@agent-finops/core 0.7.3 → 0.8.1

package/dist/sourceRegistry.js

@@ -13,9 +13,9 @@ export const ingestionLanes = [
     },
     {
         id: "browser_account_ui",
-        label: "Browser Account UI",
+        label: "Browser Account UI (schema scaffold; ingestion unavailable)",
         sourceTypes: ["browser_account"],
-        defaultFinancialEvidence: "verified"
+        defaultFinancialEvidence: "missing"
     },
     {
         id: "local_cli_tool_detection",
@@ -31,58 +31,79 @@ export const ingestionLanes = [
     }
 ];
 export const supportedSourceTypes = ingestionLanes.flatMap((lane) => lane.sourceTypes);
+const browserAccountScaffoldMissingField = "browser-account ingestion is a schema scaffold and is not implemented";
 export const providerCatalog = [
     {
         id: "openai",
         label: "OpenAI / Codex account usage",
         preferredSourceType: "provider_api",
         preferredAccessMethod: "api",
-        verifiedFields: ["organization costs", "project usage", "model usage", "api key usage"],
-        missingFields: ["admin API token reference", "organization id"]
+        verifiedFields: ["organization costs", "completions usage by project, user, model, API key, and service tier"],
+        missingFields: [
+            "OpenAI Admin API key reference",
+            "non-completions usage families",
+            "ChatGPT/Codex workspace seats, credits, and final invoice settlement"
+        ]
     },
     {
         id: "anthropic",
         label: "Anthropic / Claude / Claude Code",
         preferredSourceType: "provider_api",
         preferredAccessMethod: "api",
-        verifiedFields: ["organization cost report", "Claude Code usage", "workspace/user usage"],
-        missingFields: ["admin API token reference", "organization id"],
-        fallbackConnector: "browser_account"
+        verifiedFields: ["organization cost report", "Claude Code analytics by workspace and user"],
+        missingFields: [
+            "Anthropic Admin API key reference",
+            "Messages Usage API detail",
+            "Claude Enterprise Analytics and final invoice settlement"
+        ]
     },
     {
         id: "github-copilot",
         label: "GitHub Copilot",
         preferredSourceType: "provider_api",
         preferredAccessMethod: "api",
-        verifiedFields: ["Copilot usage metrics", "seat usage", "premium request usage"],
-        missingFields: ["GitHub token reference", "organization or enterprise slug"],
-        fallbackConnector: "browser_account"
+        verifiedFields: ["Copilot usage metrics", "seat assignments and reported plan types"],
+        missingFields: [
+            "GitHub admin token reference and organization or enterprise slug",
+            "AI-credit gross, discount, and net billing",
+            "license invoice settlement"
+        ]
     },
     {
         id: "codex",
         label: "Codex / OpenAI coding tools",
         preferredSourceType: "provider_api",
         preferredAccessMethod: "api",
-        verifiedFields: ["OpenAI project usage", "OpenAI costs", "tool/project attribution"],
-        missingFields: ["OpenAI admin API token reference", "project mapping"],
-        fallbackConnector: "browser_account"
+        verifiedFields: ["OpenAI organization costs", "OpenAI completions usage"],
+        missingFields: [
+            "OpenAI Admin API key reference",
+            "ChatGPT/Codex workspace seats, credits, and subscription billing",
+            "workspace-to-local-project mapping"
+        ]
     },
     {
         id: "cursor",
         label: "Cursor",
         preferredSourceType: "provider_api",
         preferredAccessMethod: "api",
-        verifiedFields: ["Cursor Admin API spend", "team usage", "seat usage"],
-        missingFields: ["Cursor admin API key reference or approved browser account session"],
-        fallbackConnector: "browser_account"
+        verifiedFields: ["Cursor Admin API team-member spend aggregate"],
+        missingFields: [
+            "Cursor team Admin API key reference",
+            "filtered usage-event detail and aggregate reconciliation",
+            "seat contract and final invoice settlement"
+        ]
     },
     {
         id: "gemini",
         label: "Google Gemini",
         preferredSourceType: "provider_api",
         preferredAccessMethod: "api",
-        verifiedFields: ["Google/Vertex billing export", "model usage"],
-        missingFields: ["approved billing export or API source"]
+        verifiedFields: [],
+        missingFields: [
+            "Google Cloud Billing export or approved billing API source",
+            "Gemini CLI authentication and billing mode",
+            "provider-reported billed money"
+        ]
     },
     {
         id: "langfuse",
@@ -136,35 +157,35 @@ export const providerCatalog = [
 export const providerConnectorCatalog = [
     {
         provider: "openai",
-        preferredAuthMode: "oauth",
-        fallbackAuthModes: ["api_token_ref", "browser_session"],
-        scopes: ["organization:usage:read", "organization:costs:read", "projects:read"],
+        preferredAuthMode: "api_token_ref",
+        fallbackAuthModes: [],
+        scopes: ["Organization Admin API usage read", "Organization Admin API costs read"],
         tokenStorage: "local_reference_only",
-        setupHint: "Prefer OAuth/admin consent for org usage and costs; fallback to a local keychain/token reference or dashboard export."
+        setupHint: "Use a local env reference to an OpenAI Organization Admin API key with usage and costs access; raw keys are never accepted on the command line."
     },
     {
         provider: "anthropic",
-        preferredAuthMode: "oauth",
-        fallbackAuthModes: ["api_token_ref", "browser_session"],
-        scopes: ["organization:usage:read", "organization:costs:read", "claude_code:usage:read"],
+        preferredAuthMode: "api_token_ref",
+        fallbackAuthModes: [],
+        scopes: ["Claude Console Admin cost report read", "Claude Code analytics read"],
         tokenStorage: "local_reference_only",
-        setupHint: "Prefer org/admin OAuth or admin API token reference for Claude cost and Claude Code usage reports."
+        setupHint: "Use a local env reference to a Claude Console organization Admin API key; Claude Enterprise Analytics requires a different key and is not implemented."
     },
     {
         provider: "github-copilot",
-        preferredAuthMode: "oauth",
-        fallbackAuthModes: ["api_token_ref", "browser_session"],
-        scopes: ["copilot:usage:read", "enterprise:read", "org:read"],
+        preferredAuthMode: "api_token_ref",
+        fallbackAuthModes: [],
+        scopes: ["fine-grained Administration: read", "organization or enterprise billing access"],
         tokenStorage: "local_reference_only",
-        setupHint: "Prefer GitHub App/OAuth read-only org or enterprise consent for Copilot seats and usage metrics."
+        setupHint: "Use a local env reference to a GitHub token with read-only organization or enterprise Copilot metrics and seat access; AI-credit billing is not implemented."
     },
     {
         provider: "cursor",
         preferredAuthMode: "api_token_ref",
-        fallbackAuthModes: ["browser_session", "manual_export"],
-        scopes: ["admin:*", "team:usage:read", "team:spend:read"],
+        fallbackAuthModes: [],
+        scopes: ["Cursor team Admin API spend read"],
         tokenStorage: "local_reference_only",
-        setupHint: "Use Cursor Admin API key reference for Enterprise team usage/spend when available; fallback to Browser Account UI or manual export."
+        setupHint: "Use a local env reference to a Cursor team Admin API key for the team spend aggregate; filtered usage-event and invoice reconciliation are not implemented."
     }
 ];
 export const defaultDeniedGlobs = [
@@ -215,6 +236,7 @@ export function addApprovedSource(registry, source, now = new Date()) {
     if (source.readOnly === false) {
         throw new Error("Approved source boundaries must remain read-only.");
     }
+    const browserScaffold = source.type === "browser_account";
     const nextSource = {
         id: source.id,
         type: source.type,
@@ -223,15 +245,17 @@ export function addApprovedSource(registry, source, now = new Date()) {
         ...(source.provider ? { provider: source.provider } : {}),
         readOnly: true,
         approvedAt: timestamp,
-        scope: source.scope ?? defaultScopeForSource(source.type),
+        scope: browserScaffold ? defaultScopeForSource(source.type) : (source.scope ?? defaultScopeForSource(source.type)),
         lane: source.lane ?? laneForSourceType(source.type),
         accessMethod: source.accessMethod ?? accessMethodForSourceType(source.type),
         boundaryApproval: source.boundaryApproval ?? "approved",
-        validationCoverage: source.validationCoverage ?? "untested",
-        financialEvidence: source.type === "local_folder" ? "missing" : (source.financialEvidence ?? "missing"),
-        fieldsVerified: source.fieldsVerified ?? [],
-        fieldsEstimated: source.fieldsEstimated ?? [],
-        fieldsMissing: source.fieldsMissing ?? [],
+        validationCoverage: browserScaffold ? "untested" : (source.validationCoverage ?? "untested"),
+        financialEvidence: source.type === "local_folder" || browserScaffold ? "missing" : (source.financialEvidence ?? "missing"),
+        fieldsVerified: browserScaffold ? [] : (source.fieldsVerified ?? []),
+        fieldsEstimated: browserScaffold ? [] : (source.fieldsEstimated ?? []),
+        fieldsMissing: browserScaffold
+            ? Array.from(new Set([...(source.fieldsMissing ?? []), browserAccountScaffoldMissingField]))
+            : (source.fieldsMissing ?? []),
         authMode: source.authMode,
         authScopes: source.authScopes,
         tokenStorage: source.tokenStorage,
@@ -250,6 +274,7 @@ export function createProviderConnectorStub(provider, type = providerCatalog.fin
     const catalogEntry = providerCatalog.find((entry) => entry.id === provider);
     const connectorEntry = providerConnectorCatalog.find((entry) => entry.provider === provider);
     const id = slugifySourceId(`${provider}-${type}`);
+    const browserScaffold = type === "browser_account";
     return {
         id,
         type,
@@ -265,9 +290,14 @@ export function createProviderConnectorStub(provider, type = providerCatalog.fin
         // A successful provider result promotes this axis explicitly.
         validationCoverage: "untested",
         financialEvidence: "missing",
-        fieldsVerified: catalogEntry?.verifiedFields ?? [],
+        fieldsVerified: browserScaffold ? [] : (catalogEntry?.verifiedFields ?? []),
         fieldsEstimated: [],
-        fieldsMissing: catalogEntry?.missingFields ?? ["approved account/API/export source"],
+        fieldsMissing: browserScaffold
+            ? Array.from(new Set([
+                ...(catalogEntry?.missingFields ?? []),
+                browserAccountScaffoldMissingField
+            ]))
+            : (catalogEntry?.missingFields ?? ["approved account/API/export source"]),
         authMode: authModeForConnectorType(type, connectorEntry),
         authScopes: connectorEntry?.scopes ?? [],
         tokenStorage: tokenStorageForConnectorType(type, connectorEntry)
@@ -377,6 +407,7 @@ function normalizeApprovedSource(value) {
         : isFinancialEvidence(value.verification)
             ? value.verification
             : "missing";
+    const browserScaffold = value.type === "browser_account";
     return {
         id: value.id,
         type: value.type,
@@ -385,17 +416,21 @@ function normalizeApprovedSource(value) {
         ...(provider ? { provider } : {}),
         readOnly: true,
         approvedAt: value.approvedAt,
-        scope: value.scope,
+        scope: browserScaffold ? defaultScopeForSource(value.type) : value.scope,
         lane: value.lane,
         accessMethod: value.accessMethod,
         boundaryApproval: "approved",
-        validationCoverage: isValidationCoverage(value.validationCoverage)
-            ? value.validationCoverage
-            : "untested",
-        financialEvidence: value.type === "local_folder" ? "missing" : migratedEvidence,
-        fieldsVerified: [...value.fieldsVerified],
-        fieldsEstimated: [...value.fieldsEstimated],
-        fieldsMissing: [...value.fieldsMissing],
+        validationCoverage: browserScaffold
+            ? "untested"
+            : isValidationCoverage(value.validationCoverage)
+                ? value.validationCoverage
+                : "untested",
+        financialEvidence: value.type === "local_folder" || browserScaffold ? "missing" : migratedEvidence,
+        fieldsVerified: browserScaffold ? [] : [...value.fieldsVerified],
+        fieldsEstimated: browserScaffold ? [] : [...value.fieldsEstimated],
+        fieldsMissing: browserScaffold
+            ? Array.from(new Set([...value.fieldsMissing, browserAccountScaffoldMissingField]))
+            : [...value.fieldsMissing],
         ...(authMode ? { authMode } : {}),
         ...(value.authScopes ? { authScopes: [...value.authScopes] } : {}),
         ...(tokenStorage ? { tokenStorage } : {}),
@@ -443,7 +478,7 @@ export function buildMissingSourcePrompts(signals, registry) {
         prompts.push({
             provider,
             status: "detected_unverified",
-            reason: `${provider} was detected locally, but no approved provider/API/browser/export boundary has current financial evidence. Connector validation is reported separately.`,
+            reason: `${provider} was detected locally, but no approved implemented source has current financial evidence. Connector validation is reported separately.`,
             detectedEvidence: detectedSignals.map((signal) => signal.evidence),
             suggestedConnector: `connect ${provider} --type ${preferredType}`,
             suggestedSourceTypes
@@ -490,7 +525,10 @@ function hasCurrentProviderFinancialEvidence(registry, provider) {
         return source.boundaryApproval === "approved" &&
             source.validationCoverage !== "failed" &&
             source.financialEvidence !== "missing" &&
-            source.type !== "local_tool_detection";
+            source.type !== "local_tool_detection" &&
+            // browser_account is reserved in the schema but has no ingestion
+            // implementation. Repository state cannot promote the scaffold.
+            source.type !== "browser_account";
     });
 }
 function validationCoverageForSource(provider, type) {
@@ -523,7 +561,7 @@ function defaultScopeForSource(type) {
         return "Read-only provider API/account usage source. Store token references only; no raw secrets. No billing changes. No cloud upload.";
     }
     if (type === "browser_account") {
-        return "Read-only Browser Account UI source. User logs in locally; agent never sees passwords; 2FA/CAPTCHA handoff; audit all page reads/downloads.";
+        return "Schema scaffold only. Browser-account ingestion is not implemented and cannot produce financial evidence or satisfy a missing-source prompt.";
     }
     if (type === "local_tool_detection") {
         return "Read-only local CLI/tool detection path. Detection is not official provider-reported cost; connect an account API or export to add that evidence.";

package/dist/sourceStatus.d.ts

@@ -1,4 +1,5 @@
 import type { CostConfidence, UsageRecord } from "./schema.js";
+import type { SourceRegistry } from "./sourceRegistry.js";
 import type { LocalAgentFormatId } from "./localAgentFormats/types.js";
 /**
  * How thoroughly an ingestion path itself has been exercised.
@@ -12,6 +13,8 @@ export type SourceValidationCoverage = typeof sourceValidationCoverageValues[num
 export type FinancialEvidenceStatus = CostConfidence;
 export declare const sourceFreshnessStatusValues: readonly ["fresh", "stale", "not_checked"];
 export type SourceFreshnessStatus = typeof sourceFreshnessStatusValues[number];
+export declare const providerContractStateValues: readonly ["current", "stale_contract"];
+export type ProviderContractState = typeof providerContractStateValues[number];
 export type SourceStatusId = LocalAgentFormatId | "openai" | "anthropic" | "cursor" | "github-copilot";
 export type SourceStatusDefinition = {
     id: SourceStatusId;
@@ -19,6 +22,8 @@ export type SourceStatusDefinition = {
     validationCoverage: SourceValidationCoverage;
     validationNote: string;
     staleAfterHours: number;
+    /** Review state of the provider/parser financial semantics used by this source. */
+    contractState?: ProviderContractState;
 };
 export type SourceStatusObservation = {
     id: SourceStatusId;
@@ -32,6 +37,8 @@ export type SourceStatusObservation = {
     lastError?: string;
     /** Runtime failures may override the shipped validation baseline. */
     validationCoverage?: SourceValidationCoverage;
+    /** A drift monitor or reviewed contract update may fail this source closed. */
+    contractState?: ProviderContractState;
 };
 export type SourceStatusFreshness = {
     status: SourceFreshnessStatus;
@@ -46,6 +53,7 @@ export type SourceStatus = {
     validationNote: string;
     financialEvidence: FinancialEvidenceStatus;
     financialEvidenceNote: string;
+    contractState?: ProviderContractState;
     freshness: SourceStatusFreshness;
     lastError?: string;
 };
@@ -55,12 +63,26 @@ export type SourceStatus = {
  * reconciliation.
  */
 export declare const sourceStatusDefinitions: readonly SourceStatusDefinition[];
-export declare function buildSourceStatuses(observations?: readonly SourceStatusObservation[], now?: Date): SourceStatus[];
+export declare function buildSourceStatuses(observations?: readonly SourceStatusObservation[], now?: Date, definitions?: readonly SourceStatusDefinition[]): SourceStatus[];
 /**
  * Reduce one source's current rows to the evidence label used for its headline.
  * Verified billed cost wins; otherwise estimates win over an unpriced signal.
  */
 export declare function financialEvidenceForRecords(records: readonly UsageRecord[]): FinancialEvidenceStatus;
+/**
+ * Apply the reviewed provider-contract gate before any connected financial
+ * calculation. Local transcript evidence is unchanged. When a provider's
+ * financial semantics are stale, its priced rows remain present for audit and
+ * attribution but cannot carry a dollar amount or proof-level confidence.
+ */
+export declare function applyProviderContractGate(records: readonly UsageRecord[], definitions?: readonly SourceStatusDefinition[]): UsageRecord[];
+/**
+ * Project persisted source metadata through the same fail-closed contract
+ * gate as records. This is read-time only: the signed local receipt remains
+ * byte-exact, while an upgraded release cannot repeat an obsolete verified
+ * claim from an older sources.json.
+ */
+export declare function applyProviderContractGateToSourceRegistry(registry: SourceRegistry, definitions?: readonly SourceStatusDefinition[]): SourceRegistry;
 /** Stable, plain-text formatter shared by terminal surfaces. */
 export declare function formatSourceStatuses(statuses: readonly SourceStatus[]): string;
 //# sourceMappingURL=sourceStatus.d.ts.map

package/dist/sourceStatus.js

@@ -1,4 +1,5 @@
 import { localAgentFormatDescriptors } from "./localAgentFormats/registry.js";
+import { generatedProviderContractStates } from "./providerContractStates.generated.js";
 /**
  * How thoroughly an ingestion path itself has been exercised.
  *
@@ -12,6 +13,7 @@ export const sourceValidationCoverageValues = [
     "failed"
 ];
 export const sourceFreshnessStatusValues = ["fresh", "stale", "not_checked"];
+export const providerContractStateValues = ["current", "stale_contract"];
 /**
  * Shipped validation matrix. Keep these claims proof-conservative: a live
  * authentication check is not the same as a non-empty end-to-end billing
@@ -23,48 +25,67 @@ export const sourceStatusDefinitions = [
         label: `${descriptor.label} local logs`,
         validationCoverage: descriptor.confidenceDefaults.validationCoverage,
         validationNote: descriptor.validationNote,
-        staleAfterHours: 72
+        staleAfterHours: 72,
+        ...(descriptor.id === "gemini-cli"
+            ? { contractState: generatedProviderContractStates["gemini-cli"] }
+            : {})
     })),
     {
         id: "openai",
         label: "OpenAI Costs and Usage API",
         validationCoverage: "live_verified",
         validationNote: "Product connector QA exercised non-empty Admin cost and usage API paths; the tested Costs total reconciled to invoiced API credits less the provider-UI balance with $0.00 variance. This does not reconcile the current user's account; final invoices, tax, discounts, and later adjustments remain separate.",
-        staleAfterHours: 48
+        staleAfterHours: 48,
+        contractState: generatedProviderContractStates.openai
     },
     {
         id: "anthropic",
         label: "Anthropic Cost Report and Claude Code Analytics",
         validationCoverage: "live_verified",
         validationNote: "Admin cost and Claude Code usage paths are exercised with non-empty live records.",
-        staleAfterHours: 48
+        staleAfterHours: 48,
+        contractState: generatedProviderContractStates.anthropic
     },
     {
         id: "cursor",
         label: "Cursor Admin API",
         validationCoverage: "fixture_verified",
         validationNote: "Canonical teamMemberSpend envelopes, totalPages pagination, completeness failures, and malformed responses pass recorded fixtures; live account QA is pending.",
-        staleAfterHours: 48
+        staleAfterHours: 48,
+        contractState: generatedProviderContractStates.cursor
     },
     {
         id: "github-copilot",
         label: "GitHub Copilot organization APIs",
         validationCoverage: "fixture_verified",
         validationNote: "The 2026-03-10 signed-NDJSON metrics workflow, seat pagination, per-seat plan types, and failure paths pass recorded fixtures; live account QA is pending.",
-        staleAfterHours: 48
+        staleAfterHours: 48,
+        contractState: generatedProviderContractStates["github-copilot"]
     }
 ];
-export function buildSourceStatuses(observations = [], now = new Date()) {
+export function buildSourceStatuses(observations = [], now = new Date(), definitions = sourceStatusDefinitions) {
     const byId = new Map(observations.map((observation) => [observation.id, observation]));
-    return sourceStatusDefinitions.map((definition) => {
+    return definitions.map((definition) => {
         const observation = byId.get(definition.id);
+        const observedContractState = observation?.contractState;
+        const contractState = definition.contractState === "stale_contract" || observedContractState === "stale_contract"
+            ? "stale_contract"
+            : definition.contractState;
+        const observedFinancialEvidence = observation?.financialEvidence ?? "missing";
+        const financialEvidence = contractState === "stale_contract" && observedFinancialEvidence === "verified"
+            ? "missing"
+            : observedFinancialEvidence;
+        const financialEvidenceNote = contractState === "stale_contract" && observedFinancialEvidence === "verified"
+            ? "Provider contract drift is unresolved; the verified financial headline is withheld pending human review."
+            : observation?.financialEvidenceNote ?? "No current financial evidence was observed on this machine.";
         return {
             id: definition.id,
             label: definition.label,
             validationCoverage: observation?.validationCoverage ?? definition.validationCoverage,
             validationNote: definition.validationNote,
-            financialEvidence: observation?.financialEvidence ?? "missing",
-            financialEvidenceNote: observation?.financialEvidenceNote ?? "No current financial evidence was observed on this machine.",
+            financialEvidence,
+            financialEvidenceNote,
+            ...(contractState ? { contractState } : {}),
             freshness: sourceFreshness(definition, observation, now),
             ...(observation?.lastError ? { lastError: observation.lastError } : {})
         };
@@ -86,6 +107,79 @@ export function financialEvidenceForRecords(records) {
     }
     return "missing";
 }
+/**
+ * Apply the reviewed provider-contract gate before any connected financial
+ * calculation. Local transcript evidence is unchanged. When a provider's
+ * financial semantics are stale, its priced rows remain present for audit and
+ * attribution but cannot carry a dollar amount or proof-level confidence.
+ */
+export function applyProviderContractGate(records, definitions = sourceStatusDefinitions) {
+    const contractStates = new Map(definitions
+        .filter((definition) => definition.contractState !== undefined)
+        .map((definition) => [definition.id, definition.contractState]));
+    return records.map((record) => {
+        if (record.providerCostType === "local_agent_logs")
+            return record;
+        const sourceId = providerStatusIdForRecord(record);
+        if (!sourceId || contractStates.get(sourceId) !== "stale_contract")
+            return record;
+        return {
+            ...record,
+            source: { ...record.source, confidence: "missing" },
+            amountUsd: null,
+            costConfidence: "missing"
+        };
+    });
+}
+/**
+ * Project persisted source metadata through the same fail-closed contract
+ * gate as records. This is read-time only: the signed local receipt remains
+ * byte-exact, while an upgraded release cannot repeat an obsolete verified
+ * claim from an older sources.json.
+ */
+export function applyProviderContractGateToSourceRegistry(registry, definitions = sourceStatusDefinitions) {
+    const states = new Map(definitions
+        .filter((definition) => definition.contractState !== undefined)
+        .map((definition) => [definition.id, definition.contractState]));
+    return {
+        ...registry,
+        approvedSources: registry.approvedSources.map((source) => {
+            if (source.type !== "provider_api")
+                return source;
+            const statusId = providerStatusIdForProvider(source.provider);
+            if (!statusId || states.get(statusId) !== "stale_contract")
+                return source;
+            const baseScope = source.scope.split(" Last successful pull produced ")[0]?.trim() || source.scope;
+            return {
+                ...source,
+                financialEvidence: "missing",
+                fieldsMissing: Array.from(new Set([
+                    ...source.fieldsMissing,
+                    "provider financial headline (contract review required)"
+                ])),
+                scope: `${baseScope} Provider contract drift is unresolved; prior financial evidence and headline are withheld.`
+            };
+        })
+    };
+}
+function providerStatusIdForRecord(record) {
+    if (record.source.provider === "google" && record.agentId === "gemini-cli")
+        return "gemini-cli";
+    return providerStatusIdForProvider(record.source.provider);
+}
+function providerStatusIdForProvider(provider) {
+    if (provider === "openai")
+        return "openai";
+    if (provider === "anthropic")
+        return "anthropic";
+    if (provider === "cursor")
+        return "cursor";
+    if (provider === "github" || provider === "github-copilot" || provider === "copilot")
+        return "github-copilot";
+    if (provider === "google" || provider === "gemini")
+        return "gemini-cli";
+    return undefined;
+}
 /** Stable, plain-text formatter shared by terminal surfaces. */
 export function formatSourceStatuses(statuses) {
     return statuses.map((status) => {
@@ -93,6 +187,7 @@ export function formatSourceStatuses(statuses) {
         return [
             `${status.label} (${status.id})`,
             `  validation coverage: ${status.validationCoverage}`,
+            ...(status.contractState ? [`  provider contract: ${status.contractState}`] : []),
             `  financial evidence: ${status.financialEvidence}`,
             `  freshness: ${freshness}`,
             `  last error: ${status.lastError ? singleLineStatusText(status.lastError) : "none recorded"}`,

package/dist/stateTrust.js

@@ -39,7 +39,7 @@ export async function verifyConnectedSpendTrustReceipt(rootPath, exactSpendConte
         if (isNodeError(error, "ENOENT")) {
             return missingTrust();
         }
-        return invalidTrust(error instanceof Error ? error.message : String(error));
+        return invalidTrust("the external trust directory failed safety validation");
     }
     let rawReceipt;
     try {
@@ -48,7 +48,7 @@ export async function verifyConnectedSpendTrustReceipt(rootPath, exactSpendConte
     catch (error) {
         if (isNodeError(error, "ENOENT"))
             return missingTrust();
-        return invalidTrust(error instanceof Error ? error.message : String(error));
+        return invalidTrust("the external provider-sync receipt failed safety validation");
     }
     let receipt;
     try {

package/package.json

@@ -1,9 +1,16 @@
 {
   "name": "@agent-finops/core",
-  "version": "0.7.3",
+  "version": "0.8.1",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
   "scripts": {
     "build": "tsc -b",
     "typecheck": "tsc -b --pretty false",