@patchstack/connect 0.3.25 → 0.3.27

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
 
 // src/parsers/index.ts
 import { access } from "fs/promises";
@@ -931,8 +931,8 @@ function computeManifestChecksum(packages) {
 var TOKEN_SKEW_MS = 6e4;
 function buildTokenUrl(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  const path12 = url.pathname.replace(/\/$/, "");
+  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1018,8 +1018,8 @@ function buildEndpointUrl(base, siteUuid) {
 }
 function buildRulesUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
+  const path12 = url.pathname.replace(/\/$/, "");
+  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1034,16 +1034,16 @@ function buildSettingsUrl(endpoint, siteUuid) {
 }
 function buildPackageRemovedUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
+  const path12 = url.pathname.replace(/\/$/, "");
+  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
 }
 function buildInputMapUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
+  const path12 = url.pathname.replace(/\/$/, "");
+  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1457,13 +1457,9 @@ async function persistSiteUuid(cwd, siteUuid) {
   return writeConfigFile(cwd, { ...existing, siteUuid });
 }
 async function persistApiKey(cwd, apiKey) {
-  const existing = await readConfigFile(cwd);
+  const { pulseAuth: _dropped, ...existing } = await readConfigFile(cwd);
   return writeConfigFile(cwd, { ...existing, apiKey });
 }
-async function persistPulseAuth(cwd, pulseAuth) {
-  const existing = await readConfigFile(cwd);
-  return writeConfigFile(cwd, { ...existing, pulseAuth });
-}
 async function readConfigFile(cwd) {
   const target = path6.join(cwd, CONFIG_FILENAME);
   let raw;
@@ -2953,17 +2949,40 @@ function renderGuideChecklist(state, useColor) {
 }
 
 // src/login.ts
+import { mkdtempSync, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync6 } from "fs";
+import { tmpdir } from "os";
+import path10 from "path";
+import { createHash as createHash2 } from "crypto";
 function baseFrom(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? path11.slice(0, -"/manifest".length) : "/monitor/pulse";
+  const p = url.pathname.replace(/\/$/, "");
+  url.pathname = p.endsWith("/manifest") ? p.slice(0, -"/manifest".length) : "/monitor/pulse";
   url.search = "";
   url.hash = "";
   return url.toString().replace(/\/$/, "");
 }
-async function login(config, onPrompt, deps = {}) {
+function pendingPath(siteUuid) {
+  const key = createHash2("sha256").update(siteUuid).digest("hex").slice(0, 16);
+  return path10.join(tmpdir(), `patchstack-login-${key}.json`);
+}
+function savePendingLogin(siteUuid, pending) {
+  writeFileSync6(pendingPath(siteUuid), JSON.stringify(pending), { encoding: "utf8", mode: 384 });
+}
+function readPendingLogin(siteUuid) {
+  try {
+    return JSON.parse(readFileSync6(pendingPath(siteUuid), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function clearPendingLogin(siteUuid) {
+  try {
+    rmSync(pendingPath(siteUuid));
+  } catch {
+  }
+}
+async function startLogin(config, deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = deps.now ?? (() => Date.now());
   if (config.siteUuid === null) {
     return { status: "failed", message: "No site UUID configured \u2014 run `patchstack-connect scan` first." };
@@ -2986,29 +3005,72 @@ async function login(config, onPrompt, deps = {}) {
   if (!started.ok) {
     return { status: "failed", message: `Could not start the login (HTTP ${started.status}).` };
   }
-  const { device_code: deviceCode, user_code: userCode, expires_in: expiresIn, interval } = await started.json();
-  const verificationUri = `${base}/device?code=${encodeURIComponent(userCode)}`;
-  onPrompt(userCode, verificationUri);
-  const deadline = now() + expiresIn * 1e3;
-  const intervalMs = Math.max(1, interval) * 1e3;
+  const body = await started.json();
+  const pending = {
+    deviceCode: body.device_code,
+    userCode: body.user_code,
+    // Points at the API, which redirects to the dashboard SPA — the CLI only
+    // knows the API origin, and the approval page lives on the app.
+    verificationUri: `${base}/device?code=${encodeURIComponent(body.user_code)}`,
+    expiresAt: now() + body.expires_in * 1e3,
+    intervalMs: Math.max(1, body.interval) * 1e3
+  };
+  savePendingLogin(config.siteUuid, pending);
+  return { status: "started", pending };
+}
+async function redeemIfApproved(config, pending, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const polled = await fetchImpl(`${baseFrom(config.endpoint)}/device/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ device_code: pending.deviceCode })
+  });
+  if (polled.status === 428) return "pending";
+  if (!polled.ok) {
+    if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
+    return "expired";
+  }
+  const { api_key: apiKey } = await polled.json();
+  if (typeof apiKey !== "string" || apiKey.length === 0) return "expired";
+  await persistApiKey(process.cwd(), apiKey);
+  if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
+  return "approved";
+}
+async function waitForApproval(config, pending, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Date.now());
+  const deadline = Math.min(pending.expiresAt, deps.until ?? pending.expiresAt);
+  const expired = { status: "expired", message: "The login request expired. Run the command again." };
   while (now() < deadline) {
-    await sleep(intervalMs);
-    const polled = await fetchImpl(`${base}/device/token`, {
+    await sleep(pending.intervalMs);
+    const polled = await fetchImpl(`${baseFrom(config.endpoint)}/device/token`, {
       method: "POST",
       headers: { "Content-Type": "application/json", Accept: "application/json" },
-      body: JSON.stringify({ device_code: deviceCode })
+      body: JSON.stringify({ device_code: pending.deviceCode })
     });
     if (polled.status === 428) continue;
-    if (!polled.ok) return { status: "expired", message: "The login request expired. Run the command again." };
+    if (!polled.ok) {
+      if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
+      return expired;
+    }
     const { api_key: apiKey } = await polled.json();
     if (typeof apiKey !== "string" || apiKey.length === 0) {
       return { status: "failed", message: "Patchstack approved the request but returned no credential." };
     }
-    await persistPulseAuth(process.cwd(), apiKey);
     await persistApiKey(process.cwd(), apiKey);
-    return { status: "approved", userCode, verificationUri };
+    if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
+    return { status: "approved", userCode: pending.userCode, verificationUri: pending.verificationUri };
+  }
+  return expired;
+}
+async function login(config, onPrompt, deps = {}) {
+  const started = await startLogin(config, deps);
+  if (started.status !== "started" || started.pending === void 0) {
+    return { status: started.status === "started" ? "failed" : started.status, message: started.message };
   }
-  return { status: "expired", message: "The login request expired. Run the command again." };
+  onPrompt(started.pending.userCode, started.pending.verificationUri);
+  return waitForApproval(config, started.pending, deps);
 }
 
 // src/map/ts-loader.ts
@@ -3032,8 +3094,8 @@ async function loadTypeScript(cwd) {
 }
 
 // src/map/extract.ts
-import { readFileSync as readFileSync10, realpathSync as realpathSync3 } from "fs";
-import { createHash as createHash3 } from "crypto";
+import { readFileSync as readFileSync11, realpathSync as realpathSync3 } from "fs";
+import { createHash as createHash4 } from "crypto";
 import { relative as relative4 } from "path";
 
 // src/map/ast.ts
@@ -3288,7 +3350,7 @@ function npmPackageOf(spec) {
 }
 
 // src/map/sources.ts
-import { readFileSync as readFileSync6, readdirSync as readdirSync5, realpathSync, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync7, readdirSync as readdirSync5, realpathSync, statSync as statSync3 } from "fs";
 import { join as join12, relative as relative2, isAbsolute } from "path";
 
 // src/map/routes.ts
@@ -3373,7 +3435,7 @@ function hasEntrySignal(text) {
 }
 function detectFramework(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync6(join12(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync7(join12(cwd, "package.json"), "utf8"));
     const d = { ...pkg.dependencies, ...pkg.devDependencies };
     if (d["@tanstack/react-start"] || d["@tanstack/start"] || d["@tanstack/solid-start"]) return "tanstack-start";
     if (d["next"]) return "next";
@@ -3501,10 +3563,10 @@ function detectDeploymentShapes(cwd, opts = {}) {
     boundary = realpathSync(boundary);
   } catch {
   }
-  const inProject = (path11) => {
+  const inProject = (path12) => {
     if (opts.followOutside) return true;
     try {
-      return isInside(realpathSync(path11), boundary);
+      return isInside(realpathSync(path12), boundary);
     } catch {
       return false;
     }
@@ -3570,7 +3632,7 @@ function holdsSourceFile(dir) {
 }
 
 // src/map/surface.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { join as join13 } from "path";
 var STATIC_GENERATORS = [
   { dep: "vite", label: "vite" },
@@ -3609,7 +3671,7 @@ var SHAPE_SIGNAL = {
 };
 function readManifest(cwd) {
   try {
-    const parsed = JSON.parse(readFileSync7(join13(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync8(join13(cwd, "package.json"), "utf8"));
     return typeof parsed === "object" && parsed !== null ? parsed : null;
   } catch {
     return null;
@@ -3622,7 +3684,7 @@ function nextExportsStatically(cwd, manifest, ts) {
   for (const file of ["next.config.js", "next.config.mjs", "next.config.ts", "next.config.cjs"]) {
     let text;
     try {
-      text = readFileSync7(join13(cwd, file), "utf8");
+      text = readFileSync8(join13(cwd, file), "utf8");
     } catch {
       continue;
     }
@@ -3741,7 +3803,7 @@ function classifyServerSurface(cwd, endpointCount, deploymentShapes, ts) {
 }
 function surfaceNote(surface) {
   if (surface.state === "server-runtime-detected") {
-    return "serverSurface: a server runtime was recognized in the analysed source (see its evidence). Request-path protection applies to this app.";
+    return "serverSurface: a server runtime was recognized in the analysed source (see its evidence). Request-path shielding is APPLICABLE to these paths \u2014 this is not a statement that a guard is installed, fetching rules, or enforcing them.";
   }
   if (surface.state === "static-build-detected") {
     return "serverSurface: a static build was identified and no server runtime was recognized in the analysed source. This is NOT deployment attestation \u2014 it describes the source, not what is deployed, and a serverless function added at the platform level would not appear here. Advisories against this app are dependency and bundle concerns rather than request-path risk.";
@@ -3750,7 +3812,7 @@ function surfaceNote(surface) {
 }
 
 // src/map/sinks.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 var DB_OPS = /* @__PURE__ */ new Set(["insert", "update", "delete", "select", "upsert", "rpc"]);
 var PRISMA_OPS = /* @__PURE__ */ new Set(["create", "createMany", "update", "updateMany", "delete", "deleteMany", "upsert", "findFirst", "findUnique", "findMany", "count", "aggregate"]);
 var FS_CALLS = /^(readFile|writeFile|readFileSync|writeFileSync|appendFile|createReadStream|createWriteStream|unlink|rm|rmSync|mkdir|readdir|stat|open)$/;
@@ -4006,7 +4068,7 @@ function argumentRoleOf(sinkKind, method, index, total = 0) {
   return table?.[index] ?? "unknown";
 }
 function sinkId(s, owner) {
-  return createHash2("sha256").update([s.kind, s.provider, s.package, s.table, s.op, s.file ?? owner, s.start, s.end].join("|")).digest("hex").slice(0, 12);
+  return createHash3("sha256").update([s.kind, s.provider, s.package, s.table, s.op, s.file ?? owner, s.start, s.end].join("|")).digest("hex").slice(0, 12);
 }
 function dedupeSinks(sinks, owner) {
   const seen = /* @__PURE__ */ new Set();
@@ -4022,7 +4084,7 @@ function dedupeSinks(sinks, owner) {
 }
 
 // src/map/module-graph.ts
-import { readFileSync as readFileSync8, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync9, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
 import { dirname as dirname4, join as join14, relative as relative3, resolve as resolvePath } from "path";
 var RESOLVE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 function createModuleGraph(ts, opts) {
@@ -4031,7 +4093,7 @@ function createModuleGraph(ts, opts) {
     if (cache.has(file)) return cache.get(file) ?? null;
     let entry = null;
     try {
-      const text = readFileSync8(file, "utf8");
+      const text = readFileSync9(file, "utf8");
       const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
       const bindings = buildModuleBindings(sf, ts);
       entry = { fnSinks: collectLocalSinks(sf, ts, bindings), calleesOf: collectCallees(sf, ts), bindings };
@@ -4130,8 +4192,8 @@ function collectCallees(sf, ts) {
 }
 
 // src/map/coordinates.ts
-function runtimeCoordinate(source, path11) {
-  if (/\[\d*\]/.test(path11)) {
+function runtimeCoordinate(source, path12) {
+  if (/\[\d*\]/.test(path12)) {
     return { runtimeParameter: null, runtimeParameterReason: "array traversal: needs an array_key_value rule, not a dotted parameter" };
   }
   switch (source) {
@@ -4140,15 +4202,15 @@ function runtimeCoordinate(source, path11) {
     case "multipart":
     case "body":
     case "server-fn-data":
-      return { runtimeParameter: `post.${path11}` };
+      return { runtimeParameter: `post.${path12}` };
     case "query":
-      return { runtimeParameter: `get.${path11}` };
+      return { runtimeParameter: `get.${path12}` };
     case "cookie":
-      return { runtimeParameter: `cookie.${path11}` };
+      return { runtimeParameter: `cookie.${path12}` };
     case "file":
-      return { runtimeParameter: `files.${path11}` };
+      return { runtimeParameter: `files.${path12}` };
     case "header":
-      return { runtimeParameter: `server.HTTP_${path11.toUpperCase().replace(/-/g, "_")}` };
+      return { runtimeParameter: `server.HTTP_${path12.toUpperCase().replace(/-/g, "_")}` };
     case "route-param":
       return { runtimeParameter: null, runtimeParameterReason: "route parameters are not exposed by the runtime resolver" };
     default:
@@ -4180,8 +4242,8 @@ function addressSpaceOf(source) {
 function isProvenFlow(confidence) {
   return confidence === "exact-local" || confidence === "transformed-local";
 }
-function inputIdOf(source, path11) {
-  return `${addressSpaceOf(source)}:${path11}`;
+function inputIdOf(source, path12) {
+  return `${addressSpaceOf(source)}:${path12}`;
 }
 function withCoordinates(fields, source) {
   return fields.map((f) => {
@@ -4380,8 +4442,8 @@ function linkFlows(bodyNode, params, inputs, sinks, ts) {
   if (!bodyNode || sinks.length === 0 || inputs.length === 0) return { flows: [], limitations: [] };
   const CONTAINER_KEYS = /* @__PURE__ */ new Set([...REQ_SOURCES, "data", "input", "payload"]);
   const rootPath = /* @__PURE__ */ new Map();
-  const addRoot = (name, path11, space) => {
-    if (!rootPath.has(name)) rootPath.set(name, { path: path11, space });
+  const addRoot = (name, path12, space) => {
+    if (!rootPath.has(name)) rootPath.set(name, { path: path12, space });
   };
   for (const p of params ?? []) {
     if (!p?.name) continue;
@@ -4526,8 +4588,8 @@ function dedupeLimitations(list) {
 function join22(base, seg) {
   return base ? `${base}.${seg}` : seg;
 }
-function normalizePath(path11) {
-  return path11.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
+function normalizePath(path12) {
+  return path12.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
 }
 function fluentChainCalls(call, ts) {
   let root = call;
@@ -4773,7 +4835,7 @@ function handlerEntry(name, kindLabel, params, body, ts, localSinks, bindings, c
 }
 
 // src/map/imports.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { join as join15 } from "path";
 var MAX_SITES = 5;
 var NPM_NAME = /^(?:@[^/@\s~][^/@\s]*\/)?[^/@\s.~][^/@\s]*$/;
@@ -4785,7 +4847,7 @@ function readPathAliases(cwd) {
   for (const name of ["tsconfig.json", "jsconfig.json"]) {
     let paths;
     try {
-      const raw = readFileSync9(join15(cwd, name), "utf8");
+      const raw = readFileSync10(join15(cwd, name), "utf8");
       const parsed = JSON.parse(stripJsonComments(raw));
       paths = parsed.compilerOptions?.paths;
     } catch {
@@ -5164,7 +5226,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   const hopTargets = /* @__PURE__ */ new Set();
   for (const file of files) {
     try {
-      const text = readFileSync10(file, "utf8");
+      const text = readFileSync11(file, "utf8");
       const relFile = relative4(cwd, file);
       sourceBytes += text.length;
       if (!hasEntrySignal(text)) {
@@ -5177,7 +5239,7 @@ async function extractInputMap(cwd, ts, options = {}) {
       }
       parsed++;
       entryFiles.add(file);
-      const fingerprint = createHash3("sha256").update(text).digest("hex").slice(0, 16);
+      const fingerprint = createHash4("sha256").update(text).digest("hex").slice(0, 16);
       const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
       const bindings = buildModuleBindings(sf, ts);
       for (const specifier of bindings.imports) {
@@ -5219,7 +5281,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   for (const target of hopTargets) {
     if (entryFiles.has(target)) continue;
     try {
-      const text = readFileSync10(target, "utf8");
+      const text = readFileSync11(target, "utf8");
       const sf = ts.createSourceFile(target, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, target));
       const bindings = buildModuleBindings(sf, ts);
       const called = collectInvocations(sf, ts, bindings, { file: target, owner: relative4(cwd, target), graph });
@@ -5350,8 +5412,8 @@ async function buildInputMap(cwd, options = {}) {
 }
 
 // src/setup.ts
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
-import path10 from "path";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
+import path11 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
 function setupProtection(cwd) {
@@ -5369,8 +5431,8 @@ function appendHook(existing, command) {
   return `${existing} && ${command}`;
 }
 function wireBuildScripts(cwd, packageManager) {
-  const target = path10.join(cwd, "package.json");
-  const raw = readFileSync11(target, "utf8");
+  const target = path11.join(cwd, "package.json");
+  const raw = readFileSync12(target, "utf8");
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
   const build = scripts.build;
@@ -5419,7 +5481,7 @@ function wireBuildScripts(cwd, packageManager) {
   const indentMatch = raw.match(/^[\t ]+(?=")/m)?.[0];
   const indent = indentMatch?.includes("	") ? "	" : indentMatch?.length ?? 2;
   const trailingNewline = raw.endsWith("\n") ? "\n" : "";
-  writeFileSync6(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
+  writeFileSync7(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
   if (build === void 0 || build.trim().length === 0) {
     return {
       changed: true,
@@ -5497,11 +5559,21 @@ Usage:
                                                      what's missing, with tailored commands), then
                                                      print the full setup guide. --full prints the
                                                      guide even when setup is complete
-  patchstack-connect login  [options]                Recover this site's Patchstack credential when
-                                                     .patchstackrc.json has been lost. Prints a short
-                                                     code to approve in the dashboard; approving
-                                                     rotates the credential, so the old one stops
-                                                     working
+  patchstack-connect login  [--wait]                 Recover this site's credential when
+                                                     .patchstackrc.json has been lost. Prints a link
+                                                     for the site's OWNER to approve in the dashboard.
+                                                     In a terminal it then waits. When the output is
+                                                     piped or captured \u2014 an assistant running it \u2014 it
+                                                     prints the link and EXITS, so the link is visible
+                                                     immediately. Run it AGAIN once the user confirms
+                                                     they approved: it resumes the same request rather
+                                                     than starting a new one, and finishes the flow.
+                                                     --wait blocks instead of returning. Use this
+                                                     instead of deleting
+                                                     .patchstackrc.json and re-scanning, which would
+                                                     provision a second site. Approving ROTATES the
+                                                     credential: CI, deploys and other machines using
+                                                     the old one must be updated. Not usable in CI
   patchstack-connect help                            Print this message
 
 Options (for scan, setup, status, and uninstall):
@@ -5520,7 +5592,7 @@ Options (for demo and demo-guide):
 Environment:
   PATCHSTACK_SITE_UUID    Site UUID
   PATCHSTACK_API_KEY      WP-format site API key for block-log reporting (never put in the widget)
-  PATCHSTACK_PULSE_AUTH   Credential for authenticated Pulse ingest (defaults to PATCHSTACK_API_KEY)
+  PATCHSTACK_PULSE_AUTH   Only if Pulse ingest uses a different credential from block-logs
   PATCHSTACK_TELEMETRY    Set to off to disable block-log reporting
   PATCHSTACK_API_BASE     API origin for /oauth/token and /api/logs/log (default: https://api.patchstack.com)
   PATCHSTACK_ENDPOINT     API endpoint (default: https://api.patchstack.com/monitor/pulse/manifest)
@@ -5602,17 +5674,66 @@ async function runLogin(args) {
     cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
     cliEndpoint: getStringFlag(args.flags, "endpoint")
   });
-  const result = await login(config, (userCode, verificationUri) => {
+  const approved = () => {
+    console.log("\n  \u2713 Credential restored and saved to .patchstackrc.json.");
+    console.log("    The previous credential no longer works. Update it anywhere else it was set:");
+    console.log("    CI secrets, hosting env vars, preview environments, other checkouts.\n");
+    return 0;
+  };
+  if (args.flags.has("wait")) {
+    const pending = config.siteUuid === null ? null : readPendingLogin(config.siteUuid);
+    if (pending === null) {
+      console.error("\n  No login is waiting for approval. Run `patchstack-connect login` first.\n");
+      return 1;
+    }
+    const resumed = await waitForApproval(config, pending);
+    if (resumed.status === "approved") return approved();
+    console.error(`
+  ${resumed.message ?? "Login failed."}
+`);
+    return 1;
+  }
+  const prompt = (userCode, verificationUri) => {
     console.log(`
   Your code:  ${userCode}`);
     console.log(`  Approve at: ${verificationUri}
 `);
-    console.log("  Waiting for approval\u2026");
-  });
-  if (result.status === "approved") {
-    console.log("\n  \u2713 Credential restored and saved to .patchstackrc.json.\n");
+    console.log("  Open that link and approve it as the site's owner. Approving issues a new");
+    console.log("  credential and stops the current one working \u2014 CI, deploys and any other");
+    console.log("  machine using it will need the new value.\n");
+  };
+  if (process.stdout.isTTY !== true) {
+    const existing = config.siteUuid === null ? null : readPendingLogin(config.siteUuid);
+    if (existing !== null && Date.now() < existing.expiresAt) {
+      const outcome = await redeemIfApproved(config, existing);
+      if (outcome === "approved") return approved();
+      if (outcome === "pending") {
+        const secondsLeft = Math.round((existing.expiresAt - Date.now()) / 1e3);
+        console.log(`
+  Still waiting for approval of code ${existing.userCode}.`);
+        console.log(`  Approve at: ${existing.verificationUri}`);
+        console.log(`  (valid for another ${secondsLeft}s \u2014 run this again once the user confirms)
+`);
+        return 0;
+      }
+    }
+    const started = await startLogin(config);
+    if (started.status !== "started" || started.pending === void 0) {
+      console.error(`
+  ${started.message ?? "Login failed."}
+`);
+      return 1;
+    }
+    prompt(started.pending.userCode, started.pending.verificationUri);
+    console.log("  Give that link to the user. When they confirm they have approved it, run");
+    console.log("  this same command again (or `login --wait` to block until they do).\n");
     return 0;
   }
+  const result = await login(config, (userCode, verificationUri) => {
+    prompt(userCode, verificationUri);
+    console.log("  Waiting for approval (the code expires in 10 minutes)\u2026");
+  });
+  if (result.status === "approved") return approved();
   console.error(`
   ${result.message ?? "Login failed."}
 `);
@@ -5661,7 +5782,7 @@ async function runMap(args) {
   const json = JSON.stringify(map, null, 2);
   const out = getStringFlag(args.flags, "out");
   if (out) {
-    writeFileSync7(out, json);
+    writeFileSync8(out, json);
     console.error(`patchstack: wrote ${out}`);
   } else if (args.flags.get("upload") !== true) {
     console.log(json);
@@ -5745,7 +5866,6 @@ async function runScan(args, options = {}) {
   }
   if (typeof response.api_key === "string" && response.api_key.length > 0) {
     const target = await persistApiKey(process.cwd(), response.api_key);
-    await persistPulseAuth(process.cwd(), response.api_key);
     console.log(`Saved API key to ${target} (authenticates Pulse ingest and block-log reporting; keep out of the public widget).`);
   }
   if (response.stored) {
@@ -5948,7 +6068,7 @@ async function runGuide(args) {
   console.log("\u2014\u2014\u2014\u2014 Full reference guide (ships as AGENT-INSTALL.md) \u2014\u2014\u2014\u2014");
   console.log("");
   const guidePath = new URL("../AGENT-INSTALL.md", import.meta.url);
-  console.log(readFileSync12(guidePath, "utf8"));
+  console.log(readFileSync13(guidePath, "utf8"));
   return 0;
 }
 async function runSetup(args) {
@@ -6129,7 +6249,7 @@ async function runMarkBuild(args) {
   let marked = 0;
   let widgetTouched = 0;
   for (const file of files) {
-    const before = readFileSync12(file, "utf8");
+    const before = readFileSync13(file, "utf8");
     let after = injectMarker(before, snippet);
     if (widgetUuid !== null) {
       const ensured = ensureWidgetInHtml(after, widgetUuid);
@@ -6139,7 +6259,7 @@ async function runMarkBuild(args) {
       after = ensured.html;
     }
     if (after !== before) {
-      writeFileSync7(file, after);
+      writeFileSync8(file, after);
       marked += 1;
     }
   }