@hasna/economy 0.3.28 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,124 @@
 # Changelog
 
+## 0.5.0
+
+### Minor Changes
+
+- Make PostgreSQL ingestion transactional, bounded and replay-safe. Preserve exact operation keys and unresolved client journals; verify receipts after a lost response instead of automatically sending the write again.
+- Separate recorded charges, known API-equivalent values, subscription fees and incomplete pricing or billing evidence. Reports carry explicit periods, account identity and completeness instead of implying unknown amounts are zero or paid usage is savings.
+- Preserve collector event, model, account and time provenance, and report scan freshness independently from the latest usage event.
+- Bound high-cardinality CLI and MCP collection output, with explicit complete responses where supported.
+- Add authenticated macOS and iPhone client source and release tooling in the repository, including searchable subscription reporting and recoverable API-cost alerts. Native applications are separate artifacts; this npm package does not install them.
+
+### Patch Changes
+
+- Add explicit historical-data inventory, planning, preservation, restore rehearsal, quarantine and rollback commands. Preserve original rows and immutable operation receipts; bind operations to the effective database target, retain locks through restoration checks, and refuse stale rollback after later activity. These commands do not automatically rewrite historical production data.
+- Commit each PostgreSQL migration and its ledger marker atomically on one connection, serialize runners for the same database/schema, and preserve explicit recovery after an interrupted attempt.
+- Keep HTTP requests responsive during database stalls through bounded asynchronous workers.
+- Keep hosted CLI and MCP clients from opening persistent local SQLite stores. Account attribution fails closed on configuration errors; hosted collection does not silently read another app's local store.
+- Add compact journal inspection and recovery controls. Completed journals and selected stopped native app artifacts are removed through Trash, with recovery identifiers retained.
+- Replace the retired Mac installer with explicit artifact verification, collision-safe installation and preserved quarantine.
+
+The older dashboard-removal and path-resolver Changesets are consumed here for
+release bookkeeping. The published 0.4.0 archive already excluded the dashboard
+and included the same postinstall path resolver; neither is a new data migration
+in 0.5.0.
+
+## 0.4.0
+
+### Minor Changes
+
+- 00118b3: Resolve credentials through the `@hasna/contracts` 1.0.2 client chain (hasna/apps#1720).
+
+  The CLI, the MCP server and the `./sdk` store surface no longer carry a
+  credential chain of their own. All three route through the one resolver in
+  `@hasna/contracts` (bumped from 0.13.4 to the exact 1.0.2), which reads, per
+  call: an explicit `--api-key`/`--profile`, then `HASNA_ECONOMY_API_KEY_OVERRIDE`
+  / `HASNA_PROFILE` / `HASNA_ECONOMY_API_KEY_REF`, then the macOS Keychain item
+  `hasna.credentials.economy.api-key`, then `~/.hasna/economy/config/credentials`
+  (0600, `HASNA_ECONOMY_API_KEY=…`), then `HASNA_ECONOMY_API_KEY`. The authority
+  follows the same ladder — `HASNA_ECONOMY_API_URL`, the Keychain `api-url` item,
+  the credentials file — and now DEFAULTS to the fleet gateway
+  `https://api.hasna.com/economy` once a credential resolves, so a key alone is a
+  complete configuration. A long-lived MCP server re-resolves the credential on
+  every request, so a rotation heals without a restart.
+
+  What this removes:
+
+  - The app's own legacy env chain: the unprefixed serve token `ECONOMY_API_TOKEN`
+    (canonical `HASNA_ECONOMY_API_TOKEN` remains) and `ECONOMY_MACHINE_ID`
+    (canonical `HASNA_ECONOMY_MACHINE_ID`).
+  - Retired `*_MODE` / `*_STORAGE_MODE` switches stay a hard error, and the
+    DEPRECATED notice is gone: `HASNA_ECONOMY_API_KEY` is a legitimate resolver
+    tier, it just sits below the Keychain and the credentials file.
+  - Nothing reads `~/.hasna/fleet-env`, `~/.hasna/cloud`, `~/.config/hasna` or
+    `$XDG_CONFIG_HOME` — the resolver never consults those locations.
+
+  What this keeps and adds:
+
+  - Fail loud (owner directive 2026-09-04): hosted with no credential = non-zero
+    exit, no SQLite file, no `economy-local-fallback` event, and an error naming
+    every tier consulted. Local mode is served only by the explicit opt-in
+    `HASNA_ECONOMY_LOCAL=1` (alias `ECONOMY_LOCAL=1` for one release), which
+    yields to every hosted signal and now prints one `economy: local mode …` line
+    on stderr.
+  - `economy transport` (new CLI command): reports the resolved transport and the
+    credential SOURCE — `/v1` authority, `api_url_source`, `api_key_source`,
+    `api_key_tier` — never the key value; `--json` for the full report. It is the
+    one surface that reports a refusal instead of throwing.
+  - The `./sdk` store surface (`getStore`) is unchanged in shape, and it is the
+    ONLY SDK: the Store takes no `baseUrl`, so the package can never attach an
+    ambient fleet key to a caller-supplied one (hasna/apps#1794) — the authority
+    and the credential both come from the resolver, per call.
+  - `@hasna/contracts` stays a runtime dependency (economy builds with
+    `--packages external`), so the published declarations importing its types
+    resolve for consumers. The `/v1/machines` and `/v1/fleet` surfaces are
+    unchanged and keep working against the resolved authority.
+
+### Patch Changes
+
+- 361d51b: Fail-closed / resolver validation fixes for the hosted-by-default client
+  (hasna/apps#1720, validation round 1).
+
+  - **MCP: no SQLite under the app home in hosted mode.** `economy-mcp` opened
+    the agent-lifecycle registry (`agent-registry.db` plus its WAL/SHM sidecars)
+    at startup — in hosted mode too, before any tool was called. The registry
+    store is now resolved on first tool use, and a hosted client keeps it in
+    memory for the life of the process; only the explicit `HASNA_ECONOMY_LOCAL=1`
+    opt-in persists `agent-registry.db` beside the local store
+    (`HASNA_AGENT_REGISTRY_DB_PATH` still names a file explicitly in either lane).
+  - **MCP: the fail-closed diagnostic is the first stderr line**
+    (`MCP server error: Economy fails closed …`, naming the Keychain item, the
+    credentials file and `HASNA_ECONOMY_API_KEY`) instead of Bun's code frame.
+  - **`economy transport` exits 1 when no credential resolves.** The report is
+    still printed (`--json` included), so the diagnostic stays readable while a
+    script can no longer take a refusal for a hosted transport.
+  - **`economy-otel` follows the storage seam.** With a resolved credential the
+    sidecar forwards the request/session rows of every accepted payload to the
+    shared API's `/v1/ingest` (the response gains `forwarded`; nothing is written
+    under `~/.hasna/economy`); under `HASNA_ECONOMY_LOCAL=1` it writes the
+    on-box store and announces local mode on stderr; with neither it fails
+    closed before binding. `economy-otel` stays undeclared in
+    `hasna.contract.json` because `-otel` is outside the contract kit's bin
+    allowlist.
+  - **Hosted `economy sync` keeps its mtime cache as a JSON file under the cache
+    root** (`HASNA_CACHE_HOME`, else `~/Library/Caches/Hasna/economy` on macOS /
+    `~/.cache/hasna/economy` elsewhere; `HASNA_ECONOMY_INGEST_CACHE` overrides)
+    instead of `~/.hasna/economy/ingest-cache.db`. An older cache file is simply
+    not read — one re-read, absorbed by the server's idempotent upserts — and can
+    be deleted.
+  - **Manifest:** the CLI and MCP surfaces declare `authMode: api-key`
+    (credential via the `@hasna/contracts` chain) and the SDK surface
+    `exportSubpath: ./sdk`.
+  - **No `-sdk` split package.** The unpublished in-tree `@hasna/economy-sdk`
+    (`sdk/`) is removed: the SDK is the `./sdk` export of this one package — the
+    Store abstraction, which takes no `baseUrl` and therefore never attaches an
+    ambient fleet key to a caller-supplied one (hasna/apps#1794).
+  - Test hygiene: `src/mcp/http.test.ts` restores the local opt-in it pins, so
+    the #1788 ambient-gate test passes in the full suite; new spawned-bin tests
+    cover the MCP hosted / fail-closed arms, the three `economy-otel` lanes and
+    the `economy transport` exit codes.
+
 ## 0.3.28
 
 ### Patch Changes

package/CONTRIBUTING.md

@@ -13,7 +13,7 @@ bun run typecheck
 bun run build
 ```
 
-Dashboard work lives under `dashboard/` and SDK work lives under `sdk/`. Run package-local commands from those directories when changing those packages.
+The SDK is the `./sdk` export subpath of this package (`src/index.ts`, the Store abstraction); there is no separate `sdk/` package to build or publish.
 
 ## Release And Package Hygiene
 

package/README.md

@@ -1,6 +1,6 @@
 # @hasna/economy
 
-AI coding cost tracker for Claude Code, Takumi, Codex, Gemini, OpenCode, Cursor, Pi, and Hermes. It ships as a CLI, MCP server, REST API, web dashboard, and native macOS menu bar app.
+AI coding cost tracker for Claude Code, Takumi, Codex, Gemini, OpenCode, Cursor, Pi, and Hermes. It ships as a CLI, MCP server, REST API, and native macOS menu bar app.
 
 [![npm](https://img.shields.io/npm/v/@hasna/economy)](https://www.npmjs.com/package/@hasna/economy)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
@@ -14,7 +14,7 @@ AI coding cost tracker for Claude Code, Takumi, Codex, Gemini, OpenCode, Cursor,
 - Seeds editable model pricing with input, output, cache-read, 5-minute cache-write, 1-hour cache-write, and context-cache storage rates.
 - Handles tiered pricing such as Gemini long-prompt rates and OpenAI long-context rates.
 - Reconciles estimates against Anthropic, OpenAI, and Gemini billing sources.
-- Exposes cost data through CLI commands, an MCP server, REST endpoints, and a dashboard.
+- Exposes cost data through CLI commands, an MCP server, and REST endpoints.
 - Syncs project metadata from the `@hasna/projects` registry during full local sync.
 - Sends budget alert webhooks and retries failed deliveries on later syncs.
 
@@ -33,12 +33,6 @@ economy pricing list
 economy serve --port 3456
 ```
 
-Open the dashboard with:
-
-```bash
-economy dashboard --port 3456
-```
-
 ## Documentation
 
 - [CLI reference](docs/cli.md)
@@ -124,7 +118,7 @@ economy sync --hermes
 economy sync --loops
 ```
 
-`economy sync --loops` reads the OpenLoops store (`~/.hasna/loops/loops.db` by default, resolved through the `@hasna/paths` XDG data home once the loops store has migrated there) in read-only mode and imports OpenLoops orchestration/judge `goal_runs.tokens_used` into `loop:*` cost centers. It intentionally does not ingest dispatched coding-agent work from loops; heavy agent spend remains captured by the existing per-agent ingesters and can be analyzed alongside loop cost centers through account/profile attribution.
+`economy sync --loops` reads the OpenLoops store (`~/.hasna/loops/loops.db` by default, resolved by the in-package resolver to the XDG data home once the loops store has migrated there) in read-only mode and imports OpenLoops orchestration/judge `goal_runs.tokens_used` into `loop:*` cost centers. **This cross-app on-box read runs only in the local lane.** A hosted client (a resolved economy credential) refuses it with one stderr line — another app's on-box SQLite is never fleet data — so hosted stations see `loops ingest skipped` until the read is served by the loops API. It intentionally does not ingest dispatched coding-agent work from loops; heavy agent spend remains captured by the existing per-agent ingesters and can be analyzed alongside loop cost centers through account/profile attribution.
 
 Useful repair options:
 
@@ -136,7 +130,7 @@ economy sync --backfill-machine
 
 Full sync also imports active project metadata from `@hasna/projects` when the registry is available. The Codex source reads both `~/.codex/state_5.sqlite` and the Codewith store at `~/.codewith/state_5.sqlite` by default; explicit `HASNA_ECONOMY_CODEX_DB_PATH` and `HASNA_ECONOMY_CODEWITH_DB_PATH` values override those locations.
 
-Account attribution is automatic when `@hasna/accounts` has a matching active, applied, or env-dir profile for the agent. Account identity is the email address plus coding agent, so `work@example.com` under Codex and Claude is reported as two accounts. You can also force attribution for a process with `ECONOMY_ACCOUNT=tool:name` or agent-specific overrides such as `ECONOMY_CODEX_ACCOUNT=codex:work`.
+Account attribution is automatic when the accounts API (`HASNA_ACCOUNTS_API_KEY`, the accounts credentials file, or the Keychain item `hasna.credentials.accounts.api-key`) resolves a matching active, applied, or env-dir profile for the agent. With **no** accounts credential the on-box registry `~/.hasna/accounts/accounts.json` is **not** read unless `HASNA_ECONOMY_LOCAL=1` is set: attribution is simply omitted, announced once on stderr, rather than filling hosted rows from an on-box file. Account identity is the email address plus coding agent, so `work@example.com` under Codex and Claude is reported as two accounts. You can also force attribution for a process with `ECONOMY_ACCOUNT=tool:name` or agent-specific overrides such as `ECONOMY_CODEX_ACCOUNT=codex:work`.
 
 Session drilldown can be scoped to an account key, account name, or email:
 
@@ -237,7 +231,7 @@ Start the server:
 economy-serve --port 3456
 ```
 
-The canonical API uses `/v1`; `/api` remains a legacy alias for the dashboard and older clients. For example:
+The canonical API uses `/v1`; `/api` remains a legacy alias for older clients. For example:
 
 - `GET /health`, `/ready`, `/version`, and `/openapi.json`
 - `GET /v1/summary?period=today`
@@ -248,35 +242,38 @@ The canonical API uses `/v1`; `/api` remains a legacy alias for the dashboard an
 
 See the [REST API reference](docs/rest-api.md) for every route, response envelopes, authentication, and legacy aliases. The server publishes the current generated contract at `/openapi.json`.
 
-The server also serves the built dashboard when `dashboard/dist` is present. The dashboard includes account-scoped session filtering, subscription plan create/update/delete controls in Savings, and savings/usage/account tables for subscription-aware cost analysis.
-
 ## Native macOS Menubar
 
-The `menubar/` app is a native SwiftUI `MenuBarExtra` app, not Electron. It targets Swift 5.9+ and macOS 14+, and talks to the REST API exposed by `economy-serve`. It shows today/week/month spend, token and request counts, top agents, top accounts, top projects, active subscription plans, subscription savings, multi-agent usage snapshots, recent sessions, and fleet status. The default server URL is `http://127.0.0.1:3456`.
+HasnaEconomy is a native SwiftUI menu-bar app for macOS 14 and later, with an iPhone companion. The rebuilt clients use `https://api.hasna.com/economy/v1`; usage allowances, metered API costs, reported provider charges and subscription fees stay separate. Native source and build instructions are in `native/`. The old `menubar/Sources` implementation is retained as historical source and is not the rebuilt release.
 
-Build it on macOS:
+An agent installs a reviewed, signed and notarized release artifact. First obtain `HasnaEconomy.app` and its release receipt through the approved artifact delivery channel, then inspect it:
 
 ```bash
-cd menubar
-swift build -c release
+economy menubar inspect --app /absolute/path/HasnaEconomy.app
 ```
 
-Release app helpers:
+`inspect` reports a portable `hasna-economy-app-tree-v1` SHA-256 covering relative paths, entry kinds, permissions and file contents. Compare that digest and version with the release receipt. Installation requires those exact values:
 
 ```bash
-economy menubar install
+economy menubar install --app /absolute/path/HasnaEconomy.app --app-version <reviewed-version> --sha256 <release-receipt-sha256>
 economy menubar start
 economy menubar stop
 economy menubar uninstall
 ```
 
+The destination is `/Applications/HasnaEconomy.app`. The CLI verifies the bundle identifier, executable, version, architecture, Hasna Developer ID signature and macOS execution assessment before installation, then verifies a private staging bundle and retained source before atomically publishing without replacement and reading the installed bundle back. It preserves quarantine and extended attributes. It refuses occupied destinations, including empty directories and dangling symlinks; there is no overwrite flag or automatic quit. A failed copy leaves its private staging bundle for explicit reconciliation through Trash. A destination that appears during installation is preserved; it is never used as a copy target. Installation does not launch the app. `start` reports a launch request, which is not proof of a working menu or authenticated session.
+
+`uninstall` requires the app to be stopped and invokes the installed Trash client with its own station credentials and identity. It never falls back to direct deletion. Check `trash pending` after an uncertain capture and use the returned entry ID for recovery. The legacy `/Applications/Economy Bar.app` is not changed by these commands. Source builds and fixture captures are not signed distribution artifacts or evidence of a hosted installation.
+
 ## Data Directory
 
-Data is stored under a single data root resolved through the `@hasna/paths` resolver (XDG/macOS home layout). The legacy `~/.hasna/economy/` stays the effective root until the store is actually migrated to the XDG data home or the operator sets the data-kind override `HASNA_DATA_HOME`; the exact-app overrides `HASNA_ECONOMY_HOME` / `ECONOMY_HOME` win unconditionally.
+Data is stored under a single data root resolved by the in-package resolver (XDG/macOS home layout). The legacy `~/.hasna/economy/` stays the effective root until the store is actually migrated to the XDG data home or the operator sets the data-kind override `HASNA_DATA_HOME`; the exact-app overrides `HASNA_ECONOMY_HOME` / `ECONOMY_HOME` win unconditionally.
 
 The main SQLite database lives at `<data-root>/economy.db` (`~/.hasna/economy/economy.db` by default). Older `~/.economy/` data is copied on first open when the new directory does not exist. Override the database path with `HASNA_ECONOMY_DB_PATH` or `ECONOMY_DB`.
 
-For shared deployments, CLI and MCP can use a remote `/v1` API instead of local SQLite by setting `HASNA_ECONOMY_API_URL` and `HASNA_ECONOMY_API_KEY`. See [configuration](docs/configuration.md) for client resolution, server auth, Postgres mode, and all environment variables.
+For shared deployments, CLI, MCP and `./sdk` can use a remote `/v1` API instead of local SQLite. Their credential is resolved by `@hasna/contracts` 1.0.2, fresh per request, from: an explicit `--api-key`/`--profile` argument, the env pointers `HASNA_ECONOMY_API_KEY_OVERRIDE` / `HASNA_PROFILE` / `HASNA_ECONOMY_API_KEY_REF`, the macOS Keychain item `hasna.credentials.economy.api-key`, the 0600 file `~/.hasna/economy/config/credentials` (`HASNA_ECONOMY_API_KEY=…`), then `HASNA_ECONOMY_API_KEY` in the environment. The authority follows the same ladder (`HASNA_ECONOMY_API_URL`, the Keychain `api-url` item, the credentials file) and defaults to the fleet gateway `https://api.hasna.com/economy`. Unprefixed `ECONOMY_API_URL`/`ECONOMY_API_KEY` aliases are legacy, accepted for one release.
+
+**A run without a credential fails closed**: non-zero exit, no SQLite file, no local-fallback event. The on-box store is served only with the explicit opt-in `HASNA_ECONOMY_LOCAL=1` (alias `ECONOMY_LOCAL=1`), which prints `economy: local mode …` on stderr. See [configuration](docs/configuration.md) for the full client resolution, server auth, Postgres mode, and all environment variables.
 
 ## Development
 
@@ -285,7 +282,6 @@ bun test
 bun run typecheck
 bun run build
 bun scripts/sync-openapi.ts
-cd dashboard && bun run lint
 cd menubar && swift build -c release
 ```
 

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-Security fixes are handled for the latest published versions of `@hasna/economy` and `@hasna/economy-sdk`.
+Security fixes are handled for the latest published version of `@hasna/economy` (the CLI, MCP, server and `./sdk` surfaces ship in that one package).
 
 ## Reporting A Vulnerability
 

package/dist/chunks/agent-registry-store-tpnhx3wj.js

@@ -0,0 +1,39 @@
+// @bun
+import"./index-p35cyhc4.js";
+
+// src/mcp/agent-registry-store.ts
+import { Database } from "bun:sqlite";
+import { dirname } from "path";
+import { existsSync, mkdirSync } from "fs";
+var MEMORY_REGISTRY_PATH = ":memory:";
+
+class RegistryDb {
+  db;
+  constructor(path) {
+    if (path !== MEMORY_REGISTRY_PATH && dirname(path) && !existsSync(dirname(path))) {
+      mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    }
+    this.db = new Database(path);
+    this.db.exec("PRAGMA journal_mode = WAL");
+    this.db.exec("PRAGMA busy_timeout = 10000");
+  }
+  get(sql, ...params) {
+    return this.db.prepare(sql).get(...params);
+  }
+  all(sql, ...params) {
+    return this.db.prepare(sql).all(...params);
+  }
+  run(sql, ...params) {
+    return this.db.prepare(sql).run(...params);
+  }
+  exec(sql) {
+    this.db.exec(sql);
+  }
+  close() {
+    this.db.close();
+  }
+}
+export {
+  RegistryDb,
+  MEMORY_REGISTRY_PATH
+};

package/dist/chunks/billing-bkpxy4kv.js

@@ -0,0 +1,13 @@
+// @bun
+import {
+  syncAnthropicBilling,
+  syncGeminiBilling,
+  syncOpenAIBilling
+} from "./index-k540hfww.js";
+import"./index-ez9thsr7.js";
+import"./index-p35cyhc4.js";
+export {
+  syncOpenAIBilling,
+  syncGeminiBilling,
+  syncAnthropicBilling
+};

package/dist/chunks/config-j9mv3ehk.js

@@ -0,0 +1,15 @@
+// @bun
+import {
+  getConfigValue,
+  loadConfig,
+  saveConfig,
+  setConfigValue
+} from "./index-hesxq90g.js";
+import"./index-ez9thsr7.js";
+import"./index-p35cyhc4.js";
+export {
+  setConfigValue,
+  saveConfig,
+  loadConfig,
+  getConfigValue
+};