@pretense/cli 0.6.19 → 0.6.20

package/dist/{chunk-XY4NRTOT.js → chunk-N2GZIZAD.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.19" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.20" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-XY4NRTOT.js";
+} from "./chunk-N2GZIZAD.js";
 import {
   __commonJS,
   __toESM,
@@ -16582,11 +16582,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.19" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.20" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "79bc3b0f2c6a2ff139ae392d2de37679a06308a6".length > 0 ? "79bc3b0f2c6a2ff139ae392d2de37679a06308a6" : UNKNOWN_COMMIT;
+  return "69ea69288cc5d8698de1a2bdb4e3c29c002596c6".length > 0 ? "69ea69288cc5d8698de1a2bdb4e3c29c002596c6" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",
@@ -17201,6 +17201,65 @@ function getTelemetryEmitter(dashboardUrl, pushToken) {
   _emitter = new TelemetryEmitter(url, token);
   return _emitter;
 }
+var DEFAULT_UPLOAD_URL = "https://api.pretense.ai";
+var UPLOAD_TIMEOUT_MS = 5e3;
+var MAX_IN_FLIGHT2 = 64;
+var _inFlight = 0;
+var _dropped = 0;
+function telemetryDisabled() {
+  const v = process.env["PRETENSE_NO_TELEMETRY"]?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+function resolveUploadBaseUrl() {
+  const raw2 = (process.env["PRETENSE_DASHBOARD_URL"] ?? DEFAULT_UPLOAD_URL).trim();
+  if (!raw2) return DEFAULT_UPLOAD_URL;
+  const normalized = /^https?:\/\//i.test(raw2) ? raw2 : `https://${raw2}`;
+  try {
+    const u = new URL(normalized);
+    const path2 = u.pathname === "/" ? "" : u.pathname.replace(/\/$/, "");
+    return `${u.origin}${path2}`;
+  } catch {
+    return DEFAULT_UPLOAD_URL;
+  }
+}
+function resolveUploadKey(requestKey) {
+  const dashboardKey = process.env["PRETENSE_DASHBOARD_API_KEY"]?.trim();
+  if (dashboardKey) return dashboardKey;
+  const rk = requestKey?.trim();
+  return rk && rk.length > 0 ? rk : null;
+}
+function clampCount(n) {
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 0;
+}
+function uploadProxyUsage(event) {
+  if (telemetryDisabled()) return;
+  const key = resolveUploadKey(event.apiKey);
+  if (!key) return;
+  if (_inFlight >= MAX_IN_FLIGHT2) {
+    _dropped++;
+    return;
+  }
+  const url = `${resolveUploadBaseUrl()}/api/cli/log`;
+  const signal = typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(UPLOAD_TIMEOUT_MS) : void 0;
+  _inFlight++;
+  void Promise.resolve().then(
+    () => fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${key}` },
+      // COUNTS + METADATA ONLY — never a secret value or request body.
+      body: JSON.stringify({
+        file_count: 0,
+        identifiers_mutated: clampCount(event.identifiersMutated),
+        secrets_blocked: clampCount(event.secretsBlocked),
+        llm_provider: event.provider
+      }),
+      ...signal ? { signal } : {}
+    })
+  ).catch(() => {
+  }).finally(() => {
+    _inFlight--;
+  });
+}
 var riskScorer = new RiskScorer();
 function detectUpstream(path2, overrideHeader) {
   if (overrideHeader) return overrideHeader;
@@ -18076,6 +18135,15 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
       ...skippedUnscannable > 0 ? { findings: ["skipped_unscannable_field"] } : {},
       sourceIp: c.req.header("x-forwarded-for") ?? c.req.header("x-real-ip")
     }));
+    if (anyTokenized) {
+      const usageKey = c.req.header("x-pretense-api-key") ?? c.req.header("authorization")?.replace(/^Bearer\s+/i, "");
+      uploadProxyUsage({
+        apiKey: usageKey,
+        identifiersMutated: mutationsApplied,
+        secretsBlocked: secretsTokenized,
+        provider
+      });
+    }
     const reverseMap = /* @__PURE__ */ new Map();
     for (const [orig, syn] of globalMap.entries()) {
       if (!secretMap.has(syn)) reverseMap.set(orig, syn);
@@ -21317,6 +21385,67 @@ function recordLocalAudit(rec, dbPath = localAuditDbPath()) {
   }
 }
 
+// src/usage-upload.ts
+init_esm_shims();
+var UPLOAD_TIMEOUT_MS2 = 3e3;
+function telemetryDisabled2() {
+  const v = process.env["PRETENSE_NO_TELEMETRY"]?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+function resolveUploadBaseUrl2() {
+  const raw2 = process.env["PRETENSE_DASHBOARD_URL"]?.trim();
+  if (!raw2) return getConfiguredApiRoot();
+  const normalized = /^https?:\/\//i.test(raw2) ? raw2 : `https://${raw2}`;
+  try {
+    const u = new URL(normalized);
+    const path2 = u.pathname === "/" ? "" : u.pathname.replace(/\/$/, "");
+    return `${u.origin}${path2}`;
+  } catch {
+    return getConfiguredApiRoot();
+  }
+}
+function resolveUploadKey2() {
+  const dashboardKey = process.env["PRETENSE_DASHBOARD_API_KEY"]?.trim();
+  if (dashboardKey) return dashboardKey;
+  return readApiKey();
+}
+function clampCount2(n) {
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 0;
+}
+async function uploadUsage(event) {
+  try {
+    if (telemetryDisabled2()) return "skipped";
+    const key = resolveUploadKey2();
+    if (!key) return "skipped";
+    const url = `${resolveUploadBaseUrl2()}/api/cli/log`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), UPLOAD_TIMEOUT_MS2);
+    try {
+      const resp = await fetch(url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          authorization: `Bearer ${key}`
+        },
+        // COUNTS + METADATA ONLY — never a secret value, an identifier name, or
+        // file content. Field names match the `/api/cli/log` contract.
+        body: JSON.stringify({
+          file_count: clampCount2(event.fileCount),
+          identifiers_mutated: clampCount2(event.identifiersMutated),
+          secrets_blocked: clampCount2(event.secretsBlocked),
+          llm_provider: event.llmProvider
+        }),
+        signal: controller.signal
+      });
+      return resp.ok ? "sent" : "failed";
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch {
+    return "failed";
+  }
+}
+
 // src/commands/mutate.ts
 var REVERSAL_MAP_VERSION = 3;
 function preflightReversalMap(mapPath, absFile, content, contentSha, force) {
@@ -21618,6 +21747,12 @@ async function runMutate(file, opts = {}) {
       detectorKinds: [...new Set(result.mutations.map((m) => m.type))],
       file: absFile
     });
+    await uploadUsage({
+      fileCount: 1,
+      identifiersMutated: result.mutations.length,
+      secretsBlocked,
+      llmProvider: "cli-mutate"
+    });
   }
   if (opts.showMap) {
     console.error(JSON.stringify(result.mutations, null, 2));

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-XY4NRTOT.js";
+} from "./chunk-N2GZIZAD.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.19",
+  "version": "0.6.20",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -24,14 +24,14 @@
     "typescript": "^5.4.0",
     "vitest": "^1.0.0",
     "@pretense/billing": "0.1.0",
-    "@pretense/compliance-engine": "0.1.0",
     "@pretense/protocol": "0.1.0",
     "@pretense/learner": "0.2.0",
     "@pretense/mutator": "0.2.0",
-    "@pretense/proxy": "0.1.0",
+    "@pretense/compliance-engine": "0.1.0",
     "@pretense/scanner": "0.2.0",
     "@pretense/scanner-rs": "0.2.0",
-    "@pretense/store": "0.2.0"
+    "@pretense/store": "0.2.0",
+    "@pretense/proxy": "0.1.0"
   },
   "publishConfig": {
     "access": "public",