@patchstack/connect 0.5.0 → 0.5.2

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "fs";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
 import { createRequire as createRequire2 } from "module";
 
 // src/parsers/index.ts
@@ -1210,8 +1210,8 @@ function computeManifestChecksum(packages) {
 var TOKEN_SKEW_MS = 6e4;
 function buildTokenUrl(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path13 = url.pathname.replace(/\/$/, "");
-  url.pathname = path13.endsWith("/manifest") ? `${path13.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  const path14 = url.pathname.replace(/\/$/, "");
+  url.pathname = path14.endsWith("/manifest") ? `${path14.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1291,6 +1291,25 @@ async function pulseFetch(config, url, init, fetchImpl = fetch) {
 // src/client.ts
 var DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
 var DEFAULT_TIMEOUT_MS = 3e4;
+var CLAIM_TOKEN_HEADER = "X-Patchstack-Claim-Token";
+function claimTokenHeader(config) {
+  return typeof config.claimToken === "string" && config.claimToken !== "" ? { [CLAIM_TOKEN_HEADER]: config.claimToken } : {};
+}
+function claimOutcomeLines(claim3, config) {
+  if (typeof config.claimToken !== "string" || config.claimToken === "") return [];
+  if (claim3?.state === "claimed" || claim3?.state === "owned-by-you") {
+    const dashboard = typeof claim3.dashboard_url === "string" && claim3.dashboard_url !== "" ? [`Dashboard: ${claim3.dashboard_url}`] : [];
+    return [
+      claim3.state === "claimed" ? "Connected to your Patchstack account." : "This site is already connected to your Patchstack account.",
+      ...dashboard
+    ];
+  }
+  const why = claim3 === void 0 ? "Patchstack did not act on the claim token" : claim3.state === "owned-by-other" ? "this site belongs to a different Patchstack account" : claim3.reason === "expired" ? "the claim token has expired" : "Patchstack did not recognise the claim token";
+  return [
+    `Not connected to your account: ${why}.`,
+    "Open the dashboard link below to connect it, or copy a fresh prompt from the dashboard."
+  ];
+}
 function buildEndpointUrl(base, siteUuid) {
   const trimmed = base.replace(/\/$/, "");
   return siteUuid !== void 0 && siteUuid !== null && siteUuid.length > 0 ? `${trimmed}/${encodeURIComponent(siteUuid)}` : trimmed;
@@ -1310,8 +1329,8 @@ function authFailureMessage(status, config) {
 }
 function buildRulesUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path13 = url.pathname.replace(/\/$/, "");
-  url.pathname = path13.endsWith("/manifest") ? `${path13.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
+  const path14 = url.pathname.replace(/\/$/, "");
+  url.pathname = path14.endsWith("/manifest") ? `${path14.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1326,16 +1345,16 @@ function buildSettingsUrl(endpoint, siteUuid) {
 }
 function buildPackageRemovedUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path13 = url.pathname.replace(/\/$/, "");
-  url.pathname = path13.endsWith("/manifest") ? `${path13.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
+  const path14 = url.pathname.replace(/\/$/, "");
+  url.pathname = path14.endsWith("/manifest") ? `${path14.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
 }
 function buildInputMapUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path13 = url.pathname.replace(/\/$/, "");
-  url.pathname = path13.endsWith("/manifest") ? `${path13.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
+  const path14 = url.pathname.replace(/\/$/, "");
+  url.pathname = path14.endsWith("/manifest") ? `${path14.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1454,7 +1473,8 @@ async function postManifest(config, payload) {
       headers: {
         "Content-Type": "application/json",
         Accept: "application/json",
-        "User-Agent": "@patchstack/connect"
+        "User-Agent": "@patchstack/connect",
+        ...claimTokenHeader(config)
       },
       body: JSON.stringify(buildManifestBody(config, payload)),
       signal: AbortSignal.timeout(timeoutMs)
@@ -1670,7 +1690,7 @@ async function waitForDemoRule(manifestEndpoint, siteUuid, scenario, options = {
   const pollIntervalMs = options.pollIntervalMs ?? 1e3;
   const requestTimeoutMs = options.requestTimeoutMs ?? 1e4;
   const fetchFn = options.fetchFn ?? fetch;
-  const sleep = options.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve4) => setTimeout(resolve4, ms)));
   const now = options.now ?? Date.now;
   const started = now();
   const rulesUrl = buildRulesUrl(manifestEndpoint, siteUuid);
@@ -1944,6 +1964,7 @@ async function resolveConfig(options) {
   const apiKeyRaw = fromEnv.apiKey ?? fromSecretFile.apiKey ?? fromFile.apiKey ?? null;
   const pulseAuthRaw = fromEnv.pulseAuth ?? fromSecretFile.pulseAuth ?? fromFile.pulseAuth ?? apiKeyRaw;
   const identity = options.detectSiteIdentity === true ? await resolveSiteIdentity(options.cwd, fromEnv, fromFile) : { url: null, name: null };
+  const claimToken = stated(options.cliClaimToken) ?? stated(process.env.PATCHSTACK_CLAIM_TOKEN);
   return {
     siteUuid: siteUuid === null || siteUuid.length === 0 ? null : siteUuid,
     apiKey: apiKeyRaw === null || apiKeyRaw.length === 0 ? null : apiKeyRaw,
@@ -1953,7 +1974,8 @@ async function resolveConfig(options) {
     endpoint,
     timeoutMs,
     environment,
-    widget: fromFile.widget !== false
+    widget: fromFile.widget !== false,
+    claimToken
   };
 }
 async function writeConfigFile(cwd, config) {
@@ -2989,6 +3011,112 @@ import { join as join10, dirname as dirname5 } from "path";
 import { execFileSync } from "child_process";
 import { existsSync as existsSync7 } from "fs";
 import { dirname as dirname4, join as join9, resolve } from "path";
+
+// src/protect/install/node-flags.ts
+var flagName = (token) => token.split("=")[0];
+var NO_OPERAND_FLAGS = /* @__PURE__ */ new Set([
+  "--disallow-code-generation-from-strings",
+  "--enable-source-maps",
+  "--experimental-import-meta-resolve",
+  "--experimental-json-modules",
+  "--experimental-vm-modules",
+  "--frozen-intrinsics",
+  "--no-deprecation",
+  "--no-warnings",
+  "--pending-deprecation",
+  "--preserve-symlinks",
+  "--preserve-symlinks-main",
+  "--throw-deprecation",
+  "--trace-deprecation",
+  "--trace-exit",
+  "--trace-uncaught",
+  "--trace-warnings",
+  "--use-strict",
+  "--zero-fill-buffers"
+]);
+var VALUED_FLAGS = /* @__PURE__ */ new Set([
+  "--dns-result-order",
+  "--max-http-header-size",
+  "--max-old-space-size",
+  "--max-semi-space-size",
+  "--stack-size",
+  "--title",
+  "--unhandled-rejections"
+]);
+var CODE_LOADING_FLAGS = /* @__PURE__ */ new Set([
+  "--require",
+  "-r",
+  "--import",
+  "--loader",
+  "--experimental-loader",
+  "--eval",
+  "-e",
+  "--print",
+  "-p",
+  "--inspect",
+  "--inspect-brk",
+  "--inspect-wait",
+  "--inspect-port",
+  "--debug",
+  "--debug-brk"
+]);
+var TAKES_NEXT_TOKEN = /* @__PURE__ */ new Set(["--require", "-r", "--import", "--loader", "--experimental-loader", "--eval", "-e", "--print", "-p", "--inspect-port"]);
+function tokenizeNodeOptions(value) {
+  const tokens = [];
+  let current = "";
+  let quoted = false;
+  let started = false;
+  for (const ch of value) {
+    if (ch === '"') {
+      quoted = !quoted;
+      started = true;
+      continue;
+    }
+    if (!quoted && /\s/.test(ch)) {
+      if (started) tokens.push(current);
+      current = "";
+      started = false;
+      continue;
+    }
+    current += ch;
+    started = true;
+  }
+  if (quoted) return null;
+  if (started) tokens.push(current);
+  return tokens;
+}
+function classifyNodeOptions(value) {
+  const tokens = tokenizeNodeOptions(value);
+  if (tokens === null) return { kind: "refused", why: "NODE_OPTIONS has an unbalanced double quote, so this cannot read it the way Node will" };
+  for (const token of tokens) {
+    const name = flagName(token);
+    if (CODE_LOADING_FLAGS.has(name)) {
+      return { kind: "refused", why: `NODE_OPTIONS carries ${name}, which runs code or opens a port before the listener reporter is in place` };
+    }
+    if (NO_OPERAND_FLAGS.has(token)) continue;
+    if (token.includes("=") && VALUED_FLAGS.has(name)) continue;
+    return { kind: "refused", why: `NODE_OPTIONS carries ${name}, which this does not recognise well enough to say what it does` };
+  }
+  return { kind: "safe" };
+}
+function withoutCodeLoading(value) {
+  if (value === void 0 || value.trim() === "") return "";
+  const tokens = tokenizeNodeOptions(value);
+  if (tokens === null) return "";
+  const kept = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i];
+    const name = flagName(token);
+    if (CODE_LOADING_FLAGS.has(name)) {
+      if (!token.includes("=") && TAKES_NEXT_TOKEN.has(name)) i++;
+      continue;
+    }
+    if (NO_OPERAND_FLAGS.has(token) || token.includes("=") && VALUED_FLAGS.has(name)) kept.push(token);
+  }
+  return kept.map((token) => /\s/.test(token) ? `"${token}"` : token).join(" ");
+}
+
+// src/protect/install/source-scope.ts
 var IMPORT_LINE = /^\s*(?:import\b|export\s+(?:\*|\{)|(?:const|let|var)\s+[^=]+=\s*require\()/;
 function lastTopLevelImportLine(source) {
   const lines = source.split("\n");
@@ -3067,7 +3195,10 @@ function advanceDepth(line, inBlockComment, add) {
 function parses(filePath) {
   if (!/\.(?:js|cjs|mjs)$/.test(filePath)) return null;
   try {
-    execFileSync(process.execPath, ["--check", filePath], { stdio: "pipe" });
+    execFileSync(process.execPath, ["--check", filePath], {
+      stdio: "pipe",
+      env: { ...process.env, NODE_OPTIONS: withoutCodeLoading(process.env.NODE_OPTIONS) }
+    });
     return true;
   } catch (error) {
     return isSyntaxError(error) ? false : null;
@@ -4336,12 +4467,15 @@ function renderGuideChecklist(state, useColor) {
       lines.push(detail(`${check.label}${check.hint ? ` \u2014 ${check.hint}` : ""}`));
     }
     lines.push(detail("Verify \u2192 npx @patchstack/connect protect --check"));
+    lines.push(detail("Prove a request reaches the guard (starts your app) \u2192 npx @patchstack/connect protect --check --runtime"));
   }
   lines.push("");
   if (state.claimUrl !== null) {
     lines.push(` ${paint(ANSI.cyan, "\u279C")} ${paint(ANSI.bold, "Dashboard link (open to view reports):")}`);
     lines.push(`   ${paint(ANSI.cyan, state.claimUrl)}`);
     lines.push(detail("Open this link in a browser. The CLI never opens it."));
+    lines.push(detail("Or from this terminal \u2192 npx @patchstack/connect claim"));
+    lines.push(detail("  (prints a link to sign in with, then attaches the site to that account)"));
     if (state.endpointOverride !== null) {
       lines.push(detail("(this URL inherits the endpoint override above)"));
     }
@@ -4384,7 +4518,12 @@ function renderGuideChecklist(state, useColor) {
 }
 
 // src/login.ts
-import { mkdtempSync, readFileSync as readFileSync7, rmSync, writeFileSync as writeFileSync7 } from "fs";
+import { mkdtempSync } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import path12 from "path";
+
+// src/device-flow.ts
+import { readFileSync as readFileSync7, rmSync, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir } from "os";
 import path11 from "path";
 import { createHash as createHash2 } from "crypto";
@@ -4396,108 +4535,126 @@ function baseFrom(manifestEndpoint) {
   url.hash = "";
   return url.toString().replace(/\/$/, "");
 }
-function pendingPath(siteUuid) {
+function pendingPath(siteUuid, intent) {
   const key = createHash2("sha256").update(siteUuid).digest("hex").slice(0, 16);
-  return path11.join(tmpdir(), `patchstack-login-${key}.json`);
+  return path11.join(tmpdir(), `patchstack-${intent}-${key}.json`);
 }
-function savePendingLogin(siteUuid, pending) {
-  writeFileSync7(pendingPath(siteUuid), JSON.stringify(pending), { encoding: "utf8", mode: 384 });
+function savePending(siteUuid, intent, pending) {
+  writeFileSync7(pendingPath(siteUuid, intent), JSON.stringify(pending), {
+    encoding: "utf8",
+    mode: 384
+  });
 }
-function readPendingLogin(siteUuid) {
+function readPending(siteUuid, intent) {
   try {
-    return JSON.parse(readFileSync7(pendingPath(siteUuid), "utf8"));
+    return JSON.parse(readFileSync7(pendingPath(siteUuid, intent), "utf8"));
   } catch {
     return null;
   }
 }
-function clearPendingLogin(siteUuid) {
+function clearPending(siteUuid, intent) {
   try {
-    rmSync(pendingPath(siteUuid));
+    rmSync(pendingPath(siteUuid, intent));
   } catch {
   }
 }
-async function startLogin(config, deps = {}) {
+async function requestDeviceCode(config, intent, conflictMessage, deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
   const now = deps.now ?? (() => Date.now());
   if (config.siteUuid === null) {
-    return { status: "failed", message: "No site UUID configured \u2014 run `patchstack-connect scan` first." };
-  }
-  const base = baseFrom(config.endpoint);
-  const started = await fetchImpl(`${base}/device/code`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({ site_uuid: config.siteUuid })
-  });
-  if (started.status === 409) {
     return {
-      status: "unclaimed",
-      message: "This site has not been claimed yet, so there is no owner to approve the request. Claim it in the dashboard, or delete .patchstackrc.json to provision a new site."
+      status: "failed",
+      message: "No site UUID configured \u2014 run `patchstack-connect scan` first."
     };
   }
+  const base = baseFrom(config.endpoint);
+  const started = await pulseFetch(
+    config,
+    `${base}/device/code`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify({ site_uuid: config.siteUuid, intent })
+    },
+    fetchImpl
+  );
+  if (started.status === 409) return { status: "conflict", message: conflictMessage };
   if (started.status === 404) {
     return { status: "not-found", message: "Patchstack does not recognise this site UUID." };
   }
   if (!started.ok) {
-    return { status: "failed", message: `Could not start the login (HTTP ${started.status}).` };
+    return { status: "failed", message: `Could not start the request (HTTP ${started.status}).` };
   }
   const body = await started.json();
   const pending = {
     deviceCode: body.device_code,
     userCode: body.user_code,
-    // Points at the API, which redirects to the dashboard SPA — the CLI only
-    // knows the API origin, and the approval page lives on the app.
+    // Points at the API, which redirects to the dashboard SPA — the CLI only knows the API origin,
+    // and the approval page lives on the app.
     verificationUri: `${base}/device?code=${encodeURIComponent(body.user_code)}`,
     expiresAt: now() + body.expires_in * 1e3,
     intervalMs: Math.max(1, body.interval) * 1e3
   };
-  savePendingLogin(config.siteUuid, pending);
+  savePending(config.siteUuid, intent, pending);
   return { status: "started", pending };
 }
-async function redeemIfApproved(config, pending, deps = {}) {
+async function pollDeviceToken(config, intent, pending, deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
   const polled = await fetchImpl(`${baseFrom(config.endpoint)}/device/token`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Accept: "application/json" },
     body: JSON.stringify({ device_code: pending.deviceCode })
   });
-  if (polled.status === 428) return "pending";
+  if (polled.status === 428) return { state: "pending" };
   if (!polled.ok) {
-    if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
-    return "expired";
+    if (config.siteUuid !== null) clearPending(config.siteUuid, intent);
+    return { state: "expired" };
   }
-  const { api_key: apiKey } = await polled.json();
-  if (typeof apiKey !== "string" || apiKey.length === 0) return "expired";
-  await persistApiKey(process.cwd(), apiKey);
-  if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
-  return "approved";
+  const body = await polled.json();
+  if (config.siteUuid !== null) clearPending(config.siteUuid, intent);
+  return { state: "approved", body };
 }
-async function waitForApproval(config, pending, deps = {}) {
-  const fetchImpl = deps.fetchImpl ?? fetch;
+async function pollUntilApproved(config, intent, pending, deps = {}) {
   const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const now = deps.now ?? (() => Date.now());
   const deadline = Math.min(pending.expiresAt, deps.until ?? pending.expiresAt);
-  const expired = { status: "expired", message: "The login request expired. Run the command again." };
   while (now() < deadline) {
     await sleep(pending.intervalMs);
-    const polled = await fetchImpl(`${baseFrom(config.endpoint)}/device/token`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Accept: "application/json" },
-      body: JSON.stringify({ device_code: pending.deviceCode })
-    });
-    if (polled.status === 428) continue;
-    if (!polled.ok) {
-      if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
-      return expired;
-    }
-    const { api_key: apiKey } = await polled.json();
-    if (typeof apiKey !== "string" || apiKey.length === 0) {
-      return { status: "failed", message: "Patchstack approved the request but returned no credential." };
-    }
-    await persistApiKey(process.cwd(), apiKey);
-    if (config.siteUuid !== null) clearPendingLogin(config.siteUuid);
-    return { status: "approved", userCode: pending.userCode, verificationUri: pending.verificationUri };
+    const outcome = await pollDeviceToken(config, intent, pending, deps);
+    if (outcome.state !== "pending") return outcome;
+  }
+  return { state: "expired" };
+}
+
+// src/login.ts
+var UNCLAIMED = "This site has not been claimed yet, so there is no owner to approve the request. Claim it with `patchstack-connect claim`, or delete .patchstackrc.json to provision a new site.";
+function readPendingLogin(siteUuid) {
+  return readPending(siteUuid, "login");
+}
+async function startLogin(config, deps = {}) {
+  const started = await requestDeviceCode(config, "login", UNCLAIMED, deps);
+  if (started.status === "conflict") return { status: "unclaimed", message: started.message };
+  return started;
+}
+async function redeemIfApproved(config, pending, deps = {}) {
+  const polled = await pollDeviceToken(config, "login", pending, deps);
+  if (polled.state !== "approved") return polled.state;
+  const apiKey = polled.body?.api_key;
+  if (typeof apiKey !== "string" || apiKey.length === 0) return "expired";
+  await persistApiKey(process.cwd(), apiKey);
+  return "approved";
+}
+async function waitForApproval(config, pending, deps = {}) {
+  const polled = await pollUntilApproved(config, "login", pending, deps);
+  if (polled.state === "expired") {
+    return { status: "expired", message: "The login request expired. Run the command again." };
+  }
+  const apiKey = polled.body?.api_key;
+  if (typeof apiKey !== "string" || apiKey.length === 0) {
+    return { status: "failed", message: "Patchstack approved the request but returned no credential." };
   }
-  return expired;
+  await persistApiKey(process.cwd(), apiKey);
+  return { status: "approved", userCode: pending.userCode, verificationUri: pending.verificationUri };
 }
 async function login(config, onPrompt, deps = {}) {
   const started = await startLogin(config, deps);
@@ -4508,16 +4665,546 @@ async function login(config, onPrompt, deps = {}) {
   return waitForApproval(config, started.pending, deps);
 }
 
+// src/claim.ts
+var ALREADY_CLAIMED = "This site is already attached to a Patchstack account. Nothing to claim \u2014 sign in at the dashboard to see it, or use `patchstack-connect login` if you need its credential back.";
+function readPendingClaim(siteUuid) {
+  return readPending(siteUuid, "claim");
+}
+async function startClaim(config, deps = {}) {
+  const started = await requestDeviceCode(config, "claim", ALREADY_CLAIMED, deps);
+  if (started.status === "conflict") return { status: "already-claimed", message: started.message };
+  return started;
+}
+async function settle(body) {
+  const account = typeof body?.account === "string" ? body.account : void 0;
+  const dashboardUrl = typeof body?.dashboard_url === "string" ? body.dashboard_url : void 0;
+  const apiKey = body?.api_key;
+  let credentialSaved = false;
+  if (typeof apiKey === "string" && apiKey.length > 0) {
+    await persistApiKey(process.cwd(), apiKey);
+    credentialSaved = true;
+  }
+  return { status: "claimed", account, dashboardUrl, credentialSaved };
+}
+async function redeemClaimIfApproved(config, pending, deps = {}) {
+  const polled = await pollDeviceToken(config, "claim", pending, deps);
+  if (polled.state === "pending") return "pending";
+  if (polled.state === "expired") {
+    return { status: "expired", message: "The claim request expired. Run the command again." };
+  }
+  return settle(polled.body);
+}
+async function waitForClaim(config, pending, deps = {}) {
+  const polled = await pollUntilApproved(config, "claim", pending, deps);
+  if (polled.state === "expired") {
+    return { status: "expired", message: "The claim request expired. Run the command again." };
+  }
+  return settle(polled.body);
+}
+async function claim2(config, onPrompt, deps = {}) {
+  const started = await startClaim(config, deps);
+  if (started.status !== "started" || started.pending === void 0) {
+    return {
+      status: started.status === "started" ? "failed" : started.status,
+      message: started.message
+    };
+  }
+  onPrompt(started.pending.userCode, started.pending.verificationUri);
+  return waitForClaim(config, started.pending, deps);
+}
+
+// src/protect/install/runtime/check.ts
+import { relative as relative2 } from "path";
+
+// src/protect/install/runtime/entry.ts
+import { existsSync as existsSync13, readFileSync as readFileSync8, realpathSync, statSync as statSync3 } from "fs";
+import { join as join13, resolve as resolve3, sep } from "path";
+var CONVENTIONAL = [
+  "server.js",
+  "server.mjs",
+  "server.cjs",
+  "app.js",
+  "app.mjs",
+  "app.cjs",
+  "index.js",
+  "index.mjs",
+  "index.cjs",
+  "src/server.js",
+  "src/server.mjs",
+  "src/server.cjs",
+  "src/index.js",
+  "src/index.mjs",
+  "src/index.cjs",
+  "dist/server.js",
+  "dist/index.js",
+  "dist/main.js",
+  "build/index.js",
+  "build/server.js"
+];
+var LOADABLE = /\.(?:js|mjs|cjs)$/;
+function readPackage2(cwd) {
+  try {
+    const parsed = JSON.parse(readFileSync8(join13(cwd, "package.json"), "utf8"));
+    return parsed !== null && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function isFile(path14) {
+  try {
+    return statSync3(path14).isFile();
+  } catch {
+    return false;
+  }
+}
+function loadable(cwd, candidate) {
+  const written = resolve3(cwd, candidate);
+  if (!LOADABLE.test(written) || !isFile(written)) return null;
+  let root;
+  let path14;
+  try {
+    root = realpathSync(cwd);
+    path14 = realpathSync(written);
+  } catch {
+    return null;
+  }
+  if (path14 !== root && !path14.startsWith(root + sep)) return null;
+  return written;
+}
+function passable(token) {
+  if (CODE_LOADING_FLAGS.has(flagName(token))) return false;
+  if (NO_OPERAND_FLAGS.has(token)) return true;
+  return token.includes("=") && VALUED_FLAGS.has(flagName(token));
+}
+function fromScript(cwd, script) {
+  if (/[&|;><()#$`'"*?\[\]{}\\~\r\n]/.test(script)) return null;
+  const parts = script.trim().split(/\s+/);
+  if (parts[0] !== "node") return null;
+  const nodeArgs = [];
+  let rest = parts.slice(1);
+  while (rest.length > 0 && rest[0].startsWith("-")) {
+    const token = rest[0];
+    if (!passable(token)) return null;
+    nodeArgs.push(token);
+    rest = rest.slice(1);
+  }
+  if (rest.length === 0) return null;
+  const file = loadable(cwd, rest[0]);
+  return file === null ? null : { file, nodeArgs, appArgs: rest.slice(1) };
+}
+function resolveEntry(cwd) {
+  const pkg = readPackage2(cwd);
+  const scripts = pkg?.scripts ?? null;
+  const declared = ["start", "serve"].map((name) => ({ name, script: scripts?.[name] })).find((entry) => typeof entry.script === "string" && entry.script.trim() !== "");
+  if (declared !== void 0) {
+    const resolved = fromScript(cwd, declared.script);
+    return resolved === null ? {
+      kind: "unavailable",
+      reason: `the "${declared.name}" script is outside the bounded \`node <file>\` form this check can launch without the project's own toolchain`
+    } : { kind: "entry", ...resolved, from: `the "${declared.name}" script` };
+  }
+  const main2 = pkg?.main;
+  if (typeof main2 === "string") {
+    const file = loadable(cwd, main2);
+    if (file !== null) return { kind: "entry", file, nodeArgs: [], appArgs: [], from: 'the package "main" field' };
+  }
+  for (const candidate of CONVENTIONAL) {
+    const file = loadable(cwd, candidate);
+    if (file !== null) return { kind: "entry", file, nodeArgs: [], appArgs: [], from: candidate };
+  }
+  return {
+    kind: "unavailable",
+    reason: existsSync13(join13(cwd, "package.json")) ? 'no directly loadable entry was found \u2014 declare one as a "start" script of the form `node <file>`, or run the check against a built output' : "there is no package.json here"
+  };
+}
+
+// src/protect/install/runtime/probe.ts
+import { spawn } from "child_process";
+import { createHash as createHash3, randomBytes } from "crypto";
+import { existsSync as existsSync14 } from "fs";
+import { request as httpRequest } from "http";
+import { request as httpsRequest, Agent as HttpsAgent } from "https";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var CHALLENGE_BYTES = 32;
+var VERIFY_HEADER_NAME = "x-patchstack-verify";
+var CHALLENGE_ENV = "PATCHSTACK_VERIFY_CHALLENGE";
+var SETTLE_MS = 1500;
+var RUN_MS = 2e4;
+var PROBE_MS = 5e3;
+var FREEZE_MS = 500;
+var OUTPUT_LIMIT = 4096;
+var REDACTION_OVERLAP = 256;
+var ANSWER_LIMIT = 8192;
+var LOOPBACK = ["127.0.0.1", "::1"];
+var ENDING_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP", "SIGQUIT"];
+function expectedAnswerFor(challenge) {
+  return createHash3("sha256").update(`patchstack-verify:${challenge}`).digest("hex");
+}
+function preloadPath() {
+  const candidates = [
+    new URL("./protect/runtime/report-listeners.cjs", import.meta.url),
+    // beside the built CLI
+    new URL("./report-listeners.cjs", import.meta.url)
+    // beside this file, in the repository
+  ];
+  for (const candidate of candidates) {
+    const path14 = fileURLToPath2(candidate);
+    if (existsSync14(path14)) return path14;
+  }
+  return null;
+}
+function propagatedNodeOptions(preload, existing) {
+  if (preload.includes('"')) {
+    return {
+      kind: "unavailable",
+      reason: "the path to the listener reporter contains a double quote, which NODE_OPTIONS cannot carry \u2014 so a worker thread could not inherit the listener containment"
+    };
+  }
+  const ours = `--require "${preload}"`;
+  if (existing === void 0 || existing.trim() === "") return { kind: "options", value: ours };
+  const verdict = classifyNodeOptions(existing);
+  return verdict.kind === "refused" ? { kind: "unavailable", reason: verdict.why } : { kind: "options", value: `${ours} ${existing}` };
+}
+function keptOutput(chunks, challenge, answer) {
+  const text = chunks.join("").split(challenge).join("<challenge>").split(answer).join("<answer>");
+  return text.slice(0, OUTPUT_LIMIT);
+}
+async function askListener(listener, challenge, answer, budgetMs) {
+  if (budgetMs <= 0) {
+    return { ...listener, outcome: "unreachable", detail: "the run ran out of time before it could be asked" };
+  }
+  const send = listener.scheme === "https" ? httpsRequest : httpRequest;
+  const options = {
+    host: listener.host,
+    port: listener.port,
+    path: "/",
+    method: "GET",
+    headers: { [VERIFY_HEADER_NAME]: challenge },
+    timeout: budgetMs
+  };
+  if (listener.scheme === "https") options.agent = new HttpsAgent({ rejectUnauthorized: false });
+  return new Promise((resolve4) => {
+    const req = send(options, (res) => {
+      const body = [];
+      let read2 = 0;
+      res.on("data", (chunk) => {
+        read2 += chunk.length;
+        if (read2 <= ANSWER_LIMIT) {
+          body.push(chunk);
+          return;
+        }
+        res.destroy();
+      });
+      const finish = () => {
+        const text = Buffer.concat(body).toString("utf8").trim();
+        resolve4({
+          ...listener,
+          outcome: text === answer ? "traversed" : "answered-without-sentinel",
+          detail: text === answer ? void 0 : `answered with ${res.statusCode ?? "?"} and no sentinel`
+        });
+      };
+      res.on("end", finish);
+      res.on("close", finish);
+    });
+    req.on("timeout", () => req.destroy(new Error("timed out")));
+    req.on("error", (err) => resolve4({ ...listener, outcome: "unreachable", detail: err.message }));
+    req.end();
+  });
+}
+function verdictOf(listeners) {
+  if (listeners.length === 0 || listeners.some((l) => l.outcome === "unreachable")) return "unavailable";
+  if (listeners.some((l) => l.outcome === "answered-without-sentinel")) return "not-traversed";
+  return "proven";
+}
+function terminator(child) {
+  let done = false;
+  return () => {
+    if (done) return;
+    done = true;
+    try {
+      if (child.pid !== void 0) process.kill(-child.pid, "SIGKILL");
+    } catch {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+    }
+  };
+}
+async function probeRuntimeTraversal(options) {
+  const platform = options.platform ?? process.platform;
+  const challenge = randomBytes(CHALLENGE_BYTES).toString("hex");
+  const answer = expectedAnswerFor(challenge);
+  const nothing = (reason) => ({ outcome: "unavailable", reason, listeners: [], output: "" });
+  if (platform === "win32") return nothing("process-tree cleanup is not implemented on Windows");
+  const preload = options.preload ?? preloadPath();
+  if (preload === null) return nothing("the listener reporter is missing from this installation");
+  const deadline = Date.now() + (options.timeoutMs ?? RUN_MS);
+  const remaining = () => Math.max(0, deadline - Date.now());
+  const propagation = propagatedNodeOptions(preload, process.env.NODE_OPTIONS);
+  if (propagation.kind === "unavailable") return nothing(propagation.reason);
+  let detachMessages = () => {
+  };
+  const child = spawn(process.execPath, [...options.nodeArgs ?? [], "--require", preload, options.entry, ...options.appArgs ?? []], {
+    cwd: options.cwd,
+    detached: true,
+    // its own process group, so cleanup has one stable target
+    stdio: ["ignore", "pipe", "pipe", "ipc"],
+    // The app's own environment, plus the challenge and the propagated reporter. `NODE_ENV` is
+    // deliberately left alone: choosing one here would change which code path the app takes, and the
+    // point is to verify the app as it is.
+    env: {
+      ...process.env,
+      [CHALLENGE_ENV]: challenge,
+      // Replaced rather than added to: what may be inherited was decided above, and the reporter is
+      // first in the value that goes out.
+      NODE_OPTIONS: propagation.value
+    }
+  });
+  const terminate = terminator(child);
+  const onSignal = (signal) => {
+    terminate();
+    detachHandlers();
+    if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
+  };
+  const onExit = () => terminate();
+  const detachHandlers = () => {
+    for (const signal of ENDING_SIGNALS) process.removeListener(signal, onSignal);
+    process.removeListener("exit", onExit);
+  };
+  for (const signal of ENDING_SIGNALS) process.prependListener(signal, onSignal);
+  process.on("exit", onExit);
+  try {
+    const chunks = [];
+    let kept = 0;
+    const drain = (stream) => {
+      stream?.setEncoding("utf8");
+      stream?.on("data", (chunk) => {
+        if (kept < OUTPUT_LIMIT + REDACTION_OVERLAP) {
+          chunks.push(chunk);
+          kept += chunk.length;
+        }
+      });
+    };
+    drain(child.stdout);
+    drain(child.stderr);
+    const observed = [];
+    const unsupported = [];
+    const created = [];
+    const workers = [];
+    const late = [];
+    const escaped = [];
+    let loaded = false;
+    let startFailure = null;
+    let exitHow = null;
+    let discovering = true;
+    let onFrozen = null;
+    const freeze = async () => {
+      if (!child.connected) return false;
+      return new Promise((resolve4) => {
+        const settle2 = (confirmed2) => {
+          clearTimeout(timer);
+          onFrozen = null;
+          child.removeListener("exit", onGone);
+          resolve4(confirmed2);
+        };
+        const onGone = () => settle2(false);
+        const timer = setTimeout(() => settle2(false), Math.min(FREEZE_MS, remaining()));
+        onFrozen = () => settle2(true);
+        child.once("exit", onGone);
+        try {
+          child.send({ patchstackVerify: "freeze" });
+        } catch {
+          settle2(false);
+        }
+      });
+    };
+    await new Promise((resolve4) => {
+      let settleTimer = null;
+      const done = () => {
+        discovering = false;
+        clearTimeout(runTimer);
+        if (settleTimer) clearTimeout(settleTimer);
+        resolve4();
+      };
+      const runTimer = setTimeout(done, remaining());
+      const settle2 = () => {
+        if (settleTimer) clearTimeout(settleTimer);
+        settleTimer = setTimeout(done, Math.min(options.settleMs ?? SETTLE_MS, remaining()));
+      };
+      const onMessage = (message) => {
+        const note = message;
+        if (note?.patchstackVerify === "frozen") {
+          onFrozen?.();
+          return;
+        }
+        if (note?.patchstackVerify === "process-created" && typeof note.escape === "string") escaped.push(`${note.what ?? "a process"} ${note.escape}`);
+        if (note?.patchstackVerify === "worker-created" && typeof note.escape === "string") escaped.push(`a worker thread that ${note.escape}`);
+        if (!discovering) {
+          const kind = note?.patchstackVerify;
+          if (kind === "listener") late.push(`an ${note.scheme === "https" ? "HTTPS" : "HTTP"} listener on port ${Number(note.port)}`);
+          else if (kind === "unsupported-listener") late.push(`a listener this cannot probe (${note.why ?? "an unsupported transport"})`);
+          else if (kind === "process-created") late.push(`another process (${note.what ?? "a process"} via ${note.via ?? "child_process"})`);
+          else if (kind === "worker-created") late.push(`a worker thread (${note.what ?? "a worker"})`);
+          return;
+        }
+        if (note?.patchstackVerify === "listener" && (note.scheme === "http" || note.scheme === "https")) {
+          observed.push({ scheme: note.scheme, host: String(note.host), port: Number(note.port) });
+          settle2();
+        }
+        if (note?.patchstackVerify === "unsupported-listener") {
+          unsupported.push(note.why ?? "an unsupported transport");
+          done();
+        }
+        if (note?.patchstackVerify === "process-created") {
+          created.push(
+            `${note.what ?? "a process"} (via ${note.via ?? "child_process"})${note.node === true ? "" : ", which the listener reporter cannot reach"}`
+          );
+          done();
+        }
+        if (note?.patchstackVerify === "worker-created") {
+          workers.push(note.what ?? "a worker");
+          done();
+        }
+        if (note?.patchstackVerify === "ready") loaded = true;
+      };
+      child.on("message", onMessage);
+      detachMessages = () => child.removeListener("message", onMessage);
+      child.on("error", (err) => {
+        startFailure = `the app could not be started (${err.message})`;
+        done();
+      });
+      child.on("exit", (code, signal) => {
+        exitHow = signal ?? `code ${code}`;
+        done();
+      });
+    });
+    const offLoopback = observed.filter((l) => !LOOPBACK.includes(l.host));
+    const contained = unsupported.length === 0 && created.length === 0 && workers.length === 0 && offLoopback.length === 0;
+    const listeners = contained ? await Promise.all(observed.map((l) => askListener(l, challenge, answer, Math.min(PROBE_MS, remaining())))) : [];
+    const confirmed = await freeze();
+    const output = keptOutput(chunks, challenge, answer);
+    const pid = child.pid;
+    const exitNote = startFailure ?? (exitHow === null ? null : observed.length === 0 ? `the app exited before it listened (${exitHow})` : `the app exited while it was being probed (${exitHow})`);
+    if (escaped.length > 0) {
+      return {
+        outcome: "unavailable",
+        reason: `the app tried to start something outside this run's one-process scope, and it was refused: ${escaped.join("; ")}`,
+        listeners: [],
+        output,
+        pid
+      };
+    }
+    if (unsupported.length > 0) {
+      return { outcome: "unavailable", reason: `a listener this cannot probe: ${unsupported.join("; ")}`, listeners: [], output, pid };
+    }
+    if (created.length > 0) {
+      return {
+        outcome: "unavailable",
+        reason: `the app attempted to start another process, so this run cannot answer for the whole app: ${created.join("; ")}`,
+        listeners: [],
+        output,
+        pid
+      };
+    }
+    if (workers.length > 0) {
+      return {
+        outcome: "unavailable",
+        reason: `the app started a worker thread, whose listeners cannot report back to this run: ${workers.join("; ")}`,
+        listeners: [],
+        output,
+        pid
+      };
+    }
+    if (offLoopback.length > 0) {
+      return {
+        outcome: "unavailable",
+        reason: `a listener bound an address this verification must not open: ${offLoopback.map((l) => l.host).join("; ")}`,
+        listeners: [],
+        output,
+        pid
+      };
+    }
+    if (late.length > 0) {
+      return {
+        outcome: "unavailable",
+        reason: `the app was still opening things after discovery had ended, so this run cannot answer for the whole app: ${late.join("; ")}`,
+        listeners: [],
+        output,
+        pid
+      };
+    }
+    if (observed.length === 0) {
+      if (exitNote !== null) return { outcome: "unavailable", reason: exitNote, listeners: [], output, pid };
+      if (!loaded) {
+        return { outcome: "unavailable", reason: "the listener reporter did not load in the app process", listeners: [], output, pid };
+      }
+      return { outcome: "unavailable", reason: "no HTTP listener was observed while starting up", listeners: [], output, pid };
+    }
+    const unconfirmed = !confirmed && loaded && exitHow === null;
+    const outcome = unconfirmed && verdictOf(listeners) === "proven" ? "unavailable" : verdictOf(listeners);
+    const reason = outcome === "unavailable" ? exitNote ?? (unconfirmed ? "the app never confirmed it had stopped opening listeners, so one it opened last cannot be ruled out" : listeners.find((l) => l.outcome === "unreachable")?.detail ?? "a listener could not be reached") : void 0;
+    return { outcome, reason, listeners, output, pid };
+  } finally {
+    terminate();
+    detachHandlers();
+    detachMessages();
+  }
+}
+
+// src/protect/install/runtime/check.ts
+async function runRuntimeCheck(cwd, options = {}) {
+  const entry = resolveEntry(cwd);
+  if (entry.kind === "unavailable") return { outcome: "unavailable", reason: entry.reason, listeners: [], output: "" };
+  const result = await probeRuntimeTraversal({
+    cwd,
+    entry: entry.file,
+    nodeArgs: entry.nodeArgs,
+    appArgs: entry.appArgs,
+    timeoutMs: options.timeoutMs,
+    settleMs: options.settleMs,
+    platform: options.platform
+  });
+  return { ...result, entry: { file: relative2(cwd, entry.file).replace(/\\/g, "/"), from: entry.from } };
+}
+function runtimeExitCode(report) {
+  if (report.outcome === "proven") return 0;
+  return report.outcome === "not-traversed" ? 1 : 2;
+}
+function formatRuntimeCheck(report) {
+  const lines = ["runtime traversal (--runtime):"];
+  if (report.entry) lines.push(`  entry: ${report.entry.file} (from ${report.entry.from})`);
+  for (const listener of report.listeners) {
+    const mark = listener.outcome === "traversed" ? "\u2713" : listener.outcome === "answered-without-sentinel" ? "\u2717" : "?";
+    const note = listener.outcome === "traversed" ? "runtime traversal reached the scaffolded guard seam" : listener.outcome === "answered-without-sentinel" ? "the listener answered and the guard seam did not" : listener.detail ?? "could not be reached";
+    const authority = listener.host.includes(":") ? `[${listener.host}]` : listener.host;
+    lines.push(`  ${mark} ${listener.scheme}://${authority}:${listener.port} \u2014 ${note}`);
+  }
+  if (report.outcome === "proven") {
+    lines.push("runtime traversal reached the scaffolded guard seam \u2713");
+  } else if (report.outcome === "not-traversed") {
+    lines.push("runtime traversal did NOT reach the scaffolded guard seam \u2717");
+  } else {
+    lines.push(`? runtime traversal could not be established \u2014 ${report.reason ?? "no reason given"}`);
+    lines.push("  This is not a failure. The structural checks above still stand on their own.");
+  }
+  if (report.outcome !== "proven" && report.output.trim() !== "") {
+    lines.push("  the app printed:");
+    for (const line of report.output.trim().split("\n").slice(0, 20)) lines.push(`    ${line}`);
+  }
+  return lines;
+}
+
 // src/map-command.ts
 import { writeFileSync as writeFileSync8 } from "fs";
 
 // src/map/ts-loader.ts
 import { createRequire } from "module";
 import { pathToFileURL } from "url";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 async function loadTypeScript(cwd) {
   try {
-    const req = createRequire(pathToFileURL(join13(cwd, "package.json")));
+    const req = createRequire(pathToFileURL(join14(cwd, "package.json")));
     const resolved = req.resolve("typescript");
     const mod = await import(pathToFileURL(resolved).href);
     return mod.default ?? mod;
@@ -4532,9 +5219,9 @@ async function loadTypeScript(cwd) {
 }
 
 // src/map/extract.ts
-import { readFileSync as readFileSync12, realpathSync as realpathSync3 } from "fs";
-import { createHash as createHash4 } from "crypto";
-import { relative as relative4 } from "path";
+import { readFileSync as readFileSync13, realpathSync as realpathSync4 } from "fs";
+import { createHash as createHash5 } from "crypto";
+import { relative as relative5 } from "path";
 
 // src/map/ast.ts
 function rootIdentifier(node, ts) {
@@ -4788,8 +5475,8 @@ function npmPackageOf(spec) {
 }
 
 // src/map/sources.ts
-import { readFileSync as readFileSync8, readdirSync as readdirSync5, realpathSync, statSync as statSync3 } from "fs";
-import { join as join14, relative as relative2, isAbsolute } from "path";
+import { readFileSync as readFileSync9, readdirSync as readdirSync5, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
+import { join as join15, relative as relative3, isAbsolute } from "path";
 
 // src/map/routes.ts
 var ROUTE_REGISTER_NAMES = ["get", "post", "put", "patch", "delete", "options", "all", "head", "use"];
@@ -4873,7 +5560,7 @@ function hasEntrySignal(text) {
 }
 function detectFramework(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync8(join14(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync9(join15(cwd, "package.json"), "utf8"));
     const d = { ...pkg.dependencies, ...pkg.devDependencies };
     if (d["@tanstack/react-start"] || d["@tanstack/start"] || d["@tanstack/solid-start"]) return "tanstack-start";
     if (d["next"]) return "next";
@@ -4885,11 +5572,11 @@ function detectFramework(cwd) {
   } catch {
   }
   try {
-    if (statSync3(join14(cwd, "supabase", "functions")).isDirectory()) return "supabase-functions";
+    if (statSync4(join15(cwd, "supabase", "functions")).isDirectory()) return "supabase-functions";
   } catch {
   }
   try {
-    if (statSync3(join14(cwd, "functions")).isDirectory()) return "deno-functions";
+    if (statSync4(join15(cwd, "functions")).isDirectory()) return "deno-functions";
   } catch {
   }
   return "unknown";
@@ -4931,7 +5618,7 @@ function probeForSource(dir, budget) {
   for (const e of entries) {
     if (budget.left-- <= 0) return "unknown";
     if (e.isDirectory()) {
-      if (!SKIP_IS_DEFINITIONAL.has(e.name)) dirs.push(join14(dir, e.name));
+      if (!SKIP_IS_DEFINITIONAL.has(e.name)) dirs.push(join15(dir, e.name));
     } else if (isSourceFile(e.name)) return true;
     else if (e.isSymbolicLink()) return "unknown";
   }
@@ -4944,7 +5631,7 @@ function probeForSource(dir, budget) {
 function collectSources(dir, boundary, opts, out = [], seen = /* @__PURE__ */ new Set(), stats = { discovered: 0, unwalked: 0, skippedWithSource: [], skippedUnknown: 0 }, probeBudget = { left: PROBE_BUDGET }) {
   let key;
   try {
-    key = realpathSync(dir);
+    key = realpathSync2(dir);
   } catch {
     stats.unwalked++;
     return out;
@@ -4968,19 +5655,19 @@ function collectSources(dir, boundary, opts, out = [], seen = /* @__PURE__ */ ne
       const probeable = !SKIP_IS_DEFINITIONAL.has(e.name);
       if (probeable && !e.isDirectory() && e.isSymbolicLink()) stats.skippedUnknown++;
       else if (probeable && e.isDirectory()) {
-        const held = probeForSource(join14(dir, e.name), probeBudget);
-        if (held === true) stats.skippedWithSource.push(join14(dir, e.name));
+        const held = probeForSource(join15(dir, e.name), probeBudget);
+        if (held === true) stats.skippedWithSource.push(join15(dir, e.name));
         else if (held === "unknown") stats.skippedUnknown++;
       }
       continue;
     }
-    const full = join14(dir, e.name);
+    const full = join15(dir, e.name);
     if (e.isDirectory()) collectSources(full, boundary, opts, out, seen, stats, probeBudget);
     else if (e.isSymbolicLink()) {
       let st, real;
       try {
-        st = statSync3(full);
-        real = realpathSync(full);
+        st = statSync4(full);
+        real = realpathSync2(full);
       } catch {
         stats.unwalked++;
         continue;
@@ -5003,7 +5690,7 @@ function collectSources(dir, boundary, opts, out = [], seen = /* @__PURE__ */ ne
 }
 function isInside(candidate, boundary) {
   if (candidate === boundary) return true;
-  const rel = relative2(boundary, candidate);
+  const rel = relative3(boundary, candidate);
   return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
 }
 var DEPLOYMENT_SHAPES = [
@@ -5030,13 +5717,13 @@ var DEPLOYMENT_SHAPES = [
 function detectDeploymentShapes(cwd, opts = {}) {
   let boundary = opts.boundary ?? cwd;
   try {
-    boundary = realpathSync(boundary);
+    boundary = realpathSync2(boundary);
   } catch {
   }
-  const inProject = (path13) => {
+  const inProject = (path14) => {
     if (opts.followOutside) return true;
     try {
-      return isInside(realpathSync(path13), boundary);
+      return isInside(realpathSync2(path14), boundary);
     } catch {
       return false;
     }
@@ -5044,9 +5731,9 @@ function detectDeploymentShapes(cwd, opts = {}) {
   const found = [];
   for (const candidate of DEPLOYMENT_SHAPES) {
     for (const file of candidate.files ?? []) {
-      const full = join14(cwd, file);
+      const full = join15(cwd, file);
       try {
-        if (statSync3(full).isFile() && inProject(full)) {
+        if (statSync4(full).isFile() && inProject(full)) {
           found.push({ shape: candidate.shape, source: file, evidence: candidate.evidence });
           break;
         }
@@ -5054,9 +5741,9 @@ function detectDeploymentShapes(cwd, opts = {}) {
       }
     }
     for (const dir of candidate.dirs ?? []) {
-      const full = join14(cwd, dir);
+      const full = join15(cwd, dir);
       try {
-        if (!statSync3(full).isDirectory() || !inProject(full)) continue;
+        if (!statSync4(full).isDirectory() || !inProject(full)) continue;
       } catch {
         continue;
       }
@@ -5073,7 +5760,7 @@ function holdsFunctionEntry(dir) {
     for (const entry of readdirSync5(dir, { withFileTypes: true })) {
       if (!entry.isDirectory() || entry.name.startsWith("_")) continue;
       try {
-        for (const nested of readdirSync5(join14(dir, entry.name), { withFileTypes: true })) {
+        for (const nested of readdirSync5(join15(dir, entry.name), { withFileTypes: true })) {
           if (nested.isFile() && /^index\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/.test(nested.name)) return true;
         }
       } catch {
@@ -5089,7 +5776,7 @@ function holdsSourceFile(dir) {
       if (entry.isFile() && isSourceFile(entry.name)) return true;
       if (entry.isDirectory()) {
         try {
-          for (const nested of readdirSync5(join14(dir, entry.name), { withFileTypes: true })) {
+          for (const nested of readdirSync5(join15(dir, entry.name), { withFileTypes: true })) {
             if (nested.isFile() && isSourceFile(nested.name)) return true;
           }
         } catch {
@@ -5102,8 +5789,8 @@ function holdsSourceFile(dir) {
 }
 
 // src/map/surface.ts
-import { readFileSync as readFileSync9 } from "fs";
-import { join as join15 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { join as join16 } from "path";
 var STATIC_GENERATORS = [
   { dep: "vite", label: "vite" },
   { dep: "react-scripts", label: "create-react-app" },
@@ -5141,7 +5828,7 @@ var SHAPE_SIGNAL = {
 };
 function readManifest(cwd) {
   try {
-    const parsed = JSON.parse(readFileSync9(join15(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync10(join16(cwd, "package.json"), "utf8"));
     return typeof parsed === "object" && parsed !== null ? parsed : null;
   } catch {
     return null;
@@ -5154,7 +5841,7 @@ function nextExportsStatically(cwd, manifest, ts) {
   for (const file of ["next.config.js", "next.config.mjs", "next.config.ts", "next.config.cjs"]) {
     let text;
     try {
-      text = readFileSync9(join15(cwd, file), "utf8");
+      text = readFileSync10(join16(cwd, file), "utf8");
     } catch {
       continue;
     }
@@ -5282,7 +5969,7 @@ function surfaceNote(surface) {
 }
 
 // src/map/sinks.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var DB_OPS = /* @__PURE__ */ new Set(["insert", "update", "delete", "select", "upsert", "rpc"]);
 var PRISMA_OPS = /* @__PURE__ */ new Set(["create", "createMany", "update", "updateMany", "delete", "deleteMany", "upsert", "findFirst", "findUnique", "findMany", "count", "aggregate"]);
 var FS_CALLS = /^(readFile|writeFile|readFileSync|writeFileSync|appendFile|createReadStream|createWriteStream|unlink|rm|rmSync|mkdir|readdir|stat|open)$/;
@@ -5381,14 +6068,14 @@ function directSinks(node, ts, bindings, ctx) {
     const root = base ? rootIdentifier(base, ts) : void 0;
     if (!root) return {};
     const spec = bindings.resolve(root);
-    const relative5 = spec !== void 0 && (spec.startsWith(".") || spec.startsWith("/"));
+    const relative6 = spec !== void 0 && (spec.startsWith(".") || spec.startsWith("/"));
     const pkg = npmPackageOf(spec);
     if (pkg) return { pkg, root, spec };
-    if (relative5 && ctx && spec) {
+    if (relative6 && ctx && spec) {
       const viaModule = ctx.graph.importedBinding(ctx.file, spec, bindings.exportNameOf(root) ?? root);
       if (viaModule) return { pkg: viaModule.package, root, spec };
     }
-    return { local: bindings.locals.has(root), root, spec, relative: relative5 };
+    return { local: bindings.locals.has(root), root, spec, relative: relative6 };
   };
   const attributionOf = (b, pkg) => b.pkg ? "import" : pkg ? "inferred" : void 0;
   const dbApi = (pkg, attribution) => {
@@ -5549,7 +6236,7 @@ function argumentRoleOf(sinkKind, method, index, total = 0) {
   return table?.[index] ?? "unknown";
 }
 function sinkId(s, owner) {
-  return createHash3("sha256").update([s.kind, s.provider, s.package, s.table, s.op, s.file ?? owner, s.start, s.end].join("|")).digest("hex").slice(0, 12);
+  return createHash4("sha256").update([s.kind, s.provider, s.package, s.table, s.op, s.file ?? owner, s.start, s.end].join("|")).digest("hex").slice(0, 12);
 }
 function dedupeSinks(sinks, owner) {
   const seen = /* @__PURE__ */ new Set();
@@ -5565,8 +6252,8 @@ function dedupeSinks(sinks, owner) {
 }
 
 // src/map/module-graph.ts
-import { readFileSync as readFileSync10, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
-import { dirname as dirname7, join as join16, relative as relative3, resolve as resolvePath } from "path";
+import { readFileSync as readFileSync11, realpathSync as realpathSync3, statSync as statSync5 } from "fs";
+import { dirname as dirname7, join as join17, relative as relative4, resolve as resolvePath } from "path";
 var RESOLVE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 function createModuleGraph(ts, opts) {
   const cache = /* @__PURE__ */ new Map();
@@ -5574,7 +6261,7 @@ function createModuleGraph(ts, opts) {
     if (cache.has(file)) return cache.get(file) ?? null;
     let entry = null;
     try {
-      const text = readFileSync10(file, "utf8");
+      const text = readFileSync11(file, "utf8");
       const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
       const bindings = buildModuleBindings(sf, ts);
       entry = { fnSinks: collectLocalSinks(sf, ts, bindings), calleesOf: collectCallees(sf, ts), bindings };
@@ -5590,7 +6277,7 @@ function createModuleGraph(ts, opts) {
     if (!opts.followOutside) {
       let real = target;
       try {
-        real = realpathSync2(target);
+        real = realpathSync3(target);
       } catch {
       }
       if (!isInside(real, opts.boundary)) return void 0;
@@ -5608,7 +6295,7 @@ function createModuleGraph(ts, opts) {
       for (const callee of mod.calleesOf.get(exportName) ?? []) {
         for (const s of mod.fnSinks.get(callee) ?? []) collected.push(s);
       }
-      const rel = relative3(opts.cwd, target);
+      const rel = relative4(opts.cwd, target);
       return collected.map((s) => ({ ...s, file: rel }));
     },
     // A different question about the same module: not "what sinks are in there" but "what does this
@@ -5644,10 +6331,10 @@ function resolveRelativeModule(fromFile, spec) {
   }
   candidates.push(base);
   for (const e of RESOLVE_EXTS) candidates.push(base + e);
-  for (const e of RESOLVE_EXTS) candidates.push(join16(base, "index" + e));
+  for (const e of RESOLVE_EXTS) candidates.push(join17(base, "index" + e));
   for (const c of candidates) {
     try {
-      if (statSync4(c).isFile()) return c;
+      if (statSync5(c).isFile()) return c;
     } catch {
     }
   }
@@ -5673,8 +6360,8 @@ function collectCallees(sf, ts) {
 }
 
 // src/map/coordinates.ts
-function runtimeCoordinate(source, path13) {
-  if (/\[\d*\]/.test(path13)) {
+function runtimeCoordinate(source, path14) {
+  if (/\[\d*\]/.test(path14)) {
     return { runtimeParameter: null, runtimeParameterReason: "array traversal: needs an array_key_value rule, not a dotted parameter" };
   }
   switch (source) {
@@ -5683,15 +6370,15 @@ function runtimeCoordinate(source, path13) {
     case "multipart":
     case "body":
     case "server-fn-data":
-      return { runtimeParameter: `post.${path13}` };
+      return { runtimeParameter: `post.${path14}` };
     case "query":
-      return { runtimeParameter: `get.${path13}` };
+      return { runtimeParameter: `get.${path14}` };
     case "cookie":
-      return { runtimeParameter: `cookie.${path13}` };
+      return { runtimeParameter: `cookie.${path14}` };
     case "file":
-      return { runtimeParameter: `files.${path13}` };
+      return { runtimeParameter: `files.${path14}` };
     case "header":
-      return { runtimeParameter: `server.HTTP_${path13.toUpperCase().replace(/-/g, "_")}` };
+      return { runtimeParameter: `server.HTTP_${path14.toUpperCase().replace(/-/g, "_")}` };
     case "route-param":
       return { runtimeParameter: null, runtimeParameterReason: "route parameters are not exposed by the runtime resolver" };
     default:
@@ -5723,8 +6410,8 @@ function addressSpaceOf(source) {
 function isProvenFlow(confidence) {
   return confidence === "exact-local" || confidence === "transformed-local";
 }
-function inputIdOf(source, path13) {
-  return `${addressSpaceOf(source)}:${path13}`;
+function inputIdOf(source, path14) {
+  return `${addressSpaceOf(source)}:${path14}`;
 }
 function withCoordinates(fields, source) {
   return fields.map((f) => {
@@ -5934,8 +6621,8 @@ function linkFlows(bodyNode, params, inputs, sinks, ts) {
   if (!bodyNode || sinks.length === 0 || inputs.length === 0) return { flows: [], limitations: [] };
   const CONTAINER_KEYS = /* @__PURE__ */ new Set([...REQ_SOURCES, "data", "input", "payload"]);
   const rootPath = /* @__PURE__ */ new Map();
-  const addRoot = (name, path13, space) => {
-    if (!rootPath.has(name)) rootPath.set(name, { path: path13, space });
+  const addRoot = (name, path14, space) => {
+    if (!rootPath.has(name)) rootPath.set(name, { path: path14, space });
   };
   for (const p of params ?? []) {
     if (!p?.name) continue;
@@ -6080,8 +6767,8 @@ function dedupeLimitations(list) {
 function join22(base, seg) {
   return base ? `${base}.${seg}` : seg;
 }
-function normalizePath(path13) {
-  return path13.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
+function normalizePath(path14) {
+  return path14.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
 }
 function fluentChainCalls(call, ts) {
   let root = call;
@@ -6327,8 +7014,8 @@ function handlerEntry(name, kindLabel, params, body, ts, localSinks, bindings, c
 }
 
 // src/map/imports.ts
-import { readFileSync as readFileSync11 } from "fs";
-import { join as join17 } from "path";
+import { readFileSync as readFileSync12 } from "fs";
+import { join as join18 } from "path";
 var MAX_SITES = 5;
 var NPM_NAME = /^(?:@[^/@\s~][^/@\s]*\/)?[^/@\s.~][^/@\s]*$/;
 function isNpmPackageName(pkg) {
@@ -6339,7 +7026,7 @@ function readPathAliases(cwd) {
   for (const name of ["tsconfig.json", "jsconfig.json"]) {
     let paths;
     try {
-      const raw = readFileSync11(join17(cwd, name), "utf8");
+      const raw = readFileSync12(join18(cwd, name), "utf8");
       const parsed = JSON.parse(stripJsonComments(raw));
       paths = parsed.compilerOptions?.paths;
     } catch {
@@ -6699,7 +7386,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   const failed = [];
   let boundary = cwd;
   try {
-    boundary = realpathSync3(cwd);
+    boundary = realpathSync4(cwd);
   } catch {
   }
   const graph = createModuleGraph(ts, { cwd, boundary, followOutside: options.followSymlinks });
@@ -6718,8 +7405,8 @@ async function extractInputMap(cwd, ts, options = {}) {
   const hopTargets = /* @__PURE__ */ new Set();
   for (const file of files) {
     try {
-      const text = readFileSync12(file, "utf8");
-      const relFile = relative4(cwd, file);
+      const text = readFileSync13(file, "utf8");
+      const relFile = relative5(cwd, file);
       sourceBytes += text.length;
       if (!hasEntrySignal(text)) {
         preFiltered++;
@@ -6731,7 +7418,7 @@ async function extractInputMap(cwd, ts, options = {}) {
       }
       parsed++;
       entryFiles.add(file);
-      const fingerprint = createHash4("sha256").update(text).digest("hex").slice(0, 16);
+      const fingerprint = createHash5("sha256").update(text).digest("hex").slice(0, 16);
       const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
       const bindings = buildModuleBindings(sf, ts);
       for (const specifier of bindings.imports) {
@@ -6765,7 +7452,7 @@ async function extractInputMap(cwd, ts, options = {}) {
       }
     } catch (e) {
       if (typeof process !== "undefined" && process.env?.PS_MAP_DEBUG) console.error("[patchstack] map error", file, e);
-      failed.push(relative4(cwd, file));
+      failed.push(relative5(cwd, file));
     }
   }
   let hopParsed = 0;
@@ -6773,10 +7460,10 @@ async function extractInputMap(cwd, ts, options = {}) {
   for (const target of hopTargets) {
     if (entryFiles.has(target)) continue;
     try {
-      const text = readFileSync12(target, "utf8");
+      const text = readFileSync13(target, "utf8");
       const sf = ts.createSourceFile(target, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, target));
       const bindings = buildModuleBindings(sf, ts);
-      const called = collectInvocations(sf, ts, bindings, { file: target, owner: relative4(cwd, target), graph });
+      const called = collectInvocations(sf, ts, bindings, { file: target, owner: relative5(cwd, target), graph });
       invocations.add(called.invocations);
       calls.total += called.counts.total;
       calls.dependency += called.counts.dependency;
@@ -6808,7 +7495,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   if (endpoints.length === 0) notes.push("No recognized server-side entry points found under the analyzed roots.");
   const importList = imports.list();
   const unmodelled = importList.filter((d) => d.recognizedSinkKinds.length === 0).length;
-  const skippedDirsWithSource = stats.skippedWithSource.map((d) => relative4(cwd, d));
+  const skippedDirsWithSource = stats.skippedWithSource.map((d) => relative5(cwd, d));
   const importCoverageGaps = {
     unreadableFiles: failed.length,
     unscannableFiles: importScanFailures,
@@ -6996,8 +7683,8 @@ async function runMap(flags) {
 }
 
 // src/setup.ts
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "fs";
-import path12 from "path";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
+import path13 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
 function setupProtection(cwd) {
@@ -7015,8 +7702,8 @@ function appendHook(existing, command) {
   return `${existing} && ${command}`;
 }
 function wireBuildScripts(cwd, packageManager) {
-  const target = path12.join(cwd, "package.json");
-  const raw = readFileSync13(target, "utf8");
+  const target = path13.join(cwd, "package.json");
+  const raw = readFileSync14(target, "utf8");
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
   const build = scripts.build;
@@ -7170,6 +7857,15 @@ Usage:
                                                      demonstrations, not production).
                                                      --check verifies the guard is wired (exit 1
                                                      if not) \u2014 for the wire-then-verify loop.
+                                                     It reads the app's source and never runs it.
+                                                     --check --runtime additionally STARTS THE APP
+                                                     on a loopback port and sends it one request,
+                                                     to establish that a request reaches the
+                                                     guard. Opt-in, and the only mode that runs
+                                                     the app. Exit 0 traversed, 1 a listener
+                                                     answered instead of the guard, 2 could not
+                                                     be established (e.g. a TypeScript or
+                                                     framework entry this must not start).
   patchstack-connect demo node-serialize [--url URL] Run the production-backed node-serialize
                                                      walkthrough: verify the vulnerable package,
                                                      scan it, wait for live rule 18843, install +
@@ -7182,6 +7878,20 @@ Usage:
                                                      what's missing, with tailored commands), then
                                                      print the full setup guide. --full prints the
                                                      guide even when setup is complete
+  patchstack-connect claim  [--wait]                 Attach this site to a Patchstack account from
+                                                     the terminal, so its reports become visible.
+                                                     Prints a link for the user to open and sign in
+                                                     (or sign up) \u2014 whoever approves becomes the
+                                                     site's owner. In a terminal it then waits. When
+                                                     the output is piped or captured \u2014 an assistant
+                                                     running it \u2014 it prints the link and EXITS, so
+                                                     the link is visible immediately. Run it AGAIN
+                                                     once the user confirms: it resumes the same
+                                                     request rather than starting a new one. --wait
+                                                     blocks instead of returning. Does not rotate
+                                                     the site's credential. The same claim can be
+                                                     done by opening the dashboard link that scan
+                                                     and status print. Not usable in CI
   patchstack-connect login  [--wait]                 Recover this site's credential when
                                                      .patchstackrc.local.json has been lost. Needs the
                                                      site UUID, which lives in the committed
@@ -7214,6 +7924,10 @@ Options (for scan, setup, status, and uninstall):
                           same under a workspace that pins its own copy), so an
                           advisory can be matched to the copy your code actually
                           loads. Off by default; never source file paths
+  --claim-token <token>   (scan, setup) Connect the site to the Patchstack account
+                          that issued the token \u2014 it comes from the dashboard's
+                          "Connect website" prompt. PATCHSTACK_CLAIM_TOKEN works
+                          too. Never written to a file, never printed back
 
 Options (for mark-build):
   --dir <path>            Build output directory (default: auto-detect
@@ -7247,7 +7961,7 @@ Examples:
   npx @patchstack/connect demo node-serialize
   npx @patchstack/connect demo-guide node-serialize
 `;
-var VALUE_FLAGS = /* @__PURE__ */ new Set(["site-uuid", "endpoint", "dir", "url", "out"]);
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["site-uuid", "endpoint", "dir", "url", "out", "claim-token"]);
 function parseArgs(argv) {
   const args = argv.slice(2);
   const positional = [];
@@ -7295,6 +8009,107 @@ async function runInit(args) {
   console.log("Next: run `npx @patchstack/connect scan` to send your first manifest.");
   return 0;
 }
+async function runClaim(args) {
+  if (process.env.CI !== void 0 && process.env.CI !== "" && process.env.CI !== "false") {
+    console.error("`claim` is interactive and cannot run in CI. Claim the site from a developer machine.");
+    return 1;
+  }
+  const config = await resolveConfig({
+    cwd: process.cwd(),
+    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
+    cliEndpoint: getStringFlag(args.flags, "endpoint")
+  });
+  const siteUuid = config.siteUuid;
+  if (siteUuid === null) {
+    console.error("\n  No site to claim yet \u2014 run `npx @patchstack/connect scan` first.\n");
+    return 1;
+  }
+  const settled = async (result2) => {
+    console.log(
+      `
+  \u2713 Site claimed${result2.account !== void 0 ? ` by ${result2.account}` : ""}.`
+    );
+    console.log(`    ${result2.dashboardUrl ?? buildClaimUrl(config.endpoint, siteUuid)}`);
+    if (result2.credentialSaved === true) {
+      const ignore = await secretFileIgnored(process.cwd());
+      console.log(`    A credential for this site was issued and saved to ${SECRET_CONFIG_FILENAME}.`);
+      console.log(
+        ignore.ignored ? "    Added to .gitignore." : `    NOT ignored by git \u2014 ${ignore.reason ?? "unknown reason"}. Add it to .gitignore yourself before committing.`
+      );
+    }
+    console.log("");
+    return 0;
+  };
+  const prompt = (userCode, verificationUri) => {
+    console.log(`
+  Your code:  ${userCode}`);
+    console.log(`  Claim at:   ${verificationUri}
+`);
+    console.log("  Open that link and sign in to Patchstack \u2014 or create an account \u2014 to attach");
+    console.log("  this site to it. Whoever approves becomes the site's owner.\n");
+  };
+  if (args.flags.has("wait")) {
+    const pending = readPendingClaim(siteUuid);
+    if (pending === null) {
+      console.error("\n  No claim is waiting for approval. Run `patchstack-connect claim` first.\n");
+      return 1;
+    }
+    const resumed = await waitForClaim(config, pending);
+    if (resumed.status === "claimed") return await settled(resumed);
+    console.error(`
+  ${resumed.message ?? "Claim failed."}
+`);
+    return 1;
+  }
+  if (process.stdout.isTTY !== true) {
+    const existing = readPendingClaim(siteUuid);
+    if (existing !== null && Date.now() < existing.expiresAt) {
+      const outcome = await redeemClaimIfApproved(config, existing);
+      if (outcome !== "pending" && outcome.status === "claimed") return await settled(outcome);
+      if (outcome === "pending") {
+        const secondsLeft = Math.round((existing.expiresAt - Date.now()) / 1e3);
+        console.log(`
+  Still waiting for the site to be claimed with code ${existing.userCode}.`);
+        console.log(`  Claim at: ${existing.verificationUri}`);
+        console.log(`  (valid for another ${secondsLeft}s \u2014 run this again once the user confirms)
+`);
+        return 0;
+      }
+    }
+    const started = await startClaim(config);
+    if (started.status !== "started" || started.pending === void 0) {
+      if (started.status === "already-claimed") {
+        console.log(`
+  ${started.message ?? "This site is already claimed."}
+`);
+        return 0;
+      }
+      console.error(`
+  ${started.message ?? "Claim failed."}
+`);
+      return 1;
+    }
+    prompt(started.pending.userCode, started.pending.verificationUri);
+    console.log("  Give that link to the user. When they confirm they have claimed the site, run");
+    console.log("  this same command again (or `claim --wait` to block until they do).\n");
+    return 0;
+  }
+  const result = await claim2(config, (userCode, verificationUri) => {
+    prompt(userCode, verificationUri);
+    console.log("  Waiting (the code expires in 10 minutes)\u2026");
+  });
+  if (result.status === "claimed") return await settled(result);
+  if (result.status === "already-claimed") {
+    console.log(`
+  ${result.message ?? "This site is already claimed."}
+`);
+    return 0;
+  }
+  console.error(`
+  ${result.message ?? "Claim failed."}
+`);
+  return 1;
+}
 async function runLogin(args) {
   if (process.env.CI !== void 0 && process.env.CI !== "" && process.env.CI !== "false") {
     console.error("`login` is interactive and cannot run in CI. Set PATCHSTACK_PULSE_AUTH instead.");
@@ -7381,6 +8196,7 @@ async function runScan(args, options = {}) {
     cwd: process.cwd(),
     cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
     cliEndpoint: getStringFlag(args.flags, "endpoint"),
+    cliClaimToken: getStringFlag(args.flags, "claim-token"),
     // The one command that reports them, so the one command that resolves them.
     detectSiteIdentity: true
   });
@@ -7421,6 +8237,9 @@ async function runScan(args, options = {}) {
   if (typeof body.name === "string") {
     console.log(`Reporting this app's name as "${body.name}".`);
   }
+  if (typeof config.claimToken === "string" && config.claimToken !== "") {
+    console.log("A claim token is set: the site will be connected to the Patchstack account that issued it.");
+  }
   if (dryRun) {
     console.log("");
     if (config.siteUuid === null) {
@@ -7475,17 +8294,27 @@ async function runScan(args, options = {}) {
   } else {
     console.log(`Server response: ${response.message ?? JSON.stringify(response)}`);
   }
+  const claimLines = claimOutcomeLines(response.claim, config);
+  if (claimLines.length > 0) {
+    console.log("");
+    for (const line of claimLines) console.log(line);
+  }
+  const connected = response.claim?.state === "claimed" || response.claim?.state === "owned-by-you";
   const effectiveUuid = config.siteUuid ?? response.uuid ?? null;
   if (config.widget && effectiveUuid !== null && effectiveUuid.length > 0) {
     reportSourceWidget(effectiveUuid);
   }
-  if (provisioning && response.uuid !== void 0 && response.uuid.length > 0) {
+  const linkUuid = response.uuid ?? config.siteUuid;
+  if (!connected && (provisioning || claimLines.length > 0) && linkUuid !== null && linkUuid !== void 0 && linkUuid.length > 0) {
     console.log("");
     console.log("Open this dashboard link to view vulnerability reports:");
-    console.log(`  ${buildClaimUrl(config.endpoint, response.uuid)}`);
+    console.log(`  ${buildClaimUrl(config.endpoint, linkUuid)}`);
     if (config.endpoint !== DEFAULT_ENDPOINT) {
       console.log("  (this URL inherits the endpoint override above)");
     }
+    console.log("");
+    console.log("Or attach it to your account from this terminal:");
+    console.log("  npx @patchstack/connect claim");
   }
   if (options.showRemainingSetup !== false) {
     try {
@@ -7573,6 +8402,11 @@ function reportSourceMarker(framework) {
   }
 }
 async function runProtectCommand(args) {
+  const runtime = args.flags.get("runtime") === true;
+  if (runtime && args.flags.get("check") !== true) {
+    console.error("patchstack protect: --runtime only applies to --check. Run `protect --check --runtime`.");
+    return 1;
+  }
   if (args.flags.get("check") === true) {
     const report = runVerify(process.cwd());
     console.log(`patchstack protect --check (${report.stack}):`);
@@ -7591,7 +8425,12 @@ async function runProtectCommand(args) {
     if (report.checks.some((c) => c.unverifiable)) {
       console.log("One or more checks could not be answered from here \u2014 see the `?` lines above.");
     }
-    return report.wired ? 0 : 1;
+    if (!report.wired) return 1;
+    if (!runtime) return 0;
+    console.log("");
+    const runtimeReport = await runRuntimeCheck(process.cwd());
+    for (const line2 of formatRuntimeCheck(runtimeReport)) console.log(line2);
+    return runtimeExitCode(runtimeReport);
   }
   const demo = args.flags.get("demo") === true;
   try {
@@ -7714,7 +8553,7 @@ async function runGuide(args) {
   console.log("\u2014\u2014\u2014\u2014 Full reference guide (ships as AGENT-INSTALL.md) \u2014\u2014\u2014\u2014");
   console.log("");
   const guidePath = new URL("../AGENT-INSTALL.md", import.meta.url);
-  console.log(readFileSync14(guidePath, "utf8"));
+  console.log(readFileSync15(guidePath, "utf8"));
   return 0;
 }
 async function runSetup(args) {
@@ -7788,6 +8627,7 @@ async function runStatus(args) {
   console.log(`Environment: ${config.environment}`);
   if (config.siteUuid !== null) {
     console.log(`Dashboard URL: ${buildClaimUrl(config.endpoint, config.siteUuid)}`);
+    console.log("  Not attached to an account yet? Run `npx @patchstack/connect claim`.");
     switch (await fetchSiteStatus(config)) {
       case "active":
         console.log("Site status:   active on Patchstack");
@@ -7907,7 +8747,7 @@ async function runMarkBuild(args) {
   let marked = 0;
   let widgetTouched = 0;
   for (const file of files) {
-    const before = readFileSync14(file, "utf8");
+    const before = readFileSync15(file, "utf8");
     let after = injectMarker(before, snippet);
     if (widgetUuid !== null) {
       const ensured = ensureWidgetInHtml(after, widgetUuid);
@@ -7969,6 +8809,8 @@ async function main() {
       return runSetup(args);
     case "map":
       return runMap(args.flags);
+    case "claim":
+      return runClaim(args);
     case "login":
       return runLogin(args);
     default: