fix(protect): per-piece idempotent start.ts wiring (clean upgrades) — 0.3.2

The single-marker idempotency check (skip if patchstackGuard present) meant re-running protect
after a connect upgrade silently did nothing — so an app wired by 0.3.0 never gained the new
server-function guard. Rework patchStart to reconcile each piece independently: extend the guard
import, add each middleware definition, and register each guard only when absent. Re-running now
adds exactly what's missing (verified: 0.3.0-wired app gains patchstackFunctionGuard with no
duplication; a second run is a no-op).

Author: devlob

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patchstack/connect",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Patchstack connector for JavaScript applications. Scans your lockfile and reports installed packages to Patchstack for vulnerability monitoring.",
   "keywords": [
     "patchstack",

src/protect/install.ts

@@ -39,7 +39,7 @@ const START_IMPORTS = [
   'import { GUARD_PATH, handleGuardRequest, inspectServerFn } from "@/integrations/patchstack/guard";',
 ].join('\n');
 
-const START_MIDDLEWARE = [
+const REQUEST_MIDDLEWARE_DEF = [
   '',
   '// Patchstack guard (browser tunnel): intercept tunneled Supabase traffic before anything else.',
   'const patchstackGuard = createMiddleware().server(async ({ next }) => {',
@@ -51,6 +51,10 @@ const START_MIDDLEWARE = [
   '  return next();',
   '});',
   '',
+].join('\n');
+
+const FUNCTION_MIDDLEWARE_DEF = [
+  '',
   '// Patchstack guard (server functions): inspect server-fn args before they reach the database,',
   '// covering apps that mutate via TanStack server functions (which bypass the browser tunnel).',
   'const patchstackFunctionGuard = createMiddleware({ type: "function" }).server(async ({ next, data }) => {',
@@ -94,25 +98,53 @@ function patchClient(cwd: string): void {
 function patchStart(cwd: string): void {
   const p = join(cwd, 'src/start.ts');
   let s = read(p);
-  if (s.includes('patchstackGuard')) return log('start.ts already wired');
   const importAnchor = 'import { createStart, createMiddleware } from "@tanstack/react-start";';
   const exportAnchor = 'export const startInstance';
   const rmAnchor = 'requestMiddleware: [';
-  if (!s.includes(importAnchor) || !s.includes(exportAnchor) || !s.includes(rmAnchor)) {
+  if (!s.includes(importAnchor) || !s.includes(exportAnchor)) {
     return log('start.ts anchors not found — skipping (template changed?)');
   }
-  s = s.replace(importAnchor, importAnchor + '\n' + START_IMPORTS);
-  s = s.replace(exportAnchor, START_MIDDLEWARE + '\n' + exportAnchor);
-  // Browser-tunnel guard → request middleware (covers browser-direct Supabase apps).
-  s = s.replace(rmAnchor, rmAnchor + 'patchstackGuard, ');
-  // Server-function guard → function middleware (covers apps that mutate via server functions).
-  const fmAnchor = 'functionMiddleware: [';
-  if (s.includes(fmAnchor)) {
-    s = s.replace(fmAnchor, fmAnchor + 'patchstackFunctionGuard, ');
-  } else {
-    // App declared no functionMiddleware — add the key next to requestMiddleware.
-    s = s.replace(rmAnchor, 'functionMiddleware: [patchstackFunctionGuard],\n    ' + rmAnchor);
+
+  // Each step is independently idempotent, so re-running `protect` (including after a connect
+  // upgrade that adds a new guard) reconciles only what's missing — never duplicates, never
+  // silently skips a newly-added piece.
+  const original = s;
+
+  // Imports.
+  if (!s.includes('@/integrations/patchstack/guard')) {
+    s = s.replace(importAnchor, importAnchor + '\n' + START_IMPORTS);
+  } else if (!s.includes('inspectServerFn')) {
+    // Upgrade from a build that only wired the browser tunnel: pull in inspectServerFn.
+    s = s.replace(
+      'import { GUARD_PATH, handleGuardRequest } from "@/integrations/patchstack/guard";',
+      'import { GUARD_PATH, handleGuardRequest, inspectServerFn } from "@/integrations/patchstack/guard";',
+    );
+  }
+
+  // Middleware definitions (each only if its const isn't already present).
+  if (!s.includes('const patchstackGuard =')) {
+    s = s.replace(exportAnchor, REQUEST_MIDDLEWARE_DEF + '\n' + exportAnchor);
   }
+  if (!s.includes('const patchstackFunctionGuard =')) {
+    s = s.replace(exportAnchor, FUNCTION_MIDDLEWARE_DEF + '\n' + exportAnchor);
+  }
+
+  // Register the browser-tunnel guard in requestMiddleware.
+  if (s.includes(rmAnchor) && !s.includes('requestMiddleware: [patchstackGuard')) {
+    s = s.replace(rmAnchor, rmAnchor + 'patchstackGuard, ');
+  }
+
+  // Register the server-function guard in functionMiddleware (create the key if the app has none).
+  if (!s.includes('functionMiddleware: [patchstackFunctionGuard')) {
+    const fmAnchor = 'functionMiddleware: [';
+    if (s.includes(fmAnchor)) {
+      s = s.replace(fmAnchor, fmAnchor + 'patchstackFunctionGuard, ');
+    } else if (s.includes(rmAnchor)) {
+      s = s.replace(rmAnchor, 'functionMiddleware: [patchstackFunctionGuard],\n    ' + rmAnchor);
+    }
+  }
+
+  if (s === original) return log('start.ts already wired');
   writeFileSync(p, s);
   log('patched start.ts (guard registered as request + function middleware)');
 }