xploitscan 1.1.0 → 1.1.1

package/dist/{api-UURQGULS.js → api-G2HVOYVR.js}

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { createRequire as __xpls_createRequire } from 'module';
+const require = __xpls_createRequire(import.meta.url);
 import {
   checkUsage,
   clearProRulesCache,
@@ -12,7 +14,7 @@ import {
   storeToken,
   syncUser,
   uploadScanResults
-} from "./chunk-HHYGPI7J.js";
+} from "./chunk-WGENFXRJ.js";
 export {
   checkUsage,
   clearProRulesCache,
@@ -27,4 +29,4 @@ export {
   syncUser,
   uploadScanResults
 };
-//# sourceMappingURL=api-UURQGULS.js.map
+//# sourceMappingURL=api-G2HVOYVR.js.map

package/dist/{chunk-HHYGPI7J.js → chunk-WGENFXRJ.js}

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { createRequire as __xpls_createRequire } from 'module';
+const require = __xpls_createRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -232,4 +234,4 @@ export {
   loadCachedProRules,
   clearProRulesCache
 };
-//# sourceMappingURL=chunk-HHYGPI7J.js.map
+//# sourceMappingURL=chunk-WGENFXRJ.js.map

package/dist/{chunk-HHYGPI7J.js.map → chunk-WGENFXRJ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/utils/api.ts"],"sourcesContent":["import { readFileSync, writeFileSync, mkdirSync, existsSync, unlinkSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { homedir } from \"node:os\";\nimport { createHash } from \"node:crypto\";\n\nconst CONFIG_DIR = join(homedir(), \".xploitscan\");\nconst TOKEN_FILE = join(CONFIG_DIR, \"token.json\");\nconst PRO_RULES_FILE = join(CONFIG_DIR, \"pro-rules.cjs\");\nconst PRO_RULES_META = join(CONFIG_DIR, \"pro-rules-meta.json\");\n\nconst API_BASE = process.env.XPLOITSCAN_API_URL ?? \"https://api.xploitscan.com\";\nconst WEB_BASE = process.env.XPLOITSCAN_WEB_URL ?? \"https://xploitscan.com\";\n\n/**\n * Resolve the credential to send to xploitscan.com endpoints that require\n * an `xpls_` API key (currently `/api/cli/usage` and `/api/cli/rules-bundle`).\n *\n * Order of precedence:\n *   1. `XPLOITSCAN_API_KEY` env var — how the GitHub Action and CI flows\n *      pass a long-lived key (matches the variable name documented in\n *      `packages/action/action.yml` and the Settings → API Keys docs).\n *   2. The locally stored token from `xploitscan auth login` — only useful\n *      if the user pasted an `xpls_` key during login. The legacy Clerk\n *      JWT path is no longer accepted by the server (security fix C-1).\n *\n * Returns null when no `xpls_`-shaped credential is available.\n */\nfunction getApiKey(): string | null {\n  const fromEnv = process.env.XPLOITSCAN_API_KEY;\n  if (fromEnv && fromEnv.startsWith(\"xpls_\")) return fromEnv;\n  const stored = getStoredToken();\n  if (stored && stored.token.startsWith(\"xpls_\")) return stored.token;\n  return null;\n}\n\nif (API_BASE.startsWith(\"http://\") && !API_BASE.includes(\"localhost\") && !API_BASE.includes(\"127.0.0.1\")) {\n  throw new Error(\"API URL must use HTTPS for security. Set XPLOITSCAN_API_URL to an https:// URL.\");\n}\nif (WEB_BASE.startsWith(\"http://\") && !WEB_BASE.includes(\"localhost\") && !WEB_BASE.includes(\"127.0.0.1\")) {\n  throw new Error(\"Web URL must use HTTPS for security. Set XPLOITSCAN_WEB_URL to an https:// URL.\");\n}\n\ninterface TokenData {\n  token: string;\n  userId: string;\n  email: string;\n  expiresAt?: number;\n}\n\nexport function getStoredToken(): TokenData | null {\n  try {\n    if (!existsSync(TOKEN_FILE)) return null;\n    const data = JSON.parse(readFileSync(TOKEN_FILE, \"utf-8\"));\n    if (data.expiresAt && Date.now() > data.expiresAt) {\n      // Token expired\n      unlinkSync(TOKEN_FILE);\n      return null;\n    }\n    return data;\n  } catch {\n    return null;\n  }\n}\n\nexport function storeToken(data: TokenData): void {\n  mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });\n  writeFileSync(TOKEN_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });\n}\n\nexport function clearToken(): void {\n  try {\n    if (existsSync(TOKEN_FILE)) {\n      unlinkSync(TOKEN_FILE);\n    }\n  } catch {\n    // ignore\n  }\n}\n\nexport function isAuthenticated(): boolean {\n  return getStoredToken() !== null;\n}\n\nasync function apiRequest(\n  path: string,\n  options: RequestInit = {},\n): Promise<Response> {\n  const token = getStoredToken();\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    ...(options.headers as Record<string, string>),\n  };\n\n  if (token) {\n    headers.Authorization = `Bearer ${token.token}`;\n  }\n\n  return fetch(`${API_BASE}${path}`, {\n    ...options,\n    headers,\n  });\n}\n\nexport async function checkUsage(): Promise<{\n  allowed: boolean;\n  plan: string;\n  // Set to \"indie\" when the server wants the CLI to message a monthly\n  // (rather than daily) cap. Other tiers don't set this field.\n  tier?: string;\n  remaining: number;\n  limit: number;\n}> {\n  const apiKey = getApiKey();\n  if (!apiKey) {\n    // No xpls_ key available — anonymous local-scan path (or a stale\n    // Clerk-JWT login that the server no longer accepts).\n    return { allowed: true, plan: \"anonymous\", remaining: -1, limit: -1 };\n  }\n\n  try {\n    // Use web app API for real subscription lookup\n    const res = await fetch(`${WEB_BASE}/api/cli/usage`, {\n      headers: { Authorization: `Bearer ${apiKey}` },\n    });\n    if (!res.ok) {\n      return { allowed: true, plan: \"unknown\", remaining: -1, limit: -1 };\n    }\n    return await res.json();\n  } catch {\n    // Network error — allow local scan\n    return { allowed: true, plan: \"offline\", remaining: -1, limit: -1 };\n  }\n}\n\nexport async function incrementUsage(): Promise<void> {\n  const token = getStoredToken();\n  if (!token) return;\n\n  try {\n    await apiRequest(\"/api/usage/increment\", { method: \"POST\" });\n  } catch {\n    // Silent fail — don't block scan\n  }\n}\n\nexport async function uploadScanResults(result: {\n  directory: string;\n  filesScanned: number;\n  findings: unknown[];\n  duration: number;\n}): Promise<void> {\n  const token = getStoredToken();\n  if (!token) return;\n\n  try {\n    await apiRequest(\"/api/scans\", {\n      method: \"POST\",\n      body: JSON.stringify(result),\n    });\n  } catch {\n    // Silent fail\n  }\n}\n\nexport async function syncUser(): Promise<{ plan: string; email: string } | null> {\n  const token = getStoredToken();\n  const apiKey = getApiKey();\n  if (!apiKey || !token) return null;\n  try {\n    const res = await fetch(`${WEB_BASE}/api/cli/usage`, {\n      headers: { Authorization: `Bearer ${apiKey}` },\n    });\n    if (!res.ok) return null;\n    const data = await res.json();\n    return { plan: data.plan, email: token.email };\n  } catch {\n    return null;\n  }\n}\n\nexport async function getCheckoutUrl(): Promise<string | null> {\n  try {\n    const res = await apiRequest(\"/api/billing/checkout\", { method: \"POST\" });\n    if (!res.ok) return null;\n    const data = await res.json();\n    return data.url;\n  } catch {\n    return null;\n  }\n}\n\n// ── Pro Rules Bundle (Server-Side Delivery) ──────────────────────────────\n\nconst PRO_RULES_CACHE_HOURS = 24;\n\nexport async function downloadProRulesBundle(): Promise<boolean> {\n  const apiKey = getApiKey();\n  if (!apiKey) return false;\n\n  try {\n    const res = await fetch(`${WEB_BASE}/api/cli/rules-bundle`, {\n      headers: { Authorization: `Bearer ${apiKey}` },\n    });\n    if (!res.ok) return false;\n\n    const bundle = await res.text();\n    if (!bundle || bundle.length < 100) return false;\n\n    // Basic integrity check: verify bundle contains expected exports\n    if (!bundle.includes(\"proOnlyRules\") || !bundle.includes(\"exports\")) {\n      return false;\n    }\n\n    const hash = createHash(\"sha256\").update(bundle).digest(\"hex\");\n    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });\n    writeFileSync(PRO_RULES_FILE, bundle, { mode: 0o600 });\n    writeFileSync(PRO_RULES_META, JSON.stringify({\n      cachedAt: Date.now(),\n      expiresAt: Date.now() + PRO_RULES_CACHE_HOURS * 60 * 60 * 1000,\n      sha256: hash,\n    }), { mode: 0o600 });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function loadCachedProRules(): unknown[] | null {\n  try {\n    if (!existsSync(PRO_RULES_FILE) || !existsSync(PRO_RULES_META)) return null;\n\n    const meta = JSON.parse(readFileSync(PRO_RULES_META, \"utf-8\"));\n    if (Date.now() > meta.expiresAt) {\n      clearProRulesCache();\n      return null;\n    }\n\n    // Verify integrity before loading\n    if (meta.sha256) {\n      const fileContent = readFileSync(PRO_RULES_FILE, \"utf-8\");\n      const currentHash = createHash(\"sha256\").update(fileContent).digest(\"hex\");\n      if (currentHash !== meta.sha256) {\n        clearProRulesCache();\n        return null;\n      }\n    }\n\n    // Dynamic require of the cached CJS bundle\n    const mod = require(PRO_RULES_FILE);\n    return mod.proOnlyRules || null;\n  } catch {\n    return null;\n  }\n}\n\nexport function clearProRulesCache(): void {\n  try {\n    if (existsSync(PRO_RULES_FILE)) unlinkSync(PRO_RULES_FILE);\n    if (existsSync(PRO_RULES_META)) unlinkSync(PRO_RULES_META);\n  } catch { /* ignore */ }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,cAAc,eAAe,WAAW,YAAY,kBAAkB;AAC/E,SAAS,YAAY;AACrB,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAE3B,IAAM,aAAa,KAAK,QAAQ,GAAG,aAAa;AAChD,IAAM,aAAa,KAAK,YAAY,YAAY;AAChD,IAAM,iBAAiB,KAAK,YAAY,eAAe;AACvD,IAAM,iBAAiB,KAAK,YAAY,qBAAqB;AAE7D,IAAM,WAAW,QAAQ,IAAI,sBAAsB;AACnD,IAAM,WAAW,QAAQ,IAAI,sBAAsB;AAgBnD,SAAS,YAA2B;AAClC,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,WAAW,QAAQ,WAAW,OAAO,EAAG,QAAO;AACnD,QAAM,SAAS,eAAe;AAC9B,MAAI,UAAU,OAAO,MAAM,WAAW,OAAO,EAAG,QAAO,OAAO;AAC9D,SAAO;AACT;AAEA,IAAI,SAAS,WAAW,SAAS,KAAK,CAAC,SAAS,SAAS,WAAW,KAAK,CAAC,SAAS,SAAS,WAAW,GAAG;AACxG,QAAM,IAAI,MAAM,iFAAiF;AACnG;AACA,IAAI,SAAS,WAAW,SAAS,KAAK,CAAC,SAAS,SAAS,WAAW,KAAK,CAAC,SAAS,SAAS,WAAW,GAAG;AACxG,QAAM,IAAI,MAAM,iFAAiF;AACnG;AASO,SAAS,iBAAmC;AACjD,MAAI;AACF,QAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,UAAM,OAAO,KAAK,MAAM,aAAa,YAAY,OAAO,CAAC;AACzD,QAAI,KAAK,aAAa,KAAK,IAAI,IAAI,KAAK,WAAW;AAEjD,iBAAW,UAAU;AACrB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,WAAW,MAAuB;AAChD,YAAU,YAAY,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACtD,gBAAc,YAAY,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AAC1E;AAEO,SAAS,aAAmB;AACjC,MAAI;AACF,QAAI,WAAW,UAAU,GAAG;AAC1B,iBAAW,UAAU;AAAA,IACvB;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,kBAA2B;AACzC,SAAO,eAAe,MAAM;AAC9B;AAEA,eAAe,WACb,MACA,UAAuB,CAAC,GACL;AACnB,QAAM,QAAQ,eAAe;AAC7B,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAI,QAAQ;AAAA,EACd;AAEA,MAAI,OAAO;AACT,YAAQ,gBAAgB,UAAU,MAAM,KAAK;AAAA,EAC/C;AAEA,SAAO,MAAM,GAAG,QAAQ,GAAG,IAAI,IAAI;AAAA,IACjC,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,aAQnB;AACD,QAAM,SAAS,UAAU;AACzB,MAAI,CAAC,QAAQ;AAGX,WAAO,EAAE,SAAS,MAAM,MAAM,aAAa,WAAW,IAAI,OAAO,GAAG;AAAA,EACtE;AAEA,MAAI;AAEF,UAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MACnD,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,IAC/C,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,aAAO,EAAE,SAAS,MAAM,MAAM,WAAW,WAAW,IAAI,OAAO,GAAG;AAAA,IACpE;AACA,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AAEN,WAAO,EAAE,SAAS,MAAM,MAAM,WAAW,WAAW,IAAI,OAAO,GAAG;AAAA,EACpE;AACF;AAEA,eAAsB,iBAAgC;AACpD,QAAM,QAAQ,eAAe;AAC7B,MAAI,CAAC,MAAO;AAEZ,MAAI;AACF,UAAM,WAAW,wBAAwB,EAAE,QAAQ,OAAO,CAAC;AAAA,EAC7D,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,kBAAkB,QAKtB;AAChB,QAAM,QAAQ,eAAe;AAC7B,MAAI,CAAC,MAAO;AAEZ,MAAI;AACF,UAAM,WAAW,cAAc;AAAA,MAC7B,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU,MAAM;AAAA,IAC7B,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,WAA4D;AAChF,QAAM,QAAQ,eAAe;AAC7B,QAAM,SAAS,UAAU;AACzB,MAAI,CAAC,UAAU,CAAC,MAAO,QAAO;AAC9B,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MACnD,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,IAC/C,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,EAAE,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,iBAAyC;AAC7D,MAAI;AACF,UAAM,MAAM,MAAM,WAAW,yBAAyB,EAAE,QAAQ,OAAO,CAAC;AACxE,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,KAAK;AAAA,EACd,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,IAAM,wBAAwB;AAE9B,eAAsB,yBAA2C;AAC/D,QAAM,SAAS,UAAU;AACzB,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,yBAAyB;AAAA,MAC1D,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,IAC/C,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AAEpB,UAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,QAAI,CAAC,UAAU,OAAO,SAAS,IAAK,QAAO;AAG3C,QAAI,CAAC,OAAO,SAAS,cAAc,KAAK,CAAC,OAAO,SAAS,SAAS,GAAG;AACnE,aAAO;AAAA,IACT;AAEA,UAAM,OAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK;AAC7D,cAAU,YAAY,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACtD,kBAAc,gBAAgB,QAAQ,EAAE,MAAM,IAAM,CAAC;AACrD,kBAAc,gBAAgB,KAAK,UAAU;AAAA,MAC3C,UAAU,KAAK,IAAI;AAAA,MACnB,WAAW,KAAK,IAAI,IAAI,wBAAwB,KAAK,KAAK;AAAA,MAC1D,QAAQ;AAAA,IACV,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACnB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBAAuC;AACrD,MAAI;AACF,QAAI,CAAC,WAAW,cAAc,KAAK,CAAC,WAAW,cAAc,EAAG,QAAO;AAEvE,UAAM,OAAO,KAAK,MAAM,aAAa,gBAAgB,OAAO,CAAC;AAC7D,QAAI,KAAK,IAAI,IAAI,KAAK,WAAW;AAC/B,yBAAmB;AACnB,aAAO;AAAA,IACT;AAGA,QAAI,KAAK,QAAQ;AACf,YAAM,cAAc,aAAa,gBAAgB,OAAO;AACxD,YAAM,cAAc,WAAW,QAAQ,EAAE,OAAO,WAAW,EAAE,OAAO,KAAK;AACzE,UAAI,gBAAgB,KAAK,QAAQ;AAC/B,2BAAmB;AACnB,eAAO;AAAA,MACT;AAAA,IACF;AAGA,UAAM,MAAM,UAAQ,cAAc;AAClC,WAAO,IAAI,gBAAgB;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBAA2B;AACzC,MAAI;AACF,QAAI,WAAW,cAAc,EAAG,YAAW,cAAc;AACzD,QAAI,WAAW,cAAc,EAAG,YAAW,cAAc;AAAA,EAC3D,QAAQ;AAAA,EAAe;AACzB;","names":[]}
+{"version":3,"sources":["../src/utils/api.ts"],"sourcesContent":["import { readFileSync, writeFileSync, mkdirSync, existsSync, unlinkSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { homedir } from \"node:os\";\nimport { createHash } from \"node:crypto\";\n\nconst CONFIG_DIR = join(homedir(), \".xploitscan\");\nconst TOKEN_FILE = join(CONFIG_DIR, \"token.json\");\nconst PRO_RULES_FILE = join(CONFIG_DIR, \"pro-rules.cjs\");\nconst PRO_RULES_META = join(CONFIG_DIR, \"pro-rules-meta.json\");\n\nconst API_BASE = process.env.XPLOITSCAN_API_URL ?? \"https://api.xploitscan.com\";\nconst WEB_BASE = process.env.XPLOITSCAN_WEB_URL ?? \"https://xploitscan.com\";\n\n/**\n * Resolve the credential to send to xploitscan.com endpoints that require\n * an `xpls_` API key (currently `/api/cli/usage` and `/api/cli/rules-bundle`).\n *\n * Order of precedence:\n *   1. `XPLOITSCAN_API_KEY` env var — how the GitHub Action and CI flows\n *      pass a long-lived key (matches the variable name documented in\n *      `packages/action/action.yml` and the Settings → API Keys docs).\n *   2. The locally stored token from `xploitscan auth login` — only useful\n *      if the user pasted an `xpls_` key during login. The legacy Clerk\n *      JWT path is no longer accepted by the server (security fix C-1).\n *\n * Returns null when no `xpls_`-shaped credential is available.\n */\nfunction getApiKey(): string | null {\n  const fromEnv = process.env.XPLOITSCAN_API_KEY;\n  if (fromEnv && fromEnv.startsWith(\"xpls_\")) return fromEnv;\n  const stored = getStoredToken();\n  if (stored && stored.token.startsWith(\"xpls_\")) return stored.token;\n  return null;\n}\n\nif (API_BASE.startsWith(\"http://\") && !API_BASE.includes(\"localhost\") && !API_BASE.includes(\"127.0.0.1\")) {\n  throw new Error(\"API URL must use HTTPS for security. Set XPLOITSCAN_API_URL to an https:// URL.\");\n}\nif (WEB_BASE.startsWith(\"http://\") && !WEB_BASE.includes(\"localhost\") && !WEB_BASE.includes(\"127.0.0.1\")) {\n  throw new Error(\"Web URL must use HTTPS for security. Set XPLOITSCAN_WEB_URL to an https:// URL.\");\n}\n\ninterface TokenData {\n  token: string;\n  userId: string;\n  email: string;\n  expiresAt?: number;\n}\n\nexport function getStoredToken(): TokenData | null {\n  try {\n    if (!existsSync(TOKEN_FILE)) return null;\n    const data = JSON.parse(readFileSync(TOKEN_FILE, \"utf-8\"));\n    if (data.expiresAt && Date.now() > data.expiresAt) {\n      // Token expired\n      unlinkSync(TOKEN_FILE);\n      return null;\n    }\n    return data;\n  } catch {\n    return null;\n  }\n}\n\nexport function storeToken(data: TokenData): void {\n  mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });\n  writeFileSync(TOKEN_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });\n}\n\nexport function clearToken(): void {\n  try {\n    if (existsSync(TOKEN_FILE)) {\n      unlinkSync(TOKEN_FILE);\n    }\n  } catch {\n    // ignore\n  }\n}\n\nexport function isAuthenticated(): boolean {\n  return getStoredToken() !== null;\n}\n\nasync function apiRequest(\n  path: string,\n  options: RequestInit = {},\n): Promise<Response> {\n  const token = getStoredToken();\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    ...(options.headers as Record<string, string>),\n  };\n\n  if (token) {\n    headers.Authorization = `Bearer ${token.token}`;\n  }\n\n  return fetch(`${API_BASE}${path}`, {\n    ...options,\n    headers,\n  });\n}\n\nexport async function checkUsage(): Promise<{\n  allowed: boolean;\n  plan: string;\n  // Set to \"indie\" when the server wants the CLI to message a monthly\n  // (rather than daily) cap. Other tiers don't set this field.\n  tier?: string;\n  remaining: number;\n  limit: number;\n}> {\n  const apiKey = getApiKey();\n  if (!apiKey) {\n    // No xpls_ key available — anonymous local-scan path (or a stale\n    // Clerk-JWT login that the server no longer accepts).\n    return { allowed: true, plan: \"anonymous\", remaining: -1, limit: -1 };\n  }\n\n  try {\n    // Use web app API for real subscription lookup\n    const res = await fetch(`${WEB_BASE}/api/cli/usage`, {\n      headers: { Authorization: `Bearer ${apiKey}` },\n    });\n    if (!res.ok) {\n      return { allowed: true, plan: \"unknown\", remaining: -1, limit: -1 };\n    }\n    return await res.json();\n  } catch {\n    // Network error — allow local scan\n    return { allowed: true, plan: \"offline\", remaining: -1, limit: -1 };\n  }\n}\n\nexport async function incrementUsage(): Promise<void> {\n  const token = getStoredToken();\n  if (!token) return;\n\n  try {\n    await apiRequest(\"/api/usage/increment\", { method: \"POST\" });\n  } catch {\n    // Silent fail — don't block scan\n  }\n}\n\nexport async function uploadScanResults(result: {\n  directory: string;\n  filesScanned: number;\n  findings: unknown[];\n  duration: number;\n}): Promise<void> {\n  const token = getStoredToken();\n  if (!token) return;\n\n  try {\n    await apiRequest(\"/api/scans\", {\n      method: \"POST\",\n      body: JSON.stringify(result),\n    });\n  } catch {\n    // Silent fail\n  }\n}\n\nexport async function syncUser(): Promise<{ plan: string; email: string } | null> {\n  const token = getStoredToken();\n  const apiKey = getApiKey();\n  if (!apiKey || !token) return null;\n  try {\n    const res = await fetch(`${WEB_BASE}/api/cli/usage`, {\n      headers: { Authorization: `Bearer ${apiKey}` },\n    });\n    if (!res.ok) return null;\n    const data = await res.json();\n    return { plan: data.plan, email: token.email };\n  } catch {\n    return null;\n  }\n}\n\nexport async function getCheckoutUrl(): Promise<string | null> {\n  try {\n    const res = await apiRequest(\"/api/billing/checkout\", { method: \"POST\" });\n    if (!res.ok) return null;\n    const data = await res.json();\n    return data.url;\n  } catch {\n    return null;\n  }\n}\n\n// ── Pro Rules Bundle (Server-Side Delivery) ──────────────────────────────\n\nconst PRO_RULES_CACHE_HOURS = 24;\n\nexport async function downloadProRulesBundle(): Promise<boolean> {\n  const apiKey = getApiKey();\n  if (!apiKey) return false;\n\n  try {\n    const res = await fetch(`${WEB_BASE}/api/cli/rules-bundle`, {\n      headers: { Authorization: `Bearer ${apiKey}` },\n    });\n    if (!res.ok) return false;\n\n    const bundle = await res.text();\n    if (!bundle || bundle.length < 100) return false;\n\n    // Basic integrity check: verify bundle contains expected exports\n    if (!bundle.includes(\"proOnlyRules\") || !bundle.includes(\"exports\")) {\n      return false;\n    }\n\n    const hash = createHash(\"sha256\").update(bundle).digest(\"hex\");\n    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });\n    writeFileSync(PRO_RULES_FILE, bundle, { mode: 0o600 });\n    writeFileSync(PRO_RULES_META, JSON.stringify({\n      cachedAt: Date.now(),\n      expiresAt: Date.now() + PRO_RULES_CACHE_HOURS * 60 * 60 * 1000,\n      sha256: hash,\n    }), { mode: 0o600 });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function loadCachedProRules(): unknown[] | null {\n  try {\n    if (!existsSync(PRO_RULES_FILE) || !existsSync(PRO_RULES_META)) return null;\n\n    const meta = JSON.parse(readFileSync(PRO_RULES_META, \"utf-8\"));\n    if (Date.now() > meta.expiresAt) {\n      clearProRulesCache();\n      return null;\n    }\n\n    // Verify integrity before loading\n    if (meta.sha256) {\n      const fileContent = readFileSync(PRO_RULES_FILE, \"utf-8\");\n      const currentHash = createHash(\"sha256\").update(fileContent).digest(\"hex\");\n      if (currentHash !== meta.sha256) {\n        clearProRulesCache();\n        return null;\n      }\n    }\n\n    // Dynamic require of the cached CJS bundle\n    const mod = require(PRO_RULES_FILE);\n    return mod.proOnlyRules || null;\n  } catch {\n    return null;\n  }\n}\n\nexport function clearProRulesCache(): void {\n  try {\n    if (existsSync(PRO_RULES_FILE)) unlinkSync(PRO_RULES_FILE);\n    if (existsSync(PRO_RULES_META)) unlinkSync(PRO_RULES_META);\n  } catch { /* ignore */ }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,cAAc,eAAe,WAAW,YAAY,kBAAkB;AAC/E,SAAS,YAAY;AACrB,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAE3B,IAAM,aAAa,KAAK,QAAQ,GAAG,aAAa;AAChD,IAAM,aAAa,KAAK,YAAY,YAAY;AAChD,IAAM,iBAAiB,KAAK,YAAY,eAAe;AACvD,IAAM,iBAAiB,KAAK,YAAY,qBAAqB;AAE7D,IAAM,WAAW,QAAQ,IAAI,sBAAsB;AACnD,IAAM,WAAW,QAAQ,IAAI,sBAAsB;AAgBnD,SAAS,YAA2B;AAClC,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,WAAW,QAAQ,WAAW,OAAO,EAAG,QAAO;AACnD,QAAM,SAAS,eAAe;AAC9B,MAAI,UAAU,OAAO,MAAM,WAAW,OAAO,EAAG,QAAO,OAAO;AAC9D,SAAO;AACT;AAEA,IAAI,SAAS,WAAW,SAAS,KAAK,CAAC,SAAS,SAAS,WAAW,KAAK,CAAC,SAAS,SAAS,WAAW,GAAG;AACxG,QAAM,IAAI,MAAM,iFAAiF;AACnG;AACA,IAAI,SAAS,WAAW,SAAS,KAAK,CAAC,SAAS,SAAS,WAAW,KAAK,CAAC,SAAS,SAAS,WAAW,GAAG;AACxG,QAAM,IAAI,MAAM,iFAAiF;AACnG;AASO,SAAS,iBAAmC;AACjD,MAAI;AACF,QAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,UAAM,OAAO,KAAK,MAAM,aAAa,YAAY,OAAO,CAAC;AACzD,QAAI,KAAK,aAAa,KAAK,IAAI,IAAI,KAAK,WAAW;AAEjD,iBAAW,UAAU;AACrB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,WAAW,MAAuB;AAChD,YAAU,YAAY,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACtD,gBAAc,YAAY,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AAC1E;AAEO,SAAS,aAAmB;AACjC,MAAI;AACF,QAAI,WAAW,UAAU,GAAG;AAC1B,iBAAW,UAAU;AAAA,IACvB;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,kBAA2B;AACzC,SAAO,eAAe,MAAM;AAC9B;AAEA,eAAe,WACb,MACA,UAAuB,CAAC,GACL;AACnB,QAAM,QAAQ,eAAe;AAC7B,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAI,QAAQ;AAAA,EACd;AAEA,MAAI,OAAO;AACT,YAAQ,gBAAgB,UAAU,MAAM,KAAK;AAAA,EAC/C;AAEA,SAAO,MAAM,GAAG,QAAQ,GAAG,IAAI,IAAI;AAAA,IACjC,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,aAQnB;AACD,QAAM,SAAS,UAAU;AACzB,MAAI,CAAC,QAAQ;AAGX,WAAO,EAAE,SAAS,MAAM,MAAM,aAAa,WAAW,IAAI,OAAO,GAAG;AAAA,EACtE;AAEA,MAAI;AAEF,UAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MACnD,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,IAC/C,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,aAAO,EAAE,SAAS,MAAM,MAAM,WAAW,WAAW,IAAI,OAAO,GAAG;AAAA,IACpE;AACA,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AAEN,WAAO,EAAE,SAAS,MAAM,MAAM,WAAW,WAAW,IAAI,OAAO,GAAG;AAAA,EACpE;AACF;AAEA,eAAsB,iBAAgC;AACpD,QAAM,QAAQ,eAAe;AAC7B,MAAI,CAAC,MAAO;AAEZ,MAAI;AACF,UAAM,WAAW,wBAAwB,EAAE,QAAQ,OAAO,CAAC;AAAA,EAC7D,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,kBAAkB,QAKtB;AAChB,QAAM,QAAQ,eAAe;AAC7B,MAAI,CAAC,MAAO;AAEZ,MAAI;AACF,UAAM,WAAW,cAAc;AAAA,MAC7B,QAAQ;AAAA,MACR,MAAM,KAAK,UAAU,MAAM;AAAA,IAC7B,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,WAA4D;AAChF,QAAM,QAAQ,eAAe;AAC7B,QAAM,SAAS,UAAU;AACzB,MAAI,CAAC,UAAU,CAAC,MAAO,QAAO;AAC9B,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MACnD,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,IAC/C,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,EAAE,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,iBAAyC;AAC7D,MAAI;AACF,UAAM,MAAM,MAAM,WAAW,yBAAyB,EAAE,QAAQ,OAAO,CAAC;AACxE,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,KAAK;AAAA,EACd,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,IAAM,wBAAwB;AAE9B,eAAsB,yBAA2C;AAC/D,QAAM,SAAS,UAAU;AACzB,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,yBAAyB;AAAA,MAC1D,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG;AAAA,IAC/C,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AAEpB,UAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,QAAI,CAAC,UAAU,OAAO,SAAS,IAAK,QAAO;AAG3C,QAAI,CAAC,OAAO,SAAS,cAAc,KAAK,CAAC,OAAO,SAAS,SAAS,GAAG;AACnE,aAAO;AAAA,IACT;AAEA,UAAM,OAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK;AAC7D,cAAU,YAAY,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACtD,kBAAc,gBAAgB,QAAQ,EAAE,MAAM,IAAM,CAAC;AACrD,kBAAc,gBAAgB,KAAK,UAAU;AAAA,MAC3C,UAAU,KAAK,IAAI;AAAA,MACnB,WAAW,KAAK,IAAI,IAAI,wBAAwB,KAAK,KAAK;AAAA,MAC1D,QAAQ;AAAA,IACV,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACnB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBAAuC;AACrD,MAAI;AACF,QAAI,CAAC,WAAW,cAAc,KAAK,CAAC,WAAW,cAAc,EAAG,QAAO;AAEvE,UAAM,OAAO,KAAK,MAAM,aAAa,gBAAgB,OAAO,CAAC;AAC7D,QAAI,KAAK,IAAI,IAAI,KAAK,WAAW;AAC/B,yBAAmB;AACnB,aAAO;AAAA,IACT;AAGA,QAAI,KAAK,QAAQ;AACf,YAAM,cAAc,aAAa,gBAAgB,OAAO;AACxD,YAAM,cAAc,WAAW,QAAQ,EAAE,OAAO,WAAW,EAAE,OAAO,KAAK;AACzE,UAAI,gBAAgB,KAAK,QAAQ;AAC/B,2BAAmB;AACnB,eAAO;AAAA,MACT;AAAA,IACF;AAGA,UAAM,MAAM,UAAQ,cAAc;AAClC,WAAO,IAAI,gBAAgB;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBAA2B;AACzC,MAAI;AACF,QAAI,WAAW,cAAc,EAAG,YAAW,cAAc;AACzD,QAAI,WAAW,cAAc,EAAG,YAAW,cAAc;AAAA,EAC3D,QAAQ;AAAA,EAAe;AACzB;","names":[]}

package/dist/index.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { createRequire as __xpls_createRequire } from 'module';
+const require = __xpls_createRequire(import.meta.url);
 import {
   __commonJS,
   __require,
@@ -14,7 +16,7 @@ import {
   storeToken,
   syncUser,
   uploadScanResults
-} from "./chunk-HHYGPI7J.js";
+} from "./chunk-WGENFXRJ.js";
 
 // ../../node_modules/.pnpm/@babel+parser@7.29.2/node_modules/@babel/parser/lib/index.js
 var require_lib = __commonJS({
@@ -48153,7 +48155,7 @@ async function cursorInstallCommand(opts = {}) {
 var program = new Command();
 program.name("xploitscan").description(
   "AI security scanner for vibe-coded apps. Find vulnerabilities before attackers do."
-).version("1.1.0");
+).version("1.1.1");
 program.command("scan").description("Scan a directory for security vulnerabilities").argument("[directory]", "Directory to scan", ".").option("--no-ai", "Skip AI-powered analysis").option(
   "-f, --format <format>",
   "Output format: terminal, json, sarif, splunk-hec, elastic-ecs, datadog-logs",
@@ -48182,7 +48184,7 @@ cursor.command("install").description("Drop XploitScan security rules into .curs
   await cursorInstallCommand({ force: opts.force, legacyOnly: opts.legacyOnly });
 });
 program.command("upgrade").description("Upgrade to XploitScan Pro for unlimited scans").action(async () => {
-  const { getStoredToken: getStoredToken2, getCheckoutUrl } = await import("./api-UURQGULS.js");
+  const { getStoredToken: getStoredToken2, getCheckoutUrl } = await import("./api-G2HVOYVR.js");
   const chalk6 = (await import("chalk")).default;
   const token = getStoredToken2();
   if (!token) {