@patchstack/connect 0.5.2 → 0.5.4

package/dist/protect.cjs

@@ -123,6 +123,27 @@ var init_pulse_token = __esm({
   }
 });
 
+// src/build-id.ts
+function canonicalBuildId(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return BUILD_ID.test(trimmed) ? trimmed.toLowerCase() : null;
+}
+function readBuildStamp(bundle) {
+  if (bundle === null || typeof bundle !== "object") return null;
+  const namespace = bundle[BUILD_STAMP_KEY];
+  if (namespace === null || typeof namespace !== "object") return null;
+  return canonicalBuildId(namespace.build_id);
+}
+var BUILD_ID, BUILD_STAMP_KEY;
+var init_build_id = __esm({
+  "src/build-id.ts"() {
+    "use strict";
+    BUILD_ID = /^[0-9a-f]{64}$/i;
+    BUILD_STAMP_KEY = "_patchstack";
+  }
+});
+
 // src/types.ts
 var PatchstackError;
 var init_types = __esm({
@@ -137,6 +158,46 @@ var init_types = __esm({
       }
       code;
       cause;
+      /**
+       * For a `VALIDATION_ERROR`, the request fields the server refused, as it named them. Read from the
+       * structured `errors` object a validation response carries, so a caller deciding what to do about a
+       * refusal keys on the field rather than on the wording of a sentence.
+       */
+      fields = [];
+    };
+  }
+});
+
+// src/hosting.ts
+function detectHostingPlatform(env = process.env) {
+  for (const rule of RULES) {
+    const evidence = rule.any.filter((name) => present(env, name));
+    if (evidence.length > 0) {
+      return { platform: rule.platform, evidence };
+    }
+  }
+  return { platform: null, evidence: [] };
+}
+var RULES, present;
+var init_hosting = __esm({
+  "src/hosting.ts"() {
+    "use strict";
+    RULES = [
+      { platform: "netlify", any: ["NETLIFY", "NETLIFY_BUILD_BASE", "DEPLOY_PRIME_URL"] },
+      { platform: "vercel", any: ["VERCEL", "VERCEL_ENV", "VERCEL_URL"] },
+      { platform: "cloudflare", any: ["CF_PAGES", "CF_PAGES_URL", "CLOUDFLARE_ACCOUNT_ID"] },
+      { platform: "aws", any: ["AWS_APP_ID", "AWS_LAMBDA_FUNCTION_NAME", "AWS_EXECUTION_ENV"] },
+      { platform: "render", any: ["RENDER", "RENDER_SERVICE_ID", "RENDER_EXTERNAL_URL"] },
+      { platform: "railway", any: ["RAILWAY_ENVIRONMENT", "RAILWAY_ENVIRONMENT_NAME", "RAILWAY_PROJECT_ID"] },
+      { platform: "fly", any: ["FLY_APP_NAME", "FLY_REGION", "FLY_ALLOC_ID"] },
+      { platform: "heroku", any: ["DYNO", "HEROKU_APP_NAME"] },
+      { platform: "google-cloud", any: ["K_SERVICE", "GAE_APPLICATION", "GAE_SERVICE"] },
+      { platform: "deno-deploy", any: ["DENO_DEPLOYMENT_ID"] },
+      { platform: "azure", any: ["WEBSITE_SITE_NAME", "WEBSITE_INSTANCE_ID"] }
+    ];
+    present = (env, name) => {
+      const value = env[name];
+      return value !== void 0 && value !== "";
     };
   }
 });
@@ -162,14 +223,22 @@ function authFailureMessage(status, config) {
   }
   return null;
 }
-function buildManifestBody(config, payload) {
+function buildManifestBody(config, payload, env = process.env) {
+  const hosting = config.environment === "local" ? null : detectHostingPlatform(env);
   return {
     ...payload,
     environment: config.environment,
     ...typeof config.siteUrl === "string" && config.siteUrl !== "" ? { url: config.siteUrl } : {},
-    ...typeof config.siteName === "string" && config.siteName !== "" ? { name: config.siteName } : {}
+    ...typeof config.siteName === "string" && config.siteName !== "" ? { name: config.siteName } : {},
+    ...hosting !== null && hosting.platform !== null ? { hosting } : {}
   };
 }
+function validationFields(body) {
+  if (typeof body !== "object" || body === null) return [];
+  const errors = body.errors;
+  if (typeof errors !== "object" || errors === null || Array.isArray(errors)) return [];
+  return Object.keys(errors);
+}
 async function postManifest(config, payload) {
   const url = buildEndpointUrl(config.endpoint, config.siteUuid);
   const timeoutMs = config.timeoutMs;
@@ -214,10 +283,12 @@ async function postManifest(config, payload) {
     );
   }
   if (response.status === 422) {
-    throw new PatchstackError(
+    const refused2 = new PatchstackError(
       body?.message ?? "Patchstack rejected the manifest payload (validation failed).",
       "VALIDATION_ERROR"
     );
+    refused2.fields = validationFields(body);
+    throw refused2;
   }
   const refused = authFailureMessage(response.status, config);
   if (refused !== null) {
@@ -245,13 +316,63 @@ var init_client = __esm({
   "src/client.ts"() {
     "use strict";
     init_types();
+    init_hosting();
     init_pulse_token();
+    init_build_id();
     DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
     DEFAULT_TIMEOUT_MS = 3e4;
     CLAIM_TOKEN_HEADER = "X-Patchstack-Claim-Token";
   }
 });
 
+// src/environment.ts
+function inferEnvironment(env = process.env) {
+  for (const discriminator of DISCRIMINATORS) {
+    const verdict = discriminator.read(env);
+    if (verdict !== null) {
+      return { environment: verdict.environment, evidence: [`${discriminator.platform}: ${verdict.evidence}`] };
+    }
+  }
+  return { environment: "local", evidence: [] };
+}
+var set, DISCRIMINATORS;
+var init_environment = __esm({
+  "src/environment.ts"() {
+    "use strict";
+    set = (value) => value !== void 0 && value !== "";
+    DISCRIMINATORS = [
+      {
+        platform: "vercel",
+        read: (env) => {
+          if (!set(env.VERCEL) || !set(env.VERCEL_ENV)) return null;
+          return env.VERCEL_ENV === "production" ? { environment: "production", evidence: "VERCEL_ENV=production" } : { environment: "sandbox", evidence: `VERCEL_ENV=${env.VERCEL_ENV}` };
+        }
+      },
+      {
+        platform: "netlify",
+        read: (env) => {
+          if (env.NETLIFY !== "true" || !set(env.CONTEXT)) return null;
+          return env.CONTEXT === "production" ? { environment: "production", evidence: "CONTEXT=production" } : { environment: "sandbox", evidence: `CONTEXT=${env.CONTEXT}` };
+        }
+      },
+      {
+        platform: "render",
+        read: (env) => {
+          if (env.RENDER !== "true") return null;
+          return env.IS_PULL_REQUEST === "true" ? { environment: "sandbox", evidence: "IS_PULL_REQUEST=true" } : { environment: "production", evidence: "RENDER=true, not a pull request" };
+        }
+      },
+      {
+        platform: "railway",
+        read: (env) => {
+          if (!set(env.RAILWAY_ENVIRONMENT_NAME)) return null;
+          return env.RAILWAY_ENVIRONMENT_NAME === "production" ? { environment: "production", evidence: "RAILWAY_ENVIRONMENT_NAME=production" } : { environment: "sandbox", evidence: `RAILWAY_ENVIRONMENT_NAME=${env.RAILWAY_ENVIRONMENT_NAME}` };
+        }
+      }
+    ];
+  }
+});
+
 // src/site-url.ts
 function isUnpublishableHost(hostname) {
   const host = hostname.toLowerCase().replace(/\.+$/, "");
@@ -463,11 +584,13 @@ async function resolveConfig(options) {
   const environmentRaw = fromEnv.environment ?? fromFile.environment;
   if (environmentRaw !== void 0 && !isEnvironment(environmentRaw)) {
     throw new PatchstackError(
-      `Environment must be "production" or "sandbox"; got "${environmentRaw}".`,
+      `Environment must be "production", "sandbox" or "local"; got "${environmentRaw}".`,
       "CONFIG_INVALID"
     );
   }
-  const environment = environmentRaw ?? DEFAULT_ENVIRONMENT;
+  const inferred = environmentRaw === void 0 ? inferEnvironment(process.env) : null;
+  const environment = environmentRaw ?? inferred.environment;
+  const environmentEvidence = inferred?.evidence ?? [];
   if (siteUuid !== null && siteUuid.length > 0 && !isUuid(siteUuid)) {
     throw new PatchstackError(
       `Site UUID "${siteUuid}" does not look like a valid UUID.`,
@@ -493,6 +616,7 @@ async function resolveConfig(options) {
     endpoint,
     timeoutMs,
     environment,
+    environmentEvidence,
     widget: fromFile.widget !== false,
     claimToken
   };
@@ -558,9 +682,9 @@ function isUuid(value) {
   return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
 }
 function isEnvironment(value) {
-  return value === "production" || value === "sandbox";
+  return value === "production" || value === "sandbox" || value === "local";
 }
-var import_promises2, import_node_path2, CONFIG_FILENAME, SECRET_FILENAME, DEFAULT_ENVIRONMENT;
+var import_promises2, import_node_path2, CONFIG_FILENAME, SECRET_FILENAME;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
@@ -568,11 +692,11 @@ var init_config = __esm({
     import_node_path2 = __toESM(require("path"), 1);
     init_types();
     init_client();
+    init_environment();
     init_site_url();
     init_site_name();
     CONFIG_FILENAME = ".patchstackrc.json";
     SECRET_FILENAME = ".patchstackrc.local.json";
-    DEFAULT_ENVIRONMENT = "production";
   }
 });
 
@@ -609,8 +733,8 @@ async function readDeclaredDependencyNames(cwd) {
   return [...names];
 }
 function missingDependencies(declared, packages) {
-  const present = new Set(packages.map((entry) => entry.name));
-  return declared.filter((name) => !present.has(name));
+  const present2 = new Set(packages.map((entry) => entry.name));
+  return declared.filter((name) => !present2.has(name));
 }
 function disagreements(packages, other) {
   const otherVersions = /* @__PURE__ */ new Map();
@@ -3685,6 +3809,18 @@ var RULE_PROPERTY_SHAPES = Object.freeze({
 });
 var ENFORCEMENT_VALUES = Object.freeze(["dry-run"]);
 var WHEN_KEYS = Object.freeze(["path", "method"]);
+var BUILD_SCOPE_PROPERTY = "build_scope";
+var BUILD_SCOPE = Object.freeze({
+  applies_to: Object.freeze(["firewall"]),
+  usable: Object.freeze({
+    type: "string",
+    trim: true,
+    pattern: "^[0-9a-fA-F]{64}$",
+    canonical: "lowercase"
+  }),
+  unreadable: "the rule remains accepted and detects only by default",
+  local_override: "trustLocalRuleScope may explicitly enforce a caller-supplied rule"
+});
 var RULE_PROPERTIES = Object.freeze([
   "id",
   "rule_id",
@@ -3704,12 +3840,13 @@ var RULE_PROPERTIES = Object.freeze([
   "remove_headers",
   "cookie_flags",
   "ensure",
-  "capture"
+  "capture",
+  BUILD_SCOPE_PROPERTY
 ]);
 var CAPTURE_VERSION = 1;
 var CAPTURE_KEYS = Object.freeze(["version", "raw_chars"]);
 var CAPTURE_RAW_CHARS_MAX = 512;
-var NULL_EXEMPT_PROPERTIES = Object.freeze(["capture"]);
+var NULL_EXEMPT_PROPERTIES = Object.freeze(["capture", BUILD_SCOPE_PROPERTY]);
 function captureProblem(capture) {
   if (capture === void 0 || capture === null) return null;
   if (typeof capture !== "object" || Array.isArray(capture)) return "capture must be an object";
@@ -3950,6 +4087,10 @@ function validateBundle(bundle, opts = {}) {
       rejected.push({ id: idOf(wl), reason: "whitelist has no rule_id (would suppress every rule); set allowGlobalWhitelists to permit" });
       continue;
     }
+    if (wl && typeof wl === "object" && BUILD_SCOPE_PROPERTY in wl) {
+      rejected.push({ id: idOf(wl), reason: `whitelist may not carry ${BUILD_SCOPE_PROPERTY}` });
+      continue;
+    }
     const reason = conditionsProblem(wl?.rule_v2);
     if (reason) rejected.push({ id: idOf(wl), reason: `whitelist: ${reason}` });
     else whitelists.push(wl);
@@ -4220,8 +4361,11 @@ function asText(value) {
 
 // src/protect/engine/pulse-client.js
 init_pulse_token();
+init_build_id();
 var DEFAULT_BASE_URL2 = "https://api.patchstack.com/monitor/pulse";
 var DEFAULT_CACHE_TTL2 = 3e5;
+var BUILD_VERDICT_HEADER = "X-Patchstack-Build-Match";
+var BUILD_IDENTITY_HEADER = "X-Patchstack-Build-ID";
 var JITTER_FRACTION2 = 0.1;
 var PulseRuleClient = class {
   #siteUuid;
@@ -4234,7 +4378,8 @@ var PulseRuleClient = class {
   #etag;
   #pulseAuth;
   #detectionState;
-  constructor({ siteUuid, baseUrl, cacheTtl, etag, timeoutMs, pulseAuth, detectionState } = {}) {
+  #buildId;
+  constructor({ siteUuid, baseUrl, cacheTtl, etag, timeoutMs, pulseAuth, detectionState, buildId } = {}) {
     this.#timeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 3e4;
     this.#siteUuid = siteUuid ?? process.env.PATCHSTACK_SITE_UUID;
     this.#baseUrl = safeBaseUrl(baseUrl ?? process.env.PATCHSTACK_PULSE_RULES_URL, DEFAULT_BASE_URL2, "rule endpoint");
@@ -4242,6 +4387,7 @@ var PulseRuleClient = class {
     this.#etag = etag ?? null;
     this.#pulseAuth = pulseAuth ?? null;
     this.#detectionState = typeof detectionState === "string" ? detectionState : null;
+    this.#buildId = canonicalBuildId(buildId);
     if (!this.#siteUuid) {
       throw new Error("Patchstack site UUID is required. Pass { siteUuid } or set PATCHSTACK_SITE_UUID.");
     }
@@ -4261,11 +4407,23 @@ var PulseRuleClient = class {
       if (this.#detectionState !== null && typeof auth.Authorization === "string") {
         headers["X-Patchstack-Detections"] = this.#detectionState;
       }
+      if (this.#buildId !== null && typeof auth.Authorization === "string") {
+        headers["X-Patchstack-Build"] = this.#buildId;
+      }
       if (this.#etag) headers["If-None-Match"] = this.#etag;
       const response = await fetch(url, { method: "GET", headers, signal: AbortSignal.timeout(this.#timeoutMs) });
       if (response.status === 304) {
         this.#touch(now);
-        return this.#cache ?? { success: true, notModified: true, etag: this.#etag, firewall: [], whitelists: [], whitelist_keys: {} };
+        const result2 = {
+          ...this.#cache ?? { firewall: [], whitelists: [], whitelist_keys: {} },
+          success: true,
+          notModified: true,
+          etag: response.headers?.get?.("etag") ?? this.#etag,
+          build: buildVerdictOf(response.headers)
+        };
+        this.#cache = result2;
+        this.#etag = result2.etag;
+        return result2;
       }
       if (!response.ok) {
         return { success: false, error: `API returned ${response.status}`, firewall: [], whitelists: [], whitelist_keys: {} };
@@ -4281,7 +4439,10 @@ var PulseRuleClient = class {
         firewall: data.firewall,
         whitelists: Array.isArray(data.whitelists) ? data.whitelists : [],
         whitelist_keys: data.whitelist_keys ?? {},
-        ...enforcementField(data)
+        ...enforcementField(data),
+        // Carried through so the caller can decide what a build-scoped rule may do. Response metadata,
+        // rather than bundle content, because it varies with the build asking and is also present on 304.
+        build: buildVerdictOf(response.headers)
       };
       this.#cache = result;
       this.#etag = result.etag;
@@ -4307,6 +4468,13 @@ var PulseRuleClient = class {
     this.#etag = null;
   }
 };
+function buildVerdictOf(headers) {
+  const get = headers !== null && typeof headers === "object" && typeof headers.get === "function" ? (name) => headers.get(name) : () => null;
+  const stated2 = get(BUILD_VERDICT_HEADER);
+  const verdict = stated2 === "match" || stated2 === "missing" || stated2 === "mismatch" ? stated2 : "unknown";
+  const matched = get(BUILD_IDENTITY_HEADER);
+  return { verdict, matchedBuildId: typeof matched === "string" ? matched : null };
+}
 function enforcementField(data) {
   if (!data || typeof data !== "object") return {};
   const v = data.enforcement ?? data.mode;
@@ -5069,6 +5237,7 @@ function renderBlockPage({ url = "", code = "patchstack" } = {}) {
 }
 
 // src/protect/rules/store.js
+init_build_id();
 var fsMod;
 async function loadFs() {
   if (fsMod !== void 0) return fsMod;
@@ -5149,15 +5318,25 @@ async function cacheRead(dir) {
 function toEnvelope(value) {
   if (!value || typeof value !== "object") return null;
   if (value.bundle && typeof value.bundle === "object") {
-    return { bundle: value.bundle, etag: value.etag ?? null };
+    const buildId = canonicalBuildId(value.buildId);
+    const matched = canonicalBuildId(value.matchedBuildId);
+    return {
+      bundle: value.bundle,
+      etag: value.etag ?? null,
+      buildId,
+      // A confirmation belongs to the presentation stored beside it. A crossed or partially written
+      // envelope confirms nothing, even when one of its fields happens to name the current map.
+      matchedBuildId: buildId !== null && matched === buildId ? matched : null
+    };
   }
   if (Array.isArray(value.firewall) || Array.isArray(value.whitelists)) {
-    return { bundle: value, etag: null };
+    return { bundle: value, etag: null, buildId: null, matchedBuildId: null };
   }
   return null;
 }
 
 // src/protect/rules/source.js
+init_build_id();
 function liveUpdateRejections(res, options) {
   if (options.acceptPartialBundle) return [];
   const { rejected } = validateBundle(
@@ -5184,62 +5363,146 @@ function fromSource(bundle, origin, reason) {
     source: reason === void 0 ? { ok: true, origin } : { ok: false, origin, reason }
   };
 }
+function buildIdentity(options) {
+  if (options.buildId !== void 0 && options.buildId !== null) {
+    const explicit = canonicalBuildId(options.buildId);
+    return explicit === null ? { id: null, reason: "the buildId option is not a complete 64-hex SHA-256 identity" } : { id: explicit };
+  }
+  const stamped = readBuildStamp(options.rules);
+  if (stamped !== null) return { id: stamped };
+  return {
+    id: null,
+    reason: options.rules ? "the guard rules file carries no build identity \u2014 the build did not stamp one" : "this guard was configured without bundled rules, so it carries no build identity"
+  };
+}
+function withScopedDryRun(bundle, confirmed, reason, options = {}) {
+  let held = 0;
+  let unusable = 0;
+  const firewall = bundle.firewall.map((rule) => {
+    if (rule === null || typeof rule !== "object") return rule;
+    if (!(BUILD_SCOPE_PROPERTY in rule)) return rule;
+    const scope = rule[BUILD_SCOPE_PROPERTY];
+    const target = canonicalBuildId(scope);
+    if (target !== null && confirmed !== null && target === confirmed) return rule;
+    if (rule.enforcement === "dry-run") return rule;
+    held += 1;
+    if (target === null) unusable += 1;
+    return { ...rule, enforcement: "dry-run" };
+  });
+  if (held === 0) return bundle;
+  const explanations = [
+    ...unusable > 0 ? [`${unusable} rule(s) carry an unusable ${BUILD_SCOPE_PROPERTY}`] : [],
+    ...held > unusable ? [reason] : []
+  ];
+  notify(
+    options.onError,
+    new Error(`${held} build-scoped rule(s) are detecting only, not blocking: ${explanations.join("; ")}`),
+    "onError"
+  );
+  return { ...bundle, firewall };
+}
+function confirmedBy(res, presented) {
+  if (presented === null) return null;
+  const verdict = res?.build;
+  if (verdict?.verdict !== "match") return null;
+  return canonicalBuildId(verdict.matchedBuildId) === presented ? presented : null;
+}
 async function resolveRules(options, store, ctx = {}) {
   const timeoutMs = ctx.timeoutMs;
   if (options.siteUuid) {
     const prior = await store.read();
-    const client = new PulseRuleClient({ siteUuid: options.siteUuid, baseUrl: options.pulseRulesUrl, etag: prior?.etag, timeoutMs, pulseAuth: ctx.pulseAuth, detectionState: ctx.detectionState });
+    const identity = buildIdentity(options);
+    const sameBuild = prior?.buildId === identity.id;
+    const cacheConfirmed = identity.id !== null && sameBuild && prior?.matchedBuildId === identity.id ? identity.id : null;
+    const unconfirmed = identity.reason ?? "the platform did not confirm that these coordinates belong to this map";
+    const served = (bundle, confirmed) => withScopedDryRun(bundle, confirmed, unconfirmed, options);
+    const local = (bundle) => options.trustLocalRuleScope === true ? bundle : withScopedDryRun(bundle, identity.id, identity.reason ?? "these rules name a different map", options);
+    const client = new PulseRuleClient({
+      siteUuid: options.siteUuid,
+      baseUrl: options.pulseRulesUrl,
+      etag: sameBuild ? prior?.etag : null,
+      timeoutMs,
+      pulseAuth: ctx.pulseAuth,
+      detectionState: ctx.detectionState,
+      buildId: identity.id
+    });
     const res = await client.getRules();
-    if (res.success && res.notModified && prior?.bundle) return fromSource(normalizeBundle(prior.bundle, options), "cache");
+    if (res.success && res.notModified && prior?.bundle) {
+      const confirmed = confirmedBy(res, identity.id);
+      await store.write({
+        bundle: prior.bundle,
+        etag: res.etag ?? prior.etag ?? null,
+        buildId: identity.id,
+        matchedBuildId: confirmed
+      });
+      return fromSource(served(normalizeBundle(prior.bundle, options), confirmed), "cache");
+    }
     if (res.success && !res.notModified) {
+      const confirmed = confirmedBy(res, identity.id);
       const rejected = liveUpdateRejections(res, options);
       if (rejected.length > 0) {
         reportRejections(rejected, options, "rule update rejected");
-        if (prior?.bundle) return fromSource(normalizeBundle(prior.bundle, options), "cache", "update rejected");
-        if (options.rules) return fromSource(normalizeBundle(options.rules, options), "bundled", "update rejected");
+        if (prior?.bundle) return fromSource(served(normalizeBundle(prior.bundle, options), cacheConfirmed), "cache", "update rejected");
+        if (options.rules) return fromSource(local(normalizeBundle(options.rules, options)), "bundled", "update rejected");
         return fromSource(emptyBundle(), "empty", "update rejected");
       }
       const bundle = normalizeBundle(res, options);
-      await store.write({ bundle, etag: res.etag ?? null });
-      return fromSource(bundle, "api");
+      await store.write({ bundle, etag: res.etag ?? null, buildId: identity.id, matchedBuildId: confirmed });
+      return fromSource(served(bundle, confirmed), "api");
     }
     if (prior?.bundle) {
       notify(options.onError, new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`), "onError");
-      return fromSource(normalizeBundle(prior.bundle, options), "cache", res.error ?? "no usable response");
+      return fromSource(served(normalizeBundle(prior.bundle, options), cacheConfirmed), "cache", res.error ?? "no usable response");
     }
     if (options.rules) {
       notify(options.onError, new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); using bundled fallback`), "onError");
-      return fromSource(normalizeBundle(options.rules, options), "bundled", res.error ?? "no usable response");
+      return fromSource(local(normalizeBundle(options.rules, options)), "bundled", res.error ?? "no usable response");
     }
     notify(options.onError, new Error(`pulse rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`), "onError");
     return fromSource(emptyBundle(), "empty", res.error ?? "no usable response");
   }
   if (options.token) {
+    const identity = buildIdentity(options);
+    const remote = (bundle) => withScopedDryRun(
+      bundle,
+      null,
+      "the token-authenticated rules service did not corroborate this map",
+      options
+    );
+    const local = (bundle) => options.trustLocalRuleScope === true ? bundle : withScopedDryRun(bundle, identity.id, identity.reason ?? "these rules name a different map", options);
     const prior = await store.read();
     const client = new PatchstackRuleClient({ token: options.token, baseUrl: options.baseUrl, etag: prior?.etag, timeoutMs });
     const res = await client.getRules();
-    if (res.success && res.notModified && prior?.bundle) return fromSource(normalizeBundle(prior.bundle, options), "cache");
+    if (res.success && res.notModified && prior?.bundle) {
+      return fromSource(remote(normalizeBundle(prior.bundle, options)), "cache");
+    }
     if (res.success && !res.notModified) {
       const rejected = liveUpdateRejections(res, options);
       if (rejected.length > 0) {
         reportRejections(rejected, options, "rule update rejected");
-        if (prior?.bundle) return fromSource(normalizeBundle(prior.bundle, options), "cache", "update rejected");
-        if (options.rules) return fromSource(normalizeBundle(options.rules, options), "bundled", "update rejected");
+        if (prior?.bundle) return fromSource(remote(normalizeBundle(prior.bundle, options)), "cache", "update rejected");
+        if (options.rules) return fromSource(local(normalizeBundle(options.rules, options)), "bundled", "update rejected");
         return fromSource(emptyBundle(), "empty", "update rejected");
       }
       const bundle = normalizeBundle(res, options);
       await store.write({ bundle, etag: res.etag ?? null });
-      return fromSource(bundle, "api");
+      return fromSource(remote(bundle), "api");
     }
     if (prior?.bundle) {
       notify(options.onError, new Error(`rule fetch failed (${res.error ?? "no usable response"}); using cached bundle`), "onError");
-      return fromSource(normalizeBundle(prior.bundle, options), "cache", res.error ?? "no usable response");
+      return fromSource(remote(normalizeBundle(prior.bundle, options)), "cache", res.error ?? "no usable response");
     }
     notify(options.onError, new Error(`rule fetch failed (${res.error ?? "no usable response"}); no cache \u2014 running with no rules`), "onError");
     return fromSource(emptyBundle(), "empty", res.error ?? "no usable response");
   }
   if (options.rules) {
-    return fromSource(normalizeBundle(options.rules, options), "bundled");
+    const identity = buildIdentity(options);
+    const bundle = normalizeBundle(options.rules, options);
+    if (options.trustLocalRuleScope === true) return fromSource(bundle, "bundled");
+    return fromSource(
+      withScopedDryRun(bundle, identity.id, identity.reason ?? "these rules name a different map", options),
+      "bundled"
+    );
   }
   return fromSource(emptyBundle(), "empty");
 }
@@ -6824,8 +7087,8 @@ async function createProtection(options = {}) {
       hardened = true;
       try {
         if (res.headersSent || typeof res.setHeader !== "function") return null;
-        const set = typeof res.getHeaders === "function" ? res.getHeaders() : {};
-        const headers = effective && effective.headers ? { ...set, ...effective.headers } : set;
+        const set2 = typeof res.getHeaders === "function" ? res.getHeaders() : {};
+        const headers = effective && effective.headers ? { ...set2, ...effective.headers } : set2;
         const status = effective && effective.status !== void 0 ? effective.status : res.statusCode;
         const r = screenText("", { status, headers }, reqCtx, hardensWithoutBody);
         answeredWithoutBody = true;
@@ -7537,8 +7800,8 @@ function applyHeaderMutation(headers, rule) {
     const ensure = rule.ensure === true;
     for (const [name, value] of Object.entries(rule.set_headers ?? {})) {
       const key = String(name).toLowerCase();
-      const present = headers[key] != null && headers[key] !== "";
-      if (ensure && present) continue;
+      const present2 = headers[key] != null && headers[key] !== "";
+      if (ensure && present2) continue;
       headers[key] = String(value);
     }
     return;