@agent-finops/core 0.5.9 → 0.6.1

package/dist/providerConnectors.js

@@ -3,20 +3,33 @@ import { redactSecrets } from "./discovery.js";
 export function normalizeOpenAiCostResponse(response, options) {
     const data = isObject(response) && Array.isArray(response.data) ? response.data : [];
     const records = [];
-    for (const bucket of data) {
-        const startTime = typeof bucket.start_time === "number" ? bucket.start_time : 0;
+    for (const bucketValue of data) {
+        if (!isRecord(bucketValue))
+            continue;
+        const startTime = validEpochSeconds(bucketValue.start_time);
+        if (typeof startTime !== "number")
+            continue;
         const timestamp = new Date(startTime * 1000).toISOString();
-        for (const result of bucket.results ?? []) {
+        const results = Array.isArray(bucketValue.results) ? bucketValue.results : [];
+        for (const resultValue of results) {
+            if (!isRecord(resultValue))
+                continue;
+            const amount = isRecord(resultValue.amount) ? resultValue.amount : undefined;
+            const currency = amount?.currency === undefined
+                ? "usd"
+                : typeof amount.currency === "string"
+                    ? amount.currency.toLowerCase()
+                    : undefined;
             // The live API returns amount.value as a decimal STRING (dollars);
             // accept both string and number.
-            const amountUsd = result.amount?.currency?.toLowerCase() === "usd" || !result.amount?.currency
-                ? parseDollarUsd(result.amount?.value)
+            const amountUsd = currency === "usd"
+                ? parseDollarUsd(amount?.value)
                 : undefined;
             if (typeof amountUsd !== "number")
                 continue;
-            const lineItem = result.line_item ?? "OpenAI organization costs";
-            const projectId = result.project_id ?? undefined;
-            const apiKeyId = result.api_key_id ?? undefined;
+            const lineItem = stringValue(resultValue.line_item) ?? "OpenAI organization costs";
+            const projectId = stringValue(resultValue.project_id);
+            const apiKeyId = stringValue(resultValue.api_key_id);
             records.push({
                 id: slugifySourceId(["openai-costs", String(startTime), projectId, apiKeyId, lineItem].filter(Boolean).join("-")),
                 timestamp,
@@ -36,7 +49,7 @@ export function normalizeOpenAiCostResponse(response, options) {
                 apiKeyId,
                 providerCostType: "openai_cost",
                 usageGranularity: "billing_bucket",
-                quantity: typeof result.quantity === "number" ? result.quantity : undefined,
+                quantity: nonNegativeNumberValue(resultValue.quantity),
                 operation: lineItem
             });
         }
@@ -54,12 +67,12 @@ export function normalizeOpenAiUsageResponse(response, options) {
             const userId = result.user_id ?? undefined;
             const apiKeyId = result.api_key_id ?? undefined;
             const model = result.model ?? "openai-usage";
-            const inputTokens = numberValue(result.input_tokens) ?? 0;
-            const outputTokens = numberValue(result.output_tokens) ?? 0;
-            const cachedTokens = numberValue(result.input_cached_tokens) ?? 0;
-            const audioInputTokens = numberValue(result.input_audio_tokens) ?? 0;
-            const audioOutputTokens = numberValue(result.output_audio_tokens) ?? 0;
-            const requestCount = numberValue(result.num_model_requests);
+            const inputTokens = nonNegativeIntegerValue(result.input_tokens) ?? 0;
+            const outputTokens = nonNegativeIntegerValue(result.output_tokens) ?? 0;
+            const cachedTokens = nonNegativeIntegerValue(result.input_cached_tokens) ?? 0;
+            const audioInputTokens = nonNegativeIntegerValue(result.input_audio_tokens) ?? 0;
+            const audioOutputTokens = nonNegativeIntegerValue(result.output_audio_tokens) ?? 0;
+            const requestCount = nonNegativeIntegerValue(result.num_model_requests);
             if (inputTokens + outputTokens + audioInputTokens + audioOutputTokens === 0 && typeof requestCount !== "number")
                 continue;
             records.push({
@@ -76,7 +89,7 @@ export function normalizeOpenAiUsageResponse(response, options) {
                 apiKeyId,
                 providerCostType: "openai_usage_evidence",
                 usageGranularity: "usage_bucket",
-                quantity: numberValue(result.num_model_requests),
+                quantity: requestCount,
                 operation: "OpenAI completions usage evidence"
             });
         }
@@ -94,11 +107,11 @@ export function normalizeAnthropicClaudeCodeUsageResponse(response, options) {
         const userId = stringValue(actor.email_address) ?? stringValue(actor.api_key_name) ?? stringValue(actor.id) ?? "unknown-claude-code-actor";
         const core = isRecord(row.core_metrics) ? row.core_metrics : {};
         const lines = isRecord(core.lines_of_code) ? core.lines_of_code : {};
-        const sessions = numberValue(core.num_sessions) ?? 0;
-        const added = numberValue(lines.added) ?? 0;
-        const removed = numberValue(lines.removed) ?? 0;
-        const commits = numberValue(core.commits_by_claude_code) ?? 0;
-        const prs = numberValue(core.pull_requests_by_claude_code) ?? 0;
+        const sessions = nonNegativeIntegerValue(core.num_sessions) ?? 0;
+        const added = nonNegativeIntegerValue(lines.added) ?? 0;
+        const removed = nonNegativeIntegerValue(lines.removed) ?? 0;
+        const commits = nonNegativeIntegerValue(core.commits_by_claude_code) ?? 0;
+        const prs = nonNegativeIntegerValue(core.pull_requests_by_claude_code) ?? 0;
         const organizationId = stringValue(row.organization_id) ?? options.accountId;
         const modelBreakdown = Array.isArray(row.model_breakdown) ? row.model_breakdown : [];
         for (const item of modelBreakdown) {
@@ -116,8 +129,8 @@ export function normalizeAnthropicClaudeCodeUsageResponse(response, options) {
                 timestamp: new Date(`${date}T00:00:00Z`).toISOString(),
                 source: { id: options.sourceId, name: "Anthropic Claude Code Usage Report", provider: "anthropic", confidence: "estimated", observedFrom: options.observedFrom },
                 model,
-                inputTokens: (numberValue(tokens.input) ?? 0) + (numberValue(tokens.cache_read) ?? 0) + (numberValue(tokens.cache_creation) ?? 0),
-                outputTokens: numberValue(tokens.output) ?? 0,
+                inputTokens: (nonNegativeIntegerValue(tokens.input) ?? 0) + (nonNegativeIntegerValue(tokens.cache_read) ?? 0) + (nonNegativeIntegerValue(tokens.cache_creation) ?? 0),
+                outputTokens: nonNegativeIntegerValue(tokens.output) ?? 0,
                 amountUsd,
                 costConfidence: "estimated",
                 userId,
@@ -133,8 +146,6 @@ export function normalizeAnthropicClaudeCodeUsageResponse(response, options) {
 }
 export function normalizeGitHubCopilotSeatResponse(response, options) {
     const seats = extractArray(response, "seats");
-    const plan = stringValue(isRecord(response) ? response.plan_type : undefined) ?? "business";
-    const seatUsd = plan === "enterprise" ? 39 : 19;
     const timestamp = new Date().toISOString();
     return seats.flatMap((seat) => {
         if (!isRecord(seat))
@@ -143,6 +154,12 @@ export function normalizeGitHubCopilotSeatResponse(response, options) {
         const userId = stringValue(assignee.login) ?? stringValue(assignee.email) ?? stringValue(seat.login) ?? stringValue(seat.id);
         if (!userId)
             return [];
+        // The current GitHub seat schema reports plan_type on each seat. Never
+        // inherit a top-level value: an enterprise can contain mixed Business and
+        // Enterprise organizations, and an unknown tier is evidence, not $19.
+        const reportedPlan = stringValue(seat.plan_type)?.toLowerCase();
+        const plan = reportedPlan === "business" || reportedPlan === "enterprise" ? reportedPlan : "unknown";
+        const seatUsd = plan === "enterprise" ? 39 : plan === "business" ? 19 : null;
         const lastActivity = stringValue(seat.last_activity_at);
         return [{
                 id: slugifySourceId(["github-copilot-seat", options.accountId, userId, plan].filter(Boolean).join("-")),
@@ -152,7 +169,7 @@ export function normalizeGitHubCopilotSeatResponse(response, options) {
                 inputTokens: 0,
                 outputTokens: 0,
                 amountUsd: seatUsd,
-                costConfidence: "estimated",
+                costConfidence: seatUsd === null ? "missing" : "estimated",
                 userId,
                 projectId: options.accountId,
                 providerCostType: "copilot_seat_reconciliation",
@@ -165,20 +182,33 @@ export function normalizeGitHubCopilotSeatResponse(response, options) {
 export function normalizeAnthropicCostResponse(response, options) {
     const data = isObject(response) && Array.isArray(response.data) ? response.data : [];
     const records = [];
-    for (const bucket of data) {
-        const timestamp = bucket.starting_at ?? new Date(0).toISOString();
-        for (const result of bucket.results ?? []) {
-            const currency = result.currency?.toLowerCase() ?? "usd";
+    for (const bucketValue of data) {
+        if (!isRecord(bucketValue))
+            continue;
+        const timestamp = validDateTimeString(bucketValue.starting_at);
+        if (!timestamp)
+            continue;
+        const results = Array.isArray(bucketValue.results) ? bucketValue.results : [];
+        for (const resultValue of results) {
+            if (!isRecord(resultValue))
+                continue;
+            const currency = resultValue.currency === undefined
+                ? "usd"
+                : typeof resultValue.currency === "string"
+                    ? resultValue.currency.toLowerCase()
+                    : undefined;
             if (currency !== "usd")
                 continue;
-            const amountUsd = parseMinorUsd(result.amount);
+            const amountUsd = parseMinorUsd(resultValue.amount);
             if (typeof amountUsd !== "number")
                 continue;
-            const description = result.description ?? result.cost_type ?? "Anthropic organization costs";
-            const model = result.model ?? description;
-            const workspaceId = result.workspace_id ?? undefined;
+            const costType = stringValue(resultValue.cost_type);
+            const description = stringValue(resultValue.description) ?? costType ?? "Anthropic organization costs";
+            const model = stringValue(resultValue.model) ?? description;
+            const workspaceId = stringValue(resultValue.workspace_id);
+            const tokenType = stringValue(resultValue.token_type);
             records.push({
-                id: slugifySourceId(["anthropic-costs", timestamp, workspaceId, model, result.token_type ?? result.cost_type].filter(Boolean).join("-")),
+                id: slugifySourceId(["anthropic-costs", timestamp, workspaceId, model, tokenType ?? costType].filter(Boolean).join("-")),
                 timestamp: new Date(timestamp).toISOString(),
                 source: {
                     id: options.sourceId,
@@ -194,7 +224,7 @@ export function normalizeAnthropicCostResponse(response, options) {
                 costConfidence: "verified",
                 projectId: workspaceId,
                 workspaceId,
-                providerCostType: result.cost_type ?? "anthropic_cost",
+                providerCostType: costType ?? "anthropic_cost",
                 usageGranularity: "billing_bucket",
                 operation: description
             });
@@ -239,8 +269,8 @@ export function normalizeGitHubCopilotMetricsResponse(response, options) {
                 timestamp,
                 source: { id: options.sourceId, name: "GitHub Copilot metrics API", provider: "github-copilot", confidence: "verified", observedFrom: options.observedFrom },
                 model: "github-copilot-cli",
-                inputTokens: numberValue(tokenUsage?.prompt_tokens_sum) ?? 0,
-                outputTokens: numberValue(tokenUsage?.output_tokens_sum) ?? 0,
+                inputTokens: nonNegativeIntegerValue(tokenUsage?.prompt_tokens_sum) ?? 0,
+                outputTokens: nonNegativeIntegerValue(tokenUsage?.output_tokens_sum) ?? 0,
                 amountUsd: null,
                 costConfidence: "missing",
                 projectId: options.accountId,
@@ -253,13 +283,14 @@ export function normalizeGitHubCopilotMetricsResponse(response, options) {
     return records;
 }
 export function normalizeCursorSpendResponse(response, options) {
-    const users = extractArray(response, "users").length > 0 ? extractArray(response, "users") : extractArray(response, "data");
-    const timestamp = new Date().toISOString();
+    const users = extractArray(response, "teamMemberSpend");
+    const cycleStart = isRecord(response) ? numberValue(response.subscriptionCycleStart) : undefined;
+    const timestamp = typeof cycleStart === "number" ? new Date(cycleStart).toISOString() : new Date().toISOString();
     return users.flatMap((user) => {
         if (!isRecord(user))
             return [];
-        const userId = stringValue(user.email) ?? stringValue(user.emailAddress) ?? stringValue(user.userId) ?? stringValue(user.id);
-        const cents = numberValue(user.spendCents) ?? numberValue(user.usageBasedCents) ?? numberValue(user.chargedCents);
+        const userId = stringValue(user.email) ?? stringValue(user.userId);
+        const cents = numberValue(user.spendCents);
         if (!userId || typeof cents !== "number")
             return [];
         return [{
@@ -283,22 +314,84 @@ export function normalizeCursorSpendResponse(response, options) {
     });
 }
 export async function fetchProviderUsageRecords(input) {
+    // Validate explicit bounds before resolving a credential or making a request.
+    // The interval-aware OpenAI/Anthropic result paths call the same pure helper
+    // to attach normalized bounds only after a successful fetch. Copilot and
+    // Cursor do not currently constrain their reads to these requested bounds,
+    // so they deliberately return no coverage interval.
+    requestedCoverageInterval(input);
     const token = (input.tokenResolver ?? defaultTokenResolver)(input.authReference);
     const fetcher = input.fetcher ?? defaultFetcher;
     const sourceId = input.sourceId ?? `${input.provider}-provider-api`;
-    if (input.provider === "openai") {
-        return fetchOpenAi(input, token, fetcher, sourceId);
+    const credentialVariants = resolvedCredentialVariants(input.provider, token);
+    try {
+        if (input.provider === "openai") {
+            return redactResolvedCredentialValue(await fetchOpenAi(input, token, fetcher, sourceId), credentialVariants);
+        }
+        if (input.provider === "anthropic") {
+            return redactResolvedCredentialValue(await fetchAnthropic(input, token, fetcher, sourceId), credentialVariants);
+        }
+        if (input.provider === "github-copilot") {
+            return redactResolvedCredentialValue(await fetchGitHubCopilot(input, token, fetcher, sourceId), credentialVariants);
+        }
+        if (input.provider === "cursor") {
+            return redactResolvedCredentialValue(await fetchCursor(input, token, fetcher, sourceId), credentialVariants);
+        }
+        throw new Error(`Provider connector not implemented yet: ${input.provider}`);
+    }
+    catch (error) {
+        // This is the shared credential boundary for CLI, MCP, and future hosts.
+        // Provider payloads, status text, fetch implementations, and validation
+        // errors are all untrusted after a credential has been resolved. Exact
+        // replacement covers opaque tokens that do not match a known key shape.
+        throw redactResolvedCredentialError(error, credentialVariants);
+    }
+}
+function resolvedCredentialVariants(provider, token) {
+    const values = token ? [token] : [];
+    if (provider === "cursor" && token) {
+        try {
+            const encoded = btoaCompat(`${token}:`);
+            const unpadded = encoded.replace(/=+$/g, "");
+            const base64Url = unpadded.replace(/\+/g, "-").replace(/\//g, "_");
+            values.push(encoded, unpadded, base64Url, `Basic ${encoded}`, `Basic ${unpadded}`, `Basic ${base64Url}`);
+        }
+        catch {
+            // Cursor's request will fail on the same unsupported credential. Keep the
+            // raw value in the redaction set so that failure is still safe to return.
+        }
     }
-    if (input.provider === "anthropic") {
-        return fetchAnthropic(input, token, fetcher, sourceId);
+    const encodedValues = values.flatMap((value) => {
+        const encoded = encodeURIComponent(value);
+        return encoded === value ? [value] : [value, encoded];
+    });
+    return Array.from(new Set(encodedValues)).sort((left, right) => right.length - left.length);
+}
+function exactRedactCredentialValues(value, credentialVariants) {
+    return credentialVariants.reduce((safeValue, credential) => safeValue.split(credential).join("[REDACTED]"), value);
+}
+function redactResolvedCredentialError(error, credentialVariants) {
+    const rawMessage = error instanceof Error ? error.message : String(error);
+    const withoutResolvedCredential = exactRedactCredentialValues(rawMessage, credentialVariants);
+    // Strip controls before a second exact-redaction pass: an adversarial
+    // provider can splice ANSI bytes through an opaque credential so the first
+    // literal replacement misses it and control stripping reconstructs it.
+    const safeMessage = exactRedactCredentialValues(sanitizeProviderMessage(withoutResolvedCredential), credentialVariants).trim();
+    return new Error(safeMessage || "Provider connector request failed without a safe error message.");
+}
+function redactResolvedCredentialValue(value, credentialVariants) {
+    if (typeof value === "string") {
+        const withoutResolvedCredential = exactRedactCredentialValues(value, credentialVariants);
+        return exactRedactCredentialValues(sanitizeProviderMessage(withoutResolvedCredential), credentialVariants);
     }
-    if (input.provider === "github-copilot") {
-        return fetchGitHubCopilot(input, token, fetcher, sourceId);
+    if (Array.isArray(value)) {
+        return value.map((item) => redactResolvedCredentialValue(item, credentialVariants));
     }
-    if (input.provider === "cursor") {
-        return fetchCursor(input, token, fetcher, sourceId);
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .map(([key, item]) => [key, redactResolvedCredentialValue(item, credentialVariants)]));
     }
-    throw new Error(`Provider connector not implemented yet: ${input.provider}`);
+    return value;
 }
 async function fetchOpenAi(input, token, fetcher, sourceId) {
     const request = {
@@ -306,12 +399,14 @@ async function fetchOpenAi(input, token, fetcher, sourceId) {
         headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" }
     };
     const costFetch = await fetchPaginatedJson(fetcher, buildOpenAiCostsUrl(input.startTime, input.endTime), request, "openai", "OpenAI costs API");
+    markMalformedCostRows(costFetch, "openai", "OpenAI costs API");
     const usageFetch = await fetchPaginatedJson(fetcher, buildOpenAiUsageUrl(input.startTime, input.endTime), request, "openai", "OpenAI usage API");
+    markMalformedUsageRows(usageFetch, "openai", "OpenAI usage API");
     const records = [
         ...costFetch.pages.flatMap((page) => normalizeOpenAiCostResponse(page, { sourceId, observedFrom: "OpenAI organization costs API" })),
         ...usageFetch.pages.flatMap((page) => normalizeOpenAiUsageResponse(page, { sourceId, observedFrom: "OpenAI organization usage API" }))
     ];
-    return providerResult("openai", sourceId, input.authReference, records, qaSummary("openai", [costFetch, usageFetch]));
+    return providerResult("openai", sourceId, input.authReference, records, qaSummary("openai", [costFetch, usageFetch]), requestedCoverageInterval(input));
 }
 async function fetchAnthropic(input, token, fetcher, sourceId) {
     const costRequest = {
@@ -319,12 +414,16 @@ async function fetchAnthropic(input, token, fetcher, sourceId) {
         headers: { "x-api-key": token, "anthropic-version": "2023-06-01", "Content-Type": "application/json" }
     };
     const costFetch = await fetchPaginatedJson(fetcher, buildAnthropicCostUrl(input.startTime, input.endTime), costRequest, "anthropic", "Anthropic Admin cost report");
+    markMalformedCostRows(costFetch, "anthropic", "Anthropic Admin cost report");
     const claudeCodeFetches = await fetchDateRangeJson(fetcher, buildAnthropicClaudeCodeUrl, input.startTime, input.endTime, costRequest, "anthropic", "Anthropic Claude Code usage report");
+    for (const fetchResult of claudeCodeFetches) {
+        markMalformedUsageRows(fetchResult, "anthropic", "Anthropic Claude Code usage report");
+    }
     const records = [
         ...costFetch.pages.flatMap((page) => normalizeAnthropicCostResponse(page, { sourceId, observedFrom: "Anthropic Admin Cost Report" })),
         ...claudeCodeFetches.flatMap((fetchResult) => fetchResult.pages.flatMap((page) => normalizeAnthropicClaudeCodeUsageResponse(page, { sourceId, observedFrom: "Anthropic Claude Code Usage Report", accountId: input.accountId })))
     ];
-    return providerResult("anthropic", sourceId, input.authReference, records, qaSummary("anthropic", [costFetch, ...claudeCodeFetches]));
+    return providerResult("anthropic", sourceId, input.authReference, records, qaSummary("anthropic", [costFetch, ...claudeCodeFetches]), requestedCoverageInterval(input));
 }
 async function fetchGitHubCopilot(input, token, fetcher, sourceId) {
     const accountId = input.org ?? input.enterprise;
@@ -332,38 +431,230 @@ async function fetchGitHubCopilot(input, token, fetcher, sourceId) {
         throw new Error("GitHub Copilot connector requires --org or --enterprise.");
     const request = {
         method: "GET",
-        headers: { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28" }
+        headers: { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json", "X-GitHub-Api-Version": "2026-03-10" }
     };
-    const metricsFetch = await fetchPaginatedJson(fetcher, buildGitHubCopilotMetricsUrl(input), request, "github-copilot", "GitHub Copilot metrics");
+    const metricsManifestResponse = await fetchJsonOrThrow(fetcher, buildGitHubCopilotMetricsUrl(input), request, "github-copilot", "GitHub Copilot metrics manifest");
+    const metricsManifest = metricsManifestResponse.payload;
+    const metricsDownloadLinks = requireStringArray(metricsManifest, "download_links", "GitHub Copilot metrics manifest");
+    const metricsFetch = await fetchGitHubCopilotSignedReports(fetcher, metricsDownloadLinks, metricsManifest, metricsManifestResponse.rateLimit);
+    markMalformedUsageRows(metricsFetch, "github-copilot", "GitHub Copilot metrics reports");
     const seatFetch = input.org ? await fetchPaginatedJson(fetcher, buildGitHubCopilotSeatsUrl(input.org), request, "github-copilot", "GitHub Copilot seats") : undefined;
+    if (seatFetch)
+        assessGitHubCopilotSeatCompleteness(seatFetch);
     const metricsRecords = metricsFetch.pages.flatMap((page) => normalizeGitHubCopilotMetricsResponse(page, { sourceId, observedFrom: "GitHub Copilot metrics API", accountId }));
     const seatRecords = seatFetch ? seatFetch.pages.flatMap((page) => normalizeGitHubCopilotSeatResponse(page, { sourceId, observedFrom: "GitHub Copilot billing seats API", accountId })) : [];
     return providerResult("github-copilot", sourceId, input.authReference, [...metricsRecords, ...seatRecords], qaSummary("github-copilot", [metricsFetch, ...(seatFetch ? [seatFetch] : [])]));
 }
 async function fetchCursor(input, token, fetcher, sourceId) {
     const accountId = input.accountId ?? input.org ?? "cursor-team";
-    const response = await fetchJsonOrThrow(fetcher, "https://api.cursor.com/teams/spend", {
-        method: "POST",
-        headers: { Authorization: `Basic ${btoaCompat(`${token}:`)}`, "Content-Type": "application/json" },
-        body: JSON.stringify({})
-    }, "cursor", "Cursor Admin API spend");
-    const page = response.payload;
-    const records = normalizeCursorSpendResponse(page, { sourceId, observedFrom: "Cursor Admin API", accountId });
-    // The Cursor connector is matched to the published spec but not live-verified.
-    // If the API answered with content but no spend fields we recognize, say so
-    // loudly rather than silently report $0 (which reads as "you spent nothing").
-    if (records.length === 0 && isRecord(page) && Object.keys(page).length > 0) {
-        throw new Error("Cursor returned data but no spend fields this connector recognizes " +
-            `(saw: ${Object.keys(page).slice(0, 8).join(", ")}). The Cursor connector is beta — ` +
-            "please open an issue with this field list so we can map it: https://github.com/futurastudio/ai-spend-agent/issues");
-    }
-    const singleFetch = {
-        pages: [page],
-        pagination: { label: "Cursor Admin API spend", pagesFetched: 1, stoppedBecause: "complete", maxPages: 1 },
-        rateLimits: response.rateLimit ? [response.rateLimit] : [],
-        responseDrift: detectResponseDrift(page, "cursor", "Cursor Admin API spend")
+    const spendFetch = await fetchCursorSpendPages(fetcher, token);
+    const records = spendFetch.pages.flatMap((page) => normalizeCursorSpendResponse(page, { sourceId, observedFrom: "Cursor Admin API", accountId }));
+    return providerResult("cursor", sourceId, input.authReference, records, qaSummary("cursor", [spendFetch]));
+}
+async function fetchCursorSpendPages(fetcher, token) {
+    const label = "Cursor Admin API spend";
+    const pages = [];
+    const rateLimits = [];
+    const responseDrift = [];
+    const maxPages = 50;
+    const pageSize = 100;
+    let expectedTotalPages;
+    let expectedTotalMembers;
+    let stoppedBecause = "complete";
+    let note;
+    for (let pageNumber = 1; pageNumber <= (expectedTotalPages ?? 1) && pageNumber <= maxPages; pageNumber += 1) {
+        let response;
+        try {
+            response = await fetchJsonOrThrow(fetcher, "https://api.cursor.com/teams/spend", {
+                method: "POST",
+                headers: { Authorization: `Basic ${btoaCompat(`${token}:`)}`, "Content-Type": "application/json" },
+                body: JSON.stringify({ page: pageNumber, pageSize })
+            }, "cursor", label);
+        }
+        catch (error) {
+            if (pages.length === 0)
+                throw error;
+            stoppedBecause = "fetch_error";
+            note = `Stopped after ${pages.length} page(s): ${sanitizeProviderMessage(error instanceof Error ? error.message : String(error))}`;
+            break;
+        }
+        const page = response.payload;
+        const pageMetadata = validateCursorSpendPage(page, pageNumber);
+        if (expectedTotalPages === undefined)
+            expectedTotalPages = pageMetadata.totalPages;
+        if (expectedTotalMembers === undefined)
+            expectedTotalMembers = pageMetadata.totalMembers;
+        if (pageMetadata.totalPages !== expectedTotalPages || pageMetadata.totalMembers !== expectedTotalMembers) {
+            stoppedBecause = "fetch_error";
+            note = `Cursor pagination metadata changed on page ${pageNumber} (totalPages ${expectedTotalPages}→${pageMetadata.totalPages}, totalMembers ${expectedTotalMembers}→${pageMetadata.totalMembers}); results may be incomplete.`;
+            pages.push(page);
+            responseDrift.push({ label, field: "totalPages/totalMembers", issue: note });
+            break;
+        }
+        pages.push(page);
+        if (response.rateLimit)
+            rateLimits.push(response.rateLimit);
+        responseDrift.push(...detectResponseDrift(page, "cursor", label));
+    }
+    if ((expectedTotalPages ?? 0) > maxPages && stoppedBecause === "complete") {
+        stoppedBecause = "max_pages";
+        note = `Cursor reported ${expectedTotalPages} pages, exceeding the ${maxPages}-page connector limit.`;
+    }
+    const fetchedMembers = pages.reduce((sum, page) => sum + extractArray(page, "teamMemberSpend").length, 0);
+    if (stoppedBecause === "complete" && typeof expectedTotalMembers === "number" && fetchedMembers !== expectedTotalMembers) {
+        stoppedBecause = "missing_cursor";
+        note = `Cursor reported ${expectedTotalMembers} members but returned ${fetchedMembers}; refusing to mark the sync complete.`;
+        responseDrift.push({ label, field: "totalMembers", issue: note });
+    }
+    return {
+        pages,
+        pagination: { label, pagesFetched: pages.length, stoppedBecause, maxPages, limitPerPage: pageSize, ...(note ? { note } : {}) },
+        rateLimits,
+        responseDrift
+    };
+}
+function validateCursorSpendPage(page, pageNumber) {
+    if (!isRecord(page) || !Array.isArray(page.teamMemberSpend)) {
+        const fields = isRecord(page) ? Object.keys(page).slice(0, 8).join(", ") : typeof page;
+        throw new Error(`Cursor spend page ${pageNumber} is missing canonical teamMemberSpend data (saw: ${fields}).`);
+    }
+    const totalPages = numberValue(page.totalPages);
+    if (typeof totalPages !== "number" || !Number.isInteger(totalPages) || totalPages < 1) {
+        throw new Error(`Cursor spend page ${pageNumber} has invalid or missing totalPages; completeness cannot be proven.`);
+    }
+    const totalMembers = numberValue(page.totalMembers);
+    if (typeof totalMembers !== "number" || !Number.isInteger(totalMembers) || totalMembers < 0) {
+        throw new Error(`Cursor spend page ${pageNumber} has invalid or missing totalMembers; completeness cannot be proven.`);
+    }
+    for (const [index, member] of page.teamMemberSpend.entries()) {
+        const spendCents = isRecord(member) ? numberValue(member.spendCents) : undefined;
+        if (!isRecord(member) || (!stringValue(member.email) && !stringValue(member.userId)) || typeof spendCents !== "number" || spendCents < 0) {
+            const fields = isRecord(member) ? Object.keys(member).slice(0, 8).join(", ") : typeof member;
+            throw new Error(`Cursor spend page ${pageNumber} member ${index + 1} is missing email/userId or a non-negative spendCents value (saw: ${fields}).`);
+        }
+        if (member.fastPremiumRequests !== undefined && typeof nonNegativeIntegerValue(member.fastPremiumRequests) !== "number") {
+            throw new Error(`Cursor spend page ${pageNumber} member ${index + 1} has an invalid fastPremiumRequests quantity; expected a non-negative integer.`);
+        }
+    }
+    return { totalPages, totalMembers };
+}
+async function fetchGitHubCopilotSignedReports(fetcher, downloadLinks, manifest, manifestRateLimit) {
+    const label = "GitHub Copilot metrics reports";
+    const maxReports = 100;
+    if (downloadLinks.length > maxReports) {
+        throw new Error(`GitHub Copilot metrics manifest returned ${downloadLinks.length} report files, exceeding the ${maxReports}-file safety limit.`);
+    }
+    const pages = [];
+    const responseDrift = detectResponseDrift(manifest, "github-copilot", "GitHub Copilot metrics manifest");
+    for (const [index, candidate] of downloadLinks.entries()) {
+        const safeUrl = validateSignedDownloadUrl(candidate);
+        if (!safeUrl) {
+            throw new Error(`GitHub Copilot metrics report ${index + 1} had an unsafe signed download URL; only public HTTPS URLs without embedded credentials are accepted.`);
+        }
+        const body = await fetchTextOrThrow(fetcher, safeUrl, {
+            method: "GET",
+            // Signed report URLs carry their own authorization. Never replay the
+            // GitHub bearer token to a storage host.
+            headers: { Accept: "application/x-ndjson, application/json" }
+        }, "github-copilot", `GitHub Copilot metrics report ${index + 1}`);
+        const reports = parseNdjsonReports(body, index + 1);
+        if (reports.length === 0) {
+            throw new Error(`GitHub Copilot metrics report ${index + 1} was empty; refusing to report a complete sync.`);
+        }
+        for (const report of reports) {
+            if (!isRecord(report) || !Array.isArray(report.day_totals)) {
+                const fields = isRecord(report) ? Object.keys(report).slice(0, 8).join(", ") : typeof report;
+                throw new Error(`GitHub Copilot metrics report ${index + 1} did not contain the documented day_totals wrapper (saw: ${fields}).`);
+            }
+            pages.push(report);
+            responseDrift.push(...detectResponseDrift(report, "github-copilot", label));
+        }
+    }
+    return {
+        pages,
+        pagination: { label, pagesFetched: downloadLinks.length, stoppedBecause: "complete", maxPages: maxReports },
+        rateLimits: manifestRateLimit ? [manifestRateLimit] : [],
+        responseDrift
     };
-    return providerResult("cursor", sourceId, input.authReference, records, qaSummary("cursor", [singleFetch]));
+}
+async function fetchTextOrThrow(fetcher, url, request, provider, label) {
+    let lastError;
+    for (let attempt = 0; attempt <= maxFetchRetries; attempt += 1) {
+        const response = await fetcher(url, request);
+        if (response.ok) {
+            if (!response.text)
+                throw new Error(`${label} did not expose a readable NDJSON body.`);
+            return response.text();
+        }
+        const payload = await response.json().catch(() => undefined);
+        lastError = new Error(providerPermissionPrompt(provider, label, response, payload));
+        const retryable = response.status === 429 || response.status >= 500;
+        if (!retryable || attempt === maxFetchRetries)
+            break;
+        const retryAfterSeconds = headerNumber(response.headers, "retry-after");
+        const delayMs = typeof retryAfterSeconds === "number"
+            ? Math.min(Math.max(retryAfterSeconds, 0) * 1000, maxRetryDelayMs)
+            : 500 * 2 ** attempt;
+        if (delayMs > 0)
+            await new Promise((resolveDelay) => setTimeout(resolveDelay, delayMs));
+    }
+    throw lastError ?? new Error(`${label} request failed.`);
+}
+function parseNdjsonReports(body, reportNumber) {
+    const reports = [];
+    const lines = body.split(/\r?\n/).filter((line) => line.trim().length > 0);
+    for (const [lineIndex, line] of lines.entries()) {
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            throw new Error(`GitHub Copilot metrics report ${reportNumber} contains malformed NDJSON at line ${lineIndex + 1}.`);
+        }
+        if (Array.isArray(parsed))
+            reports.push(...parsed);
+        else
+            reports.push(parsed);
+    }
+    return reports;
+}
+function validateSignedDownloadUrl(candidate) {
+    try {
+        const url = new URL(candidate);
+        const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+        if (url.protocol !== "https:" || (url.port && url.port !== "443") || url.username || url.password)
+            return undefined;
+        if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname === "::" || hostname === "::1" || hostname === "0:0:0:0:0:0:0:1")
+            return undefined;
+        if (/^0\./.test(hostname) || /^127\./.test(hostname) || /^10\./.test(hostname) || /^192\.168\./.test(hostname) || /^169\.254\./.test(hostname))
+            return undefined;
+        if (/^(?:fc|fd|fe[89ab])/i.test(hostname))
+            return undefined;
+        const private172 = hostname.match(/^172\.(\d+)\./);
+        if (private172 && Number(private172[1]) >= 16 && Number(private172[1]) <= 31)
+            return undefined;
+        return url.toString();
+    }
+    catch {
+        return undefined;
+    }
+}
+function assessGitHubCopilotSeatCompleteness(fetchResult) {
+    const expected = fetchResult.pages
+        .map((page) => isRecord(page) ? numberValue(page.total_seats) : undefined)
+        .find((value) => typeof value === "number");
+    const actual = fetchResult.pages.reduce((sum, page) => sum + extractArray(page, "seats").length, 0);
+    if (typeof expected !== "number") {
+        if (fetchResult.pagination.stoppedBecause === "complete")
+            fetchResult.pagination.stoppedBecause = "missing_cursor";
+        fetchResult.pagination.note = "GitHub Copilot seats response omitted total_seats; completeness cannot be proven.";
+        fetchResult.responseDrift.push({ label: "GitHub Copilot seats", field: "total_seats", issue: fetchResult.pagination.note });
+    }
+    else if (fetchResult.pagination.stoppedBecause === "complete" && actual !== expected) {
+        fetchResult.pagination.stoppedBecause = "missing_cursor";
+        fetchResult.pagination.note = `GitHub reported ${expected} seats but returned ${actual}; completeness cannot be proven.`;
+        fetchResult.responseDrift.push({ label: "GitHub Copilot seats", field: "total_seats", issue: fetchResult.pagination.note });
+    }
 }
 async function fetchPaginatedJson(fetcher, initialUrl, request, provider, label) {
     const pages = [];
@@ -574,6 +865,228 @@ function headerNumber(headers, name) {
 function hasHeaderGetter(headers) {
     return typeof headers?.get === "function";
 }
+function markMalformedCostRows(fetchResult, provider, label) {
+    const issues = [];
+    const maxDetailedIssues = 25;
+    let issueCount = 0;
+    const report = (field, issue) => {
+        issueCount += 1;
+        if (issues.length < maxDetailedIssues)
+            issues.push({ label, field, issue });
+    };
+    for (const page of fetchResult.pages) {
+        if (!isRecord(page) || !Array.isArray(page.data)) {
+            report("data", "cost response omitted the canonical data array; no financial completeness claim is safe");
+            continue;
+        }
+        for (const [bucketIndex, bucketValue] of page.data.entries()) {
+            const bucketPath = `data[${bucketIndex}]`;
+            if (!isRecord(bucketValue)) {
+                report(bucketPath, "cost response contained a non-object billing bucket");
+                continue;
+            }
+            if (provider === "openai") {
+                if (typeof validEpochSeconds(bucketValue.start_time) !== "number") {
+                    report(`${bucketPath}.start_time`, "cost bucket had an invalid timestamp and its rows were excluded");
+                    continue;
+                }
+            }
+            else if (!validDateTimeString(bucketValue.starting_at)) {
+                report(`${bucketPath}.starting_at`, "cost bucket had an invalid timestamp and its rows were excluded");
+                continue;
+            }
+            if (!Array.isArray(bucketValue.results)) {
+                report(`${bucketPath}.results`, "cost bucket omitted the canonical results array");
+                continue;
+            }
+            for (const [resultIndex, resultValue] of bucketValue.results.entries()) {
+                const resultPath = `${bucketPath}.results[${resultIndex}]`;
+                if (!isRecord(resultValue)) {
+                    report(resultPath, "cost response contained a non-object billed-cost row");
+                    continue;
+                }
+                if (provider === "openai") {
+                    const amount = isRecord(resultValue.amount) ? resultValue.amount : undefined;
+                    if (!amount) {
+                        report(`${resultPath}.amount`, "billed-cost row had no canonical amount object and was excluded");
+                        continue;
+                    }
+                    if (amount.currency !== undefined && (typeof amount.currency !== "string" || amount.currency.toLowerCase() !== "usd")) {
+                        report(`${resultPath}.amount.currency`, "billed-cost row used an invalid or unsupported currency and was excluded from the USD headline");
+                        continue;
+                    }
+                    if (typeof parseDollarUsd(amount.value) !== "number") {
+                        report(`${resultPath}.amount.value`, "billed-cost row had an invalid dollar amount and was excluded");
+                    }
+                    if (resultValue.quantity !== undefined && typeof nonNegativeNumberValue(resultValue.quantity) !== "number") {
+                        report(`${resultPath}.quantity`, "billed-cost row had a negative or invalid quantity; the quantity was excluded");
+                    }
+                    continue;
+                }
+                if (resultValue.currency !== undefined && (typeof resultValue.currency !== "string" || resultValue.currency.toLowerCase() !== "usd")) {
+                    report(`${resultPath}.currency`, "billed-cost row used an invalid or unsupported currency and was excluded from the USD headline");
+                    continue;
+                }
+                if (typeof parseMinorUsd(resultValue.amount) !== "number") {
+                    report(`${resultPath}.amount`, "billed-cost row had an invalid minor-unit amount and was excluded");
+                }
+            }
+        }
+    }
+    if (issueCount === 0)
+        return;
+    if (issueCount > maxDetailedIssues) {
+        issues.push({
+            label,
+            field: "data[].results[]",
+            issue: `${issueCount - maxDetailedIssues} additional malformed billed-cost schema issue(s) were omitted from QA details`
+        });
+    }
+    fetchResult.coverageIncomplete = true;
+    fetchResult.responseDrift.push(...issues);
+}
+/**
+ * Provider APIs are untrusted even after transport succeeds. A negative or
+ * fractional token count cannot satisfy UsageRecord's finance-grade schema,
+ * and a negative count/quantity cannot support a completeness claim. Keep any
+ * independently valid evidence, but mark the whole source pull partial and
+ * omit the invalid values during normalization.
+ */
+function markMalformedUsageRows(fetchResult, provider, label) {
+    const issues = [];
+    const maxDetailedIssues = 25;
+    let issueCount = 0;
+    const report = (field, issue) => {
+        issueCount += 1;
+        if (issues.length < maxDetailedIssues)
+            issues.push({ label, field, issue });
+    };
+    const checkInteger = (value, field, kind) => {
+        if (value !== undefined && typeof nonNegativeIntegerValue(value) !== "number") {
+            report(field, `${kind} must be a non-negative integer; the invalid value was excluded`);
+        }
+    };
+    for (const page of fetchResult.pages) {
+        if (provider === "openai") {
+            if (!isRecord(page) || !Array.isArray(page.data)) {
+                report("data", "usage response omitted the canonical data array; completeness cannot be proven");
+                continue;
+            }
+            for (const [bucketIndex, bucketValue] of page.data.entries()) {
+                const bucketPath = `data[${bucketIndex}]`;
+                if (!isRecord(bucketValue) || !Array.isArray(bucketValue.results)) {
+                    report(bucketPath, "usage response contained a malformed bucket or omitted its results array");
+                    continue;
+                }
+                for (const [resultIndex, resultValue] of bucketValue.results.entries()) {
+                    const resultPath = `${bucketPath}.results[${resultIndex}]`;
+                    if (!isRecord(resultValue)) {
+                        report(resultPath, "usage response contained a non-object usage row");
+                        continue;
+                    }
+                    for (const field of [
+                        "input_tokens",
+                        "input_uncached_tokens",
+                        "input_cache_write_tokens",
+                        "input_cached_tokens",
+                        "input_text_tokens",
+                        "input_image_tokens",
+                        "input_audio_tokens",
+                        "input_cached_text_tokens",
+                        "input_cached_image_tokens",
+                        "input_cached_audio_tokens",
+                        "output_tokens",
+                        "output_text_tokens",
+                        "output_image_tokens",
+                        "output_audio_tokens"
+                    ]) {
+                        checkInteger(resultValue[field], `${resultPath}.${field}`, "token count");
+                    }
+                    checkInteger(resultValue.num_model_requests, `${resultPath}.num_model_requests`, "quantity");
+                }
+            }
+            continue;
+        }
+        if (provider === "anthropic") {
+            if (!isRecord(page) || !Array.isArray(page.data)) {
+                report("data", "Claude Code usage response omitted the canonical data array; completeness cannot be proven");
+                continue;
+            }
+            for (const [rowIndex, rowValue] of page.data.entries()) {
+                const rowPath = `data[${rowIndex}]`;
+                if (!isRecord(rowValue)) {
+                    report(rowPath, "Claude Code usage response contained a non-object row");
+                    continue;
+                }
+                const core = isRecord(rowValue.core_metrics) ? rowValue.core_metrics : {};
+                const lines = isRecord(core.lines_of_code) ? core.lines_of_code : {};
+                checkInteger(core.num_sessions, `${rowPath}.core_metrics.num_sessions`, "quantity");
+                checkInteger(lines.added, `${rowPath}.core_metrics.lines_of_code.added`, "quantity");
+                checkInteger(lines.removed, `${rowPath}.core_metrics.lines_of_code.removed`, "quantity");
+                checkInteger(core.commits_by_claude_code, `${rowPath}.core_metrics.commits_by_claude_code`, "quantity");
+                checkInteger(core.pull_requests_by_claude_code, `${rowPath}.core_metrics.pull_requests_by_claude_code`, "quantity");
+                const modelBreakdown = Array.isArray(rowValue.model_breakdown) ? rowValue.model_breakdown : [];
+                for (const [modelIndex, modelValue] of modelBreakdown.entries()) {
+                    const modelPath = `${rowPath}.model_breakdown[${modelIndex}]`;
+                    if (!isRecord(modelValue)) {
+                        report(modelPath, "Claude Code usage response contained a non-object model row");
+                        continue;
+                    }
+                    const tokens = isRecord(modelValue.tokens) ? modelValue.tokens : {};
+                    for (const field of ["input", "output", "cache_read", "cache_creation"]) {
+                        checkInteger(tokens[field], `${modelPath}.tokens.${field}`, "token count");
+                    }
+                }
+            }
+            continue;
+        }
+        if (!isRecord(page) || !Array.isArray(page.day_totals)) {
+            report("day_totals", "Copilot metrics response omitted the canonical day_totals array; completeness cannot be proven");
+            continue;
+        }
+        for (const [dayIndex, dayValue] of page.day_totals.entries()) {
+            const dayPath = `day_totals[${dayIndex}]`;
+            if (!isRecord(dayValue)) {
+                report(dayPath, "Copilot metrics response contained a non-object day row");
+                continue;
+            }
+            checkInteger(dayValue.daily_active_users, `${dayPath}.daily_active_users`, "quantity");
+            const featureRows = Array.isArray(dayValue.totals_by_model_feature) ? dayValue.totals_by_model_feature : [];
+            for (const [featureIndex, featureValue] of featureRows.entries()) {
+                if (!isRecord(featureValue)) {
+                    report(`${dayPath}.totals_by_model_feature[${featureIndex}]`, "Copilot metrics response contained a non-object feature row");
+                    continue;
+                }
+                const featurePath = `${dayPath}.totals_by_model_feature[${featureIndex}]`;
+                for (const field of ["engaged_users", "total_requests", "user_initiated_interaction_count"]) {
+                    checkInteger(featureValue[field], `${featurePath}.${field}`, "quantity");
+                }
+            }
+            const cli = isRecord(dayValue.totals_by_cli) ? dayValue.totals_by_cli : undefined;
+            if (!cli)
+                continue;
+            for (const field of ["request_count", "prompt_count", "session_count", "engaged_users", "total_requests"]) {
+                checkInteger(cli[field], `${dayPath}.totals_by_cli.${field}`, "quantity");
+            }
+            const tokenUsage = isRecord(cli.token_usage) ? cli.token_usage : undefined;
+            if (!tokenUsage)
+                continue;
+            checkInteger(tokenUsage.prompt_tokens_sum, `${dayPath}.totals_by_cli.token_usage.prompt_tokens_sum`, "token count");
+            checkInteger(tokenUsage.output_tokens_sum, `${dayPath}.totals_by_cli.token_usage.output_tokens_sum`, "token count");
+        }
+    }
+    if (issueCount === 0)
+        return;
+    if (issueCount > maxDetailedIssues) {
+        issues.push({
+            label,
+            field: "usage rows",
+            issue: `${issueCount - maxDetailedIssues} additional malformed usage schema issue(s) were omitted from QA details`
+        });
+    }
+    fetchResult.coverageIncomplete = true;
+    fetchResult.responseDrift.push(...issues);
+}
 function detectResponseDrift(payload, provider, label) {
     const known = knownProviderFields(provider, label);
     const issues = [];
@@ -615,20 +1128,20 @@ function knownProviderFields(provider, label) {
         return new Set([...common, "data[].date", "data[].actor", "data[].actor.email_address", "data[].actor.api_key_name", "data[].actor.id", "data[].actor.type", "data[].organization_id", "data[].customer_type", "data[].terminal_type", "data[].subscription_type", "data[].core_metrics", "data[].core_metrics.num_sessions", "data[].core_metrics.lines_of_code", "data[].core_metrics.lines_of_code.added", "data[].core_metrics.lines_of_code.removed", "data[].core_metrics.commits_by_claude_code", "data[].core_metrics.pull_requests_by_claude_code", "data[].model_breakdown", "data[].model_breakdown[]", "data[].model_breakdown[].model", "data[].model_breakdown[].tokens", "data[].model_breakdown[].tokens.input", "data[].model_breakdown[].tokens.output", "data[].model_breakdown[].tokens.cache_read", "data[].model_breakdown[].tokens.cache_creation", "data[].model_breakdown[].estimated_cost", "data[].model_breakdown[].estimated_cost.currency", "data[].model_breakdown[].estimated_cost.amount", "data[].tool_actions", "data[].tool_actions[]"]);
     }
     if (provider === "github-copilot" && label.toLowerCase().includes("metrics")) {
-        return new Set([...common, "day_totals", "day_totals[]", "day_totals[].day", "day_totals[].daily_active_users", "day_totals[].totals_by_model_feature", "day_totals[].totals_by_model_feature[]", "day_totals[].totals_by_model_feature[].model", "day_totals[].totals_by_model_feature[].feature", "day_totals[].totals_by_model_feature[].engaged_users", "day_totals[].totals_by_model_feature[].total_requests", "day_totals[].totals_by_model_feature[].user_initiated_interaction_count", "day_totals[].totals_by_cli", "day_totals[].totals_by_cli.request_count", "day_totals[].totals_by_cli.token_usage", "day_totals[].totals_by_cli.token_usage.prompt_tokens_sum", "day_totals[].totals_by_cli.token_usage.output_tokens_sum", "day_totals[].totals_by_cli.engaged_users", "day_totals[].totals_by_cli.total_requests", "report_start_day", "report_end_day", "generated_at"]);
+        return new Set([...common, "download_links", "download_links[]", "day_totals", "day_totals[]", "day_totals[].day", "day_totals[].daily_active_users", "day_totals[].totals_by_model_feature", "day_totals[].totals_by_model_feature[]", "day_totals[].totals_by_model_feature[].model", "day_totals[].totals_by_model_feature[].feature", "day_totals[].totals_by_model_feature[].engaged_users", "day_totals[].totals_by_model_feature[].total_requests", "day_totals[].totals_by_model_feature[].user_initiated_interaction_count", "day_totals[].totals_by_cli", "day_totals[].totals_by_cli.request_count", "day_totals[].totals_by_cli.prompt_count", "day_totals[].totals_by_cli.session_count", "day_totals[].totals_by_cli.token_usage", "day_totals[].totals_by_cli.token_usage.prompt_tokens_sum", "day_totals[].totals_by_cli.token_usage.output_tokens_sum", "day_totals[].totals_by_cli.token_usage.avg_tokens_per_request", "day_totals[].totals_by_cli.engaged_users", "day_totals[].totals_by_cli.total_requests", "report_start_day", "report_end_day", "created_at", "generated_at", "etl_id", "day_partition", "entity_id_partition", "enterprise_id", "organization_id"]);
     }
     if (provider === "github-copilot" && label.toLowerCase().includes("seats")) {
-        return new Set([...common, "total_seats", "plan_type", "seats", "seats[]", "seats[].created_at", "seats[].updated_at", "seats[].pending_cancellation_date", "seats[].last_activity_at", "seats[].last_activity_editor", "seats[].plan_type", "seats[].login", "seats[].id", "seats[].assignee", "seats[].assignee.login", "seats[].assignee.email", "seats[].assignee.id", "seats[].assignee.node_id", "seats[].assignee.avatar_url", "seats[].assignee.html_url", "seats[].assignee.type", "seats[].assignee.site_admin", "seats[].assigning_team", "seats[].organization"]);
+        return new Set([...common, "total_seats", "seats", "seats[]", "seats[].created_at", "seats[].updated_at", "seats[].pending_cancellation_date", "seats[].last_activity_at", "seats[].last_activity_editor", "seats[].last_authenticated_at", "seats[].plan_type", "seats[].login", "seats[].id", "seats[].assignee", "seats[].assignee.login", "seats[].assignee.email", "seats[].assignee.id", "seats[].assignee.node_id", "seats[].assignee.avatar_url", "seats[].assignee.html_url", "seats[].assignee.type", "seats[].assignee.site_admin", "seats[].assigning_team", "seats[].organization"]);
     }
     if (provider === "cursor") {
-        return new Set([...common, "users", "users[]", "users[].email", "users[].emailAddress", "users[].userId", "users[].id", "users[].name", "users[].role", "users[].spendCents", "users[].usageBasedCents", "users[].chargedCents", "users[].fastPremiumRequests", "users[].hardLimitOverrideDollars", "data[].email", "data[].emailAddress", "data[].userId", "data[].id", "data[].name", "data[].role", "data[].spendCents", "data[].usageBasedCents", "data[].chargedCents", "subscriptionCycleStart", "totalMembers", "totalPages"]);
+        return new Set([...common, "teamMemberSpend", "teamMemberSpend[]", "teamMemberSpend[].userId", "teamMemberSpend[].email", "teamMemberSpend[].name", "teamMemberSpend[].role", "teamMemberSpend[].spendCents", "teamMemberSpend[].fastPremiumRequests", "teamMemberSpend[].hardLimitOverrideDollars", "subscriptionCycleStart", "totalMembers", "totalPages"]);
     }
     return new Set([...common]);
 }
 function qaSummary(provider, fetches) {
     return {
         provider,
-        coverage: fetches.every((fetchResult) => fetchResult.pagination.stoppedBecause === "complete") ? "complete" : "partial",
+        coverage: fetches.every((fetchResult) => fetchResult.pagination.stoppedBecause === "complete" && fetchResult.coverageIncomplete !== true) ? "complete" : "partial",
         requestedEndpoints: Array.from(new Set(fetches.map((fetchResult) => fetchResult.pagination.label))),
         pagination: fetches.map((fetchResult) => fetchResult.pagination),
         rateLimits: fetches.flatMap((fetchResult) => fetchResult.rateLimits),
@@ -689,8 +1202,26 @@ function extractProviderMessage(payload) {
     return stringValue(error?.message) ?? stringValue(payload.message) ?? "";
 }
 function sanitizeProviderMessage(message) {
-    // One redaction implementation for the whole product (discovery.ts owns it).
-    return redactSecrets(message).replace(/sk-[A-Za-z0-9_-]+/g, "[REDACTED]").replace(/gh[pousr]_[A-Za-z0-9_]+/g, "[REDACTED]");
+    // Provider error bodies/status text are terminal-facing untrusted input.
+    // Strip controls first so an escape sequence cannot split a secret pattern,
+    // then apply the product-wide redaction rules.
+    return redactSecrets(stripTerminalControlSequences(message))
+        .replace(/sk-[A-Za-z0-9_-]+/g, "[REDACTED]")
+        .replace(/gh[pousr]_[A-Za-z0-9_]+/g, "[REDACTED]")
+        .trim();
+}
+function stripTerminalControlSequences(message) {
+    return message
+        // OSC (window title, hyperlinks, clipboard), terminated by BEL/ST or EOF.
+        .replace(/(?:\u001b\]|\u009d)[\s\S]*?(?:\u0007|\u001b\\|\u009c|$)/gu, "")
+        // DCS/SOS/PM/APC string controls, terminated by ST or EOF.
+        .replace(/(?:\u001b(?:P|X|\^|_)|[\u0090\u0098\u009e\u009f])[\s\S]*?(?:\u001b\\|\u009c|$)/gu, "")
+        // CSI plus remaining two-character ESC sequences.
+        .replace(/(?:\u001b\[|\u009b)[0-?]*[ -/]*[@-~]/gu, "")
+        .replace(/\u001b[@-_]/gu, "")
+        // Prevent line/status injection while keeping words readable.
+        .replace(/[\u0000-\u001f\u007f-\u009f]/gu, " ")
+        .replace(/\s+/gu, " ");
 }
 export function summarizeProviderFinancials(records) {
     const providerReportedBilledUsd = sumAmounts(records.filter((record) => record.costConfidence === "verified"));
@@ -732,7 +1263,7 @@ function sumAmounts(records) {
         .filter((amount) => typeof amount === "number");
     return amounts.length > 0 ? amounts.reduce((sum, amount) => sum + amount, 0) : null;
 }
-function providerResult(provider, sourceId, authReference, records, qa) {
+function providerResult(provider, sourceId, authReference, records, qa, coverageInterval) {
     const resolvedQa = qa ?? qaSummary(provider, []);
     const coverage = resolvedQa.coverage
         ?? (resolvedQa.pagination.every((pagination) => pagination.stoppedBecause === "complete") ? "complete" : "partial");
@@ -747,28 +1278,71 @@ function providerResult(provider, sourceId, authReference, records, qa) {
         : headlineConfidence;
     return {
         provider,
-        source: createProviderConnection({ provider, sourceId, authReference, verifiedRecordCount: records.length, totalUsd: financials.headlineUsd ?? 0, completeness }),
+        source: createProviderConnection({ provider, sourceId, authReference, verifiedRecordCount: records.length, totalUsd: financials.headlineUsd, completeness }),
         records,
         fetchedAt: new Date().toISOString(),
         coverage,
+        ...(coverageInterval ? { coverageInterval } : {}),
         financials,
         completeness,
         qa: resolvedQa
     };
 }
+function requestedCoverageInterval(input) {
+    if (!Number.isFinite(input.startTime) || !Number.isInteger(input.startTime) || input.startTime < 0) {
+        throw new Error("Provider coverage startTime requires a non-negative whole-second timestamp.");
+    }
+    const coverageStart = new Date(input.startTime * 1_000);
+    if (Number.isNaN(coverageStart.getTime())) {
+        throw new Error("Provider coverage interval falls outside the supported timestamp range.");
+    }
+    if (input.endTime === undefined) {
+        if (coverageStart.getTime() > Date.now()) {
+            throw new Error("Provider coverage startTime cannot be in the future.");
+        }
+        return undefined;
+    }
+    if (!Number.isFinite(input.endTime) || !Number.isInteger(input.endTime) ||
+        input.endTime < input.startTime) {
+        throw new Error("Provider coverage interval requires non-negative whole-second bounds with endTime at or after startTime.");
+    }
+    const coverageEnd = new Date(input.endTime * 1_000);
+    if (Number.isNaN(coverageEnd.getTime())) {
+        throw new Error("Provider coverage interval falls outside the supported timestamp range.");
+    }
+    if (coverageEnd.getTime() > Date.now()) {
+        throw new Error("Provider coverage endTime cannot be in the future.");
+    }
+    return {
+        coverageStart: coverageStart.toISOString(),
+        coverageEnd: coverageEnd.toISOString()
+    };
+}
 export function createProviderConnection(input) {
     const source = createProviderConnectorStub(input.provider, "provider_api", input.fetchedAt);
-    const total = `$${input.totalUsd.toFixed(2)}`;
-    const verification = input.completeness ?? "verified";
+    const total = input.totalUsd === null ? "an unavailable financial headline" : formatProviderUsd(input.totalUsd);
+    const financialEvidence = input.completeness ?? "verified";
     return {
         ...source,
         id: input.sourceId ?? source.id,
-        verification,
+        validationCoverage: validationCoverageForCompletedProviderSync(input.provider),
+        financialEvidence,
         authReference: input.authReference,
         fieldsMissing: [],
-        scope: `${source.scope} Last successful pull produced ${input.verifiedRecordCount} ${verification} records totaling ${total}.`
+        scope: `${source.scope} Last successful pull produced ${input.verifiedRecordCount} record(s); financial evidence: ${financialEvidence}; financial headline: ${total}.`
     };
 }
+function validationCoverageForCompletedProviderSync(provider) {
+    if (provider === "openai" || provider === "anthropic")
+        return "live_verified";
+    if (provider === "cursor" || provider === "github-copilot" || provider === "copilot") {
+        return "fixture_verified";
+    }
+    return "untested";
+}
+function formatProviderUsd(value) {
+    return value > 0 && value < 0.01 ? "less than $0.01" : `$${value.toFixed(2)}`;
+}
 export function resolveTokenReference(reference, env = process.env) {
     if (!reference.startsWith("env:")) {
         throw new Error("Provider auth reference must be a local reference such as env:OPENAI_ADMIN_KEY; raw secrets are not accepted.");
@@ -791,7 +1365,7 @@ function buildOpenAiCostsUrl(startTime, endTime) {
     url.searchParams.append("group_by", "project_id");
     url.searchParams.append("group_by", "line_item");
     url.searchParams.append("group_by", "api_key_id");
-    if (endTime)
+    if (endTime !== undefined)
         url.searchParams.set("end_time", String(endTime));
     return url.toString();
 }
@@ -804,14 +1378,14 @@ function buildOpenAiUsageUrl(startTime, endTime) {
     url.searchParams.append("group_by", "user_id");
     url.searchParams.append("group_by", "api_key_id");
     url.searchParams.append("group_by", "model");
-    if (endTime)
+    if (endTime !== undefined)
         url.searchParams.set("end_time", String(endTime));
     return url.toString();
 }
 function buildAnthropicCostUrl(startTime, endTime) {
     const url = new URL("https://api.anthropic.com/v1/organizations/cost_report");
     url.searchParams.set("starting_at", new Date(startTime * 1000).toISOString());
-    if (endTime)
+    if (endTime !== undefined)
         url.searchParams.set("ending_at", new Date(endTime * 1000).toISOString());
     url.searchParams.set("bucket_width", "1d");
     url.searchParams.append("group_by[]", "workspace_id");
@@ -843,20 +1417,45 @@ async function defaultFetcher(url, init) {
     return fetch(url, { ...init, redirect: "manual" });
 }
 function parseMinorUsd(value) {
-    const numeric = typeof value === "number" ? value : typeof value === "string" ? Number(value) : Number.NaN;
-    return Number.isFinite(numeric) ? numeric / 100 : undefined;
+    const numeric = typeof value === "number"
+        ? value
+        : typeof value === "string" && value.trim().length > 0
+            ? Number(value)
+            : Number.NaN;
+    return Number.isFinite(numeric) && numeric >= 0 ? numeric / 100 : undefined;
 }
 /** Amount already denominated in dollars, as number or decimal string. */
 function parseDollarUsd(value) {
-    const numeric = typeof value === "number" ? value : typeof value === "string" ? Number(value) : Number.NaN;
-    return Number.isFinite(numeric) ? numeric : undefined;
+    const numeric = typeof value === "number"
+        ? value
+        : typeof value === "string" && value.trim().length > 0
+            ? Number(value)
+            : Number.NaN;
+    return Number.isFinite(numeric) && numeric >= 0 ? numeric : undefined;
 }
 function numberValue(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
+function nonNegativeNumberValue(value) {
+    const numeric = numberValue(value);
+    return typeof numeric === "number" && numeric >= 0 ? numeric : undefined;
+}
+function nonNegativeIntegerValue(value) {
+    const numeric = numberValue(value);
+    return typeof numeric === "number" && Number.isInteger(numeric) && numeric >= 0 ? numeric : undefined;
+}
 function stringValue(value) {
     return typeof value === "string" && value.length > 0 ? value : undefined;
 }
+function validEpochSeconds(value) {
+    const seconds = numberValue(value);
+    return typeof seconds === "number" && seconds >= 0 && Number.isFinite(new Date(seconds * 1000).getTime())
+        ? seconds
+        : undefined;
+}
+function validDateTimeString(value) {
+    return typeof value === "string" && value.length > 0 && Number.isFinite(Date.parse(value)) ? value : undefined;
+}
 function extractArray(value, key) {
     if (Array.isArray(value))
         return value;
@@ -864,6 +1463,20 @@ function extractArray(value, key) {
         return value[key];
     return [];
 }
+function requireStringArray(value, key, label) {
+    if (!isRecord(value) || !Array.isArray(value[key]) || value[key].length === 0) {
+        throw new Error(`${label} returned no signed NDJSON ${key}; refusing to report an empty metrics sync.`);
+    }
+    const values = value[key];
+    if (values.some((item) => typeof item !== "string" || item.length === 0)) {
+        throw new Error(`${label} returned a malformed ${key} entry; refusing a partial metrics sync.`);
+    }
+    const strings = values;
+    if (new Set(strings).size !== strings.length) {
+        throw new Error(`${label} returned duplicate ${key}; refusing to double-count a report partition.`);
+    }
+    return strings;
+}
 function isObject(value) {
     return typeof value === "object" && value !== null;
 }