@patchstack/connect 0.5.6 → 0.5.8

package/dist/index.cjs

@@ -1254,8 +1254,8 @@ function compareSegments(a, b) {
 var RULES = [
   { platform: "netlify", any: ["NETLIFY", "NETLIFY_BUILD_BASE", "DEPLOY_PRIME_URL"] },
   { platform: "vercel", any: ["VERCEL", "VERCEL_ENV", "VERCEL_URL"] },
-  { platform: "cloudflare", any: ["CF_PAGES", "CF_PAGES_URL", "CLOUDFLARE_ACCOUNT_ID"] },
-  { platform: "aws", any: ["AWS_APP_ID", "AWS_LAMBDA_FUNCTION_NAME", "AWS_EXECUTION_ENV"] },
+  { platform: "cloudflare", any: ["CF_PAGES", "CF_PAGES_URL", "WORKERS_CI", "WORKERS_CI_BRANCH", "CLOUDFLARE_ACCOUNT_ID"] },
+  { platform: "aws", any: ["AWS_APP_ID", "AWS_BRANCH", "AWS_LAMBDA_FUNCTION_NAME", "AWS_EXECUTION_ENV"] },
   { platform: "render", any: ["RENDER", "RENDER_SERVICE_ID", "RENDER_EXTERNAL_URL"] },
   { platform: "railway", any: ["RAILWAY_ENVIRONMENT", "RAILWAY_ENVIRONMENT_NAME", "RAILWAY_PROJECT_ID"] },
   { platform: "fly", any: ["FLY_APP_NAME", "FLY_REGION", "FLY_ALLOC_ID"] },
@@ -1278,6 +1278,128 @@ function detectHostingPlatform(env = process.env) {
   return { platform: null, evidence: [] };
 }
 
+// src/protect/safe-origin.js
+function isSafeOrigin(value) {
+  try {
+    const u = new URL(value);
+    if (u.protocol === "https:") return true;
+    return u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]" || u.hostname === "::1");
+  } catch {
+    return false;
+  }
+}
+
+// src/endpoint-policy.ts
+function assertConnectableEndpoint(config, target = config.endpoint) {
+  if (config.endpointTrusted === false) {
+    throw new PatchstackError(
+      "The custom endpoint in .patchstackrc.json must be confirmed with --endpoint or PATCHSTACK_ENDPOINT before it can be used.",
+      "CONFIG_INVALID"
+    );
+  }
+  if (safeRemoteUrl(config.endpoint) === null) {
+    throw new PatchstackError(
+      "Patchstack endpoints must use HTTPS, except for localhost development endpoints.",
+      "CONFIG_INVALID"
+    );
+  }
+  let endpointOrigin;
+  let targetOrigin;
+  try {
+    endpointOrigin = new URL(config.endpoint).origin;
+    targetOrigin = new URL(target).origin;
+  } catch (cause) {
+    throw new PatchstackError("The configured Patchstack endpoint is not a valid URL.", "CONFIG_INVALID", cause);
+  }
+  if (safeRemoteUrl(target) === null || targetOrigin !== endpointOrigin) {
+    throw new PatchstackError(
+      "A Patchstack request resolved outside the configured endpoint origin.",
+      "CONFIG_INVALID"
+    );
+  }
+}
+function safeRemoteUrl(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 2048) return null;
+  try {
+    const parsed = new URL(value);
+    if (!isSafeOrigin(parsed.toString()) || parsed.username !== "" || parsed.password !== "") return null;
+    return parsed.toString();
+  } catch {
+    return null;
+  }
+}
+function safeDisplayString(value, maxLength = 512) {
+  if (typeof value !== "string") return null;
+  const clean = value.replace(/\u001b(?:\[[0-?]*[ -/]*[@-~]|\][^\u0007]*(?:\u0007|\u001b\\))/g, "").replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").replace(/\s+/g, " ").trim();
+  if (clean.length === 0) return null;
+  return clean.slice(0, maxLength);
+}
+function isCanonicalUuid(value) {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}
+function isCredential(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 4096) return false;
+  for (let i = 0; i < value.length; i += 1) {
+    const code = value.charCodeAt(i);
+    if (code < 33 || code > 126) return false;
+  }
+  const separator = value.lastIndexOf("-");
+  return separator > 0 && separator < value.length - 1 && /^\d+$/.test(value.slice(separator + 1));
+}
+function isHeaderValue(value, maxLength = 8192) {
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength) return false;
+  for (let i = 0; i < value.length; i += 1) {
+    const code = value.charCodeAt(i);
+    if (code < 33 || code > 126) return false;
+  }
+  return true;
+}
+
+// src/bounded-response.ts
+var MAX_CONTROL_RESPONSE_BYTES = 256 * 1024;
+async function readBoundedText(response, maxBytes = MAX_CONTROL_RESPONSE_BYTES) {
+  const stated2 = Number(response.headers?.get?.("content-length"));
+  if (Number.isFinite(stated2) && stated2 > maxBytes) {
+    void response.body?.cancel().catch(() => {
+    });
+    throw new Error(`response exceeds ${maxBytes} bytes`);
+  }
+  const stream = response.body;
+  if (stream === null || typeof stream.getReader !== "function") {
+    if (stated2 === 0) return "";
+    throw new Error("response body cannot be read with a size bound");
+  }
+  const reader = stream.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        void reader.cancel().catch(() => {
+        });
+        throw new Error(`response exceeds ${maxBytes} bytes`);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(bytes);
+}
+async function readBoundedJson(response, maxBytes = MAX_CONTROL_RESPONSE_BYTES) {
+  const text = await readBoundedText(response, maxBytes);
+  return JSON.parse(text);
+}
+
 // src/pulse-token.ts
 var TOKEN_SKEW_MS = 6e4;
 function buildTokenUrl(manifestEndpoint) {
@@ -1295,22 +1417,48 @@ function parsePulseAuth(credential) {
   if (!/^\d+$/.test(clientId)) return null;
   return { clientId, clientSecret: credential.slice(0, index) };
 }
-var cached = null;
-var inflight = null;
-function clearPulseToken() {
-  cached = null;
+var cached = /* @__PURE__ */ new Map();
+var inflight = /* @__PURE__ */ new Map();
+function cacheKey(tokenUrl, credential) {
+  return `${tokenUrl}
+${credential}`;
+}
+function clearPulseToken(config) {
+  if (!config || typeof config.pulseAuth !== "string") {
+    cached.clear();
+    inflight.clear();
+    return;
+  }
+  try {
+    const key = cacheKey(buildTokenUrl(config.endpoint), config.pulseAuth);
+    cached.delete(key);
+    inflight.delete(key);
+  } catch {
+  }
 }
 async function getPulseToken(config, fetchImpl = fetch) {
   if (typeof config.pulseAuth !== "string" || config.pulseAuth.length === 0) return null;
-  if (cached !== null && Date.now() < cached.expiresAt - TOKEN_SKEW_MS) {
-    return cached.token;
+  if (config.endpointTrusted === false) return null;
+  let tokenUrl;
+  try {
+    tokenUrl = buildTokenUrl(config.endpoint);
+  } catch {
+    return null;
   }
-  if (inflight !== null) return inflight;
+  if (!isSafeOrigin(tokenUrl)) return null;
+  const key = cacheKey(tokenUrl, config.pulseAuth);
+  const existing = cached.get(key);
+  if (existing !== void 0 && Date.now() < existing.expiresAt - TOKEN_SKEW_MS) {
+    return existing.token;
+  }
+  const pending = inflight.get(key);
+  if (pending !== void 0) return pending;
   const credentials = parsePulseAuth(config.pulseAuth);
   if (credentials === null) return null;
-  inflight = (async () => {
+  let exchange;
+  exchange = (async () => {
     try {
-      const response = await fetchImpl(buildTokenUrl(config.endpoint), {
+      const response = await fetchImpl(tokenUrl, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
@@ -1325,25 +1473,27 @@ async function getPulseToken(config, fetchImpl = fetch) {
         signal: AbortSignal.timeout(config.timeoutMs)
       });
       if (!response.ok) return null;
-      const body = await response.json();
-      if (typeof body.access_token !== "string" || body.access_token.length === 0) return null;
+      const body = await readBoundedJson(response);
+      if (!isHeaderValue(body.access_token)) return null;
       const expiresIn = Number(body.expires_in);
       const ttlMs = Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn * 1e3 : 36e5;
-      cached = { token: body.access_token, expiresAt: Date.now() + ttlMs };
+      cached.set(key, { token: body.access_token, expiresAt: Date.now() + ttlMs });
       return body.access_token;
     } catch {
       return null;
     } finally {
-      inflight = null;
+      if (inflight.get(key) === exchange) inflight.delete(key);
     }
   })();
-  return inflight;
+  inflight.set(key, exchange);
+  return exchange;
 }
 async function pulseAuthHeader(config, fetchImpl = fetch) {
   const token = await getPulseToken(config, fetchImpl);
   return token === null ? {} : { Authorization: `Bearer ${token}` };
 }
 async function pulseFetch(config, url, init, fetchImpl = fetch) {
+  assertConnectableEndpoint(config, url);
   const send = async () => {
     const auth = await pulseAuthHeader(config, fetchImpl);
     const response = await fetchImpl(url, {
@@ -1354,7 +1504,7 @@ async function pulseFetch(config, url, init, fetchImpl = fetch) {
   };
   const first = await send();
   if (first.response.status === 401 && first.authenticated) {
-    clearPulseToken();
+    clearPulseToken(config);
     return (await send()).response;
   }
   return first.response;
@@ -1365,7 +1515,7 @@ var DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
 var DEFAULT_TIMEOUT_MS = 3e4;
 var CLAIM_TOKEN_HEADER = "X-Patchstack-Claim-Token";
 function claimTokenHeader(config) {
-  return typeof config.claimToken === "string" && config.claimToken !== "" ? { [CLAIM_TOKEN_HEADER]: config.claimToken } : {};
+  return config.endpointTrusted !== false && isHeaderValue(config.claimToken) ? { [CLAIM_TOKEN_HEADER]: config.claimToken } : {};
 }
 function buildEndpointUrl(base, siteUuid) {
   const trimmed = base.replace(/\/$/, "");
@@ -1404,9 +1554,46 @@ function validationFields(body) {
   if (typeof errors !== "object" || errors === null || Array.isArray(errors)) return [];
   return Object.keys(errors);
 }
+function manifestResponse(body, provisioning) {
+  if (typeof body !== "object" || body === null || Array.isArray(body)) return null;
+  const value = body;
+  if (typeof value.stored !== "boolean") return null;
+  const uuid = value.uuid === void 0 ? void 0 : isCanonicalUuid(value.uuid) ? value.uuid : null;
+  if (uuid === null || provisioning && uuid === void 0) return null;
+  if (value.api_key !== void 0 && !isCredential(value.api_key)) return null;
+  if (value.manifest_id !== void 0 && (!Number.isInteger(value.manifest_id) || Number(value.manifest_id) <= 0)) return null;
+  const claimValue = value.claim;
+  let claim2;
+  if (claimValue !== void 0) {
+    if (typeof claimValue !== "object" || claimValue === null || Array.isArray(claimValue)) return null;
+    const raw = claimValue;
+    if (!["claimed", "owned-by-you", "owned-by-other", "rejected"].includes(String(raw.state))) return null;
+    const dashboardUrl = raw.dashboard_url === void 0 || raw.dashboard_url === null ? null : safeRemoteUrl(raw.dashboard_url);
+    if (raw.dashboard_url !== void 0 && raw.dashboard_url !== null && dashboardUrl === null) return null;
+    claim2 = {
+      state: raw.state,
+      ...Number.isInteger(raw.site_id) ? { site_id: Number(raw.site_id) } : {},
+      ...dashboardUrl !== null ? { dashboard_url: dashboardUrl } : {},
+      ...raw.reason === "expired" || raw.reason === "invalid" ? { reason: raw.reason } : {}
+    };
+  }
+  const result = {
+    stored: value.stored,
+    ...uuid !== void 0 ? { uuid } : {},
+    ...typeof value.api_key === "string" ? { api_key: value.api_key } : {},
+    ...Number.isInteger(value.manifest_id) ? { manifest_id: Number(value.manifest_id) } : {},
+    ...safeDisplayString(value.checksum, 256) !== null ? { checksum: safeDisplayString(value.checksum, 256) } : {},
+    ...safeDisplayString(value.reason) !== null ? { reason: safeDisplayString(value.reason) } : {},
+    ...safeDisplayString(value.message) !== null ? { message: safeDisplayString(value.message) } : {},
+    ...safeDisplayString(value.error) !== null ? { error: safeDisplayString(value.error) } : {},
+    ...claim2 !== void 0 ? { claim: claim2 } : {}
+  };
+  return result;
+}
 async function postManifest(config, payload) {
   const url = buildEndpointUrl(config.endpoint, config.siteUuid);
   const timeoutMs = config.timeoutMs;
+  assertConnectableEndpoint(config, url);
   let response;
   try {
     response = await pulseFetch(config, url, {
@@ -1434,25 +1621,27 @@ async function postManifest(config, payload) {
       cause
     );
   }
-  const text = await response.text();
-  let body = null;
+  let text = "";
+  let parsed = null;
   try {
-    body = text.length > 0 ? JSON.parse(text) : null;
+    text = await readBoundedText(response);
+    parsed = text.length > 0 ? JSON.parse(text) : null;
   } catch {
-    body = null;
+    parsed = null;
   }
+  const body = manifestResponse(parsed, config.siteUuid === null);
   if (response.status === 404) {
     throw new PatchstackError(
-      body?.error ?? "Site not found. Check that your site UUID is correct and that the app is registered as a Pulse app in your Patchstack dashboard.",
+      safeDisplayString(parsed?.error) ?? "Site not found. Check that your site UUID is correct and that the app is registered as a Pulse app in your Patchstack dashboard.",
       "SITE_NOT_FOUND"
     );
   }
   if (response.status === 422) {
     const refused2 = new PatchstackError(
-      body?.message ?? "Patchstack rejected the manifest payload (validation failed).",
+      safeDisplayString(parsed?.message) ?? "Patchstack rejected the manifest payload (validation failed).",
       "VALIDATION_ERROR"
     );
-    refused2.fields = validationFields(body);
+    refused2.fields = validationFields(parsed);
     throw refused2;
   }
   const refused = authFailureMessage(response.status, config);
@@ -1461,12 +1650,12 @@ async function postManifest(config, payload) {
   }
   if (response.status < 200 || response.status >= 300) {
     throw new PatchstackError(
-      `Patchstack returned ${response.status}: ${text.slice(0, 200)}`,
+      `Patchstack returned ${response.status}: ${safeDisplayString(text, 200) ?? "no response details"}`,
       "SERVER_ERROR"
     );
   }
   if (body === null) {
-    throw new PatchstackError("Patchstack returned an empty response.", "SERVER_ERROR");
+    throw new PatchstackError("Patchstack returned an unexpected response.", "SERVER_ERROR");
   }
   return body;
 }
@@ -1480,11 +1669,23 @@ function isTimeoutError(cause) {
 // src/config.ts
 var import_promises9 = require("fs/promises");
 var import_node_path8 = __toESM(require("path"), 1);
+var import_node_crypto = require("crypto");
 
 // src/environment.ts
 var import_node_fs = require("fs");
 var import_node_path6 = __toESM(require("path"), 1);
 var set = (value) => value !== void 0 && value !== "";
+var PRODUCTION_BRANCHES = /* @__PURE__ */ new Set([
+  "main",
+  "master",
+  "production",
+  "prod",
+  "release",
+  "live"
+]);
+function environmentFromBranch(variable, branch) {
+  return PRODUCTION_BRANCHES.has(branch.toLowerCase()) ? { environment: "production", evidence: `${variable}=${branch} (a production branch by name)` } : { environment: "sandbox", evidence: `${variable}=${branch} (not a production branch by name)` };
+}
 var DISCRIMINATORS = [
   {
     platform: "vercel",
@@ -1513,6 +1714,79 @@ var DISCRIMINATORS = [
       if (!set(env.RAILWAY_ENVIRONMENT_NAME)) return null;
       return env.RAILWAY_ENVIRONMENT_NAME === "production" ? { environment: "production", evidence: "RAILWAY_ENVIRONMENT_NAME=production" } : { environment: "sandbox", evidence: `RAILWAY_ENVIRONMENT_NAME=${env.RAILWAY_ENVIRONMENT_NAME}` };
     }
+  },
+  {
+    // Pages and Workers Builds both name the branch and neither names the tier.
+    platform: "cloudflare",
+    read: (env) => {
+      if (set(env.CF_PAGES) && set(env.CF_PAGES_BRANCH)) {
+        return environmentFromBranch("CF_PAGES_BRANCH", env.CF_PAGES_BRANCH);
+      }
+      if (set(env.WORKERS_CI) && set(env.WORKERS_CI_BRANCH)) {
+        return environmentFromBranch("WORKERS_CI_BRANCH", env.WORKERS_CI_BRANCH);
+      }
+      return null;
+    }
+  },
+  {
+    // Amplify names the branch, and separately whether the build is a pull-request preview.
+    platform: "aws",
+    read: (env) => {
+      if (!set(env.AWS_APP_ID) || !set(env.AWS_BRANCH)) return null;
+      return set(env.AWS_PULL_REQUEST_ID) ? { environment: "sandbox", evidence: "AWS_PULL_REQUEST_ID set (a pull-request preview)" } : environmentFromBranch("AWS_BRANCH", env.AWS_BRANCH);
+    }
+  },
+  {
+    // A Deployment build carries `REPLIT_DEPLOYMENT`; the workspace carries `REPL_ID` alone. Read here,
+    // before the hosted-builder rule, so a workspace build in a Replit project is not its publish step.
+    platform: "replit",
+    read: (env) => {
+      if (set(env.REPLIT_DEPLOYMENT)) {
+        return { environment: "production", evidence: "REPLIT_DEPLOYMENT set (a Replit Deployment build)" };
+      }
+      if (set(env.REPL_ID)) {
+        return { environment: "sandbox", evidence: "REPL_ID set without REPLIT_DEPLOYMENT (the workspace)" };
+      }
+      return null;
+    }
+  },
+  {
+    // GitHub Pages deploys build here. A pull request checks out a merge ref whose name says nothing, so
+    // the event is read first; a tag is a release; otherwise the branch name decides.
+    platform: "github-actions",
+    read: (env) => {
+      if (env.GITHUB_ACTIONS !== "true") return null;
+      if (set(env.GITHUB_EVENT_NAME) && env.GITHUB_EVENT_NAME.startsWith("pull_request")) {
+        return { environment: "sandbox", evidence: `GITHUB_EVENT_NAME=${env.GITHUB_EVENT_NAME} (a pull-request build)` };
+      }
+      if (env.GITHUB_REF_TYPE === "tag") {
+        return { environment: "production", evidence: "GITHUB_REF_TYPE=tag (a tag build)" };
+      }
+      if (!set(env.GITHUB_REF_NAME)) return null;
+      return environmentFromBranch("GITHUB_REF_NAME", env.GITHUB_REF_NAME);
+    }
+  },
+  {
+    // The tier, when a job declares one, is GitLab's own word for it. Without one: a merge request is a
+    // check, a tag is a release, the default branch goes live, and any other branch name decides.
+    platform: "gitlab-ci",
+    read: (env) => {
+      if (env.GITLAB_CI !== "true") return null;
+      if (set(env.CI_ENVIRONMENT_TIER)) {
+        return env.CI_ENVIRONMENT_TIER === "production" ? { environment: "production", evidence: "CI_ENVIRONMENT_TIER=production" } : { environment: "sandbox", evidence: `CI_ENVIRONMENT_TIER=${env.CI_ENVIRONMENT_TIER}` };
+      }
+      if (set(env.CI_MERGE_REQUEST_IID)) {
+        return { environment: "sandbox", evidence: "CI_MERGE_REQUEST_IID set (a merge-request build)" };
+      }
+      if (set(env.CI_COMMIT_TAG)) {
+        return { environment: "production", evidence: "CI_COMMIT_TAG set (a tag build)" };
+      }
+      if (!set(env.CI_COMMIT_BRANCH)) return null;
+      if (set(env.CI_DEFAULT_BRANCH) && env.CI_COMMIT_BRANCH === env.CI_DEFAULT_BRANCH) {
+        return { environment: "production", evidence: `CI_COMMIT_BRANCH=${env.CI_COMMIT_BRANCH} (the default branch)` };
+      }
+      return environmentFromBranch("CI_COMMIT_BRANCH", env.CI_COMMIT_BRANCH);
+    }
   }
 ];
 var HOSTED_BUILDER_PACKAGES = [
@@ -1750,7 +2024,15 @@ async function resolveConfig(options) {
   const fromSecretFile = await readSecretFile(options.cwd);
   const fromEnv = readEnv();
   const siteUuid = options.cliSiteUuid ?? fromEnv.siteUuid ?? fromFile.siteUuid ?? null;
-  const endpoint = options.cliEndpoint ?? fromEnv.endpoint ?? fromFile.endpoint ?? DEFAULT_ENDPOINT;
+  const endpointRaw = options.cliEndpoint ?? fromEnv.endpoint ?? fromFile.endpoint ?? DEFAULT_ENDPOINT;
+  const endpointTrusted = endpointRaw === DEFAULT_ENDPOINT || options.cliEndpoint !== void 0 || fromEnv.endpoint !== void 0 || fromFile.endpoint === void 0;
+  const endpoint = safeRemoteUrl(endpointRaw);
+  if (endpoint === null) {
+    throw new PatchstackError(
+      "Patchstack endpoints must be valid HTTPS URLs, except for localhost development endpoints.",
+      "CONFIG_INVALID"
+    );
+  }
   const timeoutMs = fromEnv.timeoutMs ?? fromFile.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const environmentRaw = fromEnv.environment ?? fromFile.environment;
   if (environmentRaw !== void 0 && !isEnvironment(environmentRaw)) {
@@ -1762,7 +2044,7 @@ async function resolveConfig(options) {
   const inferred = environmentRaw === void 0 ? inferEnvironment(process.env, detectHostedBuilder(options.cwd)) : null;
   const environment = environmentRaw ?? inferred.environment;
   const environmentEvidence = inferred?.evidence ?? [];
-  if (siteUuid !== null && siteUuid.length > 0 && !isUuid(siteUuid)) {
+  if (siteUuid !== null && siteUuid.length > 0 && !isCanonicalUuid(siteUuid)) {
     throw new PatchstackError(
       `Site UUID "${siteUuid}" does not look like a valid UUID.`,
       "CONFIG_INVALID"
@@ -1785,6 +2067,7 @@ async function resolveConfig(options) {
     siteUrl: identity.url,
     siteName: identity.name,
     endpoint,
+    endpointTrusted,
     timeoutMs,
     environment,
     environmentEvidence,
@@ -1795,12 +2078,12 @@ async function resolveConfig(options) {
 async function writeConfigFile(cwd, config) {
   const target = import_node_path8.default.join(cwd, CONFIG_FILENAME);
   const content = JSON.stringify(config, null, 2) + "\n";
-  await (0, import_promises9.writeFile)(target, content, "utf8");
+  await writeAtomicFile(target, content, 420);
   return target;
 }
 async function writeSecretFile(cwd, secrets) {
   const target = import_node_path8.default.join(cwd, SECRET_FILENAME);
-  await (0, import_promises9.writeFile)(target, JSON.stringify(secrets, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+  await writeAtomicFile(target, JSON.stringify(secrets, null, 2) + "\n", 384);
   try {
     await (0, import_promises9.chmod)(target, 384);
   } catch {
@@ -1808,6 +2091,39 @@ async function writeSecretFile(cwd, secrets) {
   const ignore = await ensureIgnored(cwd, SECRET_FILENAME);
   return { path: target, ...ignore };
 }
+async function writeAtomicFile(target, content, mode) {
+  const temporary = `${target}.${process.pid}.${(0, import_node_crypto.randomUUID)()}.tmp`;
+  let handle;
+  try {
+    handle = await (0, import_promises9.open)(temporary, "wx", mode);
+    await handle.writeFile(content, "utf8");
+    await handle.sync();
+    await handle.close();
+    handle = void 0;
+    try {
+      await (0, import_promises9.rename)(temporary, target);
+    } catch (error) {
+      const code = error.code;
+      if (process.platform !== "win32" || code !== "EEXIST" && code !== "EPERM") throw error;
+      try {
+        await (0, import_promises9.unlink)(target);
+      } catch (unlinkError) {
+        if (unlinkError.code !== "ENOENT") throw unlinkError;
+      }
+      await (0, import_promises9.rename)(temporary, target);
+    }
+  } catch (error) {
+    try {
+      await handle?.close();
+    } catch {
+    }
+    try {
+      await (0, import_promises9.unlink)(temporary);
+    } catch {
+    }
+    throw error;
+  }
+}
 async function ensureIgnored(cwd, entry) {
   const target = import_node_path8.default.join(cwd, ".gitignore");
   let existing = "";
@@ -1826,7 +2142,7 @@ async function ensureIgnored(cwd, entry) {
 ${entry}
 `;
   try {
-    await (0, import_promises9.writeFile)(target, existing + block, "utf8");
+    await writeAtomicFile(target, existing + block, 420);
   } catch (err) {
     const code = err.code;
     return { ignored: false, reason: `.gitignore could not be written (${code ?? "unknown error"})` };
@@ -1879,8 +2195,15 @@ async function readJsonFile(cwd, filename) {
   const target = import_node_path8.default.join(cwd, filename);
   let raw;
   try {
+    if ((await (0, import_promises9.lstat)(target)).isSymbolicLink()) {
+      throw new PatchstackError(
+        `Could not read ${target}: configuration files must not be symbolic links.`,
+        "CONFIG_INVALID"
+      );
+    }
     raw = await (0, import_promises9.readFile)(target, "utf8");
   } catch (err) {
+    if (err instanceof PatchstackError) throw err;
     if (err.code === "ENOENT") {
       return {};
     }
@@ -1925,9 +2248,6 @@ function readEnv() {
     environment: environmentRaw !== void 0 && environmentRaw.length > 0 ? environmentRaw : void 0
   };
 }
-function isUuid(value) {
-  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
-}
 function isEnvironment(value) {
   return value === "production" || value === "sandbox" || value === "local";
 }
@@ -2022,8 +2342,97 @@ function isEmptyStack(stack) {
 }
 
 // src/widget.ts
+var import_node_fs3 = require("fs");
+var import_node_path10 = __toESM(require("path"), 1);
+
+// src/safe-file.ts
 var import_node_fs2 = require("fs");
-var import_node_path9 = __toESM(require("path"), 1);
+var import_node_crypto2 = require("crypto");
+var import_node_path9 = require("path");
+function pathError(message) {
+  return Object.assign(new Error(message), { code: "EINVAL" });
+}
+function existingEntry(path10) {
+  try {
+    return (0, import_node_fs2.lstatSync)(path10);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function assertWritableTarget(target) {
+  const entry = existingEntry(target);
+  if (entry?.isSymbolicLink()) throw pathError(`refusing to replace symbolic link: ${target}`);
+  if (entry && !entry.isFile()) throw pathError(`refusing to replace non-file path: ${target}`);
+  return entry;
+}
+function atomicWriteFileSync(target, content, options = {}) {
+  const current = assertWritableTarget(target);
+  const preserveMode = options.preserveMode !== false;
+  const exactMode = options.mode ?? (preserveMode && current ? current.mode & 4095 : options.createMode);
+  const temporary = (0, import_node_path9.join)((0, import_node_path9.dirname)(target), `.${(0, import_node_crypto2.randomUUID)()}.patchstack-tmp`);
+  let descriptor = null;
+  try {
+    descriptor = (0, import_node_fs2.openSync)(temporary, "wx", exactMode ?? 438);
+    (0, import_node_fs2.writeFileSync)(descriptor, content, options.encoding);
+    (0, import_node_fs2.fsyncSync)(descriptor);
+    (0, import_node_fs2.closeSync)(descriptor);
+    descriptor = null;
+    if (exactMode !== void 0) (0, import_node_fs2.chmodSync)(temporary, exactMode);
+    try {
+      (0, import_node_fs2.renameSync)(temporary, target);
+    } catch (error) {
+      const code = error.code;
+      if (process.platform !== "win32" || code !== "EEXIST" && code !== "EPERM") throw error;
+      try {
+        (0, import_node_fs2.unlinkSync)(target);
+      } catch (unlinkError) {
+        if (unlinkError.code !== "ENOENT") throw unlinkError;
+      }
+      (0, import_node_fs2.renameSync)(temporary, target);
+    }
+  } catch (error) {
+    if (descriptor !== null) {
+      try {
+        (0, import_node_fs2.closeSync)(descriptor);
+      } catch {
+      }
+    }
+    try {
+      (0, import_node_fs2.unlinkSync)(temporary);
+    } catch {
+    }
+    throw error;
+  }
+}
+function projectTarget(cwd, target, allowRoot = false) {
+  const logicalRoot = (0, import_node_path9.resolve)(cwd);
+  const logicalTarget = (0, import_node_path9.isAbsolute)(target) ? (0, import_node_path9.resolve)(target) : (0, import_node_path9.resolve)(logicalRoot, target);
+  const rel = (0, import_node_path9.relative)(logicalRoot, logicalTarget);
+  if (!allowRoot && rel === "" || rel === ".." || rel.startsWith(`..${import_node_path9.sep}`) || (0, import_node_path9.isAbsolute)(rel)) {
+    throw pathError(`path is outside the project: ${target}`);
+  }
+  const root = (0, import_node_fs2.realpathSync)(logicalRoot);
+  return { root, path: rel === "" ? root : (0, import_node_path9.join)(root, rel), parts: rel === "" ? [] : rel.split(import_node_path9.sep) };
+}
+function assertProjectParents(root, parts) {
+  let current = root;
+  for (const part of parts.slice(0, -1)) {
+    current = (0, import_node_path9.join)(current, part);
+    const entry = existingEntry(current);
+    if (entry === null) throw Object.assign(new Error(`project directory does not exist: ${current}`), { code: "ENOENT" });
+    if (entry.isSymbolicLink() || !entry.isDirectory()) {
+      throw pathError(`project path contains a non-directory or symbolic link: ${current}`);
+    }
+  }
+}
+function writeProjectFileSync(cwd, target, content, options = {}) {
+  const resolved = projectTarget(cwd, target);
+  assertProjectParents(resolved.root, resolved.parts);
+  atomicWriteFileSync(resolved.path, content, options);
+}
+
+// src/widget.ts
 var WIDGET_SCRIPT_URL = "https://cdn.patchstack.com/patchstack-widget.js";
 var WIDGET_MARKER_ATTR = "data-patchstack-connect-widget";
 var WIDGET_NEEDLE = "patchstack-widget";
@@ -2061,7 +2470,7 @@ ${indent}</body>`;
 }
 function findSourceShell(cwd) {
   for (const candidate of SOURCE_SHELL_CANDIDATES) {
-    if ((0, import_node_fs2.existsSync)(import_node_path9.default.join(cwd, candidate))) {
+    if ((0, import_node_fs3.existsSync)(import_node_path10.default.join(cwd, candidate))) {
       return candidate;
     }
   }
@@ -2072,14 +2481,14 @@ function ensureSourceWidget(cwd, siteUuid, jsxShell = null) {
   if (shell === null) {
     return { shell: null, action: "no-shell" };
   }
-  const file = import_node_path9.default.join(cwd, shell);
-  if (!(0, import_node_fs2.existsSync)(file)) {
+  const file = import_node_path10.default.join(cwd, shell);
+  if (!(0, import_node_fs3.existsSync)(file)) {
     return { shell: null, action: "no-shell" };
   }
-  const before = (0, import_node_fs2.readFileSync)(file, "utf8");
+  const before = (0, import_node_fs3.readFileSync)(file, "utf8");
   const { html, action } = ensureWidgetInHtml(before, siteUuid);
   if (html !== before) {
-    (0, import_node_fs2.writeFileSync)(file, html);
+    writeProjectFileSync(cwd, file, html, { encoding: "utf8" });
   }
   return { shell, action };
 }