@hasna/economy 0.4.0 → 0.5.0

package/dist/chunks/menubar-6xtkt17h.js

@@ -0,0 +1,296 @@
+// @bun
+import"./index-p35cyhc4.js";
+
+// src/cli/commands/menubar.ts
+import { createHash } from "crypto";
+import { execFileSync } from "child_process";
+import { closeSync, constants, fstatSync, lstatSync, mkdtempSync, openSync, readSync, readdirSync, realpathSync } from "fs";
+import { arch, platform } from "os";
+import { isAbsolute, join, resolve, dirname } from "path";
+var APP_PATH = "/Applications/HasnaEconomy.app";
+var BUNDLE_ID = "com.hasna.economy-bar";
+var EXECUTABLE = "HasnaEconomy";
+var TEAM_ID = "HKZ326A8Y3";
+var TREE_FORMAT = "hasna-economy-app-tree-v1";
+var MAX_ENTRIES = 1e4;
+var MAX_BYTES = 1073741824;
+function refuse(code, detail) {
+  throw new Error(`${code}: ${detail}`);
+}
+function occupied(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return false;
+    return refuse("PATH_UNREADABLE", "The selected path cannot be inspected.");
+  }
+}
+function fingerprintMacApp(path) {
+  if (!isAbsolute(path) || resolve(path) !== path)
+    refuse("APP_PATH", "--app must be an absolute normalized path.");
+  const root = lstatSync(path);
+  if (!root.isDirectory() || root.isSymbolicLink())
+    refuse("APP_TREE", "The app must be a real directory.");
+  const hash = createHash("sha256").update(`${TREE_FORMAT}
+`);
+  let entries = 0, bytes = 0;
+  function walk(relative) {
+    const file = relative ? join(path, relative) : path, stat = lstatSync(file);
+    if (++entries > MAX_ENTRIES)
+      refuse("APP_BOUND", "App contains too many entries.");
+    if (stat.isSymbolicLink() || !stat.isDirectory() && !stat.isFile() || stat.isFile() && stat.nlink !== 1)
+      refuse("APP_TREE", "App entries must be regular files or directories; links and special files are refused.");
+    if ((stat.mode & 3602) !== 0)
+      refuse("APP_MODE", "App entries must not have special permission bits or be writable by other users.");
+    if (stat.isDirectory() && !stat.isSymbolicLink()) {
+      hash.update(JSON.stringify([relative, "directory", stat.mode & 511]) + `
+`);
+      for (const name of readdirSync(file).sort())
+        walk(relative ? `${relative}/${name}` : name);
+      return;
+    }
+    if (stat.size > MAX_BYTES || bytes + stat.size > MAX_BYTES)
+      refuse("APP_BOUND", "App exceeds the one GiB verification bound.");
+    const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+      const before = fstatSync(fd);
+      if (!before.isFile() || before.dev !== stat.dev || before.ino !== stat.ino || before.size !== stat.size)
+        refuse("APP_CHANGED", "App changed while being read.");
+      const fileHash = createHash("sha256"), buffer = Buffer.alloc(65536);
+      let read = 0;
+      while (read < stat.size) {
+        const count = readSync(fd, buffer, 0, Math.min(buffer.length, stat.size - read), null);
+        if (count === 0)
+          refuse("APP_CHANGED", "App changed while being read.");
+        fileHash.update(buffer.subarray(0, count));
+        read += count;
+      }
+      const after = fstatSync(fd);
+      if (after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs || after.mode !== before.mode || after.nlink !== 1)
+        refuse("APP_CHANGED", "App changed while being read.");
+      bytes += read;
+      hash.update(JSON.stringify([relative, "file", stat.mode & 511, read, fileHash.digest("hex")]) + `
+`);
+    } finally {
+      closeSync(fd);
+    }
+  }
+  walk("");
+  return { sha256: hash.digest("hex"), entries, bytes, format: TREE_FORMAT };
+}
+function copyMacAppIntoDirectory(source, directoryFd) {
+  if (!process.versions.bun)
+    refuse("BUN_REQUIRED", "Native app installation requires the Bun CLI runtime.");
+  const program = `import {dlopen,FFIType} from 'bun:ffi';
+import {execFileSync} from 'node:child_process';
+import {fstatSync} from 'node:fs';
+if(!fstatSync(3).isDirectory())throw Error('reserved directory unavailable');
+const native=dlopen('/usr/lib/libSystem.B.dylib',{fchdir:{args:[FFIType.i32],returns:FFIType.i32}});
+if(native.symbols.fchdir(3)!==0)throw Error('reserved directory unavailable');
+execFileSync('/bin/cp',['-pRn',process.argv.at(-1)+'/.','.'],{cwd:'.',stdio:['ignore','pipe','pipe'],timeout:60000,maxBuffer:1048576});`;
+  try {
+    execFileSync(process.execPath, ["--eval", program, "--", source], {
+      cwd: "/",
+      env: { PATH: "/usr/bin:/bin", HOME: "/var/empty", LANG: "C" },
+      stdio: ["ignore", "pipe", "pipe", directoryFd],
+      timeout: 65000,
+      maxBuffer: 1048576
+    });
+  } catch {
+    refuse("NATIVE_COPY_FAILED", "The reserved-directory copy failed. No fallback was attempted.");
+  }
+}
+function publishMacAppExclusively(source, destination) {
+  if (!process.versions.bun)
+    refuse("BUN_REQUIRED", "Native app installation requires the Bun CLI runtime.");
+  const program = `import {dlopen,FFIType,ptr} from 'bun:ffi';
+const native=dlopen('/usr/lib/libSystem.B.dylib',{renamex_np:{args:[FFIType.ptr,FFIType.ptr,FFIType.u32],returns:FFIType.i32}});
+const source=Buffer.from(process.argv.at(-2)+'\\0'),destination=Buffer.from(process.argv.at(-1)+'\\0');
+if(native.symbols.renamex_np(ptr(source),ptr(destination),4)!==0)process.exit(1);`;
+  try {
+    execFileSync(process.execPath, ["--eval", program, "--", source, destination], {
+      cwd: "/",
+      env: { PATH: "/usr/bin:/bin", HOME: "/var/empty", LANG: "C" },
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 1e4,
+      maxBuffer: 65536
+    });
+  } catch {
+    refuse("ATOMIC_PUBLISH_REFUSED", "The verified stage could not be published without replacement. Reconcile the retained stage and destination before retrying.");
+  }
+}
+var runtime = {
+  copy: copyMacAppIntoDirectory,
+  publish: publishMacAppExclusively,
+  platform: platform(),
+  architecture: arch() === "x64" ? "x86_64" : arch(),
+  appPath: APP_PATH,
+  run(command, args) {
+    try {
+      return execFileSync(command, args, { encoding: "utf8", timeout: command === "trash" ? 300000 : 60000, maxBuffer: 1048576, stdio: ["ignore", "pipe", "pipe"] }).trim();
+    } catch {
+      return refuse("NATIVE_COMMAND_FAILED", `The ${command === "trash" ? "Trash capture" : command.split("/").pop()} operation failed. No fallback was attempted.`);
+    }
+  }
+};
+function createMenubarManager(host = runtime) {
+  function mac() {
+    if (host.platform !== "darwin")
+      refuse("MACOS_REQUIRED", "The native menu-bar app requires macOS.");
+  }
+  function plist(path, key) {
+    return host.run("/usr/bin/plutil", ["-extract", key, "raw", "-o", "-", join(path, "Contents/Info.plist")]);
+  }
+  function quarantineFlags(path) {
+    const names = host.run("/usr/bin/xattr", [path]).split(`
+`);
+    if (!names.includes("com.apple.quarantine"))
+      return null;
+    const value = host.run("/usr/bin/xattr", ["-p", "com.apple.quarantine", path]);
+    const flags = /^([a-fA-F0-9]{1,4});/.exec(value);
+    if (!flags)
+      refuse("QUARANTINE_INVALID", "The app quarantine state could not be verified.");
+    return Number.parseInt(flags[1], 16);
+  }
+  function verify(path) {
+    mac();
+    const before = fingerprintMacApp(path);
+    if (plist(path, "CFBundleIdentifier") !== BUNDLE_ID || plist(path, "CFBundleExecutable") !== EXECUTABLE || plist(path, "CFBundleName") !== EXECUTABLE)
+      refuse("BUNDLE_IDENTITY", "Expected the HasnaEconomy release bundle.");
+    const version = plist(path, "CFBundleShortVersionString"), build = plist(path, "CFBundleVersion");
+    if (!/^\d+(?:\.\d+){1,2}$/.test(version) || !/^\d+(?:\.\d+){0,2}$/.test(build))
+      refuse("BUNDLE_VERSION", "Release version or build is invalid.");
+    if (!host.run("/usr/bin/lipo", ["-archs", join(path, "Contents/MacOS", EXECUTABLE)]).split(/\s+/).includes(host.architecture))
+      refuse("BUNDLE_ARCHITECTURE", "The app does not support this Mac architecture.");
+    host.run("/usr/bin/codesign", ["--verify", "--deep", "--strict", "-R", `anchor apple generic and certificate leaf[subject.OU] = "${TEAM_ID}" and identifier "${BUNDLE_ID}"`, path]);
+    host.run("/usr/sbin/spctl", ["--assess", "--type", "execute", path]);
+    const after = fingerprintMacApp(path);
+    if (before.sha256 !== after.sha256)
+      refuse("APP_CHANGED", "App changed during signature verification.");
+    return { path, bundle_id: BUNDLE_ID, version, build, team_id: TEAM_ID, architecture: host.architecture, root_mode: lstatSync(path).mode & 511, ...after };
+  }
+  function running() {
+    const result = host.run("/usr/bin/osascript", ["-l", "JavaScript", "-e", `Application(${JSON.stringify(host.appPath)}).running()`]);
+    if (result !== "true" && result !== "false")
+      refuse("RUNNING_STATE_UNKNOWN", "Could not determine whether HasnaEconomy is running.");
+    return result === "true";
+  }
+  return {
+    inspect(path) {
+      return { status: "verified", ...verify(path) };
+    },
+    install(options) {
+      mac();
+      if (!/^[a-f0-9]{64}$/.test(options.sha256 ?? "") || !/^\d+(?:\.\d+){1,2}$/.test(options.appVersion ?? ""))
+        refuse("RELEASE_SELECTION", "--app-version and a lowercase SHA-256 from the reviewed release are required.");
+      if (occupied(host.appPath))
+        refuse("DESTINATION_EXISTS", "HasnaEconomy.app already exists. Preserve it through Trash before an explicitly authorized replacement.");
+      const source = verify(options.app);
+      if (source.sha256 !== options.sha256 || source.version !== options.appVersion)
+        refuse("RELEASE_MISMATCH", "Selected app does not match the expected release version and content hash.");
+      const quarantine = quarantineFlags(options.app);
+      const parent = dirname(host.appPath), parentStat = lstatSync(parent);
+      if (!parentStat.isDirectory() || parentStat.isSymbolicLink() || realpathSync(parent) !== parent || (parentStat.mode & 2) !== 0)
+        refuse("DESTINATION_UNSAFE", "The installation parent must be a real, non-world-writable directory.");
+      const stage = mkdtempSync(join(parent, ".HasnaEconomy-install-"));
+      const reserved = lstatSync(stage);
+      let directoryFd, published = false;
+      try {
+        directoryFd = openSync(stage, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        const opened = fstatSync(directoryFd);
+        if (!opened.isDirectory() || opened.dev !== reserved.dev || opened.ino !== reserved.ino)
+          refuse("STAGE_CHANGED", "The private stage changed before copying.");
+        host.copy(options.app, directoryFd);
+        const copied = lstatSync(stage);
+        if (!copied.isDirectory() || copied.isSymbolicLink() || copied.dev !== reserved.dev || copied.ino !== reserved.ino)
+          refuse("STAGE_CHANGED", "The private stage changed during copying.");
+        const copiedQuarantine = quarantineFlags(stage);
+        if (quarantine !== null && (copiedQuarantine === null || (copiedQuarantine & quarantine) !== quarantine))
+          refuse("QUARANTINE_LOST", "The copied app lost quarantine protection.");
+        const prepared = verify(stage);
+        if (prepared.sha256 !== source.sha256 || fingerprintMacApp(options.app).sha256 !== source.sha256)
+          refuse("COPY_MISMATCH", "The source or staged bundle differs from the selected release.");
+        host.publish(stage, host.appPath);
+        published = true;
+        const installed = verify(host.appPath);
+        if (installed.sha256 !== source.sha256)
+          refuse("INSTALL_CHANGED", "The published bundle changed before final readback.");
+        return { status: "installed", launch_requested: false, ...installed };
+      } catch (error) {
+        const code = error instanceof Error ? error.message.split(":", 1)[0] : "UNKNOWN";
+        return refuse("INSTALL_INCOMPLETE", `Installation requires reconciliation (${code}). ${published ? "The published destination requires inspection." : `Inspect the retained staging bundle at ${stage}.`} Source is retained; nothing was removed or launched.`);
+      } finally {
+        if (directoryFd !== undefined)
+          closeSync(directoryFd);
+      }
+    },
+    start() {
+      const info = verify(host.appPath);
+      host.run("/usr/bin/open", [host.appPath]);
+      return { status: "launch_requested", ...info };
+    },
+    stop() {
+      mac();
+      if (!occupied(host.appPath))
+        return { status: "not_installed", path: host.appPath };
+      if (!running())
+        return { status: "not_running", path: host.appPath };
+      host.run("/usr/bin/osascript", ["-l", "JavaScript", "-e", `Application(${JSON.stringify(host.appPath)}).quit()`]);
+      return { status: "quit_requested", path: host.appPath };
+    },
+    uninstall() {
+      mac();
+      if (!occupied(host.appPath))
+        return { status: "not_installed", path: host.appPath };
+      if (running())
+        refuse("APP_RUNNING", "Quit HasnaEconomy explicitly before removing it. No process was signaled.");
+      const before = fingerprintMacApp(host.appPath);
+      const raw = host.run("trash", ["put", host.appPath]);
+      if (occupied(host.appPath))
+        refuse("TRASH_INCOMPLETE", "Trash did not remove the app. Source is retained; check trash pending before retrying.");
+      let entry;
+      try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed) && parsed.length === 1 && parsed[0] && typeof parsed[0] === "object") {
+          const id = parsed[0].id;
+          if (typeof id === "string" && /^[a-zA-Z0-9_-]{1,200}$/.test(id) && !("error" in parsed[0]))
+            entry = id;
+        }
+      } catch {}
+      if (!entry)
+        refuse("TRASH_RECEIPT_UNKNOWN", "The app path is gone but Trash returned no single valid recovery entry. Reconcile trash pending and the selected capture before any retry.");
+      return { status: "trashed", path: host.appPath, entry_id: entry, sha256: before.sha256 };
+    }
+  };
+}
+function output(value) {
+  console.log(JSON.stringify(value));
+}
+function menubarInspect(options) {
+  output(createMenubarManager().inspect(options.app));
+}
+async function menubarInstall(options) {
+  output(createMenubarManager().install(options));
+}
+function menubarStart() {
+  output(createMenubarManager().start());
+}
+function menubarStop() {
+  output(createMenubarManager().stop());
+}
+function menubarUninstall() {
+  output(createMenubarManager().uninstall());
+}
+export {
+  publishMacAppExclusively,
+  menubarUninstall,
+  menubarStop,
+  menubarStart,
+  menubarInstall,
+  menubarInspect,
+  fingerprintMacApp,
+  createMenubarManager,
+  copyMacAppIntoDirectory
+};

package/dist/chunks/open-projects-6z4pq6mx.js

@@ -0,0 +1,39 @@
+// @bun
+import {
+  upsertProject
+} from "./index-ez9thsr7.js";
+import"./index-p35cyhc4.js";
+
+// src/lib/open-projects.ts
+var resolveProjectPath = (project) => project.primary_path || project.path || "";
+var PROJECTS_MODULE = "@hasna/projects";
+async function syncOpenProjectsRegistry(db, listActiveProjects) {
+  let listProjects = listActiveProjects;
+  if (!listProjects) {
+    const projectsApi = await import(PROJECTS_MODULE);
+    listProjects = projectsApi.listProjects;
+  }
+  const projects = listProjects({ status: "active", limit: 5000 });
+  let imported = 0;
+  let skipped = 0;
+  for (const project of projects) {
+    const path = resolveProjectPath(project);
+    if (!path) {
+      skipped++;
+      continue;
+    }
+    upsertProject(db, {
+      id: project.id,
+      path,
+      name: project.name,
+      description: project.description,
+      tags: project.tags ?? [],
+      created_at: project.created_at
+    });
+    imported++;
+  }
+  return { imported, skipped };
+}
+export {
+  syncOpenProjectsRegistry
+};

package/dist/chunks/pricing-f80p81gr.js

@@ -0,0 +1,29 @@
+// @bun
+import {
+  DEFAULT_PRICING,
+  UnknownModelPricingError,
+  assessCostFromDb,
+  assessCostFromRows,
+  computeCost,
+  computeCostFromDb,
+  ensurePricingSeeded,
+  estimateCostFromRows,
+  getPricing,
+  getPricingFromDb,
+  getPricingFromRows,
+  normalizeModelName
+} from "./index-zpvea08j.js";
+export {
+  normalizeModelName,
+  getPricingFromRows,
+  getPricingFromDb,
+  getPricing,
+  estimateCostFromRows,
+  ensurePricingSeeded,
+  computeCostFromDb,
+  computeCost,
+  assessCostFromRows,
+  assessCostFromDb,
+  UnknownModelPricingError,
+  DEFAULT_PRICING
+};

package/dist/chunks/pricing-vf2pycmh.js

@@ -0,0 +1,30 @@
+// @bun
+import {
+  DEFAULT_PRICING,
+  UnknownModelPricingError,
+  assessCostFromDb,
+  assessCostFromRows,
+  computeCost,
+  computeCostFromDb,
+  ensurePricingSeeded,
+  estimateCostFromRows,
+  getPricing,
+  getPricingFromDb,
+  getPricingFromRows,
+  normalizeModelName
+} from "./index-2hwzmfgv.js";
+import"./index-p35cyhc4.js";
+export {
+  normalizeModelName,
+  getPricingFromRows,
+  getPricingFromDb,
+  getPricing,
+  estimateCostFromRows,
+  ensurePricingSeeded,
+  computeCostFromDb,
+  computeCost,
+  assessCostFromRows,
+  assessCostFromDb,
+  UnknownModelPricingError,
+  DEFAULT_PRICING
+};

package/dist/chunks/pricing-y21mcjsa.js

@@ -0,0 +1,30 @@
+// @bun
+import {
+  DEFAULT_PRICING,
+  UnknownModelPricingError,
+  assessCostFromDb,
+  assessCostFromRows,
+  computeCost,
+  computeCostFromDb,
+  ensurePricingSeeded,
+  estimateCostFromRows,
+  getPricing,
+  getPricingFromDb,
+  getPricingFromRows,
+  normalizeModelName
+} from "./index-ez9thsr7.js";
+import"./index-p35cyhc4.js";
+export {
+  normalizeModelName,
+  getPricingFromRows,
+  getPricingFromDb,
+  getPricing,
+  estimateCostFromRows,
+  ensurePricingSeeded,
+  computeCostFromDb,
+  computeCost,
+  assessCostFromRows,
+  assessCostFromDb,
+  UnknownModelPricingError,
+  DEFAULT_PRICING
+};