@patchstack/connect 0.4.2 → 0.5.1

package/dist/cli.js

@@ -1210,8 +1210,8 @@ function computeManifestChecksum(packages) {
 var TOKEN_SKEW_MS = 6e4;
 function buildTokenUrl(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path12 = url.pathname.replace(/\/$/, "");
-  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  const path13 = url.pathname.replace(/\/$/, "");
+  url.pathname = path13.endsWith("/manifest") ? `${path13.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1291,6 +1291,25 @@ async function pulseFetch(config, url, init, fetchImpl = fetch) {
 // src/client.ts
 var DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
 var DEFAULT_TIMEOUT_MS = 3e4;
+var CLAIM_TOKEN_HEADER = "X-Patchstack-Claim-Token";
+function claimTokenHeader(config) {
+  return typeof config.claimToken === "string" && config.claimToken !== "" ? { [CLAIM_TOKEN_HEADER]: config.claimToken } : {};
+}
+function claimOutcomeLines(claim2, config) {
+  if (typeof config.claimToken !== "string" || config.claimToken === "") return [];
+  if (claim2?.state === "claimed" || claim2?.state === "owned-by-you") {
+    const dashboard = typeof claim2.dashboard_url === "string" && claim2.dashboard_url !== "" ? [`Dashboard: ${claim2.dashboard_url}`] : [];
+    return [
+      claim2.state === "claimed" ? "Connected to your Patchstack account." : "This site is already connected to your Patchstack account.",
+      ...dashboard
+    ];
+  }
+  const why = claim2 === void 0 ? "Patchstack did not act on the claim token" : claim2.state === "owned-by-other" ? "this site belongs to a different Patchstack account" : claim2.reason === "expired" ? "the claim token has expired" : "Patchstack did not recognise the claim token";
+  return [
+    `Not connected to your account: ${why}.`,
+    "Open the dashboard link below to connect it, or copy a fresh prompt from the dashboard."
+  ];
+}
 function buildEndpointUrl(base, siteUuid) {
   const trimmed = base.replace(/\/$/, "");
   return siteUuid !== void 0 && siteUuid !== null && siteUuid.length > 0 ? `${trimmed}/${encodeURIComponent(siteUuid)}` : trimmed;
@@ -1310,8 +1329,8 @@ function authFailureMessage(status, config) {
 }
 function buildRulesUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path12 = url.pathname.replace(/\/$/, "");
-  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
+  const path13 = url.pathname.replace(/\/$/, "");
+  url.pathname = path13.endsWith("/manifest") ? `${path13.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1326,16 +1345,16 @@ function buildSettingsUrl(endpoint, siteUuid) {
 }
 function buildPackageRemovedUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path12 = url.pathname.replace(/\/$/, "");
-  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
+  const path13 = url.pathname.replace(/\/$/, "");
+  url.pathname = path13.endsWith("/manifest") ? `${path13.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
 }
 function buildInputMapUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path12 = url.pathname.replace(/\/$/, "");
-  url.pathname = path12.endsWith("/manifest") ? `${path12.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
+  const path13 = url.pathname.replace(/\/$/, "");
+  url.pathname = path13.endsWith("/manifest") ? `${path13.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1436,6 +1455,14 @@ async function fetchSiteStatus(config) {
     return "unknown";
   }
 }
+function buildManifestBody(config, payload) {
+  return {
+    ...payload,
+    environment: config.environment,
+    ...typeof config.siteUrl === "string" && config.siteUrl !== "" ? { url: config.siteUrl } : {},
+    ...typeof config.siteName === "string" && config.siteName !== "" ? { name: config.siteName } : {}
+  };
+}
 async function postManifest(config, payload) {
   const url = buildEndpointUrl(config.endpoint, config.siteUuid);
   const timeoutMs = config.timeoutMs;
@@ -1446,9 +1473,10 @@ async function postManifest(config, payload) {
       headers: {
         "Content-Type": "application/json",
         Accept: "application/json",
-        "User-Agent": "@patchstack/connect"
+        "User-Agent": "@patchstack/connect",
+        ...claimTokenHeader(config)
       },
-      body: JSON.stringify({ ...payload, environment: config.environment }),
+      body: JSON.stringify(buildManifestBody(config, payload)),
       signal: AbortSignal.timeout(timeoutMs)
     });
   } catch (cause) {
@@ -1711,11 +1739,201 @@ function renderDemoTestCommands(url, scenario) {
 }
 
 // src/config.ts
-import { readFile as readFile8, writeFile, chmod } from "fs/promises";
+import { readFile as readFile9, writeFile, chmod } from "fs/promises";
+import path7 from "path";
+
+// src/site-url.ts
+var RESERVED_SUFFIXES = [
+  ".local",
+  ".localhost",
+  ".localdomain",
+  ".internal",
+  ".intranet",
+  ".invalid",
+  ".test",
+  ".example",
+  ".home.arpa",
+  ".in-addr.arpa",
+  ".ip6.arpa"
+];
+function isUnpublishableHost(hostname) {
+  const host = hostname.toLowerCase().replace(/\.+$/, "");
+  if (host === "") return true;
+  if (host.startsWith("[")) return true;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return true;
+  if (!host.includes(".")) return true;
+  return RESERVED_SUFFIXES.some((suffix) => host.endsWith(suffix));
+}
+function normaliseSiteUrl(value) {
+  const trimmed = (value ?? "").trim();
+  if (trimmed === "") return null;
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+  let parsed;
+  try {
+    parsed = new URL(withScheme);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  if (parsed.hostname === "" || isUnpublishableHost(parsed.hostname)) return null;
+  const origin = `${parsed.protocol}//${parsed.host}`;
+  return origin.length <= 191 ? origin : null;
+}
+var PRODUCTION_URL_SOURCES = [
+  {
+    // VERCEL_URL is per-deployment and changes every build, so it is deliberately not read here.
+    platform: "vercel",
+    read: (env) => env.VERCEL_ENV === "production" ? env.VERCEL_PROJECT_PRODUCTION_URL : void 0
+  },
+  {
+    // `URL` is generic enough to belong to anything, so it counts only alongside Netlify's own markers.
+    platform: "netlify",
+    read: (env) => env.NETLIFY === "true" && env.CONTEXT === "production" ? env.URL : void 0
+  },
+  {
+    platform: "render",
+    read: (env) => env.RENDER === "true" && env.IS_PULL_REQUEST !== "true" ? env.RENDER_EXTERNAL_URL : void 0
+  },
+  {
+    platform: "railway",
+    read: (env) => env.RAILWAY_ENVIRONMENT_NAME === "production" ? env.RAILWAY_PUBLIC_DOMAIN : void 0
+  }
+];
+function detectSiteUrl(env = process.env) {
+  for (const source of PRODUCTION_URL_SOURCES) {
+    const url = normaliseSiteUrl(source.read(env));
+    if (url !== null) {
+      return { url, platform: source.platform };
+    }
+  }
+  return null;
+}
+
+// src/site-name.ts
+import { readFile as readFile8 } from "fs/promises";
 import path6 from "path";
+var NAME_MAX_LENGTH = 191;
+var TEMPLATE_PACKAGE_NAMES = /* @__PURE__ */ new Set([
+  // Lovable
+  "vite_react_shadcn_ts",
+  // Bolt
+  "vite-react-typescript-starter",
+  // Scaffolders and the names people accept from them
+  "vite-project",
+  "my-app",
+  "my-project",
+  "my-v0-project",
+  "app",
+  "frontend",
+  "web",
+  "client",
+  "project",
+  "template",
+  "example",
+  "react-app",
+  "next-app",
+  "nextjs",
+  "starter",
+  "test"
+]);
+var TEMPLATE_TITLES = /* @__PURE__ */ new Set([
+  "vite + react",
+  "vite + react + ts",
+  "vite + vue",
+  "vite + vue + ts",
+  "vite app",
+  "react app",
+  "create next app",
+  "document",
+  "untitled",
+  "index",
+  "home",
+  "app"
+]);
+var NAMED_ENTITIES = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+  nbsp: " "
+};
+function normaliseSiteName(value) {
+  const collapsed = (value ?? "").replace(/\s+/g, " ").trim();
+  if (collapsed === "") return null;
+  return collapsed.slice(0, NAME_MAX_LENGTH);
+}
+function decodeEntities(text) {
+  return text.replace(/&([a-z]+);/gi, (whole, name) => NAMED_ENTITIES[name.toLowerCase()] ?? whole);
+}
+function nameFromHtmlTitle(html) {
+  const match = /<title\b[^>]*>([\s\S]*?)<\/title>/i.exec(html);
+  if (match === null) return null;
+  const name = normaliseSiteName(decodeEntities(match[1] ?? ""));
+  if (name === null || TEMPLATE_TITLES.has(name.toLowerCase())) return null;
+  return name;
+}
+function nameFromPackageName(raw) {
+  if (typeof raw !== "string") return null;
+  const unscoped = raw.trim().replace(/^@[^/]+\//, "");
+  if (unscoped === "" || TEMPLATE_PACKAGE_NAMES.has(unscoped.toLowerCase())) return null;
+  const words = unscoped.split(/[-_.\s]+/).filter((word) => word !== "").map((word) => word === word.toUpperCase() ? word : word.charAt(0).toUpperCase() + word.slice(1));
+  return normaliseSiteName(words.join(" "));
+}
+async function readIfPresent(file) {
+  try {
+    return await readFile8(file, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function detectSiteName(cwd) {
+  for (const shell of ["index.html", path6.join("public", "index.html")]) {
+    const html = await readIfPresent(path6.join(cwd, shell));
+    if (html === null) continue;
+    const name = nameFromHtmlTitle(html);
+    if (name !== null) return { name, source: "index.html" };
+  }
+  const manifest = await readIfPresent(path6.join(cwd, "package.json"));
+  if (manifest !== null) {
+    try {
+      const parsed = JSON.parse(manifest);
+      const name = nameFromPackageName(
+        typeof parsed === "object" && parsed !== null ? parsed.name : void 0
+      );
+      if (name !== null) return { name, source: "package.json" };
+    } catch {
+    }
+  }
+  return null;
+}
+
+// src/config.ts
 var CONFIG_FILENAME = ".patchstackrc.json";
 var SECRET_FILENAME = ".patchstackrc.local.json";
 var DEFAULT_ENVIRONMENT = "production";
+async function resolveSiteIdentity(cwd, fromEnv, fromFile) {
+  const configuredUrl = stated(fromEnv.url) ?? stated(fromFile.url);
+  const configuredName = stated(fromEnv.name) ?? stated(fromFile.name);
+  let url;
+  if (configuredUrl === null) {
+    url = detectSiteUrl(process.env)?.url ?? null;
+  } else {
+    url = normaliseSiteUrl(configuredUrl);
+    if (url === null) {
+      throw new PatchstackError(
+        `Site URL "${configuredUrl}" is not an address the public can reach this site at. Set "url" in .patchstackrc.json (or PATCHSTACK_SITE_URL) to the http(s) address visitors use \u2014 a hostname, not an IP address \u2014 or remove it to let the build environment answer.`,
+        "CONFIG_INVALID"
+      );
+    }
+  }
+  const name = configuredName === null ? (await detectSiteName(cwd))?.name ?? null : normaliseSiteName(configuredName);
+  return { url, name };
+}
+function stated(value) {
+  const trimmed = (value ?? "").trim();
+  return trimmed === "" ? null : trimmed;
+}
 async function resolveConfig(options) {
   const fromFile = await readConfigFile(options.cwd);
   const fromSecretFile = await readSecretFile(options.cwd);
@@ -1745,25 +1963,30 @@ async function resolveConfig(options) {
   }
   const apiKeyRaw = fromEnv.apiKey ?? fromSecretFile.apiKey ?? fromFile.apiKey ?? null;
   const pulseAuthRaw = fromEnv.pulseAuth ?? fromSecretFile.pulseAuth ?? fromFile.pulseAuth ?? apiKeyRaw;
+  const identity = options.detectSiteIdentity === true ? await resolveSiteIdentity(options.cwd, fromEnv, fromFile) : { url: null, name: null };
+  const claimToken = stated(options.cliClaimToken) ?? stated(process.env.PATCHSTACK_CLAIM_TOKEN);
   return {
     siteUuid: siteUuid === null || siteUuid.length === 0 ? null : siteUuid,
     apiKey: apiKeyRaw === null || apiKeyRaw.length === 0 ? null : apiKeyRaw,
     pulseAuth: pulseAuthRaw === null || pulseAuthRaw.length === 0 ? null : pulseAuthRaw,
+    siteUrl: identity.url,
+    siteName: identity.name,
     endpoint,
     timeoutMs,
     environment,
-    widget: fromFile.widget !== false
+    widget: fromFile.widget !== false,
+    claimToken
   };
 }
 async function writeConfigFile(cwd, config) {
-  const target = path6.join(cwd, CONFIG_FILENAME);
+  const target = path7.join(cwd, CONFIG_FILENAME);
   const content = JSON.stringify(config, null, 2) + "\n";
   await writeFile(target, content, "utf8");
   return target;
 }
 var SECRET_CONFIG_FILENAME = SECRET_FILENAME;
 async function writeSecretFile(cwd, secrets) {
-  const target = path6.join(cwd, SECRET_FILENAME);
+  const target = path7.join(cwd, SECRET_FILENAME);
   await writeFile(target, JSON.stringify(secrets, null, 2) + "\n", { encoding: "utf8", mode: 384 });
   try {
     await chmod(target, 384);
@@ -1773,10 +1996,10 @@ async function writeSecretFile(cwd, secrets) {
   return { path: target, ...ignore };
 }
 async function ensureIgnored(cwd, entry) {
-  const target = path6.join(cwd, ".gitignore");
+  const target = path7.join(cwd, ".gitignore");
   let existing = "";
   try {
-    existing = await readFile8(target, "utf8");
+    existing = await readFile9(target, "utf8");
   } catch (err) {
     const code = err.code;
     if (code !== "ENOENT") {
@@ -1796,7 +2019,7 @@ ${entry}
     return { ignored: false, reason: `.gitignore could not be written (${code ?? "unknown error"})` };
   }
   try {
-    const written = await readFile8(target, "utf8");
+    const written = await readFile9(target, "utf8");
     if (ignoresEntry(written, entry)) return { ignored: true };
     return { ignored: false, reason: ".gitignore does not cover the file after writing it" };
   } catch (err) {
@@ -1806,7 +2029,7 @@ ${entry}
 }
 async function secretFileIgnored(cwd) {
   try {
-    const contents = await readFile8(path6.join(cwd, ".gitignore"), "utf8");
+    const contents = await readFile9(path7.join(cwd, ".gitignore"), "utf8");
     if (ignoresEntry(contents, SECRET_FILENAME)) return { ignored: true };
     return { ignored: false, reason: `.gitignore does not cover ${SECRET_FILENAME}` };
   } catch (err) {
@@ -1853,10 +2076,10 @@ async function readConfigFile(cwd) {
   return readJsonFile(cwd, CONFIG_FILENAME);
 }
 async function readJsonFile(cwd, filename) {
-  const target = path6.join(cwd, filename);
+  const target = path7.join(cwd, filename);
   let raw;
   try {
-    raw = await readFile8(target, "utf8");
+    raw = await readFile9(target, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return {};
@@ -1893,6 +2116,8 @@ function readEnv() {
   const environmentRaw = process.env.PATCHSTACK_ENVIRONMENT;
   return {
     siteUuid: process.env.PATCHSTACK_SITE_UUID ?? void 0,
+    url: process.env.PATCHSTACK_SITE_URL ?? void 0,
+    name: process.env.PATCHSTACK_SITE_NAME ?? void 0,
     apiKey: process.env.PATCHSTACK_API_KEY ?? void 0,
     pulseAuth: process.env.PATCHSTACK_PULSE_AUTH ?? void 0,
     endpoint: process.env.PATCHSTACK_ENDPOINT ?? void 0,
@@ -1909,7 +2134,7 @@ function isEnvironment(value) {
 
 // src/mark-build.ts
 import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
-import path7 from "path";
+import path8 from "path";
 
 // src/stack.ts
 var STACK_RULES = [
@@ -2002,11 +2227,11 @@ var MARKER_ATTR = "data-patchstack-build";
 var BUILD_DIR_CANDIDATES = ["dist", "build", "out", ".output/public"];
 function resolveBuildDir(cwd, override) {
   if (override !== void 0 && override !== "") {
-    const abs = path7.resolve(cwd, override);
+    const abs = path8.resolve(cwd, override);
     return existsSync(abs) && statSync(abs).isDirectory() ? abs : null;
   }
   for (const candidate of BUILD_DIR_CANDIDATES) {
-    const abs = path7.resolve(cwd, candidate);
+    const abs = path8.resolve(cwd, candidate);
     if (existsSync(abs) && statSync(abs).isDirectory()) {
       return abs;
     }
@@ -2017,7 +2242,7 @@ function findHtmlFiles(dir) {
   const out = [];
   const walk2 = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const full = path7.join(current, entry.name);
+      const full = path8.join(current, entry.name);
       if (entry.isDirectory()) {
         walk2(full);
       } else if (entry.isFile() && entry.name.toLowerCase().endsWith(".html")) {
@@ -2166,7 +2391,7 @@ function ensureSourceMarker(cwd, shell, framework) {
   if (shell === null) {
     return { shell: null, source: "", action: "no-anchor" };
   }
-  const file = path7.resolve(cwd, shell);
+  const file = path8.resolve(cwd, shell);
   const before = readFileSync(file, "utf8");
   const result = ensureMarkerInJsxShell(before, framework);
   if (result.source !== before) {
@@ -2177,7 +2402,7 @@ function ensureSourceMarker(cwd, shell, framework) {
 
 // src/guide.ts
 import { existsSync as existsSync12, readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
-import path9 from "path";
+import path10 from "path";
 
 // src/protect/install/util.ts
 import { readFileSync as readFileSync2, existsSync as existsSync2, writeFileSync as writeFileSync2 } from "fs";
@@ -3674,7 +3899,7 @@ function runVerify(cwd) {
 
 // src/widget.ts
 import { existsSync as existsSync11, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
-import path8 from "path";
+import path9 from "path";
 var WIDGET_SCRIPT_URL = "https://cdn.patchstack.com/patchstack-widget.js";
 var WIDGET_MARKER_ATTR = "data-patchstack-connect-widget";
 var WIDGET_NEEDLE = "patchstack-widget";
@@ -3712,7 +3937,7 @@ ${indent}</body>`;
 }
 function findSourceShell(cwd) {
   for (const candidate of SOURCE_SHELL_CANDIDATES) {
-    if (existsSync11(path8.join(cwd, candidate))) {
+    if (existsSync11(path9.join(cwd, candidate))) {
       return candidate;
     }
   }
@@ -3723,7 +3948,7 @@ function ensureSourceWidget(cwd, siteUuid) {
   if (shell === null) {
     return { shell: null, action: "no-shell" };
   }
-  const file = path8.join(cwd, shell);
+  const file = path9.join(cwd, shell);
   const before = readFileSync5(file, "utf8");
   const { html, action } = ensureWidgetInHtml(before, siteUuid);
   if (html !== before) {
@@ -3806,7 +4031,7 @@ function detectPackageManager(cwd) {
     return declared;
   }
   for (const { filename, pm } of PM_BY_LOCKFILE) {
-    if (existsSync12(path9.join(cwd, filename))) {
+    if (existsSync12(path10.join(cwd, filename))) {
       return pm;
     }
   }
@@ -3817,7 +4042,7 @@ function installCommand(pm) {
 }
 function readPackageJson(cwd) {
   try {
-    return JSON.parse(readFileSync6(path9.join(cwd, "package.json"), "utf8"));
+    return JSON.parse(readFileSync6(path10.join(cwd, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -3825,7 +4050,7 @@ function readPackageJson(cwd) {
 function installedVersion(cwd, declaredRange) {
   try {
     const pkg = JSON.parse(
-      readFileSync6(path9.join(cwd, "node_modules", "@patchstack", "connect", "package.json"), "utf8")
+      readFileSync6(path10.join(cwd, "node_modules", "@patchstack", "connect", "package.json"), "utf8")
     );
     if (typeof pkg.version === "string" && pkg.version.length > 0) {
       return pkg.version;
@@ -3853,7 +4078,7 @@ function findWidgetMarker(cwd, siteUuid) {
       if (budget <= 0 || settled()) {
         return;
       }
-      const full = path9.join(dir, entry.name);
+      const full = path10.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (SKIPPED_DIRS.has(entry.name) || entry.name.startsWith(".")) {
           continue;
@@ -3861,7 +4086,7 @@ function findWidgetMarker(cwd, siteUuid) {
         walk2(full, depth + 1);
         continue;
       }
-      if (!entry.isFile() || !WIDGET_EXTENSIONS.has(path9.extname(entry.name).toLowerCase())) {
+      if (!entry.isFile() || !WIDGET_EXTENSIONS.has(path10.extname(entry.name).toLowerCase())) {
         continue;
       }
       budget -= 1;
@@ -3892,7 +4117,7 @@ function findProductionMarker(cwd, widgetFileHint) {
     return false;
   }
   try {
-    return readFileSync6(path9.join(cwd, widgetFileHint), "utf8").includes(PROD_MARKER_NEEDLE);
+    return readFileSync6(path10.join(cwd, widgetFileHint), "utf8").includes(PROD_MARKER_NEEDLE);
   } catch {
     return false;
   }
@@ -3903,7 +4128,7 @@ function resolveWidgetFileHint(cwd, framework) {
     ...GENERIC_WIDGET_FILES
   ];
   for (const candidate of candidates) {
-    if (existsSync12(path9.join(cwd, candidate))) {
+    if (existsSync12(path10.join(cwd, candidate))) {
       return candidate;
     }
   }
@@ -4010,7 +4235,7 @@ function renderGuideChecklist(state, useColor) {
   const headerParts = [state.framework, state.packageManager].filter(
     (part) => part !== null
   );
-  const name = state.projectName ?? path9.basename(process.cwd());
+  const name = state.projectName ?? path10.basename(process.cwd());
   lines.push(paint(ANSI.bold, `Patchstack setup status \u2014 ${name} (${headerParts.join(" \xB7 ")})`));
   if (state.endpointOverride !== null) {
     lines.push(
@@ -4025,6 +4250,15 @@ function renderGuideChecklist(state, useColor) {
     lines.push(detail("Run the guide from the project root."));
     return lines.join("\n");
   }
+  if (countRemainingSteps(state) > 0) {
+    lines.push(` ${paint(ANSI.cyan, "\u279C")} ${paint(ANSI.bold, "Tell the user what you are doing as you go.")}`);
+    lines.push("   Installs here take minutes and they are watching output they cannot read.");
+    lines.push("   Say it in plain words: their site is built out of hundreds of ready-made");
+    lines.push("   pieces of code, Patchstack keeps track of which ones it uses and warns them");
+    lines.push("   when one turns out to be unsafe, and nothing their visitors see changes.");
+    lines.push("   Avoid lockfile / dependency / manifest / npm / UUID when speaking to them.");
+    lines.push("");
+  }
   if (state.installed?.section === "dependencies") {
     lines.push(done(`@patchstack/connect installed (${state.installed.version}, ${state.installed.section})`));
   } else if (state.installed !== null) {
@@ -4174,7 +4408,7 @@ function renderGuideChecklist(state, useColor) {
 // src/login.ts
 import { mkdtempSync, readFileSync as readFileSync7, rmSync, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir } from "os";
-import path10 from "path";
+import path11 from "path";
 import { createHash as createHash2 } from "crypto";
 function baseFrom(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
@@ -4186,7 +4420,7 @@ function baseFrom(manifestEndpoint) {
 }
 function pendingPath(siteUuid) {
   const key = createHash2("sha256").update(siteUuid).digest("hex").slice(0, 16);
-  return path10.join(tmpdir(), `patchstack-login-${key}.json`);
+  return path11.join(tmpdir(), `patchstack-login-${key}.json`);
 }
 function savePendingLogin(siteUuid, pending) {
   writeFileSync7(pendingPath(siteUuid), JSON.stringify(pending), { encoding: "utf8", mode: 384 });
@@ -4821,10 +5055,10 @@ function detectDeploymentShapes(cwd, opts = {}) {
     boundary = realpathSync(boundary);
   } catch {
   }
-  const inProject = (path12) => {
+  const inProject = (path13) => {
     if (opts.followOutside) return true;
     try {
-      return isInside(realpathSync(path12), boundary);
+      return isInside(realpathSync(path13), boundary);
     } catch {
       return false;
     }
@@ -5461,8 +5695,8 @@ function collectCallees(sf, ts) {
 }
 
 // src/map/coordinates.ts
-function runtimeCoordinate(source, path12) {
-  if (/\[\d*\]/.test(path12)) {
+function runtimeCoordinate(source, path13) {
+  if (/\[\d*\]/.test(path13)) {
     return { runtimeParameter: null, runtimeParameterReason: "array traversal: needs an array_key_value rule, not a dotted parameter" };
   }
   switch (source) {
@@ -5471,15 +5705,15 @@ function runtimeCoordinate(source, path12) {
     case "multipart":
     case "body":
     case "server-fn-data":
-      return { runtimeParameter: `post.${path12}` };
+      return { runtimeParameter: `post.${path13}` };
     case "query":
-      return { runtimeParameter: `get.${path12}` };
+      return { runtimeParameter: `get.${path13}` };
     case "cookie":
-      return { runtimeParameter: `cookie.${path12}` };
+      return { runtimeParameter: `cookie.${path13}` };
     case "file":
-      return { runtimeParameter: `files.${path12}` };
+      return { runtimeParameter: `files.${path13}` };
     case "header":
-      return { runtimeParameter: `server.HTTP_${path12.toUpperCase().replace(/-/g, "_")}` };
+      return { runtimeParameter: `server.HTTP_${path13.toUpperCase().replace(/-/g, "_")}` };
     case "route-param":
       return { runtimeParameter: null, runtimeParameterReason: "route parameters are not exposed by the runtime resolver" };
     default:
@@ -5511,8 +5745,8 @@ function addressSpaceOf(source) {
 function isProvenFlow(confidence) {
   return confidence === "exact-local" || confidence === "transformed-local";
 }
-function inputIdOf(source, path12) {
-  return `${addressSpaceOf(source)}:${path12}`;
+function inputIdOf(source, path13) {
+  return `${addressSpaceOf(source)}:${path13}`;
 }
 function withCoordinates(fields, source) {
   return fields.map((f) => {
@@ -5722,8 +5956,8 @@ function linkFlows(bodyNode, params, inputs, sinks, ts) {
   if (!bodyNode || sinks.length === 0 || inputs.length === 0) return { flows: [], limitations: [] };
   const CONTAINER_KEYS = /* @__PURE__ */ new Set([...REQ_SOURCES, "data", "input", "payload"]);
   const rootPath = /* @__PURE__ */ new Map();
-  const addRoot = (name, path12, space) => {
-    if (!rootPath.has(name)) rootPath.set(name, { path: path12, space });
+  const addRoot = (name, path13, space) => {
+    if (!rootPath.has(name)) rootPath.set(name, { path: path13, space });
   };
   for (const p of params ?? []) {
     if (!p?.name) continue;
@@ -5868,8 +6102,8 @@ function dedupeLimitations(list) {
 function join22(base, seg) {
   return base ? `${base}.${seg}` : seg;
 }
-function normalizePath(path12) {
-  return path12.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
+function normalizePath(path13) {
+  return path13.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
 }
 function fluentChainCalls(call, ts) {
   let root = call;
@@ -6785,7 +7019,7 @@ async function runMap(flags) {
 
 // src/setup.ts
 import { readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "fs";
-import path11 from "path";
+import path12 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
 function setupProtection(cwd) {
@@ -6803,7 +7037,7 @@ function appendHook(existing, command) {
   return `${existing} && ${command}`;
 }
 function wireBuildScripts(cwd, packageManager) {
-  const target = path11.join(cwd, "package.json");
+  const target = path12.join(cwd, "package.json");
   const raw = readFileSync13(target, "utf8");
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
@@ -7002,6 +7236,10 @@ Options (for scan, setup, status, and uninstall):
                           same under a workspace that pins its own copy), so an
                           advisory can be matched to the copy your code actually
                           loads. Off by default; never source file paths
+  --claim-token <token>   (scan, setup) Connect the site to the Patchstack account
+                          that issued the token \u2014 it comes from the dashboard's
+                          "Connect website" prompt. PATCHSTACK_CLAIM_TOKEN works
+                          too. Never written to a file, never printed back
 
 Options (for mark-build):
   --dir <path>            Build output directory (default: auto-detect
@@ -7035,7 +7273,7 @@ Examples:
   npx @patchstack/connect demo node-serialize
   npx @patchstack/connect demo-guide node-serialize
 `;
-var VALUE_FLAGS = /* @__PURE__ */ new Set(["site-uuid", "endpoint", "dir", "url", "out"]);
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["site-uuid", "endpoint", "dir", "url", "out", "claim-token"]);
 function parseArgs(argv) {
   const args = argv.slice(2);
   const positional = [];
@@ -7168,7 +7406,10 @@ async function runScan(args, options = {}) {
   const config = await resolveConfig({
     cwd: process.cwd(),
     cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-    cliEndpoint: getStringFlag(args.flags, "endpoint")
+    cliEndpoint: getStringFlag(args.flags, "endpoint"),
+    cliClaimToken: getStringFlag(args.flags, "claim-token"),
+    // The one command that reports them, so the one command that resolves them.
+    detectSiteIdentity: true
   });
   const manifest = await scanLockfile(process.cwd());
   for (const warning of manifest.warnings ?? []) {
@@ -7200,6 +7441,16 @@ async function runScan(args, options = {}) {
       `${stats.duplicateNames.length} package(s) appear at multiple versions: ${sample}${more}`
     );
   }
+  const body = buildManifestBody(config, payload);
+  if (typeof body.url === "string") {
+    console.log(`Reporting this app's address as ${body.url}.`);
+  }
+  if (typeof body.name === "string") {
+    console.log(`Reporting this app's name as "${body.name}".`);
+  }
+  if (typeof config.claimToken === "string" && config.claimToken !== "") {
+    console.log("A claim token is set: the site will be connected to the Patchstack account that issued it.");
+  }
   if (dryRun) {
     console.log("");
     if (config.siteUuid === null) {
@@ -7208,7 +7459,7 @@ async function runScan(args, options = {}) {
       console.log(`--dry-run: not posting to Patchstack (site UUID ${config.siteUuid}).`);
     }
     console.log("Payload preview:");
-    const preview = JSON.stringify(payload, null, 2).split("\n");
+    const preview = JSON.stringify(body, null, 2).split("\n");
     console.log(preview.slice(0, Math.min(preview.length, 30)).join("\n"));
     if (preview.length > 30) {
       console.log(`  ... (${preview.length - 30} more lines)`);
@@ -7254,14 +7505,21 @@ async function runScan(args, options = {}) {
   } else {
     console.log(`Server response: ${response.message ?? JSON.stringify(response)}`);
   }
+  const claimLines = claimOutcomeLines(response.claim, config);
+  if (claimLines.length > 0) {
+    console.log("");
+    for (const line of claimLines) console.log(line);
+  }
+  const connected = response.claim?.state === "claimed" || response.claim?.state === "owned-by-you";
   const effectiveUuid = config.siteUuid ?? response.uuid ?? null;
   if (config.widget && effectiveUuid !== null && effectiveUuid.length > 0) {
     reportSourceWidget(effectiveUuid);
   }
-  if (provisioning && response.uuid !== void 0 && response.uuid.length > 0) {
+  const linkUuid = response.uuid ?? config.siteUuid;
+  if (!connected && (provisioning || claimLines.length > 0) && linkUuid !== null && linkUuid !== void 0 && linkUuid.length > 0) {
     console.log("");
     console.log("Open this dashboard link to view vulnerability reports:");
-    console.log(`  ${buildClaimUrl(config.endpoint, response.uuid)}`);
+    console.log(`  ${buildClaimUrl(config.endpoint, linkUuid)}`);
     if (config.endpoint !== DEFAULT_ENDPOINT) {
       console.log("  (this URL inherits the endpoint override above)");
     }