@patchstack/connect 0.3.29 → 0.3.30

package/dist/protect/templates/astro-middleware.ts

@@ -7,29 +7,49 @@ import fallbackRules from "./patchstack.rules.json";
 
 const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
 
-let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
+/**
+ * One protection policy, memoized on the IN-FLIGHT promise rather than the resolved value.
+ *
+ * A cold start takes several concurrent requests. Caching only the finished value lets each of them see an
+ * empty cache and start its own build — several rule fetches, several refresh loops, and several policies
+ * where the app is meant to have one. Holding the promise means the first request starts it and the rest
+ * await the same one. A failed build is not cached, so the next request retries rather than inheriting one
+ * bad boot for the life of the process.
+ */
+let _protection: Promise<Awaited<ReturnType<typeof createProtection>>> | undefined;
 async function getProtection() {
   if (!_protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true } as const;
-    _protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules as never },
-    );
+    _protection = buildProtection().catch((err) => {
+      _protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return _protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  const common = { mode, egress: true } as const;
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules as never },
+  );
+}
+
 // #region patchstack-astro (managed by patchstack-connect protect — do not edit)
 export const onRequest: MiddlewareHandler = async (context, next) => {
   const protection = await getProtection();
   const blocked = await protection.fetchGuard()(context.request);
   if (blocked) return blocked; // 403 — blocked before it reaches your route
-  return protection.screenResponse(await next());
+  // Response rules can be scoped to a route or a method, and the engine can only apply that scope if it is
+  // given the request the response belongs to. Passed through here for that reason: without it a scoped
+  // response rule is delivered, counted as protection, and never matches anything.
+  return protection.screenResponse(await next(), context.request);
 };
 // #endregion patchstack-astro

package/dist/protect/templates/demo-rules.json

@@ -54,7 +54,7 @@
           "parameter": [
             "get.file",
             "post.file",
-            "raw.file",
+
             "get.path",
             "post.path"
           ],
@@ -172,8 +172,7 @@
         {
           "parameter": [
             "get.url",
-            "post.url",
-            "raw.url"
+            "post.url"
           ],
           "mutations": [
             "urldecode"

package/dist/protect/templates/express-guard.cjs

@@ -7,25 +7,36 @@ let protection;
 
 async function getProtection() {
   if (!protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
-    // rules periodically — a dependency flagged after boot is then enforced without a restart.
-    // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
-    const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
-    const common = { mode, egress: true, refreshMs };
-    protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules },
-    );
+    // Memoized on the in-flight promise, not the resolved value: a cold start takes several
+    // concurrent requests, and caching only the finished value lets each of them build its own
+    // policy — several rule fetches and several refresh loops where the app should have one.
+    protection = buildProtection().catch((err) => {
+      protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
+  // rules periodically — a dependency flagged after boot is then enforced without a restart.
+  // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
+  const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
+  const common = { mode, egress: true, refreshMs };
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules },
+  );
+}
+
 function patchstackMiddleware(req, res, next) {
   getProtection()
     .then((active) => active.express()(req, res, next))

package/dist/protect/templates/express-guard.js

@@ -8,25 +8,36 @@ let protection;
 
 async function getProtection() {
   if (!protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
-    // rules periodically — a dependency flagged after boot is then enforced without a restart.
-    // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
-    const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
-    const common = { mode, egress: true, refreshMs };
-    protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules },
-    );
+    // Memoized on the in-flight promise, not the resolved value: a cold start takes several
+    // concurrent requests, and caching only the finished value lets each of them build its own
+    // policy — several rule fetches and several refresh loops where the app should have one.
+    protection = buildProtection().catch((err) => {
+      protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
+  // rules periodically — a dependency flagged after boot is then enforced without a restart.
+  // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
+  const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
+  const common = { mode, egress: true, refreshMs };
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules },
+  );
+}
+
 export function patchstackMiddleware(req, res, next) {
   getProtection()
     .then((active) => active.express()(req, res, next))

package/dist/protect/templates/express-guard.ts

@@ -4,29 +4,46 @@ import { createProtection } from "@patchstack/connect/protect";
 import fallbackRules from "./rules.json";
 
 const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
-let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
+/**
+ * One protection policy, memoized on the IN-FLIGHT promise rather than the resolved value.
+ *
+ * A cold start takes several concurrent requests. Caching only the finished value lets each of them see an
+ * empty cache and start its own build — several rule fetches, several refresh loops, and several policies
+ * where the app is meant to have one. Holding the promise means the first request starts it and the rest
+ * await the same one. A failed build is not cached, so the next request retries rather than inheriting one
+ * bad boot for the life of the process.
+ */
+let _protection: Promise<Awaited<ReturnType<typeof createProtection>>> | undefined;
 
 async function getProtection() {
   if (!_protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
-    // rules periodically — a dependency flagged after boot is then enforced without a restart.
-    // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
-    const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
-    const common = { mode, egress: true, refreshMs } as const;
-    _protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules as never },
-    );
+    _protection = buildProtection().catch((err) => {
+      _protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return _protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  // The sandbox dev server is long-lived and isn't restarted on change, so refresh the live
+  // rules periodically — a dependency flagged after boot is then enforced without a restart.
+  // Production relies on a redeploy (which re-fetches at boot), so refresh stays off there.
+  const refreshMs = process.env.PATCHSTACK_ENVIRONMENT === "sandbox" ? 15000 : 0;
+  const common = { mode, egress: true, refreshMs } as const;
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules as never },
+  );
+}
+
 export function patchstackMiddleware(req: unknown, res: unknown, next: (err?: unknown) => void) {
   getProtection()
     .then((protection) =>

package/dist/protect/templates/fastify-plugin.cjs

@@ -8,21 +8,32 @@ let protection;
 
 async function getProtection() {
   if (!protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true };
-    protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules },
-    );
+    // Memoized on the in-flight promise, not the resolved value: a cold start takes several
+    // concurrent requests, and caching only the finished value lets each of them build its own
+    // policy — several rule fetches and several refresh loops where the app should have one.
+    protection = buildProtection().catch((err) => {
+      protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  const common = { mode, egress: true };
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules },
+  );
+}
+
 async function patchstackFastify(fastify) {
   const protection = await getProtection();
   const guard = protection.fetchGuard();
@@ -43,4 +54,15 @@ async function patchstackFastify(fastify) {
   });
 }
 
+// Fastify ENCAPSULATES a registered plugin: hooks added inside one apply to that plugin's context and
+// its children, and to nothing else. Registered as an ordinary plugin, this guard would screen nothing
+// on the root instance and nothing in sibling route plugins — which is most of an application, and it
+// would look installed the whole time.
+//
+// This is the marker `fastify-plugin` sets, and the mechanism Fastify documents for opting out: with it,
+// `register` runs the function against the ROOT instance instead of a child context, so the hook applies
+// to every route. Set here rather than pulling in `fastify-plugin` so an installed app gains no
+// dependency it did not already have.
+patchstackFastify[Symbol.for("skip-override")] = true;
+
 module.exports = { patchstackFastify };

package/dist/protect/templates/fastify-plugin.js

@@ -9,21 +9,32 @@ let protection;
 
 async function getProtection() {
   if (!protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true };
-    protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules },
-    );
+    // Memoized on the in-flight promise, not the resolved value: a cold start takes several
+    // concurrent requests, and caching only the finished value lets each of them build its own
+    // policy — several rule fetches and several refresh loops where the app should have one.
+    protection = buildProtection().catch((err) => {
+      protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  const common = { mode, egress: true };
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules },
+  );
+}
+
 export async function patchstackFastify(fastify) {
   const protection = await getProtection();
   const guard = protection.fetchGuard();
@@ -43,3 +54,14 @@ export async function patchstackFastify(fastify) {
     }
   });
 }
+
+// Fastify ENCAPSULATES a registered plugin: hooks added inside one apply to that plugin's context and
+// its children, and to nothing else. Registered as an ordinary plugin, this guard would screen nothing
+// on the root instance and nothing in sibling route plugins — which is most of an application, and it
+// would look installed the whole time.
+//
+// This is the marker `fastify-plugin` sets, and the mechanism Fastify documents for opting out: with it,
+// `register` runs the function against the ROOT instance instead of a child context, so the hook applies
+// to every route. Set here rather than pulling in `fastify-plugin` so an installed app gains no
+// dependency it did not already have.
+patchstackFastify[Symbol.for("skip-override")] = true;

package/dist/protect/templates/fastify-plugin.ts

@@ -7,24 +7,41 @@ import fallbackRules from "./rules.json";
 
 const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
 
-let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
+/**
+ * One protection policy, memoized on the IN-FLIGHT promise rather than the resolved value.
+ *
+ * A cold start takes several concurrent requests. Caching only the finished value lets each of them see an
+ * empty cache and start its own build — several rule fetches, several refresh loops, and several policies
+ * where the app is meant to have one. Holding the promise means the first request starts it and the rest
+ * await the same one. A failed build is not cached, so the next request retries rather than inheriting one
+ * bad boot for the life of the process.
+ */
+let _protection: Promise<Awaited<ReturnType<typeof createProtection>>> | undefined;
 async function getProtection() {
   if (!_protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true } as const;
-    _protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules as never },
-    );
+    _protection = buildProtection().catch((err) => {
+      _protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return _protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  const common = { mode, egress: true } as const;
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules as never, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules as never },
+  );
+}
+
 // #region patchstack-fastify (managed by patchstack-connect protect — do not edit)
 export async function patchstackFastify(fastify: any) {
   const protection = await getProtection();
@@ -46,3 +63,14 @@ export async function patchstackFastify(fastify: any) {
   });
 }
 // #endregion patchstack-fastify
+
+// Fastify ENCAPSULATES a registered plugin: hooks added inside one apply to that plugin's context and
+// its children, and to nothing else. Registered as an ordinary plugin, this guard would screen nothing
+// on the root instance and nothing in sibling route plugins — which is most of an application, and it
+// would look installed the whole time.
+//
+// This is the marker `fastify-plugin` sets, and the mechanism Fastify documents for opting out: with it,
+// `register` runs the function against the ROOT instance instead of a child context, so the hook applies
+// to every route. Set here rather than pulling in `fastify-plugin` so an installed app gains no
+// dependency it did not already have.
+(patchstackFastify as any)[Symbol.for("skip-override")] = true;

package/dist/protect/templates/generic-guard.cjs

@@ -8,30 +8,46 @@ let protection;
 
 async function getProtection() {
   if (!protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true };
-    protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules },
-    );
+    // Memoized on the in-flight promise, not the resolved value: a cold start takes several
+    // concurrent requests, and caching only the finished value lets each of them build its own
+    // policy — several rule fetches and several refresh loops where the app should have one.
+    protection = buildProtection().catch((err) => {
+      protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  const common = { mode, egress: true };
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules },
+  );
+}
+
 function protectFetch(handler) {
   return async (request, ...rest) => {
     const active = await getProtection();
     const blocked = await active.fetchGuard()(request);
     if (blocked) return blocked;
-    return active.screenResponse(await handler(request, ...rest));
+    // Response rules can be scoped to a route or a method, and the engine can only apply that scope if it is
+    // given the request the response belongs to. Passed through here for that reason: without it a scoped
+    // response rule is delivered, counted as protection, and never matches anything.
+    return active.screenResponse(await handler(request, ...rest), request);
   };
 }
 
+// Node / Connect: app.use(patchstackMiddleware) — before any body parser. This guard reads the request
+// stream itself and exposes what it read as req.body, so a parser is not also needed.
 function patchstackMiddleware(req, res, next) {
   getProtection()
     .then((active) => active.node()(req, res, next))

package/dist/protect/templates/generic-guard.js

@@ -9,32 +9,47 @@ let protection;
 
 export async function getProtection() {
   if (!protection) {
-    const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
-    const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
-    const common = { mode, egress: true };
-    protection = await createProtection(
-      siteUuid
-        ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
-        : token
-          ? { ...common, token, cacheDir: ".patchstack" }
-          : { ...common, rules: fallbackRules },
-    );
+    // Memoized on the in-flight promise, not the resolved value: a cold start takes several
+    // concurrent requests, and caching only the finished value lets each of them build its own
+    // policy — several rule fetches and several refresh loops where the app should have one.
+    protection = buildProtection().catch((err) => {
+      protection = undefined; // don't cache a failed boot
+      throw err;
+    });
   }
+
   return protection;
 }
 
+async function buildProtection() {
+  const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
+  const token = process.env.PATCHSTACK_WAF_TOKEN;
+  const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
+  const common = { mode, egress: true };
+  return createProtection(
+    siteUuid
+      ? { ...common, siteUuid, rules: fallbackRules, cacheDir: ".patchstack" }
+      : token
+        ? { ...common, token, cacheDir: ".patchstack" }
+        : { ...common, rules: fallbackRules },
+  );
+}
+
 // Web-Fetch: export default { fetch: protectFetch(originalFetch) }
 export function protectFetch(handler) {
   return async (request, ...rest) => {
     const active = await getProtection();
     const blocked = await active.fetchGuard()(request);
     if (blocked) return blocked;
-    return active.screenResponse(await handler(request, ...rest));
+    // Response rules can be scoped to a route or a method, and the engine can only apply that scope if it is
+    // given the request the response belongs to. Passed through here for that reason: without it a scoped
+    // response rule is delivered, counted as protection, and never matches anything.
+    return active.screenResponse(await handler(request, ...rest), request);
   };
 }
 
-// Node / Express: app.use(patchstackMiddleware)
+// Node / Connect: app.use(patchstackMiddleware) — before any body parser. This guard reads the request
+// stream itself and exposes what it read as req.body, so a parser is not also needed.
 export function patchstackMiddleware(req, res, next) {
   getProtection()
     .then((active) => active.node()(req, res, next))