@hasna/economy 0.5.0 → 0.5.2

package/dist/server/index.js

@@ -3360,6 +3360,30 @@ function resolvePgConnection(dsn) {
 }
 var init_pg_connection = () => {};
 
+// src/db/legacy-large-schema.ts
+var LEGACY_LARGE_SESSION_PG_SQL = `
+CREATE INDEX idx_legacy_targets_session_operation
+  ON legacy_reconciliation_targets(session_id,operation_key);
+CREATE OR REPLACE FUNCTION economy_legacy_target_guard() RETURNS trigger LANGUAGE plpgsql AS $body$
+BEGIN
+  IF EXISTS(
+    SELECT 1 FROM (SELECT DISTINCT session_id,operation_key FROM inserted_legacy_targets) n
+    JOIN economy_legacy_active a ON a.session_id=n.session_id AND a.operation_key<>n.operation_key
+  ) OR EXISTS(
+    SELECT 1 FROM inserted_legacy_targets n
+    JOIN economy_legacy_active a ON a.request_id=n.request_id AND a.operation_key<>n.operation_key
+  ) THEN
+    RAISE EXCEPTION 'legacy reconciliation is already active for this session' USING ERRCODE='23000';
+  END IF;
+  RETURN NULL;
+END
+$body$;
+DROP TRIGGER legacy_target_no_overlap ON legacy_reconciliation_targets;
+CREATE TRIGGER legacy_target_no_overlap AFTER INSERT ON legacy_reconciliation_targets
+  REFERENCING NEW TABLE AS inserted_legacy_targets
+  FOR EACH STATEMENT EXECUTE FUNCTION economy_legacy_target_guard();
+`;
+
 // src/db/pg-migrations.ts
 var PG_MIGRATIONS;
 var init_pg_migrations = __esm(() => {
@@ -3595,7 +3619,8 @@ var init_pg_migrations = __esm(() => {
     ...OBSERVATION_PG_MIGRATIONS,
     `ALTER TABLE budgets ADD COLUMN IF NOT EXISTS metric TEXT NOT NULL DEFAULT 'legacy_request_cost_usd'
     CHECK (metric IN ('legacy_request_cost_usd', 'metered_api_usd'))`,
-    LEGACY_PG_SQL
+    LEGACY_PG_SQL,
+    LEGACY_LARGE_SESSION_PG_SQL
   ];
 });
 
@@ -4164,6 +4189,208 @@ var init_pg_migrate = __esm(() => {
   init_pg_connection();
 });
 
+// src/db/pg-legacy-schema.ts
+var exports_pg_legacy_schema = {};
+__export(exports_pg_legacy_schema, {
+  repairLegacyCostCenterSchema: () => repairLegacyCostCenterSchema
+});
+import { createHash as createHash5 } from "crypto";
+import pg4 from "pg";
+async function assertReceiptTable(client, schema) {
+  await client.query("LOCK TABLE " + quote2(schema) + ".economy_schema_repairs IN SHARE ROW EXCLUSIVE MODE");
+  const shape = await relation(client, schema, "economy_schema_repairs");
+  if (!shape || shape.columns.length !== 3 || !checkColumn("economy_schema_repairs", shape.columns.find((c) => c.name === "id"), true) || !checkColumn("economy_schema_repairs", shape.columns.find((c) => c.name === "sql_sha256"), true)) {
+    throw Error("LEGACY_SCHEMA_INCOMPATIBLE: unexpected repair ledger columns");
+  }
+  const completed = shape.columns.find((c) => c.name === "completed_at");
+  if (!completed || completed.type !== "timestamp with time zone" || !completed.required || completed.generated || completed.identity) {
+    throw Error("LEGACY_SCHEMA_INCOMPATIBLE: unexpected repair ledger timestamp");
+  }
+  const meta = await client.query(`
+    SELECT c.relpersistence='p' AND NOT c.relrowsecurity AND NOT c.relforcerowsecurity
+      AND NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid=c.oid AND NOT tgisinternal)
+      AND NOT EXISTS (SELECT 1 FROM pg_rewrite WHERE ev_class=c.oid)
+      AND NOT EXISTS (SELECT 1 FROM pg_inherits WHERE inhrelid=c.oid OR inhparent=c.oid)
+      AND NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conrelid=c.oid AND (contype<>'p' OR condeferrable))
+      AS ordinary,
+      ARRAY(SELECT a.attname::text FROM pg_index i
+        CROSS JOIN LATERAL unnest(i.indkey) WITH ORDINALITY k(attnum,ordinality)
+        JOIN pg_attribute a ON a.attrelid=c.oid AND a.attnum=k.attnum
+        WHERE i.indrelid=c.oid AND i.indisprimary AND i.indisvalid AND i.indisready
+        ORDER BY k.ordinality) AS primary_columns,
+      (SELECT pg_get_expr(d.adbin,d.adrelid) FROM pg_attrdef d JOIN pg_attribute a
+        ON a.attrelid=d.adrelid AND a.attnum=d.adnum
+        WHERE d.adrelid=c.oid AND a.attname='completed_at') AS clock_default
+    FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace
+    WHERE n.nspname=$1 AND c.relname='economy_schema_repairs'`, [schema]);
+  const row = meta.rows[0];
+  if (!row?.ordinary || JSON.stringify(row.primary_columns) !== '["id"]' || row.clock_default !== "clock_timestamp()") {
+    throw Error("LEGACY_SCHEMA_INCOMPATIBLE: unexpected repair ledger behavior");
+  }
+}
+async function relation(client, schema, name) {
+  const result = await client.query(`
+    SELECT c.relkind AS kind, a.attname AS name, a.atttypid::regtype::text AS type,
+           a.attnotnull AS required, a.attgenerated AS generated, a.attidentity AS identity
+    FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace
+    LEFT JOIN pg_attribute a ON a.attrelid=c.oid AND a.attnum>0 AND NOT a.attisdropped
+    WHERE n.nspname=$1 AND c.relname=$2 ORDER BY a.attnum`, [schema, name]);
+  if (!result.rows.length)
+    return null;
+  if (result.rows[0].kind !== "r")
+    throw Error("LEGACY_SCHEMA_INCOMPATIBLE: expected ordinary table " + name);
+  return { kind: result.rows[0].kind, columns: result.rows.filter((row) => row.name) };
+}
+function checkColumn(table, actual, required3) {
+  if (!actual)
+    return false;
+  if (actual.type !== "text" || actual.required !== required3 || actual.generated || actual.identity) {
+    throw Error("LEGACY_SCHEMA_INCOMPATIBLE: unexpected column " + table + "." + actual.name);
+  }
+  return true;
+}
+async function missingStructure(client, schema) {
+  const missing = [];
+  for (const table of ["requests", "sessions", "budgets"]) {
+    const found = await relation(client, schema, table);
+    if (!found)
+      throw Error("LEGACY_SCHEMA_INCOMPATIBLE: missing core table " + table);
+    if (!checkColumn(table, found.columns.find((column) => column.name === "cost_center_id"), false)) {
+      missing.push(table + ".cost_center_id");
+    }
+  }
+  const centers = await relation(client, schema, "cost_centers");
+  if (!centers)
+    missing.push("cost_centers");
+  else {
+    for (const [name, required3] of [
+      ["id", true],
+      ["kind", true],
+      ["name", true],
+      ["repo_path", false],
+      ["labels_json", false],
+      ["created_at", true],
+      ["updated_at", true]
+    ]) {
+      if (!checkColumn("cost_centers", centers.columns.find((column) => column.name === name), required3)) {
+        throw Error("LEGACY_SCHEMA_INCOMPATIBLE: incomplete cost_centers table");
+      }
+    }
+    const primary = await client.query(`
+      SELECT array_agg(a.attname::text ORDER BY k.ordinality) AS columns
+      FROM pg_index i JOIN pg_class c ON c.oid=i.indrelid JOIN pg_namespace n ON n.oid=c.relnamespace
+      CROSS JOIN LATERAL unnest(i.indkey) WITH ORDINALITY k(attnum,ordinality)
+      JOIN pg_attribute a ON a.attrelid=c.oid AND a.attnum=k.attnum
+      WHERE n.nspname=$1 AND c.relname='cost_centers' AND i.indisprimary
+      GROUP BY i.indexrelid`, [schema]);
+    if (JSON.stringify(primary.rows.map((row) => row.columns)) !== '[["id"]]') {
+      throw Error("LEGACY_SCHEMA_INCOMPATIBLE: unexpected cost_centers primary key");
+    }
+  }
+  for (const [name, table, column] of INDEXES) {
+    const result = await client.query(`
+      SELECT t.relname AS table_name, am.amname AS method,
+             i.indisunique AS unique, i.indisvalid AS valid, i.indisready AS ready,
+             i.indpred IS NULL AS unfiltered, i.indexprs IS NULL AS simple,
+             i.indnatts=i.indnkeyatts AS no_includes,
+             ARRAY(SELECT a.attname::text FROM unnest(i.indkey) WITH ORDINALITY k(attnum,ordinality)
+                   JOIN pg_attribute a ON a.attrelid=t.oid AND a.attnum=k.attnum
+                   ORDER BY k.ordinality) AS columns
+      FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace
+      LEFT JOIN pg_index i ON i.indexrelid=c.oid LEFT JOIN pg_class t ON t.oid=i.indrelid
+      LEFT JOIN pg_am am ON am.oid=c.relam WHERE n.nspname=$1 AND c.relname=$2`, [schema, name]);
+    if (!result.rows.length) {
+      missing.push(name);
+      continue;
+    }
+    const actual = result.rows[0];
+    if (actual.table_name !== table || actual.method !== "btree" || actual.unique || !actual.valid || !actual.ready || !actual.unfiltered || !actual.simple || !actual.no_includes || JSON.stringify(actual.columns) !== JSON.stringify([column])) {
+      throw Error("LEGACY_SCHEMA_INCOMPATIBLE: unexpected index " + name);
+    }
+  }
+  return missing;
+}
+async function repairLegacyCostCenterSchema(dsn) {
+  const result = { id: REPAIR_ID, status: "not_needed", added: [] };
+  const pool = new pg4.Pool({ ...resolvePgConnection(dsn), max: 1, connectionTimeoutMillis: 1e4 });
+  pool.on("error", () => {});
+  let client;
+  try {
+    client = await pool.connect();
+    client.on("error", () => {});
+    await client.query("SET statement_timeout='15min'; SET lock_timeout='15s'");
+    await client.query("SELECT pg_advisory_lock(hashtext('economy.pg-migrations.v1'), hashtext(current_database() || ':' || current_schema()))");
+    const schema = (await client.query("SELECT current_schema() AS name")).rows[0]?.name;
+    if (typeof schema !== "string" || !schema)
+      throw Error("LEGACY_SCHEMA_INCOMPATIBLE: missing migration schema");
+    const ledger = await relation(client, schema, "_pg_migrations");
+    if (!ledger)
+      return result;
+    const history = await client.query("SELECT version FROM " + quote2(schema) + "._pg_migrations WHERE version>=0 AND version<85 ORDER BY version");
+    if (history.rows.length !== 85 || history.rows.some((row, index) => row.version !== index)) {
+      return result;
+    }
+    await client.query("BEGIN");
+    try {
+      await client.query("SELECT set_config('search_path', $1, true)", [quote2(schema)]);
+      const missing = await missingStructure(client, schema);
+      const receiptTable = await relation(client, schema, "economy_schema_repairs");
+      if (receiptTable) {
+        await assertReceiptTable(client, schema);
+        const receipt = await client.query("SELECT sql_sha256 FROM economy_schema_repairs WHERE id=$1", [REPAIR_ID]);
+        if (receipt.rows.length) {
+          if (receipt.rows.length !== 1 || receipt.rows[0].sql_sha256 !== REPAIR_HASH || missing.length) {
+            throw Error("LEGACY_SCHEMA_INCOMPATIBLE: completed repair receipt or schema has changed");
+          }
+          await client.query("COMMIT");
+          return { ...result, status: "already_applied" };
+        }
+      }
+      if (!missing.length) {
+        await client.query("COMMIT");
+        return result;
+      }
+      await client.query(`CREATE TABLE IF NOT EXISTS economy_schema_repairs (
+        id TEXT PRIMARY KEY, sql_sha256 TEXT NOT NULL,
+        completed_at TIMESTAMPTZ NOT NULL DEFAULT pg_catalog.clock_timestamp()
+      )`);
+      await assertReceiptTable(client, schema);
+      for (const sql of REPAIR_SQL)
+        await client.query(sql);
+      if ((await missingStructure(client, schema)).length)
+        throw Error("LEGACY_SCHEMA_INCOMPATIBLE: repair postcondition failed");
+      const inserted = await client.query("INSERT INTO economy_schema_repairs (id,sql_sha256) VALUES ($1,$2) RETURNING id,sql_sha256", [REPAIR_ID, REPAIR_HASH]);
+      const readback = await client.query("SELECT id,sql_sha256 FROM economy_schema_repairs WHERE id=$1", [REPAIR_ID]);
+      for (const receipt of [inserted, readback]) {
+        if (receipt.rowCount !== 1 || receipt.rows[0]?.id !== REPAIR_ID || receipt.rows[0]?.sql_sha256 !== REPAIR_HASH) {
+          throw Error("LEGACY_SCHEMA_INCOMPATIBLE: repair receipt readback failed");
+        }
+      }
+      await client.query("COMMIT");
+      return { id: REPAIR_ID, status: "applied", added: missing };
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => {});
+      throw error;
+    }
+  } finally {
+    client?.release();
+    await pool.end().catch(() => {});
+  }
+}
+var REPAIR_ID = "legacy-cost-centers-v1", REPAIR_SQL, REPAIR_HASH, INDEXES, quote2 = (name) => '"' + name.replaceAll('"', '""') + '"';
+var init_pg_legacy_schema = __esm(() => {
+  init_pg_connection();
+  init_pg_migrations();
+  REPAIR_SQL = [0, 38, 47, 48, 15, 54, 55, 56].map((index) => PG_MIGRATIONS[index]);
+  REPAIR_HASH = createHash5("sha256").update(JSON.stringify(REPAIR_SQL)).digest("hex");
+  INDEXES = [
+    ["idx_cost_centers_kind", "cost_centers", "kind"],
+    ["idx_requests_cost_center", "requests", "cost_center_id"],
+    ["idx_sessions_cost_center", "sessions", "cost_center_id"],
+    ["idx_budgets_cost_center", "budgets", "cost_center_id"]
+  ];
+});
+
 // src/server/legacy-inventory.ts
 var exports_legacy_inventory = {};
 __export(exports_legacy_inventory, {
@@ -4306,6 +4533,42 @@ var init_legacy_inventory = __esm(() => {
   allCandidates = LEGACY_FAMILIES.map((family) => `(${predicates[family]})`).join(" OR ");
 });
 
+// src/server/legacy-limits.ts
+function legacyMode(kind, schema) {
+  if (schema === LEGACY_STANDARD[kind])
+    return LEGACY_STANDARD;
+  if (schema === LEGACY_SINGLE_SESSION[kind])
+    return LEGACY_SINGLE_SESSION;
+  throw Error(`Unsupported legacy ${kind} schema`);
+}
+var LEGACY_STANDARD, LEGACY_SINGLE_SESSION;
+var init_legacy_limits = __esm(() => {
+  LEGACY_STANDARD = {
+    selection: "economy.legacy-selection.v1",
+    plan: "economy.legacy-plan.v1",
+    capsule: "economy.legacy-preservation.v1",
+    receipt: "economy.legacy-operation-receipt.v1",
+    items: 100,
+    sessions: 100,
+    members: 1e4,
+    inputBytes: 256 * 1024,
+    originalBytes: 16 * 1024 * 1024,
+    capsuleBytes: 32 * 1024 * 1024
+  };
+  LEGACY_SINGLE_SESSION = {
+    selection: "economy.legacy-session-selection.v1",
+    plan: "economy.legacy-session-plan.v1",
+    capsule: "economy.legacy-session-preservation.v1",
+    receipt: "economy.legacy-session-operation-receipt.v1",
+    items: 50000,
+    sessions: 1,
+    members: 50000,
+    inputBytes: 32 * 1024 * 1024,
+    originalBytes: 64 * 1024 * 1024,
+    capsuleBytes: 128 * 1024 * 1024
+  };
+});
+
 // src/server/legacy-plan.ts
 var exports_legacy_plan = {};
 __export(exports_legacy_plan, {
@@ -4316,7 +4579,7 @@ __export(exports_legacy_plan, {
   parseLegacySelection: () => parseLegacySelection,
   parseLegacyPlanOptions: () => parseLegacyPlanOptions
 });
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { closeSync, constants, fstatSync, openSync, readSync } from "fs";
 import { isAbsolute } from "path";
 function object(value, fields, label) {
@@ -4341,10 +4604,11 @@ function digest2(value) {
 }
 function parseLegacySelection(value) {
   const input = object(value, ["schema", "items"], "selection");
-  if (input.schema !== "economy.legacy-selection.v1")
-    throw Error("schema must be economy.legacy-selection.v1");
-  if (!Array.isArray(input.items) || input.items.length < 1 || input.items.length > 100)
-    throw Error("items must contain 1-100 explicit request selections");
+  const mode = legacyMode("selection", input.schema);
+  if (!Array.isArray(input.items) || input.items.length < 1 || input.items.length > mode.items)
+    throw Error(`items must contain 1-${mode.items} explicit request selections`);
+  if (Buffer.byteLength(JSON.stringify(input)) > mode.inputBytes)
+    throw Error(`Selection exceeds its ${mode.inputBytes}-byte artifact bound`);
   const ids = new Set;
   const items = input.items.map((item) => {
     const row = object(item, ["id", "family", "original_sha256", "disposition", "reason", "evidence_ref"], "item");
@@ -4367,7 +4631,7 @@ function parseLegacySelection(value) {
       evidence_ref: text(row.evidence_ref, 512, "evidence_ref")
     };
   }).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
-  return { schema: "economy.legacy-selection.v1", items };
+  return { schema: mode.selection, items };
 }
 function readLegacySelectionFile(path) {
   if (!isAbsolute(path) || path.includes("\x00"))
@@ -4380,9 +4644,10 @@ function readLegacySelectionFile(path) {
   }
   try {
     const before = fstatSync(fd);
+    const sizeError = "--input must be a regular JSON file of 1-262144 bytes for standard selection, or at most 33554432 bytes for explicit single-session selection";
     if (!before.isFile() || before.size < 1 || before.size > INPUT_MAX)
-      throw Error("--input must be a regular JSON file of 1-262144 bytes");
-    const bytes = Buffer.alloc(INPUT_MAX + 1);
+      throw Error(sizeError);
+    const bytes = Buffer.alloc(Math.min(INPUT_MAX + 1, before.size + 1));
     let offset = 0, n;
     while (offset < bytes.length && (n = readSync(fd, bytes, offset, bytes.length - offset, null)) > 0)
       offset += n;
@@ -4393,9 +4658,12 @@ function readLegacySelectionFile(path) {
     try {
       value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, offset)));
     } catch {
-      throw Error("--input must contain valid UTF-8 JSON");
+      throw Error(before.size > LEGACY_STANDARD.inputBytes ? sizeError : "--input must contain valid UTF-8 JSON");
     }
-    return parseLegacySelection(value);
+    const selection = parseLegacySelection(value);
+    if (offset > legacyMode("selection", selection.schema).inputBytes)
+      throw Error(sizeError);
+    return selection;
   } finally {
     closeSync(fd);
   }
@@ -4410,6 +4678,7 @@ async function prepareLegacyPlan(client, input) {
 }
 async function withLegacyPlanSnapshot(client, input, read) {
   const selection = parseLegacySelection(input);
+  const mode = legacyMode("selection", selection.schema);
   let began = false;
   try {
     await client.query("BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY");
@@ -4444,14 +4713,16 @@ async function withLegacyPlanSnapshot(client, input, read) {
       return { ...item, session_id: identifier2(row.session_id, "session_id") };
     });
     const sessionIds = [...new Set(items.map((x) => x.session_id))].sort();
+    if (mode.sessions === 1 && sessionIds.length !== 1)
+      throw Error("Single-session reconciliation requires exactly one session");
     const sessions = (await client.query(`SELECT id, encode(sha256(convert_to(row_to_json(sessions)::text,'UTF8')),'hex') AS original_sha256
       FROM sessions WHERE id=ANY($1::text[]) ORDER BY id`, [sessionIds])).rows;
     if (sessions.length !== sessionIds.length)
       throw Error("A selected request has no session; resolve that inconsistency before reconciliation");
     const members = (await client.query(`SELECT id, session_id, encode(sha256(convert_to(row_to_json(requests)::text,'UTF8')),'hex') AS original_sha256
-      FROM requests WHERE session_id=ANY($1::text[]) ORDER BY session_id COLLATE "C", id COLLATE "C" LIMIT ${MEMBERS_MAX + 1}`, [sessionIds])).rows;
-    if (members.length > MEMBERS_MAX)
-      throw Error("Selected sessions exceed 10000 requests; split the selection by session or use a separately reviewed large-session procedure");
+      FROM requests WHERE session_id=ANY($1::text[]) ORDER BY session_id COLLATE "C", id COLLATE "C" LIMIT ${mode.members + 1}`, [sessionIds])).rows;
+    if (members.length > mode.members)
+      throw Error(`Selected sessions exceed ${mode.members} requests; complete-session reconciliation cannot truncate membership`);
     const populations = sessions.map((session) => {
       const rows = members.filter((row) => row.session_id === session.id);
       if (!rows.length)
@@ -4461,7 +4732,7 @@ async function withLegacyPlanSnapshot(client, input, read) {
       return { id: session.id, original_sha256, request_count: rows.length, members_sha256 };
     });
     const body = {
-      schema: "economy.legacy-plan.v1",
+      schema: mode.plan,
       mode: "read-only",
       original_encoding: "postgres-row-json-text-v1",
       member_encoding: "sha256-json-id-digest-pairs-utf8-c-order-v1",
@@ -4505,10 +4776,11 @@ async function runLegacyPlan(selection) {
     await pool.end();
   }
 }
-var INPUT_MAX, MEMBERS_MAX = 1e4, sha256 = (text) => createHash5("sha256").update(text).digest("hex");
+var INPUT_MAX, sha256 = (text) => createHash6("sha256").update(text).digest("hex");
 var init_legacy_plan = __esm(() => {
   init_legacy_inventory();
-  INPUT_MAX = 256 * 1024;
+  init_legacy_limits();
+  INPUT_MAX = LEGACY_SINGLE_SESSION.inputBytes;
 });
 
 // src/server/legacy-preservation.ts
@@ -4524,20 +4796,21 @@ __export(exports_legacy_preservation, {
   parseLegacyCapsule: () => parseLegacyCapsule,
   assertLegacyPlanCurrent: () => assertLegacyPlanCurrent
 });
-import { createHash as createHash6, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash7, randomUUID as randomUUID3 } from "crypto";
 import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, fsyncSync, lstatSync, openSync as openSync2, readSync as readSync2, realpathSync, writeSync } from "fs";
 import { basename as basename4, dirname as dirname4, isAbsolute as isAbsolute2 } from "path";
 function parseLegacyPlan(value) {
   const p = record(value);
+  const mode = legacyMode("plan", p.schema);
   fields(p, ["schema", "mode", "original_encoding", "member_encoding", "snapshot", "items", "sessions", "mutations_performed", "limitations", "plan_sha256"]);
-  if (p.schema !== "economy.legacy-plan.v1" || p.mode !== "read-only" || p.original_encoding !== "postgres-row-json-text-v1" || p.member_encoding !== "sha256-json-id-digest-pairs-utf8-c-order-v1" || p.mutations_performed !== 0)
+  if (p.mode !== "read-only" || p.original_encoding !== "postgres-row-json-text-v1" || p.member_encoding !== "sha256-json-id-digest-pairs-utf8-c-order-v1" || p.mutations_performed !== 0)
     fail("Unsupported legacy plan contract");
   const { plan_sha256, ...body } = p;
   if (hash(plan_sha256) !== sha2(JSON.stringify(body)))
     fail("Legacy plan digest mismatch");
   if (!Array.isArray(p.items))
     fail("Legacy plan items must be an array");
-  const selection = parseLegacySelection({ schema: "economy.legacy-selection.v1", items: p.items.map((item) => {
+  const selection = parseLegacySelection({ schema: mode.selection, items: p.items.map((item) => {
     const row = record(item);
     fields(row, ["id", "family", "original_sha256", "disposition", "reason", "evidence_ref", "session_id"]);
     identifier3(row.session_id);
@@ -4565,7 +4838,7 @@ function parseLegacyPlan(value) {
     if (typeof t.relation_oid !== "string" || !/^[0-9]+$/.test(t.relation_oid))
       fail("Invalid relation locator");
   }
-  if (!Array.isArray(p.sessions) || p.sessions.length < 1 || p.sessions.length > 100)
+  if (!Array.isArray(p.sessions) || p.sessions.length < 1 || p.sessions.length > mode.sessions)
     fail("Invalid legacy session population");
   const ids = new Set;
   let members = 0;
@@ -4582,7 +4855,7 @@ function parseLegacyPlan(value) {
       fail("Invalid legacy member count");
     members += s.request_count;
   }
-  if (members > MAX_MEMBERS || p.items.some((x) => !ids.has(x.session_id)) || ids.size !== new Set(p.items.map((x) => x.session_id)).size)
+  if (members > mode.members || p.items.some((x) => !ids.has(x.session_id)) || ids.size !== new Set(p.items.map((x) => x.session_id)).size)
     fail("Incomplete or excessive legacy session membership");
   if (!Array.isArray(p.limitations) || p.limitations.length > 20 || p.limitations.some((x) => typeof x !== "string" || x.length > 2048))
     fail("Invalid legacy plan limitations");
@@ -4599,16 +4872,28 @@ function assertLegacyPlanCurrent(expected, current) {
 }
 function parseLegacyCapsule(value) {
   const c = record(value);
+  const mode = legacyMode("capsule", c.schema);
   fields(c, ["schema", "plan", "captured_at", "requests", "sessions", "capsule_sha256"]);
-  if (c.schema !== "economy.legacy-preservation.v1" || typeof c.captured_at !== "string" || c.captured_at.length > 100 || !c.captured_at)
+  if (typeof c.captured_at !== "string" || c.captured_at.length > 100 || !c.captured_at)
     fail("Invalid preservation capsule");
   const { capsule_sha256, ...body } = c;
   const bytes = JSON.stringify(body);
-  if (Buffer.byteLength(bytes) > MAX_BYTES || hash(capsule_sha256) !== sha2(bytes))
+  if (Buffer.byteLength(bytes) > mode.capsuleBytes || hash(capsule_sha256) !== sha2(bytes))
     fail("Preservation capsule bound or digest mismatch");
   const plan = parseLegacyPlan(c.plan);
-  if (!Array.isArray(c.requests) || c.requests.length > MAX_MEMBERS || !Array.isArray(c.sessions) || c.sessions.length !== plan.sessions.length)
+  if (plan.schema !== mode.plan)
+    fail("Preservation capsule and plan use different artifact modes");
+  if (!Array.isArray(c.requests) || c.requests.length > mode.members || !Array.isArray(c.sessions) || c.sessions.length !== plan.sessions.length)
     fail("Invalid original populations");
+  let originalBytes = 0;
+  const boundOriginal = (original) => {
+    if (typeof original !== "string")
+      fail("Invalid original row text");
+    originalBytes += Buffer.byteLength(original);
+    if (originalBytes > mode.originalBytes)
+      fail("Preserved original row text exceeds its artifact mode bound");
+    return original;
+  };
   const requests = new Map;
   for (const value2 of c.requests) {
     const row = record(value2);
@@ -4616,7 +4901,7 @@ function parseLegacyCapsule(value) {
     const id = identifier3(row.id);
     if (requests.has(id) || typeof row.original !== "string")
       fail("Invalid or duplicate request original");
-    const original = record(JSON.parse(row.original));
+    const original = record(JSON.parse(boundOriginal(row.original)));
     if (original.id !== id)
       fail("Request original identity mismatch");
     requests.set(id, { session: identifier3(original.session_id), digest: sha2(row.original) });
@@ -4630,7 +4915,7 @@ function parseLegacyCapsule(value) {
       fail("Invalid or duplicate session original");
     sessions.add(id);
     const expected = plan.sessions.find((s) => s.id === id) ?? fail("Session original does not match the plan");
-    if (record(JSON.parse(row.original)).id !== id || sha2(row.original) !== expected.original_sha256)
+    if (record(JSON.parse(boundOriginal(row.original))).id !== id || sha2(row.original) !== expected.original_sha256)
       fail("Session original does not match the plan");
     const members = [...requests].filter(([, r]) => r.session === id).sort(([a], [b]) => cOrder(a, b)).map(([rid, r]) => [rid, r.digest]);
     if (members.length !== expected.request_count || sha2(JSON.stringify(members)) !== expected.members_sha256)
@@ -4647,18 +4932,19 @@ function parseLegacyCapsule(value) {
 }
 async function preserveLegacyOriginals(client, input) {
   const expected = parseLegacyPlan(input);
-  const selection = { schema: "economy.legacy-selection.v1", items: expected.items.map(({ session_id, ...item }) => item) };
+  const mode = legacyMode("plan", expected.schema);
+  const selection = { schema: mode.selection, items: expected.items.map(({ session_id, ...item }) => item) };
   return withLegacyPlanSnapshot(client, selection, async (current) => {
     assertLegacyPlanCurrent(expected, current);
     const ids = current.sessions.map((x) => x.id);
     const sizes = (await client.query(`SELECT
       (SELECT COALESCE(SUM(octet_length(row_to_json(requests)::text)),0) FROM requests WHERE session_id=ANY($1::text[]))::text AS request_bytes,
       (SELECT COALESCE(SUM(octet_length(row_to_json(sessions)::text)),0) FROM sessions WHERE id=ANY($1::text[]))::text AS session_bytes`, [ids])).rows[0];
-    if (!sizes || !/^[0-9]+$/.test(sizes.request_bytes) || !/^[0-9]+$/.test(sizes.session_bytes) || BigInt(sizes.request_bytes) + BigInt(sizes.session_bytes) > BigInt(MAX_BYTES / 2))
-      fail("Preservation exceeds 16 MiB of original row text; split by session");
-    const requests = (await client.query('SELECT id,row_to_json(requests)::text AS original FROM requests WHERE session_id=ANY($1::text[]) ORDER BY session_id COLLATE "C",id COLLATE "C" LIMIT 10001', [ids])).rows;
-    const sessions = (await client.query('SELECT id,row_to_json(sessions)::text AS original FROM sessions WHERE id=ANY($1::text[]) ORDER BY id COLLATE "C" LIMIT 101', [ids])).rows;
-    const body = { schema: "economy.legacy-preservation.v1", plan: expected, captured_at: current.snapshot.at, requests, sessions };
+    if (!sizes || !/^[0-9]+$/.test(sizes.request_bytes) || !/^[0-9]+$/.test(sizes.session_bytes) || BigInt(sizes.request_bytes) + BigInt(sizes.session_bytes) > BigInt(mode.originalBytes))
+      fail(`Preservation exceeds ${mode.originalBytes / 1024 / 1024} MiB of original row text; complete sessions cannot be truncated`);
+    const requests = (await client.query(`SELECT id,row_to_json(requests)::text AS original FROM requests WHERE session_id=ANY($1::text[]) ORDER BY session_id COLLATE "C",id COLLATE "C" LIMIT ${mode.members + 1}`, [ids])).rows;
+    const sessions = (await client.query(`SELECT id,row_to_json(sessions)::text AS original FROM sessions WHERE id=ANY($1::text[]) ORDER BY id COLLATE "C" LIMIT ${mode.sessions + 1}`, [ids])).rows;
+    const body = { schema: mode.capsule, plan: expected, captured_at: current.snapshot.at, requests, sessions };
     return parseLegacyCapsule({ ...body, capsule_sha256: sha2(JSON.stringify(body)) });
   });
 }
@@ -4689,11 +4975,16 @@ function readLegacyBytes(path, maxBytes = MAX_BYTES) {
 }
 function readLegacyArtifact(path, maxBytes = MAX_BYTES) {
   const bytes = readLegacyBytes(path, maxBytes);
+  let value;
   try {
-    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
   } catch {
     fail("Artifact must contain valid UTF-8 JSON");
   }
+  const limit = value?.schema === LEGACY_SINGLE_SESSION.plan || value?.schema === LEGACY_SINGLE_SESSION.capsule ? LEGACY_SINGLE_SESSION.capsuleBytes : LEGACY_STANDARD.capsuleBytes;
+  if (bytes.length > limit)
+    fail("Artifact exceeds its schema file bound");
+  return value;
 }
 function writeLegacyCapsule(path, input) {
   const capsule = parseLegacyCapsule(input);
@@ -4704,7 +4995,7 @@ function writeLegacyCapsule(path, input) {
     fail("Output parent must be an owner-only directory");
   const bytes = Buffer.from(JSON.stringify(capsule) + `
 `);
-  if (bytes.length > MAX_BYTES)
+  if (bytes.length > legacyMode("capsule", capsule.schema).capsuleBytes)
     fail("Preservation capsule exceeds the file bound");
   const fd = openSync2(path, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW, 384);
   try {
@@ -4774,8 +5065,8 @@ async function rehearseLegacyRestore(client, input, scope = "transaction") {
       const table = tables[i], expected = capsule.plan.snapshot.tables[i];
       if (table.table_name !== expected.table_name || table.columns_sha256 !== expected.columns_sha256)
         fail("Restore target schema differs from the preserved schema");
-      const source = quote2(table.schema_name) + "." + quote2(table.table_name);
-      const temp = quote2("economy_restore_" + randomUUID3().replaceAll("-", ""));
+      const source = quote3(table.schema_name) + "." + quote3(table.table_name);
+      const temp = quote3("economy_restore_" + randomUUID3().replaceAll("-", ""));
       await client.query("CREATE TEMP TABLE " + temp + " (LIKE " + source + " INCLUDING ALL) ON COMMIT DROP");
       const originals = table.table_name === "requests" ? capsule.requests : capsule.sessions;
       restoreTables.push({ source, temp, originals });
@@ -4835,15 +5126,16 @@ async function runLegacyPreservation(command, options) {
     await pool.end();
   }
 }
-var MAX_BYTES, MAX_MEMBERS = 1e4, sha2 = (s) => createHash6("sha256").update(s).digest("hex"), fail = (message) => {
+var MAX_BYTES, sha2 = (s) => createHash7("sha256").update(s).digest("hex"), fail = (message) => {
   throw Error(message);
 }, record = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : fail("Expected a JSON object"), hash = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v) ? v : fail("Expected a lowercase SHA-256 digest"), identifier3 = (v) => typeof v === "string" && v.length > 0 && v.length <= 1024 && !v.includes("\x00") ? v : fail("Expected a nonempty identifier of at most 1024 characters without NUL"), fields = (o, names) => {
   if (Object.keys(o).sort().join(",") !== [...names].sort().join(","))
     fail("Unexpected or missing preservation fields");
-}, cOrder = (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)), same = (a, b) => JSON.stringify(a) === JSON.stringify(b), quote2 = (s) => '"' + s.replaceAll('"', '""') + '"';
+}, cOrder = (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)), same = (a, b) => JSON.stringify(a) === JSON.stringify(b), quote3 = (s) => '"' + s.replaceAll('"', '""') + '"';
 var init_legacy_preservation = __esm(() => {
   init_legacy_plan();
-  MAX_BYTES = 32 * 1024 * 1024;
+  init_legacy_limits();
+  MAX_BYTES = LEGACY_SINGLE_SESSION.capsuleBytes;
 });
 
 // src/server/legacy-operations.ts
@@ -4858,7 +5150,7 @@ __export(exports_legacy_operations, {
   applyLegacyReconciliation: () => applyLegacyReconciliation,
   LegacyOperationInputError: () => LegacyOperationInputError
 });
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import { isAbsolute as isAbsolute3 } from "path";
 function parseLegacyIntent(action, value) {
   try {
@@ -4907,6 +5199,7 @@ function matchIntent(intent, capsule, target) {
 }
 async function verifyOriginals(client, capsule) {
   const p = capsule.plan;
+  const mode = legacyMode("capsule", capsule.schema);
   const context2 = (await client.query("SELECT current_database() AS database,(SELECT oid::text FROM pg_database WHERE datname=current_database()) AS database_oid")).rows[0];
   if (context2?.database !== p.snapshot.database || context2?.database_oid !== p.snapshot.database_oid)
     fail2("Legacy operation targets a different database");
@@ -4920,7 +5213,7 @@ async function verifyOriginals(client, capsule) {
     fail2("Legacy session originals changed; preserve later work and prepare a new review");
   const rows = (await client.query(`SELECT id,session_id,encode(sha256(convert_to(row_to_json(requests)::text,'UTF8')),'hex') AS original_sha256,
     CASE ${LEGACY_FAMILIES.map((f) => "WHEN " + LEGACY_PREDICATES[f] + " THEN '" + f + "'").join(" ")} END AS family
-    FROM requests WHERE session_id=ANY($1::text[]) ORDER BY session_id COLLATE "C",id COLLATE "C" LIMIT 10001`, [ids])).rows;
+    FROM requests WHERE session_id=ANY($1::text[]) ORDER BY session_id COLLATE "C",id COLLATE "C" LIMIT ${mode.members + 1}`, [ids])).rows;
   if (rows.length !== capsule.requests.length)
     fail2("Legacy request membership changed; preserve later work and prepare a new review");
   const originals = new Map(capsule.requests.map((r) => [r.id, sha3(r.original)]));
@@ -4974,13 +5267,14 @@ async function observed(client, run) {
 }
 function validateReceipt(value) {
   const v = value;
-  if (!v || v.schema !== "economy.legacy-operation-receipt.v1" || !["apply", "rollback"].includes(v.action))
+  if (!v || !["apply", "rollback"].includes(v.action))
     fail2("Invalid stored legacy receipt");
+  const mode = legacyMode("receipt", v.schema);
   key(v.operation_key);
   key(v.apply_key);
   digest3(v.plan_sha256);
   digest3(v.capsule_sha256);
-  if (v.source_rows_changed !== 0 || ![v.target_requests, v.preserved_requests, v.sessions].every((n) => Number.isSafeInteger(n) && n > 0 && n <= 1e4) || v.target_requests > 100 || v.sessions > 100 || typeof v.created_at !== "string" || !Number.isFinite(Date.parse(v.created_at)))
+  if (v.source_rows_changed !== 0 || ![v.target_requests, v.preserved_requests, v.sessions].every((n) => Number.isSafeInteger(n) && n > 0 && n <= mode.members) || v.target_requests > mode.items || v.sessions > mode.sessions || typeof v.created_at !== "string" || !Number.isFinite(Date.parse(v.created_at)))
     fail2("Invalid stored legacy receipt fields");
   const names = ["schema", "action", "operation_key", "apply_key", "plan_sha256", "capsule_sha256", "target_requests", "preserved_requests", "sessions", "source_rows_changed", "created_at"];
   if (Object.keys(v).sort().join(",") !== names.sort().join(","))
@@ -5005,7 +5299,7 @@ async function reply(client, row, expectedHash) {
 }
 function receipt(action, intent, capsule) {
   return {
-    schema: "economy.legacy-operation-receipt.v1",
+    schema: legacyMode("capsule", capsule.schema).receipt,
     action,
     operation_key: intent.operation_key,
     apply_key: action === "apply" ? intent.operation_key : intent.apply_key,
@@ -5045,8 +5339,9 @@ async function applyLegacyReconciliation(client, input, preserved, target) {
     const saved = (await client.query("SELECT capsule_json,capsule_sha256 FROM legacy_reconciliations WHERE operation_key=$1", [intent.operation_key])).rows[0];
     if (saved?.capsule_json !== json3 || saved?.capsule_sha256 !== capsule.capsule_sha256 || parseLegacyCapsule(JSON.parse(saved.capsule_json)).capsule_sha256 !== capsule.capsule_sha256)
       fail2("Durable preservation readback failed");
-    for (const item of capsule.plan.items)
-      await client.query("INSERT INTO legacy_reconciliation_targets VALUES($1,$2,$3,$4,$5)", [intent.operation_key, item.id, item.session_id, item.disposition, item.original_sha256]);
+    await client.query(`INSERT INTO legacy_reconciliation_targets(operation_key,request_id,session_id,disposition,original_sha256)
+      SELECT $1, x.id, x.session_id, x.disposition, x.original_sha256
+      FROM jsonb_to_recordset($2::jsonb) AS x(id text,session_id text,disposition text,original_sha256 text)`, [intent.operation_key, JSON.stringify(capsule.plan.items.map(({ id, session_id, disposition, original_sha256 }) => ({ id, session_id, disposition, original_sha256 })))]);
     const stored = await lookup(client, "apply", intent.operation_key) ?? fail2("Legacy receipt readback failed");
     if (stored.response_json !== responseJson)
       fail2("Legacy receipt readback failed");
@@ -5150,7 +5445,7 @@ async function runLegacyOperation(command, options) {
     await pool.end();
   }
 }
-var sha3 = (s) => createHash7("sha256").update(s).digest("hex"), fail2 = (s) => {
+var sha3 = (s) => createHash8("sha256").update(s).digest("hex"), fail2 = (s) => {
   throw Error(s);
 }, digest3 = (v, label = "digest") => typeof v === "string" && /^[a-f0-9]{64}$/.test(v) ? v : fail2(label + " must be a lowercase SHA-256 digest"), key = (v, label = "operation_key") => typeof v === "string" && /^[A-Za-z0-9._:-]{1,200}$/.test(v) ? v : fail2(label + " must contain 1-200 letters, digits, dot, underscore, colon or hyphen"), reference = (v, label) => typeof v === "string" && /^[A-Za-z0-9:/._-]{1,512}$/.test(v) ? v : fail2(label + " must contain 1-512 letters, digits, colon, slash, dot, underscore or hyphen"), LegacyOperationInputError, TABLES_SQL = `SELECT c.relname AS table_name,n.nspname AS schema_name,c.oid::text AS relation_oid,
   encode(sha256(convert_to(json_agg(json_build_array(a.attnum,a.attname,a.atttypid::text,a.atttypmod,a.attnotnull,a.attcollation::text) ORDER BY a.attnum)::text,'UTF8')),'hex') AS columns_sha256
@@ -5158,6 +5453,7 @@ var sha3 = (s) => createHash7("sha256").update(s).digest("hex"), fail2 = (s) =>
   WHERE c.oid IN ('requests'::regclass,'sessions'::regclass) AND a.attnum>0 AND NOT a.attisdropped
   GROUP BY c.oid,c.relname,n.nspname ORDER BY c.relname`, same2 = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 var init_legacy_operations = __esm(() => {
+  init_legacy_limits();
   init_pg_connection();
   init_legacy_inventory();
   init_legacy_preservation();
@@ -5194,7 +5490,7 @@ function isAuthorizedRequest(req, path) {
 // package.json
 var package_default = {
   name: "@hasna/economy",
-  version: "0.5.0",
+  version: "0.5.2",
   description: "AI coding cost tracker \u2014 CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   repository: {
     type: "git",
@@ -5289,7 +5585,16 @@ var package_default = {
   },
   trustedDependencies: [
     "@hasna/projects"
-  ]
+  ],
+  overrides: {
+    "fast-uri": "3.1.8",
+    hono: "4.13.7",
+    "ip-address": "10.7.1",
+    nanoid: "5.1.16",
+    "path-to-regexp": "8.4.0",
+    undici: "6.28.1",
+    "express-rate-limit": "8.7.0"
+  }
 };
 
 // src/lib/package-metadata.ts
@@ -12457,10 +12762,12 @@ function parsePort(raw, label) {
 async function runMigrate() {
   const { getCloudDatabaseUrl: getCloudDatabaseUrl2, createCloudPool: createCloudPool2, authClientFromPool: authClientFromPool2, cloudMigrations: cloudMigrations2 } = await Promise.resolve().then(() => (init_cloud(), exports_cloud));
   const { applyPgMigrations: applyPgMigrations2 } = await Promise.resolve().then(() => (init_pg_migrate(), exports_pg_migrate));
+  const { repairLegacyCostCenterSchema: repairLegacyCostCenterSchema2 } = await Promise.resolve().then(() => (init_pg_legacy_schema(), exports_pg_legacy_schema));
   const { ApiKeyStore: ApiKeyStore2 } = await import("@hasna/contracts/auth");
   const dsn = getCloudDatabaseUrl2();
   if (!dsn)
     throw new Error("migrate requires a Postgres DSN: set HASNA_ECONOMY_DATABASE_URL (or ECONOMY_DATABASE_URL / DATABASE_URL)");
+  const repair = await repairLegacyCostCenterSchema2(dsn);
   const result = await applyPgMigrations2(dsn, cloudMigrations2(), "economy");
   const pool = createCloudPool2(dsn);
   try {
@@ -12468,7 +12775,7 @@ async function runMigrate() {
   } finally {
     await pool.end().catch(() => {});
   }
-  console.log(JSON.stringify({ evt: "migrate", service: result.service, applied: result.applied, alreadyApplied: result.alreadyApplied, errors: result.errors, api_keys: "ensured" }));
+  console.log(JSON.stringify({ evt: "migrate", service: result.service, applied: result.applied, alreadyApplied: result.alreadyApplied, errors: result.errors, repair, api_keys: "ensured" }));
   if (result.errors.length)
     process.exit(1);
 }