@patchstack/connect 0.3.27 → 0.3.29

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
 
 // src/parsers/index.ts
 import { access } from "fs/promises";
@@ -1016,6 +1016,19 @@ function buildEndpointUrl(base, siteUuid) {
   const trimmed = base.replace(/\/$/, "");
   return siteUuid !== void 0 && siteUuid !== null && siteUuid.length > 0 ? `${trimmed}/${encodeURIComponent(siteUuid)}` : trimmed;
 }
+function authFailureMessage(status, config) {
+  const hasCredential = typeof config.pulseAuth === "string" && config.pulseAuth.length > 0;
+  if (status === 401 && !hasCredential) {
+    return "Patchstack requires an API credential for this site and none is configured. Run `npx patchstack-connect login`, or set PATCHSTACK_API_KEY.";
+  }
+  if (status === 401) {
+    return "Patchstack rejected this API credential. It may have expired, been revoked, or the site may no longer exist. Run `npx patchstack-connect login` to issue a new one.";
+  }
+  if (status === 403) {
+    return "This API credential is not permitted to act on this site. Check that siteUuid in .patchstackrc.json matches the credential (a credential is issued for one site).";
+  }
+  return null;
+}
 function buildRulesUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
   const path12 = url.pathname.replace(/\/$/, "");
@@ -1070,6 +1083,10 @@ async function postInputMap(config, map) {
     if (response.status === 422) {
       return { result: "failed", message: `Patchstack does not accept this map schema (version ${map.version}). Update @patchstack/connect.` };
     }
+    const refused = authFailureMessage(response.status, config);
+    if (refused !== null) {
+      return { result: "failed", message: refused };
+    }
     if (!response.ok) {
       return { result: "failed", message: `Patchstack returned ${response.status}.` };
     }
@@ -1100,6 +1117,13 @@ async function postPackageRemoved(config) {
     if (response.status === 404) {
       return { result: "gone", message: null };
     }
+    if (response.status === 401 && await fetchSiteStatus(config) === "removed") {
+      return { result: "gone", message: null };
+    }
+    const refused = authFailureMessage(response.status, config);
+    if (refused !== null) {
+      return { result: "failed", message: refused };
+    }
     if (!response.ok) {
       return { result: "failed", message: `Patchstack returned ${response.status}.` };
     }
@@ -1181,6 +1205,10 @@ async function postManifest(config, payload) {
       "VALIDATION_ERROR"
     );
   }
+  const refused = authFailureMessage(response.status, config);
+  if (refused !== null) {
+    throw new PatchstackError(refused, "UNAUTHORIZED");
+  }
   if (response.status < 200 || response.status >= 300) {
     throw new PatchstackError(
       `Patchstack returned ${response.status}: ${text.slice(0, 200)}`,
@@ -1516,7 +1544,7 @@ function isEnvironment(value) {
 }
 
 // src/mark-build.ts
-import { existsSync, readdirSync, statSync } from "fs";
+import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
 import path7 from "path";
 
 // src/stack.ts
@@ -1659,16 +1687,94 @@ function injectMarker(html, snippet) {
   }
   return stripped + snippet;
 }
+var JSX_SHELL_FRAMEWORKS = /* @__PURE__ */ new Set([
+  "next",
+  "remix",
+  "react-router",
+  "tanstack-start",
+  "gatsby"
+]);
+var PRODUCTION_GATES = {
+  next: "process.env.NODE_ENV === 'production'",
+  gatsby: "process.env.NODE_ENV === 'production'",
+  nuxt: "!import.meta.dev"
+};
+var DEFAULT_PRODUCTION_GATE = "import.meta.env.PROD";
+function productionGate(framework) {
+  const mapped = framework !== null ? PRODUCTION_GATES[framework] : void 0;
+  return mapped ?? DEFAULT_PRODUCTION_GATE;
+}
+function hasJsxShell(framework) {
+  return framework !== null && JSX_SHELL_FRAMEWORKS.has(framework);
+}
+function buildSourceMarkerSnippet(framework) {
+  const gate = productionGate(framework);
+  return `{${gate} && (
+  <script
+    ${MARKER_ATTR}="true"
+    dangerouslySetInnerHTML={{ __html: 'window.__PATCHSTACK_PROD__=true;' }}
+  />
+)}`;
+}
+var PROD_MARKER_GLOBAL = "__PATCHSTACK_PROD__";
+var REGION_OPEN = "{/* #region patchstack (managed by patchstack-connect \u2014 do not edit) */}";
+var REGION_CLOSE = "{/* #endregion patchstack */}";
+var REGION_RE = /[ \t]*\{\/\* #region patchstack[\s\S]*?#endregion patchstack \*\/\}\n?/g;
+function ensureMarkerInJsxShell(source, framework) {
+  if (!hasJsxShell(framework)) {
+    return { source, action: "unsupported" };
+  }
+  const stripped = source.replace(REGION_RE, "");
+  if (stripped.includes(PROD_MARKER_GLOBAL)) {
+    return { source, action: "manual" };
+  }
+  const block = (indent) => [REGION_OPEN, ...buildSourceMarkerSnippet(framework).split("\n"), REGION_CLOSE].map((line) => `${indent}${line}`).join("\n");
+  const widget = stripped.match(/^([ \t]*).*patchstack-widget.*$/m);
+  if (widget?.index !== void 0) {
+    const indent = widget[1] ?? "";
+    return {
+      source: `${stripped.slice(0, widget.index)}${block(indent)}
+${stripped.slice(widget.index)}`,
+      action: "added"
+    };
+  }
+  for (const anchor of [/^([ \t]*)<head>[ \t]*$/m, /^([ \t]*)<body>[ \t]*$/m]) {
+    const match = stripped.match(anchor);
+    if (match?.index === void 0) {
+      continue;
+    }
+    const end = match.index + match[0].length;
+    const indent = `${match[1] ?? ""}  `;
+    return {
+      source: `${stripped.slice(0, end)}
+${block(indent)}${stripped.slice(end)}`,
+      action: "added"
+    };
+  }
+  return { source, action: "no-anchor" };
+}
+function ensureSourceMarker(cwd, shell, framework) {
+  if (shell === null) {
+    return { shell: null, source: "", action: "no-anchor" };
+  }
+  const file = path7.resolve(cwd, shell);
+  const before = readFileSync(file, "utf8");
+  const result = ensureMarkerInJsxShell(before, framework);
+  if (result.source !== before && result.action === "added") {
+    writeFileSync(file, result.source);
+  }
+  return { ...result, shell };
+}
 
 // src/guide.ts
-import { existsSync as existsSync10, readFileSync as readFileSync5, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
 import path9 from "path";
 
 // src/protect/install/util.ts
-import { readFileSync, existsSync as existsSync2, writeFileSync } from "fs";
+import { readFileSync as readFileSync2, existsSync as existsSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join2, dirname } from "path";
 import { fileURLToPath } from "url";
-var read = (p) => readFileSync(p, "utf8");
+var read = (p) => readFileSync2(p, "utf8");
 var log = (msg) => console.log(`patchstack protect: ${msg}`);
 function hasDependency(cwd, name) {
   try {
@@ -1704,7 +1810,7 @@ function bakeSiteUuid(cwd, guardRelPath) {
     log(`${guardRelPath} site UUID already baked`);
     return false;
   }
-  writeFileSync(guardPath, source.replace(SITE_UUID_PLACEHOLDER, uuid));
+  writeFileSync2(guardPath, source.replace(SITE_UUID_PLACEHOLDER, uuid));
   log(`baked site UUID into ${guardRelPath} \u2014 live rules from the Patchstack API`);
   return true;
 }
@@ -1721,7 +1827,7 @@ function templatesDir() {
 }
 
 // src/protect/install/adapters/tanstack-supabase.ts
-import { writeFileSync as writeFileSync2, existsSync as existsSync3, mkdirSync, copyFileSync } from "fs";
+import { writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync, copyFileSync } from "fs";
 import { join as join3 } from "path";
 var CLIENT_TUNNEL = [
   "",
@@ -1835,7 +1941,7 @@ function patchClient(cwd) {
     log("client.ts anchor not found \u2014 skipping (template changed?)");
     return false;
   }
-  writeFileSync2(p, s.replace(anchor, anchor + "\n" + CLIENT_TUNNEL));
+  writeFileSync3(p, s.replace(anchor, anchor + "\n" + CLIENT_TUNNEL));
   log("patched client.ts (tunnel Supabase through the guard)");
   return true;
 }
@@ -1872,7 +1978,7 @@ function patchStart(cwd) {
     log("start.ts already wired");
     return false;
   }
-  writeFileSync2(p, s);
+  writeFileSync3(p, s);
   log("patched start.ts (guard registered as request + function middleware)");
   return true;
 }
@@ -2123,7 +2229,7 @@ var nuxtAdapter = {
 };
 
 // src/protect/install/find-app.ts
-import { readFileSync as readFileSync2, existsSync as existsSync6, readdirSync as readdirSync2, lstatSync } from "fs";
+import { readFileSync as readFileSync3, existsSync as existsSync6, readdirSync as readdirSync2, lstatSync } from "fs";
 import { join as join8, relative, dirname as dirname3 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
@@ -2170,7 +2276,7 @@ function findAppInstance(cwd, re) {
       else if (/\.(?:ts|js|mjs|cjs)$/.test(name)) {
         let src;
         try {
-          src = readFileSync2(p, "utf8");
+          src = readFileSync3(p, "utf8");
         } catch {
           continue;
         }
@@ -2190,11 +2296,11 @@ function importSpecifier(fromRel, toRel, preserveExtension = false) {
 }
 
 // src/protect/install/register.ts
-import { writeFileSync as writeFileSync4, existsSync as existsSync8 } from "fs";
+import { writeFileSync as writeFileSync5, existsSync as existsSync8 } from "fs";
 import { join as join10 } from "path";
 
 // src/protect/install/generic.ts
-import { readFileSync as readFileSync3, existsSync as existsSync7, mkdirSync as mkdirSync4, copyFileSync as copyFileSync4, readdirSync as readdirSync3, lstatSync as lstatSync2 } from "fs";
+import { readFileSync as readFileSync4, existsSync as existsSync7, mkdirSync as mkdirSync4, copyFileSync as copyFileSync4, readdirSync as readdirSync3, lstatSync as lstatSync2 } from "fs";
 import { join as join9 } from "path";
 var GUARD_MARKER = "patchstack/guard";
 function genericDir(cwd) {
@@ -2302,7 +2408,7 @@ function guardIsImported(cwd, guardPath) {
       if (st.isDirectory()) walk2(p, depth + 1);
       else if (/\.(?:ts|tsx|js|jsx|mjs|cjs)$/.test(name) && p !== guardPath) {
         try {
-          if (readFileSync3(p, "utf8").includes(GUARD_MARKER)) found = true;
+          if (readFileSync4(p, "utf8").includes(GUARD_MARKER)) found = true;
         } catch {
         }
       }
@@ -2385,7 +2491,7 @@ function wireRegister(cwd, opts, spec) {
     const callIdx = preferredIdx === -1 ? appIdx : preferredIdx;
     lines.splice(callIdx + 1, 0, REGION, spec.call(entry.appVar), "// #endregion patchstack");
   }
-  writeFileSync4(p, lines.join("\n"));
+  writeFileSync5(p, lines.join("\n"));
   changed.push(entry.relPath);
   log(`patched ${entry.relPath} (${spec.call(entry.appVar).trim()})`);
   return { ok: true, changed: [...new Set(changed)] };
@@ -2514,7 +2620,7 @@ function runVerify(cwd) {
 }
 
 // src/widget.ts
-import { existsSync as existsSync9, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
 import path8 from "path";
 var WIDGET_SCRIPT_URL = "https://cdn.patchstack.com/patchstack-widget.js";
 var WIDGET_MARKER_ATTR = "data-patchstack-connect-widget";
@@ -2565,15 +2671,16 @@ function ensureSourceWidget(cwd, siteUuid) {
     return { shell: null, action: "no-shell" };
   }
   const file = path8.join(cwd, shell);
-  const before = readFileSync4(file, "utf8");
+  const before = readFileSync5(file, "utf8");
   const { html, action } = ensureWidgetInHtml(before, siteUuid);
   if (html !== before) {
-    writeFileSync5(file, html);
+    writeFileSync6(file, html);
   }
   return { shell, action };
 }
 
 // src/guide.ts
+var PROD_MARKER_NEEDLE = "__PATCHSTACK_PROD__";
 var WIDGET_NEEDLE2 = "patchstack-widget";
 var INSTALL_COMMANDS = {
   npm: "npm install --save @patchstack/connect",
@@ -2657,7 +2764,7 @@ function installCommand(pm) {
 }
 function readPackageJson(cwd) {
   try {
-    return JSON.parse(readFileSync5(path9.join(cwd, "package.json"), "utf8"));
+    return JSON.parse(readFileSync6(path9.join(cwd, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -2665,7 +2772,7 @@ function readPackageJson(cwd) {
 function installedVersion(cwd, declaredRange) {
   try {
     const pkg = JSON.parse(
-      readFileSync5(path9.join(cwd, "node_modules", "@patchstack", "connect", "package.json"), "utf8")
+      readFileSync6(path9.join(cwd, "node_modules", "@patchstack", "connect", "package.json"), "utf8")
     );
     if (typeof pkg.version === "string" && pkg.version.length > 0) {
       return pkg.version;
@@ -2709,7 +2816,7 @@ function findWidgetMarker(cwd, siteUuid) {
         if (statSync2(full).size > WIDGET_SCAN_MAX_BYTES) {
           continue;
         }
-        const content = readFileSync5(full, "utf8");
+        const content = readFileSync6(full, "utf8");
         if (!content.includes(WIDGET_NEEDLE2)) {
           continue;
         }
@@ -2727,6 +2834,16 @@ function findWidgetMarker(cwd, siteUuid) {
     uuidMatches: sawWidget && siteUuid != null ? sawTokenMatch : null
   };
 }
+function findProductionMarker(cwd, widgetFileHint) {
+  if (widgetFileHint === null) {
+    return false;
+  }
+  try {
+    return readFileSync6(path9.join(cwd, widgetFileHint), "utf8").includes(PROD_MARKER_NEEDLE);
+  } catch {
+    return false;
+  }
+}
 function resolveWidgetFileHint(cwd, framework) {
   const candidates = [
     ...framework !== null ? WIDGET_FILE_CANDIDATES[framework] ?? [] : [],
@@ -2776,6 +2893,7 @@ async function collectGuideState(cwd) {
     {}
   );
   const widget = findWidgetMarker(cwd, siteUuid);
+  const widgetFileHint = resolveWidgetFileHint(cwd, stack.framework);
   const protection = runVerify(cwd);
   return {
     projectName: pkg?.name ?? null,
@@ -2795,7 +2913,8 @@ async function collectGuideState(cwd) {
     widgetTokenMatches: widget.uuidMatches,
     widgetOptOut,
     framework: stack.framework,
-    widgetFileHint: resolveWidgetFileHint(cwd, stack.framework),
+    widgetFileHint,
+    productionMarkerWired: findProductionMarker(cwd, widgetFileHint),
     protectionWired: protection.wired,
     protectionStack: protection.stack,
     protectionChecks: protection.checks
@@ -2809,6 +2928,12 @@ var ANSI = {
   yellow: "\x1B[33m",
   cyan: "\x1B[36m"
 };
+function needsSourceProductionMarker(state) {
+  if (state.siteUuid === null || state.widgetOptOut || state.widgetFileHint === null) {
+    return false;
+  }
+  return !state.widgetFileHint.toLowerCase().endsWith(".html");
+}
 function countRemainingSteps(state) {
   return [
     state.installed?.section === "dependencies",
@@ -2816,6 +2941,7 @@ function countRemainingSteps(state) {
     state.installScanWired,
     !state.hasBuildScript || state.prebuildWired && state.postbuildWired,
     state.widgetOptOut || state.widgetInstalled && state.widgetTokenMatches !== false,
+    !needsSourceProductionMarker(state) || state.productionMarkerWired,
     state.protectionWired
   ].filter((step) => !step).length;
 }
@@ -2906,6 +3032,34 @@ function renderGuideChecklist(state, useColor) {
     lines.push(detail(`  ${buildWidgetTag(state.siteUuid)}`));
     lines.push(detail("The site UUID is public by design \u2014 it ships in client-side HTML."));
   }
+  if (needsSourceProductionMarker(state)) {
+    if (state.productionMarkerWired) {
+      lines.push(done("Production marker wired (widget switches to report mode on the published site)"));
+    } else {
+      lines.push(todo("Add the production marker \u2014 this root is server-rendered, so mark-build cannot stamp it"));
+      lines.push(
+        detail(
+          "Without it the widget treats the published site as build mode and shows the claim flow to visitors."
+        )
+      );
+      const gate = productionGate(state.framework);
+      if (hasJsxShell(state.framework)) {
+        lines.push(detail(`Run \u2192 npx @patchstack/connect scan  (adds it to ${state.widgetFileHint} automatically)`));
+        lines.push(detail("Or add it by hand, in <head> above the widget tag:"));
+        for (const snippetLine of buildSourceMarkerSnippet(state.framework).split("\n")) {
+          lines.push(detail(`  ${snippetLine}`));
+        }
+      } else {
+        lines.push(
+          detail(
+            `Edit ${state.widgetFileHint} \u2192 using the framework's head mechanism, emit an inline`
+          )
+        );
+        lines.push(detail(`  <script>window.__PATCHSTACK_PROD__=true;</script> only when ${gate}.`));
+      }
+      lines.push(detail(`The ${gate} guard is required \u2014 an ungated marker also hides the claim flow in preview.`));
+    }
+  }
   if (state.protectionWired) {
     lines.push(done(`Runtime protection wired (${state.protectionStack})`));
   } else {
@@ -2949,7 +3103,7 @@ function renderGuideChecklist(state, useColor) {
 }
 
 // src/login.ts
-import { mkdtempSync, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync6 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync7, rmSync, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir } from "os";
 import path10 from "path";
 import { createHash as createHash2 } from "crypto";
@@ -2966,11 +3120,11 @@ function pendingPath(siteUuid) {
   return path10.join(tmpdir(), `patchstack-login-${key}.json`);
 }
 function savePendingLogin(siteUuid, pending) {
-  writeFileSync6(pendingPath(siteUuid), JSON.stringify(pending), { encoding: "utf8", mode: 384 });
+  writeFileSync7(pendingPath(siteUuid), JSON.stringify(pending), { encoding: "utf8", mode: 384 });
 }
 function readPendingLogin(siteUuid) {
   try {
-    return JSON.parse(readFileSync6(pendingPath(siteUuid), "utf8"));
+    return JSON.parse(readFileSync7(pendingPath(siteUuid), "utf8"));
   } catch {
     return null;
   }
@@ -3094,7 +3248,7 @@ async function loadTypeScript(cwd) {
 }
 
 // src/map/extract.ts
-import { readFileSync as readFileSync11, realpathSync as realpathSync3 } from "fs";
+import { readFileSync as readFileSync12, realpathSync as realpathSync3 } from "fs";
 import { createHash as createHash4 } from "crypto";
 import { relative as relative4 } from "path";
 
@@ -3350,7 +3504,7 @@ function npmPackageOf(spec) {
 }
 
 // src/map/sources.ts
-import { readFileSync as readFileSync7, readdirSync as readdirSync5, realpathSync, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync8, readdirSync as readdirSync5, realpathSync, statSync as statSync3 } from "fs";
 import { join as join12, relative as relative2, isAbsolute } from "path";
 
 // src/map/routes.ts
@@ -3435,7 +3589,7 @@ function hasEntrySignal(text) {
 }
 function detectFramework(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync7(join12(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync8(join12(cwd, "package.json"), "utf8"));
     const d = { ...pkg.dependencies, ...pkg.devDependencies };
     if (d["@tanstack/react-start"] || d["@tanstack/start"] || d["@tanstack/solid-start"]) return "tanstack-start";
     if (d["next"]) return "next";
@@ -3632,7 +3786,7 @@ function holdsSourceFile(dir) {
 }
 
 // src/map/surface.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import { join as join13 } from "path";
 var STATIC_GENERATORS = [
   { dep: "vite", label: "vite" },
@@ -3671,7 +3825,7 @@ var SHAPE_SIGNAL = {
 };
 function readManifest(cwd) {
   try {
-    const parsed = JSON.parse(readFileSync8(join13(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync9(join13(cwd, "package.json"), "utf8"));
     return typeof parsed === "object" && parsed !== null ? parsed : null;
   } catch {
     return null;
@@ -3684,7 +3838,7 @@ function nextExportsStatically(cwd, manifest, ts) {
   for (const file of ["next.config.js", "next.config.mjs", "next.config.ts", "next.config.cjs"]) {
     let text;
     try {
-      text = readFileSync8(join13(cwd, file), "utf8");
+      text = readFileSync9(join13(cwd, file), "utf8");
     } catch {
       continue;
     }
@@ -4084,7 +4238,7 @@ function dedupeSinks(sinks, owner) {
 }
 
 // src/map/module-graph.ts
-import { readFileSync as readFileSync9, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync10, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
 import { dirname as dirname4, join as join14, relative as relative3, resolve as resolvePath } from "path";
 var RESOLVE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 function createModuleGraph(ts, opts) {
@@ -4093,7 +4247,7 @@ function createModuleGraph(ts, opts) {
     if (cache.has(file)) return cache.get(file) ?? null;
     let entry = null;
     try {
-      const text = readFileSync9(file, "utf8");
+      const text = readFileSync10(file, "utf8");
       const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
       const bindings = buildModuleBindings(sf, ts);
       entry = { fnSinks: collectLocalSinks(sf, ts, bindings), calleesOf: collectCallees(sf, ts), bindings };
@@ -4835,7 +4989,7 @@ function handlerEntry(name, kindLabel, params, body, ts, localSinks, bindings, c
 }
 
 // src/map/imports.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 import { join as join15 } from "path";
 var MAX_SITES = 5;
 var NPM_NAME = /^(?:@[^/@\s~][^/@\s]*\/)?[^/@\s.~][^/@\s]*$/;
@@ -4847,7 +5001,7 @@ function readPathAliases(cwd) {
   for (const name of ["tsconfig.json", "jsconfig.json"]) {
     let paths;
     try {
-      const raw = readFileSync10(join15(cwd, name), "utf8");
+      const raw = readFileSync11(join15(cwd, name), "utf8");
       const parsed = JSON.parse(stripJsonComments(raw));
       paths = parsed.compilerOptions?.paths;
     } catch {
@@ -5226,7 +5380,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   const hopTargets = /* @__PURE__ */ new Set();
   for (const file of files) {
     try {
-      const text = readFileSync11(file, "utf8");
+      const text = readFileSync12(file, "utf8");
       const relFile = relative4(cwd, file);
       sourceBytes += text.length;
       if (!hasEntrySignal(text)) {
@@ -5281,7 +5435,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   for (const target of hopTargets) {
     if (entryFiles.has(target)) continue;
     try {
-      const text = readFileSync11(target, "utf8");
+      const text = readFileSync12(target, "utf8");
       const sf = ts.createSourceFile(target, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, target));
       const bindings = buildModuleBindings(sf, ts);
       const called = collectInvocations(sf, ts, bindings, { file: target, owner: relative4(cwd, target), graph });
@@ -5412,7 +5566,7 @@ async function buildInputMap(cwd, options = {}) {
 }
 
 // src/setup.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
 import path11 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
@@ -5432,7 +5586,7 @@ function appendHook(existing, command) {
 }
 function wireBuildScripts(cwd, packageManager) {
   const target = path11.join(cwd, "package.json");
-  const raw = readFileSync12(target, "utf8");
+  const raw = readFileSync13(target, "utf8");
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
   const build = scripts.build;
@@ -5481,7 +5635,7 @@ function wireBuildScripts(cwd, packageManager) {
   const indentMatch = raw.match(/^[\t ]+(?=")/m)?.[0];
   const indent = indentMatch?.includes("	") ? "	" : indentMatch?.length ?? 2;
   const trailingNewline = raw.endsWith("\n") ? "\n" : "";
-  writeFileSync7(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
+  writeFileSync8(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
   if (build === void 0 || build.trim().length === 0) {
     return {
       changed: true,
@@ -5782,7 +5936,7 @@ async function runMap(args) {
   const json = JSON.stringify(map, null, 2);
   const out = getStringFlag(args.flags, "out");
   if (out) {
-    writeFileSync8(out, json);
+    writeFileSync9(out, json);
     console.error(`patchstack: wrote ${out}`);
   } else if (args.flags.get("upload") !== true) {
     console.log(json);
@@ -5855,6 +6009,9 @@ async function runScan(args, options = {}) {
     }
     return 0;
   }
+  if (config.widget) {
+    reportSourceMarker(detectStack(payload.packages).framework);
+  }
   const provisioning = config.siteUuid === null;
   if (provisioning) {
     console.log("No site UUID configured \u2014 provisioning a new Patchstack site from this manifest\u2026");
@@ -5937,6 +6094,41 @@ function reportSourceWidget(siteUuid) {
     console.warn(`Widget: skipped (${err.message}).`);
   }
 }
+function reportSourceMarker(framework) {
+  try {
+    const shell = resolveWidgetFileHint(process.cwd(), framework);
+    if (shell === null || shell.toLowerCase().endsWith(".html")) {
+      return;
+    }
+    const result = ensureSourceMarker(process.cwd(), shell, framework);
+    switch (result.action) {
+      case "added":
+        console.log(`Production marker: added to ${shell} (guarded by ${productionGate(framework)}).`);
+        console.log("  This root is server-rendered, so the marker ships in source rather than built HTML.");
+        break;
+      case "manual":
+        console.log(`Production marker: already set in ${shell} \u2014 left untouched.`);
+        break;
+      case "no-anchor":
+      case "unsupported":
+        console.log(
+          `Production marker: ${shell} needs it by hand \u2014 without it the widget reads the published site as build mode.`
+        );
+        if (hasJsxShell(framework)) {
+          for (const line of buildSourceMarkerSnippet(framework).split("\n")) {
+            console.log(`  ${line}`);
+          }
+        } else {
+          console.log(
+            `  Emit <script>window.__PATCHSTACK_PROD__=true;</script> only when ${productionGate(framework)}.`
+          );
+        }
+        break;
+    }
+  } catch (err) {
+    console.warn(`Production marker: skipped (${err.message}).`);
+  }
+}
 async function runProtectCommand(args) {
   if (args.flags.get("check") === true) {
     const report = runVerify(process.cwd());
@@ -6068,7 +6260,7 @@ async function runGuide(args) {
   console.log("\u2014\u2014\u2014\u2014 Full reference guide (ships as AGENT-INSTALL.md) \u2014\u2014\u2014\u2014");
   console.log("");
   const guidePath = new URL("../AGENT-INSTALL.md", import.meta.url);
-  console.log(readFileSync13(guidePath, "utf8"));
+  console.log(readFileSync14(guidePath, "utf8"));
   return 0;
 }
 async function runSetup(args) {
@@ -6242,14 +6434,20 @@ async function runMarkBuild(args) {
   }
   const files = findHtmlFiles(dir);
   if (files.length === 0) {
-    console.warn(`mark-build: no HTML files found under ${dir}. Nothing to mark.`);
+    console.warn(`mark-build: found ${dir} but no HTML files in it.`);
+    console.warn(
+      "mark-build: this build looks server-rendered, so the production flag has nothing to stamp."
+    );
+    console.warn(
+      "mark-build: add the marker to your root shell instead \u2014 run `patchstack-connect guide` for the snippet."
+    );
     return 0;
   }
   const snippet = buildInjectionSnippet(checksum, stack);
   let marked = 0;
   let widgetTouched = 0;
   for (const file of files) {
-    const before = readFileSync13(file, "utf8");
+    const before = readFileSync14(file, "utf8");
     let after = injectMarker(before, snippet);
     if (widgetUuid !== null) {
       const ensured = ensureWidgetInHtml(after, widgetUuid);
@@ -6259,7 +6457,7 @@ async function runMarkBuild(args) {
       after = ensured.html;
     }
     if (after !== before) {
-      writeFileSync8(file, after);
+      writeFileSync9(file, after);
       marked += 1;
     }
   }