@patchstack/connect 0.4.2 → 0.5.1

package/dist/index.d.cts

@@ -41,6 +41,22 @@ interface Config {
      * Falls back to `apiKey` when unset. Prefer `PATCHSTACK_PULSE_AUTH`.
      */
     pulseAuth: string | null;
+    /**
+     * Where this app is published, reported alongside the manifest so a site provisioned without an
+     * address can learn one. `null` when nothing reliable is known — a laptop build, or a platform that
+     * publishes no production URL.
+     *
+     * Optional, and absent unless the config was resolved with `detectSiteIdentity`. Only the manifest
+     * push reads it, and it is omitted from that push when it is not a string — so a caller holding a
+     * `Config` it built itself keeps working without knowing this field exists.
+     */
+    siteUrl?: string | null;
+    /**
+     * What this app is called, reported alongside the manifest so a site provisioned nameless can learn a
+     * name. `null` when the project states none — a name Patchstack would only be guessing at is not
+     * reported. Optional on the same terms as `siteUrl`.
+     */
+    siteName?: string | null;
     endpoint: string;
     timeoutMs: number;
     /** Environment to report the manifest under. Defaults to 'production'. */
@@ -51,6 +67,27 @@ interface Config {
      * `"widget": false` in .patchstackrc.json for dependency-scanning only.
      */
     widget: boolean;
+    /**
+     * The claim token the Patchstack dashboard puts in its install prompt, so the site the first scan
+     * provisions is born in that account instead of waiting for a dashboard link. Read from
+     * `--claim-token` or `PATCHSTACK_CLAIM_TOKEN` and never written to any file: it names an account,
+     * not this project, and it stops working within a day. Optional on the same terms as `siteUrl`.
+     */
+    claimToken?: string | null;
+}
+/**
+ * What Patchstack did with a claim token that rode along with a manifest push.
+ *
+ * `claimed` — this push gave the site its owner; `owned-by-you` — it already was (a re-run of the
+ * prompt); `owned-by-other` — the site belongs to a different account and was left alone;
+ * `rejected` — the token had expired or was not one Patchstack issued, and the site stays as it was.
+ */
+interface ManifestClaimOutcome {
+    state: 'claimed' | 'owned-by-you' | 'owned-by-other' | 'rejected';
+    site_id?: number | null;
+    /** Where the connected site lives in the dashboard; present for `claimed` and `owned-by-you`. */
+    dashboard_url?: string | null;
+    reason?: 'expired' | 'invalid' | null;
 }
 interface StoreManifestResponse {
     /** The UUID of the site the manifest was stored against. Always returned. */
@@ -66,6 +103,8 @@ interface StoreManifestResponse {
     reason?: string;
     message?: string;
     error?: string;
+    /** Present only when the push carried a claim token. */
+    claim?: ManifestClaimOutcome;
 }
 declare class PatchstackError extends Error {
     readonly code: 'CONFIG_MISSING' | 'CONFIG_INVALID' | 'LOCKFILE_NOT_FOUND' | 'LOCKFILE_UNSUPPORTED' | 'LOCKFILE_PARSE_ERROR' | 'NETWORK_ERROR' | 'NETWORK_TIMEOUT' | 'SITE_NOT_FOUND' | 'UNAUTHORIZED' | 'VALIDATION_ERROR' | 'SERVER_ERROR';
@@ -172,11 +211,27 @@ interface ConfigFile {
     timeoutMs?: number;
     environment?: string;
     widget?: boolean;
+    /**
+     * Where this app is published. Committed with the UUID rather than kept secret — it is the address
+     * the site already serves to everyone. Set it for platforms whose build environment does not say
+     * which deployment is the production one.
+     */
+    url?: string;
+    /**
+     * What this app is called in the dashboard. Set it when the project's own files do not say — a
+     * `package.json` still named after its template, an HTML shell whose title is filled in by script.
+     */
+    name?: string;
 }
 interface ResolveConfigOptions {
     cwd: string;
     cliSiteUuid?: string;
     cliEndpoint?: string;
+    /**
+     * The claim token from the dashboard's install prompt (`--claim-token`). Outranks
+     * PATCHSTACK_CLAIM_TOKEN, and neither is ever written to a file.
+     */
+    cliClaimToken?: string;
     /**
      * When true, resolveConfig throws CONFIG_MISSING if no site UUID is configured.
      * Defaults to false: callers that can run without a UUID (the first `scan` after
@@ -184,6 +239,16 @@ interface ResolveConfigOptions {
      * server response.
      */
     requireSiteUuid?: boolean;
+    /**
+     * Resolve the site's public address and name into `siteUrl` and `siteName`.
+     *
+     * Off by default, and left off by every command that does not push a manifest. Resolving them reads
+     * the project's `index.html` and `package.json` and the host's production-URL variables, and the
+     * manifest push is the only thing that reports the result — so `status`, `guide`, `login`,
+     * `uninstall`, `mark-build` and the map upload have no reason to look, and do not. Both fields come
+     * back `null` when it is off.
+     */
+    detectSiteIdentity?: boolean;
 }
 declare function resolveConfig(options: ResolveConfigOptions): Promise<Config>;
 declare function writeConfigFile(cwd: string, config: ConfigFile): Promise<string>;

package/dist/index.d.ts

@@ -41,6 +41,22 @@ interface Config {
      * Falls back to `apiKey` when unset. Prefer `PATCHSTACK_PULSE_AUTH`.
      */
     pulseAuth: string | null;
+    /**
+     * Where this app is published, reported alongside the manifest so a site provisioned without an
+     * address can learn one. `null` when nothing reliable is known — a laptop build, or a platform that
+     * publishes no production URL.
+     *
+     * Optional, and absent unless the config was resolved with `detectSiteIdentity`. Only the manifest
+     * push reads it, and it is omitted from that push when it is not a string — so a caller holding a
+     * `Config` it built itself keeps working without knowing this field exists.
+     */
+    siteUrl?: string | null;
+    /**
+     * What this app is called, reported alongside the manifest so a site provisioned nameless can learn a
+     * name. `null` when the project states none — a name Patchstack would only be guessing at is not
+     * reported. Optional on the same terms as `siteUrl`.
+     */
+    siteName?: string | null;
     endpoint: string;
     timeoutMs: number;
     /** Environment to report the manifest under. Defaults to 'production'. */
@@ -51,6 +67,27 @@ interface Config {
      * `"widget": false` in .patchstackrc.json for dependency-scanning only.
      */
     widget: boolean;
+    /**
+     * The claim token the Patchstack dashboard puts in its install prompt, so the site the first scan
+     * provisions is born in that account instead of waiting for a dashboard link. Read from
+     * `--claim-token` or `PATCHSTACK_CLAIM_TOKEN` and never written to any file: it names an account,
+     * not this project, and it stops working within a day. Optional on the same terms as `siteUrl`.
+     */
+    claimToken?: string | null;
+}
+/**
+ * What Patchstack did with a claim token that rode along with a manifest push.
+ *
+ * `claimed` — this push gave the site its owner; `owned-by-you` — it already was (a re-run of the
+ * prompt); `owned-by-other` — the site belongs to a different account and was left alone;
+ * `rejected` — the token had expired or was not one Patchstack issued, and the site stays as it was.
+ */
+interface ManifestClaimOutcome {
+    state: 'claimed' | 'owned-by-you' | 'owned-by-other' | 'rejected';
+    site_id?: number | null;
+    /** Where the connected site lives in the dashboard; present for `claimed` and `owned-by-you`. */
+    dashboard_url?: string | null;
+    reason?: 'expired' | 'invalid' | null;
 }
 interface StoreManifestResponse {
     /** The UUID of the site the manifest was stored against. Always returned. */
@@ -66,6 +103,8 @@ interface StoreManifestResponse {
     reason?: string;
     message?: string;
     error?: string;
+    /** Present only when the push carried a claim token. */
+    claim?: ManifestClaimOutcome;
 }
 declare class PatchstackError extends Error {
     readonly code: 'CONFIG_MISSING' | 'CONFIG_INVALID' | 'LOCKFILE_NOT_FOUND' | 'LOCKFILE_UNSUPPORTED' | 'LOCKFILE_PARSE_ERROR' | 'NETWORK_ERROR' | 'NETWORK_TIMEOUT' | 'SITE_NOT_FOUND' | 'UNAUTHORIZED' | 'VALIDATION_ERROR' | 'SERVER_ERROR';
@@ -172,11 +211,27 @@ interface ConfigFile {
     timeoutMs?: number;
     environment?: string;
     widget?: boolean;
+    /**
+     * Where this app is published. Committed with the UUID rather than kept secret — it is the address
+     * the site already serves to everyone. Set it for platforms whose build environment does not say
+     * which deployment is the production one.
+     */
+    url?: string;
+    /**
+     * What this app is called in the dashboard. Set it when the project's own files do not say — a
+     * `package.json` still named after its template, an HTML shell whose title is filled in by script.
+     */
+    name?: string;
 }
 interface ResolveConfigOptions {
     cwd: string;
     cliSiteUuid?: string;
     cliEndpoint?: string;
+    /**
+     * The claim token from the dashboard's install prompt (`--claim-token`). Outranks
+     * PATCHSTACK_CLAIM_TOKEN, and neither is ever written to a file.
+     */
+    cliClaimToken?: string;
     /**
      * When true, resolveConfig throws CONFIG_MISSING if no site UUID is configured.
      * Defaults to false: callers that can run without a UUID (the first `scan` after
@@ -184,6 +239,16 @@ interface ResolveConfigOptions {
      * server response.
      */
     requireSiteUuid?: boolean;
+    /**
+     * Resolve the site's public address and name into `siteUrl` and `siteName`.
+     *
+     * Off by default, and left off by every command that does not push a manifest. Resolving them reads
+     * the project's `index.html` and `package.json` and the host's production-URL variables, and the
+     * manifest push is the only thing that reports the result — so `status`, `guide`, `login`,
+     * `uninstall`, `mark-build` and the map upload have no reason to look, and do not. Both fields come
+     * back `null` when it is off.
+     */
+    detectSiteIdentity?: boolean;
 }
 declare function resolveConfig(options: ResolveConfigOptions): Promise<Config>;
 declare function writeConfigFile(cwd: string, config: ConfigFile): Promise<string>;

package/dist/index.js

@@ -1189,8 +1189,8 @@ function compareSegments(a, b) {
 var TOKEN_SKEW_MS = 6e4;
 function buildTokenUrl(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path8 = url.pathname.replace(/\/$/, "");
-  url.pathname = path8.endsWith("/manifest") ? `${path8.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  const path9 = url.pathname.replace(/\/$/, "");
+  url.pathname = path9.endsWith("/manifest") ? `${path9.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1270,6 +1270,10 @@ async function pulseFetch(config, url, init, fetchImpl = fetch) {
 // src/client.ts
 var DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
 var DEFAULT_TIMEOUT_MS = 3e4;
+var CLAIM_TOKEN_HEADER = "X-Patchstack-Claim-Token";
+function claimTokenHeader(config) {
+  return typeof config.claimToken === "string" && config.claimToken !== "" ? { [CLAIM_TOKEN_HEADER]: config.claimToken } : {};
+}
 function buildEndpointUrl(base, siteUuid) {
   const trimmed = base.replace(/\/$/, "");
   return siteUuid !== void 0 && siteUuid !== null && siteUuid.length > 0 ? `${trimmed}/${encodeURIComponent(siteUuid)}` : trimmed;
@@ -1291,6 +1295,14 @@ function buildClaimUrl(endpoint, siteUuid) {
   const origin = new URL(endpoint).origin;
   return `${origin}/monitor/claim?site=${encodeURIComponent(siteUuid)}`;
 }
+function buildManifestBody(config, payload) {
+  return {
+    ...payload,
+    environment: config.environment,
+    ...typeof config.siteUrl === "string" && config.siteUrl !== "" ? { url: config.siteUrl } : {},
+    ...typeof config.siteName === "string" && config.siteName !== "" ? { name: config.siteName } : {}
+  };
+}
 async function postManifest(config, payload) {
   const url = buildEndpointUrl(config.endpoint, config.siteUuid);
   const timeoutMs = config.timeoutMs;
@@ -1301,9 +1313,10 @@ async function postManifest(config, payload) {
       headers: {
         "Content-Type": "application/json",
         Accept: "application/json",
-        "User-Agent": "@patchstack/connect"
+        "User-Agent": "@patchstack/connect",
+        ...claimTokenHeader(config)
       },
-      body: JSON.stringify({ ...payload, environment: config.environment }),
+      body: JSON.stringify(buildManifestBody(config, payload)),
       signal: AbortSignal.timeout(timeoutMs)
     });
   } catch (cause) {
@@ -1362,11 +1375,201 @@ function isTimeoutError(cause) {
 }
 
 // src/config.ts
-import { readFile as readFile7, writeFile, chmod } from "fs/promises";
+import { readFile as readFile8, writeFile, chmod } from "fs/promises";
+import path7 from "path";
+
+// src/site-url.ts
+var RESERVED_SUFFIXES = [
+  ".local",
+  ".localhost",
+  ".localdomain",
+  ".internal",
+  ".intranet",
+  ".invalid",
+  ".test",
+  ".example",
+  ".home.arpa",
+  ".in-addr.arpa",
+  ".ip6.arpa"
+];
+function isUnpublishableHost(hostname) {
+  const host = hostname.toLowerCase().replace(/\.+$/, "");
+  if (host === "") return true;
+  if (host.startsWith("[")) return true;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return true;
+  if (!host.includes(".")) return true;
+  return RESERVED_SUFFIXES.some((suffix) => host.endsWith(suffix));
+}
+function normaliseSiteUrl(value) {
+  const trimmed = (value ?? "").trim();
+  if (trimmed === "") return null;
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+  let parsed;
+  try {
+    parsed = new URL(withScheme);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  if (parsed.hostname === "" || isUnpublishableHost(parsed.hostname)) return null;
+  const origin = `${parsed.protocol}//${parsed.host}`;
+  return origin.length <= 191 ? origin : null;
+}
+var PRODUCTION_URL_SOURCES = [
+  {
+    // VERCEL_URL is per-deployment and changes every build, so it is deliberately not read here.
+    platform: "vercel",
+    read: (env) => env.VERCEL_ENV === "production" ? env.VERCEL_PROJECT_PRODUCTION_URL : void 0
+  },
+  {
+    // `URL` is generic enough to belong to anything, so it counts only alongside Netlify's own markers.
+    platform: "netlify",
+    read: (env) => env.NETLIFY === "true" && env.CONTEXT === "production" ? env.URL : void 0
+  },
+  {
+    platform: "render",
+    read: (env) => env.RENDER === "true" && env.IS_PULL_REQUEST !== "true" ? env.RENDER_EXTERNAL_URL : void 0
+  },
+  {
+    platform: "railway",
+    read: (env) => env.RAILWAY_ENVIRONMENT_NAME === "production" ? env.RAILWAY_PUBLIC_DOMAIN : void 0
+  }
+];
+function detectSiteUrl(env = process.env) {
+  for (const source of PRODUCTION_URL_SOURCES) {
+    const url = normaliseSiteUrl(source.read(env));
+    if (url !== null) {
+      return { url, platform: source.platform };
+    }
+  }
+  return null;
+}
+
+// src/site-name.ts
+import { readFile as readFile7 } from "fs/promises";
 import path6 from "path";
+var NAME_MAX_LENGTH = 191;
+var TEMPLATE_PACKAGE_NAMES = /* @__PURE__ */ new Set([
+  // Lovable
+  "vite_react_shadcn_ts",
+  // Bolt
+  "vite-react-typescript-starter",
+  // Scaffolders and the names people accept from them
+  "vite-project",
+  "my-app",
+  "my-project",
+  "my-v0-project",
+  "app",
+  "frontend",
+  "web",
+  "client",
+  "project",
+  "template",
+  "example",
+  "react-app",
+  "next-app",
+  "nextjs",
+  "starter",
+  "test"
+]);
+var TEMPLATE_TITLES = /* @__PURE__ */ new Set([
+  "vite + react",
+  "vite + react + ts",
+  "vite + vue",
+  "vite + vue + ts",
+  "vite app",
+  "react app",
+  "create next app",
+  "document",
+  "untitled",
+  "index",
+  "home",
+  "app"
+]);
+var NAMED_ENTITIES = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+  nbsp: " "
+};
+function normaliseSiteName(value) {
+  const collapsed = (value ?? "").replace(/\s+/g, " ").trim();
+  if (collapsed === "") return null;
+  return collapsed.slice(0, NAME_MAX_LENGTH);
+}
+function decodeEntities(text) {
+  return text.replace(/&([a-z]+);/gi, (whole, name) => NAMED_ENTITIES[name.toLowerCase()] ?? whole);
+}
+function nameFromHtmlTitle(html) {
+  const match = /<title\b[^>]*>([\s\S]*?)<\/title>/i.exec(html);
+  if (match === null) return null;
+  const name = normaliseSiteName(decodeEntities(match[1] ?? ""));
+  if (name === null || TEMPLATE_TITLES.has(name.toLowerCase())) return null;
+  return name;
+}
+function nameFromPackageName(raw) {
+  if (typeof raw !== "string") return null;
+  const unscoped = raw.trim().replace(/^@[^/]+\//, "");
+  if (unscoped === "" || TEMPLATE_PACKAGE_NAMES.has(unscoped.toLowerCase())) return null;
+  const words = unscoped.split(/[-_.\s]+/).filter((word) => word !== "").map((word) => word === word.toUpperCase() ? word : word.charAt(0).toUpperCase() + word.slice(1));
+  return normaliseSiteName(words.join(" "));
+}
+async function readIfPresent(file) {
+  try {
+    return await readFile7(file, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function detectSiteName(cwd) {
+  for (const shell of ["index.html", path6.join("public", "index.html")]) {
+    const html = await readIfPresent(path6.join(cwd, shell));
+    if (html === null) continue;
+    const name = nameFromHtmlTitle(html);
+    if (name !== null) return { name, source: "index.html" };
+  }
+  const manifest = await readIfPresent(path6.join(cwd, "package.json"));
+  if (manifest !== null) {
+    try {
+      const parsed = JSON.parse(manifest);
+      const name = nameFromPackageName(
+        typeof parsed === "object" && parsed !== null ? parsed.name : void 0
+      );
+      if (name !== null) return { name, source: "package.json" };
+    } catch {
+    }
+  }
+  return null;
+}
+
+// src/config.ts
 var CONFIG_FILENAME = ".patchstackrc.json";
 var SECRET_FILENAME = ".patchstackrc.local.json";
 var DEFAULT_ENVIRONMENT = "production";
+async function resolveSiteIdentity(cwd, fromEnv, fromFile) {
+  const configuredUrl = stated(fromEnv.url) ?? stated(fromFile.url);
+  const configuredName = stated(fromEnv.name) ?? stated(fromFile.name);
+  let url;
+  if (configuredUrl === null) {
+    url = detectSiteUrl(process.env)?.url ?? null;
+  } else {
+    url = normaliseSiteUrl(configuredUrl);
+    if (url === null) {
+      throw new PatchstackError(
+        `Site URL "${configuredUrl}" is not an address the public can reach this site at. Set "url" in .patchstackrc.json (or PATCHSTACK_SITE_URL) to the http(s) address visitors use \u2014 a hostname, not an IP address \u2014 or remove it to let the build environment answer.`,
+        "CONFIG_INVALID"
+      );
+    }
+  }
+  const name = configuredName === null ? (await detectSiteName(cwd))?.name ?? null : normaliseSiteName(configuredName);
+  return { url, name };
+}
+function stated(value) {
+  const trimmed = (value ?? "").trim();
+  return trimmed === "" ? null : trimmed;
+}
 async function resolveConfig(options) {
   const fromFile = await readConfigFile(options.cwd);
   const fromSecretFile = await readSecretFile(options.cwd);
@@ -1396,24 +1599,29 @@ async function resolveConfig(options) {
   }
   const apiKeyRaw = fromEnv.apiKey ?? fromSecretFile.apiKey ?? fromFile.apiKey ?? null;
   const pulseAuthRaw = fromEnv.pulseAuth ?? fromSecretFile.pulseAuth ?? fromFile.pulseAuth ?? apiKeyRaw;
+  const identity = options.detectSiteIdentity === true ? await resolveSiteIdentity(options.cwd, fromEnv, fromFile) : { url: null, name: null };
+  const claimToken = stated(options.cliClaimToken) ?? stated(process.env.PATCHSTACK_CLAIM_TOKEN);
   return {
     siteUuid: siteUuid === null || siteUuid.length === 0 ? null : siteUuid,
     apiKey: apiKeyRaw === null || apiKeyRaw.length === 0 ? null : apiKeyRaw,
     pulseAuth: pulseAuthRaw === null || pulseAuthRaw.length === 0 ? null : pulseAuthRaw,
+    siteUrl: identity.url,
+    siteName: identity.name,
     endpoint,
     timeoutMs,
     environment,
-    widget: fromFile.widget !== false
+    widget: fromFile.widget !== false,
+    claimToken
   };
 }
 async function writeConfigFile(cwd, config) {
-  const target = path6.join(cwd, CONFIG_FILENAME);
+  const target = path7.join(cwd, CONFIG_FILENAME);
   const content = JSON.stringify(config, null, 2) + "\n";
   await writeFile(target, content, "utf8");
   return target;
 }
 async function writeSecretFile(cwd, secrets) {
-  const target = path6.join(cwd, SECRET_FILENAME);
+  const target = path7.join(cwd, SECRET_FILENAME);
   await writeFile(target, JSON.stringify(secrets, null, 2) + "\n", { encoding: "utf8", mode: 384 });
   try {
     await chmod(target, 384);
@@ -1423,10 +1631,10 @@ async function writeSecretFile(cwd, secrets) {
   return { path: target, ...ignore };
 }
 async function ensureIgnored(cwd, entry) {
-  const target = path6.join(cwd, ".gitignore");
+  const target = path7.join(cwd, ".gitignore");
   let existing = "";
   try {
-    existing = await readFile7(target, "utf8");
+    existing = await readFile8(target, "utf8");
   } catch (err) {
     const code = err.code;
     if (code !== "ENOENT") {
@@ -1446,7 +1654,7 @@ ${entry}
     return { ignored: false, reason: `.gitignore could not be written (${code ?? "unknown error"})` };
   }
   try {
-    const written = await readFile7(target, "utf8");
+    const written = await readFile8(target, "utf8");
     if (ignoresEntry(written, entry)) return { ignored: true };
     return { ignored: false, reason: ".gitignore does not cover the file after writing it" };
   } catch (err) {
@@ -1490,10 +1698,10 @@ async function readConfigFile(cwd) {
   return readJsonFile(cwd, CONFIG_FILENAME);
 }
 async function readJsonFile(cwd, filename) {
-  const target = path6.join(cwd, filename);
+  const target = path7.join(cwd, filename);
   let raw;
   try {
-    raw = await readFile7(target, "utf8");
+    raw = await readFile8(target, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return {};
@@ -1530,6 +1738,8 @@ function readEnv() {
   const environmentRaw = process.env.PATCHSTACK_ENVIRONMENT;
   return {
     siteUuid: process.env.PATCHSTACK_SITE_UUID ?? void 0,
+    url: process.env.PATCHSTACK_SITE_URL ?? void 0,
+    name: process.env.PATCHSTACK_SITE_NAME ?? void 0,
     apiKey: process.env.PATCHSTACK_API_KEY ?? void 0,
     pulseAuth: process.env.PATCHSTACK_PULSE_AUTH ?? void 0,
     endpoint: process.env.PATCHSTACK_ENDPOINT ?? void 0,
@@ -1632,7 +1842,7 @@ function isEmptyStack(stack) {
 
 // src/widget.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";
-import path7 from "path";
+import path8 from "path";
 var WIDGET_SCRIPT_URL = "https://cdn.patchstack.com/patchstack-widget.js";
 var WIDGET_MARKER_ATTR = "data-patchstack-connect-widget";
 var WIDGET_NEEDLE = "patchstack-widget";
@@ -1670,7 +1880,7 @@ ${indent}</body>`;
 }
 function findSourceShell(cwd) {
   for (const candidate of SOURCE_SHELL_CANDIDATES) {
-    if (existsSync(path7.join(cwd, candidate))) {
+    if (existsSync(path8.join(cwd, candidate))) {
       return candidate;
     }
   }
@@ -1681,7 +1891,7 @@ function ensureSourceWidget(cwd, siteUuid) {
   if (shell === null) {
     return { shell: null, action: "no-shell" };
   }
-  const file = path7.join(cwd, shell);
+  const file = path8.join(cwd, shell);
   const before = readFileSync(file, "utf8");
   const { html, action } = ensureWidgetInHtml(before, siteUuid);
   if (html !== before) {
@@ -1693,7 +1903,7 @@ function ensureSourceWidget(cwd, siteUuid) {
 // src/index.ts
 async function scanAndReport(options = {}) {
   const cwd = options.cwd ?? process.cwd();
-  const config = options.config ?? await resolveConfig({ cwd });
+  const config = options.config ?? await resolveConfig({ cwd, detectSiteIdentity: true });
   const manifest = await scanLockfile(cwd);
   const { payload, stats } = buildWirePayload(manifest, { installPaths: options.installPaths === true });
   const response = await postManifest(config, payload);