@pretense/cli 0.3.0 → 0.3.1

package/dist/index.js

@@ -2,15 +2,17 @@
 
 // src/index.ts
 import { Command } from "commander";
-import chalk from "chalk";
-import { readFileSync as readFileSync4, existsSync as existsSync4, readdirSync, statSync } from "fs";
-import { resolve as resolve2, extname, join as join3 } from "path";
+import chalk7 from "chalk";
+import { readFileSync as readFileSync6, existsSync as existsSync6, readdirSync, statSync, openSync, readSync as readSync2, closeSync } from "fs";
+import { readFile, stat as fsStat, open as fsOpen } from "fs/promises";
+import { resolve as resolve2, extname, join as join5, basename } from "path";
+import os from "os";
 
 // src/types.ts
 var DEFAULT_CONFIG = {
   port: 9339,
   targetApis: ["https://api.anthropic.com", "https://api.openai.com"],
-  languages: ["typescript", "javascript", "python", "go", "java"],
+  languages: ["typescript", "javascript", "python", "go", "java", "csharp", "ruby", "rust"],
   mutationRules: [
     { tokenType: "Variable" /* Variable */, prefix: "_v" },
     { tokenType: "Function" /* Function */, prefix: "_fn" },
@@ -262,24 +264,186 @@ var JAVA_KEYWORDS = /* @__PURE__ */ new Set([
   "permits",
   "yield"
 ]);
+var CSHARP_KEYWORDS = /* @__PURE__ */ new Set([
+  "class",
+  "interface",
+  "namespace",
+  "public",
+  "private",
+  "protected",
+  "internal",
+  "static",
+  "void",
+  "return",
+  "new",
+  "using",
+  "override",
+  "sealed",
+  "abstract",
+  "virtual",
+  "readonly",
+  "const",
+  "var",
+  "int",
+  "string",
+  "bool",
+  "double",
+  "float",
+  "object",
+  "null",
+  "true",
+  "false",
+  "if",
+  "else",
+  "for",
+  "foreach",
+  "while",
+  "do",
+  "switch",
+  "case",
+  "break",
+  "continue",
+  "try",
+  "catch",
+  "finally",
+  "throw",
+  "async",
+  "await",
+  "get",
+  "set",
+  "partial",
+  "enum",
+  "struct",
+  "delegate",
+  "event"
+]);
+var RUBY_KEYWORDS = /* @__PURE__ */ new Set([
+  "def",
+  "class",
+  "module",
+  "end",
+  "do",
+  "if",
+  "else",
+  "elsif",
+  "unless",
+  "while",
+  "until",
+  "for",
+  "begin",
+  "rescue",
+  "ensure",
+  "raise",
+  "return",
+  "yield",
+  "self",
+  "super",
+  "true",
+  "false",
+  "nil",
+  "and",
+  "or",
+  "not",
+  "in",
+  "then",
+  "case",
+  "when",
+  "puts",
+  "print",
+  "require",
+  "require_relative",
+  "include",
+  "extend",
+  "attr_accessor",
+  "attr_reader",
+  "attr_writer",
+  "initialize",
+  "new",
+  "public",
+  "private",
+  "protected"
+]);
+var RUST_KEYWORDS = /* @__PURE__ */ new Set([
+  "fn",
+  "struct",
+  "enum",
+  "trait",
+  "impl",
+  "mod",
+  "pub",
+  "let",
+  "mut",
+  "const",
+  "type",
+  "use",
+  "crate",
+  "self",
+  "super",
+  "move",
+  "ref",
+  "match",
+  "if",
+  "else",
+  "loop",
+  "while",
+  "for",
+  "return",
+  "break",
+  "continue",
+  "where",
+  "as",
+  "in",
+  "true",
+  "false",
+  "unsafe",
+  "extern",
+  "dyn",
+  "box",
+  "static",
+  "async",
+  "await",
+  "Box",
+  "String",
+  "Vec",
+  "Option",
+  "Result",
+  "Ok",
+  "Err",
+  "Some",
+  "None"
+]);
 function detectLanguage(code) {
   if (/:[\s]*\w+[\s]*[;,{)]/.test(code) || /import.*from\s+['"]/.test(code) || /interface\s+\w+/.test(code)) return "typescript";
   if (/\bdef\s+\w+\s*\(/.test(code) || /\bimport\s+\w+/.test(code) && /:$/.test(code)) return "python";
   if (/\bfunc\s+\w+\s*\(/.test(code) || /\bpackage\s+\w+/.test(code)) return "go";
   if (/\bpublic\s+class\s+\w+/.test(code) || /\bimport\s+java\./.test(code)) return "java";
+  if (/\bnamespace\s+\w+/.test(code) || /\busing\s+System/.test(code)) return "csharp";
+  if (/\bfn\s+\w+\s*\(/.test(code) || /\blet\s+mut\s+\w+/.test(code)) return "rust";
+  if (/\bdef\s+\w+/.test(code) && /\bend\b/.test(code)) return "ruby";
   if (/\bconst\s+\w+\s*=/.test(code) || /\bfunction\s+\w+\s*\(/.test(code)) return "javascript";
   return "typescript";
 }
-function lineAt(code, index) {
-  let line = 1;
-  for (let i = 0; i < index && i < code.length; i++) {
-    if (code[i] === "\n") line++;
+function buildLineIndex(code) {
+  const offsets = [];
+  for (let i = 0; i < code.length; i++) {
+    if (code.charCodeAt(i) === 10) offsets.push(i);
   }
-  return line;
+  return offsets;
+}
+function lineFromIndex(lineOffsets, index) {
+  let lo = 0;
+  let hi = lineOffsets.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    if (lineOffsets[mid] < index) lo = mid + 1;
+    else hi = mid;
+  }
+  return lo + 1;
 }
 function scanTypeScript(code) {
   const tokens = [];
   if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
   const patterns = [
     // Single-line comment
     { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
@@ -322,7 +486,7 @@ function scanTypeScript(code) {
         value: captureValue,
         start: captureStart,
         end: captureStart + captureValue.length,
-        line: lineAt(code, captureStart)
+        line: lineFromIndex(lineOffsets, captureStart)
       });
     }
   }
@@ -331,6 +495,7 @@ function scanTypeScript(code) {
 function scanPython(code) {
   const tokens = [];
   if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
   const patterns = [
     // Triple-quoted docstrings
     { re: /"""[\s\S]*?"""|'''[\s\S]*?'''/g, type: "Comment" /* Comment */ },
@@ -368,7 +533,7 @@ function scanPython(code) {
         value: captureValue,
         start: captureStart,
         end: captureStart + captureValue.length,
-        line: lineAt(code, captureStart)
+        line: lineFromIndex(lineOffsets, captureStart)
       });
     }
   }
@@ -377,6 +542,7 @@ function scanPython(code) {
 function scanGo(code) {
   const tokens = [];
   if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
   const patterns = [
     { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
     { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
@@ -413,7 +579,7 @@ function scanGo(code) {
         value: captureValue,
         start: captureStart,
         end: captureStart + captureValue.length,
-        line: lineAt(code, captureStart)
+        line: lineFromIndex(lineOffsets, captureStart)
       });
     }
   }
@@ -422,6 +588,7 @@ function scanGo(code) {
 function scanJava(code) {
   const tokens = [];
   if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
   const patterns = [
     { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
     { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
@@ -454,7 +621,137 @@ function scanJava(code) {
         value: captureValue,
         start: captureStart,
         end: captureStart + captureValue.length,
-        line: lineAt(code, captureStart)
+        line: lineFromIndex(lineOffsets, captureStart)
+      });
+    }
+  }
+  return deduplicate(tokens);
+}
+function scanCSharp(code) {
+  const tokens = [];
+  if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
+  const patterns = [
+    { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
+    { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
+    // Namespace/using import
+    { re: /\busing\s+([\w.]+);/g, type: "Import" /* Import */, groupIndex: 1 },
+    // Class/interface/struct/enum names
+    { re: /\b(?:class|interface|struct|enum)\s+([A-Za-z_][A-Za-z0-9_]*)/g, type: "Class" /* Class */, groupIndex: 1 },
+    // Method/property declaration
+    { re: /\b(?:public|private|protected|internal|static|virtual|override|async)\s+(?:\w+\s+)+([a-zA-Z_]\w*)\s*\(/g, type: "Method" /* Method */, groupIndex: 1 },
+    // Local variable declarations
+    { re: /\b(?:var|int|string|bool|double|float|object)\s+([a-zA-Z_]\w*)\b/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Double-quoted strings
+    { re: /"(?:[^"\\]|\\.)*"/g, type: "String" /* String */ },
+    // Verbatim strings
+    { re: /@"(?:[^"]|"")*"/g, type: "String" /* String */ }
+  ];
+  for (const { re, type, groupIndex } of patterns) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const fullMatch = m[0];
+      const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
+      const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
+      if (!captureValue || captureValue.trim() === "") continue;
+      if (type === "Variable" /* Variable */ || type === "Method" /* Method */ || type === "Class" /* Class */) {
+        if (CSHARP_KEYWORDS.has(captureValue)) continue;
+        if (captureValue.length <= 1) continue;
+        if (/^(String|Object|Integer|Boolean|Double|Float|List|Dictionary|Array|Exception|Task|Console|Math|Enum|Delegate)$/.test(captureValue)) continue;
+      }
+      tokens.push({
+        type,
+        value: captureValue,
+        start: captureStart,
+        end: captureStart + captureValue.length,
+        line: lineFromIndex(lineOffsets, captureStart)
+      });
+    }
+  }
+  return deduplicate(tokens);
+}
+function scanRuby(code) {
+  const tokens = [];
+  if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
+  const patterns = [
+    // Single-line comment
+    { re: /#[^\n]*/g, type: "Comment" /* Comment */ },
+    // Method names
+    { re: /\bdef\s+([a-zA-Z_]\w*[!?]?)/g, type: "Function" /* Function */, groupIndex: 1 },
+    // Class and module names
+    { re: /\b(?:class|module)\s+([A-Z][a-zA-Z0-9_]*)/g, type: "Class" /* Class */, groupIndex: 1 },
+    // Instance variables
+    { re: /@([a-zA-Z_]\w*)/g, type: "Property" /* Property */, groupIndex: 1 },
+    // All-caps constants (3+ chars to avoid single-letter constants)
+    { re: /\b([A-Z][A-Z0-9_]{2,})\b/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Double-quoted strings
+    { re: /"(?:[^"\\]|\\.)*"/g, type: "String" /* String */ },
+    // Single-quoted strings
+    { re: /'(?:[^'\\]|\\.)*'/g, type: "String" /* String */ }
+  ];
+  for (const { re, type, groupIndex } of patterns) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const fullMatch = m[0];
+      const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
+      const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
+      if (!captureValue || captureValue.trim() === "") continue;
+      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */ || type === "Property" /* Property */) {
+        if (RUBY_KEYWORDS.has(captureValue)) continue;
+        if (captureValue.length <= 1) continue;
+      }
+      tokens.push({
+        type,
+        value: captureValue,
+        start: captureStart,
+        end: captureStart + captureValue.length,
+        line: lineFromIndex(lineOffsets, captureStart)
+      });
+    }
+  }
+  return deduplicate(tokens);
+}
+function scanRust(code) {
+  const tokens = [];
+  if (!code.trim()) return tokens;
+  const lineOffsets = buildLineIndex(code);
+  const patterns = [
+    { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
+    { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
+    // Use declarations
+    { re: /\buse\s+([\w:]+)/g, type: "Import" /* Import */, groupIndex: 1 },
+    // Named type declarations (struct, enum, trait)
+    { re: /\b(?:struct|enum|trait)\s+([A-Z][a-zA-Z0-9_]*)/g, type: "Class" /* Class */, groupIndex: 1 },
+    // Function names
+    { re: /\bfn\s+([a-zA-Z_]\w*)/g, type: "Function" /* Function */, groupIndex: 1 },
+    // Constants (ALL_CAPS)
+    { re: /\bconst\s+([A-Z_][A-Z0-9_]*)\s*:/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Variable bindings
+    { re: /\blet\s+(?:mut\s+)?([a-zA-Z_]\w*)/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Double-quoted strings
+    { re: /"(?:[^"\\]|\\.)*"/g, type: "String" /* String */ }
+  ];
+  for (const { re, type, groupIndex } of patterns) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const fullMatch = m[0];
+      const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
+      const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
+      if (!captureValue || captureValue.trim() === "") continue;
+      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */) {
+        if (RUST_KEYWORDS.has(captureValue)) continue;
+        if (captureValue.length <= 1) continue;
+      }
+      tokens.push({
+        type,
+        value: captureValue,
+        start: captureStart,
+        end: captureStart + captureValue.length,
+        line: lineFromIndex(lineOffsets, captureStart)
       });
     }
   }
@@ -498,12 +795,61 @@ function scan(code, language) {
     case "java":
       tokens = scanJava(code);
       break;
+    case "csharp":
+    case "cs":
+      tokens = scanCSharp(code);
+      break;
+    case "ruby":
+    case "rb":
+      tokens = scanRuby(code);
+      break;
+    case "rust":
+    case "rs":
+      tokens = scanRust(code);
+      break;
     default:
       tokens = scanTypeScript(code);
   }
   return { tokens, language: lang };
 }
 
+// src/salt.ts
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { randomBytes } from "crypto";
+var SALT_BYTES = 32;
+function getSaltPath() {
+  const dir = join(homedir(), ".pretense");
+  return { dir, path: join(dir, "mutation.salt") };
+}
+var _cachedSalt = null;
+function getMutationSalt() {
+  if (_cachedSalt) return _cachedSalt;
+  const { dir, path } = getSaltPath();
+  if (existsSync(path)) {
+    try {
+      const raw = readFileSync(path, "utf-8").trim();
+      if (/^[0-9a-f]{64}$/i.test(raw)) {
+        _cachedSalt = raw.toLowerCase();
+        return _cachedSalt;
+      }
+    } catch {
+    }
+  }
+  const salt = randomBytes(SALT_BYTES).toString("hex");
+  try {
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(path, salt, { mode: 384 });
+  } catch {
+  }
+  _cachedSalt = salt;
+  return salt;
+}
+function buildSaltedSeed(baseSeed) {
+  return `${baseSeed}:${getMutationSalt()}`;
+}
+
 // src/mutator.ts
 function hash32(str) {
   let h = 5381;
@@ -553,6 +899,7 @@ function mutate(code, language, seed = "pretense") {
       stats: { tokensScanned: 0, tokensMutated: 0, durationMs: 0, language: lang }
     };
   }
+  const effectiveSeed = seed === "pretense" ? buildSaltedSeed(seed) : seed;
   const { tokens } = scan(code, lang);
   const map = /* @__PURE__ */ new Map();
   for (const token of tokens) {
@@ -567,7 +914,7 @@ function mutate(code, language, seed = "pretense") {
       continue;
     }
     const prefix = prefixForType(token.type);
-    const synthetic = deterministicId(token.value, seed, prefix);
+    const synthetic = deterministicId(token.value, effectiveSeed, prefix);
     map.set(token.value, synthetic);
   }
   const entries = [...map.entries()].sort((a, b) => b[0].length - a[0].length);
@@ -654,7 +1001,15 @@ var SECRET_PATTERNS = [
   { name: "hashicorp-vault-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /hvs\.[A-Za-z0-9_-]{24,}/g },
   { name: "fastly-api-key", category: "secret", severity: "high", defaultAction: "block", pattern: /fastly_[A-Za-z0-9]{32}/g },
   { name: "algolia-api-key", category: "secret", severity: "high", defaultAction: "block", pattern: /[a-f0-9]{32}/g, validate: (m) => /ALGOLIA|algolia/.test(m) },
-  { name: "pulumi-token", category: "secret", severity: "high", defaultAction: "block", pattern: /pul-[a-f0-9]{40}/g }
+  { name: "pulumi-token", category: "secret", severity: "high", defaultAction: "block", pattern: /pul-[a-f0-9]{40}/g },
+  // ─── Extended patterns (v0.6 unit 8) ─────────────────────────────────────────
+  { name: "google-oauth-refresh", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bGOCSPX-[A-Za-z0-9_-]{20,}\b/g },
+  { name: "slack-webhook-url", category: "secret", severity: "critical", defaultAction: "block", pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{20,}/g },
+  { name: "sentry-dsn", category: "secret", severity: "high", defaultAction: "redact", pattern: /https:\/\/[a-f0-9]{32}@o\d+\.ingest\.sentry\.io\/\d+/g },
+  { name: "x509-certificate", category: "secret", severity: "high", defaultAction: "redact", pattern: /-----BEGIN CERTIFICATE-----/g },
+  { name: "launchdarkly-sdk-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bsdk-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g },
+  { name: "launchdarkly-mobile-key", category: "secret", severity: "high", defaultAction: "block", pattern: /\bmob-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g },
+  { name: "stripe-webhook-secret", category: "secret", severity: "critical", defaultAction: "block", pattern: /\bwhsec_[A-Za-z0-9]{32,}\b/g }
 ];
 var PII_PATTERNS = [
   { name: "ssn", category: "pii", severity: "critical", defaultAction: "redact", pattern: /\b\d{3}-\d{2}-\d{4}\b/g },
@@ -712,6 +1067,7 @@ function maskValue(value, type) {
   return "***";
 }
 var matchCounter = 0;
+var ENTROPY_SCAN_MAX_BYTES = 512 * 1024;
 function scan2(text, actionOverrides) {
   const start = performance.now();
   const matches = [];
@@ -737,28 +1093,44 @@ function scan2(text, actionOverrides) {
       });
     }
   }
-  const highEntropyPattern = /\b[A-Za-z0-9_\-/.+=$]{21,}\b/g;
-  highEntropyPattern.lastIndex = 0;
-  let hem;
-  while ((hem = highEntropyPattern.exec(text)) !== null) {
-    const value = hem[0];
-    const alreadyMatched = matches.some(
-      (m) => m.start <= hem.index && m.end >= hem.index + value.length
-    );
-    if (alreadyMatched) continue;
-    if (isHighEntropy(value)) {
-      matchCounter++;
-      matches.push({
-        id: `scan_${matchCounter}`,
-        category: "secret",
-        type: "high-entropy-string",
-        value,
-        masked: value.slice(0, 6) + "..." + value.slice(-4),
-        start: hem.index,
-        end: hem.index + value.length,
-        severity: "medium",
-        action: actionOverrides?.["high-entropy-string"] ?? "warn"
-      });
+  if (text.length <= ENTROPY_SCAN_MAX_BYTES) {
+    const sortedByStart = [...matches].sort((a, b) => a.start - b.start);
+    const coveredEnd = (idx) => {
+      let lo = 0;
+      let hi = sortedByStart.length - 1;
+      let best = -1;
+      while (lo <= hi) {
+        const mid = lo + hi >> 1;
+        if (sortedByStart[mid].start <= idx) {
+          best = mid;
+          lo = mid + 1;
+        } else {
+          hi = mid - 1;
+        }
+      }
+      return best >= 0 ? sortedByStart[best].end : -1;
+    };
+    const highEntropyPattern = /\b[A-Za-z0-9_\-/.+=$]{21,}\b/g;
+    highEntropyPattern.lastIndex = 0;
+    let hem;
+    while ((hem = highEntropyPattern.exec(text)) !== null) {
+      const value = hem[0];
+      const end = hem.index + value.length;
+      if (coveredEnd(hem.index) >= end) continue;
+      if (isHighEntropy(value)) {
+        matchCounter++;
+        matches.push({
+          id: `scan_${matchCounter}`,
+          category: "secret",
+          type: "high-entropy-string",
+          value,
+          masked: value.slice(0, 6) + "..." + value.slice(-4),
+          start: hem.index,
+          end,
+          severity: "medium",
+          action: actionOverrides?.["high-entropy-string"] ?? "warn"
+        });
+      }
     }
   }
   const severityRank = { critical: 4, high: 3, medium: 2, low: 1 };
@@ -790,7 +1162,7 @@ function applyRedactions(text, matches) {
 }
 
 // src/store.ts
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync2 } from "fs";
 import { dirname } from "path";
 var MutationStore = class {
   entries = /* @__PURE__ */ new Map();
@@ -855,20 +1227,20 @@ var MutationStore = class {
    */
   persist() {
     const dir = dirname(this.filePath);
-    if (!existsSync(dir)) {
-      mkdirSync(dir, { recursive: true });
+    if (!existsSync2(dir)) {
+      mkdirSync2(dir, { recursive: true });
     }
     const data = JSON.stringify([...this.entries.values()], null, 2);
-    writeFileSync(this.filePath, data, "utf-8");
+    writeFileSync2(this.filePath, data, "utf-8");
   }
   /**
    * Load entries from the JSON file into memory.
    * No-ops if the file doesn't exist.
    */
   load() {
-    if (!existsSync(this.filePath)) return;
+    if (!existsSync2(this.filePath)) return;
     try {
-      const raw = readFileSync(this.filePath, "utf-8");
+      const raw = readFileSync2(this.filePath, "utf-8");
       const parsed = JSON.parse(raw);
       this.entries.clear();
       for (const entry of parsed) {
@@ -901,8 +1273,9 @@ var MutationStore = class {
 };
 
 // src/config.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join, resolve } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join2, resolve } from "path";
+import { createHmac } from "crypto";
 var CONFIG_DIR_NAME = ".pretense";
 var CONFIG_FILE = "config.json";
 var MUTATION_MAP_FILE = "mutation-map.json";
@@ -914,30 +1287,33 @@ function getConfigDir(baseDir) {
 }
 function initConfig(dir) {
   const configDir = getConfigDir(dir);
-  if (!existsSync2(configDir)) {
-    mkdirSync2(configDir, { recursive: true });
+  if (!existsSync3(configDir)) {
+    mkdirSync3(configDir, { recursive: true });
   }
-  const configPath = join(configDir, CONFIG_FILE);
-  if (!existsSync2(configPath)) {
+  const configPath = join2(configDir, CONFIG_FILE);
+  if (!existsSync3(configPath)) {
     const config = {
       ...DEFAULT_CONFIG,
       storePath: configDir
     };
-    writeFileSync2(configPath, JSON.stringify(config, null, 2), "utf-8");
-  }
-  const mapPath = join(configDir, MUTATION_MAP_FILE);
-  if (!existsSync2(mapPath)) {
-    writeFileSync2(mapPath, "[]", "utf-8");
+    writeFileSync3(configPath, JSON.stringify(config, null, 2), "utf-8");
   }
-  const auditPath = join(configDir, AUDIT_LOG_FILE);
-  if (!existsSync2(auditPath)) {
-    writeFileSync2(auditPath, "", "utf-8");
+  const mapPath = join2(configDir, MUTATION_MAP_FILE);
+  if (!existsSync3(mapPath)) {
+    writeFileSync3(mapPath, "[]", "utf-8");
   }
-  const usagePath = join(configDir, USAGE_FILE);
-  if (!existsSync2(usagePath)) {
-    writeFileSync2(
+  const auditPath = join2(configDir, AUDIT_LOG_FILE);
+  if (!existsSync3(auditPath)) {
+    writeFileSync3(auditPath, "", "utf-8");
+  }
+  const usagePath = join2(configDir, USAGE_FILE);
+  if (!existsSync3(usagePath)) {
+    const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    const month = today.slice(0, 7);
+    const usageData = { month, mutations: 0, firstUseDate: today };
+    writeFileSync3(
       usagePath,
-      JSON.stringify({ date: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), mutations: 0, firstUseDate: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10) }, null, 2),
+      JSON.stringify({ ...usageData, date: today, checksum: computeUsageChecksum(usageData) }, null, 2),
       "utf-8"
     );
   }
@@ -945,71 +1321,111 @@ function initConfig(dir) {
 }
 function loadConfig(dir) {
   const configDir = getConfigDir(dir);
-  const configPath = join(configDir, CONFIG_FILE);
-  if (!existsSync2(configPath)) {
+  const configPath = join2(configDir, CONFIG_FILE);
+  if (!existsSync3(configPath)) {
     return { ...DEFAULT_CONFIG };
   }
   try {
-    const raw = readFileSync2(configPath, "utf-8");
+    const raw = readFileSync3(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     return { ...DEFAULT_CONFIG, ...parsed };
   } catch {
     return { ...DEFAULT_CONFIG };
   }
 }
+var USAGE_HMAC_SECRET = "pretense_usage_integrity_v1";
+function getUsageSecret() {
+  return process.env["PRETENSE_USAGE_SECRET"] ?? USAGE_HMAC_SECRET;
+}
+function computeUsageChecksum(data) {
+  const payload = JSON.stringify({ month: data.month, mutations: data.mutations, firstUseDate: data.firstUseDate });
+  return createHmac("sha256", getUsageSecret()).update(payload).digest("hex");
+}
+function verifyUsageChecksum(data) {
+  if (!data.checksum) return false;
+  return data.checksum === computeUsageChecksum(data);
+}
 function loadUsage(dir) {
   const configDir = getConfigDir(dir);
-  const usagePath = join(configDir, USAGE_FILE);
+  const usagePath = join2(configDir, USAGE_FILE);
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  if (!existsSync2(usagePath)) {
-    return { date: today, mutations: 0, firstUseDate: today };
+  const currentMonth = today.slice(0, 7);
+  if (!existsSync3(usagePath)) {
+    return { month: currentMonth, mutations: 0, firstUseDate: today };
   }
   try {
-    const raw = readFileSync2(usagePath, "utf-8");
+    const raw = readFileSync3(usagePath, "utf-8");
     const data = JSON.parse(raw);
-    if (data.date !== today) {
-      return { date: today, mutations: 0, firstUseDate: data.firstUseDate ?? today };
+    if (data.date && !data.month) {
+      const legacyDate = data.date;
+      return { month: currentMonth, mutations: 0, firstUseDate: data.firstUseDate ?? legacyDate };
+    }
+    if (!verifyUsageChecksum({ month: data.month, mutations: data.mutations, firstUseDate: data.firstUseDate, checksum: data.checksum })) {
+      process.stderr.write("[PRETENSE] Warning: usage.json integrity check failed. Resetting usage counter.\n");
+      return { month: currentMonth, mutations: 0, firstUseDate: data.firstUseDate ?? today };
     }
-    return data;
+    if (data.month !== currentMonth) {
+      return { month: currentMonth, mutations: 0, firstUseDate: data.firstUseDate ?? today };
+    }
+    return { month: data.month, mutations: data.mutations, firstUseDate: data.firstUseDate };
   } catch {
-    return { date: today, mutations: 0, firstUseDate: today };
+    return { month: currentMonth, mutations: 0, firstUseDate: today };
   }
 }
 function saveUsage(usage, dir) {
   const configDir = getConfigDir(dir);
-  if (!existsSync2(configDir)) {
-    mkdirSync2(configDir, { recursive: true });
+  if (!existsSync3(configDir)) {
+    mkdirSync3(configDir, { recursive: true });
   }
-  const usagePath = join(configDir, USAGE_FILE);
-  writeFileSync2(usagePath, JSON.stringify(usage, null, 2), "utf-8");
+  const usagePath = join2(configDir, USAGE_FILE);
+  const checksum = computeUsageChecksum(usage);
+  writeFileSync3(usagePath, JSON.stringify({ ...usage, checksum }, null, 2), "utf-8");
+}
+var MIN_LICENSE_KEY_LENGTH = 40;
+var LICENSE_PAYLOAD_REGEX = /^[a-zA-Z0-9]+$/;
+function isValidLicenseKey(key, prefix) {
+  if (key.length < MIN_LICENSE_KEY_LENGTH) return false;
+  const afterPrefix = key.slice(prefix.length);
+  const hmacSecret = process.env["PRETENSE_LICENSE_SECRET"];
+  if (hmacSecret) {
+    const lastUnderscore = afterPrefix.lastIndexOf("_");
+    if (lastUnderscore === -1) return false;
+    const payload = afterPrefix.slice(0, lastUnderscore);
+    const providedHmac = afterPrefix.slice(lastUnderscore + 1);
+    if (!payload || !providedHmac) return false;
+    if (!LICENSE_PAYLOAD_REGEX.test(payload)) return false;
+    const expectedHmac = createHmac("sha256", hmacSecret).update(payload).digest("hex").slice(0, 16);
+    return providedHmac === expectedHmac;
+  }
+  return LICENSE_PAYLOAD_REGEX.test(afterPrefix);
 }
 function detectTier() {
   const key = process.env["PRETENSE_LICENSE_KEY"] ?? "";
-  if (key.startsWith("pre_ent_")) return "enterprise";
-  if (key.startsWith("pre_pro_")) return "pro";
+  if (key.startsWith("pre_ent_") && isValidLicenseKey(key, "pre_ent_")) return "enterprise";
+  if (key.startsWith("pre_pro_") && isValidLicenseKey(key, "pre_pro_")) return "pro";
   return "free";
 }
 function getTierLimits(tier) {
   switch (tier) {
     case "enterprise":
-      return { dailyMutations: Infinity, auditRetentionDays: Infinity };
+      return { monthlyMutations: Infinity, auditRetentionDays: Infinity };
     case "pro":
-      return { dailyMutations: Infinity, auditRetentionDays: 90 };
+      return { monthlyMutations: Infinity, auditRetentionDays: 90 };
     case "free":
     default:
-      return { dailyMutations: 500, auditRetentionDays: 3 };
+      return { monthlyMutations: 1e3, auditRetentionDays: 30 };
   }
 }
 
 // src/audit.ts
-import { appendFileSync, existsSync as existsSync3, readFileSync as readFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join2, dirname as dirname2 } from "path";
+import { appendFileSync, existsSync as existsSync4, readFileSync as readFileSync4, mkdirSync as mkdirSync4 } from "fs";
+import { join as join3, dirname as dirname2 } from "path";
 function writeAuditEntry(entry, dir) {
   const configDir = getConfigDir(dir);
-  const auditPath = join2(configDir, "audit.log");
+  const auditPath = join3(configDir, "audit.log");
   const logDir = dirname2(auditPath);
-  if (!existsSync3(logDir)) {
-    mkdirSync3(logDir, { recursive: true });
+  if (!existsSync4(logDir)) {
+    mkdirSync4(logDir, { recursive: true });
   }
   const line = JSON.stringify(entry) + "\n";
   appendFileSync(auditPath, line, "utf-8");
@@ -1028,11 +1444,11 @@ function createAuditEntry(sessionId, file, identifiersMutated, secretsBlocked, l
 function readAuditLog(options = {}) {
   const { limit, dir } = options;
   const configDir = getConfigDir(dir);
-  const auditPath = join2(configDir, "audit.log");
-  if (!existsSync3(auditPath)) {
+  const auditPath = join3(configDir, "audit.log");
+  if (!existsSync4(auditPath)) {
     return [];
   }
-  const raw = readFileSync3(auditPath, "utf-8");
+  const raw = readFileSync4(auditPath, "utf-8");
   const lines = raw.trim().split("\n").filter(Boolean);
   let entries = [];
   for (const line of lines) {
@@ -1095,17 +1511,100 @@ function formatAudit(entries, format = "text") {
 import { Hono } from "hono";
 import { serve } from "@hono/node-server";
 import { nanoid } from "nanoid";
+import { createServer } from "net";
+
+// src/auth.ts
+import { createHash } from "crypto";
+var AUTH_HEADERS = ["authorization", "x-api-key", "x-goog-api-key"];
+var PUBLIC_PATHS = /* @__PURE__ */ new Set([
+  "/",
+  "/health",
+  "/stats",
+  "/audit",
+  "/tokens"
+]);
+function extractApiKey(c) {
+  for (const h of AUTH_HEADERS) {
+    const v = c.req.header(h);
+    if (v && v.length > 0) {
+      return v.replace(/^Bearer\s+/i, "").trim();
+    }
+  }
+  return null;
+}
+function sessionHash(apiKey) {
+  return createHash("sha256").update(apiKey).digest("hex").slice(0, 16);
+}
+var requireApiKey = async (c, next) => {
+  if (PUBLIC_PATHS.has(c.req.path)) {
+    return next();
+  }
+  const key = extractApiKey(c);
+  if (!key) {
+    return c.json(
+      {
+        error: {
+          type: "missing_api_key",
+          message: "Authorization header required (Authorization, x-api-key, or x-goog-api-key)"
+        }
+      },
+      401
+    );
+  }
+  c.set("sessionHash", sessionHash(key));
+  return next();
+};
+
+// src/session-store.ts
+var sessions = /* @__PURE__ */ new Map();
+function getSession(hash) {
+  let s = sessions.get(hash);
+  if (!s) {
+    s = {
+      mutationMap: /* @__PURE__ */ new Map(),
+      reverseMap: /* @__PURE__ */ new Map(),
+      createdAt: Date.now(),
+      lastUsed: Date.now()
+    };
+    sessions.set(hash, s);
+  }
+  s.lastUsed = Date.now();
+  return s;
+}
+function sessionCount() {
+  return sessions.size;
+}
+
+// src/proxy.ts
+function anthropicUpstream() {
+  return process.env["ANTHROPIC_UPSTREAM_URL"] ?? "https://api.anthropic.com";
+}
+function openaiUpstream() {
+  return process.env["OPENAI_UPSTREAM_URL"] ?? "https://api.openai.com";
+}
+function geminiUpstream() {
+  return process.env["GEMINI_UPSTREAM_URL"] ?? "https://generativelanguage.googleapis.com";
+}
+function ollamaUpstream() {
+  return process.env["OLLAMA_UPSTREAM_URL"] ?? "http://localhost:11434";
+}
 function detectUpstream(path) {
-  if (path.includes("/v1/messages")) return "https://api.anthropic.com";
-  if (path.includes("/v1/chat/completions") || path.includes("/v1/completions")) return "https://api.openai.com";
-  if (path.includes("/v1beta/") || path.includes("/v1/models")) return "https://generativelanguage.googleapis.com";
-  return "https://api.openai.com";
+  if (path.startsWith("/v1/messages")) return anthropicUpstream();
+  if (path.startsWith("/v1/chat/completions") || path.startsWith("/v1/completions") || path.startsWith("/v1/responses")) {
+    return openaiUpstream();
+  }
+  if (path.startsWith("/v1beta/") || path.startsWith("/v1/models")) return geminiUpstream();
+  if (path.startsWith("/api/chat") || path.startsWith("/api/generate")) return ollamaUpstream();
+  return anthropicUpstream();
 }
 function detectProvider(path) {
-  if (path.includes("/v1/messages")) return "anthropic";
-  if (path.includes("/v1/chat/completions") || path.includes("/v1/completions")) return "openai";
-  if (path.includes("/v1beta/") || path.includes("/v1/models")) return "google";
-  return "openai";
+  if (path.startsWith("/v1/messages")) return "anthropic";
+  if (path.startsWith("/v1/chat/completions") || path.startsWith("/v1/completions") || path.startsWith("/v1/responses")) {
+    return "openai";
+  }
+  if (path.startsWith("/v1beta/") || path.startsWith("/v1/models")) return "google";
+  if (path.startsWith("/api/chat") || path.startsWith("/api/generate")) return "ollama";
+  return "anthropic";
 }
 function extractText(body) {
   const parts = [];
@@ -1184,6 +1683,24 @@ function createProxy(opts = {}) {
   const store = opts.store ?? new MutationStore(`${config.storePath}/proxy-store.json`);
   const verbose = opts.verbose ?? false;
   const app = new Hono();
+  app.use("*", requireApiKey);
+  app.get(
+    "/",
+    (c) => c.json({
+      name: "pretense",
+      version: "0.3.0",
+      status: "running",
+      routes: {
+        "GET /": "This welcome page",
+        "GET /health": "Health check with uptime",
+        "GET /stats": "Mutation statistics",
+        "GET /audit": "Audit log (?limit=50)",
+        "POST /*": "Proxy to upstream LLM API (Anthropic, OpenAI, Google auto-detected)"
+      },
+      languages: ["TypeScript", "JavaScript", "Python", "Go", "Java", "C#", "Ruby", "Rust"],
+      docs: "https://pretense.ai/docs"
+    })
+  );
   app.get(
     "/health",
     (c) => c.json({
@@ -1200,7 +1717,8 @@ function createProxy(opts = {}) {
     "/stats",
     (c) => c.json({
       ...stats,
-      storeSize: store.size
+      storeSize: store.size,
+      activeSessions: sessionCount()
     })
   );
   app.get("/audit", (c) => {
@@ -1233,15 +1751,17 @@ function createProxy(opts = {}) {
     const requestId = nanoid(12);
     const upstream = c.req.header("x-pretense-upstream") ?? detectUpstream(c.req.path);
     const provider = detectProvider(c.req.path);
+    const sessHash = c.get("sessionHash");
+    const session = getSession(sessHash);
     const tier = detectTier();
-    const { dailyMutations } = getTierLimits(tier);
+    const { monthlyMutations } = getTierLimits(tier);
     const usage = loadUsage();
-    if (tier === "free" && usage.mutations >= dailyMutations) {
+    if (tier === "free" && usage.mutations >= monthlyMutations) {
       return c.json(
         {
           error: {
             type: "pretense_rate_limit",
-            message: `Daily mutation limit reached (${dailyMutations}/day). Upgrade to Pro for unlimited: https://pretense.ai/pricing`
+            message: `Monthly mutation limit reached (${monthlyMutations}/month). Upgrade to Pro for unlimited: https://pretense.ai/pricing`
           }
         },
         429
@@ -1274,7 +1794,11 @@ function createProxy(opts = {}) {
       const mutatedBlocks = [];
       for (const block of blocks) {
         const result = mutate(block.code, block.language);
-        for (const [k, v] of result.map.entries()) mutationMap.set(k, v);
+        for (const [k, v] of result.map) {
+          mutationMap.set(k, v);
+          session.mutationMap.set(k, v);
+          session.reverseMap.set(v, k);
+        }
         tokensMutated += result.stats.tokensMutated;
         mutatedBlocks.push(result.mutatedCode);
       }
@@ -1282,8 +1806,9 @@ function createProxy(opts = {}) {
     });
     usage.mutations += tokensMutated;
     saveUsage(usage);
-    if (tier === "free" && usage.mutations >= 400 && usage.mutations - tokensMutated < 400) {
-      printUpgradeNudge(`${usage.mutations}/${dailyMutations} daily mutations used. Running low!`);
+    const warningThreshold = Math.floor(monthlyMutations * 0.8);
+    if (tier === "free" && usage.mutations >= warningThreshold && usage.mutations - tokensMutated < warningThreshold) {
+      printUpgradeNudge(`${usage.mutations}/${monthlyMutations} monthly mutations used. Running low!`);
     }
     if (tier === "free" && daysSinceFirstUse() >= 7) {
       printUpgradeNudge("You've been using Pretense for 7+ days. Unlock Pro features: unlimited mutations, 90-day audit, Slack alerts.");
@@ -1326,14 +1851,59 @@ function createProxy(opts = {}) {
       return c.json({ error: { type: "pretense_upstream_error", message: "Failed to reach upstream provider" } }, 502);
     }
     if (body["stream"] === true) {
-      return new Response(upstreamResp.body, {
+      const streamReverseMap = new Map(mutationMap);
+      const upstream2 = upstreamResp.body;
+      if (!upstream2 || tokensMutated === 0) {
+        return new Response(upstream2, {
+          status: upstreamResp.status,
+          headers: {
+            "content-type": upstreamResp.headers.get("content-type") ?? "text/event-stream",
+            "cache-control": "no-cache",
+            "x-pretense-request-id": requestId,
+            "x-pretense-protected": "true",
+            "x-pretense-mutations": String(tokensMutated)
+          }
+        });
+      }
+      const decoder = new TextDecoder();
+      const encoder = new TextEncoder();
+      let buffer = "";
+      const transform = new TransformStream({
+        transform(chunk, controller) {
+          buffer += decoder.decode(chunk, { stream: true });
+          const lines = buffer.split("\n");
+          buffer = lines.pop() ?? "";
+          for (const line of lines) {
+            if (line.startsWith("data: ") && line !== "data: [DONE]") {
+              try {
+                const json = JSON.parse(line.slice(6));
+                const reversed = applyToBody(json, (text) => reverse(text, streamReverseMap));
+                controller.enqueue(encoder.encode(`data: ${JSON.stringify(reversed)}
+`));
+              } catch {
+                controller.enqueue(encoder.encode(line + "\n"));
+              }
+            } else {
+              controller.enqueue(encoder.encode(line + "\n"));
+            }
+          }
+        },
+        flush(controller) {
+          if (buffer.length > 0) {
+            controller.enqueue(encoder.encode(buffer));
+          }
+        }
+      });
+      const reversedStream = upstream2.pipeThrough(transform);
+      return new Response(reversedStream, {
         status: upstreamResp.status,
         headers: {
           "content-type": upstreamResp.headers.get("content-type") ?? "text/event-stream",
           "cache-control": "no-cache",
           "x-pretense-request-id": requestId,
           "x-pretense-protected": "true",
-          "x-pretense-mutations": String(tokensMutated)
+          "x-pretense-mutations": String(tokensMutated),
+          "x-pretense-stream-reversal": "active"
         }
       });
     }
@@ -1363,31 +1933,435 @@ function createProxy(opts = {}) {
   });
   return app;
 }
+function isPortAvailable(port) {
+  return new Promise((resolve3) => {
+    const tester = createServer().once("error", () => resolve3(false)).once("listening", () => {
+      tester.once("close", () => resolve3(true)).close();
+    }).listen(port, "127.0.0.1");
+  });
+}
+async function findAvailablePort(startPort, maxAttempts = 10) {
+  for (let i = 0; i < maxAttempts; i++) {
+    const candidate = startPort + i;
+    if (candidate < 1 || candidate > 65535) break;
+    if (await isPortAvailable(candidate)) return candidate;
+  }
+  throw new Error(
+    `No available port found in range ${startPort}-${startPort + maxAttempts - 1}. Free a port or pass --port <number>.`
+  );
+}
 function startProxy(opts = {}) {
-  const port = opts.port ?? opts.config?.port ?? DEFAULT_CONFIG.port;
+  const requestedPort = opts.port ?? opts.config?.port ?? DEFAULT_CONFIG.port;
   const app = createProxy(opts);
   const tier = detectTier();
-  serve({ fetch: app.fetch, port }, () => {
-    process.stdout.write(`
-\x1B[36m\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
-\u2502                                             \u2502
-\u2502   \x1B[1mPretense\x1B[0m\x1B[36m v0.3.0  [${tier.toUpperCase()}]${" ".repeat(20 - tier.length)}\u2502
-\u2502   Your code hits AI naked. We fix that.     \u2502
-\u2502                                             \u2502
-\u2502   Proxy:  http://localhost:${port}              \u2502
-\u2502   Health: http://localhost:${port}/health       \u2502
-\u2502   Stats:  http://localhost:${port}/stats        \u2502
-\u2502                                             \u2502
-\u2502   ANTHROPIC_BASE_URL=http://localhost:${port}   \u2502
-\u2502   OPENAI_BASE_URL=http://localhost:${port}/v1   \u2502
-\u2502                                             \u2502
-\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\x1B[0m
+  void (async () => {
+    let port;
+    try {
+      port = await findAvailablePort(requestedPort, 10);
+    } catch (err) {
+      process.stderr.write(`\x1B[31m[PRETENSE] ${err.message}\x1B[0m
 `);
-  });
+      process.exit(1);
+    }
+    if (port !== requestedPort) {
+      process.stderr.write(
+        `\x1B[33m[PRETENSE] Port ${requestedPort} in use, falling back to ${port}.\x1B[0m
+`
+      );
+    }
+    serve({ fetch: app.fetch, port }, () => {
+      const portStr = String(port);
+      process.stdout.write(`
+\x1B[36mPretense v0.3.0  [${tier.toUpperCase()}]\x1B[0m
+  Your code hits AI naked. We fix that.
+
+  Proxy:    http://localhost:${portStr}
+  Health:   http://localhost:${portStr}/health
+  Stats:    http://localhost:${portStr}/stats
+
+  Drop-in env vars:
+    ANTHROPIC_BASE_URL=http://localhost:${portStr}
+    OPENAI_BASE_URL=http://localhost:${portStr}/v1
+    GEMINI_BASE_URL=http://localhost:${portStr}/v1beta
+    OLLAMA_HOST=http://localhost:${portStr}
+
+  Routes intercepted:
+    /v1/messages              -> Anthropic (Claude Code, SDK)
+    /v1/chat/completions      -> OpenAI (ChatGPT, Cursor)
+    /v1/responses             -> OpenAI (Codex CLI)
+    /v1beta/...               -> Google Gemini
+    /api/chat, /api/generate  -> Ollama (local)
+`);
+    });
+  })();
+}
+
+// src/token-footer.ts
+import chalk from "chalk";
+var PLAN_LIMITS = {
+  free: { monthlyMutations: 1e3, monthlyScans: 5e3, seats: 3, pricePerMonth: "$0/month" },
+  pro: { monthlyMutations: 1e5, monthlyScans: 5e5, seats: 25, pricePerMonth: "$29/seat/month" },
+  enterprise: {
+    monthlyMutations: Number.POSITIVE_INFINITY,
+    monthlyScans: Number.POSITIVE_INFINITY,
+    seats: Number.POSITIVE_INFINITY,
+    pricePerMonth: "$99/seat/month"
+  }
+};
+function getPlanLimits(tier) {
+  return PLAN_LIMITS[tier];
+}
+function fmt(n) {
+  if (!Number.isFinite(n)) return "unlimited";
+  return n.toLocaleString("en-US");
+}
+function printTokenFooter(filesScanned, mutationsMade) {
+  const tier = detectTier();
+  const limits = getPlanLimits(tier);
+  const usage = loadUsage();
+  if (tier === "enterprise") {
+    process.stderr.write(
+      chalk.gray(`
+  ${filesScanned} files, ${mutationsMade} mutations  \xB7  Plan: Enterprise (unlimited)
+
+`)
+    );
+    return;
+  }
+  const used = usage.mutations;
+  const cap = limits.monthlyMutations;
+  const pct = cap > 0 ? Math.min(100, Math.round(used / cap * 100)) : 0;
+  const usageStr = pct >= 80 ? chalk.yellow(`${fmt(used)} / ${fmt(cap)}`) : chalk.gray(`${fmt(used)} / ${fmt(cap)}`);
+  process.stderr.write(
+    `
+  ${chalk.cyan(filesScanned + " files")}, ${chalk.cyan(mutationsMade + " mutations")}  \xB7  Plan: ${chalk.bold(tier.toUpperCase())}  \xB7  Mutations this month: ${usageStr} (${pct}%)
+`
+  );
+  if (tier === "free") {
+    if (pct >= 80) {
+      process.stderr.write(
+        chalk.yellow(`  \u26A0  Approaching free-tier limit. Upgrade: ${chalk.bold("pretense upgrade")}
+
+`)
+      );
+    } else {
+      process.stderr.write(
+        chalk.gray(`  Run ${chalk.bold("pretense status")} for details, ${chalk.bold("pretense upgrade")} to remove limits.
+
+`)
+      );
+    }
+  } else {
+    process.stderr.write("\n");
+  }
+}
+
+// src/banner.ts
+import chalk2 from "chalk";
+var BANNER_RAW = `\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588    pretense
+\u2588\u2588          \u2588\u2588
+\u2588\u2588          \u2588\u2588    Stop your code from
+\u2588\u2588          \u2588\u2588    leaking to any LLM.
+\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588
+\u2588\u2588                pretense.ai
+\u2588\u2588
+\u2588\u2588
+\u2588\u2588
+\u2588\u2588`;
+var ICE_BLUE = "#7DD3FC";
+function shouldPrint() {
+  if (process.env.PRETENSE_NO_BANNER === "1") return false;
+  if (!process.stdout.isTTY) return false;
+  if (process.env.CI) return false;
+  return true;
+}
+function tint(line) {
+  try {
+    return chalk2.hex(ICE_BLUE)(line);
+  } catch {
+    return line;
+  }
+}
+function printBanner() {
+  if (!shouldPrint()) return;
+  const lines = BANNER_RAW.split("\n");
+  for (const line of lines) {
+    process.stderr.write(tint(line) + "\n");
+  }
+  process.stderr.write("\n");
+}
+
+// src/commands/status.ts
+import chalk3 from "chalk";
+var PLAN_LABEL = {
+  free: "Free",
+  pro: "Pro",
+  enterprise: "Enterprise"
+};
+function fmt2(n) {
+  if (!Number.isFinite(n)) return "unlimited";
+  return n.toLocaleString("en-US");
+}
+function runStatus() {
+  const tier = detectTier();
+  const planLimits = getPlanLimits(tier);
+  const tierLimits = getTierLimits(tier);
+  const usage = loadUsage();
+  const tierBadge = tier === "enterprise" ? chalk3.bgMagenta.white.bold(" ENTERPRISE ") : tier === "pro" ? chalk3.bgBlue.white.bold(" PRO ") : chalk3.bgGray.white.bold(" FREE ");
+  const lines = [];
+  lines.push("");
+  lines.push(`${chalk3.cyan("Pretense")} ${chalk3.gray("v0.3.0")}  ${tierBadge}`);
+  lines.push("");
+  lines.push(`  Plan:        ${chalk3.bold(PLAN_LABEL[tier])} ${chalk3.gray("(" + planLimits.pricePerMonth + ")")}`);
+  lines.push(`  Mutations:   ${fmt2(usage.mutations)} / ${fmt2(planLimits.monthlyMutations)} this month`);
+  lines.push(`  Scans:       0 / ${fmt2(planLimits.monthlyScans)} this month`);
+  lines.push(`  Seats:       1 / ${fmt2(planLimits.seats)}`);
+  lines.push(`  Audit log:   ${Number.isFinite(tierLimits.auditRetentionDays) ? `${tierLimits.auditRetentionDays} days` : "unlimited"}`);
+  lines.push("");
+  if (tier === "free") {
+    lines.push(`  ${chalk3.gray("Upgrade:")}  ${chalk3.bold("pretense upgrade")}`);
+    lines.push(`  ${chalk3.gray("Credits:")}  ${chalk3.bold("pretense credits")}`);
+    lines.push("");
+  }
+  process.stdout.write(lines.join("\n") + "\n");
+}
+
+// src/commands/upgrade.ts
+import chalk4 from "chalk";
+var PRICING_URL = "https://pretense.ai/pricing";
+function runUpgrade() {
+  const tier = detectTier();
+  const lines = [];
+  lines.push("");
+  lines.push(chalk4.cyan.bold("  Pretense Plans"));
+  lines.push("");
+  lines.push(chalk4.gray("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+  lines.push(chalk4.gray("  \u2502              \u2502   Free   \u2502    Pro   \u2502  Enterprise \u2502"));
+  lines.push(chalk4.gray("  \u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524"));
+  lines.push(`  \u2502 Price/seat   \u2502 ${chalk4.bold("$0")}      \u2502 ${chalk4.bold("$29")}     \u2502 ${chalk4.bold("$99")}         \u2502`);
+  lines.push("  \u2502 Mutations/mo \u2502 1,000    \u2502 100,000  \u2502 unlimited   \u2502");
+  lines.push("  \u2502 Scans/mo     \u2502 5,000    \u2502 500,000  \u2502 unlimited   \u2502");
+  lines.push("  \u2502 Seats        \u2502 3        \u2502 25       \u2502 unlimited   \u2502");
+  lines.push("  \u2502 Audit log    \u2502 30 days  \u2502 90 days  \u2502 unlimited   \u2502");
+  lines.push("  \u2502 SSO/SAML     \u2502   -      \u2502   -      \u2502     yes     \u2502");
+  lines.push("  \u2502 On-prem      \u2502   -      \u2502   -      \u2502     yes     \u2502");
+  lines.push("  \u2502 SLA          \u2502   -      \u2502   -      \u2502   24/7      \u2502");
+  lines.push(chalk4.gray("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+  lines.push("");
+  lines.push(`  ${chalk4.gray("Current plan:")} ${chalk4.bold(tier.toUpperCase())}`);
+  lines.push(`  ${chalk4.gray("Upgrade at:")}    ${chalk4.cyan.underline(PRICING_URL)}`);
+  lines.push("");
+  lines.push(chalk4.gray("  After purchase, set:"));
+  lines.push(chalk4.gray("    export PRETENSE_LICENSE_KEY=pre_pro_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"));
+  lines.push("");
+  process.stdout.write(lines.join("\n") + "\n");
+}
+
+// src/commands/credits.ts
+import chalk5 from "chalk";
+var PLAN_LABEL2 = {
+  free: "Free",
+  pro: "Pro",
+  enterprise: "Enterprise"
+};
+function fmt3(n) {
+  if (!Number.isFinite(n)) return "unlimited";
+  return n.toLocaleString("en-US");
+}
+function progressBar(used, cap, width = 24) {
+  if (!Number.isFinite(cap) || cap <= 0) return chalk5.green("[" + "=".repeat(width) + "]");
+  const pct = Math.min(1, used / cap);
+  const filled = Math.round(pct * width);
+  const bar = "=".repeat(filled) + "-".repeat(width - filled);
+  const colored = pct >= 0.8 ? chalk5.yellow(bar) : pct >= 1 ? chalk5.red(bar) : chalk5.green(bar);
+  return "[" + colored + "]";
+}
+function runCredits() {
+  const tier = detectTier();
+  const limits = getPlanLimits(tier);
+  const usage = loadUsage();
+  const used = usage.mutations;
+  const cap = limits.monthlyMutations;
+  const remaining = Number.isFinite(cap) ? Math.max(0, cap - used) : Number.POSITIVE_INFINITY;
+  const pct = Number.isFinite(cap) && cap > 0 ? Math.round(used / cap * 100) : 0;
+  const lines = [];
+  lines.push("");
+  lines.push(chalk5.cyan.bold("  Pretense Credits"));
+  lines.push("");
+  lines.push(`  Plan:        ${chalk5.bold(PLAN_LABEL2[tier])}`);
+  lines.push(`  Month:       ${usage.month}`);
+  lines.push("");
+  lines.push(`  Mutations:   ${progressBar(used, cap)}  ${fmt3(used)} / ${fmt3(cap)}`);
+  lines.push(`  Used:        ${pct}%`);
+  lines.push(`  Remaining:   ${fmt3(remaining)}`);
+  lines.push("");
+  if (tier === "free" && Number.isFinite(cap) && used >= cap * 0.8) {
+    lines.push(chalk5.yellow("  \u26A0  Approaching free-tier limit. Run 'pretense upgrade' for unlimited."));
+    lines.push("");
+  } else if (tier === "free") {
+    lines.push(chalk5.gray("  Tip: Run 'pretense upgrade' to compare plans."));
+    lines.push("");
+  }
+  process.stdout.write(lines.join("\n") + "\n");
+}
+
+// src/commands/login.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, readFileSync as readFileSync5, chmodSync, readSync } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir2 } from "os";
+import chalk6 from "chalk";
+var CONFIG_DIR_NAME2 = ".pretense";
+var CONFIG_FILE2 = "config.json";
+function getUserConfigDir() {
+  return join4(homedir2(), CONFIG_DIR_NAME2);
+}
+function isValidKeyShape(key) {
+  const trimmed = key.trim();
+  if (trimmed.length < 24) return false;
+  if (!/^[A-Za-z0-9_]+$/.test(trimmed)) return false;
+  return trimmed.startsWith("pk_live_") || trimmed.startsWith("ptns_live_");
+}
+function readStdinIfPiped() {
+  if (process.stdin.isTTY) return "";
+  try {
+    const chunks = [];
+    const buf = Buffer.alloc(4096);
+    let bytesRead = 0;
+    do {
+      try {
+        bytesRead = readSync(0, buf, 0, buf.length, null);
+      } catch {
+        bytesRead = 0;
+      }
+      if (bytesRead > 0) chunks.push(Buffer.from(buf.subarray(0, bytesRead)));
+    } while (bytesRead === buf.length);
+    return Buffer.concat(chunks).toString("utf-8").trim();
+  } catch {
+    return "";
+  }
+}
+function maskKey(key) {
+  const trimmed = key.trim();
+  if (trimmed.length <= 12) return trimmed;
+  return `${trimmed.slice(0, 12)}${"\u2022".repeat(8)}${trimmed.slice(-4)}`;
+}
+function saveApiKey(key, configDir = getUserConfigDir()) {
+  if (!existsSync5(configDir)) {
+    mkdirSync5(configDir, { recursive: true });
+  }
+  const path = join4(configDir, CONFIG_FILE2);
+  let existing = {};
+  if (existsSync5(path)) {
+    try {
+      existing = JSON.parse(readFileSync5(path, "utf-8"));
+    } catch {
+      existing = {};
+    }
+  }
+  const next = {
+    ...existing,
+    api_key: key.trim(),
+    saved_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeFileSync4(path, JSON.stringify(next, null, 2), { encoding: "utf-8", mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+  return path;
+}
+function runLogin(opts = {}) {
+  const candidate = opts.key?.trim() || (process.env["PRETENSE_API_KEY"] ?? "").trim() || readStdinIfPiped();
+  if (!candidate) {
+    console.error(chalk6.red("Error: no API key provided."));
+    console.error(
+      chalk6.gray("Try: pretense login --key pk_live_xxxxx")
+    );
+    console.error(
+      chalk6.gray("  or: echo $PRETENSE_API_KEY | pretense login")
+    );
+    return 1;
+  }
+  if (!isValidKeyShape(candidate)) {
+    console.error(chalk6.red("Error: that does not look like a Pretense API key."));
+    console.error(
+      chalk6.gray("Keys start with pk_live_ and are at least 24 characters long.")
+    );
+    console.error(
+      chalk6.gray("Get one at https://pretense.ai/dashboard/settings/api-keys")
+    );
+    return 1;
+  }
+  const path = saveApiKey(candidate, opts.configDir);
+  console.log(chalk6.green("Saved API key to"), chalk6.bold(path));
+  console.log(chalk6.gray(`  ${maskKey(candidate)}`));
+  console.log(chalk6.gray("  File mode 600 \u2014 readable only by you."));
+  return 0;
 }
 
 // src/index.ts
+{
+  const major = parseInt(process.versions.node.split(".")[0], 10);
+  if (Number.isNaN(major) || major < 18) {
+    process.stderr.write(
+      `pretense requires Node.js 18 or newer (you have v${process.versions.node}).
+`
+    );
+    process.stderr.write(`Upgrade via nvm: nvm install 20 && nvm use 20
+`);
+    process.exit(1);
+  }
+}
 var VERSION = "0.3.0";
+var SCAN_CONCURRENCY = Math.max(2, os.cpus().length);
+var PROGRESS_INTERVAL_MS = 500;
+var SUPPORTED_LANGUAGES = ["typescript", "javascript", "python", "go", "java", "csharp", "ruby", "rust"];
+var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".go", ".java", ".cs", ".rb", ".rs"]);
+var SUPPORTED_CONFIG_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".json",
+  ".yaml",
+  ".yml",
+  ".toml",
+  ".env",
+  ".cfg",
+  ".ini",
+  ".tf",
+  ".tfstate",
+  ".tfvars",
+  ".hcl",
+  ".properties",
+  ".conf",
+  ".xml",
+  ".plist",
+  ".pem",
+  ".key",
+  ".crt",
+  ".pub",
+  ".pfx",
+  ".p12",
+  ".htpasswd"
+]);
+var SUPPORTED_FILENAMES = /* @__PURE__ */ new Set([
+  ".env",
+  ".env.local",
+  ".env.production",
+  ".env.development",
+  ".env.staging",
+  ".env.test",
+  ".npmrc",
+  ".netrc",
+  ".pypirc",
+  "Dockerfile",
+  "docker-compose.yml",
+  "docker-compose.yaml"
+]);
+function isScannableFile(filePath) {
+  const ext = extname(filePath).toLowerCase();
+  return SUPPORTED_EXTENSIONS.has(ext) || SUPPORTED_CONFIG_EXTENSIONS.has(ext) || SUPPORTED_FILENAMES.has(basename(filePath));
+}
+function isSourceCodeFile(filePath) {
+  return SUPPORTED_EXTENSIONS.has(extname(filePath).toLowerCase());
+}
 function langFromExt(filePath) {
   const ext = extname(filePath).toLowerCase();
   const map = {
@@ -1399,26 +2373,82 @@ function langFromExt(filePath) {
     ".cjs": "javascript",
     ".py": "python",
     ".go": "go",
-    ".java": "java"
+    ".java": "java",
+    ".cs": "csharp",
+    ".rb": "ruby",
+    ".rs": "rust"
   };
   return map[ext] ?? "typescript";
 }
+function validatePort(value) {
+  const port = parseInt(value, 10);
+  if (isNaN(port) || port.toString() !== value.trim()) return null;
+  if (port < 1 || port > 65535) return null;
+  return port;
+}
+function isBinaryFile(filePath) {
+  let fd;
+  try {
+    fd = openSync(filePath, "r");
+    const buf = Buffer.alloc(8192);
+    const bytesRead = readSync2(fd, buf, 0, 8192, 0);
+    for (let i = 0; i < bytesRead; i++) {
+      if (buf[i] === 0) return true;
+    }
+    return false;
+  } catch {
+    return false;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+}
+async function isBinaryFileAsync(filePath) {
+  let handle;
+  try {
+    handle = await fsOpen(filePath, "r");
+    const buf = Buffer.alloc(8192);
+    const { bytesRead } = await handle.read(buf, 0, 8192, 0);
+    for (let i = 0; i < bytesRead; i++) {
+      if (buf[i] === 0) return true;
+    }
+    return false;
+  } catch {
+    return false;
+  } finally {
+    if (handle) await handle.close().catch(() => {
+    });
+  }
+}
+function validateLanguage(lang) {
+  const normalized = lang.toLowerCase();
+  const aliases = {
+    ts: "typescript",
+    tsx: "typescript",
+    js: "javascript",
+    jsx: "javascript",
+    py: "python",
+    cs: "csharp",
+    rb: "ruby",
+    rs: "rust"
+  };
+  const resolved = aliases[normalized] ?? normalized;
+  return SUPPORTED_LANGUAGES.includes(resolved) ? resolved : null;
+}
 function collectFiles(target) {
   const abs = resolve2(target);
-  if (!existsSync4(abs)) {
+  if (!existsSync6(abs)) {
     return [];
   }
   const stat = statSync(abs);
   if (stat.isFile()) return [abs];
   const files = [];
-  const supportedExts = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".go", ".java"]);
   function walk(dir) {
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      const fullPath = join3(dir, entry.name);
+      const fullPath = join5(dir, entry.name);
       if (entry.isDirectory()) {
         if (["node_modules", ".git", "dist", "build", ".pretense", ".next", "__pycache__"].includes(entry.name)) continue;
         walk(fullPath);
-      } else if (entry.isFile() && supportedExts.has(extname(entry.name).toLowerCase())) {
+      } else if (entry.isFile() && isScannableFile(entry.name)) {
         files.push(fullPath);
       }
     }
@@ -1427,10 +2457,12 @@ function collectFiles(target) {
   return files;
 }
 var program = new Command();
-program.name("pretense").description("AI firewall CLI \u2014 mutates proprietary code before LLM API calls").version(VERSION);
+program.name("pretense").description("AI firewall CLI \u2014 mutates proprietary code before LLM API calls").version(VERSION).hook("preAction", () => {
+  printBanner();
+});
 program.command("init").description("Initialize .pretense/ config in current directory").option("-d, --dir <path>", "Target directory", process.cwd()).action((opts) => {
   const dir = resolve2(opts.dir);
-  console.log(chalk.cyan("Initializing Pretense in"), chalk.bold(dir));
+  console.log(chalk7.cyan("Initializing Pretense in"), chalk7.bold(dir));
   const configDir = initConfig(dir);
   const files = collectFiles(dir);
   const langCounts = {};
@@ -1438,83 +2470,246 @@ program.command("init").description("Initialize .pretense/ config in current dir
     const lang = langFromExt(f);
     langCounts[lang] = (langCounts[lang] ?? 0) + 1;
   }
-  console.log(chalk.green("\n  .pretense/ created at"), chalk.bold(configDir));
-  console.log(chalk.gray(`
+  console.log(chalk7.green("\n  .pretense/ created at"), chalk7.bold(configDir));
+  console.log(chalk7.gray(`
   Scanned ${files.length} source files:`));
   for (const [lang, count] of Object.entries(langCounts)) {
-    console.log(chalk.gray(`    ${lang}: ${count} files`));
+    console.log(chalk7.gray(`    ${lang}: ${count} files`));
   }
-  console.log(chalk.cyan("\n  Next: run"), chalk.bold("pretense start"), chalk.cyan("to launch the proxy"));
+  console.log(chalk7.cyan("\n  Next: run"), chalk7.bold("pretense start"), chalk7.cyan("to launch the proxy"));
   console.log();
 });
 program.command("start").description("Start the Pretense proxy server").option("-p, --port <number>", "Port number", "9339").option("-v, --verbose", "Enable verbose logging", false).action((opts) => {
   const config = loadConfig();
-  const port = parseInt(opts.port) || config.port;
+  const port = validatePort(opts.port);
+  if (port === null) {
+    console.error(chalk7.red("Error: Invalid port number:"), chalk7.bold(opts.port));
+    console.error(chalk7.gray("Port must be an integer between 1 and 65535."));
+    process.exit(1);
+  }
   startProxy({ config, port, verbose: opts.verbose });
 });
-program.command("scan <target>").description("Scan file or directory for identifiers and secrets (no mutation)").option("--secrets-only", "Only scan for secrets/credentials", false).option("--json", "Output as JSON", false).action((target, opts) => {
-  const files = collectFiles(target);
-  if (files.length === 0) {
-    console.error(chalk.red("No source files found at"), chalk.bold(target));
-    process.exit(1);
+async function scanOneFile(file, opts) {
+  let size = 0;
+  try {
+    const st = await fsStat(file);
+    size = st.size;
+    if (st.size > opts.maxFileSize) {
+      return { file, identifiers: 0, secrets: 0, secretTypes: [], skipped: "too-large", sizeBytes: size };
+    }
+  } catch {
+    return { file, identifiers: 0, secrets: 0, secretTypes: [], skipped: "read-error" };
+  }
+  if (!isSourceCodeFile(file)) {
+    try {
+      if (await isBinaryFileAsync(file)) {
+        return { file, identifiers: 0, secrets: 0, secretTypes: [], skipped: "binary", sizeBytes: size };
+      }
+    } catch {
+    }
+  }
+  let code;
+  try {
+    code = await readFile(file, "utf-8");
+  } catch {
+    return { file, identifiers: 0, secrets: 0, secretTypes: [], skipped: "read-error", sizeBytes: size };
   }
-  let totalIdentifiers = 0;
-  let totalSecrets = 0;
-  const allResults = [];
-  for (const file of files) {
-    const code = readFileSync4(file, "utf-8");
-    const lang = langFromExt(file);
-    let identifiers = 0;
-    if (!opts.secretsOnly) {
+  const lang = langFromExt(file);
+  let identifiers = 0;
+  if (!opts.secretsOnly && isSourceCodeFile(file)) {
+    try {
       const scanResult = scan(code, lang);
       identifiers = scanResult.tokens.length;
-      totalIdentifiers += identifiers;
+    } catch {
     }
+  }
+  let blocked = [];
+  try {
     const secretResult = scan2(code);
-    const blocked = secretResult.matches.filter((m) => m.action === "block" || m.action === "redact");
-    totalSecrets += blocked.length;
-    allResults.push({
-      file,
-      identifiers,
-      secrets: blocked.length,
-      secretTypes: blocked.map((m) => m.type)
-    });
+    blocked = secretResult.matches.filter((m) => m.action === "block" || m.action === "redact");
+  } catch {
+  }
+  return {
+    file,
+    identifiers,
+    secrets: blocked.length,
+    secretTypes: blocked.map((m) => m.type),
+    sizeBytes: size
+  };
+}
+async function scanFilesParallel(files, opts) {
+  const results = [];
+  let cursor = 0;
+  let done = 0;
+  let lastPrint = 0;
+  let interrupted = false;
+  const stopHandler = () => {
+    interrupted = true;
+  };
+  process.on("SIGINT", stopHandler);
+  process.on("SIGTERM", stopHandler);
+  const isTTY = process.stderr.isTTY === true;
+  const printProgress = (force = false) => {
+    if (opts.quiet) return;
+    const now = Date.now();
+    if (!force && now - lastPrint < PROGRESS_INTERVAL_MS) return;
+    lastPrint = now;
+    const found = results.reduce((acc, r) => acc + r.secrets, 0);
+    const msg = `Scanning ${done}/${files.length} files (${found} secrets so far)...`;
+    if (isTTY) {
+      process.stderr.write(`\r\x1B[K${msg}`);
+    } else {
+      process.stderr.write(`${msg}
+`);
+    }
+  };
+  async function worker() {
+    while (!interrupted) {
+      const i = cursor++;
+      if (i >= files.length) return;
+      const file = files[i];
+      const row = await scanOneFile(file, { secretsOnly: opts.secretsOnly, maxFileSize: opts.maxFileSize });
+      if (row) results.push(row);
+      done++;
+      printProgress();
+    }
+  }
+  printProgress(true);
+  const workers = Array.from({ length: Math.min(opts.concurrency, files.length || 1) }, () => worker());
+  await Promise.all(workers);
+  process.removeListener("SIGINT", stopHandler);
+  process.removeListener("SIGTERM", stopHandler);
+  if (!opts.quiet && isTTY) {
+    process.stderr.write(`\r\x1B[K`);
+  }
+  return { results, interrupted };
+}
+function parseSizeOption(value) {
+  const trimmed = value.trim().toLowerCase();
+  const m = /^(\d+(?:\.\d+)?)\s*(b|k|kb|m|mb|g|gb)?$/.exec(trimmed);
+  if (!m) return null;
+  const n = parseFloat(m[1]);
+  if (!isFinite(n) || n <= 0) return null;
+  const unit = m[2] ?? "b";
+  const mult = unit.startsWith("g") ? 1024 ** 3 : unit.startsWith("m") ? 1024 ** 2 : unit.startsWith("k") ? 1024 : 1;
+  return Math.floor(n * mult);
+}
+program.command("scan <target>").description("Scan file or directory for identifiers and secrets (no mutation)").option("--secrets-only", "Only scan for secrets/credentials", false).option("--json", "Output as JSON", false).option("--max-file-size <size>", "Skip files larger than this (e.g. 10mb, 500k)", "10mb").option("--concurrency <n>", "Max files scanned in parallel", String(SCAN_CONCURRENCY)).option("--quiet", "Suppress progress output", false).action(async (target, opts) => {
+  const absTarget = resolve2(target);
+  if (!existsSync6(absTarget)) {
+    console.error(chalk7.red("Error: Path not found:"), chalk7.bold(absTarget));
+    process.exit(1);
+  }
+  const maxFileSize = parseSizeOption(opts.maxFileSize);
+  if (maxFileSize === null) {
+    console.error(chalk7.red("Error: Invalid --max-file-size value:"), chalk7.bold(opts.maxFileSize));
+    console.error(chalk7.gray("Use bytes or a unit suffix, e.g. 10mb, 500k, 1048576"));
+    process.exit(1);
+  }
+  const concurrency = Math.max(1, parseInt(opts.concurrency, 10) || SCAN_CONCURRENCY);
+  if (!opts.quiet && !opts.json) {
+    process.stderr.write(chalk7.gray(`Discovering files in ${absTarget}...
+`));
+  }
+  const files = collectFiles(target);
+  if (files.length === 0) {
+    console.error(chalk7.red("Error: No source files found at"), chalk7.bold(absTarget));
+    console.error(chalk7.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
+    process.exit(1);
+  }
+  if (!opts.quiet && !opts.json) {
+    process.stderr.write(chalk7.gray(`Found ${files.length} candidate files. Scanning with concurrency=${concurrency}...
+`));
   }
+  const startedAt = Date.now();
+  const { results: allResults, interrupted } = await scanFilesParallel(files, {
+    secretsOnly: opts.secretsOnly,
+    maxFileSize,
+    quiet: opts.quiet || opts.json,
+    concurrency
+  });
+  const elapsedMs = Date.now() - startedAt;
+  const totalIdentifiers = allResults.reduce((acc, r) => acc + r.identifiers, 0);
+  const totalSecrets = allResults.reduce((acc, r) => acc + r.secrets, 0);
+  const skippedLarge = allResults.filter((r) => r.skipped === "too-large").length;
+  const skippedBinary = allResults.filter((r) => r.skipped === "binary").length;
   if (opts.json) {
-    console.log(JSON.stringify({ files: allResults, totalIdentifiers, totalSecrets }, null, 2));
+    console.log(JSON.stringify({
+      files: allResults,
+      totalIdentifiers,
+      totalSecrets,
+      skippedLarge,
+      skippedBinary,
+      elapsedMs,
+      interrupted
+    }, null, 2));
   } else {
-    console.log(chalk.cyan("\nPretense Scan Results\n"));
+    console.log(chalk7.cyan("\nPretense Scan Results\n"));
     for (const r of allResults) {
-      const secretBadge = r.secrets > 0 ? chalk.red(` [${r.secrets} SECRET${r.secrets > 1 ? "S" : ""}]`) : "";
+      if (r.skipped) {
+        if (r.skipped === "too-large") {
+          const mb = ((r.sizeBytes ?? 0) / 1024 / 1024).toFixed(1);
+          console.log(chalk7.gray(`  ${r.file} \u2014 skipped (${mb} MB > limit)`));
+        }
+        continue;
+      }
+      const secretBadge = r.secrets > 0 ? chalk7.red(` [${r.secrets} SECRET${r.secrets > 1 ? "S" : ""}]`) : "";
+      const showRow = r.secrets > 0 || !opts.secretsOnly && r.identifiers > 0;
+      if (!showRow) continue;
       console.log(
-        chalk.gray("  ") + chalk.white(r.file) + chalk.gray(` \u2014 ${r.identifiers} identifiers`) + secretBadge
+        chalk7.gray("  ") + chalk7.white(r.file) + chalk7.gray(` \u2014 ${r.identifiers} identifiers`) + secretBadge
       );
       if (r.secrets > 0) {
         for (const t of r.secretTypes) {
-          console.log(chalk.red(`    ! ${t}`));
+          console.log(chalk7.red(`    ! ${t}`));
         }
       }
     }
-    console.log(chalk.gray(`
-  Total: ${files.length} files, ${totalIdentifiers} identifiers, `) + (totalSecrets > 0 ? chalk.red(`${totalSecrets} secrets found`) : chalk.green("0 secrets")));
+    const skipNote = skippedLarge + skippedBinary > 0 ? chalk7.gray(` (skipped ${skippedLarge} large, ${skippedBinary} binary)`) : "";
+    console.log(
+      chalk7.gray(`
+  Total: ${allResults.length} files in ${(elapsedMs / 1e3).toFixed(2)}s, ${totalIdentifiers} identifiers, `) + (totalSecrets > 0 ? chalk7.red(`${totalSecrets} secrets found`) : chalk7.green("0 secrets")) + skipNote
+    );
+    if (interrupted) {
+      console.log(chalk7.yellow("\n  Interrupted \u2014 partial results shown above."));
+    }
     console.log();
   }
+  if (!opts.json) {
+    printTokenFooter(allResults.length, totalIdentifiers);
+  }
+  if (interrupted) {
+    process.exit(130);
+  }
   if (totalSecrets > 0) {
     process.exit(2);
   }
 });
-program.command("mutate <file>").description("Mutate a file and print result to stdout").option("-s, --seed <seed>", "Mutation seed", "pretense").option("--save", "Save mutation map to .pretense/", false).option("--json", "Output as JSON (includes map + stats)", false).action((file, opts) => {
+program.command("mutate <file>").description("Mutate a file and print result to stdout").option("-s, --seed <seed>", "Mutation seed", "pretense").option("-l, --language <lang>", "Source language (typescript, javascript, python, go, java, csharp, ruby, rust)").option("--save", "Save mutation map to .pretense/", false).option("--json", "Output as JSON (includes map + stats)", false).action((file, opts) => {
   const absPath = resolve2(file);
-  if (!existsSync4(absPath)) {
-    console.error(chalk.red("File not found:"), chalk.bold(absPath));
+  if (!existsSync6(absPath)) {
+    console.error(chalk7.red("Error: File not found:"), chalk7.bold(absPath));
+    process.exit(1);
+  }
+  if (opts.language) {
+    const validLang = validateLanguage(opts.language);
+    if (!validLang) {
+      console.error(chalk7.red("Error: Unsupported language:"), chalk7.bold(opts.language));
+      console.error(chalk7.gray("Supported languages: " + SUPPORTED_LANGUAGES.join(", ")));
+      process.exit(1);
+    }
+  }
+  if (!SUPPORTED_EXTENSIONS.has(extname(absPath).toLowerCase()) && isBinaryFile(absPath)) {
+    console.error(chalk7.red("Error: Not a supported source file:"), chalk7.bold(absPath));
+    console.error(chalk7.gray("Supported extensions: " + [...SUPPORTED_EXTENSIONS].join(", ")));
     process.exit(1);
   }
-  const code = readFileSync4(absPath, "utf-8");
-  const lang = langFromExt(absPath);
+  const code = readFileSync6(absPath, "utf-8");
+  const lang = opts.language ? validateLanguage(opts.language) : langFromExt(absPath);
   const result = mutate(code, lang, opts.seed);
   if (opts.save) {
     const configDir = getConfigDir();
-    const store = new MutationStore(join3(configDir, "mutation-map.json"));
+    const store = new MutationStore(join5(configDir, "mutation-map.json"));
     store.load();
     store.save({
       id: absPath,
@@ -1524,7 +2719,7 @@ program.command("mutate <file>").description("Mutate a file and print result to
       language: lang
     });
     store.persist();
-    process.stderr.write(chalk.gray(`Mutation map saved to ${configDir}/mutation-map.json
+    process.stderr.write(chalk7.gray(`Mutation map saved to ${configDir}/mutation-map.json
 `));
   }
   if (opts.json) {
@@ -1535,35 +2730,44 @@ program.command("mutate <file>").description("Mutate a file and print result to
     }, null, 2));
   } else {
     process.stdout.write(result.mutatedCode);
-    process.stderr.write(chalk.gray(`
+    process.stderr.write(chalk7.gray(`
 --- ${result.stats.tokensMutated} identifiers mutated in ${result.stats.durationMs}ms ---
 `));
+    printTokenFooter(1, result.stats.tokensMutated);
   }
 });
 program.command("reverse <file>").description("Reverse mutations using stored map").option("-m, --map <path>", "Path to mutation map JSON file").action((file, opts) => {
   const absPath = resolve2(file);
-  if (!existsSync4(absPath)) {
-    console.error(chalk.red("File not found:"), chalk.bold(absPath));
+  if (!existsSync6(absPath)) {
+    console.error(chalk7.red("Error: File not found:"), chalk7.bold(absPath));
     process.exit(1);
   }
-  const mutatedCode = readFileSync4(absPath, "utf-8");
-  const mapPath = opts.map ? resolve2(opts.map) : join3(getConfigDir(), "mutation-map.json");
-  if (!existsSync4(mapPath)) {
-    console.error(chalk.red("Mutation map not found:"), chalk.bold(mapPath));
-    console.error(chalk.gray("Run 'pretense mutate --save' first, or specify --map <path>"));
+  const mutatedCode = readFileSync6(absPath, "utf-8");
+  const mapPath = opts.map ? resolve2(opts.map) : join5(getConfigDir(), "mutation-map.json");
+  if (!existsSync6(mapPath)) {
+    console.error(chalk7.red("Error: Mutation map not found:"), chalk7.bold(mapPath));
+    console.error(chalk7.gray("Run 'pretense mutate --save' first, or specify --map <path>"));
+    process.exit(1);
+  }
+  let store;
+  try {
+    store = new MutationStore(mapPath);
+    store.load();
+  } catch {
+    console.error(chalk7.red("Error: Failed to load mutation map:"), chalk7.bold(mapPath));
+    console.error(chalk7.gray("The file may be corrupted. Run 'pretense mutate --save' to regenerate."));
     process.exit(1);
   }
-  const store = new MutationStore(mapPath);
-  store.load();
   const entry = store.get(absPath) ?? store.getByHash(absPath) ?? store.list(1)[0];
   if (!entry) {
-    console.error(chalk.red("No mutation map found for this file."));
+    console.error(chalk7.red("Error: No mutation map entries found."));
+    console.error(chalk7.gray("Run 'pretense mutate --save <file>' first to generate a map."));
     process.exit(1);
   }
   const map = MutationStore.toMap(entry);
   const restored = reverse(mutatedCode, map);
   process.stdout.write(restored);
-  process.stderr.write(chalk.gray(`
+  process.stderr.write(chalk7.gray(`
 --- Reversed ${map.size} mutations ---
 `));
 });
@@ -1577,5 +2781,35 @@ program.command("audit").description("View the audit log").option("--json", "Out
 program.command("version").description("Print Pretense CLI version").action(() => {
   console.log(`@pretense/cli v${VERSION}`);
 });
+program.command("status").description("Show current plan, monthly quota, seat usage").action(() => {
+  runStatus();
+});
+program.command("usage").description("Alias for `pretense status` \u2014 show monthly quota usage").action(() => {
+  runStatus();
+});
+program.command("tokens").description("Alias for `pretense credits` \u2014 show remaining mutation budget").action(() => {
+  runCredits();
+});
+program.command("upgrade").description("Compare plans and upgrade to Pro or Enterprise").action(() => {
+  runUpgrade();
+});
+program.command("credits").description("Show remaining mutation/scan budget for the current month").action(() => {
+  runCredits();
+});
+program.command("login").description("Save a Pretense API key to ~/.pretense/config.json for future CLI runs").option("-k, --key <key>", "API key (pk_live_...). If omitted, read from $PRETENSE_API_KEY or stdin.").action((opts) => {
+  const code = runLogin({ key: opts.key });
+  if (code !== 0) process.exit(code);
+});
+function handleFatalError(err) {
+  if (err instanceof Error && err.message) {
+    console.error(chalk7.red("Error:"), err.message);
+  } else {
+    console.error(chalk7.red("An unexpected error occurred."));
+  }
+  process.exit(1);
+}
+process.on("uncaughtException", handleFatalError);
+process.on("unhandledRejection", handleFatalError);
+program.showSuggestionAfterError(true).showHelpAfterError("(use --help for available commands)");
 program.parse();
 //# sourceMappingURL=index.js.map