@patchstack/connect 0.5.4 → 0.5.6

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync11 } from "fs";
-import path15 from "path";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync11 } from "fs";
+import path16 from "path";
 import { createRequire as createRequire2 } from "module";
 
 // src/parsers/index.ts
@@ -1245,8 +1245,8 @@ function detectHostingPlatform(env = process.env) {
 var TOKEN_SKEW_MS = 6e4;
 function buildTokenUrl(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
-  const path16 = url.pathname.replace(/\/$/, "");
-  url.pathname = path16.endsWith("/manifest") ? `${path16.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  const path17 = url.pathname.replace(/\/$/, "");
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1385,8 +1385,8 @@ function authFailureMessage(status, config) {
 }
 function buildRulesUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path16 = url.pathname.replace(/\/$/, "");
-  url.pathname = path16.endsWith("/manifest") ? `${path16.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
+  const path17 = url.pathname.replace(/\/$/, "");
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/rules/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/rules/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1401,16 +1401,16 @@ function buildSettingsUrl(endpoint, siteUuid) {
 }
 function buildPackageRemovedUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path16 = url.pathname.replace(/\/$/, "");
-  url.pathname = path16.endsWith("/manifest") ? `${path16.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
+  const path17 = url.pathname.replace(/\/$/, "");
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
 }
 function buildInputMapUrl(manifestEndpoint, siteUuid) {
   const url = new URL(manifestEndpoint);
-  const path16 = url.pathname.replace(/\/$/, "");
-  url.pathname = path16.endsWith("/manifest") ? `${path16.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
+  const path17 = url.pathname.replace(/\/$/, "");
+  url.pathname = path17.endsWith("/manifest") ? `${path17.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
   url.search = "";
   url.hash = "";
   return url.toString();
@@ -1827,9 +1827,11 @@ function renderDemoTestCommands(url, scenario) {
 
 // src/config.ts
 import { readFile as readFile9, writeFile, chmod } from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 
 // src/environment.ts
+import { readFileSync } from "fs";
+import path6 from "path";
 var set = (value) => value !== void 0 && value !== "";
 var DISCRIMINATORS = [
   {
@@ -1861,13 +1863,42 @@ var DISCRIMINATORS = [
     }
   }
 ];
-function inferEnvironment(env = process.env) {
+var HOSTED_BUILDER_PACKAGES = [
+  // `lovable-tagger` covers projects from before ~Aug 2026; current templates ship the
+  // `@lovable.dev/*` scoped tooling instead.
+  { builder: "lovable", exact: ["lovable-tagger"], prefixes: ["@lovable.dev/"] },
+  { builder: "replit", exact: [], prefixes: ["@replit/"] }
+];
+function detectHostedBuilder(cwd) {
+  let declared;
+  try {
+    const pkg = JSON.parse(readFileSync(path6.join(cwd, "package.json"), "utf8"));
+    declared = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+  } catch {
+    return null;
+  }
+  const names = Object.keys(declared);
+  for (const rule of HOSTED_BUILDER_PACKAGES) {
+    const hit = names.some(
+      (name) => rule.exact.includes(name) || rule.prefixes.some((prefix) => name.startsWith(prefix))
+    );
+    if (hit) return rule.builder;
+  }
+  return null;
+}
+function inferEnvironment(env = process.env, builder = null) {
   for (const discriminator of DISCRIMINATORS) {
     const verdict = discriminator.read(env);
     if (verdict !== null) {
       return { environment: verdict.environment, evidence: [`${discriminator.platform}: ${verdict.evidence}`] };
     }
   }
+  if (builder !== null) {
+    return {
+      environment: "production",
+      evidence: [`${builder}: a build in a ${builder} project is its publish step`]
+    };
+  }
   return { environment: "local", evidence: [] };
 }
 
@@ -1940,7 +1971,7 @@ function detectSiteUrl(env = process.env) {
 
 // src/site-name.ts
 import { readFile as readFile8 } from "fs/promises";
-import path6 from "path";
+import path7 from "path";
 var NAME_MAX_LENGTH = 191;
 var TEMPLATE_PACKAGE_NAMES = /* @__PURE__ */ new Set([
   // Lovable
@@ -2017,13 +2048,13 @@ async function readIfPresent(file) {
   }
 }
 async function detectSiteName(cwd) {
-  for (const shell of ["index.html", path6.join("public", "index.html")]) {
-    const html = await readIfPresent(path6.join(cwd, shell));
+  for (const shell of ["index.html", path7.join("public", "index.html")]) {
+    const html = await readIfPresent(path7.join(cwd, shell));
     if (html === null) continue;
     const name = nameFromHtmlTitle(html);
     if (name !== null) return { name, source: "index.html" };
   }
-  const manifest = await readIfPresent(path6.join(cwd, "package.json"));
+  const manifest = await readIfPresent(path7.join(cwd, "package.json"));
   if (manifest !== null) {
     try {
       const parsed = JSON.parse(manifest);
@@ -2076,7 +2107,7 @@ async function resolveConfig(options) {
       "CONFIG_INVALID"
     );
   }
-  const inferred = environmentRaw === void 0 ? inferEnvironment(process.env) : null;
+  const inferred = environmentRaw === void 0 ? inferEnvironment(process.env, detectHostedBuilder(options.cwd)) : null;
   const environment = environmentRaw ?? inferred.environment;
   const environmentEvidence = inferred?.evidence ?? [];
   if (siteUuid !== null && siteUuid.length > 0 && !isUuid(siteUuid)) {
@@ -2110,14 +2141,14 @@ async function resolveConfig(options) {
   };
 }
 async function writeConfigFile(cwd, config) {
-  const target = path7.join(cwd, CONFIG_FILENAME);
+  const target = path8.join(cwd, CONFIG_FILENAME);
   const content = JSON.stringify(config, null, 2) + "\n";
   await writeFile(target, content, "utf8");
   return target;
 }
 var SECRET_CONFIG_FILENAME = SECRET_FILENAME;
 async function writeSecretFile(cwd, secrets) {
-  const target = path7.join(cwd, SECRET_FILENAME);
+  const target = path8.join(cwd, SECRET_FILENAME);
   await writeFile(target, JSON.stringify(secrets, null, 2) + "\n", { encoding: "utf8", mode: 384 });
   try {
     await chmod(target, 384);
@@ -2127,7 +2158,7 @@ async function writeSecretFile(cwd, secrets) {
   return { path: target, ...ignore };
 }
 async function ensureIgnored(cwd, entry) {
-  const target = path7.join(cwd, ".gitignore");
+  const target = path8.join(cwd, ".gitignore");
   let existing = "";
   try {
     existing = await readFile9(target, "utf8");
@@ -2160,7 +2191,7 @@ ${entry}
 }
 async function secretFileIgnored(cwd) {
   try {
-    const contents = await readFile9(path7.join(cwd, ".gitignore"), "utf8");
+    const contents = await readFile9(path8.join(cwd, ".gitignore"), "utf8");
     if (ignoresEntry(contents, SECRET_FILENAME)) return { ignored: true };
     return { ignored: false, reason: `.gitignore does not cover ${SECRET_FILENAME}` };
   } catch (err) {
@@ -2211,7 +2242,7 @@ async function readConfigFile(cwd) {
   return readJsonFile(cwd, CONFIG_FILENAME);
 }
 async function readJsonFile(cwd, filename) {
-  const target = path7.join(cwd, filename);
+  const target = path8.join(cwd, filename);
   let raw;
   try {
     raw = await readFile9(target, "utf8");
@@ -2268,8 +2299,8 @@ function isEnvironment(value) {
 }
 
 // src/mark-build.ts
-import { existsSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "fs";
-import path8 from "path";
+import { existsSync, readFileSync as readFileSync2, readdirSync, realpathSync, statSync, writeFileSync } from "fs";
+import path9 from "path";
 
 // src/stack.ts
 var STACK_RULES = [
@@ -2362,6 +2393,24 @@ function isEmptyStack(stack) {
 
 // src/mark-build.ts
 var MARKER_ATTR = "data-patchstack-build";
+function marksPublishedBuild(environment) {
+  return environment === "production";
+}
+var STALE_BUILD_WARNING_MS = 60 * 60 * 1e3;
+function staleBuildAge(files, startedAt) {
+  let newest = null;
+  for (const file of files) {
+    try {
+      const at = statSync(file).mtimeMs;
+      if (newest === null || at > newest) newest = at;
+    } catch {
+      continue;
+    }
+  }
+  if (newest === null) return null;
+  const age = startedAt - newest;
+  return age > STALE_BUILD_WARNING_MS ? age : null;
+}
 var BUILD_DIR_CANDIDATES = ["dist", "build", "out", ".output/public", "_site"];
 var FRAMEWORK_BUILD_DIRS = {
   eleventy: ["_site"],
@@ -2382,7 +2431,7 @@ function buildDirCandidates(options = {}) {
 }
 function resolveBuildDir(cwd, override, options = {}) {
   if (override !== void 0 && override !== "") {
-    const abs = path8.resolve(cwd, override);
+    const abs = path9.resolve(cwd, override);
     return existsSync(abs) && statSync(abs).isDirectory() ? abs : null;
   }
   let boundary;
@@ -2392,7 +2441,7 @@ function resolveBuildDir(cwd, override, options = {}) {
     return null;
   }
   for (const candidate of buildDirCandidates(options)) {
-    const abs = path8.resolve(cwd, candidate);
+    const abs = path9.resolve(cwd, candidate);
     if (!existsSync(abs) || !statSync(abs).isDirectory()) continue;
     let real;
     try {
@@ -2400,7 +2449,7 @@ function resolveBuildDir(cwd, override, options = {}) {
     } catch {
       continue;
     }
-    if (real === boundary || real.startsWith(boundary + path8.sep)) {
+    if (real === boundary || real.startsWith(boundary + path9.sep)) {
       return abs;
     }
   }
@@ -2410,7 +2459,7 @@ function findHtmlFiles(dir) {
   const out = [];
   const walk2 = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const full = path8.join(current, entry.name);
+      const full = path9.join(current, entry.name);
       if (entry.isDirectory()) {
         walk2(full);
       } else if (entry.isFile() && entry.name.toLowerCase().endsWith(".html")) {
@@ -2464,12 +2513,16 @@ function productionGate(framework) {
 function hasJsxShell(framework) {
   return framework !== null && JSX_SHELL_FRAMEWORKS.has(framework);
 }
-function buildSourceMarkerSnippet(framework) {
+function buildSourceMarkerSnippet(framework, checksum = null) {
   const gate = productionGate(framework);
+  const statements = ["window.__PATCHSTACK_PROD__=true;"];
+  if (checksum !== null && checksum !== "") {
+    statements.push(`window.__PATCHSTACK_BUILD__=${JSON.stringify(checksum)};`);
+  }
   return `{${gate} && (
   <script
     ${MARKER_ATTR}="true"
-    dangerouslySetInnerHTML={{ __html: 'window.__PATCHSTACK_PROD__=true;' }}
+    dangerouslySetInnerHTML={{ __html: '${statements.join("")}' }}
   />
 )}`;
 }
@@ -2532,7 +2585,7 @@ function findJsxShellAnchor(source, tagName) {
   }
   return null;
 }
-function ensureMarkerInJsxShell(source, framework) {
+function ensureMarkerInJsxShell(source, framework, checksum = null) {
   if (!hasJsxShell(framework)) {
     return { source, action: "unsupported" };
   }
@@ -2540,7 +2593,7 @@ function ensureMarkerInJsxShell(source, framework) {
   if (stripped.includes(PROD_MARKER_GLOBAL)) {
     return { source: stripped, action: "manual" };
   }
-  const block = (indent) => [REGION_OPEN, ...buildSourceMarkerSnippet(framework).split("\n"), REGION_CLOSE].map((line) => `${indent}${line}`).join("\n");
+  const block = (indent) => [REGION_OPEN, ...buildSourceMarkerSnippet(framework, checksum).split("\n"), REGION_CLOSE].map((line) => `${indent}${line}`).join("\n");
   for (const tagName of ["head", "body"]) {
     const anchor = findJsxShellAnchor(stripped, tagName);
     if (anchor === null) continue;
@@ -2555,13 +2608,13 @@ ${block(indent)}${separator}${remainder}`,
   }
   return { source: stripped, action: "no-anchor" };
 }
-function ensureSourceMarker(cwd, shell, framework) {
+function ensureSourceMarker(cwd, shell, framework, checksum = null) {
   if (shell === null) {
     return { shell: null, source: "", action: "no-anchor" };
   }
-  const file = path8.resolve(cwd, shell);
-  const before = readFileSync(file, "utf8");
-  const result = ensureMarkerInJsxShell(before, framework);
+  const file = path9.resolve(cwd, shell);
+  const before = readFileSync2(file, "utf8");
+  const result = ensureMarkerInJsxShell(before, framework, checksum);
   if (result.source !== before) {
     writeFileSync(file, result.source);
   }
@@ -2569,15 +2622,15 @@ function ensureSourceMarker(cwd, shell, framework) {
 }
 
 // src/guide.ts
-import { existsSync as existsSync13, readFileSync as readFileSync9, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
-import path11 from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync10, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
+import path12 from "path";
 
 // src/architecture.ts
-import { existsSync as existsSync2, readFileSync as readFileSync4, statSync as statSync3 } from "fs";
-import path9 from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
+import path10 from "path";
 
 // src/map/sources.ts
-import { readFileSync as readFileSync2, readdirSync as readdirSync2, realpathSync as realpathSync2, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync3, readdirSync as readdirSync2, realpathSync as realpathSync2, statSync as statSync2 } from "fs";
 import { join as join2, relative, isAbsolute } from "path";
 
 // src/map/ast.ts
@@ -2787,7 +2840,7 @@ function hasEntrySignal(text) {
 }
 function detectFramework(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync3(join2(cwd, "package.json"), "utf8"));
     const d = { ...pkg.dependencies, ...pkg.devDependencies };
     if (d["@tanstack/react-start"] || d["@tanstack/start"] || d["@tanstack/solid-start"]) return "tanstack-start";
     if (d["next"]) return "next";
@@ -2947,10 +3000,10 @@ function detectDeploymentShapes(cwd, opts = {}) {
     boundary = realpathSync2(boundary);
   } catch {
   }
-  const inProject = (path16) => {
+  const inProject = (path17) => {
     if (opts.followOutside) return true;
     try {
-      return isInside(realpathSync2(path16), boundary);
+      return isInside(realpathSync2(path17), boundary);
     } catch {
       return false;
     }
@@ -3016,7 +3069,7 @@ function holdsSourceFile(dir) {
 }
 
 // src/map/surface.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { join as join3 } from "path";
 var STATIC_GENERATORS = [
   { dep: "vite", label: "vite" },
@@ -3058,7 +3111,7 @@ var SHAPE_SIGNAL = {
 };
 function readManifest(cwd) {
   try {
-    const parsed = JSON.parse(readFileSync3(join3(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync4(join3(cwd, "package.json"), "utf8"));
     return typeof parsed === "object" && parsed !== null ? parsed : null;
   } catch {
     return null;
@@ -3071,7 +3124,7 @@ function nextExportsStatically(cwd, manifest, ts) {
   for (const file of ["next.config.js", "next.config.mjs", "next.config.ts", "next.config.cjs"]) {
     let text;
     try {
-      text = readFileSync3(join3(cwd, file), "utf8");
+      text = readFileSync4(join3(cwd, file), "utf8");
     } catch {
       continue;
     }
@@ -3230,7 +3283,7 @@ var SERVING_CALL = /\b(?:createServer|createSecureServer|Bun\.serve|Deno\.serve|
 var MAX_ENTRY_BYTES = 256 * 1024;
 function readManifest2(cwd) {
   try {
-    const parsed = JSON.parse(readFileSync4(path9.join(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync5(path10.join(cwd, "package.json"), "utf8"));
     return typeof parsed === "object" && parsed !== null ? parsed : {};
   } catch {
     return {};
@@ -3259,16 +3312,16 @@ function staticGenerators(deps) {
 }
 function serverEntries(cwd, manifest) {
   const candidates = new Set(SERVER_ENTRY_CANDIDATES);
-  if (typeof manifest.main === "string" && manifest.main !== "" && !path9.isAbsolute(manifest.main)) {
-    const main2 = path9.normalize(manifest.main);
+  if (typeof manifest.main === "string" && manifest.main !== "" && !path10.isAbsolute(manifest.main)) {
+    const main2 = path10.normalize(manifest.main);
     if (!main2.startsWith("..")) candidates.add(main2);
   }
   const found = [];
   for (const relative7 of candidates) {
-    const file = path9.join(cwd, relative7);
+    const file = path10.join(cwd, relative7);
     try {
       if (!existsSync2(file) || !statSync3(file).isFile()) continue;
-      const text = readFileSync4(file, "utf8").slice(0, MAX_ENTRY_BYTES);
+      const text = readFileSync5(file, "utf8").slice(0, MAX_ENTRY_BYTES);
       if (SERVING_CALL.test(text)) found.push(relative7);
     } catch {
     }
@@ -3322,10 +3375,10 @@ function classifyArchitecture(cwd) {
 }
 
 // src/protect/install/util.ts
-import { readFileSync as readFileSync5, existsSync as existsSync3, writeFileSync as writeFileSync2 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync3, writeFileSync as writeFileSync2 } from "fs";
 import { join as join4, dirname } from "path";
 import { fileURLToPath } from "url";
-var read = (p) => readFileSync5(p, "utf8");
+var read = (p) => readFileSync6(p, "utf8");
 var log = (msg) => console.log(`patchstack protect: ${msg}`);
 function hasDependency(cwd, name) {
   try {
@@ -3798,7 +3851,7 @@ var nuxtAdapter = {
 };
 
 // src/protect/install/find-app.ts
-import { readFileSync as readFileSync6, existsSync as existsSync7, readdirSync as readdirSync3, lstatSync } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync7, readdirSync as readdirSync3, lstatSync } from "fs";
 import { join as join10, relative as relative2, dirname as dirname3 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   "node_modules",
@@ -3844,7 +3897,7 @@ function findAppInstance(cwd, re) {
       else if (/\.(?:ts|js|mjs|cjs)$/.test(name)) {
         let src;
         try {
-          src = readFileSync6(p, "utf8");
+          src = readFileSync7(p, "utf8");
         } catch {
           continue;
         }
@@ -3891,7 +3944,7 @@ function declaredEntries(cwd) {
   const paths = /* @__PURE__ */ new Set();
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync6(join10(cwd, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync7(join10(cwd, "package.json"), "utf8"));
   } catch {
     return paths;
   }
@@ -3921,7 +3974,7 @@ import { writeFileSync as writeFileSync5, existsSync as existsSync10 } from "fs"
 import { join as join13, resolve as resolve2 } from "path";
 
 // src/protect/install/generic.ts
-import { readFileSync as readFileSync7, existsSync as existsSync9, mkdirSync as mkdirSync4, copyFileSync as copyFileSync4, readdirSync as readdirSync4, lstatSync as lstatSync2 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync9, mkdirSync as mkdirSync4, copyFileSync as copyFileSync4, readdirSync as readdirSync4, lstatSync as lstatSync2 } from "fs";
 import { join as join12, dirname as dirname5 } from "path";
 
 // src/protect/install/source-scope.ts
@@ -4473,7 +4526,7 @@ function guardIsImported(cwd, guardPath) {
       if (st.isDirectory()) walk2(p, depth + 1);
       else if (/\.(?:ts|tsx|js|jsx|mjs|cjs)$/.test(name) && p !== guardPath) {
         try {
-          if (importsAndUsesGuard(readFileSync7(p, "utf8"), p, guardDir, packageIsModule)) found = true;
+          if (importsAndUsesGuard(readFileSync8(p, "utf8"), p, guardDir, packageIsModule)) found = true;
         } catch {
         }
       }
@@ -4957,8 +5010,8 @@ function runVerify(cwd) {
 }
 
 // src/widget.ts
-import { existsSync as existsSync12, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
-import path10 from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "fs";
+import path11 from "path";
 var WIDGET_SCRIPT_URL = "https://cdn.patchstack.com/patchstack-widget.js";
 var WIDGET_MARKER_ATTR = "data-patchstack-connect-widget";
 var WIDGET_NEEDLE = "patchstack-widget";
@@ -4996,19 +5049,22 @@ ${indent}</body>`;
 }
 function findSourceShell(cwd) {
   for (const candidate of SOURCE_SHELL_CANDIDATES) {
-    if (existsSync12(path10.join(cwd, candidate))) {
+    if (existsSync12(path11.join(cwd, candidate))) {
       return candidate;
     }
   }
   return null;
 }
-function ensureSourceWidget(cwd, siteUuid) {
-  const shell = findSourceShell(cwd);
+function ensureSourceWidget(cwd, siteUuid, jsxShell = null) {
+  const shell = findSourceShell(cwd) ?? jsxShell;
   if (shell === null) {
     return { shell: null, action: "no-shell" };
   }
-  const file = path10.join(cwd, shell);
-  const before = readFileSync8(file, "utf8");
+  const file = path11.join(cwd, shell);
+  if (!existsSync12(file)) {
+    return { shell: null, action: "no-shell" };
+  }
+  const before = readFileSync9(file, "utf8");
   const { html, action } = ensureWidgetInHtml(before, siteUuid);
   if (html !== before) {
     writeFileSync6(file, html);
@@ -5090,7 +5146,7 @@ function detectPackageManager(cwd) {
     return declared;
   }
   for (const { filename, pm } of PM_BY_LOCKFILE) {
-    if (existsSync13(path11.join(cwd, filename))) {
+    if (existsSync13(path12.join(cwd, filename))) {
       return pm;
     }
   }
@@ -5101,7 +5157,7 @@ function installCommand(pm) {
 }
 function readPackageJson(cwd) {
   try {
-    return JSON.parse(readFileSync9(path11.join(cwd, "package.json"), "utf8"));
+    return JSON.parse(readFileSync10(path12.join(cwd, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -5109,7 +5165,7 @@ function readPackageJson(cwd) {
 function installedVersion(cwd, declaredRange) {
   try {
     const pkg = JSON.parse(
-      readFileSync9(path11.join(cwd, "node_modules", "@patchstack", "connect", "package.json"), "utf8")
+      readFileSync10(path12.join(cwd, "node_modules", "@patchstack", "connect", "package.json"), "utf8")
     );
     if (typeof pkg.version === "string" && pkg.version.length > 0) {
       return pkg.version;
@@ -5137,7 +5193,7 @@ function findWidgetMarker(cwd, siteUuid) {
       if (budget <= 0 || settled()) {
         return;
       }
-      const full = path11.join(dir, entry.name);
+      const full = path12.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (SKIPPED_DIRS.has(entry.name) || entry.name.startsWith(".")) {
           continue;
@@ -5145,7 +5201,7 @@ function findWidgetMarker(cwd, siteUuid) {
         walk2(full, depth + 1);
         continue;
       }
-      if (!entry.isFile() || !WIDGET_EXTENSIONS.has(path11.extname(entry.name).toLowerCase())) {
+      if (!entry.isFile() || !WIDGET_EXTENSIONS.has(path12.extname(entry.name).toLowerCase())) {
         continue;
       }
       budget -= 1;
@@ -5153,7 +5209,7 @@ function findWidgetMarker(cwd, siteUuid) {
         if (statSync4(full).size > WIDGET_SCAN_MAX_BYTES) {
           continue;
         }
-        const content = readFileSync9(full, "utf8");
+        const content = readFileSync10(full, "utf8");
         if (!content.includes(WIDGET_NEEDLE2)) {
           continue;
         }
@@ -5176,7 +5232,7 @@ function findProductionMarker(cwd, widgetFileHint) {
     return false;
   }
   try {
-    return readFileSync9(path11.join(cwd, widgetFileHint), "utf8").includes(PROD_MARKER_NEEDLE);
+    return readFileSync10(path12.join(cwd, widgetFileHint), "utf8").includes(PROD_MARKER_NEEDLE);
   } catch {
     return false;
   }
@@ -5187,7 +5243,7 @@ function resolveWidgetFileHint(cwd, framework) {
     ...GENERIC_WIDGET_FILES
   ];
   for (const candidate of candidates) {
-    if (existsSync13(path11.join(cwd, candidate))) {
+    if (existsSync13(path12.join(cwd, candidate))) {
       return candidate;
     }
   }
@@ -5295,7 +5351,7 @@ function renderGuideChecklist(state, useColor) {
   const headerParts = [state.framework, state.packageManager].filter(
     (part) => part !== null
   );
-  const name = state.projectName ?? path11.basename(process.cwd());
+  const name = state.projectName ?? path12.basename(process.cwd());
   lines.push(paint(ANSI.bold, `Patchstack setup status \u2014 ${name} (${headerParts.join(" \xB7 ")})`));
   if (state.endpointOverride !== null) {
     lines.push(
@@ -5476,12 +5532,12 @@ function renderGuideChecklist(state, useColor) {
 // src/login.ts
 import { mkdtempSync } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import path13 from "path";
+import path14 from "path";
 
 // src/device-flow.ts
-import { readFileSync as readFileSync10, rmSync, writeFileSync as writeFileSync7 } from "fs";
+import { readFileSync as readFileSync11, rmSync, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir } from "os";
-import path12 from "path";
+import path13 from "path";
 import { createHash as createHash2 } from "crypto";
 function baseFrom(manifestEndpoint) {
   const url = new URL(manifestEndpoint);
@@ -5493,7 +5549,7 @@ function baseFrom(manifestEndpoint) {
 }
 function pendingPath(siteUuid, intent) {
   const key = createHash2("sha256").update(siteUuid).digest("hex").slice(0, 16);
-  return path12.join(tmpdir(), `patchstack-${intent}-${key}.json`);
+  return path13.join(tmpdir(), `patchstack-${intent}-${key}.json`);
 }
 function savePending(siteUuid, intent, pending) {
   writeFileSync7(pendingPath(siteUuid, intent), JSON.stringify(pending), {
@@ -5503,7 +5559,7 @@ function savePending(siteUuid, intent, pending) {
 }
 function readPending(siteUuid, intent) {
   try {
-    return JSON.parse(readFileSync10(pendingPath(siteUuid, intent), "utf8"));
+    return JSON.parse(readFileSync11(pendingPath(siteUuid, intent), "utf8"));
   } catch {
     return null;
   }
@@ -5673,7 +5729,7 @@ async function claim2(config, onPrompt, deps = {}) {
 import { relative as relative3 } from "path";
 
 // src/protect/install/runtime/entry.ts
-import { existsSync as existsSync14, readFileSync as readFileSync11, realpathSync as realpathSync3, statSync as statSync5 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync12, realpathSync as realpathSync3, statSync as statSync5 } from "fs";
 import { join as join15, resolve as resolve3, sep } from "path";
 var CONVENTIONAL = [
   "server.js",
@@ -5700,15 +5756,15 @@ var CONVENTIONAL = [
 var LOADABLE = /\.(?:js|mjs|cjs)$/;
 function readPackage2(cwd) {
   try {
-    const parsed = JSON.parse(readFileSync11(join15(cwd, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync12(join15(cwd, "package.json"), "utf8"));
     return parsed !== null && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
   }
 }
-function isFile(path16) {
+function isFile(path17) {
   try {
-    return statSync5(path16).isFile();
+    return statSync5(path17).isFile();
   } catch {
     return false;
   }
@@ -5717,14 +5773,14 @@ function loadable(cwd, candidate) {
   const written = resolve3(cwd, candidate);
   if (!LOADABLE.test(written) || !isFile(written)) return null;
   let root;
-  let path16;
+  let path17;
   try {
     root = realpathSync3(cwd);
-    path16 = realpathSync3(written);
+    path17 = realpathSync3(written);
   } catch {
     return null;
   }
-  if (path16 !== root && !path16.startsWith(root + sep)) return null;
+  if (path17 !== root && !path17.startsWith(root + sep)) return null;
   return written;
 }
 function passable(token) {
@@ -5804,8 +5860,8 @@ function preloadPath() {
     // beside this file, in the repository
   ];
   for (const candidate of candidates) {
-    const path16 = fileURLToPath2(candidate);
-    if (existsSync15(path16)) return path16;
+    const path17 = fileURLToPath2(candidate);
+    if (existsSync15(path17)) return path17;
   }
   return null;
 }
@@ -6175,7 +6231,7 @@ async function loadTypeScript(cwd) {
 }
 
 // src/map/extract.ts
-import { readFileSync as readFileSync14, realpathSync as realpathSync5 } from "fs";
+import { readFileSync as readFileSync15, realpathSync as realpathSync5 } from "fs";
 import { createHash as createHash5 } from "crypto";
 import { relative as relative5 } from "path";
 
@@ -6589,7 +6645,7 @@ function dedupeSinks(sinks, owner) {
 }
 
 // src/map/module-graph.ts
-import { readFileSync as readFileSync12, realpathSync as realpathSync4, statSync as statSync6 } from "fs";
+import { readFileSync as readFileSync13, realpathSync as realpathSync4, statSync as statSync6 } from "fs";
 import { dirname as dirname7, join as join17, relative as relative4, resolve as resolvePath } from "path";
 var RESOLVE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 function createModuleGraph(ts, opts) {
@@ -6598,7 +6654,7 @@ function createModuleGraph(ts, opts) {
     if (cache.has(file)) return cache.get(file) ?? null;
     let entry = null;
     try {
-      const text = readFileSync12(file, "utf8");
+      const text = readFileSync13(file, "utf8");
       const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
       const bindings = buildModuleBindings(sf, ts);
       entry = { fnSinks: collectLocalSinks(sf, ts, bindings), calleesOf: collectCallees(sf, ts), bindings };
@@ -6697,8 +6753,8 @@ function collectCallees(sf, ts) {
 }
 
 // src/map/coordinates.ts
-function runtimeCoordinate(source, path16) {
-  if (/\[\d*\]/.test(path16)) {
+function runtimeCoordinate(source, path17) {
+  if (/\[\d*\]/.test(path17)) {
     return { runtimeParameter: null, runtimeParameterReason: "array traversal: needs an array_key_value rule, not a dotted parameter" };
   }
   switch (source) {
@@ -6707,15 +6763,15 @@ function runtimeCoordinate(source, path16) {
     case "multipart":
     case "body":
     case "server-fn-data":
-      return { runtimeParameter: `post.${path16}` };
+      return { runtimeParameter: `post.${path17}` };
     case "query":
-      return { runtimeParameter: `get.${path16}` };
+      return { runtimeParameter: `get.${path17}` };
     case "cookie":
-      return { runtimeParameter: `cookie.${path16}` };
+      return { runtimeParameter: `cookie.${path17}` };
     case "file":
-      return { runtimeParameter: `files.${path16}` };
+      return { runtimeParameter: `files.${path17}` };
     case "header":
-      return { runtimeParameter: `server.HTTP_${path16.toUpperCase().replace(/-/g, "_")}` };
+      return { runtimeParameter: `server.HTTP_${path17.toUpperCase().replace(/-/g, "_")}` };
     case "route-param":
       return { runtimeParameter: null, runtimeParameterReason: "route parameters are not exposed by the runtime resolver" };
     default:
@@ -6747,8 +6803,8 @@ function addressSpaceOf(source) {
 function isProvenFlow(confidence) {
   return confidence === "exact-local" || confidence === "transformed-local";
 }
-function inputIdOf(source, path16) {
-  return `${addressSpaceOf(source)}:${path16}`;
+function inputIdOf(source, path17) {
+  return `${addressSpaceOf(source)}:${path17}`;
 }
 function withCoordinates(fields, source) {
   return fields.map((f) => {
@@ -6958,8 +7014,8 @@ function linkFlows(bodyNode, params, inputs, sinks, ts) {
   if (!bodyNode || sinks.length === 0 || inputs.length === 0) return { flows: [], limitations: [] };
   const CONTAINER_KEYS = /* @__PURE__ */ new Set([...REQ_SOURCES, "data", "input", "payload"]);
   const rootPath = /* @__PURE__ */ new Map();
-  const addRoot = (name, path16, space) => {
-    if (!rootPath.has(name)) rootPath.set(name, { path: path16, space });
+  const addRoot = (name, path17, space) => {
+    if (!rootPath.has(name)) rootPath.set(name, { path: path17, space });
   };
   for (const p of params ?? []) {
     if (!p?.name) continue;
@@ -7104,8 +7160,8 @@ function dedupeLimitations(list) {
 function join22(base, seg) {
   return base ? `${base}.${seg}` : seg;
 }
-function normalizePath(path16) {
-  return path16.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
+function normalizePath(path17) {
+  return path17.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
 }
 function fluentChainCalls(call, ts) {
   let root = call;
@@ -7351,7 +7407,7 @@ function handlerEntry(name, kindLabel, params, body, ts, localSinks, bindings, c
 }
 
 // src/map/imports.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { join as join18 } from "path";
 var MAX_SITES = 5;
 var NPM_NAME = /^(?:@[^/@\s~][^/@\s]*\/)?[^/@\s.~][^/@\s]*$/;
@@ -7363,7 +7419,7 @@ function readPathAliases(cwd) {
   for (const name of ["tsconfig.json", "jsconfig.json"]) {
     let paths;
     try {
-      const raw = readFileSync13(join18(cwd, name), "utf8");
+      const raw = readFileSync14(join18(cwd, name), "utf8");
       const parsed = JSON.parse(stripJsonComments(raw));
       paths = parsed.compilerOptions?.paths;
     } catch {
@@ -7742,7 +7798,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   const hopTargets = /* @__PURE__ */ new Set();
   for (const file of files) {
     try {
-      const text = readFileSync14(file, "utf8");
+      const text = readFileSync15(file, "utf8");
       const relFile = relative5(cwd, file);
       sourceBytes += text.length;
       if (!hasEntrySignal(text)) {
@@ -7797,7 +7853,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   for (const target of hopTargets) {
     if (entryFiles.has(target)) continue;
     try {
-      const text = readFileSync14(target, "utf8");
+      const text = readFileSync15(target, "utf8");
       const sf = ts.createSourceFile(target, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, target));
       const bindings = buildModuleBindings(sf, ts);
       const called = collectInvocations(sf, ts, bindings, { file: target, owner: relative5(cwd, target), graph });
@@ -7946,7 +8002,7 @@ function getStringFlag(flags, name) {
 }
 
 // src/build-stamp.ts
-import { chmodSync, lstatSync as lstatSync3, readFileSync as readFileSync15, readdirSync as readdirSync6, realpathSync as realpathSync6, renameSync, unlinkSync, writeFileSync as writeFileSync8 } from "fs";
+import { chmodSync, lstatSync as lstatSync3, readFileSync as readFileSync16, readdirSync as readdirSync6, realpathSync as realpathSync6, renameSync, unlinkSync, writeFileSync as writeFileSync8 } from "fs";
 import { join as join19, relative as relative6, sep as sep2 } from "path";
 var RULES_FILE_NAMES = /* @__PURE__ */ new Set(["rules.json", "patchstack.rules.json"]);
 var SKIP_DIRECTORIES = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "out", "coverage", "tmp", "vendor"]);
@@ -7965,11 +8021,11 @@ function guardImportsRulesFile(dir, rulesName) {
   }
   for (const name of siblings) {
     if (!GUARD_SOURCE.test(name)) continue;
-    const path16 = join19(dir, name);
+    const path17 = join19(dir, name);
     try {
-      const entry = lstatSync3(path16);
+      const entry = lstatSync3(path17);
       if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_GUARD_SOURCE_BYTES) continue;
-      const source = stripComments(readFileSync15(path16, "utf8"));
+      const source = stripComments(readFileSync16(path17, "utf8"));
       if (source.includes("@patchstack/connect/protect") && importsRules.test(source)) return true;
     } catch {
     }
@@ -7990,9 +8046,9 @@ function findRulesFile(cwd) {
   } catch {
     return { kind: "none" };
   }
-  const contained = (path16) => {
+  const contained = (path17) => {
     try {
-      const real = realpathSync6(path16);
+      const real = realpathSync6(path17);
       return real === root || real.startsWith(root + sep2);
     } catch {
       return false;
@@ -8008,25 +8064,25 @@ function findRulesFile(cwd) {
     }
     for (const name of entries) {
       if (name.startsWith(".")) continue;
-      const path16 = join19(dir, name);
+      const path17 = join19(dir, name);
       let entry;
       try {
-        entry = lstatSync3(path16);
+        entry = lstatSync3(path17);
       } catch {
         continue;
       }
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
-        if (!SKIP_DIRECTORIES.has(name)) walk2(path16, depth + 1);
+        if (!SKIP_DIRECTORIES.has(name)) walk2(path17, depth + 1);
         continue;
       }
       if (!entry.isFile() || !RULES_FILE_NAMES.has(name)) continue;
-      if (!contained(path16)) continue;
+      if (!contained(path17)) continue;
       if (!guardImportsRulesFile(dir, name)) continue;
       try {
-        if (isRuleBundle(JSON.parse(readFileSync15(path16, "utf8")))) found.push(path16);
+        if (isRuleBundle(JSON.parse(readFileSync16(path17, "utf8")))) found.push(path17);
       } catch {
-        unreadable.push(path16);
+        unreadable.push(path17);
       }
     }
   };
@@ -8057,7 +8113,7 @@ function applyBuildStamp(cwd, id) {
   const file = relative6(cwd, location.path);
   let text;
   try {
-    text = readFileSync15(location.path, "utf8");
+    text = readFileSync16(location.path, "utf8");
   } catch (err) {
     return { kind: "skipped", reason: `${file} could not be read (${err.message})` };
   }
@@ -8275,8 +8331,8 @@ async function runMap(flags) {
 }
 
 // src/setup.ts
-import { readFileSync as readFileSync16, writeFileSync as writeFileSync10 } from "fs";
-import path14 from "path";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "fs";
+import path15 from "path";
 var SCAN_COMMAND = "patchstack-connect scan";
 var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
 function setupProtection(cwd) {
@@ -8301,8 +8357,8 @@ function prependHook(existing, command) {
   return [command, ...remaining].join(" && ");
 }
 function wireBuildScripts(cwd, packageManager) {
-  const target = path14.join(cwd, "package.json");
-  const raw = readFileSync16(target, "utf8");
+  const target = path15.join(cwd, "package.json");
+  const raw = readFileSync17(target, "utf8");
   const pkg = JSON.parse(raw);
   const scripts = pkg.scripts ?? {};
   const build = scripts.build;
@@ -8411,6 +8467,10 @@ Usage:
   patchstack-connect mark-build [options]            Stamp built HTML with a production flag +
                                                      build fingerprint, and ensure the widget
                                                      tag in built pages (run as a postbuild step).
+                                                     The flag marks a page as the LIVE site, so it
+                                                     is stamped only on a production build; a local
+                                                     or preview build gets the widget tag and no
+                                                     marker (and any stale marker is removed).
                                                      Looks in the framework's own output dir, an
                                                      --output the build script names, then dist/,
                                                      build/, out/, .output/public/, _site/ \u2014 inside
@@ -8496,8 +8556,15 @@ Options (for scan, setup, status, and uninstall):
                           too. Never written to a file, never printed back
 
 Options (for mark-build):
-  --dir <path>            Build output directory (default: auto-detect
-                          dist/ build/ out/ .output/public)
+  --dir <path>            Build output directory (default: auto-detect the
+                          framework's own output dir, an --output the build
+                          script names, then dist/ build/ out/ .output/public/
+                          _site/ \u2014 inside the project only)
+  --production            Stamp the live-site marker on a build this command
+                          cannot tell is a deployment \u2014 publishing a static
+                          build by hand from a laptop, say. PATCHSTACK_ENVIRONMENT=production
+                          does the same. Never needed on a hosting platform,
+                          whose own build is recognised
 
 Options (for demo and demo-guide):
   --url <url>             Test endpoint printed at the end
@@ -8867,8 +8934,9 @@ async function runScan(args, options = {}) {
     const cleared = applyBuildStamp(process.cwd(), null);
     if (cleared.kind === "cleared") console.log(`Removed the previous map binding from ${cleared.file}.`);
   }
+  const shellFramework = detectStack(payload.packages).framework;
   if (config.widget) {
-    reportSourceMarker(detectStack(payload.packages).framework);
+    reportSourceMarker(shellFramework, computeManifestChecksum(payload.packages));
   }
   const provisioning = config.siteUuid === null;
   if (provisioning) {
@@ -8914,7 +8982,7 @@ async function runScan(args, options = {}) {
   const connected = response.claim?.state === "claimed" || response.claim?.state === "owned-by-you";
   const effectiveUuid = config.siteUuid ?? response.uuid ?? null;
   if (config.widget && effectiveUuid !== null && effectiveUuid.length > 0) {
-    reportSourceWidget(effectiveUuid);
+    reportSourceWidget(effectiveUuid, shellFramework);
   }
   const linkUuid = response.uuid ?? config.siteUuid;
   if (!connected && (provisioning || claimLines.length > 0) && linkUuid !== null && linkUuid !== void 0 && linkUuid.length > 0) {
@@ -8945,9 +9013,11 @@ async function runScan(args, options = {}) {
   }
   return 0;
 }
-function reportSourceWidget(siteUuid) {
+function reportSourceWidget(siteUuid, framework) {
   try {
-    const result = ensureSourceWidget(process.cwd(), siteUuid);
+    const hint = hasJsxShell(framework) ? resolveWidgetFileHint(process.cwd(), framework) : null;
+    const jsxShell = hint !== null && !hint.toLowerCase().endsWith(".html") ? hint : null;
+    const result = ensureSourceWidget(process.cwd(), siteUuid, jsxShell);
     switch (result.action) {
       case "added":
         console.log(`Widget: added the "Report a vulnerability" tag to ${result.shell}. Reload your preview to see it.`);
@@ -8966,7 +9036,7 @@ function reportSourceWidget(siteUuid) {
         console.log(`  ${buildWidgetTag(siteUuid)}`);
         break;
       case "no-shell":
-        console.log("Widget: no plain HTML shell found (index.html / public/index.html / src/app.html).");
+        console.log("Widget: no root shell found to edit (index.html / public/index.html / src/app.html, or a JSX root).");
         console.log("Add this tag to your root layout before </body> (run `guide` for framework-specific placement):");
         console.log(`  ${buildWidgetTag(siteUuid)}`);
         break;
@@ -8978,13 +9048,13 @@ function reportSourceWidget(siteUuid) {
     console.warn(`Widget: skipped (${err.message}).`);
   }
 }
-function reportSourceMarker(framework) {
+function reportSourceMarker(framework, checksum = null) {
   try {
     const shell = resolveWidgetFileHint(process.cwd(), framework);
     if (shell === null || shell.toLowerCase().endsWith(".html")) {
       return;
     }
-    const result = ensureSourceMarker(process.cwd(), shell, framework);
+    const result = ensureSourceMarker(process.cwd(), shell, framework, checksum);
     switch (result.action) {
       case "added":
         console.log(`Production marker: added to ${shell} (guarded by ${productionGate(framework)}).`);
@@ -9171,7 +9241,7 @@ async function runGuide(args) {
   console.log("\u2014\u2014\u2014\u2014 Full reference guide (ships as AGENT-INSTALL.md) \u2014\u2014\u2014\u2014");
   console.log("");
   const guidePath = new URL("../AGENT-INSTALL.md", import.meta.url);
-  console.log(readFileSync17(guidePath, "utf8"));
+  console.log(readFileSync18(guidePath, "utf8"));
   return 0;
 }
 async function runSetup(args) {
@@ -9346,7 +9416,7 @@ function describeStack(stack) {
 }
 function readBuildScript(cwd) {
   try {
-    const pkg = JSON.parse(readFileSync17(path15.join(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync18(path16.join(cwd, "package.json"), "utf8"));
     return pkg.scripts?.build;
   } catch {
     return void 0;
@@ -9354,6 +9424,7 @@ function readBuildScript(cwd) {
 }
 async function runMarkBuild(args) {
   const cwd = process.cwd();
+  const startedAt = Date.now();
   let checksum = null;
   let stack = null;
   try {
@@ -9370,6 +9441,8 @@ async function runMarkBuild(args) {
     );
   }
   let widgetUuid = null;
+  let environment = "local";
+  let environmentEvidence = [];
   try {
     const config = await resolveConfig({
       cwd,
@@ -9378,11 +9451,15 @@ async function runMarkBuild(args) {
     if (config.widget) {
       widgetUuid = config.siteUuid;
     }
+    environment = config.environment;
+    environmentEvidence = config.environmentEvidence ?? [];
   } catch (err) {
     console.warn(
       `mark-build: could not resolve the site UUID (${err.message}). Skipping the widget pass.`
     );
   }
+  const forcedProduction = args.flags.get("production") === true;
+  const published = forcedProduction || marksPublishedBuild(environment);
   const buildDirOptions = { framework: stack?.framework ?? null, buildScript: readBuildScript(cwd) };
   const dir = resolveBuildDir(cwd, getStringFlag(args.flags, "dir"), buildDirOptions);
   if (dir === null) {
@@ -9406,11 +9483,20 @@ async function runMarkBuild(args) {
     );
     return 0;
   }
-  const snippet = buildInjectionSnippet(checksum, stack);
+  const staleBy = staleBuildAge(files, startedAt);
+  if (staleBy !== null) {
+    console.warn(
+      `mark-build: nothing in ${dir} has been written in the last ${Math.round(staleBy / 6e4)} minute(s), so this looks like output from an earlier build.`
+    );
+    console.warn(
+      "mark-build: run it as a postbuild hook (or straight after the build) so what is stamped is what was just produced."
+    );
+  }
+  const snippet = published ? buildInjectionSnippet(checksum, stack) : "";
   let marked = 0;
   let widgetTouched = 0;
   for (const file of files) {
-    const before = readFileSync17(file, "utf8");
+    const before = readFileSync18(file, "utf8");
     let after = injectMarker(before, snippet);
     if (widgetUuid !== null) {
       const ensured = ensureWidgetInHtml(after, widgetUuid);
@@ -9425,8 +9511,21 @@ async function runMarkBuild(args) {
     }
   }
   const stackSummary = stack !== null ? describeStack(stack) : null;
+  if (published) {
+    console.log(
+      `mark-build: marked ${marked} HTML file(s) in ${dir}${checksum !== null ? ` (build ${checksum})` : ""}${widgetTouched > 0 ? `, widget tag ensured in ${widgetTouched}` : ""}${stackSummary !== null ? ` [${stackSummary}]` : ""}.`
+    );
+    return 0;
+  }
+  const because = environmentEvidence.length > 0 ? ` (${environmentEvidence.join("; ")})` : "";
+  console.log(
+    `mark-build: ${environment} build${because} \u2014 production marker withheld from ${files.length} HTML file(s) in ${dir}${widgetTouched > 0 ? `, widget tag ensured in ${widgetTouched}` : ""}${stackSummary !== null ? ` [${stackSummary}]` : ""}.`
+  );
+  console.log(
+    "mark-build: the marker tells Patchstack a page is the live site, so only the build that deploys carries it. Your hosting platform's build stamps it automatically."
+  );
   console.log(
-    `mark-build: marked ${marked} HTML file(s) in ${dir}${checksum !== null ? ` (build ${checksum})` : ""}${widgetTouched > 0 ? `, widget tag ensured in ${widgetTouched}` : ""}${stackSummary !== null ? ` [${stackSummary}]` : ""}.`
+    "mark-build: publishing this directory by hand? Re-run with --production (or set PATCHSTACK_ENVIRONMENT=production) so the deployed pages carry it."
   );
   return 0;
 }