@patchstack/connect 0.3.29 → 0.3.31

package/dist/protect.js

@@ -1,6 +1,6 @@
 import {
   pulseAuthHeader
-} from "./chunk-MJOTFUDE.js";
+} from "./chunk-LLKP5EJS.js";
 
 // src/protect/safe-origin.js
 function isSafeOrigin(value) {
@@ -131,6 +131,45 @@ function base64DecodeUtf8(value) {
   const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
   return new TextDecoder().decode(bytes);
 }
+var NAMED_ENTITIES = {
+  lt: "<",
+  gt: ">",
+  amp: "&",
+  quot: '"',
+  apos: "'",
+  "#39": "'",
+  nbsp: "\xA0",
+  sol: "/",
+  bsol: "\\",
+  colon: ":",
+  lpar: "(",
+  rpar: ")",
+  equals: "=",
+  grave: "`",
+  Tab: "	",
+  NewLine: "\n",
+  semi: ";",
+  excl: "!",
+  num: "#",
+  dollar: "$",
+  percnt: "%",
+  ast: "*"
+};
+function decodeHtmlEntities(input) {
+  return input.replace(/&(#[xX]?[0-9a-fA-F]+|[A-Za-z][A-Za-z0-9]*);?/g, (whole, body) => {
+    if (body[0] === "#") {
+      const hex = body[1] === "x" || body[1] === "X";
+      const code = Number.parseInt(hex ? body.slice(2) : body.slice(1), hex ? 16 : 10);
+      if (!Number.isFinite(code) || code < 0 || code > 1114111) return whole;
+      try {
+        return String.fromCodePoint(code);
+      } catch {
+        return whole;
+      }
+    }
+    return Object.prototype.hasOwnProperty.call(NAMED_ENTITIES, body) ? NAMED_ENTITIES[body] : whole;
+  });
+}
 var RequestResolver = class {
   #req;
   #cookies;
@@ -253,6 +292,8 @@ var RequestResolver = class {
         } catch {
           return value;
         }
+      case "htmlentitydecode":
+        return decodeHtmlEntities(String(value));
       case "intval":
         return parseInt(String(value), 10) || 0;
       case "getArrayValues":
@@ -920,6 +961,30 @@ function expandIPv6(host) {
   }
   return out;
 }
+var JWT_CANDIDATE = /(?<![A-Za-z0-9_-])(?<![A-Za-z0-9_-]\.)eyJ[A-Za-z0-9_-]{2,2048}\.[A-Za-z0-9_-]{2,8192}\.[A-Za-z0-9_-]{0,2048}(?![A-Za-z0-9_-])(?!\.[A-Za-z0-9_-])/g;
+function base64UrlToBase64(segment) {
+  const padded = segment.length % 4 === 0 ? segment : segment + "=".repeat(4 - segment.length % 4);
+  return padded.replace(/-/g, "+").replace(/_/g, "/");
+}
+function jwtClaimSpans(text, claim, value) {
+  const found = /* @__PURE__ */ new Set();
+  if (typeof text !== "string" || typeof claim !== "string" || claim === "") return [];
+  const wanted = String(value);
+  for (const [token] of text.matchAll(JWT_CANDIDATE)) {
+    const parts = token.split(".");
+    let payload;
+    try {
+      payload = JSON.parse(base64DecodeUtf8(base64UrlToBase64(parts[1])));
+    } catch {
+      continue;
+    }
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) continue;
+    if (!Object.prototype.hasOwnProperty.call(payload, claim)) continue;
+    const actual = payload[claim];
+    if (typeof actual === "string" && actual === wanted) found.add(token);
+  }
+  return [...found];
+}
 var warnedScopes = /* @__PURE__ */ new Set();
 function warnUnrecognisedScope(when) {
   const key = Object.keys(when).sort().join(",");
@@ -948,16 +1013,30 @@ function ruleAppliesTo(when, resolver) {
     return true;
   }
 }
+function foldPathForScope(value) {
+  const out = String(value).toLowerCase();
+  return out.endsWith("/") ? out.slice(0, -1) : out;
+}
+var REGEX_SYNTAX = /[\\^$*+?()[\]{}|]/;
+var REGEX_FORM = /^\/(.+?)\/([gimsuy]*)$/s;
+function isRegexForm(pattern) {
+  const parts = REGEX_FORM.exec(pattern);
+  return parts !== null && REGEX_SYNTAX.test(parts[1]);
+}
 function pathMatches(pattern, path) {
-  if (pattern.length > 2 && pattern.startsWith("/") && pattern.endsWith("/")) {
+  if (isRegexForm(pattern)) {
     const re = safeRegExp(pattern);
     return re ? re.test(path) : false;
   }
-  if (pattern.includes("*")) {
-    const re = safeRegExp("/^" + pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^?]*") + "$/");
-    return re ? re.test(path) : false;
+  const target = foldPathForScope(path);
+  const folded = foldPathForScope(pattern);
+  if (folded.includes("*")) {
+    const trailing = folded.endsWith("/*");
+    const body = (trailing ? folded.slice(0, -2) : folded).replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^?]*");
+    const re = safeRegExp("/^" + body + (trailing ? "(?:/[^?]*)?" : "") + "$/");
+    return re ? re.test(target) : false;
   }
-  return path === pattern;
+  return target === folded;
 }
 function normalizeDefaultPort(host) {
   return String(host).toLowerCase().replace(/:(?:80|443)$/, "");
@@ -1110,6 +1189,8 @@ function matchValue(type, value, matchVal, matchObj) {
       const stripped = strValue.replace(/[ _\-,]/g, "");
       return ctypeResult(strValue, /^[\w$€-￿]*$/.test(stripped), matchVal);
     }
+    case "jwt_claim_equals":
+      return jwtClaimSpans(strValue, matchObj?.claim, matchVal).length > 0;
     case "array_key_value":
       return arrayKeyValue(value, matchObj);
     // file_contains (uploaded-file content scanning) is NOT WordPress-specific, but is
@@ -1875,13 +1956,43 @@ var DEFAULT_RESPONSE_RULES = [
     rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\b(?:sk_live_[0-9A-Za-z]{16,}|rk_live_[0-9A-Za-z]{16,}|gh[opsu]_[0-9A-Za-z]{36}|github_pat_[0-9A-Za-z_]{60,}|glpat-[0-9A-Za-z_-]{20,}|xox[baprs]-[0-9A-Za-z-]{10,}|sk-ant-[0-9A-Za-z_-]{20,}|ya29\\.[0-9A-Za-z_-]{20,}|npm_[0-9A-Za-z]{36})(?![0-9A-Za-z])/" } }]
   },
   {
-    id: "resp-jwt",
-    title: "JWT in response body",
+    id: "resp-supabase-secret-key",
+    title: "Supabase secret key in response body",
+    phase: "response",
+    category: "secret-exposure",
+    action: "redact",
+    // Supabase's opaque key format, which is not a JWT and so is not covered by the JWT rule below.
+    // `sb_secret_` is the elevated one — documented as full access, bypassing Row Level Security,
+    // backend-only — while `sb_publishable_` is meant for public clients and must pass untouched.
+    // Both key systems are live at once: new keys sit alongside the legacy `anon` / `service_role`
+    // JWTs rather than replacing them, so this rule and the JWT rule cover different halves.
+    //
+    // The documented grammar is the prefix, 22 base64url characters, `_`, then an 8-character
+    // base64url checksum. Matching it exactly is what keeps the mask on the key and off the response
+    // around it: a variable-length suffix would either run past the key into adjacent syntax or stop
+    // short and leave the tail of a real key visible. The trailing guard rejects a longer run of key
+    // characters, which is not this format.
+    prefilter: ["sb_secret_"],
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\bsb_secret_[A-Za-z0-9_-]{22}_[A-Za-z0-9_-]{8}(?![A-Za-z0-9_-])/" } }]
+  },
+  {
+    id: "resp-supabase-service-role-key",
+    title: "Supabase service_role key in response body",
     phase: "response",
     category: "secret-exposure",
     action: "redact",
+    // Scoped to the one role that must never leave: `service_role` bypasses Row Level Security
+    // entirely. A JWT in a response body is not inherently a leak — the Supabase `anon` key is public
+    // by design and a login response carries the user's own access token — so this decides on the
+    // decoded payload rather than on the shape of the token.
+    //
+    // `jwt_claim_equals` also yields the matching token spans, which is what lets `redact` mask those
+    // tokens and serve the rest of the response.
+    //
+    // A broad any-JWT rule is a reasonable thing to want; it belongs in the managed hardening bundle as
+    // an opt-in, observe-only rule rather than an on-by-default mask.
     prefilter: ["eyJ"],
-    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\beyJ[A-Za-z0-9_-]{8,}\\.eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\b/" } }]
+    rule_v2: [{ parameter: "response.body", match: { type: "jwt_claim_equals", claim: "role", value: "service_role" } }]
   },
   {
     id: "resp-db-connection-string",
@@ -2106,25 +2217,468 @@ function toEnvelope(value) {
   return null;
 }
 
-// src/protect/rules/validate.js
-var LIMITS = {
+// src/protect/rules/contract.js
+var SOURCES = Object.freeze({
+  raw: Object.freeze({ keyed: false }),
+  all: Object.freeze({ keyed: false }),
+  false: Object.freeze({ keyed: false }),
+  rules: Object.freeze({ keyed: false, group: true }),
+  get: Object.freeze({ keyed: true, keys: "any", wildcard: true }),
+  post: Object.freeze({ keyed: true, keys: "any", wildcard: true }),
+  request: Object.freeze({ keyed: true, keys: "any", wildcard: true }),
+  cookie: Object.freeze({ keyed: true, keys: "any", wildcard: true }),
+  // A bare `files.<name>` resolves to the filename; an optional trailing attribute selects another part
+  // of the upload. Optional, not required — filename-scoped rules use the bare form.
+  files: Object.freeze({
+    keyed: true,
+    keys: "any",
+    wildcard: true,
+    optional_key_suffixes: Object.freeze(["content", "filename", "type"])
+  }),
+  server: Object.freeze({
+    keyed: true,
+    keys: Object.freeze([
+      "REQUEST_URI",
+      "REQUEST_METHOD",
+      "HTTP_USER_AGENT",
+      "HTTP_REFERER",
+      "HTTP_HOST",
+      "REMOTE_ADDR",
+      "ip",
+      "CONTENT_TYPE",
+      "CONTENT_LENGTH"
+    ]),
+    key_prefixes: Object.freeze(["HTTP_"])
+  }),
+  response: Object.freeze({
+    keyed: true,
+    keys: Object.freeze(["status", "body", "headers"]),
+    key_prefixes: Object.freeze(["header."])
+  }),
+  egress: Object.freeze({ keyed: true, keys: Object.freeze(["url", "host", "method"]) })
+});
+var MATCH_TYPES = Object.freeze([
+  "array_in_array",
+  "array_key_value",
+  "contains",
+  "cors_reflected",
+  "cross_origin",
+  "ctype_alnum",
+  "ctype_digit",
+  "ctype_special",
+  "equals",
+  "equals_strict",
+  "hostname",
+  "in_array",
+  "inline_js_xss",
+  "inline_xss",
+  "internal_host",
+  "is_numeric",
+  "isset",
+  "jwt_claim_equals",
+  "less_than",
+  "more_than",
+  "not_contains",
+  "not_in_array",
+  "off_origin",
+  "quotes",
+  "regex",
+  "stripos"
+]);
+var PARAMETERLESS_MATCH_TYPES = Object.freeze(["cross_origin", "off_origin", "cors_reflected"]);
+var OPERANDLESS_MATCH_TYPES = Object.freeze([
+  "isset",
+  "quotes",
+  "is_numeric",
+  "ctype_alnum",
+  "ctype_digit",
+  "ctype_special",
+  "inline_xss",
+  "inline_js_xss",
+  "internal_host",
+  "cross_origin",
+  "off_origin",
+  "cors_reflected"
+]);
+var OPERAND_SHAPES = Object.freeze([
+  "positive-number",
+  "boolean",
+  "non-empty-string",
+  "regex-literal",
+  "string-or-string-list",
+  "scalar",
+  "string",
+  "numeric",
+  "scalar-or-non-empty-list",
+  "non-empty-list",
+  "object",
+  "non-empty-object",
+  "non-empty-string-list",
+  "header-name-map",
+  "header-name-list",
+  "cookie-flags"
+]);
+var COOKIE_FLAGS = Object.freeze(["httpOnly", "secure", "sameSite"]);
+var SAME_SITE_VALUES = Object.freeze(["Strict", "Lax", "None"]);
+var HEADER_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+var REGEX_LITERAL = /^\/(.+?)\/([gimsuy]*)$/s;
+var MATCH_OPERANDS = Object.freeze({
+  array_key_value: Object.freeze({
+    required: Object.freeze(["key", "match"]),
+    shapes: Object.freeze({ key: "string-or-string-list", match: "object" })
+  }),
+  // Decides on a JWT's DECODED payload rather than its shape, and yields the matching token spans so
+  // `redact` masks only those tokens. `claim` names an own, top-level claim; `value` is compared with
+  // exact string equality. Anything not positively identified — undecodable, not JSON, not an object,
+  // oversized, claim missing, claim not a string, or a different value — is a no-match.
+  jwt_claim_equals: Object.freeze({
+    required: Object.freeze(["claim", "value"]),
+    shapes: Object.freeze({ claim: "non-empty-string", value: "non-empty-string" })
+  }),
+  regex: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "regex-literal" }) }),
+  contains: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "non-empty-string" }) }),
+  stripos: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "non-empty-string" }) }),
+  not_contains: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "non-empty-string" }) }),
+  // A hostname is compared to `new URL(value).hostname`, so an empty one only ever equals the empty
+  // hostname of an opaque-scheme URL (`file:`, `mailto:`, `data:`) — never a host, and a false positive
+  // on those. The other three are the list-membership family: an empty list makes `in_array` and
+  // `array_in_array` inert and `not_in_array` true for every value.
+  hostname: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "non-empty-string" }) }),
+  in_array: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "scalar-or-non-empty-list" }) }),
+  not_in_array: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "scalar-or-non-empty-list" }) }),
+  array_in_array: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "non-empty-list" }) }),
+  // The comparison family. `equals` coerces, so any scalar can match. `equals_strict` does not, and its
+  // subject is always a string by the time it is compared — so a number operand is unconditionally
+  // inert, which is the trap the engine's own note about `'1' !== 1` describes.
+  equals: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "scalar" }) }),
+  equals_strict: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "string" }) }),
+  less_than: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "numeric" }) }),
+  more_than: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "numeric" }) })
+});
+function operandShapeProblem(shape, value) {
+  const isFilledString = (v) => typeof v === "string" && v.trim() !== "";
+  const isScalar = (v) => typeof v === "string" || typeof v === "number" || typeof v === "boolean";
+  const isHeaderName = (v) => typeof v === "string" && HEADER_NAME.test(v);
+  switch (shape) {
+    case "positive-number":
+      return typeof value === "number" && Number.isFinite(value) && value > 0 ? null : "must be a finite positive number";
+    case "boolean":
+      return typeof value === "boolean" ? null : "must be true or false";
+    case "non-empty-string":
+      return isFilledString(value) ? null : "must be a non-empty string";
+    case "regex-literal":
+      if (!isFilledString(value)) return "must be a non-empty string";
+      return REGEX_LITERAL.test(value) ? null : "must be a delimited pattern, as in /pattern/i";
+    case "string-or-string-list":
+      if (isFilledString(value)) return null;
+      if (Array.isArray(value) && value.length > 0 && value.every(isFilledString)) return null;
+      return "must be a non-empty string, or a non-empty list of them";
+    case "scalar":
+      return isScalar(value) ? null : "must be a string, number or boolean";
+    case "string":
+      return typeof value === "string" ? null : "must be a string (this comparison is type-strict)";
+    case "numeric":
+      return isScalar(value) && Number.isFinite(Number(value)) ? null : "must be a number";
+    case "scalar-or-non-empty-list":
+      if (isScalar(value)) return null;
+      if (Array.isArray(value) && value.length > 0 && value.every(isScalar)) return null;
+      return "must be a scalar, or a non-empty list of them";
+    case "non-empty-list":
+      return Array.isArray(value) && value.length > 0 && value.every(isScalar) ? null : "must be a non-empty list of scalars";
+    case "header-name-map": {
+      if (value === null || typeof value !== "object" || Array.isArray(value)) return "must be an object";
+      const names = Object.keys(value);
+      if (names.length === 0) return "must be an object with at least one entry";
+      const bad = names.find((name) => !isHeaderName(name));
+      return bad === void 0 ? null : `names an invalid HTTP header, ${JSON.stringify(bad)}`;
+    }
+    case "header-name-list": {
+      if (!Array.isArray(value) || value.length === 0) return "must be a non-empty list of HTTP header names";
+      const bad = value.find((name) => !isHeaderName(name));
+      return bad === void 0 ? null : `names an invalid HTTP header, ${JSON.stringify(bad)}`;
+    }
+    case "cookie-flags": {
+      if (value === null || typeof value !== "object" || Array.isArray(value)) return "must be an object";
+      const unknown = Object.keys(value).filter((key) => !COOKIE_FLAGS.includes(key));
+      if (unknown.length > 0) return `has no flag named ${unknown.map((k) => JSON.stringify(k)).join(", ")}`;
+      for (const flag of ["httpOnly", "secure"]) {
+        if (value[flag] !== void 0 && typeof value[flag] !== "boolean") {
+          return `flag "${flag}" must be true or false`;
+        }
+      }
+      const sameSite = value.sameSite;
+      const sameSiteOff = sameSite === false;
+      if (sameSite !== void 0 && !sameSiteOff) {
+        if (typeof sameSite !== "string" || !SAME_SITE_VALUES.some((v) => v.toLowerCase() === sameSite.toLowerCase())) {
+          return `flag "sameSite" must be false, or one of ${SAME_SITE_VALUES.join(", ")}`;
+        }
+      }
+      if (value.httpOnly === false && value.secure === false && sameSiteOff) {
+        return "turns off every flag, so it would harden nothing";
+      }
+      return null;
+    }
+    case "object":
+      return value !== null && typeof value === "object" && !Array.isArray(value) ? null : "must be an object";
+    case "non-empty-object":
+      return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length > 0 ? null : "must be an object with at least one entry";
+    case "non-empty-string-list":
+      return Array.isArray(value) && value.length > 0 && value.every(isFilledString) ? null : "must be a non-empty list of non-empty strings";
+    default:
+      return null;
+  }
+}
+var MUTATIONS = Object.freeze([
+  "base64_decode",
+  "getArrayValues",
+  "htmlentitydecode",
+  "intval",
+  "json_decode",
+  "json_encode",
+  "urldecode"
+]);
+var PHASES = Object.freeze(["request", "response", "egress"]);
+var ACTIONS = Object.freeze([
+  "block",
+  "redact",
+  "encode",
+  "set-header",
+  "remove-header",
+  "harden-cookie"
+]);
+var RULE_PROPERTY_SHAPES = Object.freeze({
+  max_bytes: "positive-number",
+  bypass_limit: "boolean",
+  ensure: "boolean",
+  prefilter: "non-empty-string-list"
+});
+var ENFORCEMENT_VALUES = Object.freeze(["dry-run"]);
+var WHEN_KEYS = Object.freeze(["path", "method"]);
+var RULE_PROPERTIES = Object.freeze([
+  "id",
+  "rule_id",
+  "title",
+  "category",
+  "phase",
+  "action",
+  "rule_v2",
+  "when",
+  "message",
+  "enforcement",
+  "source_revision",
+  "prefilter",
+  "max_bytes",
+  "bypass_limit",
+  "set_headers",
+  "remove_headers",
+  "cookie_flags",
+  "ensure"
+]);
+var ACTION_PROPERTIES = Object.freeze({
+  block: Object.freeze({ required: Object.freeze([]), defaulted: Object.freeze([]), phases: Object.freeze(["request", "response", "egress"]) }),
+  redact: Object.freeze({ required: Object.freeze([]), defaulted: Object.freeze([]), phases: Object.freeze(["response"]) }),
+  encode: Object.freeze({ required: Object.freeze([]), defaulted: Object.freeze([]), phases: Object.freeze(["response"]) }),
+  "set-header": Object.freeze({
+    required: Object.freeze(["set_headers"]),
+    defaulted: Object.freeze(["ensure"]),
+    phases: Object.freeze(["response"]),
+    shapes: Object.freeze({ set_headers: "header-name-map" })
+  }),
+  "remove-header": Object.freeze({
+    required: Object.freeze(["remove_headers"]),
+    defaulted: Object.freeze([]),
+    phases: Object.freeze(["response"]),
+    shapes: Object.freeze({ remove_headers: "header-name-list" })
+  }),
+  "harden-cookie": Object.freeze({
+    required: Object.freeze([]),
+    defaulted: Object.freeze(["cookie_flags"]),
+    phases: Object.freeze(["response"]),
+    shapes: Object.freeze({ cookie_flags: "cookie-flags" })
+  })
+});
+var LIMITS = Object.freeze({
   maxRules: 5e3,
   maxWhitelists: 2e3,
   maxConditionsPerRule: 250,
   maxNestingDepth: 12,
   maxRegexLength: 1e3,
   maxValueLength: 8192
-};
-var PHASES = /* @__PURE__ */ new Set(["request", "response", "egress"]);
-var ACTIONS = /* @__PURE__ */ new Set(["block", "redact", "encode", "set-header", "remove-header", "harden-cookie"]);
+});
+var GROUP_PARAMETER = "rules";
+function isGroup(condition) {
+  return condition?.parameter === GROUP_PARAMETER && Array.isArray(condition?.rules);
+}
+function conditionShapeProblem(condition) {
+  if (!condition || typeof condition !== "object") return "condition is not an object";
+  const named = condition.parameter === GROUP_PARAMETER;
+  const nested = Array.isArray(condition.rules);
+  if (named && !nested) {
+    return `parameter "${GROUP_PARAMETER}" is a group and needs a "rules" array`;
+  }
+  if (nested && !named) {
+    return `condition carries nested rules but its parameter is ${JSON.stringify(condition.parameter)}; a group must be {"parameter":"${GROUP_PARAMETER}"}`;
+  }
+  if (named && nested) {
+    if (condition.match !== void 0) return "a group carries no match of its own; the engine ignores it";
+    if (condition.mutations !== void 0) return "a group carries no mutations of its own; the engine ignores them";
+    if (condition.rules.length === 0) return "group has no conditions (would never match)";
+  }
+  return null;
+}
+function parameterProblem(parameter) {
+  if (parameter === void 0 || parameter === null) return null;
+  if (Array.isArray(parameter)) {
+    if (parameter.length === 0) return "parameter list is empty";
+    for (const member of parameter) {
+      const problem = parameterProblem(member);
+      if (problem !== null) return problem;
+    }
+    return null;
+  }
+  if (typeof parameter !== "string" || parameter === "") return "parameter must be a non-empty string";
+  if (parameter === GROUP_PARAMETER) {
+    return `"${GROUP_PARAMETER}" is the group source and is only valid as a whole group, not as a parameter`;
+  }
+  const dot = parameter.indexOf(".");
+  const name = dot === -1 ? parameter : parameter.slice(0, dot);
+  const source = SOURCES[name];
+  if (source === void 0) return `unknown parameter source "${name}"`;
+  if (dot === -1) {
+    return source.keyed === true ? `source "${name}" needs a key, e.g. "${name}.fieldname"` : null;
+  }
+  if (source.keyed !== true) return `source "${name}" takes no key`;
+  const key = parameter.slice(dot + 1);
+  if (key === "") return `source "${name}" needs a key after the dot`;
+  return keyProblem(name, source, key);
+}
+function keyProblem(name, source, key) {
+  if (key.endsWith("*") && source.wildcard !== true) {
+    return `"${name}" does not fan out over a wildcard key`;
+  }
+  const bare = key.endsWith("*") ? key.slice(0, -1) : key;
+  if (source.keys === "any") return null;
+  if (Array.isArray(source.keys) && source.keys.includes(bare)) return null;
+  for (const prefix of source.key_prefixes ?? []) {
+    if (bare.startsWith(prefix) && bare.length > prefix.length) return null;
+  }
+  const accepted = [
+    ...Array.isArray(source.keys) ? source.keys : [],
+    ...(source.key_prefixes ?? []).map((p) => `${p}\u2026`)
+  ].join(", ");
+  return `"${name}" has no key "${key}" (expected one of: ${accepted})`;
+}
+function matchProblem(match, parameter) {
+  if (!match || typeof match !== "object") return "condition has no match object";
+  if (typeof match.type !== "string" || match.type === "") return "match.type must be a non-empty string";
+  if (!MATCH_TYPES.includes(match.type)) return `unknown match type "${match.type}"`;
+  const parameterless = PARAMETERLESS_MATCH_TYPES.includes(match.type);
+  if (!parameterless && (parameter === void 0 || parameter === null)) {
+    return `match type "${match.type}" needs a parameter`;
+  }
+  if (parameterless && parameter !== void 0 && parameter !== null) {
+    return `match type "${match.type}" reads the whole request and takes no parameter`;
+  }
+  const operands = MATCH_OPERANDS[match.type];
+  if (operands) {
+    for (const required of operands.required) {
+      if (match[required] === void 0 || match[required] === null) {
+        return `match type "${match.type}" needs "${required}"`;
+      }
+    }
+    for (const [operand, shape] of Object.entries(operands.shapes ?? {})) {
+      if (match[operand] === void 0) continue;
+      const problem = operandShapeProblem(shape, match[operand]);
+      if (problem) return `match type "${match.type}" operand "${operand}" ${problem}`;
+    }
+  } else if (!OPERANDLESS_MATCH_TYPES.includes(match.type) && match.value === void 0) {
+    return `match type "${match.type}" needs a value`;
+  }
+  return null;
+}
+function mutationsProblem(mutations) {
+  if (mutations === void 0 || mutations === null) return null;
+  if (!Array.isArray(mutations)) return "mutations must be an array";
+  for (const mutation of mutations) {
+    if (typeof mutation !== "string" || !MUTATIONS.includes(mutation)) {
+      return `unknown mutation "${String(mutation)}" \u2014 applied as a no-op, so the condition would test the untransformed value`;
+    }
+  }
+  return null;
+}
+function whenProblem(when) {
+  if (when === void 0 || when === null) return null;
+  if (typeof when !== "object" || Array.isArray(when)) return "when must be an object";
+  const keys = Object.keys(when);
+  if (keys.length === 0) return "when is empty \u2014 remove it, or name a path or method";
+  const unknown = keys.filter((key) => !WHEN_KEYS.includes(key));
+  if (unknown.length > 0) {
+    return `when names no supported key (${unknown.join(", ")}) \u2014 the engine understands ${WHEN_KEYS.join(" and ")}, and an unrecognised scope is ignored, so the rule would apply to every request`;
+  }
+  if ("path" in when && !isNonEmptyString(when.path)) {
+    return "when.path must be a non-empty string";
+  }
+  if ("method" in when) {
+    const methods = Array.isArray(when.method) ? when.method : [when.method];
+    if (methods.length === 0) return "when.method is an empty list, so the rule would match no method";
+    if (!methods.every(isNonEmptyString)) return "when.method must be a non-empty string, or a list of them";
+  }
+  return null;
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function nullPropertyProblem(rule) {
+  if (!rule || typeof rule !== "object") return null;
+  for (const property of RULE_PROPERTIES) {
+    if (property in rule && rule[property] === null) {
+      return `"${property}" is present but null; omit it to mean the default, since a null is a value that was meant to be something and is not`;
+    }
+  }
+  return null;
+}
+function rulePropertyProblem(rule) {
+  if (!rule || typeof rule !== "object") return null;
+  for (const [property, shape] of Object.entries(RULE_PROPERTY_SHAPES)) {
+    if (rule[property] === void 0 || rule[property] === null) continue;
+    const problem = operandShapeProblem(shape, rule[property]);
+    if (problem) return `"${property}" ${problem}`;
+  }
+  return null;
+}
+function actionProblem(action, rule) {
+  if (action === void 0 || action === null) return null;
+  if (!ACTIONS.includes(action)) return `unknown action "${action}"`;
+  const spec = ACTION_PROPERTIES[action];
+  for (const required of spec?.required ?? []) {
+    if (rule?.[required] === void 0 || rule?.[required] === null) {
+      return `action "${action}" needs "${required}"`;
+    }
+  }
+  for (const [property, shape] of Object.entries(spec?.shapes ?? {})) {
+    if (rule?.[property] === void 0 || rule?.[property] === null) continue;
+    const problem = operandShapeProblem(shape, rule[property]);
+    if (problem) return `action "${action}" property "${property}" ${problem}`;
+  }
+  const phase = rule?.phase ?? "request";
+  if (spec !== void 0 && !spec.phases.includes(phase)) {
+    return `action "${action}" is carried out on the ${spec.phases.join("/")} phase; on "${phase}" the rule blocks instead`;
+  }
+  return null;
+}
+
+// src/protect/rules/validate.js
+var LIMITS2 = LIMITS;
+var PHASES2 = new Set(PHASES);
+var ACTIONS2 = new Set(ACTIONS);
 function validateBundle(bundle, opts = {}) {
   const rejected = [];
   const inFirewall = Array.isArray(bundle?.firewall) ? bundle.firewall : [];
   const inWhitelists = Array.isArray(bundle?.whitelists) ? bundle.whitelists : [];
   const firewall = [];
   for (const rule of inFirewall) {
-    if (firewall.length >= LIMITS.maxRules) {
-      rejected.push({ id: idOf(rule), reason: `bundle exceeds maxRules (${LIMITS.maxRules})` });
+    if (firewall.length >= LIMITS2.maxRules) {
+      rejected.push({ id: idOf(rule), reason: `bundle exceeds maxRules (${LIMITS2.maxRules})` });
       continue;
     }
     const reason = ruleProblem(rule);
@@ -2133,8 +2687,8 @@ function validateBundle(bundle, opts = {}) {
   }
   const whitelists = [];
   for (const wl of inWhitelists) {
-    if (whitelists.length >= LIMITS.maxWhitelists) {
-      rejected.push({ id: idOf(wl), reason: `bundle exceeds maxWhitelists (${LIMITS.maxWhitelists})` });
+    if (whitelists.length >= LIMITS2.maxWhitelists) {
+      rejected.push({ id: idOf(wl), reason: `bundle exceeds maxWhitelists (${LIMITS2.maxWhitelists})` });
       continue;
     }
     if (!opts.allowGlobalWhitelists && wl && Array.isArray(wl.rule_v2) && !wl.rule_id) {
@@ -2156,37 +2710,47 @@ function idOf(rule) {
 }
 function ruleProblem(rule) {
   if (!rule || typeof rule !== "object") return "not an object";
-  if (rule.phase !== void 0 && !PHASES.has(rule.phase)) return `unknown phase "${rule.phase}"`;
-  if (rule.action !== void 0 && !ACTIONS.has(rule.action)) return `unknown action "${rule.action}"`;
-  const capOverride = rule.max_bytes;
-  if (capOverride !== void 0 && !(Number(capOverride) > 0)) return "max_bytes must be a positive number";
+  const nullReason = nullPropertyProblem(rule);
+  if (nullReason) return nullReason;
+  if (rule.phase !== void 0 && !PHASES2.has(rule.phase)) return `unknown phase "${rule.phase}"`;
+  const actionReason = actionProblem(rule.action, rule);
+  if (actionReason) return actionReason;
+  const scopeReason = whenProblem(rule.when);
+  if (scopeReason) return scopeReason;
+  const propertyReason = rulePropertyProblem(rule);
+  if (propertyReason) return propertyReason;
   return conditionsProblem(rule.rule_v2);
 }
 function conditionsProblem(conditions, depth = 0) {
   if (!Array.isArray(conditions)) return "rule_v2 must be an array of conditions";
   if (conditions.length === 0) return "rule_v2 is empty (would never match)";
-  if (depth > LIMITS.maxNestingDepth) return `nesting deeper than ${LIMITS.maxNestingDepth}`;
-  if (conditions.length > LIMITS.maxConditionsPerRule) {
-    return `more than ${LIMITS.maxConditionsPerRule} conditions`;
+  if (depth > LIMITS2.maxNestingDepth) return `nesting deeper than ${LIMITS2.maxNestingDepth}`;
+  if (conditions.length > LIMITS2.maxConditionsPerRule) {
+    return `more than ${LIMITS2.maxConditionsPerRule} conditions`;
   }
   for (const c of conditions) {
-    if (!c || typeof c !== "object") return "condition is not an object";
-    if (Array.isArray(c.rules)) {
+    const shapeReason = conditionShapeProblem(c);
+    if (shapeReason) return shapeReason;
+    if (isGroup(c)) {
       const nested = conditionsProblem(c.rules, depth + 1);
       if (nested) return nested;
       continue;
     }
+    const parameterReason = parameterProblem(c.parameter);
+    if (parameterReason) return parameterReason;
+    const mutationReason = mutationsProblem(c.mutations);
+    if (mutationReason) return mutationReason;
+    const matchReason = matchProblem(c.match, c.parameter);
+    if (matchReason) return matchReason;
     const m = c.match;
-    if (!m || typeof m !== "object") return "condition has no match object";
-    if (typeof m.type !== "string" || m.type === "") return "match.type must be a non-empty string";
     if (m.type === "regex") {
       if (typeof m.value !== "string") return "regex match.value must be a string";
-      if (m.value.length > LIMITS.maxRegexLength) return `regex longer than ${LIMITS.maxRegexLength} chars`;
-    } else if (typeof m.value === "string" && m.value.length > LIMITS.maxValueLength) {
-      return `match.value longer than ${LIMITS.maxValueLength} chars`;
+      if (m.value.length > LIMITS2.maxRegexLength) return `regex longer than ${LIMITS2.maxRegexLength} chars`;
+    } else if (typeof m.value === "string" && m.value.length > LIMITS2.maxValueLength) {
+      return `match.value longer than ${LIMITS2.maxValueLength} chars`;
     }
     if (m.match) {
-      const nested = conditionsProblem([{ match: m.match }], depth + 1);
+      const nested = conditionsProblem([{ parameter: c.parameter, match: m.match }], depth + 1);
       if (nested) return nested;
     }
   }
@@ -2214,64 +2778,67 @@ function reportRejections(rejected, options, label) {
     `${label}: rejected the entire update because ${rejected.length} rule(s) failed validation \u2014 keeping the previous ruleset and NOT caching this response: ${sample}${rejected.length > 3 ? ", \u2026" : ""}`
   ), "onError");
 }
+function fromSource(bundle, reason) {
+  return reason === void 0 ? { ...bundle, source: { ok: true } } : { ...bundle, source: { ok: false, reason } };
+}
 async function resolveRules(options, store, ctx = {}) {
   const timeoutMs = ctx.timeoutMs;
   if (options.siteUuid) {
     const prior = await store.read();
     const client = new PulseRuleClient({ siteUuid: options.siteUuid, baseUrl: options.pulseRulesUrl, etag: prior?.etag, timeoutMs, pulseAuth: ctx.pulseAuth, reportsDetections: options.reportDetections === true });
     const res = await client.getRules();
-    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle, options);
+    if (res.success && res.notModified && prior?.bundle) return fromSource(normalizeBundle(prior.bundle, options));
     if (res.success && !res.notModified) {
       const rejected = liveUpdateRejections(res, options);
       if (rejected.length > 0) {
         reportRejections(rejected, options, "rule update rejected");
-        if (prior?.bundle) return normalizeBundle(prior.bundle, options);
-        if (options.rules) return normalizeBundle(options.rules, options);
-        return emptyBundle();
+        if (prior?.bundle) return fromSource(normalizeBundle(prior.bundle, options), "update rejected");
+        if (options.rules) return fromSource(normalizeBundle(options.rules, options), "update rejected");
+        return fromSource(emptyBundle(), "update rejected");
       }
       const bundle = normalizeBundle(res, options);
       await store.write({ bundle, etag: res.etag ?? null });
-      return bundle;
+      return fromSource(bundle);
     }
     if (prior?.bundle) {
       notify(options.onError, new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`), "onError");
-      return normalizeBundle(prior.bundle, options);
+      return fromSource(normalizeBundle(prior.bundle, options), res.error ?? "no usable response");
     }
     if (options.rules) {
       notify(options.onError, new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using bundled fallback`), "onError");
-      return normalizeBundle(options.rules, options);
+      return fromSource(normalizeBundle(options.rules, options), res.error ?? "no usable response");
     }
     notify(options.onError, new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`), "onError");
-    return emptyBundle();
+    return fromSource(emptyBundle(), res.error ?? "no usable response");
   }
   if (options.token) {
     const prior = await store.read();
     const client = new PatchstackRuleClient({ token: options.token, baseUrl: options.baseUrl, etag: prior?.etag, timeoutMs });
     const res = await client.getRules();
-    if (res.success && res.notModified && prior?.bundle) return normalizeBundle(prior.bundle, options);
+    if (res.success && res.notModified && prior?.bundle) return fromSource(normalizeBundle(prior.bundle, options));
     if (res.success && !res.notModified) {
       const rejected = liveUpdateRejections(res, options);
       if (rejected.length > 0) {
         reportRejections(rejected, options, "rule update rejected");
-        if (prior?.bundle) return normalizeBundle(prior.bundle, options);
-        if (options.rules) return normalizeBundle(options.rules, options);
-        return emptyBundle();
+        if (prior?.bundle) return fromSource(normalizeBundle(prior.bundle, options), "update rejected");
+        if (options.rules) return fromSource(normalizeBundle(options.rules, options), "update rejected");
+        return fromSource(emptyBundle(), "update rejected");
       }
       const bundle = normalizeBundle(res, options);
       await store.write({ bundle, etag: res.etag ?? null });
-      return bundle;
+      return fromSource(bundle);
     }
     if (prior?.bundle) {
       notify(options.onError, new Error(`rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`), "onError");
-      return normalizeBundle(prior.bundle, options);
+      return fromSource(normalizeBundle(prior.bundle, options), res.error ?? "no usable response");
     }
     notify(options.onError, new Error(`rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`), "onError");
-    return emptyBundle();
+    return fromSource(emptyBundle(), res.error ?? "no usable response");
   }
   if (options.rules) {
-    return normalizeBundle(options.rules, options);
+    return fromSource(normalizeBundle(options.rules, options));
   }
-  return emptyBundle();
+  return fromSource(emptyBundle());
 }
 function normalizeBundle(b, options = {}) {
   const enforcement = b?.enforcement ?? b?.mode;
@@ -2324,8 +2891,9 @@ function startRefresh(tick, { refreshMs, onError } = {}) {
   const run = async () => {
     if (stopped) return;
     try {
-      await tick();
-      failures = 0;
+      const status = await tick();
+      if (status && status.ok === false) failures++;
+      else failures = 0;
     } catch (err) {
       failures++;
       notify(onError, err, "onError");
@@ -2352,7 +2920,8 @@ function makeRefreshHandler(tick, secret) {
     if (provided !== secret) return new Response("forbidden", { status: 403 });
     let refreshed = true;
     try {
-      await tick();
+      const status = await tick();
+      if (status && status.ok === false) refreshed = false;
     } catch {
       refreshed = false;
     }
@@ -2380,6 +2949,12 @@ function ruleParameters(rule) {
   walk(rule?.rule_v2);
   return [...out];
 }
+function revisionOf(rule) {
+  const revision = rule?.source_revision;
+  if (typeof revision === "string" && revision !== "") return revision;
+  if (typeof revision === "number" && Number.isFinite(revision)) return String(revision);
+  return null;
+}
 function routeOf(path) {
   if (typeof path !== "string" || path === "") return null;
   const cut = path.search(/[?#]/);
@@ -2388,16 +2963,30 @@ function routeOf(path) {
 function createDetectionReporter(opts) {
   const siteUuid = opts.siteUuid ?? process.env?.PATCHSTACK_SITE_UUID;
   if (!siteUuid) {
-    return { record() {
-    }, flush() {
-    }, stop() {
-    }, dropped: () => 0 };
+    return {
+      record() {
+      },
+      flush() {
+      },
+      stop() {
+      },
+      setRulesEtag() {
+      },
+      dropped: () => 0,
+      health: () => ({ sent: 0, delivered: 0, failed: 0, dropped: 0, lastDeliveredAt: null })
+    };
   }
   const configured = opts.baseUrl ?? process.env?.PATCHSTACK_PULSE_RULES_URL;
   const baseUrl = typeof configured === "string" && isSafeOrigin(configured) ? configured.replace(/\/$/, "") : DEFAULT_BASE_URL3;
   const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
   const flushMs = Number.isFinite(opts.flushMs) && opts.flushMs > 0 ? opts.flushMs : DEFAULT_FLUSH_MS;
   const maxQueue = Number.isFinite(opts.maxQueue) && opts.maxQueue > 0 ? opts.maxQueue : MAX_QUEUE;
+  let rulesEtag = opts.rulesEtag ?? null;
+  let sent = 0;
+  let delivered = 0;
+  let failed = 0;
+  let droppedTotal = 0;
+  let lastDeliveredAt = null;
   let queue = [];
   let timer = null;
   let stopped = false;
@@ -2411,6 +3000,8 @@ function createDetectionReporter(opts) {
     const batch = queue.splice(0, MAX_BATCH);
     const droppedWith = dropped;
     dropped = 0;
+    droppedTotal += droppedWith;
+    sent += batch.length;
     void (async () => {
       try {
         const res = await fetchImpl(`${baseUrl}/detections/${encodeURIComponent(siteUuid)}`, {
@@ -2419,15 +3010,22 @@ function createDetectionReporter(opts) {
             "Content-Type": "application/json",
             Accept: "application/json",
             "User-Agent": "@patchstack/connect",
-            // Same credential path as the rules fetch, and unauthenticated when none resolves: the
-            // server accepts the UUID, and reporting must never hinge on getting a token.
+            // Same credential path as the rules fetch. The detections endpoint is site-addressed and
+            // requires a verified, site-bound token, so a batch sent without one is refused — which is
+            // why the runtime does not build a reporter when no credential resolves, rather than
+            // posting into a 401.
             ...await pulseAuthHeader({ pulseAuth: opts.pulseAuth, endpoint: baseUrl }, fetchImpl)
           },
           body: JSON.stringify({ detections: batch, dropped: droppedWith })
         });
-        if (res && typeof res.then === "function") res.catch(() => {
-        });
+        if (res && res.ok) {
+          delivered += batch.length;
+          lastDeliveredAt = (/* @__PURE__ */ new Date()).toISOString();
+        } else {
+          failed += batch.length;
+        }
       } catch {
+        failed += batch.length;
       }
     })();
   };
@@ -2456,7 +3054,12 @@ function createDetectionReporter(opts) {
         // The state this detection was handled under, which is the whole point: `false` is a rule that
         // saw traffic it would have stopped.
         enforced: detection.mode === "block",
-        rules_etag: opts.rulesEtag ?? null,
+        rules_etag: rulesEtag,
+        // The revision of THIS rule, as the bundle delivered it. The bundle identity above answers "which
+        // bundle", which changes whenever anything in it changes — so it cannot say whether the counts for
+        // one rule describe the document that rule has now. Passed through untouched, and null when the
+        // bundle carried none.
+        rule_revision: revisionOf(detection.rule),
         detected_at: (/* @__PURE__ */ new Date()).toISOString()
       });
       if (queue.length >= MAX_BATCH) {
@@ -2470,7 +3073,24 @@ function createDetectionReporter(opts) {
       stopped = true;
       flush();
     },
-    dropped: () => dropped
+    /**
+     * Point later events at the bundle now running. Called after an ACCEPTED swap only — a rejected
+     * or failed refresh keeps the previous rules, so it must keep the previous identity too.
+     *
+     * Already-queued events are not rewritten: the stamp is taken when an event is recorded, which is
+     * the only moment the two are known to agree.
+     *
+     * @param {string | null | undefined} next
+     */
+    setRulesEtag(next) {
+      rulesEtag = next ?? null;
+    },
+    dropped: () => dropped,
+    /**
+     * Delivery health, counted in events: attempted, acknowledged, refused or unreachable, and dropped
+     * for queue pressure — plus when a batch was last acknowledged. No request data of any kind.
+     */
+    health: () => ({ sent, delivered, failed, dropped: droppedTotal + dropped, lastDeliveredAt })
   };
 }
 
@@ -2735,22 +3355,32 @@ async function createProtection(options = {}) {
   const bootTimeoutMs = Number(options.bootTimeoutMs) > 0 ? Number(options.bootTimeoutMs) : 5e3;
   const pulseAuth = await resolvePulseAuth(options);
   if (options.siteUuid && !pulseAuth) {
-    const message = "Patchstack: no API credential resolved for site " + options.siteUuid + ". Rule updates may be rejected and this guard would keep running on its cached rules. Set PATCHSTACK_API_KEY (or pass { pulseAuth }) \u2014 required on runtimes without a filesystem.";
+    const message = "Patchstack: no API credential resolved for site " + options.siteUuid + ". Rule updates will be rejected and this guard would keep running on its cached rules. Set PATCHSTACK_API_KEY (or pass { pulseAuth }) \u2014 required on runtimes without a filesystem.";
     notify(onError, new Error(message), "onError");
     console.warn(message);
   }
   const bundle = await resolveRules(options, store, { timeoutMs: bootTimeoutMs, pulseAuth });
+  let detectionReporting = "off";
   if (options.reportDetections === true && options.siteUuid && telemetryEnabled()) {
-    detections = createDetectionReporter({
-      siteUuid: options.siteUuid,
-      baseUrl: options.pulseRulesUrl,
-      pulseAuth,
-      // The bundle the guard is actually running, so a hit can be attributed to the rules that produced
-      // it rather than to whatever is current when the report is read.
-      rulesEtag: (await store.read())?.etag ?? null,
-      fetchImpl: options.fetchImpl,
-      flushMs: options.detectionFlushMs
-    });
+    if (!pulseAuth) {
+      detectionReporting = "unavailable-no-credential";
+      const message = "Patchstack: detection reporting is enabled for site " + options.siteUuid + " but no API credential resolved, so no report could be delivered. Reporting is off.";
+      notify(onError, new Error(message), "onError");
+      console.warn(message);
+    } else {
+      detectionReporting = "on";
+      detections = createDetectionReporter({
+        siteUuid: options.siteUuid,
+        baseUrl: options.pulseRulesUrl,
+        pulseAuth,
+        // The bundle the guard is actually running, so a hit can be attributed to the rules that produced
+        // it rather than to whatever is current when the report is read. Kept current across refreshes —
+        // see the refresh tick below.
+        rulesEtag: (await store.read())?.etag ?? null,
+        fetchImpl: options.fetchImpl,
+        flushMs: options.detectionFlushMs
+      });
+    }
   }
   let mode = resolveMode(options, bundle);
   let requestRules;
@@ -3084,11 +3714,17 @@ async function createProtection(options = {}) {
         );
       };
     },
-    // Node / Connect middleware — buffers the body itself (request phase).
+    // Node / Connect middleware — buffers the body itself (request phase). Register it BEFORE any body
+    // parser: it reads the request stream, and exposes what it read as `req.body` so a parser is not
+    // also needed. (`.express()` is the other way round — it reads a body somebody else parsed.)
     // Pass { screenResponses: true } to also screen the outgoing response (buffers it).
     node(nodeOptions = {}) {
       const maxBytes = nodeOptions.maxBodyBytes ?? 1024 * 1024;
       return (req, res, next) => {
+        if (req.readableEnded || req.body !== void 0) {
+          screenNodeRequest(req, res, next, "", req.body);
+          return;
+        }
         const chunks = [];
         let size = 0;
         let overflow = false;
@@ -3106,38 +3742,41 @@ async function createProtection(options = {}) {
         });
         req.on("end", () => {
           if (overflow) recordSkip("request", "body-cap", { bytes: size, limit: maxBytes });
-          const rawBody = overflow ? "" : Buffer.concat(chunks).toString("utf8");
-          let shaped;
-          let result;
-          try {
-            shaped = fromNodeRequest(req, rawBody);
-            result = engine.evaluate(shaped);
-          } catch (err) {
-            notify(onError, err, "onError");
-            return next();
-          }
-          decide(
-            "request",
-            result,
-            () => {
-              res.statusCode = 403;
-              if (isDocumentNavigation((n) => req.headers?.[n])) {
-                res.setHeader("content-type", "text/html; charset=utf-8");
-                res.end(renderBlockPage({ url: req.url || "/", code: result?.rule?.id }));
-              } else {
-                res.setHeader("content-type", "application/json");
-                res.end(JSON.stringify(blockBody(result)));
-              }
-            },
-            () => {
-              if (req.body === void 0) req.body = shaped.body;
-              if (nodeOptions.screenResponses) wrapNodeResponse(res, reqContextFromNode(req));
-              next();
-            },
-            nodeRequestMeta(req)
-          );
+          screenNodeRequest(req, res, next, overflow ? "" : Buffer.concat(chunks).toString("utf8"));
         });
       };
+      function screenNodeRequest(req, res, next, rawBody, parsedBody) {
+        let shaped;
+        let result;
+        try {
+          shaped = fromNodeRequest(req, rawBody);
+          if (parsedBody !== void 0 && parsedBody !== null) shaped.body = parsedBody;
+          result = engine.evaluate(shaped);
+        } catch (err) {
+          notify(onError, err, "onError");
+          return next();
+        }
+        decide(
+          "request",
+          result,
+          () => {
+            res.statusCode = 403;
+            if (isDocumentNavigation((n) => req.headers?.[n])) {
+              res.setHeader("content-type", "text/html; charset=utf-8");
+              res.end(renderBlockPage({ url: req.url || "/", code: result?.rule?.id }));
+            } else {
+              res.setHeader("content-type", "application/json");
+              res.end(JSON.stringify(blockBody(result)));
+            }
+          },
+          () => {
+            if (req.body === void 0) req.body = shaped.body;
+            if (nodeOptions.screenResponses) wrapNodeResponse(res, reqContextFromNode(req));
+            next();
+          },
+          nodeRequestMeta(req)
+        );
+      }
     }
   };
   if (options.egress) {
@@ -3158,7 +3797,7 @@ async function createProtection(options = {}) {
   let reporter = null;
   if (refreshable && options.siteUuid && options.reportManifest !== false && cwd) {
     try {
-      ({ reportManifest: reporter } = await import("./refresh-manifest-VRBE6RH6.js"));
+      ({ reportManifest: reporter } = await import("./refresh-manifest-KNZQBC4V.js"));
     } catch (err) {
       notify(onError, err, "onError");
     }
@@ -3174,24 +3813,22 @@ async function createProtection(options = {}) {
     const next = await resolveRules(options, store, { timeoutMs: options.refreshTimeoutMs, pulseAuth });
     mode = resolveMode(options, next);
     applyBundle(next);
+    if (detections) detections.setRulesEtag((await store.read())?.etag ?? null);
+    return next.source ?? { ok: true };
   };
   if (live) {
     protection.refresh = () => runRefreshTick();
     protection.refreshHandler = () => makeRefreshHandler(runRefreshTick, refreshSecret);
   }
-  if (options.refreshMs > 0 && live) {
-    const loop = startRefresh(runRefreshTick, { refreshMs: options.refreshMs, onError });
-    protection.stopRefresh = () => {
-      loop.stop();
-      firewallLog?.stop();
-      detections?.stop();
-    };
-  } else if (firewallLog) {
-    protection.stopRefresh = () => {
-      firewallLog.stop();
-      detections?.stop();
-    };
-  }
+  const loop = options.refreshMs > 0 && live ? startRefresh(runRefreshTick, { refreshMs: options.refreshMs, onError }) : null;
+  protection.stop = () => {
+    loop?.stop();
+    firewallLog?.stop();
+    detections?.stop();
+  };
+  protection.stopRefresh = protection.stop;
+  protection.detectionReporting = detectionReporting;
+  if (detections) protection.detectionHealth = () => detections.health();
   return protection;
 }
 function resolveMode(options, bundle) {
@@ -3202,22 +3839,35 @@ function resolveMode(options, bundle) {
   if (options?.mode === "dry-run") return "dry-run";
   return "dry-run";
 }
+var CREDENTIAL_FILES = [".patchstackrc.local.json", ".patchstackrc.json"];
+async function readCredentialField(options, field) {
+  if (typeof process === "undefined" || typeof process.cwd !== "function") return void 0;
+  let readFileSync;
+  let join;
+  try {
+    const [fs, pathMod] = await Promise.all([import("fs"), import("path")]);
+    readFileSync = fs.readFileSync;
+    join = pathMod.join;
+  } catch {
+    return void 0;
+  }
+  const cwd = options?.cwd ?? process.cwd();
+  for (const filename of CREDENTIAL_FILES) {
+    try {
+      const value = JSON.parse(readFileSync(join(cwd, filename), "utf8"))?.[field];
+      if (typeof value === "string" && value.length > 0) return value;
+    } catch {
+    }
+  }
+  return void 0;
+}
 async function resolveApiKey(options) {
   if (typeof options?.apiKey === "string" && options.apiKey.length > 0) return options.apiKey;
   if (typeof process !== "undefined") {
     const fromEnv = process.env?.PATCHSTACK_API_KEY;
     if (typeof fromEnv === "string" && fromEnv.length > 0) return fromEnv;
   }
-  try {
-    if (typeof process === "undefined" || typeof process.cwd !== "function") return void 0;
-    const [{ readFileSync }, { join }] = await Promise.all([import("fs"), import("path")]);
-    const cwd = options?.cwd ?? process.cwd();
-    const raw = readFileSync(join(cwd, ".patchstackrc.json"), "utf8");
-    const key = JSON.parse(raw)?.apiKey;
-    if (typeof key === "string" && key.length > 0) return key;
-  } catch {
-  }
-  return void 0;
+  return readCredentialField(options, "apiKey");
 }
 async function resolvePulseAuth(options) {
   if (typeof options?.pulseAuth === "string" && options.pulseAuth.length > 0) return options.pulseAuth;
@@ -3225,15 +3875,8 @@ async function resolvePulseAuth(options) {
     const fromEnv = process.env?.PATCHSTACK_PULSE_AUTH;
     if (typeof fromEnv === "string" && fromEnv.length > 0) return fromEnv;
   }
-  try {
-    if (typeof process === "undefined" || typeof process.cwd !== "function") return resolveApiKey(options);
-    const [{ readFileSync }, { join }] = await Promise.all([import("fs"), import("path")]);
-    const cwd = options?.cwd ?? process.cwd();
-    const raw = readFileSync(join(cwd, ".patchstackrc.json"), "utf8");
-    const key = JSON.parse(raw)?.pulseAuth;
-    if (typeof key === "string" && key.length > 0) return key;
-  } catch {
-  }
+  const fromFile = await readCredentialField(options, "pulseAuth");
+  if (fromFile !== void 0) return fromFile;
   return resolveApiKey(options);
 }
 function byPhase(rules, phase) {
@@ -3366,6 +4009,8 @@ function extractRedactors(rule) {
         }
       } else if ((m.type === "contains" || m.type === "stripos") && m.value != null) {
         out.push({ literal: String(m.value) });
+      } else if (m.type === "jwt_claim_equals" && typeof m.claim === "string") {
+        out.push({ jwtClaim: { claim: m.claim, value: String(m.value ?? "") } });
       } else if (m.type === "array_key_value" && m.match && isBodyParam(c.parameter)) {
         const keys = Array.isArray(m.key) ? m.key : [m.key];
         for (const key of keys) {
@@ -3384,7 +4029,11 @@ function applyRedactors(body, redactors, mask, transform) {
   let out = body;
   for (const r of redactors) {
     if (r.re) out = out.replace(r.re, transform ? (m) => transform(m) : mask);
-    else if (r.literal) {
+    else if (r.jwtClaim) {
+      for (const token of jwtClaimSpans(out, r.jwtClaim.claim, r.jwtClaim.value)) {
+        out = out.split(token).join(transform ? transform(token) : mask);
+      }
+    } else if (r.literal) {
       const re = new RegExp(r.literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "gi");
       out = out.replace(re, (m) => transform ? transform(m) : mask);
     }
@@ -3518,11 +4167,13 @@ function applyHeaderMutation(headers, rule) {
     }
   }
 }
+var SAME_SITE = ["Strict", "Lax", "None"];
 function hardenCookie(cookie, { httpOnly = true, secure = true, sameSite = "Lax" } = {}) {
   let out = String(cookie);
   if (httpOnly && !/;\s*httponly/i.test(out)) out += "; HttpOnly";
   if (secure && !/;\s*secure/i.test(out)) out += "; Secure";
-  if (sameSite && !/;\s*samesite\s*=/i.test(out)) out += `; SameSite=${sameSite}`;
+  const canonical = SAME_SITE.find((v) => typeof sameSite === "string" && v.toLowerCase() === sameSite.toLowerCase());
+  if (canonical && !/;\s*samesite\s*=/i.test(out)) out += `; SameSite=${canonical}`;
   return out;
 }
 function rebuildResponse(response, body, redactedHeaders) {
@@ -3536,11 +4187,9 @@ function rebuildResponse(response, body, redactedHeaders) {
         } catch {
         }
       } else if (typeof value === "string") {
-        if (headers.get(name) !== value) {
-          try {
-            headers.set(name, value);
-          } catch {
-          }
+        try {
+          if (headers.get(name) !== value) headers.set(name, value);
+        } catch {
         }
       } else if (Array.isArray(value)) {
         try {