@pretense/cli 0.6.25 → 0.6.27

package/dist/{chunk-XYBJ63JG.js → chunk-6L7NU7KI.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.25" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.27" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-XYBJ63JG.js";
+} from "./chunk-6L7NU7KI.js";
 import {
   __commonJS,
   __toESM,
@@ -7837,7 +7837,9 @@ import { execSync } from "child_process";
 
 // ../apps/proxy/dist/server.js
 init_esm_shims();
-import { resolve as resolvePath } from "path";
+import { resolve as resolvePath, join as joinPath } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync33 } from "fs";
+import { homedir as homedir3 } from "os";
 
 // ../node_modules/.pnpm/hono@4.12.9/node_modules/hono/dist/index.js
 init_esm_shims();
@@ -16657,11 +16659,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.25" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.27" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "24595f8f691656d511f75ed2d8b59f98069779ac".length > 0 ? "24595f8f691656d511f75ed2d8b59f98069779ac" : UNKNOWN_COMMIT;
+  return "2899946100b26294eb8ef8dbde2d50e63a5247a9".length > 0 ? "2899946100b26294eb8ef8dbde2d50e63a5247a9" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",
@@ -17104,7 +17106,13 @@ async function streamWithRollingBuffer(upstreamResp, map, provider, requestId) {
             if (provider === "anthropic" && line.includes("content_block_stop")) {
               const stopIndex = blockStopIndex(line);
               if (stopIndex !== null) {
-                outputLines.push(...flushBlock(stopIndex), line);
+                const flushed = flushBlock(stopIndex);
+                if (flushed.length > 0) {
+                  const header = outputLines.length > 0 && outputLines[outputLines.length - 1].startsWith("event:") ? outputLines.pop() : null;
+                  outputLines.push(...flushed);
+                  if (header !== null) outputLines.push(header);
+                }
+                outputLines.push(line);
                 continue;
               }
             }
@@ -17165,7 +17173,7 @@ async function streamWithRollingBuffer(upstreamResp, map, provider, requestId) {
 function buildFlushEvent(text, provider, kind, index) {
   if (provider === "anthropic") {
     const delta2 = kind === "input_json" ? { type: "input_json_delta", partial_json: text } : kind === "thinking" ? { type: "thinking_delta", thinking: text } : { type: "text_delta", text };
-    return "data: " + JSON.stringify({ type: "content_block_delta", index, delta: delta2 });
+    return "event: content_block_delta\ndata: " + JSON.stringify({ type: "content_block_delta", index, delta: delta2 });
   }
   if (provider === "google") {
     const part = kind === "google_thought" ? { text, thought: true } : { text };
@@ -17357,6 +17365,37 @@ var _tierCache = /* @__PURE__ */ new Map();
 var TIER_CACHE_OK_MS = 6e4;
 var TIER_CACHE_FAIL_MS = 1e4;
 var TIER_VALIDATE_TIMEOUT_MS = 3e3;
+var LOCAL_KEY_CACHE_MS = 3e4;
+var _localKeyCache = null;
+function underTestRunner() {
+  return Boolean(process.env["VITEST"]) || process.env["NODE_ENV"] === "test";
+}
+function readLocalPretenseApiKey() {
+  const now = Date.now();
+  if (_localKeyCache && _localKeyCache.expiresAt > now) return _localKeyCache.key;
+  let key = null;
+  const fromEnv = process.env["PRETENSE_API_KEY"]?.trim();
+  if (fromEnv) {
+    key = fromEnv;
+  } else if (!underTestRunner()) {
+    const path2 = joinPath(homedir3(), ".pretense", "credentials.json");
+    try {
+      if (existsSync24(path2)) {
+        const creds = JSON.parse(readFileSync33(path2, "utf-8"));
+        const raw2 = creds["apiKey"] ?? creds["api_key"];
+        if (typeof raw2 === "string" && raw2.trim().length > 0) key = raw2.trim();
+      }
+    } catch {
+    }
+  }
+  _localKeyCache = { key, expiresAt: now + LOCAL_KEY_CACHE_MS };
+  return key;
+}
+function resolvePretenseKeyForRequest(headerKey) {
+  const explicit = headerKey?.trim();
+  if (explicit) return explicit;
+  return readLocalPretenseApiKey() ?? void 0;
+}
 function tierApiRoot() {
   const raw2 = (process.env["PRETENSE_API_URL"] ?? "https://api.pretense.ai").trim();
   const normalized = /^https?:\/\//i.test(raw2) ? raw2 : `https://${raw2}`;
@@ -17832,7 +17871,7 @@ function createProxy(opts = {}) {
       return c.json({ error: { type: "invalid_request", message: "Empty request body" } }, 400);
     }
     {
-      const _apiKey = c.req.header("x-pretense-api-key") ?? c.req.header("authorization")?.replace(/^Bearer\s+/i, "");
+      const _apiKey = resolvePretenseKeyForRequest(c.req.header("x-pretense-api-key"));
       const _effectiveTier = await resolveKeyTier(_apiKey);
       const _requestEnforcer = new PlanEnforcer(_effectiveTier, planCfg.tenantId);
       const QUOTA_PERIOD_DAYS3 = 7;
@@ -18240,7 +18279,7 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
       sourceIp: c.req.header("x-forwarded-for") ?? c.req.header("x-real-ip")
     }));
     if (anyTokenized) {
-      const usageKey = c.req.header("x-pretense-api-key") ?? c.req.header("authorization")?.replace(/^Bearer\s+/i, "");
+      const usageKey = resolvePretenseKeyForRequest(c.req.header("x-pretense-api-key"));
       uploadProxyUsage({
         apiKey: usageKey,
         identifiersMutated: mutationsApplied,
@@ -18369,8 +18408,8 @@ async function findFreePort(start, opts = {}) {
 init_esm_shims();
 import { existsSync as existsSync8, readFileSync as readFileSync6, unlinkSync } from "fs";
 import { join as join7 } from "path";
-import { homedir as homedir3 } from "os";
-function pidFilePath(home = homedir3()) {
+import { homedir as homedir4 } from "os";
+function pidFilePath(home = homedir4()) {
   return join7(process.env.PRETENSE_PID_DIR ?? join7(home, ".pretense"), "proxy.pid");
 }
 function isProcessAlive(pid) {
@@ -18585,9 +18624,9 @@ import chalk3 from "chalk";
 init_esm_shims();
 import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
 import { join as join8 } from "path";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir5 } from "os";
 function credentialsPath() {
-  return join8(homedir4(), ".pretense", "credentials.json");
+  return join8(homedir5(), ".pretense", "credentials.json");
 }
 function readApiKey() {
   const fromEnv = process.env["PRETENSE_API_KEY"]?.trim();
@@ -18657,6 +18696,39 @@ function parseEntitlement(body) {
     ...subscriptionStatus !== void 0 ? { subscriptionStatus } : {}
   };
 }
+function parseCounter(raw2) {
+  if (typeof raw2 !== "number" || !Number.isFinite(raw2)) return null;
+  if (!Number.isInteger(raw2) || raw2 < 0) return null;
+  return raw2;
+}
+function parseAllowance(raw2) {
+  if (typeof raw2 !== "number" || !Number.isFinite(raw2) || !Number.isInteger(raw2)) return null;
+  if (raw2 === -1) return { limit: null, unlimited: true };
+  if (raw2 < 0) return null;
+  return { limit: raw2, unlimited: false };
+}
+function parseResetInstant(raw2) {
+  if (typeof raw2 !== "string" || raw2.trim().length === 0) return null;
+  const ms = Date.parse(raw2.trim());
+  if (!Number.isFinite(ms)) return null;
+  try {
+    return new Date(ms).toISOString();
+  } catch {
+    return null;
+  }
+}
+function parseRemoteQuota(body) {
+  const used = parseCounter(body["codeProtectionsUsed"]);
+  const allowance = parseAllowance(body["monthlyCodeProtectionLimit"]);
+  if (used === null || allowance === null) return void 0;
+  const resetsAt = parseResetInstant(body["periodResetsAt"]);
+  if (allowance.unlimited) {
+    return { used, limit: null, remaining: null, unlimited: true, resetsAt };
+  }
+  const reported = parseCounter(body["codeProtectionsRemaining"]);
+  const remaining2 = reported ?? Math.max(0, allowance.limit - used);
+  return { used, limit: allowance.limit, remaining: remaining2, unlimited: false, resetsAt };
+}
 async function tierFromBackend(apiKey) {
   const url = `${getConfiguredApiRoot()}/api/cli/auth/validate`;
   const controller = new AbortController();
@@ -18691,7 +18763,13 @@ async function tierFromBackend(apiKey) {
         detail: "the plan service did not report a recognizable plan"
       };
     }
-    return { tier, source: "backend", entitlement: parseEntitlement(body) };
+    const quota2 = parseRemoteQuota(body);
+    return {
+      tier,
+      source: "backend",
+      entitlement: parseEntitlement(body),
+      ...quota2 ? { quota: quota2 } : {}
+    };
   } catch (err) {
     const aborted = err?.name === "AbortError";
     return {
@@ -18753,6 +18831,87 @@ function collectUsage(dbPath) {
 function resetCadenceLabel() {
   return `every ${QUOTA_PERIOD_DAYS2} days`;
 }
+function formatResetInstant(iso) {
+  const ms = Date.parse(iso);
+  if (!Number.isFinite(ms)) return iso;
+  return new Date(ms).toISOString().replace("T", " ").replace(/\.\d{3}Z$/, " UTC");
+}
+function resetLabel(quota2) {
+  return quota2?.resetsAt ? formatResetInstant(quota2.resetsAt) : resetCadenceLabel();
+}
+function percentOf(used, limit) {
+  if (limit <= 0) return used > 0 ? 100 : 0;
+  return Math.round(used / limit * 100);
+}
+function resolveMutationBudget(resolution, localMutationsApplied) {
+  const quota2 = resolution.quota;
+  if (quota2) {
+    return {
+      source: "server",
+      used: quota2.used,
+      limit: quota2.limit,
+      remaining: quota2.remaining,
+      percent: quota2.unlimited ? null : percentOf(quota2.used, quota2.limit ?? 0),
+      unlimited: quota2.unlimited,
+      limitUnknown: false,
+      resetsAt: quota2.resetsAt
+    };
+  }
+  const tier = resolution.tier;
+  if (!tier) {
+    return {
+      source: "local-audit",
+      used: localMutationsApplied,
+      limit: null,
+      remaining: null,
+      percent: null,
+      unlimited: false,
+      limitUnknown: true,
+      resetsAt: null
+    };
+  }
+  const planLimit = PLAN_CONFIGS[tier].mutationsPerPeriod;
+  if (planLimit === null) {
+    return {
+      source: "local-audit",
+      used: localMutationsApplied,
+      limit: null,
+      remaining: null,
+      percent: null,
+      unlimited: true,
+      limitUnknown: false,
+      resetsAt: null
+    };
+  }
+  return {
+    source: "local-audit",
+    used: localMutationsApplied,
+    limit: planLimit,
+    remaining: Math.max(0, planLimit - localMutationsApplied),
+    percent: percentOf(localMutationsApplied, planLimit),
+    unlimited: false,
+    limitUnknown: false,
+    resetsAt: null
+  };
+}
+function budgetSourceLines(budget, resolution, localMutationsApplied) {
+  if (budget.source === "server") {
+    const lines = [
+      "Mutations: counted by the Pretense API \u2014 this is the figure your quota is enforced against."
+    ];
+    if (localMutationsApplied !== budget.used) {
+      lines.push(
+        `This machine's local audit log records ${localMutationsApplied.toLocaleString("en-US")} \u2014 a different machine set and window, not your quota.`
+      );
+    }
+    return lines;
+  }
+  const why = resolution.source === "no-credentials" ? "you are not signed in, so no server was asked" : resolution.source === "key-prefix" ? "a legacy pt- key names its plan offline, so no server was asked for your usage" : resolution.source === "unverified" ? resolution.detail ?? "the plan service could not be reached" : "the plan service did not report usage figures";
+  return [
+    "Mutations: counted LOCALLY on this machine (~/.pretense/audit.db) \u2014 this is NOT",
+    `the usage your quota is enforced against, because ${why}.`
+  ];
+}
 function priceLabel(tier) {
   const cents = PLAN_CONFIGS[tier].pricePerSeatCents;
   if (cents === null) return "custom \u2014 contact sales";
@@ -20174,7 +20333,7 @@ function configCommand() {
 init_esm_shims();
 import { Command as Command8 } from "commander";
 import chalk8 from "chalk";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir6 } from "os";
 import { join as join12 } from "path";
 function logsCommand() {
   return new Command8("logs").description("Show recent audit log entries").option("-l, --limit <n>", "Number of entries to show", "50").option("--json", "Output as JSON", false).action((opts) => {
@@ -20182,7 +20341,7 @@ function logsCommand() {
     let store;
     let entries;
     try {
-      store = new AuditStore(join12(homedir5(), ".pretense", "audit.db"));
+      store = new AuditStore(join12(homedir6(), ".pretense", "audit.db"));
       entries = store.getRecentEntries(limit);
       store.close();
     } catch {
@@ -20223,7 +20382,7 @@ init_esm_shims();
 import { Command as Command9 } from "commander";
 import chalk9 from "chalk";
 import { join as join13 } from "path";
-import { homedir as homedir6 } from "os";
+import { homedir as homedir7 } from "os";
 function renderBar(percent, width = 30) {
   const filled = Math.min(Math.round(percent / 100 * width), width);
   const empty = width - filled;
@@ -20242,27 +20401,43 @@ function percentLabel(percent) {
   if (percent >= 80) return chalk9.yellow(`${percent}%`);
   return chalk9.green(`${percent}%`);
 }
+function mutationsPayload(budget) {
+  return {
+    source: budget.source,
+    current: budget.used,
+    limit: budget.limit,
+    percent: budget.percent,
+    remaining: budget.remaining,
+    // `allowed` is only knowable with an allowance. `limitUnknown` must not
+    // read as `true` — "we could not check" is not "you are fine".
+    allowed: budget.limitUnknown ? null : budget.unlimited || (budget.remaining ?? 0) > 0,
+    unlimited: budget.unlimited
+  };
+}
 function emptyUsagePayload(resolution) {
   const tier = resolution.tier;
   const planConfig = tier ? PLAN_CONFIGS[tier] : null;
+  const budget = resolveMutationBudget(resolution, 0);
   return {
     tier,
     tierSource: resolution.source,
     ...resolution.detail ? { tierDetail: resolution.detail } : {},
     periodStart: null,
     periodEnd: null,
-    resetDate: null,
+    resetDate: budget.resetsAt,
     resetCadenceDays: QUOTA_PERIOD_DAYS2,
+    quotaSource: budget.source,
     usage: {
-      mutations: { current: 0, limit: planConfig ? planConfig.mutationsPerPeriod : null, percent: 0, allowed: true },
-      scans: { current: 0, limit: planConfig ? planConfig.scansPerPeriod : null, percent: 0, allowed: true }
+      mutations: mutationsPayload(budget),
+      scans: { source: "local-audit", current: 0, limit: planConfig ? planConfig.scansPerPeriod : null, percent: 0, allowed: true }
     },
-    overallPercent: 0,
+    localAudit: { mutations: 0, scans: 0, secretsBlocked: 0 },
+    overallPercent: budget.percent ?? 0,
     recommendedUpgrade: null
   };
 }
 function usageCommand() {
-  return new Command9("usage").description("Show plan usage vs limits for the current billing period").option("--db <path>", "Path to audit database", join13(homedir6(), ".pretense", "audit.db")).option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
+  return new Command9("usage").description("Show plan usage vs limits for the current billing period").option("--db <path>", "Path to audit database", join13(homedir7(), ".pretense", "audit.db")).option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
     const resolution = await resolvePlanTier({ offline: opts.offline });
     const tier = resolution.tier;
     const collected = collectUsage(opts.db);
@@ -20278,6 +20453,7 @@ function usageCommand() {
       return;
     }
     const usageMetrics = collected.metrics;
+    const budget = resolveMutationBudget(resolution, usageMetrics.mutationsApplied);
     if (opts.json) {
       const limits = tier ? checkAllLimits(usageMetrics, tier) : null;
       const planConfig2 = tier ? PLAN_CONFIGS[tier] : null;
@@ -20289,23 +20465,33 @@ function usageCommand() {
             ...resolution.detail ? { tierDetail: resolution.detail } : {},
             periodStart: usageMetrics.periodStart,
             periodEnd: usageMetrics.periodEnd,
-            resetDate: null,
+            // The server's own instant when it reported one. `null` means the
+            // CLI was not told — it does NOT mean "no reset exists", and it is
+            // not an invitation to compute one.
+            resetDate: budget.resetsAt,
             resetCadenceDays: QUOTA_PERIOD_DAYS2,
+            quotaSource: budget.source,
             usage: {
-              mutations: {
-                current: usageMetrics.mutationsApplied,
-                limit: planConfig2 ? planConfig2.mutationsPerPeriod : null,
-                percent: limits ? limits.mutations.usagePercent ?? 0 : null,
-                allowed: limits ? limits.mutations.allowed : null
-              },
+              mutations: mutationsPayload(budget),
+              // Scans have no server-side counterpart on the validate
+              // response, so this half is local and says so.
               scans: {
+                source: "local-audit",
                 current: usageMetrics.totalScans,
                 limit: planConfig2 ? planConfig2.scansPerPeriod : null,
                 percent: limits ? limits.scans.usagePercent ?? 0 : null,
                 allowed: limits ? limits.scans.allowed : null
               }
             },
-            overallPercent: tier ? maxUsagePercent(usageMetrics, tier) : null,
+            // The raw local counters, always under a key that names them as
+            // local, so a consumer that wants this machine's view can have it
+            // without it ever being mistaken for the quota.
+            localAudit: {
+              mutations: usageMetrics.mutationsApplied,
+              scans: usageMetrics.totalScans,
+              secretsBlocked: usageMetrics.secretsBlocked
+            },
+            overallPercent: budget.percent ?? (tier ? maxUsagePercent(usageMetrics, tier) : null),
             recommendedUpgrade: tier ? recommendedTier(usageMetrics, tier) : null
           },
           null,
@@ -20314,11 +20500,11 @@ function usageCommand() {
       );
       return;
     }
-    const resetDate = resetCadenceLabel();
+    const resetDate = resetLabel(resolution.quota);
     console.log(
       chalk9.cyan(
-        "\n  Pretense Usage \u2014 " + // Header shows today's date, NOT a billing month: quotas roll on a
-        // 7-day window anchored to signup, so a month name would imply a
+        "\n  Pretense Usage \u2014 " + // Header shows today's date, NOT a billing month: the quota window
+        // trails the account's own activity, so a month name would imply a
         // reset boundary that does not exist.
         (/* @__PURE__ */ new Date()).toLocaleDateString("en-US", {
           month: "long",
@@ -20337,35 +20523,60 @@ function usageCommand() {
         console.log(chalk9.yellow(`  ${line}`));
       }
       console.log();
-      console.log("  " + "Mutations".padEnd(20) + usageMetrics.mutationsApplied.toLocaleString("en-US"));
+      console.log("  " + "Mutations".padEnd(20) + budget.used.toLocaleString("en-US"));
       console.log("  " + "API Requests".padEnd(20) + usageMetrics.totalScans.toLocaleString("en-US"));
       console.log("  " + "Secrets Blocked".padEnd(20) + usageMetrics.secretsBlocked.toLocaleString("en-US"));
       console.log();
+      for (const line of budgetSourceLines(budget, resolution, usageMetrics.mutationsApplied)) {
+        console.log(chalk9.dim(`  ${line}`));
+      }
+      console.log();
       return;
     }
     const planConfig = PLAN_CONFIGS[tier];
-    const overall = maxUsagePercent(usageMetrics, tier);
+    const overall = budget.source === "server" ? budget.percent ?? 0 : maxUsagePercent(usageMetrics, tier);
     const nextTier = recommendedTier(usageMetrics, tier);
     console.log(
       "  " + chalk9.bold("Metric".padEnd(20)) + chalk9.bold("Used / Limit".padEnd(30)) + chalk9.bold("Progress")
     );
     console.log("  " + chalk9.dim("\u2500".repeat(72)));
     const rows = [
-      { label: "Mutations", value: usageMetrics.mutationsApplied, limit: planConfig.mutationsPerPeriod },
-      { label: "API Requests", value: usageMetrics.totalScans, limit: planConfig.scansPerPeriod }
+      {
+        label: "Mutations",
+        value: budget.used,
+        // `limitUnknown` must render as unknown, NOT as unlimited. That
+        // conflation is the original defect: an org at 100% of its quota read
+        // every missing field as "no limit" and was told it had none.
+        limit: budget.limitUnknown ? null : budget.limit,
+        percent: budget.percent
+      },
+      {
+        label: "API Requests",
+        value: usageMetrics.totalScans,
+        limit: planConfig.scansPerPeriod,
+        percent: null
+      }
     ];
     for (const row of rows) {
-      const percent = row.limit === null ? 0 : Math.round(row.value / row.limit * 100);
-      const bar2 = row.limit === null ? chalk9.dim("  unlimited  ".padEnd(32)) : renderBar(percent);
+      const percent = row.percent ?? (row.limit === null ? 0 : Math.round(row.value / row.limit * 100));
+      const unknown = row.label === "Mutations" && budget.limitUnknown;
+      const bar2 = unknown ? chalk9.dim("  not reported  ".padEnd(32)) : row.limit === null ? chalk9.dim("  unlimited  ".padEnd(32)) : renderBar(percent);
+      const used = unknown ? `${row.value.toLocaleString("en-US")} / not reported` : formatMetric(row.value, row.limit);
       console.log(
-        "  " + row.label.padEnd(20) + formatMetric(row.value, row.limit).padEnd(30) + bar2 + "  " + (row.limit === null ? "" : percentLabel(percent))
+        "  " + row.label.padEnd(20) + used.padEnd(30) + bar2 + "  " + (row.limit === null || unknown ? "" : percentLabel(percent))
       );
     }
     console.log(
       "  " + "Secrets Blocked".padEnd(20) + String(usageMetrics.secretsBlocked.toLocaleString("en-US")).padEnd(30) + chalk9.dim("(no limit)")
     );
     console.log("  " + chalk9.dim("\u2500".repeat(72)));
-    if (tier === "enterprise") {
+    for (const line of budgetSourceLines(budget, resolution, usageMetrics.mutationsApplied)) {
+      console.log("  " + chalk9.dim(line));
+    }
+    console.log(
+      "  " + chalk9.dim("API Requests / Secrets Blocked: counted locally on this machine.")
+    );
+    if (tier === "enterprise" && budget.unlimited) {
       console.log(chalk9.green("\n  Enterprise plan \u2014 all limits are unlimited.\n"));
     } else if (overall >= 100) {
       console.log(chalk9.red(`
@@ -20415,9 +20626,9 @@ import { Command as Command10 } from "commander";
 import chalk10 from "chalk";
 import { existsSync as existsSync12, readFileSync as readFileSync11, unlinkSync as unlinkSync2 } from "fs";
 import { join as join14 } from "path";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 import { execSync as execSync4 } from "child_process";
-var CREDENTIALS_DIR = join14(homedir7(), ".pretense");
+var CREDENTIALS_DIR = join14(homedir8(), ".pretense");
 var CREDENTIALS_PATH = join14(CREDENTIALS_DIR, "credentials.json");
 async function verifyApiKey(apiKey) {
   const url = `${getConfiguredApiRoot()}/api/cli/auth/validate`;
@@ -21001,9 +21212,9 @@ import { Command as Command13 } from "commander";
 import chalk13 from "chalk";
 import { appendFileSync as appendFileSync3, readFileSync as readFileSync14, existsSync as existsSync14 } from "fs";
 import { join as join17 } from "path";
-import { homedir as homedir8 } from "os";
+import { homedir as homedir9 } from "os";
 var IGNORE_FILE = ".pretenseignore";
-var LAST_SCAN_PATH = join17(homedir8(), ".pretense", "last-scan.json");
+var LAST_SCAN_PATH = join17(homedir9(), ".pretense", "last-scan.json");
 function ignorePath() {
   return join17(process.cwd(), IGNORE_FILE);
 }
@@ -21401,9 +21612,9 @@ import { resolve as resolve6, extname as extname4 } from "path";
 // src/secret-crypto.ts
 init_esm_shims();
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, hkdfSync as hkdfSync2 } from "crypto";
-import { homedir as homedir9 } from "os";
+import { homedir as homedir10 } from "os";
 import { join as join19 } from "path";
-var KEYS_DIR = join19(homedir9(), ".pretense", "keys");
+var KEYS_DIR = join19(homedir10(), ".pretense", "keys");
 var HKDF_SALT2 = Buffer.from("pretense-maps-v1", "utf-8");
 var HKDF_INFO2 = Buffer.from("secret-mapping-aes-256-gcm", "utf-8");
 var IV_LEN = 12;
@@ -21521,12 +21732,12 @@ function ensureDefaultMapPath(absFilePath, override2) {
 
 // src/local-audit.ts
 init_esm_shims();
-import { homedir as homedir10 } from "os";
+import { homedir as homedir11 } from "os";
 import { join as join24 } from "path";
 import { randomUUID } from "crypto";
 import chalk15 from "chalk";
 function localAuditDbPath() {
-  return join24(homedir10(), ".pretense", "audit.db");
+  return join24(homedir11(), ".pretense", "audit.db");
 }
 function recordLocalAudit(rec, dbPath = localAuditDbPath()) {
   let store = null;
@@ -22524,7 +22735,7 @@ function policyCommand() {
 init_esm_shims();
 import { Command as Command20 } from "commander";
 import chalk20 from "chalk";
-import { homedir as homedir11 } from "os";
+import { homedir as homedir12 } from "os";
 import { join as join25 } from "path";
 var VALID_FORMATS2 = ["table", "csv", "json", "jsonl"];
 function toSafeAuditRow(e) {
@@ -22649,7 +22860,7 @@ function auditCommand() {
 `));
       process.exit(1);
     }
-    const dbPath = opts.db ?? join25(homedir11(), ".pretense", "audit.db");
+    const dbPath = opts.db ?? join25(homedir12(), ".pretense", "audit.db");
     let rows;
     try {
       const store = new AuditStore(dbPath);
@@ -22710,7 +22921,7 @@ init_esm_shims();
 import { Command as Command21 } from "commander";
 import chalk21 from "chalk";
 import { join as join26 } from "path";
-import { homedir as homedir12 } from "os";
+import { homedir as homedir13 } from "os";
 function remaining(used, limit) {
   if (limit === null) return null;
   return Math.max(0, limit - used);
@@ -22728,7 +22939,7 @@ function bar(used, limit, width = 24) {
   return chalk21.green(s);
 }
 function creditsCommand() {
-  return new Command21("credits").alias("tokens").description("Show remaining mutation budget for the current period").option("--db <path>", "Path to audit database", join26(homedir12(), ".pretense", "audit.db")).option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
+  return new Command21("credits").alias("tokens").description("Show remaining mutation budget for the current period").option("--db <path>", "Path to audit database", join26(homedir13(), ".pretense", "audit.db")).option("--json", "Output as JSON", false).option("--offline", "Do not contact the plan service to resolve the tier", false).action(async (opts) => {
     const resolution = await resolvePlanTier({ offline: opts.offline });
     const tier = resolution.tier;
     const collected = collectUsage(opts.db);
@@ -22743,9 +22954,10 @@ function creditsCommand() {
     if (!collected && !opts.json) {
       console.log(chalk21.dim("\n  No usage recorded yet \u2014 showing your full allowance.\n"));
     }
-    const mutationLimit = tier ? PLAN_CONFIGS[tier].mutationsPerPeriod : null;
+    const budget = resolveMutationBudget(resolution, m.mutationsApplied);
+    const mutationLimit = budget.limitUnknown ? null : budget.limit;
+    const mutationsLeft = budget.limitUnknown ? null : budget.remaining;
     const scanLimit = tier ? PLAN_CONFIGS[tier].scansPerPeriod : null;
-    const mutationsLeft = tier ? remaining(m.mutationsApplied, mutationLimit) : null;
     const scansLeft = tier ? remaining(m.totalScans, scanLimit) : null;
     if (opts.json) {
       console.log(
@@ -22754,18 +22966,26 @@ function creditsCommand() {
             tier,
             tierSource: resolution.source,
             ...resolution.detail ? { tierDetail: resolution.detail } : {},
-            resetDate: null,
+            // The server's instant when it sent one. It sends `periodResetsAt`
+            // on every validation; this used to be hardcoded `null` while a
+            // hardcoded cadence string was printed beside it.
+            resetDate: budget.resetsAt,
             resetCadenceDays: QUOTA_PERIOD_DAYS2,
+            quotaSource: budget.source,
             mutations: {
-              used: m.mutationsApplied,
-              limit: tier ? mutationLimit : null,
-              remaining: tier ? mutationsLeft : null
+              source: budget.source,
+              used: budget.used,
+              limit: mutationLimit,
+              remaining: mutationsLeft,
+              unlimited: budget.unlimited
             },
             scans: {
+              source: "local-audit",
               used: m.totalScans,
               limit: tier ? scanLimit : null,
               remaining: tier ? scansLeft : null
-            }
+            },
+            localAudit: { mutations: m.mutationsApplied, scans: m.totalScans }
           },
           null,
           2
@@ -22774,29 +22994,39 @@ function creditsCommand() {
       return;
     }
     console.log(chalk21.cyan("\n  Pretense Credits"));
-    console.log(chalk21.dim(`  Plan: ${tierLabel(tier)}  |  Resets: ${resetCadenceLabel()}
-`));
+    console.log(
+      chalk21.dim(`  Plan: ${tierLabel(tier)}  |  Resets: ${resetLabel(resolution.quota)}
+`)
+    );
     if (!tier) {
       for (const line of unverifiedNote(resolution.detail)) {
         console.log(chalk21.yellow(`  ${line}`));
       }
       console.log();
-      console.log("  " + "Mutations used".padEnd(20) + m.mutationsApplied.toLocaleString("en-US"));
+      console.log("  " + "Mutations used".padEnd(20) + budget.used.toLocaleString("en-US"));
       console.log("  " + "Requests used".padEnd(20) + m.totalScans.toLocaleString("en-US"));
       console.log();
+      for (const line of budgetSourceLines(budget, resolution, m.mutationsApplied)) {
+        console.log(chalk21.dim(`  ${line}`));
+      }
+      console.log();
       return;
     }
     console.log(
-      "  " + "Mutations".padEnd(14) + bar(m.mutationsApplied, mutationLimit) + "  " + chalk21.bold(fmt(mutationsLeft)) + chalk21.dim(` left of ${fmt(mutationLimit)}`)
+      "  " + "Mutations".padEnd(14) + bar(budget.used, mutationLimit) + "  " + chalk21.bold(fmt(mutationsLeft)) + chalk21.dim(` left of ${fmt(mutationLimit)}`)
     );
     console.log(
       "  " + "Requests".padEnd(14) + bar(m.totalScans, scanLimit) + "  " + chalk21.bold(fmt(scansLeft)) + chalk21.dim(` left of ${fmt(scanLimit)}`)
     );
+    console.log();
+    for (const line of budgetSourceLines(budget, resolution, m.mutationsApplied)) {
+      console.log(chalk21.dim(`  ${line}`));
+    }
     if (tier !== "enterprise" && mutationLimit !== null && mutationsLeft === 0) {
       console.log(
         chalk21.red("\n  Mutation budget exhausted for this period.") + chalk21.dim(" Run ") + chalk21.cyan("pretense upgrade") + chalk21.dim(" to compare plans.")
       );
-    } else if (tier !== "enterprise" && mutationLimit !== null && m.mutationsApplied >= mutationLimit * 0.8) {
+    } else if (tier !== "enterprise" && mutationLimit !== null && budget.used >= mutationLimit * 0.8) {
       console.log(
         chalk21.yellow("\n  Running low.") + chalk21.dim(" Run ") + chalk21.cyan("pretense upgrade") + chalk21.dim(" to compare plans.")
       );

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-XYBJ63JG.js";
+} from "./chunk-6L7NU7KI.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.25",
+  "version": "0.6.27",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -24,14 +24,14 @@
     "typescript": "^5.4.0",
     "vitest": "^1.0.0",
     "@pretense/billing": "0.1.0",
-    "@pretense/learner": "0.2.0",
     "@pretense/compliance-engine": "0.1.0",
-    "@pretense/mutator": "0.2.0",
+    "@pretense/protocol": "0.1.0",
+    "@pretense/learner": "0.2.0",
     "@pretense/proxy": "0.1.0",
+    "@pretense/mutator": "0.2.0",
     "@pretense/scanner": "0.2.0",
     "@pretense/scanner-rs": "0.2.0",
-    "@pretense/store": "0.2.0",
-    "@pretense/protocol": "0.1.0"
+    "@pretense/store": "0.2.0"
   },
   "publishConfig": {
     "access": "public",