@patchstack/connect 0.5.11 → 0.5.12

package/dist/cli.js

@@ -2,7 +2,7 @@
 
 // src/cli.ts
 import { readFileSync as readFileSync19 } from "fs";
-import path17 from "path";
+import path16 from "path";
 import { createRequire as createRequire2 } from "module";
 
 // src/safe-file.ts
@@ -25,9 +25,9 @@ import { dirname, isAbsolute, join, relative, resolve, sep } from "path";
 function pathError(message) {
   return Object.assign(new Error(message), { code: "EINVAL" });
 }
-function existingEntry(path18) {
+function existingEntry(path17) {
   try {
-    return lstatSync(path18);
+    return lstatSync(path17);
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
@@ -1488,8 +1488,8 @@ async function readBoundedJson(response, maxBytes = MAX_CONTROL_RESPONSE_BYTES)
 var TOKEN_SKEW_MS = 6e4;
 function buildTokenUrl(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path18 = url.pathname.replace(/\/$/, "");
-  url.pathname = path18.endsWith("/manifest") ? `${path18.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  const path17 = url.pathname.replace(/\/$/, "");
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1657,8 +1657,8 @@ function authFailureMessage(status, config) {
 }
 function buildRulesUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path18 = url.pathname.replace(/\/$/, "");
-  url.pathname = path18.endsWith("/manifest") ? `${path18.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
+  const path17 = url.pathname.replace(/\/$/, "");
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1673,16 +1673,16 @@ function buildSettingsUrl(endpoint, siteUuid) {
 }
 function buildPackageRemovedUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path18 = url.pathname.replace(/\/$/, "");
-  url.pathname = path18.endsWith("/manifest") ? `${path18.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
+  const path17 = url.pathname.replace(/\/$/, "");
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
 }
 function buildInputMapUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path18 = url.pathname.replace(/\/$/, "");
-  url.pathname = path18.endsWith("/manifest") ? `${path18.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
+  const path17 = url.pathname.replace(/\/$/, "");
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -2336,6 +2336,7 @@ function isUnpublishableHost(hostname) {
   if (!host.includes(".")) return true;
   return RESERVED_SUFFIXES.some((suffix) => host.endsWith(suffix));
 }
+var URL_MAX_LENGTH = 191;
 function normaliseSiteUrl(value) {
   const trimmed = (value ?? "").trim();
   if (trimmed === "") return null;
@@ -2349,7 +2350,7 @@ function normaliseSiteUrl(value) {
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
   if (parsed.hostname === "" || isUnpublishableHost(parsed.hostname)) return null;
   const origin = `${parsed.protocol}//${parsed.host}`;
-  return origin.length <= 191 ? origin : null;
+  return origin.length <= URL_MAX_LENGTH ? origin : null;
 }
 var PRODUCTION_URL_SOURCES = [
   {
@@ -2678,10 +2679,10 @@ async function persistTimeout(cwd, timeoutMs) {
   return writeConfigFile(cwd, { ...existing, timeoutMs });
 }
 async function persistApiKey(cwd, apiKey) {
-  const { apiKey: _movedKey, pulseAuth: _movedPulse, ...publicConfig } = await readConfigFile(cwd);
+  const { apiKey: movedKey, pulseAuth: movedPulse, ...publicConfig } = await readConfigFile(cwd);
   const existingSecrets = await readSecretFile(cwd);
   const target = await writeSecretFile(cwd, { ...existingSecrets, apiKey, pulseAuth: void 0 });
-  if (_movedKey !== void 0 || _movedPulse !== void 0) {
+  if (movedKey !== void 0 || movedPulse !== void 0) {
     await writeConfigFile(cwd, publicConfig);
   }
   return target;
@@ -3460,10 +3461,10 @@ function detectDeploymentShapes(cwd, opts = {}) {
     boundary = realpathSync3(boundary);
   } catch {
   }
-  const inProject = (path18) => {
+  const inProject = (path17) => {
     if (opts.followOutside) return true;
     try {
-      return isInside(realpathSync3(path18), boundary);
+      return isInside(realpathSync3(path17), boundary);
     } catch {
       return false;
     }
@@ -4100,14 +4101,6 @@ var tanstackSupabaseAdapter = {
 // src/protect/install/adapters/next.ts
 import { existsSync as existsSync5 } from "fs";
 import { join as join7 } from "path";
-function hasNextDep(cwd) {
-  try {
-    const pkg = JSON.parse(read(join7(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.next);
-  } catch {
-    return false;
-  }
-}
 function middlewareInfo(cwd) {
   const candidates = ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"];
   for (const rel of candidates) {
@@ -4117,7 +4110,7 @@ function middlewareInfo(cwd) {
   return { relDir: useSrc ? "src" : ".", relFile: useSrc ? "src/middleware.ts" : "middleware.ts", exists: false };
 }
 function detect2(cwd) {
-  return hasNextDep(cwd);
+  return hasDependency(cwd, "next");
 }
 function rulesFile(relDir) {
   return relDir === "." ? "patchstack.rules.json" : `${relDir}/patchstack.rules.json`;
@@ -4171,9 +4164,6 @@ var nextAdapter = {
   verify: verify2
 };
 
-// src/protect/install/adapters/sveltekit.ts
-import { join as join9 } from "path";
-
 // src/protect/install/seam.ts
 import { existsSync as existsSync6 } from "fs";
 import { join as join8, dirname as dirname3 } from "path";
@@ -4231,12 +4221,7 @@ var SPEC = {
   seamLabel: "SvelteKit server hook"
 };
 function detect3(cwd) {
-  try {
-    const pkg = JSON.parse(read(join9(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }["@sveltejs/kit"]);
-  } catch {
-    return false;
-  }
+  return hasDependency(cwd, "@sveltejs/kit");
 }
 function wire3(cwd, opts) {
   return wireSeam(cwd, opts, SPEC);
@@ -4253,7 +4238,6 @@ var sveltekitAdapter = {
 };
 
 // src/protect/install/adapters/astro.ts
-import { join as join10 } from "path";
 var SPEC2 = {
   templateName: "astro-middleware.ts",
   candidates: ["src/middleware.ts", "src/middleware.js", "src/middleware/index.ts", "src/middleware/index.js"],
@@ -4263,12 +4247,7 @@ var SPEC2 = {
   seamLabel: "Astro middleware"
 };
 function detect4(cwd) {
-  try {
-    const pkg = JSON.parse(read(join10(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.astro);
-  } catch {
-    return false;
-  }
+  return hasDependency(cwd, "astro");
 }
 function wire4(cwd, opts) {
   return wireSeam(cwd, opts, SPEC2);
@@ -4312,7 +4291,7 @@ var nuxtAdapter = {
 
 // src/protect/install/find-app.ts
 import { readFileSync as readFileSync8, readdirSync as readdirSync3, lstatSync as lstatSync2 } from "fs";
-import { join as join11, relative as relative3, dirname as dirname4 } from "path";
+import { join as join9, relative as relative3, dirname as dirname4 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   "node_modules",
   "patchstack",
@@ -4344,7 +4323,7 @@ function findAppInstance(cwd, re) {
     }
     for (const name of entries) {
       if (SKIP_DIRS2.has(name) || name.startsWith(".")) continue;
-      const p = join11(dir, name);
+      const p = join9(dir, name);
       let st;
       try {
         st = lstatSync2(p);
@@ -4403,7 +4382,7 @@ function declaredEntries(cwd) {
   const paths = /* @__PURE__ */ new Set();
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync8(join11(cwd, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync8(join9(cwd, "package.json"), "utf8"));
   } catch {
     return paths;
   }
@@ -4430,16 +4409,16 @@ function importSpecifier(fromRel, toRel, preserveExtension = false) {
 
 // src/protect/install/register.ts
 import { existsSync as existsSync9 } from "fs";
-import { join as join14, resolve as resolve3 } from "path";
+import { join as join12, resolve as resolve3 } from "path";
 
 // src/protect/install/generic.ts
 import { readFileSync as readFileSync9, existsSync as existsSync8, readdirSync as readdirSync4, lstatSync as lstatSync3 } from "fs";
-import { join as join13, dirname as dirname6 } from "path";
+import { join as join11, dirname as dirname6 } from "path";
 
 // src/protect/install/source-scope.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync7 } from "fs";
-import { dirname as dirname5, join as join12, resolve as resolve2 } from "path";
+import { dirname as dirname5, join as join10, resolve as resolve2 } from "path";
 
 // src/protect/install/node-flags.ts
 var flagName = (token) => token.split("=")[0];
@@ -4729,8 +4708,8 @@ function moduleKindOf(filePath, packageIsModule) {
 }
 function resolvesToGuardModule(specifier, query) {
   const resolved = resolve2(dirname5(query.fromFile), specifier);
-  if (withoutModuleExtension(resolved) !== join12(query.guardDir, "guard")) return false;
-  const existing = GUARD_FILENAMES.filter((name) => existsSync7(join12(query.guardDir, name)));
+  if (withoutModuleExtension(resolved) !== join10(query.guardDir, "guard")) return false;
+  const existing = GUARD_FILENAMES.filter((name) => existsSync7(join10(query.guardDir, name)));
   if (existing.length === 0) return false;
   const extension = /(\.[A-Za-z0-9]+)$/.exec(specifier)?.[1] ?? "";
   if (!query.strictExtensions) return true;
@@ -4749,16 +4728,16 @@ function withoutModuleExtension(filePath) {
 // src/protect/install/generic.ts
 function packageIsEsm(cwd) {
   try {
-    return JSON.parse(read(join13(cwd, "package.json"))).type === "module";
+    return JSON.parse(read(join11(cwd, "package.json"))).type === "module";
   } catch {
     return false;
   }
 }
 function genericDir(cwd) {
-  return existsSync8(join13(cwd, "src")) ? "src/patchstack" : "patchstack";
+  return existsSync8(join11(cwd, "src")) ? "src/patchstack" : "patchstack";
 }
 function hasTypeScript(cwd) {
-  return existsSync8(join13(cwd, "tsconfig.json")) || candidateEntries(cwd).some((entry) => /\.tsx?$/.test(entry));
+  return existsSync8(join11(cwd, "tsconfig.json")) || candidateEntries(cwd).some((entry) => /\.tsx?$/.test(entry));
 }
 function genericGuardTarget(cwd) {
   if (hasTypeScript(cwd)) {
@@ -4772,7 +4751,7 @@ function genericGuardTarget(cwd) {
 function genericScaffoldFiles(cwd) {
   const dir = genericDir(cwd);
   const candidates = ["guard.ts", "guard.js", "guard.cjs", "rules.json"];
-  return candidates.map((file) => `${dir}/${file}`).filter((relative8) => existsSync8(join13(cwd, relative8)));
+  return candidates.map((file) => `${dir}/${file}`).filter((relative8) => existsSync8(join11(cwd, relative8)));
 }
 function scaffoldGeneric(cwd, opts, guardTemplate, guardFile) {
   const target = genericGuardTarget(cwd);
@@ -4780,15 +4759,15 @@ function scaffoldGeneric(cwd, opts, guardTemplate, guardFile) {
   guardFile ??= target.file;
   const templates = templatesDir();
   const dir = genericDir(cwd);
-  const dst = join13(cwd, dir);
+  const dst = join11(cwd, dir);
   ensureProjectDirectorySync(cwd, dst);
-  copyProjectFileSync(cwd, join13(templates, guardTemplate), join13(dst, guardFile));
+  copyProjectFileSync(cwd, join11(templates, guardTemplate), join11(dst, guardFile));
   const guardRel = `${dir}/${guardFile}`;
   const changed = [guardRel];
   if (!opts.demo) bakeSiteUuid(cwd, guardRel);
-  const rulesDst = join13(dst, "rules.json");
+  const rulesDst = join11(dst, "rules.json");
   if (opts.demo || !existsSync8(rulesDst)) {
-    copyProjectFileSync(cwd, join13(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    copyProjectFileSync(cwd, join11(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
     changed.push(`${dir}/rules.json`);
   }
   return { changed, dir };
@@ -4809,25 +4788,17 @@ function candidateEntries(cwd) {
     "app.ts",
     "app.js"
   ];
-  const hits = names.filter((n) => existsSync8(join13(cwd, n)));
+  const hits = names.filter((n) => existsSync8(join11(cwd, n)));
   try {
-    const pkg = JSON.parse(read(join13(cwd, "package.json")));
-    if (typeof pkg.main === "string" && existsSync8(join13(cwd, pkg.main))) hits.push(pkg.main);
+    const pkg = JSON.parse(read(join11(cwd, "package.json")));
+    if (typeof pkg.main === "string" && existsSync8(join11(cwd, pkg.main))) hits.push(pkg.main);
   } catch {
   }
   return [...new Set(hits)];
 }
-function usesExpress(cwd) {
-  try {
-    const pkg = JSON.parse(read(join13(cwd, "package.json")));
-    return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }.express);
-  } catch {
-    return false;
-  }
-}
 function wiringPlan(cwd, dir) {
   const entries = candidateEntries(cwd);
-  const express = usesExpress(cwd);
+  const express = hasDependency(cwd, "express");
   const target = genericGuardTarget(cwd);
   const lines = [
     `no built-in adapter matched this stack \u2014 scaffolded a generic guard at ${dir}/${target.file} + ${dir}/rules.json.`,
@@ -4923,9 +4894,9 @@ function escapeForRegExp(value) {
 function genericVerify(cwd) {
   const dir = genericDir(cwd);
   const target = genericGuardTarget(cwd);
-  const present2 = GUARD_FILENAMES.find((name) => existsSync8(join13(cwd, dir, name)));
+  const present2 = GUARD_FILENAMES.find((name) => existsSync8(join11(cwd, dir, name)));
   const scaffolded = present2 !== void 0;
-  const imported = scaffolded && guardIsImported(cwd, join13(cwd, dir, present2));
+  const imported = scaffolded && guardIsImported(cwd, join11(cwd, dir, present2));
   return {
     wired: scaffolded && imported,
     checks: [
@@ -4961,7 +4932,7 @@ var NON_RUNTIME_DIRS = /* @__PURE__ */ new Set([
 function guardIsImported(cwd, guardPath) {
   const guardDir = dirname6(guardPath);
   const packageIsModule = packageIsEsm(cwd);
-  const root = existsSync8(join13(cwd, "src")) ? join13(cwd, "src") : cwd;
+  const root = existsSync8(join11(cwd, "src")) ? join11(cwd, "src") : cwd;
   let found = false;
   const walk2 = (d, depth) => {
     if (found || depth > 8) return;
@@ -4974,7 +4945,7 @@ function guardIsImported(cwd, guardPath) {
     for (const name of entries) {
       if (found) return;
       if (NON_RUNTIME_DIRS.has(name) || name.startsWith(".")) continue;
-      const p = join13(d, name);
+      const p = join11(d, name);
       let st;
       try {
         st = lstatSync3(p);
@@ -5033,7 +5004,7 @@ function guardTarget(cwd, entryRel, spec) {
 }
 function packageType(cwd) {
   try {
-    return JSON.parse(read(join14(cwd, "package.json"))).type;
+    return JSON.parse(read(join12(cwd, "package.json"))).type;
   } catch {
     return void 0;
   }
@@ -5069,8 +5040,8 @@ function bindsGuard(line, maskedLine, importName, call, fileRel, guard) {
 }
 function namesGuardModule(specifier, fileRel, guard) {
   return resolvesToGuardModule(specifier, {
-    fromFile: join14(guard.cwd, fileRel),
-    guardDir: resolve3(join14(guard.cwd, guard.guardDir)),
+    fromFile: join12(guard.cwd, fileRel),
+    guardDir: resolve3(join12(guard.cwd, guard.guardDir)),
     kind: moduleKindOf(fileRel, packageType(guard.cwd) === "module"),
     strictExtensions: true
   });
@@ -5089,7 +5060,7 @@ function wireRegister(cwd, opts, spec) {
   }
   const target = guardTarget(cwd, entry.relPath, spec);
   const { changed, dir } = scaffoldGeneric(cwd, opts, target.template, target.file);
-  const p = join14(cwd, entry.relPath);
+  const p = join12(cwd, entry.relPath);
   const s = read(p);
   const state = wiringState(s, spec, entry.appVar, entry.relPath, { cwd, guardDir: dir });
   if (state.importAtTopLevel && state.callInAppScope) {
@@ -5159,17 +5130,17 @@ function firstStatementLine(lines) {
   return i;
 }
 function serverIsGuarded(cwd, spec, server, guardDir) {
-  const source = read(join14(cwd, server.relPath));
+  const source = read(join12(cwd, server.relPath));
   const state = wiringState(source, spec, server.appVar, server.relPath, { cwd, guardDir });
   if (!state.importAtTopLevel || !state.callInAppScope || !state.ordered) return false;
   return !spec.callAfter || routesBefore(source, server.appVar, state.callIndex).length === 0;
 }
 function verifyRegister(cwd, spec) {
-  const dir = existsSync9(join14(cwd, "src")) ? "src/patchstack" : "patchstack";
+  const dir = existsSync9(join12(cwd, "src")) ? "src/patchstack" : "patchstack";
   const entry = findAppInstance(cwd, spec.appRe);
   const target = entry ? guardTarget(cwd, entry.relPath, spec) : null;
-  const scaffolded = target ? existsSync9(join14(cwd, dir, target.file)) : false;
-  const entrySource = entry ? read(join14(cwd, entry.relPath)) : "";
+  const scaffolded = target ? existsSync9(join12(cwd, dir, target.file)) : false;
+  const entrySource = entry ? read(join12(cwd, entry.relPath)) : "";
   const state = entry ? wiringState(entrySource, spec, entry.appVar, entry.relPath, { cwd, guardDir: dir }) : { importAtTopLevel: false, callInAppScope: false, ordered: false, callIndex: -1, appIndex: -1 };
   const wired = state.importAtTopLevel && state.callInAppScope && state.ordered;
   const early = spec.callAfter && entry ? routesBefore(entrySource, entry.appVar, state.callIndex) : [];
@@ -5260,7 +5231,7 @@ var expressAdapter = {
 
 // src/protect/install/reporting.ts
 import { existsSync as existsSync10 } from "fs";
-import { join as join15 } from "path";
+import { join as join13 } from "path";
 
 // src/protect/reporting-state.js
 var REPORTING_STATES = Object.freeze([
@@ -5318,7 +5289,7 @@ function explainReportingState(state) {
 
 // src/protect/install/reporting.ts
 function siteIdentity(cwd, env) {
-  const rc = join15(cwd, ".patchstackrc.json");
+  const rc = join13(cwd, ".patchstackrc.json");
   let recorded;
   if (existsSync10(rc)) {
     try {
@@ -5838,6 +5809,17 @@ function renderGuideChecklist(state, useColor) {
     lines.push("   Avoid lockfile / dependency / manifest / npm / UUID when speaking to them.");
     lines.push("");
   }
+  if (state.siteUuid === null) {
+    lines.push(` ${paint(ANSI.cyan, "\u279C")} ${paint(ANSI.bold, "Nothing is set up yet \u2014 two commands cover the steps below:")}`);
+    if (state.installed?.section !== "dependencies") {
+      lines.push(`   ${installCommand(state.packageManager)}`);
+    }
+    lines.push("   npx @patchstack/connect setup");
+    lines.push("   setup provisions the site, adds the widget, installs and verifies runtime protection,");
+    lines.push("   and wires the install and build scans, then prints this checklist again. Anything");
+    lines.push("   still listed there is a step setup could not apply safely, and is yours to finish.");
+    lines.push("");
+  }
   if (state.installed?.section === "dependencies") {
     lines.push(done(`@patchstack/connect installed (${state.installed.version}, ${state.installed.section})`));
   } else if (state.installed !== null) {
@@ -6004,11 +5986,6 @@ function renderGuideChecklist(state, useColor) {
   return lines.join("\n");
 }
 
-// src/login.ts
-import { mkdtempSync } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import path14 from "path";
-
 // src/device-flow.ts
 import {
   closeSync as closeSync2,
@@ -6309,7 +6286,7 @@ import { relative as relative4 } from "path";
 
 // src/protect/install/runtime/entry.ts
 import { existsSync as existsSync13, readFileSync as readFileSync13, realpathSync as realpathSync4, statSync as statSync6 } from "fs";
-import { join as join16, resolve as resolve4, sep as sep2 } from "path";
+import { join as join14, resolve as resolve4, sep as sep2 } from "path";
 var CONVENTIONAL = [
   "server.js",
   "server.mjs",
@@ -6335,15 +6312,15 @@ var CONVENTIONAL = [
 var LOADABLE = /\.(?:js|mjs|cjs)$/;
 function readPackage2(cwd) {
   try {
-    const parsed = JSON.parse(readFileSync13(join16(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync13(join14(cwd, "package.json"), "utf8"));
     return parsed !== null && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
   }
 }
-function isFile(path18) {
+function isFile(path17) {
   try {
-    return statSync6(path18).isFile();
+    return statSync6(path17).isFile();
   } catch {
     return false;
   }
@@ -6352,14 +6329,14 @@ function loadable(cwd, candidate) {
   const written = resolve4(cwd, candidate);
   if (!LOADABLE.test(written) || !isFile(written)) return null;
   let root;
-  let path18;
+  let path17;
   try {
     root = realpathSync4(cwd);
-    path18 = realpathSync4(written);
+    path17 = realpathSync4(written);
   } catch {
     return null;
   }
-  if (path18 !== root && !path18.startsWith(root + sep2)) return null;
+  if (path17 !== root && !path17.startsWith(root + sep2)) return null;
   return written;
 }
 function passable(token) {
@@ -6405,7 +6382,7 @@ function resolveEntry(cwd) {
   }
   return {
     kind: "unavailable",
-    reason: existsSync13(join16(cwd, "package.json")) ? 'no directly loadable entry was found \u2014 declare one as a "start" script of the form `node <file>`, or run the check against a built output' : "there is no package.json here"
+    reason: existsSync13(join14(cwd, "package.json")) ? 'no directly loadable entry was found \u2014 declare one as a "start" script of the form `node <file>`, or run the check against a built output' : "there is no package.json here"
   };
 }
 
@@ -6439,8 +6416,8 @@ function preloadPath() {
     // beside this file, in the repository
   ];
   for (const candidate of candidates) {
-    const path18 = fileURLToPath2(candidate);
-    if (existsSync14(path18)) return path18;
+    const path17 = fileURLToPath2(candidate);
+    if (existsSync14(path17)) return path17;
   }
   return null;
 }
@@ -6787,15 +6764,15 @@ function formatRuntimeCheck(report) {
 }
 
 // src/map-command.ts
-import path15 from "path";
+import path14 from "path";
 
 // src/map/ts-loader.ts
 import { createRequire } from "module";
 import { pathToFileURL } from "url";
-import { join as join17 } from "path";
+import { join as join15 } from "path";
 async function loadTypeScript(cwd) {
   try {
-    const req = createRequire(pathToFileURL(join17(cwd, "package.json")));
+    const req = createRequire(pathToFileURL(join15(cwd, "package.json")));
     const resolved = req.resolve("typescript");
     const mod = await import(pathToFileURL(resolved).href);
     return mod.default ?? mod;
@@ -7225,7 +7202,7 @@ function dedupeSinks(sinks, owner) {
 
 // src/map/module-graph.ts
 import { readFileSync as readFileSync14, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
-import { dirname as dirname8, join as join18, relative as relative5, resolve as resolvePath } from "path";
+import { dirname as dirname8, join as join16, relative as relative5, resolve as resolvePath } from "path";
 var RESOLVE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 function createModuleGraph(ts, opts) {
   const cache = /* @__PURE__ */ new Map();
@@ -7303,7 +7280,7 @@ function resolveRelativeModule(fromFile, spec) {
   }
   candidates.push(base);
   for (const e of RESOLVE_EXTS) candidates.push(base + e);
-  for (const e of RESOLVE_EXTS) candidates.push(join18(base, "index" + e));
+  for (const e of RESOLVE_EXTS) candidates.push(join16(base, "index" + e));
   for (const c of candidates) {
     try {
       if (statSync7(c).isFile()) return c;
@@ -7332,8 +7309,8 @@ function collectCallees(sf, ts) {
 }
 
 // src/map/coordinates.ts
-function runtimeCoordinate(source, path18) {
-  if (/\[\d*\]/.test(path18)) {
+function runtimeCoordinate(source, path17) {
+  if (/\[\d*\]/.test(path17)) {
     return { runtimeParameter: null, runtimeParameterReason: "array traversal: needs an array_key_value rule, not a dotted parameter" };
   }
   switch (source) {
@@ -7342,15 +7319,15 @@ function runtimeCoordinate(source, path18) {
     case "multipart":
     case "body":
     case "server-fn-data":
-      return { runtimeParameter: `post.${path18}` };
+      return { runtimeParameter: `post.${path17}` };
     case "query":
-      return { runtimeParameter: `get.${path18}` };
+      return { runtimeParameter: `get.${path17}` };
     case "cookie":
-      return { runtimeParameter: `cookie.${path18}` };
+      return { runtimeParameter: `cookie.${path17}` };
     case "file":
-      return { runtimeParameter: `files.${path18}` };
+      return { runtimeParameter: `files.${path17}` };
     case "header":
-      return { runtimeParameter: `server.HTTP_${path18.toUpperCase().replace(/-/g, "_")}` };
+      return { runtimeParameter: `server.HTTP_${path17.toUpperCase().replace(/-/g, "_")}` };
     case "route-param":
       return { runtimeParameter: null, runtimeParameterReason: "route parameters are not exposed by the runtime resolver" };
     default:
@@ -7382,8 +7359,8 @@ function addressSpaceOf(source) {
 function isProvenFlow(confidence) {
   return confidence === "exact-local" || confidence === "transformed-local";
 }
-function inputIdOf(source, path18) {
-  return `${addressSpaceOf(source)}:${path18}`;
+function inputIdOf(source, path17) {
+  return `${addressSpaceOf(source)}:${path17}`;
 }
 function withCoordinates(fields, source) {
   return fields.map((f) => {
@@ -7601,8 +7578,8 @@ function linkFlows(bodyNode, params, inputs, sinks, ts, invocations) {
   }
   const CONTAINER_KEYS = /* @__PURE__ */ new Set([...REQ_SOURCES, "data", "input", "payload"]);
   const rootPath = /* @__PURE__ */ new Map();
-  const addRoot = (name, path18, space) => {
-    if (!rootPath.has(name)) rootPath.set(name, { path: path18, space });
+  const addRoot = (name, path17, space) => {
+    if (!rootPath.has(name)) rootPath.set(name, { path: path17, space });
   };
   for (const p of params ?? []) {
     if (!p?.name) continue;
@@ -7797,8 +7774,8 @@ function dedupeLimitations(list) {
 function join22(base, seg) {
   return base ? `${base}.${seg}` : seg;
 }
-function normalizePath(path18) {
-  return path18.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
+function normalizePath(path17) {
+  return path17.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
 }
 function fluentChainCalls(call, ts) {
   let root = call;
@@ -8164,7 +8141,7 @@ function handlerEntry(name, kindLabel, params, body, ts, localSinks, bindings, c
 
 // src/map/imports.ts
 import { readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { join as join17 } from "path";
 var MAX_SITES2 = 5;
 var NPM_NAME = /^(?:@[^/@\s~][^/@\s]*\/)?[^/@\s.~][^/@\s]*$/;
 function isNpmPackageName(pkg) {
@@ -8175,7 +8152,7 @@ function readPathAliases(cwd) {
   for (const name of ["tsconfig.json", "jsconfig.json"]) {
     let paths;
     try {
-      const raw = readFileSync15(join19(cwd, name), "utf8");
+      const raw = readFileSync15(join17(cwd, name), "utf8");
       const parsed = JSON.parse(stripJsonComments(raw));
       paths = parsed.compilerOptions?.paths;
     } catch {
@@ -8662,7 +8639,7 @@ function getStringFlag(flags, name) {
 
 // src/build-stamp.ts
 import { lstatSync as lstatSync4, readFileSync as readFileSync17, readdirSync as readdirSync6, realpathSync as realpathSync7 } from "fs";
-import { join as join20, relative as relative7, sep as sep3 } from "path";
+import { join as join18, relative as relative7, sep as sep3 } from "path";
 var RULES_FILE_NAMES = /* @__PURE__ */ new Set(["rules.json", "patchstack.rules.json"]);
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "out", "coverage", "tmp", "vendor"]);
 var MAX_DEPTH2 = 6;
@@ -8680,11 +8657,11 @@ function guardImportsRulesFile(dir, rulesName) {
   }
   for (const name of siblings) {
     if (!GUARD_SOURCE.test(name)) continue;
-    const path18 = join20(dir, name);
+    const path17 = join18(dir, name);
     try {
-      const entry = lstatSync4(path18);
+      const entry = lstatSync4(path17);
       if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_GUARD_SOURCE_BYTES) continue;
-      const source = stripComments(readFileSync17(path18, "utf8"));
+      const source = stripComments(readFileSync17(path17, "utf8"));
       if (source.includes("@patchstack/connect/protect") && importsRules.test(source)) return true;
     } catch {
     }
@@ -8705,9 +8682,9 @@ function findRulesFile(cwd) {
   } catch {
     return { kind: "none" };
   }
-  const contained = (path18) => {
+  const contained = (path17) => {
     try {
-      const real = realpathSync7(path18);
+      const real = realpathSync7(path17);
       return real === root || real.startsWith(root + sep3);
     } catch {
       return false;
@@ -8723,25 +8700,25 @@ function findRulesFile(cwd) {
     }
     for (const name of entries) {
       if (name.startsWith(".")) continue;
-      const path18 = join20(dir, name);
+      const path17 = join18(dir, name);
       let entry;
       try {
-        entry = lstatSync4(path18);
+        entry = lstatSync4(path17);
       } catch {
         continue;
       }
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(name)) walk2(path18, depth + 1);
+        if (!SKIP_DIRECTORIES.has(name)) walk2(path17, depth + 1);
         continue;
       }
       if (!entry.isFile() || !RULES_FILE_NAMES.has(name)) continue;
-      if (!contained(path18)) continue;
+      if (!contained(path17)) continue;
       if (!guardImportsRulesFile(dir, name)) continue;
       try {
-        if (isRuleBundle(JSON.parse(readFileSync17(path18, "utf8")))) found.push(path18);
+        if (isRuleBundle(JSON.parse(readFileSync17(path17, "utf8")))) found.push(path17);
       } catch {
-        unreadable.push(path18);
+        unreadable.push(path17);
       }
     }
   };
@@ -8933,7 +8910,7 @@ async function runMap(flags) {
   const json = JSON.stringify(map, null, 2);
   const out = getStringFlag(flags, "out");
   if (out) {
-    atomicWriteFileSync(path15.resolve(out), json, { encoding: "utf8" });
+    atomicWriteFileSync(path14.resolve(out), json, { encoding: "utf8" });
     console.error(`patchstack: wrote ${out}`);
   } else if (flags.get("upload") !== true) {
     console.log(json);
@@ -8983,7 +8960,7 @@ async function runMap(flags) {
 
 // src/setup.ts
 import { readFileSync as readFileSync18 } from "fs";
-import path16 from "path";
+import path15 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
 function setupProtection(cwd) {
@@ -9008,7 +8985,7 @@ function prependHook(existing, command) {
   return [command, ...remaining].join(" && ");
 }
 function wireBuildScripts(cwd, packageManager) {
-  const target = path16.join(cwd, "package.json");
+  const target = path15.join(cwd, "package.json");
   const raw = readFileSync18(target, "utf8");
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
@@ -9276,6 +9253,20 @@ function parseArgs(argv) {
     flags
   };
 }
+function resolveCliConfig(args, extra = {}) {
+  return resolveConfig({
+    cwd: process.cwd(),
+    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
+    cliEndpoint: getStringFlag(args.flags, "endpoint"),
+    ...extra
+  });
+}
+function runningInCi() {
+  return process.env.CI !== void 0 && process.env.CI !== "" && process.env.CI !== "false";
+}
+function gitignoreOutcomeLine(ignore) {
+  return ignore.ignored ? "    Added to .gitignore." : `    NOT ignored by git \u2014 ${ignore.reason ?? "unknown reason"}. Add it to .gitignore yourself before committing.`;
+}
 async function runInit(args) {
   const uuid = args.positional[0];
   if (!uuid) {
@@ -9283,7 +9274,7 @@ async function runInit(args) {
     console.error("Usage: patchstack-connect init <site-uuid>");
     return 1;
   }
-  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(uuid)) {
+  if (!isCanonicalUuid(uuid)) {
     console.error(`Error: "${uuid}" does not look like a valid UUID.`);
     return 1;
   }
@@ -9294,15 +9285,11 @@ async function runInit(args) {
   return 0;
 }
 async function runClaim(args) {
-  if (process.env.CI !== void 0 && process.env.CI !== "" && process.env.CI !== "false") {
+  if (runningInCi()) {
     console.error("`claim` is interactive and cannot run in CI. Claim the site from a developer machine.");
     return 1;
   }
-  const config = await resolveConfig({
-    cwd: process.cwd(),
-    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-    cliEndpoint: getStringFlag(args.flags, "endpoint")
-  });
+  const config = await resolveCliConfig(args);
   const siteUuid = config.siteUuid;
   if (siteUuid === null) {
     console.error("\n  No site to claim yet \u2014 run `npx @patchstack/connect scan` first.\n");
@@ -9317,9 +9304,7 @@ async function runClaim(args) {
     if (result2.credentialSaved === true) {
       const ignore = await secretFileIgnored(process.cwd());
       console.log(`    A credential for this site was issued and saved to ${SECRET_CONFIG_FILENAME}.`);
-      console.log(
-        ignore.ignored ? "    Added to .gitignore." : `    NOT ignored by git \u2014 ${ignore.reason ?? "unknown reason"}. Add it to .gitignore yourself before committing.`
-      );
+      console.log(gitignoreOutcomeLine(ignore));
     }
     console.log("");
     return 0;
@@ -9395,22 +9380,16 @@ async function runClaim(args) {
   return 1;
 }
 async function runLogin(args) {
-  if (process.env.CI !== void 0 && process.env.CI !== "" && process.env.CI !== "false") {
+  if (runningInCi()) {
     console.error("`login` is interactive and cannot run in CI. Set PATCHSTACK_PULSE_AUTH instead.");
     return 1;
   }
-  const config = await resolveConfig({
-    cwd: process.cwd(),
-    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-    cliEndpoint: getStringFlag(args.flags, "endpoint")
-  });
+  const config = await resolveCliConfig(args);
   const approved = async () => {
     const ignore = await secretFileIgnored(process.cwd());
     console.log(`
   \u2713 Credential restored and saved to ${SECRET_CONFIG_FILENAME}.`);
-    console.log(
-      ignore.ignored ? "    Added to .gitignore." : `    NOT ignored by git \u2014 ${ignore.reason ?? "unknown reason"}. Add it to .gitignore yourself before committing.`
-    );
+    console.log(gitignoreOutcomeLine(ignore));
     console.log("    The previous credential no longer works. Update it anywhere else it was set:");
     console.log("    CI secrets, hosting env vars, preview environments, other checkouts.\n");
     return 0;
@@ -9513,10 +9492,7 @@ async function postManifestWithPatience(config, payload) {
 }
 async function runScan(args, options = {}) {
   const dryRun = args.flags.get("dry-run") === true;
-  const config = await resolveConfig({
-    cwd: process.cwd(),
-    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-    cliEndpoint: getStringFlag(args.flags, "endpoint"),
+  const config = await resolveCliConfig(args, {
     cliClaimToken: getStringFlag(args.flags, "claim-token"),
     // The one command that reports them, so the one command that resolves them.
     detectSiteIdentity: true
@@ -9788,12 +9764,7 @@ async function runDemoCommand(args) {
   try {
     const scenario = resolveDemoScenario(args.positional[0]);
     const cwd = process.cwd();
-    const config = await resolveConfig({
-      cwd,
-      cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-      cliEndpoint: getStringFlag(args.flags, "endpoint"),
-      requireSiteUuid: true
-    });
+    const config = await resolveCliConfig(args, { requireSiteUuid: true });
     if (config.environment !== "production") {
       throw new DemoError(
         "The production-backed demo requires PATCHSTACK_ENVIRONMENT=production. Unset the sandbox override and try again."
@@ -9994,11 +9965,7 @@ function setupOutcome(state, protection, wired) {
   return lines;
 }
 async function runStatus(args) {
-  const config = await resolveConfig({
-    cwd: process.cwd(),
-    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-    cliEndpoint: getStringFlag(args.flags, "endpoint")
-  });
+  const config = await resolveCliConfig(args);
   console.log(`Site UUID:   ${config.siteUuid ?? "(none yet \u2014 the next `scan` will provision one)"}`);
   console.log(
     `Endpoint:    ${config.endpoint}${config.endpoint === DEFAULT_ENDPOINT ? "" : " (override)"}`
@@ -10034,11 +10001,7 @@ async function runStatus(args) {
   return 0;
 }
 async function runUninstall(args) {
-  const config = await resolveConfig({
-    cwd: process.cwd(),
-    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
-    cliEndpoint: getStringFlag(args.flags, "endpoint")
-  });
+  const config = await resolveCliConfig(args);
   if (config.siteUuid === null) {
     console.log("No site UUID configured \u2014 there is no site record to signal about.");
     console.log('Continue with the local removal steps in AGENT-INSTALL.md ("Uninstalling").');
@@ -10078,7 +10041,7 @@ function describeStack(stack) {
 }
 function readBuildScript(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync19(path17.join(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync19(path16.join(cwd, "package.json"), "utf8"));
     return pkg.scripts?.build;
   } catch {
     return void 0;