@pretense/cli 0.3.0

package/dist/index.js

@@ -0,0 +1,1581 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+import chalk from "chalk";
+import { readFileSync as readFileSync4, existsSync as existsSync4, readdirSync, statSync } from "fs";
+import { resolve as resolve2, extname, join as join3 } from "path";
+
+// src/types.ts
+var DEFAULT_CONFIG = {
+  port: 9339,
+  targetApis: ["https://api.anthropic.com", "https://api.openai.com"],
+  languages: ["typescript", "javascript", "python", "go", "java"],
+  mutationRules: [
+    { tokenType: "Variable" /* Variable */, prefix: "_v" },
+    { tokenType: "Function" /* Function */, prefix: "_fn" },
+    { tokenType: "Class" /* Class */, prefix: "_cls" },
+    { tokenType: "String" /* String */ },
+    { tokenType: "Comment" /* Comment */, strip: true },
+    { tokenType: "Import" /* Import */ },
+    { tokenType: "Property" /* Property */, prefix: "_prop" },
+    { tokenType: "Method" /* Method */, prefix: "_fn" }
+  ],
+  storePath: `${process.env["HOME"] ?? "/tmp"}/.pretense`
+};
+
+// src/scanner.ts
+var TS_JS_KEYWORDS = /* @__PURE__ */ new Set([
+  "abstract",
+  "any",
+  "as",
+  "async",
+  "await",
+  "boolean",
+  "break",
+  "case",
+  "catch",
+  "class",
+  "const",
+  "constructor",
+  "continue",
+  "debugger",
+  "declare",
+  "default",
+  "delete",
+  "do",
+  "else",
+  "enum",
+  "export",
+  "extends",
+  "false",
+  "finally",
+  "for",
+  "from",
+  "function",
+  "get",
+  "if",
+  "implements",
+  "import",
+  "in",
+  "instanceof",
+  "interface",
+  "keyof",
+  "let",
+  "module",
+  "namespace",
+  "never",
+  "new",
+  "null",
+  "number",
+  "object",
+  "of",
+  "package",
+  "private",
+  "protected",
+  "public",
+  "readonly",
+  "require",
+  "return",
+  "set",
+  "static",
+  "string",
+  "super",
+  "switch",
+  "symbol",
+  "this",
+  "throw",
+  "true",
+  "try",
+  "type",
+  "typeof",
+  "undefined",
+  "unknown",
+  "var",
+  "void",
+  "while",
+  "with",
+  "yield",
+  "satisfies",
+  "using",
+  "infer",
+  "asserts"
+]);
+var PYTHON_KEYWORDS = /* @__PURE__ */ new Set([
+  "False",
+  "None",
+  "True",
+  "and",
+  "as",
+  "assert",
+  "async",
+  "await",
+  "break",
+  "class",
+  "continue",
+  "def",
+  "del",
+  "elif",
+  "else",
+  "except",
+  "finally",
+  "for",
+  "from",
+  "global",
+  "if",
+  "import",
+  "in",
+  "is",
+  "lambda",
+  "nonlocal",
+  "not",
+  "or",
+  "pass",
+  "raise",
+  "return",
+  "try",
+  "while",
+  "with",
+  "yield",
+  "self",
+  "cls"
+]);
+var GO_KEYWORDS = /* @__PURE__ */ new Set([
+  "break",
+  "case",
+  "chan",
+  "const",
+  "continue",
+  "default",
+  "defer",
+  "else",
+  "fallthrough",
+  "for",
+  "func",
+  "go",
+  "goto",
+  "if",
+  "import",
+  "interface",
+  "map",
+  "package",
+  "range",
+  "return",
+  "select",
+  "struct",
+  "switch",
+  "type",
+  "var",
+  "nil",
+  "true",
+  "false",
+  "error",
+  "string",
+  "int",
+  "int8",
+  "int16",
+  "int32",
+  "int64",
+  "uint",
+  "uint8",
+  "uint16",
+  "uint32",
+  "uint64",
+  "float32",
+  "float64",
+  "complex64",
+  "complex128",
+  "bool",
+  "byte",
+  "rune",
+  "uintptr",
+  "make",
+  "new",
+  "len",
+  "cap",
+  "append",
+  "copy",
+  "close",
+  "delete",
+  "panic",
+  "recover",
+  "print",
+  "println"
+]);
+var JAVA_KEYWORDS = /* @__PURE__ */ new Set([
+  "abstract",
+  "assert",
+  "boolean",
+  "break",
+  "byte",
+  "case",
+  "catch",
+  "char",
+  "class",
+  "const",
+  "continue",
+  "default",
+  "do",
+  "double",
+  "else",
+  "enum",
+  "extends",
+  "final",
+  "finally",
+  "float",
+  "for",
+  "goto",
+  "if",
+  "implements",
+  "import",
+  "instanceof",
+  "int",
+  "interface",
+  "long",
+  "native",
+  "new",
+  "package",
+  "private",
+  "protected",
+  "public",
+  "return",
+  "short",
+  "static",
+  "strictfp",
+  "super",
+  "switch",
+  "synchronized",
+  "this",
+  "throw",
+  "throws",
+  "transient",
+  "try",
+  "void",
+  "volatile",
+  "while",
+  "true",
+  "false",
+  "null",
+  "var",
+  "record",
+  "sealed",
+  "permits",
+  "yield"
+]);
+function detectLanguage(code) {
+  if (/:[\s]*\w+[\s]*[;,{)]/.test(code) || /import.*from\s+['"]/.test(code) || /interface\s+\w+/.test(code)) return "typescript";
+  if (/\bdef\s+\w+\s*\(/.test(code) || /\bimport\s+\w+/.test(code) && /:$/.test(code)) return "python";
+  if (/\bfunc\s+\w+\s*\(/.test(code) || /\bpackage\s+\w+/.test(code)) return "go";
+  if (/\bpublic\s+class\s+\w+/.test(code) || /\bimport\s+java\./.test(code)) return "java";
+  if (/\bconst\s+\w+\s*=/.test(code) || /\bfunction\s+\w+\s*\(/.test(code)) return "javascript";
+  return "typescript";
+}
+function lineAt(code, index) {
+  let line = 1;
+  for (let i = 0; i < index && i < code.length; i++) {
+    if (code[i] === "\n") line++;
+  }
+  return line;
+}
+function scanTypeScript(code) {
+  const tokens = [];
+  if (!code.trim()) return tokens;
+  const patterns = [
+    // Single-line comment
+    { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
+    // Multi-line comment
+    { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
+    // Import source (the module path string)
+    { re: /\bimport\b[^'"]*['"]([^'"]+)['"]/g, type: "Import" /* Import */, groupIndex: 1 },
+    // Class name
+    { re: /\bclass\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, type: "Class" /* Class */, groupIndex: 1 },
+    // Function/method name (function keyword)
+    { re: /\bfunction\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, type: "Function" /* Function */, groupIndex: 1 },
+    // Arrow function assigned to const/let/var
+    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(?:async\s*)?\(/g, type: "Function" /* Function */, groupIndex: 1 },
+    // Method: identifier followed by (
+    { re: /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g, type: "Method" /* Method */, groupIndex: 1 },
+    // Variable declarations
+    { re: /\b(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\b/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Template literals (preserve backtick wrapper)
+    { re: /`[^`]*`/g, type: "String" /* String */ },
+    // Double-quoted strings
+    { re: /"(?:[^"\\]|\\.)*"/g, type: "String" /* String */ },
+    // Single-quoted strings
+    { re: /'(?:[^'\\]|\\.)*'/g, type: "String" /* String */ }
+  ];
+  for (const { re, type, groupIndex } of patterns) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const fullMatch = m[0];
+      const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
+      const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
+      if (!captureValue || captureValue.trim() === "") continue;
+      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */ || type === "Method" /* Method */ || type === "Property" /* Property */) {
+        if (TS_JS_KEYWORDS.has(captureValue)) continue;
+        if (/^(console|process|Object|Array|Math|JSON|Promise|Error|Map|Set|Date|RegExp|Symbol|Proxy|Reflect|global|globalThis|window|document|module|exports|require|__dirname|__filename)$/.test(captureValue)) continue;
+        if (captureValue.length <= 1) continue;
+      }
+      tokens.push({
+        type,
+        value: captureValue,
+        start: captureStart,
+        end: captureStart + captureValue.length,
+        line: lineAt(code, captureStart)
+      });
+    }
+  }
+  return deduplicate(tokens);
+}
+function scanPython(code) {
+  const tokens = [];
+  if (!code.trim()) return tokens;
+  const patterns = [
+    // Triple-quoted docstrings
+    { re: /"""[\s\S]*?"""|'''[\s\S]*?'''/g, type: "Comment" /* Comment */ },
+    // Line comments
+    { re: /#[^\n]*/g, type: "Comment" /* Comment */ },
+    // Import module name
+    { re: /\bimport\s+([A-Za-z_][A-Za-z0-9_.]*)/g, type: "Import" /* Import */, groupIndex: 1 },
+    { re: /\bfrom\s+([A-Za-z_.][A-Za-z0-9_.]*)\s+import/g, type: "Import" /* Import */, groupIndex: 1 },
+    // Class name
+    { re: /\bclass\s+([A-Za-z_][A-Za-z0-9_]*)/g, type: "Class" /* Class */, groupIndex: 1 },
+    // Function/method def
+    { re: /\bdef\s+([A-Za-z_][A-Za-z0-9_]*)/g, type: "Function" /* Function */, groupIndex: 1 },
+    // Variable assignment (simple name = ...)
+    { re: /^([A-Za-z_][A-Za-z0-9_]*)\s*=/gm, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Double-quoted strings
+    { re: /"(?:[^"\\]|\\.)*"/g, type: "String" /* String */ },
+    // Single-quoted strings
+    { re: /'(?:[^'\\]|\\.)*'/g, type: "String" /* String */ }
+  ];
+  for (const { re, type, groupIndex } of patterns) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const fullMatch = m[0];
+      const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
+      const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
+      if (!captureValue || captureValue.trim() === "") continue;
+      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */) {
+        if (PYTHON_KEYWORDS.has(captureValue)) continue;
+        if (captureValue.length <= 1) continue;
+        if (captureValue.startsWith("__") && captureValue.endsWith("__")) continue;
+      }
+      tokens.push({
+        type,
+        value: captureValue,
+        start: captureStart,
+        end: captureStart + captureValue.length,
+        line: lineAt(code, captureStart)
+      });
+    }
+  }
+  return deduplicate(tokens);
+}
+function scanGo(code) {
+  const tokens = [];
+  if (!code.trim()) return tokens;
+  const patterns = [
+    { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
+    { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
+    // Import path
+    { re: /import\s*\(\s*([\s\S]*?)\s*\)/g, type: "Import" /* Import */ },
+    { re: /import\s+"([^"]+)"/g, type: "Import" /* Import */, groupIndex: 1 },
+    // Type declaration
+    { re: /\btype\s+([A-Za-z_][A-Za-z0-9_]*)\s+(?:struct|interface)/g, type: "Class" /* Class */, groupIndex: 1 },
+    // Func name
+    { re: /\bfunc\s+(?:\([^)]*\)\s*)?([A-Za-z_][A-Za-z0-9_]*)\s*\(/g, type: "Function" /* Function */, groupIndex: 1 },
+    // Var/const declaration
+    { re: /\b(?:var|const)\s+([A-Za-z_][A-Za-z0-9_]*)\b/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Short variable declaration
+    { re: /\b([A-Za-z_][A-Za-z0-9_]*)\s*:=/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Double-quoted strings
+    { re: /"(?:[^"\\]|\\.)*"/g, type: "String" /* String */ },
+    // Backtick raw strings
+    { re: /`[^`]*`/g, type: "String" /* String */ }
+  ];
+  for (const { re, type, groupIndex } of patterns) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const fullMatch = m[0];
+      const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
+      const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
+      if (!captureValue || captureValue.trim() === "") continue;
+      if (type === "Variable" /* Variable */ || type === "Function" /* Function */ || type === "Class" /* Class */) {
+        if (GO_KEYWORDS.has(captureValue)) continue;
+        if (captureValue.length <= 1) continue;
+      }
+      tokens.push({
+        type,
+        value: captureValue,
+        start: captureStart,
+        end: captureStart + captureValue.length,
+        line: lineAt(code, captureStart)
+      });
+    }
+  }
+  return deduplicate(tokens);
+}
+function scanJava(code) {
+  const tokens = [];
+  if (!code.trim()) return tokens;
+  const patterns = [
+    { re: /\/\/[^\n]*/g, type: "Comment" /* Comment */ },
+    { re: /\/\*[\s\S]*?\*\//g, type: "Comment" /* Comment */ },
+    // Import statement
+    { re: /\bimport\s+([\w.]+);/g, type: "Import" /* Import */, groupIndex: 1 },
+    // Class/interface/enum
+    { re: /\b(?:class|interface|enum|record)\s+([A-Za-z_$][A-Za-z0-9_$]*)/g, type: "Class" /* Class */, groupIndex: 1 },
+    // Method declaration
+    { re: /\b(?:public|private|protected|static|final|abstract|synchronized|native|default)[\w\s<>\[\],]*\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g, type: "Method" /* Method */, groupIndex: 1 },
+    // Variable declaration
+    { re: /\b(?:int|long|double|float|boolean|char|byte|short|String|Object|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*[=;,)]/g, type: "Variable" /* Variable */, groupIndex: 1 },
+    // Double-quoted strings
+    { re: /"(?:[^"\\]|\\.)*"/g, type: "String" /* String */ }
+  ];
+  for (const { re, type, groupIndex } of patterns) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const fullMatch = m[0];
+      const captureValue = groupIndex !== void 0 ? m[groupIndex] ?? fullMatch : fullMatch;
+      const captureStart = groupIndex !== void 0 ? m.index + fullMatch.indexOf(captureValue) : m.index;
+      if (!captureValue || captureValue.trim() === "") continue;
+      if (type === "Variable" /* Variable */ || type === "Method" /* Method */ || type === "Class" /* Class */) {
+        if (JAVA_KEYWORDS.has(captureValue)) continue;
+        if (captureValue.length <= 1) continue;
+        if (/^(String|Object|Integer|Long|Double|Boolean|List|Map|Set|Array|Exception|Error|System|Math|Thread|Class|Enum)$/.test(captureValue)) continue;
+      }
+      tokens.push({
+        type,
+        value: captureValue,
+        start: captureStart,
+        end: captureStart + captureValue.length,
+        line: lineAt(code, captureStart)
+      });
+    }
+  }
+  return deduplicate(tokens);
+}
+function deduplicate(tokens) {
+  tokens.sort((a, b) => a.start - b.start);
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const token of tokens) {
+    const key = `${token.start}:${token.end}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      result.push(token);
+    }
+  }
+  return result;
+}
+function scan(code, language) {
+  if (!code || !code.trim()) {
+    return { tokens: [], language };
+  }
+  const lang = language.toLowerCase();
+  let tokens;
+  switch (lang) {
+    case "typescript":
+    case "javascript":
+    case "ts":
+    case "js":
+    case "tsx":
+    case "jsx":
+      tokens = scanTypeScript(code);
+      break;
+    case "python":
+    case "py":
+      tokens = scanPython(code);
+      break;
+    case "go":
+      tokens = scanGo(code);
+      break;
+    case "java":
+      tokens = scanJava(code);
+      break;
+    default:
+      tokens = scanTypeScript(code);
+  }
+  return { tokens, language: lang };
+}
+
+// src/mutator.ts
+function hash32(str) {
+  let h = 5381;
+  for (let i = 0; i < str.length; i++) {
+    h = (h << 5) + h ^ str.charCodeAt(i);
+  }
+  return h >>> 0;
+}
+function toAlphaNum(n, len) {
+  const CHARS = "abcdefghijklmnopqrstuvwxyz0123456789";
+  let result = "";
+  let v = n;
+  for (let i = 0; i < len; i++) {
+    result = CHARS[v % CHARS.length] + result;
+    v = Math.floor(v / CHARS.length);
+  }
+  return result;
+}
+function deterministicId(original, seed, prefix, len = 4) {
+  const combined = `${seed}:${prefix}:${original}`;
+  const h = hash32(combined);
+  return prefix + toAlphaNum(h, len);
+}
+function prefixForType(type) {
+  switch (type) {
+    case "Class" /* Class */:
+      return "_cls";
+    case "Function" /* Function */:
+    case "Method" /* Method */:
+      return "_fn";
+    case "Variable" /* Variable */:
+      return "_v";
+    case "Property" /* Property */:
+      return "_prop";
+    default:
+      return "_tok";
+  }
+}
+function mutate(code, language, seed = "pretense") {
+  const startMs = performance.now();
+  const lang = language ?? detectLanguage(code);
+  if (!code || !code.trim()) {
+    const emptyMap = /* @__PURE__ */ new Map();
+    return {
+      mutatedCode: code,
+      map: emptyMap,
+      stats: { tokensScanned: 0, tokensMutated: 0, durationMs: 0, language: lang }
+    };
+  }
+  const { tokens } = scan(code, lang);
+  const map = /* @__PURE__ */ new Map();
+  for (const token of tokens) {
+    if (map.has(token.value)) continue;
+    if (token.type === "Comment" /* Comment */) {
+      continue;
+    }
+    if (token.type === "String" /* String */) {
+      continue;
+    }
+    if (token.type === "Import" /* Import */) {
+      continue;
+    }
+    const prefix = prefixForType(token.type);
+    const synthetic = deterministicId(token.value, seed, prefix);
+    map.set(token.value, synthetic);
+  }
+  const entries = [...map.entries()].sort((a, b) => b[0].length - a[0].length);
+  let mutatedCode = code;
+  for (const [original, synthetic] of entries) {
+    if (!synthetic) continue;
+    const escaped = original.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    if (original.match(/^[A-Za-z_$][A-Za-z0-9_$]*$/)) {
+      mutatedCode = mutatedCode.replace(new RegExp(`\\b${escaped}\\b`, "g"), synthetic);
+    } else {
+      mutatedCode = mutatedCode.split(original).join(synthetic);
+    }
+  }
+  const durationMs = Math.round((performance.now() - startMs) * 100) / 100;
+  return {
+    mutatedCode,
+    map,
+    stats: {
+      tokensScanned: tokens.length,
+      tokensMutated: map.size,
+      durationMs,
+      language: lang
+    }
+  };
+}
+
+// src/reverser.ts
+function reverse(mutatedCode, map) {
+  if (!mutatedCode || map.size === 0) return mutatedCode;
+  const reverseMap = /* @__PURE__ */ new Map();
+  for (const [original, synthetic] of map.entries()) {
+    if (synthetic === "" || !synthetic) continue;
+    reverseMap.set(synthetic, original);
+  }
+  if (reverseMap.size === 0) return mutatedCode;
+  const sortedEntries = [...reverseMap.entries()].sort((a, b) => b[0].length - a[0].length);
+  let result = mutatedCode;
+  for (const [synthetic, original] of sortedEntries) {
+    const escaped = synthetic.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    if (synthetic.match(/^[A-Za-z_$][A-Za-z0-9_$]*$/) || synthetic.match(/^_[a-z]+[a-z0-9]{4,}$/)) {
+      result = result.replace(new RegExp(`\\b${escaped}\\b`, "g"), original);
+    } else {
+      result = result.split(synthetic).join(original);
+    }
+  }
+  return result;
+}
+
+// src/secrets.ts
+var SECRET_PATTERNS = [
+  { name: "anthropic-api-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /sk-ant-api\d{2}-[A-Za-z0-9_-]{40,}/g },
+  { name: "openai-api-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /sk-[A-Za-z0-9]{20,}/g },
+  { name: "aws-access-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /AKIA[0-9A-Z]{16}/g },
+  { name: "aws-secret-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/g },
+  { name: "github-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /gh[ps]_[A-Za-z0-9_]{36,}/g },
+  { name: "github-fine-grained", category: "secret", severity: "critical", defaultAction: "block", pattern: /github_pat_[A-Za-z0-9_]{22,}/g },
+  { name: "stripe-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /(?:sk|pk|rk)_(?:test|live)_[A-Za-z0-9]{20,}/g },
+  { name: "private-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
+  { name: "jwt-token", category: "secret", severity: "high", defaultAction: "block", pattern: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g },
+  { name: "database-url", category: "credential", severity: "critical", defaultAction: "block", pattern: /(?:postgres|mysql|mongodb|redis|amqp):\/\/[^\s'"\\)]+:[^\s'"\\)]+@[^\s'"\\)]+/g },
+  { name: "generic-password", category: "credential", severity: "high", defaultAction: "redact", pattern: /(?:password|passwd|pwd|secret|token|api_key|apikey|api-key)\s*[=:]\s*['"][^\s'"]{8,}['"]/gi },
+  { name: "slack-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /xox[bpors]-[A-Za-z0-9-]{10,}/g },
+  { name: "google-api-key", category: "secret", severity: "high", defaultAction: "block", pattern: /AIza[A-Za-z0-9_-]{35}/g },
+  { name: "npm-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /npm_[A-Za-z0-9]{36}/g },
+  { name: "sendgrid-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g },
+  { name: "twilio-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /SK[a-f0-9]{32}/g },
+  // ─── Additional patterns (v0.3) ──────────────────────────────────────────────
+  { name: "azure-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /(?:AccountKey|SharedAccessKey)=[A-Za-z0-9+/=]{40,}/g },
+  { name: "mailgun-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /key-[a-f0-9]{32}/g },
+  { name: "twilio-sid", category: "secret", severity: "high", defaultAction: "block", pattern: /AC[a-f0-9]{32}/g },
+  { name: "heroku-api-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /[hH]eroku.*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/g },
+  { name: "shopify-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /shpat_[a-fA-F0-9]{32}/g },
+  { name: "datadog-key", category: "secret", severity: "high", defaultAction: "block", pattern: /dd[a-z]{1,2}_[a-zA-Z0-9]{32,}/g },
+  { name: "vercel-token", category: "secret", severity: "high", defaultAction: "block", pattern: /vc_[a-zA-Z0-9]{24,}/g },
+  { name: "supabase-key", category: "secret", severity: "critical", defaultAction: "block", pattern: /sbp_[a-f0-9]{40}/g },
+  { name: "linear-api-key", category: "secret", severity: "high", defaultAction: "block", pattern: /lin_api_[A-Za-z0-9]{40}/g },
+  { name: "cloudflare-api-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /v1\.0-[a-f0-9]{24}-[a-f0-9]{146}/g },
+  { name: "discord-bot-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}/g },
+  { name: "grafana-api-key", category: "secret", severity: "high", defaultAction: "block", pattern: /eyJrIjoi[A-Za-z0-9_-]{40,}/g },
+  { name: "confluent-key", category: "secret", severity: "high", defaultAction: "block", pattern: /CONFLUENT[A-Z_]*\s*[=:]\s*['"]?[A-Za-z0-9/+=]{16,}['"]?/g },
+  { name: "digitalocean-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /dop_v1_[a-f0-9]{64}/g },
+  { name: "doppler-token", category: "secret", severity: "high", defaultAction: "block", pattern: /dp\.st\.[a-z0-9_-]{2,}\.[A-Za-z0-9]{40,}/g },
+  { name: "planetscale-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /pscale_tkn_[A-Za-z0-9_-]{32,}/g },
+  { name: "hashicorp-vault-token", category: "secret", severity: "critical", defaultAction: "block", pattern: /hvs\.[A-Za-z0-9_-]{24,}/g },
+  { name: "fastly-api-key", category: "secret", severity: "high", defaultAction: "block", pattern: /fastly_[A-Za-z0-9]{32}/g },
+  { name: "algolia-api-key", category: "secret", severity: "high", defaultAction: "block", pattern: /[a-f0-9]{32}/g, validate: (m) => /ALGOLIA|algolia/.test(m) },
+  { name: "pulumi-token", category: "secret", severity: "high", defaultAction: "block", pattern: /pul-[a-f0-9]{40}/g }
+];
+var PII_PATTERNS = [
+  { name: "ssn", category: "pii", severity: "critical", defaultAction: "redact", pattern: /\b\d{3}-\d{2}-\d{4}\b/g },
+  { name: "credit-card", category: "pii", severity: "critical", defaultAction: "redact", pattern: /\b(?:\d[ -]*?){13,19}\b/g, validate: luhnCheck },
+  { name: "email", category: "pii", severity: "medium", defaultAction: "warn", pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g },
+  { name: "phone-us", category: "pii", severity: "medium", defaultAction: "warn", pattern: /\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g },
+  { name: "ip-address", category: "pii", severity: "low", defaultAction: "warn", pattern: /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b/g, validate: (ip) => !ip.startsWith("127.") && !ip.startsWith("0.") && ip !== "255.255.255.255" }
+];
+var ENV_PATTERNS = [
+  { name: "env-secret", category: "credential", severity: "high", defaultAction: "block", pattern: /(?:process\.env\.|os\.environ\[|ENV\[|getenv\()['"]?((?:SECRET|TOKEN|PASSWORD|API_KEY|PRIVATE|AUTH)[A-Z_0-9]*)['"]?\]?\)?/gi }
+];
+function luhnCheck(num) {
+  const digits = num.replace(/\D/g, "");
+  if (digits.length < 13 || digits.length > 19) return false;
+  let sum = 0;
+  let alternate = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let n = parseInt(digits[i], 10);
+    if (alternate) {
+      n *= 2;
+      if (n > 9) n -= 9;
+    }
+    sum += n;
+    alternate = !alternate;
+  }
+  return sum % 10 === 0;
+}
+function shannonEntropy(str) {
+  if (str.length === 0) return 0;
+  const freq = /* @__PURE__ */ new Map();
+  for (const ch of str) {
+    freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  }
+  let entropy = 0;
+  const len = str.length;
+  for (const count of freq.values()) {
+    const p = count / len;
+    if (p > 0) entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+function isHighEntropy(str, minLength = 20, threshold = 4.5) {
+  if (str.length <= minLength) return false;
+  return shannonEntropy(str) > threshold;
+}
+function maskValue(value, type) {
+  if (type.includes("key") || type.includes("token") || type.includes("secret")) return value.slice(0, 6) + "..." + value.slice(-4);
+  if (type === "ssn") return "***-**-" + value.slice(-4);
+  if (type === "credit-card") return "****-****-****-" + value.replace(/\D/g, "").slice(-4);
+  if (type === "email") {
+    const [local, domain] = value.split("@");
+    return (local?.[0] ?? "*") + "***@" + (domain ?? "");
+  }
+  if (value.length > 12) return value.slice(0, 4) + "..." + value.slice(-4);
+  return "***";
+}
+var matchCounter = 0;
+function scan2(text, actionOverrides) {
+  const start = performance.now();
+  const matches = [];
+  const allPatterns = [...SECRET_PATTERNS, ...PII_PATTERNS, ...ENV_PATTERNS];
+  for (const def of allPatterns) {
+    def.pattern.lastIndex = 0;
+    let m;
+    while ((m = def.pattern.exec(text)) !== null) {
+      const value = m[0];
+      if (def.validate && !def.validate(value)) continue;
+      const action = actionOverrides?.[def.name] ?? def.defaultAction;
+      matchCounter++;
+      matches.push({
+        id: `scan_${matchCounter}`,
+        category: def.category,
+        type: def.name,
+        value,
+        masked: maskValue(value, def.name),
+        start: m.index,
+        end: m.index + value.length,
+        severity: def.severity,
+        action
+      });
+    }
+  }
+  const highEntropyPattern = /\b[A-Za-z0-9_\-/.+=$]{21,}\b/g;
+  highEntropyPattern.lastIndex = 0;
+  let hem;
+  while ((hem = highEntropyPattern.exec(text)) !== null) {
+    const value = hem[0];
+    const alreadyMatched = matches.some(
+      (m) => m.start <= hem.index && m.end >= hem.index + value.length
+    );
+    if (alreadyMatched) continue;
+    if (isHighEntropy(value)) {
+      matchCounter++;
+      matches.push({
+        id: `scan_${matchCounter}`,
+        category: "secret",
+        type: "high-entropy-string",
+        value,
+        masked: value.slice(0, 6) + "..." + value.slice(-4),
+        start: hem.index,
+        end: hem.index + value.length,
+        severity: "medium",
+        action: actionOverrides?.["high-entropy-string"] ?? "warn"
+      });
+    }
+  }
+  const severityRank = { critical: 4, high: 3, medium: 2, low: 1 };
+  matches.sort((a, b) => a.start - b.start || severityRank[b.severity] - severityRank[a.severity]);
+  const deduped = [];
+  let lastEnd = -1;
+  for (const match of matches) {
+    if (match.start >= lastEnd) {
+      deduped.push(match);
+      lastEnd = match.end;
+    }
+  }
+  return {
+    clean: deduped.filter((m) => m.action === "block" || m.action === "redact").length === 0,
+    matches: deduped,
+    scannedAt: Date.now(),
+    durationMs: Math.round((performance.now() - start) * 100) / 100
+  };
+}
+function applyRedactions(text, matches) {
+  const sorted = [...matches].sort((a, b) => b.start - a.start);
+  let result = text;
+  for (const match of sorted) {
+    if (match.action === "block" || match.action === "redact") {
+      result = result.slice(0, match.start) + `[PRETENSE:${match.type.toUpperCase()}]` + result.slice(match.end);
+    }
+  }
+  return result;
+}
+
+// src/store.ts
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
+import { dirname } from "path";
+var MutationStore = class {
+  entries = /* @__PURE__ */ new Map();
+  filePath;
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  /**
+   * Persist a mutation map with associated metadata.
+   *
+   * @example
+   * store.save({ id: "req-1", originalHash: "abc", mapEntries: [...], timestamp: Date.now(), language: "typescript" });
+   */
+  save(entry) {
+    this.entries.set(entry.id, { ...entry });
+  }
+  /**
+   * Retrieve a stored entry by request ID.
+   *
+   * @example
+   * const entry = store.get("req-1");
+   */
+  get(id) {
+    return this.entries.get(id) ?? null;
+  }
+  /**
+   * Find the most recent entry whose originalHash matches.
+   *
+   * @example
+   * const entry = store.getByHash("sha256-abc123");
+   */
+  getByHash(hash) {
+    for (const entry of [...this.entries.values()].reverse()) {
+      if (entry.originalHash === hash) return entry;
+    }
+    return null;
+  }
+  /**
+   * Return all stored entries, newest first, up to `limit`.
+   *
+   * @example
+   * store.list(10) // last 10 entries
+   */
+  list(limit = 50) {
+    const all = [...this.entries.values()].reverse();
+    return all.slice(0, limit);
+  }
+  /**
+   * Delete an entry by ID. Returns true if it existed.
+   */
+  delete(id) {
+    return this.entries.delete(id);
+  }
+  /**
+   * Remove all entries from memory.
+   */
+  clear() {
+    this.entries.clear();
+  }
+  /**
+   * Write current in-memory state to the JSON file.
+   */
+  persist() {
+    const dir = dirname(this.filePath);
+    if (!existsSync(dir)) {
+      mkdirSync(dir, { recursive: true });
+    }
+    const data = JSON.stringify([...this.entries.values()], null, 2);
+    writeFileSync(this.filePath, data, "utf-8");
+  }
+  /**
+   * Load entries from the JSON file into memory.
+   * No-ops if the file doesn't exist.
+   */
+  load() {
+    if (!existsSync(this.filePath)) return;
+    try {
+      const raw = readFileSync(this.filePath, "utf-8");
+      const parsed = JSON.parse(raw);
+      this.entries.clear();
+      for (const entry of parsed) {
+        this.entries.set(entry.id, entry);
+      }
+    } catch {
+      this.entries.clear();
+    }
+  }
+  /** Total entries in memory */
+  get size() {
+    return this.entries.size;
+  }
+  /**
+   * Reconstruct a MutationMap from a stored entry.
+   *
+   * @example
+   * const map = store.toMap(entry);
+   * reverse(mutatedCode, map);
+   */
+  static toMap(entry) {
+    return new Map(entry.mapEntries);
+  }
+  /**
+   * Serialize a MutationMap to the format stored in StoreEntry.
+   */
+  static fromMap(map) {
+    return [...map.entries()];
+  }
+};
+
+// src/config.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join, resolve } from "path";
+var CONFIG_DIR_NAME = ".pretense";
+var CONFIG_FILE = "config.json";
+var MUTATION_MAP_FILE = "mutation-map.json";
+var AUDIT_LOG_FILE = "audit.log";
+var USAGE_FILE = "usage.json";
+function getConfigDir(baseDir) {
+  const base = baseDir ?? process.cwd();
+  return resolve(base, CONFIG_DIR_NAME);
+}
+function initConfig(dir) {
+  const configDir = getConfigDir(dir);
+  if (!existsSync2(configDir)) {
+    mkdirSync2(configDir, { recursive: true });
+  }
+  const configPath = join(configDir, CONFIG_FILE);
+  if (!existsSync2(configPath)) {
+    const config = {
+      ...DEFAULT_CONFIG,
+      storePath: configDir
+    };
+    writeFileSync2(configPath, JSON.stringify(config, null, 2), "utf-8");
+  }
+  const mapPath = join(configDir, MUTATION_MAP_FILE);
+  if (!existsSync2(mapPath)) {
+    writeFileSync2(mapPath, "[]", "utf-8");
+  }
+  const auditPath = join(configDir, AUDIT_LOG_FILE);
+  if (!existsSync2(auditPath)) {
+    writeFileSync2(auditPath, "", "utf-8");
+  }
+  const usagePath = join(configDir, USAGE_FILE);
+  if (!existsSync2(usagePath)) {
+    writeFileSync2(
+      usagePath,
+      JSON.stringify({ date: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), mutations: 0, firstUseDate: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10) }, null, 2),
+      "utf-8"
+    );
+  }
+  return configDir;
+}
+function loadConfig(dir) {
+  const configDir = getConfigDir(dir);
+  const configPath = join(configDir, CONFIG_FILE);
+  if (!existsSync2(configPath)) {
+    return { ...DEFAULT_CONFIG };
+  }
+  try {
+    const raw = readFileSync2(configPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    return { ...DEFAULT_CONFIG, ...parsed };
+  } catch {
+    return { ...DEFAULT_CONFIG };
+  }
+}
+function loadUsage(dir) {
+  const configDir = getConfigDir(dir);
+  const usagePath = join(configDir, USAGE_FILE);
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  if (!existsSync2(usagePath)) {
+    return { date: today, mutations: 0, firstUseDate: today };
+  }
+  try {
+    const raw = readFileSync2(usagePath, "utf-8");
+    const data = JSON.parse(raw);
+    if (data.date !== today) {
+      return { date: today, mutations: 0, firstUseDate: data.firstUseDate ?? today };
+    }
+    return data;
+  } catch {
+    return { date: today, mutations: 0, firstUseDate: today };
+  }
+}
+function saveUsage(usage, dir) {
+  const configDir = getConfigDir(dir);
+  if (!existsSync2(configDir)) {
+    mkdirSync2(configDir, { recursive: true });
+  }
+  const usagePath = join(configDir, USAGE_FILE);
+  writeFileSync2(usagePath, JSON.stringify(usage, null, 2), "utf-8");
+}
+function detectTier() {
+  const key = process.env["PRETENSE_LICENSE_KEY"] ?? "";
+  if (key.startsWith("pre_ent_")) return "enterprise";
+  if (key.startsWith("pre_pro_")) return "pro";
+  return "free";
+}
+function getTierLimits(tier) {
+  switch (tier) {
+    case "enterprise":
+      return { dailyMutations: Infinity, auditRetentionDays: Infinity };
+    case "pro":
+      return { dailyMutations: Infinity, auditRetentionDays: 90 };
+    case "free":
+    default:
+      return { dailyMutations: 500, auditRetentionDays: 3 };
+  }
+}
+
+// src/audit.ts
+import { appendFileSync, existsSync as existsSync3, readFileSync as readFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { join as join2, dirname as dirname2 } from "path";
+function writeAuditEntry(entry, dir) {
+  const configDir = getConfigDir(dir);
+  const auditPath = join2(configDir, "audit.log");
+  const logDir = dirname2(auditPath);
+  if (!existsSync3(logDir)) {
+    mkdirSync3(logDir, { recursive: true });
+  }
+  const line = JSON.stringify(entry) + "\n";
+  appendFileSync(auditPath, line, "utf-8");
+}
+function createAuditEntry(sessionId, file, identifiersMutated, secretsBlocked, llmProvider, latencyMs) {
+  return {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    sessionId,
+    file,
+    identifiersMutated,
+    secretsBlocked,
+    llmProvider,
+    latencyMs
+  };
+}
+function readAuditLog(options = {}) {
+  const { limit, dir } = options;
+  const configDir = getConfigDir(dir);
+  const auditPath = join2(configDir, "audit.log");
+  if (!existsSync3(auditPath)) {
+    return [];
+  }
+  const raw = readFileSync3(auditPath, "utf-8");
+  const lines = raw.trim().split("\n").filter(Boolean);
+  let entries = [];
+  for (const line of lines) {
+    try {
+      entries.push(JSON.parse(line));
+    } catch {
+    }
+  }
+  const tier = detectTier();
+  const { auditRetentionDays } = getTierLimits(tier);
+  if (auditRetentionDays !== Infinity) {
+    const cutoff = Date.now() - auditRetentionDays * 24 * 60 * 60 * 1e3;
+    entries = entries.filter((e) => new Date(e.timestamp).getTime() >= cutoff);
+  }
+  entries.sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());
+  if (limit && limit > 0) {
+    entries = entries.slice(0, limit);
+  }
+  return entries;
+}
+function formatJson(entries) {
+  return JSON.stringify(entries, null, 2);
+}
+function formatCsv(entries) {
+  const headers = "timestamp,sessionId,file,identifiersMutated,secretsBlocked,llmProvider,latencyMs";
+  const rows = entries.map(
+    (e) => [
+      e.timestamp,
+      e.sessionId,
+      `"${e.file.replace(/"/g, '""')}"`,
+      e.identifiersMutated,
+      e.secretsBlocked,
+      e.llmProvider,
+      e.latencyMs
+    ].join(",")
+  );
+  return [headers, ...rows].join("\n");
+}
+function formatText(entries) {
+  if (entries.length === 0) return "No audit entries found.";
+  const lines = entries.map((e) => {
+    const date = new Date(e.timestamp).toLocaleString();
+    return `[${date}] ${e.file} | ${e.identifiersMutated} mutated | ${e.secretsBlocked} secrets blocked | ${e.llmProvider} | ${e.latencyMs}ms`;
+  });
+  return lines.join("\n");
+}
+function formatAudit(entries, format = "text") {
+  switch (format) {
+    case "json":
+      return formatJson(entries);
+    case "csv":
+      return formatCsv(entries);
+    case "text":
+    default:
+      return formatText(entries);
+  }
+}
+
+// src/proxy.ts
+import { Hono } from "hono";
+import { serve } from "@hono/node-server";
+import { nanoid } from "nanoid";
+function detectUpstream(path) {
+  if (path.includes("/v1/messages")) return "https://api.anthropic.com";
+  if (path.includes("/v1/chat/completions") || path.includes("/v1/completions")) return "https://api.openai.com";
+  if (path.includes("/v1beta/") || path.includes("/v1/models")) return "https://generativelanguage.googleapis.com";
+  return "https://api.openai.com";
+}
+function detectProvider(path) {
+  if (path.includes("/v1/messages")) return "anthropic";
+  if (path.includes("/v1/chat/completions") || path.includes("/v1/completions")) return "openai";
+  if (path.includes("/v1beta/") || path.includes("/v1/models")) return "google";
+  return "openai";
+}
+function extractText(body) {
+  const parts = [];
+  if (typeof body["system"] === "string") parts.push(body["system"]);
+  if (Array.isArray(body["messages"])) {
+    for (const msg of body["messages"]) {
+      if (typeof msg["content"] === "string") parts.push(msg["content"]);
+      else if (Array.isArray(msg["content"])) {
+        for (const block of msg["content"]) {
+          if (block["type"] === "text" && typeof block["text"] === "string") parts.push(block["text"]);
+        }
+      }
+    }
+  }
+  return parts.join("\n");
+}
+function extractCodeBlocks(text) {
+  const blocks = [];
+  const re = /```(\w*)\n([\s\S]*?)```/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    blocks.push({
+      code: m[2] ?? "",
+      language: m[1] ?? "typescript",
+      start: m.index,
+      end: m.index + m[0].length
+    });
+  }
+  return blocks;
+}
+function replaceCodeBlocks(text, blocks, replacements) {
+  let result = text;
+  for (let i = blocks.length - 1; i >= 0; i--) {
+    const block = blocks[i];
+    const replacement = replacements[i] ?? block.code;
+    const lang = block.language ?? "typescript";
+    result = result.slice(0, block.start) + "```" + lang + "\n" + replacement + "```" + result.slice(block.end);
+  }
+  return result;
+}
+function applyToBody(body, transform) {
+  const mutateField = (val) => {
+    if (typeof val === "string") return transform(val);
+    if (Array.isArray(val)) return val.map(mutateField);
+    if (val && typeof val === "object") {
+      const obj = val;
+      return Object.fromEntries(Object.entries(obj).map(([k, v]) => [k, mutateField(v)]));
+    }
+    return val;
+  };
+  return mutateField(body);
+}
+var stats = {
+  requestsProcessed: 0,
+  totalTokensMutated: 0,
+  totalSecretsBlocked: 0,
+  startedAt: Date.now()
+};
+function daysSinceFirstUse() {
+  const usage = loadUsage();
+  if (!usage.firstUseDate) return 0;
+  const first = new Date(usage.firstUseDate).getTime();
+  return Math.floor((Date.now() - first) / (24 * 60 * 60 * 1e3));
+}
+function printUpgradeNudge(reason) {
+  process.stdout.write(
+    `
+\x1B[33m[PRETENSE] ${reason}\x1B[0m
+\x1B[33m[PRETENSE] Upgrade to Pro: https://pretense.ai/pricing\x1B[0m
+
+`
+  );
+}
+function createProxy(opts = {}) {
+  const config = { ...DEFAULT_CONFIG, ...opts.config };
+  const store = opts.store ?? new MutationStore(`${config.storePath}/proxy-store.json`);
+  const verbose = opts.verbose ?? false;
+  const app = new Hono();
+  app.get(
+    "/health",
+    (c) => c.json({
+      status: "ok",
+      version: "0.3.0",
+      uptime: Math.floor((Date.now() - stats.startedAt) / 1e3),
+      stats: {
+        requestsProcessed: stats.requestsProcessed,
+        totalTokensMutated: stats.totalTokensMutated
+      }
+    })
+  );
+  app.get(
+    "/stats",
+    (c) => c.json({
+      ...stats,
+      storeSize: store.size
+    })
+  );
+  app.get("/audit", (c) => {
+    const limit = parseInt(c.req.query("limit") ?? "50");
+    return c.json(store.list(limit));
+  });
+  app.all("/*", async (c) => {
+    if (c.req.method !== "POST") {
+      const upstream2 = c.req.header("x-pretense-upstream") ?? detectUpstream(c.req.path);
+      const url = upstream2 + c.req.path;
+      const headers2 = {};
+      c.req.raw.headers.forEach((v, k) => {
+        headers2[k] = v;
+      });
+      delete headers2["host"];
+      headers2["host"] = new URL(upstream2).host;
+      const resp = await fetch(url, { method: c.req.method, headers: headers2 });
+      return new Response(resp.body, { status: resp.status, headers: Object.fromEntries(resp.headers.entries()) });
+    }
+    const requestStart = performance.now();
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ error: { type: "invalid_request", message: "Invalid JSON body" } }, 400);
+    }
+    if (!body || Object.keys(body).length === 0) {
+      return c.json({ error: { type: "invalid_request", message: "Empty request body" } }, 400);
+    }
+    const requestId = nanoid(12);
+    const upstream = c.req.header("x-pretense-upstream") ?? detectUpstream(c.req.path);
+    const provider = detectProvider(c.req.path);
+    const tier = detectTier();
+    const { dailyMutations } = getTierLimits(tier);
+    const usage = loadUsage();
+    if (tier === "free" && usage.mutations >= dailyMutations) {
+      return c.json(
+        {
+          error: {
+            type: "pretense_rate_limit",
+            message: `Daily mutation limit reached (${dailyMutations}/day). Upgrade to Pro for unlimited: https://pretense.ai/pricing`
+          }
+        },
+        429
+      );
+    }
+    const fullText = extractText(body);
+    const secretScan = scan2(fullText);
+    const blockedSecrets = secretScan.matches.filter((m) => m.action === "block");
+    if (blockedSecrets.length > 0) {
+      stats.totalSecretsBlocked += blockedSecrets.length;
+      if (tier === "free") {
+        printUpgradeNudge(`${blockedSecrets.length} secret(s) blocked. Pro tier includes real-time secret alerts via Slack/PagerDuty.`);
+      }
+      return c.json(
+        {
+          error: {
+            type: "pretense_blocked",
+            message: `Request blocked: ${blockedSecrets.length} secret(s) detected. Types: ${[...new Set(blockedSecrets.map((m) => m.type))].join(", ")}`
+          }
+        },
+        400
+      );
+    }
+    const processedBody = applyToBody(body, (text) => applyRedactions(text, secretScan.matches));
+    const mutationMap = /* @__PURE__ */ new Map();
+    let tokensMutated = 0;
+    const mutatedBody = applyToBody(processedBody, (text) => {
+      const blocks = extractCodeBlocks(text);
+      if (blocks.length === 0) return text;
+      const mutatedBlocks = [];
+      for (const block of blocks) {
+        const result = mutate(block.code, block.language);
+        for (const [k, v] of result.map.entries()) mutationMap.set(k, v);
+        tokensMutated += result.stats.tokensMutated;
+        mutatedBlocks.push(result.mutatedCode);
+      }
+      return replaceCodeBlocks(text, blocks, mutatedBlocks);
+    });
+    usage.mutations += tokensMutated;
+    saveUsage(usage);
+    if (tier === "free" && usage.mutations >= 400 && usage.mutations - tokensMutated < 400) {
+      printUpgradeNudge(`${usage.mutations}/${dailyMutations} daily mutations used. Running low!`);
+    }
+    if (tier === "free" && daysSinceFirstUse() >= 7) {
+      printUpgradeNudge("You've been using Pretense for 7+ days. Unlock Pro features: unlimited mutations, 90-day audit, Slack alerts.");
+    }
+    const entry = {
+      id: requestId,
+      originalHash: requestId,
+      mapEntries: [...mutationMap.entries()],
+      timestamp: Date.now(),
+      language: "mixed"
+    };
+    store.save(entry);
+    stats.requestsProcessed++;
+    stats.totalTokensMutated += tokensMutated;
+    const latencyMs = Math.round((performance.now() - requestStart) * 100) / 100;
+    writeAuditEntry(
+      createAuditEntry(requestId, "proxy-request", tokensMutated, blockedSecrets.length, provider, latencyMs)
+    );
+    if (verbose && tokensMutated > 0) {
+      process.stdout.write(`[PRETENSE] ${tokensMutated} tokens mutated for request ${requestId}
+`);
+    }
+    const headers = {};
+    c.req.raw.headers.forEach((v, k) => {
+      headers[k] = v;
+    });
+    delete headers["host"];
+    delete headers["content-length"];
+    headers["host"] = new URL(upstream).host;
+    headers["x-pretense-request-id"] = requestId;
+    const forwardBody = JSON.stringify(mutatedBody);
+    let upstreamResp;
+    try {
+      upstreamResp = await fetch(upstream + c.req.path, {
+        method: "POST",
+        headers: { ...headers, "content-type": "application/json", "content-length": String(Buffer.byteLength(forwardBody)) },
+        body: forwardBody
+      });
+    } catch {
+      return c.json({ error: { type: "pretense_upstream_error", message: "Failed to reach upstream provider" } }, 502);
+    }
+    if (body["stream"] === true) {
+      return new Response(upstreamResp.body, {
+        status: upstreamResp.status,
+        headers: {
+          "content-type": upstreamResp.headers.get("content-type") ?? "text/event-stream",
+          "cache-control": "no-cache",
+          "x-pretense-request-id": requestId,
+          "x-pretense-protected": "true",
+          "x-pretense-mutations": String(tokensMutated)
+        }
+      });
+    }
+    const reverseMap = new Map(mutationMap);
+    let respBody;
+    try {
+      respBody = await upstreamResp.json();
+    } catch {
+      return new Response(null, {
+        status: upstreamResp.status,
+        headers: {
+          "x-pretense-protected": "true",
+          "x-pretense-mutations": String(tokensMutated)
+        }
+      });
+    }
+    const reversedBody = applyToBody(respBody, (text) => {
+      const blocks = extractCodeBlocks(text);
+      if (blocks.length === 0) return reverse(text, reverseMap);
+      const reversedBlocks = blocks.map((b) => reverse(b.code, reverseMap));
+      return replaceCodeBlocks(text, blocks, reversedBlocks);
+    });
+    c.header("x-pretense-request-id", requestId);
+    c.header("x-pretense-protected", "true");
+    c.header("x-pretense-mutations", String(tokensMutated));
+    return c.json(reversedBody, upstreamResp.status);
+  });
+  return app;
+}
+function startProxy(opts = {}) {
+  const port = opts.port ?? opts.config?.port ?? DEFAULT_CONFIG.port;
+  const app = createProxy(opts);
+  const tier = detectTier();
+  serve({ fetch: app.fetch, port }, () => {
+    process.stdout.write(`
+\x1B[36m\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
+\u2502                                             \u2502
+\u2502   \x1B[1mPretense\x1B[0m\x1B[36m v0.3.0  [${tier.toUpperCase()}]${" ".repeat(20 - tier.length)}\u2502
+\u2502   Your code hits AI naked. We fix that.     \u2502
+\u2502                                             \u2502
+\u2502   Proxy:  http://localhost:${port}              \u2502
+\u2502   Health: http://localhost:${port}/health       \u2502
+\u2502   Stats:  http://localhost:${port}/stats        \u2502
+\u2502                                             \u2502
+\u2502   ANTHROPIC_BASE_URL=http://localhost:${port}   \u2502
+\u2502   OPENAI_BASE_URL=http://localhost:${port}/v1   \u2502
+\u2502                                             \u2502
+\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\x1B[0m
+`);
+  });
+}
+
+// src/index.ts
+var VERSION = "0.3.0";
+function langFromExt(filePath) {
+  const ext = extname(filePath).toLowerCase();
+  const map = {
+    ".ts": "typescript",
+    ".tsx": "typescript",
+    ".js": "javascript",
+    ".jsx": "javascript",
+    ".mjs": "javascript",
+    ".cjs": "javascript",
+    ".py": "python",
+    ".go": "go",
+    ".java": "java"
+  };
+  return map[ext] ?? "typescript";
+}
+function collectFiles(target) {
+  const abs = resolve2(target);
+  if (!existsSync4(abs)) {
+    return [];
+  }
+  const stat = statSync(abs);
+  if (stat.isFile()) return [abs];
+  const files = [];
+  const supportedExts = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".go", ".java"]);
+  function walk(dir) {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const fullPath = join3(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (["node_modules", ".git", "dist", "build", ".pretense", ".next", "__pycache__"].includes(entry.name)) continue;
+        walk(fullPath);
+      } else if (entry.isFile() && supportedExts.has(extname(entry.name).toLowerCase())) {
+        files.push(fullPath);
+      }
+    }
+  }
+  walk(abs);
+  return files;
+}
+var program = new Command();
+program.name("pretense").description("AI firewall CLI \u2014 mutates proprietary code before LLM API calls").version(VERSION);
+program.command("init").description("Initialize .pretense/ config in current directory").option("-d, --dir <path>", "Target directory", process.cwd()).action((opts) => {
+  const dir = resolve2(opts.dir);
+  console.log(chalk.cyan("Initializing Pretense in"), chalk.bold(dir));
+  const configDir = initConfig(dir);
+  const files = collectFiles(dir);
+  const langCounts = {};
+  for (const f of files) {
+    const lang = langFromExt(f);
+    langCounts[lang] = (langCounts[lang] ?? 0) + 1;
+  }
+  console.log(chalk.green("\n  .pretense/ created at"), chalk.bold(configDir));
+  console.log(chalk.gray(`
+  Scanned ${files.length} source files:`));
+  for (const [lang, count] of Object.entries(langCounts)) {
+    console.log(chalk.gray(`    ${lang}: ${count} files`));
+  }
+  console.log(chalk.cyan("\n  Next: run"), chalk.bold("pretense start"), chalk.cyan("to launch the proxy"));
+  console.log();
+});
+program.command("start").description("Start the Pretense proxy server").option("-p, --port <number>", "Port number", "9339").option("-v, --verbose", "Enable verbose logging", false).action((opts) => {
+  const config = loadConfig();
+  const port = parseInt(opts.port) || config.port;
+  startProxy({ config, port, verbose: opts.verbose });
+});
+program.command("scan <target>").description("Scan file or directory for identifiers and secrets (no mutation)").option("--secrets-only", "Only scan for secrets/credentials", false).option("--json", "Output as JSON", false).action((target, opts) => {
+  const files = collectFiles(target);
+  if (files.length === 0) {
+    console.error(chalk.red("No source files found at"), chalk.bold(target));
+    process.exit(1);
+  }
+  let totalIdentifiers = 0;
+  let totalSecrets = 0;
+  const allResults = [];
+  for (const file of files) {
+    const code = readFileSync4(file, "utf-8");
+    const lang = langFromExt(file);
+    let identifiers = 0;
+    if (!opts.secretsOnly) {
+      const scanResult = scan(code, lang);
+      identifiers = scanResult.tokens.length;
+      totalIdentifiers += identifiers;
+    }
+    const secretResult = scan2(code);
+    const blocked = secretResult.matches.filter((m) => m.action === "block" || m.action === "redact");
+    totalSecrets += blocked.length;
+    allResults.push({
+      file,
+      identifiers,
+      secrets: blocked.length,
+      secretTypes: blocked.map((m) => m.type)
+    });
+  }
+  if (opts.json) {
+    console.log(JSON.stringify({ files: allResults, totalIdentifiers, totalSecrets }, null, 2));
+  } else {
+    console.log(chalk.cyan("\nPretense Scan Results\n"));
+    for (const r of allResults) {
+      const secretBadge = r.secrets > 0 ? chalk.red(` [${r.secrets} SECRET${r.secrets > 1 ? "S" : ""}]`) : "";
+      console.log(
+        chalk.gray("  ") + chalk.white(r.file) + chalk.gray(` \u2014 ${r.identifiers} identifiers`) + secretBadge
+      );
+      if (r.secrets > 0) {
+        for (const t of r.secretTypes) {
+          console.log(chalk.red(`    ! ${t}`));
+        }
+      }
+    }
+    console.log(chalk.gray(`
+  Total: ${files.length} files, ${totalIdentifiers} identifiers, `) + (totalSecrets > 0 ? chalk.red(`${totalSecrets} secrets found`) : chalk.green("0 secrets")));
+    console.log();
+  }
+  if (totalSecrets > 0) {
+    process.exit(2);
+  }
+});
+program.command("mutate <file>").description("Mutate a file and print result to stdout").option("-s, --seed <seed>", "Mutation seed", "pretense").option("--save", "Save mutation map to .pretense/", false).option("--json", "Output as JSON (includes map + stats)", false).action((file, opts) => {
+  const absPath = resolve2(file);
+  if (!existsSync4(absPath)) {
+    console.error(chalk.red("File not found:"), chalk.bold(absPath));
+    process.exit(1);
+  }
+  const code = readFileSync4(absPath, "utf-8");
+  const lang = langFromExt(absPath);
+  const result = mutate(code, lang, opts.seed);
+  if (opts.save) {
+    const configDir = getConfigDir();
+    const store = new MutationStore(join3(configDir, "mutation-map.json"));
+    store.load();
+    store.save({
+      id: absPath,
+      originalHash: absPath,
+      mapEntries: MutationStore.fromMap(result.map),
+      timestamp: Date.now(),
+      language: lang
+    });
+    store.persist();
+    process.stderr.write(chalk.gray(`Mutation map saved to ${configDir}/mutation-map.json
+`));
+  }
+  if (opts.json) {
+    console.log(JSON.stringify({
+      mutatedCode: result.mutatedCode,
+      map: Object.fromEntries(result.map),
+      stats: result.stats
+    }, null, 2));
+  } else {
+    process.stdout.write(result.mutatedCode);
+    process.stderr.write(chalk.gray(`
+--- ${result.stats.tokensMutated} identifiers mutated in ${result.stats.durationMs}ms ---
+`));
+  }
+});
+program.command("reverse <file>").description("Reverse mutations using stored map").option("-m, --map <path>", "Path to mutation map JSON file").action((file, opts) => {
+  const absPath = resolve2(file);
+  if (!existsSync4(absPath)) {
+    console.error(chalk.red("File not found:"), chalk.bold(absPath));
+    process.exit(1);
+  }
+  const mutatedCode = readFileSync4(absPath, "utf-8");
+  const mapPath = opts.map ? resolve2(opts.map) : join3(getConfigDir(), "mutation-map.json");
+  if (!existsSync4(mapPath)) {
+    console.error(chalk.red("Mutation map not found:"), chalk.bold(mapPath));
+    console.error(chalk.gray("Run 'pretense mutate --save' first, or specify --map <path>"));
+    process.exit(1);
+  }
+  const store = new MutationStore(mapPath);
+  store.load();
+  const entry = store.get(absPath) ?? store.getByHash(absPath) ?? store.list(1)[0];
+  if (!entry) {
+    console.error(chalk.red("No mutation map found for this file."));
+    process.exit(1);
+  }
+  const map = MutationStore.toMap(entry);
+  const restored = reverse(mutatedCode, map);
+  process.stdout.write(restored);
+  process.stderr.write(chalk.gray(`
+--- Reversed ${map.size} mutations ---
+`));
+});
+program.command("audit").description("View the audit log").option("--json", "Output as JSON", false).option("--csv", "Output as CSV", false).option("-l, --limit <number>", "Limit entries", "50").action((opts) => {
+  const format = opts.json ? "json" : opts.csv ? "csv" : "text";
+  const limit = parseInt(opts.limit) || 50;
+  const entries = readAuditLog({ limit, format });
+  const output = formatAudit(entries, format);
+  console.log(output);
+});
+program.command("version").description("Print Pretense CLI version").action(() => {
+  console.log(`@pretense/cli v${VERSION}`);
+});
+program.parse();
+//# sourceMappingURL=index.js.map