@patchstack/connect 0.3.23 → 0.3.24

package/dist/protect.edge.js

@@ -0,0 +1,3530 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// ps-edge:ps-edge-stub
+var require_ps_edge_stub = __commonJS({
+  "ps-edge:ps-edge-stub"() {
+    throw new Error("[patchstack] this module is Node-only and unavailable on an edge runtime");
+  }
+});
+
+// src/protect/safe-origin.js
+function isSafeOrigin(value) {
+  try {
+    const u = new URL(value);
+    if (u.protocol === "https:") return true;
+    return u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]" || u.hostname === "::1");
+  } catch {
+    return false;
+  }
+}
+function safeBaseUrl(candidate, fallback, label) {
+  if (typeof candidate !== "string" || candidate === "") return fallback;
+  if (isSafeOrigin(candidate)) return candidate;
+  warnOnce(label, `[patchstack] ignoring unsafe ${label} override (${candidate}): must be https (or localhost). Using the default.`);
+  return fallback;
+}
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(key, message) {
+  if (warned.has(key)) return;
+  warned.add(key);
+  console.warn(message);
+}
+
+// src/protect/engine/client.js
+var DEFAULT_BASE_URL = "https://api.patchstack.com";
+var DEFAULT_CACHE_TTL = 3e5;
+var JITTER_FRACTION = 0.1;
+var PatchstackRuleClient = class {
+  #token;
+  #baseUrl;
+  #cacheTtl;
+  #cache = null;
+  #cacheTime = null;
+  #ttlEffective = 0;
+  #etag;
+  #timeoutMs;
+  constructor({ token, baseUrl, cacheTtl, etag, timeoutMs } = {}) {
+    this.#timeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 3e4;
+    this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN;
+    this.#baseUrl = safeBaseUrl(baseUrl ?? process.env.PATCHSTACK_WAF_API_URL, DEFAULT_BASE_URL, "rule endpoint");
+    this.#cacheTtl = Number.isFinite(cacheTtl) && cacheTtl > 0 ? cacheTtl : DEFAULT_CACHE_TTL;
+    this.#etag = etag ?? null;
+    if (!this.#token) {
+      throw new Error("Patchstack WAF token is required. Pass { token } or set PATCHSTACK_WAF_TOKEN env var.");
+    }
+  }
+  async getRules() {
+    const now = Date.now();
+    if (this.#cache && this.#cacheTime !== null && now - this.#cacheTime < this.#ttlEffective) {
+      return this.#cache;
+    }
+    const url = `${this.#baseUrl}/api/get-rules/3`;
+    try {
+      const headers = {
+        "Content-Type": "application/json",
+        "Authorization": `Bearer ${this.#token}`,
+        "LicenseID": "1"
+        // Hard-coded, is never actually used but needed by the API
+      };
+      if (this.#etag) headers["If-None-Match"] = this.#etag;
+      const response = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({}),
+        signal: AbortSignal.timeout(this.#timeoutMs)
+      });
+      if (response.status === 304) {
+        this.#touch(now);
+        return this.#cache ?? { success: true, notModified: true, etag: this.#etag, firewall: [], whitelists: [], whitelist_keys: {} };
+      }
+      if (!response.ok) {
+        return {
+          success: false,
+          error: `API returned ${response.status}: ${response.statusText}`,
+          firewall: [],
+          whitelists: [],
+          whitelist_keys: {}
+        };
+      }
+      const data = await response.json();
+      if (!data || !Array.isArray(data.firewall)) {
+        return { success: false, error: "unexpected response shape (no firewall array)", firewall: [], whitelists: [], whitelist_keys: {} };
+      }
+      const result = {
+        success: true,
+        notModified: false,
+        etag: response.headers?.get?.("etag") ?? null,
+        firewall: data.firewall,
+        whitelists: Array.isArray(data.whitelists) ? data.whitelists : [],
+        whitelist_keys: data.whitelist_keys ?? {}
+      };
+      this.#cache = result;
+      this.#etag = result.etag;
+      this.#touch(now);
+      return result;
+    } catch (err) {
+      return {
+        success: false,
+        error: err.name === "TimeoutError" ? "Request timed out" : err.message,
+        firewall: [],
+        whitelists: [],
+        whitelist_keys: {}
+      };
+    }
+  }
+  #touch(now) {
+    this.#cacheTime = now;
+    this.#ttlEffective = this.#cacheTtl - Math.floor(Math.random() * this.#cacheTtl * JITTER_FRACTION);
+  }
+  clearCache() {
+    this.#cache = null;
+    this.#cacheTime = null;
+    this.#etag = null;
+  }
+};
+
+// src/protect/engine/request.js
+var FILE_ATTRS = /* @__PURE__ */ new Set(["content", "filename", "type"]);
+var fileFilename = (f) => f && typeof f === "object" ? f.filename : f;
+var fileAttribute = (f, attr) => f && typeof f === "object" ? f[attr] : attr === "filename" ? f : void 0;
+function base64DecodeUtf8(value) {
+  const str = String(value);
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(str, "base64").toString("utf-8");
+  }
+  const binary = atob(str);
+  const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
+}
+var RequestResolver = class {
+  #req;
+  #cookies;
+  constructor(req) {
+    this.#req = req;
+    this.#cookies = null;
+  }
+  resolve(parameter) {
+    if (!parameter || parameter === "false") {
+      return [null];
+    }
+    if (parameter === "rules") {
+      return [null];
+    }
+    if (parameter === "raw") {
+      return this.#resolveRaw();
+    }
+    if (parameter === "all") {
+      return this.#resolveAll();
+    }
+    const dotIndex = parameter.indexOf(".");
+    if (dotIndex === -1) {
+      return [];
+    }
+    const source = parameter.substring(0, dotIndex);
+    const key = parameter.substring(dotIndex + 1);
+    switch (source) {
+      case "get":
+        return this.#resolveGet(key);
+      case "post":
+        return this.#resolvePost(key);
+      case "request":
+        return this.#resolveRequest(key);
+      case "cookie":
+        return this.#resolveCookie(key);
+      case "server":
+        return this.#resolveServer(key);
+      case "files":
+        return this.#resolveFiles(key);
+      case "response":
+        return this.#resolveResponse(key);
+      case "egress":
+        return this.#resolveEgress(key);
+      default:
+        return [];
+    }
+  }
+  // Response-phase sources (req._response = { status, headers, body }). Lets rules inspect
+  // what the app is about to SEND — e.g. a leaked secret in the body — regardless of route.
+  #resolveResponse(key) {
+    const resp = this.#req._response;
+    if (!resp) {
+      return [];
+    }
+    if (key === "status") {
+      return resp.status !== void 0 ? [String(resp.status)] : [];
+    }
+    if (key === "body") {
+      return resp.body != null && resp.body !== "" ? [resp.body] : [];
+    }
+    if (key === "headers") {
+      const headers = resp.headers ?? {};
+      return [Object.entries(headers).map(([k, v]) => `${k}: ${v}`).join("\n")];
+    }
+    if (key.startsWith("header.")) {
+      const name = key.slice("header.".length).toLowerCase();
+      const value = (resp.headers ?? {})[name];
+      return value !== void 0 ? [value] : [];
+    }
+    return [];
+  }
+  // Egress-phase sources (req._egress = { url, host, method }). Lets rules inspect an
+  // OUTBOUND request the app is about to make — SSRF at the egress boundary.
+  #resolveEgress(key) {
+    const eg = this.#req._egress;
+    if (!eg) {
+      return [];
+    }
+    if (key === "url") return eg.url ? [eg.url] : [];
+    if (key === "host") return eg.host ? [eg.host] : [];
+    if (key === "method") return eg.method ? [eg.method] : [];
+    return [];
+  }
+  applyMutations(mutations, value) {
+    if (!mutations || !Array.isArray(mutations)) {
+      return value;
+    }
+    let result = value;
+    for (const mutation of mutations) {
+      result = this.#applyMutation(mutation, result);
+    }
+    return result;
+  }
+  #applyMutation(mutation, value) {
+    if (value === null || value === void 0) {
+      return value;
+    }
+    switch (mutation) {
+      case "base64_decode":
+        try {
+          return base64DecodeUtf8(value);
+        } catch {
+          return value;
+        }
+      case "json_decode":
+        try {
+          return JSON.parse(String(value));
+        } catch {
+          return value;
+        }
+      case "json_encode":
+        try {
+          return JSON.stringify(value);
+        } catch {
+          return value;
+        }
+      case "urldecode":
+        try {
+          return decodeURIComponent(String(value));
+        } catch {
+          return value;
+        }
+      case "intval":
+        return parseInt(String(value), 10) || 0;
+      case "getArrayValues":
+        if (typeof value === "object" && value !== null) {
+          return Object.values(value);
+        }
+        return value;
+      default:
+        return value;
+    }
+  }
+  #resolveGet(key) {
+    const query = this.#req.query ?? {};
+    if (key.endsWith("*")) {
+      return this.#resolveWildcard(query, key);
+    }
+    const value = this.#getNestedValue(query, key);
+    return value !== void 0 ? [value] : [];
+  }
+  #resolvePost(key) {
+    const body = this.#req.body ?? {};
+    if (key.endsWith("*")) {
+      return this.#resolveWildcard(body, key);
+    }
+    const value = this.#getNestedValue(body, key);
+    return value !== void 0 ? [value] : [];
+  }
+  #resolveRequest(key) {
+    const query = this.#req.query ?? {};
+    const body = this.#req.body ?? {};
+    const cookies = this.#parseCookies();
+    if (key.endsWith("*")) {
+      return [
+        ...this.#resolveWildcard(query, key),
+        ...this.#resolveWildcard(body, key),
+        ...this.#resolveWildcard(cookies, key)
+      ];
+    }
+    const value = this.#getNestedValue(query, key) ?? this.#getNestedValue(body, key) ?? cookies[key];
+    return value !== void 0 ? [value] : [];
+  }
+  #resolveCookie(key) {
+    const cookies = this.#parseCookies();
+    if (key.endsWith("*")) {
+      return this.#resolveWildcard(cookies, key);
+    }
+    const value = cookies[key];
+    return value !== void 0 ? [value] : [];
+  }
+  #resolveServer(key) {
+    const req = this.#req;
+    switch (key) {
+      case "REQUEST_URI":
+        return [req.originalUrl ?? req.url ?? "/"];
+      case "REQUEST_METHOD":
+        return [req.method ?? "GET"];
+      case "HTTP_USER_AGENT":
+        return req.headers?.["user-agent"] ? [req.headers["user-agent"]] : [];
+      case "HTTP_REFERER":
+        return req.headers?.referer ? [req.headers.referer] : [];
+      case "HTTP_HOST":
+        return req.headers?.host ? [req.headers.host] : [];
+      case "REMOTE_ADDR":
+      case "ip":
+        return [req.ip ?? req.socket?.remoteAddress ?? ""];
+      case "CONTENT_TYPE":
+        return req.headers?.["content-type"] ? [req.headers["content-type"]] : [];
+      case "CONTENT_LENGTH":
+        return req.headers?.["content-length"] ? [req.headers["content-length"]] : [];
+      default: {
+        if (key.startsWith("HTTP_")) {
+          const headerName = key.substring(5).toLowerCase().replace(/_/g, "-");
+          const headers = req.headers;
+          if (headers === null || typeof headers !== "object") return [];
+          return Object.prototype.hasOwnProperty.call(headers, headerName) ? [headers[headerName]] : [];
+        }
+        return [];
+      }
+    }
+  }
+  #resolveFiles(key) {
+    const files = this.#req.files;
+    if (!files || typeof files !== "object") {
+      return [];
+    }
+    const dot = key.lastIndexOf(".");
+    if (dot !== -1 && FILE_ATTRS.has(key.slice(dot + 1)) && Object.prototype.hasOwnProperty.call(files, key.slice(0, dot))) {
+      const attr = key.slice(dot + 1);
+      const entry = files[key.slice(0, dot)];
+      const list = Array.isArray(entry) ? entry : [entry];
+      const out = [];
+      for (const f of list) {
+        const v = fileAttribute(f, attr);
+        if (v !== void 0 && v !== "") out.push(v);
+      }
+      return out;
+    }
+    const filenamesOf = (entry) => Array.isArray(entry) ? entry.map(fileFilename) : [fileFilename(entry)];
+    if (key.endsWith("*")) {
+      const prefix = key.slice(0, -1);
+      const out = [];
+      for (const [k, entry] of Object.entries(files)) {
+        if (k.startsWith(prefix)) out.push(...filenamesOf(entry));
+      }
+      return out.filter((v) => v !== void 0);
+    }
+    if (!Object.prototype.hasOwnProperty.call(files, key)) return [];
+    return filenamesOf(files[key]).filter((v) => v !== void 0);
+  }
+  #resolveRaw() {
+    if (typeof this.#req._rawBody === "string") {
+      return this.#req._rawBody ? [this.#req._rawBody] : [];
+    }
+    const body = this.#req.body;
+    if (body === void 0 || body === null) {
+      return [];
+    }
+    if (typeof body === "string") {
+      return [body];
+    }
+    try {
+      return [JSON.stringify(body)];
+    } catch {
+      return [String(body)];
+    }
+  }
+  #resolveAll() {
+    const parts = [];
+    const uri = this.#req.originalUrl ?? this.#req.url ?? "/";
+    parts.push(uri);
+    const queryString = uri.includes("?") ? uri.split("?")[1] : "";
+    if (queryString) {
+      parts.push(queryString);
+    }
+    const body = this.#req.body;
+    if (body) {
+      parts.push(typeof body === "string" ? body : JSON.stringify(body));
+    }
+    if (typeof this.#req._rawBody === "string" && this.#req._rawBody) {
+      parts.push(this.#req._rawBody);
+    }
+    const headers = this.#req.headers ?? {};
+    const excludedHeaders = /* @__PURE__ */ new Set([
+      "host",
+      "connection",
+      "cache-control",
+      "accept",
+      "accept-encoding",
+      "accept-language",
+      "priority",
+      "sec-ch-ua",
+      "sec-ch-ua-mobile",
+      "sec-ch-ua-platform",
+      "sec-fetch-dest",
+      "sec-fetch-mode",
+      "sec-fetch-site",
+      "sec-fetch-user",
+      "upgrade-insecure-requests"
+    ]);
+    for (const [name, value] of Object.entries(headers)) {
+      if (!excludedHeaders.has(name)) {
+        parts.push(`${name}: ${value}`);
+      }
+    }
+    const cookies = this.#parseCookies();
+    const cookieStr = Object.entries(cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+    if (cookieStr) {
+      parts.push(cookieStr);
+    }
+    return [parts.join(" ")];
+  }
+  #resolveWildcard(obj, pattern) {
+    if (typeof obj !== "object" || obj === null) {
+      return [];
+    }
+    const prefix = pattern.slice(0, -1);
+    const values = [];
+    for (const [key, value] of Object.entries(obj)) {
+      if (key.startsWith(prefix)) {
+        values.push(value);
+      }
+    }
+    return values;
+  }
+  #getNestedValue(obj, key) {
+    if (typeof obj !== "object" || obj === null) {
+      return void 0;
+    }
+    const own = (o, k) => o !== null && typeof o === "object" && Object.prototype.hasOwnProperty.call(o, k);
+    if (own(obj, key)) {
+      return obj[key];
+    }
+    const parts = key.split(".");
+    let current = obj;
+    for (const part of parts) {
+      if (!own(current, part)) {
+        return void 0;
+      }
+      current = current[part];
+    }
+    return current;
+  }
+  #parseCookies() {
+    if (this.#cookies !== null) {
+      return this.#cookies;
+    }
+    if (this.#req.cookies) {
+      this.#cookies = this.#req.cookies;
+      return this.#cookies;
+    }
+    const header = this.#req.headers?.cookie;
+    if (!header) {
+      this.#cookies = {};
+      return this.#cookies;
+    }
+    const cookies = {};
+    for (const pair of header.split(";")) {
+      const eqIndex = pair.indexOf("=");
+      if (eqIndex === -1) {
+        continue;
+      }
+      const name = pair.substring(0, eqIndex).trim();
+      const value = pair.substring(eqIndex + 1).trim();
+      cookies[name] = value;
+    }
+    this.#cookies = cookies;
+    return this.#cookies;
+  }
+};
+
+// src/protect/engine/normalizer.js
+var HTML_ENTITIES = {
+  "&amp;": "&",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&quot;": '"',
+  "&#39;": "'",
+  "&apos;": "'",
+  "&nbsp;": " ",
+  "&#x27;": "'",
+  "&#x22;": '"',
+  "&#x3C;": "<",
+  "&#x3E;": ">",
+  "&#x26;": "&",
+  "&#34;": '"',
+  "&#60;": "<",
+  "&#62;": ">",
+  "&#38;": "&"
+};
+var MAX_DECODE_ITERATIONS = 5;
+function normalize(value, options = {}) {
+  if (typeof value !== "string") {
+    return value;
+  }
+  const opts = {
+    urlDecode: true,
+    htmlDecode: true,
+    sqlComments: true,
+    nullBytes: true,
+    whitespace: true,
+    ...options
+  };
+  let result = value;
+  if (opts.nullBytes) {
+    result = removeNullBytes(result);
+  }
+  if (opts.urlDecode) {
+    result = urlDecode(result);
+  }
+  if (opts.htmlDecode) {
+    result = htmlEntityDecode(result);
+  }
+  if (opts.sqlComments) {
+    result = removeSqlComments(result);
+  }
+  if (opts.whitespace) {
+    result = normalizeWhitespace(result);
+  }
+  return result;
+}
+function urlDecode(value) {
+  if (typeof value !== "string") {
+    return value;
+  }
+  let result = value;
+  let previous = "";
+  let iterations = 0;
+  while (result !== previous && iterations < MAX_DECODE_ITERATIONS) {
+    previous = result;
+    iterations++;
+    try {
+      result = decodeURIComponent(result);
+    } catch {
+      result = safeUrlDecode(result);
+      break;
+    }
+  }
+  return result;
+}
+function safeUrlDecode(value) {
+  return value.replace(/%([0-9A-Fa-f]{2})/g, (match, hex) => {
+    try {
+      return String.fromCharCode(parseInt(hex, 16));
+    } catch {
+      return match;
+    }
+  });
+}
+function htmlEntityDecode(value) {
+  if (typeof value !== "string") {
+    return value;
+  }
+  let result = value;
+  for (const [entity, char] of Object.entries(HTML_ENTITIES)) {
+    result = result.split(entity).join(char);
+  }
+  result = result.replace(/&#(\d+);/g, (match, code) => {
+    const num = parseInt(code, 10);
+    return num > 0 && num < 65536 ? String.fromCharCode(num) : match;
+  });
+  result = result.replace(/&#x([0-9A-Fa-f]+);/g, (match, hex) => {
+    const num = parseInt(hex, 16);
+    return num > 0 && num < 65536 ? String.fromCharCode(num) : match;
+  });
+  return result;
+}
+function removeSqlComments(value) {
+  if (typeof value !== "string") {
+    return value;
+  }
+  let result = value;
+  result = result.replace(/\/\*[\s\S]*?\*\//g, " ");
+  result = result.replace(/\/\*![\s\S]*?\*\//g, " ");
+  return result;
+}
+function removeNullBytes(value) {
+  if (typeof value !== "string") {
+    return value;
+  }
+  let result = value.replace(/\x00/g, "");
+  result = result.replace(/[\x01-\x08\x0B\x0C\x0E-\x1F]/g, "");
+  return result;
+}
+function normalizeWhitespace(value) {
+  if (typeof value !== "string") {
+    return value;
+  }
+  let result = value.replace(/[\t\r\n\f\v]+/g, " ");
+  result = result.replace(/ {2,}/g, " ");
+  return result;
+}
+function serializeForRawDetection(body, visited = /* @__PURE__ */ new Set(), isRoot = true) {
+  if (body === null || body === void 0) {
+    return isRoot ? "" : "null";
+  }
+  if (typeof body === "string") {
+    return isRoot ? body : JSON.stringify(body);
+  }
+  if (typeof body !== "object") {
+    return String(body);
+  }
+  if (visited.has(body)) {
+    return "[Circular]";
+  }
+  visited.add(body);
+  if (Array.isArray(body)) {
+    const items = body.map((item) => serializeForRawDetection(item, visited, false));
+    return "[" + items.join(",") + "]";
+  }
+  const keys = Object.getOwnPropertyNames(body);
+  const parts = keys.map((key) => {
+    const val = serializeForRawDetection(body[key], visited, false);
+    return JSON.stringify(key) + ":" + val;
+  });
+  return "{" + parts.join(",") + "}";
+}
+function normalizeRequest(req, options = {}) {
+  const rawBody = typeof req._rawBody === "string" ? req._rawBody : serializeForRawDetection(req.body ?? null);
+  return {
+    query: normalizeObject(req.query || {}, options),
+    body: normalizeObject(req.body || {}, options),
+    headers: normalizeObject(req.headers || {}, options),
+    url: normalize(req.url || "", options),
+    originalUrl: normalize(req.originalUrl || req.url || "", options),
+    _rawBody: rawBody
+  };
+}
+var MAX_NORMALIZE_DEPTH = 200;
+function normalizeObject(value, options = {}, depth = 0) {
+  if (typeof value === "string") {
+    return normalize(value, options);
+  }
+  if (depth >= MAX_NORMALIZE_DEPTH) {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => normalizeObject(item, options, depth + 1));
+  }
+  if (typeof value === "object" && value !== null) {
+    const result = {};
+    for (const [key, val] of Object.entries(value)) {
+      result[key] = normalizeObject(val, options, depth + 1);
+    }
+    return result;
+  }
+  return value;
+}
+
+// src/protect/engine/engine.js
+var GRP = "(?:[^()]|\\([^()]*\\))*";
+var REDOS_PATTERNS = [
+  /\([^)]*[+*}][^)]*\)\s*[+*]/,
+  /\([^)]*\|[^)]*\)\s*[+*]/,
+  new RegExp("\\(" + GRP + "[+*}]" + GRP + "\\)\\s*[+*]"),
+  // nested quantified subgroup
+  new RegExp("\\(" + GRP + "\\|" + GRP + "\\)\\s*[+*]")
+  // nested alternation under a quantifier
+];
+var warnedRejectedPatterns = /* @__PURE__ */ new Set();
+function warnRejectedPatternOnce(pattern) {
+  const key = String(pattern);
+  if (warnedRejectedPatterns.has(key)) return;
+  warnedRejectedPatterns.add(key);
+  console.warn(
+    `[patchstack] rule_v2 regex pattern rejected (unsafe or invalid) \u2014 condition treated as no-match. The rule relying on it is NOT enforced: ${key}`
+  );
+}
+var MAX_PATTERN_LENGTH = 1e3;
+function safeRegExp(pattern) {
+  if (!pattern) {
+    return null;
+  }
+  if (typeof pattern !== "string" || pattern.length > MAX_PATTERN_LENGTH) {
+    return null;
+  }
+  for (const dangerous of REDOS_PATTERNS) {
+    if (dangerous.test(pattern)) {
+      return null;
+    }
+  }
+  const match = pattern.match(/^\/(.+?)\/([gimsuy]*)$/s);
+  if (!match) {
+    return null;
+  }
+  try {
+    return new RegExp(match[1], match[2]);
+  } catch {
+    return null;
+  }
+}
+function ctypeResult(strValue, isClass, matchVal) {
+  if (strValue === "") {
+    return false;
+  }
+  const expected = typeof matchVal === "boolean" ? matchVal : true;
+  return isClass === expected;
+}
+function walkLeaves(node, segments, cb) {
+  if (node === null || typeof node !== "object") return;
+  if (Array.isArray(node)) {
+    for (const el of node) walkLeaves(el, segments, cb);
+    return;
+  }
+  const [head, ...rest] = segments;
+  if (head === void 0 || !Object.prototype.hasOwnProperty.call(node, head)) return;
+  if (rest.length === 0) {
+    const leaf = node[head];
+    if (Array.isArray(leaf)) {
+      for (let i = 0; i < leaf.length; i++) cb({ parent: leaf, key: i, value: leaf[i] });
+    } else {
+      cb({ parent: node, key: head, value: leaf });
+    }
+  } else {
+    walkLeaves(node[head], rest, cb);
+  }
+}
+function arrayKeyValue(value, matchObj) {
+  if (!matchObj || !matchObj.match || value === null || typeof value !== "object") {
+    return false;
+  }
+  const keys = Array.isArray(matchObj.key) ? matchObj.key : [matchObj.key];
+  const sub = matchObj.match;
+  for (const key of keys) {
+    let matched = false;
+    walkLeaves(value, String(key).split("."), ({ value: leaf }) => {
+      if (!matched && matchValue(sub.type, leaf, sub.value, sub)) matched = true;
+    });
+    if (matched) return true;
+  }
+  return false;
+}
+var WHOLE_VALUE_MATCH_TYPES = /* @__PURE__ */ new Set(["isset", "array_in_array", "array_key_value"]);
+function collectLeafValues(root, nodeCap = 2e4, maxDepth = 1e3) {
+  const out = [];
+  const stack = [[root, 0]];
+  let visited = 0;
+  while (stack.length) {
+    const [node, depth] = stack.pop();
+    if (node === null || node === void 0) continue;
+    if (typeof node !== "object") {
+      out.push(node);
+      continue;
+    }
+    if (depth >= maxDepth || visited >= nodeCap) continue;
+    visited++;
+    if (Array.isArray(node)) {
+      for (let i = node.length - 1; i >= 0; i--) stack.push([node[i], depth + 1]);
+    } else {
+      for (const k of Object.keys(node)) stack.push([node[k], depth + 1]);
+    }
+  }
+  return out;
+}
+var warnedKeys = /* @__PURE__ */ new Set();
+function warnOnce2(key, message) {
+  if (warnedKeys.has(key)) return;
+  warnedKeys.add(key);
+  console.warn(message);
+}
+var warnedMatchTypes = /* @__PURE__ */ new Set();
+function warnUnsupportedMatchType(type) {
+  if (type == null || warnedMatchTypes.has(type)) {
+    return;
+  }
+  warnedMatchTypes.add(type);
+  console.warn(
+    `[patchstack] Unsupported rule_v2 match type "${type}" \u2014 condition treated as no-match. Rules relying on it are not enforced by this engine.`
+  );
+}
+function isInternalHost(hostname) {
+  if (!hostname) return false;
+  let host = String(hostname).toLowerCase().replace(/^\[|\]$/g, "");
+  host = host.replace(/%[^\]]*$/, "");
+  host = host.replace(/\.$/, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) return true;
+  if (host === "metadata.google.internal") return true;
+  if (host.includes(":")) {
+    const g = expandIPv6(host);
+    if (!g) return false;
+    const allZeroHi = g[0] === 0 && g[1] === 0 && g[2] === 0 && g[3] === 0 && g[4] === 0;
+    if (allZeroHi && g[5] === 0 && g[6] === 0 && (g[7] === 0 || g[7] === 1)) return true;
+    if ((g[0] & 65472) === 65152) return true;
+    if ((g[0] & 65024) === 64512) return true;
+    if (allZeroHi && (g[5] === 65535 || g[5] === 0)) {
+      return isPrivateV4Int((g[6] << 16 >>> 0 | g[7]) >>> 0);
+    }
+    return false;
+  }
+  const v4 = parseIPv4ToInt(host);
+  if (v4 !== null) return isPrivateV4Int(v4);
+  return false;
+}
+function isPrivateV4Int(n) {
+  const a = n >>> 24 & 255;
+  const b = n >>> 16 & 255;
+  if (a === 127 || a === 10 || a === 0) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  return false;
+}
+function parseIPv4ToInt(host) {
+  if (!/^[0-9a-fx]+(\.[0-9a-fx]+)*$/i.test(host)) return null;
+  const parts = host.split(".");
+  if (parts.length > 4) return null;
+  const nums = [];
+  for (const p of parts) {
+    let n;
+    if (/^0x[0-9a-f]+$/i.test(p)) n = parseInt(p, 16);
+    else if (/^0[0-7]+$/.test(p)) n = parseInt(p, 8);
+    else if (/^[0-9]+$/.test(p)) n = parseInt(p, 10);
+    else return null;
+    if (!Number.isInteger(n) || n < 0) return null;
+    nums.push(n);
+  }
+  const last = nums.length - 1;
+  let value = 0;
+  for (let i = 0; i < last; i++) {
+    if (nums[i] > 255) return null;
+    value += nums[i] * 2 ** (8 * (3 - i));
+  }
+  const maxLast = 2 ** (8 * (5 - nums.length)) - 1;
+  if (nums[last] > maxLast) return null;
+  value += nums[last];
+  if (value < 0 || value > 4294967295) return null;
+  return value >>> 0;
+}
+function expandIPv6(host) {
+  if (!host.includes(":")) return null;
+  let s = host;
+  const lastColon = s.lastIndexOf(":");
+  const tail = s.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    const v4 = parseIPv4ToInt(tail);
+    if (v4 === null) return null;
+    s = s.slice(0, lastColon + 1) + (v4 >>> 16 & 65535).toString(16) + ":" + (v4 & 65535).toString(16);
+  }
+  const halves = s.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const back = halves.length === 2 ? halves[1] ? halves[1].split(":") : [] : null;
+  let groups;
+  if (back === null) {
+    groups = head;
+  } else {
+    const fill = 8 - head.length - back.length;
+    if (fill < 0) return null;
+    groups = [...head, ...Array(fill).fill("0"), ...back];
+  }
+  if (groups.length !== 8) return null;
+  const out = [];
+  for (const g of groups) {
+    if (!/^[0-9a-f]{1,4}$/i.test(g)) return null;
+    out.push(parseInt(g, 16));
+  }
+  return out;
+}
+function ruleAppliesTo(when, resolver) {
+  try {
+    if (when.method) {
+      const methods = (Array.isArray(when.method) ? when.method : [when.method]).map((m) => String(m).toUpperCase());
+      const actual = String(resolver.resolve("server.REQUEST_METHOD")[0] ?? "GET").toUpperCase();
+      if (!methods.includes(actual)) return false;
+    }
+    if (when.path) {
+      const uri = String(resolver.resolve("server.REQUEST_URI")[0] ?? "/");
+      if (!pathMatches(String(when.path), uri.split("?")[0])) return false;
+    }
+    return true;
+  } catch {
+    return true;
+  }
+}
+function pathMatches(pattern, path) {
+  if (pattern.length > 2 && pattern.startsWith("/") && pattern.endsWith("/")) {
+    const re = safeRegExp(pattern);
+    return re ? re.test(path) : false;
+  }
+  if (pattern.includes("*")) {
+    const re = safeRegExp("/^" + pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^?]*") + "$/");
+    return re ? re.test(path) : false;
+  }
+  return path === pattern;
+}
+function normalizeDefaultPort(host) {
+  return String(host).toLowerCase().replace(/:(?:80|443)$/, "");
+}
+function isCrossOrigin(resolver) {
+  try {
+    const host = normalizeDefaultPort(String(resolver.resolve("server.HTTP_HOST")[0] ?? ""));
+    if (!host) return false;
+    const originRaw = resolver.resolve("server.HTTP_ORIGIN")[0];
+    const hasOrigin = originRaw !== void 0 && originRaw !== null;
+    const src = hasOrigin ? originRaw : resolver.resolve("server.HTTP_REFERER")[0];
+    if (src === void 0 || src === null) return false;
+    const s = String(src).trim();
+    if (hasOrigin && (s === "" || s.toLowerCase() === "null")) return true;
+    const srcHost = hostFromUrl(s);
+    if (srcHost === null) return hasOrigin;
+    return normalizeDefaultPort(srcHost) !== host;
+  } catch {
+    return false;
+  }
+}
+function hostFromUrl(value) {
+  try {
+    return new URL(value).host.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function isOffOriginRedirect(resolver) {
+  try {
+    const status = Number(resolver.resolve("response.status")[0] ?? 0);
+    if (status < 300 || status >= 400) return false;
+    const location = resolver.resolve("response.header.location")[0];
+    if (!location) return false;
+    const host = String(resolver.resolve("server.HTTP_HOST")[0] ?? "").toLowerCase();
+    if (!host) return false;
+    const loc = String(location).replace(/[\t\r\n]/g, "").replace(/\\/g, "/");
+    let target;
+    try {
+      target = new URL(loc, "http://" + host).host.toLowerCase();
+    } catch {
+      return false;
+    }
+    return normalizeDefaultPort(target) !== normalizeDefaultPort(host);
+  } catch {
+    return false;
+  }
+}
+function isReflectedCorsWithCredentials(resolver) {
+  try {
+    const acac = String(resolver.resolve("response.header.access-control-allow-credentials")[0] ?? "").toLowerCase();
+    if (acac !== "true") return false;
+    const acao = String(resolver.resolve("response.header.access-control-allow-origin")[0] ?? "");
+    if (!acao) return false;
+    if (acao === "*") return true;
+    if (acao.toLowerCase() === "null") return true;
+    const origin = String(resolver.resolve("server.HTTP_ORIGIN")[0] ?? "");
+    if (!origin) return false;
+    return acao === origin;
+  } catch {
+    return false;
+  }
+}
+function matchValue(type, value, matchVal, matchObj) {
+  if (value === null || value === void 0) {
+    if (type === "isset") {
+      return false;
+    }
+    return false;
+  }
+  let strValue;
+  if (typeof value === "string") {
+    strValue = value;
+  } else {
+    try {
+      strValue = String(value);
+    } catch {
+      strValue = "";
+    }
+  }
+  switch (type) {
+    case "equals":
+      return strValue == matchVal;
+    case "equals_strict":
+      return strValue === matchVal;
+    case "contains":
+    // engine-php exposes `stripos` as an alias of `contains`.
+    case "stripos": {
+      const lower = strValue.toLowerCase();
+      const target = String(matchVal).toLowerCase();
+      return lower.includes(target);
+    }
+    case "not_contains": {
+      const lower = strValue.toLowerCase();
+      const target = String(matchVal).toLowerCase();
+      return !lower.includes(target);
+    }
+    case "regex": {
+      const regex = safeRegExp(matchVal);
+      if (!regex) {
+        warnRejectedPatternOnce(matchVal);
+        return false;
+      }
+      return regex.test(strValue);
+    }
+    case "more_than":
+      return Number(strValue) > Number(matchVal);
+    case "less_than":
+      return Number(strValue) < Number(matchVal);
+    case "ctype_digit":
+      return ctypeResult(strValue, /^\d+$/.test(strValue), matchVal);
+    case "ctype_alnum":
+      return ctypeResult(strValue, /^[\w$\u0080-\uFFFF]+$/.test(strValue), matchVal);
+    case "is_numeric":
+      return ctypeResult(strValue, !isNaN(strValue) && strValue.trim() !== "", matchVal);
+    case "isset":
+      return true;
+    case "in_array": {
+      const arr = (Array.isArray(matchVal) ? matchVal : [matchVal]).map((x) => String(x));
+      return arr.includes(strValue);
+    }
+    case "not_in_array": {
+      const arr = (Array.isArray(matchVal) ? matchVal : [matchVal]).map((x) => String(x));
+      return !arr.includes(strValue);
+    }
+    case "array_in_array": {
+      if (!Array.isArray(value) || !Array.isArray(matchVal)) {
+        return false;
+      }
+      const target = matchVal.map((x) => String(x));
+      return value.some((v) => target.includes(String(v)));
+    }
+    case "hostname": {
+      try {
+        const url = new URL(strValue);
+        return url.hostname === matchVal;
+      } catch {
+        return false;
+      }
+    }
+    case "internal_host":
+      return isInternalHost(strValue);
+    case "quotes":
+    // engine-php exposes `inline_js_xss` as an alias of `quotes`.
+    case "inline_js_xss":
+      return /['"]/.test(strValue);
+    case "inline_xss":
+      return /['"]/.test(strValue) && /[>=]/.test(strValue);
+    case "ctype_special": {
+      const stripped = strValue.replace(/[ _\-,]/g, "");
+      return ctypeResult(strValue, /^[\w$€-￿]*$/.test(stripped), matchVal);
+    }
+    case "array_key_value":
+      return arrayKeyValue(value, matchObj);
+    // file_contains (uploaded-file content scanning) is NOT WordPress-specific, but is
+    // not yet implemented in the JS engine (needs multipart body access). Kept as an
+    // explicit, documented no-match rather than silently hitting `default`.
+    case "file_contains":
+      return false;
+    // WordPress-only match types (current_user_cannot, general_xss, getShortcodeAtts,
+    // getBlockAtts) have been removed: they depend on WP capabilities, wp_kses_post, and
+    // the shortcode/block parsers, and have no meaning in a JS app. They now fall through
+    // here and are reported once instead of pretending to be a no-match.
+    default:
+      warnUnsupportedMatchType(type);
+      return false;
+  }
+}
+var RuleEngine = class {
+  #rules;
+  #whitelists;
+  #whitelistKeys;
+  #onError;
+  #reportedErrors = /* @__PURE__ */ new Set();
+  constructor({ firewall = [], whitelists = [], whitelist_keys = {}, onError } = {}) {
+    this.#rules = firewall;
+    this.#whitelists = whitelists;
+    this.#whitelistKeys = whitelist_keys;
+    this.#onError = onError;
+    if (Array.isArray(whitelists) && whitelists.some((w) => w && Array.isArray(w.rule_v2) && !w.rule_id)) {
+      warnOnce2(
+        "whitelist-no-rule-id",
+        "[patchstack] a whitelist has no `rule_id` \u2014 it suppresses ALL rules when it matches. Scope each whitelist to a specific rule_id, and key it only on values an attacker cannot set."
+      );
+    }
+    if (whitelist_keys && typeof whitelist_keys === "object" && Object.keys(whitelist_keys).length > 0) {
+      warnOnce2("whitelist-keys-unimplemented", "[patchstack] `whitelist_keys` is not implemented and has no effect.");
+    }
+  }
+  // A mitigation engine must never take down the app it protects: any error while
+  // evaluating a rule is reported and the request is allowed through (fail open). A
+  // malformed rule is skipped without aborting the rest of the ruleset.
+  #reportError(err) {
+    if (this.#onError) {
+      this.#onError(err);
+      return;
+    }
+    const key = err && err.message ? err.message : String(err);
+    if (this.#reportedErrors.has(key)) {
+      return;
+    }
+    this.#reportedErrors.add(key);
+    console.error("[patchstack] rule evaluation error (rule skipped, request allowed):", err);
+  }
+  evaluate(req) {
+    let normalizedReq;
+    let resolver;
+    try {
+      normalizedReq = { ...req, ...normalizeRequest(req) };
+      resolver = new RequestResolver(normalizedReq);
+    } catch (err) {
+      this.#reportError(err);
+      return { blocked: false, rule: null, message: null };
+    }
+    for (const rule of this.#rules) {
+      try {
+        if (rule.when && !ruleAppliesTo(rule.when, resolver)) {
+          continue;
+        }
+        const conditions = rule.rule_v2;
+        if (!Array.isArray(conditions) || conditions.length === 0) {
+          continue;
+        }
+        if (this.#evaluateRule(conditions, resolver)) {
+          if (this.#isWhitelisted(normalizedReq, rule)) {
+            continue;
+          }
+          return {
+            blocked: true,
+            rule,
+            message: rule.message ?? `Blocked by Patchstack WAF rule: ${rule.title ?? rule.id}`
+          };
+        }
+      } catch (err) {
+        this.#reportError(err);
+      }
+    }
+    return { blocked: false, rule: null, message: null };
+  }
+  #evaluateRule(conditions, resolver) {
+    const inclusiveConditions = conditions.filter((c) => c.inclusive);
+    const nonInclusiveConditions = conditions.filter((c) => !c.inclusive);
+    if (inclusiveConditions.length > 0) {
+      let inclusiveHits = 0;
+      for (const condition of inclusiveConditions) {
+        if (this.#evaluateCondition(condition, resolver)) {
+          inclusiveHits++;
+        }
+      }
+      if (inclusiveHits === inclusiveConditions.length) {
+        return true;
+      }
+    }
+    for (const condition of nonInclusiveConditions) {
+      if (this.#evaluateCondition(condition, resolver)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  #evaluateCondition(condition, resolver) {
+    const { parameter, match, mutations } = condition;
+    if (parameter === "rules" && Array.isArray(condition.rules)) {
+      return this.#evaluateRule(condition.rules, resolver);
+    }
+    if (match && match.type === "cross_origin") {
+      return isCrossOrigin(resolver);
+    }
+    if (match && match.type === "off_origin") {
+      return isOffOriginRedirect(resolver);
+    }
+    if (match && match.type === "cors_reflected") {
+      return isReflectedCorsWithCredentials(resolver);
+    }
+    const params = Array.isArray(parameter) ? parameter : [parameter];
+    const values = params.flatMap((p) => resolver.resolve(p));
+    if (values.length === 0) {
+      return false;
+    }
+    for (let value of values) {
+      if (mutations) {
+        value = resolver.applyMutations(mutations, value);
+      }
+      if (match.type === "array_key_value") {
+        if (matchValue(match.type, value, match.value, match)) {
+          return true;
+        }
+        continue;
+      }
+      if (typeof value === "object" && value !== null) {
+        if (WHOLE_VALUE_MATCH_TYPES.has(match.type)) {
+          if (matchValue(match.type, value, match.value, match)) return true;
+        } else {
+          for (const leaf of collectLeafValues(value)) {
+            if (matchValue(match.type, leaf, match.value, match)) return true;
+          }
+        }
+        continue;
+      }
+      if (matchValue(match.type, value, match.value, match)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  #isWhitelisted(req, rule) {
+    if (!this.#whitelists || this.#whitelists.length === 0) {
+      return false;
+    }
+    for (const whitelist of this.#whitelists) {
+      if (!Array.isArray(whitelist.rule_v2)) {
+        continue;
+      }
+      if (whitelist.rule_id && whitelist.rule_id !== rule.id) {
+        continue;
+      }
+      const resolver = new RequestResolver(req);
+      if (this.#evaluateRule(whitelist.rule_v2, resolver)) {
+        return true;
+      }
+    }
+    return false;
+  }
+};
+
+// src/pulse-token.ts
+var TOKEN_SKEW_MS = 6e4;
+function buildTokenUrl(manifestEndpoint) {
+  const url = new URL(manifestEndpoint);
+  const path = url.pathname.replace(/\/$/, "");
+  url.pathname = path.endsWith("/manifest") ? `${path.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function parsePulseAuth(credential) {
+  const index = credential.lastIndexOf("-");
+  if (index <= 0 || index === credential.length - 1) return null;
+  const clientId = credential.slice(index + 1);
+  if (!/^\d+$/.test(clientId)) return null;
+  return { clientId, clientSecret: credential.slice(0, index) };
+}
+var cached = null;
+var inflight = null;
+async function getPulseToken(config, fetchImpl = fetch) {
+  if (typeof config.pulseAuth !== "string" || config.pulseAuth.length === 0) return null;
+  if (cached !== null && Date.now() < cached.expiresAt - TOKEN_SKEW_MS) {
+    return cached.token;
+  }
+  if (inflight !== null) return inflight;
+  const credentials = parsePulseAuth(config.pulseAuth);
+  if (credentials === null) return null;
+  inflight = (async () => {
+    try {
+      const response = await fetchImpl(buildTokenUrl(config.endpoint), {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "application/json",
+          "User-Agent": "@patchstack/connect"
+        },
+        body: JSON.stringify({
+          grant_type: "client_credentials",
+          client_id: credentials.clientId,
+          client_secret: credentials.clientSecret
+        }),
+        signal: AbortSignal.timeout(config.timeoutMs)
+      });
+      if (!response.ok) return null;
+      const body = await response.json();
+      if (typeof body.access_token !== "string" || body.access_token.length === 0) return null;
+      const expiresIn = Number(body.expires_in);
+      const ttlMs = Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn * 1e3 : 36e5;
+      cached = { token: body.access_token, expiresAt: Date.now() + ttlMs };
+      return body.access_token;
+    } catch {
+      return null;
+    } finally {
+      inflight = null;
+    }
+  })();
+  return inflight;
+}
+async function pulseAuthHeader(config, fetchImpl = fetch) {
+  const token = await getPulseToken(config, fetchImpl);
+  return token === null ? {} : { Authorization: `Bearer ${token}` };
+}
+
+// src/protect/engine/pulse-client.js
+var DEFAULT_BASE_URL2 = "https://api.patchstack.com/monitor/pulse";
+var DEFAULT_CACHE_TTL2 = 3e5;
+var JITTER_FRACTION2 = 0.1;
+var PulseRuleClient = class {
+  #siteUuid;
+  #timeoutMs;
+  #baseUrl;
+  #cacheTtl;
+  #cache = null;
+  #cacheTime = null;
+  #ttlEffective = 0;
+  #etag;
+  #pulseAuth;
+  constructor({ siteUuid, baseUrl, cacheTtl, etag, timeoutMs, pulseAuth } = {}) {
+    this.#timeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 3e4;
+    this.#siteUuid = siteUuid ?? process.env.PATCHSTACK_SITE_UUID;
+    this.#baseUrl = safeBaseUrl(baseUrl ?? process.env.PATCHSTACK_PULSE_RULES_URL, DEFAULT_BASE_URL2, "rule endpoint");
+    this.#cacheTtl = Number.isFinite(cacheTtl) && cacheTtl > 0 ? cacheTtl : DEFAULT_CACHE_TTL2;
+    this.#etag = etag ?? null;
+    this.#pulseAuth = pulseAuth ?? null;
+    if (!this.#siteUuid) {
+      throw new Error("Patchstack site UUID is required. Pass { siteUuid } or set PATCHSTACK_SITE_UUID.");
+    }
+  }
+  async getRules() {
+    const now = Date.now();
+    if (this.#cache && this.#cacheTime !== null && now - this.#cacheTime < this.#ttlEffective) {
+      return this.#cache;
+    }
+    const url = `${this.#baseUrl}/rules/${encodeURIComponent(this.#siteUuid)}`;
+    try {
+      const headers = {
+        Accept: "application/json",
+        ...await pulseAuthHeader(
+          { pulseAuth: this.#pulseAuth, endpoint: this.#baseUrl, timeoutMs: this.#timeoutMs },
+          fetch
+        )
+      };
+      if (this.#etag) headers["If-None-Match"] = this.#etag;
+      const response = await fetch(url, { method: "GET", headers, signal: AbortSignal.timeout(this.#timeoutMs) });
+      if (response.status === 304) {
+        this.#touch(now);
+        return this.#cache ?? { success: true, notModified: true, etag: this.#etag, firewall: [], whitelists: [], whitelist_keys: {} };
+      }
+      if (!response.ok) {
+        return { success: false, error: `API returned ${response.status}`, firewall: [], whitelists: [], whitelist_keys: {} };
+      }
+      const data = await response.json();
+      if (!data || !Array.isArray(data.firewall)) {
+        return { success: false, error: "unexpected response shape (no firewall array)", firewall: [], whitelists: [], whitelist_keys: {} };
+      }
+      const result = {
+        success: true,
+        notModified: false,
+        etag: response.headers?.get?.("etag") ?? null,
+        firewall: data.firewall,
+        whitelists: Array.isArray(data.whitelists) ? data.whitelists : [],
+        whitelist_keys: data.whitelist_keys ?? {},
+        ...enforcementField(data)
+      };
+      this.#cache = result;
+      this.#etag = result.etag;
+      this.#touch(now);
+      return result;
+    } catch (err) {
+      return {
+        success: false,
+        error: err.name === "TimeoutError" ? "Request timed out" : err.message,
+        firewall: [],
+        whitelists: [],
+        whitelist_keys: {}
+      };
+    }
+  }
+  #touch(now) {
+    this.#cacheTime = now;
+    this.#ttlEffective = this.#cacheTtl - Math.floor(Math.random() * this.#cacheTtl * JITTER_FRACTION2);
+  }
+  clearCache() {
+    this.#cache = null;
+    this.#cacheTime = null;
+    this.#etag = null;
+  }
+};
+function enforcementField(data) {
+  if (!data || typeof data !== "object") return {};
+  const v = data.enforcement ?? data.mode;
+  return v === "block" || v === "dry-run" ? { enforcement: v } : {};
+}
+
+// src/protect/engine/fetch.js
+var MAX_BODY_BYTES = 1024 * 1024;
+async function fromFetchRequest(request, options = {}) {
+  const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;
+  const url = new URL(request.url);
+  const method = (request.method || "GET").toUpperCase();
+  const headers = {};
+  request.headers.forEach((value, key) => {
+    headers[key.toLowerCase()] = value;
+  });
+  const query = {};
+  for (const [key, value] of url.searchParams) {
+    if (key in query) {
+      query[key] = Array.isArray(query[key]) ? [...query[key], value] : [query[key], value];
+    } else {
+      query[key] = value;
+    }
+  }
+  let rawBody = "";
+  if (method !== "GET" && method !== "HEAD") {
+    rawBody = await readCappedText(request, maxBodyBytes);
+  }
+  const contentType = headers["content-type"] || "";
+  let body = {};
+  let files;
+  if (rawBody) {
+    const parsed = parseBody(rawBody, contentType);
+    body = parsed.body;
+    files = parsed.files;
+  }
+  const uri = url.pathname + url.search;
+  const forwarded = headers["cf-connecting-ip"] || headers["x-forwarded-for"] || headers["x-real-ip"] || "";
+  return {
+    method,
+    url: uri,
+    originalUrl: uri,
+    query,
+    body,
+    files,
+    headers,
+    ip: forwarded.split(",")[0].trim(),
+    cookies: parseCookies(headers.cookie),
+    // Verbatim body text: preserves literal keys (e.g. `__proto__`) that JSON.stringify
+    // drops, so prototype-pollution rules on `raw` are robust.
+    _rawBody: rawBody
+  };
+}
+async function readCappedText(request, max) {
+  let clone;
+  try {
+    clone = request.clone();
+  } catch {
+    return "";
+  }
+  const body = clone.body;
+  if (body && typeof body.getReader === "function") {
+    const reader = body.getReader();
+    const chunks = [];
+    let buffered = 0;
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        if (!value || buffered >= max) continue;
+        const take = Math.min(value.byteLength, max - buffered);
+        chunks.push(take === value.byteLength ? value : value.subarray(0, take));
+        buffered += take;
+      }
+    } catch {
+      return "";
+    }
+    try {
+      return new TextDecoder().decode(concatChunks(chunks, buffered));
+    } catch {
+      return "";
+    }
+  }
+  try {
+    const text = await clone.text();
+    return text.length > max ? text.slice(0, max) : text;
+  } catch {
+    return "";
+  }
+}
+function concatChunks(chunks, total) {
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    out.set(c, offset);
+    offset += c.byteLength;
+  }
+  return out;
+}
+function parseBody(rawBody, contentType) {
+  const ct = String(contentType || "").toLowerCase();
+  const isJson = ct.includes("application/json") || /\+json\b/.test(ct);
+  const isForm = ct.includes("application/x-www-form-urlencoded");
+  const isMultipart = ct.includes("multipart/form-data");
+  const isAmbiguous = ct === "" || ct.startsWith("text/plain") || ct.includes("csp-report") || ct.includes("/json");
+  if (isMultipart) {
+    const boundary = /boundary=("?)([^";]+)\1/i.exec(contentType)?.[2];
+    if (boundary) return parseMultipart(rawBody, boundary);
+    return { body: {}, files: void 0 };
+  }
+  if (isForm) {
+    const body = {};
+    for (const [k, v] of new URLSearchParams(rawBody)) body[k] = k in body ? [].concat(body[k], v) : v;
+    return { body, files: void 0 };
+  }
+  if (isJson || isAmbiguous) {
+    try {
+      const parsed = JSON.parse(rawBody);
+      if (parsed && typeof parsed === "object") return { body: parsed, files: void 0 };
+    } catch {
+    }
+  }
+  return { body: {}, files: void 0 };
+}
+function parseMultipart(rawBody, boundary) {
+  const body = {};
+  const files = {};
+  for (const part of rawBody.split("--" + boundary)) {
+    const sep = /\r?\n\r?\n/.exec(part);
+    if (!sep) continue;
+    const rawHeaders = part.slice(0, sep.index);
+    const disposition = /content-disposition:[^\r\n]*/i.exec(rawHeaders)?.[0];
+    if (!disposition) continue;
+    const name = /name="([^"]*)"/i.exec(disposition)?.[1];
+    if (name == null) continue;
+    const content = part.slice(sep.index + sep[0].length).replace(/\r?\n$/, "");
+    const filename = /filename="([^"]*)"/i.exec(disposition)?.[1];
+    if (filename !== void 0) {
+      const partType = /content-type:\s*([^\r\n;]+)/i.exec(rawHeaders)?.[1]?.trim() || "";
+      const file = { filename, type: partType, content };
+      files[name] = name in files ? [].concat(files[name], file) : file;
+    } else {
+      body[name] = name in body ? [].concat(body[name], content) : content;
+    }
+  }
+  return { body, files };
+}
+function parseCookies(header) {
+  const cookies = {};
+  if (!header) {
+    return cookies;
+  }
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) {
+      continue;
+    }
+    cookies[pair.slice(0, idx).trim()] = pair.slice(idx + 1).trim();
+  }
+  return cookies;
+}
+
+// src/protect/engine/node.js
+function fromNodeRequest(req, rawBody = "") {
+  const method = (req.method || "GET").toUpperCase();
+  const headers = {};
+  for (const [key, value] of Object.entries(req.headers || {})) {
+    headers[key.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;
+  }
+  const host = headers.host || "localhost";
+  let url;
+  try {
+    url = new URL(req.url || "/", `http://${host}`);
+  } catch {
+    try {
+      url = new URL(req.url || "/", "http://localhost");
+    } catch {
+      url = new URL("http://localhost/");
+    }
+  }
+  const query = {};
+  for (const [key, value] of url.searchParams) {
+    if (key in query) {
+      query[key] = Array.isArray(query[key]) ? [...query[key], value] : [query[key], value];
+    } else {
+      query[key] = value;
+    }
+  }
+  const contentType = headers["content-type"] || "";
+  let body = {};
+  let files;
+  if (rawBody) {
+    const parsed = parseBody(rawBody, contentType);
+    body = parsed.body;
+    files = parsed.files;
+  }
+  const uri = url.pathname + url.search;
+  const forwarded = headers["cf-connecting-ip"] || headers["x-forwarded-for"] || headers["x-real-ip"] || "";
+  return {
+    method,
+    url: uri,
+    originalUrl: uri,
+    query,
+    body,
+    files,
+    headers,
+    ip: forwarded.split(",")[0].trim() || req.socket && req.socket.remoteAddress || "",
+    cookies: parseCookies2(headers.cookie),
+    // Verbatim body text: preserves literal keys (e.g. `__proto__`) that JSON.stringify drops.
+    _rawBody: rawBody
+  };
+}
+function parseCookies2(header) {
+  const cookies = {};
+  if (!header) {
+    return cookies;
+  }
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) {
+      continue;
+    }
+    cookies[pair.slice(0, idx).trim()] = pair.slice(idx + 1).trim();
+  }
+  return cookies;
+}
+
+// src/protect/egress.js
+async function installEgressGuard({ shouldBlock, onBlock, onSkip, dnsScreen = true, lookup, allowHosts } = {}) {
+  const restores = [];
+  if (typeof shouldBlock !== "function") return () => {
+  };
+  const exempt = new Set((allowHosts ?? []).map((h) => String(h).toLowerCase()));
+  const block = (url, host, method) => {
+    if (!shouldBlock(url, host, method)) return false;
+    onBlock?.({ url, host, method });
+    return true;
+  };
+  let screen = null;
+  if (dnsScreen) {
+    try {
+      const resolveLookup = lookup ?? (await Promise.resolve().then(() => __toESM(require_ps_edge_stub(), 1))).lookup;
+      const { isIP } = await Promise.resolve().then(() => __toESM(require_ps_edge_stub(), 1));
+      if (typeof resolveLookup === "function" && typeof isIP === "function") {
+        screen = { lookup: resolveLookup, isIP, isExempt: (h) => exempt.has(String(h).toLowerCase()) };
+      }
+    } catch {
+      screen = null;
+    }
+  }
+  const skip = (reason, detail) => {
+    try {
+      onSkip?.({ phase: "egress", reason, detail });
+    } catch {
+    }
+  };
+  const resolvesToDisallowed = (url, host, method) => new Promise((resolve) => {
+    if (!screen) {
+      if (host && dnsScreen) skip("resolver-unavailable", { host });
+      return resolve(false);
+    }
+    if (!host || screen.isIP(host) !== 0 || screen.isExempt(host)) return resolve(false);
+    try {
+      screen.lookup(host, { all: true }, (err, addresses) => {
+        if (err || !Array.isArray(addresses)) {
+          skip("resolver-failed", { host });
+          return resolve(false);
+        }
+        for (const a of addresses) {
+          const ip = a && typeof a === "object" ? a.address : a;
+          if (ip && block(url, ip, method)) return resolve(true);
+        }
+        resolve(false);
+      });
+    } catch {
+      skip("resolver-failed", { host });
+      resolve(false);
+    }
+  });
+  const originalFetch = globalThis.fetch;
+  if (typeof originalFetch === "function" && !originalFetch.__patchstackGuarded) {
+    const REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+    const MAX_REDIRECTS = 20;
+    const screenUrl = async (u, method) => {
+      let host = null;
+      try {
+        host = new URL(u).hostname;
+      } catch {
+        host = null;
+      }
+      if (block(u, host, method) || await resolvesToDisallowed(u, host, method)) {
+        throw new Error(`Patchstack blocked an outbound request to a disallowed address: ${host ?? u}`);
+      }
+    };
+    const guarded = async (input, init) => {
+      let cur;
+      try {
+        cur = new Request(input, { ...init || {}, redirect: "manual" });
+      } catch {
+        return originalFetch(input, init);
+      }
+      const callerRedirect = init && init.redirect || input && input.redirect || "follow";
+      let url = cur.url;
+      let method = cur.method;
+      await screenUrl(url, method);
+      if (callerRedirect !== "follow") return originalFetch(input, init);
+      const headers = new Headers(cur.headers);
+      const signal = cur.signal;
+      let body = method === "GET" || method === "HEAD" ? void 0 : await cur.clone().arrayBuffer();
+      for (let hop = 0; ; hop++) {
+        const resp = await originalFetch(
+          hop === 0 ? cur : new Request(url, { method, headers, body, redirect: "manual", signal })
+        );
+        const location = REDIRECT_STATUSES.has(resp.status) ? resp.headers.get("location") : null;
+        if (!location) return resp;
+        if (hop >= MAX_REDIRECTS) throw new Error("Patchstack blocked an outbound request: too many redirects");
+        const next = new URL(location, url).href;
+        if (resp.status === 303 || (resp.status === 301 || resp.status === 302) && method === "POST") {
+          method = "GET";
+          body = void 0;
+          headers.delete("content-type");
+          headers.delete("content-length");
+        }
+        if (new URL(next).origin !== new URL(url).origin) {
+          headers.delete("authorization");
+          headers.delete("cookie");
+        }
+        await screenUrl(next, method);
+        url = next;
+      }
+    };
+    guarded.__patchstackGuarded = true;
+    globalThis.fetch = guarded;
+    restores.push(() => {
+      if (globalThis.fetch === guarded) globalThis.fetch = originalFetch;
+    });
+  }
+  for (const moduleName of ["node:http", "node:https"]) {
+    try {
+      const mod = await import(moduleName);
+      const restore = patchHttpModule(mod.default ?? mod, block, screen);
+      if (restore) restores.push(restore);
+    } catch {
+    }
+  }
+  return () => {
+    for (const restore of restores) {
+      try {
+        restore();
+      } catch {
+      }
+    }
+  };
+}
+function patchHttpModule(http, block, screen) {
+  if (!http || typeof http.request !== "function" || http.__patchstackGuarded) return null;
+  const originalRequest = http.request;
+  const originalGet = http.get;
+  const wrap = (original) => function(...args) {
+    const target = extractHttpTarget(args);
+    if (target && block(target.url, target.host, target.method)) {
+      throw new Error(`Patchstack blocked an outbound request to a disallowed address: ${target.host ?? target.url}`);
+    }
+    if (target && screen && target.host && screen.isIP(target.host) === 0 && !screen.isExempt(target.host)) {
+      try {
+        args = withScreeningLookup(args, target, block, screen.lookup);
+      } catch {
+      }
+    }
+    return original.apply(this, args);
+  };
+  const guardedRequest = wrap(originalRequest);
+  http.request = guardedRequest;
+  let guardedGet;
+  if (typeof originalGet === "function") {
+    guardedGet = wrap(originalGet);
+    http.get = guardedGet;
+  }
+  http.__patchstackGuarded = true;
+  return () => {
+    if (http.request === guardedRequest) http.request = originalRequest;
+    if (guardedGet && http.get === guardedGet) http.get = originalGet;
+    delete http.__patchstackGuarded;
+  };
+}
+function extractHttpTarget(args) {
+  const first = args[0];
+  try {
+    if (typeof first === "string" || first instanceof URL) {
+      const url = new URL(String(first));
+      const opts = args.find((a) => a && typeof a === "object" && !(a instanceof URL));
+      return { url: url.href, host: url.hostname, method: opts && opts.method || "GET" };
+    }
+    if (first && typeof first === "object") {
+      const host = normalizeHost(first.hostname || first.host) || "localhost";
+      const protocol = first.protocol || "http:";
+      const port = first.port ? `:${first.port}` : "";
+      const path = first.path || "/";
+      return { url: `${protocol}//${host}${port}${path}`, host, method: first.method || "GET" };
+    }
+  } catch {
+  }
+  return null;
+}
+function normalizeHost(raw) {
+  const host = String(raw || "").trim();
+  const bracketed = /^\[([^\]]+)\]/.exec(host);
+  if (bracketed) return bracketed[1];
+  if ((host.match(/:/g) || []).length > 1) return host;
+  return host.split(":")[0];
+}
+function screenResolved(addresses, target, block) {
+  for (const a of addresses || []) {
+    const ip = a && typeof a === "object" ? a.address : a;
+    if (ip && block(target.url, ip, target.method)) return ip;
+  }
+  return null;
+}
+function withScreeningLookup(args, target, block, lookup) {
+  const screeningLookup = (hostname, options, callback) => {
+    let opts = options;
+    let cb = callback;
+    if (typeof opts === "function") {
+      cb = opts;
+      opts = {};
+    }
+    if (!opts || typeof opts !== "object") opts = {};
+    try {
+      lookup(hostname, { ...opts, all: true }, (err, addresses) => {
+        if (err) return cb(err);
+        const list = Array.isArray(addresses) ? addresses : [];
+        const blocked = screenResolved(list, target, block);
+        if (blocked) {
+          return cb(new Error(`Patchstack blocked an outbound request to a disallowed address: ${target.host} resolved to ${blocked}`));
+        }
+        if (opts.all) return cb(null, list);
+        const first = list[0];
+        if (!first) return cb(new Error(`Patchstack: could not resolve ${hostname}`));
+        return cb(null, first.address, first.family);
+      });
+    } catch {
+      try {
+        lookup(hostname, opts, cb);
+      } catch {
+        cb(new Error(`Patchstack: lookup failed for ${hostname}`));
+      }
+    }
+  };
+  return injectLookupOption(args, screeningLookup);
+}
+function injectLookupOption(args, lookup) {
+  const first = args[0];
+  if (first && typeof first === "object" && !(first instanceof URL)) {
+    return [{ ...first, lookup }, ...args.slice(1)];
+  }
+  const rest = args.slice(1);
+  const optIdx = rest.findIndex((a) => a && typeof a === "object" && !(a instanceof URL));
+  if (optIdx !== -1) {
+    const next = [...rest];
+    next[optIdx] = { ...rest[optIdx], lookup };
+    return [first, ...next];
+  }
+  const cbIdx = rest.findIndex((a) => typeof a === "function");
+  if (cbIdx === -1) return [first, { lookup }, ...rest];
+  return [first, ...rest.slice(0, cbIdx), { lookup }, ...rest.slice(cbIdx)];
+}
+
+// src/protect/defaults.js
+var DEFAULT_RESPONSE_RULES = [
+  {
+    id: "resp-private-key",
+    title: "Private key in response body",
+    phase: "response",
+    category: "secret-exposure",
+    action: "redact",
+    prefilter: ["PRIVATE KEY"],
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/" } }]
+  },
+  {
+    id: "resp-aws-access-key",
+    title: "AWS access key id in response body",
+    phase: "response",
+    category: "secret-exposure",
+    action: "redact",
+    prefilter: ["AKIA", "ASIA"],
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\b(?:AKIA|ASIA)[0-9A-Z]{16}\\b/" } }]
+  },
+  {
+    id: "resp-gcp-api-key",
+    title: "Google API key in response body",
+    phase: "response",
+    category: "secret-exposure",
+    action: "redact",
+    prefilter: ["AIza"],
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\bAIza[0-9A-Za-z_-]{35}\\b/" } }]
+  },
+  {
+    id: "resp-vendor-api-key",
+    title: "Vendor API key / token in response body",
+    phase: "response",
+    category: "secret-exposure",
+    action: "redact",
+    // High-signal, prefix-anchored provider tokens that never legitimately appear in a response
+    // body: Stripe (sk_live_/rk_live_), GitHub (gh[opsu]_ / github_pat_), GitLab (glpat-),
+    // Slack (xox[baprs]-), Anthropic (sk-ant-), Google OAuth (ya29.), npm (npm_). Trailing
+    // (?![0-9A-Za-z]) instead of \\b since some tokens end in - / _ .
+    prefilter: ["sk_live_", "rk_live_", "ghp_", "gho_", "ghs_", "ghu_", "github_pat_", "glpat-", "xox", "sk-ant-", "ya29.", "npm_"],
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\b(?:sk_live_[0-9A-Za-z]{16,}|rk_live_[0-9A-Za-z]{16,}|gh[opsu]_[0-9A-Za-z]{36}|github_pat_[0-9A-Za-z_]{60,}|glpat-[0-9A-Za-z_-]{20,}|xox[baprs]-[0-9A-Za-z-]{10,}|sk-ant-[0-9A-Za-z_-]{20,}|ya29\\.[0-9A-Za-z_-]{20,}|npm_[0-9A-Za-z]{36})(?![0-9A-Za-z])/" } }]
+  },
+  {
+    id: "resp-jwt",
+    title: "JWT in response body",
+    phase: "response",
+    category: "secret-exposure",
+    action: "redact",
+    prefilter: ["eyJ"],
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\beyJ[A-Za-z0-9_-]{8,}\\.eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\b/" } }]
+  },
+  {
+    id: "resp-db-connection-string",
+    title: "Database connection string with credentials in response body",
+    phase: "response",
+    category: "secret-exposure",
+    action: "redact",
+    prefilter: ["mongodb", "postgres", "mysql", "redis", "amqp"],
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\b(?:mongodb(?:\\+srv)?|postgres(?:ql)?|mysql|redis|amqps?):\\/\\/[^\\s:@\\/]+:[^\\s:@\\/]+@/i" } }]
+  },
+  {
+    id: "resp-stack-trace",
+    title: "Node stack trace leaking in response body",
+    phase: "response",
+    category: "info-exposure",
+    action: "redact",
+    // No prefilter: a Node stack frame has no single distinctive literal (` at ` is too common to
+    // gate on). The pattern is linearly bounded per line, so it runs on every screened body.
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\n\\s+at\\s+.+\\(.+:\\d+:\\d+\\)/" } }]
+  },
+  {
+    id: "resp-sql-error",
+    title: "SQL / ORM error disclosure in response body",
+    phase: "response",
+    category: "info-exposure",
+    action: "redact",
+    prefilter: ["SQLSTATE", "Sequelize", "ER_", "ORA-", "PG::", "SQLITE_ERROR", "SQL syntax"],
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/(SQLSTATE\\[[0-9A-Z]+\\]|SequelizeDatabaseError|ER_[A-Z_]+|ORA-\\d{5}|PG::[A-Za-z]+Error|SQLITE_ERROR|You have an error in your SQL syntax)/i" } }]
+  },
+  {
+    id: "resp-exception-trace",
+    title: "Backend exception / stack trace disclosure in response body",
+    phase: "response",
+    category: "info-exposure",
+    action: "redact",
+    // Multi-language exception/traceback signatures a normal API response never carries:
+    // Python traceback, Java "Exception in thread", .NET System.*Exception, JVM stack frames,
+    // Go goroutine dumps. (Node `at fn (file:line:col)` frames are handled by resp-stack-trace.)
+    prefilter: ["Traceback", "Exception in thread", "System.", "goroutine ", ".java:", ".kt:", ".scala:", ".rb:", ".py:", ".cs:"],
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: '/(Traceback \\(most recent call last\\)|Exception in thread "|System\\.[A-Za-z.]+Exception|\\bat [\\w.$]+\\([\\w]+\\.(?:java|kt|scala|rb|py|cs):\\d+\\)|goroutine \\d+ \\[)/' } }]
+  }
+];
+var DEFAULT_EGRESS_RULES = [
+  {
+    id: "egress-internal-address",
+    title: "Outbound request to an internal / metadata address (SSRF)",
+    phase: "egress",
+    category: "ssrf",
+    rule_v2: [{ parameter: "egress.host", match: { type: "internal_host" } }]
+  }
+];
+
+// src/protect/block-page.js
+function escapeHtml(s) {
+  return String(s).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+function renderBlockPage({ url = "", code = "patchstack" } = {}) {
+  const safeUrl = escapeHtml(url);
+  const safeCode = escapeHtml(code || "patchstack");
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style type="text/css">
+		.access-denied,.site-url-text{letter-spacing:.01em;color:#fff}body{background:#111216}.main-container{display:flex;justify-content:center;flex-direction:column;align-items:center}.container{width:688px;height:456px;background:#1c1e22;border-radius:16px;margin-top:120px}.content{height:330px;margin:64px}.access-denied{font-family:Verdana;font-style:normal;font-weight:600;font-size:24px;line-height:32px;display:flex;align-items:center}.descp-text,.site-url{display:flex;align-items:center}.site-url{margin-top:32px;width:560px;height:64px;background:#26282c;border-radius:4px}.reason-code-text,.site-url-text{font-family:Verdana;font-style:normal;border:none;background:#26282c}.site-url-text{text-overflow: ellipsis;font-weight:400;font-size:16px;line-height:24px;margin-left:16px;width:85%}.copy-icon{width:19px;height:22px;margin-left:20px}.copy-icon:hover{cursor:pointer}.reason-code-text{font-weight:600;font-size:24px;line-height:32px;letter-spacing:.01em;color:#AFE614;margin-left:16px;width:85%}.descp-text,.return-text{font-size:16px;line-height:24px;letter-spacing:.01em;font-weight:400}.return-text:hover{color: #AFE614}.descp-text,.logoText,.return-text,.secured-text{font-family:Verdana;font-style:normal;color:#fff}.descp{margin-top:32px;width:560px}.bottom-second-containers,.bottom-text-containers{align-items:center;display:flex}.bottom-container{margin-top:40px;display:flex;width:688px}.bottom-second-containers{margin-left:auto}.arrow-vector{margin-left:20px}.return-text{text-align:center;margin-left:12.59px;text-decoration:none}.secured-text{font-weight:400;font-size:11.2px;line-height:16px;display:flex;align-items:center;letter-spacing:.02em;margin-right:8px}.logoText{font-weight:600;font-size:16px;line-height:24px;letter-spacing:.01em;flex:none;order:1;flex-grow:0}.patch-logo{width:120px}.mobile-bottom-container{margin-top:40px;width:372px;display:none}.mobile-bottom-second-containers{margin-top:64px;display:flex;margin-left:16.5px}@media only screen and (max-width:900px){.container{background:#111216;width:370px;height:auto;margin-top:0}.content{margin-left:16.5px}.descp,.site-url{width:340px}.site-url-text{font-weight:400;font-size:14.4px;line-height:20px;letter-spacing:.02em;width:80%}.copy-icon{margin-left:20px}.reason-code-text{font-size:16px;line-height:32px;letter-spacing:.02em;margin-left:16px;width:80%}.descp-text,.return-text{font-size:14.4px;line-height:20px}.descp-text{display:flex;align-items:center;letter-spacing:.02em}.bottom-container{display:none}.mobile-bottom-container{display:block}.return-text{text-align:center;letter-spacing:.01em;color:#fff;margin-left:9.73px}}
+    </style>
+    <title>Access Denied</title>
+</head>
+<body>
+    <div class="main-container">
+        <div class="container">
+            <div class="content">
+                <span class="access-denied">Access Denied</span>
+                <div class="site-url">
+                    <input id="url" class="site-url-text" type="text"
+                        value="${safeUrl}" readonly>
+                    <img class="copy-icon" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkiIGhlaWdodD0iMjMiIHZpZXdCb3g9IjAgMCAxOSAyMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0IDAuMDIzNDM3NUgwVjE2LjAyMzRIMlYyLjAyMzQ0SDE0VjAuMDIzNDM3NVpNMTkgNC4wMjM0NEg0VjIyLjAyMzRIMTlWNC4wMjM0NFpNMTcgMjAuMDIzNEg2VjYuMDIzNDRIMTdWMjAuMDIzNFoiIGZpbGw9IndoaXRlIi8+Cjwvc3ZnPgo=" alt="Copy Text" onmouseover="hover(this);" onmouseout="unhover(this);" onclick="copyText(id='url')">
+                </div>
+                <div class="site-url">
+                    <input id="response" class="reason-code-text" type="text" value="${safeCode}" readonly>
+                    <img class="copy-icon" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkiIGhlaWdodD0iMjMiIHZpZXdCb3g9IjAgMCAxOSAyMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0IDAuMDIzNDM3NUgwVjE2LjAyMzRIMlYyLjAyMzQ0SDE0VjAuMDIzNDM3NVpNMTkgNC4wMjM0NEg0VjIyLjAyMzRIMTlWNC4wMjM0NFpNMTcgMjAuMDIzNEg2VjYuMDIzNDRIMTdWMjAuMDIzNFoiIGZpbGw9IndoaXRlIi8+Cjwvc3ZnPgo=" alt="Copy Text" onmouseover="hover(this);" onmouseout="unhover(this);" onclick="copyText(id='response')">
+                </div>
+                <div class="descp">
+                    <span class="descp-text">This request has been blocked by Patchstack. If this message persists and you are a legitimate user, contact the site administrator with the reference above.</span>
+                </div>
+            </div>
+        </div>
+        <div class="bottom-container">
+            <div class="bottom-text-containers">
+                <img class="arrow-vector" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iOCIgaGVpZ2h0PSIxMyIgdmlld0JveD0iMCAwIDggMTMiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik03LjQxIDEuNDMzNDRMNiAwLjAyMzQzNzVMMCA2LjAyMzQ0TDYgMTIuMDIzNEw3LjQxIDEwLjYxMzRMMi44MyA2LjAyMzQ0TDcuNDEgMS40MzM0NFoiIGZpbGw9IiNBRkU2MTQiLz4KPC9zdmc+Cg==" alt="Arrow Left">
+                <a href="/" class="return-text">Return to homepage</a>
+            </div>
+            <div class="bottom-second-containers">
+                <span class="secured-text">This website is secured by</span>
+                <a href="https://patchstack.com" class="logoText">
+                    <img class="patch-logo" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTg0IiBoZWlnaHQ9IjIyIiB2aWV3Qm94PSIwIDAgMTg0IDIyIiBmaWxsPSJub25lIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTUwLjQwMDEgMTEuNTAwOEM1MC40MDAxIDkuMTAwNzggNDkuMzAwMSA4LjEwMDc4IDQ2LjYwMDEgOC4xMDA3OEM0NC4wMDAxIDguMTAwNzggNDIuNzAwMSA5LjIwMDc4IDQyLjcwMDEgMTEuNTAwOEM0Mi43MDAxIDEzLjgwMDggNDQuMDAwMSAxNC45MDA4IDQ2LjYwMDEgMTQuOTAwOEM0OS4zMDAxIDE0LjkwMDggNTAuNDAwMSAxMy44MDA4IDUwLjQwMDEgMTEuNTAwOFpNNTMuNDAwMSAxMS41MDA4QzUzLjQwMDEgMTUuMzAwOCA1MS4zMDAxIDE3LjYwMDggNDcuNDAwMSAxNy42MDA4QzQ1LjQwMDEgMTcuNjAwOCA0My42MDAxIDE2LjUwMDggNDIuNzAwMSAxNC41MDA4VjIxLjUwMDhIMzkuNjAwMVY1LjYwMDc4SDQyLjcwMDFWOC41MDA3OEM0My42MDAxIDYuNTAwNzggNDUuNDAwMSA1LjMwMDc4IDQ3LjUwMDEgNS4zMDA3OEM1MS40MDAxIDUuMzAwNzggNTMuNDAwMSA3LjcwMDc4IDUzLjQwMDEgMTEuNTAwOFoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNNjYuNDAwMSAxMS40OTg0QzY2LjQwMDEgOS4xOTg0NCA2NS4xMDAxIDguMDk4NDQgNjIuNTAwMSA4LjA5ODQ0QzU5LjgwMDEgOC4wOTg0NCA1OC43MDAxIDkuMDk4NDQgNTguNzAwMSAxMS40OTg0QzU4LjcwMDEgMTMuNzk4NCA1OS44MDAxIDE0Ljg5ODQgNjIuNTAwMSAxNC44OTg0QzY1LjEwMDEgMTQuODk4NCA2Ni40MDAxIDEzLjc5ODQgNjYuNDAwMSAxMS40OTg0Wk02Ni4zMDAxIDUuNTk4NDRINjkuNDAwMVYxNy4zOTg0SDY2LjMwMDFWMTQuNDk4NEM2NS40MDAxIDE2LjQ5ODQgNjMuNzAwMSAxNy42OTg0IDYxLjYwMDEgMTcuNjk4NEM1Ny43MDAxIDE3LjY5ODQgNTUuNjAwMSAxNS4yOTg0IDU1LjYwMDEgMTEuNTk4NEM1NS42MDAxIDcuNzk4NDQgNTcuNjAwMSA1LjM5ODQ0IDYxLjQwMDEgNS4zOTg0NEM2My41MDAxIDUuMzk4NDQgNjUuNDAwMSA2LjU5ODQ0IDY2LjIwMDEgOC41OTg0NFY1LjU5ODQ0SDY2LjMwMDFaIiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTgxLjM5OTkgOC4zSDc3LjM5OTlWMTQuN0g4MS4wOTk5VjE3LjRINzcuOTk5OUM3NS43OTk5IDE3LjQgNzQuMjk5OSAxNS45IDc0LjI5OTkgMTMuN1Y4LjNINzEuMzk5OVY1LjZINzQuMjk5OVYySDc3LjM5OTlWNS41SDgxLjM5OTlWOC4zWiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik05My42OTk5IDEyLjIwMDhMOTYuNjk5OSAxMi45MDA4Qzk1Ljk5OTkgMTYuMDAwOCA5My42OTk5IDE3LjYwMDggODkuOTk5OSAxNy42MDA4Qzg3Ljc5OTkgMTcuNjAwOCA4Ni4wOTk5IDE3LjAwMDggODQuNzk5OSAxNS45MDA4QzgzLjQ5OTkgMTQuODAwOCA4Mi44OTk5IDEzLjMwMDggODIuODk5OSAxMS41MDA4QzgyLjg5OTkgOS42MDA3OCA4My40OTk5IDguMTAwNzggODQuNzk5OSA3LjAwMDc4Qzg2LjA5OTkgNS45MDA3OCA4Ny43OTk5IDUuMzAwNzggODkuOTk5OSA1LjMwMDc4QzkzLjY5OTkgNS4zMDA3OCA5NS45OTk5IDYuOTAwNzggOTYuNjk5OSAxMC4wMDA4TDkzLjY5OTkgMTAuNzAwOEM5My4yOTk5IDguODAwNzggOTIuMjk5OSA4LjEwMDc4IDg5Ljg5OTkgOC4xMDA3OEM4Ni45OTk5IDguMTAwNzggODUuODk5OSA5LjIwMDc4IDg1Ljg5OTkgMTEuNTAwOEM4NS44OTk5IDEzLjgwMDggODYuOTk5OSAxNC45MDA4IDg5Ljg5OTkgMTQuOTAwOEM5Mi4yOTk5IDE0LjkwMDggOTMuMjk5OSAxNC4yMDA4IDkzLjY5OTkgMTIuMjAwOFoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTExLjggMTAuNlYxNy40SDEwOC43VjExLjJDMTA4LjcgOSAxMDcuOCA4LjEgMTA1LjkgOC4xQzEwMy42IDguMSAxMDIuNCA5LjMgMTAyLjQgMTEuN1YxNy4zSDk5LjI5OThWMC41SDEwMi40VjguM0MxMDMuMSA2LjMgMTA0LjYgNS4zIDEwNyA1LjNDMTEwLjIgNS4zIDExMS44IDcuMSAxMTEuOCAxMC42WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xMTQuMSAxNC4wOTg0TDExNy4xIDEzLjI5ODRDMTE3LjQgMTQuNzk4NCAxMTguMyAxNS4yOTg0IDEyMC4yIDE1LjI5ODRDMTIxLjggMTUuMjk4NCAxMjIuNyAxNC44OTg0IDEyMi43IDE0LjA5ODRDMTIyLjcgMTMuMjk4NCAxMjIuMiAxMi45OTg0IDEyMC42IDEyLjc5ODRMMTE4LjIgMTIuNDk4NEMxMTUuOSAxMi4xOTg0IDExNC41IDEwLjg5ODQgMTE0LjUgOC45OTg0NEMxMTQuNSA2Ljc5ODQ0IDExNi41IDUuMzk4NDQgMTE5LjggNS4zOTg0NEMxMjMuMSA1LjM5ODQ0IDEyNSA2LjY5ODQ0IDEyNS41IDguODk4NDRMMTIyLjUgOS41OTg0NEMxMjIuMyA4LjA5ODQ0IDEyMS41IDcuNjk4NDQgMTE5LjkgNy42OTg0NEMxMTguNCA3LjY5ODQ0IDExNy42IDguMDk4NDQgMTE3LjYgOC44OTg0NEMxMTcuNiA5LjU5ODQ0IDExOC4xIDkuOTk4NDQgMTE5LjMgMTAuMDk4NEwxMjIuMiAxMC40OTg0QzEyNC40IDEwLjc5ODQgMTI1LjggMTEuOTk4NCAxMjUuOCAxMy44OTg0QzEyNS44IDE2LjI5ODQgMTIzLjcgMTcuNzk4NCAxMjAuMSAxNy43OTg0QzExNi43IDE3LjU5ODQgMTE0LjUgMTYuMTk4NCAxMTQuMSAxNC4wOTg0WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xMzYuNyA4LjNIMTMyLjdWMTQuN0gxMzYuNFYxNy40SDEzMy4zQzEzMS4xIDE3LjQgMTI5LjYgMTUuOSAxMjkuNiAxMy43VjguM0gxMjYuN1Y1LjZIMTI5LjZWMkgxMzIuN1Y1LjVIMTM2LjdWOC4zWiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xNDkuMiAxMS40OTg0QzE0OS4yIDkuMTk4NDQgMTQ3LjkgOC4wOTg0NCAxNDUuMyA4LjA5ODQ0QzE0Mi42IDguMDk4NDQgMTQxLjUgOS4wOTg0NCAxNDEuNSAxMS40OTg0QzE0MS41IDEzLjc5ODQgMTQyLjYgMTQuODk4NCAxNDUuMyAxNC44OTg0QzE0Ny45IDE0Ljg5ODQgMTQ5LjIgMTMuNzk4NCAxNDkuMiAxMS40OTg0Wk0xNDkuMSA1LjU5ODQ0SDE1Mi4yVjE3LjM5ODRIMTQ5LjFWMTQuNDk4NEMxNDguMiAxNi40OTg0IDE0Ni41IDE3LjY5ODQgMTQ0LjQgMTcuNjk4NEMxNDAuNSAxNy42OTg0IDEzOC40IDE1LjI5ODQgMTM4LjQgMTEuNTk4NEMxMzguNCA3Ljc5ODQ0IDE0MC40IDUuMzk4NDQgMTQ0LjIgNS4zOTg0NEMxNDYuMyA1LjM5ODQ0IDE0OC4yIDYuNTk4NDQgMTQ5IDguNTk4NDRWNS41OTg0NEgxNDkuMVoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTY1LjYgMTIuMjAwOEwxNjguNiAxMi45MDA4QzE2Ny45IDE2LjAwMDggMTY1LjYgMTcuNjAwOCAxNjEuOSAxNy42MDA4QzE1OS43IDE3LjYwMDggMTU4IDE3LjAwMDggMTU2LjcgMTUuOTAwOEMxNTUuNCAxNC44MDA4IDE1NC44IDEzLjMwMDggMTU0LjggMTEuNTAwOEMxNTQuOCA5LjYwMDc4IDE1NS40IDguMTAwNzggMTU2LjcgNy4wMDA3OEMxNTggNS45MDA3OCAxNTkuNyA1LjMwMDc4IDE2MS45IDUuMzAwNzhDMTY1LjYgNS4zMDA3OCAxNjcuOSA2LjkwMDc4IDE2OC42IDEwLjAwMDhMMTY1LjYgMTAuNzAwOEMxNjUuMiA4LjgwMDc4IDE2NC4yIDguMTAwNzggMTYxLjggOC4xMDA3OEMxNTguOSA4LjEwMDc4IDE1Ny44IDkuMjAwNzggMTU3LjggMTEuNTAwOEMxNTcuOCAxMy44MDA4IDE1OC45IDE0LjkwMDggMTYxLjggMTQuOTAwOEMxNjQuMSAxNC45MDA4IDE2NS4xIDE0LjIwMDggMTY1LjYgMTIuMjAwOFoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTgwLjI1NyAxNy40TDE3Ni42NTcgMTIuM0wxNzQuMTU3IDE0LjZWMTcuNEgxNzEuMTU3VjAuNUgxNzQuMTU3VjExLjFMMTc5Ljg1NyA1LjZIMTgzLjc1N0wxNzguNTU3IDEwLjVMMTgzLjk1NyAxNy40SDE4MC4yNTdaIiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTAgMjEuNTAwOEg3LjNWMTYuMzAwOEgwVjIxLjUwMDhaIiBmaWxsPSIjQUZFNjE0Ii8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNNy4yOTk4IDIxLjUwMDhIMTQuNTk5OFYxNi4zMDA4SDcuMjk5OFYyMS41MDA4WiIgZmlsbD0iIzZFQkUwMCIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTE0LjYwMDEgMTYuM0gyOS4yMDAxVjAuNUgxNC42MDAxVjE2LjNaIiBmaWxsPSIjQUZFNjE0Ii8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMCAxMUgxNC42VjAuNUgwVjExWiIgZmlsbD0iIzZFQkUwMCIvPgo8L3N2Zz4K" alt="Patchstack Logo">
+				</a>
+            </div>
+        </div>
+    
+        <div class="mobile-bottom-container">
+            <div class="mobile-bottom-text-containers">
+                <img class="arrow-vector" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iOCIgaGVpZ2h0PSIxMyIgdmlld0JveD0iMCAwIDggMTMiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxwYXRoIGQ9Ik03LjQxIDEuNDMzNDRMNiAwLjAyMzQzNzVMMCA2LjAyMzQ0TDYgMTIuMDIzNEw3LjQxIDEwLjYxMzRMMi44MyA2LjAyMzQ0TDcuNDEgMS40MzM0NFoiIGZpbGw9IiNBRkU2MTQiLz4KPC9zdmc+Cg==" alt="Arrow Left">
+                <a href="/" class="return-text">Return to homepage</a>
+            </div>
+            <div class="mobile-bottom-second-containers">
+                <span class="secured-text">This website is secured by</span>
+                <a href="https://patchstack.com" class="logoText">
+                    <img class="patch-logo" src="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTg0IiBoZWlnaHQ9IjIyIiB2aWV3Qm94PSIwIDAgMTg0IDIyIiBmaWxsPSJub25lIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTUwLjQwMDEgMTEuNTAwOEM1MC40MDAxIDkuMTAwNzggNDkuMzAwMSA4LjEwMDc4IDQ2LjYwMDEgOC4xMDA3OEM0NC4wMDAxIDguMTAwNzggNDIuNzAwMSA5LjIwMDc4IDQyLjcwMDEgMTEuNTAwOEM0Mi43MDAxIDEzLjgwMDggNDQuMDAwMSAxNC45MDA4IDQ2LjYwMDEgMTQuOTAwOEM0OS4zMDAxIDE0LjkwMDggNTAuNDAwMSAxMy44MDA4IDUwLjQwMDEgMTEuNTAwOFpNNTMuNDAwMSAxMS41MDA4QzUzLjQwMDEgMTUuMzAwOCA1MS4zMDAxIDE3LjYwMDggNDcuNDAwMSAxNy42MDA4QzQ1LjQwMDEgMTcuNjAwOCA0My42MDAxIDE2LjUwMDggNDIuNzAwMSAxNC41MDA4VjIxLjUwMDhIMzkuNjAwMVY1LjYwMDc4SDQyLjcwMDFWOC41MDA3OEM0My42MDAxIDYuNTAwNzggNDUuNDAwMSA1LjMwMDc4IDQ3LjUwMDEgNS4zMDA3OEM1MS40MDAxIDUuMzAwNzggNTMuNDAwMSA3LjcwMDc4IDUzLjQwMDEgMTEuNTAwOFoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNNjYuNDAwMSAxMS40OTg0QzY2LjQwMDEgOS4xOTg0NCA2NS4xMDAxIDguMDk4NDQgNjIuNTAwMSA4LjA5ODQ0QzU5LjgwMDEgOC4wOTg0NCA1OC43MDAxIDkuMDk4NDQgNTguNzAwMSAxMS40OTg0QzU4LjcwMDEgMTMuNzk4NCA1OS44MDAxIDE0Ljg5ODQgNjIuNTAwMSAxNC44OTg0QzY1LjEwMDEgMTQuODk4NCA2Ni40MDAxIDEzLjc5ODQgNjYuNDAwMSAxMS40OTg0Wk02Ni4zMDAxIDUuNTk4NDRINjkuNDAwMVYxNy4zOTg0SDY2LjMwMDFWMTQuNDk4NEM2NS40MDAxIDE2LjQ5ODQgNjMuNzAwMSAxNy42OTg0IDYxLjYwMDEgMTcuNjk4NEM1Ny43MDAxIDE3LjY5ODQgNTUuNjAwMSAxNS4yOTg0IDU1LjYwMDEgMTEuNTk4NEM1NS42MDAxIDcuNzk4NDQgNTcuNjAwMSA1LjM5ODQ0IDYxLjQwMDEgNS4zOTg0NEM2My41MDAxIDUuMzk4NDQgNjUuNDAwMSA2LjU5ODQ0IDY2LjIwMDEgOC41OTg0NFY1LjU5ODQ0SDY2LjMwMDFaIiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTgxLjM5OTkgOC4zSDc3LjM5OTlWMTQuN0g4MS4wOTk5VjE3LjRINzcuOTk5OUM3NS43OTk5IDE3LjQgNzQuMjk5OSAxNS45IDc0LjI5OTkgMTMuN1Y4LjNINzEuMzk5OVY1LjZINzQuMjk5OVYySDc3LjM5OTlWNS41SDgxLjM5OTlWOC4zWiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik05My42OTk5IDEyLjIwMDhMOTYuNjk5OSAxMi45MDA4Qzk1Ljk5OTkgMTYuMDAwOCA5My42OTk5IDE3LjYwMDggODkuOTk5OSAxNy42MDA4Qzg3Ljc5OTkgMTcuNjAwOCA4Ni4wOTk5IDE3LjAwMDggODQuNzk5OSAxNS45MDA4QzgzLjQ5OTkgMTQuODAwOCA4Mi44OTk5IDEzLjMwMDggODIuODk5OSAxMS41MDA4QzgyLjg5OTkgOS42MDA3OCA4My40OTk5IDguMTAwNzggODQuNzk5OSA3LjAwMDc4Qzg2LjA5OTkgNS45MDA3OCA4Ny43OTk5IDUuMzAwNzggODkuOTk5OSA1LjMwMDc4QzkzLjY5OTkgNS4zMDA3OCA5NS45OTk5IDYuOTAwNzggOTYuNjk5OSAxMC4wMDA4TDkzLjY5OTkgMTAuNzAwOEM5My4yOTk5IDguODAwNzggOTIuMjk5OSA4LjEwMDc4IDg5Ljg5OTkgOC4xMDA3OEM4Ni45OTk5IDguMTAwNzggODUuODk5OSA5LjIwMDc4IDg1Ljg5OTkgMTEuNTAwOEM4NS44OTk5IDEzLjgwMDggODYuOTk5OSAxNC45MDA4IDg5Ljg5OTkgMTQuOTAwOEM5Mi4yOTk5IDE0LjkwMDggOTMuMjk5OSAxNC4yMDA4IDkzLjY5OTkgMTIuMjAwOFoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTExLjggMTAuNlYxNy40SDEwOC43VjExLjJDMTA4LjcgOSAxMDcuOCA4LjEgMTA1LjkgOC4xQzEwMy42IDguMSAxMDIuNCA5LjMgMTAyLjQgMTEuN1YxNy4zSDk5LjI5OThWMC41SDEwMi40VjguM0MxMDMuMSA2LjMgMTA0LjYgNS4zIDEwNyA1LjNDMTEwLjIgNS4zIDExMS44IDcuMSAxMTEuOCAxMC42WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xMTQuMSAxNC4wOTg0TDExNy4xIDEzLjI5ODRDMTE3LjQgMTQuNzk4NCAxMTguMyAxNS4yOTg0IDEyMC4yIDE1LjI5ODRDMTIxLjggMTUuMjk4NCAxMjIuNyAxNC44OTg0IDEyMi43IDE0LjA5ODRDMTIyLjcgMTMuMjk4NCAxMjIuMiAxMi45OTg0IDEyMC42IDEyLjc5ODRMMTE4LjIgMTIuNDk4NEMxMTUuOSAxMi4xOTg0IDExNC41IDEwLjg5ODQgMTE0LjUgOC45OTg0NEMxMTQuNSA2Ljc5ODQ0IDExNi41IDUuMzk4NDQgMTE5LjggNS4zOTg0NEMxMjMuMSA1LjM5ODQ0IDEyNSA2LjY5ODQ0IDEyNS41IDguODk4NDRMMTIyLjUgOS41OTg0NEMxMjIuMyA4LjA5ODQ0IDEyMS41IDcuNjk4NDQgMTE5LjkgNy42OTg0NEMxMTguNCA3LjY5ODQ0IDExNy42IDguMDk4NDQgMTE3LjYgOC44OTg0NEMxMTcuNiA5LjU5ODQ0IDExOC4xIDkuOTk4NDQgMTE5LjMgMTAuMDk4NEwxMjIuMiAxMC40OTg0QzEyNC40IDEwLjc5ODQgMTI1LjggMTEuOTk4NCAxMjUuOCAxMy44OTg0QzEyNS44IDE2LjI5ODQgMTIzLjcgMTcuNzk4NCAxMjAuMSAxNy43OTg0QzExNi43IDE3LjU5ODQgMTE0LjUgMTYuMTk4NCAxMTQuMSAxNC4wOTg0WiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xMzYuNyA4LjNIMTMyLjdWMTQuN0gxMzYuNFYxNy40SDEzMy4zQzEzMS4xIDE3LjQgMTI5LjYgMTUuOSAxMjkuNiAxMy43VjguM0gxMjYuN1Y1LjZIMTI5LjZWMkgxMzIuN1Y1LjVIMTM2LjdWOC4zWiIgZmlsbD0id2hpdGUiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik0xNDkuMiAxMS40OTg0QzE0OS4yIDkuMTk4NDQgMTQ3LjkgOC4wOTg0NCAxNDUuMyA4LjA5ODQ0QzE0Mi42IDguMDk4NDQgMTQxLjUgOS4wOTg0NCAxNDEuNSAxMS40OTg0QzE0MS41IDEzLjc5ODQgMTQyLjYgMTQuODk4NCAxNDUuMyAxNC44OTg0QzE0Ny45IDE0Ljg5ODQgMTQ5LjIgMTMuNzk4NCAxNDkuMiAxMS40OTg0Wk0xNDkuMSA1LjU5ODQ0SDE1Mi4yVjE3LjM5ODRIMTQ5LjFWMTQuNDk4NEMxNDguMiAxNi40OTg0IDE0Ni41IDE3LjY5ODQgMTQ0LjQgMTcuNjk4NEMxNDAuNSAxNy42OTg0IDEzOC40IDE1LjI5ODQgMTM4LjQgMTEuNTk4NEMxMzguNCA3Ljc5ODQ0IDE0MC40IDUuMzk4NDQgMTQ0LjIgNS4zOTg0NEMxNDYuMyA1LjM5ODQ0IDE0OC4yIDYuNTk4NDQgMTQ5IDguNTk4NDRWNS41OTg0NEgxNDkuMVoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTY1LjYgMTIuMjAwOEwxNjguNiAxMi45MDA4QzE2Ny45IDE2LjAwMDggMTY1LjYgMTcuNjAwOCAxNjEuOSAxNy42MDA4QzE1OS43IDE3LjYwMDggMTU4IDE3LjAwMDggMTU2LjcgMTUuOTAwOEMxNTUuNCAxNC44MDA4IDE1NC44IDEzLjMwMDggMTU0LjggMTEuNTAwOEMxNTQuOCA5LjYwMDc4IDE1NS40IDguMTAwNzggMTU2LjcgNy4wMDA3OEMxNTggNS45MDA3OCAxNTkuNyA1LjMwMDc4IDE2MS45IDUuMzAwNzhDMTY1LjYgNS4zMDA3OCAxNjcuOSA2LjkwMDc4IDE2OC42IDEwLjAwMDhMMTY1LjYgMTAuNzAwOEMxNjUuMiA4LjgwMDc4IDE2NC4yIDguMTAwNzggMTYxLjggOC4xMDA3OEMxNTguOSA4LjEwMDc4IDE1Ny44IDkuMjAwNzggMTU3LjggMTEuNTAwOEMxNTcuOCAxMy44MDA4IDE1OC45IDE0LjkwMDggMTYxLjggMTQuOTAwOEMxNjQuMSAxNC45MDA4IDE2NS4xIDE0LjIwMDggMTY1LjYgMTIuMjAwOFoiIGZpbGw9IndoaXRlIi8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMTgwLjI1NyAxNy40TDE3Ni42NTcgMTIuM0wxNzQuMTU3IDE0LjZWMTcuNEgxNzEuMTU3VjAuNUgxNzQuMTU3VjExLjFMMTc5Ljg1NyA1LjZIMTgzLjc1N0wxNzguNTU3IDEwLjVMMTgzLjk1NyAxNy40SDE4MC4yNTdaIiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTAgMjEuNTAwOEg3LjNWMTYuMzAwOEgwVjIxLjUwMDhaIiBmaWxsPSIjQUZFNjE0Ii8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNNy4yOTk4IDIxLjUwMDhIMTQuNTk5OFYxNi4zMDA4SDcuMjk5OFYyMS41MDA4WiIgZmlsbD0iIzZFQkUwMCIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTE0LjYwMDEgMTYuM0gyOS4yMDAxVjAuNUgxNC42MDAxVjE2LjNaIiBmaWxsPSIjQUZFNjE0Ii8+CjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMCAxMUgxNC42VjAuNUgwVjExWiIgZmlsbD0iIzZFQkUwMCIvPgo8L3N2Zz4K" alt="Patchstack Logo">
+				</a>
+            </div>
+        </div>
+    </div>
+</body>
+<script>
+    function copyText(id) {
+        var copyText = document.getElementById(id)
+        copyText.select();
+        copyText.setSelectionRange(0, 99999);
+        navigator.clipboard.writeText(copyText.value);
+    }
+
+    function hover(element) {
+        element.setAttribute('src', 'data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkiIGhlaWdodD0iMjMiIHZpZXdCb3g9IjAgMCAxOSAyMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0IDAuMDIzNDM3NUgwVjE2LjAyMzRIMlYyLjAyMzQ0SDE0VjAuMDIzNDM3NVpNMTkgNC4wMjM0NEg0VjIyLjAyMzRIMTlWNC4wMjM0NFpNMTcgMjAuMDIzNEg2VjYuMDIzNDRIMTdWMjAuMDIzNFoiIGZpbGw9IiNBRkU2MTQiLz4KPC9zdmc+Cg==');
+    }
+
+    function unhover(element) {
+        element.setAttribute('src', 'data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTkiIGhlaWdodD0iMjMiIHZpZXdCb3g9IjAgMCAxOSAyMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0IDAuMDIzNDM3NUgwVjE2LjAyMzRIMlYyLjAyMzQ0SDE0VjAuMDIzNDM3NVpNMTkgNC4wMjM0NEg0VjIyLjAyMzRIMTlWNC4wMjM0NFpNMTcgMjAuMDIzNEg2VjYuMDIzNDRIMTdWMjAuMDIzNFoiIGZpbGw9IndoaXRlIi8+Cjwvc3ZnPgo=');
+    }
+<\/script>
+</html>`;
+}
+
+// src/protect/rules/store.js
+var fsMod;
+async function loadFs() {
+  if (fsMod !== void 0) return fsMod;
+  try {
+    const [fs, path] = await Promise.all([Promise.resolve().then(() => __toESM(require_ps_edge_stub(), 1)), Promise.resolve().then(() => __toESM(require_ps_edge_stub(), 1))]);
+    fsMod = {
+      readFileSync: fs.readFileSync,
+      writeFileSync: fs.writeFileSync,
+      mkdirSync: fs.mkdirSync,
+      join: path.join
+    };
+  } catch {
+    fsMod = null;
+  }
+  return fsMod;
+}
+function makeStore(options = {}) {
+  let mem = null;
+  const durable = durableTier(options);
+  return {
+    async read() {
+      if (mem) return mem;
+      const env = await durable.read();
+      if (env) mem = env;
+      return env;
+    },
+    async write(env) {
+      if (env) mem = env;
+      await durable.write(env);
+    }
+  };
+}
+function durableTier(options) {
+  const adapter = options.ruleCache;
+  if (adapter && typeof adapter.read === "function" && typeof adapter.write === "function") {
+    return {
+      read: async () => {
+        try {
+          return toEnvelope(await adapter.read());
+        } catch {
+          return null;
+        }
+      },
+      write: async (env) => {
+        try {
+          await adapter.write(env);
+        } catch {
+        }
+      }
+    };
+  }
+  const dir = options.cacheDir;
+  return {
+    read: async () => cacheRead(dir),
+    write: async (env) => cacheWrite(dir, env)
+  };
+}
+async function cacheWrite(dir, env) {
+  if (!dir) return;
+  const fs = await loadFs();
+  if (!fs) return;
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(fs.join(dir, "patchstack-rules.json"), JSON.stringify(env));
+  } catch {
+  }
+}
+async function cacheRead(dir) {
+  if (!dir) return null;
+  const fs = await loadFs();
+  if (!fs) return null;
+  try {
+    return toEnvelope(JSON.parse(fs.readFileSync(fs.join(dir, "patchstack-rules.json"), "utf8")));
+  } catch {
+    return null;
+  }
+}
+function toEnvelope(value) {
+  if (!value || typeof value !== "object") return null;
+  if (value.bundle && typeof value.bundle === "object") {
+    return { bundle: value.bundle, etag: value.etag ?? null };
+  }
+  if (Array.isArray(value.firewall) || Array.isArray(value.whitelists)) {
+    return { bundle: value, etag: null };
+  }
+  return null;
+}
+
+// src/protect/rules/validate.js
+var LIMITS = {
+  maxRules: 5e3,
+  maxWhitelists: 2e3,
+  maxConditionsPerRule: 250,
+  maxNestingDepth: 12,
+  maxRegexLength: 1e3,
+  maxValueLength: 8192
+};
+var PHASES = /* @__PURE__ */ new Set(["request", "response", "egress"]);
+var ACTIONS = /* @__PURE__ */ new Set(["block", "redact", "encode", "set-header", "remove-header", "harden-cookie"]);
+function validateBundle(bundle, opts = {}) {
+  const rejected = [];
+  const inFirewall = Array.isArray(bundle?.firewall) ? bundle.firewall : [];
+  const inWhitelists = Array.isArray(bundle?.whitelists) ? bundle.whitelists : [];
+  const firewall = [];
+  for (const rule of inFirewall) {
+    if (firewall.length >= LIMITS.maxRules) {
+      rejected.push({ id: idOf(rule), reason: `bundle exceeds maxRules (${LIMITS.maxRules})` });
+      continue;
+    }
+    const reason = ruleProblem(rule);
+    if (reason) rejected.push({ id: idOf(rule), reason });
+    else firewall.push(rule);
+  }
+  const whitelists = [];
+  for (const wl of inWhitelists) {
+    if (whitelists.length >= LIMITS.maxWhitelists) {
+      rejected.push({ id: idOf(wl), reason: `bundle exceeds maxWhitelists (${LIMITS.maxWhitelists})` });
+      continue;
+    }
+    if (!opts.allowGlobalWhitelists && wl && Array.isArray(wl.rule_v2) && !wl.rule_id) {
+      rejected.push({ id: idOf(wl), reason: "whitelist has no rule_id (would suppress every rule); set allowGlobalWhitelists to permit" });
+      continue;
+    }
+    const reason = conditionsProblem(wl?.rule_v2);
+    if (reason) rejected.push({ id: idOf(wl), reason: `whitelist: ${reason}` });
+    else whitelists.push(wl);
+  }
+  return {
+    bundle: { ...bundle, firewall, whitelists },
+    rejected
+  };
+}
+function idOf(rule) {
+  const id = rule?.id ?? rule?.rule_id;
+  return id === void 0 || id === null ? "(unidentified)" : String(id);
+}
+function ruleProblem(rule) {
+  if (!rule || typeof rule !== "object") return "not an object";
+  if (rule.phase !== void 0 && !PHASES.has(rule.phase)) return `unknown phase "${rule.phase}"`;
+  if (rule.action !== void 0 && !ACTIONS.has(rule.action)) return `unknown action "${rule.action}"`;
+  const capOverride = rule.max_bytes;
+  if (capOverride !== void 0 && !(Number(capOverride) > 0)) return "max_bytes must be a positive number";
+  return conditionsProblem(rule.rule_v2);
+}
+function conditionsProblem(conditions, depth = 0) {
+  if (!Array.isArray(conditions)) return "rule_v2 must be an array of conditions";
+  if (conditions.length === 0) return "rule_v2 is empty (would never match)";
+  if (depth > LIMITS.maxNestingDepth) return `nesting deeper than ${LIMITS.maxNestingDepth}`;
+  if (conditions.length > LIMITS.maxConditionsPerRule) {
+    return `more than ${LIMITS.maxConditionsPerRule} conditions`;
+  }
+  for (const c of conditions) {
+    if (!c || typeof c !== "object") return "condition is not an object";
+    if (Array.isArray(c.rules)) {
+      const nested = conditionsProblem(c.rules, depth + 1);
+      if (nested) return nested;
+      continue;
+    }
+    const m = c.match;
+    if (!m || typeof m !== "object") return "condition has no match object";
+    if (typeof m.type !== "string" || m.type === "") return "match.type must be a non-empty string";
+    if (m.type === "regex") {
+      if (typeof m.value !== "string") return "regex match.value must be a string";
+      if (m.value.length > LIMITS.maxRegexLength) return `regex longer than ${LIMITS.maxRegexLength} chars`;
+    } else if (typeof m.value === "string" && m.value.length > LIMITS.maxValueLength) {
+      return `match.value longer than ${LIMITS.maxValueLength} chars`;
+    }
+    if (m.match) {
+      const nested = conditionsProblem([{ match: m.match }], depth + 1);
+      if (nested) return nested;
+    }
+  }
+  return null;
+}
+
+// src/protect/rules/source.js
+function liveUpdateRejections(res, options) {
+  if (options.acceptPartialBundle) return [];
+  const { rejected } = validateBundle(
+    { firewall: Array.isArray(res.firewall) ? res.firewall : [], whitelists: Array.isArray(res.whitelists) ? res.whitelists : [] },
+    { allowGlobalWhitelists: options.allowGlobalWhitelists }
+  );
+  return rejected;
+}
+function reportRejections(rejected, options, label) {
+  const report = options.onRuleRejected;
+  for (const r of rejected) {
+    if (typeof report === "function") {
+      try {
+        report({ ...r, accepted: false });
+      } catch {
+      }
+    }
+  }
+  const sample = rejected.slice(0, 3).map((r) => `${r.id} (${r.reason})`).join("; ");
+  options.onError?.(new Error(
+    `${label}: rejected the entire update because ${rejected.length} rule(s) failed validation \u2014 keeping the previous ruleset and NOT caching this response: ${sample}${rejected.length > 3 ? ", \u2026" : ""}`
+  ));
+}
+async function resolveRules(options, store, ctx = {}) {
+  const timeoutMs = ctx.timeoutMs;
+  if (options.siteUuid) {
+    const prior = await store.read();
+    const client = new PulseRuleClient({ siteUuid: options.siteUuid, baseUrl: options.pulseRulesUrl, etag: prior?.etag, timeoutMs, pulseAuth: ctx.pulseAuth });
+    const res = await client.getRules();
+    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle, options);
+    if (res.success && !res.notModified) {
+      const rejected = liveUpdateRejections(res, options);
+      if (rejected.length > 0) {
+        reportRejections(rejected, options, "rule update rejected");
+        if (prior?.bundle) return normalizeBundle(prior.bundle, options);
+        if (options.rules) return normalizeBundle(options.rules, options);
+        return emptyBundle();
+      }
+      const bundle = normalizeBundle(res, options);
+      await store.write({ bundle, etag: res.etag ?? null });
+      return bundle;
+    }
+    if (prior?.bundle) {
+      options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`));
+      return normalizeBundle(prior.bundle, options);
+    }
+    if (options.rules) {
+      options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using bundled fallback`));
+      return normalizeBundle(options.rules, options);
+    }
+    options.onError?.(new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`));
+    return emptyBundle();
+  }
+  if (options.token) {
+    const prior = await store.read();
+    const client = new PatchstackRuleClient({ token: options.token, baseUrl: options.baseUrl, etag: prior?.etag, timeoutMs });
+    const res = await client.getRules();
+    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle, options);
+    if (res.success && !res.notModified) {
+      const rejected = liveUpdateRejections(res, options);
+      if (rejected.length > 0) {
+        reportRejections(rejected, options, "rule update rejected");
+        if (prior?.bundle) return normalizeBundle(prior.bundle, options);
+        if (options.rules) return normalizeBundle(options.rules, options);
+        return emptyBundle();
+      }
+      const bundle = normalizeBundle(res, options);
+      await store.write({ bundle, etag: res.etag ?? null });
+      return bundle;
+    }
+    if (prior?.bundle) {
+      options.onError?.(new Error(`rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`));
+      return normalizeBundle(prior.bundle, options);
+    }
+    options.onError?.(new Error(`rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`));
+    return emptyBundle();
+  }
+  if (options.rules) {
+    return normalizeBundle(options.rules, options);
+  }
+  return emptyBundle();
+}
+function normalizeBundle(b, options = {}) {
+  const enforcement = b?.enforcement ?? b?.mode;
+  const { bundle: checked, rejected } = validateBundle(
+    {
+      firewall: Array.isArray(b.firewall) ? b.firewall : [],
+      whitelists: Array.isArray(b.whitelists) ? b.whitelists : []
+    },
+    { allowGlobalWhitelists: options.allowGlobalWhitelists }
+  );
+  if (rejected.length > 0) {
+    const report = options.onRuleRejected;
+    if (typeof report === "function") {
+      for (const r of rejected) {
+        try {
+          report(r);
+        } catch {
+        }
+      }
+    } else {
+      const sample = rejected.slice(0, 3).map((r) => `${r.id} (${r.reason})`).join("; ");
+      console.warn(
+        `[patchstack] ${rejected.length} delivered rule(s) rejected as invalid/oversized and are NOT enforced: ${sample}` + (rejected.length > 3 ? ", \u2026" : "")
+      );
+    }
+  }
+  return {
+    firewall: checked.firewall,
+    whitelists: checked.whitelists,
+    whitelist_keys: b.whitelist_keys ?? {},
+    ...enforcement === "block" || enforcement === "dry-run" ? { enforcement } : {}
+  };
+}
+function emptyBundle() {
+  return { firewall: [], whitelists: [], whitelist_keys: {} };
+}
+
+// src/protect/rules/refresh.js
+var JITTER_FRACTION3 = 0.1;
+var MAX_BACKOFF_MULTIPLIER = 8;
+function startRefresh(tick, { refreshMs, onError } = {}) {
+  let stopped = false;
+  let failures = 0;
+  let timer = null;
+  const schedule = () => {
+    if (stopped) return;
+    const backoff = Math.min(2 ** failures, MAX_BACKOFF_MULTIPLIER);
+    const jitter = 1 - Math.random() * JITTER_FRACTION3;
+    const delay = refreshMs * backoff * jitter;
+    timer = setTimeout(run, delay);
+    timer?.unref?.();
+  };
+  const run = async () => {
+    if (stopped) return;
+    try {
+      await tick();
+      failures = 0;
+    } catch (err) {
+      failures++;
+      onError?.(err);
+    }
+    schedule();
+  };
+  schedule();
+  return {
+    stop() {
+      stopped = true;
+      if (timer) clearTimeout(timer);
+    }
+  };
+}
+function makeRefreshHandler(tick, secret) {
+  return async (request) => {
+    if (!secret) return new Response("not found", { status: 404 });
+    let provided = null;
+    try {
+      provided = request?.headers?.get?.("x-patchstack-refresh") ?? new URL(request.url).searchParams.get("token");
+    } catch {
+      provided = null;
+    }
+    if (provided !== secret) return new Response("forbidden", { status: 403 });
+    let refreshed = true;
+    try {
+      await tick();
+    } catch {
+      refreshed = false;
+    }
+    return new Response(JSON.stringify({ refreshed }), { status: 200, headers: { "content-type": "application/json" } });
+  };
+}
+
+// src/protect/firewall-log.js
+var DEFAULT_API_BASE = "https://api.patchstack.com";
+var DEFAULT_FLUSH_MS = 1e3;
+var MAX_BATCH = 50;
+var TOKEN_SKEW_MS2 = 6e4;
+function parseApiKey(apiKey) {
+  if (typeof apiKey !== "string" || apiKey.length === 0) return null;
+  const idx = apiKey.lastIndexOf("-");
+  if (idx <= 0 || idx === apiKey.length - 1) return null;
+  const clientSecret = apiKey.slice(0, idx);
+  const clientId = apiKey.slice(idx + 1);
+  if (!/^\d+$/.test(clientId) || clientSecret.length === 0) return null;
+  return { clientId, clientSecret };
+}
+function resolveApiBase(pulseOrManifestUrl) {
+  const fromEnv = typeof process !== "undefined" ? process.env?.PATCHSTACK_API_BASE : void 0;
+  if (typeof fromEnv === "string" && fromEnv.length > 0) {
+    const candidate = fromEnv.replace(/\/$/, "");
+    if (isSafeOrigin(candidate)) return candidate;
+    console.warn(
+      "[patchstack] ignoring PATCHSTACK_API_BASE: block-log reporting requires an https origin (or localhost). Falling back to the default API origin."
+    );
+  }
+  if (typeof pulseOrManifestUrl === "string" && pulseOrManifestUrl.length > 0) {
+    try {
+      return new URL(pulseOrManifestUrl).origin;
+    } catch {
+    }
+  }
+  const endpoint = typeof process !== "undefined" ? process.env?.PATCHSTACK_ENDPOINT : void 0;
+  if (typeof endpoint === "string" && endpoint.length > 0) {
+    try {
+      return new URL(endpoint).origin;
+    } catch {
+    }
+  }
+  return DEFAULT_API_BASE;
+}
+function createFirewallLogReporter(opts) {
+  const creds = parseApiKey(opts.apiKey);
+  if (!creds) {
+    return { record() {
+    }, flush() {
+    }, stop() {
+    } };
+  }
+  const apiBase = (opts.apiBase ?? DEFAULT_API_BASE).replace(/\/$/, "");
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  const flushMs = Number.isFinite(opts.flushMs) ? opts.flushMs : DEFAULT_FLUSH_MS;
+  const sourceHost = typeof opts.sourceHost === "string" ? opts.sourceHost : "";
+  let queue = [];
+  let timer = null;
+  let stopped = false;
+  let cachedToken = null;
+  let tokenInflight = null;
+  const fetchAccessToken = async () => {
+    if (cachedToken && Date.now() < cachedToken.expiresAt - TOKEN_SKEW_MS2) {
+      return cachedToken.token;
+    }
+    if (tokenInflight) return tokenInflight;
+    tokenInflight = (async () => {
+      try {
+        const res = await fetchImpl(`${apiBase}/oauth/token`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json",
+            "User-Agent": "@patchstack/connect"
+          },
+          body: JSON.stringify({
+            grant_type: "client_credentials",
+            client_id: creds.clientId,
+            client_secret: creds.clientSecret
+          })
+        });
+        if (!res || !res.ok) return null;
+        const body = await res.json();
+        const token = body?.access_token;
+        if (typeof token !== "string" || token.length === 0) return null;
+        const expiresIn = Number(body?.expires_in);
+        const ttlMs = Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn * 1e3 : 36e5;
+        cachedToken = { token, expiresAt: Date.now() + ttlMs };
+        return token;
+      } catch {
+        return null;
+      } finally {
+        tokenInflight = null;
+      }
+    })();
+    return tokenInflight;
+  };
+  const flush = () => {
+    if (timer) {
+      clearTimeout(timer);
+      timer = null;
+    }
+    if (queue.length === 0 || typeof fetchImpl !== "function") return;
+    const batch = queue.splice(0, MAX_BATCH);
+    void (async () => {
+      const token = await fetchAccessToken();
+      if (!token) return;
+      const body = new URLSearchParams();
+      body.set("type", "firewall");
+      body.set("logs", JSON.stringify(batch));
+      try {
+        const p = fetchImpl(`${apiBase}/api/logs/log`, {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+            "User-Agent": "@patchstack/connect",
+            ...sourceHost ? { "Source-Host": sourceHost } : {}
+          },
+          body
+        });
+        if (p && typeof p.then === "function") p.catch(() => {
+        });
+      } catch {
+      }
+    })();
+  };
+  return {
+    /**
+     * @param {{
+     *   rule?: { id?: string | number },
+     *   method?: string | null,
+     *   path?: string | null,
+     *   ip?: string | null,
+     *   userAgent?: string | null,
+     * }} event
+     */
+    record(event) {
+      if (stopped) return;
+      const fid = event?.rule?.id;
+      if (fid === void 0 || fid === null || fid === "") return;
+      queue.push({
+        fid,
+        method: event.method ?? null,
+        request_uri: event.path ?? null,
+        ip: event.ip ?? null,
+        user_agent: event.userAgent ?? null,
+        log_date: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      if (queue.length >= MAX_BATCH) {
+        flush();
+        return;
+      }
+      if (!timer) timer = setTimeout(flush, flushMs);
+    },
+    flush,
+    stop() {
+      stopped = true;
+      flush();
+    }
+  };
+}
+function telemetryEnabled() {
+  const v = typeof process !== "undefined" ? process.env?.PATCHSTACK_TELEMETRY : void 0;
+  if (v === void 0 || v === "") return true;
+  return !/^(0|false|off|no)$/i.test(String(v));
+}
+
+// src/protect/supabase-guard.js
+var GUARD_PATH = "/_patchstack/guard";
+var HOP_BY_HOP = /* @__PURE__ */ new Set(["content-encoding", "content-length", "transfer-encoding", "connection"]);
+function createSupabaseGuard({ protection, supabaseUrl, fetchImpl = fetch }) {
+  const guard = protection.fetchGuard();
+  const allowedOrigin = supabaseUrl ? new URL(supabaseUrl).origin : null;
+  return async function handleGuardRequest(request) {
+    const target = request.headers.get("x-ps-target");
+    if (!target) return new Response("patchstack: missing x-ps-target", { status: 400 });
+    let targetUrl;
+    try {
+      targetUrl = new URL(target);
+    } catch {
+      return new Response("patchstack: invalid target", { status: 400 });
+    }
+    if (!allowedOrigin || targetUrl.protocol !== "https:" || targetUrl.origin !== allowedOrigin) {
+      return new Response("patchstack: target not allowed", { status: 403 });
+    }
+    const hasBody = request.method !== "GET" && request.method !== "HEAD";
+    const bodyText = hasBody ? await request.text() : "";
+    const evalReq = new Request(targetUrl.toString(), {
+      method: request.method,
+      headers: request.headers,
+      body: hasBody ? bodyText : void 0
+    });
+    const blocked = await guard(evalReq);
+    if (blocked) return blocked;
+    const forwardHeaders = new Headers(request.headers);
+    forwardHeaders.delete("x-ps-target");
+    forwardHeaders.delete("host");
+    const upstream = await fetchImpl(targetUrl.toString(), {
+      method: request.method,
+      headers: forwardHeaders,
+      body: hasBody ? bodyText : void 0,
+      redirect: "manual"
+    });
+    const outHeaders = new Headers();
+    upstream.headers.forEach((value, key) => {
+      if (!HOP_BY_HOP.has(key.toLowerCase())) outHeaders.set(key, value);
+    });
+    const buf = await upstream.arrayBuffer();
+    const forwarded = new Response(buf, { status: upstream.status, statusText: upstream.statusText, headers: outHeaders });
+    return protection.screenResponse ? protection.screenResponse(forwarded) : forwarded;
+  };
+}
+
+// src/protect/runtime.js
+function createServerFnGuard({ protection }) {
+  const guard = protection.fetchGuard();
+  return async (data) => {
+    let res;
+    try {
+      const req = new Request("https://patchstack.local/_serverfn", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(data ?? {})
+      });
+      res = await guard(req);
+    } catch {
+      return null;
+    }
+    if (!res) return null;
+    let body = {};
+    try {
+      body = await res.clone().json();
+    } catch {
+    }
+    return { rule: body.rule, message: body.message || "Blocked by Patchstack" };
+  };
+}
+async function createProtection(options = {}) {
+  const onError = options.onError;
+  const userOnDetect = options.onDetect ?? defaultOnDetect;
+  const apiKey = await resolveApiKey(options);
+  const firewallLog = apiKey && telemetryEnabled() && options.reportFirewallLog !== false ? createFirewallLogReporter({
+    apiKey,
+    apiBase: resolveApiBase(options.pulseRulesUrl ?? options.baseUrl),
+    sourceHost: options.sourceHost,
+    fetchImpl: options.fetchImpl
+  }) : null;
+  const onDetect = (detection) => {
+    userOnDetect(detection);
+    if (firewallLog && detection?.mode === "block") {
+      firewallLog.record({
+        rule: detection.rule,
+        method: detection.method,
+        path: detection.path,
+        ip: detection.ip,
+        userAgent: detection.userAgent
+      });
+    }
+  };
+  const store = makeStore(options);
+  const bootTimeoutMs = Number(options.bootTimeoutMs) > 0 ? Number(options.bootTimeoutMs) : 5e3;
+  const pulseAuth = await resolvePulseAuth(options);
+  const bundle = await resolveRules(options, store, { timeoutMs: bootTimeoutMs, pulseAuth });
+  let mode = resolveMode(options, bundle);
+  let requestRules;
+  let responseRules;
+  let egressRules;
+  let screenCap;
+  let engine;
+  let responseRuleSet;
+  let egressEngine;
+  const applyBundle = (delivered) => {
+    const incoming = delivered.firewall ?? [];
+    requestRules = byPhase(incoming, "request");
+    responseRules = [...options.responseRules ?? DEFAULT_RESPONSE_RULES, ...byPhase(incoming, "response")];
+    screenCap = responseScreenCap(responseRules);
+    egressRules = [...options.egressRules ?? DEFAULT_EGRESS_RULES, ...byPhase(incoming, "egress")];
+    engine = new RuleEngine({
+      firewall: requestRules,
+      whitelists: delivered.whitelists,
+      whitelist_keys: delivered.whitelist_keys,
+      onError
+    });
+    responseRuleSet = responseRules.map((rule) => ({
+      rule,
+      engine: new RuleEngine({ firewall: [rule], onError }),
+      redactors: rule.action === "redact" || rule.action === "encode" ? extractRedactors(rule) : null,
+      // A redact/encode condition that carries body-transforming mutations (base64_decode, urldecode,
+      // json_decode, …) detects on the DECODED body but the span redactors run on the RAW body — so
+      // they mask nothing and the secret is served while the log says "redacted". Flag it so screenText
+      // fails such a rule CLOSED (block) instead of serving a no-op redaction.
+      mutatedSpan: (rule.action === "redact" || rule.action === "encode") && hasSpanMutations(rule),
+      // Optional cheap pre-filter: literal anchor(s) that MUST appear for the (expensive) regex to
+      // have any chance of matching. Lets screenText skip the full scan on bodies with no candidate —
+      // the common case — cutting CPU/latency and shrinking the regex/ReDoS surface. Case-insensitive.
+      prefilter: Array.isArray(rule.prefilter) && rule.prefilter.length ? rule.prefilter.map((s) => String(s).toLowerCase()) : null
+    }));
+    egressEngine = new RuleEngine({ firewall: egressRules, onError });
+  };
+  applyBundle(bundle);
+  const skipCounts = /* @__PURE__ */ Object.create(null);
+  const onSkip = typeof options.onSkip === "function" ? options.onSkip : null;
+  const recordSkip = (phase, reason, detail) => {
+    const key = `${phase}:${reason}`;
+    skipCounts[key] = (skipCounts[key] ?? 0) + 1;
+    if (onSkip) {
+      try {
+        onSkip({ phase, reason, detail, count: skipCounts[key] });
+      } catch {
+      }
+    }
+  };
+  const maskFn = typeof options.maskWith === "function" ? options.maskWith : () => typeof options.maskWith === "string" ? options.maskWith : "[REDACTED]";
+  const ruleMode = (rule) => rule?.enforcement === "dry-run" ? "dry-run" : mode;
+  const decide = (phase, result, block, allow2, ctx = {}) => {
+    if (!result || !result.blocked) return allow2();
+    const effectiveMode = ruleMode(result.rule);
+    onDetect({
+      phase,
+      // The mode this detection was actually handled under, not the site's: a consumer counting blocks
+      // would otherwise over-report, and the whole point of a dry-run rule is that it did not block.
+      mode: effectiveMode,
+      category: result.rule?.category,
+      rule: result.rule,
+      message: result.message,
+      method: ctx.method,
+      path: ctx.path,
+      ip: ctx.ip,
+      userAgent: ctx.userAgent
+    });
+    return effectiveMode === "block" ? block() : allow2();
+  };
+  const screenText = (text, meta, reqCtx) => {
+    let blockRule = null;
+    const redactions = [];
+    const headerMutations = [];
+    let lowerText = null;
+    for (const { rule, engine: re, redactors, prefilter, mutatedSpan } of responseRuleSet) {
+      if (prefilter) {
+        if (lowerText === null) lowerText = text.toLowerCase();
+        if (!prefilter.some((p) => lowerText.includes(p))) continue;
+      }
+      let result;
+      try {
+        result = re.evaluate({ ...reqCtx || {}, _response: { ...meta, body: text } });
+      } catch (err) {
+        onError?.(err);
+        continue;
+      }
+      if (!result.blocked) continue;
+      const responseMode = ruleMode(rule);
+      onDetect({ phase: "response", mode: responseMode, category: rule.category, rule, message: result.message });
+      if (responseMode !== "block") continue;
+      if (redactors && redactors.length) {
+        const spanRedactors = redactors.filter((r) => !r.jsonPath);
+        if (mutatedSpan && spanRedactors.length) {
+          if (!blockRule) blockRule = rule;
+        } else {
+          redactions.push({ rule, redactors });
+        }
+      } else if (isHeaderMutation(rule.action)) headerMutations.push(rule);
+      else if (!blockRule) blockRule = rule;
+    }
+    if (mode !== "block" || !blockRule && !redactions.length && !headerMutations.length) return { verdict: "pass" };
+    if (blockRule) return { verdict: "block" };
+    let body = text;
+    const headers = { ...meta.headers || {} };
+    for (const { rule, redactors } of redactions) {
+      const mask = maskFn(rule.category);
+      const transform = rule.action === "encode" ? htmlEscape : null;
+      const pathRedactors = redactors.filter((r) => r.jsonPath);
+      const spanRedactors = redactors.filter((r) => !r.jsonPath);
+      if (pathRedactors.length) body = applyPathRedactors(body, pathRedactors, mask, screenCap, transform);
+      if (!spanRedactors.length) continue;
+      body = applyRedactors(body, spanRedactors, mask, transform);
+      if (transform) continue;
+      for (const name of Object.keys(headers)) {
+        const value = headers[name];
+        if (typeof value === "string") {
+          headers[name] = applyRedactors(value, spanRedactors, mask);
+        } else if (Array.isArray(value)) {
+          headers[name] = value.map((item) => typeof item === "string" ? applyRedactors(item, spanRedactors, mask) : item);
+        }
+      }
+    }
+    for (const rule of headerMutations) applyHeaderMutation(headers, rule);
+    return { verdict: "redact", body, headers };
+  };
+  const reqContextFromFetch = (request) => {
+    try {
+      const u = new URL(request.url);
+      const headers = headerObject(request.headers);
+      if (!headers.host) headers.host = u.host;
+      return { method: request.method, originalUrl: u.pathname + u.search, headers };
+    } catch {
+      return void 0;
+    }
+  };
+  const reqContextFromNode = (req) => req ? { method: req.method, originalUrl: req.url, headers: req.headers || {} } : void 0;
+  const screenResp = async (response, reqCtx) => {
+    const read = await readTextResponse(response, screenCap);
+    if (read.skip) {
+      if (read.skip !== "not-a-response") recordSkip("response", read.skip, { status: response?.status });
+      return response;
+    }
+    const text = read.text;
+    const r = screenText(text, { status: response.status, headers: headerObject(response.headers) }, reqCtx);
+    if (r.verdict === "block") return leakResponse();
+    if (r.verdict === "redact") return rebuildResponse(response, r.body, r.headers);
+    return response;
+  };
+  const wrapNodeResponse = (res, reqCtx) => {
+    const origWrite = res.write.bind(res);
+    const origEnd = res.end.bind(res);
+    const chunks = [];
+    let size = 0;
+    let overflow = false;
+    const MAX = screenCap;
+    const collect = (chunk, enc) => {
+      if (chunk == null) return;
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, typeof enc === "string" ? enc : "utf8");
+      size += buf.length;
+      if (size > MAX) {
+        for (const c of chunks) origWrite(c);
+        chunks.length = 0;
+        origWrite(buf);
+        overflow = true;
+        recordSkip("response", "body-cap", { bytes: size });
+        return;
+      }
+      chunks.push(buf);
+    };
+    res.write = function(chunk, enc, cb) {
+      if (overflow) return origWrite(chunk, enc, cb);
+      collect(chunk, enc);
+      if (typeof enc === "function") enc();
+      else if (typeof cb === "function") cb();
+      return true;
+    };
+    res.end = function(chunk, enc, cb) {
+      if (typeof chunk === "function") {
+        cb = chunk;
+        chunk = void 0;
+        enc = void 0;
+      } else if (typeof enc === "function") {
+        cb = enc;
+        enc = void 0;
+      }
+      if (overflow) {
+        if (chunk != null) origWrite(chunk, enc);
+        return origEnd(cb);
+      }
+      collect(chunk, enc);
+      if (overflow) return origEnd(cb);
+      const buffer = Buffer.concat(chunks);
+      let ct = res.getHeader ? res.getHeader("content-type") : void 0;
+      if (Array.isArray(ct)) ct = ct[0];
+      const kind = screenableContentType(ct);
+      if (kind === "skip" || kind === "sniff" && looksBinary(buffer)) {
+        recordSkip("response", kind === "skip" ? baseContentType(ct) === "text/event-stream" ? "live-stream" : "non-text-content-type" : "binary-body");
+        for (const c of chunks) origWrite(c);
+        return origEnd(cb);
+      }
+      const text = buffer.toString("utf8");
+      let r;
+      try {
+        r = screenText(text, { status: res.statusCode, headers: res.getHeaders ? res.getHeaders() : {} }, reqCtx);
+      } catch (err) {
+        onError?.(err);
+        for (const c of chunks) origWrite(c);
+        return origEnd(cb);
+      }
+      if (r.verdict === "block") {
+        res.statusCode = 500;
+        try {
+          res.setHeader("content-type", "application/json");
+        } catch {
+        }
+        return origEnd(JSON.stringify({ error: "Response withheld by Patchstack (sensitive data detected)" }), cb);
+      }
+      if (r.verdict === "redact") {
+        try {
+          res.removeHeader && res.removeHeader("content-length");
+        } catch {
+        }
+        if (r.headers && res.setHeader) {
+          const current = res.getHeaders ? res.getHeaders() : {};
+          for (const [name, value] of Object.entries(r.headers)) {
+            if (name.toLowerCase() === "content-length") continue;
+            if (value === null || value === void 0) {
+              try {
+                res.removeHeader && res.removeHeader(name);
+              } catch {
+              }
+            } else if (Array.isArray(value)) {
+              try {
+                res.setHeader(name, value);
+              } catch {
+              }
+            } else if (typeof value === "string" && current[name] !== value) {
+              try {
+                res.setHeader(name, value);
+              } catch {
+              }
+            }
+          }
+        }
+        return origEnd(r.body, cb);
+      }
+      for (const c of chunks) origWrite(c);
+      return origEnd(cb);
+    };
+  };
+  const allow = new Set((options.allowHosts ?? []).map((h) => String(h).toLowerCase()));
+  const egressShouldBlock = (url, host, method) => {
+    if (host && allow.has(host.toLowerCase())) return false;
+    let result;
+    try {
+      result = egressEngine.evaluate({ _egress: { url, host, method } });
+    } catch (err) {
+      onError?.(err);
+      return false;
+    }
+    if (!result.blocked) return false;
+    const egressMode = ruleMode(result.rule);
+    onDetect({ phase: "egress", mode: egressMode, category: result.rule?.category, rule: result.rule, message: result.message });
+    return egressMode === "block";
+  };
+  const protection = {
+    get mode() {
+      return mode;
+    },
+    get rules() {
+      return { request: requestRules, response: responseRules, egress: egressRules };
+    },
+    /**
+     * Enforcement coverage: how often the guard FAILED OPEN rather than inspecting, keyed
+     * `<phase>:<reason>` (e.g. `response:body-cap`, `request:body-cap`, `response:live-stream`,
+     * `egress:resolver-failed`). "Always-on" is not "always inspected" — surface this (or pass
+     * `onSkip`) so an unscreened path is visible and alertable rather than silent.
+     */
+    coverage() {
+      return { skipped: { ...skipCounts } };
+    },
+    // Screen a fetch Response through the response-phase rules (redact/block). Used by
+    // .fetch(), and by the Supabase guard on its forwarded upstream response.
+    screenResponse: (response, request) => screenResp(response, request ? reqContextFromFetch(request) : void 0),
+    // (request) => Response | null   (null = allow, caller proceeds). Request phase only.
+    fetchGuard() {
+      return async (request) => {
+        let result;
+        try {
+          result = engine.evaluate(await fromFetchRequest(request));
+        } catch (err) {
+          onError?.(err);
+          return null;
+        }
+        return decide("request", result, () => blockResponse(result, request), () => null, fetchRequestMeta(request));
+      };
+    },
+    // Wrap a fetch handler: screens the request, then the response (redact/block).
+    fetch(handler) {
+      const guard = protection.fetchGuard();
+      return async (request, ...rest) => {
+        const blocked = await guard(request);
+        if (blocked) return blocked;
+        const response = await handler(request, ...rest);
+        return screenResp(response, reqContextFromFetch(request));
+      };
+    },
+    // Express middleware (request phase; expects express-parsed req.query/req.body).
+    // Pass { screenResponses: true } to also screen the outgoing response (buffers it).
+    express(exprOptions = {}) {
+      return (req, res, next) => {
+        let result;
+        try {
+          result = engine.evaluate(req);
+        } catch (err) {
+          onError?.(err);
+          if (exprOptions.screenResponses) wrapNodeResponse(res, reqContextFromNode(req));
+          return next();
+        }
+        decide(
+          "request",
+          result,
+          () => {
+            if (isDocumentNavigation((n) => req.headers?.[n])) {
+              res.status(403).type("html").send(renderBlockPage({ url: req.originalUrl || req.url || "/", code: result?.rule?.id }));
+            } else {
+              res.status(403).json(blockBody(result));
+            }
+          },
+          () => {
+            if (exprOptions.screenResponses) wrapNodeResponse(res, reqContextFromNode(req));
+            next();
+          },
+          nodeRequestMeta(req)
+        );
+      };
+    },
+    // Node / Connect middleware — buffers the body itself (request phase).
+    // Pass { screenResponses: true } to also screen the outgoing response (buffers it).
+    node(nodeOptions = {}) {
+      const maxBytes = nodeOptions.maxBodyBytes ?? 1024 * 1024;
+      return (req, res, next) => {
+        const chunks = [];
+        let size = 0;
+        let overflow = false;
+        req.on("data", (chunk) => {
+          size += chunk.length;
+          if (size > maxBytes) {
+            overflow = true;
+            return;
+          }
+          chunks.push(chunk);
+        });
+        req.on("error", (err) => {
+          onError?.(err);
+          next();
+        });
+        req.on("end", () => {
+          if (overflow) recordSkip("request", "body-cap", { bytes: size, limit: maxBytes });
+          const rawBody = overflow ? "" : Buffer.concat(chunks).toString("utf8");
+          let shaped;
+          let result;
+          try {
+            shaped = fromNodeRequest(req, rawBody);
+            result = engine.evaluate(shaped);
+          } catch (err) {
+            onError?.(err);
+            return next();
+          }
+          decide(
+            "request",
+            result,
+            () => {
+              res.statusCode = 403;
+              if (isDocumentNavigation((n) => req.headers?.[n])) {
+                res.setHeader("content-type", "text/html; charset=utf-8");
+                res.end(renderBlockPage({ url: req.url || "/", code: result?.rule?.id }));
+              } else {
+                res.setHeader("content-type", "application/json");
+                res.end(JSON.stringify(blockBody(result)));
+              }
+            },
+            () => {
+              if (req.body === void 0) req.body = shaped.body;
+              if (nodeOptions.screenResponses) wrapNodeResponse(res, reqContextFromNode(req));
+              next();
+            },
+            nodeRequestMeta(req)
+          );
+        });
+      };
+    }
+  };
+  if (options.egress) {
+    protection.uninstallEgress = await installEgressGuard({
+      shouldBlock: egressShouldBlock,
+      onBlock: options.onEgressBlock,
+      // Route egress coverage gaps (a DNS resolver failure / no resolver on this runtime) into the
+      // same skip accounting as the request/response phases.
+      onSkip: ({ reason, detail }) => recordSkip("egress", reason, detail),
+      dnsScreen: options.screenDns !== false,
+      allowHosts: options.allowHosts
+    });
+  }
+  const cwd = options.cwd ?? (typeof process !== "undefined" ? process.cwd() : void 0);
+  const live = Boolean(options.siteUuid || options.token);
+  const refreshSecret = options.refreshSecret ?? (typeof process !== "undefined" ? process.env.PATCHSTACK_REFRESH_SECRET : void 0);
+  const refreshable = live && (options.refreshMs > 0 || Boolean(refreshSecret));
+  let reporter = null;
+  if (refreshable && options.siteUuid && options.reportManifest !== false && cwd) {
+    try {
+      ({ reportManifest: reporter } = await Promise.resolve().then(() => __toESM(require_ps_edge_stub(), 1)));
+    } catch (err) {
+      onError?.(err);
+    }
+  }
+  const runRefreshTick = async () => {
+    if (reporter) {
+      try {
+        await reporter(cwd);
+      } catch (err) {
+        onError?.(err);
+      }
+    }
+    const next = await resolveRules(options, store, { timeoutMs: options.refreshTimeoutMs, pulseAuth });
+    mode = resolveMode(options, next);
+    applyBundle(next);
+  };
+  if (live) {
+    protection.refresh = () => runRefreshTick();
+    protection.refreshHandler = () => makeRefreshHandler(runRefreshTick, refreshSecret);
+  }
+  if (options.refreshMs > 0 && live) {
+    const loop = startRefresh(runRefreshTick, { refreshMs: options.refreshMs, onError });
+    protection.stopRefresh = () => {
+      loop.stop();
+      firewallLog?.stop();
+    };
+  } else if (firewallLog) {
+    protection.stopRefresh = () => firewallLog.stop();
+  }
+  return protection;
+}
+function resolveMode(options, bundle) {
+  const env = typeof process !== "undefined" ? process.env?.PATCHSTACK_MODE : void 0;
+  if (env === "block" || env === "dry-run") return env;
+  if (bundle?.enforcement === "block" || bundle?.enforcement === "dry-run") return bundle.enforcement;
+  if (options?.mode === "block") return "block";
+  if (options?.mode === "dry-run") return "dry-run";
+  return "dry-run";
+}
+async function resolveApiKey(options) {
+  if (typeof options?.apiKey === "string" && options.apiKey.length > 0) return options.apiKey;
+  if (typeof process !== "undefined") {
+    const fromEnv = process.env?.PATCHSTACK_API_KEY;
+    if (typeof fromEnv === "string" && fromEnv.length > 0) return fromEnv;
+  }
+  try {
+    if (typeof process === "undefined" || typeof process.cwd !== "function") return void 0;
+    const [{ readFileSync }, { join }] = await Promise.all([Promise.resolve().then(() => __toESM(require_ps_edge_stub(), 1)), Promise.resolve().then(() => __toESM(require_ps_edge_stub(), 1))]);
+    const cwd = options?.cwd ?? process.cwd();
+    const raw = readFileSync(join(cwd, ".patchstackrc.json"), "utf8");
+    const key = JSON.parse(raw)?.apiKey;
+    if (typeof key === "string" && key.length > 0) return key;
+  } catch {
+  }
+  return void 0;
+}
+async function resolvePulseAuth(options) {
+  if (typeof options?.pulseAuth === "string" && options.pulseAuth.length > 0) return options.pulseAuth;
+  if (typeof process !== "undefined") {
+    const fromEnv = process.env?.PATCHSTACK_PULSE_AUTH;
+    if (typeof fromEnv === "string" && fromEnv.length > 0) return fromEnv;
+  }
+  try {
+    if (typeof process === "undefined" || typeof process.cwd !== "function") return resolveApiKey(options);
+    const [{ readFileSync }, { join }] = await Promise.all([Promise.resolve().then(() => __toESM(require_ps_edge_stub(), 1)), Promise.resolve().then(() => __toESM(require_ps_edge_stub(), 1))]);
+    const cwd = options?.cwd ?? process.cwd();
+    const raw = readFileSync(join(cwd, ".patchstackrc.json"), "utf8");
+    const key = JSON.parse(raw)?.pulseAuth;
+    if (typeof key === "string" && key.length > 0) return key;
+  } catch {
+  }
+  return resolveApiKey(options);
+}
+function byPhase(rules, phase) {
+  return (rules ?? []).filter((r) => (r.phase ?? "request") === phase);
+}
+function baseContentType(ct) {
+  return String(ct || "").toLowerCase().split(";")[0].trim();
+}
+function screenableContentType(ct) {
+  const base = baseContentType(ct);
+  if (base === "text/event-stream") return "skip";
+  if (base === "") return "text";
+  if (/(json|text|xml|html|javascript|csv|yaml|x-www-form-urlencoded)/.test(base)) return "text";
+  if (base === "application/octet-stream") return "sniff";
+  return "skip";
+}
+function looksBinary(bytes) {
+  const n = Math.min(bytes.length, 512);
+  let ctrl = 0;
+  for (let i = 0; i < n; i++) {
+    const b = bytes[i];
+    if (b === 0) return true;
+    if (b < 9 || b > 13 && b < 32) ctrl++;
+  }
+  return n > 0 && ctrl / n > 0.1;
+}
+async function readTextResponse(response, cap = DEFAULT_SCREEN_CAP) {
+  if (!response || typeof response.clone !== "function") return { skip: "not-a-response" };
+  const ct = response.headers?.get?.("content-type") || "";
+  const kind = screenableContentType(ct);
+  if (kind === "skip") return { skip: baseContentType(ct) === "text/event-stream" ? "live-stream" : "non-text-content-type" };
+  const sniff = kind === "sniff";
+  const len = Number(response.headers?.get?.("content-length") || 0);
+  if (len && len > cap) return { skip: "body-cap" };
+  let clone;
+  try {
+    clone = response.clone();
+  } catch {
+    return { skip: "clone-failed" };
+  }
+  const body = clone.body;
+  if (body && typeof body.getReader === "function") {
+    const reader = body.getReader();
+    const chunks = [];
+    let size = 0;
+    let over = false;
+    let sniffed = !sniff;
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        if (!value) continue;
+        if (!sniffed) {
+          sniffed = true;
+          if (looksBinary(value)) return { skip: "binary-body" };
+        }
+        size += value.byteLength;
+        if (over) continue;
+        if (size > cap) {
+          over = true;
+          continue;
+        }
+        chunks.push(value);
+      }
+    } catch {
+      return { skip: "read-failed" };
+    }
+    if (over) return { skip: "body-cap" };
+    try {
+      return { text: new TextDecoder().decode(concatBytes(chunks, size)) };
+    } catch {
+      return { skip: "decode-failed" };
+    }
+  }
+  try {
+    const text = await clone.text();
+    if (text.length > cap) return { skip: "body-cap" };
+    if (sniff && looksBinary(new TextEncoder().encode(text.slice(0, 512)))) return { skip: "binary-body" };
+    return { text };
+  } catch {
+    return { skip: "read-failed" };
+  }
+}
+function concatBytes(chunks, total) {
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    out.set(c, offset);
+    offset += c.byteLength;
+  }
+  return out;
+}
+function headerObject(headers) {
+  const out = {};
+  headers?.forEach?.((v, k) => {
+    out[k.toLowerCase()] = v;
+  });
+  const setCookies = headers?.getSetCookie?.();
+  if (setCookies && setCookies.length) out["set-cookie"] = setCookies;
+  return out;
+}
+function hasSpanMutations(rule) {
+  let found = false;
+  const walk = (conds) => {
+    for (const c of conds ?? []) {
+      if (found) return;
+      if (Array.isArray(c.rules)) walk(c.rules);
+      const isSpan = c.match && (c.match.type === "regex" || c.match.type === "contains" || c.match.type === "stripos");
+      if (isSpan && Array.isArray(c.mutations) && c.mutations.length) found = true;
+    }
+  };
+  walk(rule.rule_v2);
+  return found;
+}
+function extractRedactors(rule) {
+  const out = [];
+  const walk = (conds) => {
+    for (const c of conds ?? []) {
+      if (Array.isArray(c.rules)) walk(c.rules);
+      const m = c.match;
+      if (!m) continue;
+      if (m.type === "regex" && typeof m.value === "string") {
+        const safe = safeRegExp(m.value);
+        if (safe) {
+          const flags = safe.flags.includes("g") ? safe.flags : safe.flags + "g";
+          try {
+            out.push({ re: new RegExp(safe.source, flags) });
+          } catch {
+          }
+        }
+      } else if ((m.type === "contains" || m.type === "stripos") && m.value != null) {
+        out.push({ literal: String(m.value) });
+      } else if (m.type === "array_key_value" && m.match && isBodyParam(c.parameter)) {
+        const keys = Array.isArray(m.key) ? m.key : [m.key];
+        for (const key of keys) {
+          out.push({ jsonPath: String(key).split("."), condition: m.match });
+        }
+      }
+    }
+  };
+  walk(rule.rule_v2);
+  return out;
+}
+function htmlEscape(str) {
+  return String(str).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+function applyRedactors(body, redactors, mask, transform) {
+  let out = body;
+  for (const r of redactors) {
+    if (r.re) out = out.replace(r.re, transform ? (m) => transform(m) : mask);
+    else if (r.literal) {
+      const re = new RegExp(r.literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "gi");
+      out = out.replace(re, (m) => transform ? transform(m) : mask);
+    }
+  }
+  return out;
+}
+function isBodyParam(parameter) {
+  return parameter == null || parameter === "response.body" || parameter === "raw" || parameter === "response.raw";
+}
+function conditionPredicate(condition) {
+  if (!condition || !condition.type) return () => true;
+  return (value) => {
+    try {
+      return matchValue(condition.type, value, condition.value, condition);
+    } catch {
+      return false;
+    }
+  };
+}
+var DEFAULT_SCREEN_CAP = 512 * 1024;
+function responseScreenCap(rules) {
+  let cap = DEFAULT_SCREEN_CAP;
+  for (const r of rules ?? []) {
+    if (r && r.bypass_limit === true) return Infinity;
+    const n = Number(r && r.max_bytes);
+    if (Number.isFinite(n) && n > cap) cap = n;
+  }
+  return cap;
+}
+function applyPathRedactors(text, pathRedactors, mask, cap, transform) {
+  if (!pathRedactors.length || typeof text !== "string" || text.length > cap) return text;
+  const head = text.trimStart()[0];
+  if (head !== "{" && head !== "[") return text;
+  const preserved = preserveBigInts(text);
+  let obj;
+  try {
+    obj = JSON.parse(preserved);
+  } catch {
+    return text;
+  }
+  let changed = false;
+  for (const r of pathRedactors) {
+    const pred = conditionPredicate(r.condition);
+    walkLeaves(obj, r.jsonPath, (loc) => {
+      try {
+        if (pred(loc.value)) {
+          loc.parent[loc.key] = transform ? transform(String(loc.value)) : mask;
+          changed = true;
+        }
+      } catch {
+      }
+    });
+  }
+  return changed ? restoreBigInts(JSON.stringify(obj)) : text;
+}
+var BIGINT_OPEN = "__PSBIGINT_9c2f__";
+var BIGINT_CLOSE = "__DNEGIB__";
+function preserveBigInts(text) {
+  let out = "";
+  let inStr = false;
+  for (let i = 0; i < text.length; ) {
+    const ch = text[i];
+    if (inStr) {
+      out += ch;
+      if (ch === "\\") {
+        out += text[i + 1] ?? "";
+        i += 2;
+        continue;
+      }
+      if (ch === '"') inStr = false;
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      inStr = true;
+      out += ch;
+      i++;
+      continue;
+    }
+    if (ch === "-" || ch >= "0" && ch <= "9") {
+      let j = ch === "-" ? i + 1 : i;
+      let digits = 0;
+      while (j < text.length && text[j] >= "0" && text[j] <= "9") {
+        digits++;
+        j++;
+      }
+      const next = text[j];
+      const isIntToken = digits > 0 && next !== "." && next !== "e" && next !== "E";
+      if (isIntToken && digits >= 16) {
+        out += `"${BIGINT_OPEN}${text.slice(i, j)}${BIGINT_CLOSE}"`;
+      } else {
+        out += text.slice(i, j || i + 1);
+      }
+      i = j > i ? j : i + 1;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function restoreBigInts(text) {
+  if (!text.includes(BIGINT_OPEN)) return text;
+  return text.replace(new RegExp(`"${BIGINT_OPEN}(-?\\d+)${BIGINT_CLOSE}"`, "g"), "$1");
+}
+function isHeaderMutation(action) {
+  return action === "set-header" || action === "remove-header" || action === "harden-cookie";
+}
+function applyHeaderMutation(headers, rule) {
+  if (rule.action === "remove-header") {
+    for (const name of rule.remove_headers ?? []) headers[String(name).toLowerCase()] = null;
+    return;
+  }
+  if (rule.action === "set-header") {
+    const ensure = rule.ensure === true;
+    for (const [name, value] of Object.entries(rule.set_headers ?? {})) {
+      const key = String(name).toLowerCase();
+      const present = headers[key] != null && headers[key] !== "";
+      if (ensure && present) continue;
+      headers[key] = String(value);
+    }
+    return;
+  }
+  if (rule.action === "harden-cookie") {
+    const cookie = headers["set-cookie"];
+    const flags = rule.cookie_flags ?? {};
+    if (Array.isArray(cookie)) {
+      headers["set-cookie"] = cookie.map((c) => typeof c === "string" ? hardenCookie(c, flags) : c);
+    } else if (typeof cookie === "string") {
+      headers["set-cookie"] = hardenCookie(cookie, flags);
+    }
+  }
+}
+function hardenCookie(cookie, { httpOnly = true, secure = true, sameSite = "Lax" } = {}) {
+  let out = String(cookie);
+  if (httpOnly && !/;\s*httponly/i.test(out)) out += "; HttpOnly";
+  if (secure && !/;\s*secure/i.test(out)) out += "; Secure";
+  if (sameSite && !/;\s*samesite\s*=/i.test(out)) out += `; SameSite=${sameSite}`;
+  return out;
+}
+function rebuildResponse(response, body, redactedHeaders) {
+  const headers = new Headers(response.headers);
+  headers.delete("content-length");
+  if (redactedHeaders) {
+    for (const [name, value] of Object.entries(redactedHeaders)) {
+      if (value === null || value === void 0) {
+        try {
+          headers.delete(name);
+        } catch {
+        }
+      } else if (typeof value === "string") {
+        if (headers.get(name) !== value) {
+          try {
+            headers.set(name, value);
+          } catch {
+          }
+        }
+      } else if (Array.isArray(value)) {
+        try {
+          headers.delete(name);
+          for (const item of value) headers.append(name, String(item));
+        } catch {
+        }
+      }
+    }
+  }
+  const nullBody = response.status === 101 || response.status === 204 || response.status === 205 || response.status === 304;
+  return new Response(nullBody ? null : body, { status: response.status, statusText: response.statusText, headers });
+}
+function leakResponse() {
+  return new Response(JSON.stringify({ error: "Response withheld by Patchstack (sensitive data detected)" }), {
+    status: 500,
+    headers: { "content-type": "application/json" }
+  });
+}
+var BLOCK_MESSAGE = "This request has been blocked by Patchstack.";
+function blockBody(result) {
+  return { error: BLOCK_MESSAGE, message: BLOCK_MESSAGE, rule: result?.rule?.id };
+}
+function isDocumentNavigation(getHeader) {
+  const dest = getHeader("sec-fetch-dest");
+  if (dest) return dest === "document";
+  return (getHeader("accept") || "").includes("text/html");
+}
+function blockResponse(result, request) {
+  if (request && isDocumentNavigation((n) => request.headers.get(n))) {
+    return new Response(renderBlockPage({ url: request.url, code: result?.rule?.id }), {
+      status: 403,
+      headers: { "content-type": "text/html; charset=utf-8" }
+    });
+  }
+  return new Response(JSON.stringify(blockBody(result)), {
+    status: 403,
+    headers: { "content-type": "application/json" }
+  });
+}
+function defaultOnDetect({ phase, mode, category, rule, message }) {
+  const tag = mode === "block" ? "BLOCK" : "DETECT (dry-run)";
+  console.warn(`[patchstack] ${tag} phase=${phase ?? "request"} category=${category ?? "?"} rule=${rule?.id ?? "?"} ${message ?? ""}`.trim());
+}
+function fetchRequestMeta(request) {
+  if (!request) return {};
+  let path = null;
+  try {
+    path = new URL(request.url).pathname;
+  } catch {
+    path = typeof request.url === "string" ? request.url : null;
+  }
+  return {
+    method: request.method ?? null,
+    path,
+    ip: request.headers?.get?.("x-forwarded-for") ?? null,
+    userAgent: request.headers?.get?.("user-agent") ?? null
+  };
+}
+function nodeRequestMeta(req) {
+  if (!req) return {};
+  const headers = req.headers ?? {};
+  const ua = headers["user-agent"] ?? headers["User-Agent"];
+  const fwd = headers["x-forwarded-for"] ?? headers["X-Forwarded-For"];
+  return {
+    method: req.method ?? null,
+    path: req.originalUrl || req.url || null,
+    ip: req.ip ?? (typeof fwd === "string" ? fwd : null),
+    userAgent: typeof ua === "string" ? ua : Array.isArray(ua) ? ua[0] : null
+  };
+}
+export {
+  GUARD_PATH,
+  PulseRuleClient,
+  createProtection,
+  createServerFnGuard,
+  createSupabaseGuard
+};
+//# sourceMappingURL=protect.edge.js.map