@patchstack/connect 0.3.21 → 0.3.22

package/dist/protect.d.ts

@@ -5,6 +5,8 @@ export interface RuleBundle {
   firewall: unknown[];
   whitelists: unknown[];
   whitelist_keys: Record<string, unknown>;
+  /** From the Pulse rules API when present (`block` = enforce, `dry-run` = detect only). */
+  enforcement?: "block" | "dry-run";
 }
 
 export type Phase = "request" | "response" | "egress";
@@ -33,7 +35,11 @@ export interface Protection {
 }
 
 export interface CreateProtectionOptions {
-  /** Default "dry-run". The scaffolded guard sets "block". */
+  /**
+   * Fallback when the Pulse rules API does not send `enforcement`.
+   * Overridden by `PATCHSTACK_MODE` when set, otherwise by API `enforcement`.
+   * Default "dry-run". Scaffolded guards pass "block" when env is unset.
+   */
   mode?: "block" | "dry-run";
   /** Explicit rule bundle (used as the token-less fallback). */
   rules?: unknown;

package/dist/protect.js

@@ -1032,7 +1032,8 @@ var PulseRuleClient = class {
         etag: response.headers?.get?.("etag") ?? null,
         firewall: data.firewall,
         whitelists: Array.isArray(data.whitelists) ? data.whitelists : [],
-        whitelist_keys: data.whitelist_keys ?? {}
+        whitelist_keys: data.whitelist_keys ?? {},
+        ...enforcementField(data)
       };
       this.#cache = result;
       this.#etag = result.etag;
@@ -1058,6 +1059,11 @@ var PulseRuleClient = class {
     this.#etag = null;
   }
 };
+function enforcementField(data) {
+  if (!data || typeof data !== "object") return {};
+  const v = data.enforcement ?? data.mode;
+  return v === "block" || v === "dry-run" ? { enforcement: v } : {};
+}
 
 // src/protect/engine/fetch.js
 var MAX_BODY_BYTES = 1024 * 1024;
@@ -1785,10 +1791,12 @@ async function resolveRules(options, store) {
   return emptyBundle();
 }
 function normalizeBundle(b) {
+  const enforcement = b?.enforcement ?? b?.mode;
   return {
     firewall: Array.isArray(b.firewall) ? b.firewall : [],
     whitelists: Array.isArray(b.whitelists) ? b.whitelists : [],
-    whitelist_keys: b.whitelist_keys ?? {}
+    whitelist_keys: b.whitelist_keys ?? {},
+    ...enforcement === "block" || enforcement === "dry-run" ? { enforcement } : {}
   };
 }
 function emptyBundle() {
@@ -1920,11 +1928,11 @@ function createServerFnGuard({ protection }) {
   };
 }
 async function createProtection(options = {}) {
-  const mode = options.mode === "block" ? "block" : "dry-run";
   const onError = options.onError;
   const onDetect = options.onDetect ?? defaultOnDetect;
   const store = makeStore(options);
   const bundle = await resolveRules(options, store);
+  let mode = resolveMode(options, bundle);
   let requestRules;
   let responseRules;
   let egressRules;
@@ -2119,7 +2127,9 @@ async function createProtection(options = {}) {
     return mode === "block";
   };
   const protection = {
-    mode,
+    get mode() {
+      return mode;
+    },
     get rules() {
       return { request: requestRules, response: responseRules, egress: egressRules };
     },
@@ -2247,7 +2257,7 @@ async function createProtection(options = {}) {
   let reporter = null;
   if (refreshable && options.siteUuid && options.reportManifest !== false && cwd) {
     try {
-      ({ reportManifest: reporter } = await import("./refresh-manifest-XBOGN446.js"));
+      ({ reportManifest: reporter } = await import("./refresh-manifest-OW7WT5A6.js"));
     } catch (err) {
       onError?.(err);
     }
@@ -2260,7 +2270,9 @@ async function createProtection(options = {}) {
         onError?.(err);
       }
     }
-    applyBundle(await resolveRules(options, store));
+    const next = await resolveRules(options, store);
+    mode = resolveMode(options, next);
+    applyBundle(next);
   };
   if (live) {
     protection.refresh = () => runRefreshTick();
@@ -2272,6 +2284,14 @@ async function createProtection(options = {}) {
   }
   return protection;
 }
+function resolveMode(options, bundle) {
+  const env = typeof process !== "undefined" ? process.env?.PATCHSTACK_MODE : void 0;
+  if (env === "block" || env === "dry-run") return env;
+  if (bundle?.enforcement === "block" || bundle?.enforcement === "dry-run") return bundle.enforcement;
+  if (options?.mode === "block") return "block";
+  if (options?.mode === "dry-run") return "dry-run";
+  return "dry-run";
+}
 function byPhase(rules, phase) {
   return (rules ?? []).filter((r) => (r.phase ?? "request") === phase);
 }