@patchstack/connect 0.5.0 → 0.5.2

package/dist/protect.d.cts

@@ -117,6 +117,20 @@ export interface Protection {
   };
 }
 
+/**
+ * The header a runtime wiring check sends, and the value a scaffolded guard answers it with.
+ *
+ * `protect --check --runtime` starts the app with a fresh challenge carried for that verification run,
+ * then asks for a response derived from it. The whole app process can read the challenge; the response
+ * rules out an accidental match, but does not prove which module answered.
+ *
+ * The seam reads the header itself and passes the value here; this decides whether it is the challenge
+ * and, if so, what to answer with. In a process not launched for runtime verification there is no
+ * challenge to match, so the answer is null and the request is screened exactly as it would have been.
+ */
+export declare const VERIFY_HEADER: "x-patchstack-verify";
+export declare function sentinelAnswer(offered: unknown): Promise<string | null>;
+
 export interface CreateProtectionOptions {
   /**
    * Fallback when the Pulse rules API does not send `enforcement`.

package/dist/protect.d.ts

@@ -117,6 +117,20 @@ export interface Protection {
   };
 }
 
+/**
+ * The header a runtime wiring check sends, and the value a scaffolded guard answers it with.
+ *
+ * `protect --check --runtime` starts the app with a fresh challenge carried for that verification run,
+ * then asks for a response derived from it. The whole app process can read the challenge; the response
+ * rules out an accidental match, but does not prove which module answered.
+ *
+ * The seam reads the header itself and passes the value here; this decides whether it is the challenge
+ * and, if so, what to answer with. In a process not launched for runtime verification there is no
+ * challenge to match, so the answer is null and the request is screened exactly as it would have been.
+ */
+export declare const VERIFY_HEADER: "x-patchstack-verify";
+export declare function sentinelAnswer(offered: unknown): Promise<string | null>;
+
 export interface CreateProtectionOptions {
   /**
    * Fallback when the Pulse rules API does not send `enforcement`.

package/dist/protect.edge.js

@@ -4594,6 +4594,33 @@ function createSupabaseGuard({ protection, supabaseUrl, fetchImpl = fetch }) {
   };
 }
 
+// src/protect/verify-sentinel.js
+var VERIFY_HEADER = "x-patchstack-verify";
+var CHALLENGE = "PATCHSTACK_VERIFY_CHALLENGE";
+function configuredChallenge() {
+  const value = typeof process !== "undefined" ? process.env?.[CHALLENGE] : void 0;
+  return typeof value === "string" && value.length >= 32 ? value : null;
+}
+function sameValue(a, b) {
+  if (typeof a !== "string" || typeof b !== "string" || a.length !== b.length) return false;
+  let differs = 0;
+  for (let i = 0; i < a.length; i += 1) differs |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return differs === 0;
+}
+async function sentinelAnswer(offered) {
+  const challenge = configuredChallenge();
+  if (challenge === null || !sameValue(challenge, typeof offered === "string" ? offered : null)) return null;
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle || typeof subtle.digest !== "function" || typeof TextEncoder === "undefined") return null;
+  try {
+    const bytes = new TextEncoder().encode(`patchstack-verify:${challenge}`);
+    const digest = await subtle.digest("SHA-256", bytes);
+    return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+  } catch {
+    return null;
+  }
+}
+
 // src/protect/runtime.js
 function createServerFnGuard({ protection }) {
   const guard = protection.fetchGuard();
@@ -5930,8 +5957,10 @@ function nodeRequestMeta(req, client) {
 export {
   GUARD_PATH,
   PulseRuleClient,
+  VERIFY_HEADER,
   createProtection,
   createServerFnGuard,
-  createSupabaseGuard
+  createSupabaseGuard,
+  sentinelAnswer
 };
 //# sourceMappingURL=protect.edge.js.map