@hasna/economy 0.3.28 → 0.5.0

package/docs/ingestion.md

@@ -2,7 +2,39 @@
 
 `economy sync` imports local coding-agent usage into Economy's SQLite database. A sync with no source flag runs every source; one or more source flags limit the run. Reads such as `economy today` also auto-sync all local sources before querying.
 
-In cloud-client mode, CLI and MCP reads/writes go directly to the shared HTTP API. Local `sync` and `billing sync` deliberately do nothing in that mode; ingest on a machine running in local mode, or use the authenticated server ingest endpoints.
+In cloud-client mode, CLI and MCP reads/writes go directly to the shared HTTP API (on-box auto-sync is skipped). The explicit `economy sync` / `economy billing sync` verbs still run the same on-box provider ingest against a scratch store and push the rows to `/v1/ingest`.
+
+## Hosted batch integrity
+
+`POST /v1/ingest` accepts the supported table arrays, optional `schema_version: 1`
+and an `idempotency_key` of 1–200 letters, digits, dots, underscores, colons or
+hyphens. A command is limited to 10000 rows total and 4 MiB of JSON. The client
+splits large scans into deterministic commands of at most 500 rows; each command
+commits separately. All rows, session totals, predecessor snapshots and the
+receipt for one command share a transaction.
+
+Supply source `updated_at` values as ISO UTC timestamps ending in `Z`. An older
+version is skipped, while different content at the same version is a conflict.
+An unversioned row may be inserted or replayed, but cannot silently replace
+different existing content. The server does not treat arrival time as a source
+version. Session totals are derived from canonical request rows when present.
+Collectors use recorded source revisions or event times, never a fresh scan time
+as revision authority. A changed event without a newer source version conflicts;
+changing a file's mtime does not grant permission to replace accepted usage.
+
+The response's `data` contains `ingested`, `total`, `stale`, `unchanged`,
+`operation_key` and `replayed`. Reuse the **identical body and key** after an
+uncertain response: a committed command returns its original receipt. Reusing
+that key for different content returns 409. Keys are scoped to the authenticated
+principal. Legacy commands without a key derive one from their exact content.
+
+Invalid fields return 400, source/key conflicts return 409, and oversized
+commands return 413, with `code`, `field` and `expected` details. These are
+definitive refusals. A timeout or lost response has an uncertain outcome; the
+client never automatically repeats it. The authority-bound durable journal
+retains the exact intent and its committed receipt or proven terminal refusal.
+Use [journal status and reconciliation](ingest-journal.md) after an interruption;
+a newly reconstructed scan is not exact reconciliation of the previous command.
 
 ## Sources
 
@@ -16,23 +48,47 @@ In cloud-client mode, CLI and MCP reads/writes go directly to the shared HTTP AP
 | OpenCode | `~/.local/share/opencode/storage/message/**/*.json` | Imports assistant-message usage and uses the recorded cost when present. |
 | Cursor | Cursor `/api/usage` and `/api/usage-summary` | Requires `CURSOR_SESSION_TOKEN` (or `CURSOR_API_TOKEN`). Creates daily usage snapshots and a subscription rollup when spend is present. |
 | Pi | `~/.pi/agent/sessions/**/*.json` | Override with `PI_CODING_AGENT_SESSION_DIR`. Uses recorded turn cost; a missing cost remains zero until pricing is repaired or the source records one. |
-| Hermes | `~/.hermes/state.db` | Imports session-level token and cost rollups. |
-| OpenLoops | `~/.hasna/loops/loops.db` | Override with `HASNA_ECONOMY_LOOPS_DB_PATH`; price with `HASNA_ECONOMY_LOOPS_MODEL` or `ECONOMY_LOOPS_MODEL`. Imports orchestration/judge `goal_runs.tokens_used` only, into `loop:*` cost centers. |
+| Hermes | `~/.hermes/state.db` | Retains session lifetime totals and their actual start/end span. It cannot establish individual request times. |
+| OpenLoops | `~/.hasna/loops/loops.db` | **Local lane only** — a hosted client refuses this cross-app on-box read (`loops ingest skipped`, one stderr line); pending a hosted loops read. Override with `HASNA_ECONOMY_LOOPS_DB_PATH`; price with `HASNA_ECONOMY_LOOPS_MODEL` or `ECONOMY_LOOPS_MODEL`. Imports orchestration/judge `goal_runs.tokens_used` only, into `loop:*` cost centers. |
 
 Full, unfiltered sync also attempts to import active metadata from `@hasna/projects`. Missing files, optional registries, and unavailable quota credentials are skipped; use `--verbose` to see source-level diagnostics.
 
+Claude/Takumi, Gemini, Pi and OpenCode usage without a valid recorded event timestamp remains uncollected and
+reports `SOURCE_INVALID`, including on repeat scans. The original source stays
+intact. A file's modification time or the containing session's update time cannot
+date an otherwise undated request. Hermes lifetime-only usage reports `USAGE_EVENTS_UNAVAILABLE`; it creates
+no artificial end-date request. Summaries identify overlapping session-only
+lifetime totals separately and leave the complete period total unavailable.
+These values are not allocated to days or months. Existing Hermes rollup requests
+require a separately preserved historical migration and are not rewritten by sync.
+
+Ingestion treats subscriptions as `quota_observation` by default, preserving the
+existing assignment, active status, plan label and billing-cycle settings. Explicit
+subscription edits use `subscription_mode: "configuration"` with a subscriptions
+array; the normal subscription command supplies this mode. Both modes remain
+subject to the same source-version, current write-authority and receipt checks.
+Authenticated mutating API requests require `economy:write`; a read-only key
+cannot change subscription configuration or other stored settings.
+An explicit configuration replaces monetary values and their provenance, including
+unknown amounts. Omitting a fee on a plan change does not retain the previous plan's
+fee; the comparison stays unavailable until the new fee is known.
+Quota refreshes with unknown monetary amounts preserve a subscription's existing
+configured or observed fee and included value. A deliberate known zero must carry
+`configured` or `observed` provenance. A zero-priced request with no affirmative
+price evidence keeps both summaries and subscription comparisons unavailable.
+
 ## Incremental and repair behavior
 
 File/database state is cached in the `ingest_state` table, and request IDs are upserted and deduplicated. Consequently, normal repeated syncs are incremental.
 
 - `--force` clears the ingest-state entries for the supported sources and reprocesses them.
-- `--backfill-machine` fills empty `machine_id` values with `ECONOMY_MACHINE_ID` or the normalized hostname.
+- `--backfill-machine` fills empty `machine_id` values with `HASNA_ECONOMY_MACHINE_ID` or the normalized hostname.
 - `--recalculate` prices token-bearing requests whose `cost_usd` is zero, then rerolls affected sessions. It reports buckets still missing usable pricing.
 - Budget webhooks are checked after a CLI or REST sync. Failed deliveries remain eligible for a later retry.
 
 ## Account and cost-center attribution
 
-Economy first checks agent-specific overrides such as `ECONOMY_CODEX_ACCOUNT`, then generic `ECONOMY_ACCOUNT` overrides, then matching `@hasna/accounts` env-dir/applied/current profiles. An override may be `tool:name`, an email, or separate `*_ACCOUNT_TOOL`, `*_ACCOUNT_NAME`, and `*_ACCOUNT_EMAIL` fields. See [configuration](configuration.md#account-attribution).
+Economy first checks agent-specific overrides such as `ECONOMY_CODEX_ACCOUNT`, then generic `ECONOMY_ACCOUNT` overrides, then matching accounts env-dir/applied/current profiles from the accounts API. The on-box accounts registry (`~/.hasna/accounts/accounts.json`) is consulted **only** under the explicit local opt-in `HASNA_ECONOMY_LOCAL=1`; without an accounts credential and without that flag, attribution is omitted and the refusal is printed once on stderr. An override may be `tool:name`, an email, or separate `*_ACCOUNT_TOOL`, `*_ACCOUNT_NAME`, and `*_ACCOUNT_EMAIL` fields. See [configuration](configuration.md#account-attribution).
 
 Apps and services can report explicit project, repository, account, attribution-tag, and cost-center fields through [`economy-otel`](otel.md). `ECONOMY_TAG` supplies a fallback attribution tag for records written through the local database helpers.
 

package/docs/mcp.md

@@ -24,7 +24,7 @@ Gemini settings:
 }
 ```
 
-`economy mcp --all` prints these snippets. The MCP server uses the same local-versus-cloud Store selection as the CLI; configure a shared API with `HASNA_ECONOMY_API_URL` and `HASNA_ECONOMY_API_KEY` as described in [configuration](configuration.md#climcp-cloud-client).
+`economy mcp --all` prints these snippets. The MCP server uses the same local-versus-cloud Store selection as the CLI; the credential resolves through the `@hasna/contracts` chain as described in [configuration](configuration.md#climcp-cloud-client).
 
 ## Streamable HTTP
 
@@ -56,10 +56,12 @@ Management and estimation:
 - `list_subscriptions`, `set_subscription`, `remove_subscription`
 - `sync`, `send_feedback`
 
-Shared agent-registry tools:
+Shared agent lifecycle tools:
 
 - `register_agent`, `heartbeat`, `set_focus`, `list_agents`
 
+The agent registry behind these tools is opened on first use, never at startup — through a dynamic import, so the published `dist/mcp` bundle contains no `bun:sqlite` reference at all. A hosted server (a resolved credential) keeps it in memory for the life of the process — no SQLite file is created under `~/.hasna/economy` in hosted mode; under the explicit local opt-in (`HASNA_ECONOMY_LOCAL=1`) it persists as `agent-registry.db` beside the local store and is shared by every MCP process on the box. `HASNA_AGENT_REGISTRY_DB_PATH` overrides that file only in the explicit local lane; hosted transport ignores it and remains in memory.
+
 High-cardinality tools return compact text by default. Where the schema offers them, use `limit`, `verbose=true`, or `json=true`. Limits are clamped to 100 for MCP calls.
 
-The `sync` tool accepts `all`, any supported coding agent, or `loops`. It ingests on-box files (in local mode into the local SQLite; in cloud-client mode it reads the on-box files on this machine and pushes the rows to the shared API).
+The `sync` tool accepts `all`, any supported coding agent, or `loops`. It ingests on-box files (in local mode into the local SQLite; in cloud-client mode it reads the on-box files on this machine and pushes the rows to the shared API). `loops` is the exception: it reads ANOTHER app's on-box SQLite, so a hosted server refuses it and reports `loops ingest skipped`.

package/docs/native-budget-save.md

@@ -0,0 +1,84 @@
+# Native metered API budget rules
+
+The native Save action uses the existing authenticated `POST /v1/ingest` command
+and `GET /v1/ingest/receipts` recovery path. It creates one rule; it does not edit
+an existing rule, cap spending, or request notification delivery. Existing
+`POST /v1/budgets`, CLI `budget set` and MCP `set_budget` retain legacy semantics.
+
+Capture the rule ID, idempotency key and timestamps once when the user confirms.
+Keep the complete command unchanged until its outcome is resolved. For example:
+
+```json
+{
+  "schema_version": 1,
+  "idempotency_key": "budget-create-example-1",
+  "budget_mode": "create",
+  "budgets": [{
+    "id": "budget-example-1",
+    "metric": "metered_api_usd",
+    "period": "monthly",
+    "limit_usd": 50,
+    "alert_at_percent": 80,
+    "project_path": null,
+    "agent": null,
+    "created_at": "2026-09-30T12:00:00.000Z",
+    "updated_at": "2026-09-30T12:00:00.000Z"
+  }]
+}
+```
+
+Use fresh caller-owned UUIDs for real rule IDs and keys. The command requires
+schema version 1, the explicit create mode, exactly one rule and no other tables.
+Limits are positive finite USD values. Thresholds are integers from 1 through
+100. Periods are `daily`, `weekly`, or `monthly`. Omitted or null project, agent
+and cost-center fields mean all values; provided text cannot be empty. Agents
+must be members of Economy's published agent enum. Both timestamps are explicit
+ISO UTC instants ending in `Z` and are part of the exact retry intent.
+
+The transaction inserts the rule only when its ID is absent. Concurrent creation
+or another actor's use of the same ID cannot overwrite it. A committed identical
+command by the same authenticated actor returns the original receipt with
+`replayed: true`. Reusing a key for different content returns 409. A new key is
+not a way to edit an existing ID. Generic observation ingestion can recognize an
+exact unchanged new rule but cannot edit it or convert a legacy rule's metric.
+
+After a timeout or lost response, do not automatically create a new command. Read
+`/v1/ingest/receipts?idempotency_key=…&body_hash=…` using the same authenticated
+principal. `body_hash` is lowercase SHA-256 of `canonicalIngestBodyHash`'s stable
+JSON encoding: recursively sort object keys, retain array order and JSON scalar
+encoding. The hash includes the key, mode and all fields exactly as submitted.
+Keep the serialized command and its hash together. A committed receipt must
+match the principal and hash. `absent` is only a current observation; an earlier
+request may still commit. Explicit retry, if chosen, uses that same full body/key.
+Read-only or revoked principals cannot write or reconcile a write receipt.
+
+After confirmation, fetch `GET /v1/budgets` and show the matching ID and its
+authoritative threshold status. Do not label it saved merely because a request
+was sent or a matching-looking row was listed before the transaction.
+
+`metered_api_usd` sums stored requests whose `cost_basis` is exactly
+`metered_api`. It excludes `subscription_included`, `estimated`, `unknown`,
+subscription fees, quota values and separate provider billing rows. These are
+recorded API usage values, not a guarantee of complete collection or a reconciled
+provider invoice. Scope combines selected project, agent and cost center.
+The new metric sums the stored numbers' round-trip decimal representations and
+compares thresholds in decimal arithmetic. Fractional-cent API charges remain
+intact; neither individual charges nor the comparison are rounded to cents.
+The numeric display fields keep their existing JSON-number representation, while
+the alert and limit flags come from the exact comparison. A total or percentage
+outside that numeric display range fails visibly rather than reporting a false
+zero or serializing infinity as null. Legacy rules retain their previous sum.
+Thresholds are in-app status, not spending enforcement or guaranteed alerts.
+Creating or replaying this rule never invokes optional webhook delivery.
+
+Periods use the existing full UTC calendar windows. Days begin at 00:00 UTC,
+weeks begin on Sunday, and months begin on the first. Each budget status exposes
+`period_bounds` with `time_zone`, `start_date` and `end_date_exclusive`; display
+those semantics rather than interpreting the date in the device's timezone.
+
+The additive migration appends `budgets.metric` with default
+`legacy_request_cost_usd`. Existing rows and their request-cost sum behavior are
+preserved; historical migration bytes do not change. Apply the new migration
+through the reviewed deployment path before enabling the native Save action.
+This document and fixture results alone do not establish hosted activation,
+native human authentication, push delivery or production data changes.

package/docs/native-human-auth.md

@@ -0,0 +1,102 @@
+# Native human authentication
+
+This additive protocol leaves signed agent keys under their existing verifier.
+It does not activate human access by default. Deployment requires an operator to
+verify which tenant and human principals own the entire existing Economy report
+store. The store is not partitioned by the tenant in an incoming token.
+
+## Identity protocol
+
+The native client uses the existing Identities authority at
+`https://api.hasna.com/identities/v1`, with HTTPS and redirects disabled:
+
+1. `POST /auth/login` with `{ "email": "<human email>" }` requests an email code.
+   The response contains `challenge: true` and `expires_in`.
+2. `POST /auth/verify` with `{ "email": "<human email>", "code": "<code>" }`
+   returns `session`, `session_expires_in`,
+   `principal: { user_id, kind, email, display_name }` and
+   `tenants: [{ tenant_id, role }]`. Store the session in the platform credential
+   store. It is an Identities credential and must never be sent to Economy.
+3. Select an explicit tenant from the returned memberships. `POST /auth/token`
+   with that session in the Bearer header and body
+   `{ "app": "economy", "tenant_id": "<selected tenant>" }` returns
+   `access_token`, `token_type: "Bearer"`, `uid`, `tid`, `scope`, `expires_in`,
+   `aud: "economy"`, `pt: "user"`, `alg: "EdDSA"` and `kid`.
+   Omit `scopes` to receive current grants; never require write scope just to
+   sign in. Explicit scopes can only narrow access. Economy token TTL defaults
+   to 300 seconds, cannot exceed 300, and cannot outlive the session.
+4. Use the access token as Bearer at `https://api.hasna.com/economy/v1`.
+   `GET /auth/session` returns
+   `{ data: { subject, tenant_id, scopes, session_id, expires_at }, meta: {} }`.
+   `expires_at` is integer epoch seconds; `scopes` is the effective intersection
+   of current Identities grants and Economy's store binding. Hide write controls
+   unless it includes `economy:write`. Human report and session responses are
+   `Cache-Control: no-store`.
+5. Refresh by repeating step 3 while the session is valid. Stable account identity
+   is the verified `(tenant_id, subject)` pair, not token id or signing key.
+   Fence all pending requests when account, tenant or session changes. Do not
+   display a prior account's cached report after a change.
+6. Sign out locally first, cancelling requests and clearing session, access
+   token and account-scoped caches. Make one best-effort `POST /auth/logout` to
+   Identities using the previous session bearer. Success is
+   `{ "signed_out": true }`. This revokes only that session and its Economy
+   tokens. Report a failed remote sign-out accurately; other legacy app tokens
+   retain their existing semantics.
+
+This is the existing email-code protocol, not OAuth/PKCE. No browser callback,
+embedded station key, signup or new identity account is needed by the client.
+Clients bound request/response sizes and deadlines and never follow redirects
+while sending a credential. No token, code or raw auth response belongs in logs.
+
+## Economy store binding
+
+`ECONOMY_HUMAN_AUTH_BINDING` is non-secret server configuration:
+
+```json
+{
+  "tenantId": "<operator-verified data tenant>",
+  "principals": [
+    { "subject": "<verified human user id>", "scopes": ["economy:read"] }
+  ]
+}
+```
+
+These values must come from independently verified ownership and current grants;
+never populate them from the requesting token or an unverified native-client
+choice. Only the named tenant and principals are admitted. Add write scope only
+where the existing budget/configuration authority permits it. Agent permissions
+remain unchanged. Missing configuration returns `503 human_auth_not_configured`
+for human credentials while agent keys continue working. Malformed configuration
+refuses server startup.
+
+The server sends only the Economy access token to the fixed default endpoint
+`https://api.hasna.com/identities/v1/auth/economy-authority`. An explicit HTTPS
+`authorityUrl` permits a self-hosted authority with the same contract; it cannot
+contain credentials, query parameters or fragments. No response can select a
+different origin. Redirects are refused. Each authority call has a three-second
+deadline and a 16 KiB response cap; tokens are capped at 8 KiB. Failure is closed
+and redacted (`human_authority_unavailable`); no offline grant cache is used.
+
+Identities verifies the EdDSA signature, issuer `identities`, audience `economy`,
+300-second lifetime and signed session id, then checks the current session,
+human, tenant and membership together in one database statement. Only concrete
+read/write grants survive the role and explicit membership-scope ceiling.
+Economy intersects that response with its store binding. It checks at request
+admission and again after body reading/queue waiting immediately before dispatch.
+Actor identity uses the tenant and stable human subject across token refreshes.
+
+This establishes current authority at dispatch. It does not introduce a
+distributed transaction with Identities, undo already-started work on logout, or
+claim that a later revocation is observed at database commit. Native session
+generation fencing remains required for responses already in flight.
+
+## Verification and activation
+
+Package tests cover config refusal, stable actor, effective scopes, agent-key
+compatibility, changed authority before dispatch and bounded/redacted failures.
+The owning Identities fixture uses fresh PostgreSQL, real HTTP login/verification
+and signed tokens; the cross-app acceptance fixture also exercises actual TLS
+requests, foreign tenant/principal refusal, queued revocation and redirect
+refusal. These are source/fixture proofs. Live email delivery, existing human
+grants/store ownership, service releases and production activation are separate
+requirements. No production key or record is created by these source changes.

package/docs/otel.md

@@ -1,6 +1,6 @@
 # OTLP/HTTP sidecar
 
-`economy-otel` writes application/service metrics into the local Economy SQLite database:
+`economy-otel` ingests application/service metrics into Economy — forwarded to the hosted API when a credential resolves, or written to the on-box SQLite store under the explicit local opt-in (see [Storage](#storage)):
 
 ```bash
 economy-otel --port 4318
@@ -50,4 +50,10 @@ The OTLP parser reads sum or gauge data points. Metric names containing cost or
 
 Resource and point attributes may use plain names (`model`, `session_id`, `request_id`, `project_path`, and the attribution fields above) or common dotted aliases such as `ai.model`, `session.id`, `event.id`, `service.name`, `economy.cost_center`, and `account.email`.
 
-The sidecar always opens the local SQLite database. It does not forward to a cloud API; use the authenticated REST bulk-ingest path for remote ingestion.
+## Storage
+
+The sidecar follows the same storage seam as the CLI and the MCP server ([configuration](configuration.md#climcp-cloud-client)), decided once at startup, before the listener binds:
+
+- **Hosted** — a credential resolves through the `@hasna/contracts` chain (Keychain, `~/.hasna/economy/config/credentials`, `HASNA_ECONOMY_API_KEY`): every accepted payload is ingested into a scratch in-memory store and its request/session rows are pushed to the shared API's `/v1/ingest` (idempotent upserts). The response adds `forwarded` (rows the server accepted). Nothing is written under `~/.hasna/economy`; the `cost_centers` table is not part of `/v1/ingest`, so pushed rows carry their `cost_center_id` but the server's cost-center registry is not updated by the sidecar. A failed push answers 502 and the payload is not retried.
+- **Local** — `HASNA_ECONOMY_LOCAL=1`: rows are written to the on-box `economy.db`, and the sidecar prints `economy: local mode …` on stderr once.
+- **Neither** — the sidecar fails closed: exit 1 with the resolver's diagnostic and no listener, no SQLite file.

package/docs/rest-api.md

@@ -2,7 +2,7 @@
 
 Start the service with `economy-serve` or `economy serve`. The default local origin is `http://127.0.0.1:3456`; the bind behavior is detailed in [configuration](configuration.md#rest-server).
 
-The canonical application prefix is `/v1`. Equivalent `/api` routes remain available for the bundled dashboard and older clients. Successful application responses use:
+The canonical application prefix is `/v1`. Equivalent `/api` routes remain available for older clients. Successful application responses use:
 
 ```json
 { "data": {}, "meta": {} }
@@ -23,14 +23,14 @@ These routes are open. The checked-in OpenAPI source is [`openapi/economy.json`]
 
 ## Authentication
 
-In local mode, set `ECONOMY_API_TOKEN` or `HASNA_ECONOMY_API_TOKEN` and send either:
+In local mode, set `HASNA_ECONOMY_API_TOKEN` (the unprefixed `ECONOMY_API_TOKEN` spelling is retired) and send either:
 
 ```text
 Authorization: Bearer <token>
 X-Economy-Token: <token>
 ```
 
-In self-hosted Postgres mode, send a valid Economy API key as `x-api-key` or a bearer token. All non-probe routes require a valid key when the server has an authenticator. Bulk ingest and feedback additionally request the `economy:write` scope.
+With a Postgres backend (database URL configured), send a valid Economy API key as `x-api-key` or a bearer token. All non-probe routes require a valid key when the server has an authenticator. Bulk ingest and feedback additionally request the `economy:write` scope.
 
 ## Read routes
 
@@ -83,7 +83,7 @@ Common period values are `today`, `yesterday`, `week`, `month`, `year`, and `all
 | `DELETE` | `/v1/project-registry/{path}` | Delete a URL-encoded project path. |
 | `POST` | `/v1/sync` | `{ "sources": "all" }` or one of the eight agents/`loops`; triggers server-local ingestion. |
 | `POST` | `/v1/billing/sync` | Optional `days` (1–366) and `providers` from `anthropic`, `openai`, `gemini`. Provider failures are returned per provider. |
-| `POST` | `/v1/ingest` | Idempotently merge arrays named `requests`, `sessions`, `projects`, `budgets`, `goals`, `billing_daily`, `model_pricing`, `subscriptions`, and `usage_snapshots`. |
+| `POST` | `/v1/ingest` | Atomically ingest versioned, bounded arrays named `requests`, `sessions`, `projects`, `budgets`, `goals`, `billing_daily`, `model_pricing`, `subscriptions`, and `usage_snapshots`. |
 | `POST` | `/v1/feedback` | Required `message`; optional `email` and `category=bug|feature|general`. |
 
 Agent fields accept `claude`, `takumi`, `codex`, `gemini`, `opencode`, `cursor`, `pi`, or `hermes`.

package/package.json

@@ -1,15 +1,16 @@
 {
   "name": "@hasna/economy",
-  "version": "0.3.28",
-  "description": "AI coding cost tracker — CLI + MCP server + REST API + web dashboard for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
+  "version": "0.5.0",
+  "description": "AI coding cost tracker — CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/hasna/economy.git"
+    "url": "https://github.com/hasna/apps.git",
+    "directory": "apps/economy"
   },
   "bugs": {
-    "url": "https://github.com/hasna/economy/issues"
+    "url": "https://github.com/hasna/apps/issues"
   },
-  "homepage": "https://github.com/hasna/economy#readme",
+  "homepage": "https://github.com/hasna/apps/tree/main/apps/economy#readme",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -32,22 +33,21 @@
   "files": [
     "dist",
     "docs",
-    "dashboard/dist",
     "postinstall.js",
     "LICENSE",
     "README.md",
     "CHANGELOG.md",
     "SECURITY.md",
     "CONTRIBUTING.md",
-    "CODE_OF_CONDUCT.md"
+    "CODE_OF_CONDUCT.md",
+    "!dist/lib/test-hermetic-*"
   ],
   "scripts": {
-    "build": "cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.ts --outdir dist/cli --target bun --packages external && bun build src/mcp/index.ts --outdir dist/mcp --target bun --packages external && bun build src/server/index.ts --outdir dist/server --target bun --packages external && bun build src/db/pg-sync-worker.ts --outdir dist/server --target bun --packages external && bun build src/otel/index.ts --outdir dist/otel --target bun --packages external && bun build src/index.ts --outdir dist --target bun --packages external && tsc --emitDeclarationOnly --outDir dist",
-    "build:cli": "bun build src/cli/index.ts --outdir dist/cli --target bun --packages external",
-    "build:mcp": "bun build src/mcp/index.ts --outdir dist/mcp --target bun --packages external",
-    "build:server": "bun build src/server/index.ts --outdir dist/server --target bun --packages external",
-    "build:lib": "bun build src/index.ts --outdir dist --target bun --packages external",
-    "build:dashboard": "cd dashboard && bun run build",
+    "build": "bun build src/cli/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming \"chunks/[name]-[hash].[ext]\" && bun build src/mcp/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming \"chunks/[name]-[hash].[ext]\" && bun build src/server/index.ts --outdir dist/server --target bun --packages external && bun build src/db/pg-sync-worker.ts --outdir dist/server --target bun --packages external && bun build src/server/service-worker.ts --outdir dist/server --target bun --packages external && bun build src/otel/index.ts --outdir dist/otel --target bun --packages external && bun build src/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming \"chunks/[name]-[hash].[ext]\" && tsc --emitDeclarationOnly --outDir dist",
+    "build:cli": "bun build src/cli/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming \"chunks/[name]-[hash].[ext]\"",
+    "build:mcp": "bun build src/mcp/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming \"chunks/[name]-[hash].[ext]\"",
+    "build:server": "bun build src/server/index.ts --outdir dist/server --target bun --packages external && bun build src/db/pg-sync-worker.ts --outdir dist/server --target bun --packages external && bun build src/server/service-worker.ts --outdir dist/server --target bun --packages external",
+    "build:lib": "bun build src/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming \"chunks/[name]-[hash].[ext]\"",
     "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
     "prepack": "bun run build && bun run artifact-scan",
     "typecheck": "tsc --noEmit",
@@ -77,21 +77,18 @@
     "access": "public"
   },
   "dependencies": {
-    "@hasna/accounts": "0.2.23",
-    "@hasna/agent-registry": "^0.1.0",
-    "@hasna/contracts": "0.13.4",
+    "@hasna/contracts": "1.0.2",
     "@hasna/events": "^0.1.16",
-    "@hasna/mcp-harness": "^0.1.0",
-    "@hasna/paths": "0.1.0",
     "@hasna/projects": "1.0.0",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "chalk": "^5.4.1",
     "commander": "^13.1.0",
     "pg": "8.13.1",
-    "zod": "^3.24.2"
+    "zod": "^3.24.2",
+    "@hasna/trash": "0.2.3"
   },
   "devDependencies": {
-    "@types/bun": "latest",
+    "@types/bun": "1.3.14",
     "@types/pg": "^8.20.0",
     "bun-types": "latest",
     "typescript": "^5.7.2"

package/postinstall.js

@@ -6,6 +6,57 @@
 // ~/.hasna/economy default. Failures are non-fatal: the runtime getDataDir()
 // creates the same directories on first use.
 import { existsSync, mkdirSync } from "node:fs";
+// --- Local path resolver -------------------------------------------------
+// @hasna/paths was deleted (hasna/apps#1535, 2026-09-03); this in-package
+// implementation preserves the resolver contract (XDG / macOS home layout
+// honoring HASNA_{CONFIG,DATA,STATE,CACHE}_HOME, with the same env-override
+// and home-override semantics the deleted package had).
+import { homedir as pathsResolverHomedir } from "node:os";
+import { join as pathsResolverJoin } from "node:path";
+
+const PATHS_RESOLVER_KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME",
+};
+
+function pathsResolverBaseDir(kind, options) {
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0) return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin(home, ".cache", "hasna");
+  }
+}
+
+function pathsResolverResolve(kind, options) {
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return pathsResolverResolve("data", options);
+}
 import { homedir } from "node:os";
 import { join } from "node:path";
 
@@ -13,7 +64,7 @@ const EXACT_OVERRIDE = (process.env["HASNA_ECONOMY_HOME"] || process.env["ECONOM
 const DATA_HOME_OVERRIDE = (process.env["HASNA_DATA_HOME"] || "").trim();
 
 try {
-  const { dataDir } = await import("@hasna/paths");
+  // (local resolver — @hasna/paths deleted, hasna/apps#1535)
   const resolved = dataDir({ app: "economy" });
   let root;
   if (EXACT_OVERRIDE) {

package/dashboard/README.md

@@ -1,26 +0,0 @@
-# Economy dashboard
-
-The dashboard is the React/Vite UI served by `economy-serve`. It covers overview, sessions, models, projects, budgets, goals, usage, accounts, savings, fleet, reconciliation, pricing, and provider billing.
-
-## Development
-
-Run the API from the repository root, then start Vite:
-
-```bash
-economy-serve --port 3456
-cd dashboard
-bun install
-bun run dev
-```
-
-The development build uses `http://localhost:3456` by default. Set `VITE_API_URL` at build/dev time to use another origin. The dashboard currently calls the server's legacy-compatible `/api` routes; the public canonical API is `/v1`.
-
-## Validation
-
-```bash
-bun test
-bun run lint
-bun run build
-```
-
-The root package build writes production assets to `dashboard/dist`; `economy-serve` serves those assets and provides SPA fallback routing.

package/dist/cli/brains.d.ts

@@ -1,3 +0,0 @@
-import { Command } from 'commander';
-export declare function registerBrainsCommand(program: Command): void;
-//# sourceMappingURL=brains.d.ts.map

package/dist/cli/brains.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"brains.d.ts","sourceRoot":"","sources":["../../src/cli/brains.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAQnC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoL5D"}

package/dist/lib/test-hermetic-accounts.d.ts

@@ -1,6 +0,0 @@
-/**
- * Stash and delete the hosted-accounts env vars. Returns a restore function
- * for afterEach/afterAll. Safe to call when the variables are unset.
- */
-export declare function isolateHostedAccountsEnv(): () => void;
-//# sourceMappingURL=test-hermetic-accounts.d.ts.map

package/dist/lib/test-hermetic-accounts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"test-hermetic-accounts.d.ts","sourceRoot":"","sources":["../../src/lib/test-hermetic-accounts.ts"],"names":[],"mappings":"AAaA;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,IAAI,CAUrD"}