@pretense/cli 0.6.20 → 0.6.22

package/dist/{chunk-N2GZIZAD.js → chunk-BWS6UMKL.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.20" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.22" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-N2GZIZAD.js";
+} from "./chunk-BWS6UMKL.js";
 import {
   __commonJS,
   __toESM,
@@ -14472,14 +14472,16 @@ async function scanWithPresidio(text, presidioUrl, opts = {}) {
 
 // ../packages/mutator/dist/index.js
 init_esm_shims();
+import { existsSync as existsSync4, readFileSync as readFileSync32 } from "fs";
+import { join as join4 } from "path";
 import { createHmac, hkdfSync, randomBytes as randomBytes2 } from "crypto";
 import { createHash, randomBytes } from "crypto";
 import { readFileSync as readFileSync4, existsSync as existsSync22 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join22, dirname, parse, resolve } from "path";
-import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync2, statSync, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync2, statSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var DIR_MODE = 448;
 var FILE_MODE = 384;
 var POSIX_MODES_ENFORCED = process.platform !== "win32";
@@ -14501,10 +14503,10 @@ var PretenseHomeError = class extends Error {
   }
 };
 function pretenseHome() {
-  return join4(homedir(), ".pretense");
+  return join5(homedir(), ".pretense");
 }
 function ensureDirOwnerOnly(dir) {
-  const preExisting = existsSync4(dir);
+  const preExisting = existsSync5(dir);
   if (!preExisting) {
     try {
       mkdirSync2(dir, { recursive: true, mode: DIR_MODE });
@@ -15634,6 +15636,79 @@ function mutate(code, language, seed = "pretense", opts = {}) {
     }
   };
 }
+function mutateNamedIdentifiers(code, language, identifiers, seed = "pretense", opts = {}) {
+  const t0 = performance.now();
+  const lang = language ?? detectLanguage(code);
+  const map = /* @__PURE__ */ new Map();
+  if (!code?.trim() || identifiers.length === 0) {
+    return { mutatedCode: code ?? "", map, stats: { tokensScanned: identifiers.length, tokensMutated: 0, durationMs: 0, language: lang } };
+  }
+  const signingKey = resolveSigningKey(opts);
+  const usedSynthetics = /* @__PURE__ */ new Set();
+  for (const { name, category } of identifiers) {
+    if (!name || name.length <= 1 || SKIP_IDENTIFIERS2.has(name)) continue;
+    if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name)) continue;
+    if (map.has(name)) continue;
+    let synthetic = generateSyntheticName(name, seed, category, signingKey);
+    let attempt = 0;
+    while ((usedSynthetics.has(synthetic) || synthetic === name || code.includes(synthetic)) && attempt < 100) {
+      attempt++;
+      synthetic = generateSyntheticName(name, `${seed}:${attempt}`, category, signingKey);
+    }
+    if (synthetic !== name && !usedSynthetics.has(synthetic) && !code.includes(synthetic)) {
+      map.set(name, synthetic);
+      usedSynthetics.add(synthetic);
+    }
+  }
+  const entries = [...map.entries()].sort((a, b) => b[0].length - a[0].length);
+  let mutatedCode = code;
+  const applied = /* @__PURE__ */ new Map();
+  for (const [original, synthetic] of entries) {
+    const next = replaceAll(mutatedCode, [[original, synthetic]], lang, true);
+    if (next !== mutatedCode) {
+      applied.set(original, synthetic);
+      mutatedCode = next;
+    }
+  }
+  return {
+    mutatedCode,
+    map: applied,
+    stats: {
+      tokensScanned: identifiers.length,
+      tokensMutated: applied.size,
+      durationMs: Math.round((performance.now() - t0) * 100) / 100,
+      language: lang
+    }
+  };
+}
+var FINGERPRINT_CATEGORIES = [
+  ["functions", "function"],
+  ["classes", "class"],
+  ["constants", "constant"],
+  ["envVars", "variable"]
+];
+function loadFingerprintIdentifiers(projectRoot) {
+  const path2 = join4(projectRoot, ".pretense", "fingerprint.json");
+  if (!existsSync4(path2)) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync32(path2, "utf-8"));
+  } catch {
+    return [];
+  }
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [key, category] of FINGERPRINT_CATEGORIES) {
+    const arr = parsed[key];
+    if (!Array.isArray(arr)) continue;
+    for (const name of arr) {
+      if (typeof name !== "string" || seen.has(name)) continue;
+      seen.add(name);
+      out.push({ name, category });
+    }
+  }
+  return out;
+}
 function reverse(mutatedCode, map) {
   if (!mutatedCode || map.size === 0) return mutatedCode;
   assertNoReplacementCollision(map.entries());
@@ -15940,7 +16015,7 @@ var RiskScorer = class {
 // ../packages/store/dist/index.js
 init_esm_shims();
 import { createRequire as createRequire2 } from "module";
-import { mkdirSync as mkdirSync22, existsSync as existsSync5, chmodSync as chmodSync2, statSync as statSync2 } from "fs";
+import { mkdirSync as mkdirSync22, existsSync as existsSync6, chmodSync as chmodSync2, statSync as statSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 import { homedir as homedir22 } from "os";
 var nodeRequire = createRequire2(import.meta.url);
@@ -16001,7 +16076,7 @@ function openDatabase(path2) {
   return sqliteBackend === "bun:sqlite" ? openBun(path2) : openBetterSqlite3(path2);
 }
 function ensureDbDirOwnerOnly(dir) {
-  const preExisting = existsSync5(dir);
+  const preExisting = existsSync6(dir);
   if (!preExisting) mkdirSync22(dir, { recursive: true, mode: 448 });
   if (process.platform === "win32") return;
   try {
@@ -16051,7 +16126,7 @@ var AuditStore = class {
     if (!isMemory) {
       for (const p of [resolvedPath, `${resolvedPath}-wal`, `${resolvedPath}-shm`]) {
         try {
-          if (existsSync5(p)) chmodSync2(p, 384);
+          if (existsSync6(p)) chmodSync2(p, 384);
         } catch {
         }
       }
@@ -16432,8 +16507,8 @@ var PERIOD_DAYS = 7;
 var PERIOD_MS = PERIOD_DAYS * 24 * 60 * 60 * 1e3;
 
 // ../apps/proxy/dist/server.js
-import { readFileSync as readFileSync5, existsSync as existsSync6 } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync5, existsSync as existsSync7 } from "fs";
+import { join as join6 } from "path";
 import { parse as parseYaml } from "yaml";
 import { readFileSync as readFileSync23 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -16531,12 +16606,12 @@ var DEFAULTS = {
 };
 function loadConfig(configPath) {
   const paths = configPath ? [configPath] : [
-    join5(process.cwd(), "pretense.yaml"),
-    join5(process.cwd(), "pretense.yml"),
-    join5(process.env["HOME"] ?? "/tmp", ".pretense", "config.yaml")
+    join6(process.cwd(), "pretense.yaml"),
+    join6(process.cwd(), "pretense.yml"),
+    join6(process.env["HOME"] ?? "/tmp", ".pretense", "config.yaml")
   ];
   for (const p of paths) {
-    if (existsSync6(p)) {
+    if (existsSync7(p)) {
       try {
         const raw2 = parseYaml(readFileSync5(p, "utf-8"));
         return deepMerge(DEFAULTS, raw2);
@@ -16582,11 +16657,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.20" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.22" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "69ea69288cc5d8698de1a2bdb4e3c29c002596c6".length > 0 ? "69ea69288cc5d8698de1a2bdb4e3c29c002596c6" : UNKNOWN_COMMIT;
+  return "6c0840ef4a9ecc06829215df3a27c5a1b1b603ab".length > 0 ? "6c0840ef4a9ecc06829215df3a27c5a1b1b603ab" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",
@@ -17591,6 +17666,7 @@ function createProxy(opts = {}) {
   }
   const app = new Hono2();
   const derivation = { projectRoot: resolveProxyProjectRoot(opts.projectRoot) };
+  const fingerprintIdentifiers = loadFingerprintIdentifiers(derivation.projectRoot);
   let auditWriteFailures = 0;
   let auditWriteFailureLogged = false;
   const safeLog = (entry) => {
@@ -17958,9 +18034,16 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
           continue;
         }
         const result = mutate(block.code, block.language, "pretense", derivation);
+        let blockCode = result.mutatedCode;
         for (const [k, v] of result.map.entries()) globalMap.set(k, v);
         tokensMutated += result.stats.tokensMutated;
-        mutatedBlocks.push(result.mutatedCode);
+        if (fingerprintIdentifiers.length > 0) {
+          const fp = mutateNamedIdentifiers(blockCode, block.language, fingerprintIdentifiers, "pretense", derivation);
+          for (const [k, v] of fp.map.entries()) globalMap.set(k, v);
+          tokensMutated += fp.stats.tokensMutated;
+          blockCode = fp.mutatedCode;
+        }
+        mutatedBlocks.push(blockCode);
       }
       return replaceCodeBlocks(text, blocks, mutatedBlocks);
     });
@@ -18006,7 +18089,12 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
         action: "blocked",
         secretsBlocked: secretsTokenized,
         piiRedacted: piiTokenized,
-        mutationCount: tokensMutated,
+        // TRUTHFUL COUNT: every span this proxy rewrote before egress, of any
+        // kind (identifier tokens + tokenized secrets/PII) — the SAME number the
+        // audit row logs as `mutationsApplied`. `tokensMutated` alone counted
+        // only code identifiers, so a secret-only mutation pushed mutationCount:0
+        // to the live dashboard even though a secret WAS mutated on the wire.
+        mutationCount: mutationsApplied,
         bytesScanned: fullText.length,
         provider,
         findings: riskResult.factors.map((f) => f.name),
@@ -18088,7 +18176,12 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
         action: "error",
         secretsBlocked: secretsTokenized,
         piiRedacted: piiTokenized,
-        mutationCount: tokensMutated,
+        // TRUTHFUL COUNT: every span this proxy rewrote before egress, of any
+        // kind (identifier tokens + tokenized secrets/PII) — the SAME number the
+        // audit row logs as `mutationsApplied`. `tokensMutated` alone counted
+        // only code identifiers, so a secret-only mutation pushed mutationCount:0
+        // to the live dashboard even though a secret WAS mutated on the wire.
+        mutationCount: mutationsApplied,
         bytesScanned: originalSize,
         provider,
         findings: ["upstream_unreachable"],
@@ -18127,12 +18220,23 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
       action: anyTokenized ? "mutated" : "allowed",
       secretsBlocked: secretsTokenized,
       piiRedacted: piiTokenized,
-      mutationCount: tokensMutated,
+      // TRUTHFUL COUNT: every span rewritten before egress (identifier tokens +
+      // tokenized secrets/PII), matching the audit row's `mutationsApplied`. Using
+      // `tokensMutated` here made the live dashboard show mutationCount:0 for a
+      // request whose only mutation was a tokenized secret — the exact "meter logs
+      // 0" defect. severity now reflects it too (mutationCount>0 -> 3, not 1).
+      mutationCount: mutationsApplied,
       bytesScanned: originalSize,
       provider,
-      // Surface the skip in the telemetry stream too, so a dashboard/SIEM can
-      // alert on unscannable egress fields rather than assume full coverage.
-      ...skippedUnscannable > 0 ? { findings: ["skipped_unscannable_field"] } : {},
+      // Detector KINDS that fired (e.g. "aws_access_key") — metadata only, the same
+      // kinds the audit row records as `detectorKinds`. NEVER secret VALUES or
+      // identifier NAMES (the SSE bus carries the usage-upload privacy contract).
+      // Plus the unscannable-skip marker so a dashboard/SIEM can alert on coverage
+      // gaps rather than assume full coverage.
+      findings: [
+        ...foundTypes,
+        ...skippedUnscannable > 0 ? ["skipped_unscannable_field"] : []
+      ],
       sourceIp: c.req.header("x-forwarded-for") ?? c.req.header("x-real-ip")
     }));
     if (anyTokenized) {
@@ -18263,11 +18367,11 @@ async function findFreePort(start, opts = {}) {
 
 // src/proxy-pidfile.ts
 init_esm_shims();
-import { existsSync as existsSync7, readFileSync as readFileSync6, unlinkSync } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6, unlinkSync } from "fs";
+import { join as join7 } from "path";
 import { homedir as homedir3 } from "os";
 function pidFilePath(home = homedir3()) {
-  return join6(process.env.PRETENSE_PID_DIR ?? join6(home, ".pretense"), "proxy.pid");
+  return join7(process.env.PRETENSE_PID_DIR ?? join7(home, ".pretense"), "proxy.pid");
 }
 function isProcessAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -18279,7 +18383,7 @@ function isProcessAlive(pid) {
   }
 }
 function readProxyRecord(path2 = pidFilePath()) {
-  if (!existsSync7(path2)) return null;
+  if (!existsSync8(path2)) return null;
   try {
     const parsed = JSON.parse(readFileSync6(path2, "utf-8"));
     if (!Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
@@ -18306,7 +18410,7 @@ var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function stopProxy(path2 = pidFilePath(), graceMs = 2e3, pollMs = 50) {
   const rec = readProxyRecord(path2);
   if (!rec) {
-    if (existsSync7(path2)) {
+    if (existsSync8(path2)) {
       removeProxyRecord(path2);
       return { kind: "stale", pid: 0, path: path2 };
     }
@@ -18479,17 +18583,17 @@ import chalk3 from "chalk";
 
 // src/plan-usage.ts
 init_esm_shims();
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { join as join8 } from "path";
 import { homedir as homedir4 } from "os";
 function credentialsPath() {
-  return join7(homedir4(), ".pretense", "credentials.json");
+  return join8(homedir4(), ".pretense", "credentials.json");
 }
 function readApiKey() {
   const fromEnv = process.env["PRETENSE_API_KEY"]?.trim();
   if (fromEnv) return fromEnv;
   const path2 = credentialsPath();
-  if (!existsSync8(path2)) return null;
+  if (!existsSync9(path2)) return null;
   try {
     const creds = JSON.parse(readFileSync7(path2, "utf-8"));
     const key = creds["apiKey"] ?? creds["api_key"];
@@ -18911,7 +19015,7 @@ import { Command as Command5, Option, InvalidArgumentError as InvalidArgumentErr
 import chalk5 from "chalk";
 import { readFileSync as readFileSync8, statSync as statSync3, readdirSync as readdirSync2, openSync, readSync, closeSync } from "fs";
 import { execSync as execSync3 } from "child_process";
-import { resolve as resolve3, join as join8, extname as extname2, basename } from "path";
+import { resolve as resolve3, join as join9, extname as extname2, basename } from "path";
 
 // src/safe-output.ts
 init_esm_shims();
@@ -19101,9 +19205,9 @@ function walkDir(dir) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (entry.name.startsWith(".") || SKIP_DIRS.has(entry.name)) continue;
-      files.push(...walkDir(join8(dir, entry.name)));
+      files.push(...walkDir(join9(dir, entry.name)));
     } else if (entry.isFile()) {
-      files.push(join8(dir, entry.name));
+      files.push(join9(dir, entry.name));
     }
   }
   return files;
@@ -19827,13 +19931,13 @@ function scanCommand() {
 init_esm_shims();
 import { Command as Command6 } from "commander";
 import chalk6 from "chalk";
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
+import { join as join10 } from "path";
 function statusCommand() {
   return new Command6("status").description("Show Pretense protection status").action(async () => {
     const dir = process.cwd();
-    const fingerprintPath = join9(dir, ".pretense", "fingerprint.json");
-    const configPath = join9(dir, "pretense.yaml");
+    const fingerprintPath = join10(dir, ".pretense", "fingerprint.json");
+    const configPath = join10(dir, "pretense.yaml");
     console.log(chalk6.cyan("\n  Pretense Status\n"));
     const record = readProxyRecord(pidFilePath());
     if (record && !isProcessAlive(record.pid)) {
@@ -19855,12 +19959,12 @@ function statusCommand() {
         console.log(chalk6.yellow(`  \u25CB Proxy not running  ${chalk6.dim("(run: pretense start)")}`));
       }
     }
-    if (existsSync9(configPath)) {
+    if (existsSync10(configPath)) {
       console.log(chalk6.green(`  \u2713 Config: pretense.yaml`));
     } else {
       console.log(chalk6.yellow(`  \u25CB No config  ${chalk6.dim("(run: pretense config)")}`));
     }
-    if (existsSync9(fingerprintPath)) {
+    if (existsSync10(fingerprintPath)) {
       try {
         const fp = JSON.parse(readFileSync9(fingerprintPath, "utf-8"));
         const age = Math.round((Date.now() - fp.scannedAt) / (60 * 1e3));
@@ -19882,8 +19986,8 @@ function statusCommand() {
 init_esm_shims();
 import { Command as Command7 } from "commander";
 import chalk7 from "chalk";
-import { writeFileSync as writeFileSync4, readFileSync as readFileSync10, existsSync as existsSync10 } from "fs";
-import { join as join10 } from "path";
+import { writeFileSync as writeFileSync4, readFileSync as readFileSync10, existsSync as existsSync11 } from "fs";
+import { join as join11 } from "path";
 import YAML2 from "yaml";
 var DEFAULT_CONFIG = {
   version: 1,
@@ -19896,8 +20000,8 @@ function findConfigPath() {
   const cwd = process.cwd();
   const candidates = [".pretense.yaml", "pretense.yaml"];
   for (const name of candidates) {
-    const full = join10(cwd, name);
-    if (existsSync10(full)) return full;
+    const full = join11(cwd, name);
+    if (existsSync11(full)) return full;
   }
   return null;
 }
@@ -19912,7 +20016,7 @@ function loadConfig2() {
   }
 }
 function configFilePath() {
-  return findConfigPath() ?? join10(process.cwd(), "pretense.yaml");
+  return findConfigPath() ?? join11(process.cwd(), "pretense.yaml");
 }
 function getNestedValue(obj, key) {
   const parts = key.split(".");
@@ -19983,7 +20087,7 @@ function configCommand() {
   });
   cmd.option("--force", "Overwrite existing config with defaults", false).action((opts) => {
     if (opts.force) {
-      const outPath = join10(process.cwd(), "pretense.yaml");
+      const outPath = join11(process.cwd(), "pretense.yaml");
       writeFileSync4(outPath, YAML2.stringify(DEFAULT_CONFIG));
       console.log(chalk7.green(`
   \u2713 Created pretense.yaml
@@ -20000,14 +20104,14 @@ init_esm_shims();
 import { Command as Command8 } from "commander";
 import chalk8 from "chalk";
 import { homedir as homedir5 } from "os";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function logsCommand() {
   return new Command8("logs").description("Show recent audit log entries").option("-l, --limit <n>", "Number of entries to show", "50").option("--json", "Output as JSON", false).action((opts) => {
     const limit = parseInt(opts.limit, 10);
     let store;
     let entries;
     try {
-      store = new AuditStore(join11(homedir5(), ".pretense", "audit.db"));
+      store = new AuditStore(join12(homedir5(), ".pretense", "audit.db"));
       entries = store.getRecentEntries(limit);
       store.close();
     } catch {
@@ -20047,7 +20151,7 @@ function logsCommand() {
 init_esm_shims();
 import { Command as Command9 } from "commander";
 import chalk9 from "chalk";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { homedir as homedir6 } from "os";
 function renderBar(percent, width = 30) {
   const filled = Math.min(Math.round(percent / 100 * width), width);
@@ -20087,7 +20191,7 @@ function emptyUsagePayload(resolution) {
   };
 }
 function usageCommand() {
-  return new Command9("usage").description("Show plan usage vs limits for the current billing period").option("--db <path>", "Path to audit database", join12(homedir6(), ".pretense", "audit.db")).option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
+  return new Command9("usage").description("Show plan usage vs limits for the current billing period").option("--db <path>", "Path to audit database", join13(homedir6(), ".pretense", "audit.db")).option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
     const resolution = await resolvePlanTier({ offline: opts.offline });
     const tier = resolution.tier;
     const collected = collectUsage(opts.db);
@@ -20238,12 +20342,12 @@ function usageCommand() {
 init_esm_shims();
 import { Command as Command10 } from "commander";
 import chalk10 from "chalk";
-import { existsSync as existsSync11, readFileSync as readFileSync11, unlinkSync as unlinkSync2 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync11, unlinkSync as unlinkSync2 } from "fs";
+import { join as join14 } from "path";
 import { homedir as homedir7 } from "os";
 import { execSync as execSync4 } from "child_process";
-var CREDENTIALS_DIR = join13(homedir7(), ".pretense");
-var CREDENTIALS_PATH = join13(CREDENTIALS_DIR, "credentials.json");
+var CREDENTIALS_DIR = join14(homedir7(), ".pretense");
+var CREDENTIALS_PATH = join14(CREDENTIALS_DIR, "credentials.json");
 async function verifyApiKey(apiKey) {
   const url = `${getConfiguredApiRoot()}/api/cli/auth/validate`;
   const timeoutMs = tierRequestTimeoutMs();
@@ -20290,7 +20394,7 @@ function storageNotice() {
 `);
 }
 function readCredentials() {
-  if (!existsSync11(CREDENTIALS_PATH)) return null;
+  if (!existsSync12(CREDENTIALS_PATH)) return null;
   try {
     return JSON.parse(readFileSync11(CREDENTIALS_PATH, "utf-8"));
   } catch {
@@ -20424,7 +20528,7 @@ function authCommand() {
     openUrl(authUrl);
   });
   auth.command("logout").description("Remove stored credentials").action(() => {
-    if (!existsSync11(CREDENTIALS_PATH)) {
+    if (!existsSync12(CREDENTIALS_PATH)) {
       console.log(chalk10.yellow("\n  No credentials found. Already logged out.\n"));
       return;
     }
@@ -20479,7 +20583,7 @@ init_esm_shims();
 import { Command as Command11 } from "commander";
 import chalk11 from "chalk";
 import { readdirSync as readdirSync3, readFileSync as readFileSync12, statSync as statSync4 } from "fs";
-import { join as join14, extname as extname3, relative, isAbsolute } from "path";
+import { join as join15, extname as extname3, relative, isAbsolute } from "path";
 var SUPPORTED_EXTENSIONS2 = /* @__PURE__ */ new Set([
   ".ts",
   ".tsx",
@@ -20514,7 +20618,7 @@ function discoverFiles(dir) {
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const full = join14(current, entry);
+      const full = join15(current, entry);
       let stat;
       try {
         stat = statSync4(full);
@@ -20605,7 +20709,7 @@ function formatAgent(results, basePath) {
   const agentResults = [];
   for (const r of results) {
     if (r.mutations.length === 0 && r.secrets.length === 0) continue;
-    const filePath = join14(basePath, r.file);
+    const filePath = join15(basePath, r.file);
     let lines;
     try {
       lines = readFileSync12(filePath, "utf-8").split("\n");
@@ -20676,7 +20780,7 @@ function formatInteractive(results) {
 }
 function reviewCommand() {
   return new Command11("review").description("Preview mutations and secrets that would be applied").argument("[path]", "Directory to review (defaults to current directory)").option("--plain", "Plain text output", false).option("--json", "JSON array output with metadata", false).option("--agent", "Structured JSON optimized for AI agent consumption", false).option("--prompt-only", "Minimal output suitable for piping", false).option("--interactive", "Interactive formatted output (default)", false).action(async (path2, opts) => {
-    const targetDir = path2 ? isAbsolute(path2) ? path2 : join14(process.cwd(), path2) : process.cwd();
+    const targetDir = path2 ? isAbsolute(path2) ? path2 : join15(process.cwd(), path2) : process.cwd();
     const files = discoverFiles(targetDir);
     if (files.length === 0) {
       if (opts?.json || opts?.agent) {
@@ -20712,13 +20816,13 @@ init_esm_shims();
 import { Command as Command12 } from "commander";
 import chalk12 from "chalk";
 import {
-  existsSync as existsSync12,
+  existsSync as existsSync13,
   writeFileSync as writeFileSync5,
   chmodSync as chmodSync3,
   readFileSync as readFileSync13,
   mkdirSync as mkdirSync3
 } from "fs";
-import { join as join15, resolve as resolve4 } from "path";
+import { join as join16, resolve as resolve4 } from "path";
 var HOOK_SCRIPTS = {
   "pre-commit": `#!/bin/sh
 # Pretense AI Firewall \u2014 pre-commit hook
@@ -20737,14 +20841,14 @@ exit $?
 };
 var VALID_MODES = ["pre-commit", "pre-push"];
 function findGitDir(cwd) {
-  const gitDir = join15(cwd, ".git");
-  if (existsSync12(gitDir)) return gitDir;
+  const gitDir = join16(cwd, ".git");
+  if (existsSync13(gitDir)) return gitDir;
   return null;
 }
 function installHook(hooksDir, mode, force) {
-  const hookPath = join15(hooksDir, mode);
+  const hookPath = join16(hooksDir, mode);
   const script = HOOK_SCRIPTS[mode];
-  if (existsSync12(hookPath) && !force) {
+  if (existsSync13(hookPath) && !force) {
     const existing = readFileSync13(hookPath, "utf-8");
     if (existing.includes("Pretense AI Firewall")) {
       return { installed: false, path: hookPath, skipped: true };
@@ -20786,7 +20890,7 @@ function installCommand() {
       );
       process.exit(1);
     }
-    const hooksDir = join15(gitDir, "hooks");
+    const hooksDir = join16(gitDir, "hooks");
     mkdirSync3(hooksDir, { recursive: true });
     console.log(chalk12.cyan("\n  Pretense hook installer\n"));
     let hasError = false;
@@ -20823,22 +20927,22 @@ function installCommand() {
 init_esm_shims();
 import { Command as Command13 } from "commander";
 import chalk13 from "chalk";
-import { appendFileSync as appendFileSync3, readFileSync as readFileSync14, existsSync as existsSync13 } from "fs";
-import { join as join16 } from "path";
+import { appendFileSync as appendFileSync3, readFileSync as readFileSync14, existsSync as existsSync14 } from "fs";
+import { join as join17 } from "path";
 import { homedir as homedir8 } from "os";
 var IGNORE_FILE = ".pretenseignore";
-var LAST_SCAN_PATH = join16(homedir8(), ".pretense", "last-scan.json");
+var LAST_SCAN_PATH = join17(homedir8(), ".pretense", "last-scan.json");
 function ignorePath() {
-  return join16(process.cwd(), IGNORE_FILE);
+  return join17(process.cwd(), IGNORE_FILE);
 }
 function readIgnoreFile() {
   const p = ignorePath();
-  if (!existsSync13(p)) return [];
+  if (!existsSync14(p)) return [];
   return readFileSync14(p, "utf-8").split("\n").filter((l) => l.length > 0);
 }
 function appendPattern(pattern) {
   const p = ignorePath();
-  const content = existsSync13(p) ? readFileSync14(p, "utf-8") : "";
+  const content = existsSync14(p) ? readFileSync14(p, "utf-8") : "";
   const lines = content.split("\n").filter((l) => l.length > 0);
   if (lines.includes(pattern)) {
     console.log(chalk13.yellow(`
@@ -20877,7 +20981,7 @@ function ignoreCommand() {
       return;
     }
     if (opts.lastFound) {
-      if (!existsSync13(LAST_SCAN_PATH)) {
+      if (!existsSync14(LAST_SCAN_PATH)) {
         console.error(chalk13.red(`
   \u2717 No last scan results found at ${LAST_SCAN_PATH}
 `));
@@ -21135,8 +21239,8 @@ function completionCommand() {
 init_esm_shims();
 import { Command as Command15 } from "commander";
 import chalk14 from "chalk";
-import { existsSync as existsSync14, writeFileSync as writeFileSync6 } from "fs";
-import { join as join17, resolve as resolve5 } from "path";
+import { existsSync as existsSync15, writeFileSync as writeFileSync6 } from "fs";
+import { join as join18, resolve as resolve5 } from "path";
 var DEFAULT_CONFIG_YAML = `scan:
   secrets: block
   pii: redact
@@ -21176,9 +21280,9 @@ function quickstartCommand() {
       process.exit(1);
     }
     console.log(chalk14.dim("  [2/4] Writing config..."));
-    const configPath = join17(dir, "pretense.yaml");
+    const configPath = join18(dir, "pretense.yaml");
     if (!opts.dryRun) {
-      if (!existsSync14(configPath)) {
+      if (!existsSync15(configPath)) {
         writeFileSync6(configPath, DEFAULT_CONFIG_YAML);
         console.log(chalk14.green("         Created pretense.yaml"));
       } else {
@@ -21187,8 +21291,8 @@ function quickstartCommand() {
     }
     console.log(chalk14.dim("  [3/4] Updating .gitignore..."));
     if (!opts.dryRun) {
-      const gitignorePath = join17(dir, ".gitignore");
-      let content = existsSync14(gitignorePath) ? (await import("fs")).default.readFileSync(gitignorePath, "utf-8") : "";
+      const gitignorePath = join18(dir, ".gitignore");
+      let content = existsSync15(gitignorePath) ? (await import("fs")).default.readFileSync(gitignorePath, "utf-8") : "";
       if (!content.includes(".pretense/")) {
         content = content + (content.endsWith("\n") ? "" : "\n") + ".pretense/\n";
         writeFileSync6(gitignorePath, content);
@@ -21218,7 +21322,7 @@ function quickstartCommand() {
 init_esm_shims();
 import { Command as Command16, Option as Option2 } from "commander";
 import chalk16 from "chalk";
-import { readFileSync as readFileSync15, writeFileSync as writeFileSync7, chmodSync as chmodSync4, existsSync as existsSync15 } from "fs";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync7, chmodSync as chmodSync4, existsSync as existsSync16 } from "fs";
 import { createHash as createHash3 } from "crypto";
 import { resolve as resolve6, extname as extname4 } from "path";
 
@@ -21226,8 +21330,8 @@ import { resolve as resolve6, extname as extname4 } from "path";
 init_esm_shims();
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, hkdfSync as hkdfSync2 } from "crypto";
 import { homedir as homedir9 } from "os";
-import { join as join18 } from "path";
-var KEYS_DIR = join18(homedir9(), ".pretense", "keys");
+import { join as join19 } from "path";
+var KEYS_DIR = join19(homedir9(), ".pretense", "keys");
 var HKDF_SALT2 = Buffer.from("pretense-maps-v1", "utf-8");
 var HKDF_INFO2 = Buffer.from("secret-mapping-aes-256-gcm", "utf-8");
 var IV_LEN = 12;
@@ -21272,13 +21376,13 @@ import {
   fchmodSync
 } from "fs";
 import { randomBytes as randomBytes4 } from "crypto";
-import { dirname as dirname4, basename as basename2, join as join19 } from "path";
+import { dirname as dirname4, basename as basename2, join as join20 } from "path";
 function writeFileAtomicSync(targetPath, data, opts = {}) {
   let resolved;
   try {
     resolved = realpathSync2(targetPath);
   } catch {
-    resolved = join19(realpathSync2(dirname4(targetPath)), basename2(targetPath));
+    resolved = join20(realpathSync2(dirname4(targetPath)), basename2(targetPath));
   }
   let mode = opts.mode;
   if (mode === void 0) {
@@ -21289,7 +21393,7 @@ function writeFileAtomicSync(targetPath, data, opts = {}) {
     }
   }
   const dir = dirname4(resolved);
-  const tmp = join19(dir, `.${basename2(resolved)}.pretense-${randomBytes4(6).toString("hex")}.tmp`);
+  const tmp = join20(dir, `.${basename2(resolved)}.pretense-${randomBytes4(6).toString("hex")}.tmp`);
   const buf = Buffer.isBuffer(data) ? data : Buffer.from(data, "utf-8");
   let fd = openSync2(tmp, "wx", 384);
   try {
@@ -21330,13 +21434,13 @@ function writeFileAtomicSync(targetPath, data, opts = {}) {
 // src/default-map.ts
 init_esm_shims();
 import { createHash as createHash2 } from "crypto";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 function mapsDir(override2) {
-  return override2 ?? join20(pretenseHome(), "maps");
+  return override2 ?? join21(pretenseHome(), "maps");
 }
 function defaultMapPath(absFilePath, override2) {
   const digest = createHash2("sha256").update(absFilePath, "utf8").digest("hex");
-  return join20(mapsDir(override2), `${digest}.json`);
+  return join21(mapsDir(override2), `${digest}.json`);
 }
 function ensureDefaultMapPath(absFilePath, override2) {
   ensureDirOwnerOnly(mapsDir(override2));
@@ -21346,11 +21450,11 @@ function ensureDefaultMapPath(absFilePath, override2) {
 // src/local-audit.ts
 init_esm_shims();
 import { homedir as homedir10 } from "os";
-import { join as join21 } from "path";
+import { join as join24 } from "path";
 import { randomUUID } from "crypto";
 import chalk15 from "chalk";
 function localAuditDbPath() {
-  return join21(homedir10(), ".pretense", "audit.db");
+  return join24(homedir10(), ".pretense", "audit.db");
 }
 function recordLocalAudit(rec, dbPath = localAuditDbPath()) {
   let store = null;
@@ -21449,7 +21553,7 @@ async function uploadUsage(event) {
 // src/commands/mutate.ts
 var REVERSAL_MAP_VERSION = 3;
 function preflightReversalMap(mapPath, absFile, content, contentSha, force) {
-  if (!existsSync15(mapPath)) return { action: "write", generation: 1 };
+  if (!existsSync16(mapPath)) return { action: "write", generation: 1 };
   let existing;
   try {
     const parsed = JSON.parse(readFileSync15(mapPath, "utf-8"));
@@ -21626,7 +21730,25 @@ async function runMutate(file, opts = {}) {
     opts.level,
     opts.presetName
   );
-  if (findings.length === 0) {
+  const absFile = resolve6(file);
+  const projectRoot = resolveProjectRoot(absFile);
+  const secretResult = mutateSecrets(content, findings, { projectRoot, keysDir: opts.keysDir });
+  const fingerprintIds = loadFingerprintIdentifiers(projectRoot);
+  const idMut = fingerprintIds.length > 0 ? mutateNamedIdentifiers(
+    secretResult.content,
+    L2_LANGUAGE_BY_EXT2[extname4(file).toLowerCase()],
+    fingerprintIds,
+    "pretense",
+    { projectRoot, keysDir: opts.keysDir }
+  ) : { mutatedCode: secretResult.content, map: /* @__PURE__ */ new Map() };
+  const finalContent = idMut.mutatedCode;
+  const identifierMutations = [...idMut.map.entries()].map(([original, replacement]) => ({
+    original,
+    replacement,
+    type: "proprietary"
+  }));
+  const totalMutations = secretResult.mutations.length + identifierMutations.length;
+  if (totalMutations === 0) {
     if (unmutatable.size === 0) {
       console.error(chalk16.dim(`  No secrets found in ${file} \u2014 nothing to mutate.`));
     } else {
@@ -21636,9 +21758,10 @@ async function runMutate(file, opts = {}) {
     return 0;
   }
   reportUnmutatable(unmutatable);
-  const absFile = resolve6(file);
-  const projectRoot = resolveProjectRoot(absFile);
-  const result = mutateSecrets(content, findings, { projectRoot, keysDir: opts.keysDir });
+  const result = {
+    content: finalContent,
+    mutations: [...secretResult.mutations, ...identifierMutations]
+  };
   let effectiveMap;
   if (preview) {
     effectiveMap = void 0;
@@ -21710,13 +21833,21 @@ async function runMutate(file, opts = {}) {
     );
     return 1;
   }
+  const secretCount = secretResult.mutations.length;
+  const idCount = identifierMutations.length;
+  const summary = () => {
+    const parts = [];
+    if (secretCount > 0) parts.push(`${secretCount} secret${secretCount === 1 ? "" : "s"}`);
+    if (idCount > 0) parts.push(`${idCount} registered identifier${idCount === 1 ? "" : "s"}`);
+    return parts.join(" + ");
+  };
   try {
     if (inPlace) {
       writeFileAtomicSync(file, result.content);
-      console.error(chalk16.green(`  \u2713 Mutated ${result.mutations.length} secrets in ${file} (in-place)`));
+      console.error(chalk16.green(`  \u2713 Mutated ${summary()} in ${file} (in-place)`));
     } else if (opts.output) {
       writeFileAtomicSync(opts.output, result.content);
-      console.error(chalk16.green(`  \u2713 Mutated ${result.mutations.length} secrets \u2192 ${opts.output}`));
+      console.error(chalk16.green(`  \u2713 Mutated ${summary()} \u2192 ${opts.output}`));
     } else {
       process.stdout.write(result.content);
     }
@@ -21733,7 +21864,9 @@ async function runMutate(file, opts = {}) {
     let secretsBlocked = 0;
     let piiRedacted = 0;
     for (const m of result.mutations) {
-      if (categoryByType.get(m.type) === "pii") piiRedacted += 1;
+      const cat = categoryByType.get(m.type);
+      if (cat === "pii") piiRedacted += 1;
+      else if (m.type === "proprietary") continue;
       else secretsBlocked += 1;
     }
     recordLocalAudit({
@@ -21795,7 +21928,7 @@ function mutateCommand() {
 init_esm_shims();
 import { Command as Command17 } from "commander";
 import chalk17 from "chalk";
-import { readFileSync as readFileSync16, existsSync as existsSync16, statSync as statSync6 } from "fs";
+import { readFileSync as readFileSync16, existsSync as existsSync17, statSync as statSync6 } from "fs";
 import { resolve as resolve7 } from "path";
 import { createHash as createHash4 } from "crypto";
 function sha256Hex3(s) {
@@ -21856,14 +21989,14 @@ function loadReversalMap(mapPath) {
 function runReverse(file, opts = {}) {
   const reverseStartMs = Date.now();
   const absPath = resolve7(file);
-  if (!existsSync16(absPath) || !statSync6(absPath).isFile()) {
+  if (!existsSync17(absPath) || !statSync6(absPath).isFile()) {
     console.error(chalk17.red(`
   x File not found: ${file}
 `));
     return 1;
   }
   const mapPath = opts.map ?? defaultMapPath(absPath, opts.mapsDir);
-  if (!opts.map && !existsSync16(mapPath)) {
+  if (!opts.map && !existsSync17(mapPath)) {
     console.error(
       chalk17.red(`
   x No reversal map found for ${absPath}`) + chalk17.dim(`
@@ -22320,7 +22453,7 @@ init_esm_shims();
 import { Command as Command20 } from "commander";
 import chalk20 from "chalk";
 import { homedir as homedir11 } from "os";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 var VALID_FORMATS2 = ["table", "csv", "json", "jsonl"];
 function toSafeAuditRow(e) {
   return {
@@ -22444,7 +22577,7 @@ function auditCommand() {
 `));
       process.exit(1);
     }
-    const dbPath = opts.db ?? join24(homedir11(), ".pretense", "audit.db");
+    const dbPath = opts.db ?? join25(homedir11(), ".pretense", "audit.db");
     let rows;
     try {
       const store = new AuditStore(dbPath);
@@ -22504,7 +22637,7 @@ function auditCommand() {
 init_esm_shims();
 import { Command as Command21 } from "commander";
 import chalk21 from "chalk";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 import { homedir as homedir12 } from "os";
 function remaining(used, limit) {
   if (limit === null) return null;
@@ -22523,7 +22656,7 @@ function bar(used, limit, width = 24) {
   return chalk21.green(s);
 }
 function creditsCommand() {
-  return new Command21("credits").alias("tokens").description("Show remaining mutation budget for the current period").option("--db <path>", "Path to audit database", join25(homedir12(), ".pretense", "audit.db")).option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
+  return new Command21("credits").alias("tokens").description("Show remaining mutation budget for the current period").option("--db <path>", "Path to audit database", join26(homedir12(), ".pretense", "audit.db")).option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
     const resolution = await resolvePlanTier({ offline: opts.offline });
     const tier = resolution.tier;
     const collected = collectUsage(opts.db);

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-N2GZIZAD.js";
+} from "./chunk-BWS6UMKL.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.20",
+  "version": "0.6.22",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -24,14 +24,14 @@
     "typescript": "^5.4.0",
     "vitest": "^1.0.0",
     "@pretense/billing": "0.1.0",
-    "@pretense/protocol": "0.1.0",
+    "@pretense/compliance-engine": "0.1.0",
     "@pretense/learner": "0.2.0",
     "@pretense/mutator": "0.2.0",
-    "@pretense/compliance-engine": "0.1.0",
+    "@pretense/proxy": "0.1.0",
     "@pretense/scanner": "0.2.0",
     "@pretense/scanner-rs": "0.2.0",
     "@pretense/store": "0.2.0",
-    "@pretense/proxy": "0.1.0"
+    "@pretense/protocol": "0.1.0"
   },
   "publishConfig": {
     "access": "public",