fix(protect): type-safe scaffolded guard.ts (strict TanStack build)

[patchstackdave]

A real patchstack-connect protect install failed the target app's tsc build with two errors in the scaffolded guard.ts:

guard.ts: TS2345 … Type 'string' is not assignable to type '"block" | "dry-run" | undefined'.
start.ts: TS2322 … Type 'Promise<unknown>' is not assignable to type 'Promise<RequestServerResult | Response>'.

Cause & fix

• mode was inferred as string in the published template → the createProtection(...) argument was rejected. Pin it: const mode: "block" | "dry-run" = ….
• screenResponse(response: unknown): Promise<unknown> (added in feat(protect): scaffold response screening + first scaffolder tests #70) made the request-middleware server fn return Promise<unknown>, which TanStack's RequestMiddlewareServerFnResult rejects. Make it a generic passthrough screenResponse<T>(response: T): Promise<T>, so screenResponse(await next()) preserves next()'s return type. (Only guard.ts changes — the start.ts error is caused by this signature, so it clears with no start.ts edit.)

Both were reproduced under tsc --strict in isolation and confirmed fixed. Added a scaffolder regression test asserting the guard ships these type-safe signatures.

Note

connect's own typecheck doesn't compile the .ts templates against a real TanStack app, which is why this slipped through #70. The new assertion is a content guard; a full template-typecheck-against-TanStack pass is a possible follow-up.

🤖 Generated with Claude Code

[coderbuds]

Introduces explicit union types and generics for strict type safety in guard.ts.

🎯 Quality: 100% Elite · 📦 Size: Small

📈 This month: Your 28th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review