@patchstack/connect 0.5.10 → 0.5.12

package/dist/cli.js

@@ -2,7 +2,7 @@
 
 // src/cli.ts
 import { readFileSync as readFileSync19 } from "fs";
-import path17 from "path";
+import path16 from "path";
 import { createRequire as createRequire2 } from "module";
 
 // src/safe-file.ts
@@ -25,9 +25,9 @@ import { dirname, isAbsolute, join, relative, resolve, sep } from "path";
 function pathError(message) {
   return Object.assign(new Error(message), { code: "EINVAL" });
 }
-function existingEntry(path18) {
+function existingEntry(path17) {
   try {
-    return lstatSync(path18);
+    return lstatSync(path17);
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
@@ -1488,8 +1488,8 @@ async function readBoundedJson(response, maxBytes = MAX_CONTROL_RESPONSE_BYTES)
 var TOKEN_SKEW_MS = 6e4;
 function buildTokenUrl(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path18 = url.pathname.replace(/\/$/, "");
-  url.pathname = path18.endsWith("/manifest") ? `${path18.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  const path17 = url.pathname.replace(/\/$/, "");
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1657,8 +1657,8 @@ function authFailureMessage(status, config) {
 }
 function buildRulesUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path18 = url.pathname.replace(/\/$/, "");
-  url.pathname = path18.endsWith("/manifest") ? `${path18.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
+  const path17 = url.pathname.replace(/\/$/, "");
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1673,16 +1673,16 @@ function buildSettingsUrl(endpoint, siteUuid) {
 }
 function buildPackageRemovedUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path18 = url.pathname.replace(/\/$/, "");
-  url.pathname = path18.endsWith("/manifest") ? `${path18.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
+  const path17 = url.pathname.replace(/\/$/, "");
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
 }
 function buildInputMapUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path18 = url.pathname.replace(/\/$/, "");
-  url.pathname = path18.endsWith("/manifest") ? `${path18.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
+  const path17 = url.pathname.replace(/\/$/, "");
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -2336,6 +2336,7 @@ function isUnpublishableHost(hostname) {
   if (!host.includes(".")) return true;
   return RESERVED_SUFFIXES.some((suffix) => host.endsWith(suffix));
 }
+var URL_MAX_LENGTH = 191;
 function normaliseSiteUrl(value) {
   const trimmed = (value ?? "").trim();
   if (trimmed === "") return null;
@@ -2349,7 +2350,7 @@ function normaliseSiteUrl(value) {
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
   if (parsed.hostname === "" || isUnpublishableHost(parsed.hostname)) return null;
   const origin = `${parsed.protocol}//${parsed.host}`;
-  return origin.length <= 191 ? origin : null;
+  return origin.length <= URL_MAX_LENGTH ? origin : null;
 }
 var PRODUCTION_URL_SOURCES = [
   {
@@ -2678,10 +2679,10 @@ async function persistTimeout(cwd, timeoutMs) {
   return writeConfigFile(cwd, { ...existing, timeoutMs });
 }
 async function persistApiKey(cwd, apiKey) {
-  const { apiKey: _movedKey, pulseAuth: _movedPulse, ...publicConfig } = await readConfigFile(cwd);
+  const { apiKey: movedKey, pulseAuth: movedPulse, ...publicConfig } = await readConfigFile(cwd);
   const existingSecrets = await readSecretFile(cwd);
   const target = await writeSecretFile(cwd, { ...existingSecrets, apiKey, pulseAuth: void 0 });
-  if (_movedKey !== void 0 || _movedPulse !== void 0) {
+  if (movedKey !== void 0 || movedPulse !== void 0) {
     await writeConfigFile(cwd, publicConfig);
   }
   return target;
@@ -3082,7 +3083,7 @@ function ensureSourceMarker(cwd, shell, framework, checksum = null) {
 }
 
 // src/guide.ts
-import { existsSync as existsSync13, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync5 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync5 } from "fs";
 import path12 from "path";
 
 // src/architecture.ts
@@ -3460,10 +3461,10 @@ function detectDeploymentShapes(cwd, opts = {}) {
     boundary = realpathSync3(boundary);
   } catch {
   }
-  const inProject = (path18) => {
+  const inProject = (path17) => {
     if (opts.followOutside) return true;
     try {
-      return isInside(realpathSync3(path18), boundary);
+      return isInside(realpathSync3(path17), boundary);
     } catch {
       return false;
     }
@@ -4100,14 +4101,6 @@ var tanstackSupabaseAdapter = {
 // src/protect/install/adapters/next.ts
 import { existsSync as existsSync5 } from "fs";
 import { join as join7 } from "path";
-function hasNextDep(cwd) {
-  try {
-    const pkg = JSON.parse(read(join7(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.next);
-  } catch {
-    return false;
-  }
-}
 function middlewareInfo(cwd) {
   const candidates = ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"];
   for (const rel of candidates) {
@@ -4117,7 +4110,7 @@ function middlewareInfo(cwd) {
   return { relDir: useSrc ? "src" : ".", relFile: useSrc ? "src/middleware.ts" : "middleware.ts", exists: false };
 }
 function detect2(cwd) {
-  return hasNextDep(cwd);
+  return hasDependency(cwd, "next");
 }
 function rulesFile(relDir) {
   return relDir === "." ? "patchstack.rules.json" : `${relDir}/patchstack.rules.json`;
@@ -4171,9 +4164,6 @@ var nextAdapter = {
   verify: verify2
 };
 
-// src/protect/install/adapters/sveltekit.ts
-import { join as join9 } from "path";
-
 // src/protect/install/seam.ts
 import { existsSync as existsSync6 } from "fs";
 import { join as join8, dirname as dirname3 } from "path";
@@ -4231,12 +4221,7 @@ var SPEC = {
   seamLabel: "SvelteKit server hook"
 };
 function detect3(cwd) {
-  try {
-    const pkg = JSON.parse(read(join9(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }["@sveltejs/kit"]);
-  } catch {
-    return false;
-  }
+  return hasDependency(cwd, "@sveltejs/kit");
 }
 function wire3(cwd, opts) {
   return wireSeam(cwd, opts, SPEC);
@@ -4253,7 +4238,6 @@ var sveltekitAdapter = {
 };
 
 // src/protect/install/adapters/astro.ts
-import { join as join10 } from "path";
 var SPEC2 = {
   templateName: "astro-middleware.ts",
   candidates: ["src/middleware.ts", "src/middleware.js", "src/middleware/index.ts", "src/middleware/index.js"],
@@ -4263,12 +4247,7 @@ var SPEC2 = {
   seamLabel: "Astro middleware"
 };
 function detect4(cwd) {
-  try {
-    const pkg = JSON.parse(read(join10(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.astro);
-  } catch {
-    return false;
-  }
+  return hasDependency(cwd, "astro");
 }
 function wire4(cwd, opts) {
   return wireSeam(cwd, opts, SPEC2);
@@ -4311,8 +4290,8 @@ var nuxtAdapter = {
 };
 
 // src/protect/install/find-app.ts
-import { readFileSync as readFileSync8, existsSync as existsSync7, readdirSync as readdirSync3, lstatSync as lstatSync2 } from "fs";
-import { join as join11, relative as relative3, dirname as dirname4 } from "path";
+import { readFileSync as readFileSync8, readdirSync as readdirSync3, lstatSync as lstatSync2 } from "fs";
+import { join as join9, relative as relative3, dirname as dirname4 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   "node_modules",
   "patchstack",
@@ -4333,7 +4312,6 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([
 ]);
 var MAX_DEPTH = 8;
 function findAppInstance(cwd, re) {
-  const root = existsSync7(join11(cwd, "src")) ? join11(cwd, "src") : cwd;
   const found = [];
   const walk2 = (dir, depth) => {
     if (depth > MAX_DEPTH) return;
@@ -4345,7 +4323,7 @@ function findAppInstance(cwd, re) {
     }
     for (const name of entries) {
       if (SKIP_DIRS2.has(name) || name.startsWith(".")) continue;
-      const p = join11(dir, name);
+      const p = join9(dir, name);
       let st;
       try {
         st = lstatSync2(p);
@@ -4372,7 +4350,7 @@ function findAppInstance(cwd, re) {
       }
     }
   };
-  walk2(root, 0);
+  walk2(cwd, 0);
   if (found.length === 0) return null;
   const declared = declaredEntries(cwd);
   const chosen = found.slice().sort((a, b) => rankEntry({ ...a, declared: declared.has(a.relPath) }, { ...b, declared: declared.has(b.relPath) }))[0];
@@ -4404,7 +4382,7 @@ function declaredEntries(cwd) {
   const paths = /* @__PURE__ */ new Set();
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync8(join11(cwd, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync8(join9(cwd, "package.json"), "utf8"));
   } catch {
     return paths;
   }
@@ -4430,17 +4408,17 @@ function importSpecifier(fromRel, toRel, preserveExtension = false) {
 }
 
 // src/protect/install/register.ts
-import { existsSync as existsSync10 } from "fs";
-import { join as join14, resolve as resolve3 } from "path";
+import { existsSync as existsSync9 } from "fs";
+import { join as join12, resolve as resolve3 } from "path";
 
 // src/protect/install/generic.ts
-import { readFileSync as readFileSync9, existsSync as existsSync9, readdirSync as readdirSync4, lstatSync as lstatSync3 } from "fs";
-import { join as join13, dirname as dirname6 } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync8, readdirSync as readdirSync4, lstatSync as lstatSync3 } from "fs";
+import { join as join11, dirname as dirname6 } from "path";
 
 // src/protect/install/source-scope.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync8 } from "fs";
-import { dirname as dirname5, join as join12, resolve as resolve2 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { dirname as dirname5, join as join10, resolve as resolve2 } from "path";
 
 // src/protect/install/node-flags.ts
 var flagName = (token) => token.split("=")[0];
@@ -4730,8 +4708,8 @@ function moduleKindOf(filePath, packageIsModule) {
 }
 function resolvesToGuardModule(specifier, query) {
   const resolved = resolve2(dirname5(query.fromFile), specifier);
-  if (withoutModuleExtension(resolved) !== join12(query.guardDir, "guard")) return false;
-  const existing = GUARD_FILENAMES.filter((name) => existsSync8(join12(query.guardDir, name)));
+  if (withoutModuleExtension(resolved) !== join10(query.guardDir, "guard")) return false;
+  const existing = GUARD_FILENAMES.filter((name) => existsSync7(join10(query.guardDir, name)));
   if (existing.length === 0) return false;
   const extension = /(\.[A-Za-z0-9]+)$/.exec(specifier)?.[1] ?? "";
   if (!query.strictExtensions) return true;
@@ -4740,7 +4718,7 @@ function resolvesToGuardModule(specifier, query) {
     if (query.kind === "cjs") return existing.includes("guard.js");
     return true;
   }
-  if (existsSync8(resolved)) return true;
+  if (existsSync7(resolved)) return true;
   return query.kind === "ts" && extension === ".js" && existing.includes("guard.ts");
 }
 function withoutModuleExtension(filePath) {
@@ -4750,16 +4728,16 @@ function withoutModuleExtension(filePath) {
 // src/protect/install/generic.ts
 function packageIsEsm(cwd) {
   try {
-    return JSON.parse(read(join13(cwd, "package.json"))).type === "module";
+    return JSON.parse(read(join11(cwd, "package.json"))).type === "module";
   } catch {
     return false;
   }
 }
 function genericDir(cwd) {
-  return existsSync9(join13(cwd, "src")) ? "src/patchstack" : "patchstack";
+  return existsSync8(join11(cwd, "src")) ? "src/patchstack" : "patchstack";
 }
 function hasTypeScript(cwd) {
-  return existsSync9(join13(cwd, "tsconfig.json")) || candidateEntries(cwd).some((entry) => /\.tsx?$/.test(entry));
+  return existsSync8(join11(cwd, "tsconfig.json")) || candidateEntries(cwd).some((entry) => /\.tsx?$/.test(entry));
 }
 function genericGuardTarget(cwd) {
   if (hasTypeScript(cwd)) {
@@ -4773,7 +4751,7 @@ function genericGuardTarget(cwd) {
 function genericScaffoldFiles(cwd) {
   const dir = genericDir(cwd);
   const candidates = ["guard.ts", "guard.js", "guard.cjs", "rules.json"];
-  return candidates.map((file) => `${dir}/${file}`).filter((relative8) => existsSync9(join13(cwd, relative8)));
+  return candidates.map((file) => `${dir}/${file}`).filter((relative8) => existsSync8(join11(cwd, relative8)));
 }
 function scaffoldGeneric(cwd, opts, guardTemplate, guardFile) {
   const target = genericGuardTarget(cwd);
@@ -4781,15 +4759,15 @@ function scaffoldGeneric(cwd, opts, guardTemplate, guardFile) {
   guardFile ??= target.file;
   const templates = templatesDir();
   const dir = genericDir(cwd);
-  const dst = join13(cwd, dir);
+  const dst = join11(cwd, dir);
   ensureProjectDirectorySync(cwd, dst);
-  copyProjectFileSync(cwd, join13(templates, guardTemplate), join13(dst, guardFile));
+  copyProjectFileSync(cwd, join11(templates, guardTemplate), join11(dst, guardFile));
   const guardRel = `${dir}/${guardFile}`;
   const changed = [guardRel];
   if (!opts.demo) bakeSiteUuid(cwd, guardRel);
-  const rulesDst = join13(dst, "rules.json");
-  if (opts.demo || !existsSync9(rulesDst)) {
-    copyProjectFileSync(cwd, join13(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+  const rulesDst = join11(dst, "rules.json");
+  if (opts.demo || !existsSync8(rulesDst)) {
+    copyProjectFileSync(cwd, join11(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
     changed.push(`${dir}/rules.json`);
   }
   return { changed, dir };
@@ -4810,25 +4788,17 @@ function candidateEntries(cwd) {
     "app.ts",
     "app.js"
   ];
-  const hits = names.filter((n) => existsSync9(join13(cwd, n)));
+  const hits = names.filter((n) => existsSync8(join11(cwd, n)));
   try {
-    const pkg = JSON.parse(read(join13(cwd, "package.json")));
-    if (typeof pkg.main === "string" && existsSync9(join13(cwd, pkg.main))) hits.push(pkg.main);
+    const pkg = JSON.parse(read(join11(cwd, "package.json")));
+    if (typeof pkg.main === "string" && existsSync8(join11(cwd, pkg.main))) hits.push(pkg.main);
   } catch {
   }
   return [...new Set(hits)];
 }
-function usesExpress(cwd) {
-  try {
-    const pkg = JSON.parse(read(join13(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.express);
-  } catch {
-    return false;
-  }
-}
 function wiringPlan(cwd, dir) {
   const entries = candidateEntries(cwd);
-  const express = usesExpress(cwd);
+  const express = hasDependency(cwd, "express");
   const target = genericGuardTarget(cwd);
   const lines = [
     `no built-in adapter matched this stack \u2014 scaffolded a generic guard at ${dir}/${target.file} + ${dir}/rules.json.`,
@@ -4924,9 +4894,9 @@ function escapeForRegExp(value) {
 function genericVerify(cwd) {
   const dir = genericDir(cwd);
   const target = genericGuardTarget(cwd);
-  const present2 = GUARD_FILENAMES.find((name) => existsSync9(join13(cwd, dir, name)));
+  const present2 = GUARD_FILENAMES.find((name) => existsSync8(join11(cwd, dir, name)));
   const scaffolded = present2 !== void 0;
-  const imported = scaffolded && guardIsImported(cwd, join13(cwd, dir, present2));
+  const imported = scaffolded && guardIsImported(cwd, join11(cwd, dir, present2));
   return {
     wired: scaffolded && imported,
     checks: [
@@ -4962,7 +4932,7 @@ var NON_RUNTIME_DIRS = /* @__PURE__ */ new Set([
 function guardIsImported(cwd, guardPath) {
   const guardDir = dirname6(guardPath);
   const packageIsModule = packageIsEsm(cwd);
-  const root = existsSync9(join13(cwd, "src")) ? join13(cwd, "src") : cwd;
+  const root = existsSync8(join11(cwd, "src")) ? join11(cwd, "src") : cwd;
   let found = false;
   const walk2 = (d, depth) => {
     if (found || depth > 8) return;
@@ -4975,7 +4945,7 @@ function guardIsImported(cwd, guardPath) {
     for (const name of entries) {
       if (found) return;
       if (NON_RUNTIME_DIRS.has(name) || name.startsWith(".")) continue;
-      const p = join13(d, name);
+      const p = join11(d, name);
       let st;
       try {
         st = lstatSync3(p);
@@ -5034,7 +5004,7 @@ function guardTarget(cwd, entryRel, spec) {
 }
 function packageType(cwd) {
   try {
-    return JSON.parse(read(join14(cwd, "package.json"))).type;
+    return JSON.parse(read(join12(cwd, "package.json"))).type;
   } catch {
     return void 0;
   }
@@ -5070,8 +5040,8 @@ function bindsGuard(line, maskedLine, importName, call, fileRel, guard) {
 }
 function namesGuardModule(specifier, fileRel, guard) {
   return resolvesToGuardModule(specifier, {
-    fromFile: join14(guard.cwd, fileRel),
-    guardDir: resolve3(join14(guard.cwd, guard.guardDir)),
+    fromFile: join12(guard.cwd, fileRel),
+    guardDir: resolve3(join12(guard.cwd, guard.guardDir)),
     kind: moduleKindOf(fileRel, packageType(guard.cwd) === "module"),
     strictExtensions: true
   });
@@ -5090,7 +5060,7 @@ function wireRegister(cwd, opts, spec) {
   }
   const target = guardTarget(cwd, entry.relPath, spec);
   const { changed, dir } = scaffoldGeneric(cwd, opts, target.template, target.file);
-  const p = join14(cwd, entry.relPath);
+  const p = join12(cwd, entry.relPath);
   const s = read(p);
   const state = wiringState(s, spec, entry.appVar, entry.relPath, { cwd, guardDir: dir });
   if (state.importAtTopLevel && state.callInAppScope) {
@@ -5160,17 +5130,17 @@ function firstStatementLine(lines) {
   return i;
 }
 function serverIsGuarded(cwd, spec, server, guardDir) {
-  const source = read(join14(cwd, server.relPath));
+  const source = read(join12(cwd, server.relPath));
   const state = wiringState(source, spec, server.appVar, server.relPath, { cwd, guardDir });
   if (!state.importAtTopLevel || !state.callInAppScope || !state.ordered) return false;
   return !spec.callAfter || routesBefore(source, server.appVar, state.callIndex).length === 0;
 }
 function verifyRegister(cwd, spec) {
-  const dir = existsSync10(join14(cwd, "src")) ? "src/patchstack" : "patchstack";
+  const dir = existsSync9(join12(cwd, "src")) ? "src/patchstack" : "patchstack";
   const entry = findAppInstance(cwd, spec.appRe);
   const target = entry ? guardTarget(cwd, entry.relPath, spec) : null;
-  const scaffolded = target ? existsSync10(join14(cwd, dir, target.file)) : false;
-  const entrySource = entry ? read(join14(cwd, entry.relPath)) : "";
+  const scaffolded = target ? existsSync9(join12(cwd, dir, target.file)) : false;
+  const entrySource = entry ? read(join12(cwd, entry.relPath)) : "";
   const state = entry ? wiringState(entrySource, spec, entry.appVar, entry.relPath, { cwd, guardDir: dir }) : { importAtTopLevel: false, callInAppScope: false, ordered: false, callIndex: -1, appIndex: -1 };
   const wired = state.importAtTopLevel && state.callInAppScope && state.ordered;
   const early = spec.callAfter && entry ? routesBefore(entrySource, entry.appVar, state.callIndex) : [];
@@ -5260,8 +5230,8 @@ var expressAdapter = {
 };
 
 // src/protect/install/reporting.ts
-import { existsSync as existsSync11 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync10 } from "fs";
+import { join as join13 } from "path";
 
 // src/protect/reporting-state.js
 var REPORTING_STATES = Object.freeze([
@@ -5319,9 +5289,9 @@ function explainReportingState(state) {
 
 // src/protect/install/reporting.ts
 function siteIdentity(cwd, env) {
-  const rc = join15(cwd, ".patchstackrc.json");
+  const rc = join13(cwd, ".patchstackrc.json");
   let recorded;
-  if (existsSync11(rc)) {
+  if (existsSync10(rc)) {
     try {
       recorded = JSON.parse(read(rc)).siteUuid;
     } catch {
@@ -5470,7 +5440,7 @@ function runVerify(cwd) {
 }
 
 // src/widget.ts
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
 import path11 from "path";
 var WIDGET_SCRIPT_URL = "https://cdn.patchstack.com/patchstack-widget.js";
 var WIDGET_MARKER_ATTR = "data-patchstack-connect-widget";
@@ -5509,7 +5479,7 @@ ${indent}</body>`;
 }
 function findSourceShell(cwd) {
   for (const candidate of SOURCE_SHELL_CANDIDATES) {
-    if (existsSync12(path11.join(cwd, candidate))) {
+    if (existsSync11(path11.join(cwd, candidate))) {
       return candidate;
     }
   }
@@ -5521,7 +5491,7 @@ function ensureSourceWidget(cwd, siteUuid, jsxShell = null) {
     return { shell: null, action: "no-shell" };
   }
   const file = path11.join(cwd, shell);
-  if (!existsSync12(file)) {
+  if (!existsSync11(file)) {
     return { shell: null, action: "no-shell" };
   }
   const before = readFileSync10(file, "utf8");
@@ -5606,7 +5576,7 @@ function detectPackageManager(cwd) {
     return declared;
   }
   for (const { filename, pm } of PM_BY_LOCKFILE) {
-    if (existsSync13(path12.join(cwd, filename))) {
+    if (existsSync12(path12.join(cwd, filename))) {
       return pm;
     }
   }
@@ -5703,7 +5673,7 @@ function resolveWidgetFileHint(cwd, framework) {
     ...GENERIC_WIDGET_FILES
   ];
   for (const candidate of candidates) {
-    if (existsSync13(path12.join(cwd, candidate))) {
+    if (existsSync12(path12.join(cwd, candidate))) {
       return candidate;
     }
   }
@@ -5823,7 +5793,11 @@ function renderGuideChecklist(state, useColor) {
   lines.push("");
   if (!state.hasPackageJson) {
     lines.push(todo("No package.json found in this directory."));
-    lines.push(detail("Run the guide from the project root."));
+    lines.push(detail("For a JS/Node app, run the guide from its package directory; check that package.json is readable and valid."));
+    lines.push(detail("For a standalone HTML/CSS/browser-JavaScript site, use the disclosure widget directly."));
+    lines.push(detail("Do not create a Node project, build hooks, or a server just to install the widget."));
+    lines.push(detail("Use the correct site UUID or widget snippet from the Patchstack dashboard; never invent one."));
+    lines.push(detail('See "Plain HTML sites" in AGENT-INSTALL.md. Widget-only setup provides no dependency scan or runtime protection.'));
     return lines.join("\n");
   }
   if (countRemainingSteps(state) > 0) {
@@ -5835,6 +5809,17 @@ function renderGuideChecklist(state, useColor) {
     lines.push("   Avoid lockfile / dependency / manifest / npm / UUID when speaking to them.");
     lines.push("");
   }
+  if (state.siteUuid === null) {
+    lines.push(` ${paint(ANSI.cyan, "\u279C")} ${paint(ANSI.bold, "Nothing is set up yet \u2014 two commands cover the steps below:")}`);
+    if (state.installed?.section !== "dependencies") {
+      lines.push(`   ${installCommand(state.packageManager)}`);
+    }
+    lines.push("   npx @patchstack/connect setup");
+    lines.push("   setup provisions the site, adds the widget, installs and verifies runtime protection,");
+    lines.push("   and wires the install and build scans, then prints this checklist again. Anything");
+    lines.push("   still listed there is a step setup could not apply safely, and is yours to finish.");
+    lines.push("");
+  }
   if (state.installed?.section === "dependencies") {
     lines.push(done(`@patchstack/connect installed (${state.installed.version}, ${state.installed.section})`));
   } else if (state.installed !== null) {
@@ -5945,11 +5930,19 @@ function renderGuideChecklist(state, useColor) {
   }
   lines.push("");
   if (state.claimUrl !== null) {
-    lines.push(` ${paint(ANSI.cyan, "\u279C")} ${paint(ANSI.bold, "Dashboard link (open to view reports):")}`);
-    lines.push(`   ${paint(ANSI.cyan, state.claimUrl)}`);
-    lines.push(detail("Open this link in a browser. The CLI never opens it."));
-    lines.push(detail("Or from this terminal \u2192 npx @patchstack/connect claim"));
-    lines.push(detail("  (prints a link to sign in with, then attaches the site to that account)"));
+    lines.push(` ${paint(ANSI.cyan, "\u279C")} ${paint(ANSI.bold, "Connect this site to your Patchstack account:")}`);
+    let route = 1;
+    if (widgetTagInPlace(state)) {
+      lines.push(`   ${route++}. In the preview \u2014 while the site is unclaimed the widget shows a`);
+      lines.push('      "Connect this website" panel. Signing in there attaches the site.');
+    }
+    lines.push(`   ${route++}. In a browser \u2014 open the dashboard link (the CLI never opens it):`);
+    lines.push(`      ${paint(ANSI.cyan, state.claimUrl)}`);
+    lines.push(`   ${route}. From this terminal \u2192 npx @patchstack/connect claim`);
+    lines.push("      (prints a link to sign in with, then attaches the site to that account)");
+    lines.push(detail("Reports have no owner to reach until one of these completes. The site UUID ships"));
+    lines.push(detail("in the page and claiming is first-come, so an unclaimed site stays claimable by"));
+    lines.push(detail("anyone who loads it."));
     if (state.endpointOverride !== null) {
       lines.push(detail("(this URL inherits the endpoint override above)"));
     }
@@ -5959,9 +5952,11 @@ function renderGuideChecklist(state, useColor) {
   if (widgetTagInPlace(state)) {
     lines.push("");
     lines.push(` ${paint(ANSI.cyan, "\u279C")} ${paint(ANSI.bold, "Refresh the preview to see the widget:")}`);
-    lines.push('   The "Report a vulnerability" button loads with the page, so a preview that was');
-    lines.push("   already open still shows the HTML from before this change. Builders that hot");
-    lines.push("   reload refresh it themselves; if the button is missing, refresh the preview once.");
+    lines.push("   The widget loads with the page, so a preview that was already open still shows");
+    lines.push("   the HTML from before this change. Builders that hot reload refresh it themselves;");
+    lines.push("   if nothing appears, refresh the preview once.");
+    lines.push('   Unclaimed, the widget shows the "Connect this website" panel; the public');
+    lines.push('   "Report a vulnerability" button takes its place once the site is claimed.');
   }
   if (state.siteUuid !== null) {
     lines.push("");
@@ -5991,11 +5986,6 @@ function renderGuideChecklist(state, useColor) {
   return lines.join("\n");
 }
 
-// src/login.ts
-import { mkdtempSync } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import path14 from "path";
-
 // src/device-flow.ts
 import {
   closeSync as closeSync2,
@@ -6295,8 +6285,8 @@ async function claim2(config, onPrompt, deps = {}) {
 import { relative as relative4 } from "path";
 
 // src/protect/install/runtime/entry.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13, realpathSync as realpathSync4, statSync as statSync6 } from "fs";
-import { join as join16, resolve as resolve4, sep as sep2 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync13, realpathSync as realpathSync4, statSync as statSync6 } from "fs";
+import { join as join14, resolve as resolve4, sep as sep2 } from "path";
 var CONVENTIONAL = [
   "server.js",
   "server.mjs",
@@ -6322,15 +6312,15 @@ var CONVENTIONAL = [
 var LOADABLE = /\.(?:js|mjs|cjs)$/;
 function readPackage2(cwd) {
   try {
-    const parsed = JSON.parse(readFileSync13(join16(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync13(join14(cwd, "package.json"), "utf8"));
     return parsed !== null && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
   }
 }
-function isFile(path18) {
+function isFile(path17) {
   try {
-    return statSync6(path18).isFile();
+    return statSync6(path17).isFile();
   } catch {
     return false;
   }
@@ -6339,14 +6329,14 @@ function loadable(cwd, candidate) {
   const written = resolve4(cwd, candidate);
   if (!LOADABLE.test(written) || !isFile(written)) return null;
   let root;
-  let path18;
+  let path17;
   try {
     root = realpathSync4(cwd);
-    path18 = realpathSync4(written);
+    path17 = realpathSync4(written);
   } catch {
     return null;
   }
-  if (path18 !== root && !path18.startsWith(root + sep2)) return null;
+  if (path17 !== root && !path17.startsWith(root + sep2)) return null;
   return written;
 }
 function passable(token) {
@@ -6392,14 +6382,14 @@ function resolveEntry(cwd) {
   }
   return {
     kind: "unavailable",
-    reason: existsSync14(join16(cwd, "package.json")) ? 'no directly loadable entry was found \u2014 declare one as a "start" script of the form `node <file>`, or run the check against a built output' : "there is no package.json here"
+    reason: existsSync13(join14(cwd, "package.json")) ? 'no directly loadable entry was found \u2014 declare one as a "start" script of the form `node <file>`, or run the check against a built output' : "there is no package.json here"
   };
 }
 
 // src/protect/install/runtime/probe.ts
 import { spawn } from "child_process";
 import { createHash as createHash3, randomBytes } from "crypto";
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { request as httpRequest } from "http";
 import { request as httpsRequest, Agent as HttpsAgent } from "https";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -6426,8 +6416,8 @@ function preloadPath() {
     // beside this file, in the repository
   ];
   for (const candidate of candidates) {
-    const path18 = fileURLToPath2(candidate);
-    if (existsSync15(path18)) return path18;
+    const path17 = fileURLToPath2(candidate);
+    if (existsSync14(path17)) return path17;
   }
   return null;
 }
@@ -6774,15 +6764,15 @@ function formatRuntimeCheck(report) {
 }
 
 // src/map-command.ts
-import path15 from "path";
+import path14 from "path";
 
 // src/map/ts-loader.ts
 import { createRequire } from "module";
 import { pathToFileURL } from "url";
-import { join as join17 } from "path";
+import { join as join15 } from "path";
 async function loadTypeScript(cwd) {
   try {
-    const req = createRequire(pathToFileURL(join17(cwd, "package.json")));
+    const req = createRequire(pathToFileURL(join15(cwd, "package.json")));
     const resolved = req.resolve("typescript");
     const mod = await import(pathToFileURL(resolved).href);
     return mod.default ?? mod;
@@ -7212,7 +7202,7 @@ function dedupeSinks(sinks, owner) {
 
 // src/map/module-graph.ts
 import { readFileSync as readFileSync14, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
-import { dirname as dirname8, join as join18, relative as relative5, resolve as resolvePath } from "path";
+import { dirname as dirname8, join as join16, relative as relative5, resolve as resolvePath } from "path";
 var RESOLVE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 function createModuleGraph(ts, opts) {
   const cache = /* @__PURE__ */ new Map();
@@ -7290,7 +7280,7 @@ function resolveRelativeModule(fromFile, spec) {
   }
   candidates.push(base);
   for (const e of RESOLVE_EXTS) candidates.push(base + e);
-  for (const e of RESOLVE_EXTS) candidates.push(join18(base, "index" + e));
+  for (const e of RESOLVE_EXTS) candidates.push(join16(base, "index" + e));
   for (const c of candidates) {
     try {
       if (statSync7(c).isFile()) return c;
@@ -7319,8 +7309,8 @@ function collectCallees(sf, ts) {
 }
 
 // src/map/coordinates.ts
-function runtimeCoordinate(source, path18) {
-  if (/\[\d*\]/.test(path18)) {
+function runtimeCoordinate(source, path17) {
+  if (/\[\d*\]/.test(path17)) {
     return { runtimeParameter: null, runtimeParameterReason: "array traversal: needs an array_key_value rule, not a dotted parameter" };
   }
   switch (source) {
@@ -7329,15 +7319,15 @@ function runtimeCoordinate(source, path18) {
     case "multipart":
     case "body":
     case "server-fn-data":
-      return { runtimeParameter: `post.${path18}` };
+      return { runtimeParameter: `post.${path17}` };
     case "query":
-      return { runtimeParameter: `get.${path18}` };
+      return { runtimeParameter: `get.${path17}` };
     case "cookie":
-      return { runtimeParameter: `cookie.${path18}` };
+      return { runtimeParameter: `cookie.${path17}` };
     case "file":
-      return { runtimeParameter: `files.${path18}` };
+      return { runtimeParameter: `files.${path17}` };
     case "header":
-      return { runtimeParameter: `server.HTTP_${path18.toUpperCase().replace(/-/g, "_")}` };
+      return { runtimeParameter: `server.HTTP_${path17.toUpperCase().replace(/-/g, "_")}` };
     case "route-param":
       return { runtimeParameter: null, runtimeParameterReason: "route parameters are not exposed by the runtime resolver" };
     default:
@@ -7369,8 +7359,8 @@ function addressSpaceOf(source) {
 function isProvenFlow(confidence) {
   return confidence === "exact-local" || confidence === "transformed-local";
 }
-function inputIdOf(source, path18) {
-  return `${addressSpaceOf(source)}:${path18}`;
+function inputIdOf(source, path17) {
+  return `${addressSpaceOf(source)}:${path17}`;
 }
 function withCoordinates(fields, source) {
   return fields.map((f) => {
@@ -7588,8 +7578,8 @@ function linkFlows(bodyNode, params, inputs, sinks, ts, invocations) {
   }
   const CONTAINER_KEYS = /* @__PURE__ */ new Set([...REQ_SOURCES, "data", "input", "payload"]);
   const rootPath = /* @__PURE__ */ new Map();
-  const addRoot = (name, path18, space) => {
-    if (!rootPath.has(name)) rootPath.set(name, { path: path18, space });
+  const addRoot = (name, path17, space) => {
+    if (!rootPath.has(name)) rootPath.set(name, { path: path17, space });
   };
   for (const p of params ?? []) {
     if (!p?.name) continue;
@@ -7784,8 +7774,8 @@ function dedupeLimitations(list) {
 function join22(base, seg) {
   return base ? `${base}.${seg}` : seg;
 }
-function normalizePath(path18) {
-  return path18.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
+function normalizePath(path17) {
+  return path17.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
 }
 function fluentChainCalls(call, ts) {
   let root = call;
@@ -8151,7 +8141,7 @@ function handlerEntry(name, kindLabel, params, body, ts, localSinks, bindings, c
 
 // src/map/imports.ts
 import { readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { join as join17 } from "path";
 var MAX_SITES2 = 5;
 var NPM_NAME = /^(?:@[^/@\s~][^/@\s]*\/)?[^/@\s.~][^/@\s]*$/;
 function isNpmPackageName(pkg) {
@@ -8162,7 +8152,7 @@ function readPathAliases(cwd) {
   for (const name of ["tsconfig.json", "jsconfig.json"]) {
     let paths;
     try {
-      const raw = readFileSync15(join19(cwd, name), "utf8");
+      const raw = readFileSync15(join17(cwd, name), "utf8");
       const parsed = JSON.parse(stripJsonComments(raw));
       paths = parsed.compilerOptions?.paths;
     } catch {
@@ -8649,7 +8639,7 @@ function getStringFlag(flags, name) {
 
 // src/build-stamp.ts
 import { lstatSync as lstatSync4, readFileSync as readFileSync17, readdirSync as readdirSync6, realpathSync as realpathSync7 } from "fs";
-import { join as join20, relative as relative7, sep as sep3 } from "path";
+import { join as join18, relative as relative7, sep as sep3 } from "path";
 var RULES_FILE_NAMES = /* @__PURE__ */ new Set(["rules.json", "patchstack.rules.json"]);
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "out", "coverage", "tmp", "vendor"]);
 var MAX_DEPTH2 = 6;
@@ -8667,11 +8657,11 @@ function guardImportsRulesFile(dir, rulesName) {
   }
   for (const name of siblings) {
     if (!GUARD_SOURCE.test(name)) continue;
-    const path18 = join20(dir, name);
+    const path17 = join18(dir, name);
     try {
-      const entry = lstatSync4(path18);
+      const entry = lstatSync4(path17);
       if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_GUARD_SOURCE_BYTES) continue;
-      const source = stripComments(readFileSync17(path18, "utf8"));
+      const source = stripComments(readFileSync17(path17, "utf8"));
       if (source.includes("@patchstack/connect/protect") && importsRules.test(source)) return true;
     } catch {
     }
@@ -8692,9 +8682,9 @@ function findRulesFile(cwd) {
   } catch {
     return { kind: "none" };
   }
-  const contained = (path18) => {
+  const contained = (path17) => {
     try {
-      const real = realpathSync7(path18);
+      const real = realpathSync7(path17);
       return real === root || real.startsWith(root + sep3);
     } catch {
       return false;
@@ -8710,25 +8700,25 @@ function findRulesFile(cwd) {
     }
     for (const name of entries) {
       if (name.startsWith(".")) continue;
-      const path18 = join20(dir, name);
+      const path17 = join18(dir, name);
       let entry;
       try {
-        entry = lstatSync4(path18);
+        entry = lstatSync4(path17);
       } catch {
         continue;
       }
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(name)) walk2(path18, depth + 1);
+        if (!SKIP_DIRECTORIES.has(name)) walk2(path17, depth + 1);
         continue;
       }
       if (!entry.isFile() || !RULES_FILE_NAMES.has(name)) continue;
-      if (!contained(path18)) continue;
+      if (!contained(path17)) continue;
       if (!guardImportsRulesFile(dir, name)) continue;
       try {
-        if (isRuleBundle(JSON.parse(readFileSync17(path18, "utf8")))) found.push(path18);
+        if (isRuleBundle(JSON.parse(readFileSync17(path17, "utf8")))) found.push(path17);
       } catch {
-        unreadable.push(path18);
+        unreadable.push(path17);
       }
     }
   };
@@ -8920,7 +8910,7 @@ async function runMap(flags) {
   const json = JSON.stringify(map, null, 2);
   const out = getStringFlag(flags, "out");
   if (out) {
-    atomicWriteFileSync(path15.resolve(out), json, { encoding: "utf8" });
+    atomicWriteFileSync(path14.resolve(out), json, { encoding: "utf8" });
     console.error(`patchstack: wrote ${out}`);
   } else if (flags.get("upload") !== true) {
     console.log(json);
@@ -8970,7 +8960,7 @@ async function runMap(flags) {
 
 // src/setup.ts
 import { readFileSync as readFileSync18 } from "fs";
-import path16 from "path";
+import path15 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
 function setupProtection(cwd) {
@@ -8995,7 +8985,7 @@ function prependHook(existing, command) {
   return [command, ...remaining].join(" && ");
 }
 function wireBuildScripts(cwd, packageManager) {
-  const target = path16.join(cwd, "package.json");
+  const target = path15.join(cwd, "package.json");
   const raw = readFileSync18(target, "utf8");
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
@@ -9263,6 +9253,20 @@ function parseArgs(argv) {
     flags
   };
 }
+function resolveCliConfig(args, extra = {}) {
+  return resolveConfig({
+    cwd: process.cwd(),
+    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
+    cliEndpoint: getStringFlag(args.flags, "endpoint"),
+    ...extra
+  });
+}
+function runningInCi() {
+  return process.env.CI !== void 0 && process.env.CI !== "" && process.env.CI !== "false";
+}
+function gitignoreOutcomeLine(ignore) {
+  return ignore.ignored ? "    Added to .gitignore." : `    NOT ignored by git \u2014 ${ignore.reason ?? "unknown reason"}. Add it to .gitignore yourself before committing.`;
+}
 async function runInit(args) {
   const uuid = args.positional[0];
   if (!uuid) {
@@ -9270,7 +9274,7 @@ async function runInit(args) {
     console.error("Usage: patchstack-connect init <site-uuid>");
     return 1;
   }
-  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(uuid)) {
+  if (!isCanonicalUuid(uuid)) {
     console.error(`Error: "${uuid}" does not look like a valid UUID.`);
     return 1;
   }
@@ -9281,15 +9285,11 @@ async function runInit(args) {
   return 0;
 }
 async function runClaim(args) {
-  if (process.env.CI !== void 0 && process.env.CI !== "" && process.env.CI !== "false") {
+  if (runningInCi()) {
     console.error("`claim` is interactive and cannot run in CI. Claim the site from a developer machine.");
     return 1;
   }
-  const config = await resolveConfig({
-    cwd: process.cwd(),
-    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-    cliEndpoint: getStringFlag(args.flags, "endpoint")
-  });
+  const config = await resolveCliConfig(args);
   const siteUuid = config.siteUuid;
   if (siteUuid === null) {
     console.error("\n  No site to claim yet \u2014 run `npx @patchstack/connect scan` first.\n");
@@ -9304,9 +9304,7 @@ async function runClaim(args) {
     if (result2.credentialSaved === true) {
       const ignore = await secretFileIgnored(process.cwd());
       console.log(`    A credential for this site was issued and saved to ${SECRET_CONFIG_FILENAME}.`);
-      console.log(
-        ignore.ignored ? "    Added to .gitignore." : `    NOT ignored by git \u2014 ${ignore.reason ?? "unknown reason"}. Add it to .gitignore yourself before committing.`
-      );
+      console.log(gitignoreOutcomeLine(ignore));
     }
     console.log("");
     return 0;
@@ -9382,22 +9380,16 @@ async function runClaim(args) {
   return 1;
 }
 async function runLogin(args) {
-  if (process.env.CI !== void 0 && process.env.CI !== "" && process.env.CI !== "false") {
+  if (runningInCi()) {
     console.error("`login` is interactive and cannot run in CI. Set PATCHSTACK_PULSE_AUTH instead.");
     return 1;
   }
-  const config = await resolveConfig({
-    cwd: process.cwd(),
-    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-    cliEndpoint: getStringFlag(args.flags, "endpoint")
-  });
+  const config = await resolveCliConfig(args);
   const approved = async () => {
     const ignore = await secretFileIgnored(process.cwd());
     console.log(`
   \u2713 Credential restored and saved to ${SECRET_CONFIG_FILENAME}.`);
-    console.log(
-      ignore.ignored ? "    Added to .gitignore." : `    NOT ignored by git \u2014 ${ignore.reason ?? "unknown reason"}. Add it to .gitignore yourself before committing.`
-    );
+    console.log(gitignoreOutcomeLine(ignore));
     console.log("    The previous credential no longer works. Update it anywhere else it was set:");
     console.log("    CI secrets, hosting env vars, preview environments, other checkouts.\n");
     return 0;
@@ -9500,10 +9492,7 @@ async function postManifestWithPatience(config, payload) {
 }
 async function runScan(args, options = {}) {
   const dryRun = args.flags.get("dry-run") === true;
-  const config = await resolveConfig({
-    cwd: process.cwd(),
-    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-    cliEndpoint: getStringFlag(args.flags, "endpoint"),
+  const config = await resolveCliConfig(args, {
     cliClaimToken: getStringFlag(args.flags, "claim-token"),
     // The one command that reports them, so the one command that resolves them.
     detectSiteIdentity: true
@@ -9625,14 +9614,21 @@ async function runScan(args, options = {}) {
   const linkUuid = response.uuid ?? config.siteUuid;
   if (!connected && (provisioning || claimLines.length > 0) && linkUuid !== null && linkUuid !== void 0 && linkUuid.length > 0) {
     console.log("");
-    console.log("Open this dashboard link to view vulnerability reports:");
-    console.log(`  ${buildClaimUrl(config.endpoint, linkUuid)}`);
+    console.log("Connect this site to your Patchstack account \u2014 any one of these:");
+    if (config.widget) {
+      console.log('  1. In the preview \u2014 the widget shows a "Connect this website" panel while the');
+      console.log("     site is unclaimed. Signing in there attaches it.");
+      console.log("  2. Open this dashboard link in a browser:");
+      console.log(`     ${buildClaimUrl(config.endpoint, linkUuid)}`);
+      console.log("  3. From this terminal: npx @patchstack/connect claim");
+    } else {
+      console.log("  1. Open this dashboard link in a browser:");
+      console.log(`     ${buildClaimUrl(config.endpoint, linkUuid)}`);
+      console.log("  2. From this terminal: npx @patchstack/connect claim");
+    }
     if (config.endpoint !== DEFAULT_ENDPOINT) {
       console.log("  (this URL inherits the endpoint override above)");
     }
-    console.log("");
-    console.log("Or attach it to your account from this terminal:");
-    console.log("  npx @patchstack/connect claim");
   }
   if (options.showRemainingSetup !== false) {
     try {
@@ -9658,7 +9654,8 @@ function reportSourceWidget(siteUuid, framework) {
     const result = ensureSourceWidget(process.cwd(), siteUuid, jsxShell);
     switch (result.action) {
       case "added":
-        console.log(`Widget: added the "Report a vulnerability" tag to ${result.shell}. Reload your preview to see it.`);
+        console.log(`Widget: added the disclosure widget tag to ${result.shell}. Reload your preview to see it.`);
+        console.log('  Unclaimed, it shows a "Connect this website" panel; the "Report a vulnerability" button replaces it once the site is claimed.');
         break;
       case "updated":
         console.log(`Widget: updated the managed tag in ${result.shell} to site ${siteUuid}.`);
@@ -9767,12 +9764,7 @@ async function runDemoCommand(args) {
   try {
     const scenario = resolveDemoScenario(args.positional[0]);
     const cwd = process.cwd();
-    const config = await resolveConfig({
-      cwd,
-      cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-      cliEndpoint: getStringFlag(args.flags, "endpoint"),
-      requireSiteUuid: true
-    });
+    const config = await resolveCliConfig(args, { requireSiteUuid: true });
     if (config.environment !== "production") {
       throw new DemoError(
         "The production-backed demo requires PATCHSTACK_ENVIRONMENT=production. Unset the sandbox override and try again."
@@ -9890,6 +9882,7 @@ async function runSetup(args) {
   const before = await collectGuideState(process.cwd());
   if (!before.hasPackageJson) {
     console.error("Error: no package.json found. Run setup from the project root.");
+    console.error("For a standalone HTML site, use the widget-only instructions in AGENT-INSTALL.md; do not create a Node project just to run setup.");
     return 1;
   }
   if (before.installed === null) {
@@ -9967,16 +9960,12 @@ function setupOutcome(state, protection, wired) {
   if (protection.install.status === "not-applicable" && protection.install.leftovers.length > 0) {
     warnings.push(`earlier guard scaffold does nothing here and can be deleted: ${protection.install.leftovers.join(", ")}`);
   }
-  if (state.claimUrl !== null) warnings.push("the site is not attached to an account until the dashboard link is opened or `npx @patchstack/connect claim` completes");
+  if (state.claimUrl !== null) warnings.push('the site is not attached to an account until someone signs in through the widget\'s "Connect this website" panel, the dashboard link is opened, or `npx @patchstack/connect claim` completes');
   if (warnings.length > 0) lines.push(["Warnings", warnings.join("; ")]);
   return lines;
 }
 async function runStatus(args) {
-  const config = await resolveConfig({
-    cwd: process.cwd(),
-    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-    cliEndpoint: getStringFlag(args.flags, "endpoint")
-  });
+  const config = await resolveCliConfig(args);
   console.log(`Site UUID:   ${config.siteUuid ?? "(none yet \u2014 the next `scan` will provision one)"}`);
   console.log(
     `Endpoint:    ${config.endpoint}${config.endpoint === DEFAULT_ENDPOINT ? "" : " (override)"}`
@@ -9985,7 +9974,9 @@ async function runStatus(args) {
   console.log(`Environment: ${config.environment}`);
   if (config.siteUuid !== null) {
     console.log(`Dashboard URL: ${buildClaimUrl(config.endpoint, config.siteUuid)}`);
-    console.log("  Not attached to an account yet? Run `npx @patchstack/connect claim`.");
+    console.log(`  Not attached to an account yet? Sign in through the widget's "Connect this`);
+    console.log('  website" panel on the preview, open the link above, or run');
+    console.log("  `npx @patchstack/connect claim`.");
     switch (await fetchSiteStatus(config)) {
       case "active":
         console.log("Site status:   active on Patchstack");
@@ -10010,11 +10001,7 @@ async function runStatus(args) {
   return 0;
 }
 async function runUninstall(args) {
-  const config = await resolveConfig({
-    cwd: process.cwd(),
-    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-    cliEndpoint: getStringFlag(args.flags, "endpoint")
-  });
+  const config = await resolveCliConfig(args);
   if (config.siteUuid === null) {
     console.log("No site UUID configured \u2014 there is no site record to signal about.");
     console.log('Continue with the local removal steps in AGENT-INSTALL.md ("Uninstalling").');
@@ -10054,7 +10041,7 @@ function describeStack(stack) {
 }
 function readBuildScript(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync19(path17.join(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync19(path16.join(cwd, "package.json"), "utf8"));
     return pkg.scripts?.build;
   } catch {
     return void 0;