@patchstack/connect 0.5.7 → 0.5.9

package/dist/protect.cjs

@@ -369,8 +369,8 @@ var init_hosting = __esm({
     RULES = [
       { platform: "netlify", any: ["NETLIFY", "NETLIFY_BUILD_BASE", "DEPLOY_PRIME_URL"] },
       { platform: "vercel", any: ["VERCEL", "VERCEL_ENV", "VERCEL_URL"] },
-      { platform: "cloudflare", any: ["CF_PAGES", "CF_PAGES_URL", "CLOUDFLARE_ACCOUNT_ID"] },
-      { platform: "aws", any: ["AWS_APP_ID", "AWS_LAMBDA_FUNCTION_NAME", "AWS_EXECUTION_ENV"] },
+      { platform: "cloudflare", any: ["CF_PAGES", "CF_PAGES_URL", "WORKERS_CI", "WORKERS_CI_BRANCH", "CLOUDFLARE_ACCOUNT_ID"] },
+      { platform: "aws", any: ["AWS_APP_ID", "AWS_BRANCH", "AWS_LAMBDA_FUNCTION_NAME", "AWS_EXECUTION_ENV"] },
       { platform: "render", any: ["RENDER", "RENDER_SERVICE_ID", "RENDER_EXTERNAL_URL"] },
       { platform: "railway", any: ["RAILWAY_ENVIRONMENT", "RAILWAY_ENVIRONMENT_NAME", "RAILWAY_PROJECT_ID"] },
       { platform: "fly", any: ["FLY_APP_NAME", "FLY_REGION", "FLY_ALLOC_ID"] },
@@ -407,11 +407,18 @@ function authFailureMessage(status, config) {
   }
   return null;
 }
-function buildManifestBody(config, payload, env = process.env) {
+function buildManifestBody(config, payload, env = process.env, marker = null) {
   const hosting = config.environment === "local" ? null : detectHostingPlatform(env);
   return {
     ...payload,
     environment: config.environment,
+    // What the label rests on, sent with the label itself: a `production` claim decided by an
+    // assumption about the project is worth less than one the platform declared, and only the
+    // report can say which this was.
+    ...config.environmentSource != null ? { environment_source: config.environmentSource } : {},
+    // Present only on the report from a finished build, which is also what tells the two reports
+    // of one build apart.
+    ...marker !== null ? { marker } : {},
     ...typeof config.siteUrl === "string" && config.siteUrl !== "" ? { url: config.siteUrl } : {},
     ...typeof config.siteName === "string" && config.siteName !== "" ? { name: config.siteName } : {},
     ...hosting !== null && hosting.platform !== null ? { hosting } : {}
@@ -459,7 +466,7 @@ function manifestResponse(body, provisioning) {
   };
   return result;
 }
-async function postManifest(config, payload) {
+async function postManifest(config, payload, marker = null) {
   const url = buildEndpointUrl(config.endpoint, config.siteUuid);
   const timeoutMs = config.timeoutMs;
   assertConnectableEndpoint(config, url);
@@ -473,7 +480,7 @@ async function postManifest(config, payload) {
         "User-Agent": "@patchstack/connect",
         ...claimTokenHeader(config)
       },
-      body: JSON.stringify(buildManifestBody(config, payload)),
+      body: JSON.stringify(buildManifestBody(config, payload, process.env, marker)),
       signal: AbortSignal.timeout(timeoutMs)
     });
   } catch (cause) {
@@ -551,6 +558,9 @@ var init_client = __esm({
 });
 
 // src/environment.ts
+function environmentFromBranch(variable, branch) {
+  return PRODUCTION_BRANCHES.has(branch.toLowerCase()) ? { environment: "production", evidence: `${variable}=${branch} (a production branch by name)` } : { environment: "sandbox", evidence: `${variable}=${branch} (not a production branch by name)` };
+}
 function detectHostedBuilder(cwd) {
   let declared;
   try {
@@ -572,24 +582,37 @@ function inferEnvironment(env = process.env, builder = null) {
   for (const discriminator of DISCRIMINATORS) {
     const verdict = discriminator.read(env);
     if (verdict !== null) {
-      return { environment: verdict.environment, evidence: [`${discriminator.platform}: ${verdict.evidence}`] };
+      return {
+        environment: verdict.environment,
+        evidence: [`${discriminator.platform}: ${verdict.evidence}`],
+        source: "platform"
+      };
     }
   }
   if (builder !== null) {
     return {
       environment: "production",
-      evidence: [`${builder}: a build in a ${builder} project is its publish step`]
+      evidence: [`${builder}: a build in a ${builder} project is its publish step`],
+      source: "builder"
     };
   }
-  return { environment: "local", evidence: [] };
+  return { environment: "local", evidence: [], source: null };
 }
-var import_node_fs, import_node_path, set, DISCRIMINATORS, HOSTED_BUILDER_PACKAGES;
+var import_node_fs, import_node_path, set, PRODUCTION_BRANCHES, DISCRIMINATORS, HOSTED_BUILDER_PACKAGES;
 var init_environment = __esm({
   "src/environment.ts"() {
     "use strict";
     import_node_fs = require("fs");
     import_node_path = __toESM(require("path"), 1);
     set = (value) => value !== void 0 && value !== "";
+    PRODUCTION_BRANCHES = /* @__PURE__ */ new Set([
+      "main",
+      "master",
+      "production",
+      "prod",
+      "release",
+      "live"
+    ]);
     DISCRIMINATORS = [
       {
         platform: "vercel",
@@ -618,6 +641,79 @@ var init_environment = __esm({
           if (!set(env.RAILWAY_ENVIRONMENT_NAME)) return null;
           return env.RAILWAY_ENVIRONMENT_NAME === "production" ? { environment: "production", evidence: "RAILWAY_ENVIRONMENT_NAME=production" } : { environment: "sandbox", evidence: `RAILWAY_ENVIRONMENT_NAME=${env.RAILWAY_ENVIRONMENT_NAME}` };
         }
+      },
+      {
+        // Pages and Workers Builds both name the branch and neither names the tier.
+        platform: "cloudflare",
+        read: (env) => {
+          if (set(env.CF_PAGES) && set(env.CF_PAGES_BRANCH)) {
+            return environmentFromBranch("CF_PAGES_BRANCH", env.CF_PAGES_BRANCH);
+          }
+          if (set(env.WORKERS_CI) && set(env.WORKERS_CI_BRANCH)) {
+            return environmentFromBranch("WORKERS_CI_BRANCH", env.WORKERS_CI_BRANCH);
+          }
+          return null;
+        }
+      },
+      {
+        // Amplify names the branch, and separately whether the build is a pull-request preview.
+        platform: "aws",
+        read: (env) => {
+          if (!set(env.AWS_APP_ID) || !set(env.AWS_BRANCH)) return null;
+          return set(env.AWS_PULL_REQUEST_ID) ? { environment: "sandbox", evidence: "AWS_PULL_REQUEST_ID set (a pull-request preview)" } : environmentFromBranch("AWS_BRANCH", env.AWS_BRANCH);
+        }
+      },
+      {
+        // A Deployment build carries `REPLIT_DEPLOYMENT`; the workspace carries `REPL_ID` alone. Read here,
+        // before the hosted-builder rule, so a workspace build in a Replit project is not its publish step.
+        platform: "replit",
+        read: (env) => {
+          if (set(env.REPLIT_DEPLOYMENT)) {
+            return { environment: "production", evidence: "REPLIT_DEPLOYMENT set (a Replit Deployment build)" };
+          }
+          if (set(env.REPL_ID)) {
+            return { environment: "sandbox", evidence: "REPL_ID set without REPLIT_DEPLOYMENT (the workspace)" };
+          }
+          return null;
+        }
+      },
+      {
+        // GitHub Pages deploys build here. A pull request checks out a merge ref whose name says nothing, so
+        // the event is read first; a tag is a release; otherwise the branch name decides.
+        platform: "github-actions",
+        read: (env) => {
+          if (env.GITHUB_ACTIONS !== "true") return null;
+          if (set(env.GITHUB_EVENT_NAME) && env.GITHUB_EVENT_NAME.startsWith("pull_request")) {
+            return { environment: "sandbox", evidence: `GITHUB_EVENT_NAME=${env.GITHUB_EVENT_NAME} (a pull-request build)` };
+          }
+          if (env.GITHUB_REF_TYPE === "tag") {
+            return { environment: "production", evidence: "GITHUB_REF_TYPE=tag (a tag build)" };
+          }
+          if (!set(env.GITHUB_REF_NAME)) return null;
+          return environmentFromBranch("GITHUB_REF_NAME", env.GITHUB_REF_NAME);
+        }
+      },
+      {
+        // The tier, when a job declares one, is GitLab's own word for it. Without one: a merge request is a
+        // check, a tag is a release, the default branch goes live, and any other branch name decides.
+        platform: "gitlab-ci",
+        read: (env) => {
+          if (env.GITLAB_CI !== "true") return null;
+          if (set(env.CI_ENVIRONMENT_TIER)) {
+            return env.CI_ENVIRONMENT_TIER === "production" ? { environment: "production", evidence: "CI_ENVIRONMENT_TIER=production" } : { environment: "sandbox", evidence: `CI_ENVIRONMENT_TIER=${env.CI_ENVIRONMENT_TIER}` };
+          }
+          if (set(env.CI_MERGE_REQUEST_IID)) {
+            return { environment: "sandbox", evidence: "CI_MERGE_REQUEST_IID set (a merge-request build)" };
+          }
+          if (set(env.CI_COMMIT_TAG)) {
+            return { environment: "production", evidence: "CI_COMMIT_TAG set (a tag build)" };
+          }
+          if (!set(env.CI_COMMIT_BRANCH)) return null;
+          if (set(env.CI_DEFAULT_BRANCH) && env.CI_COMMIT_BRANCH === env.CI_DEFAULT_BRANCH) {
+            return { environment: "production", evidence: `CI_COMMIT_BRANCH=${env.CI_COMMIT_BRANCH} (the default branch)` };
+          }
+          return environmentFromBranch("CI_COMMIT_BRANCH", env.CI_COMMIT_BRANCH);
+        }
       }
     ];
     HOSTED_BUILDER_PACKAGES = [
@@ -855,6 +951,7 @@ async function resolveConfig(options) {
   const inferred = environmentRaw === void 0 ? inferEnvironment(process.env, detectHostedBuilder(options.cwd)) : null;
   const environment = environmentRaw ?? inferred.environment;
   const environmentEvidence = inferred?.evidence ?? [];
+  const environmentSource = environmentRaw !== void 0 ? "override" : inferred.source;
   if (siteUuid !== null && siteUuid.length > 0 && !isCanonicalUuid(siteUuid)) {
     throw new PatchstackError(
       `Site UUID "${siteUuid}" does not look like a valid UUID.`,
@@ -882,6 +979,7 @@ async function resolveConfig(options) {
     timeoutMs,
     environment,
     environmentEvidence,
+    environmentSource,
     widget: fromFile.widget !== false,
     claimToken
   };
@@ -4974,6 +5072,7 @@ var DEFAULT_BASE_URL2 = "https://api.patchstack.com/monitor/pulse";
 var DEFAULT_CACHE_TTL2 = 3e5;
 var BUILD_VERDICT_HEADER = "X-Patchstack-Build-Match";
 var BUILD_IDENTITY_HEADER = "X-Patchstack-Build-ID";
+var PER_RULE_DRY_RUN_HEADER = "X-Patchstack-Per-Rule-Dry-Run";
 var JITTER_FRACTION2 = 0.1;
 var PulseRuleClient = class {
   #siteUuid;
@@ -5018,6 +5117,9 @@ var PulseRuleClient = class {
       if (this.#buildId !== null && typeof auth.Authorization === "string") {
         headers["X-Patchstack-Build"] = this.#buildId;
       }
+      if (typeof auth.Authorization === "string") {
+        headers[PER_RULE_DRY_RUN_HEADER] = "1";
+      }
       if (this.#etag) headers["If-None-Match"] = this.#etag;
       const response = await fetch(url, { method: "GET", headers, signal: AbortSignal.timeout(this.#timeoutMs) });
       if (response.status === 304) {