@agent-finops/core 0.9.2 → 0.9.3

package/dist/activitySnapshotCache.js

@@ -1,6 +1,6 @@
 import { constants } from "node:fs";
 import { execFile as execFileCallback } from "node:child_process";
-import { open, lstat, mkdir, chmod, realpath, rename, unlink } from "node:fs/promises";
+import { open, lstat, mkdir, chmod, readdir, realpath, rename, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join, relative, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -343,12 +343,48 @@ async function ensureDefaultParent(homeDirectory, create) {
         throw new ActivitySnapshotCacheError("unsafe_directory", "The private aibill directory is not a real directory.");
     }
     if (!create && !hasPrivatePermissions(info.mode)) {
-        throw new ActivitySnapshotCacheError("unsafe_directory", "The private aibill directory is not private.");
+        // Self-heal (NEW-B1): 0.9.2's signup/telemetry state writers created
+        // ~/.aibill without a mode (755 under the default umask), which this
+        // guard then refused forever — bricking init on machines that ran
+        // 0.9.2 in that window. When the directory holds ONLY our own state
+        // files (no cache/ yet, nothing foreign), tighten it to 0700 and
+        // proceed instead of erroring. Anything unexpected still refuses.
+        if (!await selfHealStateOnlyAibillDirectory(parent)) {
+            throw new ActivitySnapshotCacheError("unsafe_directory", `The private aibill directory is not private. Fix: chmod 700 ${parent}`);
+        }
     }
     if (create)
         await chmod(parent, 0o700);
     await ensureDefaultCacheGitPrivacy(parent, create);
 }
+/**
+ * The complete set of files aibill's own home-scope state writers may have
+ * placed in ~/.aibill before any cache exists. A directory with exactly
+ * these contents (or fewer) is provably ours to repair.
+ */
+const selfHealableAibillEntries = new Set([
+    "signup.json",
+    "signup.json.tmp",
+    "telemetry.json",
+    "telemetry.json.tmp",
+    ".gitignore"
+]);
+async function selfHealStateOnlyAibillDirectory(parent) {
+    try {
+        const entries = await readdir(parent, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isFile() || !selfHealableAibillEntries.has(entry.name))
+                return false;
+        }
+        await chmod(parent, 0o700);
+        const confirmed = await lstat(parent);
+        return !confirmed.isSymbolicLink() && confirmed.isDirectory() &&
+            hasPrivatePermissions(confirmed.mode);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * When a synthetic or real HOME is itself inside a Git worktree, protect the
  * complete top-level private state directory before any cache child is

package/dist/emailAddress.d.ts

@@ -0,0 +1,7 @@
+/**
+ * One intentionally pragmatic normalizer for waitlist and receipt-email
+ * boundaries. It prevents header/control injection without pretending to be
+ * a mailbox-verification system; ownership still requires an explicit flow.
+ */
+export declare function normalizeAibillEmailAddress(value: string): string | undefined;
+//# sourceMappingURL=emailAddress.d.ts.map

package/dist/emailAddress.js

@@ -0,0 +1,16 @@
+const controlCharacters = /[\u0000-\u001F\u007F]/u;
+const pragmaticEmailAddress = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
+/**
+ * One intentionally pragmatic normalizer for waitlist and receipt-email
+ * boundaries. It prevents header/control injection without pretending to be
+ * a mailbox-verification system; ownership still requires an explicit flow.
+ */
+export function normalizeAibillEmailAddress(value) {
+    const normalized = value.trim().toLowerCase();
+    if (normalized.length < 3 || normalized.length > 254)
+        return undefined;
+    if (controlCharacters.test(normalized))
+        return undefined;
+    return pragmaticEmailAddress.test(normalized) ? normalized : undefined;
+}
+//# sourceMappingURL=emailAddress.js.map

package/dist/receiptShare.d.ts

@@ -27,9 +27,9 @@ export declare const receiptShareCardV0Schema: z.ZodObject<{
     currency: z.ZodLiteral<"USD">;
     windowDays: z.ZodNumber;
     mode: z.ZodEnum<{
-        "local-logs": "local-logs";
-        connected: "connected";
         mixed: "mixed";
+        connected: "connected";
+        "local-logs": "local-logs";
     }>;
     financials: z.ZodObject<{
         subscriptionCommitted: z.ZodObject<{
@@ -47,8 +47,8 @@ export declare const receiptShareCardV0Schema: z.ZodObject<{
         providerBilled: z.ZodObject<{
             amountUsd: z.ZodNullable<z.ZodNumber>;
             financialEvidence: z.ZodEnum<{
-                missing: "missing";
                 verified: "verified";
+                missing: "missing";
             }>;
         }, z.core.$strict>;
         blended: z.ZodNull;
@@ -58,9 +58,9 @@ export declare const receiptShareCardV0Schema: z.ZodObject<{
     recordCount: z.ZodNumber;
     confidence: z.ZodEnum<{
         estimated: "estimated";
-        missing: "missing";
         verified: "verified";
         detected_unverified: "detected_unverified";
+        missing: "missing";
     }>;
     cuts: z.ZodArray<z.ZodObject<{
         template: z.ZodEnum<{
@@ -89,9 +89,9 @@ export declare const receiptEmailRequestV0Schema: z.ZodObject<{
         currency: z.ZodLiteral<"USD">;
         windowDays: z.ZodNumber;
         mode: z.ZodEnum<{
-            "local-logs": "local-logs";
-            connected: "connected";
             mixed: "mixed";
+            connected: "connected";
+            "local-logs": "local-logs";
         }>;
         financials: z.ZodObject<{
             subscriptionCommitted: z.ZodObject<{
@@ -109,8 +109,8 @@ export declare const receiptEmailRequestV0Schema: z.ZodObject<{
             providerBilled: z.ZodObject<{
                 amountUsd: z.ZodNullable<z.ZodNumber>;
                 financialEvidence: z.ZodEnum<{
-                    missing: "missing";
                     verified: "verified";
+                    missing: "missing";
                 }>;
             }, z.core.$strict>;
             blended: z.ZodNull;
@@ -120,9 +120,9 @@ export declare const receiptEmailRequestV0Schema: z.ZodObject<{
         recordCount: z.ZodNumber;
         confidence: z.ZodEnum<{
             estimated: "estimated";
-            missing: "missing";
             verified: "verified";
             detected_unverified: "detected_unverified";
+            missing: "missing";
         }>;
         cuts: z.ZodArray<z.ZodObject<{
             template: z.ZodEnum<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-finops/core",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "funding": "https://asktilden.com",
   "type": "module",
   "main": "./dist/index.js",