ai-spend-agent 0.9.7 → 0.9.8

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
+import { type WorkspaceTransport, type WorkspaceExchangeTransport, type WorkspaceDisconnectTransport } from "./workspaceConnect.js";
 import { type GuidedPromptSource } from "./guidedPrompt.js";
 import { type SignupDnsResolver } from "./signup.js";
+import { loadLocalAgentFinancialUsage } from "@agent-finops/core";
 import { decideReportAutoOpen, openReportInBrowser } from "./reportOpener.js";
 export type CliResult = {
     exitCode: number;
@@ -8,6 +10,12 @@ export type CliResult = {
     stderr: string;
 };
 export type CliRuntimeOptions = {
+    /** Workspace test seams; production uses native transport and explicit financial-only loading. */
+    workspaceNow?: string;
+    workspaceTransport?: WorkspaceTransport;
+    workspaceExchangeTransport?: WorkspaceExchangeTransport;
+    workspaceDisconnectTransport?: WorkspaceDisconnectTransport;
+    workspaceLoadCalls?: () => Promise<Awaited<ReturnType<typeof loadLocalAgentFinancialUsage>>>;
     /** Test/embedding override. Production always defaults to the OS home. */
     homeDirectory?: string;
     /** Test/embedding override. Packed production reads the built runtime asset. */

package/dist/index.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { beginWorkspaceEnrollment, finishWorkspaceEnrollment, workspaceStatus, prepareWorkspacePush, sendWorkspacePending, disconnectWorkspace, WORKSPACE_ORIGIN, workspaceCanonicalJson, } from "./workspaceConnect.js";
+import { workspaceClock } from "./lib/clock.js";
 import { randomUUID } from "node:crypto";
 import { realpathSync } from "node:fs";
 import { lstat, mkdir, readdir, readFile, rm, stat } from "node:fs/promises";
@@ -137,6 +139,8 @@ export async function runCli(argv = process.argv.slice(2), runtime = {}) {
     if (args.command === "list-sources") {
         return listSourcesCommand(args);
     }
+    if (args.command === "workspace")
+        return workspaceCommand(args, runtime);
     if (args.command === "connect") {
         return connectCommand(args);
     }
@@ -1038,6 +1042,94 @@ function renderCliQualitativeCoverage(coverage) {
  * persists the typed email on failure. `--forget` clears local signup state;
  * `--never` records never-ask without sending anything.
  */
+async function workspaceCommand(args, runtime) {
+    const fail = (message) => ({ exitCode: 1, stdout: "", stderr: message });
+    const action = args.workspaceAction;
+    if (!["connect", "push", "status", "disconnect"].includes(action ?? ""))
+        return fail("Use npx aibill workspace connect [response-bundle], push, status, or disconnect.");
+    if (action !== "status" && (runtime.interactive !== true || !runtime.consentRead && !runtime.prompt))
+        return fail("Workspace changes require an interactive terminal and explicit consent. Status remains available without a terminal.");
+    const consent = async (message) => {
+        try {
+            const answer = runtime.consentRead ? await runtime.consentRead(message, 120000) : await runtime.prompt?.(message);
+            return answer?.trim().toLowerCase() === "y" || answer?.trim().toLowerCase() === "yes";
+        }
+        catch {
+            return false;
+        }
+    };
+    try {
+        if (action === "status") {
+            const status = await workspaceStatus(runtime.homeDirectory);
+            if (status.state === "not_connected")
+                return ok("This machine has no completed local Workspace pairing. No logs or network were read.");
+            return ok([`Workspace: ${status.origin}`, `Last accepted push: ${status.lastAcceptedAt ?? "no push yet"}`,
+                `Pairing state: local record present; disconnect ${status.disconnect ?? "not requested"}`,
+                `Acknowledged fact keys: ${status.acknowledgedFacts}`, `Pending batch: ${status.pending?.state ?? "none"}`,
+                "Status reads local pairing state only; it does not confirm current server grant authority."].join("\n"));
+        }
+        if (action === "connect") {
+            if (!args.workspaceCode) {
+                if (!await consent("Create a private device key and display its public enrollment request? No session facts are sent. [y/N] "))
+                    return ok("Not paired.");
+                const prepared = await beginWorkspaceEnrollment(runtime.homeDirectory);
+                return ok([`Open ${WORKSPACE_ORIGIN}/settings/machines, paste this public request and confirm enrollment:`, prepared.bundle,
+                    "Then run: npx aibill workspace connect <response-bundle>", "The private device key stays on this machine. No session facts were sent."].join("\n"));
+            }
+            const result = await finishWorkspaceEnrollment({ home: runtime.homeDirectory, bundle: args.workspaceCode,
+                now: runtime.workspaceNow ?? workspaceClock.now(), transport: runtime.workspaceExchangeTransport,
+                confirm: details => consent([`Pair with ${details.origin} for local facts from ${details.collectionNotBefore}, grant ending ${details.grantExpiresAt}?`,
+                    `Selected tenant: ${details.tenantId}`, `Reviewed source: ${details.localSourceInstanceRef}`, `Project: ${details.projectId}`, `Source project: ${details.sourceProjectRef}`,
+                    `Exact enrollment policy: ${workspaceCanonicalJson(details.policy)}`, "Sign this enrollment exchange? [y/N] "].join("\n")) });
+            return result.state === "connected" ? ok(`Paired. Finish all-repository consent at ${WORKSPACE_ORIGIN}/settings/machines before your first push. Then run npx aibill workspace push to preview local session facts.`)
+                : result.state === "cancelled" ? ok("Pairing exchange not sent.")
+                    : fail("Pairing outcome is unknown. Do not replay this response bundle; inspect and revoke the enrollment in Settings before starting another.");
+        }
+        if (action === "disconnect") {
+            const result = await disconnectWorkspace({ home: runtime.homeDirectory, transport: runtime.workspaceDisconnectTransport,
+                confirm: action => consent(action === "abandon_unexchanged"
+                    ? "This native request has never attempted exchange. Destroy its unused private pairing key so it can no longer complete enrollment? Cancel any browser challenge in Settings as well. [y/N] "
+                    : "Revoke this machine's Workspace grant and remove its local pairing after the accepted receipt? [y/N] ") });
+            return result.state === "revoked" ? ok("Workspace revoked this machine grant. Local pairing was removed.")
+                : result.state === "abandoned" ? ok("Unused native pairing key removed. No remote revocation was claimed. Run npx aibill workspace connect to start a new request.")
+                    : result.state === "cancelled" ? ok("Pairing kept.") : result.state === "not_paired" ? ok("No completed local pairing exists.")
+                        : fail(`Disconnect outcome is unknown. Local keys remain; no retry was sent. Reconcile this machine at ${WORKSPACE_ORIGIN}/settings/machines.`);
+        }
+        const status = await workspaceStatus(runtime.homeDirectory);
+        if (status.state !== "connected")
+            return fail("Connect this machine before pushing local facts.");
+        if (status.disconnect)
+            return fail("Disconnect is pending or complete. No session facts were read or sent.");
+        if (status.pending?.state === "refused")
+            return fail("A retained batch was refused. No new envelope or nonce was created; resolve the refusal before pushing again.");
+        const now = runtime.workspaceNow ?? workspaceClock.now();
+        const loaded = status.pending ? undefined : runtime.workspaceLoadCalls ? await runtime.workspaceLoadCalls()
+            : await loadLocalAgentFinancialUsage({ workspaceDailyFacts: true, sinceIso: workspaceClock.daysBefore(now, 30) });
+        if (loaded?.diagnostics.some(item => item.code !== "directory_missing"))
+            return fail("Local source reading is incomplete. No facts were replaced or sent; resolve the reported source coverage before pushing.");
+        const prepared = await prepareWorkspacePush({ home: runtime.homeDirectory, calls: loaded?.calls ?? [], generatedAt: now,
+            confirm: (payload, coverage) => consent(["Exact outgoing local facts (no prompts, paths, session IDs, or amounts):", payload,
+                `Excluded calls: ${coverage.excludedCalls}. Missing token components: ${coverage.incompleteComponents}.`,
+                status.pending?.state === "uncertain" ? "This retries only the identical retained signed batch with its original nonce. Send this exact batch again? [y/N] "
+                    : "Machine tokens remain separate from provider-reported tokens and billed costs. Send this batch? [y/N] "].join("\n")) });
+        if (prepared.state === "unchanged")
+            return ok(prepared.coverage?.excludedCalls
+                ? "No complete changed facts are available. Some local calls lack a usable day or identity; absence is not zero usage."
+                : "No changed eligible local session facts to push.");
+        if (prepared.state === "cancelled")
+            return ok("Not sent.");
+        if (prepared.state === "pending")
+            return fail("A prior batch remains retained. No new envelope was created.");
+        const sent = await sendWorkspacePending({ home: runtime.homeDirectory, transport: runtime.workspaceTransport });
+        return sent.state === "accepted" ? ok(`Workspace accepted ${sent.factCount} local session facts. These are attribution inputs, not billed costs.`)
+            : sent.state === "refused" ? fail("Workspace refused this batch. Its exact envelope and refusal are retained; no new nonce was created.")
+                : fail("Push outcome is unknown. The exact signed envelope is retained; run workspace push to review and explicitly retry this exact batch.");
+    }
+    catch {
+        // Never echo remote payloads, raw argument bundles, tokens or filesystem contents.
+        return fail("Workspace operation stopped safely. Local state was not reset; inspect pairing status and permissions before continuing.");
+    }
+}
 async function signupCommand(args, runtime) {
     const stateFile = signupStateFilePath(runtime.homeDirectory);
     if (args.signupForget) {
@@ -6625,6 +6717,13 @@ function parseArgs(argv) {
         path: process.cwd(),
         parseErrors: []
     };
+    if (command === "workspace" && rest[0] && !rest[0].startsWith("--")) {
+        parsed.workspaceAction = rest.shift();
+        if (parsed.workspaceAction === "connect" && rest[0] && !rest[0].startsWith("--"))
+            parsed.workspaceCode = rest.shift();
+        if (rest.length)
+            parsed.parseErrors.push("workspace accepts only connect [response-bundle], push, status, or disconnect");
+    }
     if (command === "statusline" && rest[0] && !rest[0].startsWith("--")) {
         parsed.statuslineAction = rest.shift();
     }
@@ -7288,6 +7387,13 @@ function helpText(telemetryDisclosure) {
         `  ${actionRuntimeCommand("outcome github")}    Attach one merged PR whose observed status checks passed`,
         `  ${actionRuntimeCommand("accountability")}    Answer owner → outcome → approval → measured-result for this project`,
         "",
+        "Optional Workspace machine attribution (explicit consent, no provider calls):",
+        "  npx aibill workspace connect         Prepare this machine's public pairing request",
+        "  npx aibill workspace connect <code>  Finish the browser-confirmed pairing",
+        "  npx aibill workspace push            Preview and send local session facts",
+        "  npx aibill workspace status          Read local pairing/pending status only",
+        "  npx aibill workspace disconnect      Revoke the grant or abandon an unused pairing key",
+        "",
         "Add official provider-reported cost (ADMIN/owner-gated):",
         "  npx aibill connect openai            Requires an org-owner Admin credential reference",
         "  npx aibill connect anthropic         Requires an Admin credential reference",

package/dist/lib/clock.d.ts

@@ -0,0 +1,6 @@
+/** Workspace command clock. Tests inject the instant at the command boundary. */
+export declare const workspaceClock: {
+    now: () => string;
+    daysBefore: (now: string, days: number) => string;
+};
+//# sourceMappingURL=clock.d.ts.map

package/dist/lib/clock.js

@@ -0,0 +1,6 @@
+/** Workspace command clock. Tests inject the instant at the command boundary. */
+export const workspaceClock = {
+    now: () => new Date().toISOString(),
+    daysBefore: (now, days) => `${new Date(Date.parse(now) - days * 86400000).toISOString().slice(0, 10)}T00:00:00.000Z`,
+};
+//# sourceMappingURL=clock.js.map

package/dist/projectAccountabilityState.js

@@ -566,9 +566,20 @@ async function ensureIgnoredPrivateBoundary(privateBase, gitRoot, create) {
     const tracked = await execFile("git", ["-C", gitRoot, "ls-files", "--", relativeBase], {
         encoding: "utf8",
         maxBuffer: 64 * 1024
-    }).then(({ stdout }) => stdout.trim()).catch(() => {
+    }).then(({ stdout }) => stdout.trim()).catch((error) => {
+        // A `.git` entry that Git itself rejects is not a repository: an
+        // interrupted `git init`, or a copied `.git` with no `objects/`, leaves
+        // an entry `lstat` sees but Git refuses to open. Nothing under such a
+        // directory can be staged or committed, so there is no tracking to
+        // verify and no boundary to prove -- the `*` marker written above still
+        // protects the state if a real repository is ever initialised here.
+        // Every other failure stays genuinely unverifiable and must refuse.
+        if (isNonRepositoryGitFailure(error))
+            return undefined;
         throw new ProjectAccountabilityStateError("malformed_state", "Private project accountability tracking status could not be verified.");
     });
+    if (tracked === undefined)
+        return;
     if (tracked) {
         throw new ProjectAccountabilityStateError("malformed_state", "Private project accountability storage is already tracked by Git.");
     }
@@ -833,6 +844,20 @@ function hasExactKeys(value, expected) {
     return keys.length === sorted.length &&
         keys.every((key, index) => key === sorted[index]);
 }
+/**
+ * True only when Git itself ran and reported that the directory is not a
+ * repository. A spawn failure (Git missing) carries a string `code` and a
+ * non-zero exit carries a numeric one, so an environment where Git cannot be
+ * consulted at all keeps the conservative "unverifiable" refusal.
+ */
+function isNonRepositoryGitFailure(error) {
+    if (!(error instanceof Error))
+        return false;
+    if (typeof error.code !== "number")
+        return false;
+    const stderr = error.stderr;
+    return typeof stderr === "string" && /not a git repository/i.test(stderr);
+}
 function isNodeError(error, code) {
     return error instanceof Error && error.code === code;
 }

package/dist/workspaceConnect.d.ts

@@ -0,0 +1,228 @@
+import { type LocalAgentCall } from "@agent-finops/core";
+export declare const WORKSPACE_ORIGIN = "https://app.asktilden.com";
+export declare const WORKSPACE_FACTS_PATH = "/api/workspace/local-session-facts";
+type Json = null | boolean | number | string | Json[] | {
+    [key: string]: Json;
+};
+export type WorkspaceTokens = {
+    uncachedInputTokens: string | null;
+    cacheReadTokens: string | null;
+    cacheWriteTokens: string | null;
+    outputTokens: string | null;
+};
+export type WorkspaceFact = {
+    day: string;
+    agent: "claude-code" | "codex";
+    provider: "anthropic" | "openai";
+    model: string;
+    projectName: string | null;
+    directoryRef: string;
+    apiKeyRef: null;
+    workspaceRef: null;
+    sessionCount: string;
+    sessionRefs: string[];
+    tokens: WorkspaceTokens;
+    sessionsHash: string;
+    factRevision: string;
+};
+export type WorkspaceFactState = Record<string, {
+    revision: string;
+    contentHash: string;
+}>;
+export type WorkspaceDevice = {
+    origin: typeof WORKSPACE_ORIGIN;
+    grantId: string;
+    keyId: string;
+    grantRevision: string;
+    connectionEpoch: string;
+    token: string;
+    privateKeyPem: string;
+    sequence: string;
+    collectionNotBefore: string;
+    authorityStartsAt: string;
+    expiresAt: string;
+};
+export type WorkspaceEnvelope = {
+    schemaVersion: "1";
+    deviceGrantId: string;
+    grantRevision: string;
+    deviceKeyId: string;
+    sequence: string;
+    nonce: string;
+    batchId: string;
+    idempotencyKey: string;
+    generatedAt: string;
+    facts: WorkspaceFact[];
+    manifestHash: string;
+    signature: {
+        algorithm: "ed25519";
+        canonicalization: "jcs-v1";
+        value: string;
+    };
+};
+export type WorkspacePending = {
+    envelope: WorkspaceEnvelope;
+    state: "ready" | "uncertain" | "refused";
+    refusal: "invalid" | "conflict" | "stale" | "expired" | null;
+};
+export type WorkspaceState = {
+    version: 1;
+    device: WorkspaceDevice;
+    facts: WorkspaceFactState;
+    pending: WorkspacePending | null;
+    lastAcceptedAt: string | null;
+    disconnect: null | {
+        state: "uncertain" | "revoked";
+        requestId: string;
+        revokedAt: string | null;
+    };
+};
+export type WorkspaceAggregate = {
+    facts: WorkspaceFact[];
+    excludedCalls: number;
+    incompleteComponents: number;
+    reasons: string[];
+};
+export declare function workspaceCanonicalJson(value: Json): string;
+export declare const workspaceDomainHash: (domain: string, value: Json) => string;
+export declare function workspaceFactKey(fact: WorkspaceFact): string;
+export declare function workspaceFactContentHash(fact: WorkspaceFact): string;
+/** Caller supplies approved numeric-only calls; this function never opens local logs. */
+export declare function aggregateWorkspaceFacts(calls: readonly LocalAgentCall[], previous?: WorkspaceFactState, deviceKeyId?: string): WorkspaceAggregate;
+export declare function buildWorkspaceEnvelope(device: WorkspaceDevice, facts: WorkspaceFact[], generatedAt: string): WorkspaceEnvelope;
+export type WorkspaceStatus = {
+    state: "not_connected";
+} | {
+    state: "connected";
+    origin: string;
+    lastAcceptedAt: string | null;
+    acknowledgedFacts: number;
+    disconnect: "uncertain" | "revoked" | null;
+    pending: null | {
+        state: WorkspacePending["state"];
+        factCount: number;
+        generatedAt: string;
+        refusal: WorkspacePending["refusal"];
+    };
+};
+/** Reads only the private pairing record; never logs, a provider, or the Workspace. */
+export declare function workspaceStatus(home?: string): Promise<WorkspaceStatus>;
+export type WorkspaceTransportResult = {
+    status: number;
+    body: unknown;
+};
+export type WorkspaceTransport = (path: typeof WORKSPACE_FACTS_PATH, payload: string, token: string) => Promise<WorkspaceTransportResult>;
+/** HTTPS native transport avoids browser Origin/Sec-Fetch headers and never follows redirects. */
+export declare const workspaceTransport: WorkspaceTransport;
+export declare const WORKSPACE_DISCONNECT_PATH = "/api/workspace/machines/disconnect";
+export type WorkspaceDisconnectTransport = (payload: string, token: string) => Promise<WorkspaceTransportResult>;
+export declare const workspaceDisconnectTransport: WorkspaceDisconnectTransport;
+export declare const WORKSPACE_EXCHANGE_PATH = "/api/workspace/device-enrollment/exchange";
+export type WorkspaceExchangeTransport = (payload: string) => Promise<WorkspaceTransportResult>;
+export declare const workspaceExchangeTransport: WorkspaceExchangeTransport;
+/** Consent precedes durable preparation. A pending batch is never replaced with a fresh nonce. */
+export declare function prepareWorkspacePush(options: {
+    home?: string;
+    calls: readonly LocalAgentCall[];
+    generatedAt: string;
+    confirm: (exactPayload: string, coverage: WorkspaceAggregate) => Promise<boolean>;
+}): Promise<{
+    state: "prepared" | "pending" | "unchanged" | "cancelled";
+    coverage?: WorkspaceAggregate;
+}>;
+/** One attempt. Uncertain/refused batches remain retained and cannot silently be resubmitted. */
+export declare function sendWorkspacePending(options: {
+    home?: string;
+    transport?: WorkspaceTransport;
+}): Promise<{
+    state: "accepted" | "refused" | "unconfirmed";
+    factCount?: number;
+}>;
+export type WorkspaceEnrollmentRequest = {
+    schemaVersion: "1";
+    kind: "tilden_machine_enrollment_request";
+    origin: typeof WORKSPACE_ORIGIN;
+    publicKey: string;
+    keyId: string;
+    requestId: string;
+};
+export type WorkspaceEnrollmentIntent = {
+    publicKey: string;
+    keyId: string;
+    requestId: string;
+    localSourceInstanceRef: string;
+    policyRevision: string;
+    readerRevision: string;
+    projectAdmissionRevision: string;
+    collectionNotBefore: string;
+    authorityStartsAt: string;
+    grantExpiresAt: string;
+};
+export type WorkspaceEnrollmentResponse = {
+    schemaVersion: "1";
+    kind: "tilden_machine_enrollment_response";
+    origin: typeof WORKSPACE_ORIGIN;
+    intent: WorkspaceEnrollmentIntent;
+    binding: {
+        tenantId: string;
+        policy: Record<string, Json>;
+        projectId: string;
+        sourceProjectRef: string;
+    };
+    receipt: {
+        state: "prepared";
+        challengeId: string;
+        requestHash: string;
+        grantId: string;
+        deviceId: string;
+        policy: Record<string, Json>;
+        projectId: string;
+        projectRevision: string;
+        sourceProjectRef: string;
+        collectionNotBefore: string;
+        authorityStartsAt: string;
+        grantExpiresAt: string;
+        nonce: string;
+        pairingCode: string;
+    };
+    confirmation: {
+        state: "confirmed";
+        challengeId: string;
+    };
+};
+export declare function encodeWorkspaceBundle(value: WorkspaceEnrollmentRequest | WorkspaceEnrollmentResponse): string;
+/** Generates native custody before displaying public enrollment material. No network call. */
+export declare function beginWorkspaceEnrollment(home?: string): Promise<{
+    request: WorkspaceEnrollmentRequest;
+    bundle: string;
+}>;
+export declare function validateWorkspaceEnrollmentResponse(request: WorkspaceEnrollmentRequest, response: WorkspaceEnrollmentResponse, now: string): string;
+/** Exchange is marked uncertain durably before dispatch and is never retried implicitly. */
+export declare function finishWorkspaceEnrollment(options: {
+    home?: string;
+    bundle: string;
+    now: string;
+    confirm: (details: {
+        origin: string;
+        collectionNotBefore: string;
+        grantExpiresAt: string;
+        localSourceInstanceRef: string;
+        tenantId: string;
+        projectId: string;
+        sourceProjectRef: string;
+        policy: Record<string, Json>;
+    }) => Promise<boolean>;
+    transport?: WorkspaceExchangeTransport;
+}): Promise<{
+    state: "connected" | "cancelled" | "unconfirmed";
+}>;
+/** Revocation is one native attempt. Unknown outcomes retain keys and block further writes. */
+export declare function disconnectWorkspace(options: {
+    home?: string;
+    confirm: (action: "revoke" | "abandon_unexchanged") => Promise<boolean>;
+    transport?: WorkspaceDisconnectTransport;
+}): Promise<{
+    state: "revoked" | "abandoned" | "cancelled" | "unconfirmed" | "not_paired";
+}>;
+export {};
+//# sourceMappingURL=workspaceConnect.d.ts.map

package/dist/workspaceConnect.js

@@ -0,0 +1,730 @@
+/** Native Workspace pairing, transport, and retained facts. No implicit log scan. */
+import { constants } from "node:fs";
+import { lstat, mkdir, open, realpath, rename, unlink } from "node:fs/promises";
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, verify } from "node:crypto";
+import { request as httpsRequest } from "node:https";
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+import { dedupeCumulativeSessionCalls } from "@agent-finops/core";
+export const WORKSPACE_ORIGIN = "https://app.asktilden.com";
+export const WORKSPACE_FACTS_PATH = "/api/workspace/local-session-facts";
+const MAX_BYTES = 262144;
+const MAX_STATE_BYTES = 8 * 1024 * 1024;
+const MAX_FACTS = 256;
+const STATE_FILE = "workspace-device.json";
+const LOCK_FILE = ".workspace-device.lock";
+const REF = /^oref_[A-Za-z0-9_-]{43}$/;
+const HASH = /^sha256_[a-f0-9]{64}$/;
+const UINT = /^(0|[1-9][0-9]{0,24})$/;
+const DAY_FORMAT = new Intl.DateTimeFormat("sv-SE", { timeZone: "UTC", year: "numeric", month: "2-digit", day: "2-digit" });
+export function workspaceCanonicalJson(value) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw Error("Workspace JSON contains a non-finite number.");
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(workspaceCanonicalJson).join(",")}]`;
+    if (typeof value !== "object" || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)
+        throw Error("Workspace JSON contains an unsupported value.");
+    return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${workspaceCanonicalJson(value[key])}`).join(",")}}`;
+}
+const sha = (value) => `sha256_${createHash("sha256").update(value, "utf8").digest("hex")}`;
+export const workspaceDomainHash = (domain, value) => {
+    if (!/^[a-z][a-z0-9-]*(?::[a-z0-9-]+)+:v[1-9][0-9]*$/.test(domain))
+        throw Error("Workspace hash domain is invalid.");
+    return sha(`${domain}\0${workspaceCanonicalJson(value)}`);
+};
+export function workspaceFactKey(fact) {
+    const { day, agent, provider, model, projectName, directoryRef, apiKeyRef, workspaceRef } = fact;
+    return workspaceDomainHash("tilden:local-session-fact-key:v1", { day, agent, provider, model, projectName, directoryRef, apiKeyRef, workspaceRef });
+}
+export function workspaceFactContentHash(fact) {
+    const { factRevision: ignored, ...content } = fact;
+    return workspaceDomainHash("tilden:local-session-fact-content:v1", content);
+}
+function utcDay(value) {
+    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/.test(value) || !Number.isFinite(Date.parse(value)))
+        throw Error("Local call has no canonical UTC timestamp.");
+    const day = DAY_FORMAT.format(Date.parse(value));
+    if (day !== value.slice(0, 10))
+        throw Error("Local call calendar day is invalid.");
+    return day;
+}
+function safeDirectoryRef(call) {
+    let supplied;
+    if (call.workingDirectoryRef) {
+        if (/^avref_[a-f0-9]{64}$/.test(call.workingDirectoryRef))
+            supplied = `sha256_${call.workingDirectoryRef.slice(6)}`;
+        else if (HASH.test(call.workingDirectoryRef))
+            supplied = call.workingDirectoryRef;
+        else
+            throw Error("directory_identity_invalid");
+    }
+    const derived = call.workingDirectory && isAbsolute(call.workingDirectory)
+        ? sha(`project-working-directory\0${call.workingDirectory}`) : undefined;
+    if (supplied && derived && supplied !== derived)
+        throw Error("directory_identity_conflict");
+    if (!supplied && !derived)
+        throw Error("directory_identity_missing");
+    return supplied ?? derived;
+}
+function component(value, supported) {
+    return supported && Number.isSafeInteger(value) && value >= 0 ? BigInt(value) : null;
+}
+function tokenComponents(call) {
+    const supported = call.usageSupport !== "unsupported_token_shape";
+    const evidence = call.tokenComponentEvidence;
+    const cacheWrites = supported && evidence?.cacheWriteTokens === "observed"
+        ? [component(call.usage.cacheWrite5mTokens ?? 0, true), component(call.usage.cacheWrite1hTokens ?? 0, true)] : [null, null];
+    return {
+        uncachedInputTokens: component(call.usage.inputTokens, supported && (call.agent !== "codex" || evidence?.cacheReadTokens === "observed")),
+        outputTokens: component(call.usage.outputTokens, supported),
+        cacheReadTokens: component(call.usage.cacheReadTokens, supported && evidence?.cacheReadTokens === "observed"),
+        cacheWriteTokens: cacheWrites.every(value => value !== null) ? cacheWrites[0] + cacheWrites[1] : null,
+    };
+}
+/** Caller supplies approved numeric-only calls; this function never opens local logs. */
+export function aggregateWorkspaceFacts(calls, previous = {}, deviceKeyId) {
+    if (!deviceKeyId || !REF.test(deviceKeyId))
+        throw Error("A retained device key is required for private session identities.");
+    const groups = new Map(), reasons = new Set();
+    let excludedCalls = 0, incompleteComponents = 0;
+    for (const call of dedupeCumulativeSessionCalls([...calls])) {
+        if (call.agent !== "claude-code" && call.agent !== "codex")
+            continue;
+        try {
+            const day = utcDay(call.timestamp);
+            if (!call.sessionId)
+                throw Error("session_identity_missing");
+            if (call.usageScope === "session_cumulative") {
+                if (!call.startedAt || utcDay(call.startedAt) !== day || Date.parse(call.startedAt) > Date.parse(call.timestamp))
+                    throw Error("cumulative_day_unresolved");
+            }
+            else if (call.usageScope !== "turn")
+                throw Error("call_scope_unresolved");
+            if (!/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,119}$/.test(call.model))
+                throw Error("model_invalid");
+            let projectName = call.project && call.project !== "(home)" ? call.project : null;
+            if (projectName && (projectName.length > 120 || /[/\\\u0000-\u001f\u007f@]/.test(projectName) || [".", ".."].includes(projectName)))
+                projectName = null;
+            const fact = { day, agent: call.agent, provider: call.agent === "claude-code" ? "anthropic" : "openai",
+                model: call.model, projectName, directoryRef: safeDirectoryRef(call), apiKeyRef: null, workspaceRef: null,
+                sessionCount: "1", sessionRefs: [], tokens: { uncachedInputTokens: null, cacheReadTokens: null, cacheWriteTokens: null, outputTokens: null },
+                sessionsHash: sha(""), factRevision: "1" };
+            const key = workspaceFactKey(fact), tokens = tokenComponents(call), group = groups.get(key);
+            const identity = workspaceDomainHash("tilden:local-session-identity:v1", [deviceKeyId, call.agent, call.sessionId, call.subagentId ?? null]);
+            if (group) {
+                group.sessions.add(identity);
+                for (const name of Object.keys(tokens))
+                    group.tokens[name] = group.tokens[name] === null || tokens[name] === null ? null : group.tokens[name] + tokens[name];
+            }
+            else
+                groups.set(key, { fact, sessions: new Set([identity]), tokens });
+        }
+        catch (error) {
+            excludedCalls++;
+            const reason = error instanceof Error ? error.message : "call_invalid";
+            reasons.add(/^[a-z_]+$/.test(reason) ? reason : "timestamp_invalid");
+        }
+    }
+    const facts = [];
+    for (const [key, group] of [...groups.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+        const fact = group.fact;
+        if (group.sessions.size > 1024)
+            throw Error("A local fact exceeds the session identity bound.");
+        fact.sessionCount = String(group.sessions.size);
+        fact.sessionRefs = [...group.sessions].sort();
+        fact.sessionsHash = workspaceDomainHash("tilden:local-session-identities:v1", fact.sessionRefs);
+        for (const name of Object.keys(group.tokens)) {
+            fact.tokens[name] = group.tokens[name]?.toString() ?? null;
+            if (fact.tokens[name] === null)
+                incompleteComponents++;
+        }
+        const prior = previous[key];
+        if (prior && prior.contentHash === workspaceFactContentHash(fact))
+            continue;
+        if (prior && !UINT.test(prior.revision))
+            throw Error("Local fact revision is invalid.");
+        fact.factRevision = prior ? String(BigInt(prior.revision) + 1n) : "1";
+        if (!UINT.test(fact.factRevision))
+            throw Error("Local fact revision exceeds its bound.");
+        facts.push(fact);
+    }
+    return { facts, excludedCalls, incompleteComponents, reasons: [...reasons].sort() };
+}
+function exactKeys(value, keys) {
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).sort().join("\0") !== keys.sort().join("\0"))
+        throw Error("Workspace state or receipt has an invalid shape.");
+}
+function bytes(value, count) {
+    return typeof value === "string" && /^[A-Za-z0-9_-]+$/.test(value) && Buffer.from(value, "base64url").length === count
+        && Buffer.from(value, "base64url").toString("base64url") === value;
+}
+function validateFact(fact) {
+    exactKeys(fact, ["day", "agent", "provider", "model", "projectName", "directoryRef", "apiKeyRef", "workspaceRef", "sessionCount", "sessionRefs", "tokens", "sessionsHash", "factRevision"]);
+    exactKeys(fact.tokens, ["uncachedInputTokens", "cacheReadTokens", "cacheWriteTokens", "outputTokens"]);
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(fact.day) || utcDay(`${fact.day}T00:00:00.000Z`) !== fact.day
+        || !["claude-code", "codex"].includes(fact.agent) || fact.provider !== (fact.agent === "claude-code" ? "anthropic" : "openai")
+        || !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,119}$/.test(fact.model) || !HASH.test(fact.directoryRef)
+        || fact.apiKeyRef !== null || fact.workspaceRef !== null || !UINT.test(fact.sessionCount) || fact.sessionCount === "0"
+        || !Array.isArray(fact.sessionRefs) || fact.sessionRefs.length < 1 || fact.sessionRefs.length > 1024
+        || fact.sessionRefs.some((value, index) => !HASH.test(value) || index > 0 && value <= fact.sessionRefs[index - 1])
+        || fact.sessionCount !== String(fact.sessionRefs.length)
+        || workspaceDomainHash("tilden:local-session-identities:v1", fact.sessionRefs) !== fact.sessionsHash
+        || !HASH.test(fact.sessionsHash) || !UINT.test(fact.factRevision)
+        || Object.values(fact.tokens).some(value => value !== null && (typeof value !== "string" || !UINT.test(value)))
+        || fact.projectName !== null && (typeof fact.projectName !== "string" || !fact.projectName.length || fact.projectName.length > 120
+            || /[/\\\u0000-\u001f\u007f@]/.test(fact.projectName) || [".", ".."].includes(fact.projectName)))
+        throw Error("Workspace fact shape is invalid.");
+}
+function validateEnvelope(envelope, device) {
+    exactKeys(envelope, ["schemaVersion", "deviceGrantId", "grantRevision", "deviceKeyId", "sequence", "nonce", "batchId", "idempotencyKey", "generatedAt", "facts", "manifestHash", "signature"]);
+    exactKeys(envelope.signature, ["algorithm", "canonicalization", "value"]);
+    utcDay(envelope.generatedAt);
+    if (envelope.schemaVersion !== "1" || envelope.deviceGrantId !== device.grantId || envelope.deviceKeyId !== device.keyId
+        || envelope.grantRevision !== device.grantRevision || !UINT.test(envelope.sequence)
+        || envelope.sequence !== String(BigInt(device.sequence) + 1n) || !bytes(envelope.nonce, 16)
+        || !REF.test(envelope.batchId) || !REF.test(envelope.idempotencyKey) || !HASH.test(envelope.manifestHash)
+        || !Array.isArray(envelope.facts) || envelope.facts.length < 1 || envelope.facts.length > MAX_FACTS
+        || envelope.signature.algorithm !== "ed25519" || envelope.signature.canonicalization !== "jcs-v1" || !bytes(envelope.signature.value, 64))
+        throw Error("Workspace envelope shape is invalid.");
+    envelope.facts.forEach(validateFact);
+    if (new Set(envelope.facts.map(workspaceFactKey)).size !== envelope.facts.length)
+        throw Error("Duplicate Workspace fact key.");
+    const { signature, manifestHash, ...body } = envelope;
+    if (workspaceDomainHash("tilden:local-session-facts-manifest:v1", body) !== manifestHash
+        || !verify(null, Buffer.from(workspaceCanonicalJson({ ...body, manifestHash })), createPublicKey(device.privateKeyPem), Buffer.from(signature.value, "base64url"))
+        || Buffer.byteLength(workspaceCanonicalJson(envelope)) > MAX_BYTES)
+        throw Error("Workspace envelope binding is invalid.");
+}
+function validateDevice(device) {
+    exactKeys(device, ["origin", "grantId", "keyId", "grantRevision", "connectionEpoch", "token", "privateKeyPem", "sequence", "collectionNotBefore", "authorityStartsAt", "expiresAt"]);
+    [device.collectionNotBefore, device.authorityStartsAt, device.expiresAt].forEach(utcDay);
+    if (device.origin !== WORKSPACE_ORIGIN || !REF.test(device.grantId) || !REF.test(device.keyId)
+        || !UINT.test(device.grantRevision) || !UINT.test(device.connectionEpoch) || !UINT.test(device.sequence)
+        || !bytes(device.token, 32) || typeof device.privateKeyPem !== "string" || device.privateKeyPem.length > 2048
+        || device.authorityStartsAt > device.collectionNotBefore || device.collectionNotBefore >= device.expiresAt
+        || createPrivateKey(device.privateKeyPem).asymmetricKeyType !== "ed25519")
+        throw Error("Workspace device state is invalid.");
+}
+export function buildWorkspaceEnvelope(device, facts, generatedAt) {
+    validateDevice(device);
+    utcDay(generatedAt);
+    facts.forEach(validateFact);
+    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(generatedAt) || facts.length < 1 || facts.length > MAX_FACTS)
+        throw Error("Workspace envelope bounds are invalid.");
+    const sequence = String(BigInt(device.sequence) + 1n);
+    if (!UINT.test(sequence))
+        throw Error("Workspace sequence exceeds its bound.");
+    const body = { schemaVersion: "1", deviceGrantId: device.grantId, grantRevision: device.grantRevision, deviceKeyId: device.keyId,
+        sequence, nonce: randomBytes(16).toString("base64url"), batchId: `oref_${randomBytes(32).toString("base64url")}`,
+        idempotencyKey: `oref_${randomBytes(32).toString("base64url")}`, generatedAt, facts };
+    const unsigned = { ...body, manifestHash: workspaceDomainHash("tilden:local-session-facts-manifest:v1", body) };
+    const envelope = { ...unsigned, signature: { algorithm: "ed25519", canonicalization: "jcs-v1",
+            value: sign(null, Buffer.from(workspaceCanonicalJson(unsigned)), device.privateKeyPem).toString("base64url") } };
+    if (Buffer.byteLength(workspaceCanonicalJson(envelope)) > MAX_BYTES)
+        throw Error("Workspace envelope exceeds its byte bound.");
+    validateEnvelope(envelope, device);
+    return envelope;
+}
+const noFollow = constants.O_NOFOLLOW ?? 0;
+const missing = (error) => error instanceof Error && error.code === "ENOENT";
+async function privateDirectory(home, create) {
+    const canonicalHome = await realpath(resolve(home)), path = join(canonicalHome, ".aibill");
+    if (create)
+        await mkdir(path, { mode: 0o700 }).catch(error => { if (error.code !== "EEXIST")
+            throw error; });
+    const info = await lstat(path);
+    if (!info.isDirectory() || info.isSymbolicLink() || (info.mode & 0o077) !== 0 || process.getuid && info.uid !== process.getuid())
+        throw Error("Workspace private directory is unavailable.");
+    return path;
+}
+async function readState(path) {
+    let file;
+    try {
+        file = await open(join(path, STATE_FILE), constants.O_RDONLY | noFollow);
+    }
+    catch (error) {
+        if (missing(error))
+            return null;
+        throw Error("Workspace state could not be opened safely.");
+    }
+    try {
+        const info = await file.stat();
+        if (!info.isFile() || info.nlink !== 1 || info.mode & 0o077 || info.size > MAX_STATE_BYTES || process.getuid && info.uid !== process.getuid())
+            throw Error("Workspace state is not a private regular file.");
+        const state = JSON.parse(await file.readFile("utf8"));
+        exactKeys(state, ["version", "device", "facts", "pending", "lastAcceptedAt", "disconnect"]);
+        if (state.version !== 1 || !state.facts || typeof state.facts !== "object" || Array.isArray(state.facts))
+            throw Error("Workspace state is invalid.");
+        validateDevice(state.device);
+        if (state.lastAcceptedAt !== null)
+            utcDay(state.lastAcceptedAt);
+        for (const [key, value] of Object.entries(state.facts)) {
+            exactKeys(value, ["revision", "contentHash"]);
+            if (!HASH.test(key) || !UINT.test(value.revision) || !HASH.test(value.contentHash))
+                throw Error("Workspace fact state is invalid.");
+        }
+        if (state.pending) {
+            exactKeys(state.pending, ["envelope", "state", "refusal"]);
+            if (!["ready", "uncertain", "refused"].includes(state.pending.state))
+                throw Error("Workspace pending state is invalid.");
+            if (state.pending.state === "refused" ? !["invalid", "conflict", "stale", "expired"].includes(String(state.pending.refusal)) : state.pending.refusal !== null)
+                throw Error("Workspace refusal state is invalid.");
+            validateEnvelope(state.pending.envelope, state.device);
+        }
+        if (state.disconnect !== null) {
+            exactKeys(state.disconnect, ["state", "requestId", "revokedAt"]);
+            if (!["uncertain", "revoked"].includes(state.disconnect.state) || !REF.test(state.disconnect.requestId)
+                || (state.disconnect.state === "uncertain" ? state.disconnect.revokedAt !== null : typeof state.disconnect.revokedAt !== "string"))
+                throw Error("Workspace disconnect state is invalid.");
+            if (state.disconnect.revokedAt !== null)
+                utcDay(state.disconnect.revokedAt);
+        }
+        return state;
+    }
+    catch {
+        throw Error("Workspace state is unreadable or invalid; it was not reset.");
+    }
+    finally {
+        await file.close();
+    }
+}
+async function atomicState(path, state) {
+    return atomicPrivateJson(path, STATE_FILE, state);
+}
+async function atomicPrivateJson(path, name, value) {
+    const serialized = `${workspaceCanonicalJson(value)}\n`;
+    if (Buffer.byteLength(serialized) > MAX_STATE_BYTES)
+        throw Error("Workspace state exceeds its byte bound.");
+    const temporary = join(path, `.workspace-device-${randomBytes(16).toString("hex")}.tmp`);
+    const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow, 0o600);
+    try {
+        await handle.writeFile(serialized);
+        await handle.sync();
+        await handle.close();
+        await rename(temporary, join(path, name));
+        const directory = await open(path, constants.O_RDONLY | noFollow);
+        try {
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+        await unlink(temporary).catch(error => { if (!missing(error))
+            throw error; });
+    }
+}
+async function withState(home, callback) {
+    const path = await privateDirectory(home, true), directory = await lstat(path);
+    let lock;
+    try {
+        lock = await open(join(path, LOCK_FILE), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow, 0o600);
+    }
+    catch {
+        throw Error("Workspace state is locked. Do not remove a lock while another Workspace command is running.");
+    }
+    const identity = await lock.stat();
+    try {
+        return await callback(await readState(path), async (state) => {
+            const current = await lstat(path);
+            if (current.dev !== directory.dev || current.ino !== directory.ino || current.isSymbolicLink())
+                throw Error("Workspace state directory changed.");
+            await atomicState(path, state);
+        }, path);
+    }
+    finally {
+        await lock.close();
+        const current = await lstat(join(path, LOCK_FILE)).catch(() => null);
+        if (current?.dev === identity.dev && current.ino === identity.ino)
+            await unlink(join(path, LOCK_FILE));
+    }
+}
+/** Reads only the private pairing record; never logs, a provider, or the Workspace. */
+export async function workspaceStatus(home = homedir()) {
+    let path;
+    try {
+        path = await privateDirectory(home, false);
+    }
+    catch (error) {
+        if (missing(error))
+            return { state: "not_connected" };
+        throw error;
+    }
+    const state = await readState(path);
+    return state ? { state: "connected", origin: state.device.origin, lastAcceptedAt: state.lastAcceptedAt,
+        acknowledgedFacts: Object.keys(state.facts).length, disconnect: state.disconnect?.state ?? null, pending: state.pending ? { state: state.pending.state,
+            factCount: state.pending.envelope.facts.length, generatedAt: state.pending.envelope.generatedAt, refusal: state.pending.refusal } : null }
+        : { state: "not_connected" };
+}
+/** HTTPS native transport avoids browser Origin/Sec-Fetch headers and never follows redirects. */
+export const workspaceTransport = (path, payload, token) => workspaceNativeRequest(path, payload, token);
+export const WORKSPACE_DISCONNECT_PATH = "/api/workspace/machines/disconnect";
+export const workspaceDisconnectTransport = (payload, token) => workspaceNativeRequest(WORKSPACE_DISCONNECT_PATH, payload, token);
+export const WORKSPACE_EXCHANGE_PATH = "/api/workspace/device-enrollment/exchange";
+export const workspaceExchangeTransport = payload => workspaceNativeRequest(WORKSPACE_EXCHANGE_PATH, payload);
+function workspaceNativeRequest(path, payload, token) {
+    return new Promise((resolveResult, reject) => {
+        if (![WORKSPACE_FACTS_PATH, WORKSPACE_EXCHANGE_PATH, WORKSPACE_DISCONNECT_PATH].includes(path) || Buffer.byteLength(payload) > MAX_BYTES
+            || (path !== WORKSPACE_EXCHANGE_PATH ? !bytes(token, 32) : token !== undefined)) {
+            reject(Error("Workspace request is invalid."));
+            return;
+        }
+        let settled = false;
+        const finish = (error, result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (error)
+                reject(error);
+            else
+                resolveResult(result);
+        };
+        const request = httpsRequest(`${WORKSPACE_ORIGIN}${path}`, { method: "POST", headers: {
+                "content-type": "application/json", "content-length": Buffer.byteLength(payload), ...(token ? { authorization: `Device ${token}` } : {}),
+            } }, response => {
+            const parts = [];
+            let size = 0;
+            response.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > MAX_BYTES) {
+                    response.destroy();
+                    request.destroy();
+                    finish(Error("Workspace response exceeded its bound."));
+                }
+                else
+                    parts.push(chunk);
+            });
+            response.on("error", () => finish(Error("Workspace response was interrupted.")));
+            response.on("end", () => {
+                if (settled)
+                    return;
+                const status = response.statusCode ?? 0;
+                if (status >= 300 && status < 400) {
+                    finish(Error("Workspace redirect refused."));
+                    return;
+                }
+                try {
+                    finish(undefined, { status, body: JSON.parse(Buffer.concat(parts).toString("utf8")) });
+                }
+                catch {
+                    finish(Error("Workspace response was not valid JSON."));
+                }
+            });
+        });
+        const timer = setTimeout(() => { request.destroy(); finish(Error("Workspace request timed out; its outcome is unknown.")); }, 30000);
+        request.on("error", () => finish(Error("Workspace request failed; its outcome is unknown.")));
+        request.end(payload);
+    });
+}
+/** Consent precedes durable preparation. A pending batch is never replaced with a fresh nonce. */
+export async function prepareWorkspacePush(options) {
+    return withState(options.home ?? homedir(), async (state, save) => {
+        if (!state)
+            throw Error("This machine is not connected to a Workspace.");
+        if (state.disconnect)
+            throw Error("Disconnect is pending or complete; no facts may be sent.");
+        if (state.pending) {
+            if (state.pending.state === "refused")
+                return { state: "pending" };
+            const coverage = { facts: state.pending.envelope.facts, excludedCalls: 0, incompleteComponents: 0, reasons: ["retained_pending_batch"] };
+            if (!await options.confirm(workspaceCanonicalJson(state.pending.envelope), coverage))
+                return { state: "cancelled", coverage };
+            // Explicit consent permits only the identical retained envelope to be attempted again.
+            if (state.pending.state === "uncertain")
+                await save({ ...state, pending: { ...state.pending, state: "ready" } });
+            return { state: "prepared", coverage };
+        }
+        const coverage = aggregateWorkspaceFacts(options.calls, state.facts, state.device.keyId);
+        if (coverage.excludedCalls)
+            throw Error("Incomplete source identities cannot replace complete daily facts.");
+        const today = utcDay(options.generatedAt), authority = Math.max(Date.parse(state.device.collectionNotBefore), Date.parse(state.device.authorityStartsAt));
+        const eligible = coverage.facts.filter(fact => fact.day < today && Date.parse(`${fact.day}T00:00:00.000Z`) >= authority
+            && Date.parse(`${fact.day}T00:00:00.000Z`) + 86400000 <= Date.parse(state.device.expiresAt));
+        if (eligible.length !== coverage.facts.length)
+            coverage.reasons.push("outside_closed_authorized_days");
+        coverage.facts = eligible;
+        if (!coverage.facts.length)
+            return { state: "unchanged", coverage };
+        const envelope = buildWorkspaceEnvelope(state.device, coverage.facts.slice(0, MAX_FACTS), options.generatedAt);
+        if (!await options.confirm(workspaceCanonicalJson(envelope), coverage))
+            return { state: "cancelled", coverage };
+        await save({ ...state, pending: { envelope, state: "ready", refusal: null } });
+        return { state: "prepared", coverage };
+    });
+}
+/** One attempt. Uncertain/refused batches remain retained and cannot silently be resubmitted. */
+export async function sendWorkspacePending(options) {
+    return withState(options.home ?? homedir(), async (state, save) => {
+        if (!state?.pending)
+            throw Error("No prepared Workspace batch exists.");
+        if (state.disconnect)
+            throw Error("Disconnect is pending or complete; no facts may be sent.");
+        if (state.pending.state !== "ready")
+            throw Error("This batch already has a result or an uncertain outcome; reconcile it before another push.");
+        const envelope = state.pending.envelope;
+        const dispatched = { ...state, pending: { ...state.pending, state: "uncertain" } };
+        await save(dispatched);
+        let result;
+        try {
+            result = await (options.transport ?? workspaceTransport)(WORKSPACE_FACTS_PATH, workspaceCanonicalJson(envelope), state.device.token);
+        }
+        catch {
+            return { state: "unconfirmed" };
+        }
+        try {
+            const receipt = result.body;
+            if (result.status === 200) {
+                exactKeys(receipt, ["state", "batchId", "manifestHash", "factCount", "introduced", "replaced", "unchanged", "acceptedAt"]);
+                if (receipt.state !== "accepted" || receipt.batchId !== envelope.batchId || receipt.manifestHash !== envelope.manifestHash
+                    || receipt.factCount !== envelope.facts.length || typeof receipt.acceptedAt !== "string")
+                    throw Error("receipt_mismatch");
+                utcDay(receipt.acceptedAt);
+                const counts = [receipt.introduced, receipt.replaced, receipt.unchanged];
+                if (counts.some(value => !Number.isSafeInteger(value) || value < 0)
+                    || counts.reduce((sum, value) => sum + value, 0) !== envelope.facts.length)
+                    throw Error("receipt_counts");
+                const facts = { ...state.facts };
+                for (const fact of envelope.facts)
+                    facts[workspaceFactKey(fact)] = { revision: fact.factRevision, contentHash: workspaceFactContentHash(fact) };
+                await save({ ...state, device: { ...state.device, sequence: envelope.sequence }, facts, pending: null, lastAcceptedAt: receipt.acceptedAt });
+                return { state: "accepted", factCount: envelope.facts.length };
+            }
+            if (result.status === 409) {
+                exactKeys(receipt, ["state", "reason"]);
+                if (receipt.state !== "refused" || !["invalid", "conflict", "stale", "expired"].includes(String(receipt.reason)))
+                    throw Error("receipt_refusal");
+                await save({ ...dispatched, pending: { envelope, state: "refused", refusal: receipt.reason } });
+                return { state: "refused" };
+            }
+        }
+        catch {
+            return { state: "unconfirmed" };
+        }
+        return { state: "unconfirmed" };
+    });
+}
+const ENROLLMENT_FILE = "workspace-enrollment.json";
+export function encodeWorkspaceBundle(value) {
+    return Buffer.from(workspaceCanonicalJson(value), "utf8").toString("base64url");
+}
+function parseWorkspaceResponseBundle(code) {
+    if (code.length > 32768 || !/^[A-Za-z0-9_-]+$/.test(code))
+        throw Error("The Workspace response bundle is invalid.");
+    const decoded = Buffer.from(code, "base64url");
+    if (decoded.toString("base64url") !== code)
+        throw Error("The Workspace response bundle is not canonical.");
+    let value;
+    try {
+        value = JSON.parse(decoded.toString("utf8"));
+    }
+    catch {
+        throw Error("The Workspace response bundle is invalid.");
+    }
+    if (Buffer.from(workspaceCanonicalJson(value)).toString("base64url") !== code)
+        throw Error("The Workspace response bundle is not canonical.");
+    exactKeys(value, ["schemaVersion", "kind", "origin", "intent", "binding", "receipt", "confirmation"]);
+    if (value.schemaVersion !== "1" || value.kind !== "tilden_machine_enrollment_response" || value.origin !== WORKSPACE_ORIGIN)
+        throw Error("The Workspace response bundle has a different origin or purpose.");
+    return value;
+}
+async function readEnrollment(path) {
+    let handle;
+    try {
+        handle = await open(join(path, ENROLLMENT_FILE), constants.O_RDONLY | noFollow);
+    }
+    catch (error) {
+        if (missing(error))
+            return null;
+        throw Error("Workspace enrollment could not be opened safely.");
+    }
+    try {
+        const info = await handle.stat();
+        if (!info.isFile() || info.nlink !== 1 || info.mode & 0o077 || info.size > 16384 || process.getuid && info.uid !== process.getuid())
+            throw Error("Workspace enrollment is not a private regular file.");
+        const state = JSON.parse(await handle.readFile("utf8"));
+        exactKeys(state, ["version", "request", "privateKeyPem", "state"]);
+        exactKeys(state.request, ["schemaVersion", "kind", "origin", "publicKey", "keyId", "requestId"]);
+        if (state.version !== 1 || !["prepared", "exchange_uncertain"].includes(state.state)
+            || state.request.schemaVersion !== "1" || state.request.kind !== "tilden_machine_enrollment_request"
+            || state.request.origin !== WORKSPACE_ORIGIN || !bytes(state.request.publicKey, 32)
+            || ![state.request.keyId, state.request.requestId].every(value => REF.test(value))
+            || createPublicKey(state.privateKeyPem).export({ format: "jwk" }).x !== state.request.publicKey)
+            throw Error("Workspace enrollment state is invalid.");
+        return state;
+    }
+    catch {
+        throw Error("Workspace enrollment state is unreadable or invalid; it was not reset.");
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Generates native custody before displaying public enrollment material. No network call. */
+export async function beginWorkspaceEnrollment(home = homedir()) {
+    return withState(home, async (device, _save, path) => {
+        if (device)
+            throw Error("This machine is already connected. Disconnect it in the Workspace before pairing it again.");
+        const retained = await readEnrollment(path);
+        if (retained?.state === "exchange_uncertain")
+            throw Error("The earlier exchange outcome is unknown. Revoke that enrollment in the Workspace before starting again.");
+        if (retained)
+            return { request: retained.request, bundle: encodeWorkspaceBundle(retained.request) };
+        const pair = generateKeyPairSync("ed25519"), ref = () => `oref_${randomBytes(32).toString("base64url")}`;
+        const request = { schemaVersion: "1", kind: "tilden_machine_enrollment_request", origin: WORKSPACE_ORIGIN,
+            publicKey: pair.publicKey.export({ format: "jwk" }).x, keyId: ref(), requestId: ref() };
+        await atomicPrivateJson(path, ENROLLMENT_FILE, { version: 1, request,
+            privateKeyPem: pair.privateKey.export({ format: "pem", type: "pkcs8" }).toString(), state: "prepared" });
+        return { request, bundle: encodeWorkspaceBundle(request) };
+    });
+}
+export function validateWorkspaceEnrollmentResponse(request, response, now) {
+    utcDay(now);
+    const { intent, binding, receipt, confirmation } = response;
+    exactKeys(intent, ["publicKey", "keyId", "requestId", "localSourceInstanceRef", "policyRevision", "readerRevision", "projectAdmissionRevision", "collectionNotBefore", "authorityStartsAt", "grantExpiresAt"]);
+    exactKeys(binding, ["tenantId", "policy", "projectId", "sourceProjectRef"]);
+    if (typeof binding.tenantId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,254}$/.test(binding.tenantId))
+        throw Error("The selected tenant reference is invalid.");
+    exactKeys(receipt, ["state", "challengeId", "requestHash", "grantId", "deviceId", "policy", "projectId", "projectRevision", "sourceProjectRef", "collectionNotBefore", "authorityStartsAt", "grantExpiresAt", "nonce", "pairingCode"]);
+    exactKeys(confirmation, ["state", "challengeId"]);
+    for (const key of ["publicKey", "keyId", "requestId"])
+        if (intent[key] !== request[key])
+            throw Error("The response belongs to a different native enrollment request.");
+    const refs = [intent.keyId, intent.requestId, intent.localSourceInstanceRef, intent.policyRevision, intent.readerRevision,
+        intent.projectAdmissionRevision, receipt.grantId, receipt.deviceId, receipt.projectId, receipt.projectRevision, receipt.sourceProjectRef];
+    if (!refs.every(value => REF.test(value)) || !bytes(receipt.nonce, 32) || !bytes(receipt.pairingCode, 16))
+        throw Error("Enrollment receipt contains invalid references.");
+    for (const value of [intent.collectionNotBefore, intent.authorityStartsAt, intent.grantExpiresAt])
+        utcDay(value);
+    const requestHash = workspaceDomainHash("tilden:device-enrollment-request:v1", { ...intent, challengeId: intent.requestId,
+        deviceId: receipt.deviceId, grantId: receipt.grantId, nonceHash: sha(receipt.nonce), pairingCodeHash: sha(receipt.pairingCode) });
+    if (receipt.state !== "prepared" || confirmation.state !== "confirmed" || receipt.challengeId !== intent.requestId
+        || confirmation.challengeId !== receipt.challengeId || receipt.requestHash !== requestHash
+        || receipt.policy.active !== true || receipt.policy.consentRevisionRef !== intent.policyRevision
+        || workspaceCanonicalJson(receipt.policy) !== workspaceCanonicalJson(binding.policy)
+        || receipt.projectId !== binding.projectId || receipt.sourceProjectRef !== binding.sourceProjectRef
+        || receipt.projectRevision !== intent.projectAdmissionRevision || receipt.collectionNotBefore !== intent.collectionNotBefore
+        || receipt.authorityStartsAt !== intent.authorityStartsAt || receipt.grantExpiresAt !== intent.grantExpiresAt
+        || intent.authorityStartsAt > intent.collectionNotBefore || intent.collectionNotBefore >= intent.grantExpiresAt
+        || intent.grantExpiresAt <= now)
+        throw Error("The prepared enrollment does not match its native request and browser confirmation.");
+    return workspaceCanonicalJson({ purpose: "device_enrollment_v1", challengeId: receipt.challengeId,
+        nonce: receipt.nonce, keyId: intent.keyId, requestHash });
+}
+/** Exchange is marked uncertain durably before dispatch and is never retried implicitly. */
+export async function finishWorkspaceEnrollment(options) {
+    return withState(options.home ?? homedir(), async (device, save, path) => {
+        if (device)
+            throw Error("This machine is already connected.");
+        const retained = await readEnrollment(path);
+        if (!retained || retained.state !== "prepared")
+            throw Error("No unused native enrollment exists. Do not replay a completed or uncertain exchange.");
+        const response = parseWorkspaceResponseBundle(options.bundle);
+        const proof = validateWorkspaceEnrollmentResponse(retained.request, response, options.now);
+        if (!await options.confirm({ origin: WORKSPACE_ORIGIN, collectionNotBefore: response.intent.collectionNotBefore,
+            grantExpiresAt: response.intent.grantExpiresAt, localSourceInstanceRef: response.intent.localSourceInstanceRef,
+            tenantId: response.binding.tenantId, projectId: response.binding.projectId, sourceProjectRef: response.binding.sourceProjectRef, policy: response.binding.policy }))
+            return { state: "cancelled" };
+        const body = workspaceCanonicalJson({ challengeId: response.receipt.challengeId, nonce: response.receipt.nonce,
+            signature: sign(null, Buffer.from(proof), retained.privateKeyPem).toString("base64url") });
+        await atomicPrivateJson(path, ENROLLMENT_FILE, { ...retained, state: "exchange_uncertain" });
+        try {
+            const result = await (options.transport ?? workspaceExchangeTransport)(body), receipt = result.body;
+            exactKeys(receipt, ["state", "deviceGrantId", "grantRevision", "deviceKeyId", "connectionEpoch", "expiresAt", "token", "tokenHashKeyVersion"]);
+            if (result.status !== 200 || receipt.state !== "enrolled" || receipt.deviceGrantId !== response.receipt.grantId
+                || receipt.deviceKeyId !== retained.request.keyId || receipt.expiresAt !== response.intent.grantExpiresAt
+                || typeof receipt.grantRevision !== "string" || !UINT.test(receipt.grantRevision)
+                || typeof receipt.connectionEpoch !== "string" || !UINT.test(receipt.connectionEpoch) || !bytes(receipt.token, 32))
+                return { state: "unconfirmed" };
+            const enrolled = { origin: WORKSPACE_ORIGIN, grantId: receipt.deviceGrantId,
+                keyId: receipt.deviceKeyId, grantRevision: receipt.grantRevision, connectionEpoch: receipt.connectionEpoch,
+                token: receipt.token, privateKeyPem: retained.privateKeyPem, sequence: "0",
+                collectionNotBefore: response.intent.collectionNotBefore, authorityStartsAt: response.intent.authorityStartsAt, expiresAt: response.intent.grantExpiresAt };
+            validateDevice(enrolled);
+            await save({ version: 1, device: enrolled, facts: {}, pending: null, lastAcceptedAt: null, disconnect: null });
+            await unlink(join(path, ENROLLMENT_FILE));
+            return { state: "connected" };
+        }
+        catch {
+            return { state: "unconfirmed" };
+        }
+    });
+}
+/** Revocation is one native attempt. Unknown outcomes retain keys and block further writes. */
+export async function disconnectWorkspace(options) {
+    return withState(options.home ?? homedir(), async (state, save, path) => {
+        if (!state) {
+            const enrollment = await readEnrollment(path);
+            if (!enrollment)
+                return { state: "not_paired" };
+            // No exchange can have been dispatched while this state is prepared:
+            // finishWorkspaceEnrollment persists exchange_uncertain before transport.
+            // An unsigned pasted browser receipt never overrides uncertain custody.
+            if (enrollment.state !== "prepared")
+                return { state: "unconfirmed" };
+            if (!await options.confirm("abandon_unexchanged"))
+                return { state: "cancelled" };
+            await unlink(join(path, ENROLLMENT_FILE));
+            const directory = await open(path, constants.O_RDONLY | noFollow);
+            try {
+                await directory.sync();
+            }
+            finally {
+                await directory.close();
+            }
+            return { state: "abandoned" };
+        }
+        if (state.disconnect?.state === "uncertain")
+            return { state: "unconfirmed" };
+        if (!await options.confirm("revoke"))
+            return { state: "cancelled" };
+        if (!state.disconnect) {
+            const proof = { purpose: "machine_disconnect_v1", grantId: state.device.grantId,
+                grantRevision: state.device.grantRevision, connectionEpoch: state.device.connectionEpoch,
+                requestId: `oref_${randomBytes(32).toString("base64url")}` };
+            const body = { ...proof, publicKey: createPublicKey(state.device.privateKeyPem).export({ format: "jwk" }).x,
+                signature: sign(null, Buffer.from(workspaceCanonicalJson(proof)), state.device.privateKeyPem).toString("base64url") };
+            const uncertain = { ...state, disconnect: { state: "uncertain", requestId: proof.requestId, revokedAt: null } };
+            await save(uncertain);
+            try {
+                const result = await (options.transport ?? workspaceDisconnectTransport)(workspaceCanonicalJson(body), state.device.token);
+                const receipt = result.body;
+                exactKeys(receipt, ["state", "grantId", "connectionEpoch", "revokedAt"]);
+                if (result.status !== 200 || receipt.state !== "revoked" || receipt.grantId !== proof.grantId
+                    || receipt.connectionEpoch !== String(BigInt(proof.connectionEpoch) + 1n) || typeof receipt.revokedAt !== "string")
+                    return { state: "unconfirmed" };
+                utcDay(receipt.revokedAt);
+                await save({ ...uncertain, disconnect: { state: "revoked", requestId: proof.requestId, revokedAt: receipt.revokedAt } });
+            }
+            catch {
+                return { state: "unconfirmed" };
+            }
+        }
+        // A durable accepted receipt precedes removal, so a crash cannot authorize another request.
+        for (const name of [ENROLLMENT_FILE, STATE_FILE]) {
+            const target = join(path, name), info = await lstat(target).catch(error => { if (missing(error))
+                return null; throw error; });
+            if (info) {
+                if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.mode & 0o077 || process.getuid && info.uid !== process.getuid())
+                    throw Error("Workspace pairing file is not private; no link target was removed.");
+                await unlink(target);
+            }
+        }
+        const directory = await open(path, constants.O_RDONLY | noFollow);
+        try {
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
+        return { state: "revoked" };
+    });
+}
+//# sourceMappingURL=workspaceConnect.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-spend-agent",
-  "version": "0.9.7",
+  "version": "0.9.8",
   "funding": "https://asktilden.com",
   "description": "Local-first financial accountability CLI: Claude Code/Codex attribution, provenance, and next actions, plus experimental Gemini CLI cost evidence.",
   "type": "module",
@@ -55,8 +55,8 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@agent-finops/core": "0.9.7",
-    "@agent-finops/report": "0.9.7",
+    "@agent-finops/core": "0.9.8",
+    "@agent-finops/report": "0.9.8",
     "yocto-spinner": "^1.2.0"
   }
 }