@westbayberry/dg 1.1.2 → 1.1.3

package/dist/index.mjs

@@ -1649,7 +1649,7 @@ function initTelemetry(version) {
   });
 }
 function redact(s) {
-  return s.replace(/dg_(?:live|test)_[A-Za-z0-9_-]{3,}/gi, "[DG_KEY_REDACTED]").replace(/\/Users\/[^\s:]+/g, "[USER_PATH]").replace(/\/home\/[^\s:]+/g, "[USER_PATH]").replace(/C:\\Users\\[^\s:]+/g, "[USER_PATH]").replace(/Bearer [^\s]+/g, "Bearer [REDACTED]");
+  return s.replace(/(--token(?:=|\s+))\S+/gi, "$1[REDACTED]").replace(/dg_(?:live|test)_[A-Za-z0-9_-]{3,}/gi, "[DG_KEY_REDACTED]").replace(/\/Users\/[^\s:]+/g, "[USER_PATH]").replace(/\/home\/[^\s:]+/g, "[USER_PATH]").replace(/C:\\Users\\[^\s:]+/g, "[USER_PATH]").replace(/Bearer [^\s]+/g, "Bearer [REDACTED]");
 }
 function suppressNudge() {
   return !telemetryEnabled();
@@ -1669,7 +1669,7 @@ function trimStack(raw, debug) {
 }
 function buildIssueUrl(error, ctx) {
   const msg = redact(error.message || error.name || "Unknown error").slice(0, 120);
-  const cmd = process.argv.slice(2).join(" ") || "(none)";
+  const cmd = redact(process.argv.slice(2).join(" ")) || "(none)";
   const stack = trimStack(error.stack, false).join("\n");
   const body = [
     "**dg crashed**",
@@ -1730,7 +1730,7 @@ function captureError(error, context) {
       process.exitCode = 1;
       return;
     }
-    const cmd = process.argv.slice(2).join(" ") || "(none)";
+    const cmd = redact(process.argv.slice(2).join(" ")) || "(none)";
     process.stderr.write("\n" + chalk18.dim(SEPARATOR) + "\n\n");
     process.stderr.write(
       "  " + chalk18.red.bold("\u2718 dg crashed: ") + chalk18.red(redact(err.message || err.name)) + "\n\n"
@@ -1958,49 +1958,64 @@ function authBase() {
   }
 }
 async function createAuthSession() {
-  let res;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), 1e4);
   try {
-    res = await globalThis.fetch(`${authBase()}/cli/auth/sessions`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" }
-    });
-  } catch {
-    throw new Error("Could not connect to westbayberry.com");
-  }
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    throw new Error(
-      `Failed to create auth session (HTTP ${res.status})${body ? `: ${body}` : ""}`
-    );
+    let res;
+    try {
+      res = await globalThis.fetch(`${authBase()}/cli/auth/sessions`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        signal: ctrl.signal
+      });
+    } catch {
+      throw new Error("Could not connect to westbayberry.com");
+    }
+    if (!res.ok) {
+      const body = await res.text().catch(() => "");
+      throw new Error(
+        `Failed to create auth session (HTTP ${res.status})${body ? `: ${body}` : ""}`
+      );
+    }
+    const json = await res.json();
+    return {
+      sessionId: json.session_id,
+      verifyUrl: json.verify_url,
+      expiresIn: json.expires_in
+    };
+  } finally {
+    clearTimeout(timer);
   }
-  const json = await res.json();
-  return {
-    sessionId: json.session_id,
-    verifyUrl: json.verify_url,
-    expiresIn: json.expires_in
-  };
 }
 async function pollAuthSession(sessionId) {
-  let res;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), 8e3);
   try {
-    res = await globalThis.fetch(
-      `${authBase()}/cli/auth/sessions/${sessionId}/token`
-    );
-  } catch {
-    return { status: "expired" };
-  }
-  if (res.status === 404) {
-    return { status: "expired" };
-  }
-  if (!res.ok) {
-    return { status: "expired" };
+    let res;
+    try {
+      res = await globalThis.fetch(
+        `${authBase()}/cli/auth/sessions/${sessionId}/token`,
+        { signal: ctrl.signal }
+      );
+    } catch (e) {
+      if (e instanceof Error && e.name === "AbortError") return { status: "pending" };
+      return { status: "expired" };
+    }
+    if (res.status === 404) {
+      return { status: "expired" };
+    }
+    if (!res.ok) {
+      return { status: "expired" };
+    }
+    const json = await res.json();
+    return {
+      status: json.status,
+      apiKey: json.api_key,
+      email: json.email
+    };
+  } finally {
+    clearTimeout(timer);
   }
-  const json = await res.json();
-  return {
-    status: json.status,
-    apiKey: json.api_key,
-    email: json.email
-  };
 }
 function configPath() {
   return dgConfigPath();
@@ -2297,7 +2312,7 @@ async function preflightAuthCheck(apiUrl) {
   const cached = readCachedAuthStatus();
   if (cached) {
     if (cached.freeTierCapReached) {
-      throw new PreflightFreeCapReachedError(cached.scansUsed, cached.scansLimit ?? cached.scansUsed);
+      throw new PreflightFreeCapReachedError(cached.scansUsed, cached.scansLimit ?? cached.scansUsed, cached.capReason ?? "monthly_limit");
     }
     return cached;
   }
@@ -2331,15 +2346,17 @@ async function preflightAuthCheck(apiUrl) {
     } catch {
     }
     if (body.freeTierCapReached) {
+      const capReason = body.capReason === "prefix_cap" ? "prefix_cap" : "monthly_limit";
       const status2 = {
         authenticated: !!apiKey,
         freeTierCapReached: true,
         scansUsed: body.scansUsed ?? 0,
         scansLimit: body.maxScans ?? 0,
+        capReason,
         fetchedAt: Date.now()
       };
       writeCachedAuthStatus(status2);
-      throw new PreflightFreeCapReachedError(status2.scansUsed, status2.scansLimit ?? 0);
+      throw new PreflightFreeCapReachedError(status2.scansUsed, status2.scansLimit ?? 0, capReason);
     }
   }
   if (!resp.ok) {
@@ -2476,10 +2493,13 @@ var init_auth = __esm({
     init_paths();
     DEFAULT_WEB_BASE = "https://westbayberry.com";
     PreflightFreeCapReachedError = class extends Error {
-      constructor(scansUsed, maxScans) {
-        super("Free tier monthly cap reached. Run `dg upgrade` for Pro.");
+      constructor(scansUsed, maxScans, reason = "monthly_limit") {
+        super(
+          reason === "prefix_cap" ? "Too many anonymous devices from your network this month. Sign in with `dg login` to keep scanning." : "Free tier monthly package limit reached. Run `dg upgrade` for Pro."
+        );
         this.scansUsed = scansUsed;
         this.maxScans = maxScans;
+        this.reason = reason;
         this.name = "PreflightFreeCapReachedError";
       }
     };
@@ -3945,7 +3965,7 @@ unset it manually if you want fully anonymous behavior.
     UPGRADE = `
 dg upgrade \u2014 start Stripe checkout for Pro
 
-Free tier is 1000 scans/mo per device. Pro is 5000/mo + watchlists +
+Free tier is 50,000 packages/mo per device. Pro is 250,000/mo + watchlists +
 saved reports + Dashboard analytics.
 
 Usage:
@@ -4014,7 +4034,7 @@ async function maybeShowWelcomePanel(opts) {
   if (existsSync9(welcomeShownPath())) return;
   if (!existsSync9(installReceiptPath2())) return;
   try {
-    const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+    const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
     const lines = [
       "",
       chalk18.bold("  \u2713 Dependency Guardian is active.") + "",
@@ -4065,7 +4085,7 @@ __export(upgrade_exports, {
   handleUpgradeCommand: () => handleUpgradeCommand
 });
 async function handleUpgradeCommand(opts) {
-  const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+  const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
   const webUrl = opts?.webUrl ?? process.env.DG_WEB_URL ?? "https://westbayberry.com";
   const deviceId = getOrCreateDeviceId();
   const url = `${webUrl}/upgrade?device=${encodeURIComponent(deviceId)}`;
@@ -39038,9 +39058,9 @@ var import_react22, import_jsx_runtime, CHAR_POOL, COLOR_POOL, GRAVITY, DRAG, FR
 var init_Confetti = __esm({
   async "src/ui/components/Confetti.tsx"() {
     "use strict";
-    import_react22 = __toESM(require_react());
+    import_react22 = __toESM(require_react(), 1);
     await init_build2();
-    import_jsx_runtime = __toESM(require_jsx_runtime());
+    import_jsx_runtime = __toESM(require_jsx_runtime(), 1);
     CHAR_POOL = [
       "*",
       "*",
@@ -39155,7 +39175,7 @@ var import_react23;
 var init_useTerminalSize = __esm({
   async "src/ui/hooks/useTerminalSize.ts"() {
     "use strict";
-    import_react23 = __toESM(require_react());
+    import_react23 = __toESM(require_react(), 1);
     await init_build2();
   }
 });
@@ -39169,11 +39189,11 @@ var import_react24, import_jsx_runtime2, LoginCelebrateApp;
 var init_LoginCelebrateApp = __esm({
   async "src/ui/apps/LoginCelebrateApp.tsx"() {
     "use strict";
-    import_react24 = __toESM(require_react());
+    import_react24 = __toESM(require_react(), 1);
     await init_build2();
     await init_Confetti();
     await init_useTerminalSize();
-    import_jsx_runtime2 = __toESM(require_jsx_runtime());
+    import_jsx_runtime2 = __toESM(require_jsx_runtime(), 1);
     LoginCelebrateApp = ({ email, durationMs = 2500 }) => {
       const { exit } = use_app_default();
       const { cols, rows } = useTerminalSize();
@@ -39230,7 +39250,7 @@ async function celebrateFirstLoginIfNew(email) {
   if (!shouldCelebrate()) return;
   try {
     const { render: render2 } = await init_build2().then(() => build_exports);
-    const React22 = await Promise.resolve().then(() => __toESM(require_react()));
+    const React22 = await Promise.resolve().then(() => __toESM(require_react(), 1));
     const { LoginCelebrateApp: LoginCelebrateApp2 } = await init_LoginCelebrateApp().then(() => LoginCelebrateApp_exports);
     const { enterTui: enterTui2, leaveTui: leaveTui2 } = await Promise.resolve().then(() => (init_terminal_state(), terminal_state_exports));
     enterTui2();
@@ -39284,7 +39304,7 @@ function parseLoginArgs(args) {
   return { kind: "token", value: token, force };
 }
 async function handleLoginWithToken(raw, opts) {
-  const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+  const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
   const existing = getStoredApiKey();
   if (existing && !opts.force) {
     process.stderr.write(
@@ -39439,7 +39459,7 @@ var import_react25, POLL_INTERVAL_MS, MAX_POLL_ATTEMPTS;
 var init_useLogin = __esm({
   "src/ui/hooks/useLogin.ts"() {
     "use strict";
-    import_react25 = __toESM(require_react());
+    import_react25 = __toESM(require_react(), 1);
     init_auth();
     POLL_INTERVAL_MS = 2e3;
     MAX_POLL_ATTEMPTS = 150;
@@ -41125,7 +41145,7 @@ var init_Spinner = __esm({
     "use strict";
     await init_build2();
     await init_build3();
-    import_jsx_runtime3 = __toESM(require_jsx_runtime());
+    import_jsx_runtime3 = __toESM(require_jsx_runtime(), 1);
     Spinner2 = ({ label }) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Box_default, { children: [
       /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(Text, { color: "cyan", children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(build_default, { type: "dots" }) }),
       /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Text, { children: [
@@ -41145,11 +41165,11 @@ var import_react27, import_jsx_runtime4, LoginApp;
 var init_LoginApp = __esm({
   async "src/ui/apps/LoginApp.tsx"() {
     "use strict";
-    import_react27 = __toESM(require_react());
+    import_react27 = __toESM(require_react(), 1);
     await init_build2();
     init_useLogin();
     await init_Spinner();
-    import_jsx_runtime4 = __toESM(require_jsx_runtime());
+    import_jsx_runtime4 = __toESM(require_jsx_runtime(), 1);
     LoginApp = () => {
       const { state, openAndPoll } = useLogin();
       const { exit } = use_app_default();
@@ -41289,7 +41309,8 @@ __export(client_exports, {
   callAnalyzeAPI: () => callAnalyzeAPI,
   callPyPIAnalyzeAPI: () => callPyPIAnalyzeAPI,
   fetchLicenses: () => fetchLicenses,
-  fetchPyPILicenses: () => fetchPyPILicenses
+  fetchPyPILicenses: () => fetchPyPILicenses,
+  mergeResponses: () => mergeResponses
 });
 import { randomUUID as randomUUID2 } from "node:crypto";
 function batchConcurrency() {
@@ -41328,7 +41349,11 @@ async function handleFreeCapReached(response) {
     const body = await response.json().catch(() => ({}));
     if (body && body.freeTierCapReached) {
       const b = body;
-      throw new FreeCapReachedError(b.scansUsed, b.maxScans);
+      throw new FreeCapReachedError(
+        b.scansUsed,
+        b.maxScans,
+        b.capReason === "prefix_cap" ? "prefix_cap" : "monthly_limit"
+      );
     }
     throw new APIError("Forbidden", 403, JSON.stringify(body));
   }
@@ -41467,12 +41492,19 @@ function mergeResponses(results) {
   for (const r of results) {
     Object.assign(safeVersions, r.safeVersions);
   }
+  const remaining = results.map((r) => r.freeScansRemaining).filter((v) => typeof v === "number");
+  const usage = results.map((r) => r.usage).filter((u) => !!u).reduce(
+    (best, u) => best === void 0 || u.used > best.used ? u : best,
+    void 0
+  );
   return {
     score: maxScore,
     action,
     packages: allPackages,
     safeVersions,
-    durationMs: results.reduce((s, r) => s + (r.durationMs || 0), 0)
+    durationMs: results.reduce((s, r) => s + (r.durationMs || 0), 0),
+    ...remaining.length > 0 ? { freeScansRemaining: Math.min(...remaining) } : {},
+    ...usage ? { usage } : {}
   };
 }
 function formatApiErrorMessage(status, rawBody, config) {
@@ -41858,10 +41890,13 @@ var init_client = __esm({
       }
     };
     FreeCapReachedError = class extends Error {
-      constructor(scansUsed, maxScans) {
-        super("Free trial scans used up. Run `dg login` to create a free account and continue scanning.");
+      constructor(scansUsed, maxScans, reason = "monthly_limit") {
+        super(
+          reason === "prefix_cap" ? "Too many anonymous devices from your network this month. Sign in with `dg login` to keep scanning." : "Free tier monthly package limit reached. Run `dg upgrade` for Pro."
+        );
         this.scansUsed = scansUsed;
         this.maxScans = maxScans;
+        this.reason = reason;
         this.name = "FreeCapReachedError";
       }
     };
@@ -42269,13 +42304,17 @@ function discoverChanges(cwd2, config) {
     cwd2 = join7(cwd2, config.workspace);
   }
   const lockfileInfo = findLockfile(cwd2);
-  const pythonDepFiles = ["requirements.txt", "Pipfile.lock", "poetry.lock"];
+  const pythonDepFiles = ["requirements.txt", "Pipfile.lock", "poetry.lock", "uv.lock"];
   let pythonPackages = [];
+  const pythonSkipped = [];
   for (const pyFile of pythonDepFiles) {
     if (existsSync12(join7(cwd2, pyFile))) {
       const pyPkgs = parsePythonDepFile(cwd2, pyFile);
       for (const p of pyPkgs) {
-        if (p.version === "latest") continue;
+        if (p.version === "latest") {
+          pythonSkipped.push(`${p.name} (unpinned \u2014 pin with == to scan)`);
+          continue;
+        }
         pythonPackages.push({
           name: sanitize(p.name),
           version: sanitize(p.version),
@@ -42287,8 +42326,8 @@ function discoverChanges(cwd2, config) {
     }
   }
   if (!lockfileInfo) {
-    if (pythonPackages.length > 0) {
-      const skipped2 = [];
+    if (pythonPackages.length > 0 || pythonSkipped.length > 0) {
+      const skipped2 = [...pythonSkipped];
       if (pythonPackages.length > config.maxPackages) {
         skipped2.push(...pythonPackages.slice(config.maxPackages).map((p) => `${p.name}@${p.version}`));
         pythonPackages = pythonPackages.slice(0, config.maxPackages);
@@ -42296,7 +42335,7 @@ function discoverChanges(cwd2, config) {
       return { packages: [], pythonPackages, method: "scan-all", skipped: skipped2 };
     }
     throw new Error(
-      "No lockfile found (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, or poetry.lock). Run from your project root or use --base-lockfile."
+      "No lockfile found (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, or uv.lock). Run from your project root or use --base-lockfile."
     );
   }
   const headContent = readFileSafe(lockfileInfo.path);
@@ -42313,7 +42352,7 @@ function discoverChanges(cwd2, config) {
       packages: diff2.changes.map(toPackageInput).filter((p) => p.name !== SELF_PACKAGE),
       pythonPackages,
       method: "base-lockfile",
-      skipped: diff2.skipped
+      skipped: [...diff2.skipped, ...pythonSkipped]
     };
   }
   if (!config.scanAll) {
@@ -42325,7 +42364,7 @@ function discoverChanges(cwd2, config) {
         packages: diff2.changes.map(toPackageInput).filter((p) => p.name !== SELF_PACKAGE),
         pythonPackages,
         method: "git-diff",
-        skipped: diff2.skipped
+        skipped: [...diff2.skipped, ...pythonSkipped]
       };
     }
     const pkgJsonPath = join7(cwd2, "package.json");
@@ -42346,7 +42385,7 @@ function discoverChanges(cwd2, config) {
           packages: resolved.map(toPackageInput).filter((p) => p.name !== SELF_PACKAGE),
           pythonPackages,
           method: "fallback",
-          skipped: []
+          skipped: [...pythonSkipped]
         };
       }
     }
@@ -42369,7 +42408,7 @@ function discoverChanges(cwd2, config) {
       });
     }
   }
-  return { packages, pythonPackages, method: "scan-all", skipped };
+  return { packages, pythonPackages, method: "scan-all", skipped: [...skipped, ...pythonSkipped] };
 }
 function findLockfile(cwd2) {
   const candidates = [
@@ -42476,10 +42515,11 @@ function parsePythonDepFile(projectDir, depFile) {
       return [];
     }
   }
-  if (depFile === "poetry.lock") {
+  if (depFile === "poetry.lock" || depFile === "uv.lock") {
     const packages2 = [];
     const blocks = content.split(/^\[\[package\]\]/gm);
     for (const block of blocks) {
+      if (/source\s*=\s*\{[^}]*\b(editable|virtual|directory)\b/.test(block)) continue;
       const nameMatch = block.match(/^name\s*=\s*"([^"]+)"/m);
       const versionMatch = block.match(/^version\s*=\s*"([^"]+)"/m);
       if (nameMatch && versionMatch) {
@@ -43460,6 +43500,24 @@ var init_artifact_integrity = __esm({
 });
 
 // src/ui/format-helpers.ts
+var format_helpers_exports = {};
+__export(format_helpers_exports, {
+  USAGE_NEAR_LIMIT_RATIO: () => USAGE_NEAR_LIMIT_RATIO,
+  formatUsage: () => formatUsage,
+  groupPackages: () => groupPackages,
+  pad: () => pad,
+  truncate: () => truncate
+});
+function formatUsage(usage) {
+  const used = usage.used.toLocaleString();
+  if (usage.limit === null) {
+    return { text: `${used} packages this month`, nearLimit: false };
+  }
+  return {
+    text: `${used} / ${usage.limit.toLocaleString()} packages this month`,
+    nearLimit: usage.used / usage.limit >= USAGE_NEAR_LIMIT_RATIO
+  };
+}
 function pad(s, len) {
   return s + " ".repeat(Math.max(0, len - s.length));
 }
@@ -43479,9 +43537,11 @@ function groupPackages(packages, keyBy = "name") {
     key: keyBy === "fingerprint" ? fingerprint : pkgs[0].name
   })).sort((a, b) => b.packages[0].score - a.packages[0].score);
 }
+var USAGE_NEAR_LIMIT_RATIO;
 var init_format_helpers = __esm({
   "src/ui/format-helpers.ts"() {
     "use strict";
+    USAGE_NEAR_LIMIT_RATIO = 0.8;
   }
 });
 
@@ -43545,11 +43605,11 @@ var import_react28, import_chalk4, import_jsx_runtime5, VISIBLE_ROWS, FileSavePr
 var init_FileSavePrompt = __esm({
   async "src/ui/components/FileSavePrompt.tsx"() {
     "use strict";
-    import_react28 = __toESM(require_react());
+    import_react28 = __toESM(require_react(), 1);
     await init_build2();
-    import_chalk4 = __toESM(require_source());
+    import_chalk4 = __toESM(require_source(), 1);
     await init_useTerminalSize();
-    import_jsx_runtime5 = __toESM(require_jsx_runtime());
+    import_jsx_runtime5 = __toESM(require_jsx_runtime(), 1);
     VISIBLE_ROWS = 15;
     FileSavePrompt = ({
       defaultName,
@@ -43824,7 +43884,7 @@ async function countPythonPackages(depPath, depFile) {
       const parsed = JSON.parse(content);
       return Object.keys(parsed.default || {}).length + Object.keys(parsed.develop || {}).length;
     }
-    if (depFile === "poetry.lock") {
+    if (depFile === "poetry.lock" || depFile === "uv.lock") {
       return (content.match(/^\[\[package\]\]/gm) || []).length;
     }
     return content.split("\n").filter(
@@ -43843,7 +43903,7 @@ var init_count_packages = __esm({
   "src/discover/count-packages.ts"() {
     "use strict";
     NPM_LOCKFILES = ["package-lock.json", "yarn.lock", "pnpm-lock.yaml", "npm-shrinkwrap.json"];
-    PYTHON_DEPFILES = ["requirements.txt", "Pipfile.lock", "poetry.lock"];
+    PYTHON_DEPFILES = ["requirements.txt", "Pipfile.lock", "poetry.lock", "uv.lock"];
   }
 });
 
@@ -44385,13 +44445,16 @@ function derivePackageAction(pkg) {
 function overallAction(packages) {
   let hasBlock = false;
   let hasWarn = false;
+  let hasIncomplete = false;
   for (const p of packages) {
-    const a = derivePackageActionFromFindings(p);
+    const a = derivePackageAction(p);
     if (a === "block") hasBlock = true;
     else if (a === "warn") hasWarn = true;
+    if (p.action === "analysis_incomplete") hasIncomplete = true;
   }
   if (hasBlock) return "block";
   if (hasWarn) return "warn";
+  if (hasIncomplete) return "analysis_incomplete";
   return "pass";
 }
 function applyAllowlist(allowlist, result, apiKind) {
@@ -44423,6 +44486,7 @@ function applyAllowlist(allowlist, result, apiKind) {
   let suppressedCount = 0;
   const filteredPackages = result.packages.map((pkg) => {
     const matchingEntry = activePackages.find((e) => packageMatches(e, pkg, apiKind));
+    const originalCount = (pkg.findings ?? []).length;
     let findings = pkg.findings ?? [];
     if (matchingEntry) {
       if (!matchingEntry.rules) {
@@ -44437,8 +44501,8 @@ function applyAllowlist(allowlist, result, apiKind) {
     const globallySupressed = findings.filter((f) => activeGlobalRules[findingRuleId(f)] !== void 0);
     suppressedCount += globallySupressed.length;
     findings = findings.filter((f) => activeGlobalRules[findingRuleId(f)] === void 0);
-    const newPkg = { ...pkg, findings };
-    return newPkg;
+    const action = findings.length !== originalCount ? derivePackageActionFromFindings({ ...pkg, findings }) : pkg.action ?? derivePackageAction(pkg);
+    return { ...pkg, findings, action };
   });
   const newAction = overallAction(filteredPackages);
   return {
@@ -44733,7 +44797,8 @@ __export(static_output_exports, {
   runStatic: () => runStatic,
   runStaticLogin: () => runStaticLogin,
   runStaticNpm: () => runStaticNpm,
-  runStaticPip: () => runStaticPip
+  runStaticPip: () => runStaticPip,
+  scanExitCode: () => scanExitCode
 });
 import { writeFileSync as writeFileSync11, readFileSync as readFileSync12, existsSync as existsSync18, mkdirSync as mkdirSync8, lstatSync as lstatSync5 } from "node:fs";
 import { resolve as resolvePath, dirname as dirname12 } from "node:path";
@@ -44806,7 +44871,7 @@ async function handleJsonOutput(result, config) {
   const localDate = (/* @__PURE__ */ new Date()).toLocaleDateString("sv-SE");
   const defaultName = `dg-scan-${localDate}`;
   const { render: render2 } = await init_build2().then(() => build_exports);
-  const React22 = await Promise.resolve().then(() => __toESM(require_react()));
+  const React22 = await Promise.resolve().then(() => __toESM(require_react(), 1));
   const { FileSavePrompt: FileSavePrompt2 } = await init_FileSavePrompt().then(() => FileSavePrompt_exports);
   await new Promise((resolve3) => {
     const inkInstance = render2(
@@ -44874,7 +44939,7 @@ function handleFreeCapReached2(error, jsonMode = false) {
       hasKey = !!getStoredApiKey();
     } catch {
     }
-    const message = hasKey ? "Your API key may be invalid or expired. Run `dg logout` then `dg login` to re-authenticate." : `Free tier monthly cap reached (${error.scansUsed}/${error.maxScans}). Run \`dg upgrade\` for Pro (5000/mo) or wait until next month.`;
+    const message = hasKey ? "Your API key may be invalid or expired. Run `dg logout` then `dg login` to re-authenticate." : `Free tier monthly package limit reached (${error.scansUsed.toLocaleString()}/${error.maxScans.toLocaleString()}). Run \`dg upgrade\` for Pro or wait until next month.`;
     if (jsonMode) {
       process.stdout.write(JSON.stringify({
         error: true,
@@ -44892,8 +44957,8 @@ function handleFreeCapReached2(error, jsonMode = false) {
       } else {
         process.stderr.write(
           import_chalk5.default.yellow(`
-  Free tier monthly cap reached (${error.scansUsed}/${error.maxScans}).
-`) + import_chalk5.default.white(`  Run \`dg upgrade\` for Pro (5000/mo) or wait until next month.
+  Free tier monthly package limit reached (${error.scansUsed.toLocaleString()}/${error.maxScans.toLocaleString()}).
+`) + import_chalk5.default.white(`  Run \`dg upgrade\` for Pro or wait until next month.
 
 `)
         );
@@ -45045,6 +45110,12 @@ function renderResultDetails(result, _config) {
 function renderResultStatic(result, config) {
   return config.details ? renderResultDetails(result, config) : renderResultClean(result, config);
 }
+function scanExitCode(action, mode) {
+  if (action === "block" && mode === "block") return 2;
+  if (action === "block" || action === "warn") return 1;
+  if (action === "analysis_incomplete") return 4;
+  return 0;
+}
 async function runStatic(config) {
   const dbg = (msg) => {
     if (config.debug)
@@ -45107,7 +45178,7 @@ async function runStatic(config) {
 `
     )
   );
-  if (discovery.skipped.length > 0 && config.maxPackages < 1e4) {
+  if (discovery.skipped.length > 0) {
     note(
       config,
       import_chalk5.default.dim(
@@ -45191,26 +45262,23 @@ async function runStatic(config) {
       process.stdout.write(sarif + "\n");
     }
     printTrialBanner(result, config);
-    if (result.action === "block" && config.mode === "block") process.exit(2);
-    else if (result.action === "block" || result.action === "warn") process.exit(1);
-    process.exit(0);
+    process.exit(scanExitCode(result.action, config.mode));
   }
   const jsonHandled = await handleJsonOutput(result, config);
   if (jsonHandled) {
     printTrialBanner(result, config);
-    if (result.action === "block" && config.mode === "block") process.exit(2);
-    else if (result.action === "block" || result.action === "warn") process.exit(1);
-    process.exit(0);
+    process.exit(scanExitCode(result.action, config.mode));
   }
   const output = renderResultStatic(result, config);
   process.stdout.write(output + "\n");
-  printTrialBanner(result, config);
-  if (result.action === "block" && config.mode === "block") {
-    process.exit(2);
-  } else if (result.action === "block" || result.action === "warn") {
-    process.exit(1);
+  if (result.usage) {
+    const u = formatUsage(result.usage);
+    process.stdout.write(
+      (u.nearLimit ? import_chalk5.default.yellow(`  ${u.text}  \u2191 dg upgrade for Pro`) : import_chalk5.default.dim(`  ${u.text}`)) + "\n"
+    );
   }
-  process.exit(0);
+  printTrialBanner(result, config);
+  process.exit(scanExitCode(result.action, config.mode));
 }
 function mergeProjectConfig(config, _argv) {
   return config;
@@ -45927,7 +45995,7 @@ var import_chalk5, MAX_PACKAGE_LOCK_BYTES, NUDGE_INTERVAL_MS;
 var init_static_output = __esm({
   "src/formatters/static-output.ts"() {
     "use strict";
-    import_chalk5 = __toESM(require_source());
+    import_chalk5 = __toESM(require_source(), 1);
     init_paths();
     init_client();
     init_auth();
@@ -46056,7 +46124,7 @@ function isEngineResolvable() {
   }
 }
 async function renderStatusHuman(s) {
-  const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+  const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
   const out = [];
   out.push("\n");
   out.push(`  ${chalk18.bold("Dependency Guardian")} ${chalk18.dim(s.update.current)}
@@ -46074,7 +46142,7 @@ async function renderStatusHuman(s) {
     authGlyph = chalk18.green("\u2713");
     authLine = "signed in";
   } else {
-    const usage = s.auth.scansLimit === null ? "unlimited scans" : `${s.auth.scansUsed ?? 0}/${s.auth.scansLimit} scans this month`;
+    const usage = s.auth.scansLimit === null ? "unlimited packages" : `${(s.auth.scansUsed ?? 0).toLocaleString()}/${s.auth.scansLimit.toLocaleString()} packages this month`;
     authGlyph = chalk18.green("\u2713");
     authLine = `${s.auth.tier ?? "free"} tier \xB7 ${usage}`;
   }
@@ -46198,7 +46266,7 @@ var import_chalk6, USAGE2;
 var init_config2 = __esm({
   "src/commands/config.ts"() {
     "use strict";
-    import_chalk6 = __toESM(require_source());
+    import_chalk6 = __toESM(require_source(), 1);
     init_auth();
     USAGE2 = `
   dg config \u2014 view or set persisted CLI preferences
@@ -46304,7 +46372,7 @@ var import_chalk7, SINK_RANKS, CSV_FORMULA_PREFIXES;
 var init_license_export = __esm({
   "src/formatters/license-export.ts"() {
     "use strict";
-    import_chalk7 = __toESM(require_source());
+    import_chalk7 = __toESM(require_source(), 1);
     SINK_RANKS = { "no-license": 2, unknown: 1 };
     CSV_FORMULA_PREFIXES = /* @__PURE__ */ new Set(["=", "+", "-", "@", "	", "\r"]);
   }
@@ -46367,9 +46435,9 @@ var init_ScoreHeader = __esm({
   async "src/ui/components/ScoreHeader.tsx"() {
     "use strict";
     await init_build2();
-    import_chalk8 = __toESM(require_source());
+    import_chalk8 = __toESM(require_source(), 1);
     await init_useTerminalSize();
-    import_jsx_runtime6 = __toESM(require_jsx_runtime());
+    import_jsx_runtime6 = __toESM(require_jsx_runtime(), 1);
     LOGO_DATA = (() => {
       const W = 22, H = 28;
       const grid = Array.from({ length: H }, () => Array(W).fill(0));
@@ -46417,7 +46485,8 @@ var init_ScoreHeader = __esm({
       flagged,
       clean,
       userStatus,
-      scanUsage
+      scanUsage,
+      usageNearLimit
     }) => {
       const logo = renderLogo(action);
       const { cols } = useTerminalSize();
@@ -46457,7 +46526,10 @@ var init_ScoreHeader = __esm({
                     import_chalk8.default.green("all clean")
                   ] })
                 ] }),
-                scanUsage && /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(Text, { dimColor: true, children: scanUsage })
+                scanUsage && (usageNearLimit ? /* @__PURE__ */ (0, import_jsx_runtime6.jsxs)(Text, { color: "yellow", children: [
+                  scanUsage,
+                  "  \u2191 dg upgrade for Pro"
+                ] }) : /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(Text, { dimColor: true, children: scanUsage }))
               ] })
             ] }),
             showLogo && /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(Box_default, { flexDirection: "column", marginLeft: 2, children: logo.map((line, i) => /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(Text, { children: line }, i)) })
@@ -46510,7 +46582,7 @@ var import_react29;
 var init_useExpandAnimation = __esm({
   "src/ui/hooks/useExpandAnimation.ts"() {
     "use strict";
-    import_react29 = __toESM(require_react());
+    import_react29 = __toESM(require_react(), 1);
   }
 });
 
@@ -46683,16 +46755,16 @@ var import_react30, import_chalk9, import_jsx_runtime7, SEVERITY_LABELS, SEVERIT
 var init_InteractiveResultsView = __esm({
   async "src/ui/components/InteractiveResultsView.tsx"() {
     "use strict";
-    import_react30 = __toESM(require_react());
+    import_react30 = __toESM(require_react(), 1);
     await init_build2();
-    import_chalk9 = __toESM(require_source());
+    import_chalk9 = __toESM(require_source(), 1);
     init_auth();
     await init_ScoreHeader();
     init_useExpandAnimation();
     await init_useTerminalSize();
     init_terminal_state();
     init_format_helpers();
-    import_jsx_runtime7 = __toESM(require_jsx_runtime());
+    import_jsx_runtime7 = __toESM(require_jsx_runtime(), 1);
     SEVERITY_LABELS = {
       5: "CRIT",
       4: "HIGH",
@@ -46721,7 +46793,9 @@ var init_InteractiveResultsView = __esm({
       scanUsage: scanUsageProp,
       initialView
     }) => {
-      const scanUsage = result.freeScansRemaining !== void 0 ? `${result.freeScansRemaining} scans left` : scanUsageProp;
+      const usageDisplay = result.usage ? formatUsage(result.usage) : null;
+      const scanUsage = usageDisplay ? usageDisplay.text : result.freeScansRemaining !== void 0 ? `${result.freeScansRemaining.toLocaleString()} packages left` : scanUsageProp;
+      const usageNearLimit = usageDisplay?.nearLimit ?? false;
       const flagged = (0, import_react30.useMemo)(
         () => result.packages.filter((p) => p.score > 0),
         [result.packages]
@@ -47422,7 +47496,8 @@ var init_InteractiveResultsView = __esm({
               flagged: flagged.length,
               clean: clean.length,
               userStatus,
-              scanUsage
+              scanUsage,
+              usageNearLimit
             }
           ),
           /* @__PURE__ */ (0, import_jsx_runtime7.jsxs)(Box_default, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingLeft: 2, paddingRight: 2, children: [
@@ -47466,7 +47541,8 @@ var init_InteractiveResultsView = __esm({
               flagged: flagged.length,
               clean: clean.length,
               userStatus,
-              scanUsage
+              scanUsage,
+              usageNearLimit
             }
           ),
           /* @__PURE__ */ (0, import_jsx_runtime7.jsxs)(
@@ -47613,7 +47689,8 @@ var init_InteractiveResultsView = __esm({
                 flagged: flagged.length,
                 clean: clean.length,
                 userStatus,
-                scanUsage
+                scanUsage,
+                usageNearLimit
               }
             ),
             /* @__PURE__ */ (0, import_jsx_runtime7.jsxs)(Box_default, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingLeft: 2, paddingRight: 2, width: "100%", children: [
@@ -47714,7 +47791,8 @@ var init_InteractiveResultsView = __esm({
               flagged: flagged.length,
               clean: clean.length,
               userStatus,
-              scanUsage
+              scanUsage,
+              usageNearLimit
             }
           ),
           /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(Text, { dimColor: true, children: import_chalk9.default.dim("\u2500".repeat(Math.max(20, termCols - 4))) }),
@@ -47820,7 +47898,8 @@ var init_InteractiveResultsView = __esm({
                 flagged: flagged.length,
                 clean: clean.length,
                 userStatus,
-                scanUsage
+                scanUsage,
+                usageNearLimit
               }
             ),
             /* @__PURE__ */ (0, import_jsx_runtime7.jsx)(Text, { dimColor: true, children: import_chalk9.default.dim("\u2500".repeat(Math.max(20, termCols - 4))) }),
@@ -47908,7 +47987,8 @@ var init_InteractiveResultsView = __esm({
             flagged: flagged.length,
             clean: clean.length,
             userStatus,
-            scanUsage
+            scanUsage,
+            usageNearLimit
           }
         ),
         groups.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime7.jsxs)(import_jsx_runtime7.Fragment, { children: [
@@ -48260,7 +48340,7 @@ function toAPIResponse(results) {
   };
 }
 async function renderTui(results) {
-  const React22 = (await Promise.resolve().then(() => __toESM(require_react()))).default;
+  const React22 = (await Promise.resolve().then(() => __toESM(require_react(), 1))).default;
   const { render: render2, Box: Box2 } = await init_build2().then(() => build_exports);
   const { InteractiveResultsView: InteractiveResultsView2 } = await init_InteractiveResultsView().then(() => InteractiveResultsView_exports);
   const { enterTui: enterTui2, leaveTui: leaveTui2 } = await Promise.resolve().then(() => (init_terminal_state(), terminal_state_exports));
@@ -48302,7 +48382,7 @@ async function handleLicensesCommand() {
     return;
   }
   const config = parseConfig(process.argv, false);
-  const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+  const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
   let discovery;
   try {
     discovery = await discoverLicenseTargets(process.cwd(), config);
@@ -49661,7 +49741,7 @@ var import_chalk10, PKG_NAME2, FETCH_TIMEOUT_MS, USAGE4;
 var init_update = __esm({
   "src/commands/update.ts"() {
     "use strict";
-    import_chalk10 = __toESM(require_source());
+    import_chalk10 = __toESM(require_source(), 1);
     init_paths();
     init_update_check();
     PKG_NAME2 = "@westbayberry/dg";
@@ -50092,7 +50172,7 @@ var import_chalk11, REVOKE_TIMEOUT_MS, USAGE5;
 var init_uninstall = __esm({
   "src/commands/uninstall.ts"() {
     "use strict";
-    import_chalk11 = __toESM(require_source());
+    import_chalk11 = __toESM(require_source(), 1);
     init_paths();
     init_hooks_registry();
     init_hook();
@@ -50375,7 +50455,7 @@ var import_chalk12, USAGE6;
 var init_verify = __esm({
   "src/commands/verify.ts"() {
     "use strict";
-    import_chalk12 = __toESM(require_source());
+    import_chalk12 = __toESM(require_source(), 1);
     init_config();
     init_client();
     init_npm_wrapper();
@@ -50434,11 +50514,11 @@ var import_react31, import_jsx_runtime8, ConfettiDemoApp;
 var init_ConfettiDemoApp = __esm({
   async "src/ui/apps/ConfettiDemoApp.tsx"() {
     "use strict";
-    import_react31 = __toESM(require_react());
+    import_react31 = __toESM(require_react(), 1);
     await init_build2();
     await init_Confetti();
     await init_useTerminalSize();
-    import_jsx_runtime8 = __toESM(require_jsx_runtime());
+    import_jsx_runtime8 = __toESM(require_jsx_runtime(), 1);
     ConfettiDemoApp = () => {
       const { exit } = use_app_default();
       const { cols, rows } = useTerminalSize();
@@ -50490,7 +50570,7 @@ var import_react32, USAGE7;
 var init_confetti = __esm({
   "src/commands/confetti.ts"() {
     "use strict";
-    import_react32 = __toESM(require_react());
+    import_react32 = __toESM(require_react(), 1);
     USAGE7 = `
   dg confetti \u2014 preview the terminal confetti effect (dev)
 
@@ -50559,7 +50639,7 @@ function reducer3(_state, action) {
     case "ERROR":
       return { phase: "error", error: action.error };
     case "FREE_CAP_REACHED":
-      return { phase: "free_cap_reached", scansUsed: action.scansUsed, maxScans: action.maxScans };
+      return { phase: "free_cap_reached", scansUsed: action.scansUsed, maxScans: action.maxScans, capReason: action.capReason };
   }
 }
 function useScan(config) {
@@ -50620,7 +50700,7 @@ async function runNpmScan(packages, skippedCount, config, dispatch) {
     dispatch({ type: "SCAN_COMPLETE", result, durationMs: Date.now() - startMs, skippedCount });
   } catch (error) {
     if (error instanceof FreeCapReachedError) {
-      dispatch({ type: "FREE_CAP_REACHED", scansUsed: error.scansUsed, maxScans: error.maxScans });
+      dispatch({ type: "FREE_CAP_REACHED", scansUsed: error.scansUsed, maxScans: error.maxScans, capReason: error.reason });
       return;
     }
     const err = error instanceof Error ? error : new Error(String(error));
@@ -50711,7 +50791,7 @@ async function scanProjects(projects, config, dispatch) {
     dispatch({ type: "SCAN_COMPLETE", result: merged, durationMs: merged.durationMs, skippedCount: 0, discoveredTotal });
   } catch (error) {
     if (error instanceof FreeCapReachedError) {
-      dispatch({ type: "FREE_CAP_REACHED", scansUsed: error.scansUsed, maxScans: error.maxScans });
+      dispatch({ type: "FREE_CAP_REACHED", scansUsed: error.scansUsed, maxScans: error.maxScans, capReason: error.reason });
       return;
     }
     const err = error instanceof Error ? error : new Error(String(error));
@@ -50723,7 +50803,7 @@ var import_react33;
 var init_useScan = __esm({
   "src/ui/hooks/useScan.ts"() {
     "use strict";
-    import_react33 = __toESM(require_react());
+    import_react33 = __toESM(require_react(), 1);
     init_lockfile();
     init_client();
     init_walker();
@@ -50761,12 +50841,12 @@ var import_react34, import_chalk13, import_jsx_runtime9, ProgressBar;
 var init_ProgressBar = __esm({
   async "src/ui/components/ProgressBar.tsx"() {
     "use strict";
-    import_react34 = __toESM(require_react());
+    import_react34 = __toESM(require_react(), 1);
     await init_build2();
     await init_build3();
-    import_chalk13 = __toESM(require_source());
+    import_chalk13 = __toESM(require_source(), 1);
     await init_useTerminalSize();
-    import_jsx_runtime9 = __toESM(require_jsx_runtime());
+    import_jsx_runtime9 = __toESM(require_jsx_runtime(), 1);
     ProgressBar = ({
       value,
       total,
@@ -50863,9 +50943,9 @@ var init_ErrorView = __esm({
   async "src/ui/components/ErrorView.tsx"() {
     "use strict";
     await init_build2();
-    import_chalk14 = __toESM(require_source());
+    import_chalk14 = __toESM(require_source(), 1);
     init_sanitize();
-    import_jsx_runtime10 = __toESM(require_jsx_runtime());
+    import_jsx_runtime10 = __toESM(require_jsx_runtime(), 1);
     ErrorView = ({ error }) => {
       const hint = getHint(error);
       return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
@@ -50896,12 +50976,12 @@ var import_react35, import_chalk15, import_jsx_runtime11, ProjectSelector;
 var init_ProjectSelector = __esm({
   async "src/ui/components/ProjectSelector.tsx"() {
     "use strict";
-    import_react35 = __toESM(require_react());
+    import_react35 = __toESM(require_react(), 1);
     await init_build2();
-    import_chalk15 = __toESM(require_source());
+    import_chalk15 = __toESM(require_source(), 1);
     init_sanitize();
     await init_useTerminalSize();
-    import_jsx_runtime11 = __toESM(require_jsx_runtime());
+    import_jsx_runtime11 = __toESM(require_jsx_runtime(), 1);
     ProjectSelector = ({ projects, onConfirm, onCancel, userStatus }) => {
       const [cursor, setCursor] = (0, import_react35.useState)(0);
       const [selected, setSelected] = (0, import_react35.useState)(() => new Set(projects.map((_, i) => i)));
@@ -50996,7 +51076,7 @@ var init_SetupBanner = __esm({
   async "src/ui/components/SetupBanner.tsx"() {
     "use strict";
     await init_build2();
-    import_jsx_runtime12 = __toESM(require_jsx_runtime());
+    import_jsx_runtime12 = __toESM(require_jsx_runtime(), 1);
     SetupBanner = ({ issues }) => {
       if (issues.length === 0) return null;
       return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
@@ -51039,7 +51119,7 @@ var import_react36, import_jsx_runtime13, App2;
 var init_App2 = __esm({
   async "src/ui/App.tsx"() {
     "use strict";
-    import_react36 = __toESM(require_react());
+    import_react36 = __toESM(require_react(), 1);
     await init_build2();
     init_auth();
     init_useScan();
@@ -51051,7 +51131,7 @@ var init_App2 = __esm({
     await init_SetupBanner();
     await init_useTerminalSize();
     init_terminal_state();
-    import_jsx_runtime13 = __toESM(require_jsx_runtime());
+    import_jsx_runtime13 = __toESM(require_jsx_runtime(), 1);
     App2 = ({ config, userStatus, scanUsage, setupIssues = [] }) => {
       const { state, scanSelectedProjects, restartSelection } = useScan(config);
       const { exit } = use_app_default();
@@ -51135,7 +51215,7 @@ var init_App2 = __esm({
             exit();
           }
         }
-        if (state.phase === "trial_exhausted") {
+        if (state.phase === "free_cap_reached") {
           if (input === "q" || key.escape || key.return) {
             process.exitCode = 1;
             leaveAltScreen();
@@ -51188,7 +51268,7 @@ var init_App2 = __esm({
             return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { dimColor: true, children: state.message });
           case "error":
             return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(ErrorView, { error: state.error });
-          case "trial_exhausted": {
+          case "free_cap_reached": {
             let hasKey = false;
             try {
               hasKey = !!getStoredApiKey();
@@ -51205,12 +51285,25 @@ var init_App2 = __esm({
                   /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { color: "cyan", bold: true, children: "dg login" }),
                   " to re-authenticate."
                 ] })
-              ] }) : /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_jsx_runtime13.Fragment, { children: [
-                /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { color: "yellow", bold: true, children: "You've used your 5 free anonymous scans." }),
+              ] }) : state.capReason === "prefix_cap" ? /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_jsx_runtime13.Fragment, { children: [
+                /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { color: "yellow", bold: true, children: "Too many anonymous devices from your network this month." }),
                 /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(Text, { children: [
-                  "Run ",
+                  "Sign in with ",
                   /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { color: "cyan", bold: true, children: "dg login" }),
-                  " to access Dependency Guardian for free."
+                  " to keep scanning."
+                ] })
+              ] }) : /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_jsx_runtime13.Fragment, { children: [
+                /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(Text, { color: "yellow", bold: true, children: [
+                  "Free monthly limit reached (",
+                  state.scansUsed.toLocaleString(),
+                  "/",
+                  state.maxScans.toLocaleString(),
+                  " packages)."
+                ] }),
+                /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(Text, { children: [
+                  "Upgrade to Pro with ",
+                  /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { color: "cyan", bold: true, children: "dg upgrade" }),
+                  " for 250k packages/month."
                 ] })
               ] }),
               /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Text, { children: " " }),
@@ -51581,7 +51674,7 @@ function useInstallWrapper(rawArgs, config, opts, exit) {
         const result = await opts.callAnalyze(resolved, config);
         if (result.action === "pass") {
           if (exit) exit();
-          const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+          const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
           const line = formatPassLine(result, chalk18);
           process.stderr.write("  " + line + "\n\n");
           const code = await opts.runInstall(parsed.rawArgs);
@@ -51700,7 +51793,7 @@ var import_react37, NPM_OPTIONS, PIP_OPTIONS;
 var init_useWrapperBase = __esm({
   "src/ui/hooks/useWrapperBase.ts"() {
     "use strict";
-    import_react37 = __toESM(require_react());
+    import_react37 = __toESM(require_react(), 1);
     init_client();
     init_npm_wrapper();
     init_pip_wrapper();
@@ -51732,7 +51825,7 @@ var init_DurationLine = __esm({
   async "src/ui/components/DurationLine.tsx"() {
     "use strict";
     await init_build2();
-    import_jsx_runtime14 = __toESM(require_jsx_runtime());
+    import_jsx_runtime14 = __toESM(require_jsx_runtime(), 1);
     DurationLine = ({ ms }) => /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(Text, { dimColor: true, children: [
       "Completed in ",
       (ms / 1e3).toFixed(1),
@@ -51759,11 +51852,11 @@ var init_ResultsView = __esm({
   async "src/ui/components/ResultsView.tsx"() {
     "use strict";
     await init_build2();
-    import_chalk16 = __toESM(require_source());
+    import_chalk16 = __toESM(require_source(), 1);
     await init_ScoreHeader();
     await init_DurationLine();
     init_format_helpers();
-    import_jsx_runtime15 = __toESM(require_jsx_runtime());
+    import_jsx_runtime15 = __toESM(require_jsx_runtime(), 1);
     SEVERITY_LABELS2 = {
       5: "CRITICAL",
       4: "HIGH",
@@ -51883,8 +51976,8 @@ var init_ConfirmPrompt = __esm({
     "use strict";
     await init_build2();
     await init_build2();
-    import_chalk17 = __toESM(require_source());
-    import_jsx_runtime16 = __toESM(require_jsx_runtime());
+    import_chalk17 = __toESM(require_source(), 1);
+    import_jsx_runtime16 = __toESM(require_jsx_runtime(), 1);
     ConfirmPrompt = ({
       message,
       onConfirm,
@@ -51946,7 +52039,7 @@ var init_WrapperVerdictLine = __esm({
   async "src/ui/components/WrapperVerdictLine.tsx"() {
     "use strict";
     await init_build2();
-    import_jsx_runtime17 = __toESM(require_jsx_runtime());
+    import_jsx_runtime17 = __toESM(require_jsx_runtime(), 1);
     WrapperVerdictLine = ({
       result,
       verdict,
@@ -52043,7 +52136,7 @@ var import_react38, import_jsx_runtime18, LABELS, WrapperApp;
 var init_WrapperApp = __esm({
   async "src/ui/apps/WrapperApp.tsx"() {
     "use strict";
-    import_react38 = __toESM(require_react());
+    import_react38 = __toESM(require_react(), 1);
     await init_build2();
     init_auth();
     init_useWrapperBase();
@@ -52052,7 +52145,7 @@ var init_WrapperApp = __esm({
     await init_ConfirmPrompt();
     await init_ErrorView();
     await init_WrapperVerdictLine();
-    import_jsx_runtime18 = __toESM(require_jsx_runtime());
+    import_jsx_runtime18 = __toESM(require_jsx_runtime(), 1);
     LABELS = {
       npm: {
         resolving: (n, s) => `Resolving ${n} package${s}...`,
@@ -52080,7 +52173,7 @@ var init_WrapperApp = __esm({
           const timer = setTimeout(() => exit(), 0);
           return () => clearTimeout(timer);
         }
-        if (state.phase === "trial_exhausted") {
+        if (state.phase === "free_cap_reached") {
           process.exitCode = 1;
           const timer = setTimeout(() => exit(), 0);
           return () => clearTimeout(timer);
@@ -52123,7 +52216,7 @@ var init_WrapperApp = __esm({
           return /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ErrorView, { error: new Error(state.message) });
         case "passthrough":
           return null;
-        case "trial_exhausted": {
+        case "free_cap_reached": {
           let hasKey = false;
           try {
             hasKey = !!getStoredApiKey();
@@ -52215,7 +52308,7 @@ var import_chalk18, INSTALL_COMMANDS3, adapter;
 var init_conda_wrapper = __esm({
   "src/commands/conda-wrapper.ts"() {
     "use strict";
-    import_chalk18 = __toESM(require_source());
+    import_chalk18 = __toESM(require_source(), 1);
     init_wrapper_shared();
     init_resolve();
     init_install();
@@ -53028,7 +53121,7 @@ var import_chalk19;
 var init_wrapper_factory = __esm({
   "src/commands/wrapper-factory.ts"() {
     "use strict";
-    import_chalk19 = __toESM(require_source());
+    import_chalk19 = __toESM(require_source(), 1);
     init_client();
     init_resolve();
     init_install();
@@ -53352,7 +53445,7 @@ async function maybeShowWiringHint(rawCommand) {
     const hintMarker = dgStatePath2("wiring-hint-shown");
     if (existsSync26(receiptPath) || existsSync26(shimPath)) return;
     if (existsSync26(hintMarker)) return;
-    const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+    const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
     process.stderr.write(
       `
   ${chalk18.yellow("\u2139 Shell wiring not detected.")} Reinstall with ${chalk18.cyan("npm install -g @westbayberry/dg")}
@@ -53395,7 +53488,7 @@ async function main() {
   }
   const KNOWN_COMMANDS = ["scan", "licenses", "login", "logout", "upgrade", "status", "hook", "config", "update", "help", "version", "publish-check", "uninstall", "verify", "gallery", "confetti", "__wrap"];
   if (rawCommand && !rawCommand.startsWith("-") && !KNOWN_COMMANDS.includes(rawCommand)) {
-    const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+    const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
     const best = closestCommand(rawCommand, KNOWN_COMMANDS);
     const hint = best ? ` Did you mean '${best}'?` : "";
     process.stderr.write(`
@@ -53431,7 +53524,7 @@ async function main() {
     const loginArgs = process.argv.slice(3);
     const parsed = parseLoginArgs2(loginArgs);
     if (parsed.kind === "unknown-flag") {
-      const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+      const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
       process.stderr.write(`
   ${chalk18.red("Error:")} Unknown option '${parsed.flag}'.
 `);
@@ -53441,7 +53534,7 @@ async function main() {
       process.exit(1);
     }
     if (parsed.kind === "missing-value") {
-      const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+      const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
       process.stderr.write(`
   ${chalk18.red("Error:")} ${parsed.flag} requires a value.
 
@@ -53454,7 +53547,7 @@ async function main() {
     }
     if (isInteractive) {
       const { render: render2 } = await init_build2().then(() => build_exports);
-      const React22 = await Promise.resolve().then(() => __toESM(require_react()));
+      const React22 = await Promise.resolve().then(() => __toESM(require_react(), 1));
       const { LoginApp: LoginApp2 } = await init_LoginApp().then(() => LoginApp_exports);
       const { waitUntilExit } = render2(React22.createElement(LoginApp2));
       await waitUntilExit();
@@ -53513,7 +53606,7 @@ async function main() {
       if (wantJson) {
         process.stdout.write(JSON.stringify({ ok: false, error: out.errorMessage }) + "\n");
       } else {
-        const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+        const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
         process.stderr.write(`
   ${chalk18.red("publish-check error:")} ${out.errorMessage}
 
@@ -53557,7 +53650,7 @@ async function main() {
     await handleHookCommand2(process.argv.slice(3));
     const updateMsg = await updatePromise2;
     if (updateMsg) {
-      const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+      const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
       process.stderr.write(chalk18.dim(updateMsg));
     }
     return;
@@ -53589,7 +53682,7 @@ async function main() {
   }
   if (rawCommand === "logout") {
     const { getStoredApiKey: getStoredApiKey2, clearCredentials: clearCredentials2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
-    const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+    const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
     const apiKey = getStoredApiKey2();
     if (apiKey) {
       const { parseConfig: parseConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
@@ -53616,7 +53709,7 @@ async function main() {
       await preflightAuthCheck2(config.apiUrl);
     } catch (err) {
       if (err instanceof PreflightFreeCapReachedError2) {
-        const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+        const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
         const { getStoredApiKey: getStoredApiKey2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
         const hasKey = !!getStoredApiKey2();
         process.stderr.write("\n");
@@ -53624,11 +53717,16 @@ async function main() {
           process.stderr.write(chalk18.yellow("  Your API key may be invalid or expired.\n"));
           process.stderr.write(`  Run ${chalk18.cyan("dg logout")} then ${chalk18.cyan("dg login")} to re-authenticate.
 
+`);
+        } else if (err.reason === "prefix_cap") {
+          process.stderr.write(chalk18.yellow("  Too many anonymous devices from your network this month (anti-abuse limit).\n"));
+          process.stderr.write(`  Sign in with ${chalk18.cyan("dg login")} to keep scanning.
+
 `);
         } else {
-          process.stderr.write(chalk18.yellow(`  Free tier monthly cap reached (${err.scansUsed}/${err.maxScans}).
+          process.stderr.write(chalk18.yellow(`  Free tier monthly package limit reached (${err.scansUsed.toLocaleString()}/${err.maxScans.toLocaleString()} packages).
 `));
-          process.stderr.write(`  Run ${chalk18.cyan("dg upgrade")} for Pro (5000/mo) or wait until next month.
+          process.stderr.write(`  Run ${chalk18.cyan("dg upgrade")} for Pro or wait until next month.
 
 `);
         }
@@ -53643,13 +53741,13 @@ async function main() {
       await runStatic2(config);
     } else {
       if (config.mode === "off") {
-        const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+        const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
         process.stderr.write(chalk18.dim("  Dependency Guardian: mode is off \u2014 skipping.\n"));
         process.exit(0);
       }
       const { getStoredApiKey: getStoredApiKey2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
       const apiKey = getStoredApiKey2();
-      const chalkMod = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+      const chalkMod = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
       const loginChip = chalkMod.cyan.bold("dg login");
       const freeTierStatus = `${chalkMod.dim("free tier \xB7")} ${loginChip} ${chalkMod.dim("for more")}`;
       const sessionExpiredStatus = `${chalkMod.dim("session expired \xB7")} ${loginChip}`;
@@ -53667,14 +53765,12 @@ async function main() {
             const tier = data.tier || "free";
             const tierColor = tier === "free" ? chalkMod.yellow(tier) : chalkMod.green(tier);
             userStatus = `${chalkMod.dim(name)} ${chalkMod.dim("\xB7")} ${tierColor}`;
-            if (data.scansLimit === null || data.scansLimit === void 0) {
-              scanUsage = "unlimited scans";
-            } else {
-              const used = data.scansUsed ?? 0;
-              const limit = data.scansLimit;
-              const remaining = limit - used;
-              scanUsage = `${remaining}/${limit} scans left`;
-            }
+            const { formatUsage: formatUsage2 } = await Promise.resolve().then(() => (init_format_helpers(), format_helpers_exports));
+            scanUsage = formatUsage2({
+              used: data.scansUsed ?? 0,
+              limit: data.scansLimit ?? null,
+              tier
+            }).text;
           } else if (resp.status === 401) {
             userStatus = sessionExpiredStatus;
           } else {
@@ -53687,7 +53783,7 @@ async function main() {
       const { getSetupIssues: getSetupIssues2 } = await Promise.resolve().then(() => (init_setup_status(), setup_status_exports));
       const setupIssues = getSetupIssues2(process.cwd());
       const { render: render2 } = await init_build2().then(() => build_exports);
-      const React22 = await Promise.resolve().then(() => __toESM(require_react()));
+      const React22 = await Promise.resolve().then(() => __toESM(require_react(), 1));
       const { App: App3 } = await init_App2().then(() => App_exports);
       const { setInkInstance: setInkInstance2, resetInkClear: resetInkClear2, initInkInstances: initInkInstances2, patchInkLogForAbsolutePositioning: patchInkLogForAbsolutePositioning2 } = await Promise.resolve().then(() => (init_ink_controls(), ink_controls_exports));
       await initInkInstances2();
@@ -53702,7 +53798,7 @@ async function main() {
     }
     const updateMsg = await updatePromise;
     if (updateMsg) {
-      const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+      const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
       process.stderr.write(chalk18.dim(updateMsg));
     }
     try {
@@ -53778,7 +53874,7 @@ async function handleWrapInternal(argv) {
       return 0;
     }
     const { render: render2 } = await init_build2().then(() => build_exports);
-    const React22 = await Promise.resolve().then(() => __toESM(require_react()));
+    const React22 = await Promise.resolve().then(() => __toESM(require_react(), 1));
     const { WrapperApp: WrapperApp2 } = await init_WrapperApp().then(() => WrapperApp_exports);
     const { waitUntilExit } = render2(
       React22.createElement(WrapperApp2, { config, args: wrapperArgs, ecosystem: "npm" })
@@ -53793,7 +53889,7 @@ async function handleWrapInternal(argv) {
       return 0;
     }
     const { render: render2 } = await init_build2().then(() => build_exports);
-    const React22 = await Promise.resolve().then(() => __toESM(require_react()));
+    const React22 = await Promise.resolve().then(() => __toESM(require_react(), 1));
     const { WrapperApp: WrapperApp2 } = await init_WrapperApp().then(() => WrapperApp_exports);
     const { waitUntilExit } = render2(
       React22.createElement(WrapperApp2, { config, args: wrapperArgs, ecosystem: "pypi" })
@@ -53838,7 +53934,7 @@ main().catch(async (err) => {
       authenticated: isAuthed
     });
     await flush();
-    const chalk18 = (await Promise.resolve().then(() => __toESM(require_source()))).default;
+    const chalk18 = (await Promise.resolve().then(() => __toESM(require_source(), 1))).default;
     const color = err.securityRelease ? chalk18.bold.red : chalk18.yellow;
     if (process.argv.includes("--json")) {
       process.stdout.write(JSON.stringify({
@@ -53876,7 +53972,7 @@ main().catch(async (err) => {
     }, null, 2) + "\n");
   } else {
     try {
-      const chalkMod = await Promise.resolve().then(() => __toESM(require_source()));
+      const chalkMod = await Promise.resolve().then(() => __toESM(require_source(), 1));
       process.stderr.write(`
   ${chalkMod.default.bold.red("Error:")} ${err.message}
 

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@westbayberry/dg",
-  "version": "1.1.2",
+  "version": "1.1.3",
+  "type": "module",
   "description": "Supply chain security scanner for npm and Python dependencies — 35 behavioral detectors catch zero-day attacks CVE databases miss. 99.66% catch rate on 155K packages.",
   "bin": {
     "dependency-guardian": "dist/index.mjs",