@hasna/economy 0.4.0 → 0.5.1

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 0.5.1
+
+### Patch Changes
+
+- Update the hosted container to the pinned Alpine runtime and age-eligible security fixes, with exact standalone dependency overrides and reproducible lockfile resolution.
+- Repair missing legacy PostgreSQL cost-center schema during explicit migration, preserving original rows and migration history with an atomic, validated completion receipt.
+
+## 0.5.0
+
+### Minor Changes
+
+- Make PostgreSQL ingestion transactional, bounded and replay-safe. Preserve exact operation keys and unresolved client journals; verify receipts after a lost response instead of automatically sending the write again.
+- Separate recorded charges, known API-equivalent values, subscription fees and incomplete pricing or billing evidence. Reports carry explicit periods, account identity and completeness instead of implying unknown amounts are zero or paid usage is savings.
+- Preserve collector event, model, account and time provenance, and report scan freshness independently from the latest usage event.
+- Bound high-cardinality CLI and MCP collection output, with explicit complete responses where supported.
+- Add authenticated macOS and iPhone client source and release tooling in the repository, including searchable subscription reporting and recoverable API-cost alerts. Native applications are separate artifacts; this npm package does not install them.
+
+### Patch Changes
+
+- Add explicit historical-data inventory, planning, preservation, restore rehearsal, quarantine and rollback commands. Preserve original rows and immutable operation receipts; bind operations to the effective database target, retain locks through restoration checks, and refuse stale rollback after later activity. These commands do not automatically rewrite historical production data.
+- Commit each PostgreSQL migration and its ledger marker atomically on one connection, serialize runners for the same database/schema, and preserve explicit recovery after an interrupted attempt.
+- Keep HTTP requests responsive during database stalls through bounded asynchronous workers.
+- Keep hosted CLI and MCP clients from opening persistent local SQLite stores. Account attribution fails closed on configuration errors; hosted collection does not silently read another app's local store.
+- Add compact journal inspection and recovery controls. Completed journals and selected stopped native app artifacts are removed through Trash, with recovery identifiers retained.
+- Replace the retired Mac installer with explicit artifact verification, collision-safe installation and preserved quarantine.
+
+The older dashboard-removal and path-resolver Changesets are consumed here for
+release bookkeeping. The published 0.4.0 archive already excluded the dashboard
+and included the same postinstall path resolver; neither is a new data migration
+in 0.5.0.
+
 ## 0.4.0
 
 ### Minor Changes

package/README.md

@@ -118,7 +118,7 @@ economy sync --hermes
 economy sync --loops
 ```
 
-`economy sync --loops` reads the OpenLoops store (`~/.hasna/loops/loops.db` by default, resolved through the `@hasna/paths` XDG data home once the loops store has migrated there) in read-only mode and imports OpenLoops orchestration/judge `goal_runs.tokens_used` into `loop:*` cost centers. It intentionally does not ingest dispatched coding-agent work from loops; heavy agent spend remains captured by the existing per-agent ingesters and can be analyzed alongside loop cost centers through account/profile attribution.
+`economy sync --loops` reads the OpenLoops store (`~/.hasna/loops/loops.db` by default, resolved by the in-package resolver to the XDG data home once the loops store has migrated there) in read-only mode and imports OpenLoops orchestration/judge `goal_runs.tokens_used` into `loop:*` cost centers. **This cross-app on-box read runs only in the local lane.** A hosted client (a resolved economy credential) refuses it with one stderr line — another app's on-box SQLite is never fleet data — so hosted stations see `loops ingest skipped` until the read is served by the loops API. It intentionally does not ingest dispatched coding-agent work from loops; heavy agent spend remains captured by the existing per-agent ingesters and can be analyzed alongside loop cost centers through account/profile attribution.
 
 Useful repair options:
 
@@ -130,7 +130,7 @@ economy sync --backfill-machine
 
 Full sync also imports active project metadata from `@hasna/projects` when the registry is available. The Codex source reads both `~/.codex/state_5.sqlite` and the Codewith store at `~/.codewith/state_5.sqlite` by default; explicit `HASNA_ECONOMY_CODEX_DB_PATH` and `HASNA_ECONOMY_CODEWITH_DB_PATH` values override those locations.
 
-Account attribution is automatic when `@hasna/accounts` has a matching active, applied, or env-dir profile for the agent. Account identity is the email address plus coding agent, so `work@example.com` under Codex and Claude is reported as two accounts. You can also force attribution for a process with `ECONOMY_ACCOUNT=tool:name` or agent-specific overrides such as `ECONOMY_CODEX_ACCOUNT=codex:work`.
+Account attribution is automatic when the accounts API (`HASNA_ACCOUNTS_API_KEY`, the accounts credentials file, or the Keychain item `hasna.credentials.accounts.api-key`) resolves a matching active, applied, or env-dir profile for the agent. With **no** accounts credential the on-box registry `~/.hasna/accounts/accounts.json` is **not** read unless `HASNA_ECONOMY_LOCAL=1` is set: attribution is simply omitted, announced once on stderr, rather than filling hosted rows from an on-box file. Account identity is the email address plus coding agent, so `work@example.com` under Codex and Claude is reported as two accounts. You can also force attribution for a process with `ECONOMY_ACCOUNT=tool:name` or agent-specific overrides such as `ECONOMY_CODEX_ACCOUNT=codex:work`.
 
 Session drilldown can be scoped to an account key, account name, or email:
 
@@ -244,27 +244,30 @@ See the [REST API reference](docs/rest-api.md) for every route, response envelop
 
 ## Native macOS Menubar
 
-The `menubar/` app is a native SwiftUI `MenuBarExtra` app, not Electron. It targets Swift 5.9+ and macOS 14+, and talks to the REST API exposed by `economy-serve`. It shows today/week/month spend, token and request counts, top agents, top accounts, top projects, active subscription plans, subscription savings, multi-agent usage snapshots, recent sessions, and fleet status. The default server URL is `http://127.0.0.1:3456`.
+HasnaEconomy is a native SwiftUI menu-bar app for macOS 14 and later, with an iPhone companion. The rebuilt clients use `https://api.hasna.com/economy/v1`; usage allowances, metered API costs, reported provider charges and subscription fees stay separate. Native source and build instructions are in `native/`. The old `menubar/Sources` implementation is retained as historical source and is not the rebuilt release.
 
-Build it on macOS:
+An agent installs a reviewed, signed and notarized release artifact. First obtain `HasnaEconomy.app` and its release receipt through the approved artifact delivery channel, then inspect it:
 
 ```bash
-cd menubar
-swift build -c release
+economy menubar inspect --app /absolute/path/HasnaEconomy.app
 ```
 
-Release app helpers:
+`inspect` reports a portable `hasna-economy-app-tree-v1` SHA-256 covering relative paths, entry kinds, permissions and file contents. Compare that digest and version with the release receipt. Installation requires those exact values:
 
 ```bash
-economy menubar install
+economy menubar install --app /absolute/path/HasnaEconomy.app --app-version <reviewed-version> --sha256 <release-receipt-sha256>
 economy menubar start
 economy menubar stop
 economy menubar uninstall
 ```
 
+The destination is `/Applications/HasnaEconomy.app`. The CLI verifies the bundle identifier, executable, version, architecture, Hasna Developer ID signature and macOS execution assessment before installation, then verifies a private staging bundle and retained source before atomically publishing without replacement and reading the installed bundle back. It preserves quarantine and extended attributes. It refuses occupied destinations, including empty directories and dangling symlinks; there is no overwrite flag or automatic quit. A failed copy leaves its private staging bundle for explicit reconciliation through Trash. A destination that appears during installation is preserved; it is never used as a copy target. Installation does not launch the app. `start` reports a launch request, which is not proof of a working menu or authenticated session.
+
+`uninstall` requires the app to be stopped and invokes the installed Trash client with its own station credentials and identity. It never falls back to direct deletion. Check `trash pending` after an uncertain capture and use the returned entry ID for recovery. The legacy `/Applications/Economy Bar.app` is not changed by these commands. Source builds and fixture captures are not signed distribution artifacts or evidence of a hosted installation.
+
 ## Data Directory
 
-Data is stored under a single data root resolved through the `@hasna/paths` resolver (XDG/macOS home layout). The legacy `~/.hasna/economy/` stays the effective root until the store is actually migrated to the XDG data home or the operator sets the data-kind override `HASNA_DATA_HOME`; the exact-app overrides `HASNA_ECONOMY_HOME` / `ECONOMY_HOME` win unconditionally.
+Data is stored under a single data root resolved by the in-package resolver (XDG/macOS home layout). The legacy `~/.hasna/economy/` stays the effective root until the store is actually migrated to the XDG data home or the operator sets the data-kind override `HASNA_DATA_HOME`; the exact-app overrides `HASNA_ECONOMY_HOME` / `ECONOMY_HOME` win unconditionally.
 
 The main SQLite database lives at `<data-root>/economy.db` (`~/.hasna/economy/economy.db` by default). Older `~/.economy/` data is copied on first open when the new directory does not exist. Override the database path with `HASNA_ECONOMY_DB_PATH` or `ECONOMY_DB`.
 

package/dist/chunks/agent-registry-store-tpnhx3wj.js

@@ -0,0 +1,39 @@
+// @bun
+import"./index-p35cyhc4.js";
+
+// src/mcp/agent-registry-store.ts
+import { Database } from "bun:sqlite";
+import { dirname } from "path";
+import { existsSync, mkdirSync } from "fs";
+var MEMORY_REGISTRY_PATH = ":memory:";
+
+class RegistryDb {
+  db;
+  constructor(path) {
+    if (path !== MEMORY_REGISTRY_PATH && dirname(path) && !existsSync(dirname(path))) {
+      mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    }
+    this.db = new Database(path);
+    this.db.exec("PRAGMA journal_mode = WAL");
+    this.db.exec("PRAGMA busy_timeout = 10000");
+  }
+  get(sql, ...params) {
+    return this.db.prepare(sql).get(...params);
+  }
+  all(sql, ...params) {
+    return this.db.prepare(sql).all(...params);
+  }
+  run(sql, ...params) {
+    return this.db.prepare(sql).run(...params);
+  }
+  exec(sql) {
+    this.db.exec(sql);
+  }
+  close() {
+    this.db.close();
+  }
+}
+export {
+  RegistryDb,
+  MEMORY_REGISTRY_PATH
+};

package/dist/chunks/billing-bkpxy4kv.js

@@ -0,0 +1,13 @@
+// @bun
+import {
+  syncAnthropicBilling,
+  syncGeminiBilling,
+  syncOpenAIBilling
+} from "./index-k540hfww.js";
+import"./index-ez9thsr7.js";
+import"./index-p35cyhc4.js";
+export {
+  syncOpenAIBilling,
+  syncGeminiBilling,
+  syncAnthropicBilling
+};

package/dist/chunks/config-j9mv3ehk.js

@@ -0,0 +1,15 @@
+// @bun
+import {
+  getConfigValue,
+  loadConfig,
+  saveConfig,
+  setConfigValue
+} from "./index-hesxq90g.js";
+import"./index-ez9thsr7.js";
+import"./index-p35cyhc4.js";
+export {
+  setConfigValue,
+  saveConfig,
+  loadConfig,
+  getConfigValue
+};