@patchstack/connect 0.5.19 → 0.5.21

package/AGENT-INSTALL.md

@@ -277,6 +277,8 @@ Handle it in this order:
 
 - `apiKey` (in `.patchstackrc.local.json`, which is git-ignored; also `PATCHSTACK_API_KEY`, WP format `{secret}-{oauth.id}`) — one credential for both paths. It authenticates **Pulse ingest** (manifest, attack-surface map, package removal, rule detections), where it is exchanged for a short-lived token rather than sent directly, and **block-log reporting** through the connector `POST /api/logs/log`, so "Threats blocked" fills in the dashboard.
 
+A production build of a registered site that has **no** credential — a hosted builder's publish, which builds from the committed project and so never sees the git-ignored key file — cannot send its manifest. `scan` and `mark-build` then POST `monitor/pulse/build/<your site uuid>` instead, with no credential and exactly three fields: the manifest checksum, `environment: "production"`, and (`mark-build` only) the marker result. **No package names, no address, no name, no environment variable values.** Patchstack accepts it only when the checksum is the build it last scanned for this site, and shows the build as reported rather than deployed until the live page is seen running it. A publish that changed your packages is refused; set `PATCHSTACK_API_KEY` for that build.
+
 It is server-only. Never put it in the widget tag, client bundles, or public env vars (`NEXT_PUBLIC_*`, etc.). Prefer `PATCHSTACK_API_KEY` in production; the git-ignored `.patchstackrc.local.json` is fine for local DX. If it is lost, `npx @patchstack/connect login` recovers it via dashboard approval — do not delete the file and re-provision, which would create a second site. Opt out of reporting with `PATCHSTACK_TELEMETRY=off`. If the project must not carry the widget, persist `"widget": false` in `.patchstackrc.json`; otherwise the next scan re-adds it.
 
    A `pulseAuth` field is still honoured if a project has one, and `PATCHSTACK_PULSE_AUTH` still overrides it, for deployments that authenticate Pulse ingest with a different credential from block-logs. Do not add either yourself: they are unnecessary when the two share one credential, which is the default.

package/README.md

@@ -262,7 +262,7 @@ group, and a verification that can leave a server running is worse than an unans
 
 No other command runs your application. `protect`, `protect --check`, `setup`, `guide`, `scan`,
 `status` and `mark-build` only read and write files, and — for `scan` and `mark-build` — report the
-dependency manifest they read.
+dependency manifest they read, or only its checksum from a production build that has no API key.
 
 ## Configuration
 
@@ -310,7 +310,7 @@ The site UUID identifies the site and is **not** a secret — the Patchstack Con
 
 If it is ever lost, `npx @patchstack/connect login` recovers it — approval happens in the dashboard and rotates the credential.
 
-The credential's file is never committed, so CI needs `PATCHSTACK_API_KEY` in the environment (and `PATCHSTACK_SITE_UUID` too where `.patchstackrc.json` is also absent). Precedence is CLI flag → env var → `.patchstackrc.local.json` → `.patchstackrc.json`.
+The credential's file is never committed, so CI needs `PATCHSTACK_API_KEY` in the environment (and `PATCHSTACK_SITE_UUID` too where `.patchstackrc.json` is also absent). A production build that has the site UUID but no key — a hosted builder's publish, typically — reports only that the build ran: it POSTs the manifest checksum to `monitor/pulse/build/<uuid>` without a credential and without the package list, and Patchstack accepts it only for the build it last scanned. Set the key there if the publish can change your packages. Precedence is CLI flag → env var → `.patchstackrc.local.json` → `.patchstackrc.json`.
 
 A `pulseAuth` field is still read if present, and `PATCHSTACK_PULSE_AUTH` still overrides, for deployments that authenticate Pulse ingest with a different credential from block-logs. Neither is written by default, and neither is needed when the two share one.
 

package/dist/cli.js

@@ -1876,11 +1876,79 @@ async function postManifestWithEnvironmentFallback(config, payload, marker = nul
       environmentUsed: config.environment
     };
   } catch (err) {
+    if (err instanceof PatchstackError && err.code === "UNAUTHORIZED" && reportsBuildWithoutCredential(config)) {
+      return {
+        response: await postBuildReport(config, computeManifestChecksum(payload.packages), marker),
+        environmentUsed: "production"
+      };
+    }
     if (config.environment !== "local" || !environmentRejected(err)) throw err;
     const fallback = { ...config, environment: "sandbox" };
     return { response: await postManifest(fallback, payload, marker), environmentUsed: "sandbox" };
   }
 }
+function reportsBuildWithoutCredential(config) {
+  const hasCredential = typeof config.pulseAuth === "string" && config.pulseAuth.length > 0;
+  return !hasCredential && config.environment === "production" && config.siteUuid !== null && config.siteUuid !== "";
+}
+function buildReportUrl(manifestEndpoint, siteUuid) {
+  const url = new URL(manifestEndpoint);
+  const path17 = url.pathname.replace(/\/$/, "");
+  const id = encodeURIComponent(siteUuid);
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/build/${id}` : `/monitor/pulse/build/${id}`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+async function postBuildReport(config, checksum, marker = null) {
+  const siteUuid = config.siteUuid ?? "";
+  const url = buildReportUrl(config.endpoint, siteUuid);
+  assertConnectableEndpoint(config, url);
+  const needsKey = authFailureMessage(401, config) ?? "Set PATCHSTACK_API_KEY where this build runs.";
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+        "User-Agent": "@patchstack/connect"
+      },
+      body: JSON.stringify({ checksum, environment: "production", ...marker !== null ? { marker } : {} }),
+      signal: AbortSignal.timeout(config.timeoutMs)
+    });
+  } catch (cause) {
+    throw new PatchstackError(
+      isTimeoutError(cause) ? `Patchstack request to ${url} timed out after ${config.timeoutMs}ms. Override with PATCHSTACK_TIMEOUT_MS.` : `Could not reach Patchstack at ${url}. Check your network connection.`,
+      isTimeoutError(cause) ? "NETWORK_TIMEOUT" : "NETWORK_ERROR",
+      cause
+    );
+  }
+  let parsed = null;
+  try {
+    const text = await readBoundedText(response);
+    parsed = text.length > 0 ? JSON.parse(text) : null;
+  } catch {
+    parsed = null;
+  }
+  if (response.status === 422) {
+    throw new PatchstackError(
+      safeDisplayString(parsed?.error) ?? `This build is not the one Patchstack last scanned. ${needsKey}`,
+      "UNAUTHORIZED"
+    );
+  }
+  if (response.status < 200 || response.status >= 300) {
+    throw new PatchstackError(needsKey, "UNAUTHORIZED");
+  }
+  const result = parsed?.result;
+  return {
+    uuid: siteUuid,
+    stored: false,
+    checksum,
+    reason: "build-reported",
+    message: result === "already-reported" ? "Patchstack already knew this build was published" : "Told Patchstack this build was published. There is no API key here, so the package list was not sent again"
+  };
+}
 async function postManifest(config, payload, marker = null) {
   const url = buildEndpointUrl(config.endpoint, config.siteUuid);
   const timeoutMs = config.timeoutMs;
@@ -8391,6 +8459,234 @@ function pathFromTainted(node, ts, rootPath, trailing = []) {
   return { path: normalizePath([base.path, ...segs].filter(Boolean).join(".")), space, ...request, ...accessor, ...reassigned };
 }
 
+// src/map/budget.ts
+var INGEST_LIMITS = {
+  bytes: 2 * 1024 * 1024,
+  nodes: 5e4,
+  depth: 12,
+  endpoints: 2e3,
+  fileLength: 512,
+  inputsPerEndpoint: 500,
+  sinksPerEndpoint: 500,
+  flowsPerEndpoint: 2e3,
+  dependencyInputFlowsPerEndpoint: 100
+};
+var RESERVE = { nodes: 8, bytes: 256 };
+function nodeCount(value) {
+  if (value === null || typeof value !== "object") return 0;
+  let n = 0;
+  for (const item of Object.values(value)) n += 1 + nodeCount(item);
+  return n;
+}
+function depthOf(value, depth = 0) {
+  if (value === null || typeof value !== "object") return depth;
+  let deepest = depth;
+  for (const item of Object.values(value)) deepest = Math.max(deepest, depthOf(item, depth + 1));
+  return deepest;
+}
+var encoder = new TextEncoder();
+var byteLength = (value) => encoder.encode(JSON.stringify(value)).length;
+function ingestProblems(map, limits = INGEST_LIMITS) {
+  const problems = [];
+  const bytes = byteLength(map);
+  const nodes = nodeCount(map);
+  const depth = depthOf(map);
+  if (bytes > limits.bytes - RESERVE.bytes) problems.push(`${bytes} bytes, over the ${limits.bytes - RESERVE.bytes} the upload can carry`);
+  if (nodes > limits.nodes - RESERVE.nodes) problems.push(`${nodes} nodes, over the ${limits.nodes - RESERVE.nodes} the upload can carry`);
+  if (depth > limits.depth) problems.push(`nesting ${depth} levels deep, over ${limits.depth}`);
+  if (map.endpoints.length > limits.endpoints) problems.push(`${map.endpoints.length} endpoints, over ${limits.endpoints}`);
+  map.endpoints.forEach((e, i) => {
+    const at = `endpoint ${i}`;
+    if (typeof e.file !== "string" || e.file.length > limits.fileLength) problems.push(`${at} has a file path over ${limits.fileLength} characters`);
+    if (e.inputs.length > limits.inputsPerEndpoint) problems.push(`${at} has ${e.inputs.length} inputs, over ${limits.inputsPerEndpoint}`);
+    if (e.sinks.length > limits.sinksPerEndpoint) problems.push(`${at} has ${e.sinks.length} sinks, over ${limits.sinksPerEndpoint}`);
+    if (e.flows.length > limits.flowsPerEndpoint) problems.push(`${at} has ${e.flows.length} flows, over ${limits.flowsPerEndpoint}`);
+    if ((e.dependencyInputFlows?.length ?? 0) > limits.dependencyInputFlowsPerEndpoint) problems.push(`${at} has ${e.dependencyInputFlows.length} dependency input links, over ${limits.dependencyInputFlowsPerEndpoint}`);
+  });
+  return problems;
+}
+function keepPriority(flow) {
+  if (flow.confidence === "exact-local") return flow.ruleGeneratable ? 3 : 2;
+  if (flow.confidence === "transformed-local") return 1;
+  return 0;
+}
+var STAGES = ["unproven", "invocation", "dependency", "transformed", "exact", "generatable", "import"];
+function budgetDocument(input, limits = INGEST_LIMITS) {
+  let endpointsOmitted = 0;
+  let endpoints = input.endpoints.filter((e) => {
+    const ok = typeof e.file === "string" && e.file.length <= limits.fileLength;
+    if (!ok) endpointsOmitted++;
+    return ok;
+  });
+  if (endpoints.length > limits.endpoints) {
+    endpointsOmitted += endpoints.length - limits.endpoints;
+    endpoints = endpoints.slice(0, limits.endpoints);
+  }
+  endpoints = endpoints.map((e) => capEndpoint(e, limits));
+  let map = { ...input, endpoints };
+  if (endpointsOmitted > 0) map = { ...map, coverage: { ...map.coverage, endpointsOmitted } };
+  const removals = [];
+  map.endpoints.forEach((e, s) => {
+    e.flows.forEach((f, i) => {
+      const p = keepPriority(f);
+      const stage = p === 3 ? "generatable" : p === 2 ? "exact" : p === 1 ? "transformed" : "unproven";
+      removals.push({ stage, section: s, item: i, nodes: 1 + nodeCount(f), bytes: byteLength(f) + 1 });
+    });
+    (e.dependencyInputFlows ?? []).forEach((d, i) => removals.push({ stage: "dependency", section: s, item: i, nodes: 1 + nodeCount(d), bytes: byteLength(d) + 1 }));
+  });
+  (map.apiInvocations ?? []).forEach((v, i) => removals.push({ stage: "invocation", section: -1, item: i, nodes: 1 + nodeCount(v), bytes: byteLength(v) + 1 }));
+  (map.imports ?? []).forEach((v, i) => removals.push({ stage: "import", section: -1, item: i, nodes: 1 + nodeCount(v), bytes: byteLength(v) + 1 }));
+  removals.sort((a, b) => STAGES.indexOf(a.stage) - STAGES.indexOf(b.stage) || b.section - a.section || b.item - a.item);
+  const removed = /* @__PURE__ */ new Set();
+  const key = (r) => `${r.stage === "unproven" || r.stage === "transformed" || r.stage === "exact" || r.stage === "generatable" ? "flow" : r.stage}:${r.section}:${r.item}`;
+  const fitsSize = (doc2) => nodeCount(doc2) <= limits.nodes - RESERVE.nodes && byteLength(doc2) <= limits.bytes - RESERVE.bytes;
+  let doc = withNote(applyRemovals(map, removed));
+  let nodes = nodeCount(doc);
+  let bytes = byteLength(doc);
+  for (const r of removals) {
+    if (nodes <= limits.nodes - RESERVE.nodes && bytes <= limits.bytes - RESERVE.bytes) {
+      doc = withNote(applyRemovals(map, removed));
+      nodes = nodeCount(doc);
+      bytes = byteLength(doc);
+      if (fitsSize(doc)) break;
+    }
+    removed.add(key(r));
+    nodes -= r.nodes;
+    bytes -= r.bytes;
+  }
+  doc = withNote(applyRemovals(map, removed));
+  const problems = ingestProblems(doc, limits);
+  if (problems.length === 0) return doc;
+  return {
+    ...doc,
+    coverage: {
+      ...doc.coverage,
+      notes: [...doc.coverage.notes, `This map cannot be fitted to the size the Patchstack API accepts (${problems.join("; ")}), even after leaving out everything that may be left out. It must not be uploaded.`]
+    }
+  };
+}
+function capEndpoint(e, limits) {
+  let flows = e.flows;
+  let droppedProven = 0;
+  let droppedUnproven = 0;
+  const drop = (keep) => {
+    flows = flows.filter((f) => {
+      if (keep(f)) return true;
+      if (isProvenFlow(f.confidence)) droppedProven++;
+      else droppedUnproven++;
+      return false;
+    });
+  };
+  if (flows.length > limits.flowsPerEndpoint) {
+    const kept = new Set(
+      flows.map((f, i) => ({ f, i, p: keepPriority(f) })).sort((a, b) => b.p - a.p || a.i - b.i).slice(0, limits.flowsPerEndpoint).map(({ i }) => i)
+    );
+    const byIndex = new Map(flows.map((f, i) => [f, i]));
+    drop((f) => kept.has(byIndex.get(f)));
+  }
+  const ranked = [...flows].sort((a, b) => keepPriority(b) - keepPriority(a));
+  const pick = (items, limit, idOf) => {
+    if (items.length <= limit) return { kept: items, omitted: 0 };
+    const wanted = /* @__PURE__ */ new Set();
+    for (const f of ranked) {
+      const id = idOf(f);
+      if (id !== void 0 && wanted.size < limit) wanted.add(id);
+    }
+    const chosen = new Set(items.filter((it) => it.id !== void 0 && wanted.has(it.id)));
+    for (const it of items) if (chosen.size < limit) chosen.add(it);
+    return { kept: items.filter((it) => chosen.has(it)), omitted: items.length - chosen.size };
+  };
+  const inputs = pick(e.inputs, limits.inputsPerEndpoint, (f) => f.inputId);
+  const sinks = pick(e.sinks, limits.sinksPerEndpoint, (f) => f.sink?.id);
+  if (inputs.omitted > 0 || sinks.omitted > 0) {
+    const inputIds = new Set(inputs.kept.map((i) => i.id));
+    const sinkIds = new Set(sinks.kept.map((s) => s.id));
+    drop((f) => (f.inputId === void 0 || inputIds.has(f.inputId)) && (f.sink?.id === void 0 || sinkIds.has(f.sink.id)));
+  }
+  let links = e.dependencyInputFlows;
+  let linksTruncated = e.dependencyInputFlowsTruncated === true;
+  if (links !== void 0 && links.length > limits.dependencyInputFlowsPerEndpoint) {
+    links = links.slice(0, limits.dependencyInputFlowsPerEndpoint);
+    linksTruncated = true;
+  }
+  if (flows === e.flows && inputs.omitted === 0 && sinks.omitted === 0 && links === e.dependencyInputFlows) return e;
+  return {
+    ...e,
+    inputs: inputs.kept,
+    sinks: sinks.kept,
+    flows,
+    ...links !== void 0 ? { dependencyInputFlows: links } : {},
+    ...linksTruncated ? { dependencyInputFlowsTruncated: true } : {},
+    ...droppedUnproven > 0 ? { flowsTruncated: true } : {},
+    ...droppedProven > 0 ? { provenFlowsOmitted: (e.provenFlowsOmitted ?? 0) + droppedProven } : {},
+    ...inputs.omitted > 0 ? { inputsOmitted: inputs.omitted } : {},
+    ...sinks.omitted > 0 ? { sinksOmitted: sinks.omitted } : {}
+  };
+}
+function applyRemovals(map, removed) {
+  if (removed.size === 0) return map;
+  const endpoints = map.endpoints.map((e, s) => {
+    let proven = 0;
+    let unproven = 0;
+    const flows = e.flows.filter((f, i) => {
+      if (!removed.has(`flow:${s}:${i}`)) return true;
+      if (isProvenFlow(f.confidence)) proven++;
+      else unproven++;
+      return false;
+    });
+    const links = e.dependencyInputFlows?.filter((_, i) => !removed.has(`dependency:${s}:${i}`));
+    const linksDropped = (e.dependencyInputFlows?.length ?? 0) - (links?.length ?? 0);
+    if (proven === 0 && unproven === 0 && linksDropped === 0) return e;
+    return {
+      ...e,
+      flows,
+      ...links !== void 0 ? { dependencyInputFlows: links } : {},
+      ...unproven > 0 ? { flowsTruncated: true } : {},
+      ...proven > 0 ? { provenFlowsOmitted: (e.provenFlowsOmitted ?? 0) + proven } : {},
+      ...linksDropped > 0 ? { dependencyInputFlowsTruncated: true } : {}
+    };
+  });
+  const invocations = map.apiInvocations?.filter((_, i) => !removed.has(`invocation:-1:${i}`));
+  const imports = map.imports?.filter((_, i) => !removed.has(`import:-1:${i}`));
+  const invocationsOmitted = (map.apiInvocations?.length ?? 0) - (invocations?.length ?? 0);
+  const importsOmitted = (map.imports?.length ?? 0) - (imports?.length ?? 0);
+  return {
+    ...map,
+    endpoints,
+    ...invocations !== void 0 ? { apiInvocations: invocations } : {},
+    ...imports !== void 0 ? { imports } : {},
+    coverage: {
+      ...map.coverage,
+      ...invocationsOmitted > 0 ? { apiInvocationsOmitted: invocationsOmitted } : {},
+      // A package missing from a trimmed inventory may still be imported, so the inventory stops licensing
+      // any "not imported" conclusion.
+      ...importsOmitted > 0 ? { importsComplete: false, importCoverageGaps: { ...map.coverage.importCoverageGaps, omittedForSize: importsOmitted } } : {}
+    }
+  };
+}
+function withNote(doc) {
+  const parts = [];
+  const proven = doc.endpoints.reduce((n, e) => n + (e.provenFlowsOmitted ?? 0), 0);
+  const marked = doc.endpoints.filter((e) => e.provenFlowsOmitted || e.inputsOmitted || e.sinksOmitted).length;
+  if (proven > 0) parts.push(`${proven} proven flow(s)`);
+  const inputs = doc.endpoints.reduce((n, e) => n + (e.inputsOmitted ?? 0), 0);
+  const sinks = doc.endpoints.reduce((n, e) => n + (e.sinksOmitted ?? 0), 0);
+  if (inputs > 0) parts.push(`${inputs} input(s)`);
+  if (sinks > 0) parts.push(`${sinks} sink(s)`);
+  if (doc.coverage.apiInvocationsOmitted) parts.push(`${doc.coverage.apiInvocationsOmitted} API invocation(s)`);
+  if (doc.coverage.importCoverageGaps?.omittedForSize) parts.push(`${doc.coverage.importCoverageGaps.omittedForSize} import(s)`);
+  if (doc.coverage.endpointsOmitted) parts.push(`${doc.coverage.endpointsOmitted} endpoint(s)`);
+  const links = doc.endpoints.filter((e) => e.dependencyInputFlowsTruncated).length;
+  if (parts.length === 0) return doc;
+  return {
+    ...doc,
+    coverage: {
+      ...doc.coverage,
+      notes: [...doc.coverage.notes, `To stay within the size the Patchstack API accepts, this map left out ${parts.join(", ")}${marked > 0 ? ` (${marked} endpoint(s) marked provenFlowsOmitted, inputsOmitted or sinksOmitted)` : ""}${links > 0 ? `; ${links} endpoint(s) have dependencyInputFlowsTruncated` : ""}. What is listed is true; what was left out is unknown, not absent.`]
+    }
+  };
+}
+
 // src/map/module-graph.ts
 import { readFileSync as readFileSync14, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
 import { dirname as dirname8, join as join16, relative as relative5, resolve as resolvePath } from "path";
@@ -9221,7 +9517,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   notes.push(deploymentShapes.length === 0 ? "`deploymentShapes` is EMPTY: no deployment artifact was recognized. That is not evidence the app has no server-side runtime \u2014 a serverless handler this analysis cannot parse produces no endpoint and looks identical to an app that has none, and entry-point recognition has no completeness flag (coverage.importsComplete covers the import inventory only). A definitive answer needs deployment or build attestation, which source analysis cannot supply." : `\`deploymentShapes\` records ${deploymentShapes.length} deployment artifact(s) the project declares (${deploymentShapes.map((s) => s.shape).join(", ")}). POSITIVE EVIDENCE ONLY, and findings differ in strength: only \`runtime-entry\` (a worker entry, or a provider function directory with source) shows something that serves. \`deployment-config\` means the project deploys to a platform \u2014 a static site on Netlify has a \`netlify.toml\` \u2014 and \`layout\` (a root \`api/\` or \`functions/\` folder) is an ordinary application folder. Neither may on its own be read as a server runtime.`);
   const serverSurface = classifyServerSurface(cwd, endpoints.length, deploymentShapes, ts);
   notes.push(surfaceNote(serverSurface));
-  return {
+  return budgetDocument({
     version: 3,
     framework: detectFramework(cwd),
     deploymentShapes,
@@ -9261,7 +9557,7 @@ async function extractInputMap(cwd, ts, options = {}) {
       roots: ["."],
       notes
     }
-  };
+  });
 }
 
 // src/map/index.ts
@@ -9562,6 +9858,11 @@ async function runMap(flags) {
     console.log(json);
   }
   if (flags.get("upload") === true) {
+    const problems = ingestProblems(map);
+    if (problems.length > 0) {
+      console.error(`patchstack: did not upload the attack surface \u2014 it cannot be fitted to the size Patchstack accepts (${problems.join("; ")}).`);
+      return 0;
+    }
     if (map.endpoints.length === 0) {
       console.error(
         "patchstack: no server entry points were recognized \u2014 uploading the import inventory and coverage notes anyway, so a vulnerability can still be judged imported or not. Nothing here can decide whether a request reaches it."
@@ -10230,6 +10531,8 @@ async function runScan(args, options = {}) {
     say(`Stored manifest #${response.manifest_id} (checksum ${response.checksum}).`);
   } else if (response.reason === "duplicate") {
     report.done.unshift(checked, "No changes since the last check");
+  } else if (response.reason === "build-reported") {
+    report.done.unshift(checked, response.message ?? "Reported this production build");
   } else {
     report.missing.push({
       text: "Patchstack did not save this check",
@@ -10275,7 +10578,7 @@ async function runScan(args, options = {}) {
   if (config.widget && effectiveUuid !== null && effectiveUuid.length > 0) {
     reportSourceWidget(effectiveUuid, shellFramework, report);
   }
-  const synced = effectiveUuid !== null && effectiveUuid.length > 0 && (response.stored || response.reason === "duplicate");
+  const synced = effectiveUuid !== null && effectiveUuid.length > 0 && (response.stored || response.reason === "duplicate" || response.reason === "build-reported");
   const outcome = {
     connected,
     synced,