@pretense/cli 0.6.25 → 0.6.26

package/dist/{chunk-XYBJ63JG.js → chunk-ZSQPYJVT.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.25" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.26" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-XYBJ63JG.js";
+} from "./chunk-ZSQPYJVT.js";
 import {
   __commonJS,
   __toESM,
@@ -16657,11 +16657,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.25" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.26" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "24595f8f691656d511f75ed2d8b59f98069779ac".length > 0 ? "24595f8f691656d511f75ed2d8b59f98069779ac" : UNKNOWN_COMMIT;
+  return "91077fab39006ac43c0256257c895b5534640e17".length > 0 ? "91077fab39006ac43c0256257c895b5534640e17" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",
@@ -18657,6 +18657,39 @@ function parseEntitlement(body) {
     ...subscriptionStatus !== void 0 ? { subscriptionStatus } : {}
   };
 }
+function parseCounter(raw2) {
+  if (typeof raw2 !== "number" || !Number.isFinite(raw2)) return null;
+  if (!Number.isInteger(raw2) || raw2 < 0) return null;
+  return raw2;
+}
+function parseAllowance(raw2) {
+  if (typeof raw2 !== "number" || !Number.isFinite(raw2) || !Number.isInteger(raw2)) return null;
+  if (raw2 === -1) return { limit: null, unlimited: true };
+  if (raw2 < 0) return null;
+  return { limit: raw2, unlimited: false };
+}
+function parseResetInstant(raw2) {
+  if (typeof raw2 !== "string" || raw2.trim().length === 0) return null;
+  const ms = Date.parse(raw2.trim());
+  if (!Number.isFinite(ms)) return null;
+  try {
+    return new Date(ms).toISOString();
+  } catch {
+    return null;
+  }
+}
+function parseRemoteQuota(body) {
+  const used = parseCounter(body["codeProtectionsUsed"]);
+  const allowance = parseAllowance(body["monthlyCodeProtectionLimit"]);
+  if (used === null || allowance === null) return void 0;
+  const resetsAt = parseResetInstant(body["periodResetsAt"]);
+  if (allowance.unlimited) {
+    return { used, limit: null, remaining: null, unlimited: true, resetsAt };
+  }
+  const reported = parseCounter(body["codeProtectionsRemaining"]);
+  const remaining2 = reported ?? Math.max(0, allowance.limit - used);
+  return { used, limit: allowance.limit, remaining: remaining2, unlimited: false, resetsAt };
+}
 async function tierFromBackend(apiKey) {
   const url = `${getConfiguredApiRoot()}/api/cli/auth/validate`;
   const controller = new AbortController();
@@ -18691,7 +18724,13 @@ async function tierFromBackend(apiKey) {
         detail: "the plan service did not report a recognizable plan"
       };
     }
-    return { tier, source: "backend", entitlement: parseEntitlement(body) };
+    const quota2 = parseRemoteQuota(body);
+    return {
+      tier,
+      source: "backend",
+      entitlement: parseEntitlement(body),
+      ...quota2 ? { quota: quota2 } : {}
+    };
   } catch (err) {
     const aborted = err?.name === "AbortError";
     return {
@@ -18753,6 +18792,87 @@ function collectUsage(dbPath) {
 function resetCadenceLabel() {
   return `every ${QUOTA_PERIOD_DAYS2} days`;
 }
+function formatResetInstant(iso) {
+  const ms = Date.parse(iso);
+  if (!Number.isFinite(ms)) return iso;
+  return new Date(ms).toISOString().replace("T", " ").replace(/\.\d{3}Z$/, " UTC");
+}
+function resetLabel(quota2) {
+  return quota2?.resetsAt ? formatResetInstant(quota2.resetsAt) : resetCadenceLabel();
+}
+function percentOf(used, limit) {
+  if (limit <= 0) return used > 0 ? 100 : 0;
+  return Math.round(used / limit * 100);
+}
+function resolveMutationBudget(resolution, localMutationsApplied) {
+  const quota2 = resolution.quota;
+  if (quota2) {
+    return {
+      source: "server",
+      used: quota2.used,
+      limit: quota2.limit,
+      remaining: quota2.remaining,
+      percent: quota2.unlimited ? null : percentOf(quota2.used, quota2.limit ?? 0),
+      unlimited: quota2.unlimited,
+      limitUnknown: false,
+      resetsAt: quota2.resetsAt
+    };
+  }
+  const tier = resolution.tier;
+  if (!tier) {
+    return {
+      source: "local-audit",
+      used: localMutationsApplied,
+      limit: null,
+      remaining: null,
+      percent: null,
+      unlimited: false,
+      limitUnknown: true,
+      resetsAt: null
+    };
+  }
+  const planLimit = PLAN_CONFIGS[tier].mutationsPerPeriod;
+  if (planLimit === null) {
+    return {
+      source: "local-audit",
+      used: localMutationsApplied,
+      limit: null,
+      remaining: null,
+      percent: null,
+      unlimited: true,
+      limitUnknown: false,
+      resetsAt: null
+    };
+  }
+  return {
+    source: "local-audit",
+    used: localMutationsApplied,
+    limit: planLimit,
+    remaining: Math.max(0, planLimit - localMutationsApplied),
+    percent: percentOf(localMutationsApplied, planLimit),
+    unlimited: false,
+    limitUnknown: false,
+    resetsAt: null
+  };
+}
+function budgetSourceLines(budget, resolution, localMutationsApplied) {
+  if (budget.source === "server") {
+    const lines = [
+      "Mutations: counted by the Pretense API \u2014 this is the figure your quota is enforced against."
+    ];
+    if (localMutationsApplied !== budget.used) {
+      lines.push(
+        `This machine's local audit log records ${localMutationsApplied.toLocaleString("en-US")} \u2014 a different machine set and window, not your quota.`
+      );
+    }
+    return lines;
+  }
+  const why = resolution.source === "no-credentials" ? "you are not signed in, so no server was asked" : resolution.source === "key-prefix" ? "a legacy pt- key names its plan offline, so no server was asked for your usage" : resolution.source === "unverified" ? resolution.detail ?? "the plan service could not be reached" : "the plan service did not report usage figures";
+  return [
+    "Mutations: counted LOCALLY on this machine (~/.pretense/audit.db) \u2014 this is NOT",
+    `the usage your quota is enforced against, because ${why}.`
+  ];
+}
 function priceLabel(tier) {
   const cents = PLAN_CONFIGS[tier].pricePerSeatCents;
   if (cents === null) return "custom \u2014 contact sales";
@@ -20242,22 +20362,38 @@ function percentLabel(percent) {
   if (percent >= 80) return chalk9.yellow(`${percent}%`);
   return chalk9.green(`${percent}%`);
 }
+function mutationsPayload(budget) {
+  return {
+    source: budget.source,
+    current: budget.used,
+    limit: budget.limit,
+    percent: budget.percent,
+    remaining: budget.remaining,
+    // `allowed` is only knowable with an allowance. `limitUnknown` must not
+    // read as `true` — "we could not check" is not "you are fine".
+    allowed: budget.limitUnknown ? null : budget.unlimited || (budget.remaining ?? 0) > 0,
+    unlimited: budget.unlimited
+  };
+}
 function emptyUsagePayload(resolution) {
   const tier = resolution.tier;
   const planConfig = tier ? PLAN_CONFIGS[tier] : null;
+  const budget = resolveMutationBudget(resolution, 0);
   return {
     tier,
     tierSource: resolution.source,
     ...resolution.detail ? { tierDetail: resolution.detail } : {},
     periodStart: null,
     periodEnd: null,
-    resetDate: null,
+    resetDate: budget.resetsAt,
     resetCadenceDays: QUOTA_PERIOD_DAYS2,
+    quotaSource: budget.source,
     usage: {
-      mutations: { current: 0, limit: planConfig ? planConfig.mutationsPerPeriod : null, percent: 0, allowed: true },
-      scans: { current: 0, limit: planConfig ? planConfig.scansPerPeriod : null, percent: 0, allowed: true }
+      mutations: mutationsPayload(budget),
+      scans: { source: "local-audit", current: 0, limit: planConfig ? planConfig.scansPerPeriod : null, percent: 0, allowed: true }
     },
-    overallPercent: 0,
+    localAudit: { mutations: 0, scans: 0, secretsBlocked: 0 },
+    overallPercent: budget.percent ?? 0,
     recommendedUpgrade: null
   };
 }
@@ -20278,6 +20414,7 @@ function usageCommand() {
       return;
     }
     const usageMetrics = collected.metrics;
+    const budget = resolveMutationBudget(resolution, usageMetrics.mutationsApplied);
     if (opts.json) {
       const limits = tier ? checkAllLimits(usageMetrics, tier) : null;
       const planConfig2 = tier ? PLAN_CONFIGS[tier] : null;
@@ -20289,23 +20426,33 @@ function usageCommand() {
             ...resolution.detail ? { tierDetail: resolution.detail } : {},
             periodStart: usageMetrics.periodStart,
             periodEnd: usageMetrics.periodEnd,
-            resetDate: null,
+            // The server's own instant when it reported one. `null` means the
+            // CLI was not told — it does NOT mean "no reset exists", and it is
+            // not an invitation to compute one.
+            resetDate: budget.resetsAt,
             resetCadenceDays: QUOTA_PERIOD_DAYS2,
+            quotaSource: budget.source,
             usage: {
-              mutations: {
-                current: usageMetrics.mutationsApplied,
-                limit: planConfig2 ? planConfig2.mutationsPerPeriod : null,
-                percent: limits ? limits.mutations.usagePercent ?? 0 : null,
-                allowed: limits ? limits.mutations.allowed : null
-              },
+              mutations: mutationsPayload(budget),
+              // Scans have no server-side counterpart on the validate
+              // response, so this half is local and says so.
               scans: {
+                source: "local-audit",
                 current: usageMetrics.totalScans,
                 limit: planConfig2 ? planConfig2.scansPerPeriod : null,
                 percent: limits ? limits.scans.usagePercent ?? 0 : null,
                 allowed: limits ? limits.scans.allowed : null
               }
             },
-            overallPercent: tier ? maxUsagePercent(usageMetrics, tier) : null,
+            // The raw local counters, always under a key that names them as
+            // local, so a consumer that wants this machine's view can have it
+            // without it ever being mistaken for the quota.
+            localAudit: {
+              mutations: usageMetrics.mutationsApplied,
+              scans: usageMetrics.totalScans,
+              secretsBlocked: usageMetrics.secretsBlocked
+            },
+            overallPercent: budget.percent ?? (tier ? maxUsagePercent(usageMetrics, tier) : null),
             recommendedUpgrade: tier ? recommendedTier(usageMetrics, tier) : null
           },
           null,
@@ -20314,11 +20461,11 @@ function usageCommand() {
       );
       return;
     }
-    const resetDate = resetCadenceLabel();
+    const resetDate = resetLabel(resolution.quota);
     console.log(
       chalk9.cyan(
-        "\n  Pretense Usage \u2014 " + // Header shows today's date, NOT a billing month: quotas roll on a
-        // 7-day window anchored to signup, so a month name would imply a
+        "\n  Pretense Usage \u2014 " + // Header shows today's date, NOT a billing month: the quota window
+        // trails the account's own activity, so a month name would imply a
         // reset boundary that does not exist.
         (/* @__PURE__ */ new Date()).toLocaleDateString("en-US", {
           month: "long",
@@ -20337,35 +20484,60 @@ function usageCommand() {
         console.log(chalk9.yellow(`  ${line}`));
       }
       console.log();
-      console.log("  " + "Mutations".padEnd(20) + usageMetrics.mutationsApplied.toLocaleString("en-US"));
+      console.log("  " + "Mutations".padEnd(20) + budget.used.toLocaleString("en-US"));
       console.log("  " + "API Requests".padEnd(20) + usageMetrics.totalScans.toLocaleString("en-US"));
       console.log("  " + "Secrets Blocked".padEnd(20) + usageMetrics.secretsBlocked.toLocaleString("en-US"));
       console.log();
+      for (const line of budgetSourceLines(budget, resolution, usageMetrics.mutationsApplied)) {
+        console.log(chalk9.dim(`  ${line}`));
+      }
+      console.log();
       return;
     }
     const planConfig = PLAN_CONFIGS[tier];
-    const overall = maxUsagePercent(usageMetrics, tier);
+    const overall = budget.source === "server" ? budget.percent ?? 0 : maxUsagePercent(usageMetrics, tier);
     const nextTier = recommendedTier(usageMetrics, tier);
     console.log(
       "  " + chalk9.bold("Metric".padEnd(20)) + chalk9.bold("Used / Limit".padEnd(30)) + chalk9.bold("Progress")
     );
     console.log("  " + chalk9.dim("\u2500".repeat(72)));
     const rows = [
-      { label: "Mutations", value: usageMetrics.mutationsApplied, limit: planConfig.mutationsPerPeriod },
-      { label: "API Requests", value: usageMetrics.totalScans, limit: planConfig.scansPerPeriod }
+      {
+        label: "Mutations",
+        value: budget.used,
+        // `limitUnknown` must render as unknown, NOT as unlimited. That
+        // conflation is the original defect: an org at 100% of its quota read
+        // every missing field as "no limit" and was told it had none.
+        limit: budget.limitUnknown ? null : budget.limit,
+        percent: budget.percent
+      },
+      {
+        label: "API Requests",
+        value: usageMetrics.totalScans,
+        limit: planConfig.scansPerPeriod,
+        percent: null
+      }
     ];
     for (const row of rows) {
-      const percent = row.limit === null ? 0 : Math.round(row.value / row.limit * 100);
-      const bar2 = row.limit === null ? chalk9.dim("  unlimited  ".padEnd(32)) : renderBar(percent);
+      const percent = row.percent ?? (row.limit === null ? 0 : Math.round(row.value / row.limit * 100));
+      const unknown = row.label === "Mutations" && budget.limitUnknown;
+      const bar2 = unknown ? chalk9.dim("  not reported  ".padEnd(32)) : row.limit === null ? chalk9.dim("  unlimited  ".padEnd(32)) : renderBar(percent);
+      const used = unknown ? `${row.value.toLocaleString("en-US")} / not reported` : formatMetric(row.value, row.limit);
       console.log(
-        "  " + row.label.padEnd(20) + formatMetric(row.value, row.limit).padEnd(30) + bar2 + "  " + (row.limit === null ? "" : percentLabel(percent))
+        "  " + row.label.padEnd(20) + used.padEnd(30) + bar2 + "  " + (row.limit === null || unknown ? "" : percentLabel(percent))
       );
     }
     console.log(
       "  " + "Secrets Blocked".padEnd(20) + String(usageMetrics.secretsBlocked.toLocaleString("en-US")).padEnd(30) + chalk9.dim("(no limit)")
     );
     console.log("  " + chalk9.dim("\u2500".repeat(72)));
-    if (tier === "enterprise") {
+    for (const line of budgetSourceLines(budget, resolution, usageMetrics.mutationsApplied)) {
+      console.log("  " + chalk9.dim(line));
+    }
+    console.log(
+      "  " + chalk9.dim("API Requests / Secrets Blocked: counted locally on this machine.")
+    );
+    if (tier === "enterprise" && budget.unlimited) {
       console.log(chalk9.green("\n  Enterprise plan \u2014 all limits are unlimited.\n"));
     } else if (overall >= 100) {
       console.log(chalk9.red(`
@@ -22743,9 +22915,10 @@ function creditsCommand() {
     if (!collected && !opts.json) {
       console.log(chalk21.dim("\n  No usage recorded yet \u2014 showing your full allowance.\n"));
     }
-    const mutationLimit = tier ? PLAN_CONFIGS[tier].mutationsPerPeriod : null;
+    const budget = resolveMutationBudget(resolution, m.mutationsApplied);
+    const mutationLimit = budget.limitUnknown ? null : budget.limit;
+    const mutationsLeft = budget.limitUnknown ? null : budget.remaining;
     const scanLimit = tier ? PLAN_CONFIGS[tier].scansPerPeriod : null;
-    const mutationsLeft = tier ? remaining(m.mutationsApplied, mutationLimit) : null;
     const scansLeft = tier ? remaining(m.totalScans, scanLimit) : null;
     if (opts.json) {
       console.log(
@@ -22754,18 +22927,26 @@ function creditsCommand() {
             tier,
             tierSource: resolution.source,
             ...resolution.detail ? { tierDetail: resolution.detail } : {},
-            resetDate: null,
+            // The server's instant when it sent one. It sends `periodResetsAt`
+            // on every validation; this used to be hardcoded `null` while a
+            // hardcoded cadence string was printed beside it.
+            resetDate: budget.resetsAt,
             resetCadenceDays: QUOTA_PERIOD_DAYS2,
+            quotaSource: budget.source,
             mutations: {
-              used: m.mutationsApplied,
-              limit: tier ? mutationLimit : null,
-              remaining: tier ? mutationsLeft : null
+              source: budget.source,
+              used: budget.used,
+              limit: mutationLimit,
+              remaining: mutationsLeft,
+              unlimited: budget.unlimited
             },
             scans: {
+              source: "local-audit",
               used: m.totalScans,
               limit: tier ? scanLimit : null,
               remaining: tier ? scansLeft : null
-            }
+            },
+            localAudit: { mutations: m.mutationsApplied, scans: m.totalScans }
           },
           null,
           2
@@ -22774,29 +22955,39 @@ function creditsCommand() {
       return;
     }
     console.log(chalk21.cyan("\n  Pretense Credits"));
-    console.log(chalk21.dim(`  Plan: ${tierLabel(tier)}  |  Resets: ${resetCadenceLabel()}
-`));
+    console.log(
+      chalk21.dim(`  Plan: ${tierLabel(tier)}  |  Resets: ${resetLabel(resolution.quota)}
+`)
+    );
     if (!tier) {
       for (const line of unverifiedNote(resolution.detail)) {
         console.log(chalk21.yellow(`  ${line}`));
       }
       console.log();
-      console.log("  " + "Mutations used".padEnd(20) + m.mutationsApplied.toLocaleString("en-US"));
+      console.log("  " + "Mutations used".padEnd(20) + budget.used.toLocaleString("en-US"));
       console.log("  " + "Requests used".padEnd(20) + m.totalScans.toLocaleString("en-US"));
       console.log();
+      for (const line of budgetSourceLines(budget, resolution, m.mutationsApplied)) {
+        console.log(chalk21.dim(`  ${line}`));
+      }
+      console.log();
       return;
     }
     console.log(
-      "  " + "Mutations".padEnd(14) + bar(m.mutationsApplied, mutationLimit) + "  " + chalk21.bold(fmt(mutationsLeft)) + chalk21.dim(` left of ${fmt(mutationLimit)}`)
+      "  " + "Mutations".padEnd(14) + bar(budget.used, mutationLimit) + "  " + chalk21.bold(fmt(mutationsLeft)) + chalk21.dim(` left of ${fmt(mutationLimit)}`)
     );
     console.log(
       "  " + "Requests".padEnd(14) + bar(m.totalScans, scanLimit) + "  " + chalk21.bold(fmt(scansLeft)) + chalk21.dim(` left of ${fmt(scanLimit)}`)
     );
+    console.log();
+    for (const line of budgetSourceLines(budget, resolution, m.mutationsApplied)) {
+      console.log(chalk21.dim(`  ${line}`));
+    }
     if (tier !== "enterprise" && mutationLimit !== null && mutationsLeft === 0) {
       console.log(
         chalk21.red("\n  Mutation budget exhausted for this period.") + chalk21.dim(" Run ") + chalk21.cyan("pretense upgrade") + chalk21.dim(" to compare plans.")
       );
-    } else if (tier !== "enterprise" && mutationLimit !== null && m.mutationsApplied >= mutationLimit * 0.8) {
+    } else if (tier !== "enterprise" && mutationLimit !== null && budget.used >= mutationLimit * 0.8) {
       console.log(
         chalk21.yellow("\n  Running low.") + chalk21.dim(" Run ") + chalk21.cyan("pretense upgrade") + chalk21.dim(" to compare plans.")
       );

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-XYBJ63JG.js";
+} from "./chunk-ZSQPYJVT.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.25",
+  "version": "0.6.26",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -23,15 +23,15 @@
     "tsx": "^4.0.0",
     "typescript": "^5.4.0",
     "vitest": "^1.0.0",
-    "@pretense/billing": "0.1.0",
-    "@pretense/learner": "0.2.0",
     "@pretense/compliance-engine": "0.1.0",
+    "@pretense/protocol": "0.1.0",
+    "@pretense/learner": "0.2.0",
+    "@pretense/billing": "0.1.0",
     "@pretense/mutator": "0.2.0",
     "@pretense/proxy": "0.1.0",
     "@pretense/scanner": "0.2.0",
     "@pretense/scanner-rs": "0.2.0",
-    "@pretense/store": "0.2.0",
-    "@pretense/protocol": "0.1.0"
+    "@pretense/store": "0.2.0"
   },
   "publishConfig": {
     "access": "public",