@patchstack/connect 0.4.2 → 0.5.1

package/dist/protect.cjs

@@ -38,8 +38,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/pulse-token.ts
 function buildTokenUrl(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path7 = url.pathname.replace(/\/$/, "");
-  url.pathname = path7.endsWith("/manifest") ? `${path7.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  const path8 = url.pathname.replace(/\/$/, "");
+  url.pathname = path8.endsWith("/manifest") ? `${path8.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -142,6 +142,9 @@ var init_types = __esm({
 });
 
 // src/client.ts
+function claimTokenHeader(config) {
+  return typeof config.claimToken === "string" && config.claimToken !== "" ? { [CLAIM_TOKEN_HEADER]: config.claimToken } : {};
+}
 function buildEndpointUrl(base, siteUuid) {
   const trimmed = base.replace(/\/$/, "");
   return siteUuid !== void 0 && siteUuid !== null && siteUuid.length > 0 ? `${trimmed}/${encodeURIComponent(siteUuid)}` : trimmed;
@@ -159,6 +162,14 @@ function authFailureMessage(status, config) {
   }
   return null;
 }
+function buildManifestBody(config, payload) {
+  return {
+    ...payload,
+    environment: config.environment,
+    ...typeof config.siteUrl === "string" && config.siteUrl !== "" ? { url: config.siteUrl } : {},
+    ...typeof config.siteName === "string" && config.siteName !== "" ? { name: config.siteName } : {}
+  };
+}
 async function postManifest(config, payload) {
   const url = buildEndpointUrl(config.endpoint, config.siteUuid);
   const timeoutMs = config.timeoutMs;
@@ -169,9 +180,10 @@ async function postManifest(config, payload) {
       headers: {
         "Content-Type": "application/json",
         Accept: "application/json",
-        "User-Agent": "@patchstack/connect"
+        "User-Agent": "@patchstack/connect",
+        ...claimTokenHeader(config)
       },
-      body: JSON.stringify({ ...payload, environment: config.environment }),
+      body: JSON.stringify(buildManifestBody(config, payload)),
       signal: AbortSignal.timeout(timeoutMs)
     });
   } catch (cause) {
@@ -228,7 +240,7 @@ function isTimeoutError(cause) {
   }
   return false;
 }
-var DEFAULT_ENDPOINT, DEFAULT_TIMEOUT_MS;
+var DEFAULT_ENDPOINT, DEFAULT_TIMEOUT_MS, CLAIM_TOKEN_HEADER;
 var init_client = __esm({
   "src/client.ts"() {
     "use strict";
@@ -236,10 +248,211 @@ var init_client = __esm({
     init_pulse_token();
     DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
     DEFAULT_TIMEOUT_MS = 3e4;
+    CLAIM_TOKEN_HEADER = "X-Patchstack-Claim-Token";
+  }
+});
+
+// src/site-url.ts
+function isUnpublishableHost(hostname) {
+  const host = hostname.toLowerCase().replace(/\.+$/, "");
+  if (host === "") return true;
+  if (host.startsWith("[")) return true;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return true;
+  if (!host.includes(".")) return true;
+  return RESERVED_SUFFIXES.some((suffix) => host.endsWith(suffix));
+}
+function normaliseSiteUrl(value) {
+  const trimmed = (value ?? "").trim();
+  if (trimmed === "") return null;
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+  let parsed;
+  try {
+    parsed = new URL(withScheme);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  if (parsed.hostname === "" || isUnpublishableHost(parsed.hostname)) return null;
+  const origin = `${parsed.protocol}//${parsed.host}`;
+  return origin.length <= 191 ? origin : null;
+}
+function detectSiteUrl(env = process.env) {
+  for (const source of PRODUCTION_URL_SOURCES) {
+    const url = normaliseSiteUrl(source.read(env));
+    if (url !== null) {
+      return { url, platform: source.platform };
+    }
+  }
+  return null;
+}
+var RESERVED_SUFFIXES, PRODUCTION_URL_SOURCES;
+var init_site_url = __esm({
+  "src/site-url.ts"() {
+    "use strict";
+    RESERVED_SUFFIXES = [
+      ".local",
+      ".localhost",
+      ".localdomain",
+      ".internal",
+      ".intranet",
+      ".invalid",
+      ".test",
+      ".example",
+      ".home.arpa",
+      ".in-addr.arpa",
+      ".ip6.arpa"
+    ];
+    PRODUCTION_URL_SOURCES = [
+      {
+        // VERCEL_URL is per-deployment and changes every build, so it is deliberately not read here.
+        platform: "vercel",
+        read: (env) => env.VERCEL_ENV === "production" ? env.VERCEL_PROJECT_PRODUCTION_URL : void 0
+      },
+      {
+        // `URL` is generic enough to belong to anything, so it counts only alongside Netlify's own markers.
+        platform: "netlify",
+        read: (env) => env.NETLIFY === "true" && env.CONTEXT === "production" ? env.URL : void 0
+      },
+      {
+        platform: "render",
+        read: (env) => env.RENDER === "true" && env.IS_PULL_REQUEST !== "true" ? env.RENDER_EXTERNAL_URL : void 0
+      },
+      {
+        platform: "railway",
+        read: (env) => env.RAILWAY_ENVIRONMENT_NAME === "production" ? env.RAILWAY_PUBLIC_DOMAIN : void 0
+      }
+    ];
+  }
+});
+
+// src/site-name.ts
+function normaliseSiteName(value) {
+  const collapsed = (value ?? "").replace(/\s+/g, " ").trim();
+  if (collapsed === "") return null;
+  return collapsed.slice(0, NAME_MAX_LENGTH);
+}
+function decodeEntities(text) {
+  return text.replace(/&([a-z]+);/gi, (whole, name) => NAMED_ENTITIES2[name.toLowerCase()] ?? whole);
+}
+function nameFromHtmlTitle(html) {
+  const match = /<title\b[^>]*>([\s\S]*?)<\/title>/i.exec(html);
+  if (match === null) return null;
+  const name = normaliseSiteName(decodeEntities(match[1] ?? ""));
+  if (name === null || TEMPLATE_TITLES.has(name.toLowerCase())) return null;
+  return name;
+}
+function nameFromPackageName(raw) {
+  if (typeof raw !== "string") return null;
+  const unscoped = raw.trim().replace(/^@[^/]+\//, "");
+  if (unscoped === "" || TEMPLATE_PACKAGE_NAMES.has(unscoped.toLowerCase())) return null;
+  const words = unscoped.split(/[-_.\s]+/).filter((word) => word !== "").map((word) => word === word.toUpperCase() ? word : word.charAt(0).toUpperCase() + word.slice(1));
+  return normaliseSiteName(words.join(" "));
+}
+async function readIfPresent(file) {
+  try {
+    return await (0, import_promises.readFile)(file, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function detectSiteName(cwd) {
+  for (const shell of ["index.html", import_node_path.default.join("public", "index.html")]) {
+    const html = await readIfPresent(import_node_path.default.join(cwd, shell));
+    if (html === null) continue;
+    const name = nameFromHtmlTitle(html);
+    if (name !== null) return { name, source: "index.html" };
+  }
+  const manifest = await readIfPresent(import_node_path.default.join(cwd, "package.json"));
+  if (manifest !== null) {
+    try {
+      const parsed = JSON.parse(manifest);
+      const name = nameFromPackageName(
+        typeof parsed === "object" && parsed !== null ? parsed.name : void 0
+      );
+      if (name !== null) return { name, source: "package.json" };
+    } catch {
+    }
+  }
+  return null;
+}
+var import_promises, import_node_path, NAME_MAX_LENGTH, TEMPLATE_PACKAGE_NAMES, TEMPLATE_TITLES, NAMED_ENTITIES2;
+var init_site_name = __esm({
+  "src/site-name.ts"() {
+    "use strict";
+    import_promises = require("fs/promises");
+    import_node_path = __toESM(require("path"), 1);
+    NAME_MAX_LENGTH = 191;
+    TEMPLATE_PACKAGE_NAMES = /* @__PURE__ */ new Set([
+      // Lovable
+      "vite_react_shadcn_ts",
+      // Bolt
+      "vite-react-typescript-starter",
+      // Scaffolders and the names people accept from them
+      "vite-project",
+      "my-app",
+      "my-project",
+      "my-v0-project",
+      "app",
+      "frontend",
+      "web",
+      "client",
+      "project",
+      "template",
+      "example",
+      "react-app",
+      "next-app",
+      "nextjs",
+      "starter",
+      "test"
+    ]);
+    TEMPLATE_TITLES = /* @__PURE__ */ new Set([
+      "vite + react",
+      "vite + react + ts",
+      "vite + vue",
+      "vite + vue + ts",
+      "vite app",
+      "react app",
+      "create next app",
+      "document",
+      "untitled",
+      "index",
+      "home",
+      "app"
+    ]);
+    NAMED_ENTITIES2 = {
+      amp: "&",
+      lt: "<",
+      gt: ">",
+      quot: '"',
+      apos: "'",
+      nbsp: " "
+    };
   }
 });
 
 // src/config.ts
+async function resolveSiteIdentity(cwd, fromEnv, fromFile) {
+  const configuredUrl = stated(fromEnv.url) ?? stated(fromFile.url);
+  const configuredName = stated(fromEnv.name) ?? stated(fromFile.name);
+  let url;
+  if (configuredUrl === null) {
+    url = detectSiteUrl(process.env)?.url ?? null;
+  } else {
+    url = normaliseSiteUrl(configuredUrl);
+    if (url === null) {
+      throw new PatchstackError(
+        `Site URL "${configuredUrl}" is not an address the public can reach this site at. Set "url" in .patchstackrc.json (or PATCHSTACK_SITE_URL) to the http(s) address visitors use \u2014 a hostname, not an IP address \u2014 or remove it to let the build environment answer.`,
+        "CONFIG_INVALID"
+      );
+    }
+  }
+  const name = configuredName === null ? (await detectSiteName(cwd))?.name ?? null : normaliseSiteName(configuredName);
+  return { url, name };
+}
+function stated(value) {
+  const trimmed = (value ?? "").trim();
+  return trimmed === "" ? null : trimmed;
+}
 async function resolveConfig(options) {
   const fromFile = await readConfigFile(options.cwd);
   const fromSecretFile = await readSecretFile(options.cwd);
@@ -269,14 +482,19 @@ async function resolveConfig(options) {
   }
   const apiKeyRaw = fromEnv.apiKey ?? fromSecretFile.apiKey ?? fromFile.apiKey ?? null;
   const pulseAuthRaw = fromEnv.pulseAuth ?? fromSecretFile.pulseAuth ?? fromFile.pulseAuth ?? apiKeyRaw;
+  const identity = options.detectSiteIdentity === true ? await resolveSiteIdentity(options.cwd, fromEnv, fromFile) : { url: null, name: null };
+  const claimToken = stated(options.cliClaimToken) ?? stated(process.env.PATCHSTACK_CLAIM_TOKEN);
   return {
     siteUuid: siteUuid === null || siteUuid.length === 0 ? null : siteUuid,
     apiKey: apiKeyRaw === null || apiKeyRaw.length === 0 ? null : apiKeyRaw,
     pulseAuth: pulseAuthRaw === null || pulseAuthRaw.length === 0 ? null : pulseAuthRaw,
+    siteUrl: identity.url,
+    siteName: identity.name,
     endpoint,
     timeoutMs,
     environment,
-    widget: fromFile.widget !== false
+    widget: fromFile.widget !== false,
+    claimToken
   };
 }
 async function readSecretFile(cwd) {
@@ -287,10 +505,10 @@ async function readConfigFile(cwd) {
   return readJsonFile(cwd, CONFIG_FILENAME);
 }
 async function readJsonFile(cwd, filename) {
-  const target = import_node_path.default.join(cwd, filename);
+  const target = import_node_path2.default.join(cwd, filename);
   let raw;
   try {
-    raw = await (0, import_promises.readFile)(target, "utf8");
+    raw = await (0, import_promises2.readFile)(target, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return {};
@@ -327,6 +545,8 @@ function readEnv() {
   const environmentRaw = process.env.PATCHSTACK_ENVIRONMENT;
   return {
     siteUuid: process.env.PATCHSTACK_SITE_UUID ?? void 0,
+    url: process.env.PATCHSTACK_SITE_URL ?? void 0,
+    name: process.env.PATCHSTACK_SITE_NAME ?? void 0,
     apiKey: process.env.PATCHSTACK_API_KEY ?? void 0,
     pulseAuth: process.env.PATCHSTACK_PULSE_AUTH ?? void 0,
     endpoint: process.env.PATCHSTACK_ENDPOINT ?? void 0,
@@ -340,14 +560,16 @@ function isUuid(value) {
 function isEnvironment(value) {
   return value === "production" || value === "sandbox";
 }
-var import_promises, import_node_path, CONFIG_FILENAME, SECRET_FILENAME, DEFAULT_ENVIRONMENT;
+var import_promises2, import_node_path2, CONFIG_FILENAME, SECRET_FILENAME, DEFAULT_ENVIRONMENT;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
-    import_promises = require("fs/promises");
-    import_node_path = __toESM(require("path"), 1);
+    import_promises2 = require("fs/promises");
+    import_node_path2 = __toESM(require("path"), 1);
     init_types();
     init_client();
+    init_site_url();
+    init_site_name();
     CONFIG_FILENAME = ".patchstackrc.json";
     SECRET_FILENAME = ".patchstackrc.local.json";
     DEFAULT_ENVIRONMENT = "production";
@@ -358,7 +580,7 @@ var init_config = __esm({
 async function readDeclaredDependencyNames(cwd) {
   let raw;
   try {
-    raw = await (0, import_promises2.readFile)(import_node_path2.default.join(cwd, "package.json"), "utf8");
+    raw = await (0, import_promises3.readFile)(import_node_path3.default.join(cwd, "package.json"), "utf8");
   } catch {
     return [];
   }
@@ -407,12 +629,12 @@ function disagreements(packages, other) {
   }
   return conflicts;
 }
-var import_promises2, import_node_path2;
+var import_promises3, import_node_path3;
 var init_consistency = __esm({
   "src/parsers/consistency.ts"() {
     "use strict";
-    import_promises2 = require("fs/promises");
-    import_node_path2 = __toESM(require("path"), 1);
+    import_promises3 = require("fs/promises");
+    import_node_path3 = __toESM(require("path"), 1);
   }
 });
 
@@ -443,7 +665,7 @@ var init_report = __esm({
 async function parseBunLockfile(lockfilePath, report) {
   let raw;
   try {
-    raw = await (0, import_promises3.readFile)(lockfilePath, "utf8");
+    raw = await (0, import_promises4.readFile)(lockfilePath, "utf8");
   } catch (cause) {
     throw new PatchstackError(`Could not read lockfile at ${lockfilePath}`, "LOCKFILE_NOT_FOUND", cause);
   }
@@ -557,11 +779,11 @@ function stripTrailingCommas(source) {
   }
   return out.join("");
 }
-var import_promises3, NON_REGISTRY_VERSION;
+var import_promises4, NON_REGISTRY_VERSION;
 var init_bun = __esm({
   "src/parsers/bun.ts"() {
     "use strict";
-    import_promises3 = require("fs/promises");
+    import_promises4 = require("fs/promises");
     init_types();
     init_report();
     NON_REGISTRY_VERSION = /^[a-z][a-z0-9+.-]*:|\//i;
@@ -572,7 +794,7 @@ var init_bun = __esm({
 async function parseNpmLockfile(lockfilePath) {
   let raw;
   try {
-    raw = await (0, import_promises4.readFile)(lockfilePath, "utf8");
+    raw = await (0, import_promises5.readFile)(lockfilePath, "utf8");
   } catch (cause) {
     throw new PatchstackError(`Could not read lockfile at ${lockfilePath}`, "LOCKFILE_NOT_FOUND", cause);
   }
@@ -630,7 +852,7 @@ function extractFromV1(deps, acc = [], depth = 0) {
   return acc;
 }
 function extractNameFromPath(pkgPath) {
-  const segments = pkgPath.split("node_modules" + import_node_path3.default.sep === pkgPath ? import_node_path3.default.sep : "/");
+  const segments = pkgPath.split("node_modules" + import_node_path4.default.sep === pkgPath ? import_node_path4.default.sep : "/");
   const parts = pkgPath.split("/");
   const nmIndex = parts.lastIndexOf("node_modules");
   if (nmIndex === -1 || nmIndex >= parts.length - 1) {
@@ -651,21 +873,21 @@ function isDirectV2(pkgPath) {
   const nmCount = parts.filter((p) => p === "node_modules").length;
   return nmCount === 1;
 }
-var import_promises4, import_node_path3;
+var import_promises5, import_node_path4;
 var init_npm = __esm({
   "src/parsers/npm.ts"() {
     "use strict";
-    import_promises4 = require("fs/promises");
-    import_node_path3 = __toESM(require("path"), 1);
+    import_promises5 = require("fs/promises");
+    import_node_path4 = __toESM(require("path"), 1);
     init_types();
   }
 });
 
 // src/parsers/node_modules.ts
 async function walkNodeModules(cwd) {
-  const root = import_node_path4.default.join(cwd, "node_modules");
+  const root = import_node_path5.default.join(cwd, "node_modules");
   try {
-    const info = await (0, import_promises5.stat)(root);
+    const info = await (0, import_promises6.stat)(root);
     if (!info.isDirectory()) {
       throw new PatchstackError(
         `${root} exists but is not a directory.`,
@@ -684,7 +906,7 @@ async function walkNodeModules(cwd) {
   }
   const seen = /* @__PURE__ */ new Map();
   try {
-    seen.set(await (0, import_promises5.realpath)(cwd), -1);
+    seen.set(await (0, import_promises6.realpath)(cwd), -1);
   } catch {
   }
   return dedupeByShallowest(await walk(root, 0, seen, cwd));
@@ -700,26 +922,26 @@ function dedupeByShallowest(found) {
 async function walk(dir, depth, seen, root) {
   let names;
   try {
-    names = await (0, import_promises5.readdir)(dir);
+    names = await (0, import_promises6.readdir)(dir);
   } catch {
     return [];
   }
   const perEntry = await mapLimit(names, async (name) => {
     if (name.startsWith(".") && !PACKAGE_STORE_DIRS.has(name)) return [];
-    const fullPath = import_node_path4.default.join(dir, name);
+    const fullPath = import_node_path5.default.join(dir, name);
     const resolved = await claim(fullPath, seen, depth);
     if (resolved === null) return [];
     if (PACKAGE_STORE_DIRS.has(name)) return walk(fullPath, depth, seen, root);
     if (name.startsWith("@")) {
       let subNames;
       try {
-        subNames = await (0, import_promises5.readdir)(fullPath);
+        subNames = await (0, import_promises6.readdir)(fullPath);
       } catch {
         return [];
       }
       const scoped = await mapLimit(subNames, async (sub) => {
         if (sub.startsWith(".")) return [];
-        const scopedDir = import_node_path4.default.join(fullPath, sub);
+        const scopedDir = import_node_path5.default.join(fullPath, sub);
         const scopedReal = await claim(scopedDir, seen, depth);
         if (scopedReal === null) return [];
         return packageAndNested(scopedDir, scopedReal, depth, seen, root);
@@ -746,13 +968,13 @@ async function mapLimit(items, fn) {
   await Promise.all(workers);
   return results;
 }
-function installLocation(root, pkgDir, impl = import_node_path4.default) {
+function installLocation(root, pkgDir, impl = import_node_path5.default) {
   return impl.relative(root, pkgDir).split(impl.sep).join("/");
 }
 async function readPackage(pkgDir, depth, root) {
   let raw;
   try {
-    raw = await (0, import_promises5.readFile)(import_node_path4.default.join(pkgDir, "package.json"), "utf8");
+    raw = await (0, import_promises6.readFile)(import_node_path5.default.join(pkgDir, "package.json"), "utf8");
   } catch {
     return null;
   }
@@ -771,7 +993,7 @@ async function readPackage(pkgDir, depth, root) {
   return { name: parsed.name, version: parsed.version, path: installLocation(root, pkgDir), direct: depth === 0 };
 }
 async function walkNested(pkgDir, depth, seen, root) {
-  const nested = import_node_path4.default.join(pkgDir, "node_modules");
+  const nested = import_node_path5.default.join(pkgDir, "node_modules");
   if (await claim(nested, seen, depth + 1) === null) {
     return [];
   }
@@ -780,10 +1002,10 @@ async function walkNested(pkgDir, depth, seen, root) {
 async function claim(dir, seen, depth) {
   let resolved;
   try {
-    const info = await (0, import_promises5.lstat)(dir);
+    const info = await (0, import_promises6.lstat)(dir);
     if (!info.isDirectory() && !info.isSymbolicLink()) return null;
-    resolved = await (0, import_promises5.realpath)(dir);
-    const target = await (0, import_promises5.stat)(resolved);
+    resolved = await (0, import_promises6.realpath)(dir);
+    const target = await (0, import_promises6.stat)(resolved);
     if (!target.isDirectory()) return null;
   } catch {
     return null;
@@ -793,12 +1015,12 @@ async function claim(dir, seen, depth) {
   seen.set(resolved, depth);
   return resolved;
 }
-var import_promises5, import_node_path4, PACKAGE_STORE_DIRS, CONCURRENCY;
+var import_promises6, import_node_path5, PACKAGE_STORE_DIRS, CONCURRENCY;
 var init_node_modules = __esm({
   "src/parsers/node_modules.ts"() {
     "use strict";
-    import_promises5 = require("fs/promises");
-    import_node_path4 = __toESM(require("path"), 1);
+    import_promises6 = require("fs/promises");
+    import_node_path5 = __toESM(require("path"), 1);
     init_types();
     PACKAGE_STORE_DIRS = /* @__PURE__ */ new Set([".bun", ".pnpm", ".store"]);
     CONCURRENCY = 32;
@@ -809,7 +1031,7 @@ var init_node_modules = __esm({
 async function parsePnpmLockfile(lockfilePath, report) {
   let raw;
   try {
-    raw = await (0, import_promises6.readFile)(lockfilePath, "utf8");
+    raw = await (0, import_promises7.readFile)(lockfilePath, "utf8");
   } catch (cause) {
     throw new PatchstackError(
       `Could not read lockfile at ${lockfilePath}`,
@@ -1051,11 +1273,11 @@ function extractLeafName(trimmed) {
   }
   return name.length > 0 ? name : null;
 }
-var import_promises6, DEP_SECTIONS;
+var import_promises7, DEP_SECTIONS;
 var init_pnpm = __esm({
   "src/parsers/pnpm.ts"() {
     "use strict";
-    import_promises6 = require("fs/promises");
+    import_promises7 = require("fs/promises");
     init_types();
     init_report();
     DEP_SECTIONS = /* @__PURE__ */ new Set([
@@ -1070,7 +1292,7 @@ var init_pnpm = __esm({
 async function parseYarnLockfile(lockfilePath, report) {
   let raw;
   try {
-    raw = await (0, import_promises7.readFile)(lockfilePath, "utf8");
+    raw = await (0, import_promises8.readFile)(lockfilePath, "utf8");
   } catch (cause) {
     throw new PatchstackError(
       `Could not read lockfile at ${lockfilePath}`,
@@ -1085,7 +1307,7 @@ async function parseYarnLockfile(lockfilePath, report) {
       "LOCKFILE_PARSE_ERROR"
     );
   }
-  const directNames = await readDirectDepNames(import_node_path5.default.dirname(lockfilePath));
+  const directNames = await readDirectDepNames(import_node_path6.default.dirname(lockfilePath));
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
   for (const block of blocks) {
@@ -1250,7 +1472,7 @@ async function readDirectDepNames(cwd) {
   const names = /* @__PURE__ */ new Set();
   let raw;
   try {
-    raw = await (0, import_promises7.readFile)(import_node_path5.default.join(cwd, "package.json"), "utf8");
+    raw = await (0, import_promises8.readFile)(import_node_path6.default.join(cwd, "package.json"), "utf8");
   } catch {
     return names;
   }
@@ -1275,12 +1497,12 @@ async function readDirectDepNames(cwd) {
   }
   return names;
 }
-var import_promises7, import_node_path5, NON_PACKAGE_KEYS, NON_REGISTRY_PROTOCOLS;
+var import_promises8, import_node_path6, NON_PACKAGE_KEYS, NON_REGISTRY_PROTOCOLS;
 var init_yarn = __esm({
   "src/parsers/yarn.ts"() {
     "use strict";
-    import_promises7 = require("fs/promises");
-    import_node_path5 = __toESM(require("path"), 1);
+    import_promises8 = require("fs/promises");
+    import_node_path6 = __toESM(require("path"), 1);
     init_types();
     init_report();
     NON_PACKAGE_KEYS = /* @__PURE__ */ new Set(["__metadata"]);
@@ -1292,7 +1514,7 @@ var init_yarn = __esm({
 async function detectLockfile(cwd) {
   const probed = await Promise.all(
     LOCKFILE_CANDIDATES.map(async (candidate) => {
-      const filePath = import_node_path6.default.join(cwd, candidate.filename);
+      const filePath = import_node_path7.default.join(cwd, candidate.filename);
       return { ...candidate, filePath, present: await exists(filePath) };
     })
   );
@@ -1403,7 +1625,7 @@ function staleWarning(source, missing) {
 async function presentLockfiles(cwd) {
   const probed = await Promise.all(
     LOCKFILE_CANDIDATES.map(async (candidate) => {
-      const filePath = import_node_path6.default.join(cwd, candidate.filename);
+      const filePath = import_node_path7.default.join(cwd, candidate.filename);
       return { ...candidate, filePath, present: await exists(filePath) };
     })
   );
@@ -1427,18 +1649,18 @@ async function runStrategy(detected, cwd, report) {
 }
 async function exists(filePath) {
   try {
-    await (0, import_promises8.access)(filePath);
+    await (0, import_promises9.access)(filePath);
     return true;
   } catch {
     return false;
   }
 }
-var import_promises8, import_node_path6, LOCKFILE_CANDIDATES;
+var import_promises9, import_node_path7, LOCKFILE_CANDIDATES;
 var init_parsers = __esm({
   "src/parsers/index.ts"() {
     "use strict";
-    import_promises8 = require("fs/promises");
-    import_node_path6 = __toESM(require("path"), 1);
+    import_promises9 = require("fs/promises");
+    import_node_path7 = __toESM(require("path"), 1);
     init_types();
     init_consistency();
     init_bun();
@@ -2879,12 +3101,12 @@ function isRegexForm(pattern) {
   const parts = REGEX_FORM.exec(pattern);
   return parts !== null && REGEX_SYNTAX.test(parts[1]);
 }
-function pathMatches(pattern, path7) {
+function pathMatches(pattern, path8) {
   if (isRegexForm(pattern)) {
     const re = safeRegExp(pattern);
-    return re ? re.test(path7) : false;
+    return re ? re.test(path8) : false;
   }
-  const target = foldPathForScope(path7);
+  const target = foldPathForScope(path8);
   const folded = foldPathForScope(pattern);
   if (folded.includes("*")) {
     const trailing = folded.endsWith("/*");
@@ -4426,7 +4648,7 @@ async function installEgressGuard({ shouldBlock, onBlock, onSkip, dnsScreen = tr
   for (const moduleName of ["node:http", "node:https"]) {
     try {
       const mod = await import(moduleName);
-      const restore = patchHttpModule(mod.default ?? mod, block, screen);
+      const restore = patchHttpModule(mod.default ?? mod, block, screen, skip);
       if (restore) restores.push(restore);
     } catch {
     }
@@ -4440,7 +4662,7 @@ async function installEgressGuard({ shouldBlock, onBlock, onSkip, dnsScreen = tr
     }
   };
 }
-function patchHttpModule(http, block, screen) {
+function patchHttpModule(http, block, screen, skip) {
   if (!http || typeof http.request !== "function" || http.__patchstackGuarded) return null;
   const originalRequest = http.request;
   const originalGet = http.get;
@@ -4451,7 +4673,7 @@ function patchHttpModule(http, block, screen) {
     }
     if (target && screen && target.host && screen.isIP(target.host) === 0 && !screen.isExempt(target.host)) {
       try {
-        args = withScreeningLookup(args, target, block, screen.lookup);
+        args = withScreeningLookup(args, target, block, screen.lookup, skip);
       } catch {
       }
     }
@@ -4483,8 +4705,8 @@ function extractHttpTarget(args) {
       const host = normalizeHost(first.hostname || first.host) || "localhost";
       const protocol = first.protocol || "http:";
       const port = first.port ? `:${first.port}` : "";
-      const path7 = first.path || "/";
-      return { url: `${protocol}//${host}${port}${path7}`, host, method: first.method || "GET" };
+      const path8 = first.path || "/";
+      return { url: `${protocol}//${host}${port}${path8}`, host, method: first.method || "GET" };
     }
   } catch {
   }
@@ -4504,7 +4726,9 @@ function screenResolved(addresses, target, block) {
   }
   return null;
 }
-function withScreeningLookup(args, target, block, lookup) {
+function withScreeningLookup(args, target, block, lookup, skip) {
+  const own = callerLookup(args);
+  const resolve = typeof own === "function" ? own : lookup;
   const screeningLookup = (hostname, options, callback) => {
     let opts = options;
     let cb = callback;
@@ -4513,29 +4737,43 @@ function withScreeningLookup(args, target, block, lookup) {
       opts = {};
     }
     if (!opts || typeof opts !== "object") opts = {};
+    const handOver = (list) => {
+      if (opts.all) return cb(null, list);
+      const first = list[0];
+      if (!first) return cb(new Error(`Patchstack: could not resolve ${hostname}`));
+      return cb(null, first.address, first.family);
+    };
+    let answered = false;
     try {
-      lookup(hostname, { ...opts, all: true }, (err, addresses) => {
+      resolve(hostname, { ...opts, all: true }, (err, addresses) => {
+        answered = true;
         if (err) return cb(err);
         const list = Array.isArray(addresses) ? addresses : [];
-        const blocked = screenResolved(list, target, block);
+        let blocked;
+        try {
+          blocked = screenResolved(list, target, block);
+        } catch {
+          skip("screen-failed", { host: hostname });
+          return handOver(list);
+        }
         if (blocked) {
           return cb(new Error(`Patchstack blocked an outbound request to a disallowed address: ${target.host} resolved to ${blocked}`));
         }
-        if (opts.all) return cb(null, list);
-        const first = list[0];
-        if (!first) return cb(new Error(`Patchstack: could not resolve ${hostname}`));
-        return cb(null, first.address, first.family);
+        return handOver(list);
       });
-    } catch {
-      try {
-        lookup(hostname, opts, cb);
-      } catch {
-        cb(new Error(`Patchstack: lookup failed for ${hostname}`));
-      }
+    } catch (err) {
+      if (answered) throw err;
+      return cb(err);
     }
   };
   return injectLookupOption(args, screeningLookup);
 }
+function callerLookup(args) {
+  for (const arg of args) {
+    if (arg && typeof arg === "object" && !(arg instanceof URL) && typeof arg.lookup === "function") return arg.lookup;
+  }
+  return void 0;
+}
 function injectLookupOption(args, lookup) {
   const first = args[0];
   if (first && typeof first === "object" && !(first instanceof URL)) {
@@ -4833,12 +5071,12 @@ var fsMod;
 async function loadFs() {
   if (fsMod !== void 0) return fsMod;
   try {
-    const [fs, path7] = await Promise.all([import("fs"), import("path")]);
+    const [fs, path8] = await Promise.all([import("fs"), import("path")]);
     fsMod = {
       readFileSync: fs.readFileSync,
       writeFileSync: fs.writeFileSync,
       mkdirSync: fs.mkdirSync,
-      join: path7.join
+      join: path8.join
     };
   } catch {
     fsMod = null;
@@ -5132,13 +5370,13 @@ var MAX_CAPTURED_VALUE_CHARS = 512;
 var MAX_QUERY_KEYS = 10;
 var MAX_METHOD_CHARS = 16;
 var MAX_BODY_BYTES2 = 64 * 1024;
-function queryKeysOf(path7) {
-  if (typeof path7 !== "string") return { keys: [], total: 0 };
-  const start = path7.indexOf("?");
+function queryKeysOf(path8) {
+  if (typeof path8 !== "string") return { keys: [], total: 0 };
+  const start = path8.indexOf("?");
   if (start === -1) return { keys: [], total: 0 };
   let names;
   try {
-    names = [...new URLSearchParams(path7.slice(start + 1)).keys()];
+    names = [...new URLSearchParams(path8.slice(start + 1)).keys()];
   } catch {
     return { keys: [], total: 0 };
   }
@@ -5277,10 +5515,10 @@ function revisionOf(rule) {
   if (typeof revision === "number" && Number.isFinite(revision)) return String(revision);
   return null;
 }
-function routeOf(path7) {
-  if (typeof path7 !== "string" || path7 === "") return null;
-  const cut = path7.search(/[?#]/);
-  return cut === -1 ? path7 : path7.slice(0, cut);
+function routeOf(path8) {
+  if (typeof path8 !== "string" || path8 === "") return null;
+  const cut = path8.search(/[?#]/);
+  return cut === -1 ? path8 : path8.slice(0, cut);
 }
 function createDetectionReporter(opts) {
   const siteUuid = opts.siteUuid ?? process.env?.PATCHSTACK_SITE_UUID;
@@ -6116,8 +6354,17 @@ function createServerFnGuard({ protection }) {
     return { rule: body.rule, message: body.message || "Blocked by Patchstack" };
   };
 }
+function listOption(value, fallback, name, onError) {
+  if (value === void 0) return fallback;
+  if (Array.isArray(value)) return value;
+  notify(onError, new Error(`patchstack: \`${name}\` has to be an array; the value configured is ignored`), "onError");
+  return fallback;
+}
 async function createProtection(options = {}) {
   const onError = options.onError;
+  const allowHosts = listOption(options.allowHosts, [], "allowHosts", onError);
+  const configuredResponseRules = listOption(options.responseRules, DEFAULT_RESPONSE_RULES, "responseRules", onError);
+  const configuredEgressRules = listOption(options.egressRules, DEFAULT_EGRESS_RULES, "egressRules", onError);
   const userOnDetect = options.onDetect ?? defaultOnDetect;
   const apiKey = await resolveApiKey(options);
   const firewallLog = apiKey && telemetryEnabled() && options.reportFirewallLog !== false ? createFirewallLogReporter({
@@ -6217,9 +6464,9 @@ async function createProtection(options = {}) {
   const applyBundle = (delivered) => {
     const incoming = delivered.firewall ?? [];
     requestRules = byPhase(incoming, "request");
-    responseRules = [...options.responseRules ?? DEFAULT_RESPONSE_RULES, ...byPhase(incoming, "response")];
+    responseRules = [...configuredResponseRules, ...byPhase(incoming, "response")];
     screenCap = responseScreenCap(responseRules);
-    egressRules = [...options.egressRules ?? DEFAULT_EGRESS_RULES, ...byPhase(incoming, "egress")];
+    egressRules = [...configuredEgressRules, ...byPhase(incoming, "egress")];
     engine = new RuleEngine({
       firewall: requestRules,
       whitelists: delivered.whitelists,
@@ -6688,7 +6935,7 @@ async function createProtection(options = {}) {
       return origEnd(cb);
     };
   };
-  const allow = new Set((options.allowHosts ?? []).map((h) => String(h).toLowerCase()));
+  const allow = new Set(allowHosts.map((h) => String(h).toLowerCase()));
   const egressShouldBlock = (url, host, method) => {
     if (host && allow.has(host.toLowerCase())) return false;
     let egressPath = null;
@@ -6740,10 +6987,17 @@ async function createProtection(options = {}) {
       return { request: requestRules, response: responseRules, egress: egressRules };
     },
     /**
-     * Enforcement coverage: how often the guard FAILED OPEN rather than inspecting, keyed
-     * `<phase>:<reason>` (e.g. `response:body-cap`, `request:body-cap`, `response:live-stream`,
-     * `egress:resolver-failed`). "Always-on" is not "always inspected" — surface this (or pass
-     * `onSkip`) so an unscreened path is visible and alertable rather than silent.
+     * Enforcement coverage: how often the guard failed open rather than inspecting, in the cases it can
+     * observe itself — keyed `<phase>:<reason>` (e.g. `response:body-cap`, `request:body-cap`,
+     * `response:live-stream`, `egress:resolver-failed` for a fetch call whose address could not be
+     * resolved). "Always-on" is not "always inspected", so surface this (or pass `onSkip`) rather than
+     * assuming coverage.
+     *
+     * Not a total, in two ways. An outbound call can miss the address check without being counted:
+     * whether it resolved through the screening resolver depends on the agent and the socket pool,
+     * which this guard cannot observe. And a resolver failure on the node path appears nowhere here
+     * because it is not a bypass — that resolver is the connection's, so the call fails instead.
+     * Zero skips means nothing the guard can see was bypassed, not that nothing was.
      */
     coverage() {
       return { skipped: { ...skipCounts } };
@@ -6876,7 +7130,7 @@ async function createProtection(options = {}) {
       // same skip accounting as the request/response phases.
       onSkip: ({ reason, detail }) => recordSkip("egress", reason, detail),
       dnsScreen: options.screenDns !== false,
-      allowHosts: options.allowHosts
+      allowHosts
     });
   }
   const cwd = options.cwd ?? (typeof process !== "undefined" ? process.cwd() : void 0);
@@ -7378,20 +7632,20 @@ function requestMetaFromContext(reqCtx) {
 }
 function requestMeta(shaped, request) {
   const client = shaped?._clientIp ?? { ip: null, source: "unavailable" };
-  let path7 = null;
+  let path8 = null;
   let method = null;
   let userAgent = null;
   if (request) {
     try {
       const u = new URL(request.url);
-      path7 = u.pathname + u.search;
+      path8 = u.pathname + u.search;
     } catch {
-      path7 = typeof request.url === "string" ? request.url : null;
+      path8 = typeof request.url === "string" ? request.url : null;
     }
     method = request.method ?? null;
     userAgent = request.headers?.get?.("user-agent") ?? null;
   }
-  return { method, path: path7, ip: client.ip, clientIpSource: client.source, userAgent, event: eventFor(request) };
+  return { method, path: path8, ip: client.ip, clientIpSource: client.source, userAgent, event: eventFor(request) };
 }
 function nodeRequestMeta(req, client) {
   if (!req) return {};