@patchstack/connect 0.3.22 → 0.3.24

package/dist/index.d.ts

@@ -29,6 +29,18 @@ interface Config {
      * UUID it returns should be persisted via `persistSiteUuid()`.
      */
     siteUuid: string | null;
+    /**
+     * WP-format site API key (`{oauth.secret}-{oauth.id}`) for authenticated
+     * block-log reporting via connector `/api/logs/log`. Issued once as `api_key`
+     * on first provision. Prefer `PATCHSTACK_API_KEY` in production deploys.
+     */
+    apiKey: string | null;
+    /**
+     * Credential for the authenticated Pulse endpoints (ADR-0018). Exchanged for
+     * a short-lived bearer token at `monitor/pulse/token`; never sent directly.
+     * Falls back to `apiKey` when unset. Prefer `PATCHSTACK_PULSE_AUTH`.
+     */
+    pulseAuth: string | null;
     endpoint: string;
     timeoutMs: number;
     /** Environment to report the manifest under. Defaults to 'production'. */
@@ -43,6 +55,11 @@ interface Config {
 interface StoreManifestResponse {
     /** The UUID of the site the manifest was stored against. Always returned. */
     uuid?: string;
+    /**
+     * WP-format API key for connector log ingest. Present only when oauth
+     * credentials are created in this request (first provision / backfill).
+     */
+    api_key?: string;
     stored: boolean;
     manifest_id?: number;
     checksum?: string;
@@ -101,6 +118,14 @@ declare function postManifest(config: Config, payload: WirePayload): Promise<Sto
 
 interface ConfigFile {
     siteUuid?: string;
+    /** WP-format `{secret}-{oauth.id}` for connector /api/logs/log. Server-only. */
+    apiKey?: string;
+    /**
+     * Credential for the authenticated Pulse endpoints (ADR-0018). Same format as
+     * `apiKey` and today the same value, but kept as its own field so the Pulse
+     * and block-log paths can diverge without disturbing each other. Server-only.
+     */
+    pulseAuth?: string;
     endpoint?: string;
     timeoutMs?: number;
     environment?: string;
@@ -122,9 +147,19 @@ declare function resolveConfig(options: ResolveConfigOptions): Promise<Config>;
 declare function writeConfigFile(cwd: string, config: ConfigFile): Promise<string>;
 /**
  * Merge a new siteUuid into the existing `.patchstackrc.json` (or create it).
- * Preserves any `endpoint` / `timeoutMs` the user already wrote.
+ * Preserves any `endpoint` / `timeoutMs` / `apiKey` the user already wrote.
  */
 declare function persistSiteUuid(cwd: string, siteUuid: string): Promise<string>;
+/**
+ * Persist the WP-format api_key issued at provision (for connector log auth).
+ * Never embed this value in the public disclosure widget.
+ */
+declare function persistApiKey(cwd: string, apiKey: string): Promise<string>;
+/**
+ * Persist the credential used for the authenticated Pulse endpoints.
+ * Kept separate from `apiKey` so block-log auth is never disturbed.
+ */
+declare function persistPulseAuth(cwd: string, pulseAuth: string): Promise<string>;
 
 /**
  * A best-effort description of the stack a build was produced with, derived
@@ -218,4 +253,4 @@ interface ScanAndReportResult {
 }
 declare function scanAndReport(options?: ScanAndReportOptions): Promise<ScanAndReportResult>;
 
-export { type Config, DEFAULT_ENDPOINT, type Ecosystem, type Manifest, type PackageEntry, PatchstackError, type ScanAndReportOptions, type ScanAndReportResult, type SourceWidgetResult, type StackDescriptor, type StoreManifestResponse, WIDGET_MARKER_ATTR, WIDGET_SCRIPT_URL, type WidgetEnsureAction, type WidgetEnsureResult, buildClaimUrl, buildEndpointUrl, buildWidgetTag, buildWirePayload, collectHostingEnvKeys, compareVersions, detectLockfile, detectStack, ensureSourceWidget, ensureWidgetInHtml, findSourceShell, isEmptyStack, persistSiteUuid, postManifest, resolveConfig, scanAndReport, scanLockfile, writeConfigFile };
+export { type Config, DEFAULT_ENDPOINT, type Ecosystem, type Manifest, type PackageEntry, PatchstackError, type ScanAndReportOptions, type ScanAndReportResult, type SourceWidgetResult, type StackDescriptor, type StoreManifestResponse, WIDGET_MARKER_ATTR, WIDGET_SCRIPT_URL, type WidgetEnsureAction, type WidgetEnsureResult, buildClaimUrl, buildEndpointUrl, buildWidgetTag, buildWirePayload, collectHostingEnvKeys, compareVersions, detectLockfile, detectStack, ensureSourceWidget, ensureWidgetInHtml, findSourceShell, isEmptyStack, persistApiKey, persistPulseAuth, persistSiteUuid, postManifest, resolveConfig, scanAndReport, scanLockfile, writeConfigFile };

package/dist/index.js

@@ -907,6 +907,88 @@ function compareSegments(a, b) {
   return 0;
 }
 
+// src/pulse-token.ts
+var TOKEN_SKEW_MS = 6e4;
+function buildTokenUrl(manifestEndpoint) {
+  const url = new URL(manifestEndpoint);
+  const path8 = url.pathname.replace(/\/$/, "");
+  url.pathname = path8.endsWith("/manifest") ? `${path8.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function parsePulseAuth(credential) {
+  const index = credential.lastIndexOf("-");
+  if (index <= 0 || index === credential.length - 1) return null;
+  const clientId = credential.slice(index + 1);
+  if (!/^\d+$/.test(clientId)) return null;
+  return { clientId, clientSecret: credential.slice(0, index) };
+}
+var cached = null;
+var inflight = null;
+function clearPulseToken() {
+  cached = null;
+}
+async function getPulseToken(config, fetchImpl = fetch) {
+  if (typeof config.pulseAuth !== "string" || config.pulseAuth.length === 0) return null;
+  if (cached !== null && Date.now() < cached.expiresAt - TOKEN_SKEW_MS) {
+    return cached.token;
+  }
+  if (inflight !== null) return inflight;
+  const credentials = parsePulseAuth(config.pulseAuth);
+  if (credentials === null) return null;
+  inflight = (async () => {
+    try {
+      const response = await fetchImpl(buildTokenUrl(config.endpoint), {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "application/json",
+          "User-Agent": "@patchstack/connect"
+        },
+        body: JSON.stringify({
+          grant_type: "client_credentials",
+          client_id: credentials.clientId,
+          client_secret: credentials.clientSecret
+        }),
+        signal: AbortSignal.timeout(config.timeoutMs)
+      });
+      if (!response.ok) return null;
+      const body = await response.json();
+      if (typeof body.access_token !== "string" || body.access_token.length === 0) return null;
+      const expiresIn = Number(body.expires_in);
+      const ttlMs = Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn * 1e3 : 36e5;
+      cached = { token: body.access_token, expiresAt: Date.now() + ttlMs };
+      return body.access_token;
+    } catch {
+      return null;
+    } finally {
+      inflight = null;
+    }
+  })();
+  return inflight;
+}
+async function pulseAuthHeader(config, fetchImpl = fetch) {
+  const token = await getPulseToken(config, fetchImpl);
+  return token === null ? {} : { Authorization: `Bearer ${token}` };
+}
+async function pulseFetch(config, url, init, fetchImpl = fetch) {
+  const send = async () => {
+    const auth = await pulseAuthHeader(config, fetchImpl);
+    const response = await fetchImpl(url, {
+      ...init,
+      headers: { ...init.headers, ...auth }
+    });
+    return { response, authenticated: auth.Authorization !== void 0 };
+  };
+  const first = await send();
+  if (first.response.status === 401 && first.authenticated) {
+    clearPulseToken();
+    return (await send()).response;
+  }
+  return first.response;
+}
+
 // src/client.ts
 var DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -923,7 +1005,7 @@ async function postManifest(config, payload) {
   const timeoutMs = config.timeoutMs;
   let response;
   try {
-    response = await fetch(url, {
+    response = await pulseFetch(config, url, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -1015,8 +1097,12 @@ async function resolveConfig(options) {
       "CONFIG_MISSING"
     );
   }
+  const apiKeyRaw = fromEnv.apiKey ?? fromFile.apiKey ?? null;
+  const pulseAuthRaw = fromEnv.pulseAuth ?? fromFile.pulseAuth ?? apiKeyRaw;
   return {
     siteUuid: siteUuid === null || siteUuid.length === 0 ? null : siteUuid,
+    apiKey: apiKeyRaw === null || apiKeyRaw.length === 0 ? null : apiKeyRaw,
+    pulseAuth: pulseAuthRaw === null || pulseAuthRaw.length === 0 ? null : pulseAuthRaw,
     endpoint,
     timeoutMs,
     environment,
@@ -1033,6 +1119,14 @@ async function persistSiteUuid(cwd, siteUuid) {
   const existing = await readConfigFile(cwd);
   return writeConfigFile(cwd, { ...existing, siteUuid });
 }
+async function persistApiKey(cwd, apiKey) {
+  const existing = await readConfigFile(cwd);
+  return writeConfigFile(cwd, { ...existing, apiKey });
+}
+async function persistPulseAuth(cwd, pulseAuth) {
+  const existing = await readConfigFile(cwd);
+  return writeConfigFile(cwd, { ...existing, pulseAuth });
+}
 async function readConfigFile(cwd) {
   const target = path6.join(cwd, CONFIG_FILENAME);
   let raw;
@@ -1074,6 +1168,8 @@ function readEnv() {
   const environmentRaw = process.env.PATCHSTACK_ENVIRONMENT;
   return {
     siteUuid: process.env.PATCHSTACK_SITE_UUID ?? void 0,
+    apiKey: process.env.PATCHSTACK_API_KEY ?? void 0,
+    pulseAuth: process.env.PATCHSTACK_PULSE_AUTH ?? void 0,
     endpoint: process.env.PATCHSTACK_ENDPOINT ?? void 0,
     timeoutMs,
     environment: environmentRaw !== void 0 && environmentRaw.length > 0 ? environmentRaw : void 0
@@ -1242,6 +1338,10 @@ async function scanAndReport(options = {}) {
   if (config.siteUuid === null && response.uuid !== void 0 && response.uuid.length > 0) {
     await persistSiteUuid(cwd, response.uuid);
   }
+  if (typeof response.api_key === "string" && response.api_key.length > 0) {
+    await persistApiKey(cwd, response.api_key);
+    await persistPulseAuth(cwd, response.api_key);
+  }
   return {
     manifest,
     response,
@@ -1267,6 +1367,8 @@ export {
   ensureWidgetInHtml,
   findSourceShell,
   isEmptyStack,
+  persistApiKey,
+  persistPulseAuth,
   persistSiteUuid,
   postManifest,
   resolveConfig,