@patchstack/connect 0.5.23 → 0.5.25

package/dist/cli.js

@@ -3,7 +3,7 @@
 // src/cli.ts
 import { readFileSync as readFileSync19 } from "fs";
 import path16 from "path";
-import { createRequire as createRequire2 } from "module";
+import { createRequire as createRequire3 } from "module";
 
 // src/safe-file.ts
 import {
@@ -3179,7 +3179,7 @@ function ensureSourceMarker(cwd, shell, framework, checksum = null) {
 }
 
 // src/guide.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync5 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync11, readdirSync as readdirSync6, statSync as statSync5 } from "fs";
 import path12 from "path";
 
 // src/architecture.ts
@@ -3815,8 +3815,8 @@ function staticSignals(cwd, ts) {
     signals.push({ signal: "static-generator", source: "astro (no SSR adapter)" });
   }
   if (deps["next"] !== void 0) {
-    const exported = nextExportsStatically(cwd, manifest, ts);
-    if (exported !== null) signals.push({ signal: "static-generator", source: `next: ${exported}` });
+    const exported2 = nextExportsStatically(cwd, manifest, ts);
+    if (exported2 !== null) signals.push({ signal: "static-generator", source: `next: ${exported2}` });
   }
   return signals;
 }
@@ -3937,12 +3937,12 @@ function serverEntries(cwd, manifest) {
     if (!main2.startsWith("..")) candidates.add(main2);
   }
   const found = [];
-  for (const relative8 of candidates) {
-    const file = path10.join(cwd, relative8);
+  for (const relative9 of candidates) {
+    const file = path10.join(cwd, relative9);
     try {
       if (!existsSync2(file) || !statSync4(file).isFile()) continue;
       const text = readFileSync6(file, "utf8").slice(0, MAX_ENTRY_BYTES);
-      if (SERVING_CALL.test(text)) found.push(relative8);
+      if (SERVING_CALL.test(text)) found.push(relative9);
     } catch {
     }
   }
@@ -4272,90 +4272,459 @@ var tanstackSupabaseAdapter = {
 };
 
 // src/protect/install/adapters/next.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync5, lstatSync as lstatSync2, readdirSync as readdirSync3 } from "fs";
+import { dirname as dirname3, join as join8, relative as relative3 } from "path";
+
+// src/protect/install/adapters/next-source.ts
+import { createRequire } from "module";
 import { join as join7 } from "path";
+var NEXT_MARKER = "// #region patchstack-next-composed";
+var ROUTE_MARKER = "// #region patchstack-next-route";
+var METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+function nextCompiler(cwd) {
+  for (const base of [join7(cwd, "package.json"), import.meta.url]) {
+    try {
+      return createRequire(base)("typescript");
+    } catch {
+    }
+  }
+  return null;
+}
+function parse(ts, file, source) {
+  const sf = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true);
+  return sf.parseDiagnostics.length ? null : sf;
+}
+function exported(ts, node) {
+  return ts.canHaveModifiers(node) && !!ts.getModifiers(node)?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+}
+function apply(source, edits) {
+  for (const edit of edits.sort((a, b) => b.start - a.start)) {
+    source = source.slice(0, edit.start) + edit.text + source.slice(edit.end);
+  }
+  return source;
+}
+function handlers(ts, sf, names) {
+  const out = [];
+  for (const s of sf.statements) {
+    if (!exported(ts, s)) continue;
+    if (ts.isFunctionDeclaration(s) && s.name && names.has(s.name.text)) out.push(s);
+    if (ts.isVariableStatement(s)) {
+      for (const d of s.declarationList.declarations) {
+        if (ts.isIdentifier(d.name) && names.has(d.name.text) && d.initializer && (ts.isArrowFunction(d.initializer) || ts.isFunctionExpression(d.initializer))) out.push(d.initializer);
+      }
+    }
+  }
+  return out;
+}
+function methodExportCount(ts, sf) {
+  return sf.statements.filter((s) => exported(ts, s)).flatMap((s) => {
+    if (ts.isFunctionDeclaration(s)) return s.name ? [s.name.text] : [];
+    if (ts.isVariableStatement(s)) return s.declarationList.declarations.map((d) => d.name.getText(sf));
+    return [];
+  }).filter((n) => METHODS.has(n)).length;
+}
+function standardNextRouting(ts, file, source) {
+  const sf = parse(ts, file, source);
+  if (!sf) return false;
+  const objects = /* @__PURE__ */ new Map();
+  let target;
+  for (const s of sf.statements) {
+    if (ts.isImportDeclaration(s) && s.importClause?.isTypeOnly) continue;
+    if (ts.isVariableStatement(s) && s.declarationList.flags & ts.NodeFlags.Const) {
+      for (const d of s.declarationList.declarations) {
+        if (!ts.isIdentifier(d.name) || !d.initializer) return false;
+        objects.set(d.name.text, d.initializer);
+      }
+    } else if (ts.isExportAssignment(s) && !s.isExportEquals && !target) target = s.expression;
+    else return false;
+  }
+  const unwrap = (expr) => {
+    while (ts.isAsExpression(expr) || ts.isSatisfiesExpression(expr) || ts.isParenthesizedExpression(expr)) expr = expr.expression;
+    return expr;
+  };
+  if (!target) return false;
+  target = unwrap(target);
+  if (ts.isIdentifier(target)) target = objects.get(target.text);
+  if (!target) return false;
+  target = unwrap(target);
+  if (!ts.isObjectLiteralExpression(target)) return false;
+  const literal = (node) => {
+    const expr = unwrap(node);
+    if (ts.isStringLiteral(expr) || ts.isNumericLiteral(expr) || [ts.SyntaxKind.TrueKeyword, ts.SyntaxKind.FalseKeyword, ts.SyntaxKind.NullKeyword].includes(expr.kind)) return true;
+    if (ts.isArrayLiteralExpression(expr)) return expr.elements.every(literal);
+    if (ts.isObjectLiteralExpression(expr)) return expr.properties.every((p) => ts.isPropertyAssignment(p) && (ts.isIdentifier(p.name) || ts.isStringLiteral(p.name)) && literal(p.initializer));
+    return false;
+  };
+  if (!literal(target) || ![...objects.values()].every(literal)) return false;
+  return target.properties.every((p) => p.name && !["basePath", "i18n", "skipMiddlewareUrlNormalize", "pageExtensions", "__proto__"].includes(
+    ts.isIdentifier(p.name) || ts.isStringLiteral(p.name) ? p.name.text : ""
+  ));
+}
+function matcherRegex(value) {
+  if (value === "/:path*") return "^/";
+  if (!/^\/[\w-]+(?:\/[\w-]+)*(?:\/:\w+\*)?$/.test(value)) return null;
+  const catchAll = /\/:\w+\*$/.test(value);
+  const prefix = value.replace(/\/:\w+\*$/, "");
+  return `^(?:/_next/data/[^/]+)?${prefix}${catchAll ? "(?:/.*)?" : ""}(?:\\.json)?/?$`;
+}
+function middlewareScope(ts, sf) {
+  const configs = sf.statements.filter((s) => ts.isVariableStatement(s) && exported(ts, s)).flatMap((s) => [...s.declarationList.declarations]).filter((d) => ts.isIdentifier(d.name) && d.name.text === "config");
+  if (!configs.length) {
+    if (sf.statements.some((s) => ts.isExportDeclaration(s))) return null;
+    return { tests: [], edits: [] };
+  }
+  const config = configs[0]?.initializer;
+  if (configs.length !== 1 || !config || !ts.isObjectLiteralExpression(config)) return null;
+  if (config.properties.some((p) => !ts.isPropertyAssignment(p) || !ts.isIdentifier(p.name))) return null;
+  const matcher = config.properties.find((p) => p.name?.getText(sf) === "matcher");
+  if (!matcher) return { tests: [], edits: [] };
+  const values = ts.isArrayLiteralExpression(matcher.initializer) ? [...matcher.initializer.elements] : [matcher.initializer];
+  if (!values.length || !values.every((v) => ts.isStringLiteral(v))) return null;
+  const tests = values.map((v) => matcherRegex(v.text));
+  if (tests.some((v) => v === null)) return null;
+  return {
+    tests,
+    edits: [{ start: matcher.initializer.getStart(sf), end: matcher.initializer.end, text: '"/:path*"' }]
+  };
+}
+function requestName(ts, fn) {
+  const param = fn.parameters[0];
+  if (!param) return "psRequest";
+  if (!ts.isIdentifier(param.name) || param.dotDotDotToken || param.initializer || param.questionToken) return null;
+  return param.name.text;
+}
+function requestParameter(fn, file) {
+  return fn.parameters.length ? [] : [{
+    start: fn.parameters.pos,
+    end: fn.parameters.pos,
+    text: file.endsWith(".ts") ? "psRequest: Request" : "psRequest"
+  }];
+}
+function importPosition(ts, sf) {
+  let position = 0;
+  for (const statement of sf.statements) {
+    if (!ts.isExpressionStatement(statement) || !ts.isStringLiteral(statement.expression)) break;
+    position = statement.end;
+  }
+  return position;
+}
+function prelude(request, marker) {
+  return `
+  ${marker}
+  const psProtection = await getPatchstackProtection();
+  const psBlocked = psProtection && await psProtection.fetchGuard()(${request});
+  if (psBlocked) return psBlocked;
+  // #endregion
+`;
+}
+function composeNextMiddleware(ts, file, source, guardImport) {
+  const sf = parse(ts, file, source);
+  if (!sf || /\b(?:psProtection|psBlocked|psRequest|getPatchstackProtection)\b/.test(source)) return null;
+  const found = handlers(ts, sf, /* @__PURE__ */ new Set(["middleware"]));
+  if (found.length !== 1 || sf.statements.some((s) => ts.isExportAssignment(s) || ts.isExportDeclaration(s))) return null;
+  const fn = found[0];
+  const request = requestName(ts, fn);
+  const scope = middlewareScope(ts, sf);
+  if (!request || !scope || !fn.body || !ts.isBlock(fn.body) || fn.asteriskToken || fn.type) return null;
+  const edits = [...scope.edits, ...requestParameter(fn, file)];
+  const isAsync = fn.modifiers?.some((m) => m.kind === ts.SyntaxKind.AsyncKeyword);
+  if (!isAsync) {
+    const start = ts.isFunctionDeclaration(fn) ? fn.getChildren(sf).find((n) => n.kind === ts.SyntaxKind.FunctionKeyword).getStart(sf) : fn.getStart(sf);
+    edits.push({ start, end: start, text: "async " });
+  }
+  const scopeCheck = scope.tests.length ? `  if (!${JSON.stringify(scope.tests)}.some(pattern => new RegExp(pattern).test(new URL(${request}.url).pathname))) return;
+` : "";
+  edits.push({ start: fn.body.getStart(sf) + 1, end: fn.body.getStart(sf) + 1, text: prelude(request, NEXT_MARKER) + scopeCheck });
+  const position = importPosition(ts, sf);
+  edits.push({ start: position, end: position, text: `
+import { getPatchstackProtection } from ${JSON.stringify(guardImport)};
+` });
+  return apply(source, edits);
+}
+function composeNextRoute(ts, file, source, guardImport) {
+  const sf = parse(ts, file, source);
+  if (!sf || /\b(?:psProtection|psBlocked|psRequest|getPatchstackProtection|screenPatchstackResponse)\b/.test(source)) return null;
+  const found = handlers(ts, sf, METHODS);
+  if (!found.length || sf.statements.some((s) => ts.isExportDeclaration(s) || ts.isExportAssignment(s))) return null;
+  if (methodExportCount(ts, sf) !== found.length) return null;
+  const edits = [];
+  for (const fn of found) {
+    const request = requestName(ts, fn);
+    if (!request || !fn.body || !ts.isBlock(fn.body) || fn.asteriskToken || fn.type || !fn.modifiers?.some((m) => m.kind === ts.SyntaxKind.AsyncKeyword)) return null;
+    const returns = [];
+    const visit = (node) => {
+      if (ts.isFunctionLike(node)) return;
+      if (ts.isReturnStatement(node)) returns.push(node);
+      ts.forEachChild(node, visit);
+    };
+    visit(fn.body);
+    if (!returns.length || returns.some((r) => !r.expression)) return null;
+    for (const r of returns) {
+      const expr = r.expression;
+      edits.push({
+        start: expr.getStart(sf),
+        end: expr.end,
+        text: `screenPatchstackResponse((${expr.getText(sf)}), ${request}, psProtection)`
+      });
+    }
+    edits.push(...requestParameter(fn, file));
+    edits.push({ start: fn.body.getStart(sf) + 1, end: fn.body.getStart(sf) + 1, text: prelude(request, ROUTE_MARKER) });
+  }
+  const position = importPosition(ts, sf);
+  edits.push({ start: position, end: position, text: `
+import { getPatchstackProtection, screenPatchstackResponse } from ${JSON.stringify(guardImport)};
+` });
+  return apply(source, edits);
+}
+function nextSourceWired(ts, file, source, guardImport, route = false) {
+  const sf = parse(ts, file, source);
+  if (!sf) return false;
+  const imported = sf.statements.some((s) => ts.isImportDeclaration(s) && ts.isStringLiteral(s.moduleSpecifier) && s.moduleSpecifier.text === guardImport && s.importClause?.namedBindings && ts.isNamedImports(s.importClause.namedBindings) && s.importClause.namedBindings.elements.some((e) => !e.propertyName && e.name.text === "getPatchstackProtection"));
+  if (!imported) return false;
+  if (route && !sf.statements.some((s) => ts.isImportDeclaration(s) && ts.isStringLiteral(s.moduleSpecifier) && s.moduleSpecifier.text === guardImport && s.importClause?.namedBindings && ts.isNamedImports(s.importClause.namedBindings) && s.importClause.namedBindings.elements.some((e) => !e.propertyName && e.name.text === "screenPatchstackResponse"))) return false;
+  const found = handlers(ts, sf, route ? METHODS : /* @__PURE__ */ new Set(["middleware"]));
+  if (!found.length || sf.statements.some((s) => ts.isExportDeclaration(s) || ts.isExportAssignment(s))) return false;
+  if (route && methodExportCount(ts, sf) !== found.length) return false;
+  const compact = (text) => text.replace(/\s+/g, "");
+  for (const fn of found) {
+    const request = requestName(ts, fn);
+    if (!request || !fn.body || !ts.isBlock(fn.body)) return false;
+    const head = fn.body.statements.slice(0, 3).map((s) => s.getText(sf)).join("");
+    const expected = `const psProtection = await getPatchstackProtection();
+      const psBlocked = psProtection && await psProtection.fetchGuard()(${request});
+      if (psBlocked) return psBlocked;`;
+    if (compact(head) !== compact(expected)) return false;
+    if (route) {
+      let covered = true;
+      const visit = (node) => {
+        if (ts.isFunctionLike(node)) return;
+        if (ts.isReturnStatement(node) && node.expression?.getText(sf) !== "psBlocked") {
+          const expr = node.expression;
+          if (!expr || !ts.isCallExpression(expr) || expr.expression.getText(sf) !== "screenPatchstackResponse" || expr.arguments[1]?.getText(sf) !== request || expr.arguments[2]?.getText(sf) !== "psProtection") covered = false;
+        }
+        ts.forEachChild(node, visit);
+      };
+      visit(fn.body);
+      if (!covered) return false;
+    }
+  }
+  if (!route) {
+    const scope = middlewareScope(ts, sf);
+    if (!scope || scope.tests.some((test) => test !== "^/")) return false;
+  }
+  return true;
+}
+
+// src/protect/install/adapters/next.ts
 function middlewareInfo(cwd) {
   const candidates = ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"];
-  for (const rel of candidates) {
-    if (existsSync5(join7(cwd, rel))) return { relDir: rel.includes("/") ? "src" : ".", relFile: rel, exists: true };
+  const relFile = candidates.find((rel) => existsSync5(join8(cwd, rel))) ?? (existsSync5(join8(cwd, "src")) ? "src/middleware.ts" : "middleware.ts");
+  return { relFile, relDir: dirname3(relFile), exists: existsSync5(join8(cwd, relFile)) };
+}
+function proxyFiles(cwd) {
+  return ["proxy.ts", "proxy.js", "src/proxy.ts", "src/proxy.js"].filter((file) => existsSync5(join8(cwd, file)));
+}
+function paths(cwd) {
+  const mw = middlewareInfo(cwd);
+  const ext = mw.relFile.endsWith(".js") ? "js" : "ts";
+  return { ...mw, rules: join8(mw.relDir, "patchstack.rules.json"), guard: join8(mw.relDir, `patchstack.next.${ext}`) };
+}
+function importFrom(file, guard) {
+  const rel = relative3(dirname3(file), guard).replace(/\\/g, "/").replace(/\.ts$/, "");
+  return rel.startsWith(".") ? rel : `./${rel}`;
+}
+function routes(cwd) {
+  const files = [];
+  let incomplete = false;
+  let visited = 0;
+  const walk2 = (rel) => {
+    if (++visited > 5e3) {
+      incomplete = true;
+      return;
+    }
+    const full = join8(cwd, rel);
+    if (lstatSync2(full).isSymbolicLink()) {
+      incomplete = true;
+      return;
+    }
+    for (const entry of readdirSync3(full, { withFileTypes: true })) {
+      if (entry.name.startsWith("_") || entry.name.startsWith(".") || entry.name === "node_modules") continue;
+      if (entry.isSymbolicLink()) {
+        incomplete = true;
+        continue;
+      }
+      const child = join8(rel, entry.name);
+      if (entry.isDirectory()) walk2(child);
+      else if (entry.isFile() && /^route\.(?:tsx?|jsx?)$/.test(entry.name)) files.push(child);
+    }
+  };
+  for (const root of ["app", "src/app"]) {
+    if (!existsSync5(join8(cwd, root))) continue;
+    if (root.startsWith("src/") && lstatSync2(join8(cwd, "src")).isSymbolicLink()) {
+      incomplete = true;
+      continue;
+    }
+    try {
+      walk2(root);
+    } catch {
+      incomplete = true;
+    }
   }
-  const useSrc = existsSync5(join7(cwd, "src"));
-  return { relDir: useSrc ? "src" : ".", relFile: useSrc ? "src/middleware.ts" : "middleware.ts", exists: false };
+  return { files: files.sort(), incomplete };
 }
-function detect2(cwd) {
-  return hasDependency(cwd, "next");
+function customRouting(cwd, ts) {
+  return ["js", "mjs", "ts", "cjs"].some((ext) => {
+    const file = join8(cwd, `next.config.${ext}`);
+    return existsSync5(file) && !standardNextRouting(ts, file, read(file));
+  });
 }
-function rulesFile(relDir) {
-  return relDir === "." ? "patchstack.rules.json" : `${relDir}/patchstack.rules.json`;
+function sharedGuardPresent(file) {
+  if (!existsSync5(file)) return false;
+  const source = read(file);
+  return source.includes("export async function getPatchstackProtection") && source.includes("export async function screenPatchstackResponse") && source.includes('import { createProtection } from "@patchstack/connect/protect"');
 }
 function wire2(cwd, opts) {
+  const proxies = proxyFiles(cwd);
+  if (proxies.length) {
+    log(`left ${proxies.join(", ")} untouched: Next.js proxy integration requires manual wiring. Do not add middleware alongside a proxy; protect --check reports this gap.`);
+    return { ok: false, changed: [] };
+  }
   const templates = templatesDir();
-  const mw = middlewareInfo(cwd);
-  const dir = join7(cwd, mw.relDir === "." ? "" : mw.relDir);
-  ensureProjectDirectorySync(cwd, dir);
-  const rulesDst = join7(dir, "patchstack.rules.json");
+  const mw = paths(cwd);
+  ensureProjectDirectorySync(cwd, join8(cwd, mw.relDir));
   const changed = [];
-  if (opts.demo || !existsSync5(rulesDst)) {
-    copyProjectFileSync(cwd, join7(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
-    changed.push(rulesFile(mw.relDir));
-  }
-  const mwPath = join7(cwd, mw.relFile);
-  const existing = mw.exists ? read(mwPath) : "";
-  if (mw.exists && existing.includes("patchstack-next")) {
-    log(`${mw.relFile} already has the Patchstack middleware \u2014 left as-is`);
-    return { ok: true, changed };
+  if (opts.demo || !existsSync5(join8(cwd, mw.rules))) {
+    copyProjectFileSync(cwd, join8(templates, opts.demo ? "demo-rules.json" : "rules.json"), join8(cwd, mw.rules));
+    changed.push(mw.rules);
+  }
+  const ts = nextCompiler(cwd);
+  const guardPath = join8(cwd, mw.guard);
+  const guardConflict = existsSync5(guardPath) && !sharedGuardPresent(guardPath);
+  const ensureGuard = () => {
+    if (existsSync5(guardPath)) return;
+    const source = read(join8(templates, "next-guard.ts"));
+    writeProjectFileSync(cwd, guardPath, mw.guard.endsWith(".js") ? ts.transpileModule(source, { compilerOptions: { target: ts.ScriptTarget.ES2022, module: ts.ModuleKind.ESNext } }).outputText : source);
+    if (!opts.demo) bakeSiteUuid(cwd, mw.guard);
+    changed.push(mw.guard);
+  };
+  const existing = mw.exists ? read(join8(cwd, mw.relFile)) : "";
+  if (!mw.exists) {
+    copyProjectFileSync(cwd, join8(templates, "next-middleware.ts"), join8(cwd, mw.relFile));
+    if (!opts.demo) bakeSiteUuid(cwd, mw.relFile);
+    changed.push(mw.relFile);
+    log(`scaffolded ${mw.relFile} (request-phase guard)`);
+  } else if (existing.includes(NEXT_MARKER) || existing.includes("#region patchstack-next (")) {
+    log(`${mw.relFile} already has a Patchstack guard \u2014 left as-is`);
+    if (ts && existing.includes(NEXT_MARKER)) ensureGuard();
+  } else {
+    const composed = ts && !guardConflict && !customRouting(cwd, ts) && composeNextMiddleware(ts, mw.relFile, existing, importFrom(mw.relFile, mw.guard));
+    if (composed) {
+      ensureGuard();
+      writeProjectFileSync(cwd, join8(cwd, mw.relFile), composed);
+      changed.push(mw.relFile);
+      log(`composed ${mw.relFile}: request guard first; existing middleware keeps its original matcher scope`);
+    } else {
+      log(`left ${mw.relFile} untouched: middleware/export/matcher shape needs manual integration${ts ? "" : " (install typescript to enable source-aware composition)"}. Add a guard before application middleware and preserve its routing scope; protect --check reports this gap.`);
+    }
   }
-  if (mw.exists) {
-    log(
-      `existing ${mw.relFile} left untouched \u2014 scaffolded ${rulesFile(mw.relDir)}; add the guard to your middleware: import { createProtection } from "@patchstack/connect/protect", run fetchGuard() on the request, and return the block Response. Then: npx patchstack-connect protect --check`
-    );
-    return { ok: true, changed };
+  const inventory = routes(cwd);
+  for (const file of inventory.files) {
+    const source = read(join8(cwd, file));
+    if (source.includes(ROUTE_MARKER)) {
+      if (ts) ensureGuard();
+      continue;
+    }
+    const composed = ts && !guardConflict && /\.(?:ts|js)$/.test(file) && composeNextRoute(ts, file, source, importFrom(file, mw.guard));
+    if (composed) {
+      ensureGuard();
+      writeProjectFileSync(cwd, join8(cwd, file), composed);
+      changed.push(file);
+      log(`wired ${file} (request checks + response filtering)`);
+    } else {
+      log(`left ${file} untouched: wrap its request and final Response manually; protect --check reports this response-filtering gap.`);
+    }
   }
-  copyProjectFileSync(cwd, join7(templates, "next-middleware.ts"), mwPath);
-  if (!opts.demo) bakeSiteUuid(cwd, mw.relFile);
-  changed.push(mw.relFile);
-  log(`scaffolded ${mw.relFile} (Patchstack middleware)`);
+  if (guardConflict) log(`${mw.guard} already exists but is not a recognized helper \u2014 left untouched; resolve the filename conflict before integrating handlers.`);
+  if (inventory.incomplete) log("App Router inventory was incomplete \u2014 review skipped paths manually.");
+  log("Next middleware cannot inspect downstream response bodies. Route-handler filtering does not cover rendered pages, Server Actions, or Pages API routes. Keep Next.js patched: a middleware bypass also bypasses a middleware guard.");
   return { ok: true, changed: [...new Set(changed)] };
 }
 function verify2(cwd) {
-  const mw = middlewareInfo(cwd);
-  const present2 = mw.exists && read(join7(cwd, mw.relFile)).includes("patchstack-next");
-  const rulesPresent = existsSync5(join7(cwd, rulesFile(mw.relDir)));
+  const proxies = proxyFiles(cwd);
+  if (proxies.length) return {
+    wired: false,
+    checks: [{
+      label: "Next.js proxy wiring requires manual verification",
+      ok: false,
+      hint: `review ${proxies.join(", ")}; automatic proxy integration is not supported. Next.js cannot use middleware and proxy together.`
+    }]
+  };
+  const mw = paths(cwd);
+  const ts = nextCompiler(cwd);
+  const source = mw.exists ? read(join8(cwd, mw.relFile)) : "";
+  const shared = sharedGuardPresent(join8(cwd, mw.guard));
+  const legacy = source.includes("#region patchstack-next (") && source.includes("await protection.fetchGuard()(request)") && source.includes("if (blocked) return blocked") && source.includes('matcher: "/:path*"');
+  const composed = ts && shared && !customRouting(cwd, ts) && nextSourceWired(ts, mw.relFile, source, importFrom(mw.relFile, mw.guard));
+  const present2 = !!(legacy || composed);
+  const rulesPresent = existsSync5(join8(cwd, mw.rules));
+  const inventory = routes(cwd);
+  const missing = inventory.files.filter((file) => !(ts && shared && nextSourceWired(ts, file, read(join8(cwd, file)), importFrom(file, mw.guard), true)));
   return {
-    wired: present2 && rulesPresent,
+    wired: present2 && rulesPresent && missing.length === 0 && !inventory.incomplete,
     checks: [
-      { label: "Patchstack middleware present", ok: present2, hint: `run \`patchstack-connect protect\` (writes ${mw.relFile})` },
-      { label: "rules co-located with the middleware", ok: rulesPresent, hint: "run `patchstack-connect protect`" }
+      {
+        label: "Next middleware request guard has a catch-all matcher",
+        ok: present2,
+        hint: `run \`patchstack-connect protect\`; review any unsupported middleware shape in ${mw.relFile}`
+      },
+      { label: "fallback rules co-located with the guard", ok: rulesPresent, hint: "run `patchstack-connect protect`" },
+      {
+        label: `App Router request/response wiring: ${inventory.files.length - missing.length}/${inventory.files.length} route files`,
+        ok: missing.length === 0 && !inventory.incomplete,
+        hint: `run protect again after adding routes; manually integrate unsupported handlers: ${missing.join(", ") || "inventory incomplete"}`
+      },
+      {
+        label: "rendered pages, Server Actions and Pages API response filtering are not verified",
+        ok: true,
+        unverifiable: true,
+        hint: "middleware cannot screen the downstream response; use a supported server boundary or add response filtering to those handlers"
+      },
+      {
+        label: "live rule delivery and enforcement are not established by source inspection",
+        ok: true,
+        unverifiable: true,
+        hint: "inspect the running guard\u2019s ruleSource and mode; a request reaching middleware does not prove rules were fetched, accepted, or enforced. Framework middleware bypasses require a patched Next.js or upstream protection."
+      }
     ]
   };
 }
 var nextAdapter = {
   name: "nextjs",
   label: "Next.js",
-  detect: detect2,
+  detect: (cwd) => hasDependency(cwd, "next"),
   wire: wire2,
   verify: verify2
 };
 
 // src/protect/install/seam.ts
 import { existsSync as existsSync6 } from "fs";
-import { join as join8, dirname as dirname3 } from "path";
+import { join as join9, dirname as dirname4 } from "path";
 function rulesRel(seamRel) {
-  const d = dirname3(seamRel);
+  const d = dirname4(seamRel);
   return (d === "." ? "patchstack.rules.json" : `${d}/patchstack.rules.json`).replace(/\\/g, "/");
 }
 function wireSeam(cwd, opts, spec) {
   const templates = templatesDir();
-  const existing = spec.candidates.find((c) => existsSync6(join8(cwd, c)));
+  const existing = spec.candidates.find((c) => existsSync6(join9(cwd, c)));
   const seamRel = existing ?? spec.target;
-  ensureProjectDirectorySync(cwd, dirname3(join8(cwd, seamRel)));
-  const rulesDst = join8(cwd, rulesRel(seamRel));
+  ensureProjectDirectorySync(cwd, dirname4(join9(cwd, seamRel)));
+  const rulesDst = join9(cwd, rulesRel(seamRel));
   const changed = [];
   if (opts.demo || !existsSync6(rulesDst)) {
-    copyProjectFileSync(cwd, join8(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    copyProjectFileSync(cwd, join9(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
     changed.push(rulesRel(seamRel));
   }
-  const current = existing ? read(join8(cwd, existing)) : "";
+  const current = existing ? read(join9(cwd, existing)) : "";
   if (existing && current.includes(spec.marker)) {
     log(`${existing} already has the Patchstack guard \u2014 left as-is`);
     return { ok: true, changed };
@@ -4364,17 +4733,17 @@ function wireSeam(cwd, opts, spec) {
     log(`existing ${existing} left untouched \u2014 scaffolded ${rulesRel(seamRel)}; ${spec.planHint}`);
     return { ok: true, changed };
   }
-  copyProjectFileSync(cwd, join8(templates, spec.templateName), join8(cwd, seamRel));
+  copyProjectFileSync(cwd, join9(templates, spec.templateName), join9(cwd, seamRel));
   if (!opts.demo) bakeSiteUuid(cwd, seamRel);
   changed.push(seamRel);
   log(`scaffolded ${seamRel}`);
   return { ok: true, changed: [...new Set(changed)] };
 }
 function verifySeam(cwd, spec) {
-  const existing = spec.candidates.find((c) => existsSync6(join8(cwd, c)));
+  const existing = spec.candidates.find((c) => existsSync6(join9(cwd, c)));
   const seamRel = existing ?? spec.target;
-  const present2 = existing ? read(join8(cwd, existing)).includes(spec.marker) : false;
-  const rulesPresent = existsSync6(join8(cwd, rulesRel(seamRel)));
+  const present2 = existing ? read(join9(cwd, existing)).includes(spec.marker) : false;
+  const rulesPresent = existsSync6(join9(cwd, rulesRel(seamRel)));
   return {
     wired: present2 && rulesPresent,
     checks: [
@@ -4393,7 +4762,7 @@ var SPEC = {
   planHint: 'add the guard to your `handle` (compose with `sequence()` from "@sveltejs/kit/hooks"), then: npx patchstack-connect protect --check',
   seamLabel: "SvelteKit server hook"
 };
-function detect3(cwd) {
+function detect2(cwd) {
   return hasDependency(cwd, "@sveltejs/kit");
 }
 function wire3(cwd, opts) {
@@ -4405,7 +4774,7 @@ function verify3(cwd) {
 var sveltekitAdapter = {
   name: "sveltekit",
   label: "SvelteKit",
-  detect: detect3,
+  detect: detect2,
   wire: wire3,
   verify: verify3
 };
@@ -4419,7 +4788,7 @@ var SPEC2 = {
   planHint: 'add the guard to your `onRequest` (compose with `sequence()` from "astro:middleware"), then: npx patchstack-connect protect --check',
   seamLabel: "Astro middleware"
 };
-function detect4(cwd) {
+function detect3(cwd) {
   return hasDependency(cwd, "astro");
 }
 function wire4(cwd, opts) {
@@ -4431,7 +4800,7 @@ function verify4(cwd) {
 var astroAdapter = {
   name: "astro",
   label: "Astro",
-  detect: detect4,
+  detect: detect3,
   wire: wire4,
   verify: verify4
 };
@@ -4445,7 +4814,7 @@ var SPEC3 = {
   planHint: "add a `server/middleware/` handler that runs the guard, then: npx patchstack-connect protect --check",
   seamLabel: "Nuxt server middleware"
 };
-function detect5(cwd) {
+function detect4(cwd) {
   return hasDependency(cwd, "nuxt");
 }
 function wire5(cwd, opts) {
@@ -4457,14 +4826,14 @@ function verify5(cwd) {
 var nuxtAdapter = {
   name: "nuxt",
   label: "Nuxt",
-  detect: detect5,
+  detect: detect4,
   wire: wire5,
   verify: verify5
 };
 
 // src/protect/install/find-app.ts
-import { readFileSync as readFileSync8, readdirSync as readdirSync3, lstatSync as lstatSync2 } from "fs";
-import { join as join9, relative as relative3, dirname as dirname4 } from "path";
+import { readFileSync as readFileSync8, readdirSync as readdirSync4, lstatSync as lstatSync3 } from "fs";
+import { join as join10, relative as relative4, dirname as dirname5 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   "node_modules",
   "patchstack",
@@ -4490,16 +4859,16 @@ function findAppInstance(cwd, re) {
     if (depth > MAX_DEPTH) return;
     let entries;
     try {
-      entries = readdirSync3(dir).sort();
+      entries = readdirSync4(dir).sort();
     } catch {
       return;
     }
     for (const name of entries) {
       if (SKIP_DIRS2.has(name) || name.startsWith(".")) continue;
-      const p = join9(dir, name);
+      const p = join10(dir, name);
       let st;
       try {
-        st = lstatSync2(p);
+        st = lstatSync3(p);
       } catch {
         continue;
       }
@@ -4516,7 +4885,7 @@ function findAppInstance(cwd, re) {
         if (!m) continue;
         const appVar = m[1];
         found.push({
-          relPath: relative3(cwd, p).replace(/\\/g, "/"),
+          relPath: relative4(cwd, p).replace(/\\/g, "/"),
           appVar,
           listens: listensOn(src, appVar)
         });
@@ -4552,17 +4921,17 @@ function entryRank(relPath) {
   return index === -1 ? ENTRY_NAMES.length : index;
 }
 function declaredEntries(cwd) {
-  const paths = /* @__PURE__ */ new Set();
+  const paths2 = /* @__PURE__ */ new Set();
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync8(join9(cwd, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync8(join10(cwd, "package.json"), "utf8"));
   } catch {
-    return paths;
+    return paths2;
   }
   const add = (value) => {
     if (typeof value !== "string") return;
     for (const match of value.matchAll(/[\w./@-]+\.(?:ts|js|mjs|cjs)/g)) {
-      paths.add(match[0].replace(/^\.\//, ""));
+      paths2.add(match[0].replace(/^\.\//, ""));
     }
   };
   add(pkg.main);
@@ -4571,10 +4940,10 @@ function declaredEntries(cwd) {
   if (typeof scripts === "object" && scripts !== null) {
     for (const name of ["start", "serve", "dev"]) add(scripts[name]);
   }
-  return paths;
+  return paths2;
 }
 function importSpecifier(fromRel, toRel, preserveExtension = false) {
-  let spec = relative3(dirname4(fromRel), toRel).replace(/\\/g, "/");
+  let spec = relative4(dirname5(fromRel), toRel).replace(/\\/g, "/");
   if (!preserveExtension) spec = spec.replace(/\.(?:ts|js)$/, "");
   if (!spec.startsWith(".")) spec = `./${spec}`;
   return spec;
@@ -4582,16 +4951,16 @@ function importSpecifier(fromRel, toRel, preserveExtension = false) {
 
 // src/protect/install/register.ts
 import { existsSync as existsSync9 } from "fs";
-import { join as join12, resolve as resolve3 } from "path";
+import { join as join13, resolve as resolve3 } from "path";
 
 // src/protect/install/generic.ts
-import { readFileSync as readFileSync9, existsSync as existsSync8, readdirSync as readdirSync4, lstatSync as lstatSync3 } from "fs";
-import { join as join11, dirname as dirname6 } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync8, readdirSync as readdirSync5, lstatSync as lstatSync4 } from "fs";
+import { join as join12, dirname as dirname7 } from "path";
 
 // src/protect/install/source-scope.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync7 } from "fs";
-import { dirname as dirname5, join as join10, resolve as resolve2 } from "path";
+import { dirname as dirname6, join as join11, resolve as resolve2 } from "path";
 
 // src/protect/install/node-flags.ts
 var flagName = (token) => token.split("=")[0];
@@ -4880,9 +5249,9 @@ function moduleKindOf(filePath, packageIsModule) {
   return packageIsModule ? "esm" : "cjs";
 }
 function resolvesToGuardModule(specifier, query) {
-  const resolved = resolve2(dirname5(query.fromFile), specifier);
-  if (withoutModuleExtension(resolved) !== join10(query.guardDir, "guard")) return false;
-  const existing = GUARD_FILENAMES.filter((name) => existsSync7(join10(query.guardDir, name)));
+  const resolved = resolve2(dirname6(query.fromFile), specifier);
+  if (withoutModuleExtension(resolved) !== join11(query.guardDir, "guard")) return false;
+  const existing = GUARD_FILENAMES.filter((name) => existsSync7(join11(query.guardDir, name)));
   if (existing.length === 0) return false;
   const extension = /(\.[A-Za-z0-9]+)$/.exec(specifier)?.[1] ?? "";
   if (!query.strictExtensions) return true;
@@ -4901,16 +5270,16 @@ function withoutModuleExtension(filePath) {
 // src/protect/install/generic.ts
 function packageIsEsm(cwd) {
   try {
-    return JSON.parse(read(join11(cwd, "package.json"))).type === "module";
+    return JSON.parse(read(join12(cwd, "package.json"))).type === "module";
   } catch {
     return false;
   }
 }
 function genericDir(cwd) {
-  return existsSync8(join11(cwd, "src")) ? "src/patchstack" : "patchstack";
+  return existsSync8(join12(cwd, "src")) ? "src/patchstack" : "patchstack";
 }
 function hasTypeScript(cwd) {
-  return existsSync8(join11(cwd, "tsconfig.json")) || candidateEntries(cwd).some((entry) => /\.tsx?$/.test(entry));
+  return existsSync8(join12(cwd, "tsconfig.json")) || candidateEntries(cwd).some((entry) => /\.tsx?$/.test(entry));
 }
 function genericGuardTarget(cwd) {
   if (hasTypeScript(cwd)) {
@@ -4924,7 +5293,7 @@ function genericGuardTarget(cwd) {
 function genericScaffoldFiles(cwd) {
   const dir = genericDir(cwd);
   const candidates = ["guard.ts", "guard.js", "guard.cjs", "rules.json"];
-  return candidates.map((file) => `${dir}/${file}`).filter((relative8) => existsSync8(join11(cwd, relative8)));
+  return candidates.map((file) => `${dir}/${file}`).filter((relative9) => existsSync8(join12(cwd, relative9)));
 }
 function scaffoldGeneric(cwd, opts, guardTemplate, guardFile) {
   const target = genericGuardTarget(cwd);
@@ -4932,15 +5301,15 @@ function scaffoldGeneric(cwd, opts, guardTemplate, guardFile) {
   guardFile ??= target.file;
   const templates = templatesDir();
   const dir = genericDir(cwd);
-  const dst = join11(cwd, dir);
+  const dst = join12(cwd, dir);
   ensureProjectDirectorySync(cwd, dst);
-  copyProjectFileSync(cwd, join11(templates, guardTemplate), join11(dst, guardFile));
+  copyProjectFileSync(cwd, join12(templates, guardTemplate), join12(dst, guardFile));
   const guardRel = `${dir}/${guardFile}`;
   const changed = [guardRel];
   if (!opts.demo) bakeSiteUuid(cwd, guardRel);
-  const rulesDst = join11(dst, "rules.json");
+  const rulesDst = join12(dst, "rules.json");
   if (opts.demo || !existsSync8(rulesDst)) {
-    copyProjectFileSync(cwd, join11(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
+    copyProjectFileSync(cwd, join12(templates, opts.demo ? "demo-rules.json" : "rules.json"), rulesDst);
     changed.push(`${dir}/rules.json`);
   }
   return { changed, dir };
@@ -4961,10 +5330,10 @@ function candidateEntries(cwd) {
     "app.ts",
     "app.js"
   ];
-  const hits = names.filter((n) => existsSync8(join11(cwd, n)));
+  const hits = names.filter((n) => existsSync8(join12(cwd, n)));
   try {
-    const pkg = JSON.parse(read(join11(cwd, "package.json")));
-    if (typeof pkg.main === "string" && existsSync8(join11(cwd, pkg.main))) hits.push(pkg.main);
+    const pkg = JSON.parse(read(join12(cwd, "package.json")));
+    if (typeof pkg.main === "string" && existsSync8(join12(cwd, pkg.main))) hits.push(pkg.main);
   } catch {
   }
   return [...new Set(hits)];
@@ -5038,8 +5407,8 @@ function boundNames(declaration) {
   const braced = /\{([^}]*)\}/.exec(clause)?.[1];
   if (braced !== void 0) {
     for (const part of braced.split(",")) {
-      const [exported, local] = splitBinding(part);
-      if (!isGuardExport(exported)) continue;
+      const [exported2, local] = splitBinding(part);
+      if (!isGuardExport(exported2)) continue;
       if (/^[A-Za-z_$][\w$]*$/.test(local)) direct.push(local);
     }
   }
@@ -5055,8 +5424,8 @@ function splitBinding(part) {
     const name = part.trim();
     return [name, name];
   }
-  const [exported, ...rest] = part.split(separator);
-  return [(exported ?? "").trim(), (rest.join(separator) ?? "").trim()];
+  const [exported2, ...rest] = part.split(separator);
+  return [(exported2 ?? "").trim(), (rest.join(separator) ?? "").trim()];
 }
 function isGuardExport(name) {
   return GUARD_EXPORTS.includes(name);
@@ -5067,9 +5436,9 @@ function escapeForRegExp(value) {
 function genericVerify(cwd) {
   const dir = genericDir(cwd);
   const target = genericGuardTarget(cwd);
-  const present2 = GUARD_FILENAMES.find((name) => existsSync8(join11(cwd, dir, name)));
+  const present2 = GUARD_FILENAMES.find((name) => existsSync8(join12(cwd, dir, name)));
   const scaffolded = present2 !== void 0;
-  const imported = scaffolded && guardIsImported(cwd, join11(cwd, dir, present2));
+  const imported = scaffolded && guardIsImported(cwd, join12(cwd, dir, present2));
   return {
     wired: scaffolded && imported,
     checks: [
@@ -5103,25 +5472,25 @@ var NON_RUNTIME_DIRS = /* @__PURE__ */ new Set([
   "__mocks__"
 ]);
 function guardIsImported(cwd, guardPath) {
-  const guardDir = dirname6(guardPath);
+  const guardDir = dirname7(guardPath);
   const packageIsModule = packageIsEsm(cwd);
-  const root = existsSync8(join11(cwd, "src")) ? join11(cwd, "src") : cwd;
+  const root = existsSync8(join12(cwd, "src")) ? join12(cwd, "src") : cwd;
   let found = false;
   const walk2 = (d, depth) => {
     if (found || depth > 8) return;
     let entries;
     try {
-      entries = readdirSync4(d);
+      entries = readdirSync5(d);
     } catch {
       return;
     }
     for (const name of entries) {
       if (found) return;
       if (NON_RUNTIME_DIRS.has(name) || name.startsWith(".")) continue;
-      const p = join11(d, name);
+      const p = join12(d, name);
       let st;
       try {
-        st = lstatSync3(p);
+        st = lstatSync4(p);
       } catch {
         continue;
       }
@@ -5177,7 +5546,7 @@ function guardTarget(cwd, entryRel, spec) {
 }
 function packageType(cwd) {
   try {
-    return JSON.parse(read(join12(cwd, "package.json"))).type;
+    return JSON.parse(read(join13(cwd, "package.json"))).type;
   } catch {
     return void 0;
   }
@@ -5213,8 +5582,8 @@ function bindsGuard(line, maskedLine, importName, call, fileRel, guard) {
 }
 function namesGuardModule(specifier, fileRel, guard) {
   return resolvesToGuardModule(specifier, {
-    fromFile: join12(guard.cwd, fileRel),
-    guardDir: resolve3(join12(guard.cwd, guard.guardDir)),
+    fromFile: join13(guard.cwd, fileRel),
+    guardDir: resolve3(join13(guard.cwd, guard.guardDir)),
     kind: moduleKindOf(fileRel, packageType(guard.cwd) === "module"),
     strictExtensions: true
   });
@@ -5233,7 +5602,7 @@ function wireRegister(cwd, opts, spec) {
   }
   const target = guardTarget(cwd, entry.relPath, spec);
   const { changed, dir } = scaffoldGeneric(cwd, opts, target.template, target.file);
-  const p = join12(cwd, entry.relPath);
+  const p = join13(cwd, entry.relPath);
   const s = read(p);
   const state = wiringState(s, spec, entry.appVar, entry.relPath, { cwd, guardDir: dir });
   if (state.importAtTopLevel && state.callInAppScope) {
@@ -5303,17 +5672,17 @@ function firstStatementLine(lines) {
   return i;
 }
 function serverIsGuarded(cwd, spec, server, guardDir) {
-  const source = read(join12(cwd, server.relPath));
+  const source = read(join13(cwd, server.relPath));
   const state = wiringState(source, spec, server.appVar, server.relPath, { cwd, guardDir });
   if (!state.importAtTopLevel || !state.callInAppScope || !state.ordered) return false;
   return !spec.callAfter || routesBefore(source, server.appVar, state.callIndex).length === 0;
 }
 function verifyRegister(cwd, spec) {
-  const dir = existsSync9(join12(cwd, "src")) ? "src/patchstack" : "patchstack";
+  const dir = existsSync9(join13(cwd, "src")) ? "src/patchstack" : "patchstack";
   const entry = findAppInstance(cwd, spec.appRe);
   const target = entry ? guardTarget(cwd, entry.relPath, spec) : null;
-  const scaffolded = target ? existsSync9(join12(cwd, dir, target.file)) : false;
-  const entrySource = entry ? read(join12(cwd, entry.relPath)) : "";
+  const scaffolded = target ? existsSync9(join13(cwd, dir, target.file)) : false;
+  const entrySource = entry ? read(join13(cwd, entry.relPath)) : "";
   const state = entry ? wiringState(entrySource, spec, entry.appVar, entry.relPath, { cwd, guardDir: dir }) : { importAtTopLevel: false, callInAppScope: false, ordered: false, callIndex: -1, appIndex: -1 };
   const wired = state.importAtTopLevel && state.callInAppScope && state.ordered;
   const early = spec.callAfter && entry ? routesBefore(entrySource, entry.appVar, state.callIndex) : [];
@@ -5404,7 +5773,7 @@ var expressAdapter = {
 
 // src/protect/install/reporting.ts
 import { existsSync as existsSync10 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 
 // src/protect/reporting-state.js
 var REPORTING_STATES = Object.freeze([
@@ -5462,7 +5831,7 @@ function explainReportingState(state) {
 
 // src/protect/install/reporting.ts
 function siteIdentity(cwd, env) {
-  const rc = join13(cwd, ".patchstackrc.json");
+  const rc = join14(cwd, ".patchstackrc.json");
   let recorded;
   if (existsSync10(rc)) {
     try {
@@ -5559,7 +5928,7 @@ function runProtect(cwd, opts = {}) {
     return { status: "scaffolded", adapter: "generic", changed: [], plan: "" };
   }
 }
-var RUNTIMES_WITHOUT_CONFIG_FILE = /* @__PURE__ */ new Set(["next", "sveltekit", "astro", "nuxt", "generic"]);
+var RUNTIMES_WITHOUT_CONFIG_FILE = /* @__PURE__ */ new Set(["nextjs", "sveltekit", "astro", "nuxt", "generic"]);
 function credentialNote(cwd, adapterName) {
   if (!RUNTIMES_WITHOUT_CONFIG_FILE.has(adapterName)) return [];
   const localHint = hasResolvableCredential(cwd) ? "a credential is configured here; set the same one in your deployment" : "no credential found here either \u2014 run `npx @patchstack/connect scan` to provision one";
@@ -5929,7 +6298,7 @@ function findWidgetMarker(cwd, siteUuid) {
     }
     let entries;
     try {
-      entries = readdirSync5(dir, { withFileTypes: true });
+      entries = readdirSync6(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -5997,7 +6366,7 @@ function findAstroDocumentLayout(cwd) {
   const dir = path12.join("src", "layouts");
   let names;
   try {
-    names = readdirSync5(path12.join(cwd, dir)).filter((name) => name.endsWith(".astro")).sort();
+    names = readdirSync6(path12.join(cwd, dir)).filter((name) => name.endsWith(".astro")).sort();
   } catch {
     return null;
   }
@@ -6543,11 +6912,11 @@ async function claim2(config, onPrompt, deps = {}) {
 }
 
 // src/protect/install/runtime/check.ts
-import { relative as relative4 } from "path";
+import { relative as relative5 } from "path";
 
 // src/protect/install/runtime/entry.ts
 import { existsSync as existsSync13, readFileSync as readFileSync13, realpathSync as realpathSync4, statSync as statSync6 } from "fs";
-import { join as join14, resolve as resolve4, sep as sep2 } from "path";
+import { join as join15, resolve as resolve4, sep as sep2 } from "path";
 var CONVENTIONAL = [
   "server.js",
   "server.mjs",
@@ -6573,7 +6942,7 @@ var CONVENTIONAL = [
 var LOADABLE = /\.(?:js|mjs|cjs)$/;
 function readPackage2(cwd) {
   try {
-    const parsed = JSON.parse(readFileSync13(join14(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync13(join15(cwd, "package.json"), "utf8"));
     return parsed !== null && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -6643,7 +7012,7 @@ function resolveEntry(cwd) {
   }
   return {
     kind: "unavailable",
-    reason: existsSync13(join14(cwd, "package.json")) ? 'no directly loadable entry was found \u2014 declare one as a "start" script of the form `node <file>`, or run the check against a built output' : "there is no package.json here"
+    reason: existsSync13(join15(cwd, "package.json")) ? 'no directly loadable entry was found \u2014 declare one as a "start" script of the form `node <file>`, or run the check against a built output' : "there is no package.json here"
   };
 }
 
@@ -6994,7 +7363,7 @@ async function runRuntimeCheck(cwd, options = {}) {
     settleMs: options.settleMs,
     platform: options.platform
   });
-  return { ...result, entry: { file: relative4(cwd, entry.file).replace(/\\/g, "/"), from: entry.from } };
+  return { ...result, entry: { file: relative5(cwd, entry.file).replace(/\\/g, "/"), from: entry.from } };
 }
 function runtimeExitCode(report) {
   if (report.outcome === "proven") return 0;
@@ -7028,12 +7397,12 @@ function formatRuntimeCheck(report) {
 import path14 from "path";
 
 // src/map/ts-loader.ts
-import { createRequire } from "module";
+import { createRequire as createRequire2 } from "module";
 import { pathToFileURL } from "url";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 async function loadTypeScript(cwd) {
   try {
-    const req = createRequire(pathToFileURL(join15(cwd, "package.json")));
+    const req = createRequire2(pathToFileURL(join16(cwd, "package.json")));
     const resolved = req.resolve("typescript");
     const mod = await import(pathToFileURL(resolved).href);
     return mod.default ?? mod;
@@ -7050,7 +7419,7 @@ async function loadTypeScript(cwd) {
 // src/map/extract.ts
 import { readFileSync as readFileSync16, realpathSync as realpathSync6 } from "fs";
 import { createHash as createHash5 } from "crypto";
-import { relative as relative6 } from "path";
+import { relative as relative7 } from "path";
 
 // src/map/bindings.ts
 import { builtinModules } from "module";
@@ -7407,14 +7776,14 @@ function directSinks(node, ts, bindings, ctx) {
     const root = base ? rootIdentifier(base, ts) : void 0;
     if (!root) return {};
     const spec = bindings.resolve(root);
-    const relative8 = spec !== void 0 && (spec.startsWith(".") || spec.startsWith("/"));
+    const relative9 = spec !== void 0 && (spec.startsWith(".") || spec.startsWith("/"));
     const pkg = npmPackageOf(spec);
     if (pkg) return { pkg, root, spec };
-    if (relative8 && ctx && spec) {
+    if (relative9 && ctx && spec) {
       const viaModule = ctx.graph.importedBinding(ctx.file, spec, bindings.exportNameOf(root) ?? root);
       if (viaModule) return { pkg: viaModule.package, root, spec };
     }
-    return { local: bindings.locals.has(root), root, spec, relative: relative8 };
+    return { local: bindings.locals.has(root), root, spec, relative: relative9 };
   };
   const attributionOf = (b, pkg) => b.pkg ? "import" : pkg ? "inferred" : void 0;
   const dbApi = (pkg, attribution) => {
@@ -8704,7 +9073,7 @@ function withNote(doc) {
 
 // src/map/module-graph.ts
 import { readFileSync as readFileSync14, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
-import { dirname as dirname8, join as join16, relative as relative5, resolve as resolvePath } from "path";
+import { dirname as dirname9, join as join17, relative as relative6, resolve as resolvePath } from "path";
 var RESOLVE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 function createModuleGraph(ts, opts) {
   const cache = /* @__PURE__ */ new Map();
@@ -8746,7 +9115,7 @@ function createModuleGraph(ts, opts) {
       for (const callee of mod.calleesOf.get(exportName) ?? []) {
         for (const s of mod.fnSinks.get(callee) ?? []) collected.push(s);
       }
-      const rel = relative5(opts.cwd, target);
+      const rel = relative6(opts.cwd, target);
       return collected.map((s) => ({ ...s, file: rel }));
     },
     // A different question about the same module: not "what sinks are in there" but "what does this
@@ -8772,7 +9141,7 @@ function createModuleGraph(ts, opts) {
 }
 function resolveRelativeModule(fromFile, spec) {
   if (!spec.startsWith(".")) return void 0;
-  const dir = dirname8(fromFile);
+  const dir = dirname9(fromFile);
   const base = resolvePath(dir, spec);
   const candidates = [];
   const jsLike = /\.(js|jsx|mjs|cjs)$/.exec(base);
@@ -8782,7 +9151,7 @@ function resolveRelativeModule(fromFile, spec) {
   }
   candidates.push(base);
   for (const e of RESOLVE_EXTS) candidates.push(base + e);
-  for (const e of RESOLVE_EXTS) candidates.push(join16(base, "index" + e));
+  for (const e of RESOLVE_EXTS) candidates.push(join17(base, "index" + e));
   for (const c of candidates) {
     try {
       if (statSync7(c).isFile()) return c;
@@ -9072,7 +9441,7 @@ function handlerEntry(name, kindLabel, params, body, ts, localSinks, bindings, c
 
 // src/map/imports.ts
 import { readFileSync as readFileSync15 } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var MAX_SITES2 = 5;
 var NPM_NAME = /^(?:@[^/@\s~][^/@\s]*\/)?[^/@\s.~][^/@\s]*$/;
 function isNpmPackageName(pkg) {
@@ -9081,15 +9450,15 @@ function isNpmPackageName(pkg) {
 function readPathAliases(cwd) {
   const aliases = [];
   for (const name of ["tsconfig.json", "jsconfig.json"]) {
-    let paths;
+    let paths2;
     try {
-      const raw = readFileSync15(join17(cwd, name), "utf8");
+      const raw = readFileSync15(join18(cwd, name), "utf8");
       const parsed = JSON.parse(stripJsonComments(raw));
-      paths = parsed.compilerOptions?.paths;
+      paths2 = parsed.compilerOptions?.paths;
     } catch {
       continue;
     }
-    for (const key of Object.keys(paths ?? {})) {
+    for (const key of Object.keys(paths2 ?? {})) {
       if (key.startsWith(".")) continue;
       if (key.endsWith("*")) aliases.push({ prefix: key.slice(0, -1), wildcard: true });
       else aliases.push({ prefix: key, wildcard: false });
@@ -9355,7 +9724,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   for (const file of files) {
     try {
       const text = readFileSync16(file, "utf8");
-      const relFile = relative6(cwd, file);
+      const relFile = relative7(cwd, file);
       sourceBytes += text.length;
       if (isComponentFile(file)) {
         componentFiles++;
@@ -9424,7 +9793,7 @@ async function extractInputMap(cwd, ts, options = {}) {
       }
     } catch (e) {
       if (typeof process !== "undefined" && process.env?.PS_MAP_DEBUG) console.error("[patchstack] map error", file, e);
-      failed.push(relative6(cwd, file));
+      failed.push(relative7(cwd, file));
     }
   }
   let hopParsed = 0;
@@ -9435,7 +9804,7 @@ async function extractInputMap(cwd, ts, options = {}) {
       const text = readFileSync16(target, "utf8");
       const sf = ts.createSourceFile(target, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, target));
       const bindings = buildModuleBindings(sf, ts);
-      const called = collectInvocations(sf, ts, bindings, { file: target, owner: relative6(cwd, target), graph });
+      const called = collectInvocations(sf, ts, bindings, { file: target, owner: relative7(cwd, target), graph });
       invocations.add(called.invocations);
       calls.total += called.counts.total;
       calls.dependency += called.counts.dependency;
@@ -9481,7 +9850,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   if (endpoints.length === 0) notes.push("No recognized server-side entry points found under the analyzed roots.");
   const importList = imports.list();
   const unmodelled = importList.filter((d) => d.recognizedSinkKinds.length === 0).length;
-  const skippedDirsWithSource = stats.skippedWithSource.map((d) => relative6(cwd, d));
+  const skippedDirsWithSource = stats.skippedWithSource.map((d) => relative7(cwd, d));
   const importCoverageGaps = {
     unreadableFiles: failed.length,
     unscannableFiles: importScanFailures,
@@ -9595,8 +9964,8 @@ function getStringFlag(flags, name) {
 }
 
 // src/build-stamp.ts
-import { lstatSync as lstatSync4, readFileSync as readFileSync17, readdirSync as readdirSync6, realpathSync as realpathSync7 } from "fs";
-import { join as join18, relative as relative7, sep as sep3 } from "path";
+import { lstatSync as lstatSync5, readFileSync as readFileSync17, readdirSync as readdirSync7, realpathSync as realpathSync7 } from "fs";
+import { join as join19, relative as relative8, sep as sep3 } from "path";
 var RULES_FILE_NAMES = /* @__PURE__ */ new Set(["rules.json", "patchstack.rules.json"]);
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "out", "coverage", "tmp", "vendor"]);
 var MAX_DEPTH2 = 6;
@@ -9608,15 +9977,15 @@ function guardImportsRulesFile(dir, rulesName) {
   const importsRules = new RegExp(`(?:\\bfrom\\s*|\\brequire\\s*\\(\\s*|\\bnew\\s+URL\\s*\\(\\s*)${quotedRules}`);
   let siblings;
   try {
-    siblings = readdirSync6(dir);
+    siblings = readdirSync7(dir);
   } catch {
     return false;
   }
   for (const name of siblings) {
     if (!GUARD_SOURCE.test(name)) continue;
-    const path17 = join18(dir, name);
+    const path17 = join19(dir, name);
     try {
-      const entry = lstatSync4(path17);
+      const entry = lstatSync5(path17);
       if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_GUARD_SOURCE_BYTES) continue;
       const source = stripComments(readFileSync17(path17, "utf8"));
       if (source.includes("@patchstack/connect/protect") && importsRules.test(source)) return true;
@@ -9651,16 +10020,16 @@ function findRulesFile(cwd) {
     if (depth > MAX_DEPTH2 || found.length > 8) return;
     let entries;
     try {
-      entries = readdirSync6(dir);
+      entries = readdirSync7(dir);
     } catch {
       return;
     }
     for (const name of entries) {
       if (name.startsWith(".")) continue;
-      const path17 = join18(dir, name);
+      const path17 = join19(dir, name);
       let entry;
       try {
-        entry = lstatSync4(path17);
+        entry = lstatSync5(path17);
       } catch {
         continue;
       }
@@ -9680,9 +10049,9 @@ function findRulesFile(cwd) {
     }
   };
   walk2(cwd, 0);
-  if (found.length > 1) return { kind: "ambiguous", paths: found.map((p) => relative7(cwd, p)) };
+  if (found.length > 1) return { kind: "ambiguous", paths: found.map((p) => relative8(cwd, p)) };
   if (found.length === 1) return { kind: "one", path: found[0] };
-  if (unreadable.length > 0) return { kind: "unreadable", paths: unreadable.map((p) => relative7(cwd, p)) };
+  if (unreadable.length > 0) return { kind: "unreadable", paths: unreadable.map((p) => relative8(cwd, p)) };
   return { kind: "none" };
 }
 function detectIndent(text) {
@@ -9703,7 +10072,7 @@ function applyBuildStamp(cwd, id) {
       reason: `more than one candidate guard rules file (${location.paths.join(", ")}) \u2014 none was stamped`
     };
   }
-  const file = relative7(cwd, location.path);
+  const file = relative8(cwd, location.path);
   let text;
   try {
     text = readFileSync17(location.path, "utf8");
@@ -11142,7 +11511,7 @@ async function runMarkBuild(args) {
 }
 function packageVersion() {
   try {
-    const require2 = createRequire2(import.meta.url);
+    const require2 = createRequire3(import.meta.url);
     const manifest = require2("../package.json");
     return typeof manifest.version === "string" && manifest.version.length > 0 ? manifest.version : "unknown";
   } catch {