ai-spend-agent 0.9.1 → 0.9.3

package/dist/improveFlow.js

@@ -132,18 +132,20 @@ const identityFields = [
     {
         field: "owner", kind: "name", label: "owner",
         question: "Who is the accountable human owner of this project's AI cost?",
-        example: "Jose Artigas"
+        // Neutral placeholder identities only — a real person's details in an
+        // e.g. hint read as prefilled truth (shipped-audit fix).
+        example: "Sam Rivera"
     },
     {
         field: "team", kind: "team", label: "team",
         question: "What team does this cost belong to?",
-        example: "Futura Studio"
+        example: "Platform Team"
     },
     {
         field: "role", kind: "role", label: "role",
         question: "What is your approval role for this project?",
         guidance: "(A job role — not aibill's held/passed quality vocabulary.)",
-        example: "Founder"
+        example: "Engineering Manager"
     },
     {
         field: "client", kind: "optional", label: "client",

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { type GuidedPromptSource } from "./guidedPrompt.js";
+import { type SignupDnsResolver } from "./signup.js";
 export type CliResult = {
     exitCode: number;
     stdout: string;
@@ -17,6 +18,13 @@ export type CliRuntimeOptions = {
     interactive?: boolean;
     /** Foreground terminal prompt. Tests/embeddings must inject it explicitly. */
     prompt?: (question: string) => Promise<string>;
+    /**
+     * Consent-grade read for the explicit signup command (adversary SF1):
+     * buffered/type-ahead bytes never answer, EOF/^C resolve undefined. The
+     * bin wires signup.openTerminalConsentRead; tests inject stubs. When
+     * absent, `prompt` is the fallback with aborts mapped to "nothing sent".
+     */
+    consentRead?: (query: string, timeoutMs: number) => Promise<string | undefined>;
     /**
      * Guided-flow line IO for the improve/identify sittings. The foreground
      * terminal wires an arrival-timestamped readline source; tests inject
@@ -26,6 +34,16 @@ export type CliRuntimeOptions = {
         source: GuidedPromptSource;
         write: (text: string) => void;
     }>;
+    /** Test override for the waitlist signup POST. Production uses global fetch. */
+    waitlistFetch?: typeof fetch;
+    /** Test override for signup email deliverability DNS. Production uses node:dns. */
+    signupDns?: SignupDnsResolver;
+    /**
+     * Set ONLY by the bin entrypoint when telemetry is enabled AND noticed:
+     * every "nothing uploaded" claim then prints the disclosure line instead.
+     * Embedded/MCP callers never set it (and never emit telemetry).
+     */
+    telemetryDisclosure?: boolean;
 };
 export declare function runCli(argv?: string[], runtime?: CliRuntimeOptions): Promise<CliResult>;
 /**