@pretense/cli 0.6.21 → 0.6.22

package/dist/{chunk-2BMR5XBU.js → chunk-BWS6UMKL.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.21" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.22" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-2BMR5XBU.js";
+} from "./chunk-BWS6UMKL.js";
 import {
   __commonJS,
   __toESM,
@@ -16657,11 +16657,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.21" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.22" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "7e80103647b573f455a73aecebeae1a0e2fa3ac9".length > 0 ? "7e80103647b573f455a73aecebeae1a0e2fa3ac9" : UNKNOWN_COMMIT;
+  return "6c0840ef4a9ecc06829215df3a27c5a1b1b603ab".length > 0 ? "6c0840ef4a9ecc06829215df3a27c5a1b1b603ab" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",
@@ -18089,7 +18089,12 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
         action: "blocked",
         secretsBlocked: secretsTokenized,
         piiRedacted: piiTokenized,
-        mutationCount: tokensMutated,
+        // TRUTHFUL COUNT: every span this proxy rewrote before egress, of any
+        // kind (identifier tokens + tokenized secrets/PII) — the SAME number the
+        // audit row logs as `mutationsApplied`. `tokensMutated` alone counted
+        // only code identifiers, so a secret-only mutation pushed mutationCount:0
+        // to the live dashboard even though a secret WAS mutated on the wire.
+        mutationCount: mutationsApplied,
         bytesScanned: fullText.length,
         provider,
         findings: riskResult.factors.map((f) => f.name),
@@ -18171,7 +18176,12 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
         action: "error",
         secretsBlocked: secretsTokenized,
         piiRedacted: piiTokenized,
-        mutationCount: tokensMutated,
+        // TRUTHFUL COUNT: every span this proxy rewrote before egress, of any
+        // kind (identifier tokens + tokenized secrets/PII) — the SAME number the
+        // audit row logs as `mutationsApplied`. `tokensMutated` alone counted
+        // only code identifiers, so a secret-only mutation pushed mutationCount:0
+        // to the live dashboard even though a secret WAS mutated on the wire.
+        mutationCount: mutationsApplied,
         bytesScanned: originalSize,
         provider,
         findings: ["upstream_unreachable"],
@@ -18210,12 +18220,23 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
       action: anyTokenized ? "mutated" : "allowed",
       secretsBlocked: secretsTokenized,
       piiRedacted: piiTokenized,
-      mutationCount: tokensMutated,
+      // TRUTHFUL COUNT: every span rewritten before egress (identifier tokens +
+      // tokenized secrets/PII), matching the audit row's `mutationsApplied`. Using
+      // `tokensMutated` here made the live dashboard show mutationCount:0 for a
+      // request whose only mutation was a tokenized secret — the exact "meter logs
+      // 0" defect. severity now reflects it too (mutationCount>0 -> 3, not 1).
+      mutationCount: mutationsApplied,
       bytesScanned: originalSize,
       provider,
-      // Surface the skip in the telemetry stream too, so a dashboard/SIEM can
-      // alert on unscannable egress fields rather than assume full coverage.
-      ...skippedUnscannable > 0 ? { findings: ["skipped_unscannable_field"] } : {},
+      // Detector KINDS that fired (e.g. "aws_access_key") — metadata only, the same
+      // kinds the audit row records as `detectorKinds`. NEVER secret VALUES or
+      // identifier NAMES (the SSE bus carries the usage-upload privacy contract).
+      // Plus the unscannable-skip marker so a dashboard/SIEM can alert on coverage
+      // gaps rather than assume full coverage.
+      findings: [
+        ...foundTypes,
+        ...skippedUnscannable > 0 ? ["skipped_unscannable_field"] : []
+      ],
       sourceIp: c.req.header("x-forwarded-for") ?? c.req.header("x-real-ip")
     }));
     if (anyTokenized) {

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-2BMR5XBU.js";
+} from "./chunk-BWS6UMKL.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.21",
+  "version": "0.6.22",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -25,13 +25,13 @@
     "vitest": "^1.0.0",
     "@pretense/billing": "0.1.0",
     "@pretense/compliance-engine": "0.1.0",
-    "@pretense/protocol": "0.1.0",
     "@pretense/learner": "0.2.0",
     "@pretense/mutator": "0.2.0",
     "@pretense/proxy": "0.1.0",
     "@pretense/scanner": "0.2.0",
     "@pretense/scanner-rs": "0.2.0",
-    "@pretense/store": "0.2.0"
+    "@pretense/store": "0.2.0",
+    "@pretense/protocol": "0.1.0"
   },
   "publishConfig": {
     "access": "public",