@patchstack/connect 0.3.33 → 0.4.1

package/dist/protect.edge.js

@@ -2194,18 +2194,10 @@ function conditionsProblem(conditions, depth = 0) {
   return null;
 }
 
-// src/protect/capture-plan.js
-var NEVER_CAPTURABLE = /* @__PURE__ */ new Set(["response"]);
-var CAPTURE_LIMITS = Object.freeze({
-  /** Named and prefix values in one event, together. Raw has its own allowance. */
-  capturedValues: 10,
-  /** Characters of any single captured value. */
-  valueChars: 512,
-  /** Resolved values one prefix permission may contribute. */
-  prefixValues: 5
-});
-function parametersOf(rule) {
+// src/protect/rule-parameters.js
+function readRuleParameters(rule) {
   const out = /* @__PURE__ */ new Set();
+  let complete = true;
   const add = (parameter) => {
     if (typeof parameter === "string" && parameter !== "rules") out.add(parameter);
   };
@@ -2217,7 +2209,11 @@ function parametersOf(rule) {
     add(parameter);
   };
   const walk = (conditions, depth) => {
-    if (!Array.isArray(conditions) || depth > 20) return;
+    if (!Array.isArray(conditions)) return;
+    if (depth > LIMITS.maxNestingDepth) {
+      complete = false;
+      return;
+    }
     for (const condition of conditions) {
       if (!condition || typeof condition !== "object") continue;
       collect(condition.parameter);
@@ -2225,8 +2221,22 @@ function parametersOf(rule) {
     }
   };
   walk(rule?.rule_v2, 0);
-  return [...out];
+  return { parameters: [...out], complete };
+}
+function ruleParameters(rule) {
+  return readRuleParameters(rule).parameters;
 }
+
+// src/protect/capture-plan.js
+var NEVER_CAPTURABLE = /* @__PURE__ */ new Set(["response"]);
+var CAPTURE_LIMITS = Object.freeze({
+  /** Named and prefix values in one event, together. Raw has its own allowance. */
+  capturedValues: 10,
+  /** Characters of any single captured value. */
+  valueChars: 512,
+  /** Resolved values one prefix permission may contribute. */
+  prefixValues: 5
+});
 function rawOptIn(rule) {
   if (!rule || typeof rule !== "object" || !Object.hasOwn(rule, "capture")) return null;
   const capture = rule.capture;
@@ -2244,7 +2254,7 @@ function derivePlan(rule) {
   const named = /* @__PURE__ */ new Set();
   const prefixes = /* @__PURE__ */ new Set();
   if (enforceableRuleProblem(rule) !== null) return NOTHING;
-  const parameters = parametersOf(rule).filter((parameter) => parameterProblem(parameter) === null);
+  const parameters = ruleParameters(rule).filter((parameter) => parameterProblem(parameter) === null);
   for (const parameter of parameters) {
     const dot = parameter.indexOf(".");
     if (dot === -1) continue;
@@ -3037,9 +3047,23 @@ var DEFAULT_RESPONSE_RULES = [
     title: "Private key in response body",
     phase: "response",
     category: "secret-exposure",
-    action: "redact",
+    // Withheld: the key material sits after the marker and this pattern does not delimit it.
+    action: "block",
     prefilter: ["PRIVATE KEY"],
-    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/" } }]
+    // Matches a PEM BEGIN line whose label contains `PRIVATE KEY`, with up to 32 further label
+    // characters — uppercase letters, digits, spaces and hyphens — on either side of it. That covers
+    // the enumerated types (`RSA`, `EC`, `OPENSSH`, `DSA`, `ENCRYPTED`), a label carrying words after
+    // `PRIVATE KEY` (`PGP PRIVATE KEY BLOCK`), a hyphenated or otherwise unlisted type, and a bare
+    // `-----BEGIN PRIVATE KEY-----`. `PUBLIC KEY` and `CERTIFICATE` do not match, and neither does
+    // prose that mentions a private key without a BEGIN line.
+    //
+    // No footer required: a truncated response or an absent END marker does not make the material
+    // above it less of a key. Two bounded character classes rather than a repeated group — a
+    // quantifier inside a quantified group is the shape the engine refuses as a backtracking risk, and
+    // a refused pattern is a rule that never fires.
+    //
+    // A lowercase label, or one longer than 32 characters on either side, is not matched.
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/-----BEGIN [A-Z0-9 -]{0,32}PRIVATE KEY[A-Z0-9 -]{0,32}-----/" } }]
   },
   {
     id: "resp-aws-access-key",
@@ -3116,26 +3140,65 @@ var DEFAULT_RESPONSE_RULES = [
     title: "Database connection string with credentials in response body",
     phase: "response",
     category: "secret-exposure",
-    action: "redact",
+    // Withheld. The credentials are only the first half of the disclosure — the host, port, database
+    // name and query name the system they open — and a URI's own grammar admits commas, parentheses
+    // and semicolons, so no end-of-URI character class delimits it in free text without either
+    // stopping inside a real URI or consuming the punctuation around it. The pattern therefore
+    // identifies the URI and the response is withheld rather than partly rewritten.
+    action: "block",
     prefilter: ["mongodb", "postgres", "mysql", "redis", "amqp"],
-    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\b(?:mongodb(?:\\+srv)?|postgres(?:ql)?|mysql|redis|amqps?):\\/\\/[^\\s:@\\/]+:[^\\s:@\\/]+@/i" } }]
+    // A scheme this application connects with, a user, a password and an `@`. Credentials are
+    // required, so a URL without them is not matched.
+    //
+    // The username is the userinfo grammar without `:`; the password is the same grammar with it. Every
+    // other character either class admits may appear raw in a real credential, so a narrower one turns
+    // a live credential into a rule that says nothing — `postgres://user:p;ss@host` is an ordinary DSN.
+    //
+    // The first raw colon separates username from password. Excluding it from the username makes the
+    // separator unambiguous and keeps matching linear; the password continues to admit raw colons. A
+    // username that contains a colon carries it as `%3A`.
+    //
+    // Both classes admitting `:` would leave every colon available as the separator, so a candidate
+    // run with no `@` is re-split at every position. The screening cap does not bound that: a rule may
+    // raise it with `max_bytes` or remove it with `bypass_limit`.
+    //
+    // What terminates a candidate is everything the grammar excludes: whitespace, `/`, `?`, `#`, `@`,
+    // quotes, backslashes, angle and square brackets and braces. That is what keeps the run inside one
+    // value. Expressed as "anything but `:`, `@`, `/` and whitespace" it crosses structure instead: in
+    // `{"docs":"postgres://db.internal","contact":"user@example.com"}` it consumes the closing quote,
+    // the comma and the next key, reaching the `:` and `@` of an unrelated property and withholding a
+    // response that discloses nothing.
+    //
+    // The consequence is deliberate: a run of punctuation-joined text that parses as a credential URI
+    // is treated as one. `postgres://db.internal;contact:admin@example.com` has username
+    // `db.internal;contact`, password `admin` and host `example.com` — indistinguishable from a leak,
+    // so it is withheld. Ordinary prose separates with whitespace, which terminates the candidate.
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\b(?:mongodb(?:\\+srv)?|postgres(?:ql)?|mysql|redis|amqps?):\\/\\/[A-Za-z0-9._~%!$&'()*+,;=-]+:[A-Za-z0-9._~%!$&'()*+,;=:-]+@/i" } }]
   },
   {
     id: "resp-stack-trace",
     title: "Node stack trace leaking in response body",
     phase: "response",
     category: "info-exposure",
-    action: "redact",
+    // Withheld. A frame is recognised by its shape and the trace has no end the pattern can rely on,
+    // so masking the frames it happens to match leaves the message, the remaining frames and every
+    // path and line number in them.
+    action: "block",
     // No prefilter: a Node stack frame has no single distinctive literal (` at ` is too common to
     // gate on). The pattern is linearly bounded per line, so it runs on every screened body.
-    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\n\\s+at\\s+.+\\(.+:\\d+:\\d+\\)/" } }]
+    //
+    // Accepts a real newline and a JSON-escaped one. Most traces reach a client inside a JSON error
+    // body, where the newline is the two characters `\` and `n`.
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/(?:\\n|\\\\n)\\s*at\\s+.+\\(.+:\\d+:\\d+\\)/" } }]
   },
   {
     id: "resp-sql-error",
     title: "SQL / ORM error disclosure in response body",
     phase: "response",
     category: "info-exposure",
-    action: "redact",
+    // Withheld. The signature is the start of the disclosure: masking `SQLSTATE[23000]` and serving
+    // the constraint name, the column and the offending value discloses the schema anyway.
+    action: "block",
     prefilter: ["SQLSTATE", "Sequelize", "ER_", "ORA-", "PG::", "SQLITE_ERROR", "SQL syntax"],
     rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/(SQLSTATE\\[[0-9A-Z]+\\]|SequelizeDatabaseError|ER_[A-Z_]+|ORA-\\d{5}|PG::[A-Za-z]+Error|SQLITE_ERROR|You have an error in your SQL syntax)/i" } }]
   },
@@ -3144,7 +3207,9 @@ var DEFAULT_RESPONSE_RULES = [
     title: "Backend exception / stack trace disclosure in response body",
     phase: "response",
     category: "info-exposure",
-    action: "redact",
+    // Withheld, for the same reason as the trace above: the marker opens the dump and the file names,
+    // line numbers and frames after it are the disclosure.
+    action: "block",
     // Multi-language exception/traceback signatures a normal API response never carries:
     // Python traceback, Java "Exception in thread", .NET System.*Exception, JVM stack frames,
     // Go goroutine dumps. (Node `at fn (file:line:col)` frames are handled by resp-stack-trace.)
@@ -3158,6 +3223,11 @@ var DEFAULT_EGRESS_RULES = [
     title: "Outbound request to an internal / metadata address (SSRF)",
     phase: "egress",
     category: "ssrf",
+    // Declared, not implied. Nothing in the egress path reads it — a match refuses the call, and the
+    // rule's mode decides whether it actually did — but the action is part of how a rule describes
+    // itself to whatever reports on it, and a rule that declares nothing is reported as a rule nobody
+    // can classify.
+    action: "block",
     rule_v2: [{ parameter: "egress.host", match: { type: "internal_host" } }]
   }
 ];
@@ -3524,10 +3594,25 @@ function worthRetrying(status) {
 }
 var ATTEMPT_TIMEOUT_MS = 1e4;
 var STOP_BUDGET_MS = 5e3;
+var CATEGORY_PATTERN = /^[a-z][a-z0-9-]*$/;
+var RESERVED_CATEGORY = "unknown";
+function declaredClass(declared, recognised) {
+  if (typeof declared !== "string" || declared === "") return { value: null, dropped: false };
+  if (!recognised(declared)) return { value: null, dropped: false };
+  if (declared.length > MAX_CLASS_CHARS) return { value: null, dropped: true };
+  return { value: declared, dropped: false };
+}
+var recognisedCategory = (value) => value !== RESERVED_CATEGORY && CATEGORY_PATTERN.test(value);
+var recognisedAction = (value) => ACTIONS.includes(value);
 var MAX_ROUTE_CHARS = 256;
 var MAX_PARAMETERS = 25;
 var MAX_PARAMETER_CHARS = 64;
 var MAX_IDENTIFIER_CHARS = 256;
+var MAX_CLASS_CHARS = 64;
+var EVENT_PATTERN = /^[0-9a-f]{32}$/;
+function eventIdentity(value) {
+  return typeof value === "string" && EVENT_PATTERN.test(value) ? value : null;
+}
 var MAX_CAPTURED_VALUES = 10;
 var MAX_CAPTURED_VALUE_CHARS = 512;
 var MAX_QUERY_KEYS = 10;
@@ -3672,21 +3757,6 @@ function unattended(timer) {
   if (timer && typeof timer.unref === "function") timer.unref();
   return timer;
 }
-function ruleParameters(rule) {
-  const out = /* @__PURE__ */ new Set();
-  const walk = (conditions) => {
-    if (!Array.isArray(conditions)) return;
-    for (const condition of conditions) {
-      if (!condition || typeof condition !== "object") continue;
-      if (typeof condition.parameter === "string" && condition.parameter !== "rules") {
-        out.add(condition.parameter);
-      }
-      if (Array.isArray(condition.rules)) walk(condition.rules);
-    }
-  };
-  walk(rule?.rule_v2);
-  return [...out];
-}
 function revisionOf(rule) {
   const revision = rule?.source_revision;
   if (typeof revision === "string" && revision !== "") return revision;
@@ -3987,7 +4057,7 @@ function createDetectionReporter(opts) {
       const capture = boundCapture(detection.capture);
       const rawRoute = routeOf(detection.path);
       const route = typeof rawRoute === "string" ? capText(rawRoute, MAX_ROUTE_CHARS) : { value: rawRoute, truncated: false };
-      const allParameters = ruleParameters(detection.rule);
+      const { parameters: allParameters, complete: sawEveryParameter } = readRuleParameters(detection.rule);
       const parameters = allParameters.slice(0, MAX_PARAMETERS).map((name) => capText(name, MAX_PARAMETER_CHARS));
       const truncated = [];
       if (route.truncated) truncated.push("route");
@@ -3996,12 +4066,14 @@ function createDetectionReporter(opts) {
       if (query.total > queryKeys.length || queryKeys.some((entry) => entry.truncated)) {
         truncated.push("query_keys");
       }
-      if (allParameters.length > MAX_PARAMETERS || parameters.some((entry) => entry.truncated)) {
+      if (!sawEveryParameter || allParameters.length > MAX_PARAMETERS || parameters.some((entry) => entry.truncated)) {
         truncated.push("parameters");
       }
       const id = capText(String(ruleId), MAX_IDENTIFIER_CHARS);
       const revision = capText(revisionOf(detection.rule) ?? "", MAX_IDENTIFIER_CHARS);
       const etag = capText(rulesEtag ?? "", MAX_IDENTIFIER_CHARS);
+      const classCategory = declaredClass(detection.rule?.category, recognisedCategory);
+      const classAction = declaredClass(detection.rule?.action, recognisedAction);
       for (const [name, field] of [
         ["rule_id", id],
         ["rule_revision", revision],
@@ -4009,6 +4081,12 @@ function createDetectionReporter(opts) {
       ]) {
         if (field.truncated) truncated.push(name);
       }
+      for (const [name, field] of [
+        ["category", classCategory],
+        ["action", classAction]
+      ]) {
+        if (field.dropped) truncated.push(name);
+      }
       queue.push({
         rule_id: id.value,
         route: route.value,
@@ -4017,7 +4095,10 @@ function createDetectionReporter(opts) {
         ...truncated.length > 0 ? { truncated } : {},
         // Only when parameters were actually left out. Reporting a total because some OTHER field was
         // shortened states that parameters were omitted when none were.
-        ...truncated.includes("parameters") ? { parameters_total: allParameters.length } : {},
+        // Only when the walk saw the whole rule. Shortened by the cap, this is the true total; cut short
+        // by the nesting bound, it is the count of what was seen, and sending that as the total states a
+        // size nobody established. The mark travels either way, so a short list is always marked as one.
+        ...truncated.includes("parameters") && sawEveryParameter ? { parameters_total: allParameters.length } : {},
         method: method === null ? null : method.value,
         // The rest of the URL, as names only. `route` is the path; together they say what was requested
         // without saying what was in it.
@@ -4026,7 +4107,32 @@ function createDetectionReporter(opts) {
         ...query.total > queryKeys.length ? { query_keys_total: query.total } : {},
         // Who asked. Capped, since it is client-supplied text and this is an event with a size bound.
         user_agent: userAgent === null ? null : userAgent.value,
+        // What KIND of match this was: which phase it happened in, what class of thing the rule is for,
+        // and what the rule DECLARES it does about it.
+        //
+        // Three separate facts, and none of them is `enforced` below. A rule declaring `block` while
+        // observing reports exactly that — `action: 'block'`, `enforced: false` — which is what a
+        // dry-run window consists of. Reading either off the other would describe such a window as
+        // protection that never happened, or as rules that do nothing.
+        //
+        // `null` where the rule says nothing, never a guess. A consumer can tell "this rule is for
+        // secret exposure" from "we cannot say what this rule is for", and a filled-in value would take
+        // that distinction away for the sake of a tidier field.
         phase: detection.phase ?? null,
+        // `null` where the rule declared nothing, and also where what it declared could not be carried:
+        // both are "we cannot say what this rule is for", which is a different fact from a class we do
+        // know, and `truncated` distinguishes the second from the first.
+        category: classCategory.value,
+        action: classAction.value,
+        // Which call this detection belongs to, so a consumer can tell one call two rules saw from two
+        // separate calls. Two rules matching one call is the ordinary case — a rule that enforces and a
+        // rule that only observes are meant to match the same thing — so without this, adding these up
+        // reports one call more than once.
+        //
+        // Nothing about the request goes into it: it is only ever compared with other identities, so
+        // deriving it from the address or the path would carry something about whoever made the request
+        // into a place nothing needs it. That is a property of how it is minted, not of its shape.
+        event: eventIdentity(detection.event),
         // The state this detection was handled under, which is the whole point: `false` is a rule that
         // saw traffic it would have stopped.
         enforced: detection.mode === "block",
@@ -4197,6 +4303,19 @@ function reportingState(input) {
   return { state: "on", reports: true };
 }
 
+// src/protect/response-hardening.js
+var BODY_INDEPENDENT = Object.freeze(["response.status", "response.headers"]);
+var BODY_INDEPENDENT_PREFIX = "response.header.";
+var HEADER_ACTIONS = Object.freeze(["set-header", "remove-header", "harden-cookie"]);
+function hardensWithoutBody(rule) {
+  if (!rule || !HEADER_ACTIONS.includes(rule.action)) return false;
+  const { parameters, complete } = readRuleParameters(rule);
+  if (!complete) return false;
+  return parameters.every(
+    (parameter) => BODY_INDEPENDENT.includes(parameter) || parameter.startsWith(BODY_INDEPENDENT_PREFIX)
+  );
+}
+
 // src/protect/firewall-log.js
 var DEFAULT_API_BASE = "https://api.patchstack.com";
 var STOP_BUDGET_MS2 = 5e3;
@@ -4580,7 +4699,7 @@ async function createProtection(options = {}) {
   let screenCap;
   let engine;
   let responseRuleSet;
-  let egressEngine;
+  let egressRuleSet;
   const applyBundle = (delivered) => {
     const incoming = delivered.firewall ?? [];
     requestRules = byPhase(incoming, "request");
@@ -4607,7 +4726,10 @@ async function createProtection(options = {}) {
       // the common case — cutting CPU/latency and shrinking the regex/ReDoS surface. Case-insensitive.
       prefilter: Array.isArray(rule.prefilter) && rule.prefilter.length ? rule.prefilter.map((s) => String(s).toLowerCase()) : null
     }));
-    egressEngine = new RuleEngine({ firewall: egressRules, onError });
+    egressRuleSet = egressRules.map((rule) => ({
+      rule,
+      engine: new RuleEngine({ firewall: [rule], onError })
+    }));
   };
   applyBundle(bundle);
   const skipCounts = /* @__PURE__ */ Object.create(null);
@@ -4632,8 +4754,9 @@ async function createProtection(options = {}) {
     if (!permitsAnything(entry.plan)) return { plan: entry.reference };
     return { plan: entry.reference, ...captureValues(entry.plan, result.resolver) };
   };
-  const decide = (phase, result, block, allow2, ctx = {}) => {
+  const decide = (phase, result, block, allow2, describe = () => ({})) => {
     if (!result || !result.blocked) return allow2();
+    const ctx = describe() ?? {};
     const effectiveMode = ruleMode(result.rule);
     onDetect({
       phase,
@@ -4646,6 +4769,9 @@ async function createProtection(options = {}) {
       method: ctx.method,
       path: ctx.path,
       ip: ctx.ip,
+      // Which call this was. Named here rather than spread from `ctx` for the same reason as everything
+      // else in this payload: a field reaches the wire because someone listed it.
+      event: ctx.event ?? null,
       // Provenance travels with the address. Without it a consumer cannot tell an observed peer from a
       // value read out of a forwarded header, and `null` from "there was no address to establish".
       clientIpSource: ctx.clientIpSource,
@@ -4655,12 +4781,13 @@ async function createProtection(options = {}) {
     });
     return effectiveMode === "block" ? block() : allow2();
   };
-  const screenText = (text, meta, reqCtx) => {
+  const screenText = (text, meta, reqCtx, only) => {
     let blockRule = null;
     const redactions = [];
     const headerMutations = [];
     let lowerText = null;
     for (const { rule, engine: re, redactors, prefilter, mutatedSpan } of responseRuleSet) {
+      if (only && !only(rule)) continue;
       if (prefilter) {
         if (lowerText === null) lowerText = text.toLowerCase();
         if (!prefilter.some((p) => lowerText.includes(p))) continue;
@@ -4776,7 +4903,7 @@ async function createProtection(options = {}) {
       result,
       () => blockResponse(result, request),
       () => null,
-      requestMeta(shaped, request)
+      () => requestMeta(shaped, request)
     );
     return { blocked, client: shaped?._clientIp };
   };
@@ -4791,7 +4918,12 @@ async function createProtection(options = {}) {
         originalUrl: u.pathname + u.search,
         headers,
         ip: resolved.ip ?? "",
-        _clientIp: resolved
+        _clientIp: resolved,
+        // The request itself, so the identity can be asked for LATER. This context is built on every
+        // request whether or not anything matches, so asking here would mint one for every request —
+        // and asking of the context rather than of the request would give the response a different
+        // identity from the request that caused it, reporting one call as two.
+        _eventOf: request
       };
     } catch {
       return void 0;
@@ -4802,13 +4934,17 @@ async function createProtection(options = {}) {
     originalUrl: req.url,
     headers: req.headers || {},
     ip: client?.ip ?? "",
-    _clientIp: client ?? { ip: null, source: "unavailable" }
+    _clientIp: client ?? { ip: null, source: "unavailable" },
+    // The request itself, for the same reasons as on the fetch path above: asked for later, and
+    // asked of the request rather than of this context.
+    _eventOf: req
   } : void 0;
   const screenResp = async (response, reqCtx) => {
     const read = await readTextResponse(response, screenCap);
     if (read.skip) {
       if (read.skip !== "not-a-response") recordSkip("response", read.skip, { status: response?.status });
-      return response;
+      if (read.skip === "not-a-response") return response;
+      return hardenHeadersOnly(response, reqCtx);
     }
     const text = read.text;
     const r = screenText(text, { status: response.status, headers: headerObject(response.headers) }, reqCtx);
@@ -4816,6 +4952,74 @@ async function createProtection(options = {}) {
     if (r.verdict === "redact") return rebuildResponse(response, r.body, r.headers);
     return response;
   };
+  const headerValueChanged = (was, value) => {
+    const had = was !== void 0 && was !== null;
+    if (value === null || value === void 0) return had;
+    if (!had) return true;
+    if (Array.isArray(value) || Array.isArray(was)) {
+      const a = Array.isArray(was) ? was : [was];
+      const b = Array.isArray(value) ? value : [value];
+      return a.length !== b.length || b.some((item, i) => String(item) !== String(a[i]));
+    }
+    return String(value) !== String(was);
+  };
+  const headersChanged = (before, after) => Object.entries(after).some(([name, value]) => headerValueChanged(before[name], value));
+  const writeHeadHeaderIndex = (args) => {
+    const at = typeof args[1] === "string" ? 2 : 1;
+    const value = args[at];
+    return value !== null && typeof value === "object" ? at : -1;
+  };
+  const writeHeadEntries = (headers) => {
+    if (!Array.isArray(headers)) return Object.entries(headers);
+    if (headers.length && headers.every((entry) => Array.isArray(entry) && entry.length === 2)) {
+      return headers.map(([name, value]) => [String(name), value]);
+    }
+    const entries = [];
+    for (let i = 0; i + 1 < headers.length; i += 2) entries.push([String(headers[i]), headers[i + 1]]);
+    return entries;
+  };
+  const writeHeadHeaderObject = (headers) => {
+    const out = {};
+    for (const [name, value] of writeHeadEntries(headers)) {
+      const key = name.toLowerCase();
+      out[key] = Object.hasOwn(out, key) ? [].concat(out[key], value) : value;
+    }
+    return out;
+  };
+  const rewriteWriteHeadHeaders = (headers, changed) => {
+    const replaced = /* @__PURE__ */ new Set();
+    const entries = [];
+    for (const [name, value] of writeHeadEntries(headers)) {
+      const key = name.toLowerCase();
+      if (!changed.has(key)) {
+        entries.push([name, value]);
+        continue;
+      }
+      if (replaced.has(key)) continue;
+      replaced.add(key);
+      const replacement = changed.get(key);
+      if (replacement === null || replacement === void 0) continue;
+      entries.push([name, replacement]);
+    }
+    if (!Array.isArray(headers)) return Object.fromEntries(entries);
+    const paired = headers.length > 0 && headers.every((entry) => Array.isArray(entry) && entry.length === 2);
+    const expanded = entries.flatMap(
+      ([name, value]) => Array.isArray(value) ? value.map((item) => [name, item]) : [[name, value]]
+    );
+    return paired ? expanded : expanded.flat();
+  };
+  const hardenHeadersOnly = (response, reqCtx) => {
+    try {
+      const meta = { status: response.status, headers: headerObject(response.headers) };
+      const r = screenText("", meta, reqCtx, hardensWithoutBody);
+      if (r.verdict !== "redact" || !r.headers) return response;
+      if (!headersChanged(meta.headers, r.headers)) return response;
+      return rebuildResponse(response, response.body, r.headers);
+    } catch (err) {
+      notify(onError, err, "onError");
+      return response;
+    }
+  };
   const wrapNodeResponse = (res, reqCtx) => {
     const origWrite = res.write.bind(res);
     const origEnd = res.end.bind(res);
@@ -4823,6 +5027,51 @@ async function createProtection(options = {}) {
     let size = 0;
     let overflow = false;
     const MAX = screenCap;
+    let hardened = false;
+    let answeredWithoutBody = false;
+    const hardenBeforeFlush = (effective) => {
+      if (hardened) return null;
+      hardened = true;
+      try {
+        if (res.headersSent || typeof res.setHeader !== "function") return null;
+        const set = typeof res.getHeaders === "function" ? res.getHeaders() : {};
+        const headers = effective && effective.headers ? { ...set, ...effective.headers } : set;
+        const status = effective && effective.status !== void 0 ? effective.status : res.statusCode;
+        const r = screenText("", { status, headers }, reqCtx, hardensWithoutBody);
+        answeredWithoutBody = true;
+        if (r.verdict !== "redact" || !r.headers) return null;
+        const changed = /* @__PURE__ */ new Map();
+        for (const [name, value] of Object.entries(r.headers)) {
+          if (!headerValueChanged(headers[name], value)) continue;
+          changed.set(name.toLowerCase(), value);
+          try {
+            if (value === null || value === void 0) res.removeHeader?.(name);
+            else res.setHeader(name, value);
+          } catch {
+          }
+        }
+        return changed.size ? changed : null;
+      } catch (err) {
+        notify(onError, err, "onError");
+        return null;
+      }
+    };
+    const stillToAnswer = (rule) => !hardensWithoutBody(rule);
+    if (typeof res.writeHead === "function") {
+      const origWriteHead = res.writeHead.bind(res);
+      res.writeHead = function(...args) {
+        const at = writeHeadHeaderIndex(args);
+        const given = at === -1 ? null : args[at];
+        const changed = hardenBeforeFlush({
+          status: typeof args[0] === "number" ? args[0] : void 0,
+          headers: given ? writeHeadHeaderObject(given) : null
+        });
+        if (!changed || !given) return origWriteHead(...args);
+        const rewritten = [...args];
+        rewritten[at] = rewriteWriteHeadHeaders(given, changed);
+        return origWriteHead(...rewritten);
+      };
+    }
     const collect = (chunk, enc) => {
       if (chunk == null) return;
       const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, typeof enc === "string" ? enc : "utf8");
@@ -4838,6 +5087,7 @@ async function createProtection(options = {}) {
       chunks.push(buf);
     };
     res.write = function(chunk, enc, cb) {
+      hardenBeforeFlush();
       if (overflow) return origWrite(chunk, enc, cb);
       collect(chunk, enc);
       if (typeof enc === "function") enc();
@@ -4845,6 +5095,7 @@ async function createProtection(options = {}) {
       return true;
     };
     res.end = function(chunk, enc, cb) {
+      hardenBeforeFlush();
       if (typeof chunk === "function") {
         cb = chunk;
         chunk = void 0;
@@ -4871,7 +5122,12 @@ async function createProtection(options = {}) {
       const text = buffer.toString("utf8");
       let r;
       try {
-        r = screenText(text, { status: res.statusCode, headers: res.getHeaders ? res.getHeaders() : {} }, reqCtx);
+        r = screenText(
+          text,
+          { status: res.statusCode, headers: res.getHeaders ? res.getHeaders() : {} },
+          reqCtx,
+          answeredWithoutBody ? stillToAnswer : void 0
+        );
       } catch (err) {
         notify(onError, err, "onError");
         for (const c of chunks) origWrite(c);
@@ -4921,15 +5177,6 @@ async function createProtection(options = {}) {
   const allow = new Set((options.allowHosts ?? []).map((h) => String(h).toLowerCase()));
   const egressShouldBlock = (url, host, method) => {
     if (host && allow.has(host.toLowerCase())) return false;
-    let result;
-    try {
-      result = egressEngine.evaluate({ _egress: { url, host, method } });
-    } catch (err) {
-      notify(onError, err, "onError");
-      return false;
-    }
-    if (!result.blocked) return false;
-    const egressMode = ruleMode(result.rule);
     let egressPath = null;
     try {
       const u = new URL(url);
@@ -4937,17 +5184,39 @@ async function createProtection(options = {}) {
     } catch {
       egressPath = typeof url === "string" ? url : null;
     }
-    onDetect({
-      phase: "egress",
-      mode: egressMode,
-      category: result.rule?.category,
-      rule: result.rule,
-      message: result.message,
-      method: typeof method === "string" ? method : null,
-      path: egressPath,
-      capture: evidenceFrom(result)
-    });
-    return egressMode === "block";
+    const egressEvent = mintEvent();
+    let block = false;
+    for (const { rule, engine: re } of egressRuleSet) {
+      let result;
+      try {
+        result = re.evaluate({ _egress: { url, host, method } });
+      } catch (err) {
+        notify(onError, err, "onError");
+        continue;
+      }
+      if (!result.blocked) continue;
+      const egressMode = ruleMode(rule);
+      onDetect({
+        phase: "egress",
+        mode: egressMode,
+        category: rule?.category,
+        rule,
+        message: result.message,
+        // One identity for this outbound call, shared by every rule that matches it — the egress phase
+        // evaluates all of them rather than stopping at the first, so without this two rules refusing one
+        // call would count as two calls refused.
+        //
+        // Its own identity, not the identity of whatever request the application was serving when it made
+        // the call. An outbound attempt is a thing that happened in its own right, and a call made outside
+        // any request — a job, a timer — has no request to belong to.
+        event: egressEvent,
+        method: typeof method === "string" ? method : null,
+        path: egressPath,
+        capture: evidenceFrom(result)
+      });
+      if (egressMode === "block") block = true;
+    }
+    return block;
   };
   const protection = {
     get mode() {
@@ -5016,7 +5285,7 @@ async function createProtection(options = {}) {
             if (exprOptions.screenResponses) wrapNodeResponse(res, reqContextFromNode(req, client));
             next();
           },
-          nodeRequestMeta(req, client)
+          () => nodeRequestMeta(req, client)
         );
       };
     },
@@ -5080,7 +5349,7 @@ async function createProtection(options = {}) {
             if (nodeOptions.screenResponses) wrapNodeResponse(res, reqContextFromNode(req, shaped?._clientIp));
             next();
           },
-          nodeRequestMeta(req, shaped?._clientIp)
+          () => nodeRequestMeta(req, shaped?._clientIp)
         );
       }
     }
@@ -5554,11 +5823,37 @@ function defaultOnDetect({ phase, mode, category, rule, message }) {
   const tag = mode === "block" ? "BLOCK" : "DETECT (dry-run)";
   console.warn(`[patchstack] ${tag} phase=${phase ?? "request"} category=${category ?? "?"} rule=${rule?.id ?? "?"} ${message ?? ""}`.trim());
 }
+var eventIdentities = /* @__PURE__ */ new WeakMap();
+function mintEvent() {
+  try {
+    const bytes = globalThis.crypto?.getRandomValues?.(new Uint8Array(16));
+    if (bytes) return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  } catch {
+  }
+  try {
+    let hex = Date.now().toString(16);
+    while (hex.length < 32) hex += Math.floor(Math.random() * 4294967295).toString(16).padStart(8, "0");
+    return hex.slice(0, 32);
+  } catch {
+    return null;
+  }
+}
+function eventFor(request) {
+  if (request === null || typeof request !== "object") return mintEvent();
+  const existing = eventIdentities.get(request);
+  if (existing !== void 0) return existing;
+  const minted = mintEvent();
+  if (minted !== null) eventIdentities.set(request, minted);
+  return minted;
+}
 function requestMetaFromContext(reqCtx) {
   if (!reqCtx) return {};
   const client = reqCtx._clientIp ?? { ip: null, source: "unavailable" };
   return {
     method: reqCtx.method ?? null,
+    // The originating request's identity, so a response detection and the request detection for the same
+    // request are one event rather than two. Asked for here, which is inside a detection being raised.
+    event: eventFor(reqCtx._eventOf),
     // Path AND query. The reporter is what drops the query's VALUES, keeping its parameter names, so
     // trimming it here would leave a Fetch or response detection unable to say what was requested.
     path: typeof reqCtx.originalUrl === "string" ? reqCtx.originalUrl : null,
@@ -5582,7 +5877,7 @@ function requestMeta(shaped, request) {
     method = request.method ?? null;
     userAgent = request.headers?.get?.("user-agent") ?? null;
   }
-  return { method, path, ip: client.ip, clientIpSource: client.source, userAgent };
+  return { method, path, ip: client.ip, clientIpSource: client.source, userAgent, event: eventFor(request) };
 }
 function nodeRequestMeta(req, client) {
   if (!req) return {};
@@ -5596,7 +5891,8 @@ function nodeRequestMeta(req, client) {
     // verified, and a second derivation could disagree with the one the engine evaluated.
     ip: resolved.ip,
     clientIpSource: resolved.source,
-    userAgent: typeof ua === "string" ? ua : Array.isArray(ua) ? ua[0] : null
+    userAgent: typeof ua === "string" ? ua : Array.isArray(ua) ? ua[0] : null,
+    event: eventFor(req)
   };
 }
 export {