@patchstack/connect 0.5.2 → 0.5.3

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
+import { readFileSync as readFileSync16, writeFileSync as writeFileSync11 } from "fs";
 import { createRequire as createRequire2 } from "module";
 
 // src/parsers/index.ts
@@ -1288,6 +1288,27 @@ async function pulseFetch(config, url, init, fetchImpl = fetch) {
   return first.response;
 }
 
+// src/build-id.ts
+var BUILD_ID = /^[0-9a-f]{64}$/i;
+function canonicalBuildId(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return BUILD_ID.test(trimmed) ? trimmed.toLowerCase() : null;
+}
+var BUILD_STAMP_KEY = "_patchstack";
+function readBuildStamp(bundle) {
+  if (bundle === null || typeof bundle !== "object") return null;
+  const namespace = bundle[BUILD_STAMP_KEY];
+  if (namespace === null || typeof namespace !== "object") return null;
+  return canonicalBuildId(namespace.build_id);
+}
+function hasRawBuildStamp(bundle) {
+  if (bundle === null || typeof bundle !== "object") return false;
+  const namespace = bundle[BUILD_STAMP_KEY];
+  if (namespace === null || typeof namespace !== "object") return false;
+  return "build_id" in namespace;
+}
+
 // src/client.ts
 var DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -1359,12 +1380,13 @@ function buildInputMapUrl(manifestEndpoint, siteUuid) {
   url.hash = "";
   return url.toString();
 }
-async function postInputMap(config, map) {
+async function postInputMap(config, map, buildId) {
   if (config.siteUuid === null) {
     return { result: "skipped", message: "No site UUID configured \u2014 run `patchstack-connect scan` first." };
   }
   const url = buildInputMapUrl(config.endpoint, config.siteUuid);
   try {
+    const canonical = canonicalBuildId(buildId);
     const response = await pulseFetch(config, url, {
       method: "POST",
       headers: {
@@ -1372,7 +1394,12 @@ async function postInputMap(config, map) {
         "Content-Type": "application/json",
         "User-Agent": "@patchstack/connect"
       },
-      body: JSON.stringify(map),
+      // `build_id` is additive to the v3 document: a reader that ignores it behaves exactly as before.
+      // It is the digest of the policy map carrying these coordinates, so the server can serve a rule pinned
+      // to one of them as enforceable only to a guard carrying that same map. Omitted entirely when this
+      // run could not bind the map into a pre-bundle guard — an absent field is a question the server
+      // answers by withholding enforceability, which is the safe direction.
+      body: JSON.stringify(canonical === null ? map : { ...map, build_id: canonical }),
       signal: AbortSignal.timeout(config.timeoutMs)
     });
     if (response.status === 404) {
@@ -4292,9 +4319,9 @@ async function collectGuideState(cwd) {
     endpointOverride,
     hasBuildScript: Boolean(pkg?.scripts?.build?.trim()),
     installScanWired: (pkg?.scripts?.postinstall ?? "").includes("patchstack-connect scan"),
-    // bun run doesn't execute npm-style pre/post scripts, so chaining inside
-    // the build script itself also counts as wired (and is what we suggest on bun).
-    prebuildWired: (pkg?.scripts?.prebuild ?? "").includes("patchstack-connect scan") || (pkg?.scripts?.build ?? "").includes("patchstack-connect scan"),
+    // The scan has to run first: a later prebuild command may upload and stamp the map that the bundle
+    // must retain. Bun skips npm-style pre/post scripts, so its build chain follows the same order.
+    prebuildWired: /^\s*patchstack-connect\s+scan(?:\s*(?:&&|;)|\s*$)/.test(pkg?.scripts?.prebuild ?? "") || /^\s*patchstack-connect\s+scan(?:\s*(?:&&|;)|\s*$)/.test(pkg?.scripts?.build ?? ""),
     postbuildWired: (pkg?.scripts?.postbuild ?? "").includes("patchstack-connect mark-build") || (pkg?.scripts?.build ?? "").includes("patchstack-connect mark-build"),
     widgetInstalled: widget.found,
     widgetTokenMatches: widget.uuidMatches,
@@ -5196,7 +5223,7 @@ function formatRuntimeCheck(report) {
 }
 
 // src/map-command.ts
-import { writeFileSync as writeFileSync8 } from "fs";
+import { writeFileSync as writeFileSync9 } from "fs";
 
 // src/map/ts-loader.ts
 import { createRequire } from "module";
@@ -6068,14 +6095,14 @@ function directSinks(node, ts, bindings, ctx) {
     const root = base ? rootIdentifier(base, ts) : void 0;
     if (!root) return {};
     const spec = bindings.resolve(root);
-    const relative6 = spec !== void 0 && (spec.startsWith(".") || spec.startsWith("/"));
+    const relative7 = spec !== void 0 && (spec.startsWith(".") || spec.startsWith("/"));
     const pkg = npmPackageOf(spec);
     if (pkg) return { pkg, root, spec };
-    if (relative6 && ctx && spec) {
+    if (relative7 && ctx && spec) {
       const viaModule = ctx.graph.importedBinding(ctx.file, spec, bindings.exportNameOf(root) ?? root);
       if (viaModule) return { pkg: viaModule.package, root, spec };
     }
-    return { local: bindings.locals.has(root), root, spec, relative: relative6 };
+    return { local: bindings.locals.has(root), root, spec, relative: relative7 };
   };
   const attributionOf = (b, pkg) => b.pkg ? "import" : pkg ? "inferred" : void 0;
   const dbApi = (pkg, attribution) => {
@@ -7608,6 +7635,243 @@ function getStringFlag(flags, name) {
   return typeof value === "string" ? value : void 0;
 }
 
+// src/build-stamp.ts
+import { chmodSync, lstatSync as lstatSync3, readFileSync as readFileSync14, readdirSync as readdirSync6, realpathSync as realpathSync5, renameSync, unlinkSync, writeFileSync as writeFileSync8 } from "fs";
+import { join as join19, relative as relative6, sep as sep2 } from "path";
+var RULES_FILE_NAMES = /* @__PURE__ */ new Set(["rules.json", "patchstack.rules.json"]);
+var SKIP_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "out", "coverage", "tmp", "vendor"]);
+var MAX_DEPTH2 = 6;
+var GUARD_SOURCE = /\.(?:[cm]?[jt]sx?)$/;
+var MAX_GUARD_SOURCE_BYTES = 1024 * 1024;
+var escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function guardImportsRulesFile(dir, rulesName) {
+  const quotedRules = `["']\\./${escapeRegExp(rulesName)}["']`;
+  const importsRules = new RegExp(`(?:\\bfrom\\s*|\\brequire\\s*\\(\\s*|\\bnew\\s+URL\\s*\\(\\s*)${quotedRules}`);
+  let siblings;
+  try {
+    siblings = readdirSync6(dir);
+  } catch {
+    return false;
+  }
+  for (const name of siblings) {
+    if (!GUARD_SOURCE.test(name)) continue;
+    const path14 = join19(dir, name);
+    try {
+      const entry = lstatSync3(path14);
+      if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_GUARD_SOURCE_BYTES) continue;
+      const source = stripComments(readFileSync14(path14, "utf8"));
+      if (source.includes("@patchstack/connect/protect") && importsRules.test(source)) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function isRuleBundle(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  return Array.isArray(record.firewall) && Array.isArray(record.whitelists) && record.whitelist_keys !== null && typeof record.whitelist_keys === "object";
+}
+function findRulesFile(cwd) {
+  const found = [];
+  const unreadable = [];
+  let root;
+  try {
+    root = realpathSync5(cwd);
+  } catch {
+    return { kind: "none" };
+  }
+  const contained = (path14) => {
+    try {
+      const real = realpathSync5(path14);
+      return real === root || real.startsWith(root + sep2);
+    } catch {
+      return false;
+    }
+  };
+  const walk2 = (dir, depth) => {
+    if (depth > MAX_DEPTH2 || found.length > 8) return;
+    let entries;
+    try {
+      entries = readdirSync6(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (name.startsWith(".")) continue;
+      const path14 = join19(dir, name);
+      let entry;
+      try {
+        entry = lstatSync3(path14);
+      } catch {
+        continue;
+      }
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRECTORIES.has(name)) walk2(path14, depth + 1);
+        continue;
+      }
+      if (!entry.isFile() || !RULES_FILE_NAMES.has(name)) continue;
+      if (!contained(path14)) continue;
+      if (!guardImportsRulesFile(dir, name)) continue;
+      try {
+        if (isRuleBundle(JSON.parse(readFileSync14(path14, "utf8")))) found.push(path14);
+      } catch {
+        unreadable.push(path14);
+      }
+    }
+  };
+  walk2(cwd, 0);
+  if (found.length > 1) return { kind: "ambiguous", paths: found.map((p) => relative6(cwd, p)) };
+  if (found.length === 1) return { kind: "one", path: found[0] };
+  if (unreadable.length > 0) return { kind: "unreadable", paths: unreadable.map((p) => relative6(cwd, p)) };
+  return { kind: "none" };
+}
+function detectIndent(text) {
+  const match = /\n([ \t]+)"/.exec(text);
+  if (match === null) return 0;
+  const whitespace = match[1];
+  return whitespace.includes("	") ? "	" : whitespace.length;
+}
+function applyBuildStamp(cwd, id) {
+  const location = findRulesFile(cwd);
+  if (location.kind === "none") return { kind: "skipped", reason: "no guard rules file in this project" };
+  if (location.kind === "unreadable") {
+    return { kind: "skipped", reason: `${location.paths.join(", ")} is not valid JSON \u2014 left untouched` };
+  }
+  if (location.kind === "ambiguous") {
+    return {
+      kind: "skipped",
+      reason: `more than one candidate guard rules file (${location.paths.join(", ")}) \u2014 none was stamped`
+    };
+  }
+  const file = relative6(cwd, location.path);
+  let text;
+  try {
+    text = readFileSync14(location.path, "utf8");
+  } catch (err) {
+    return { kind: "skipped", reason: `${file} could not be read (${err.message})` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return { kind: "skipped", reason: `${file} is not valid JSON \u2014 left untouched` };
+  }
+  if (!isRuleBundle(parsed)) return { kind: "skipped", reason: `${file} is not a guard rules bundle` };
+  const bundle = parsed;
+  const current = readBuildStamp(bundle);
+  if (id === null ? !hasRawBuildStamp(bundle) : current === id) return { kind: "unchanged", file };
+  const namespace = { ...bundle[BUILD_STAMP_KEY] ?? {} };
+  if (id === null) delete namespace.build_id;
+  else namespace.build_id = id;
+  if (Object.keys(namespace).length === 0) delete bundle[BUILD_STAMP_KEY];
+  else bundle[BUILD_STAMP_KEY] = namespace;
+  const serialised = JSON.stringify(bundle, null, detectIndent(text)) + (text.endsWith("\n") ? "\n" : "");
+  const temporary = `${location.path}.patchstack-${process.pid}.tmp`;
+  try {
+    const mode = lstatSync3(location.path).mode & 4095;
+    writeFileSync8(temporary, serialised, { encoding: "utf8", mode });
+    chmodSync(temporary, mode);
+    renameSync(temporary, location.path);
+  } catch (err) {
+    try {
+      unlinkSync(temporary);
+    } catch {
+    }
+    return { kind: "skipped", reason: `${file} could not be written (${err.message})` };
+  }
+  return id === null ? { kind: "cleared", file } : { kind: "stamped", file, id };
+}
+
+// src/build-hook.ts
+var INSTALL_AND_BUILD_EVENTS = /* @__PURE__ */ new Set([
+  "preinstall",
+  "install",
+  "postinstall",
+  "prepare",
+  "prebuild",
+  "build",
+  "postbuild"
+]);
+function isInstallOrBuildHook(env = process.env) {
+  const event = env.npm_lifecycle_event;
+  return typeof event === "string" && INSTALL_AND_BUILD_EVENTS.has(event);
+}
+function isPreBundleBuildHook(env = process.env) {
+  const event = env.npm_lifecycle_event;
+  if (event === "prebuild") return true;
+  if (event !== "build") return false;
+  return /^\s*patchstack-connect\s+scan(?:\s*(?:&&|;)|\s*$)/.test(env.npm_lifecycle_script ?? "");
+}
+function undeliveredReportLines(err, config, cwd) {
+  const lines = [`patchstack: manifest not reported \u2014 ${err.message}`];
+  if (err.code === "UNAUTHORIZED") {
+    const hasCredential = typeof config.pulseAuth === "string" && config.pulseAuth.length > 0;
+    if (hasCredential) {
+      lines.push(
+        "patchstack: the credential this environment holds was rejected. If `login` rotated it, set the new value as PATCHSTACK_API_KEY here."
+      );
+    } else {
+      lines.push(
+        `patchstack: PATCHSTACK_API_KEY is not set, and neither ${SECRET_CONFIG_FILENAME} nor .patchstackrc.json in ${cwd} holds a credential.`,
+        `patchstack: ${SECRET_CONFIG_FILENAME} is git-ignored, so a clean checkout never has it. Set PATCHSTACK_API_KEY in the platform's environment so builds can report.`
+      );
+    }
+  }
+  lines.push(
+    "patchstack: continuing the build. Patchstack keeps the last manifest it accepted for this site until a scan that can report."
+  );
+  return lines;
+}
+
+// src/input-map-id.ts
+import { createHash as createHash6 } from "crypto";
+var NonCanonicalInputMap = class extends Error {
+};
+function canonicalString(value) {
+  let out = '"';
+  for (const character of value) {
+    const code = character.codePointAt(0);
+    if (character === '"') out += '\\"';
+    else if (character === "\\") out += "\\\\";
+    else if (code < 32) out += `\\u${code.toString(16).padStart(4, "0")}`;
+    else out += character;
+  }
+  return `${out}"`;
+}
+function canonicalText(value) {
+  if (value === null) return "null";
+  if (value === true) return "true";
+  if (value === false) return "false";
+  if (typeof value === "string") return canonicalString(value);
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value)) {
+      throw new NonCanonicalInputMap("the input map contains a number outside the safe-integer form");
+    }
+    return String(value === 0 ? 0 : value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalText).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    const record = value;
+    const keys = Object.keys(record).sort();
+    return `{${keys.map((key) => `${canonicalString(key)}:${canonicalText(record[key])}`).join(",")}}`;
+  }
+  throw new NonCanonicalInputMap(`the input map contains a value with no JSON form (${typeof value})`);
+}
+function inputMapBuildId(map) {
+  let material = map;
+  if (map !== null && typeof map === "object" && !Array.isArray(map)) {
+    const record = map;
+    const { build_id: _buildId, ...mapDocument } = record;
+    const coverage = record.coverage;
+    if (coverage !== null && typeof coverage === "object" && !Array.isArray(coverage)) {
+      const { analysisMs: _analysisMs, rssBytes: _rssBytes, peakRssBytes: _peakRssBytes, ...stableCoverage } = coverage;
+      material = { ...mapDocument, coverage: stableCoverage };
+    } else material = mapDocument;
+  }
+  return createHash6("sha256").update("patchstack-input-map-v1\0", "utf8").update(canonicalText(material), "utf8").digest("hex");
+}
+
 // src/map-command.ts
 async function runMap(flags) {
   const cwd = getStringFlag(flags, "dir") ?? process.cwd();
@@ -7652,7 +7916,7 @@ async function runMap(flags) {
   const json = JSON.stringify(map, null, 2);
   const out = getStringFlag(flags, "out");
   if (out) {
-    writeFileSync8(out, json);
+    writeFileSync9(out, json);
     console.error(`patchstack: wrote ${out}`);
   } else if (flags.get("upload") !== true) {
     console.log(json);
@@ -7668,7 +7932,25 @@ async function runMap(flags) {
       cliSiteUuid: getStringFlag(flags, "site-uuid"),
       cliEndpoint: getStringFlag(flags, "endpoint")
     });
-    const outcome = await postInputMap(config, map);
+    let buildId = null;
+    if (isPreBundleBuildHook()) {
+      const candidate = inputMapBuildId(map);
+      const stamp = applyBuildStamp(cwd, candidate);
+      if (stamp.kind === "stamped" || stamp.kind === "unchanged") {
+        buildId = candidate;
+        console.error(`patchstack: bound this map to ${stamp.file} (${candidate.slice(0, 12)}).`);
+      } else {
+        const reason = stamp.kind === "skipped" ? stamp.reason : "the rules file did not retain the map identity";
+        console.error(
+          `patchstack: could not bind this map to the runtime guard \u2014 ${reason}. Rules generated from these coordinates will detect only, not block.`
+        );
+      }
+    } else {
+      console.error(
+        "patchstack: no runtime binding recorded \u2014 run `map --upload` in a prebuild hook before the bundler, so rules generated from these coordinates can be tied to the runtime guard. Until then they detect only, not block."
+      );
+    }
+    const outcome = await postInputMap(config, map, buildId);
     if (outcome.result === "stored") {
       console.error(`patchstack: uploaded the attack surface (revision ${outcome.revision}).`);
     } else if (outcome.result === "unchanged") {
@@ -7683,7 +7965,7 @@ async function runMap(flags) {
 }
 
 // src/setup.ts
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
 import path13 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
@@ -7701,9 +7983,16 @@ function appendHook(existing, command) {
   }
   return `${existing} && ${command}`;
 }
+function prependHook(existing, command) {
+  if (existing === void 0 || existing.trim().length === 0) return command;
+  const escaped = command.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  if (new RegExp(`^\\s*${escaped}\\s*(?:;|\\|\\|)`).test(existing)) return existing;
+  const remaining = existing.split(/\s*&&\s*/).filter((part) => part.trim() !== command && part.trim().length > 0);
+  return [command, ...remaining].join(" && ");
+}
 function wireBuildScripts(cwd, packageManager) {
   const target = path13.join(cwd, "package.json");
-  const raw = readFileSync14(target, "utf8");
+  const raw = readFileSync15(target, "utf8");
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
   const build = scripts.build;
@@ -7718,10 +8007,7 @@ function wireBuildScripts(cwd, packageManager) {
     }
     scripts.postinstall = postinstall;
   } else if (packageManager === "bun") {
-    let nextBuild = build;
-    if (!nextBuild.includes(SCAN_COMMAND)) {
-      nextBuild = `${SCAN_COMMAND} && ${nextBuild}`;
-    }
+    let nextBuild = prependHook(build, SCAN_COMMAND);
     if (!nextBuild.includes(MARK_BUILD_COMMAND)) {
       nextBuild = `${nextBuild} && ${MARK_BUILD_COMMAND}`;
     }
@@ -7735,7 +8021,7 @@ function wireBuildScripts(cwd, packageManager) {
     scripts.postinstall = postinstall;
     scripts.build = nextBuild;
   } else {
-    const prebuild = appendHook(scripts.prebuild, SCAN_COMMAND);
+    const prebuild = prependHook(scripts.prebuild, SCAN_COMMAND);
     const postbuild = appendHook(scripts.postbuild, MARK_BUILD_COMMAND);
     if (prebuild === scripts.prebuild && postbuild === scripts.postbuild && postinstall === scripts.postinstall) {
       return {
@@ -7752,7 +8038,7 @@ function wireBuildScripts(cwd, packageManager) {
   const indentMatch = raw.match(/^[\t ]+(?=")/m)?.[0];
   const indent = indentMatch?.includes("	") ? "	" : indentMatch?.length ?? 2;
   const trailingNewline = raw.endsWith("\n") ? "\n" : "";
-  writeFileSync9(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
+  writeFileSync10(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
   if (build === void 0 || build.trim().length === 0) {
     return {
       changed: true,
@@ -7771,41 +8057,6 @@ function wireBuildScripts(cwd, packageManager) {
   };
 }
 
-// src/build-hook.ts
-var INSTALL_AND_BUILD_EVENTS = /* @__PURE__ */ new Set([
-  "preinstall",
-  "install",
-  "postinstall",
-  "prepare",
-  "prebuild",
-  "build",
-  "postbuild"
-]);
-function isInstallOrBuildHook(env = process.env) {
-  const event = env.npm_lifecycle_event;
-  return typeof event === "string" && INSTALL_AND_BUILD_EVENTS.has(event);
-}
-function undeliveredReportLines(err, config, cwd) {
-  const lines = [`patchstack: manifest not reported \u2014 ${err.message}`];
-  if (err.code === "UNAUTHORIZED") {
-    const hasCredential = typeof config.pulseAuth === "string" && config.pulseAuth.length > 0;
-    if (hasCredential) {
-      lines.push(
-        "patchstack: the credential this environment holds was rejected. If `login` rotated it, set the new value as PATCHSTACK_API_KEY here."
-      );
-    } else {
-      lines.push(
-        `patchstack: PATCHSTACK_API_KEY is not set, and neither ${SECRET_CONFIG_FILENAME} nor .patchstackrc.json in ${cwd} holds a credential.`,
-        `patchstack: ${SECRET_CONFIG_FILENAME} is git-ignored, so a clean checkout never has it. Set PATCHSTACK_API_KEY in the platform's environment so builds can report.`
-      );
-    }
-  }
-  lines.push(
-    "patchstack: continuing the build. Patchstack keeps the last manifest it accepted for this site until a scan that can report."
-  );
-  return lines;
-}
-
 // src/cli.ts
 var HELP = `@patchstack/connect \u2014 scan your lockfile and report packages to Patchstack.
 
@@ -7833,7 +8084,8 @@ Usage:
                                                      with how the link was established). Best-effort static
                                                      analysis \u2014 reports the DETECTED surface, with
                                                      coverage counters. Prints JSON (--out writes a
-                                                     file; --follow-symlinks leaves the project dir).
+                                                     file; a pre-bundle --upload also stamps the existing
+                                                     guard rules file; --follow-symlinks leaves the project dir).
                                                      Uses the app's own TypeScript
   patchstack-connect init   <site-uuid>              Optional: pre-seed .patchstackrc.json
                                                      with an existing site UUID
@@ -8255,6 +8507,10 @@ async function runScan(args, options = {}) {
     }
     return 0;
   }
+  if (isPreBundleBuildHook()) {
+    const cleared = applyBuildStamp(process.cwd(), null);
+    if (cleared.kind === "cleared") console.log(`Removed the previous map binding from ${cleared.file}.`);
+  }
   if (config.widget) {
     reportSourceMarker(detectStack(payload.packages).framework);
   }
@@ -8553,7 +8809,7 @@ async function runGuide(args) {
   console.log("\u2014\u2014\u2014\u2014 Full reference guide (ships as AGENT-INSTALL.md) \u2014\u2014\u2014\u2014");
   console.log("");
   const guidePath = new URL("../AGENT-INSTALL.md", import.meta.url);
-  console.log(readFileSync15(guidePath, "utf8"));
+  console.log(readFileSync16(guidePath, "utf8"));
   return 0;
 }
 async function runSetup(args) {
@@ -8747,7 +9003,7 @@ async function runMarkBuild(args) {
   let marked = 0;
   let widgetTouched = 0;
   for (const file of files) {
-    const before = readFileSync15(file, "utf8");
+    const before = readFileSync16(file, "utf8");
     let after = injectMarker(before, snippet);
     if (widgetUuid !== null) {
       const ensured = ensureWidgetInHtml(after, widgetUuid);
@@ -8757,7 +9013,7 @@ async function runMarkBuild(args) {
       after = ensured.html;
     }
     if (after !== before) {
-      writeFileSync10(file, after);
+      writeFileSync11(file, after);
       marked += 1;
     }
   }