@patchstack/connect 0.5.3 → 0.5.5

package/dist/index.d.cts

@@ -1,11 +1,12 @@
 type Ecosystem = 'npm' | 'composer';
 /**
- * Which environment a manifest was captured in. The connector reports from real
- * builds (prebuild scan / build hooks), so it defaults to 'production'. Override
- * with PATCHSTACK_ENVIRONMENT=sandbox (or "environment" in .patchstackrc.json)
- * for test manifests.
+ * Where a manifest was built. `production` only when the hosting platform's own discriminator says this
+ * build is the production one; `sandbox` for a preview it names as such, or a hosted builder's workspace;
+ * `local` for everything else, a developer's machine included — inventory, never evidence of a live site.
+ * Inferred when nothing sets it (see `environment.ts`); `PATCHSTACK_ENVIRONMENT` or `"environment"` in
+ * .patchstackrc.json overrides.
  */
-type Environment = 'production' | 'sandbox';
+type Environment = 'production' | 'sandbox' | 'local';
 interface PackageEntry {
     name: string;
     version: string;
@@ -59,8 +60,14 @@ interface Config {
     siteName?: string | null;
     endpoint: string;
     timeoutMs: number;
-    /** Environment to report the manifest under. Defaults to 'production'. */
+    /** Environment to report the manifest under. Inferred from the build environment when not stated. */
     environment: Environment;
+    /**
+     * What decided `environment` when nothing set it: the hosting platform's own production or preview
+     * discriminator. Empty when it was stated, and empty for `local`, which is decided by the absence of
+     * any such evidence.
+     */
+    environmentEvidence?: string[];
     /**
      * Whether the connector manages the disclosure-widget tag (source shell on
      * `scan`, built HTML on `mark-build`). Defaults to true; persist
@@ -109,6 +116,12 @@ interface StoreManifestResponse {
 declare class PatchstackError extends Error {
     readonly code: 'CONFIG_MISSING' | 'CONFIG_INVALID' | 'LOCKFILE_NOT_FOUND' | 'LOCKFILE_UNSUPPORTED' | 'LOCKFILE_PARSE_ERROR' | 'NETWORK_ERROR' | 'NETWORK_TIMEOUT' | 'SITE_NOT_FOUND' | 'UNAUTHORIZED' | 'VALIDATION_ERROR' | 'SERVER_ERROR';
     readonly cause?: unknown | undefined;
+    /**
+     * For a `VALIDATION_ERROR`, the request fields the server refused, as it named them. Read from the
+     * structured `errors` object a validation response carries, so a caller deciding what to do about a
+     * refusal keys on the field rather than on the wording of a sentence.
+     */
+    fields: readonly string[];
     constructor(message: string, code: 'CONFIG_MISSING' | 'CONFIG_INVALID' | 'LOCKFILE_NOT_FOUND' | 'LOCKFILE_UNSUPPORTED' | 'LOCKFILE_PARSE_ERROR' | 'NETWORK_ERROR' | 'NETWORK_TIMEOUT' | 'SITE_NOT_FOUND' | 'UNAUTHORIZED' | 'VALIDATION_ERROR' | 'SERVER_ERROR', cause?: unknown | undefined);
 }
 
@@ -185,6 +198,55 @@ interface WireOptions {
 declare function buildWirePayload(manifest: Manifest, options?: WireOptions): NormalizeResult;
 declare function compareVersions(a: string, b: string): number;
 
+/**
+ * A best-effort description of the stack a build was produced with, derived
+ * entirely from the lockfile (ground truth) plus the build-time environment.
+ *
+ * The disclosure widget reads this from `window.__PATCHSTACK_STACK__` (injected
+ * by `mark-build`) and reports it to Patchstack, so we learn how the sites we
+ * protect are actually built and hosted — across every "vibe" platform — without
+ * shipping a runtime probe onto the host server. Every field is a coarse label
+ * or a bare key *name*: no versions beyond the framework, and never an env value.
+ */
+interface StackDescriptor {
+    /** App / meta-framework, e.g. "next", "nuxt", "tanstack-start", "remix". */
+    framework: string | null;
+    /** UI runtime, e.g. "react", "vue", "svelte", "solid". */
+    ui: string | null;
+    /** Build tool / bundler, e.g. "vite", "webpack", "rspack". */
+    bundler: string | null;
+    /** Deployment-runtime hint from deps, e.g. "cloudflare-workers", "vercel". */
+    runtime: string | null;
+    /** The vibe/builder platform that generated the project, e.g. "lovable". */
+    builder: string | null;
+    /** Package ecosystem the manifest came from. */
+    ecosystem: 'npm';
+    /** Hosting-related build-environment variable NAMES (never their values). */
+    hostingEnvKeys: string[];
+}
+/**
+ * An environment, described structurally so it needs no ambient types.
+ *
+ * `@types/node` is not a dependency of this package, so nothing in its public surface may name
+ * `NodeJS.ProcessEnv`: a consumer without those types cannot compile against a signature that does.
+ * `process.env` satisfies this, and so does a plain object.
+ */
+type EnvLike = Record<string, string | undefined>;
+/**
+ * Return the sorted NAMES of hosting-related environment variables present in
+ * `env`. Only names are surfaced — never values — so a build fingerprint can
+ * distinguish "deployed on Cloudflare" from "deployed on Vercel" without ever
+ * disclosing a secret.
+ */
+declare function collectHostingEnvKeys(env?: EnvLike): string[];
+/**
+ * Derive a {@link StackDescriptor} from the wire packages and the build
+ * environment. Never throws: an unrecognised stack just yields nulls.
+ */
+declare function detectStack(packages: readonly WirePackage[], env?: EnvLike): StackDescriptor;
+/** True when the descriptor carries no useful signal (nothing worth injecting). */
+declare function isEmptyStack(stack: StackDescriptor): boolean;
+
 declare const DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
 declare function buildEndpointUrl(base: string, siteUuid?: string | null): string;
 /**
@@ -295,55 +357,6 @@ declare function persistApiKey(cwd: string, apiKey: string): Promise<SecretFileR
  */
 declare function persistPulseAuth(cwd: string, pulseAuth: string): Promise<SecretFileResult>;
 
-/**
- * A best-effort description of the stack a build was produced with, derived
- * entirely from the lockfile (ground truth) plus the build-time environment.
- *
- * The disclosure widget reads this from `window.__PATCHSTACK_STACK__` (injected
- * by `mark-build`) and reports it to Patchstack, so we learn how the sites we
- * protect are actually built and hosted — across every "vibe" platform — without
- * shipping a runtime probe onto the host server. Every field is a coarse label
- * or a bare key *name*: no versions beyond the framework, and never an env value.
- */
-interface StackDescriptor {
-    /** App / meta-framework, e.g. "next", "nuxt", "tanstack-start", "remix". */
-    framework: string | null;
-    /** UI runtime, e.g. "react", "vue", "svelte", "solid". */
-    ui: string | null;
-    /** Build tool / bundler, e.g. "vite", "webpack", "rspack". */
-    bundler: string | null;
-    /** Deployment-runtime hint from deps, e.g. "cloudflare-workers", "vercel". */
-    runtime: string | null;
-    /** The vibe/builder platform that generated the project, e.g. "lovable". */
-    builder: string | null;
-    /** Package ecosystem the manifest came from. */
-    ecosystem: 'npm';
-    /** Hosting-related build-environment variable NAMES (never their values). */
-    hostingEnvKeys: string[];
-}
-/**
- * An environment, described structurally so it needs no ambient types.
- *
- * `@types/node` is not a dependency of this package, so nothing in its public surface may name
- * `NodeJS.ProcessEnv`: a consumer without those types cannot compile against a signature that does.
- * `process.env` satisfies this, and so does a plain object.
- */
-type EnvLike = Record<string, string | undefined>;
-/**
- * Return the sorted NAMES of hosting-related environment variables present in
- * `env`. Only names are surfaced — never values — so a build fingerprint can
- * distinguish "deployed on Cloudflare" from "deployed on Vercel" without ever
- * disclosing a secret.
- */
-declare function collectHostingEnvKeys(env?: EnvLike): string[];
-/**
- * Derive a {@link StackDescriptor} from the wire packages and the build
- * environment. Never throws: an unrecognised stack just yields nulls.
- */
-declare function detectStack(packages: readonly WirePackage[], env?: EnvLike): StackDescriptor;
-/** True when the descriptor carries no useful signal (nothing worth injecting). */
-declare function isEmptyStack(stack: StackDescriptor): boolean;
-
 declare const WIDGET_SCRIPT_URL = "https://cdn.patchstack.com/patchstack-widget.js";
 /** Attribute that tags the connector-managed widget tag so re-runs update it. */
 declare const WIDGET_MARKER_ATTR = "data-patchstack-connect-widget";

package/dist/index.d.ts

@@ -1,11 +1,12 @@
 type Ecosystem = 'npm' | 'composer';
 /**
- * Which environment a manifest was captured in. The connector reports from real
- * builds (prebuild scan / build hooks), so it defaults to 'production'. Override
- * with PATCHSTACK_ENVIRONMENT=sandbox (or "environment" in .patchstackrc.json)
- * for test manifests.
+ * Where a manifest was built. `production` only when the hosting platform's own discriminator says this
+ * build is the production one; `sandbox` for a preview it names as such, or a hosted builder's workspace;
+ * `local` for everything else, a developer's machine included — inventory, never evidence of a live site.
+ * Inferred when nothing sets it (see `environment.ts`); `PATCHSTACK_ENVIRONMENT` or `"environment"` in
+ * .patchstackrc.json overrides.
  */
-type Environment = 'production' | 'sandbox';
+type Environment = 'production' | 'sandbox' | 'local';
 interface PackageEntry {
     name: string;
     version: string;
@@ -59,8 +60,14 @@ interface Config {
     siteName?: string | null;
     endpoint: string;
     timeoutMs: number;
-    /** Environment to report the manifest under. Defaults to 'production'. */
+    /** Environment to report the manifest under. Inferred from the build environment when not stated. */
     environment: Environment;
+    /**
+     * What decided `environment` when nothing set it: the hosting platform's own production or preview
+     * discriminator. Empty when it was stated, and empty for `local`, which is decided by the absence of
+     * any such evidence.
+     */
+    environmentEvidence?: string[];
     /**
      * Whether the connector manages the disclosure-widget tag (source shell on
      * `scan`, built HTML on `mark-build`). Defaults to true; persist
@@ -109,6 +116,12 @@ interface StoreManifestResponse {
 declare class PatchstackError extends Error {
     readonly code: 'CONFIG_MISSING' | 'CONFIG_INVALID' | 'LOCKFILE_NOT_FOUND' | 'LOCKFILE_UNSUPPORTED' | 'LOCKFILE_PARSE_ERROR' | 'NETWORK_ERROR' | 'NETWORK_TIMEOUT' | 'SITE_NOT_FOUND' | 'UNAUTHORIZED' | 'VALIDATION_ERROR' | 'SERVER_ERROR';
     readonly cause?: unknown | undefined;
+    /**
+     * For a `VALIDATION_ERROR`, the request fields the server refused, as it named them. Read from the
+     * structured `errors` object a validation response carries, so a caller deciding what to do about a
+     * refusal keys on the field rather than on the wording of a sentence.
+     */
+    fields: readonly string[];
     constructor(message: string, code: 'CONFIG_MISSING' | 'CONFIG_INVALID' | 'LOCKFILE_NOT_FOUND' | 'LOCKFILE_UNSUPPORTED' | 'LOCKFILE_PARSE_ERROR' | 'NETWORK_ERROR' | 'NETWORK_TIMEOUT' | 'SITE_NOT_FOUND' | 'UNAUTHORIZED' | 'VALIDATION_ERROR' | 'SERVER_ERROR', cause?: unknown | undefined);
 }
 
@@ -185,6 +198,55 @@ interface WireOptions {
 declare function buildWirePayload(manifest: Manifest, options?: WireOptions): NormalizeResult;
 declare function compareVersions(a: string, b: string): number;
 
+/**
+ * A best-effort description of the stack a build was produced with, derived
+ * entirely from the lockfile (ground truth) plus the build-time environment.
+ *
+ * The disclosure widget reads this from `window.__PATCHSTACK_STACK__` (injected
+ * by `mark-build`) and reports it to Patchstack, so we learn how the sites we
+ * protect are actually built and hosted — across every "vibe" platform — without
+ * shipping a runtime probe onto the host server. Every field is a coarse label
+ * or a bare key *name*: no versions beyond the framework, and never an env value.
+ */
+interface StackDescriptor {
+    /** App / meta-framework, e.g. "next", "nuxt", "tanstack-start", "remix". */
+    framework: string | null;
+    /** UI runtime, e.g. "react", "vue", "svelte", "solid". */
+    ui: string | null;
+    /** Build tool / bundler, e.g. "vite", "webpack", "rspack". */
+    bundler: string | null;
+    /** Deployment-runtime hint from deps, e.g. "cloudflare-workers", "vercel". */
+    runtime: string | null;
+    /** The vibe/builder platform that generated the project, e.g. "lovable". */
+    builder: string | null;
+    /** Package ecosystem the manifest came from. */
+    ecosystem: 'npm';
+    /** Hosting-related build-environment variable NAMES (never their values). */
+    hostingEnvKeys: string[];
+}
+/**
+ * An environment, described structurally so it needs no ambient types.
+ *
+ * `@types/node` is not a dependency of this package, so nothing in its public surface may name
+ * `NodeJS.ProcessEnv`: a consumer without those types cannot compile against a signature that does.
+ * `process.env` satisfies this, and so does a plain object.
+ */
+type EnvLike = Record<string, string | undefined>;
+/**
+ * Return the sorted NAMES of hosting-related environment variables present in
+ * `env`. Only names are surfaced — never values — so a build fingerprint can
+ * distinguish "deployed on Cloudflare" from "deployed on Vercel" without ever
+ * disclosing a secret.
+ */
+declare function collectHostingEnvKeys(env?: EnvLike): string[];
+/**
+ * Derive a {@link StackDescriptor} from the wire packages and the build
+ * environment. Never throws: an unrecognised stack just yields nulls.
+ */
+declare function detectStack(packages: readonly WirePackage[], env?: EnvLike): StackDescriptor;
+/** True when the descriptor carries no useful signal (nothing worth injecting). */
+declare function isEmptyStack(stack: StackDescriptor): boolean;
+
 declare const DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
 declare function buildEndpointUrl(base: string, siteUuid?: string | null): string;
 /**
@@ -295,55 +357,6 @@ declare function persistApiKey(cwd: string, apiKey: string): Promise<SecretFileR
  */
 declare function persistPulseAuth(cwd: string, pulseAuth: string): Promise<SecretFileResult>;
 
-/**
- * A best-effort description of the stack a build was produced with, derived
- * entirely from the lockfile (ground truth) plus the build-time environment.
- *
- * The disclosure widget reads this from `window.__PATCHSTACK_STACK__` (injected
- * by `mark-build`) and reports it to Patchstack, so we learn how the sites we
- * protect are actually built and hosted — across every "vibe" platform — without
- * shipping a runtime probe onto the host server. Every field is a coarse label
- * or a bare key *name*: no versions beyond the framework, and never an env value.
- */
-interface StackDescriptor {
-    /** App / meta-framework, e.g. "next", "nuxt", "tanstack-start", "remix". */
-    framework: string | null;
-    /** UI runtime, e.g. "react", "vue", "svelte", "solid". */
-    ui: string | null;
-    /** Build tool / bundler, e.g. "vite", "webpack", "rspack". */
-    bundler: string | null;
-    /** Deployment-runtime hint from deps, e.g. "cloudflare-workers", "vercel". */
-    runtime: string | null;
-    /** The vibe/builder platform that generated the project, e.g. "lovable". */
-    builder: string | null;
-    /** Package ecosystem the manifest came from. */
-    ecosystem: 'npm';
-    /** Hosting-related build-environment variable NAMES (never their values). */
-    hostingEnvKeys: string[];
-}
-/**
- * An environment, described structurally so it needs no ambient types.
- *
- * `@types/node` is not a dependency of this package, so nothing in its public surface may name
- * `NodeJS.ProcessEnv`: a consumer without those types cannot compile against a signature that does.
- * `process.env` satisfies this, and so does a plain object.
- */
-type EnvLike = Record<string, string | undefined>;
-/**
- * Return the sorted NAMES of hosting-related environment variables present in
- * `env`. Only names are surfaced — never values — so a build fingerprint can
- * distinguish "deployed on Cloudflare" from "deployed on Vercel" without ever
- * disclosing a secret.
- */
-declare function collectHostingEnvKeys(env?: EnvLike): string[];
-/**
- * Derive a {@link StackDescriptor} from the wire packages and the build
- * environment. Never throws: an unrecognised stack just yields nulls.
- */
-declare function detectStack(packages: readonly WirePackage[], env?: EnvLike): StackDescriptor;
-/** True when the descriptor carries no useful signal (nothing worth injecting). */
-declare function isEmptyStack(stack: StackDescriptor): boolean;
-
 declare const WIDGET_SCRIPT_URL = "https://cdn.patchstack.com/patchstack-widget.js";
 /** Attribute that tags the connector-managed widget tag so re-runs update it. */
 declare const WIDGET_MARKER_ATTR = "data-patchstack-connect-widget";

package/dist/index.js

@@ -12,6 +12,12 @@ var PatchstackError = class extends Error {
   }
   code;
   cause;
+  /**
+   * For a `VALIDATION_ERROR`, the request fields the server refused, as it named them. Read from the
+   * structured `errors` object a validation response carries, so a caller deciding what to do about a
+   * refusal keys on the field rather than on the wording of a sentence.
+   */
+  fields = [];
 };
 
 // src/parsers/consistency.ts
@@ -49,8 +55,8 @@ async function readDeclaredDependencyNames(cwd) {
   return [...names];
 }
 function missingDependencies(declared, packages) {
-  const present = new Set(packages.map((entry) => entry.name));
-  return declared.filter((name) => !present.has(name));
+  const present2 = new Set(packages.map((entry) => entry.name));
+  return declared.filter((name) => !present2.has(name));
 }
 function disagreements(packages, other) {
   const otherVersions = /* @__PURE__ */ new Map();
@@ -1185,12 +1191,40 @@ function compareSegments(a, b) {
   return 0;
 }
 
+// src/hosting.ts
+var RULES = [
+  { platform: "netlify", any: ["NETLIFY", "NETLIFY_BUILD_BASE", "DEPLOY_PRIME_URL"] },
+  { platform: "vercel", any: ["VERCEL", "VERCEL_ENV", "VERCEL_URL"] },
+  { platform: "cloudflare", any: ["CF_PAGES", "CF_PAGES_URL", "CLOUDFLARE_ACCOUNT_ID"] },
+  { platform: "aws", any: ["AWS_APP_ID", "AWS_LAMBDA_FUNCTION_NAME", "AWS_EXECUTION_ENV"] },
+  { platform: "render", any: ["RENDER", "RENDER_SERVICE_ID", "RENDER_EXTERNAL_URL"] },
+  { platform: "railway", any: ["RAILWAY_ENVIRONMENT", "RAILWAY_ENVIRONMENT_NAME", "RAILWAY_PROJECT_ID"] },
+  { platform: "fly", any: ["FLY_APP_NAME", "FLY_REGION", "FLY_ALLOC_ID"] },
+  { platform: "heroku", any: ["DYNO", "HEROKU_APP_NAME"] },
+  { platform: "google-cloud", any: ["K_SERVICE", "GAE_APPLICATION", "GAE_SERVICE"] },
+  { platform: "deno-deploy", any: ["DENO_DEPLOYMENT_ID"] },
+  { platform: "azure", any: ["WEBSITE_SITE_NAME", "WEBSITE_INSTANCE_ID"] }
+];
+var present = (env, name) => {
+  const value = env[name];
+  return value !== void 0 && value !== "";
+};
+function detectHostingPlatform(env = process.env) {
+  for (const rule of RULES) {
+    const evidence = rule.any.filter((name) => present(env, name));
+    if (evidence.length > 0) {
+      return { platform: rule.platform, evidence };
+    }
+  }
+  return { platform: null, evidence: [] };
+}
+
 // src/pulse-token.ts
 var TOKEN_SKEW_MS = 6e4;
 function buildTokenUrl(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path9 = url.pathname.replace(/\/$/, "");
-  url.pathname = path9.endsWith("/manifest") ? `${path9.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  const path10 = url.pathname.replace(/\/$/, "");
+  url.pathname = path10.endsWith("/manifest") ? `${path10.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1295,14 +1329,22 @@ function buildClaimUrl(endpoint, siteUuid) {
   const origin = new URL(endpoint).origin;
   return `${origin}/monitor/claim?site=${encodeURIComponent(siteUuid)}`;
 }
-function buildManifestBody(config, payload) {
+function buildManifestBody(config, payload, env = process.env) {
+  const hosting = config.environment === "local" ? null : detectHostingPlatform(env);
   return {
     ...payload,
     environment: config.environment,
     ...typeof config.siteUrl === "string" && config.siteUrl !== "" ? { url: config.siteUrl } : {},
-    ...typeof config.siteName === "string" && config.siteName !== "" ? { name: config.siteName } : {}
+    ...typeof config.siteName === "string" && config.siteName !== "" ? { name: config.siteName } : {},
+    ...hosting !== null && hosting.platform !== null ? { hosting } : {}
   };
 }
+function validationFields(body) {
+  if (typeof body !== "object" || body === null) return [];
+  const errors = body.errors;
+  if (typeof errors !== "object" || errors === null || Array.isArray(errors)) return [];
+  return Object.keys(errors);
+}
 async function postManifest(config, payload) {
   const url = buildEndpointUrl(config.endpoint, config.siteUuid);
   const timeoutMs = config.timeoutMs;
@@ -1347,10 +1389,12 @@ async function postManifest(config, payload) {
     );
   }
   if (response.status === 422) {
-    throw new PatchstackError(
+    const refused2 = new PatchstackError(
       body?.message ?? "Patchstack rejected the manifest payload (validation failed).",
       "VALIDATION_ERROR"
     );
+    refused2.fields = validationFields(body);
+    throw refused2;
   }
   const refused = authFailureMessage(response.status, config);
   if (refused !== null) {
@@ -1376,7 +1420,80 @@ function isTimeoutError(cause) {
 
 // src/config.ts
 import { readFile as readFile8, writeFile, chmod } from "fs/promises";
-import path7 from "path";
+import path8 from "path";
+
+// src/environment.ts
+import { readFileSync } from "fs";
+import path6 from "path";
+var set = (value) => value !== void 0 && value !== "";
+var DISCRIMINATORS = [
+  {
+    platform: "vercel",
+    read: (env) => {
+      if (!set(env.VERCEL) || !set(env.VERCEL_ENV)) return null;
+      return env.VERCEL_ENV === "production" ? { environment: "production", evidence: "VERCEL_ENV=production" } : { environment: "sandbox", evidence: `VERCEL_ENV=${env.VERCEL_ENV}` };
+    }
+  },
+  {
+    platform: "netlify",
+    read: (env) => {
+      if (env.NETLIFY !== "true" || !set(env.CONTEXT)) return null;
+      return env.CONTEXT === "production" ? { environment: "production", evidence: "CONTEXT=production" } : { environment: "sandbox", evidence: `CONTEXT=${env.CONTEXT}` };
+    }
+  },
+  {
+    platform: "render",
+    read: (env) => {
+      if (env.RENDER !== "true") return null;
+      return env.IS_PULL_REQUEST === "true" ? { environment: "sandbox", evidence: "IS_PULL_REQUEST=true" } : { environment: "production", evidence: "RENDER=true, not a pull request" };
+    }
+  },
+  {
+    platform: "railway",
+    read: (env) => {
+      if (!set(env.RAILWAY_ENVIRONMENT_NAME)) return null;
+      return env.RAILWAY_ENVIRONMENT_NAME === "production" ? { environment: "production", evidence: "RAILWAY_ENVIRONMENT_NAME=production" } : { environment: "sandbox", evidence: `RAILWAY_ENVIRONMENT_NAME=${env.RAILWAY_ENVIRONMENT_NAME}` };
+    }
+  }
+];
+var HOSTED_BUILDER_PACKAGES = [
+  // `lovable-tagger` covers projects from before ~Aug 2026; current templates ship the
+  // `@lovable.dev/*` scoped tooling instead.
+  { builder: "lovable", exact: ["lovable-tagger"], prefixes: ["@lovable.dev/"] },
+  { builder: "replit", exact: [], prefixes: ["@replit/"] }
+];
+function detectHostedBuilder(cwd) {
+  let declared;
+  try {
+    const pkg = JSON.parse(readFileSync(path6.join(cwd, "package.json"), "utf8"));
+    declared = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+  } catch {
+    return null;
+  }
+  const names = Object.keys(declared);
+  for (const rule of HOSTED_BUILDER_PACKAGES) {
+    const hit = names.some(
+      (name) => rule.exact.includes(name) || rule.prefixes.some((prefix) => name.startsWith(prefix))
+    );
+    if (hit) return rule.builder;
+  }
+  return null;
+}
+function inferEnvironment(env = process.env, builder = null) {
+  for (const discriminator of DISCRIMINATORS) {
+    const verdict = discriminator.read(env);
+    if (verdict !== null) {
+      return { environment: verdict.environment, evidence: [`${discriminator.platform}: ${verdict.evidence}`] };
+    }
+  }
+  if (builder !== null) {
+    return {
+      environment: "production",
+      evidence: [`${builder}: a build in a ${builder} project is its publish step`]
+    };
+  }
+  return { environment: "local", evidence: [] };
+}
 
 // src/site-url.ts
 var RESERVED_SUFFIXES = [
@@ -1447,7 +1564,7 @@ function detectSiteUrl(env = process.env) {
 
 // src/site-name.ts
 import { readFile as readFile7 } from "fs/promises";
-import path6 from "path";
+import path7 from "path";
 var NAME_MAX_LENGTH = 191;
 var TEMPLATE_PACKAGE_NAMES = /* @__PURE__ */ new Set([
   // Lovable
@@ -1524,13 +1641,13 @@ async function readIfPresent(file) {
   }
 }
 async function detectSiteName(cwd) {
-  for (const shell of ["index.html", path6.join("public", "index.html")]) {
-    const html = await readIfPresent(path6.join(cwd, shell));
+  for (const shell of ["index.html", path7.join("public", "index.html")]) {
+    const html = await readIfPresent(path7.join(cwd, shell));
     if (html === null) continue;
     const name = nameFromHtmlTitle(html);
     if (name !== null) return { name, source: "index.html" };
   }
-  const manifest = await readIfPresent(path6.join(cwd, "package.json"));
+  const manifest = await readIfPresent(path7.join(cwd, "package.json"));
   if (manifest !== null) {
     try {
       const parsed = JSON.parse(manifest);
@@ -1547,7 +1664,6 @@ async function detectSiteName(cwd) {
 // src/config.ts
 var CONFIG_FILENAME = ".patchstackrc.json";
 var SECRET_FILENAME = ".patchstackrc.local.json";
-var DEFAULT_ENVIRONMENT = "production";
 async function resolveSiteIdentity(cwd, fromEnv, fromFile) {
   const configuredUrl = stated(fromEnv.url) ?? stated(fromFile.url);
   const configuredName = stated(fromEnv.name) ?? stated(fromFile.name);
@@ -1580,11 +1696,13 @@ async function resolveConfig(options) {
   const environmentRaw = fromEnv.environment ?? fromFile.environment;
   if (environmentRaw !== void 0 && !isEnvironment(environmentRaw)) {
     throw new PatchstackError(
-      `Environment must be "production" or "sandbox"; got "${environmentRaw}".`,
+      `Environment must be "production", "sandbox" or "local"; got "${environmentRaw}".`,
       "CONFIG_INVALID"
     );
   }
-  const environment = environmentRaw ?? DEFAULT_ENVIRONMENT;
+  const inferred = environmentRaw === void 0 ? inferEnvironment(process.env, detectHostedBuilder(options.cwd)) : null;
+  const environment = environmentRaw ?? inferred.environment;
+  const environmentEvidence = inferred?.evidence ?? [];
   if (siteUuid !== null && siteUuid.length > 0 && !isUuid(siteUuid)) {
     throw new PatchstackError(
       `Site UUID "${siteUuid}" does not look like a valid UUID.`,
@@ -1610,18 +1728,19 @@ async function resolveConfig(options) {
     endpoint,
     timeoutMs,
     environment,
+    environmentEvidence,
     widget: fromFile.widget !== false,
     claimToken
   };
 }
 async function writeConfigFile(cwd, config) {
-  const target = path7.join(cwd, CONFIG_FILENAME);
+  const target = path8.join(cwd, CONFIG_FILENAME);
   const content = JSON.stringify(config, null, 2) + "\n";
   await writeFile(target, content, "utf8");
   return target;
 }
 async function writeSecretFile(cwd, secrets) {
-  const target = path7.join(cwd, SECRET_FILENAME);
+  const target = path8.join(cwd, SECRET_FILENAME);
   await writeFile(target, JSON.stringify(secrets, null, 2) + "\n", { encoding: "utf8", mode: 384 });
   try {
     await chmod(target, 384);
@@ -1631,7 +1750,7 @@ async function writeSecretFile(cwd, secrets) {
   return { path: target, ...ignore };
 }
 async function ensureIgnored(cwd, entry) {
-  const target = path7.join(cwd, ".gitignore");
+  const target = path8.join(cwd, ".gitignore");
   let existing = "";
   try {
     existing = await readFile8(target, "utf8");
@@ -1698,7 +1817,7 @@ async function readConfigFile(cwd) {
   return readJsonFile(cwd, CONFIG_FILENAME);
 }
 async function readJsonFile(cwd, filename) {
-  const target = path7.join(cwd, filename);
+  const target = path8.join(cwd, filename);
   let raw;
   try {
     raw = await readFile8(target, "utf8");
@@ -1751,7 +1870,7 @@ function isUuid(value) {
   return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
 }
 function isEnvironment(value) {
-  return value === "production" || value === "sandbox";
+  return value === "production" || value === "sandbox" || value === "local";
 }
 
 // src/stack.ts
@@ -1768,6 +1887,9 @@ var STACK_RULES = [
   { category: "framework", pkg: "@sveltejs/kit", label: "sveltekit" },
   { category: "framework", pkg: "@builder.io/qwik-city", label: "qwik-city" },
   { category: "framework", pkg: "gatsby", label: "gatsby" },
+  { category: "framework", pkg: "@11ty/eleventy", label: "eleventy" },
+  { category: "framework", pkg: "@docusaurus/core", label: "docusaurus" },
+  { category: "framework", pkg: "vitepress", label: "vitepress" },
   { category: "framework", pkg: "express", label: "express" },
   { category: "framework", pkg: "fastify", label: "fastify" },
   // UI runtimes.
@@ -1817,10 +1939,10 @@ function collectHostingEnvKeys(env = process.env) {
   return Object.keys(env).filter((key) => HOSTING_ENV_PATTERNS.some((pattern) => pattern.test(key))).sort();
 }
 function detectStack(packages, env = process.env) {
-  const present = new Set(packages.map((pkg) => pkg.name));
+  const present2 = new Set(packages.map((pkg) => pkg.name));
   const firstMatch = (category) => {
     for (const rule of STACK_RULES) {
-      if (rule.category === category && present.has(rule.pkg)) {
+      if (rule.category === category && present2.has(rule.pkg)) {
         return rule.label;
       }
     }
@@ -1841,8 +1963,8 @@ function isEmptyStack(stack) {
 }
 
 // src/widget.ts
-import { existsSync, readFileSync, writeFileSync } from "fs";
-import path8 from "path";
+import { existsSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import path9 from "path";
 var WIDGET_SCRIPT_URL = "https://cdn.patchstack.com/patchstack-widget.js";
 var WIDGET_MARKER_ATTR = "data-patchstack-connect-widget";
 var WIDGET_NEEDLE = "patchstack-widget";
@@ -1880,7 +2002,7 @@ ${indent}</body>`;
 }
 function findSourceShell(cwd) {
   for (const candidate of SOURCE_SHELL_CANDIDATES) {
-    if (existsSync(path8.join(cwd, candidate))) {
+    if (existsSync(path9.join(cwd, candidate))) {
       return candidate;
     }
   }
@@ -1891,8 +2013,8 @@ function ensureSourceWidget(cwd, siteUuid) {
   if (shell === null) {
     return { shell: null, action: "no-shell" };
   }
-  const file = path8.join(cwd, shell);
-  const before = readFileSync(file, "utf8");
+  const file = path9.join(cwd, shell);
+  const before = readFileSync2(file, "utf8");
   const { html, action } = ensureWidgetInHtml(before, siteUuid);
   if (html !== before) {
     writeFileSync(file, html);