@mafdet/cli 0.4.10 → 0.4.12

package/CHANGELOG.md

@@ -6,17 +6,59 @@ The version is the contract for the JSON output shapes and the exit codes.
 Being 0.x, semver still permits a break in a minor bump; the intent is not to
 use that latitude, and the promise becomes binding at 1.0.0.
 
+## 0.4.12 - 2026-08-12
+
+- Validate usage-event pages, model identities, non-stream Chat responses and
+  Agent tool calls at the HTTP boundary. Malformed remote data now produces a
+  typed unavailable error instead of an empty success or a runtime exception.
+- Require account and settled ledger amounts to be non-negative integer
+  micro-USD strings. An invalid settlement remains pending; it is never
+  rewritten as a fabricated zero-dollar settlement.
+- Correct the reconciliation documentation: refresh queries the current key's
+  paged usage-event window and matches request IDs locally, while retaining
+  local estimates alongside settled figures.
+
+## 0.4.11 - 2026-08-12
+
+A seventh audit round, fixed at the root rather than sink by sink - which is
+what the first round asked for and what six rounds of patching individual
+strings failed to do.
+
+**One boundary for human-readable output.** Interactive agent failures,
+model-controlled tool names and results, the command-line approval preview,
+TUI tool cards, account tables and model retirement text all go through it
+now. Previously each was a separate string that someone had to remember. The
+approval preview mattered most: a control sequence there can redraw the diff
+between what you are shown and what you are agreeing to.
+
+**One definition of a price.** `isMicroUsd` is shared by the agent's cost
+ceiling, chat estimates, `models show` and the TUI picker. A catalogue serving
+`abc` used to crash `models show` and the model picker outright, and in chat it
+threw _after_ the request had been paid for, losing the answer and the saved
+session with it. Invalid prices now read as unknown, and `"0"` is still a
+price.
+
+**Remote JSON is validated where it arrives.** Catalogue, wallet, usage and
+subscription responses are checked at the HTTP boundary instead of being
+trusted because TypeScript describes them. Malformed token counts are ignored
+rather than entering totals or BigInt arithmetic.
+
+Machine output is unchanged throughout: `--json`, `--plain` and redirected
+streams still carry exactly what the server sent.
+
 ## 0.4.10 - 2026-08-12
 
 A sixth audit round, and the finding that matters most is about how the last
 one was tested.
 
-**Every human-readable error now goes through one function.** 0.4.9 said this
-and it was not true: `embed` and `speech` handled a surface mismatch
-themselves, `mafdet agent` printed the upstream's message directly, and the
-request id - which comes from a response header - was concatenated outside the
-sanitiser inside the very function meant to be the boundary. Four paths, all
-carrying remote text to a terminal.
+**Four previously missed error paths now share one function.** 0.4.9 said every
+human-readable error used it, which was still too broad: the interactive Agent
+and other human-output paths were found separately and are fixed under
+Unreleased. The four 0.4.10 paths were: `embed` and `speech` handled a surface
+mismatch themselves, `mafdet agent` printed the upstream's message directly,
+and the request id - which comes from a response header - was concatenated
+outside the sanitiser inside the very function meant to be the boundary. All
+four carried remote text to a terminal.
 
 The test that was supposed to cover this called the sanitiser directly, so it
 passed while every caller bypassed it. That is the same mistake as the one in
@@ -313,9 +355,10 @@ each platform, and that deleting one is an ordinary file delete rather than a
 secure erase.
 
 `mafdet sessions usage <id> --refresh` asks the billing ledger what the
-requests actually cost and replaces the local estimate with the settled
-figure. It sends the request IDs already in the transcript and nothing else -
-no messages, no title, no workspace, no session ID. Requests paid for by a
+requests actually cost and records the settled figure alongside the local
+estimate. **Correction:** it queries the current key's paged usage-event
+window; request IDs stay local for matching rather than being sent. No
+messages, title, workspace or session ID leave the machine. Requests paid for by a
 different API key are left alone and reported rather than guessed at, and a
 request the ledger has not settled stays `pending` rather than being shown as
 zero.

package/README.md

@@ -3,7 +3,7 @@
 The official Mafdet AI command line: model calls, account queries, and a
 permissioned local agent.
 
-> **0.4.10.** 中文版见 [README.zh-CN.md](./README.zh-CN.md). The CLI never
+> **0.4.12.** 中文版见 [README.zh-CN.md](./README.zh-CN.md). The CLI never
 > advertises a command it cannot serve, so `mafdet help` always lists exactly
 > what works.
 >
@@ -23,8 +23,8 @@ Or build it from this repository:
 
 ```bash
 pnpm --filter @mafdet/cli build
-cd packages/cli && npm pack          # -> mafdet-cli-0.4.10.tgz
-npm install -g ./mafdet-cli-0.4.10.tgz
+cd packages/cli && npm pack          # -> mafdet-cli-0.4.12.tgz
+npm install -g ./mafdet-cli-0.4.12.tgz
 ```
 
 ## The interactive session
@@ -87,7 +87,7 @@ prompt as an argument, or use `--input <file>`.
 | `mafdet speech [text\|<file>] --model <id> --output <file> --voice <name>`                           | Text to an audio file                                                      |
 | `mafdet account balance\|usage\|subscription`                                                        | Wallet, spend and plan (needs the `account:read` scope)                    |
 | `mafdet sessions list\|show\|usage\|delete`                                                          | Conversations saved on this computer (never calls a model)                 |
-| `mafdet sessions usage <id> --refresh`                                                               | Replace the local estimate with the billing ledger's figure                |
+| `mafdet sessions usage <id> --refresh`                                                               | Show settled ledger figures alongside the local estimate                   |
 | `mafdet config list`                                                                                 | The resolved settings and where each came from                             |
 
 `--json` on any query command emits one complete JSON document; `--plain`
@@ -247,9 +247,10 @@ erase — backups, snapshots and the filesystem itself may still hold copies.
 record. Those charges are estimates, computed with the gateway's own
 arithmetic but computed here.
 
-`--refresh` asks the billing ledger for the real figure. It sends the request
-IDs already in the transcript and nothing else — no messages, no title, no
-workspace, no session ID. Requests paid for by a different API key are left
+`--refresh` asks the billing ledger for settled figures. It pages through the
+current API key's usage events for the session's time window; request IDs stay
+local and are used only to match returned rows. No messages, title, workspace
+or session ID are sent. Requests paid for by a different API key are left
 alone and reported, so you know to run it again with that key.
 
 A request that the ledger has not caught up with stays `pending`, and a request

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 Mafdet AI 官方命令行：模型调用、账户查询，以及一个受权限约束的本地 Agent。
 
-> **0.4.10。** 英文版见 [README.md](./README.md)。
+> **0.4.12。** 英文版见 [README.md](./README.md)。
 
 ## 环境要求
 
@@ -73,7 +73,7 @@ mafdet doctor
 | `mafdet agent`（不带目标，需终端）                                                                   | 交互会话                                                            |
 | `mafdet account balance\|usage\|subscription`                                                        | 钱包、用量、套餐（需 `account:read` scope）                         |
 | `mafdet sessions list\|show\|usage\|delete`                                                          | 保存在这台电脑上的会话（不会调用模型）                              |
-| `mafdet sessions usage <id> --refresh`                                                               | 用账单账本的权威金额替换本地估算                                    |
+| `mafdet sessions usage <id> --refresh`                                                               | 在本地估算旁显示账单账本的已结算金额                                |
 | `mafdet config list`                                                                                 | 当前生效的配置及其来源                                              |
 
 查询类命令都支持 `--json`（输出一份完整 JSON 文档）与 `--plain`（无表头的 TSV，方便
@@ -214,9 +214,9 @@ mafdet sessions delete <id> --yes
 `mafdet sessions usage <id>` 从本地记录累加一次会话的用量。那些金额是**估算**，
 算法与网关一致，但是在本地算的。
 
-`--refresh` 会去问账单账本要真实金额。它只发送存档里已有的 request ID，**别的什么都不发**——
-不发消息、不发标题、不发工作区路径、不发 session ID。由另一把 API Key 支付的请求会被跳过
-并如实告知，好让你知道该换那把 Key 再跑一次。
+`--refresh` 会按会话时间窗口和游标查询当前 API Key 的用量事件；request ID 只留在本地，
+用于匹配账本返回的记录。它不发送消息、标题、工作区路径或 session ID。由另一把 API Key
+支付的请求会被跳过并如实告知，好让你知道该换那把 Key 再跑一次。
 
 账本还没跟上的请求保持 `pending`，从未拿到 ID 的请求保持 `unknown`。
 **两者都绝不显示为 `0`**——0 读起来像「免费」。

package/dist/agent/approvals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../../src/agent/approvals.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,EAAE,QAIrB,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,UAAU,EAAE,QAIxB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE;IACtC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAChC,GAAG,QAAQ,CAgBX;AAED,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;AAEjE;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE;IAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EACtC,aAAa,GAAE,OAAsC,GACpD,QAAQ,CAIV"}
+{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../../src/agent/approvals.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrD;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,EAAE,QAIrB,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,UAAU,EAAE,QAIxB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE;IACtC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAChC,GAAG,QAAQ,CAwBX;AAED,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;AAEjE;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE;IAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EACtC,aAAa,GAAE,OAAsC,GACpD,QAAQ,CAIV"}

package/dist/agent/approvals.js

@@ -1,4 +1,5 @@
 import { createInterface } from "node:readline/promises";
+import { safeForTerminal } from "../output/terminal-safe.js";
 /**
  * `read-only`, and every non-interactive run that has not been given explicit
  * permission. Plan §8.1: a CI job must not acquire write access by accident,
@@ -24,7 +25,13 @@ export const approveAll = {
 export function interactiveApprover(io) {
     return {
         async approve(request) {
-            io.stderr(`\n${request.summary}\n${request.preview}\n`);
+            // Always sanitised, unlike every other stderr write, and the exception
+            // is deliberate: this prompt only exists when a person is about to
+            // answer it, and the answer decides whether a file is written. A control
+            // sequence here could clear the screen or redraw the diff between what
+            // is shown and what is asked. There is no redirected-output case to
+            // preserve bytes for - a redirected run cannot answer the prompt.
+            io.stderr(safeForTerminal(`\n${request.summary}\n${request.preview}\n`, true));
             const rl = createInterface({
                 input: io.input ?? process.stdin,
                 output: io.output ?? process.stderr,

package/dist/agent/loop.d.ts

@@ -1,3 +1,4 @@
+import { type ToolCall } from "../api/chat-response.js";
 import type { HttpClient } from "../api/http.js";
 import type { CatalogModel } from "../api/models.js";
 import type { Approver } from "./approvals.js";
@@ -146,14 +147,6 @@ export interface ChatMessage {
     tool_calls?: ToolCall[];
     tool_call_id?: string;
 }
-interface ToolCall {
-    id: string;
-    type: "function";
-    function: {
-        name: string;
-        arguments: string;
-    };
-}
 /**
  * The read-only agent loop.
  *
@@ -180,5 +173,4 @@ export declare function backoffMs(retryAfterSeconds: number | undefined, attempt
  * direction - a free model would have been refused.
  */
 export declare function hasValidPrices(model: CatalogModel | undefined): boolean;
-export {};
 //# sourceMappingURL=loop.d.ts.map

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc;AAChB,8EAA8E;GAC5E,eAAe;AACjB;;;;GAIG;GACD,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAYD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAiP1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR;AAwBD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAKvE"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AAMjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc;AAChB,8EAA8E;GAC5E,eAAe;AACjB;;;;GAIG;GACD,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAgP1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR;AA8BD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAKvE"}

package/dist/agent/loop.js

@@ -1,5 +1,7 @@
 import { ApiError } from "../api/errors.js";
+import { parseChatCompletion, } from "../api/chat-response.js";
 import { compactUntilItFits, requestSize, shouldCompact, } from "./context-budget.js";
+import { isMicroUsd } from "../output/money.js";
 import { toolToJsonSchema, } from "./tools/types.js";
 /** Plan §7.4. */
 export const DEFAULT_LIMITS = {
@@ -129,7 +131,7 @@ export async function runAgent(options) {
         // report and fed into the compaction ratio - it no longer priced anything,
         // but it still produced negative token totals and steered a decision about
         // what to send next.
-        const usage = response.usage;
+        const usage = usageObject(response.usage);
         const promptTokens = isTokenCount(usage?.prompt_tokens)
             ? usage.prompt_tokens
             : undefined;
@@ -161,9 +163,8 @@ export async function runAgent(options) {
         });
         if (!canPrice(options.pricing, usage))
             report.unpricedRequests += 1;
-        const choice = response.choices?.[0];
-        const message = choice?.message;
-        const calls = message?.tool_calls ?? [];
+        const message = response.choices[0].message;
+        const calls = message.tool_calls ?? [];
         if (typeof message?.content === "string" && message.content.length > 0) {
             report.finalText = message.content;
             options.onEvent?.({ type: "text", text: message.content });
@@ -294,7 +295,7 @@ async function requestWithRateLimitHandling(options, limits, body, report, clock
             const { data, requestId } = await options.client.postJson("/chat/completions", body, { signal: options.signal });
             // Carried on the response so the caller can tie this turn to its ledger
             // row without the loop needing to know what a session is.
-            return { ...data, requestId };
+            return { ...parseChatCompletion(data, "agent API"), requestId };
         }
         catch (error) {
             // Everything except an explicit 429 propagates. A timeout or a 5xx may
@@ -345,9 +346,10 @@ export function backoffMs(retryAfterSeconds, attempt, random = Math.random) {
 function isTokenCount(value) {
     return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
-/** Integer micro-USD, non-negative. Anything else is not a price. */
-function isPrice(value) {
-    return typeof value === "string" && /^\d+$/.test(value);
+function usageObject(value) {
+    return value !== null && typeof value === "object"
+        ? value
+        : undefined;
 }
 /**
  * W-1 · Can this model be priced at all, before anything is sent?
@@ -362,8 +364,8 @@ function isPrice(value) {
  * direction - a free model would have been refused.
  */
 export function hasValidPrices(model) {
-    return (isPrice(model?.inputPricePer1mMicroUsd) &&
-        isPrice(model?.outputPricePer1mMicroUsd));
+    return (isMicroUsd(model?.inputPricePer1mMicroUsd) &&
+        isMicroUsd(model?.outputPricePer1mMicroUsd));
 }
 function canPrice(model, usage) {
     if (usage === undefined)
@@ -379,8 +381,10 @@ function priceTurn(model, usage) {
     // charged for and reported as unpriced - or the reverse.
     if (!canPrice(model, usage))
         return 0n;
-    const prompt = usage?.prompt_tokens ?? 0;
-    const completion = usage?.completion_tokens ?? 0;
+    const prompt = usage?.prompt_tokens;
+    const completion = usage?.completion_tokens;
+    if (!isTokenCount(prompt) || !isTokenCount(completion))
+        return 0n;
     const ceilDiv = (tokens, price) => (BigInt(tokens) * BigInt(price) + 999999n) / 1000000n;
     return (ceilDiv(prompt, model?.inputPricePer1mMicroUsd ?? "0") +
         ceilDiv(completion, model?.outputPricePer1mMicroUsd ?? "0"));

package/dist/agent/session.d.ts

@@ -44,6 +44,8 @@ export interface SessionOptions {
     onGoal?: (goal: string) => void;
     /** R-4 · False when stdout is a pipe or a file, which get exact bytes. */
     isTty?: boolean;
+    /** Whether stderr is a terminal; independent from stdout. */
+    isErrTty?: boolean;
     /**
      * A conversation to continue, rebuilt from a saved session (CLI-024).
      * Appended to in place, exactly as the fresh array would be.

package/dist/agent/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/agent/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAY,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAapE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,oEAAoE;IACpE,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAwGzB;AAsHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CA2B7D"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/agent/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK/C,OAAO,EAAY,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAapE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,oEAAoE;IACpE,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAqHzB;AAsHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CA2B7D"}

package/dist/agent/session.js

@@ -2,7 +2,7 @@ import { createInterface } from "node:readline/promises";
 import { isAgentEligible } from "../api/models.js";
 import { formatUsdWithUnpriced } from "../output/money.js";
 import { renderRecord } from "../output/format.js";
-import { safeForTerminal } from "../output/terminal-safe.js";
+import { safeForTerminal, terminalSafeWriter, } from "../output/terminal-safe.js";
 import { runAgent } from "./loop.js";
 const HELP = `Session commands:
   /model [id]     Show or switch the model
@@ -23,6 +23,18 @@ Anything else is sent to the model as the next goal.
  * rather than the last question.
  */
 export async function runSession(options) {
+    // Interactive session stderr is a human surface. Wrap it once so new slash
+    // commands and progress messages cannot accidentally bypass the boundary.
+    // Preserve a dynamic signal getter: the TUI swaps its AbortController after
+    // cancelling one request so the session can return to the prompt.
+    const signalDescriptor = Object.getOwnPropertyDescriptor(options, "signal");
+    options = {
+        ...options,
+        stderr: terminalSafeWriter(options.stderr, options.isErrTty ?? true),
+    };
+    if (signalDescriptor?.get !== undefined) {
+        Object.defineProperty(options, "signal", signalDescriptor);
+    }
     const history = options.history ?? [];
     const summary = {
         goals: 0,
@@ -105,7 +117,7 @@ export async function runSession(options) {
                 options.stdout(`${safeForTerminal(report.finalText, options.isTty ?? true)}\n`);
             }
             if (report.stopReason !== "completed") {
-                options.stderr(`[${report.stopReason}${report.error ? `: ${report.error}` : ""}]\n`);
+                humanError(options, `[${report.stopReason}${report.error ? `: ${report.error}` : ""}]\n`);
             }
             if (report.stopReason === "cancelled" && options.signal?.aborted)
                 break;
@@ -296,12 +308,15 @@ function lineSource(input) {
 function reportEvent(event, options) {
     if (event.type === "tool") {
         const first = event.detail.split("\n")[0].slice(0, 100);
-        options.stderr(`  ${event.ok ? "-" : "!"} ${event.name}: ${first}\n`);
+        humanError(options, `  ${event.ok ? "-" : "!"} ${event.name}: ${first}\n`);
     }
     else if (event.type === "declined") {
-        options.stderr(`  declined: ${event.summary}\n`);
+        humanError(options, `  declined: ${event.summary}\n`);
     }
     else if (event.type === "rate_limited") {
         options.stderr(`  rate limited, waiting ${event.waitMs}ms (attempt ${event.attempt})\n`);
     }
 }
+function humanError(options, text) {
+    options.stderr(safeForTerminal(text, options.isErrTty ?? true));
+}

package/dist/api/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/api/account.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C;;;GAGG;AAEH,MAAM,WAAW,MAAM;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE;QACX,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,MAAM,CAAC;QACvB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAyBD,wBAAsB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAKrE;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,UAAU,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CAKvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,yBAAyB,EAAE,MAAM,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAOD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,gFAAgF;AAChF,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE;IACP,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACjB,GACL,OAAO,CAAC,iBAAiB,CAAC,CAgC5B"}
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/api/account.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AA8C5C;;;GAGG;AAEH,MAAM,WAAW,MAAM;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE;QACX,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,MAAM,CAAC;QACvB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAyBD,wBAAsB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAKrE;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,UAAU,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CAKvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,yBAAyB,EAAE,MAAM,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAoBD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,gFAAgF;AAChF,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE;IACP,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACjB,GACL,OAAO,CAAC,iBAAiB,CAAC,CAiC5B"}

package/dist/api/account.js

@@ -1,4 +1,48 @@
 import { ApiError } from "./errors.js";
+import { z } from "zod";
+import { isMicroUsd } from "../output/money.js";
+import { parseApiData } from "./validate.js";
+const nonnegativeMoney = z.string().refine(isMicroUsd);
+const count = z.number().safe().int().nonnegative();
+const walletSchema = z
+    .object({
+    balance_micro_usd: nonnegativeMoney,
+    bonus_micro_usd: nonnegativeMoney,
+    frozen_micro_usd: nonnegativeMoney,
+    available_micro_usd: nonnegativeMoney,
+    currency_anchor: z.string(),
+})
+    .passthrough();
+const usageSummarySchema = z
+    .object({
+    days: count,
+    from: z.string(),
+    to: z.string(),
+    count,
+    input_tokens: count,
+    output_tokens: count,
+    total_tokens: count,
+    charge_micro_usd: nonnegativeMoney,
+})
+    .passthrough();
+const subscriptionSchema = z
+    .object({
+    status: z.string(),
+    plan_slug: z.string().optional(),
+    plan_name: z.string().optional(),
+    current_period_end: z.string().optional(),
+    playground: z
+        .object({
+        allowance_micro_usd: nonnegativeMoney,
+        used_micro_usd: nonnegativeMoney,
+        remaining_micro_usd: nonnegativeMoney,
+        usage_percent: z.number().finite(),
+        state: z.string(),
+    })
+        .passthrough()
+        .optional(),
+})
+    .passthrough();
 /**
  * The account plane answers 401 with its own error shape when the key lacks
  * `account:read`. That is a scope problem, not a bad key, and saying so saves
@@ -22,21 +66,38 @@ export async function fetchWallet(client) {
     const { data } = await client
         .getJson("/keyinfo/wallet")
         .catch(explainScope);
-    return data;
+    return parseApiData(walletSchema, data, "wallet API");
 }
 export async function fetchUsage(client, days) {
     const query = days === undefined ? "" : `?days=${days}`;
     const { data } = await client
         .getJson(`/keyinfo/usage-summary${query}`)
         .catch(explainScope);
-    return data;
+    return parseApiData(usageSummarySchema, data, "usage API");
 }
 export async function fetchSubscription(client) {
     const { data } = await client
         .getJson("/keyinfo/subscription")
         .catch(explainScope);
-    return data;
+    return parseApiData(subscriptionSchema, data, "subscription API");
 }
+const usageEventSchema = z
+    .object({
+    request_id: z.string().min(1),
+    model_id: z.string().min(1),
+    input_tokens: count,
+    output_tokens: count,
+    platform_charge_micro_usd: nonnegativeMoney,
+    status: z.string().min(1),
+    created_at: z.string().min(1),
+})
+    .passthrough();
+const usageEventsPageSchema = z
+    .object({
+    data: z.array(usageEventSchema),
+    next_cursor: z.string().nullable().optional(),
+})
+    .passthrough();
 /** Hard stop on paging, so a busy key cannot turn one command into hundreds. */
 export const MAX_USAGE_EVENT_PAGES = 20;
 /**
@@ -63,15 +124,16 @@ export async function fetchUsageEvents(client, options = {}) {
             signal: options.signal,
         })
             .catch(explainScope);
+        const page = parseApiData(usageEventsPageSchema, data, "usage events API");
         pages += 1;
-        for (const event of data.data ?? []) {
+        for (const event of page.data) {
             events.push(event);
             remaining?.delete(event.request_id);
         }
         if (remaining !== undefined && remaining.size === 0) {
             return { events, pages, exhausted: true };
         }
-        cursor = data.next_cursor ?? null;
+        cursor = page.next_cursor ?? null;
         if (cursor === null)
             return { events, pages, exhausted: true };
     }

package/dist/api/chat-response.d.ts

@@ -0,0 +1,32 @@
+import { z } from "zod";
+declare const toolCallSchema: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodLiteral<"function">;
+    function: z.ZodObject<{
+        name: z.ZodString;
+        arguments: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$loose>;
+declare const chatCompletionSchema: z.ZodObject<{
+    choices: z.ZodArray<z.ZodObject<{
+        message: z.ZodObject<{
+            content: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            tool_calls: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                type: z.ZodLiteral<"function">;
+                function: z.ZodObject<{
+                    name: z.ZodString;
+                    arguments: z.ZodString;
+                }, z.core.$strip>;
+            }, z.core.$loose>>>;
+        }, z.core.$loose>;
+        finish_reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$loose>>;
+    usage: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$loose>;
+export type ToolCall = z.infer<typeof toolCallSchema>;
+export type ChatCompletion = z.infer<typeof chatCompletionSchema>;
+export declare function parseChatCompletion(value: unknown, label?: string): ChatCompletion;
+export declare function parseChatTextCompletion(value: unknown, label?: string): ChatCompletion;
+export {};
+//# sourceMappingURL=chat-response.d.ts.map

package/dist/api/chat-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-response.d.ts","sourceRoot":"","sources":["../../src/api/chat-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,cAAc;;;;;;;iBASJ,CAAC;AAEjB,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;iBAqBV,CAAC;AAMjB,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,KAAK,SAAa,GACjB,cAAc,CAEhB;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,KAAK,SAAa,GACjB,cAAc,CAEhB"}

package/dist/api/chat-response.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+import { parseApiData } from "./validate.js";
+const toolCallSchema = z
+    .object({
+    id: z.string().min(1),
+    type: z.literal("function"),
+    function: z.object({
+        name: z.string().min(1),
+        arguments: z.string(),
+    }),
+})
+    .passthrough();
+const chatCompletionSchema = z
+    .object({
+    choices: z
+        .array(z
+        .object({
+        message: z
+            .object({
+            content: z.string().nullable().optional(),
+            tool_calls: z.array(toolCallSchema).optional(),
+        })
+            .passthrough(),
+        finish_reason: z.string().nullable().optional(),
+    })
+        .passthrough())
+        .min(1),
+    // Usage is validated independently. A usable, already-billed answer must
+    // survive malformed accounting and be reported with unknown usage.
+    usage: z.unknown().optional(),
+})
+    .passthrough();
+const chatTextCompletionSchema = chatCompletionSchema.refine((response) => typeof response.choices[0]?.message.content === "string", { path: ["choices", 0, "message", "content"] });
+export function parseChatCompletion(value, label = "chat API") {
+    return parseApiData(chatCompletionSchema, value, label);
+}
+export function parseChatTextCompletion(value, label = "chat API") {
+    return parseApiData(chatTextCompletionSchema, value, label);
+}

package/dist/api/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/api/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAUxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,cAAc,EAAE,EACpC,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,SAAS,CA4BX;AAED,8CAA8C;AAC9C,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,cAAc,EAAE,CAAC,CAG3B;AAED,2EAA2E;AAC3E,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,EAAE,CAAC,CAGzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,YAAY,GAAG,SAAS,CAY1B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAFhB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM;CAO5B"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/api/models.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AA+B5C,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAUxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,cAAc,EAAE,EACpC,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,SAAS,CA4BX;AAED,8CAA8C;AAC9C,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,cAAc,EAAE,CAAC,CAG3B;AAED,2EAA2E;AAC3E,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,EAAE,CAAC,CAGzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,YAAY,GAAG,SAAS,CAY1B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAFhB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM;CAO5B"}

package/dist/api/models.js

@@ -1,3 +1,29 @@
+import { z } from "zod";
+import { parseApiData } from "./validate.js";
+const dataPlaneModelsSchema = z
+    .object({
+    data: z.array(z.object({ id: z.string().refine(isUsableModelId) }).passthrough()),
+})
+    .passthrough();
+const catalogModelSchema = z
+    .object({
+    modelId: z.string().refine(isUsableModelId),
+    displayName: z.string().optional(),
+    provider: z.string().optional(),
+    capabilities: z.array(z.string()).optional(),
+    apiSurface: z.string().optional(),
+    contextLength: z.number().safe().int().nonnegative().optional(),
+    inputPricePer1mMicroUsd: z.string().optional(),
+    outputPricePer1mMicroUsd: z.string().optional(),
+    accessTier: z.string().optional(),
+    deprecated: z.boolean().optional(),
+    retires_at: z.string().nullable().optional(),
+    replacement_model_id: z.string().nullable().optional(),
+})
+    .passthrough();
+const catalogSchema = z
+    .object({ data: z.array(catalogModelSchema) })
+    .passthrough();
 /**
  * Agent admission. Every condition is something the catalogue states outright;
  * nothing is inferred from the model id, the provider or the display name —
@@ -59,13 +85,13 @@ export function intersectModels(dataPlane, catalog) {
 }
 /** GET /v1/models — the key's access list. */
 export async function fetchAccessibleModels(client) {
-    const { data } = await client.getJson("/models");
-    return data.data ?? [];
+    const response = await client.getJson("/models");
+    return parseApiData(dataPlaneModelsSchema, response.data, "model API").data;
 }
 /** GET /models on the business API — public catalogue, no key required. */
 export async function fetchCatalog(client) {
-    const { data } = await client.getJson("/models");
-    return data.data ?? [];
+    const response = await client.getJson("/models");
+    return parseApiData(catalogSchema, response.data, "model catalogue").data;
 }
 /**
  * U-3 · Is this a usable model identifier?

package/dist/api/sse-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse-parser.d.ts","sourceRoot":"","sources":["../../src/api/sse-parser.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAWD,+EAA+E;AAC/E,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE;IAMjC,kDAAkD;IAClD,GAAG,IAAI,MAAM,EAAE;IASf,OAAO,CAAC,KAAK;CAYd;AAED,8DAA8D;AAC9D,qBAAa,mBAAmB;IAOlB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAC7D,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,KAAK,CAAC,CAAc;IAC5B,OAAO,CAAC,IAAI,CAAS;gBAEQ,MAAM,GAAE,YAAiB;IAEtD,4DAA4D;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAgD9B,MAAM,IAAI,YAAY;CASvB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAC9C,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AACzD,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,QAAc,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,MAAM,GAAE,YAAiB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,GAAE,YAAiB,GACxB,OAAO,CAAC,YAAY,CAAC,CAqGvB"}
+{"version":3,"file":"sse-parser.d.ts","sourceRoot":"","sources":["../../src/api/sse-parser.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAWD,+EAA+E;AAC/E,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE;IAMjC,kDAAkD;IAClD,GAAG,IAAI,MAAM,EAAE;IASf,OAAO,CAAC,KAAK;CAYd;AAED,8DAA8D;AAC9D,qBAAa,mBAAmB;IAOlB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAC7D,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,KAAK,CAAC,CAAc;IAC5B,OAAO,CAAC,IAAI,CAAS;gBAEQ,MAAM,GAAE,YAAiB;IAEtD,4DAA4D;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAgD9B,MAAM,IAAI,YAAY;CASvB;AAaD,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAC9C,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AACzD,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,QAAc,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,MAAM,GAAE,YAAiB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,GAAE,YAAiB,GACxB,OAAO,CAAC,YAAY,CAAC,CAqGvB"}

package/dist/api/sse-parser.js

@@ -61,7 +61,7 @@ export class ChatStreamAssembler {
         }
         // Read usage wherever it appears — it rides a frame that still has a
         // (empty-delta) choice on this gateway.
-        if (chunk.usage)
+        if (isStreamUsage(chunk.usage))
             this.usage = chunk.usage;
         const choice = chunk.choices?.[0];
         if (!choice)
@@ -100,6 +100,14 @@ export class ChatStreamAssembler {
         };
     }
 }
+function isStreamUsage(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const usage = value;
+    return ["prompt_tokens", "completion_tokens", "total_tokens"].every((key) => typeof usage[key] === "number" &&
+        Number.isSafeInteger(usage[key]) &&
+        usage[key] >= 0);
+}
 export const DEFAULT_STREAM_IDLE_MS = 120_000;
 export const DEFAULT_STREAM_MAX_BYTES = 32 * 1024 * 1024;
 /** Matches the agent's wall-clock ceiling (§7.4), for the same reason. */

package/dist/api/validate.d.ts

@@ -0,0 +1,4 @@
+import type { z } from "zod";
+/** Validate untrusted JSON at the HTTP boundary and expose a stable CLI error. */
+export declare function parseApiData<T>(schema: z.ZodType<T>, value: unknown, label: string): T;
+//# sourceMappingURL=validate.d.ts.map

package/dist/api/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/api/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAK7B,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,CAAC,EAC5B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EACpB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,GACZ,CAAC,CAUH"}

package/dist/api/validate.js

@@ -0,0 +1,15 @@
+import { ExitCode } from "../output/exit-codes.js";
+import { ApiError } from "./errors.js";
+/** Validate untrusted JSON at the HTTP boundary and expose a stable CLI error. */
+export function parseApiData(schema, value, label) {
+    const parsed = schema.safeParse(value);
+    if (parsed.success)
+        return parsed.data;
+    const issue = parsed.error.issues[0];
+    const path = issue?.path.length ? ` at ${issue.path.join(".")}` : "";
+    throw new ApiError({
+        kind: "server",
+        exitCode: ExitCode.Unavailable,
+        message: `${label} returned an invalid response${path}`,
+    });
+}

package/dist/commands/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/commands/account.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAOnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAUtB,wBAAsB,cAAc,CAClC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,QAAQ,CAAC,CAmGnB"}
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/commands/account.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAQnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAUtB,wBAAsB,cAAc,CAClC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,QAAQ,CAAC,CA8GnB"}

package/dist/commands/account.js

@@ -2,6 +2,7 @@ import { fetchSubscription, fetchUsage, fetchWallet } from "../api/account.js";
 import { ExitCode } from "../output/exit-codes.js";
 import { parseFormatFlags, renderJson, renderRecord, } from "../output/format.js";
 import { formatUsd } from "../output/money.js";
+import { safeForTerminal } from "../output/terminal-safe.js";
 import { buildRuntime, reportError, requireApiKey, } from "./runtime.js";
 const USAGE = `Usage:
   mafdet account balance [--json]
@@ -30,12 +31,12 @@ export async function accountCommand(argv, io) {
                 io.stdout(renderJson(wallet));
                 return ExitCode.Ok;
             }
-            io.stdout(renderRecord([
+            io.stdout(safeForTerminal(renderRecord([
                 ["balance", formatUsd(wallet.balance_micro_usd)],
                 ["bonus", formatUsd(wallet.bonus_micro_usd)],
                 ["frozen", formatUsd(wallet.frozen_micro_usd)],
                 ["available", formatUsd(wallet.available_micro_usd)],
-            ]));
+            ]), io.isTty ?? process.stdout.isTTY === true));
             return ExitCode.Ok;
         }
         if (subcommand === "usage") {
@@ -57,7 +58,7 @@ export async function accountCommand(argv, io) {
                 io.stdout(renderJson(usage));
                 return ExitCode.Ok;
             }
-            io.stdout(renderRecord([
+            io.stdout(safeForTerminal(renderRecord([
                 ["window", `${usage.days} day(s), ${usage.from} -> ${usage.to}`],
                 // Throttled attempts land in the ledger with a zero charge
                 // (CLI-001), so the count and the money answer different questions.
@@ -68,7 +69,7 @@ export async function accountCommand(argv, io) {
                 ["input tokens", String(usage.input_tokens)],
                 ["output tokens", String(usage.output_tokens)],
                 ["charged", formatUsd(usage.charge_micro_usd)],
-            ]));
+            ]), io.isTty ?? process.stdout.isTTY === true));
             return ExitCode.Ok;
         }
         if (args.length > 0)
@@ -90,7 +91,7 @@ export async function accountCommand(argv, io) {
                 `${formatUsd(pg.used_micro_usd)} (${pg.usage_percent}%)`,
             ], ["playground left", formatUsd(pg.remaining_micro_usd)]);
         }
-        io.stdout(renderRecord(rows));
+        io.stdout(safeForTerminal(renderRecord(rows), io.isTty ?? process.stdout.isTTY === true));
         return ExitCode.Ok;
     }
     catch (error) {

package/dist/commands/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/commands/agent.ts"],"names":[],"mappings":"AAQA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAiBvE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAmBtB,eAAO,MAAM,gBAAgB,0XAK+C,CAAC;AAE7E,eAAO,MAAM,YAAY,mgBAOmB,CAAC;AAE7C,MAAM,WAAW,OAAQ,SAAQ,SAAS;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,uBAAuB,EAAE,QAAQ,CAAC;IACpD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9C;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,OAAO,GACV,OAAO,CAAC,QAAQ,CAAC,CAuInB;AAoLD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,kBAAkB,EAAE,OAAO,0JAI3E"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/commands/agent.ts"],"names":[],"mappings":"AAQA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAiBvE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAmBtB,eAAO,MAAM,gBAAgB,0XAK+C,CAAC;AAE7E,eAAO,MAAM,YAAY,mgBAOmB,CAAC;AAE7C,MAAM,WAAW,OAAQ,SAAQ,SAAS;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,uBAAuB,EAAE,QAAQ,CAAC;IACpD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9C;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,OAAO,GACV,OAAO,CAAC,QAAQ,CAAC,CA2InB;AAoLD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,kBAAkB,EAAE,OAAO,0JAI3E"}

package/dist/commands/agent.js

@@ -82,7 +82,7 @@ export async function agentCommand(argv, io) {
         if (parsed.allowWrite && !interactive) {
             io.stderr("note: --allow-write needs an interactive terminal to confirm changes; running read-only\n");
         }
-        io.stderr(`workspace: ${workspace.root}\nmodel: ${model} (${mode})\n`);
+        writeHumanError(io, `workspace: ${workspace.root}\nmodel: ${model} (${mode})\n`);
         if (parsed.goal.length === 0) {
             if (!interactive) {
                 io.stderr(`mafdet agent: no goal\n${USAGE}`);
@@ -119,6 +119,7 @@ export async function agentCommand(argv, io) {
                     stderr: io.stderr,
                     signal: io.signal,
                     isTty: isTty(io),
+                    isErrTty: io.isErrTty ?? process.stderr.isTTY === true,
                     ...(io.readLine === undefined ? {} : { readLine: io.readLine }),
                 });
             }
@@ -345,7 +346,7 @@ function reportEvent(event, io) {
         io.stderr(`\n[turn ${event.turn}]\n`);
     else if (event.type === "tool") {
         const first = event.detail.split("\n")[0].slice(0, 100);
-        io.stderr(`  ${event.ok ? "-" : "!"} ${event.name}: ${first}\n`);
+        writeHumanError(io, `  ${event.ok ? "-" : "!"} ${event.name}: ${first}\n`);
     }
     else if (event.type === "rate_limited") {
         io.stderr(`  rate limited, waiting ${event.waitMs}ms (attempt ${event.attempt})\n`);

package/dist/commands/chat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../src/commands/chat.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWxE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAatB,MAAM,WAAW,MAAO,SAAQ,SAAS;IACvC,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,gDAAgD;IAChD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAcD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,QAAQ,CAAC,CA8BnB;AA8SD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,YAAY,GAAG,SAAS,EAC/B,KAAK,EAAE,WAAW,GACjB,MAAM,GAAG,SAAS,CASpB"}
+{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../src/commands/chat.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEnE,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWxE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAatB,MAAM,WAAW,MAAO,SAAQ,SAAS;IACvC,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,gDAAgD;IAChD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAcD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,QAAQ,CAAC,CA8BnB;AAiTD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,YAAY,GAAG,SAAS,EAC/B,KAAK,EAAE,WAAW,GACjB,MAAM,GAAG,SAAS,CAYpB"}

package/dist/commands/chat.js

@@ -1,5 +1,6 @@
 import { readFileSync } from "node:fs";
 import { fetchCatalog } from "../api/models.js";
+import { parseChatTextCompletion } from "../api/chat-response.js";
 import { readChatStream } from "../api/sse-parser.js";
 import { ApiError } from "../api/errors.js";
 import { safeForTerminal, terminalSafeWriter, } from "../output/terminal-safe.js";
@@ -9,7 +10,7 @@ import { upsertIndexEntry } from "../sessions/index-file.js";
 import { decideRecording } from "../sessions/policy.js";
 import { SessionWriter } from "../sessions/store.js";
 import { ExitCode } from "../output/exit-codes.js";
-import { formatUsd } from "../output/money.js";
+import { formatUsd, isMicroUsd } from "../output/money.js";
 import { buildRuntime, reportError, requireApiKey, } from "./runtime.js";
 const USAGE = `Usage:
   mafdet chat [prompt] [--model <id>] [--system <file>] [--input <file>]
@@ -275,12 +276,17 @@ async function streamChat(runtime, body, args, io) {
     return ExitCode.Ok;
 }
 async function completeChat(runtime, body, args, io) {
-    const { data, requestId } = await runtime.dataPlane.postJson("/chat/completions", body, { signal: io.signal });
-    const answer = data.choices?.[0]?.message?.content ?? "";
+    const { data: rawData, requestId } = await runtime.dataPlane.postJson("/chat/completions", body, {
+        signal: io.signal,
+    });
+    const data = parseChatTextCompletion(rawData);
+    const rawAnswer = data.choices[0].message.content;
+    const answer = typeof rawAnswer === "string" ? rawAnswer : "";
+    const usage = validUsage(data.usage);
     io.stdout(`${safeForTerminal(answer, isTty(io))}\n`);
     const model = await priceModel(runtime, args.model, !args.quiet || args.save);
-    summarise(args, data.usage, io, model);
-    saveChat(args, io, answer, data.usage, requestId, model);
+    summarise(args, usage, io, model);
+    saveChat(args, io, answer, usage, requestId, model);
     return ExitCode.Ok;
 }
 /**
@@ -300,9 +306,32 @@ function summarise(args, usage, io, model, options = {}) {
     io.stderr(`${prefix}${usage.prompt_tokens} in / ${usage.completion_tokens} out tokens${cost}\n`);
 }
 export function estimateChargeMicroUsd(model, usage) {
-    if (!model?.inputPricePer1mMicroUsd || !model.outputPricePer1mMicroUsd)
+    if (!isMicroUsd(model?.inputPricePer1mMicroUsd) ||
+        !isMicroUsd(model.outputPricePer1mMicroUsd))
         return undefined;
     const ceilDiv = (tokens, pricePer1m) => (BigInt(tokens) * BigInt(pricePer1m) + 999999n) / 1000000n;
     return (ceilDiv(usage.prompt_tokens, model.inputPricePer1mMicroUsd) +
         ceilDiv(usage.completion_tokens, model.outputPricePer1mMicroUsd));
 }
+function validUsage(value) {
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const usage = value;
+    const count = (field) => {
+        const candidate = usage[field];
+        return typeof candidate === "number" &&
+            Number.isSafeInteger(candidate) &&
+            candidate >= 0
+            ? candidate
+            : undefined;
+    };
+    const prompt = count("prompt_tokens");
+    const completion = count("completion_tokens");
+    if (prompt === undefined || completion === undefined)
+        return undefined;
+    return {
+        prompt_tokens: prompt,
+        completion_tokens: completion,
+        total_tokens: count("total_tokens") ?? prompt + completion,
+    };
+}

package/dist/commands/models.js

@@ -1,7 +1,7 @@
 import { fetchAccessibleModels, fetchCatalog, intersectModels, } from "../api/models.js";
 import { ExitCode } from "../output/exit-codes.js";
 import { parseFormatFlags, renderJson, renderPlain, renderRecord, renderTable, } from "../output/format.js";
-import { formatUsd } from "../output/money.js";
+import { formatUsd, isMicroUsd } from "../output/money.js";
 import { safeForTerminal } from "../output/terminal-safe.js";
 import { buildRuntime, reportError, requireApiKey, } from "./runtime.js";
 const USAGE = `Usage:
@@ -151,20 +151,20 @@ function showModel(sets, args, format, io) {
         ["agent eligible", model.agentEligible ? "yes" : "no"],
         [
             "input / 1M",
-            model.inputPricePer1mMicroUsd
+            isMicroUsd(model.inputPricePer1mMicroUsd)
                 ? formatUsd(model.inputPricePer1mMicroUsd)
                 : "-",
         ],
         [
             "output / 1M",
-            model.outputPricePer1mMicroUsd
+            isMicroUsd(model.outputPricePer1mMicroUsd)
                 ? formatUsd(model.outputPricePer1mMicroUsd)
                 : "-",
         ],
         [
             "deprecated",
             model.deprecated
-                ? `yes${model.retires_at ? ` (retires ${model.retires_at})` : ""}`
+                ? clean(`yes${model.retires_at ? ` (retires ${model.retires_at})` : ""}`)
                 : "no",
         ],
     ]));

package/dist/commands/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/commands/sessions.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AA4BnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAetB,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAoRD,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAUX,CAAC"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/commands/sessions.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AA4BnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAgBtB,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAoRD,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAUX,CAAC"}

package/dist/commands/sessions.js

@@ -30,7 +30,8 @@ Conversations are stored on this computer only. Browsing them never
 calls a model and is never charged.
 
 --refresh asks the billing ledger what this key's requests actually
-cost. It sends request IDs and nothing else - no messages, no titles.
+cost. It queries this key's usage-event window; request IDs stay local
+for matching. No messages, titles, workspace or session ID are sent.
 `;
 export async function sessionsCommand(argv, io) {
     // F-013 · Nothing here may reach the top level as a raw Error. `--json

package/dist/output/money.d.ts

@@ -5,6 +5,8 @@
  * reason: a float round-trip can turn a balance into a number that does not
  * match the invoice. Everything here is BigInt in, string out.
  */
+/** A non-negative integral micro-USD value as spoken by Mafdet APIs. */
+export declare function isMicroUsd(value: unknown): value is string;
 export declare function parseMicroUsd(value: string | number | bigint): bigint;
 /**
  * Render micro-USD as dollars. `minimumFractionDigits` keeps small amounts

package/dist/output/money.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"money.d.ts","sourceRoot":"","sources":["../../src/output/money.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAOrE;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAClC,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3C,MAAM,CAeR;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GAAG,MAAM,EACzB,gBAAgB,EAAE,MAAM,GACvB,MAAM,CAIR"}
+{"version":3,"file":"money.d.ts","sourceRoot":"","sources":["../../src/output/money.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE1D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAOrE;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAClC,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3C,MAAM,CAeR;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GAAG,MAAM,EACzB,gBAAgB,EAAE,MAAM,GACvB,MAAM,CAIR"}

package/dist/output/money.js

@@ -6,6 +6,10 @@
  * match the invoice. Everything here is BigInt in, string out.
  */
 const MICROS_PER_USD = 1000000n;
+/** A non-negative integral micro-USD value as spoken by Mafdet APIs. */
+export function isMicroUsd(value) {
+    return typeof value === "string" && /^\d+$/.test(value);
+}
 export function parseMicroUsd(value) {
     if (typeof value === "bigint")
         return value;

package/dist/sessions/reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../src/sessions/reconcile.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,gBAAgB,EAAE,MAAM,GACvB,aAAa,CAwCf;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,UAAU,EAAE,MAAM,GACjB,WAAW,CAyBb;AAOD;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,MAAM,CAM7E"}
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../src/sessions/reconcile.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,gBAAgB,EAAE,MAAM,GACvB,aAAa,CAwCf;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,UAAU,EAAE,MAAM,GACjB,WAAW,CAiCb;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,MAAM,CAM7E"}

package/dist/sessions/reconcile.js

@@ -12,6 +12,7 @@
 // caught up with yet, and the user is told to wait for something that will
 // never arrive. With it, we can say which key to run this under instead.
 import { isComparableKeyRef } from "../security/redact.js";
+import { isMicroUsd } from "../output/money.js";
 /**
  * Decide what to ask about, from the transcript alone.
  *
@@ -69,8 +70,13 @@ export function planReconciliation(events, currentKeyDigest) {
 export function matchSettlements(plan, ledger, observedAt) {
     const byId = new Map();
     for (const row of ledger) {
-        if (plan.wanted.has(row.request_id))
+        // Defense in depth: the API boundary rejects this already. If an invalid
+        // row is nevertheless injected, it remains pending instead of becoming a
+        // fabricated zero-dollar settlement.
+        if (plan.wanted.has(row.request_id) &&
+            isMicroUsd(row.platform_charge_micro_usd)) {
             byId.set(row.request_id, row);
+        }
     }
     const settlements = [];
     const missing = [];
@@ -85,17 +91,13 @@ export function matchSettlements(plan, ledger, observedAt) {
             request_id: id,
             // Kept as the string the server sent. Parsing it into a number here is
             // how integer micro-USD becomes a float somewhere downstream.
-            settled_charge_micro_usd: normaliseMicro(row.platform_charge_micro_usd),
+            settled_charge_micro_usd: row.platform_charge_micro_usd,
             server_status: typeof row.status === "string" ? row.status : "unknown",
             observed_at: observedAt,
         });
     }
     return { settlements, missing };
 }
-/** Anything that is not an integer count of micro-USD is not a charge. */
-function normaliseMicro(value) {
-    return typeof value === "string" && /^-?\d+$/.test(value) ? value : "0";
-}
 /**
  * How many days back the ledger has to be asked about.
  *

package/dist/tui/adapters/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../src/tui/adapters/models.ts"],"names":[],"mappings":"AAiBA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAKzE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoB1B;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoB1D;AASD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,KAAK,EAAE,MAAM,GACZ,SAAS,aAAa,EAAE,CAgB1B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,UAAU,CA8Cb"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../src/tui/adapters/models.ts"],"names":[],"mappings":"AAiBA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAMzE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoB1B;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoB1D;AASD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,KAAK,EAAE,MAAM,GACZ,SAAS,aAAa,EAAE,CAgB1B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,UAAU,CA8Cb"}

package/dist/tui/adapters/models.js

@@ -13,6 +13,7 @@ import { buildRuntime } from "../../commands/runtime.js";
 import { parseUserConfig } from "../../config/config.js";
 import { userConfigPath } from "../../config/paths.js";
 import { formatUsd } from "../../output/money.js";
+import { isMicroUsd } from "../../output/money.js";
 /**
  * The catalogue does not publish a per-route RPM - checked against the live
  * `/models` response, which has 31 models and no rate field at all. Plan §19.5
@@ -62,7 +63,7 @@ export function describeModel(model) {
 function priceSummary(model) {
     const input = model.inputPricePer1mMicroUsd;
     const output = model.outputPricePer1mMicroUsd;
-    if (input === undefined || output === undefined)
+    if (!isMicroUsd(input) || !isMicroUsd(output))
         return undefined;
     return `${formatUsd(input)}/${formatUsd(output)} per 1M`;
 }

package/dist/tui/tool-card.js

@@ -122,11 +122,11 @@ function firstLine(text) {
 export function renderCard(card, capabilities) {
     const { dim, bold, accent } = palette(capabilities);
     const glyph = GLYPHS[card.state];
-    const head = `  ${glyph}  ${bold(card.name)} ${dim(card.arguments)}`;
+    const head = `  ${glyph}  ${bold(stripAnsi(card.name))} ${dim(card.arguments)}`;
     if (card.detail === undefined || card.detail.length === 0)
         return `${head}\n`;
     const detail = card.state === "failed" || card.state === "refused"
-        ? accent(card.detail)
-        : dim(card.detail);
+        ? accent(firstLine(card.detail))
+        : dim(firstLine(card.detail));
     return `${head}\n        ${detail}\n`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mafdet/cli",
-  "version": "0.4.10",
+  "version": "0.4.12",
   "description": "Mafdet AI command line — model calls, account queries, and a permissioned local agent.",
   "type": "module",
   "license": "MIT",