }
 }
-var import_promises4, import_node_path4;
+var import_promises4, import_node_path5;
 var init_node_modules = __esm({
   "src/parsers/node_modules.ts"() {
     "use strict";
     import_promises4 = require("fs/promises");
-    import_node_path4 = __toESM(require("path"), 1);
+    import_node_path5 = __toESM(require("path"), 1);
     init_types();
   }
 });
@@ -758,7 +758,7 @@ async function parseYarnLockfile(lockfilePath) {
       "LOCKFILE_PARSE_ERROR"
     );
   }
-  const directNames = await readDirectDepNames(import_node_path5.default.dirname(lockfilePath));
+  const directNames = await readDirectDepNames(import_node_path6.default.dirname(lockfilePath));
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   for (const block of blocks) {
@@ -902,7 +902,7 @@ async function readDirectDepNames(cwd) {
   const names = /* @__PURE__ */ new Set();
   let raw;
   try {
-    raw = await (0, import_promises6.readFile)(import_node_path5.default.join(cwd, "package.json"), "utf8");
+    raw = await (0, import_promises6.readFile)(import_node_path6.default.join(cwd, "package.json"), "utf8");
   } catch {
     return names;
   }
@@ -927,12 +927,12 @@ async function readDirectDepNames(cwd) {
   }
   return names;
 }
-var import_promises6, import_node_path5;
+var import_promises6, import_node_path6;
 var init_yarn = __esm({
   "src/parsers/yarn.ts"() {
     "use strict";
     import_promises6 = require("fs/promises");
-    import_node_path5 = __toESM(require("path"), 1);
+    import_node_path6 = __toESM(require("path"), 1);
     init_types();
   }
 });
@@ -941,7 +941,7 @@ var init_yarn = __esm({
 async function detectLockfile(cwd) {
   const probed = await Promise.all(
     LOCKFILE_CANDIDATES.map(async (candidate) => {
-      const filePath = import_node_path6.default.join(cwd, candidate.filename);
+      const filePath = import_node_path7.default.join(cwd, candidate.filename);
       return { ...candidate, filePath, present: await exists(filePath) };
     })
   );
@@ -1019,7 +1019,7 @@ function staleWarning(source, missing) {
 async function presentLockfiles(cwd) {
   const probed = await Promise.all(
     LOCKFILE_CANDIDATES.map(async (candidate) => {
-      const filePath = import_node_path6.default.join(cwd, candidate.filename);
+      const filePath = import_node_path7.default.join(cwd, candidate.filename);
       return { ...candidate, filePath, present: await exists(filePath) };
     })
   );
@@ -1045,12 +1045,12 @@ async function exists(filePath) {
     return false;
   }
 }
-var import_promises7, import_node_path6, LOCKFILE_CANDIDATES;
+var import_promises7, import_node_path7, LOCKFILE_CANDIDATES;
 var init_parsers = __esm({
   "src/parsers/index.ts"() {
     "use strict";
     import_promises7 = require("fs/promises");
-    import_node_path6 = __toESM(require("path"), 1);
+    import_node_path7 = __toESM(require("path"), 1);
     init_types();
     init_consistency();
     init_npm();
@@ -2243,7 +2243,8 @@ var PulseRuleClient = class {
         etag: response.headers?.get?.("etag") ?? null,
         firewall: data.firewall,
         whitelists: Array.isArray(data.whitelists) ? data.whitelists : [],
-        whitelist_keys: data.whitelist_keys ?? {}
+        whitelist_keys: data.whitelist_keys ?? {},
+        ...enforcementField(data)
       };
       this.#cache = result;
       this.#etag = result.etag;
@@ -2269,6 +2270,11 @@ var PulseRuleClient = class {
     this.#etag = null;
   }
 };
+function enforcementField(data) {
+  if (!data || typeof data !== "object") return {};
+  const v = data.enforcement ?? data.mode;
+  return v === "block" || v === "dry-run" ? { enforcement: v } : {};
+}
 
 // src/protect/engine/fetch.js
 var MAX_BODY_BYTES = 1024 * 1024;
@@ -2876,9 +2882,191 @@ function renderBlockPage({ url = "", code = "patchstack" } = {}) {
 </html>`;
 }
 
-// src/protect/runtime.js
+// src/protect/rules/store.js
 var import_node_fs = require("fs");
-var import_node_path7 = require("path");
+var import_node_path = require("path");
+function makeStore(options = {}) {
+  let mem = null;
+  const durable = durableTier(options);
+  return {
+    async read() {
+      if (mem) return mem;
+      const env = await durable.read();
+      if (env) mem = env;
+      return env;
+    },
+    async write(env) {
+      if (env) mem = env;
+      await durable.write(env);
+    }
+  };
+}
+function durableTier(options) {
+  const adapter = options.ruleCache;
+  if (adapter && typeof adapter.read === "function" && typeof adapter.write === "function") {
+    return {
+      read: async () => {
+        try {
+          return toEnvelope(await adapter.read());
+        } catch {
+          return null;
+        }
+      },
+      write: async (env) => {
+        try {
+          await adapter.write(env);
+        } catch {
+        }
+      }
+    };
+  }
+  const dir = options.cacheDir;
+  return {
+    read: async () => cacheRead(dir),
+    write: async (env) => cacheWrite(dir, env)
+  };
+}
+function cachePath(dir) {
+  return (0, import_node_path.join)(dir, "patchstack-rules.json");
+}
+function cacheWrite(dir, env) {
+  if (!dir) return;
+  try {
+    (0, import_node_fs.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs.writeFileSync)(cachePath(dir), JSON.stringify(env));
+  } catch {
+  }
+}
+function cacheRead(dir) {
+  if (!dir) return null;
+  try {
+    return toEnvelope(JSON.parse((0, import_node_fs.readFileSync)(cachePath(dir), "utf8")));
+  } catch {
+    return null;
+  }
+}
+function toEnvelope(value) {
+  if (!value || typeof value !== "object") return null;
+  if (value.bundle && typeof value.bundle === "object") {
+    return { bundle: value.bundle, etag: value.etag ?? null };
+  }
+  if (Array.isArray(value.firewall) || Array.isArray(value.whitelists)) {
+    return { bundle: value, etag: null };
+  }
+  return null;
+}
+
+// src/protect/rules/source.js
+async function resolveRules(options, store) {
+  if (options.siteUuid) {
+    const prior = await store.read();
+    const client = new PulseRuleClient({ siteUuid: options.siteUuid, baseUrl: options.pulseRulesUrl, etag: prior?.etag });
+    const res = await client.getRules();
+    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle);
+    if (res.success && !res.notModified) {
+      const bundle = normalizeBundle(res);
+      await store.write({ bundle, etag: res.etag ?? null });
+      return bundle;
+    }
+    if (prior?.bundle) {
+      options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`));
+      return normalizeBundle(prior.bundle);
+    }
+    if (options.rules) {
+      options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using bundled fallback`));
+      return normalizeBundle(options.rules);
+    }
+    options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`));
+    return emptyBundle();
+  }
+  if (options.token) {
+    const prior = await store.read();
+    const client = new PatchstackRuleClient({ token: options.token, baseUrl: options.baseUrl, etag: prior?.etag });
+    const res = await client.getRules();
+    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle);
+    if (res.success && !res.notModified) {
+      const bundle = normalizeBundle(res);
+      await store.write({ bundle, etag: res.etag ?? null });
+      return bundle;
+    }
+    if (prior?.bundle) {
+      options.onError?.(new Error(`rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`));
+      return normalizeBundle(prior.bundle);
+    }
+    options.onError?.(new Error(`rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`));
+    return emptyBundle();
+  }
+  if (options.rules) {
+    return normalizeBundle(options.rules);
+  }
+  return emptyBundle();
+}
+function normalizeBundle(b) {
+  const enforcement = b?.enforcement ?? b?.mode;
+  return {
+    firewall: Array.isArray(b.firewall) ? b.firewall : [],
+    whitelists: Array.isArray(b.whitelists) ? b.whitelists : [],
+    whitelist_keys: b.whitelist_keys ?? {},
+    ...enforcement === "block" || enforcement === "dry-run" ? { enforcement } : {}
+  };
+}
+function emptyBundle() {
+  return { firewall: [], whitelists: [], whitelist_keys: {} };
+}
+
+// src/protect/rules/refresh.js
+var JITTER_FRACTION3 = 0.1;
+var MAX_BACKOFF_MULTIPLIER = 8;
+function startRefresh(tick, { refreshMs, onError } = {}) {
+  let stopped = false;
+  let failures = 0;
+  let timer = null;
+  const schedule = () => {
+    if (stopped) return;
+    const backoff = Math.min(2 ** failures, MAX_BACKOFF_MULTIPLIER);
+    const jitter = 1 - Math.random() * JITTER_FRACTION3;
+    const delay = refreshMs * backoff * jitter;
+    timer = setTimeout(run, delay);
+    timer?.unref?.();
+  };
+  const run = async () => {
+    if (stopped) return;
+    try {
+      await tick();
+      failures = 0;
+    } catch (err) {
+      failures++;
+      onError?.(err);
+    }
+    schedule();
+  };
+  schedule();
+  return {
+    stop() {
+      stopped = true;
+      if (timer) clearTimeout(timer);
+    }
+  };
+}
+function makeRefreshHandler(tick, secret) {
+  return async (request) => {
+    if (!secret) return new Response("not found", { status: 404 });
+    let provided = null;
+    try {
+      provided = request?.headers?.get?.("x-patchstack-refresh") ?? new URL(request.url).searchParams.get("token");
+    } catch {
+      provided = null;
+    }
+    if (provided !== secret) return new Response("forbidden", { status: 403 });
+    let refreshed = true;
+    try {
+      await tick();
+    } catch {
+      refreshed = false;
+    }
+    return new Response(JSON.stringify({ refreshed }), { status: 200, headers: { "content-type": "application/json" } });
+  };
+}
 
 // src/protect/supabase-guard.js
 var GUARD_PATH = "/_patchstack/guard";
@@ -2951,10 +3139,11 @@ function createServerFnGuard({ protection }) {
   };
 }
 async function createProtection(options = {}) {
-  const mode = options.mode === "block" ? "block" : "dry-run";
   const onError = options.onError;
   const onDetect = options.onDetect ?? defaultOnDetect;
-  const bundle = await resolveRules(options);
+  const store = makeStore(options);
+  const bundle = await resolveRules(options, store);
+  let mode = resolveMode(options, bundle);
   let requestRules;
   let responseRules;
   let egressRules;
@@ -3149,7 +3338,9 @@ async function createProtection(options = {}) {
     return mode === "block";
   };
   const protection = {
-    mode,
+    get mode() {
+      return mode;
+    },
     get rules() {
       return { request: requestRules, response: responseRules, egress: egressRules };
     },
@@ -3270,33 +3461,48 @@ async function createProtection(options = {}) {
       allowHosts: options.allowHosts
     });
   }
-  if (options.refreshMs > 0 && (options.siteUuid || options.token)) {
-    const cwd = options.cwd ?? (typeof process !== "undefined" ? process.cwd() : void 0);
-    let reportManifest2 = null;
-    if (options.siteUuid && options.reportManifest !== false && cwd) {
+  const cwd = options.cwd ?? (typeof process !== "undefined" ? process.cwd() : void 0);
+  const live = Boolean(options.siteUuid || options.token);
+  const refreshSecret = options.refreshSecret ?? (typeof process !== "undefined" ? process.env.PATCHSTACK_REFRESH_SECRET : void 0);
+  const refreshable = live && (options.refreshMs > 0 || Boolean(refreshSecret));
+  let reporter = null;
+  if (refreshable && options.siteUuid && options.reportManifest !== false && cwd) {
+    try {
+      ({ reportManifest: reporter } = await Promise.resolve().then(() => (init_refresh_manifest(), refresh_manifest_exports)));
+    } catch (err) {
+      onError?.(err);
+    }
+  }
+  const runRefreshTick = async () => {
+    if (reporter) {
       try {
-        ({ reportManifest: reportManifest2 } = await Promise.resolve().then(() => (init_refresh_manifest(), refresh_manifest_exports)));
+        await reporter(cwd);
       } catch (err) {
         onError?.(err);
       }
     }
-    const timer = setInterval(() => {
-      (async () => {
-        if (reportManifest2) {
-          try {
-            await reportManifest2(cwd);
-          } catch (err) {
-            onError?.(err);
-          }
-        }
-        applyBundle(await resolveRules(options));
-      })().catch((err) => onError?.(err));
-    }, options.refreshMs);
-    timer.unref?.();
-    protection.stopRefresh = () => clearInterval(timer);
+    const next = await resolveRules(options, store);
+    mode = resolveMode(options, next);
+    applyBundle(next);
+  };
+  if (live) {
+    protection.refresh = () => runRefreshTick();
+    protection.refreshHandler = () => makeRefreshHandler(runRefreshTick, refreshSecret);
+  }
+  if (options.refreshMs > 0 && live) {
+    const loop = startRefresh(runRefreshTick, { refreshMs: options.refreshMs, onError });
+    protection.stopRefresh = loop.stop;
   }
   return protection;
 }
+function resolveMode(options, bundle) {
+  const env = typeof process !== "undefined" ? process.env?.PATCHSTACK_MODE : void 0;
+  if (env === "block" || env === "dry-run") return env;
+  if (bundle?.enforcement === "block" || bundle?.enforcement === "dry-run") return bundle.enforcement;
+  if (options?.mode === "block") return "block";
+  if (options?.mode === "dry-run") return "dry-run";
+  return "dry-run";
+}
 function byPhase(rules, phase) {
   return (rules ?? []).filter((r) => (r.phase ?? "request") === phase);
 }
@@ -3535,115 +3741,6 @@ function leakResponse() {
     headers: { "content-type": "application/json" }
   });
 }
-async function resolveRules(options) {
-  const cache = makeCache(options);
-  if (options.siteUuid) {
-    const prior = await cache.read();
-    const client = new PulseRuleClient({ siteUuid: options.siteUuid, baseUrl: options.pulseRulesUrl, etag: prior?.etag });
-    const res = await client.getRules();
-    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle);
-    if (res.success && !res.notModified) {
-      const bundle = normalizeBundle(res);
-      await cache.write({ bundle, etag: res.etag ?? null });
-      return bundle;
-    }
-    if (prior?.bundle) {
-      options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`));
-      return normalizeBundle(prior.bundle);
-    }
-    if (options.rules) {
-      options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using bundled fallback`));
-      return normalizeBundle(options.rules);
-    }
-    options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`));
-    return emptyBundle();
-  }
-  if (options.token) {
-    const prior = await cache.read();
-    const client = new PatchstackRuleClient({ token: options.token, baseUrl: options.baseUrl, etag: prior?.etag });
-    const res = await client.getRules();
-    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle);
-    if (res.success && !res.notModified) {
-      const bundle = normalizeBundle(res);
-      await cache.write({ bundle, etag: res.etag ?? null });
-      return bundle;
-    }
-    if (prior?.bundle) {
-      options.onError?.(new Error(`rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`));
-      return normalizeBundle(prior.bundle);
-    }
-    options.onError?.(new Error(`rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`));
-    return emptyBundle();
-  }
-  if (options.rules) {
-    return normalizeBundle(options.rules);
-  }
-  return emptyBundle();
-}
-function normalizeBundle(b) {
-  return {
-    firewall: Array.isArray(b.firewall) ? b.firewall : [],
-    whitelists: Array.isArray(b.whitelists) ? b.whitelists : [],
-    whitelist_keys: b.whitelist_keys ?? {}
-  };
-}
-function emptyBundle() {
-  return { firewall: [], whitelists: [], whitelist_keys: {} };
-}
-function makeCache(options) {
-  const adapter = options.ruleCache;
-  if (adapter && typeof adapter.read === "function" && typeof adapter.write === "function") {
-    return {
-      read: async () => {
-        try {
-          return toEnvelope(await adapter.read());
-        } catch {
-          return null;
-        }
-      },
-      write: async (env) => {
-        try {
-          await adapter.write(env);
-        } catch {
-        }
-      }
-    };
-  }
-  const dir = options.cacheDir;
-  return {
-    read: async () => cacheRead(dir),
-    write: async (env) => cacheWrite(dir, env)
-  };
-}
-function cachePath(dir) {
-  return (0, import_node_path7.join)(dir, "patchstack-rules.json");
-}
-function cacheWrite(dir, env) {
-  if (!dir) return;
-  try {
-    (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-    (0, import_node_fs.writeFileSync)(cachePath(dir), JSON.stringify(env));
-  } catch {
-  }
-}
-function cacheRead(dir) {
-  if (!dir) return null;
-  try {
-    return toEnvelope(JSON.parse((0, import_node_fs.readFileSync)(cachePath(dir), "utf8")));
-  } catch {
-    return null;
-  }
-}
-function toEnvelope(value) {
-  if (!value || typeof value !== "object") return null;
-  if (value.bundle && typeof value.bundle === "object") {
-    return { bundle: value.bundle, etag: value.etag ?? null };
-  }
-  if (Array.isArray(value.firewall) || Array.isArray(value.whitelists)) {
-    return { bundle: value, etag: null };
-  }
-  return null;
-}
 var BLOCK_MESSAGE = "This request has been blocked by Patchstack.";
 function blockBody(result) {
   return { error: BLOCK_MESSAGE, message: BLOCK_MESSAGE, rule: result?.rule?.id };