@patchstack/connect 0.3.26 → 0.3.28

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
 
 // src/parsers/index.ts
 import { access } from "fs/promises";
@@ -931,8 +931,8 @@ function computeManifestChecksum(packages) {
 var TOKEN_SKEW_MS = 6e4;
 function buildTokenUrl(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  const path12 = url.pathname.replace(/\/$/, "");
+  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1016,10 +1016,23 @@ function buildEndpointUrl(base, siteUuid) {
   const trimmed = base.replace(/\/$/, "");
   return siteUuid !== void 0 && siteUuid !== null && siteUuid.length > 0 ? `${trimmed}/${encodeURIComponent(siteUuid)}` : trimmed;
 }
+function authFailureMessage(status, config) {
+  const hasCredential = typeof config.pulseAuth === "string" && config.pulseAuth.length > 0;
+  if (status === 401 && !hasCredential) {
+    return "Patchstack requires an API credential for this site and none is configured. Run `npx patchstack-connect login`, or set PATCHSTACK_API_KEY.";
+  }
+  if (status === 401) {
+    return "Patchstack rejected this API credential. It may have expired, been revoked, or the site may no longer exist. Run `npx patchstack-connect login` to issue a new one.";
+  }
+  if (status === 403) {
+    return "This API credential is not permitted to act on this site. Check that siteUuid in .patchstackrc.json matches the credential (a credential is issued for one site).";
+  }
+  return null;
+}
 function buildRulesUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
+  const path12 = url.pathname.replace(/\/$/, "");
+  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1034,16 +1047,16 @@ function buildSettingsUrl(endpoint, siteUuid) {
 }
 function buildPackageRemovedUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
+  const path12 = url.pathname.replace(/\/$/, "");
+  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
 }
 function buildInputMapUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
+  const path12 = url.pathname.replace(/\/$/, "");
+  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1070,6 +1083,10 @@ async function postInputMap(config, map) {
     if (response.status === 422) {
       return { result: "failed", message: `Patchstack does not accept this map schema (version ${map.version}). Update @patchstack/connect.` };
     }
+    const refused = authFailureMessage(response.status, config);
+    if (refused !== null) {
+      return { result: "failed", message: refused };
+    }
     if (!response.ok) {
       return { result: "failed", message: `Patchstack returned ${response.status}.` };
     }
@@ -1100,6 +1117,13 @@ async function postPackageRemoved(config) {
     if (response.status === 404) {
       return { result: "gone", message: null };
     }
+    if (response.status === 401 && await fetchSiteStatus(config) === "removed") {
+      return { result: "gone", message: null };
+    }
+    const refused = authFailureMessage(response.status, config);
+    if (refused !== null) {
+      return { result: "failed", message: refused };
+    }
     if (!response.ok) {
       return { result: "failed", message: `Patchstack returned ${response.status}.` };
     }
@@ -1181,6 +1205,10 @@ async function postManifest(config, payload) {
       "VALIDATION_ERROR"
     );
   }
+  const refused = authFailureMessage(response.status, config);
+  if (refused !== null) {
+    throw new PatchstackError(refused, "UNAUTHORIZED");
+  }
   if (response.status < 200 || response.status >= 300) {
     throw new PatchstackError(
       `Patchstack returned ${response.status}: ${text.slice(0, 200)}`,
@@ -2949,17 +2977,40 @@ function renderGuideChecklist(state, useColor) {
 }
 
 // src/login.ts
+import { mkdtempSync, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync6 } from "fs";
+import { tmpdir } from "os";
+import path10 from "path";
+import { createHash as createHash2 } from "crypto";
 function baseFrom(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path11 = url.pathname.replace(/\/$/, "");
-  url.pathname = path11.endsWith("/manifest") ? path11.slice(0, -"/manifest".length) : "/monitor/pulse";
+  const p = url.pathname.replace(/\/$/, "");
+  url.pathname = p.endsWith("/manifest") ? p.slice(0, -"/manifest".length) : "/monitor/pulse";
   url.search = "";
   url.hash = "";
   return url.toString().replace(/\/$/, "");
 }
-async function login(config, onPrompt, deps = {}) {
+function pendingPath(siteUuid) {
+  const key = createHash2("sha256").update(siteUuid).digest("hex").slice(0, 16);
+  return path10.join(tmpdir(), `patchstack-login-${key}.json`);
+}
+function savePendingLogin(siteUuid, pending) {
+  writeFileSync6(pendingPath(siteUuid), JSON.stringify(pending), { encoding: "utf8", mode: 384 });
+}
+function readPendingLogin(siteUuid) {
+  try {
+    return JSON.parse(readFileSync6(pendingPath(siteUuid), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function clearPendingLogin(siteUuid) {
+  try {
+    rmSync(pendingPath(siteUuid));
+  } catch {
+  }
+}
+async function startLogin(config, deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = deps.now ?? (() => Date.now());
   if (config.siteUuid === null) {
     return { status: "failed", message: "No site UUID configured \u2014 run `patchstack-connect scan` first." };
@@ -2982,28 +3033,72 @@ async function login(config, onPrompt, deps = {}) {
   if (!started.ok) {
     return { status: "failed", message: `Could not start the login (HTTP ${started.status}).` };
   }
-  const { device_code: deviceCode, user_code: userCode, expires_in: expiresIn, interval } = await started.json();
-  const verificationUri = `${base}/device?code=${encodeURIComponent(userCode)}`;
-  onPrompt(userCode, verificationUri);
-  const deadline = now() + expiresIn * 1e3;
-  const intervalMs = Math.max(1, interval) * 1e3;
+  const body = await started.json();
+  const pending = {
+    deviceCode: body.device_code,
+    userCode: body.user_code,
+    // Points at the API, which redirects to the dashboard SPA — the CLI only
+    // knows the API origin, and the approval page lives on the app.
+    verificationUri: `${base}/device?code=${encodeURIComponent(body.user_code)}`,
+    expiresAt: now() + body.expires_in * 1e3,
+    intervalMs: Math.max(1, body.interval) * 1e3
+  };
+  savePendingLogin(config.siteUuid, pending);
+  return { status: "started", pending };
+}
+async function redeemIfApproved(config, pending, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const polled = await fetchImpl(`${baseFrom(config.endpoint)}/device/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ device_code: pending.deviceCode })
+  });
+  if (polled.status === 428) return "pending";
+  if (!polled.ok) {
+    if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
+    return "expired";
+  }
+  const { api_key: apiKey } = await polled.json();
+  if (typeof apiKey !== "string" || apiKey.length === 0) return "expired";
+  await persistApiKey(process.cwd(), apiKey);
+  if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
+  return "approved";
+}
+async function waitForApproval(config, pending, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Date.now());
+  const deadline = Math.min(pending.expiresAt, deps.until ?? pending.expiresAt);
+  const expired = { status: "expired", message: "The login request expired. Run the command again." };
   while (now() < deadline) {
-    await sleep(intervalMs);
-    const polled = await fetchImpl(`${base}/device/token`, {
+    await sleep(pending.intervalMs);
+    const polled = await fetchImpl(`${baseFrom(config.endpoint)}/device/token`, {
       method: "POST",
       headers: { "Content-Type": "application/json", Accept: "application/json" },
-      body: JSON.stringify({ device_code: deviceCode })
+      body: JSON.stringify({ device_code: pending.deviceCode })
     });
     if (polled.status === 428) continue;
-    if (!polled.ok) return { status: "expired", message: "The login request expired. Run the command again." };
+    if (!polled.ok) {
+      if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
+      return expired;
+    }
     const { api_key: apiKey } = await polled.json();
     if (typeof apiKey !== "string" || apiKey.length === 0) {
       return { status: "failed", message: "Patchstack approved the request but returned no credential." };
     }
     await persistApiKey(process.cwd(), apiKey);
-    return { status: "approved", userCode, verificationUri };
+    if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
+    return { status: "approved", userCode: pending.userCode, verificationUri: pending.verificationUri };
   }
-  return { status: "expired", message: "The login request expired. Run the command again." };
+  return expired;
+}
+async function login(config, onPrompt, deps = {}) {
+  const started = await startLogin(config, deps);
+  if (started.status !== "started" || started.pending === void 0) {
+    return { status: started.status === "started" ? "failed" : started.status, message: started.message };
+  }
+  onPrompt(started.pending.userCode, started.pending.verificationUri);
+  return waitForApproval(config, started.pending, deps);
 }
 
 // src/map/ts-loader.ts
@@ -3027,8 +3122,8 @@ async function loadTypeScript(cwd) {
 }
 
 // src/map/extract.ts
-import { readFileSync as readFileSync10, realpathSync as realpathSync3 } from "fs";
-import { createHash as createHash3 } from "crypto";
+import { readFileSync as readFileSync11, realpathSync as realpathSync3 } from "fs";
+import { createHash as createHash4 } from "crypto";
 import { relative as relative4 } from "path";
 
 // src/map/ast.ts
@@ -3283,7 +3378,7 @@ function npmPackageOf(spec) {
 }
 
 // src/map/sources.ts
-import { readFileSync as readFileSync6, readdirSync as readdirSync5, realpathSync, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync7, readdirSync as readdirSync5, realpathSync, statSync as statSync3 } from "fs";
 import { join as join12, relative as relative2, isAbsolute } from "path";
 
 // src/map/routes.ts
@@ -3368,7 +3463,7 @@ function hasEntrySignal(text) {
 }
 function detectFramework(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync6(join12(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync7(join12(cwd, "package.json"), "utf8"));
     const d = { ...pkg.dependencies, ...pkg.devDependencies };
     if (d["@tanstack/react-start"] || d["@tanstack/start"] || d["@tanstack/solid-start"]) return "tanstack-start";
     if (d["next"]) return "next";
@@ -3496,10 +3591,10 @@ function detectDeploymentShapes(cwd, opts = {}) {
     boundary = realpathSync(boundary);
   } catch {
   }
-  const inProject = (path11) => {
+  const inProject = (path12) => {
     if (opts.followOutside) return true;
     try {
-      return isInside(realpathSync(path11), boundary);
+      return isInside(realpathSync(path12), boundary);
     } catch {
       return false;
     }
@@ -3565,7 +3660,7 @@ function holdsSourceFile(dir) {
 }
 
 // src/map/surface.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { join as join13 } from "path";
 var STATIC_GENERATORS = [
   { dep: "vite", label: "vite" },
@@ -3604,7 +3699,7 @@ var SHAPE_SIGNAL = {
 };
 function readManifest(cwd) {
   try {
-    const parsed = JSON.parse(readFileSync7(join13(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync8(join13(cwd, "package.json"), "utf8"));
     return typeof parsed === "object" && parsed !== null ? parsed : null;
   } catch {
     return null;
@@ -3617,7 +3712,7 @@ function nextExportsStatically(cwd, manifest, ts) {
   for (const file of ["next.config.js", "next.config.mjs", "next.config.ts", "next.config.cjs"]) {
     let text;
     try {
-      text = readFileSync7(join13(cwd, file), "utf8");
+      text = readFileSync8(join13(cwd, file), "utf8");
     } catch {
       continue;
     }
@@ -3745,7 +3840,7 @@ function surfaceNote(surface) {
 }
 
 // src/map/sinks.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 var DB_OPS = /* @__PURE__ */ new Set(["insert", "update", "delete", "select", "upsert", "rpc"]);
 var PRISMA_OPS = /* @__PURE__ */ new Set(["create", "createMany", "update", "updateMany", "delete", "deleteMany", "upsert", "findFirst", "findUnique", "findMany", "count", "aggregate"]);
 var FS_CALLS = /^(readFile|writeFile|readFileSync|writeFileSync|appendFile|createReadStream|createWriteStream|unlink|rm|rmSync|mkdir|readdir|stat|open)$/;
@@ -4001,7 +4096,7 @@ function argumentRoleOf(sinkKind, method, index, total = 0) {
   return table?.[index] ?? "unknown";
 }
 function sinkId(s, owner) {
-  return createHash2("sha256").update([s.kind, s.provider, s.package, s.table, s.op, s.file ?? owner, s.start, s.end].join("|")).digest("hex").slice(0, 12);
+  return createHash3("sha256").update([s.kind, s.provider, s.package, s.table, s.op, s.file ?? owner, s.start, s.end].join("|")).digest("hex").slice(0, 12);
 }
 function dedupeSinks(sinks, owner) {
   const seen = /* @__PURE__ */ new Set();
@@ -4017,7 +4112,7 @@ function dedupeSinks(sinks, owner) {
 }
 
 // src/map/module-graph.ts
-import { readFileSync as readFileSync8, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync9, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
 import { dirname as dirname4, join as join14, relative as relative3, resolve as resolvePath } from "path";
 var RESOLVE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 function createModuleGraph(ts, opts) {
@@ -4026,7 +4121,7 @@ function createModuleGraph(ts, opts) {
     if (cache.has(file)) return cache.get(file) ?? null;
     let entry = null;
     try {
-      const text = readFileSync8(file, "utf8");
+      const text = readFileSync9(file, "utf8");
       const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
       const bindings = buildModuleBindings(sf, ts);
       entry = { fnSinks: collectLocalSinks(sf, ts, bindings), calleesOf: collectCallees(sf, ts), bindings };
@@ -4125,8 +4220,8 @@ function collectCallees(sf, ts) {
 }
 
 // src/map/coordinates.ts
-function runtimeCoordinate(source, path11) {
-  if (/\[\d*\]/.test(path11)) {
+function runtimeCoordinate(source, path12) {
+  if (/\[\d*\]/.test(path12)) {
     return { runtimeParameter: null, runtimeParameterReason: "array traversal: needs an array_key_value rule, not a dotted parameter" };
   }
   switch (source) {
@@ -4135,15 +4230,15 @@ function runtimeCoordinate(source, path11) {
     case "multipart":
     case "body":
     case "server-fn-data":
-      return { runtimeParameter: `post.${path11}` };
+      return { runtimeParameter: `post.${path12}` };
     case "query":
-      return { runtimeParameter: `get.${path11}` };
+      return { runtimeParameter: `get.${path12}` };
     case "cookie":
-      return { runtimeParameter: `cookie.${path11}` };
+      return { runtimeParameter: `cookie.${path12}` };
     case "file":
-      return { runtimeParameter: `files.${path11}` };
+      return { runtimeParameter: `files.${path12}` };
     case "header":
-      return { runtimeParameter: `server.HTTP_${path11.toUpperCase().replace(/-/g, "_")}` };
+      return { runtimeParameter: `server.HTTP_${path12.toUpperCase().replace(/-/g, "_")}` };
     case "route-param":
       return { runtimeParameter: null, runtimeParameterReason: "route parameters are not exposed by the runtime resolver" };
     default:
@@ -4175,8 +4270,8 @@ function addressSpaceOf(source) {
 function isProvenFlow(confidence) {
   return confidence === "exact-local" || confidence === "transformed-local";
 }
-function inputIdOf(source, path11) {
-  return `${addressSpaceOf(source)}:${path11}`;
+function inputIdOf(source, path12) {
+  return `${addressSpaceOf(source)}:${path12}`;
 }
 function withCoordinates(fields, source) {
   return fields.map((f) => {
@@ -4375,8 +4470,8 @@ function linkFlows(bodyNode, params, inputs, sinks, ts) {
   if (!bodyNode || sinks.length === 0 || inputs.length === 0) return { flows: [], limitations: [] };
   const CONTAINER_KEYS = /* @__PURE__ */ new Set([...REQ_SOURCES, "data", "input", "payload"]);
   const rootPath = /* @__PURE__ */ new Map();
-  const addRoot = (name, path11, space) => {
-    if (!rootPath.has(name)) rootPath.set(name, { path: path11, space });
+  const addRoot = (name, path12, space) => {
+    if (!rootPath.has(name)) rootPath.set(name, { path: path12, space });
   };
   for (const p of params ?? []) {
     if (!p?.name) continue;
@@ -4521,8 +4616,8 @@ function dedupeLimitations(list) {
 function join22(base, seg) {
   return base ? `${base}.${seg}` : seg;
 }
-function normalizePath(path11) {
-  return path11.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
+function normalizePath(path12) {
+  return path12.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
 }
 function fluentChainCalls(call, ts) {
   let root = call;
@@ -4768,7 +4863,7 @@ function handlerEntry(name, kindLabel, params, body, ts, localSinks, bindings, c
 }
 
 // src/map/imports.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { join as join15 } from "path";
 var MAX_SITES = 5;
 var NPM_NAME = /^(?:@[^/@\s~][^/@\s]*\/)?[^/@\s.~][^/@\s]*$/;
@@ -4780,7 +4875,7 @@ function readPathAliases(cwd) {
   for (const name of ["tsconfig.json", "jsconfig.json"]) {
     let paths;
     try {
-      const raw = readFileSync9(join15(cwd, name), "utf8");
+      const raw = readFileSync10(join15(cwd, name), "utf8");
       const parsed = JSON.parse(stripJsonComments(raw));
       paths = parsed.compilerOptions?.paths;
     } catch {
@@ -5159,7 +5254,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   const hopTargets = /* @__PURE__ */ new Set();
   for (const file of files) {
     try {
-      const text = readFileSync10(file, "utf8");
+      const text = readFileSync11(file, "utf8");
       const relFile = relative4(cwd, file);
       sourceBytes += text.length;
       if (!hasEntrySignal(text)) {
@@ -5172,7 +5267,7 @@ async function extractInputMap(cwd, ts, options = {}) {
       }
       parsed++;
       entryFiles.add(file);
-      const fingerprint = createHash3("sha256").update(text).digest("hex").slice(0, 16);
+      const fingerprint = createHash4("sha256").update(text).digest("hex").slice(0, 16);
       const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
       const bindings = buildModuleBindings(sf, ts);
       for (const specifier of bindings.imports) {
@@ -5214,7 +5309,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   for (const target of hopTargets) {
     if (entryFiles.has(target)) continue;
     try {
-      const text = readFileSync10(target, "utf8");
+      const text = readFileSync11(target, "utf8");
       const sf = ts.createSourceFile(target, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, target));
       const bindings = buildModuleBindings(sf, ts);
       const called = collectInvocations(sf, ts, bindings, { file: target, owner: relative4(cwd, target), graph });
@@ -5345,8 +5440,8 @@ async function buildInputMap(cwd, options = {}) {
 }
 
 // src/setup.ts
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
-import path10 from "path";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
+import path11 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
 function setupProtection(cwd) {
@@ -5364,8 +5459,8 @@ function appendHook(existing, command) {
   return `${existing} && ${command}`;
 }
 function wireBuildScripts(cwd, packageManager) {
-  const target = path10.join(cwd, "package.json");
-  const raw = readFileSync11(target, "utf8");
+  const target = path11.join(cwd, "package.json");
+  const raw = readFileSync12(target, "utf8");
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
   const build = scripts.build;
@@ -5414,7 +5509,7 @@ function wireBuildScripts(cwd, packageManager) {
   const indentMatch = raw.match(/^[\t ]+(?=")/m)?.[0];
   const indent = indentMatch?.includes("	") ? "	" : indentMatch?.length ?? 2;
   const trailingNewline = raw.endsWith("\n") ? "\n" : "";
-  writeFileSync6(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
+  writeFileSync7(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
   if (build === void 0 || build.trim().length === 0) {
     return {
       changed: true,
@@ -5492,10 +5587,17 @@ Usage:
                                                      what's missing, with tailored commands), then
                                                      print the full setup guide. --full prints the
                                                      guide even when setup is complete
-  patchstack-connect login  [options]                Recover this site's credential when
+  patchstack-connect login  [--wait]                 Recover this site's credential when
                                                      .patchstackrc.json has been lost. Prints a link
-                                                     for the site's OWNER to approve in the dashboard,
-                                                     then waits (10 min). Use this instead of deleting
+                                                     for the site's OWNER to approve in the dashboard.
+                                                     In a terminal it then waits. When the output is
+                                                     piped or captured \u2014 an assistant running it \u2014 it
+                                                     prints the link and EXITS, so the link is visible
+                                                     immediately. Run it AGAIN once the user confirms
+                                                     they approved: it resumes the same request rather
+                                                     than starting a new one, and finishes the flow.
+                                                     --wait blocks instead of returning. Use this
+                                                     instead of deleting
                                                      .patchstackrc.json and re-scanning, which would
                                                      provision a second site. Approving ROTATES the
                                                      credential: CI, deploys and other machines using
@@ -5600,7 +5702,26 @@ async function runLogin(args) {
     cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
     cliEndpoint: getStringFlag(args.flags, "endpoint")
   });
-  const result = await login(config, (userCode, verificationUri) => {
+  const approved = () => {
+    console.log("\n  \u2713 Credential restored and saved to .patchstackrc.json.");
+    console.log("    The previous credential no longer works. Update it anywhere else it was set:");
+    console.log("    CI secrets, hosting env vars, preview environments, other checkouts.\n");
+    return 0;
+  };
+  if (args.flags.has("wait")) {
+    const pending = config.siteUuid === null ? null : readPendingLogin(config.siteUuid);
+    if (pending === null) {
+      console.error("\n  No login is waiting for approval. Run `patchstack-connect login` first.\n");
+      return 1;
+    }
+    const resumed = await waitForApproval(config, pending);
+    if (resumed.status === "approved") return approved();
+    console.error(`
+  ${resumed.message ?? "Login failed."}
+`);
+    return 1;
+  }
+  const prompt = (userCode, verificationUri) => {
     console.log(`
   Your code:  ${userCode}`);
     console.log(`  Approve at: ${verificationUri}
@@ -5608,14 +5729,39 @@ async function runLogin(args) {
     console.log("  Open that link and approve it as the site's owner. Approving issues a new");
     console.log("  credential and stops the current one working \u2014 CI, deploys and any other");
     console.log("  machine using it will need the new value.\n");
-    console.log("  Waiting for approval (the code expires in 10 minutes)\u2026");
-  });
-  if (result.status === "approved") {
-    console.log("\n  \u2713 Credential restored and saved to .patchstackrc.json.");
-    console.log("    The previous credential no longer works. Update it anywhere else it was set:");
-    console.log("    CI secrets, hosting env vars, preview environments, other checkouts.\n");
+  };
+  if (process.stdout.isTTY !== true) {
+    const existing = config.siteUuid === null ? null : readPendingLogin(config.siteUuid);
+    if (existing !== null && Date.now() < existing.expiresAt) {
+      const outcome = await redeemIfApproved(config, existing);
+      if (outcome === "approved") return approved();
+      if (outcome === "pending") {
+        const secondsLeft = Math.round((existing.expiresAt - Date.now()) / 1e3);
+        console.log(`
+  Still waiting for approval of code ${existing.userCode}.`);
+        console.log(`  Approve at: ${existing.verificationUri}`);
+        console.log(`  (valid for another ${secondsLeft}s \u2014 run this again once the user confirms)
+`);
+        return 0;
+      }
+    }
+    const started = await startLogin(config);
+    if (started.status !== "started" || started.pending === void 0) {
+      console.error(`
+  ${started.message ?? "Login failed."}
+`);
+      return 1;
+    }
+    prompt(started.pending.userCode, started.pending.verificationUri);
+    console.log("  Give that link to the user. When they confirm they have approved it, run");
+    console.log("  this same command again (or `login --wait` to block until they do).\n");
     return 0;
   }
+  const result = await login(config, (userCode, verificationUri) => {
+    prompt(userCode, verificationUri);
+    console.log("  Waiting for approval (the code expires in 10 minutes)\u2026");
+  });
+  if (result.status === "approved") return approved();
   console.error(`
   ${result.message ?? "Login failed."}
 `);
@@ -5664,7 +5810,7 @@ async function runMap(args) {
   const json = JSON.stringify(map, null, 2);
   const out = getStringFlag(args.flags, "out");
   if (out) {
-    writeFileSync7(out, json);
+    writeFileSync8(out, json);
     console.error(`patchstack: wrote ${out}`);
   } else if (args.flags.get("upload") !== true) {
     console.log(json);
@@ -5950,7 +6096,7 @@ async function runGuide(args) {
   console.log("\u2014\u2014\u2014\u2014 Full reference guide (ships as AGENT-INSTALL.md) \u2014\u2014\u2014\u2014");
   console.log("");
   const guidePath = new URL("../AGENT-INSTALL.md", import.meta.url);
-  console.log(readFileSync12(guidePath, "utf8"));
+  console.log(readFileSync13(guidePath, "utf8"));
   return 0;
 }
 async function runSetup(args) {
@@ -6131,7 +6277,7 @@ async function runMarkBuild(args) {
   let marked = 0;
   let widgetTouched = 0;
   for (const file of files) {
-    const before = readFileSync12(file, "utf8");
+    const before = readFileSync13(file, "utf8");
     let after = injectMarker(before, snippet);
     if (widgetUuid !== null) {
       const ensured = ensureWidgetInHtml(after, widgetUuid);
@@ -6141,7 +6287,7 @@ async function runMarkBuild(args) {
       after = ensured.html;
     }
     if (after !== before) {
-      writeFileSync7(file, after);
+      writeFileSync8(file, after);
       marked += 1;
     }
   }