@patchstack/connect 0.5.12 → 0.5.15

package/dist/protect.cjs

@@ -397,13 +397,13 @@ function buildEndpointUrl(base, siteUuid) {
 function authFailureMessage(status, config) {
   const hasCredential = typeof config.pulseAuth === "string" && config.pulseAuth.length > 0;
   if (status === 401 && !hasCredential) {
-    return "Patchstack requires an API credential for this site and none is configured. Run `npx patchstack-connect login`, or set PATCHSTACK_API_KEY.";
+    return "Patchstack needs this project's API key, and none is set here. Run npx @patchstack/connect login, or set PATCHSTACK_API_KEY.";
   }
   if (status === 401) {
-    return "Patchstack rejected this API credential. It may have expired, been revoked, or the site may no longer exist. Run `npx patchstack-connect login` to issue a new one.";
+    return "Patchstack did not accept this project's API key: it may have expired or been revoked, or the project may no longer exist. Run npx @patchstack/connect login to get a new one.";
   }
   if (status === 403) {
-    return "This API credential is not permitted to act on this site. Check that siteUuid in .patchstackrc.json matches the credential (a credential is issued for one site).";
+    return "This API key belongs to a different project. Check that siteUuid in .patchstackrc.json is the project the key was made for.";
   }
   return null;
 }
@@ -1145,7 +1145,7 @@ function unreadableWarning(filename, report) {
   if (report.unreadable === 0) return null;
   const shown = report.samples.join(", ");
   const one = report.unreadable === 1;
-  return `${filename}: ${report.unreadable} entr${one ? "y was" : "ies were"} not in a form this scanner reads (${shown}${report.unreadable > report.samples.length ? ", \u2026" : ""}), so ${one ? "it is" : "they are"} absent from this manifest. Anything installed only through ${one ? "that entry" : "those entries"} is not being checked.`;
+  return `${filename}: ${report.unreadable} entr${one ? "y" : "ies"} could not be read (${shown}${report.unreadable > report.samples.length ? ", \u2026" : ""}), so ${one ? "that package is" : "those packages are"} not being checked.`;
 }
 var MAX_SAMPLES;
 var init_report = __esm({
@@ -2083,7 +2083,7 @@ async function scanLockfile(cwd) {
       warnings.push(staleWarning("node_modules/", missing));
     }
     warnings.push(
-      walkWasCandidate ? "Reporting node_modules/, which is what the build loads." : "Scanned node_modules/ instead. Delete the stale lockfile to silence this warning."
+      walkWasCandidate ? "Checked the installed packages in node_modules/, which is what the build loads." : "Checked the installed packages in node_modules/ instead. Delete the out-of-date package list file to stop this warning."
     );
     return manifestWith(walked, warnings);
   }
@@ -2095,7 +2095,7 @@ async function scanLockfile(cwd) {
     );
   }
   warnings.push(
-    `No fully-consistent source found; reporting ${firstParsed.filename}. The manifest may understate the real dependency set.`
+    `No package list matches package.json; checked ${firstParsed.filename}, so some packages may be missing. Reinstall your packages to fix this.`
   );
   return manifestWith(firstParsed.packages, warnings);
 }
@@ -2109,12 +2109,12 @@ function otherCompleteSources(all, current, declared) {
 }
 function conflictWarning(filename, conflicts) {
   const shown = conflicts.slice(0, 3).map(({ other, conflict }) => `${conflict.name} ${conflict.version} vs ${conflict.otherVersion} in ${other}`).join("; ");
-  return `${filename} and another lockfile disagree about installed versions (${shown}${conflicts.length > 3 ? `, +${conflicts.length - 3} more` : ""}). Scanned node_modules/ instead. Remove whichever lockfile your package manager does not maintain.`;
+  return `${filename} and another package list file give different versions (${shown}${conflicts.length > 3 ? `, +${conflicts.length - 3} more` : ""}). Checked node_modules/ instead. Delete the file your package manager does not use.`;
 }
 function staleWarning(source, missing) {
   const sample = missing.slice(0, 3).join(", ");
   const suffix = missing.length > 3 ? `, +${missing.length - 3} more` : "";
-  return `${source} looks stale: package.json declares ${missing.length} dependenc${missing.length === 1 ? "y" : "ies"} it does not contain (${sample}${suffix}).`;
+  return `${source} is out of date: it is missing ${missing.length} package${missing.length === 1 ? "" : "s"} listed in package.json (${sample}${suffix}). Run ${INSTALL_BY_SOURCE[source] ?? "your install command"} to update it.`;
 }
 async function presentLockfiles(cwd) {
   const probed = await Promise.all(
@@ -2149,7 +2149,7 @@ async function exists(filePath) {
     return false;
   }
 }
-var import_promises9, import_node_path8, LOCKFILE_CANDIDATES;
+var import_promises9, import_node_path8, LOCKFILE_CANDIDATES, INSTALL_BY_SOURCE;
 var init_parsers = __esm({
   "src/parsers/index.ts"() {
     "use strict";
@@ -2173,6 +2173,13 @@ var init_parsers = __esm({
       { filename: "pnpm-lock.yaml", strategy: "pnpm-lockfile" },
       { filename: "yarn.lock", strategy: "yarn-lockfile" }
     ];
+    INSTALL_BY_SOURCE = {
+      "package-lock.json": "npm install",
+      "bun.lock": "bun install",
+      "bun.lockb": "bun install",
+      "pnpm-lock.yaml": "pnpm install",
+      "yarn.lock": "yarn install"
+    };
   }
 });
 
@@ -3527,6 +3534,184 @@ function hasAdjacentUnbounded(body, flags) {
   }
   return false;
 }
+function parseRepetition(body) {
+  let i = 0;
+  const parseAlternation = () => {
+    const branches = [parseSequence()];
+    while (body[i] === "|") {
+      i++;
+      branches.push(parseSequence());
+    }
+    return branches.length === 1 ? branches[0] : { type: "alt", branches };
+  };
+  const parseSequence = () => {
+    const items = [];
+    while (i < body.length && body[i] !== "|" && body[i] !== ")") {
+      const atom = parseAtom();
+      if (atom === null) return null;
+      const quantified = parseQuantifier(atom);
+      if (quantified === null) return null;
+      items.push(quantified);
+    }
+    return { type: "seq", items };
+  };
+  const parseAtom = () => {
+    const ch = body[i];
+    if (ch === "(") {
+      const start2 = i;
+      i++;
+      let kind = "capture";
+      if (body.startsWith("?:", i)) {
+        kind = "group";
+        i += 2;
+      } else if (body.startsWith("?=", i) || body.startsWith("?!", i)) {
+        kind = "look";
+        i += 2;
+      } else if (body.startsWith("?<=", i) || body.startsWith("?<!", i)) {
+        kind = "look";
+        i += 3;
+      } else if (body.startsWith("?<", i)) {
+        const close = body.indexOf(">", i + 2);
+        if (close === -1) return null;
+        i = close + 1;
+      } else if (body[i] === "?") {
+        return null;
+      }
+      const inner = parseAlternation();
+      if (inner === null || body[i] !== ")") return null;
+      i++;
+      return { type: "group", kind, body: inner, source: body.slice(start2, i) };
+    }
+    const start = i;
+    if (ch === "[") {
+      i++;
+      if (body[i] === "^") i++;
+      if (body[i] === "]") i++;
+      while (i < body.length && body[i] !== "]") i += body[i] === "\\" ? 2 : 1;
+      if (body[i] !== "]") return null;
+      i++;
+      return { type: "atom", source: body.slice(start, i) };
+    }
+    if (ch === "\\") {
+      const next = body[i + 1];
+      if (next === void 0) return null;
+      if ((next === "p" || next === "P" || next === "u") && body[i + 2] === "{") {
+        const close = body.indexOf("}", i + 3);
+        if (close === -1) return null;
+        i = close + 1;
+      } else if (next === "k" && body[i + 2] === "<") {
+        const close = body.indexOf(">", i + 3);
+        if (close === -1) return null;
+        i = close + 1;
+      } else {
+        i += 2;
+      }
+      return { type: /[bB]/.test(next) ? "assert" : "atom", source: body.slice(start, i) };
+    }
+    if (ch === "^" || ch === "$") {
+      i++;
+      return { type: "assert" };
+    }
+    if (ch === "*" || ch === "+" || ch === "?") return null;
+    i++;
+    return { type: "atom", source: body.slice(start, i) };
+  };
+  const parseQuantifier = (atom) => {
+    let min;
+    let max;
+    const ch = body[i];
+    if (ch === "*") [min, max, i] = [0, Infinity, i + 1];
+    else if (ch === "+") [min, max, i] = [1, Infinity, i + 1];
+    else if (ch === "?") [min, max, i] = [0, 1, i + 1];
+    else if (ch === "{") {
+      const bounds = /^\{(\d+)(,(\d*))?\}/.exec(body.slice(i));
+      if (!bounds) return atom;
+      min = Number(bounds[1]);
+      max = bounds[2] === void 0 ? min : bounds[3] === "" ? Infinity : Number(bounds[3]);
+      i += bounds[0].length;
+    } else {
+      return atom;
+    }
+    if (body[i] === "?") i++;
+    if (body[i] === "*" || body[i] === "+" || body[i] === "?" || body[i] === "{") return null;
+    return { type: "quant", min, max, body: atom };
+  };
+  const root = parseAlternation();
+  return root !== null && i === body.length ? root : null;
+}
+function* nodesOf(node) {
+  if (!node) return;
+  yield node;
+  if (node.type === "alt") for (const branch of node.branches) yield* nodesOf(branch);
+  else if (node.type === "seq") for (const item of node.items) yield* nodesOf(item);
+  else if (node.type === "group" || node.type === "quant") yield* nodesOf(node.body);
+}
+var BOUNDED_NESTING_LIMIT = 100;
+var BOUNDED_ALTERNATION_LIMIT = 16;
+var OPTIONAL_REPEAT_LIMIT = 8;
+function hasFencedRepetitions(quant, flags) {
+  let body = quant.body;
+  if (body.type === "group" && body.kind !== "look") body = body.body;
+  if (body.type !== "seq" || body.items.length < 2) return false;
+  const variable = [...nodesOf(body)].filter((n) => n.type === "quant" && (n.max > 1 || n.min < n.max));
+  if (variable.some((n) => n.body.type !== "atom" || n.body.source === void 0)) return false;
+  const atomFlags = flags.replace(/[^i]/g, "");
+  const unicode = /[uv]/.test(flags);
+  let insides;
+  try {
+    insides = variable.map((n) => new RegExp(`^(?:${n.body.source})$`, `${atomFlags}${unicode ? "u" : ""}`));
+  } catch {
+    return false;
+  }
+  const literalOf = (source) => {
+    if (source.length === 1 && !".[]()|^$\\".includes(source)) return source;
+    if (source.length === 2 && source[0] === "\\" && /[^\w\s]/.test(source[1])) return source[1];
+    return null;
+  };
+  const disjoint = (edge) => {
+    if (edge?.type !== "atom" || edge.source === void 0) return false;
+    const literal = literalOf(edge.source);
+    if (literal !== null) return insides.every((re) => !re.test(literal));
+    if (unicode) return false;
+    let fence;
+    try {
+      fence = new RegExp(`^(?:${edge.source})$`, atomFlags);
+    } catch {
+      return false;
+    }
+    for (let unit = 0; unit <= 65535; unit++) {
+      const ch = String.fromCharCode(unit);
+      if (fence.test(ch) && insides.some((re) => re.test(ch))) return false;
+    }
+    return true;
+  };
+  return disjoint(body.items[0]) || disjoint(body.items[body.items.length - 1]);
+}
+function hasCatastrophicShape(body, flags) {
+  const root = parseRepetition(body);
+  if (root === null) return null;
+  for (const node of nodesOf(root)) {
+    if (node.type === "group" && node.kind === "look" && hasAdjacentUnbounded(lookaroundBody(node.source), flags)) return true;
+    if (node.type !== "quant" || node.max <= 1) continue;
+    const fenced = hasFencedRepetitions(node, flags);
+    for (const inner of nodesOf(node.body)) {
+      if (inner === node.body && inner.type === "quant") continue;
+      if (inner.type === "quant" && inner.max > 1 && !fenced) {
+        if (node.max === Infinity || inner.max === Infinity || node.max * inner.max > BOUNDED_NESTING_LIMIT) return true;
+      }
+      if (inner.type === "quant" && inner.min === 0 && inner.max <= 1 && !fenced && (node.max === Infinity || node.max > OPTIONAL_REPEAT_LIMIT)) {
+        return true;
+      }
+      if (inner.type === "alt" && inner.branches.length > 1 && (node.max === Infinity || node.max > BOUNDED_ALTERNATION_LIMIT)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function lookaroundBody(source) {
+  return source.slice(source.startsWith("(?<") ? 4 : 3, -1);
+}
 function groupEnd(body, start) {
   let depth = 0;
   let inClass = false;
@@ -3553,6 +3738,8 @@ function warnRejectedPatternOnce(pattern) {
   );
 }
 var MAX_PATTERN_LENGTH = 1e3;
+var regexVerdicts = /* @__PURE__ */ new Map();
+var REGEX_VERDICT_LIMIT = 2048;
 function safeRegExp(pattern) {
   if (!pattern) {
     return null;
@@ -3564,16 +3751,32 @@ function safeRegExp(pattern) {
   if (!match) {
     return null;
   }
-  for (const dangerous of REDOS_PATTERNS) {
-    if (dangerous.test(match[1])) return null;
+  let safe = regexVerdicts.get(pattern);
+  if (safe === void 0) {
+    safe = isSafeBody(match[1], match[2]);
+    if (regexVerdicts.size >= REGEX_VERDICT_LIMIT) regexVerdicts.clear();
+    regexVerdicts.set(pattern, safe);
   }
-  if (hasAdjacentUnbounded(match[1], match[2])) return null;
+  if (!safe) return null;
   try {
     return new RegExp(match[1], match[2]);
   } catch {
     return null;
   }
 }
+function isSafeBody(body, flags) {
+  for (const dangerous of REDOS_PATTERNS) {
+    if (dangerous.test(body)) return false;
+  }
+  if (hasAdjacentUnbounded(body, flags)) return false;
+  if (hasCatastrophicShape(body, flags) === true) return false;
+  try {
+    new RegExp(body, flags);
+  } catch {
+    return false;
+  }
+  return true;
+}
 function ctypeResult(strValue, isClass, matchVal) {
   if (strValue === "") {
     return false;
@@ -5297,7 +5500,7 @@ function concatChunks(chunks, total) {
 }
 function parseBody(rawBody, contentType) {
   const ct = String(contentType || "").toLowerCase();
-  const isJson = ct.includes("application/json") || /\+json\b/.test(ct);
+  const isJson2 = ct.includes("application/json") || /\+json\b/.test(ct);
   const isForm = ct.includes("application/x-www-form-urlencoded");
   const isMultipart = ct.includes("multipart/form-data");
   const isAmbiguous = ct === "" || ct.startsWith("text/plain") || ct.includes("csp-report") || ct.includes("/json");
@@ -5311,7 +5514,7 @@ function parseBody(rawBody, contentType) {
     for (const [k, v] of new URLSearchParams(rawBody)) appendOwn(body, k, v);
     return { body, files: void 0 };
   }
-  if (isJson || isAmbiguous) {
+  if (isJson2 || isAmbiguous) {
     try {
       const parsed = JSON.parse(rawBody);
       if (parsed && typeof parsed === "object") return { body: parsed, files: void 0 };
@@ -5327,22 +5530,68 @@ function parseMultipart(rawBody, boundary) {
     const sep = /\r?\n\r?\n/.exec(part);
     if (!sep) continue;
     const rawHeaders = part.slice(0, sep.index);
-    const disposition = /content-disposition:[^\r\n]*/i.exec(rawHeaders)?.[0];
-    if (!disposition) continue;
-    const name = /name="([^"]*)"/i.exec(disposition)?.[1];
-    if (name == null) continue;
+    const disposition = /content-disposition:([^\r\n]*)/i.exec(rawHeaders)?.[1];
+    if (disposition === void 0) continue;
+    const { names, filename } = dispositionFields(disposition);
+    if (names.length === 0) continue;
     const content = part.slice(sep.index + sep[0].length).replace(/\r?\n$/, "");
-    const filename = /filename="([^"]*)"/i.exec(disposition)?.[1];
-    if (filename !== void 0) {
-      const partType = /content-type:\s*([^\r\n;]+)/i.exec(rawHeaders)?.[1]?.trim() || "";
-      const file = { filename, type: partType, content };
-      appendOwn(files, name, file);
-    } else {
-      appendOwn(body, name, content);
+    const file = filename === void 0 ? void 0 : { filename, type: /content-type:\s*([^\r\n;]+)/i.exec(rawHeaders)?.[1]?.trim() || "", content };
+    for (const name of names) {
+      if (file) appendOwn(files, name, file);
+      else appendOwn(body, name, content);
     }
   }
   return { body, files };
 }
+function dispositionFields(value) {
+  const text = String(value);
+  const names = /* @__PURE__ */ new Set();
+  let filename;
+  let extendedFilename;
+  let i = text.indexOf(";");
+  while (i !== -1 && i < text.length) {
+    i++;
+    while (text[i] === " " || text[i] === "	") i++;
+    let key = "";
+    while (i < text.length && text[i] !== "=" && text[i] !== ";") key += text[i++];
+    key = key.trim().toLowerCase();
+    let val = null;
+    if (text[i] === "=") {
+      i++;
+      while (text[i] === " " || text[i] === "	") i++;
+      if (text[i] === '"') {
+        i++;
+        val = "";
+        while (i < text.length && text[i] !== '"') {
+          if (text[i] === "\\" && i + 1 < text.length) i++;
+          val += text[i++];
+        }
+        i++;
+        while (i < text.length && text[i] !== ";") i++;
+      } else {
+        let bare = "";
+        while (i < text.length && text[i] !== ";") bare += text[i++];
+        val = bare.trim();
+      }
+    }
+    if (val !== null) {
+      if (key === "name") names.add(val);
+      else if (key === "filename") filename = val;
+      else if (key === "filename*") extendedFilename = decodeExtendedValue(val);
+    }
+    i = i < text.length && text[i] === ";" ? i : -1;
+  }
+  return { names: [...names], filename: extendedFilename ?? filename };
+}
+function decodeExtendedValue(value) {
+  const match = /^([^']*)'[^']*'(.*)$/.exec(value);
+  if (!match) return value;
+  try {
+    return decodeURIComponent(match[2]);
+  } catch {
+    return match[2];
+  }
+}
 function parseCookies(header) {
   const cookies = {};
   if (!header) {
@@ -5613,14 +5862,29 @@ async function installEgressGuard({ shouldBlock, onBlock, onSkip, dnsScreen = tr
       if (globalThis.fetch === guarded) globalThis.fetch = originalFetch;
     });
   }
+  let syncBuiltins = () => {
+  };
+  try {
+    const { syncBuiltinESMExports } = await import("module");
+    if (typeof syncBuiltinESMExports === "function") syncBuiltins = syncBuiltinESMExports;
+  } catch {
+  }
+  let patchedAny = false;
   for (const moduleName of ["node:http", "node:https"]) {
     try {
       const mod = await import(moduleName);
       const restore = patchHttpModule(mod.default ?? mod, block, screen, skip);
-      if (restore) restores.push(restore);
+      if (restore) {
+        patchedAny = true;
+        restores.push(() => {
+          restore();
+          syncBuiltins();
+        });
+      }
     } catch {
     }
   }
+  if (patchedAny) syncBuiltins();
   return () => {
     for (const restore of restores) {
       try {
@@ -5634,18 +5898,22 @@ function patchHttpModule(http, block, screen, skip) {
   if (!http || typeof http.request !== "function" || http.__patchstackGuarded) return null;
   const originalRequest = http.request;
   const originalGet = http.get;
-  const wrap = (original) => function(...args) {
+  const OriginalClientRequest = typeof http.ClientRequest === "function" ? http.ClientRequest : null;
+  const guardArgs = (args) => {
     const target = extractHttpTarget(args);
     if (target && block(target.url, target.host, target.method)) {
       throw new Error(`Patchstack blocked an outbound request to a disallowed address: ${target.host ?? target.url}`);
     }
     if (target && screen && target.host && screen.isIP(target.host) === 0 && !screen.isExempt(target.host)) {
       try {
-        args = withScreeningLookup(args, target, block, screen.lookup, skip);
+        return withScreeningLookup(args, target, block, screen.lookup, skip);
       } catch {
       }
     }
-    return original.apply(this, args);
+    return args;
+  };
+  const wrap = (original) => function(...args) {
+    return original.apply(this, guardArgs(args));
   };
   const guardedRequest = wrap(originalRequest);
   http.request = guardedRequest;
@@ -5654,10 +5922,21 @@ function patchHttpModule(http, block, screen, skip) {
     guardedGet = wrap(originalGet);
     http.get = guardedGet;
   }
+  let GuardedClientRequest;
+  if (OriginalClientRequest) {
+    GuardedClientRequest = function ClientRequest(...args) {
+      const screened = guardArgs(args);
+      return new.target ? Reflect.construct(OriginalClientRequest, screened, new.target) : Reflect.construct(OriginalClientRequest, screened);
+    };
+    GuardedClientRequest.prototype = OriginalClientRequest.prototype;
+    Object.setPrototypeOf(GuardedClientRequest, OriginalClientRequest);
+    http.ClientRequest = GuardedClientRequest;
+  }
   http.__patchstackGuarded = true;
   return () => {
     if (http.request === guardedRequest) http.request = originalRequest;
     if (guardedGet && http.get === guardedGet) http.get = originalGet;
+    if (GuardedClientRequest && http.ClientRequest === GuardedClientRequest) http.ClientRequest = OriginalClientRequest;
     delete http.__patchstackGuarded;
   };
 }
@@ -5667,19 +5946,27 @@ function extractHttpTarget(args) {
     if (typeof first === "string" || first instanceof URL) {
       const url = new URL(String(first));
       const opts = args.find((a) => a && typeof a === "object" && !(a instanceof URL));
-      return { url: url.href, host: url.hostname, method: opts && opts.method || "GET" };
-    }
-    if (first && typeof first === "object") {
-      const host = normalizeHost(first.hostname || first.host) || "localhost";
-      const protocol = first.protocol || "http:";
-      const port = first.port ? `:${first.port}` : "";
-      const path9 = first.path || "/";
-      return { url: `${protocol}//${host}${port}${path9}`, host, method: first.method || "GET" };
+      return targetOf({ ...optionsFromUrl(url), ...opts ?? {} });
     }
+    if (first && typeof first === "object") return targetOf(first);
   } catch {
   }
   return null;
 }
+function optionsFromUrl(url) {
+  const hostname = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : url.hostname;
+  const options = { protocol: url.protocol, hostname, path: `${url.pathname || "/"}${url.search}` };
+  if (url.port !== "") options.port = Number(url.port);
+  return options;
+}
+function targetOf(options) {
+  const host = normalizeHost(options.hostname || options.host) || "localhost";
+  const protocol = options.protocol || "http:";
+  const port = options.port ? `:${options.port}` : "";
+  const path9 = options.path || "/";
+  const authority = host.includes(":") ? `[${host}]` : host;
+  return { url: `${protocol}//${authority}${port}${path9}`, host, method: options.method || "GET" };
+}
 function normalizeHost(raw) {
   const host = String(raw || "").trim();
   const bracketed = /^\[([^\]]+)\]/.exec(host);
@@ -6061,19 +6348,49 @@ async function loadFs() {
   }
   return fsMod;
 }
+async function sourceIdentity(options = {}) {
+  if (typeof options.siteUuid === "string" && options.siteUuid.trim() !== "") {
+    const endpoint = typeof options.pulseRulesUrl === "string" ? options.pulseRulesUrl : "";
+    return `site:${options.siteUuid.trim().toLowerCase()}@${endpoint}`;
+  }
+  if (typeof options.token === "string" && options.token !== "") {
+    const digest = await sha256Hex(options.token);
+    if (digest === null) return null;
+    const endpoint = typeof options.baseUrl === "string" ? options.baseUrl : "";
+    return `token:${digest}@${endpoint}`;
+  }
+  return null;
+}
+async function sha256Hex(text) {
+  try {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle || typeof TextEncoder === "undefined") return null;
+    const digest = await subtle.digest("SHA-256", new TextEncoder().encode(text));
+    return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+  } catch {
+    return null;
+  }
+}
 function makeStore(options = {}) {
   let mem = null;
   const durable = durableTier(options);
+  let identity;
+  const identityOf = () => identity ??= sourceIdentity(options);
   return {
     async read() {
       if (mem) return mem;
+      const source = await identityOf();
+      if (source === null) return null;
       const env = await durable.read();
-      if (env) mem = env;
+      if (!env || env.source !== source) return null;
+      mem = env;
       return env;
     },
     async write(env) {
-      if (env) mem = env;
-      await durable.write(env);
+      if (!env) return;
+      const stamped = { ...env, source: await identityOf() };
+      mem = stamped;
+      await durable.write(stamped);
     }
   };
 }
@@ -6195,11 +6512,12 @@ function toEnvelope(value) {
       buildId,
       // A confirmation belongs to the presentation stored beside it. A crossed or partially written
       // envelope confirms nothing, even when one of its fields happens to name the current map.
-      matchedBuildId: buildId !== null && matched === buildId ? matched : null
+      matchedBuildId: buildId !== null && matched === buildId ? matched : null,
+      source: typeof value.source === "string" ? value.source : null
     };
   }
   if (Array.isArray(value.firewall) || Array.isArray(value.whitelists)) {
-    return { bundle: value, etag: null, buildId: null, matchedBuildId: null };
+    return { bundle: value, etag: null, buildId: null, matchedBuildId: null, source: null };
   }
   return null;
 }
@@ -6267,13 +6585,17 @@ function withScopedDryRun(bundle, confirmed, reason, options = {}) {
     ...unusable > 0 ? [`${unusable} rule(s) carry an unusable ${BUILD_SCOPE_PROPERTY}`] : [],
     ...held > unusable ? [reason] : []
   ];
-  notify(
-    options.onError,
-    new Error(`${held} build-scoped rule(s) are detecting only, not blocking: ${explanations.join("; ")}`),
-    "onError"
-  );
+  const message = `${held} build-scoped rule(s) are detecting only, not blocking: ${explanations.join("; ")}`;
+  if (typeof options.onError === "function") notify(options.onError, new Error(message), "onError");
+  else warnHeldOnce(message);
   return { ...bundle, firewall };
 }
+var warnedHeld = /* @__PURE__ */ new Set();
+function warnHeldOnce(message) {
+  if (warnedHeld.has(message)) return;
+  warnedHeld.add(message);
+  console.warn(`[patchstack] ${message}. Pass { onError } to handle this yourself.`);
+}
 function confirmedBy(res, presented) {
   if (presented === null) return null;
   const verdict = res?.build;
@@ -6448,6 +6770,60 @@ function startRefresh(tick, { refreshMs, onError } = {}) {
     }
   };
 }
+var RECOVERY_DELAYS_MS = [5e3, 15e3, 45e3, 12e4, 3e5, 6e5];
+function startRecovery(tick, { onError } = {}) {
+  let stopped = false;
+  let attempt = 0;
+  let timer = null;
+  const schedule = () => {
+    if (stopped) return;
+    const delay = RECOVERY_DELAYS_MS[Math.min(attempt, RECOVERY_DELAYS_MS.length - 1)];
+    timer = setTimeout(run, delay * (1 - Math.random() * JITTER_FRACTION3));
+    timer?.unref?.();
+  };
+  const run = async () => {
+    if (stopped) return;
+    attempt++;
+    try {
+      const status = await tick();
+      if (!status || status.ok !== false) {
+        stopped = true;
+        return;
+      }
+    } catch (err) {
+      notify(onError, err, "onError");
+    }
+    schedule();
+  };
+  schedule();
+  return {
+    stop() {
+      stopped = true;
+      if (timer) clearTimeout(timer);
+    }
+  };
+}
+function serialise(tick) {
+  let running = null;
+  let next = null;
+  const run = () => {
+    if (!running) {
+      running = Promise.resolve().then(() => tick()).finally(() => {
+        running = null;
+      });
+      return running;
+    }
+    if (!next) {
+      next = running.catch(() => {
+      }).then(() => {
+        next = null;
+        return run();
+      });
+    }
+    return next;
+  };
+  return run;
+}
 function makeRefreshHandler(tick, secret) {
   let inflight2 = null;
   const runOnce = () => {
@@ -7603,7 +7979,7 @@ function createSupabaseGuard({
       statusText: upstream.statusText,
       headers: responseHeaders(upstream.headers)
     });
-    return protection.screenResponse ? protection.screenResponse(forwarded) : forwarded;
+    return protection.screenResponse ? protection.screenResponse(forwarded, evalReq) : forwarded;
   };
 }
 
@@ -7697,6 +8073,7 @@ async function createProtection(options = {}) {
       "onDetect"
     );
   };
+  const nodeHttp = await import("http").then((m) => m.default ?? m, () => null);
   const store = makeStore(options);
   const bootTimeoutMs = Number(options.bootTimeoutMs) > 0 ? Number(options.bootTimeoutMs) : 5e3;
   const pulseAuth = await resolvePulseAuth(options);
@@ -7722,6 +8099,21 @@ async function createProtection(options = {}) {
     pulseAuth,
     detectionState: preFetchState
   });
+  let ruleSource = { ...bundle.source ?? { ok: true, origin: "empty" } };
+  const warnedSources = /* @__PURE__ */ new Set();
+  const hasLiveSource = Boolean(options.siteUuid || options.token);
+  const noteRuleSource = (source) => {
+    ruleSource = { ...source ?? { ok: true, origin: ruleSource.origin } };
+    if (!hasLiveSource || typeof onError === "function" || ruleSource.ok !== false) return;
+    const cause = `${ruleSource.origin}:${ruleSource.reason ?? ""}`;
+    if (warnedSources.has(cause)) return;
+    warnedSources.add(cause);
+    const running = ruleSource.origin === "cache" ? "the last rules it received" : ruleSource.origin === "bundled" ? "its bundled fallback rules" : "no rules at all";
+    console.warn(
+      `[patchstack] the guard's rules are not current (${ruleSource.reason ?? "the rules source did not answer"}); it is running on ${running}. Pass { onError } to handle this yourself.`
+    );
+  };
+  noteRuleSource(bundle.source);
   let detectionReporting = "not-enrolled";
   let currentOrigin;
   const applyReportingState = async (origin) => {
@@ -7900,7 +8292,9 @@ async function createProtection(options = {}) {
       const spanRedactors = redactors.filter((r) => !r.jsonPath);
       if (pathRedactors.length) body = applyPathRedactors(body, pathRedactors, mask, screenCap, transform);
       if (!spanRedactors.length) continue;
+      const beforeSpan = body;
       body = applyRedactors(body, spanRedactors, mask, transform);
+      if (body !== beforeSpan && !preservesJsonStructure(beforeSpan, body)) return { verdict: "block" };
       if (transform) continue;
       for (const name of Object.keys(headers)) {
         const value = headers[name];
@@ -7915,6 +8309,7 @@ async function createProtection(options = {}) {
         }
       }
     }
+    if (body !== text && isJson(text) && !isJson(body)) return { verdict: "block" };
     for (const rule of headerMutations) applyHeaderMutation(headers, rule);
     return { verdict: "redact", body, headers };
   };
@@ -8017,7 +8412,9 @@ async function createProtection(options = {}) {
   const screenResp = async (response, reqCtx) => {
     const read = await readTextResponse(response, screenCap);
     if (read.skip) {
-      if (read.skip !== "not-a-response") recordSkip("response", read.skip, { status: response?.status });
+      if (read.skip !== "not-a-response") {
+        recordSkip("response", read.skip, { status: response?.status, ...read.encoding ? { encoding: read.encoding } : {} });
+      }
       if (read.skip === "not-a-response") return response;
       return hardenHeadersOnly(response, reqCtx);
     }
@@ -8098,6 +8495,11 @@ async function createProtection(options = {}) {
   const wrapNodeResponse = (res, reqCtx) => {
     const origWrite = res.write.bind(res);
     const origEnd = res.end.bind(res);
+    const setHeaderNow = typeof res.setHeader === "function" ? res.setHeader.bind(res) : null;
+    const removeHeaderNow = typeof res.removeHeader === "function" ? res.removeHeader.bind(res) : null;
+    const sentAccessor = accessorOf(res, "headersSent");
+    let sentValue = sentAccessor ? void 0 : res.headersSent;
+    const reallySent = () => Boolean(sentAccessor ? sentAccessor.call(res) : sentValue);
     const chunks = [];
     let size = 0;
     let overflow = false;
@@ -8108,7 +8510,7 @@ async function createProtection(options = {}) {
       if (hardened) return null;
       hardened = true;
       try {
-        if (res.headersSent || typeof res.setHeader !== "function") return null;
+        if (reallySent() || !setHeaderNow) return null;
         const set2 = typeof res.getHeaders === "function" ? res.getHeaders() : {};
         const headers = effective && effective.headers ? { ...set2, ...effective.headers } : set2;
         const status = effective && effective.status !== void 0 ? effective.status : res.statusCode;
@@ -8120,8 +8522,8 @@ async function createProtection(options = {}) {
           if (!headerValueChanged(headers[name], value)) continue;
           changed.set(name.toLowerCase(), value);
           try {
-            if (value === null || value === void 0) res.removeHeader?.(name);
-            else res.setHeader(name, value);
+            if (value === null || value === void 0) removeHeaderNow?.(name);
+            else setHeaderNow(name, value);
           } catch {
           }
         }
@@ -8132,26 +8534,139 @@ async function createProtection(options = {}) {
       }
     };
     const stillToAnswer = (rule) => !hardensWithoutBody(rule);
-    if (typeof res.writeHead === "function") {
-      const origWriteHead = res.writeHead.bind(res);
+    let pendingHead = null;
+    let sending = false;
+    const origWriteHead = typeof res.writeHead === "function" ? res.writeHead.bind(res) : null;
+    if (origWriteHead) {
       res.writeHead = function(...args) {
-        const at = writeHeadHeaderIndex(args);
-        const given = at === -1 ? null : args[at];
-        const changed = hardenBeforeFlush({
-          status: typeof args[0] === "number" ? args[0] : void 0,
-          headers: given ? writeHeadHeaderObject(given) : null
-        });
-        if (!changed || !given) return origWriteHead(...args);
-        const rewritten = [...args];
-        rewritten[at] = rewriteWriteHeadHeaders(given, changed);
-        return origWriteHead(...rewritten);
+        if (sending || reallySent()) return origWriteHead(...args);
+        if (pendingHead) throw headersSentError("write");
+        const judged = judgeWriteHead(args);
+        if (judged) {
+          res.statusCode = judged.statusCode;
+          res.statusMessage = judged.statusMessage;
+          mirrorHeaders(judged.headers);
+          pendingHead = args;
+        } else {
+          pendingHead = args;
+          if (typeof args[0] === "number") res.statusCode = args[0];
+          if (typeof args[1] === "string") res.statusMessage = args[1];
+        }
+        return res;
       };
     }
+    function judgeWriteHead(args) {
+      const ServerResponse = nodeHttp?.ServerResponse;
+      if (typeof ServerResponse !== "function") return null;
+      const detached = new ServerResponse({ method: res.req?.method ?? "GET", httpVersionMajor: 1, httpVersionMinor: 1, headers: {} });
+      if (res.statusMessage !== void 0) detached.statusMessage = res.statusMessage;
+      for (const [name, value] of headerEntries(res)) detached.setHeader(name, value);
+      detached.writeHead(...args);
+      return { statusCode: detached.statusCode, statusMessage: detached.statusMessage, headers: headerEntries(detached) };
+    }
+    function headerEntries(target) {
+      const names = typeof target.getRawHeaderNames === "function" ? target.getRawHeaderNames() : typeof target.getHeaderNames === "function" ? target.getHeaderNames() : [];
+      return names.map((name) => [name, target.getHeader(name)]);
+    }
+    function mirrorHeaders(entries) {
+      if (!setHeaderNow) return;
+      for (const [name, value] of entries) {
+        const current = res.getHeader?.(name);
+        if (current === void 0 || headerValueChanged(current, value)) setHeaderNow(name, value);
+      }
+    }
+    Object.defineProperty(res, "headersSent", {
+      configurable: true,
+      enumerable: true,
+      get: () => pendingHead !== null || reallySent(),
+      // A response-like object that tracks the flag itself keeps doing so.
+      set: (value) => {
+        if (!sentAccessor) sentValue = value;
+      }
+    });
+    for (const [method, verb] of [["setHeader", "set"], ["removeHeader", "remove"], ["appendHeader", "append"]]) {
+      const original = typeof res[method] === "function" ? res[method].bind(res) : null;
+      if (!original) continue;
+      res[method] = function(...args) {
+        if (pendingHead) throw headersSentError(verb);
+        return original(...args);
+      };
+    }
+    if (typeof res.flushHeaders === "function") {
+      const origFlushHeaders = res.flushHeaders.bind(res);
+      res.flushHeaders = function() {
+        sendHead();
+        return origFlushHeaders();
+      };
+    }
+    let hardenDone = false;
+    let hardenedValues = null;
+    const hardenOnce = () => {
+      if (hardenDone) return hardenedValues;
+      hardenDone = true;
+      if (!pendingHead) {
+        hardenedValues = hardenBeforeFlush();
+        return hardenedValues;
+      }
+      const at = writeHeadHeaderIndex(pendingHead);
+      hardenedValues = hardenBeforeFlush({
+        status: typeof pendingHead[0] === "number" ? pendingHead[0] : void 0,
+        headers: at === -1 ? null : writeHeadHeaderObject(pendingHead[at])
+      });
+      return hardenedValues;
+    };
+    const effectiveHead = () => {
+      const set2 = typeof res.getHeaders === "function" ? { ...res.getHeaders() } : {};
+      if (typeof res.getHeaders !== "function" && typeof res.getHeader === "function") {
+        for (const name of ["content-type", "content-length"]) {
+          const value = res.getHeader(name);
+          if (value !== void 0) set2[name] = value;
+        }
+      }
+      if (!pendingHead) return { status: res.statusCode, headers: set2 };
+      const at = writeHeadHeaderIndex(pendingHead);
+      return {
+        status: typeof pendingHead[0] === "number" ? pendingHead[0] : res.statusCode,
+        headers: at === -1 ? set2 : { ...set2, ...writeHeadHeaderObject(pendingHead[at]) }
+      };
+    };
+    const sendHead = (changes) => {
+      if (sending) return;
+      const hardened2 = hardenOnce();
+      sending = true;
+      if (!pendingHead) {
+        if (changes) applyToResponse(changes);
+        return;
+      }
+      const args = [...pendingHead];
+      pendingHead = null;
+      const merged = new Map(hardened2 ?? []);
+      for (const [name, value] of changes?.headers ?? []) merged.set(name, value);
+      if (changes?.status !== void 0) {
+        args[0] = changes.status;
+        if (typeof args[1] === "string") args.splice(1, 1);
+      }
+      const headerAt = writeHeadHeaderIndex(args);
+      if (headerAt !== -1 && merged.size) args[headerAt] = rewriteWriteHeadHeaders(args[headerAt], merged);
+      applyToResponse({ headers: merged });
+      origWriteHead(...args);
+    };
+    const applyToResponse = (changes) => {
+      if (changes.status !== void 0) res.statusCode = changes.status;
+      for (const [name, value] of changes.headers ?? []) {
+        try {
+          if (value === null || value === void 0) removeHeaderNow?.(name);
+          else setHeaderNow?.(name, value);
+        } catch {
+        }
+      }
+    };
     const collect = (chunk, enc) => {
       if (chunk == null) return;
       const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, typeof enc === "string" ? enc : "utf8");
       size += buf.length;
       if (size > MAX) {
+        sendHead();
         for (const c of chunks) origWrite(c);
         chunks.length = 0;
         origWrite(buf);
@@ -8162,7 +8677,6 @@ async function createProtection(options = {}) {
       chunks.push(buf);
     };
     res.write = function(chunk, enc, cb) {
-      hardenBeforeFlush();
       if (overflow) return origWrite(chunk, enc, cb);
       collect(chunk, enc);
       if (typeof enc === "function") enc();
@@ -8170,7 +8684,6 @@ async function createProtection(options = {}) {
       return true;
     };
     res.end = function(chunk, enc, cb) {
-      hardenBeforeFlush();
       if (typeof chunk === "function") {
         cb = chunk;
         chunk = void 0;
@@ -8185,68 +8698,77 @@ async function createProtection(options = {}) {
       }
       collect(chunk, enc);
       if (overflow) return origEnd(cb);
+      hardenOnce();
+      const passThrough = () => {
+        sendHead();
+        for (const c of chunks) origWrite(c);
+        return origEnd(cb);
+      };
       const buffer = Buffer.concat(chunks);
-      let ct = res.getHeader ? res.getHeader("content-type") : void 0;
+      const head = effectiveHead();
+      let ct = head.headers["content-type"];
       if (Array.isArray(ct)) ct = ct[0];
       const kind = screenableContentType(ct);
       if (kind === "skip" || kind === "sniff" && looksBinary(buffer)) {
         recordSkip("response", kind === "skip" ? baseContentType(ct) === "text/event-stream" ? "live-stream" : "non-text-content-type" : "binary-body");
-        for (const c of chunks) origWrite(c);
-        return origEnd(cb);
+        return passThrough();
+      }
+      const codings = declaredCodings(head.headers["content-encoding"]);
+      if (codings.length > 0 && stillEncoded(buffer)) {
+        recordSkip("response", "encoded-body", { encoding: codings.join(", ") });
+        return passThrough();
       }
       const text = buffer.toString("utf8");
       let r;
       try {
-        r = screenText(
-          text,
-          { status: res.statusCode, headers: res.getHeaders ? res.getHeaders() : {} },
-          reqCtx,
-          answeredWithoutBody ? stillToAnswer : void 0
-        );
+        r = screenText(text, head, reqCtx, answeredWithoutBody ? stillToAnswer : void 0);
       } catch (err) {
         notify(onError, err, "onError");
-        for (const c of chunks) origWrite(c);
-        return origEnd(cb);
+        return passThrough();
+      }
+      if (r.verdict !== "block" && r.verdict !== "redact") return passThrough();
+      if (reallySent() && res.chunkedEncoding !== true) {
+        notify(onError, new Error("Patchstack: response withheld \u2014 its headers were sent before the body could be screened"), "onError");
+        res.destroy?.();
+        return res;
       }
       if (r.verdict === "block") {
-        res.statusCode = 500;
-        try {
-          res.setHeader("content-type", "application/json");
-        } catch {
+        const body = JSON.stringify({ error: "Response withheld by Patchstack (sensitive data detected)" });
+        if (reallySent()) {
+          res.destroy?.();
+          return res;
         }
-        return origEnd(JSON.stringify({ error: "Response withheld by Patchstack (sensitive data detected)" }), cb);
+        sendHead({
+          status: 500,
+          headers: /* @__PURE__ */ new Map([
+            ["content-type", "application/json"],
+            ["content-length", String(Buffer.byteLength(body))],
+            ["transfer-encoding", null]
+          ])
+        });
+        return origEnd(body, cb);
       }
-      if (r.verdict === "redact") {
-        try {
-          res.removeHeader && res.removeHeader("content-length");
-        } catch {
+      const changed = /* @__PURE__ */ new Map();
+      if (r.headers) {
+        for (const [name, value] of Object.entries(r.headers)) {
+          if (name.toLowerCase() === "content-length") continue;
+          if (!headerValueChanged(head.headers[name], value)) continue;
+          changed.set(name.toLowerCase(), value);
         }
-        if (r.headers && res.setHeader) {
-          const current = res.getHeaders ? res.getHeaders() : {};
-          for (const [name, value] of Object.entries(r.headers)) {
-            if (name.toLowerCase() === "content-length") continue;
-            if (value === null || value === void 0) {
-              try {
-                res.removeHeader && res.removeHeader(name);
-              } catch {
-              }
-            } else if (Array.isArray(value)) {
-              try {
-                res.setHeader(name, value);
-              } catch {
-              }
-            } else if (typeof value === "string" && current[name] !== value) {
-              try {
-                res.setHeader(name, value);
-              } catch {
-              }
-            }
-          }
+      }
+      if (!reallySent()) {
+        const declared = head.headers["content-length"];
+        if (declared === void 0) {
+          changed.set("content-length", null);
+        } else {
+          changed.set("content-length", String(Buffer.byteLength(r.body)));
+          changed.set("transfer-encoding", null);
         }
-        return origEnd(r.body, cb);
+        sendHead({ headers: changed });
+      } else if (changed.size) {
+        recordSkip("response", "headers-sent", { headers: [...changed.keys()] });
       }
-      for (const c of chunks) origWrite(c);
-      return origEnd(cb);
+      return origEnd(r.body, cb);
     };
   };
   const allow = new Set(allowHosts.map((h) => String(h).toLowerCase()));
@@ -8459,6 +8981,7 @@ async function createProtection(options = {}) {
       notify(onError, err, "onError");
     }
   }
+  let recovery = null;
   const runRefreshTick = async () => {
     if (reporter) {
       try {
@@ -8475,23 +8998,33 @@ async function createProtection(options = {}) {
     });
     mode = resolveMode(options, next);
     applyBundle(next);
+    noteRuleSource(next.source);
+    if (next.source?.ok !== false) recovery?.stop();
     await applyAndAcknowledge(next.source?.origin, declaredState);
     if (detections) detections.setRulesEtag((await store.read())?.etag ?? null);
     return next.source ?? { ok: true };
   };
+  const refreshTick = serialise(runRefreshTick);
   if (live) {
-    protection.refresh = () => runRefreshTick();
-    protection.refreshHandler = () => makeRefreshHandler(runRefreshTick, refreshSecret);
+    protection.refresh = () => refreshTick();
+    protection.refreshHandler = () => makeRefreshHandler(refreshTick, refreshSecret);
   }
-  const loop = options.refreshMs > 0 && live ? startRefresh(runRefreshTick, { refreshMs: options.refreshMs, onError }) : null;
+  const loop = options.refreshMs > 0 && live ? startRefresh(refreshTick, { refreshMs: options.refreshMs, onError }) : null;
+  const canAsk = Boolean(options.token || pulseAuth);
+  recovery = live && canAsk && !loop && ruleSource.ok === false ? startRecovery(refreshTick, { onError }) : null;
   protection.stop = () => {
     loop?.stop();
+    recovery?.stop();
     const outstanding = [firewallLog?.stop(), detections?.stop()].filter(
       (wait) => wait && typeof wait.then === "function"
     );
     return Promise.all(outstanding).then(() => void 0);
   };
   protection.stopRefresh = protection.stop;
+  Object.defineProperty(protection, "ruleSource", {
+    get: () => ({ ...ruleSource }),
+    enumerable: true
+  });
   Object.defineProperty(protection, "detectionReporting", {
     get: () => detectionReporting,
     enumerable: true
@@ -8502,6 +9035,16 @@ async function createProtection(options = {}) {
   });
   return protection;
 }
+function accessorOf(obj, name) {
+  for (let o = obj; o; o = Object.getPrototypeOf(o)) {
+    const d = Object.getOwnPropertyDescriptor(o, name);
+    if (d) return typeof d.get === "function" ? d.get : null;
+  }
+  return null;
+}
+function headersSentError(verb) {
+  return Object.assign(new Error(`Cannot ${verb} headers after they are sent to the client`), { code: "ERR_HTTP_HEADERS_SENT" });
+}
 function resolveMode(options, bundle) {
   const env = typeof process !== "undefined" ? process.env?.PATCHSTACK_MODE : void 0;
   if (env === "block" || env === "dry-run") return env;
@@ -8574,11 +9117,26 @@ function looksBinary(bytes) {
   }
   return n > 0 && ctrl / n > 0.1;
 }
+function declaredCodings(value) {
+  const raw = Array.isArray(value) ? value.join(",") : String(value ?? "");
+  return raw.toLowerCase().split(",").map((c) => c.trim()).filter((c) => c !== "" && c !== "identity");
+}
+function stillEncoded(bytes) {
+  if (looksBinary(bytes)) return true;
+  try {
+    new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return false;
+  } catch {
+    return true;
+  }
+}
 async function readTextResponse(response, cap = DEFAULT_SCREEN_CAP) {
   if (!response || typeof response.clone !== "function") return { skip: "not-a-response" };
   const ct = response.headers?.get?.("content-type") || "";
   const kind = screenableContentType(ct);
   if (kind === "skip") return { skip: baseContentType(ct) === "text/event-stream" ? "live-stream" : "non-text-content-type" };
+  const codings = declaredCodings(response.headers?.get?.("content-encoding"));
+  const encodedSkip = () => ({ skip: "encoded-body", encoding: codings.join(", ") });
   const sniff = kind === "sniff";
   const len = Number(response.headers?.get?.("content-length") || 0);
   if (len && len > cap) return { skip: "body-cap" };
@@ -8622,13 +9180,21 @@ async function readTextResponse(response, cap = DEFAULT_SCREEN_CAP) {
     } finally {
       reader.releaseLock();
     }
+    const bytes = concatBytes(chunks, size);
+    if (codings.length > 0 && stillEncoded(bytes)) return encodedSkip();
     try {
-      return { text: new TextDecoder().decode(concatBytes(chunks, size)) };
+      return { text: new TextDecoder().decode(bytes) };
     } catch {
       return { skip: "decode-failed" };
     }
   }
   try {
+    if (codings.length > 0) {
+      const bytes = new Uint8Array(await clone.arrayBuffer());
+      if (bytes.byteLength > cap) return { skip: "body-cap" };
+      if (stillEncoded(bytes)) return encodedSkip();
+      return { text: new TextDecoder().decode(bytes) };
+    }
     const text = await clone.text();
     if (text.length > cap) return { skip: "body-cap" };
     if (sniff && looksBinary(new TextEncoder().encode(text.slice(0, 512)))) return { skip: "binary-body" };
@@ -8702,6 +9268,39 @@ function extractRedactors(rule) {
 function htmlEscape(str) {
   return String(str).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 }
+function isJson(text) {
+  try {
+    JSON.parse(text);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function preservesJsonStructure(before, after) {
+  if (!isJson(before)) return true;
+  if (!isJson(after)) return false;
+  const expected = jsonStructure(before);
+  const actual = jsonStructure(after);
+  for (; ; ) {
+    const left = expected.next();
+    const right = actual.next();
+    if (left.done || right.done) return left.done === right.done;
+    if (left.value !== right.value) return false;
+  }
+}
+function* jsonStructure(text) {
+  const tokens = /"(?:[^"\\]|\\[\s\S])*"|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|[^\s]/g;
+  for (const match of text.matchAll(tokens)) {
+    const token = match[0];
+    if (token[0] !== '"') {
+      yield "token:" + token;
+      continue;
+    }
+    let next = match.index + token.length;
+    while (text[next] === " " || text[next] === "	" || text[next] === "\r" || text[next] === "\n") next++;
+    yield text[next] === ":" ? "key:" + JSON.parse(token) : "string";
+  }
+}
 function applyRedactors(body, redactors, mask, transform) {
   let out = body;
   for (const r of redactors) {
@@ -8744,10 +9343,12 @@ function applyPathRedactors(text, pathRedactors, mask, cap, transform) {
   if (!pathRedactors.length || typeof text !== "string" || text.length > cap) return text;
   const head = text.trimStart()[0];
   if (head !== "{" && head !== "[") return text;
-  const preserved = preserveBigInts(text);
+  let preserved;
   let obj;
   try {
-    obj = JSON.parse(preserved);
+    JSON.parse(text);
+    preserved = preserveBigInts(text, mask);
+    obj = JSON.parse(preserved.text);
   } catch {
     return text;
   }
@@ -8756,65 +9357,44 @@ function applyPathRedactors(text, pathRedactors, mask, cap, transform) {
     const pred = conditionPredicate(r.condition);
     walkLeaves(obj, r.jsonPath, (loc) => {
       try {
-        if (pred(loc.value)) {
-          loc.parent[loc.key] = transform ? transform(String(loc.value)) : mask;
+        const number = preserved.numbers.get(loc.value);
+        if (pred(number === void 0 ? loc.value : Number(number))) {
+          setOwn(loc.parent, loc.key, transform ? transform(number ?? String(loc.value)) : mask);
           changed = true;
         }
       } catch {
       }
     });
   }
-  return changed ? restoreBigInts(JSON.stringify(obj)) : text;
-}
-var BIGINT_OPEN = "__PSBIGINT_9c2f__";
-var BIGINT_CLOSE = "__DNEGIB__";
-function preserveBigInts(text) {
-  let out = "";
-  let inStr = false;
-  for (let i = 0; i < text.length; ) {
-    const ch = text[i];
-    if (inStr) {
-      out += ch;
-      if (ch === "\\") {
-        out += text[i + 1] ?? "";
-        i += 2;
-        continue;
-      }
-      if (ch === '"') inStr = false;
-      i++;
-      continue;
-    }
-    if (ch === '"') {
-      inStr = true;
-      out += ch;
-      i++;
-      continue;
-    }
-    if (ch === "-" || ch >= "0" && ch <= "9") {
-      let j = ch === "-" ? i + 1 : i;
-      let digits = 0;
-      while (j < text.length && text[j] >= "0" && text[j] <= "9") {
-        digits++;
-        j++;
-      }
-      const next = text[j];
-      const isIntToken = digits > 0 && next !== "." && next !== "e" && next !== "E";
-      if (isIntToken && digits >= 16) {
-        out += `"${BIGINT_OPEN}${text.slice(i, j)}${BIGINT_CLOSE}"`;
-      } else {
-        out += text.slice(i, j || i + 1);
-      }
-      i = j > i ? j : i + 1;
-      continue;
-    }
-    out += ch;
-    i++;
-  }
-  return out;
+  return changed ? restoreBigInts(JSON.stringify(obj), preserved.numbers) : text;
 }
-function restoreBigInts(text) {
-  if (!text.includes(BIGINT_OPEN)) return text;
-  return text.replace(new RegExp(`"${BIGINT_OPEN}(-?\\d+)${BIGINT_CLOSE}"`, "g"), "$1");
+function preserveBigInts(text, mask) {
+  const occupied = /* @__PURE__ */ new Set([mask]);
+  const integers = [];
+  const tokens = /"(?:[^"\\]|\\[\s\S])*"|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/g;
+  for (const match of text.matchAll(tokens)) {
+    const token = match[0];
+    if (token[0] === '"') occupied.add(JSON.parse(token));
+    else if (/^-?\d{16,}$/.test(token)) integers.push({ start: match.index, token });
+  }
+  const numbers = /* @__PURE__ */ new Map();
+  const chunks = [];
+  let offset = 0;
+  let index = 0;
+  for (const { start, token } of integers) {
+    let marker;
+    do {
+      marker = "__PSNUMBER_" + index++ + "__";
+    } while (occupied.has(marker));
+    numbers.set(marker, token);
+    chunks.push(text.slice(offset, start), JSON.stringify(marker));
+    offset = start + token.length;
+  }
+  chunks.push(text.slice(offset));
+  return { text: chunks.join(""), numbers };
+}
+function restoreBigInts(text, numbers) {
+  return text.replace(/"(__PSNUMBER_\d+__)"/g, (token, marker) => numbers.get(marker) ?? token);
 }
 function isHeaderMutation(action) {
   return action === "set-header" || action === "remove-header" || action === "harden-cookie";