@hasna/economy 0.3.28 → 0.5.0

package/dist/otel/index.js

@@ -15,6 +15,7 @@ var __export = (target, all) => {
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
 
 // src/db/sqlite-adapter.ts
 import { Database } from "bun:sqlite";
@@ -72,6 +73,851 @@ class SqliteAdapter {
 }
 var init_sqlite_adapter = () => {};
 
+// src/db/observation-schema.ts
+var OBSERVATION_COLUMNS, SCAN_RECEIPTS_SQL = `CREATE TABLE IF NOT EXISTS scan_receipts (
+  id TEXT PRIMARY KEY, machine_id TEXT NOT NULL, source TEXT NOT NULL,
+  attempted_at TEXT NOT NULL, completed_at TEXT NOT NULL, status TEXT NOT NULL,
+  latest_event_at TEXT, parser_version TEXT NOT NULL, error_code TEXT,
+  updated_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_scan_receipts_machine_source
+  ON scan_receipts(machine_id, source, completed_at);`, OBSERVATION_PG_MIGRATIONS;
+var init_observation_schema = __esm(() => {
+  OBSERVATION_COLUMNS = {
+    usage_snapshots: {
+      provider: "TEXT NOT NULL DEFAULT ''",
+      account_key: "TEXT NOT NULL DEFAULT ''",
+      observed_at: "TEXT",
+      source_timestamp: "TEXT",
+      window_start: "TEXT",
+      window_end: "TEXT",
+      reset_at: "TEXT",
+      window_seconds: "INTEGER",
+      value_kind: "TEXT NOT NULL DEFAULT 'unknown'"
+    },
+    subscriptions: {
+      account_key: "TEXT NOT NULL DEFAULT ''",
+      observed_station: "TEXT",
+      observed_at: "TEXT",
+      fee_basis: "TEXT NOT NULL DEFAULT 'unknown'",
+      included_basis: "TEXT NOT NULL DEFAULT 'unknown'"
+    }
+  };
+  OBSERVATION_PG_MIGRATIONS = [
+    ...Object.entries(OBSERVATION_COLUMNS).flatMap(([table, columns]) => Object.entries(columns).map(([column, type]) => `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS ${column} ${type}`)),
+    SCAN_RECEIPTS_SQL
+  ];
+});
+
+// src/db/ingest-errors.ts
+var IngestError;
+var init_ingest_errors = __esm(() => {
+  IngestError = class IngestError extends Error {
+    status;
+    code;
+    field;
+    expected;
+    constructor(status, code, field, expected) {
+      super(`${field}: ${expected}`);
+      this.status = status;
+      this.code = code;
+      this.field = field;
+      this.expected = expected;
+      this.name = "IngestError";
+    }
+  };
+});
+
+// src/db/observation-provenance.ts
+import { createHash } from "crypto";
+function observationId(input) {
+  return digest([input.provider, input.account_key, input.machine_id, input.metric, new Date(input.observed_at).toISOString()]);
+}
+function subscriptionId(input) {
+  return digest([input.provider, input.account_key]);
+}
+function scanReceiptId(input) {
+  return digest([input.machine_id, input.source, new Date(input.attempted_at).toISOString()]);
+}
+function required(row, keys, path) {
+  for (const key of keys)
+    if (typeof row[key] !== "string" || !row[key].trim() || row[key].length > 256) {
+      invalid(`${path}.${key}`, "expected nonempty text of at most 256 characters");
+    }
+}
+function validateObservationProvenance(table, row, path) {
+  if (table === "usage_snapshots") {
+    if (!["gauge", "cumulative", "delta", "unknown"].includes(String(row["value_kind"] === undefined ? "unknown" : row["value_kind"])))
+      invalid(`${path}.value_kind`, "expected gauge, cumulative, delta or unknown");
+    const newProvenance = ["provider", "account_key", "observed_at", "source_timestamp", "window_start", "window_end", "reset_at", "window_seconds"].some((k) => row[k] != null && row[k] !== "") || row["value_kind"] != null && row["value_kind"] !== "unknown";
+    if (newProvenance) {
+      required(row, ["provider", "account_key", "machine_id", "observed_at", "metric"], path);
+      if (row["id"] !== observationId(row))
+        invalid(`${path}.id`, "expected SHA-256 identity of provider, account_key, machine_id, metric and observed_at");
+      if (row["date"] !== String(row["observed_at"]).slice(0, 10))
+        invalid(`${path}.date`, "expected the UTC observation date");
+      if (row["window_seconds"] != null && (!Number.isSafeInteger(row["window_seconds"]) || Number(row["window_seconds"]) <= 0))
+        invalid(`${path}.window_seconds`, "expected positive integer seconds or null");
+      if (row["window_start"] && row["window_end"] && Date.parse(String(row["window_start"])) >= Date.parse(String(row["window_end"])))
+        invalid(`${path}.window_end`, "expected a time after window_start");
+    }
+  }
+  if (table === "subscriptions") {
+    for (const key of ["fee_basis", "included_basis"])
+      if (!["unknown", "observed", "configured"].includes(String(row[key] === undefined ? "unknown" : row[key])))
+        invalid(`${path}.${key}`, "expected unknown, observed or configured");
+    const identified = row["account_key"] != null && row["account_key"] !== "" || row["observed_at"] != null;
+    if (identified || ["fee_basis", "included_basis"].some((k) => row[k] != null && row[k] !== "unknown")) {
+      required(row, ["provider", "account_key", "observed_at"], path);
+      if (row["id"] !== subscriptionId(row))
+        invalid(`${path}.id`, "expected SHA-256 identity of provider and account_key");
+      if (row["updated_at"] !== row["observed_at"])
+        invalid(`${path}.updated_at`, "expected the observation timestamp");
+    }
+  }
+  if (table === "scan_receipts") {
+    required(row, ["machine_id", "source", "attempted_at", "completed_at", "parser_version"], path);
+    if (!["success", "unchanged", "missing", "unsupported", "failed"].includes(String(row["status"])))
+      invalid(`${path}.status`, "expected success, unchanged, missing, unsupported or failed");
+    if (row["id"] !== scanReceiptId(row))
+      invalid(`${path}.id`, "expected SHA-256 identity of machine_id, source and attempted_at");
+    if (Date.parse(String(row["completed_at"])) < Date.parse(String(row["attempted_at"])))
+      invalid(`${path}.completed_at`, "expected a time at or after attempted_at");
+    if (row["updated_at"] !== row["completed_at"])
+      invalid(`${path}.updated_at`, "expected completed_at");
+    if (row["error_code"] != null && (typeof row["error_code"] !== "string" || !SCAN_ERROR_CODES.includes(row["error_code"])))
+      invalid(`${path}.error_code`, "expected a supported authored scan error code or null");
+    if (["success", "unchanged"].includes(String(row["status"])) && row["error_code"] != null)
+      invalid(`${path}.error_code`, "expected null for a successful scan");
+  }
+}
+var SCAN_ERROR_CODES, digest = (parts) => createHash("sha256").update(JSON.stringify(parts)).digest("hex"), invalid = (path, expected) => {
+  throw new IngestError(400, "INVALID_INGEST", path, expected);
+};
+var init_observation_provenance = __esm(() => {
+  init_ingest_errors();
+  SCAN_ERROR_CODES = [
+    "SOURCE_MISSING",
+    "SOURCE_UNREADABLE",
+    "SOURCE_INVALID",
+    "LEGACY_AGGREGATE_REQUIRES_MIGRATION",
+    "USAGE_EVENTS_UNAVAILABLE",
+    "USAGE_EVENTS_INCOMPLETE",
+    "PROVIDER_CREDENTIAL_UNAVAILABLE",
+    "PROVIDER_CREDENTIAL_UNREADABLE",
+    "PROVIDER_AUTH_REFUSED",
+    "PROVIDER_REFUSED",
+    "PROVIDER_UNAVAILABLE",
+    "ACCOUNT_IDENTITY_UNAVAILABLE",
+    "SUBSCRIPTION_QUOTA_NOT_APPLICABLE",
+    "TEAM_USAGE_ATTRIBUTION_UNAVAILABLE",
+    "CROSS_APP_LOCAL_READ_REFUSED",
+    "COLLECTION_FAILED"
+  ];
+});
+
+// src/db/ingest-specs.ts
+function ingestSpecs() {
+  return [
+    {
+      table: "requests",
+      pk: ["id"],
+      columns: [
+        "id",
+        "agent",
+        "session_id",
+        "model",
+        "input_tokens",
+        "output_tokens",
+        "cache_read_tokens",
+        "cache_create_tokens",
+        "cache_create_5m_tokens",
+        "cache_create_1h_tokens",
+        "cost_usd",
+        "cost_basis",
+        "duration_ms",
+        "timestamp",
+        "source_request_id",
+        "machine_id",
+        "cost_center_id",
+        "attribution_tag",
+        "account_key",
+        "account_tool",
+        "account_name",
+        "account_email",
+        "account_source",
+        "updated_at",
+        "synced_at"
+      ],
+      map: (r, now) => [
+        strOr(r["id"]),
+        strOr(r["agent"]),
+        strOr(r["session_id"]),
+        strOr(r["model"]),
+        numOr(r["input_tokens"]),
+        numOr(r["output_tokens"]),
+        numOr(r["cache_read_tokens"]),
+        numOr(r["cache_create_tokens"]),
+        numOr(r["cache_create_5m_tokens"] ?? r["cache_create_tokens"]),
+        numOr(r["cache_create_1h_tokens"]),
+        numOr(r["cost_usd"]),
+        strOr(r["cost_basis"], "estimated"),
+        numOr(r["duration_ms"]),
+        strOr(r["timestamp"]),
+        r["source_request_id"] == null ? null : strOr(r["source_request_id"]),
+        strOr(r["machine_id"]),
+        r["cost_center_id"] == null ? null : strOr(r["cost_center_id"]),
+        strOr(r["attribution_tag"]),
+        strOr(r["account_key"]),
+        strOr(r["account_tool"]),
+        strOr(r["account_name"]),
+        strOr(r["account_email"]),
+        strOr(r["account_source"]),
+        strOr(r["updated_at"], now),
+        strOr(r["synced_at"])
+      ]
+    },
+    {
+      table: "sessions",
+      pk: ["id"],
+      columns: [
+        "id",
+        "agent",
+        "project_path",
+        "project_name",
+        "started_at",
+        "ended_at",
+        "total_cost_usd",
+        "total_tokens",
+        "request_count",
+        "machine_id",
+        "cost_center_id",
+        "attribution_tag",
+        "account_key",
+        "account_tool",
+        "account_name",
+        "account_email",
+        "account_source",
+        "updated_at",
+        "synced_at"
+      ],
+      map: (r, now) => [
+        strOr(r["id"]),
+        strOr(r["agent"]),
+        strOr(r["project_path"]),
+        strOr(r["project_name"]),
+        strOr(r["started_at"]),
+        r["ended_at"] == null ? null : strOr(r["ended_at"]),
+        numOr(r["total_cost_usd"]),
+        numOr(r["total_tokens"]),
+        numOr(r["request_count"]),
+        strOr(r["machine_id"]),
+        r["cost_center_id"] == null ? null : strOr(r["cost_center_id"]),
+        strOr(r["attribution_tag"]),
+        strOr(r["account_key"]),
+        strOr(r["account_tool"]),
+        strOr(r["account_name"]),
+        strOr(r["account_email"]),
+        strOr(r["account_source"]),
+        strOr(r["updated_at"], now),
+        strOr(r["synced_at"])
+      ]
+    },
+    {
+      table: "projects",
+      pk: ["id"],
+      columns: ["id", "path", "name", "description", "tags", "created_at"],
+      map: (r) => [
+        strOr(r["id"]),
+        strOr(r["path"]),
+        strOr(r["name"]),
+        r["description"] == null ? null : strOr(r["description"]),
+        typeof r["tags"] === "string" ? r["tags"] : JSON.stringify(r["tags"] ?? []),
+        strOr(r["created_at"])
+      ]
+    },
+    {
+      table: "budgets",
+      pk: ["id"],
+      columns: ["id", "project_path", "agent", "period", "limit_usd", "alert_at_percent", "cost_center_id", "created_at", "updated_at", "metric"],
+      map: (r) => [
+        strOr(r["id"]),
+        r["project_path"] == null ? null : strOr(r["project_path"]),
+        r["agent"] == null ? null : strOr(r["agent"]),
+        strOr(r["period"]),
+        numOr(r["limit_usd"]),
+        numOr(r["alert_at_percent"], 80),
+        r["cost_center_id"] == null ? null : strOr(r["cost_center_id"]),
+        strOr(r["created_at"]),
+        strOr(r["updated_at"]),
+        strOr(r["metric"], "legacy_request_cost_usd")
+      ]
+    },
+    {
+      table: "goals",
+      pk: ["id"],
+      columns: ["id", "period", "project_path", "agent", "limit_usd", "created_at", "updated_at"],
+      map: (r) => [
+        strOr(r["id"]),
+        strOr(r["period"]),
+        r["project_path"] == null ? null : strOr(r["project_path"]),
+        r["agent"] == null ? null : strOr(r["agent"]),
+        numOr(r["limit_usd"]),
+        strOr(r["created_at"]),
+        strOr(r["updated_at"])
+      ]
+    },
+    {
+      table: "billing_daily",
+      pk: ["date", "provider", "description"],
+      columns: ["date", "provider", "description", "cost_usd", "updated_at"],
+      map: (r) => [strOr(r["date"]), strOr(r["provider"]), strOr(r["description"]), numOr(r["cost_usd"]), strOr(r["updated_at"])]
+    },
+    {
+      table: "model_pricing",
+      pk: ["model"],
+      columns: [
+        "model",
+        "input_per_1m",
+        "output_per_1m",
+        "cache_read_per_1m",
+        "cache_write_per_1m",
+        "cache_write_1h_per_1m",
+        "cache_storage_per_1m_hour",
+        "updated_at"
+      ],
+      map: (r) => [
+        strOr(r["model"]),
+        numOr(r["input_per_1m"]),
+        numOr(r["output_per_1m"]),
+        numOr(r["cache_read_per_1m"]),
+        numOr(r["cache_write_per_1m"]),
+        numOr(r["cache_write_1h_per_1m"]),
+        numOr(r["cache_storage_per_1m_hour"]),
+        strOr(r["updated_at"])
+      ]
+    },
+    {
+      table: "subscriptions",
+      pk: ["id"],
+      columns: [
+        "id",
+        "agent",
+        "provider",
+        "plan",
+        "monthly_fee_usd",
+        "included_usage_usd",
+        "billing_cycle_start",
+        "reset_policy",
+        "active",
+        "created_at",
+        "updated_at",
+        "account_key",
+        "observed_station",
+        "observed_at",
+        "fee_basis",
+        "included_basis"
+      ],
+      map: (r) => [
+        strOr(r["id"]),
+        r["agent"] == null ? null : strOr(r["agent"]),
+        strOr(r["provider"]),
+        strOr(r["plan"]),
+        numOr(r["monthly_fee_usd"]),
+        numOr(r["included_usage_usd"]),
+        r["billing_cycle_start"] == null ? null : strOr(r["billing_cycle_start"]),
+        strOr(r["reset_policy"], "unknown"),
+        numOr(r["active"], 1),
+        strOr(r["created_at"]),
+        strOr(r["updated_at"]),
+        strOr(r["account_key"]),
+        r["observed_station"] ?? null,
+        r["observed_at"] ?? null,
+        strOr(r["fee_basis"], "unknown"),
+        strOr(r["included_basis"], "unknown")
+      ]
+    },
+    {
+      table: "usage_snapshots",
+      pk: ["id"],
+      columns: [
+        "id",
+        "agent",
+        "date",
+        "metric",
+        "value",
+        "unit",
+        "machine_id",
+        "updated_at",
+        "provider",
+        "account_key",
+        "observed_at",
+        "source_timestamp",
+        "window_start",
+        "window_end",
+        "reset_at",
+        "window_seconds",
+        "value_kind"
+      ],
+      map: (r, now) => [
+        strOr(r["id"], `${strOr(r["agent"])}-${strOr(r["date"])}-${strOr(r["metric"])}-${strOr(r["machine_id"])}`),
+        strOr(r["agent"]),
+        strOr(r["date"]),
+        strOr(r["metric"]),
+        numOr(r["value"]),
+        strOr(r["unit"]),
+        strOr(r["machine_id"]),
+        strOr(r["updated_at"], now),
+        strOr(r["provider"]),
+        strOr(r["account_key"]),
+        r["observed_at"] ?? null,
+        r["source_timestamp"] ?? null,
+        r["window_start"] ?? null,
+        r["window_end"] ?? null,
+        r["reset_at"] ?? null,
+        r["window_seconds"] ?? null,
+        strOr(r["value_kind"], "unknown")
+      ]
+    },
+    {
+      table: "scan_receipts",
+      pk: ["id"],
+      columns: ["id", "machine_id", "source", "attempted_at", "completed_at", "status", "latest_event_at", "parser_version", "error_code", "updated_at"],
+      map: (r) => [strOr(r["id"]), strOr(r["machine_id"]), strOr(r["source"]), strOr(r["attempted_at"]), strOr(r["completed_at"]), strOr(r["status"]), r["latest_event_at"] ?? null, strOr(r["parser_version"]), r["error_code"] ?? null, strOr(r["updated_at"], strOr(r["completed_at"]))]
+    }
+  ];
+}
+var numOr = (v, d = 0) => {
+  if (v == null)
+    return d;
+  const num = Number(v);
+  return Number.isFinite(num) ? num : d;
+}, strOr = (v, d = "") => v == null ? d : String(v);
+
+// src/lib/agents.ts
+function isAgent(value) {
+  return AGENTS.includes(value);
+}
+var AGENTS;
+var init_agents = __esm(() => {
+  AGENTS = [
+    "claude",
+    "takumi",
+    "codex",
+    "gemini",
+    "opencode",
+    "cursor",
+    "pi",
+    "hermes"
+  ];
+});
+
+// src/db/ingest-validation.ts
+import { createHash as createHash2 } from "crypto";
+function stableJson(value) {
+  if (Array.isArray(value))
+    return `[${value.map(stableJson).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map((k) => `${JSON.stringify(k)}:${stableJson(record[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function canonicalIngestBodyHash(body) {
+  return createHash2("sha256").update(stableJson(body)).digest("hex");
+}
+function invalid2(field, expected) {
+  throw new IngestError(400, "INVALID_INGEST", field, expected);
+}
+function plain(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+}
+function date(value) {
+  return /^\d{4}-\d{2}-\d{2}$/.test(value) && Number.isFinite(Date.parse(value)) && new Date(value).toISOString().slice(0, 10) === value;
+}
+function instant(value) {
+  return /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/.test(value) && date(value.slice(0, 10)) && Number.isFinite(Date.parse(value)) && new Date(value).toISOString().slice(0, 19) === value.slice(0, 19);
+}
+function validateIngest(body) {
+  if (!plain(body))
+    invalid2("body", "expected an object of supported table arrays");
+  const specs = ingestSpecs();
+  const allowed = new Set(["schema_version", "idempotency_key", "subscription_mode", "budget_mode", ...specs.map((s) => s.table)]);
+  for (const key of Object.keys(body))
+    if (!allowed.has(key))
+      invalid2("body", "unknown field; expected a supported table, schema_version, subscription_mode, budget_mode or idempotency_key");
+  if (body["subscription_mode"] !== undefined && (typeof body["subscription_mode"] !== "string" || !["quota_observation", "configuration"].includes(body["subscription_mode"]) || !Array.isArray(body["subscriptions"]))) {
+    invalid2("subscription_mode", "expected quota_observation or configuration with a subscriptions array");
+  }
+  if (body["schema_version"] !== undefined && body["schema_version"] !== 1)
+    invalid2("schema_version", "expected 1");
+  if (body["idempotency_key"] !== undefined && (typeof body["idempotency_key"] !== "string" || !/^[A-Za-z0-9._:-]{1,200}$/.test(body["idempotency_key"])))
+    invalid2("idempotency_key", "expected 1\u2013200 letters, digits, dot, underscore, colon or hyphen");
+  const createBudget = body["budget_mode"] !== undefined;
+  if (createBudget) {
+    if (body["budget_mode"] !== "create")
+      invalid2("budget_mode", "expected create");
+    if (body["schema_version"] !== 1)
+      invalid2("schema_version", "budget creation requires 1");
+    if (typeof body["idempotency_key"] !== "string")
+      invalid2("idempotency_key", "budget creation requires a stable caller-owned key");
+    if (Object.keys(body).some((k) => !["schema_version", "idempotency_key", "budget_mode", "budgets"].includes(k)))
+      invalid2("body", "budget creation accepts only schema_version, idempotency_key, budget_mode and budgets");
+    if (!Array.isArray(body["budgets"]) || body["budgets"].length !== 1)
+      invalid2("budgets", "budget creation requires exactly one rule");
+  }
+  let count = 0;
+  let bytes = 0;
+  const groups = [];
+  for (const spec of specs) {
+    const input = body[spec.table];
+    if (input === undefined)
+      continue;
+    if (!Array.isArray(input))
+      invalid2(spec.table, "expected an array");
+    count += input.length;
+    if (count > MAX_INGEST_ROWS)
+      throw new IngestError(413, "INGEST_TOO_LARGE", "body", `maximum ${MAX_INGEST_ROWS} rows; split into bounded commands`);
+    const rows = [];
+    for (let i = 0;i < input.length; i++) {
+      const raw = input[i];
+      const path = `${spec.table}[${i}]`;
+      if (!plain(raw))
+        invalid2(path, "expected a row object");
+      const row = {};
+      for (const key of Object.keys(raw)) {
+        if (!spec.columns.includes(key))
+          invalid2(/^[a-z_]{1,64}$/.test(key) ? `${path}.${key}` : path, "unknown column for this table");
+        const value = raw[key];
+        if (["observed_at", "source_timestamp", "window_start", "window_end", "reset_at", "attempted_at", "completed_at", "latest_event_at"].includes(key) && value === "")
+          invalid2(`${path}.${key}`, "expected an ISO UTC timestamp or null");
+        if (numeric.has(key) && !(key === "window_seconds" && value === null)) {
+          if (typeof value !== "number" || !Number.isFinite(value) || integers.has(key) && !Number.isSafeInteger(value) || value < 0 && !(spec.table === "billing_daily" && key === "cost_usd"))
+            invalid2(`${path}.${key}`, "expected a finite numeric value in the supported range");
+          if (key === "active" && value !== 0 && value !== 1)
+            invalid2(`${path}.active`, "expected 0 or 1");
+        } else if (key === "tags" && Array.isArray(value)) {
+          if (value.length > 100 || value.some((t) => typeof t !== "string" || t.length > 256))
+            invalid2(`${path}.tags`, "expected at most 100 string tags of at most 256 characters");
+        } else if (value !== null && (typeof value !== "string" || value.length > 16384 || value.includes("\x00"))) {
+          invalid2(`${path}.${key}`, "expected text of at most 16384 characters without NUL, or null");
+        }
+        if (typeof value === "string" && (key === "date" || key === "billing_cycle_start") && value !== "" && !date(value))
+          invalid2(`${path}.${key}`, "expected a valid YYYY-MM-DD date");
+        if (typeof value === "string" && (key.endsWith("_at") || ["timestamp", "source_timestamp", "window_start", "window_end"].includes(key)) && value !== "") {
+          if (!instant(value))
+            invalid2(`${path}.${key}`, "expected an ISO UTC timestamp ending in Z");
+          row[key] = new Date(value).toISOString();
+        } else
+          row[key] = value;
+      }
+      for (const key of required2[spec.table] ?? spec.pk) {
+        if (typeof row[key] !== "string" || row[key] === "")
+          invalid2(`${path}.${key}`, "expected nonempty text");
+      }
+      for (const key of spec.pk)
+        if (typeof (row[key] ?? "") !== "string" || String(row[key] ?? "").length > 1024)
+          invalid2(`${path}.${key}`, "expected a primary key of at most 1024 characters");
+      if (spec.table === "budgets" && !["daily", "weekly", "monthly"].includes(String(row["period"])))
+        invalid2(`${path}.period`, "expected daily, weekly or monthly");
+      if (spec.table === "budgets") {
+        if (row["metric"] !== undefined && !["legacy_request_cost_usd", "metered_api_usd"].includes(String(row["metric"])))
+          invalid2(`${path}.metric`, "expected legacy_request_cost_usd or metered_api_usd");
+        if (createBudget) {
+          if (String(row["id"]).trim() === "")
+            invalid2(`${path}.id`, "expected a nonempty caller-owned rule identity");
+          if (row["metric"] !== "metered_api_usd")
+            invalid2(`${path}.metric`, "budget creation requires metered_api_usd");
+          if (typeof row["limit_usd"] !== "number" || row["limit_usd"] <= 0)
+            invalid2(`${path}.limit_usd`, "expected a positive finite USD amount");
+          if (!Number.isInteger(row["alert_at_percent"]) || Number(row["alert_at_percent"]) < 1 || Number(row["alert_at_percent"]) > 100)
+            invalid2(`${path}.alert_at_percent`, "expected an integer from 1 to 100");
+          for (const field of ["created_at", "updated_at"])
+            if (typeof row[field] !== "string" || !instant(row[field]))
+              invalid2(`${path}.${field}`, "expected an explicit ISO UTC timestamp ending in Z; preserve it on retry");
+          for (const field of ["project_path", "cost_center_id"])
+            if (row[field] !== undefined && row[field] !== null && (typeof row[field] !== "string" || row[field].trim() === ""))
+              invalid2(`${path}.${field}`, "expected nonempty text or null for all scopes");
+          if (row["agent"] !== undefined && row["agent"] !== null && (typeof row["agent"] !== "string" || !isAgent(row["agent"])))
+            invalid2(`${path}.agent`, "expected a supported Economy agent or null for all agents");
+        }
+      }
+      if (spec.table === "goals" && !["day", "week", "month", "year"].includes(String(row["period"])))
+        invalid2(`${path}.period`, "expected day, week, month or year");
+      if (spec.table === "scan_receipts" && row["updated_at"] === undefined)
+        row["updated_at"] = row["completed_at"];
+      validateObservationProvenance(spec.table, row, path);
+      bytes += Buffer.byteLength(stableJson(row));
+      if (bytes > MAX_INGEST_BYTES)
+        throw new IngestError(413, "INGEST_TOO_LARGE", "body", `maximum ${MAX_INGEST_BYTES} JSON bytes; split into bounded commands`);
+      rows.push(row);
+    }
+    groups.push({ spec, rows });
+  }
+  if (Buffer.byteLength(stableJson(body)) > MAX_INGEST_BYTES)
+    throw new IngestError(413, "INGEST_TOO_LARGE", "body", `maximum ${MAX_INGEST_BYTES} JSON bytes; split into bounded commands`);
+  return groups;
+}
+var MAX_INGEST_ROWS = 1e4, MAX_INGEST_BYTES, integers, numeric, required2;
+var init_ingest_validation = __esm(() => {
+  init_observation_provenance();
+  init_ingest_errors();
+  init_agents();
+  MAX_INGEST_BYTES = 4 * 1024 * 1024;
+  integers = new Set([
+    "input_tokens",
+    "output_tokens",
+    "cache_read_tokens",
+    "cache_create_tokens",
+    "cache_create_5m_tokens",
+    "cache_create_1h_tokens",
+    "duration_ms",
+    "total_tokens",
+    "request_count",
+    "active",
+    "window_seconds"
+  ]);
+  numeric = new Set([
+    ...integers,
+    "cost_usd",
+    "total_cost_usd",
+    "limit_usd",
+    "alert_at_percent",
+    "input_per_1m",
+    "output_per_1m",
+    "cache_read_per_1m",
+    "cache_write_per_1m",
+    "cache_write_1h_per_1m",
+    "cache_storage_per_1m_hour",
+    "monthly_fee_usd",
+    "included_usage_usd",
+    "value"
+  ]);
+  required2 = {
+    requests: ["id", "agent", "session_id", "model", "timestamp"],
+    sessions: ["id", "agent", "started_at"],
+    projects: ["id", "path", "name", "created_at"],
+    budgets: ["id", "period"],
+    goals: ["id", "period"],
+    billing_daily: ["date", "provider"],
+    model_pricing: ["model"],
+    subscriptions: ["id", "provider", "plan"],
+    usage_snapshots: ["id", "agent", "date", "metric", "unit"],
+    scan_receipts: ["id", "machine_id", "source", "attempted_at", "completed_at", "status", "parser_version"]
+  };
+});
+
+// src/db/ingest-schema.ts
+var INGEST_SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS ingest_session_locks (
+  session_id TEXT PRIMARY KEY
+);
+  CREATE TABLE IF NOT EXISTS ingest_batches (
+    operation_key TEXT PRIMARY KEY,
+    actor_id TEXT NOT NULL,
+    payload_hash TEXT NOT NULL,
+    response_json TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS ingest_preimages (
+    id TEXT PRIMARY KEY,
+    operation_key TEXT NOT NULL REFERENCES ingest_batches(operation_key),
+    table_name TEXT NOT NULL,
+    entity_key TEXT NOT NULL,
+    record_json TEXT NOT NULL,
+    record_sha256 TEXT NOT NULL,
+    recorded_at TEXT NOT NULL,
+    UNIQUE (operation_key, table_name, entity_key)
+  );
+  CREATE INDEX IF NOT EXISTS idx_ingest_preimages_entity
+    ON ingest_preimages(table_name, entity_key);
+`;
+
+// src/db/legacy-schema.ts
+var LEGACY_LEDGER_SQL = `
+CREATE TABLE IF NOT EXISTS legacy_reconciliations (
+  operation_key TEXT PRIMARY KEY NOT NULL,
+  payload_sha256 TEXT NOT NULL CHECK(length(payload_sha256)=64),
+  plan_sha256 TEXT NOT NULL CHECK(length(plan_sha256)=64),
+  capsule_sha256 TEXT NOT NULL CHECK(length(capsule_sha256)=64),
+  capsule_json TEXT NOT NULL,
+  actor_ref TEXT NOT NULL,
+  authority_ref TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  response_json TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS legacy_reconciliation_targets (
+  operation_key TEXT NOT NULL REFERENCES legacy_reconciliations(operation_key),
+  request_id TEXT NOT NULL,
+  session_id TEXT NOT NULL,
+  disposition TEXT NOT NULL CHECK(disposition IN ('quarantine_aggregate','mark_billing_unknown')),
+  original_sha256 TEXT NOT NULL CHECK(length(original_sha256)=64),
+  PRIMARY KEY(operation_key,request_id)
+);
+CREATE INDEX IF NOT EXISTS idx_legacy_targets_request ON legacy_reconciliation_targets(request_id);
+CREATE INDEX IF NOT EXISTS idx_legacy_targets_session ON legacy_reconciliation_targets(session_id);
+CREATE TABLE IF NOT EXISTS legacy_rollbacks (
+  operation_key TEXT PRIMARY KEY NOT NULL,
+  apply_key TEXT NOT NULL UNIQUE REFERENCES legacy_reconciliations(operation_key),
+  payload_sha256 TEXT NOT NULL CHECK(length(payload_sha256)=64),
+  actor_ref TEXT NOT NULL,
+  authority_ref TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  response_json TEXT NOT NULL
+);
+`, requestColumns, sessionColumns, q = (s) => '"' + s + '"', requestProjection, totals, sessionProjection, LEGACY_VIEWS_SQL, immutableTables, collision = (table) => table === "legacy_reconciliation_targets" ? "operation_key=NEW.operation_key AND request_id=NEW.request_id" : table === "legacy_rollbacks" ? "operation_key=NEW.operation_key OR apply_key=NEW.apply_key" : "operation_key=NEW.operation_key", LEGACY_SQLITE_SQL, pgViews, LEGACY_PG_SQL;
+var init_legacy_schema = __esm(() => {
+  requestColumns = [
+    "id",
+    "agent",
+    "session_id",
+    "model",
+    "input_tokens",
+    "output_tokens",
+    "cache_read_tokens",
+    "cache_create_tokens",
+    "cache_create_5m_tokens",
+    "cache_create_1h_tokens",
+    "cost_usd",
+    "cost_basis",
+    "duration_ms",
+    "timestamp",
+    "source_request_id",
+    "machine_id",
+    "cost_center_id",
+    "attribution_tag",
+    "account_key",
+    "account_tool",
+    "account_name",
+    "account_email",
+    "account_source",
+    "updated_at",
+    "synced_at"
+  ];
+  sessionColumns = [
+    "id",
+    "agent",
+    "project_path",
+    "project_name",
+    "started_at",
+    "ended_at",
+    "total_cost_usd",
+    "total_tokens",
+    "request_count",
+    "machine_id",
+    "cost_center_id",
+    "attribution_tag",
+    "account_key",
+    "account_tool",
+    "account_name",
+    "account_email",
+    "account_source",
+    "updated_at",
+    "synced_at"
+  ];
+  requestProjection = requestColumns.map((column) => column === "cost_basis" ? "CASE WHEN EXISTS (SELECT 1 FROM economy_legacy_active a WHERE a.request_id=r.id AND a.disposition='mark_billing_unknown') THEN 'unknown' ELSE r.cost_basis END AS cost_basis" : "r." + q(column)).join(`,
+`);
+  totals = {
+    total_cost_usd: "COALESCE(SUM(cost_usd),0)",
+    total_tokens: "COALESCE(SUM(input_tokens+output_tokens+cache_read_tokens+cache_create_tokens),0)",
+    request_count: "COUNT(*)"
+  };
+  sessionProjection = sessionColumns.map((column) => totals[column] ? `CASE WHEN EXISTS (SELECT 1 FROM economy_legacy_active a WHERE a.session_id=s.id)
+      THEN (SELECT ${totals[column]} FROM economy_effective_requests r WHERE r.session_id=s.id)
+      ELSE s.${q(column)} END AS ${q(column)}` : "s." + q(column)).join(`,
+`);
+  LEGACY_VIEWS_SQL = `
+CREATE VIEW IF NOT EXISTS economy_legacy_active AS
+  SELECT t.* FROM legacy_reconciliation_targets t
+  WHERE NOT EXISTS (SELECT 1 FROM legacy_rollbacks b WHERE b.apply_key=t.operation_key);
+CREATE VIEW IF NOT EXISTS economy_effective_requests AS
+  SELECT ${requestProjection} FROM requests r
+  WHERE NOT EXISTS (SELECT 1 FROM economy_legacy_active a WHERE a.request_id=r.id AND a.disposition='quarantine_aggregate');
+CREATE VIEW IF NOT EXISTS economy_effective_sessions AS
+  SELECT ${sessionProjection} FROM sessions s
+  WHERE NOT EXISTS (SELECT 1 FROM economy_legacy_active a WHERE a.session_id=s.id)
+     OR EXISTS (SELECT 1 FROM economy_effective_requests r WHERE r.session_id=s.id);
+`;
+  immutableTables = ["legacy_reconciliations", "legacy_reconciliation_targets", "legacy_rollbacks"];
+  LEGACY_SQLITE_SQL = LEGACY_LEDGER_SQL + LEGACY_VIEWS_SQL + immutableTables.map((table) => `
+CREATE TRIGGER IF NOT EXISTS ${table}_no_update BEFORE UPDATE ON ${table}
+  BEGIN SELECT RAISE(ABORT,'legacy reconciliation history is immutable'); END;
+CREATE TRIGGER IF NOT EXISTS ${table}_no_delete BEFORE DELETE ON ${table}
+  BEGIN SELECT RAISE(ABORT,'legacy reconciliation history is immutable'); END;
+CREATE TRIGGER IF NOT EXISTS ${table}_no_replace BEFORE INSERT ON ${table}
+  WHEN EXISTS(SELECT 1 FROM ${table} WHERE ${collision(table)})
+  BEGIN SELECT RAISE(ABORT,'legacy reconciliation history is immutable'); END;
+`).join("") + `
+CREATE TRIGGER IF NOT EXISTS legacy_target_no_overlap BEFORE INSERT ON legacy_reconciliation_targets
+  WHEN EXISTS(SELECT 1 FROM economy_legacy_active a WHERE a.session_id=NEW.session_id AND a.operation_key<>NEW.operation_key)
+    OR EXISTS(SELECT 1 FROM economy_legacy_active a WHERE a.request_id=NEW.request_id)
+  BEGIN SELECT RAISE(ABORT,'legacy reconciliation is already active for this session'); END;
+CREATE TRIGGER IF NOT EXISTS legacy_request_no_insert BEFORE INSERT ON requests
+  WHEN EXISTS(SELECT 1 FROM economy_legacy_active a WHERE a.request_id=NEW.id)
+  BEGIN SELECT RAISE(ABORT,'legacy reconciliation protects this request'); END;
+CREATE TRIGGER IF NOT EXISTS legacy_request_no_update BEFORE UPDATE ON requests
+  WHEN EXISTS(SELECT 1 FROM economy_legacy_active a WHERE a.request_id=NEW.id OR a.request_id=OLD.id)
+  BEGIN SELECT RAISE(ABORT,'legacy reconciliation protects this request'); END;
+CREATE TRIGGER IF NOT EXISTS legacy_request_no_delete BEFORE DELETE ON requests
+  WHEN EXISTS(SELECT 1 FROM economy_legacy_active a WHERE a.request_id=OLD.id)
+  BEGIN SELECT RAISE(ABORT,'legacy reconciliation protects this request'); END;
+`;
+  pgViews = LEGACY_VIEWS_SQL.replace(/CREATE VIEW IF NOT EXISTS (\w+) AS/g, "CREATE VIEW $1 WITH (security_invoker=true) AS");
+  LEGACY_PG_SQL = LEGACY_LEDGER_SQL + pgViews + `
+CREATE FUNCTION economy_legacy_history_immutable() RETURNS trigger LANGUAGE plpgsql AS $body$
+BEGIN
+  RAISE EXCEPTION 'legacy reconciliation history is immutable' USING ERRCODE='23000';
+END
+$body$;
+` + immutableTables.map((table) => `
+CREATE TRIGGER ${table}_immutable BEFORE UPDATE OR DELETE OR TRUNCATE ON ${table}
+  FOR EACH STATEMENT EXECUTE FUNCTION economy_legacy_history_immutable();
+`).join("") + `
+CREATE FUNCTION economy_legacy_request_guard() RETURNS trigger LANGUAGE plpgsql AS $body$
+BEGIN
+  IF TG_OP='TRUNCATE' THEN
+    IF EXISTS(SELECT 1 FROM economy_legacy_active) THEN
+      RAISE EXCEPTION 'legacy reconciliation protects requests' USING ERRCODE='23000';
+    END IF;
+    RETURN NULL;
+  END IF;
+  IF TG_OP IN ('INSERT','UPDATE') THEN
+    IF EXISTS(SELECT 1 FROM economy_legacy_active WHERE request_id=NEW.id) THEN
+      RAISE EXCEPTION 'legacy reconciliation protects this request' USING ERRCODE='23000';
+    END IF;
+  END IF;
+  IF TG_OP IN ('UPDATE','DELETE') THEN
+    IF EXISTS(SELECT 1 FROM economy_legacy_active WHERE request_id=OLD.id) THEN
+      RAISE EXCEPTION 'legacy reconciliation protects this request' USING ERRCODE='23000';
+    END IF;
+  END IF;
+  IF TG_OP='DELETE' THEN RETURN OLD; END IF;
+  RETURN NEW;
+END
+$body$;
+CREATE TRIGGER legacy_request_guard BEFORE INSERT OR UPDATE OR DELETE ON requests
+  FOR EACH ROW EXECUTE FUNCTION economy_legacy_request_guard();
+CREATE TRIGGER legacy_request_no_truncate BEFORE TRUNCATE ON requests
+  FOR EACH STATEMENT EXECUTE FUNCTION economy_legacy_request_guard();
+CREATE FUNCTION economy_legacy_target_guard() RETURNS trigger LANGUAGE plpgsql AS $body$
+BEGIN
+  IF EXISTS(SELECT 1 FROM economy_legacy_active a WHERE a.session_id=NEW.session_id AND a.operation_key<>NEW.operation_key)
+    OR EXISTS(SELECT 1 FROM economy_legacy_active a WHERE a.request_id=NEW.request_id) THEN
+    RAISE EXCEPTION 'legacy reconciliation is already active for this session' USING ERRCODE='23000';
+  END IF;
+  RETURN NEW;
+END
+$body$;
+CREATE TRIGGER legacy_target_no_overlap BEFORE INSERT ON legacy_reconciliation_targets
+  FOR EACH ROW EXECUTE FUNCTION economy_legacy_target_guard();
+`;
+});
+
+// src/db/ingest.ts
+var init_ingest = __esm(() => {
+  init_ingest_errors();
+  init_ingest_validation();
+});
 // src/lib/pricing.ts
 var exports_pricing = {};
 __export(exports_pricing, {
@@ -83,6 +929,9 @@ __export(exports_pricing, {
   ensurePricingSeeded: () => ensurePricingSeeded,
   computeCostFromDb: () => computeCostFromDb,
   computeCost: () => computeCost,
+  assessCostFromRows: () => assessCostFromRows,
+  assessCostFromDb: () => assessCostFromDb,
+  UnknownModelPricingError: () => UnknownModelPricingError,
   DEFAULT_PRICING: () => DEFAULT_PRICING
 });
 function normalizeModelName(raw) {
@@ -259,16 +1108,18 @@ function isFreeModel(model) {
   return model.trim().toLowerCase().endsWith(":free");
 }
 function computeCost(model, inputTokens, outputTokens, cacheReadTokens = 0, cacheWriteTokens = 0, cacheWrite1hTokens = 0, cacheStorageTokenHours = 0) {
-  const pricing = getPricing(model);
-  if (!pricing)
-    return 0;
-  return computeCostWithPricing(model, pricing, inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, cacheWrite1hTokens, cacheStorageTokenHours);
+  return requirePricedCost(assessResolvedCost(model, null, inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, cacheWrite1hTokens, cacheStorageTokenHours));
 }
 function computeCostFromDb(db, model, inputTokens, outputTokens, cacheReadTokens = 0, cacheWriteTokens = 0, cacheWrite1hTokens = 0, cacheStorageTokenHours = 0) {
-  const pricing = getPricingFromDb(db, model) ?? getPricing(model);
-  if (!pricing)
-    return 0;
-  return computeCostWithPricing(model, pricing, inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, cacheWrite1hTokens, cacheStorageTokenHours);
+  return requirePricedCost(assessCostFromDb(db, model, inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, cacheWrite1hTokens, cacheStorageTokenHours));
+}
+function requirePricedCost(assessment) {
+  if (assessment.usd === null)
+    throw new UnknownModelPricingError;
+  return assessment.usd;
+}
+function assessCostFromDb(db, model, inputTokens, outputTokens, cacheReadTokens = 0, cacheWriteTokens = 0, cacheWrite1hTokens = 0, cacheStorageTokenHours = 0) {
+  return assessResolvedCost(model, getPricingFromDb(db, model), inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, cacheWrite1hTokens, cacheStorageTokenHours);
 }
 function getPricingFromRows(rows, model) {
   if (isFreeModel(model))
@@ -284,10 +1135,32 @@ function getPricingFromRows(rows, model) {
   return modelPricingFromDbRow(match);
 }
 function estimateCostFromRows(rows, model, inputTokens, outputTokens, cacheReadTokens = 0, cacheWriteTokens = 0, cacheWrite1hTokens = 0, cacheStorageTokenHours = 0) {
-  const pricing = getPricingFromRows(rows, model) ?? getPricing(model);
+  return requirePricedCost(assessCostFromRows(rows, model, inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, cacheWrite1hTokens, cacheStorageTokenHours));
+}
+function assessCostFromRows(rows, model, inputTokens, outputTokens, cacheReadTokens = 0, cacheWriteTokens = 0, cacheWrite1hTokens = 0, cacheStorageTokenHours = 0) {
+  return assessResolvedCost(model, getPricingFromRows(rows, model), inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, cacheWrite1hTokens, cacheStorageTokenHours);
+}
+function assessResolvedCost(model, configured, inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, cacheWrite1hTokens, cacheStorageTokenHours) {
+  const counts = { inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, cacheWrite1hTokens };
+  for (const [field, value] of Object.entries(counts)) {
+    if (!Number.isSafeInteger(value) || value < 0)
+      throw new RangeError(`${field} must be a nonnegative safe integer`);
+  }
+  if (!Number.isFinite(cacheStorageTokenHours) || cacheStorageTokenHours < 0) {
+    throw new RangeError("cacheStorageTokenHours must be finite and nonnegative");
+  }
+  if (isFreeModel(model))
+    return { usd: 0, pricing: "explicit_free" };
+  const pricing = configured ?? getPricing(model);
   if (!pricing)
-    return 0;
-  return computeCostWithPricing(model, pricing, inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, cacheWrite1hTokens, cacheStorageTokenHours);
+    return { usd: null, pricing: "missing" };
+  if (Object.values(pricing).some((value) => value !== undefined && (!Number.isFinite(value) || value < 0))) {
+    throw new RangeError("Model pricing rates must be finite and nonnegative");
+  }
+  const usd = computeCostWithPricing(model, pricing, inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, cacheWrite1hTokens, cacheStorageTokenHours);
+  if (!Number.isFinite(usd))
+    throw new RangeError("Cost estimate exceeds the supported numeric range");
+  return { usd, pricing: configured ? "configured" : "catalog" };
 }
 function computeCostWithPricing(model, pricing, inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, cacheWrite1hTokens, cacheStorageTokenHours) {
   if (isFreeModel(model))
@@ -308,7 +1181,7 @@ function computeCostWithPricing(model, pricing, inputTokens, outputTokens, cache
   }
   return (inputTokens * effective.inputPer1M + outputTokens * effective.outputPer1M + cacheReadTokens * effective.cacheReadPer1M + cacheWriteTokens * effective.cacheWritePer1M + cacheWrite1hTokens * (effective.cacheWrite1hPer1M ?? effective.cacheWritePer1M) + cacheStorageTokenHours * (effective.cacheStoragePer1MHour ?? 0)) / 1e6;
 }
-var DEFAULT_PRICING, LEGACY_DEFAULT_PRICING, ADDITIONAL_LEGACY_DEFAULT_PRICING, REMOVED_DEFAULT_PRICING, FREE_PRICING, GEMINI_PROMPT_TIERS, OPENAI_PROMPT_TIERS, QWEN_PROMPT_TIERS, MINIMAX_PROMPT_TIERS, XAI_PROMPT_TIERS;
+var DEFAULT_PRICING, LEGACY_DEFAULT_PRICING, ADDITIONAL_LEGACY_DEFAULT_PRICING, REMOVED_DEFAULT_PRICING, FREE_PRICING, GEMINI_PROMPT_TIERS, OPENAI_PROMPT_TIERS, QWEN_PROMPT_TIERS, MINIMAX_PROMPT_TIERS, XAI_PROMPT_TIERS, UnknownModelPricingError;
 var init_pricing = __esm(() => {
   init_database();
   DEFAULT_PRICING = {
@@ -587,6 +1460,17 @@ var init_pricing = __esm(() => {
       cacheReadPer1M: 0
     }
   };
+  UnknownModelPricingError = class UnknownModelPricingError extends Error {
+    code = "MODEL_PRICING_UNAVAILABLE";
+    constructor() {
+      super("MODEL_PRICING_UNAVAILABLE: Pricing unavailable for model; configure its rates before estimating cost");
+      this.name = "UnknownModelPricingError";
+    }
+  };
+});
+// src/lib/summary-contract.ts
+var init_summary_contract = __esm(() => {
+  init_pricing();
 });
 
 // src/db/database.ts
@@ -595,7 +1479,62 @@ import { copyFileSync, existsSync, mkdirSync, readdirSync, statSync } from "fs";
 import { hostname, platform } from "os";
 import { homedir } from "os";
 import { join, resolve } from "path";
-import { dataDir } from "@hasna/paths";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+function pathsResolverAssertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform2 = options.platform ?? process.platform;
+  if (platform2 === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return pathsResolverResolve("data", options);
+}
+function cacheDir(options) {
+  return pathsResolverResolve("cache", options);
+}
 function normalizeMachineId(value) {
   const id = value?.trim().toLowerCase().split(".")[0];
   return id && id.length > 0 ? id : null;
@@ -618,7 +1557,7 @@ function macHostMachineId() {
   return null;
 }
 function getMachineId() {
-  const envMachine = normalizeMachineId(process.env["ECONOMY_MACHINE_ID"]);
+  const envMachine = normalizeMachineId(process.env["HASNA_ECONOMY_MACHINE_ID"]);
   if (envMachine)
     return envMachine;
   const hostMachine = normalizeMachineId(hostname()) ?? "unknown";
@@ -676,59 +1615,6 @@ function getDbPath() {
     return process.env["ECONOMY_DB"];
   return join(getDataDir(), "economy.db");
 }
-function isSqliteBusyError(error) {
-  const candidate = error;
-  const code = typeof candidate.code === "string" ? candidate.code : "";
-  const message = typeof candidate.message === "string" ? candidate.message : String(error);
-  return code === "SQLITE_BUSY" || code === "SQLITE_BUSY_RECOVERY" || /database is locked|SQLITE_BUSY/i.test(message);
-}
-function retryDelayMs(attempt) {
-  return Math.min(1000, 50 * 2 ** attempt);
-}
-function withSqliteBusyRetry(operation, context) {
-  const maxAttempts = 8;
-  let lastError;
-  for (let attempt = 0;attempt < maxAttempts; attempt++) {
-    try {
-      return operation();
-    } catch (error) {
-      if (!isSqliteBusyError(error))
-        throw error;
-      lastError = error;
-      if (attempt === maxAttempts - 1)
-        break;
-      Bun.sleepSync(retryDelayMs(attempt));
-    }
-  }
-  throw new Error(`SQLite database is locked after ${maxAttempts} attempts while ${context}. Another economy sync/merge may be recovering the database; retry shortly.`, { cause: lastError });
-}
-function openDatabase(dbPath, skipSeed = false) {
-  const path = dbPath ?? getDbPath();
-  if (path !== ":memory:") {
-    const dir = path.substring(0, path.lastIndexOf("/"));
-    if (dir && !existsSync(dir))
-      mkdirSync(dir, { recursive: true });
-  }
-  const db = withSqliteBusyRetry(() => {
-    const opened = new SqliteAdapter(path);
-    try {
-      opened.exec("PRAGMA busy_timeout = 10000");
-      opened.exec("PRAGMA journal_mode = WAL");
-      opened.exec("PRAGMA foreign_keys = ON");
-      initSchema(opened);
-      return opened;
-    } catch (error) {
-      try {
-        opened.close();
-      } catch {}
-      throw error;
-    }
-  }, `opening ${path}`);
-  if (!skipSeed) {
-    Promise.resolve().then(() => (init_pricing(), exports_pricing)).then(({ ensurePricingSeeded: ensurePricingSeeded2 }) => ensurePricingSeeded2(db)).catch(() => {});
-  }
-  return db;
-}
 function quoteSqlIdent(identifier) {
   return `"${identifier.replace(/"/g, '""')}"`;
 }
@@ -750,6 +1636,7 @@ function addColumnIfMissing(db, table, column, definition) {
   }
 }
 function initSchema(db) {
+  db.exec(INGEST_SCHEMA_SQL);
   db.exec(`
     CREATE TABLE IF NOT EXISTS cost_centers (
       id TEXT PRIMARY KEY,
@@ -941,6 +1828,7 @@ function initSchema(db) {
   addColumnIfMissing(db, "requests", "cost_center_id", `TEXT`);
   addColumnIfMissing(db, "sessions", "cost_center_id", `TEXT`);
   addColumnIfMissing(db, "budgets", "cost_center_id", `TEXT`);
+  addColumnIfMissing(db, "budgets", "metric", `TEXT NOT NULL DEFAULT 'legacy_request_cost_usd' CHECK (metric IN ('legacy_request_cost_usd', 'metered_api_usd'))`);
   if (addColumnIfMissing(db, "requests", "cache_create_5m_tokens", "INTEGER DEFAULT 0")) {
     db.exec(`UPDATE requests SET cache_create_5m_tokens = cache_create_tokens WHERE cache_create_5m_tokens = 0`);
   }
@@ -974,6 +1862,12 @@ function initSchema(db) {
     CREATE INDEX IF NOT EXISTS idx_budgets_cost_center ON budgets(cost_center_id);
     CREATE INDEX IF NOT EXISTS idx_cost_centers_kind ON cost_centers(kind);
   `);
+  for (const [table, columns] of Object.entries(OBSERVATION_COLUMNS)) {
+    for (const [column, type] of Object.entries(columns))
+      addColumnIfMissing(db, table, column, type);
+  }
+  db.exec(SCAN_RECEIPTS_SQL);
+  db.exec(LEGACY_SQLITE_SQL);
 }
 function upsertCostCenter(db, center) {
   const updatedAt = center.updated_at ?? center.created_at;
@@ -984,7 +1878,7 @@ function upsertCostCenter(db, center) {
   `).run(center.id, center.kind, center.name, center.repo_path ?? null, center.labels_json ?? "{}", center.created_at, updatedAt);
 }
 function upsertRequest(db, req) {
-  const now = req.updated_at ?? new Date().toISOString();
+  const now = req.updated_at ?? req.timestamp;
   db.prepare(`
     INSERT OR REPLACE INTO requests
       (id, agent, session_id, model, input_tokens, output_tokens,
@@ -996,7 +1890,7 @@ function upsertRequest(db, req) {
   `).run(req.id, req.agent, req.session_id, req.model, req.input_tokens, req.output_tokens, req.cache_read_tokens, req.cache_create_tokens, req.cache_create_5m_tokens ?? req.cache_create_tokens, req.cache_create_1h_tokens ?? 0, req.cost_usd, req.cost_basis ?? "estimated", req.duration_ms, req.timestamp, req.source_request_id, req.machine_id ?? "", req.cost_center_id ?? null, req.attribution_tag ?? process.env["ECONOMY_TAG"] ?? "", req.account_key ?? "", req.account_tool ?? "", req.account_name ?? "", req.account_email ?? "", req.account_source ?? "", now, req.synced_at ?? "");
 }
 function upsertSession(db, session) {
-  const now = session.updated_at ?? new Date().toISOString();
+  const now = session.updated_at ?? session.ended_at ?? session.started_at;
   db.prepare(`
     INSERT OR REPLACE INTO sessions
       (id, agent, project_path, project_name, started_at, ended_at,
@@ -1008,30 +1902,30 @@ function upsertSession(db, session) {
 function rollupSession(db, sessionId) {
   db.prepare(`
     UPDATE sessions SET
-      total_cost_usd = (SELECT COALESCE(SUM(cost_usd), 0) FROM requests WHERE session_id = ?),
-      total_tokens   = (SELECT COALESCE(SUM(input_tokens + output_tokens + cache_read_tokens + cache_create_tokens), 0) FROM requests WHERE session_id = ?),
-      request_count  = (SELECT COUNT(*) FROM requests WHERE session_id = ?),
-      ended_at       = (SELECT MAX(timestamp) FROM requests WHERE session_id = ?),
+      total_cost_usd = (SELECT COALESCE(SUM(cost_usd), 0) FROM economy_effective_requests WHERE session_id = ?),
+      total_tokens   = (SELECT COALESCE(SUM(input_tokens + output_tokens + cache_read_tokens + cache_create_tokens), 0) FROM economy_effective_requests WHERE session_id = ?),
+      request_count  = (SELECT COUNT(*) FROM economy_effective_requests WHERE session_id = ?),
+      ended_at       = (SELECT MAX(timestamp) FROM economy_effective_requests WHERE session_id = ?),
       started_at     = CASE WHEN started_at = '' OR started_at IS NULL
-                            THEN (SELECT MIN(timestamp) FROM requests WHERE session_id = ?)
+                            THEN (SELECT MIN(timestamp) FROM economy_effective_requests WHERE session_id = ?)
                             ELSE started_at END,
       account_key    = CASE WHEN account_key = '' OR account_key IS NULL
-                            THEN COALESCE((SELECT account_key FROM requests WHERE session_id = ? AND account_key != '' ORDER BY timestamp DESC LIMIT 1), '')
+                            THEN COALESCE((SELECT account_key FROM economy_effective_requests WHERE session_id = ? AND account_key != '' ORDER BY timestamp DESC LIMIT 1), '')
                             ELSE account_key END,
       account_tool   = CASE WHEN account_tool = '' OR account_tool IS NULL
-                            THEN COALESCE((SELECT account_tool FROM requests WHERE session_id = ? AND account_tool != '' ORDER BY timestamp DESC LIMIT 1), '')
+                            THEN COALESCE((SELECT account_tool FROM economy_effective_requests WHERE session_id = ? AND account_tool != '' ORDER BY timestamp DESC LIMIT 1), '')
                             ELSE account_tool END,
       account_name   = CASE WHEN account_name = '' OR account_name IS NULL
-                            THEN COALESCE((SELECT account_name FROM requests WHERE session_id = ? AND account_name != '' ORDER BY timestamp DESC LIMIT 1), '')
+                            THEN COALESCE((SELECT account_name FROM economy_effective_requests WHERE session_id = ? AND account_name != '' ORDER BY timestamp DESC LIMIT 1), '')
                             ELSE account_name END,
       account_email  = CASE WHEN account_email = '' OR account_email IS NULL
-                            THEN COALESCE((SELECT account_email FROM requests WHERE session_id = ? AND account_email != '' ORDER BY timestamp DESC LIMIT 1), '')
+                            THEN COALESCE((SELECT account_email FROM economy_effective_requests WHERE session_id = ? AND account_email != '' ORDER BY timestamp DESC LIMIT 1), '')
                             ELSE account_email END,
       account_source = CASE WHEN account_source = '' OR account_source IS NULL
-                            THEN COALESCE((SELECT account_source FROM requests WHERE session_id = ? AND account_source != '' ORDER BY timestamp DESC LIMIT 1), '')
+                            THEN COALESCE((SELECT account_source FROM economy_effective_requests WHERE session_id = ? AND account_source != '' ORDER BY timestamp DESC LIMIT 1), '')
                             ELSE account_source END,
       cost_center_id = CASE WHEN cost_center_id = '' OR cost_center_id IS NULL
-                            THEN COALESCE((SELECT cost_center_id FROM requests WHERE session_id = ? AND cost_center_id IS NOT NULL AND cost_center_id != '' ORDER BY timestamp DESC LIMIT 1), NULL)
+                            THEN COALESCE((SELECT cost_center_id FROM economy_effective_requests WHERE session_id = ? AND cost_center_id IS NOT NULL AND cost_center_id != '' ORDER BY timestamp DESC LIMIT 1), NULL)
                             ELSE cost_center_id END
     WHERE id = ?
   `).run(sessionId, sessionId, sessionId, sessionId, sessionId, sessionId, sessionId, sessionId, sessionId, sessionId, sessionId, sessionId);
@@ -1067,32 +1961,91 @@ function seedModelPricing(db, defaults) {
     });
   }
 }
+var PATHS_RESOLVER_KIND_ENV, PATHS_RESOLVER_APP_SLUG_RE;
 var init_database = __esm(() => {
+  init_observation_schema();
+  init_observation_provenance();
+  init_ingest_validation();
+  init_legacy_schema();
+  init_ingest();
+  init_ingest_errors();
+  init_summary_contract();
+  PATHS_RESOLVER_KIND_ENV = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+});
+
+// src/db/sqlite-store.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
+function isSqliteBusyError(error) {
+  const candidate = error;
+  const code = typeof candidate.code === "string" ? candidate.code : "";
+  const message = typeof candidate.message === "string" ? candidate.message : String(error);
+  return code === "SQLITE_BUSY" || code === "SQLITE_BUSY_RECOVERY" || /database is locked|SQLITE_BUSY/i.test(message);
+}
+function retryDelayMs(attempt) {
+  return Math.min(1000, 50 * 2 ** attempt);
+}
+function withSqliteBusyRetry(operation, context) {
+  const maxAttempts = 8;
+  let lastError;
+  for (let attempt = 0;attempt < maxAttempts; attempt++) {
+    try {
+      return operation();
+    } catch (error) {
+      if (!isSqliteBusyError(error))
+        throw error;
+      lastError = error;
+      if (attempt === maxAttempts - 1)
+        break;
+      Bun.sleepSync(retryDelayMs(attempt));
+    }
+  }
+  throw new Error(`SQLite database is locked after ${maxAttempts} attempts while ${context}. Another economy sync/merge may be recovering the database; retry shortly.`, { cause: lastError });
+}
+function openDatabase(dbPath, skipSeed = false) {
+  const path = dbPath ?? getDbPath();
+  if (path !== ":memory:") {
+    const dir = path.substring(0, path.lastIndexOf("/"));
+    if (dir && !existsSync2(dir))
+      mkdirSync2(dir, { recursive: true });
+  }
+  const db = withSqliteBusyRetry(() => {
+    const opened = new SqliteAdapter(path);
+    try {
+      opened.exec("PRAGMA busy_timeout = 10000");
+      opened.exec("PRAGMA journal_mode = WAL");
+      opened.exec("PRAGMA foreign_keys = ON");
+      initSchema(opened);
+      return opened;
+    } catch (error) {
+      try {
+        opened.close();
+      } catch {}
+      throw error;
+    }
+  }, `opening ${path}`);
+  if (!skipSeed) {
+    Promise.resolve().then(() => (init_pricing(), exports_pricing)).then(({ ensurePricingSeeded: ensurePricingSeeded2 }) => ensurePricingSeeded2(db)).catch(() => {});
+  }
+  return db;
+}
+var init_sqlite_store = __esm(() => {
   init_sqlite_adapter();
+  init_database();
+  init_database();
 });
 
 // src/otel/index.ts
-init_database();
+init_sqlite_store();
 
 // src/ingest/otel.ts
 init_database();
-
-// src/lib/agents.ts
-var AGENTS = [
-  "claude",
-  "takumi",
-  "codex",
-  "gemini",
-  "opencode",
-  "cursor",
-  "pi",
-  "hermes"
-];
-function isAgent(value) {
-  return AGENTS.includes(value);
-}
-
-// src/ingest/otel.ts
+init_agents();
 function attrValue(attr) {
   if (!attr?.value)
     return;
@@ -1413,19 +2366,1109 @@ async function ingestOtelRows(db, rows) {
     rollupSession(db, sessionId);
   return { requests, sessions: sessions.size };
 }
+
+// src/lib/cloud-ingest.ts
+init_database();
+init_pricing();
+
+// src/ingest/collection-outcome.ts
+import { AsyncLocalStorage } from "async_hooks";
+var context = new AsyncLocalStorage;
+
+// src/ingest/claude.ts
+init_database();
+init_pricing();
+import { homedir as homedir3 } from "os";
+import { join as join3, basename } from "path";
+
+// src/lib/accounts-store.ts
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+import { z } from "zod";
+import { resolveClientTransport, resolveCredential } from "@hasna/contracts/client";
+
+// src/lib/cloud-storage.ts
+import {
+  appConfigDiskValue,
+  ClientTransportConfigurationError,
+  clientTransportEnvKeys,
+  createClientTransport,
+  credentialDiskSources,
+  credentialOverrideEnvKey,
+  credentialPointerEnvKey,
+  CREDENTIAL_PROFILE_ENV_KEY,
+  keychainConfigValue
+} from "@hasna/contracts/client";
+import { createHasnaStorageClient } from "@hasna/contracts/client/storage";
+var ECONOMY_APP = "economy";
+var LOCAL_STORAGE_OPT_IN_KEYS = ["HASNA_ECONOMY_LOCAL", "ECONOMY_LOCAL"];
+function envFlagSet(env, key) {
+  const raw = env[key];
+  if (raw === undefined)
+    return false;
+  const value = raw.trim().toLowerCase();
+  return value !== "" && value !== "0" && value !== "false" && value !== "no" && value !== "off";
+}
+function localStorageExplicitlyOptedIn(env) {
+  return LOCAL_STORAGE_OPT_IN_KEYS.some((key) => envFlagSet(env, key));
+}
+function economyAuthorityEnvKeys() {
+  const keys = clientTransportEnvKeys(ECONOMY_APP);
+  return [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey(ECONOMY_APP),
+    credentialPointerEnvKey(ECONOMY_APP),
+    CREDENTIAL_PROFILE_ENV_KEY
+  ];
+}
+function hasEconomyEnvAuthorityIntent(env) {
+  return economyAuthorityEnvKeys().some((key) => (env[key] ?? "").trim().length > 0);
+}
+function hostedAuthorityConfigured(env, options = {}) {
+  const keys = clientTransportEnvKeys(ECONOMY_APP);
+  if (keys.apiUrlKeys.some((key) => (env[key] ?? "").trim().length > 0))
+    return true;
+  if (keychainConfigValue(ECONOMY_APP, env, options.credentials?.keychain) !== null)
+    return true;
+  return appConfigDiskValue(ECONOMY_APP, env, keys.apiUrlKeys) !== null;
+}
+function economyResolverEnv(env) {
+  const blanks = economyAuthorityEnvKeys().filter((key) => (key in env) && (env[key] ?? "").trim() === "");
+  if (blanks.length === 0)
+    return env;
+  const next = { ...env };
+  for (const key of blanks)
+    delete next[key];
+  return next;
+}
+var CONTRACTS_AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+function isAmbientEconomyEnv(env) {
+  if (typeof process !== "undefined" && env === process.env)
+    return true;
+  return env[CONTRACTS_AMBIENT_ENVIRONMENT] === true;
+}
+function economyResolverInputs(env, credentials = {}) {
+  const normalised = economyResolverEnv(env);
+  if (normalised === env)
+    return { env: normalised, credentials };
+  const keychain = { ...credentials.keychain };
+  if (keychain.enabled === undefined && keychain.run === undefined) {
+    keychain.enabled = isAmbientEconomyEnv(env);
+  }
+  return { env: normalised, credentials: { ...credentials, keychain } };
+}
+function resolveEconomyStorageClient(name, env, overrides = {}) {
+  const { env: resolverEnv, credentials } = economyResolverInputs(env, overrides.credentials);
+  const wired = createClientTransport(name, resolverEnv, {
+    credentials,
+    ...overrides.fetchImpl ? { fetchImpl: overrides.fetchImpl } : {},
+    ...overrides.headers ? { headers: overrides.headers } : {},
+    ...overrides.timeoutMs ? { timeoutMs: overrides.timeoutMs } : {},
+    ...overrides.retry !== undefined ? { retry: overrides.retry } : {},
+    ...overrides.sleepImpl ? { sleepImpl: overrides.sleepImpl } : {}
+  });
+  return {
+    transport: "http",
+    client: createHasnaStorageClient(name, wired.client),
+    resolution: wired.resolution
+  };
+}
+function localEconomyNotice() {
+  return `economy: LOCAL mode (${LOCAL_STORAGE_OPT_IN_KEYS[0]}=1) \u2014 reading and writing the on-box ` + `SQLite store, not the hosted fleet. Data in the shared economy API is NOT included.`;
+}
+function credentialRequiredError(env, cause) {
+  const keys = clientTransportEnvKeys(ECONOMY_APP);
+  const clientEnv = env;
+  const detail = cause instanceof Error ? cause.message : `No API key could be resolved for '${ECONOMY_APP}'. Looked in the Keychain (macOS only), ` + `then for a credential file at ${credentialDiskSources(ECONOMY_APP, clientEnv).join(" or ") || "<no HOME set>"}, ` + `then for ${keys.apiKeyKeys[0]} in the environment.`;
+  const wayOut = hostedAuthorityConfigured(clientEnv) ? `${keys.apiUrlKeys[0]} (or the Keychain hasna.credentials.${ECONOMY_APP}.api-url item, or ` + `~/.hasna/${ECONOMY_APP}/config/credentials) selects a hosted service, so ${LOCAL_STORAGE_OPT_IN_KEYS[0]} ` + `does not apply; unset the authority to use the local store.` : `Or set ${LOCAL_STORAGE_OPT_IN_KEYS[0]}=1 to explicitly opt into the local store.`;
+  return new Error(`Economy fails closed instead of silently serving the local SQLite store: ${detail} ` + `Set ${keys.apiUrlKeys[0]} and ${keys.apiKeyKeys[0]} (or store the key in the Keychain item ` + `hasna.credentials.${ECONOMY_APP}.api-key, or in ~/.hasna/${ECONOMY_APP}/config/credentials) to use the ` + `hosted economy API at ${keys.apiUrlKeys[0]} or the default fleet gateway. ` + wayOut);
+}
+var cache;
+var localNoticePrinted = false;
+function resolveEconomyCloudStorage(env = process.env, overrides) {
+  const clientEnv = env;
+  if (localStorageExplicitlyOptedIn(env) && !hasEconomyEnvAuthorityIntent(clientEnv)) {
+    return { active: false, client: null };
+  }
+  let resolved;
+  try {
+    resolved = resolveEconomyStorageClient(ECONOMY_APP, clientEnv, overrides ?? {});
+  } catch (error) {
+    if (error instanceof ClientTransportConfigurationError) {
+      throw credentialRequiredError(env, error);
+    }
+    throw error;
+  }
+  return { active: true, client: resolved.client };
+}
+function economyCloudStorage(env = process.env) {
+  if (cache === undefined) {
+    cache = resolveEconomyCloudStorage(env);
+    if (!cache.active && !localNoticePrinted) {
+      localNoticePrinted = true;
+      if (typeof process !== "undefined")
+        process.stderr.write(`${localEconomyNotice()}
+`);
+    }
+  }
+  return cache;
+}
+
+// src/lib/accounts-store.ts
+var profileNameSchema = z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "must be lowercase alphanumeric/hyphen and start with a letter or digit");
+var profileSchema = z.object({
+  name: z.string(),
+  tool: z.string(),
+  email: z.string().optional(),
+  displayName: z.string().optional(),
+  dir: z.string(),
+  description: z.string().optional(),
+  createdAt: z.string(),
+  lastUsedAt: z.string().optional()
+});
+var toolDefSchema = z.object({
+  id: z.string(),
+  label: z.string(),
+  envVar: z.string(),
+  defaultDir: z.string(),
+  bin: z.string()
+});
+var storeSchema = z.object({
+  version: z.literal(1),
+  current: z.record(z.string(), z.string()).default({}),
+  applied: z.record(z.string(), z.string()).default({}),
+  toolLocks: z.record(z.string(), z.string()).default({}),
+  profiles: z.array(profileSchema).default([]),
+  tools: z.array(toolDefSchema).default([])
+});
+var BUILTIN_TOOLS = [
+  { id: "claude", label: "Claude Code", envVar: "CLAUDE_CONFIG_DIR", defaultDir: join2(homedir2(), ".claude"), bin: "claude" },
+  { id: "codex-app", label: "Codex App", envVar: "CODEX_HOME", defaultDir: join2(homedir2(), ".codex"), bin: "/Applications/Codex.app/Contents/MacOS/Codex" },
+  { id: "codex", label: "Codex CLI", envVar: "CODEX_HOME", defaultDir: join2(homedir2(), ".codex"), bin: "codex" },
+  { id: "codewith", label: "Codewith", envVar: "CODEWITH_HOME", defaultDir: join2(homedir2(), ".codewith"), bin: "codewith" },
+  { id: "takumi", label: "Takumi", envVar: "TAKUMI_CONFIG_DIR", defaultDir: join2(homedir2(), ".takumi"), bin: "takumi" },
+  { id: "gemini", label: "Gemini CLI", envVar: "GEMINI_CONFIG_DIR", defaultDir: join2(homedir2(), ".gemini"), bin: "gemini" },
+  { id: "opencode", label: "opencode", envVar: "OPENCODE_CONFIG_DIR", defaultDir: join2(homedir2(), ".config", "opencode"), bin: "opencode" },
+  { id: "cursor", label: "Cursor Agent", envVar: "CURSOR_CONFIG_DIR", defaultDir: join2(homedir2(), ".cursor"), bin: "cursor-agent" },
+  { id: "pi", label: "Pi Coding Agent", envVar: "PI_CODING_AGENT_HOME", defaultDir: join2(homedir2(), ".pi"), bin: "pi" },
+  { id: "hermes", label: "Hermes", envVar: "HERMES_HOME", defaultDir: join2(homedir2(), ".hermes"), bin: "hermes" },
+  { id: "kimi", label: "Kimi Code", envVar: "KIMI_CODE_HOME", defaultDir: join2(homedir2(), ".kimi-code"), bin: "kimi" },
+  { id: "grok", label: "Grok Build", envVar: "HOME", defaultDir: join2(homedir2(), ".grok"), bin: "grok" }
+];
+
+// src/ingest/claude.ts
+var CLAUDE_PROJECTS_DIR = process.env["HASNA_ECONOMY_CLAUDE_PROJECTS_DIR"] ?? join3(homedir3(), ".claude", "projects");
+var TAKUMI_PROJECTS_DIR = process.env["HASNA_ECONOMY_TAKUMI_PROJECTS_DIR"] ?? join3(homedir3(), ".takumi", "projects");
+
+// src/ingest/codex.ts
+init_database();
+init_pricing();
+import { homedir as homedir4 } from "os";
+import { join as join4, basename as basename2 } from "path";
+var DEFAULT_CODEX_DB_PATH = join4(homedir4(), ".codex", "state_5.sqlite");
+var DEFAULT_CODEX_CONFIG_PATH = join4(homedir4(), ".codex", "config.toml");
+var DEFAULT_CODEWITH_DB_PATH = join4(homedir4(), ".codewith", "state_5.sqlite");
+var DEFAULT_CODEWITH_CONFIG_PATH = join4(homedir4(), ".codewith", "config.toml");
+
+// src/ingest/gemini.ts
+init_database();
+init_pricing();
+import { homedir as homedir5 } from "os";
+import { join as join5, basename as basename3 } from "path";
+var DEFAULT_GEMINI_TMP_DIR = join5(homedir5(), ".gemini", "tmp");
+var DEFAULT_GEMINI_HISTORY_DIR = join5(homedir5(), ".gemini", "history");
+
+// src/ingest/opencode.ts
+init_database();
+init_pricing();
+import { homedir as homedir6 } from "os";
+import { join as join6 } from "path";
+var OPENCODE_STORAGE = join6(homedir6(), ".local", "share", "opencode", "storage");
+
+// src/ingest/quota-observation.ts
+init_database();
+init_observation_provenance();
+
+// src/ingest/pi.ts
+init_database();
+import { homedir as homedir7 } from "os";
+import { join as join7 } from "path";
+var PI_SESSION_DIR = process.env["PI_CODING_AGENT_SESSION_DIR"] ?? join7(homedir7(), ".pi", "agent", "sessions");
+
+// src/ingest/hermes.ts
+init_database();
+import { homedir as homedir8 } from "os";
+import { join as join8 } from "path";
+var HERMES_DB = join8(homedir8(), ".hermes", "state.db");
+
+// src/ingest/loops.ts
+init_database();
+init_pricing();
+
+// src/ingest/codex-quota.ts
+var WHAM_USAGE_URL = process.env["CODEX_USAGE_URL"] ?? "https://chatgpt.com/backend-api/wham/usage";
+
+// src/lib/sync-all.ts
+init_database();
+init_observation_provenance();
+
+// src/ingest/billing.ts
+init_database();
+
+// src/lib/sync-maintenance.ts
+init_database();
+
+// src/lib/ingest-batches.ts
+init_ingest_validation();
+import { createHash as createHash3 } from "crypto";
+function* ingestBatches(body) {
+  let rows = {};
+  let count = 0;
+  let bytes = 0;
+  const finish = () => {
+    const digest2 = createHash3("sha256").update(stableJson(rows)).digest("hex");
+    const batch = { ...rows, schema_version: 1, idempotency_key: `scan-${digest2}` };
+    rows = {};
+    count = 0;
+    bytes = 0;
+    if (Buffer.byteLength(JSON.stringify(batch)) > MAX_INGEST_BYTES)
+      throw new Error("Ingest batch exceeds the server byte limit");
+    return batch;
+  };
+  const rowLimit = Math.min(MAX_INGEST_ROWS, 500);
+  const byteLimit = MAX_INGEST_BYTES - 4096;
+  for (const table of Object.keys(body).sort()) {
+    const sorted = body[table].map((row) => ({ row, canonical: stableJson(row) })).sort((a, b) => a.canonical < b.canonical ? -1 : a.canonical > b.canonical ? 1 : 0);
+    for (const { row, canonical } of sorted) {
+      const size = Buffer.byteLength(canonical) + 1;
+      if (size > byteLimit)
+        throw new Error("One ingestion row exceeds the server byte limit");
+      if (count > 0 && (count >= rowLimit || bytes + size > byteLimit))
+        yield finish();
+      (rows[table] ??= []).push(row);
+      count++;
+      bytes += size;
+    }
+  }
+  if (count > 0)
+    yield finish();
+}
+
+class IngestBatchFailure extends Error {
+  pending_key;
+  completed;
+  pending_command;
+  constructor(pending_key, completed, pending_command) {
+    super("Ingest batch did not return a verified receipt; retain the exact staged command and reconcile before retrying");
+    this.pending_key = pending_key;
+    this.completed = completed;
+    this.pending_command = pending_command;
+    this.name = "IngestBatchFailure";
+  }
+}
+
+// src/lib/ingest-journal.ts
+init_ingest_validation();
+init_database();
+import { constants, closeSync, fsyncSync, fstatSync, lstatSync, mkdirSync as mkdirSync3, openSync, readFileSync, opendirSync, realpathSync, writeFileSync } from "fs";
+import { createHash as createHash4 } from "crypto";
+import { join as join9, resolve as resolve2 } from "path";
+var MAX_COMMANDS = 1000;
+var MAX_BYTES = 64 * 1024 * 1024;
+var RECEIPT_RESERVE = 4096;
+var MAINTENANCE_RESERVE = 16384;
+var sha = (s) => createHash4("sha256").update(s).digest("hex");
+
+class PendingIngestError extends Error {
+  pending_keys;
+  code = "INGEST_RECONCILIATION_REQUIRED";
+  constructor(pending_keys) {
+    super("Pending ingestion requires hosted receipt reconciliation; no command was replayed");
+    this.pending_keys = pending_keys;
+    this.name = "PendingIngestError";
+  }
+}
+function definitiveIngestRefusal(status, body) {
+  const reasons = { 400: "invalid_ingest", 409: "ingest_conflict", 413: "ingest_too_large", 422: "unprocessable_ingest" };
+  if (!Object.hasOwn(reasons, status))
+    return null;
+  const legacy = body?.expected === "legacy_aggregate_requires_migration";
+  return {
+    status,
+    code: legacy ? "legacy_aggregate_requires_migration" : "ingest_refused",
+    reason: legacy ? "legacy_aggregate_requires_migration" : reasons[status]
+  };
+}
+function getIngestJournalPath() {
+  return process.env.HASNA_ECONOMY_INGEST_JOURNAL ?? join9(cacheDir({ app: "economy", home: process.env.HOME || process.env.USERPROFILE }), "pending-ingest");
+}
+function targetId(cloud) {
+  const url = new URL(cloud.client.transport.baseUrl);
+  if (url.username || url.password || url.search || url.hash)
+    throw new Error("Ingest authority must not contain URL credentials or capabilities");
+  return sha(url.toString().replace(/\/+$/, ""));
+}
+function secureDirectory(path) {
+  mkdirSync3(path, { recursive: true, mode: 448 });
+  const stat = lstatSync(path);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 63) !== 0 || process.getuid && stat.uid !== process.getuid())
+    throw new Error("Ingest journal must be a private owner directory");
+}
+function readJson(path, max) {
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const st = fstatSync(fd);
+    if (!st.isFile() || st.size > max || (st.mode & 63) !== 0 || process.getuid && st.uid !== process.getuid())
+      throw new Error("Unsafe ingest journal record");
+    return JSON.parse(readFileSync(fd, "utf8"));
+  } finally {
+    closeSync(fd);
+  }
+}
+function createExact(path, value) {
+  const bytes = JSON.stringify(value);
+  let fd;
+  try {
+    fd = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+  } catch (error) {
+    if (error.code === "EEXIST")
+      return false;
+    throw error;
+  }
+  try {
+    writeFileSync(fd, bytes);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  if (JSON.stringify(readJson(path, MAX_INGEST_BYTES + 4096)) !== bytes)
+    throw new Error("Ingest journal readback failed");
+  const directory = openSync(resolve2(path, ".."), constants.O_RDONLY);
+  try {
+    fsyncSync(directory);
+  } finally {
+    closeSync(directory);
+  }
+  return true;
+}
+function unwrap(raw) {
+  return raw && typeof raw === "object" && "data" in raw ? raw.data : raw;
+}
+function verifyIngestReceipt(raw, command) {
+  const receipt = unwrap(raw);
+  if (!receipt || typeof receipt !== "object" || !receipt.ingested || typeof receipt.ingested !== "object" || Array.isArray(receipt.ingested) || !Number.isSafeInteger(receipt.total) || receipt.total < 0 || typeof receipt.operation_key !== "string" || !/^[a-f0-9]{64}$/.test(receipt.operation_key) || typeof receipt.replayed !== "boolean")
+    throw new Error("Invalid ingest receipt");
+  let sum = 0;
+  for (const [table, count] of Object.entries(receipt.ingested)) {
+    if (!Array.isArray(command[table]) || typeof count !== "number" || !Number.isSafeInteger(count) || count < 0 || count > command[table].length)
+      throw new Error("Invalid ingest receipt");
+    sum += count;
+  }
+  if (sum !== receipt.total)
+    throw new Error("Invalid ingest receipt");
+  const projected = {
+    ingested: Object.fromEntries(Object.entries(receipt.ingested)),
+    total: receipt.total,
+    operation_key: receipt.operation_key,
+    replayed: receipt.replayed,
+    stale: receipt.stale ?? 0,
+    unchanged: receipt.unchanged ?? 0
+  };
+  const rows = Object.values(command).reduce((n, v) => n + (Array.isArray(v) ? v.length : 0), 0);
+  if (![projected.stale, projected.unchanged].every((n) => Number.isSafeInteger(n) && n >= 0 && n <= rows) || Buffer.byteLength(JSON.stringify(projected)) > RECEIPT_RESERVE - 256)
+    throw new Error("Invalid ingest receipt");
+  return projected;
+}
+function sameReceipt(left, right) {
+  const meaning = (value) => ({ ingested: value?.ingested, total: value?.total, operation_key: value?.operation_key, stale: value?.stale ?? 0, unchanged: value?.unchanged ?? 0 });
+  return stableJson(meaning(left)) === stableJson(meaning(right));
+}
+async function lookupJournalReceipt(cloud, key, bodyHash, timeoutMs = 1e4) {
+  const query = new URLSearchParams({ idempotency_key: key, body_hash: bodyHash });
+  const raw = unwrap(await cloud.client.transport.get(`/ingest/receipts?${query}`, { retry: false, timeoutMs }));
+  if (!raw || raw.body_hash !== bodyHash)
+    throw new Error("Invalid reconciliation response");
+  if (raw.status === "absent")
+    return null;
+  if (raw.status !== "committed")
+    throw new Error("Invalid reconciliation response");
+  return raw.receipt;
+}
+
+class IngestJournal {
+  directory;
+  target;
+  inventoryBytes = 0;
+  freshlyStaged = new Set;
+  constructor(cloud, path = getIngestJournalPath()) {
+    this.target = targetId(cloud);
+    secureDirectory(path);
+    this.directory = join9(realpathSync(path), this.target);
+    secureDirectory(this.directory);
+  }
+  names() {
+    const names = [];
+    const directory = opendirSync(this.directory);
+    try {
+      for (let entry;entry = directory.readSync(); ) {
+        if (entry.name === ".lease" || entry.name === ".maintenance" || entry.name === ".authority.json" || entry.name === ".recovery")
+          continue;
+        names.push(entry.name);
+        if (names.length > MAX_COMMANDS * 2)
+          throw new Error("Ingest journal capacity reached; preserve and reconcile records");
+      }
+    } finally {
+      directory.closeSync();
+    }
+    this.inventoryBytes = 0;
+    const set = new Set(names);
+    for (const name of names) {
+      if (!/^[a-f0-9]{64}\.(intent|receipt|refusal)\.json$/.test(name))
+        throw new Error("Unexpected ingest journal entry");
+      if (!name.endsWith(".intent.json") && !set.has(name.replace(/\.(receipt|refusal)\./, ".intent.")))
+        throw new Error("Orphaned ingest outcome requires maintenance recovery");
+      if (name.endsWith(".refusal.json") && set.has(name.replace(".refusal.", ".receipt.")))
+        throw new Error("Conflicting ingest receipt and refusal");
+      const stat = lstatSync(join9(this.directory, name));
+      if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 63) !== 0)
+        throw new Error("Unsafe ingest journal record");
+      if (stat.size > MAX_INGEST_BYTES + 4096)
+        throw new Error("Oversized ingest journal record");
+      this.inventoryBytes += stat.size;
+      if (name.endsWith(".refusal.json"))
+        this.refusal(this.intent(name.replace(".refusal.", ".intent.")).command);
+    }
+    return names;
+  }
+  file(key, kind) {
+    return join9(this.directory, `${sha(key)}.${kind}.json`);
+  }
+  intent(name) {
+    const record = readJson(join9(this.directory, name), MAX_INGEST_BYTES + 4096);
+    if (record.version !== 1 || record.target !== this.target || !record.command || typeof record.command.idempotency_key !== "string" || record.body_hash !== canonicalIngestBodyHash(record.command) || name !== `${sha(record.command.idempotency_key)}.intent.json`)
+      throw new Error("Invalid ingest journal intent");
+    validateIngest(record.command);
+    return record;
+  }
+  status() {
+    const names = this.names(), intents = names.filter((n) => n.endsWith(".intent.json"));
+    const set = new Set(names);
+    const completed = intents.filter((name) => set.has(name.replace(".intent.", ".receipt."))).length;
+    const rejected = intents.filter((name) => set.has(name.replace(".intent.", ".refusal."))).length;
+    const bytes = this.inventoryBytes;
+    return { target: this.target, commands: intents.length, completed, rejected, pending: intents.length - completed - rejected, bytes, reserved_bytes: bytes + (intents.length - completed - rejected) * RECEIPT_RESERVE + MAINTENANCE_RESERVE };
+  }
+  canStage(command, status = this.status()) {
+    const name = `${sha(command.idempotency_key)}.intent.json`;
+    try {
+      if (this.intent(name).body_hash !== canonicalIngestBodyHash(command))
+        throw new Error("Ingest command key is already bound to different content");
+      return true;
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+    const record = { version: 1, target: this.target, body_hash: canonicalIngestBodyHash(command), command };
+    return status.commands < MAX_COMMANDS && status.reserved_bytes + Buffer.byteLength(JSON.stringify(record)) + RECEIPT_RESERVE <= MAX_BYTES;
+  }
+  receipt(command) {
+    if (this.refusal(command))
+      throw new Error("Conflicting ingest receipt and refusal");
+    const record = readJson(this.file(command.idempotency_key, "receipt"), RECEIPT_RESERVE);
+    if (record.version !== 1 || record.target !== this.target || record.body_hash !== canonicalIngestBodyHash(command))
+      throw new Error("Invalid receipt journal binding");
+    return verifyIngestReceipt(record.receipt, command);
+  }
+  stage(command) {
+    validateIngest(command);
+    const path = this.file(command.idempotency_key, "intent");
+    const record = { version: 1, target: this.target, body_hash: canonicalIngestBodyHash(command), command };
+    if (!this.canStage(command))
+      throw new Error("Ingest journal capacity reached; run economy ingest journal maintain; originals preserved");
+    if (createExact(path, record)) {
+      this.freshlyStaged.add(command.idempotency_key);
+      return true;
+    }
+    this.freshlyStaged.delete(command.idempotency_key);
+    const old = this.intent(`${sha(command.idempotency_key)}.intent.json`);
+    if (old.body_hash !== record.body_hash)
+      throw new Error("Ingest command key is already bound to different content");
+    return false;
+  }
+  accept(command, raw) {
+    if (this.refusal(command))
+      throw new Error("A refused command cannot accept a receipt");
+    this.freshlyStaged.delete(command.idempotency_key);
+    const receipt = verifyIngestReceipt(raw, command);
+    const intent = this.intent(`${sha(command.idempotency_key)}.intent.json`);
+    if (intent.body_hash !== canonicalIngestBodyHash(command))
+      throw new Error("Ingest receipt content conflicts with exact intent");
+    const record = { version: 1, target: this.target, body_hash: canonicalIngestBodyHash(command), receipt };
+    const path = this.file(command.idempotency_key, "receipt");
+    if (!this.names().includes(`${sha(command.idempotency_key)}.receipt.json`) && this.inventoryBytes + Buffer.byteLength(JSON.stringify(record)) > MAX_BYTES)
+      throw new Error("Receipt capacity exhausted; exact intent retained for reconciliation");
+    if (!createExact(path, record)) {
+      const old = readJson(path, MAX_INGEST_BYTES);
+      if (old.body_hash !== record.body_hash || old.target !== this.target || !sameReceipt(old.receipt, receipt))
+        throw new Error("Ingest receipt journal conflict");
+    }
+    return receipt;
+  }
+  recordRefusal(command, refusal) {
+    if (!this.freshlyStaged.delete(command.idempotency_key))
+      throw new Error("Refusal requires this invocation's fresh command");
+    const intent = this.intent(`${sha(command.idempotency_key)}.intent.json`);
+    if (intent.body_hash !== canonicalIngestBodyHash(command))
+      throw new Error("Refusal conflicts with exact intent");
+    const expected = definitiveIngestRefusal(refusal.status, refusal.code === "legacy_aggregate_requires_migration" ? { expected: refusal.code } : null);
+    if (!expected || stableJson(expected) !== stableJson(refusal))
+      throw new Error("Invalid definitive refusal");
+    const names = this.names();
+    if (names.includes(`${sha(command.idempotency_key)}.receipt.json`))
+      throw new Error("A completed command cannot be refused");
+    const record = { version: 1, target: this.target, body_hash: intent.body_hash, refusal };
+    if (Buffer.byteLength(JSON.stringify(record)) > RECEIPT_RESERVE || this.inventoryBytes + Buffer.byteLength(JSON.stringify(record)) > MAX_BYTES)
+      throw new Error("Refusal capacity exhausted; exact intent retained");
+    if (!createExact(this.file(command.idempotency_key, "refusal"), record))
+      throw new Error("Existing refusal requires inspection");
+    this.refusal(command);
+  }
+  refusal(command) {
+    let record;
+    try {
+      record = readJson(this.file(command.idempotency_key, "refusal"), RECEIPT_RESERVE);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return null;
+      throw error;
+    }
+    const intent = this.intent(`${sha(command.idempotency_key)}.intent.json`), r = record?.refusal;
+    const expected = definitiveIngestRefusal(r?.status, r?.code === "legacy_aggregate_requires_migration" ? { expected: r.code } : null);
+    if (record?.version !== 1 || record.target !== this.target || record.body_hash !== intent.body_hash || intent.body_hash !== canonicalIngestBodyHash(command) || !expected || stableJson(expected) !== stableJson(r))
+      throw new Error("Invalid refusal journal binding");
+    try {
+      lstatSync(this.file(command.idempotency_key, "receipt"));
+      throw new Error("Conflicting ingest receipt and refusal");
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+    return expected;
+  }
+  async reconcileCommand(cloud, command, timeoutMs = 1e4) {
+    const receipt = await this.lookupReceipt(cloud, command, timeoutMs);
+    return receipt ? this.accept(command, receipt) : null;
+  }
+  assertCloud(cloud) {
+    if (targetId(cloud) !== this.target)
+      throw new Error("Ingest journal authority changed");
+  }
+  async lookupReceipt(cloud, command, timeoutMs = 1e4) {
+    this.assertCloud(cloud);
+    const receipt = await lookupJournalReceipt(cloud, command.idempotency_key, canonicalIngestBodyHash(command), timeoutMs);
+    return receipt === null ? null : verifyIngestReceipt(receipt, command);
+  }
+  async reconcilePending(cloud) {
+    const names = this.names(), unresolved = [];
+    const deadline = performance.now() + 30000;
+    for (const name of names.filter((n) => n.endsWith(".intent.json"))) {
+      const intent = this.intent(name);
+      if (names.includes(`${sha(intent.command.idempotency_key)}.refusal.json`)) {
+        this.refusal(intent.command);
+        continue;
+      }
+      if (names.includes(`${sha(intent.command.idempotency_key)}.receipt.json`)) {
+        const record = readJson(this.file(intent.command.idempotency_key, "receipt"), MAX_INGEST_BYTES);
+        if (record.target !== this.target || record.body_hash !== intent.body_hash)
+          throw new Error("Invalid receipt journal binding");
+        verifyIngestReceipt(record.receipt, intent.command);
+        continue;
+      }
+      if (performance.now() >= deadline) {
+        unresolved.push(intent.command.idempotency_key);
+        continue;
+      }
+      try {
+        if (!await this.reconcileCommand(cloud, intent.command, Math.max(1, Math.min(1e4, deadline - performance.now()))))
+          unresolved.push(intent.command.idempotency_key);
+      } catch {
+        unresolved.push(intent.command.idempotency_key);
+      }
+    }
+    if (unresolved.length)
+      throw new PendingIngestError(unresolved);
+  }
+}
+
+// src/lib/ingest-journal-maintenance.ts
+import { constants as constants2, closeSync as closeSync2, fstatSync as fstatSync2, lstatSync as lstatSync2, openSync as openSync2, readFileSync as readFileSync2, readdirSync as readdirSync2 } from "fs";
+import { createHash as createHash5 } from "crypto";
+import { join as join10 } from "path";
+var uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+var digest2 = /^[a-f0-9]{64}$/;
+var sha2 = (bytes) => createHash5("sha256").update(bytes).digest("hex");
+
+class JournalMaintenanceError extends Error {
+  reason;
+  target;
+  code = "INGEST_JOURNAL_MAINTENANCE_REQUIRED";
+  constructor(reason, target) {
+    super(`Ingest journal maintenance required (${reason}); run economy ingest journal maintain; originals or Trash recovery state preserved`);
+    this.reason = reason;
+    this.target = target;
+    this.name = "JournalMaintenanceError";
+  }
+}
+function exists(path) {
+  try {
+    lstatSync2(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+}
+function snapshot(path) {
+  const fd = openSync2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
+  try {
+    const stat = fstatSync2(fd);
+    if (!stat.isFile() || stat.nlink !== 1 || stat.size > 4 * 1024 * 1024 + 4096 || (stat.mode & 63) !== 0 || process.getuid && stat.uid !== process.getuid())
+      throw new Error("Unsafe maintenance source");
+    const bytes = readFileSync2(fd), after = fstatSync2(fd);
+    if (after.ctimeMs !== stat.ctimeMs || bytes.length !== stat.size)
+      throw new Error("Maintenance source changed");
+    return { sha256: sha2(bytes), sizeBytes: stat.size, mode: stat.mode & 511, device: String(stat.dev), inode: String(stat.ino), ctime: stat.ctimeMs };
+  } finally {
+    closeSync2(fd);
+  }
+}
+function sameSource(path, expected) {
+  const { capture_sha256: _capture, ...original } = expected;
+  if (JSON.stringify(snapshot(path)) !== JSON.stringify(original))
+    throw new Error("Maintenance source changed; preserve for inspection");
+}
+function validAnchor(value, target) {
+  const a = value;
+  if (a?.version !== 1 || a.target !== target || !/^[A-Za-z0-9._:-]{1,200}$/.test(a.key) || !digest2.test(a.body_hash) || !digest2.test(a.receipt?.operation_key))
+    throw new Error("Invalid journal authority anchor");
+  return a;
+}
+async function confirm(cloud, anchor, deadline) {
+  if (Date.now() >= deadline)
+    throw new Error("Maintenance deadline reached");
+  const current = await lookupJournalReceipt(cloud, anchor.key, anchor.body_hash, Math.max(1, Math.min(1e4, deadline - Date.now())));
+  if (current === null || !sameReceipt(current, anchor.receipt))
+    throw new Error("Exact Economy receipt is unavailable or changed");
+}
+async function verifyJournalAuthority(journal, cloud) {
+  journal.assertCloud(cloud);
+  const path = join10(journal.directory, ".authority.json");
+  if (!exists(path)) {
+    const names = journal.names();
+    const name = names.find((n) => n.endsWith(".intent.json") && names.includes(n.replace(".intent.", ".receipt.")));
+    if (!name)
+      return;
+    const intent = journal.intent(name), receipt = journal.receipt(intent.command);
+    createExact(path, { version: 1, target: journal.target, key: intent.command.idempotency_key, body_hash: intent.body_hash, receipt });
+  }
+  await confirm(cloud, validAnchor(readJson(path, 4096), journal.target), Date.now() + 1e4);
+}
+function recoveryFactory(cloud, env = process.env) {
+  return async (operationRoot, checkpoint, deadline) => {
+    if (env.HASNA_ECONOMY_INGEST_RECOVERY !== "trash")
+      throw new Error("recovery_not_configured");
+    const economy = new URL(cloud.client.transport.baseUrl);
+    const fleet = economy.origin === "https://api.hasna.com" && /^\/economy(?:\/v1)?\/?$/.test(economy.pathname);
+    if (!fleet && !env.HASNA_TRASH_API_URL)
+      throw new Error("self_host_trash_authority_required");
+    const sdk = await import("@hasna/trash/sdk");
+    if (sdk.VERSION !== "0.2.3")
+      throw new Error("trash_version_mismatch");
+    const boundedFetch = (input, init) => {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0)
+        throw new Error("maintenance_deadline");
+      const signal = AbortSignal.timeout(remaining);
+      return fetch(input, { ...init, signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal, redirect: "error" });
+    };
+    return Object.assign(sdk.createTrash({ env, operationRoot, checkpoint, fetchImpl: boundedFetch, transferFetch: boundedFetch, lockTimeoutMs: 100 }), { snapshot: sdk.snapshotIdentity });
+  };
+}
+
+class IngestJournalMaintenance {
+  journal;
+  cloud;
+  factory;
+  control;
+  operationRoot;
+  constructor(journal, cloud, factory = recoveryFactory(cloud)) {
+    this.journal = journal;
+    this.cloud = cloud;
+    this.factory = factory;
+    journal.assertCloud(cloud);
+    this.control = join10(journal.directory, ".maintenance");
+    this.operationRoot = join10(journal.directory, ".recovery");
+  }
+  manifest() {
+    secureDirectory(this.control);
+    const names = readdirSync2(this.control);
+    if (names.some((n) => !["manifest.json", "intent.operation.json", "receipt.operation.json"].includes(n)))
+      throw new Error("Unexpected maintenance entry");
+    let size = 0;
+    for (const name of names)
+      size += lstatSync2(join10(this.control, name)).size;
+    if (size > MAINTENANCE_RESERVE)
+      throw new Error("Maintenance metadata exceeds reserve");
+    const m = validAnchor(readJson(join10(this.control, "manifest.json"), 8192), this.journal.target);
+    for (const part of [m.intent, m.receipt_file])
+      if (!part || !digest2.test(part.sha256) || !digest2.test(part.capture_sha256 ?? "") || !Number.isSafeInteger(part.sizeBytes) || part.sizeBytes < 1 || part.sizeBytes > 4198400 || part.mode !== 384 || !/^\d+$/.test(part.device) || !/^\d+$/.test(part.inode) || !Number.isFinite(part.ctime))
+        throw new Error("Invalid maintenance snapshot");
+    return m;
+  }
+  pending(backend) {
+    const pending = backend.pending(4);
+    if (pending.length > 3 || pending.some((p) => !uuid.test(p.id) || p.phase === "unreadable"))
+      throw new Error("Unexpected Trash recovery state");
+    return pending;
+  }
+  async backend(deadline) {
+    const backend = await this.factory(this.operationRoot, async (point, operation) => {
+      if (operation.path === this.control)
+        return;
+      const m = this.manifest();
+      const kind = operation.path === this.journal.file(m.key, "receipt") ? "receipt" : operation.path === this.journal.file(m.key, "intent") ? "intent" : null;
+      if (!kind || operation.kind !== "capture" || !uuid.test(operation.id) || operation.id !== operation.entryId)
+        throw new Error("Unexpected Trash operation");
+      const expected = kind === "receipt" ? m.receipt_file : m.intent;
+      if (point === "afterSnapshot") {
+        if (!operation.receipt || operation.receipt.sha256 !== expected.capture_sha256 || operation.receipt.sizeBytes !== expected.sizeBytes || operation.receipt.mode !== expected.mode)
+          throw new Error("Trash snapshot mismatch");
+        sameSource(operation.path, expected);
+        const path = join10(this.control, `${kind}.operation.json`);
+        createExact(path, { id: operation.id });
+        if (readJson(path, 1024).id !== operation.id)
+          throw new Error("Conflicting Trash operation");
+      }
+      if (point === "beforeStage") {
+        await confirm(this.cloud, m, deadline);
+        sameSource(operation.path, expected);
+      }
+    }, deadline);
+    const status = await backend.doctor();
+    if (!status.station || !uuid.test(status.station.id) || !Number.isInteger(status.retentionDays) || status.retentionDays < 1)
+      throw new Error("Trash station authority unavailable");
+    return backend;
+  }
+  async entry(backend, id, path, expected) {
+    const e = await backend.api.get(id);
+    if (e.id !== id || e.originalPath !== path || e.kind !== "file" || e.sha256 !== expected.capture_sha256 || e.sizeBytes !== expected.sizeBytes || e.mode !== expected.mode || e.state !== "trashed")
+      throw new Error("Trash preservation readback refused");
+    if (exists(path))
+      throw new Error("Retired source reappeared; preserve for inspection");
+  }
+  async pairFile(backend, m, kind, deadline) {
+    await confirm(this.cloud, m, deadline);
+    const path = this.journal.file(m.key, kind), expected = kind === "receipt" ? m.receipt_file : m.intent;
+    const saved = join10(this.control, `${kind}.operation.json`);
+    let id;
+    if (exists(saved))
+      id = readJson(saved, 1024).id;
+    const pending = this.pending(backend);
+    const matches = pending.filter((p) => p.path === path);
+    if (matches.length > 1 || id && !uuid.test(id))
+      throw new Error("Conflicting Trash operation");
+    if (matches[0]) {
+      if (id && id !== matches[0].id)
+        throw new Error("Conflicting Trash operation");
+      id = matches[0].id;
+      const operation = backend.journal.read(id);
+      if (operation.kind !== "capture" || operation.path !== path || operation.entryId !== id)
+        throw new Error("Invalid Trash operation binding");
+      if (exists(path))
+        sameSource(path, expected);
+      await backend.recover(id, { takeAbandonedLock: true });
+    } else if (!id) {
+      sameSource(path, expected);
+      const status = await backend.doctor();
+      const e = await backend.put(path, { retentionDays: status.retentionDays });
+      id = e.id;
+      if (!exists(saved) || readJson(saved, 1024).id !== id)
+        throw new Error("Trash did not persist its capture binding");
+    }
+    await this.entry(backend, id, path, expected);
+  }
+  async recover() {
+    if (!exists(this.control) && !exists(this.operationRoot))
+      return;
+    if (exists(this.operationRoot))
+      secureDirectory(this.operationRoot);
+    if (!exists(this.control) && readdirSync2(this.operationRoot).every((n) => n === ".locks"))
+      return;
+    const deadline = Date.now() + 30000;
+    try {
+      await this.finish(await this.backend(deadline), deadline);
+    } catch (error) {
+      if (error instanceof JournalMaintenanceError)
+        throw error;
+      throw new JournalMaintenanceError("recovery_unresolved", this.journal.target);
+    }
+  }
+  async finish(backend, deadline) {
+    const pending = this.pending(backend);
+    const control = pending.filter((p) => p.path === this.control);
+    if (control.length) {
+      if (control.length !== 1 || pending.length !== 1)
+        throw new Error("Conflicting maintenance cleanup");
+      const op = backend.journal.read(control[0].id);
+      if (op.kind !== "capture" || op.path !== this.control)
+        throw new Error("Invalid maintenance cleanup");
+      await backend.recover(op.id, { takeAbandonedLock: true });
+      if (exists(this.control) || this.pending(backend).length)
+        throw new Error("Maintenance cleanup unresolved");
+      return;
+    }
+    if (!exists(this.control)) {
+      if (pending.length)
+        throw new Error("Orphaned maintenance operation");
+      return;
+    }
+    if (readdirSync2(this.control).length === 0) {
+      if (pending.length)
+        throw new Error("Orphaned maintenance operation");
+      const status2 = await backend.doctor();
+      await backend.put(this.control, { retentionDays: status2.retentionDays });
+      return;
+    }
+    const m = this.manifest();
+    if (pending.some((p) => p.path !== this.journal.file(m.key, "receipt") && p.path !== this.journal.file(m.key, "intent")))
+      throw new Error("Unexpected recovery path");
+    await this.pairFile(backend, m, "receipt", deadline);
+    await this.pairFile(backend, m, "intent", deadline);
+    if (this.pending(backend).length)
+      throw new Error("Unfinished pair capture");
+    await confirm(this.cloud, m, deadline);
+    const status = await backend.doctor();
+    await backend.put(this.control, { retentionDays: status.retentionDays });
+    if (exists(this.control) || this.pending(backend).length)
+      throw new Error("Maintenance cleanup unresolved");
+  }
+  async maintain(limit = 32) {
+    if (!Number.isInteger(limit) || limit < 1 || limit > 32)
+      throw new Error("Journal maintenance limit must be 1\u201332");
+    await this.recover();
+    await verifyJournalAuthority(this.journal, this.cloud);
+    const deadline = Date.now() + 30000;
+    let retired = 0, bytes = 0;
+    let backend;
+    try {
+      const names = this.journal.names();
+      for (const name of names.filter((n) => n.endsWith(".intent.json"))) {
+        if (retired >= limit || Date.now() >= deadline || retired > 0 && bytes >= 1048576)
+          break;
+        if (!names.includes(name.replace(".intent.", ".receipt.")))
+          continue;
+        const intent = this.journal.intent(name), receipt = this.journal.receipt(intent.command);
+        backend ??= await this.backend(deadline);
+        const m = {
+          version: 1,
+          target: this.journal.target,
+          key: intent.command.idempotency_key,
+          body_hash: intent.body_hash,
+          receipt,
+          intent: snapshot(join10(this.journal.directory, name)),
+          receipt_file: snapshot(this.journal.file(intent.command.idempotency_key, "receipt"))
+        };
+        await confirm(this.cloud, m, deadline);
+        m.intent.capture_sha256 = backend.snapshot(this.journal.file(m.key, "intent")).sha256;
+        m.receipt_file.capture_sha256 = backend.snapshot(this.journal.file(m.key, "receipt")).sha256;
+        secureDirectory(this.control);
+        if (!createExact(join10(this.control, "manifest.json"), m))
+          throw new Error("Existing maintenance transaction");
+        await this.finish(backend, deadline);
+        retired++;
+        bytes += m.intent.sizeBytes + m.receipt_file.sizeBytes;
+      }
+      return { retired, remaining: this.journal.status().completed };
+    } catch (error) {
+      if (error instanceof JournalMaintenanceError)
+        throw error;
+      const reason = error instanceof Error && ["recovery_not_configured", "self_host_trash_authority_required", "trash_version_mismatch"].includes(error.message) ? error.message : backend ? "recovery_unresolved" : "recovery_authority_unavailable";
+      throw new JournalMaintenanceError(reason, this.journal.target);
+    }
+  }
+  async admit(command) {
+    const status = this.journal.status();
+    const fits = this.journal.canStage(command, status);
+    if (status.commands < 64 && status.reserved_bytes < 50331648 && fits)
+      return;
+    try {
+      await this.maintain();
+    } catch (error) {
+      if (exists(this.control) || !this.journal.canStage(command))
+        throw error;
+    }
+    if (!this.journal.canStage(command))
+      throw new JournalMaintenanceError("capacity", this.journal.target);
+  }
+}
+
+// src/lib/ingest-journal-lock.ts
+import { constants as constants3, closeSync as closeSync3, fstatSync as fstatSync3, lstatSync as lstatSync3, openSync as openSync3 } from "fs";
+import { join as join11 } from "path";
+async function withIngestJournalLock(directory, action) {
+  if (process.platform !== "linux" && process.platform !== "darwin")
+    throw new Error("Ingest journal locking requires Linux or macOS");
+  const { dlopen, FFIType } = await import("bun:ffi");
+  const library = dlopen(process.platform === "darwin" ? "/usr/lib/libSystem.B.dylib" : "libc.so.6", {
+    flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 }
+  });
+  const path = join11(directory, ".lease");
+  let fd;
+  try {
+    fd = openSync3(path, constants3.O_RDWR | constants3.O_CREAT | constants3.O_NOFOLLOW | constants3.O_NONBLOCK, 384);
+    const stat = fstatSync3(fd), current = lstatSync3(path);
+    if (!stat.isFile() || stat.size !== 0 || stat.nlink !== 1 || stat.ino !== current.ino || stat.dev !== current.dev || (stat.mode & 63) !== 0 || process.getuid && stat.uid !== process.getuid())
+      throw new Error("Unsafe ingest journal lease");
+    if (library.symbols.flock(fd, 6) !== 0) {
+      const error = new Error("Ingest journal is busy; retry after the current operation finishes");
+      Object.assign(error, { code: "INGEST_JOURNAL_BUSY" });
+      throw error;
+    }
+    return await action();
+  } finally {
+    if (fd !== undefined)
+      closeSync3(fd);
+    library.close();
+  }
+}
+
+// src/lib/ingest-journal-operation.ts
+import { z as z2 } from "zod";
+var ingestJournalOperationSchema = z2.discriminatedUnion("action", [
+  z2.object({ action: z2.literal("status") }).strict(),
+  z2.object({ action: z2.literal("reconcile") }).strict(),
+  z2.object({ action: z2.literal("maintain"), confirm: z2.literal(true), limit: z2.number().int().min(1).max(32).default(32) }).strict()
+]);
+
+// src/lib/cloud-ingest.ts
+import { HasnaHttpError } from "@hasna/contracts/client";
+var CLOUD_INGEST_TABLES = ["requests", "sessions", "billing_daily", "usage_snapshots", "subscriptions", "scan_receipts"];
+function exportIngestRows(db) {
+  const body = {};
+  for (const table of CLOUD_INGEST_TABLES) {
+    const rows = db.prepare(`SELECT * FROM ${table}`).all();
+    if (rows.length > 0)
+      body[table] = rows;
+  }
+  return body;
+}
+
+class IngestRefused extends Error {
+  status;
+  code;
+  reason;
+  constructor(status, code, reason = code) {
+    super(`Ingestion refused: ${reason}; exact command intent retained`);
+    this.status = status;
+    this.code = code;
+    this.reason = reason;
+    this.name = "IngestRefused";
+  }
+}
+async function postIngest(cloud, body) {
+  const journal = new IngestJournal(cloud);
+  return withIngestJournalLock(journal.directory, async () => {
+    const maintenance = new IngestJournalMaintenance(journal, cloud);
+    await maintenance.recover();
+    await journal.reconcilePending(cloud);
+    await verifyJournalAuthority(journal, cloud);
+    const ingested = {};
+    const completed = [];
+    let total = 0;
+    for (const batch of ingestBatches(body)) {
+      try {
+        const refused = journal.refusal(batch);
+        if (refused)
+          throw new IngestRefused(refused.status, refused.code, refused.reason);
+        await maintenance.admit(batch);
+        const known = await journal.lookupReceipt(cloud, batch);
+        const fresh = journal.stage(batch);
+        const sendFresh = async () => {
+          let response;
+          try {
+            response = await cloud.client.transport.post("/ingest", batch, { retry: false });
+          } catch (error) {
+            const refusal = error instanceof HasnaHttpError ? definitiveIngestRefusal(error.status, error.body) : null;
+            if (refusal) {
+              journal.recordRefusal(batch, refusal);
+              throw new IngestRefused(refusal.status, refusal.code, refusal.reason);
+            }
+            throw error;
+          }
+          return journal.accept(batch, response);
+        };
+        const payload = known ? journal.accept(batch, known) : fresh ? await sendFresh() : await journal.reconcileCommand(cloud, batch);
+        await verifyJournalAuthority(journal, cloud);
+        if (!payload)
+          throw new PendingIngestError([batch.idempotency_key]);
+        verifyIngestReceipt(payload, batch);
+        const counts = payload["ingested"];
+        if (!counts || typeof counts !== "object" || Array.isArray(counts) || typeof payload["total"] !== "number" || !Number.isSafeInteger(payload["total"]) || payload["total"] < 0)
+          throw new Error("Invalid ingest receipt");
+        let sum = 0;
+        for (const [table, count] of Object.entries(counts)) {
+          if (!CLOUD_INGEST_TABLES.includes(table) || typeof count !== "number" || !Number.isSafeInteger(count) || count < 0)
+            throw new Error("Invalid ingest receipt");
+          sum += count;
+          ingested[table] = (ingested[table] ?? 0) + count;
+        }
+        if (sum !== payload["total"])
+          throw new Error("Invalid ingest receipt");
+        total += sum;
+        const operation = payload["operation_key"];
+        if (operation !== undefined && (typeof operation !== "string" || !/^[a-f0-9]{64}$/.test(operation)))
+          throw new Error("Invalid ingest receipt");
+        completed.push({
+          idempotency_key: batch.idempotency_key,
+          ...typeof operation === "string" ? { operation_key: operation } : {},
+          replayed: payload["replayed"] === true
+        });
+      } catch (error) {
+        if (error instanceof PendingIngestError || error instanceof JournalMaintenanceError || error instanceof IngestRefused)
+          throw error;
+        if (error instanceof HasnaHttpError && error.status >= 400 && error.status < 500 && error.status !== 408) {
+          const body2 = error.body;
+          throw new IngestRefused(error.status, body2?.expected === "legacy_aggregate_requires_migration" ? "legacy_aggregate_requires_migration" : "ingest_refused");
+        }
+        throw new IngestBatchFailure(batch.idempotency_key, completed, batch);
+      }
+    }
+    return { ingested, total, receipts: completed };
+  });
+}
+async function pushIngestRows(cloud, scratch) {
+  const body = exportIngestRows(scratch);
+  if (Object.keys(body).length === 0)
+    return { posted: false, ingested: {}, total: 0, receipts: [] };
+  const response = await postIngest(cloud, body);
+  return { posted: true, ...response };
+}
 // package.json
 var package_default = {
   name: "@hasna/economy",
-  version: "0.3.28",
-  description: "AI coding cost tracker \u2014 CLI + MCP server + REST API + web dashboard for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
+  version: "0.5.0",
+  description: "AI coding cost tracker \u2014 CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   repository: {
     type: "git",
-    url: "git+https://github.com/hasna/economy.git"
+    url: "https://github.com/hasna/apps.git",
+    directory: "apps/economy"
   },
   bugs: {
-    url: "https://github.com/hasna/economy/issues"
+    url: "https://github.com/hasna/apps/issues"
   },
-  homepage: "https://github.com/hasna/economy#readme",
+  homepage: "https://github.com/hasna/apps/tree/main/apps/economy#readme",
   type: "module",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -1448,22 +3491,21 @@ var package_default = {
   files: [
     "dist",
     "docs",
-    "dashboard/dist",
     "postinstall.js",
     "LICENSE",
     "README.md",
     "CHANGELOG.md",
     "SECURITY.md",
     "CONTRIBUTING.md",
-    "CODE_OF_CONDUCT.md"
+    "CODE_OF_CONDUCT.md",
+    "!dist/lib/test-hermetic-*"
   ],
   scripts: {
-    build: "cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.ts --outdir dist/cli --target bun --packages external && bun build src/mcp/index.ts --outdir dist/mcp --target bun --packages external && bun build src/server/index.ts --outdir dist/server --target bun --packages external && bun build src/db/pg-sync-worker.ts --outdir dist/server --target bun --packages external && bun build src/otel/index.ts --outdir dist/otel --target bun --packages external && bun build src/index.ts --outdir dist --target bun --packages external && tsc --emitDeclarationOnly --outDir dist",
-    "build:cli": "bun build src/cli/index.ts --outdir dist/cli --target bun --packages external",
-    "build:mcp": "bun build src/mcp/index.ts --outdir dist/mcp --target bun --packages external",
-    "build:server": "bun build src/server/index.ts --outdir dist/server --target bun --packages external",
-    "build:lib": "bun build src/index.ts --outdir dist --target bun --packages external",
-    "build:dashboard": "cd dashboard && bun run build",
+    build: 'bun build src/cli/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming "chunks/[name]-[hash].[ext]" && bun build src/mcp/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming "chunks/[name]-[hash].[ext]" && bun build src/server/index.ts --outdir dist/server --target bun --packages external && bun build src/db/pg-sync-worker.ts --outdir dist/server --target bun --packages external && bun build src/server/service-worker.ts --outdir dist/server --target bun --packages external && bun build src/otel/index.ts --outdir dist/otel --target bun --packages external && bun build src/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming "chunks/[name]-[hash].[ext]" && tsc --emitDeclarationOnly --outDir dist',
+    "build:cli": 'bun build src/cli/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming "chunks/[name]-[hash].[ext]"',
+    "build:mcp": 'bun build src/mcp/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming "chunks/[name]-[hash].[ext]"',
+    "build:server": "bun build src/server/index.ts --outdir dist/server --target bun --packages external && bun build src/db/pg-sync-worker.ts --outdir dist/server --target bun --packages external && bun build src/server/service-worker.ts --outdir dist/server --target bun --packages external",
+    "build:lib": 'bun build src/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming "chunks/[name]-[hash].[ext]"',
     "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
     prepack: "bun run build && bun run artifact-scan",
     typecheck: "tsc --noEmit",
@@ -1493,21 +3535,18 @@ var package_default = {
     access: "public"
   },
   dependencies: {
-    "@hasna/accounts": "0.2.23",
-    "@hasna/agent-registry": "^0.1.0",
-    "@hasna/contracts": "0.13.4",
+    "@hasna/contracts": "1.0.2",
     "@hasna/events": "^0.1.16",
-    "@hasna/mcp-harness": "^0.1.0",
-    "@hasna/paths": "0.1.0",
     "@hasna/projects": "1.0.0",
     "@modelcontextprotocol/sdk": "^1.12.1",
     chalk: "^5.4.1",
     commander: "^13.1.0",
     pg: "8.13.1",
-    zod: "^3.24.2"
+    zod: "^3.24.2",
+    "@hasna/trash": "0.2.3"
   },
   devDependencies: {
-    "@types/bun": "latest",
+    "@types/bun": "1.3.14",
     "@types/pg": "^8.20.0",
     "bun-types": "latest",
     typescript: "^5.7.2"
@@ -1547,7 +3586,7 @@ if (args.includes("--version") || args.includes("-V")) {
 if (args.includes("--help") || args.includes("-h")) {
   console.log(`Usage: economy-otel [options]
 
-OTLP/HTTP metrics sidecar \u2014 ingests *.cost.* / *.token.* metrics into economy.db
+OTLP/HTTP metrics sidecar \u2014 ingests *.cost.* / *.token.* metrics into Economy
 
 Options:
   -p, --port <port>  Port to bind (default: ECONOMY_OTEL_PORT or 4318)
@@ -1558,6 +3597,13 @@ Environment:
   ECONOMY_OTEL_PORT  Override the default port (4318)
   ECONOMY_OTEL_BIND  Bind address (default: 127.0.0.1)
 
+Storage (decided at startup, before the listener binds):
+  A credential resolved by @hasna/contracts (Keychain item
+  hasna.credentials.economy.api-key, ~/.hasna/economy/config/credentials,
+  HASNA_ECONOMY_API_KEY) forwards every accepted payload to the hosted
+  API's /v1/ingest. HASNA_ECONOMY_LOCAL=1 writes the on-box SQLite store
+  instead. With neither the sidecar fails closed (exit 1, no listener).
+
 Endpoints:
   POST /v1/metrics     OTLP JSON metrics
   POST /ingest         Simplified single-event JSON
@@ -1565,7 +3611,28 @@ Endpoints:
   process.exit(0);
 }
 var port = resolvePort(args);
-var db = openDatabase();
+function resolveStorage() {
+  try {
+    return economyCloudStorage();
+  } catch (error) {
+    console.error(`economy-otel: ${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+  }
+}
+var storage = resolveStorage();
+var localDb = storage.active ? null : openDatabase();
+async function forwardRows(cloud, rows) {
+  const scratch = openDatabase(":memory:", true);
+  try {
+    const result = await ingestOtelRows(scratch, rows);
+    const pushed = await pushIngestRows(cloud, scratch);
+    return { ...result, forwarded: pushed.total };
+  } finally {
+    try {
+      scratch.close();
+    } catch {}
+  }
+}
 var server = Bun.serve({
   port,
   hostname: process.env["ECONOMY_OTEL_BIND"] ?? "127.0.0.1",
@@ -1590,7 +3657,16 @@ var server = Bun.serve({
     if (rows.length === 0) {
       return Response.json({ ingested: 0, message: "no matching metrics" });
     }
-    const result = await ingestOtelRows(db, rows);
+    if (storage.active) {
+      try {
+        const result2 = await forwardRows(storage, rows);
+        return Response.json({ ingested: result2.requests, sessions: result2.sessions, forwarded: result2.forwarded });
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        return Response.json({ error: `forward to the economy API failed: ${reason}` }, { status: 502 });
+      }
+    }
+    const result = await ingestOtelRows(localDb, rows);
     return Response.json({ ingested: result.requests, sessions: result.sessions });
   }
 });