@hasna/economy 0.3.28 → 0.5.0

package/dist/server/legacy-inventory.d.ts

@@ -0,0 +1,52 @@
+export declare const LEGACY_FAMILIES: readonly ["codex_aggregate", "hermes_aggregate", "cursor_cumulative", "claude_billing_unverified"];
+export type LegacyFamily = typeof LEGACY_FAMILIES[number];
+export interface LegacyInventoryOptions {
+    family?: LegacyFamily;
+    limit: number;
+    after?: string;
+}
+interface Reader {
+    query(sql: string, values?: unknown[]): Promise<{
+        rows: Record<string, any>[];
+    }>;
+}
+export declare const LEGACY_PREDICATES: Readonly<Record<LegacyFamily, string>>;
+export declare function parseLegacyInventoryOptions(args: string[]): LegacyInventoryOptions;
+/** A bounded, read-only PostgreSQL page. Caller owns and releases the connection.
+ * Each call has its own repeatable-read snapshot; pages are NOT one frozen export.
+ * An apply operation must independently recheck the exact original row digests.
+ */
+export declare function readLegacyInventory(client: Reader, options: LegacyInventoryOptions): Promise<{
+    schema: string;
+    mode: string;
+    original_encoding: string;
+    snapshot: {
+        at: any;
+        database: any;
+        scope: string;
+    };
+    total_requests: number;
+    candidate_counts: {
+        [k: string]: number;
+    };
+    filter: string;
+    items: {
+        id: string;
+        session_id: any;
+        agent: any;
+        family: LegacyFamily;
+        original_sha256: string;
+        cost_basis: any;
+        source_request_id: any;
+        timestamp: any;
+        updated_at: any;
+        disposition: "requires_source_and_preservation_review";
+    }[];
+    has_more: boolean;
+    next_after: string | null;
+    mutations_performed: number;
+    limitations: string[];
+}>;
+export declare function runLegacyInventory(args: string[]): Promise<void>;
+export {};
+//# sourceMappingURL=legacy-inventory.d.ts.map

package/dist/server/legacy-inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-inventory.d.ts","sourceRoot":"","sources":["../../src/server/legacy-inventory.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,oGAAqG,CAAA;AACjI,MAAM,MAAM,YAAY,GAAG,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;AACzD,MAAM,WAAW,sBAAsB;IAAG,MAAM,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAChG,UAAU,MAAM;IAAG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAA;KAAE,CAAC,CAAA;CAAE;AAIrG,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAKpE,CAAA;AAID,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAqBlF;AAQD;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB;;;;;;;;;;;;;;;;;;gBAqC/D,YAAY;;;;;;;;;;;;GAuBrC;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtE"}

package/dist/server/legacy-operations.d.ts

@@ -0,0 +1,64 @@
+import type pg from 'pg';
+import type { LegacyReader } from './legacy-plan.js';
+type Action = 'apply' | 'rollback';
+export interface LegacyIntent {
+    schema: string;
+    operation_key: string;
+    target_sha256: string;
+    plan_sha256: string;
+    capsule_sha256: string;
+    actor_ref: string;
+    authority_ref: string;
+    apply_key?: string;
+}
+/** Only locally authored validation messages may be rendered by the CLI. */
+export declare class LegacyOperationInputError extends Error {
+}
+export declare function parseLegacyIntent(action: Action, value: unknown): LegacyIntent;
+/** Bind the configured connection target without exposing its credential. This
+ * complements exact database/relation locators; it is not ownership approval. */
+export declare function legacyTargetDigest(target: string | pg.PoolConfig): string;
+interface Receipt {
+    schema: 'economy.legacy-operation-receipt.v1';
+    action: Action;
+    operation_key: string;
+    apply_key: string;
+    plan_sha256: string;
+    capsule_sha256: string;
+    target_requests: number;
+    preserved_requests: number;
+    sessions: number;
+    source_rows_changed: 0;
+    created_at: string;
+}
+export declare function applyLegacyReconciliation(client: LegacyReader, input: unknown, preserved: unknown, target: string): Promise<{
+    status: "committed";
+    receipt: Receipt;
+    active: boolean;
+    replayed: boolean;
+}>;
+export declare function rollbackLegacyReconciliation(client: LegacyReader, input: unknown, target: string): Promise<{
+    status: "committed";
+    receipt: Receipt;
+    active: boolean;
+    replayed: boolean;
+}>;
+/** An absent observation is not proof that an in-flight uncertain command cannot commit. */
+export declare function readLegacyOperation(client: LegacyReader, operation: string): Promise<{
+    status: "committed";
+    receipt: Receipt;
+    active: boolean;
+    replayed: boolean;
+} | {
+    status: "absent";
+    operation_key: string;
+    limitation: string;
+}>;
+export declare function parseLegacyOperationOptions(command: string, args: string[]): {
+    input?: string;
+    capsule?: string;
+    operation?: string;
+};
+export declare function runLegacyOperation(command: string, options: ReturnType<typeof parseLegacyOperationOptions>): Promise<void>;
+export {};
+//# sourceMappingURL=legacy-operations.d.ts.map

package/dist/server/legacy-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-operations.d.ts","sourceRoot":"","sources":["../../src/server/legacy-operations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAGxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAQpD,KAAK,MAAM,GAAC,OAAO,GAAC,UAAU,CAAA;AAC9B,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAC,MAAM,CAAC;IAAC,aAAa,EAAC,MAAM,CAAC;IAAC,aAAa,EAAC,MAAM,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAC,cAAc,EAAC,MAAM,CAAA;IACpG,SAAS,EAAC,MAAM,CAAC;IAAC,aAAa,EAAC,MAAM,CAAC;IAAC,SAAS,CAAC,EAAC,MAAM,CAAA;CAC1D;AACD,4EAA4E;AAC5E,qBAAa,yBAA0B,SAAQ,KAAK;CAAG;AACvD,wBAAgB,iBAAiB,CAAC,MAAM,EAAC,MAAM,EAAC,KAAK,EAAC,OAAO,GAAE,YAAY,CAY1E;AACD;iFACiF;AACjF,wBAAgB,kBAAkB,CAAC,MAAM,EAAC,MAAM,GAAC,EAAE,CAAC,UAAU,GAAE,MAAM,CAOrE;AAgED,UAAU,OAAO;IACf,MAAM,EAAC,qCAAqC,CAAC;IAAA,MAAM,EAAC,MAAM,CAAC;IAAA,aAAa,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAA;IAChG,WAAW,EAAC,MAAM,CAAC;IAAA,cAAc,EAAC,MAAM,CAAC;IAAA,eAAe,EAAC,MAAM,CAAC;IAAA,kBAAkB,EAAC,MAAM,CAAC;IAAA,QAAQ,EAAC,MAAM,CAAA;IACzG,mBAAmB,EAAC,CAAC,CAAC;IAAA,UAAU,EAAC,MAAM,CAAA;CACxC;AAmCD,wBAAsB,yBAAyB,CAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,OAAO,EAAC,SAAS,EAAC,OAAO,EAAC,MAAM,EAAC,MAAM;;;;;GA8BhH;AACD,wBAAsB,4BAA4B,CAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,OAAO,EAAC,MAAM,EAAC,MAAM;;;;;GAuBjG;AACD,4FAA4F;AAC5F,wBAAsB,mBAAmB,CAAC,MAAM,EAAC,YAAY,EAAC,SAAS,EAAC,MAAM;;;;;;;;;GAQ7E;AACD,wBAAgB,2BAA2B,CAAC,OAAO,EAAC,MAAM,EAAC,IAAI,EAAC,MAAM,EAAE,GAAE;IAAC,KAAK,CAAC,EAAC,MAAM,CAAC;IAAA,OAAO,CAAC,EAAC,MAAM,CAAC;IAAA,SAAS,CAAC,EAAC,MAAM,CAAA;CAAC,CAQ1H;AACD,wBAAsB,kBAAkB,CAAC,OAAO,EAAC,MAAM,EAAC,OAAO,EAAC,UAAU,CAAC,OAAO,2BAA2B,CAAC,iBAgC7G"}

package/dist/server/legacy-plan.d.ts

@@ -0,0 +1,55 @@
+import { type LegacyFamily } from './legacy-inventory.js';
+export interface LegacyReader {
+    query(sql: string, values?: unknown[]): Promise<{
+        rows: Record<string, any>[];
+    }>;
+}
+export interface LegacyPlan {
+    schema: string;
+    mode: string;
+    original_encoding: string;
+    member_encoding: string;
+    snapshot: {
+        at: string;
+        database: string;
+        database_oid: string;
+        tables: Array<Record<string, any>>;
+    };
+    items: Array<LegacySelection['items'][number] & {
+        session_id: string;
+    }>;
+    sessions: Array<{
+        id: string;
+        original_sha256: string;
+        request_count: number;
+        members_sha256: string;
+    }>;
+    mutations_performed: number;
+    limitations: string[];
+    plan_sha256: string;
+}
+type Disposition = 'quarantine_aggregate' | 'mark_billing_unknown';
+export interface LegacySelection {
+    schema: 'economy.legacy-selection.v1';
+    items: Array<{
+        id: string;
+        family: LegacyFamily;
+        original_sha256: string;
+        disposition: Disposition;
+        reason: string;
+        evidence_ref: string;
+    }>;
+}
+/** Explicit operator proposals; a source-shape match never chooses a disposition. */
+export declare function parseLegacySelection(value: unknown): LegacySelection;
+/** Open first with nonblocking/no-follow flags, then validate the actual descriptor. */
+export declare function readLegacySelectionFile(path: string): LegacySelection;
+export declare function parseLegacyPlanOptions(args: string[]): string;
+/** One snapshot binds selected requests, their sessions and each session's entire
+ * request population. This is a review proposal, not a backup or apply receipt. */
+export declare function prepareLegacyPlan(client: LegacyReader, input: unknown): Promise<LegacyPlan>;
+/** Additional bounded reads share the planner's locked, read-only snapshot. */
+export declare function withLegacyPlanSnapshot<T>(client: LegacyReader, input: unknown, read: (plan: LegacyPlan) => Promise<T>): Promise<T>;
+export declare function runLegacyPlan(selection: LegacySelection): Promise<void>;
+export {};
+//# sourceMappingURL=legacy-plan.d.ts.map

package/dist/server/legacy-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-plan.d.ts","sourceRoot":"","sources":["../../src/server/legacy-plan.ts"],"names":[],"mappings":"AAGA,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAE7F,MAAM,WAAW,YAAY;IAAG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAA;KAAE,CAAC,CAAA;CAAE;AAClH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;IAChF,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;KAAE,CAAA;IACpG,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvE,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvG,mBAAmB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CACxE;AACD,KAAK,WAAW,GAAG,sBAAsB,GAAG,sBAAsB,CAAA;AAClE,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,6BAA6B,CAAA;IACrC,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,WAAW,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC5I;AAuBD,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAkBpE;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAkBrE;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAG7D;AAED;mFACmF;AACnF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAEjG;AAED,+EAA+E;AAC/E,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAClF,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAwEpD;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAU7E"}

package/dist/server/legacy-preservation.d.ts

@@ -0,0 +1,58 @@
+import { type LegacyPlan, type LegacyReader } from './legacy-plan.js';
+/** Validate the complete emitted proposal before taking a connection or opening output. */
+export declare function parseLegacyPlan(value: unknown): LegacyPlan;
+export declare function assertLegacyPlanCurrent(expected: LegacyPlan, current: LegacyPlan): void;
+interface Original {
+    id: string;
+    original: string;
+}
+export interface LegacyCapsule {
+    schema: 'economy.legacy-preservation.v1';
+    plan: LegacyPlan;
+    captured_at: string;
+    requests: Original[];
+    sessions: Original[];
+    capsule_sha256: string;
+}
+/** Full original JSON remains text: JS never round-trips PostgreSQL integers/floats. */
+export declare function parseLegacyCapsule(value: unknown): LegacyCapsule;
+export declare function preserveLegacyOriginals(client: LegacyReader, input: unknown): Promise<LegacyCapsule>;
+export declare function readLegacyArtifact(path: string, maxBytes?: number): unknown;
+/** Never overwrite a previous capture. On interruption the partial file is retained
+ * and must be inspected; retry uses a new destination after checking the original. */
+export declare function writeLegacyCapsule(path: string, input: unknown): {
+    schema: string;
+    file: string;
+    plan_sha256: string;
+    capsule_sha256: string;
+    file_sha256: string;
+    requests: number;
+    sessions: number;
+    readback: string;
+    restore: string;
+    source_mutations: number;
+};
+/** Reconstruct native typed rows in transaction-local TEMP tables, compare the
+ * original PostgreSQL JSON bytes, then ROLLBACK. No application row is written.
+ * This is a logical selected-row restore rehearsal, not a whole-store restore. */
+export declare function rehearseLegacyRestore(client: LegacyReader, input: unknown, scope?: 'transaction' | 'savepoint'): Promise<{
+    schema: string;
+    capsule_sha256: string;
+    plan_sha256: string;
+    requests: number;
+    sessions: number;
+    restored_original_bytes: string;
+    temporary_rows: string;
+    source_mutations: number;
+    scope: string;
+}>;
+export declare function parseLegacyPreservationOptions(command: string, args: string[]): {
+    input: string;
+    output?: string;
+};
+export declare function runLegacyPreservation(command: string, options: {
+    input: string;
+    output?: string;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=legacy-preservation.d.ts.map

package/dist/server/legacy-preservation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-preservation.d.ts","sourceRoot":"","sources":["../../src/server/legacy-preservation.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgD,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAgBnH,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CA6C1D;AAOD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,CAEvF;AAED,UAAU,QAAQ;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AACnD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,gCAAgC,CAAA;IACxC,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,QAAQ,EAAE,CAAA;IACpB,QAAQ,EAAE,QAAQ,EAAE,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAmChE;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAiB1G;AAmBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,SAAU,GAAG,OAAO,CAI5E;AAED;sFACsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAC,MAAM,EAAC,KAAK,EAAC,OAAO;;;;;;;;;;;EAwB3D;AAED;;kFAEkF;AAClF,wBAAsB,qBAAqB,CAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,OAAO,EAAC,KAAK,GAAC,aAAa,GAAC,WAAyB;;;;;;;;;;GAwD1H;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAC,MAAM,EAAC,IAAI,EAAC,MAAM,EAAE,GAAG;IAAC,KAAK,EAAC,MAAM,CAAC;IAAA,MAAM,CAAC,EAAC,MAAM,CAAA;CAAC,CAM1G;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAC,MAAM,EAAC,OAAO,EAAC;IAAC,KAAK,EAAC,MAAM,CAAC;IAAA,MAAM,CAAC,EAAC,MAAM,CAAA;CAAC,iBAgB/F"}

package/dist/server/pg-sync-worker.js

@@ -1,31 +1,205 @@
 // @bun
 // src/db/pg-sync-worker.ts
 import { parentPort, workerData } from "worker_threads";
+import pg2 from "pg";
+
+// src/db/pg-connection.ts
 import pg from "pg";
-pg.types.setTypeParser(20, (v) => v === null ? null : Number(v));
-pg.types.setTypeParser(1700, (v) => v === null ? null : Number(v));
-var dsn = workerData?.dsn;
-var ssl = dsn && (dsn.includes("sslmode=require") || dsn.includes("ssl=true")) ? { rejectUnauthorized: false } : undefined;
-var pool = new pg.Pool({
-  connectionString: dsn,
-  ssl,
-  max: Number(process.env["ECONOMY_PG_POOL_MAX"] ?? "5"),
-  connectionTimeoutMillis: 1e4
-});
-pool.on("error", (err) => {
-  console.error(JSON.stringify({ evt: "pg_worker_pool_error", message: err.message }));
-});
-var replyPort = null;
+import { checkServerIdentity } from "tls";
+function resolvePgConnection(dsn) {
+  try {
+    const client = new pg.Client({ connectionString: dsn });
+    const resolved = client.connectionParameters;
+    const ssl = resolved.ssl;
+    const host = resolved.host.replace(/^\[|\]$/g, "");
+    const tls = ssl ? {
+      ...typeof ssl === "object" ? ssl : {},
+      rejectUnauthorized: true,
+      checkServerIdentity: (_servername, cert) => checkServerIdentity(host, cert)
+    } : false;
+    return { ...resolved, password: resolved.password, ssl: tls };
+  } catch {
+    throw new Error("PostgreSQL connection configuration is invalid or its TLS files are unreadable");
+  }
+}
+
+// src/db/pg-protocol.ts
+function pgNow() {
+  return performance.timeOrigin + performance.now();
+}
+
+// src/db/pg-sync-worker.ts
+pg2.types.setTypeParser(20, (v) => v === null ? null : Number(v));
+pg2.types.setTypeParser(1700, (v) => v === null ? null : Number(v));
+var config = workerData;
+var lifecycle = new Int32Array(config.lifecycle);
+var pool;
+try {
+  pool = new pg2.Pool({
+    ...resolvePgConnection(config.dsn),
+    max: Number(process.env["ECONOMY_PG_POOL_MAX"] ?? "5"),
+    connectionTimeoutMillis: Math.min(config.queryTimeoutMs, 1e4),
+    statement_timeout: config.queryTimeoutMs,
+    idle_in_transaction_session_timeout: config.transactionTimeoutMs
+  });
+  pool.on("error", () => {});
+} catch {}
+var replyPort;
+var leased;
+var transactionId = null;
+var queue = Promise.resolve();
+function onIdleTransactionError() {
+  Atomics.store(lifecycle, 0, 1);
+  const client = leased;
+  leased = undefined;
+  transactionId = null;
+  client?.release(true);
+}
+function fail(code) {
+  return Object.assign(new Error(code), { code });
+}
+async function execute(msg) {
+  let active;
+  let done = false;
+  let destroyed = false;
+  let releaseTransaction = false;
+  const finish = (reply) => {
+    if (done)
+      return;
+    done = true;
+    replyPort?.postMessage(reply);
+    const signal = new Int32Array(msg.signal);
+    Atomics.store(signal, 0, 1);
+    Atomics.notify(signal, 0);
+  };
+  const destroy = () => {
+    if (destroyed)
+      return;
+    destroyed = true;
+    Atomics.store(lifecycle, 0, 1);
+    const client = active ?? leased;
+    leased = undefined;
+    transactionId = null;
+    client?.release(true);
+  };
+  const check = () => {
+    if (done || pgNow() >= msg.deadline || Atomics.load(lifecycle, 0) !== 0)
+      throw fail("ECONOMY_PG_ABANDONED");
+  };
+  const timer = setTimeout(() => {
+    destroy();
+    finish({
+      id: msg.id,
+      ok: false,
+      code: "ECONOMY_PG_TIMEOUT",
+      fatal: true,
+      error: "PostgreSQL operation deadline exceeded; write outcome may be unknown"
+    });
+  }, Math.max(1, msg.deadline - pgNow()));
+  const onClientError = () => {
+    destroy();
+    finish({
+      id: msg.id,
+      ok: false,
+      code: "ECONOMY_PG_CONNECTION",
+      fatal: true,
+      error: "PostgreSQL connection failed; write outcome may be unknown"
+    });
+  };
+  try {
+    check();
+    if (!pool)
+      throw fail("ECONOMY_PG_CONFIG");
+    if (msg.operation === "begin" ? transactionId !== null : msg.transactionId !== transactionId) {
+      throw fail("ECONOMY_PG_TRANSACTION");
+    }
+    active = leased ?? await pool.connect();
+    if (destroyed || done) {
+      active.release(true);
+      active = undefined;
+      return;
+    }
+    active.removeListener("error", onIdleTransactionError);
+    active.on("error", onClientError);
+    check();
+    let sql;
+    const savepoint = `economy_sp_${msg.depth}`;
+    switch (msg.operation) {
+      case "begin":
+        sql = "BEGIN";
+        break;
+      case "commit":
+        sql = "COMMIT";
+        break;
+      case "rollback":
+        sql = "ROLLBACK";
+        break;
+      case "savepoint":
+        sql = `SAVEPOINT ${savepoint}`;
+        break;
+      case "release":
+        sql = `RELEASE SAVEPOINT ${savepoint}`;
+        break;
+      case "rollbackTo":
+        sql = `ROLLBACK TO SAVEPOINT ${savepoint}`;
+        break;
+      case "query":
+        sql = msg.sql;
+        break;
+      default:
+        throw fail("ECONOMY_PG_PROTOCOL");
+    }
+    const result = await active.query(sql, msg.operation === "query" ? msg.params : []);
+    check();
+    if (msg.operation === "begin") {
+      leased = active;
+      transactionId = msg.transactionId;
+    }
+    if (msg.operation === "rollbackTo") {
+      check();
+      await active.query(`RELEASE SAVEPOINT ${savepoint}`);
+      check();
+    }
+    const last = Array.isArray(result) ? result.at(-1) : result;
+    if (msg.operation === "commit" && last?.command !== "COMMIT")
+      throw fail("25P02");
+    releaseTransaction = msg.operation === "commit" || msg.operation === "rollback";
+    finish({ id: msg.id, ok: true, rows: last?.rows ?? [], rowCount: last?.rowCount ?? 0 });
+  } catch (error) {
+    const rawCode = error?.code;
+    const sqlState = typeof rawCode === "string" && /^[0-9A-Z]{5}$/.test(rawCode) ? rawCode : undefined;
+    const fatal = !sqlState || sqlState.startsWith("08") || /^57P0[123]$/.test(sqlState);
+    if (fatal)
+      destroy();
+    const code = sqlState ?? "ECONOMY_PG_UNAVAILABLE";
+    finish({
+      id: msg.id,
+      ok: false,
+      code,
+      fatal,
+      error: sqlState ? `PostgreSQL operation failed (${sqlState})` : "PostgreSQL connection or worker unavailable; write outcome may be unknown"
+    });
+  } finally {
+    clearTimeout(timer);
+    active?.removeListener("error", onClientError);
+    if (!destroyed && active) {
+      if (releaseTransaction) {
+        leased = undefined;
+        transactionId = null;
+      }
+      if (active !== leased)
+        active.release();
+      else
+        active.on("error", onIdleTransactionError);
+    }
+  }
+}
 parentPort?.on("message", (msg) => {
-  if (msg.type === "init") {
+  if ("type" in msg) {
     replyPort = msg.port;
     return;
   }
-  const { id, sql, params, signal } = msg;
-  const sig = new Int32Array(signal);
-  pool.query(sql, params).then((res) => ({ id, ok: true, rows: res.rows, rowCount: res.rowCount ?? 0 })).catch((err) => ({ id, ok: false, error: err instanceof Error ? err.message : String(err) })).then((response) => {
-    replyPort?.postMessage(response);
-    Atomics.store(sig, 0, 1);
-    Atomics.notify(sig, 0);
+  queue = queue.then(() => execute(msg)).catch(() => {
+    Atomics.store(lifecycle, 0, 1);
   });
 });

package/dist/server/serve.d.ts

@@ -1,11 +1,7 @@
 import type { SqliteAdapter as Database } from '../db/sqlite-adapter.js';
-/** The serve OpenAPI document (source of the generated SDK), version-synced. */
+import { type ServiceLimits } from './service-dispatcher.js';
+import { type OperationDispatcher } from './service-protocol.js';
 export declare function openApiDocument(): Record<string, unknown>;
-/**
- * Framework-agnostic API-key verifier shape (matches `@hasna/contracts/auth`
- * `ApiKeyVerifier`). Kept structural so serve.ts has no hard dependency on the
- * auth package; the entry point injects the real verifier.
- */
 export interface ApiAuthenticator {
     authenticate(headers: Headers, context?: {
         method?: string | null;
@@ -16,27 +12,33 @@ export interface ApiAuthenticator {
         status: number;
         reason?: string;
         message?: string;
+        principal?: {
+            tid: string | null;
+            kid: string;
+            kind?: 'human';
+            subject?: string;
+            scopes?: string[];
+            sessionId?: string;
+            expiresAt?: number;
+        };
     }>;
 }
-interface StartServerOptions {
-    db?: Database;
-    dashboardDir?: string;
-    hostname?: string;
-    log?: (message: string) => void;
-}
-export declare function createServerFetch(apiHandler: (req: Request) => Promise<Response>, dashboardDir?: string): (req: Request) => Promise<Response>;
 export interface HandlerOptions {
-    /** API-key verifier (from `@hasna/contracts/auth`). When present, every
-     * request outside the open foundation probes must present a valid
-     * `economy:*` scoped key. This is the internet-facing auth path. */
     authenticator?: ApiAuthenticator;
-    /** Readiness probe proving storage is reachable + migrated. */
     readyCheck?: () => Promise<{
         ready: boolean;
         detail?: string;
     }>;
+    limits?: ServiceLimits;
+}
+interface StartServerOptions {
+    db?: Database;
+    hostname?: string;
+    log?: (message: string) => void;
 }
-export declare function createHandler(db: Database, options?: HandlerOptions): (req: Request) => Promise<Response>;
+/** Explicit injected database handles remain supported for embedding/tests.
+ * The production server always supplies an asynchronous operation dispatcher. */
+export declare function createHandler(target: Database | OperationDispatcher, options?: HandlerOptions): (req: Request) => Promise<Response>;
 export declare function startServer(port?: number, options?: StartServerOptions): ReturnType<typeof Bun.serve>;
 export {};
 //# sourceMappingURL=serve.d.ts.map

package/dist/server/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/server/serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,IAAI,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAgDxE,gFAAgF;AAChF,wBAAgB,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzD;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CACV,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC/E;AAuBD,UAAU,kBAAkB;IAC1B,EAAE,CAAC,EAAE,QAAQ,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AA6ED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,EAAE,YAAY,SAAwB,IACzF,KAAK,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAwB7D;AAQD,MAAM,WAAW,cAAc;IAC7B;;wEAEoE;IACpE,aAAa,CAAC,EAAE,gBAAgB,CAAA;IAChC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChE;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,GAAE,cAAmB,IACxC,KAAK,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAmhB/D;AAMD,wBAAgB,WAAW,CAAC,IAAI,SAAO,EAAE,OAAO,GAAE,kBAAuB,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAqDvG"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/server/serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,IAAI,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAOxE,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvH,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAK9E,wBAAgB,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzD;AACD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC3H,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE;YAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAA;CAC5N;AASD,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,gBAAgB,CAAA;IAChC,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC/D,MAAM,CAAC,EAAE,aAAa,CAAA;CACvB;AACD,UAAU,kBAAkB;IAC1B,EAAE,CAAC,EAAE,QAAQ,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAmCD;iFACiF;AACjF,wBAAgB,aAAa,CAAC,MAAM,EAAE,QAAQ,GAAG,mBAAmB,EAAE,OAAO,GAAE,cAAmB,IAOlE,KAAK,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CA4E/D;AAGD,wBAAgB,WAAW,CAAC,IAAI,SAAO,EAAE,OAAO,GAAE,kBAAuB,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CA+DvG"}

package/dist/server/service-admission.d.ts

@@ -0,0 +1,10 @@
+/** Bound asynchronous authority/readiness work independently of data workers.
+ * A timed-out caller does not free admission until the underlying call settles. */
+export declare class ServiceAdmission {
+    private readonly capacity;
+    private readonly deadlineMs;
+    private active;
+    constructor(capacity: number, deadlineMs: number);
+    run<T>(work: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=service-admission.d.ts.map

package/dist/server/service-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-admission.d.ts","sourceRoot":"","sources":["../../src/server/service-admission.ts"],"names":[],"mappings":"AAAA;mFACmF;AACnF,qBAAa,gBAAgB;IAEf,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAU,OAAO,CAAC,QAAQ,CAAC,UAAU;IAD1E,OAAO,CAAC,MAAM,CAAI;gBACW,QAAQ,EAAE,MAAM,EAAmB,UAAU,EAAE,MAAM;IAC5E,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAYjD"}

package/dist/server/service-dispatcher.d.ts

@@ -0,0 +1,45 @@
+import { type OperationDispatcher, type ServiceBackend, type ServiceOperation, type ServiceResult } from './service-protocol.js';
+export interface ServiceLimits {
+    workers: number;
+    maxQueue: number;
+    deadlineMs: number;
+    maxInputBytes: number;
+    maxResultBytes: number;
+    maxQueuedBytes: number;
+}
+export declare const DEFAULT_SERVICE_LIMITS: ServiceLimits;
+export declare function serviceLimits(env?: Record<string, string | undefined>): ServiceLimits;
+export declare class ServiceUnavailable extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly operationId: string;
+    readonly outcome: 'not_started' | 'unknown';
+    constructor(code: string, status: number, operationId: string, outcome: 'not_started' | 'unknown');
+}
+/** Bounded operation processes, bounded queued input and one deadline per call.
+ * No request is replayed. A new operation gets an independent process/context. */
+export declare class AsyncServiceDispatcher implements OperationDispatcher {
+    private readonly backend;
+    readonly limits: ServiceLimits;
+    private readonly queue;
+    private readonly active;
+    private generation;
+    private queuedBytes;
+    private stopped;
+    constructor(backend: ServiceBackend, limits?: ServiceLimits);
+    dispatch(operation: ServiceOperation, signal?: AbortSignal, beforeStart?: () => Promise<void>): Promise<ServiceResult>;
+    private settle;
+    private fail;
+    private pump;
+    private start;
+    private launch;
+    /** Metadata only; no PID, SQL, bodies or credentials. */
+    state(): {
+        active: number;
+        queued: number;
+        queuedBytes: number;
+        stopped: boolean;
+    };
+    close(): Promise<void>;
+}
+//# sourceMappingURL=service-dispatcher.d.ts.map

package/dist/server/service-dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-dispatcher.d.ts","sourceRoot":"","sources":["../../src/server/service-dispatcher.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkB,KAAK,mBAAmB,EAAE,KAAK,cAAc,EAAE,KAAK,gBAAgB,EAAE,KAAK,aAAa,EAAoB,MAAM,uBAAuB,CAAA;AAElK,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;CACvB;AACD,eAAO,MAAM,sBAAsB,EAAE,aAGpC,CAAA;AACD,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,aAAa,CAelG;AACD,qBAAa,kBAAmB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM;IACtF,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS;gBADxB,IAAI,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM,EAAW,WAAW,EAAE,MAAM,EAC7E,OAAO,EAAE,aAAa,GAAG,SAAS;CAC9C;AAiBD;kFACkF;AAClF,qBAAa,sBAAuB,YAAW,mBAAmB;IAMpD,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAkB,QAAQ,CAAC,MAAM;IALrE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,WAAW,CAAI;IACvB,OAAO,CAAC,OAAO,CAAQ;gBACM,OAAO,EAAE,cAAc,EAAW,MAAM,gBAAkB;IAEvF,QAAQ,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IA0BtH,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,IAAI;IAQZ,OAAO,CAAC,IAAI;IASZ,OAAO,CAAC,KAAK;IAiBb,OAAO,CAAC,MAAM;IA8Cd,yDAAyD;IACzD,KAAK,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE;IAG5E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAS7B"}

package/dist/server/service-operations.d.ts

@@ -0,0 +1,5 @@
+import type { SqliteAdapter as Database } from '../db/sqlite-adapter.js';
+import type { ServiceOperation, ServiceResult } from './service-protocol.js';
+/** Execute one complete, already-authorized operation. No request authorization headers enter this executor. */
+export declare function executeServiceOperation(db: Database, operation: ServiceOperation): Promise<ServiceResult>;
+//# sourceMappingURL=service-operations.d.ts.map

package/dist/server/service-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-operations.d.ts","sourceRoot":"","sources":["../../src/server/service-operations.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,IAAI,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAuCxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AA6jB5E,gHAAgH;AAChH,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAe/G"}