@hasna/economy 0.4.0 → 0.5.1

package/docs/ingestion.md

@@ -2,7 +2,39 @@
 
 `economy sync` imports local coding-agent usage into Economy's SQLite database. A sync with no source flag runs every source; one or more source flags limit the run. Reads such as `economy today` also auto-sync all local sources before querying.
 
-In cloud-client mode, CLI and MCP reads/writes go directly to the shared HTTP API. Local `sync` and `billing sync` deliberately do nothing in that mode; ingest on a machine running in local mode, or use the authenticated server ingest endpoints.
+In cloud-client mode, CLI and MCP reads/writes go directly to the shared HTTP API (on-box auto-sync is skipped). The explicit `economy sync` / `economy billing sync` verbs still run the same on-box provider ingest against a scratch store and push the rows to `/v1/ingest`.
+
+## Hosted batch integrity
+
+`POST /v1/ingest` accepts the supported table arrays, optional `schema_version: 1`
+and an `idempotency_key` of 1–200 letters, digits, dots, underscores, colons or
+hyphens. A command is limited to 10000 rows total and 4 MiB of JSON. The client
+splits large scans into deterministic commands of at most 500 rows; each command
+commits separately. All rows, session totals, predecessor snapshots and the
+receipt for one command share a transaction.
+
+Supply source `updated_at` values as ISO UTC timestamps ending in `Z`. An older
+version is skipped, while different content at the same version is a conflict.
+An unversioned row may be inserted or replayed, but cannot silently replace
+different existing content. The server does not treat arrival time as a source
+version. Session totals are derived from canonical request rows when present.
+Collectors use recorded source revisions or event times, never a fresh scan time
+as revision authority. A changed event without a newer source version conflicts;
+changing a file's mtime does not grant permission to replace accepted usage.
+
+The response's `data` contains `ingested`, `total`, `stale`, `unchanged`,
+`operation_key` and `replayed`. Reuse the **identical body and key** after an
+uncertain response: a committed command returns its original receipt. Reusing
+that key for different content returns 409. Keys are scoped to the authenticated
+principal. Legacy commands without a key derive one from their exact content.
+
+Invalid fields return 400, source/key conflicts return 409, and oversized
+commands return 413, with `code`, `field` and `expected` details. These are
+definitive refusals. A timeout or lost response has an uncertain outcome; the
+client never automatically repeats it. The authority-bound durable journal
+retains the exact intent and its committed receipt or proven terminal refusal.
+Use [journal status and reconciliation](ingest-journal.md) after an interruption;
+a newly reconstructed scan is not exact reconciliation of the previous command.
 
 ## Sources
 
@@ -16,11 +48,35 @@ In cloud-client mode, CLI and MCP reads/writes go directly to the shared HTTP AP
 | OpenCode | `~/.local/share/opencode/storage/message/**/*.json` | Imports assistant-message usage and uses the recorded cost when present. |
 | Cursor | Cursor `/api/usage` and `/api/usage-summary` | Requires `CURSOR_SESSION_TOKEN` (or `CURSOR_API_TOKEN`). Creates daily usage snapshots and a subscription rollup when spend is present. |
 | Pi | `~/.pi/agent/sessions/**/*.json` | Override with `PI_CODING_AGENT_SESSION_DIR`. Uses recorded turn cost; a missing cost remains zero until pricing is repaired or the source records one. |
-| Hermes | `~/.hermes/state.db` | Imports session-level token and cost rollups. |
-| OpenLoops | `~/.hasna/loops/loops.db` | Override with `HASNA_ECONOMY_LOOPS_DB_PATH`; price with `HASNA_ECONOMY_LOOPS_MODEL` or `ECONOMY_LOOPS_MODEL`. Imports orchestration/judge `goal_runs.tokens_used` only, into `loop:*` cost centers. |
+| Hermes | `~/.hermes/state.db` | Retains session lifetime totals and their actual start/end span. It cannot establish individual request times. |
+| OpenLoops | `~/.hasna/loops/loops.db` | **Local lane only** — a hosted client refuses this cross-app on-box read (`loops ingest skipped`, one stderr line); pending a hosted loops read. Override with `HASNA_ECONOMY_LOOPS_DB_PATH`; price with `HASNA_ECONOMY_LOOPS_MODEL` or `ECONOMY_LOOPS_MODEL`. Imports orchestration/judge `goal_runs.tokens_used` only, into `loop:*` cost centers. |
 
 Full, unfiltered sync also attempts to import active metadata from `@hasna/projects`. Missing files, optional registries, and unavailable quota credentials are skipped; use `--verbose` to see source-level diagnostics.
 
+Claude/Takumi, Gemini, Pi and OpenCode usage without a valid recorded event timestamp remains uncollected and
+reports `SOURCE_INVALID`, including on repeat scans. The original source stays
+intact. A file's modification time or the containing session's update time cannot
+date an otherwise undated request. Hermes lifetime-only usage reports `USAGE_EVENTS_UNAVAILABLE`; it creates
+no artificial end-date request. Summaries identify overlapping session-only
+lifetime totals separately and leave the complete period total unavailable.
+These values are not allocated to days or months. Existing Hermes rollup requests
+require a separately preserved historical migration and are not rewritten by sync.
+
+Ingestion treats subscriptions as `quota_observation` by default, preserving the
+existing assignment, active status, plan label and billing-cycle settings. Explicit
+subscription edits use `subscription_mode: "configuration"` with a subscriptions
+array; the normal subscription command supplies this mode. Both modes remain
+subject to the same source-version, current write-authority and receipt checks.
+Authenticated mutating API requests require `economy:write`; a read-only key
+cannot change subscription configuration or other stored settings.
+An explicit configuration replaces monetary values and their provenance, including
+unknown amounts. Omitting a fee on a plan change does not retain the previous plan's
+fee; the comparison stays unavailable until the new fee is known.
+Quota refreshes with unknown monetary amounts preserve a subscription's existing
+configured or observed fee and included value. A deliberate known zero must carry
+`configured` or `observed` provenance. A zero-priced request with no affirmative
+price evidence keeps both summaries and subscription comparisons unavailable.
+
 ## Incremental and repair behavior
 
 File/database state is cached in the `ingest_state` table, and request IDs are upserted and deduplicated. Consequently, normal repeated syncs are incremental.
@@ -32,7 +88,7 @@ File/database state is cached in the `ingest_state` table, and request IDs are u
 
 ## Account and cost-center attribution
 
-Economy first checks agent-specific overrides such as `ECONOMY_CODEX_ACCOUNT`, then generic `ECONOMY_ACCOUNT` overrides, then matching `@hasna/accounts` env-dir/applied/current profiles. An override may be `tool:name`, an email, or separate `*_ACCOUNT_TOOL`, `*_ACCOUNT_NAME`, and `*_ACCOUNT_EMAIL` fields. See [configuration](configuration.md#account-attribution).
+Economy first checks agent-specific overrides such as `ECONOMY_CODEX_ACCOUNT`, then generic `ECONOMY_ACCOUNT` overrides, then matching accounts env-dir/applied/current profiles from the accounts API. The on-box accounts registry (`~/.hasna/accounts/accounts.json`) is consulted **only** under the explicit local opt-in `HASNA_ECONOMY_LOCAL=1`; without an accounts credential and without that flag, attribution is omitted and the refusal is printed once on stderr. An override may be `tool:name`, an email, or separate `*_ACCOUNT_TOOL`, `*_ACCOUNT_NAME`, and `*_ACCOUNT_EMAIL` fields. See [configuration](configuration.md#account-attribution).
 
 Apps and services can report explicit project, repository, account, attribution-tag, and cost-center fields through [`economy-otel`](otel.md). `ECONOMY_TAG` supplies a fallback attribution tag for records written through the local database helpers.
 

package/docs/mcp.md

@@ -60,8 +60,8 @@ Shared agent lifecycle tools:
 
 - `register_agent`, `heartbeat`, `set_focus`, `list_agents`
 
-The agent registry behind these tools is opened on first use, never at startup. A hosted server (a resolved credential) keeps it in memory for the life of the process — no SQLite file is created under `~/.hasna/economy` in hosted mode; under the explicit local opt-in (`HASNA_ECONOMY_LOCAL=1`) it persists as `agent-registry.db` beside the local store and is shared by every MCP process on the box. `HASNA_AGENT_REGISTRY_DB_PATH` names a file explicitly in either lane.
+The agent registry behind these tools is opened on first use, never at startup — through a dynamic import, so the published `dist/mcp` bundle contains no `bun:sqlite` reference at all. A hosted server (a resolved credential) keeps it in memory for the life of the process — no SQLite file is created under `~/.hasna/economy` in hosted mode; under the explicit local opt-in (`HASNA_ECONOMY_LOCAL=1`) it persists as `agent-registry.db` beside the local store and is shared by every MCP process on the box. `HASNA_AGENT_REGISTRY_DB_PATH` overrides that file only in the explicit local lane; hosted transport ignores it and remains in memory.
 
 High-cardinality tools return compact text by default. Where the schema offers them, use `limit`, `verbose=true`, or `json=true`. Limits are clamped to 100 for MCP calls.
 
-The `sync` tool accepts `all`, any supported coding agent, or `loops`. It ingests on-box files (in local mode into the local SQLite; in cloud-client mode it reads the on-box files on this machine and pushes the rows to the shared API).
+The `sync` tool accepts `all`, any supported coding agent, or `loops`. It ingests on-box files (in local mode into the local SQLite; in cloud-client mode it reads the on-box files on this machine and pushes the rows to the shared API). `loops` is the exception: it reads ANOTHER app's on-box SQLite, so a hosted server refuses it and reports `loops ingest skipped`.

package/docs/native-budget-save.md

@@ -0,0 +1,84 @@
+# Native metered API budget rules
+
+The native Save action uses the existing authenticated `POST /v1/ingest` command
+and `GET /v1/ingest/receipts` recovery path. It creates one rule; it does not edit
+an existing rule, cap spending, or request notification delivery. Existing
+`POST /v1/budgets`, CLI `budget set` and MCP `set_budget` retain legacy semantics.
+
+Capture the rule ID, idempotency key and timestamps once when the user confirms.
+Keep the complete command unchanged until its outcome is resolved. For example:
+
+```json
+{
+  "schema_version": 1,
+  "idempotency_key": "budget-create-example-1",
+  "budget_mode": "create",
+  "budgets": [{
+    "id": "budget-example-1",
+    "metric": "metered_api_usd",
+    "period": "monthly",
+    "limit_usd": 50,
+    "alert_at_percent": 80,
+    "project_path": null,
+    "agent": null,
+    "created_at": "2026-09-30T12:00:00.000Z",
+    "updated_at": "2026-09-30T12:00:00.000Z"
+  }]
+}
+```
+
+Use fresh caller-owned UUIDs for real rule IDs and keys. The command requires
+schema version 1, the explicit create mode, exactly one rule and no other tables.
+Limits are positive finite USD values. Thresholds are integers from 1 through
+100. Periods are `daily`, `weekly`, or `monthly`. Omitted or null project, agent
+and cost-center fields mean all values; provided text cannot be empty. Agents
+must be members of Economy's published agent enum. Both timestamps are explicit
+ISO UTC instants ending in `Z` and are part of the exact retry intent.
+
+The transaction inserts the rule only when its ID is absent. Concurrent creation
+or another actor's use of the same ID cannot overwrite it. A committed identical
+command by the same authenticated actor returns the original receipt with
+`replayed: true`. Reusing a key for different content returns 409. A new key is
+not a way to edit an existing ID. Generic observation ingestion can recognize an
+exact unchanged new rule but cannot edit it or convert a legacy rule's metric.
+
+After a timeout or lost response, do not automatically create a new command. Read
+`/v1/ingest/receipts?idempotency_key=…&body_hash=…` using the same authenticated
+principal. `body_hash` is lowercase SHA-256 of `canonicalIngestBodyHash`'s stable
+JSON encoding: recursively sort object keys, retain array order and JSON scalar
+encoding. The hash includes the key, mode and all fields exactly as submitted.
+Keep the serialized command and its hash together. A committed receipt must
+match the principal and hash. `absent` is only a current observation; an earlier
+request may still commit. Explicit retry, if chosen, uses that same full body/key.
+Read-only or revoked principals cannot write or reconcile a write receipt.
+
+After confirmation, fetch `GET /v1/budgets` and show the matching ID and its
+authoritative threshold status. Do not label it saved merely because a request
+was sent or a matching-looking row was listed before the transaction.
+
+`metered_api_usd` sums stored requests whose `cost_basis` is exactly
+`metered_api`. It excludes `subscription_included`, `estimated`, `unknown`,
+subscription fees, quota values and separate provider billing rows. These are
+recorded API usage values, not a guarantee of complete collection or a reconciled
+provider invoice. Scope combines selected project, agent and cost center.
+The new metric sums the stored numbers' round-trip decimal representations and
+compares thresholds in decimal arithmetic. Fractional-cent API charges remain
+intact; neither individual charges nor the comparison are rounded to cents.
+The numeric display fields keep their existing JSON-number representation, while
+the alert and limit flags come from the exact comparison. A total or percentage
+outside that numeric display range fails visibly rather than reporting a false
+zero or serializing infinity as null. Legacy rules retain their previous sum.
+Thresholds are in-app status, not spending enforcement or guaranteed alerts.
+Creating or replaying this rule never invokes optional webhook delivery.
+
+Periods use the existing full UTC calendar windows. Days begin at 00:00 UTC,
+weeks begin on Sunday, and months begin on the first. Each budget status exposes
+`period_bounds` with `time_zone`, `start_date` and `end_date_exclusive`; display
+those semantics rather than interpreting the date in the device's timezone.
+
+The additive migration appends `budgets.metric` with default
+`legacy_request_cost_usd`. Existing rows and their request-cost sum behavior are
+preserved; historical migration bytes do not change. Apply the new migration
+through the reviewed deployment path before enabling the native Save action.
+This document and fixture results alone do not establish hosted activation,
+native human authentication, push delivery or production data changes.

package/docs/native-human-auth.md

@@ -0,0 +1,102 @@
+# Native human authentication
+
+This additive protocol leaves signed agent keys under their existing verifier.
+It does not activate human access by default. Deployment requires an operator to
+verify which tenant and human principals own the entire existing Economy report
+store. The store is not partitioned by the tenant in an incoming token.
+
+## Identity protocol
+
+The native client uses the existing Identities authority at
+`https://api.hasna.com/identities/v1`, with HTTPS and redirects disabled:
+
+1. `POST /auth/login` with `{ "email": "<human email>" }` requests an email code.
+   The response contains `challenge: true` and `expires_in`.
+2. `POST /auth/verify` with `{ "email": "<human email>", "code": "<code>" }`
+   returns `session`, `session_expires_in`,
+   `principal: { user_id, kind, email, display_name }` and
+   `tenants: [{ tenant_id, role }]`. Store the session in the platform credential
+   store. It is an Identities credential and must never be sent to Economy.
+3. Select an explicit tenant from the returned memberships. `POST /auth/token`
+   with that session in the Bearer header and body
+   `{ "app": "economy", "tenant_id": "<selected tenant>" }` returns
+   `access_token`, `token_type: "Bearer"`, `uid`, `tid`, `scope`, `expires_in`,
+   `aud: "economy"`, `pt: "user"`, `alg: "EdDSA"` and `kid`.
+   Omit `scopes` to receive current grants; never require write scope just to
+   sign in. Explicit scopes can only narrow access. Economy token TTL defaults
+   to 300 seconds, cannot exceed 300, and cannot outlive the session.
+4. Use the access token as Bearer at `https://api.hasna.com/economy/v1`.
+   `GET /auth/session` returns
+   `{ data: { subject, tenant_id, scopes, session_id, expires_at }, meta: {} }`.
+   `expires_at` is integer epoch seconds; `scopes` is the effective intersection
+   of current Identities grants and Economy's store binding. Hide write controls
+   unless it includes `economy:write`. Human report and session responses are
+   `Cache-Control: no-store`.
+5. Refresh by repeating step 3 while the session is valid. Stable account identity
+   is the verified `(tenant_id, subject)` pair, not token id or signing key.
+   Fence all pending requests when account, tenant or session changes. Do not
+   display a prior account's cached report after a change.
+6. Sign out locally first, cancelling requests and clearing session, access
+   token and account-scoped caches. Make one best-effort `POST /auth/logout` to
+   Identities using the previous session bearer. Success is
+   `{ "signed_out": true }`. This revokes only that session and its Economy
+   tokens. Report a failed remote sign-out accurately; other legacy app tokens
+   retain their existing semantics.
+
+This is the existing email-code protocol, not OAuth/PKCE. No browser callback,
+embedded station key, signup or new identity account is needed by the client.
+Clients bound request/response sizes and deadlines and never follow redirects
+while sending a credential. No token, code or raw auth response belongs in logs.
+
+## Economy store binding
+
+`ECONOMY_HUMAN_AUTH_BINDING` is non-secret server configuration:
+
+```json
+{
+  "tenantId": "<operator-verified data tenant>",
+  "principals": [
+    { "subject": "<verified human user id>", "scopes": ["economy:read"] }
+  ]
+}
+```
+
+These values must come from independently verified ownership and current grants;
+never populate them from the requesting token or an unverified native-client
+choice. Only the named tenant and principals are admitted. Add write scope only
+where the existing budget/configuration authority permits it. Agent permissions
+remain unchanged. Missing configuration returns `503 human_auth_not_configured`
+for human credentials while agent keys continue working. Malformed configuration
+refuses server startup.
+
+The server sends only the Economy access token to the fixed default endpoint
+`https://api.hasna.com/identities/v1/auth/economy-authority`. An explicit HTTPS
+`authorityUrl` permits a self-hosted authority with the same contract; it cannot
+contain credentials, query parameters or fragments. No response can select a
+different origin. Redirects are refused. Each authority call has a three-second
+deadline and a 16 KiB response cap; tokens are capped at 8 KiB. Failure is closed
+and redacted (`human_authority_unavailable`); no offline grant cache is used.
+
+Identities verifies the EdDSA signature, issuer `identities`, audience `economy`,
+300-second lifetime and signed session id, then checks the current session,
+human, tenant and membership together in one database statement. Only concrete
+read/write grants survive the role and explicit membership-scope ceiling.
+Economy intersects that response with its store binding. It checks at request
+admission and again after body reading/queue waiting immediately before dispatch.
+Actor identity uses the tenant and stable human subject across token refreshes.
+
+This establishes current authority at dispatch. It does not introduce a
+distributed transaction with Identities, undo already-started work on logout, or
+claim that a later revocation is observed at database commit. Native session
+generation fencing remains required for responses already in flight.
+
+## Verification and activation
+
+Package tests cover config refusal, stable actor, effective scopes, agent-key
+compatibility, changed authority before dispatch and bounded/redacted failures.
+The owning Identities fixture uses fresh PostgreSQL, real HTTP login/verification
+and signed tokens; the cross-app acceptance fixture also exercises actual TLS
+requests, foreign tenant/principal refusal, queued revocation and redirect
+refusal. These are source/fixture proofs. Live email delivery, existing human
+grants/store ownership, service releases and production activation are separate
+requirements. No production key or record is created by these source changes.

package/docs/postgresql-legacy-schema-repair.md

@@ -0,0 +1,30 @@
+# Legacy PostgreSQL cost-center schema repair
+
+Some existing databases record migrations 0–84 while missing `cost_centers`
+and the nullable `cost_center_id` columns on `requests`, `sessions` and
+`budgets`. Migration 102 requires those columns.
+
+The explicit `economy-serve migrate` command checks this known layout before
+running the numbered migrations. It adds the missing table, columns and four
+indexes using their unchanged original definitions. It does not infer cost
+center assignments, change existing row values or rewrite migration history.
+Fresh and already complete databases need no compatibility repair.
+
+The repair serializes with the existing migration runner. Its DDL and one
+`legacy-cost-centers-v1` receipt commit in one transaction. The receipt records
+the exact repair SQL hash. An existing receipt ledger must have the canonical
+permanent shape, with no triggers, rewrite rules or row security. A completed
+receipt with changed schema or hash is refused. Incompatible existing tables,
+columns or indexes are also refused without replacing them.
+
+Preserve and restore-test the database before using the normal deployment
+migration operation. Server startup does not run this repair. If a connection
+is lost during commit, keep the outcome uncertain and inspect the database
+before an explicit retry; the command never retries automatically. A subsequent
+invocation recognizes a committed matching receipt as `already_applied`.
+Numbered migrations retain their separate atomic completion markers.
+
+The migration JSON includes `repair.id`, `repair.status` and `repair.added`.
+Possible statuses are `not_needed`, `applied` and `already_applied`. Retain that
+result with the deployment and preservation records. Rolling application code
+back does not remove the added schema or repair receipt.

package/docs/rest-api.md

@@ -30,7 +30,7 @@ Authorization: Bearer <token>
 X-Economy-Token: <token>
 ```
 
-In self-hosted Postgres mode, send a valid Economy API key as `x-api-key` or a bearer token. All non-probe routes require a valid key when the server has an authenticator. Bulk ingest and feedback additionally request the `economy:write` scope.
+With a Postgres backend (database URL configured), send a valid Economy API key as `x-api-key` or a bearer token. All non-probe routes require a valid key when the server has an authenticator. Bulk ingest and feedback additionally request the `economy:write` scope.
 
 ## Read routes
 
@@ -83,7 +83,7 @@ Common period values are `today`, `yesterday`, `week`, `month`, `year`, and `all
 | `DELETE` | `/v1/project-registry/{path}` | Delete a URL-encoded project path. |
 | `POST` | `/v1/sync` | `{ "sources": "all" }` or one of the eight agents/`loops`; triggers server-local ingestion. |
 | `POST` | `/v1/billing/sync` | Optional `days` (1–366) and `providers` from `anthropic`, `openai`, `gemini`. Provider failures are returned per provider. |
-| `POST` | `/v1/ingest` | Idempotently merge arrays named `requests`, `sessions`, `projects`, `budgets`, `goals`, `billing_daily`, `model_pricing`, `subscriptions`, and `usage_snapshots`. |
+| `POST` | `/v1/ingest` | Atomically ingest versioned, bounded arrays named `requests`, `sessions`, `projects`, `budgets`, `goals`, `billing_daily`, `model_pricing`, `subscriptions`, and `usage_snapshots`. |
 | `POST` | `/v1/feedback` | Required `message`; optional `email` and `category=bug|feature|general`. |
 
 Agent fields accept `claude`, `takumi`, `codex`, `gemini`, `opencode`, `cursor`, `pi`, or `hermes`.

package/package.json

@@ -1,15 +1,16 @@
 {
   "name": "@hasna/economy",
-  "version": "0.4.0",
-  "description": "AI coding cost tracker \u2014 CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
+  "version": "0.5.1",
+  "description": "AI coding cost tracker — CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/hasna/economy.git"
+    "url": "https://github.com/hasna/apps.git",
+    "directory": "apps/economy"
   },
   "bugs": {
-    "url": "https://github.com/hasna/economy/issues"
+    "url": "https://github.com/hasna/apps/issues"
   },
-  "homepage": "https://github.com/hasna/economy#readme",
+  "homepage": "https://github.com/hasna/apps/tree/main/apps/economy#readme",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -38,14 +39,15 @@
     "CHANGELOG.md",
     "SECURITY.md",
     "CONTRIBUTING.md",
-    "CODE_OF_CONDUCT.md"
+    "CODE_OF_CONDUCT.md",
+    "!dist/lib/test-hermetic-*"
   ],
   "scripts": {
-    "build": "bun build src/cli/index.ts --outdir dist/cli --target bun --packages external && bun build src/mcp/index.ts --outdir dist/mcp --target bun --packages external && bun build src/server/index.ts --outdir dist/server --target bun --packages external && bun build src/db/pg-sync-worker.ts --outdir dist/server --target bun --packages external && bun build src/otel/index.ts --outdir dist/otel --target bun --packages external && bun build src/index.ts --outdir dist --target bun --packages external && tsc --emitDeclarationOnly --outDir dist",
-    "build:cli": "bun build src/cli/index.ts --outdir dist/cli --target bun --packages external",
-    "build:mcp": "bun build src/mcp/index.ts --outdir dist/mcp --target bun --packages external",
-    "build:server": "bun build src/server/index.ts --outdir dist/server --target bun --packages external",
-    "build:lib": "bun build src/index.ts --outdir dist --target bun --packages external",
+    "build": "bun build src/cli/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming \"chunks/[name]-[hash].[ext]\" && bun build src/mcp/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming \"chunks/[name]-[hash].[ext]\" && bun build src/server/index.ts --outdir dist/server --target bun --packages external && bun build src/db/pg-sync-worker.ts --outdir dist/server --target bun --packages external && bun build src/server/service-worker.ts --outdir dist/server --target bun --packages external && bun build src/otel/index.ts --outdir dist/otel --target bun --packages external && bun build src/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming \"chunks/[name]-[hash].[ext]\" && tsc --emitDeclarationOnly --outDir dist",
+    "build:cli": "bun build src/cli/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming \"chunks/[name]-[hash].[ext]\"",
+    "build:mcp": "bun build src/mcp/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming \"chunks/[name]-[hash].[ext]\"",
+    "build:server": "bun build src/server/index.ts --outdir dist/server --target bun --packages external && bun build src/db/pg-sync-worker.ts --outdir dist/server --target bun --packages external && bun build src/server/service-worker.ts --outdir dist/server --target bun --packages external",
+    "build:lib": "bun build src/index.ts --outdir dist --root src --target bun --packages external --splitting --chunk-naming \"chunks/[name]-[hash].[ext]\"",
     "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
     "prepack": "bun run build && bun run artifact-scan",
     "typecheck": "tsc --noEmit",
@@ -82,7 +84,8 @@
     "chalk": "^5.4.1",
     "commander": "^13.1.0",
     "pg": "8.13.1",
-    "zod": "^3.24.2"
+    "zod": "^3.24.2",
+    "@hasna/trash": "0.2.3"
   },
   "devDependencies": {
     "@types/bun": "1.3.14",
@@ -92,5 +95,14 @@
   },
   "trustedDependencies": [
     "@hasna/projects"
-  ]
+  ],
+  "overrides": {
+    "fast-uri": "3.1.8",
+    "hono": "4.13.7",
+    "ip-address": "10.7.1",
+    "nanoid": "5.1.16",
+    "path-to-regexp": "8.4.0",
+    "undici": "6.28.1",
+    "express-rate-limit": "8.7.0"
+  }
 }

package/dist/lib/test-hermetic-accounts.d.ts

@@ -1,7 +0,0 @@
-/**
- * Stash and delete the hosted-accounts env vars, and redirect the resolver's
- * disk root to an empty temp dir. Returns a restore function for
- * afterEach/afterAll. Safe to call when the variables are unset.
- */
-export declare function isolateHostedAccountsEnv(): () => void;
-//# sourceMappingURL=test-hermetic-accounts.d.ts.map

package/dist/lib/test-hermetic-accounts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"test-hermetic-accounts.d.ts","sourceRoot":"","sources":["../../src/lib/test-hermetic-accounts.ts"],"names":[],"mappings":"AAuBA;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,IAAI,CAgBrD"}

package/dist/lib/test-hermetic-fleet-env.d.ts

@@ -1,4 +0,0 @@
-export declare function hermeticFleetEnv(tempRoot: string, extra?: Record<string, string>): Record<string, string>;
-/** Every SQLite file — WAL/SHM/journal sidecars included — under a root. */
-export declare function sqliteFilesUnder(dir: string): string[];
-//# sourceMappingURL=test-hermetic-fleet-env.d.ts.map

package/dist/lib/test-hermetic-fleet-env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"test-hermetic-fleet-env.d.ts","sourceRoot":"","sources":["../../src/lib/test-hermetic-fleet-env.ts"],"names":[],"mappings":"AAcA,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmB7G;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAStD"}