@hasna/economy 0.5.2 → 0.5.4

package/dist/server/index.js

@@ -1118,12 +1118,32 @@ function meteredBudgetAmounts(groups, limit, threshold) {
 function ymd(date2) {
   return date2.toISOString().substring(0, 10);
 }
-function calendarPeriodBounds(period, now = new Date) {
+function resolveReportingInterval(interval, now = new Date) {
   if (!Number.isFinite(now.getTime()))
     throw new RangeError("Invalid reporting clock");
-  const start = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
+  const start = new Date(now);
+  start.setUTCHours(0, 0, 0, 0);
   const end = new Date(start);
-  switch (period) {
+  if (interval.kind === "rolling") {
+    if (!Number.isSafeInteger(interval.count) || interval.count < 1)
+      throw new RangeError("Invalid reporting window");
+    if (interval.unit === "hour") {
+      start.setTime(now.getTime() - interval.count * 3600000);
+      if (!Number.isFinite(start.getTime()))
+        throw new RangeError("Invalid reporting window");
+      return { time_zone: "UTC", start: start.toISOString(), end_exclusive: now.toISOString() };
+    }
+    if (interval.unit !== "day")
+      throw new RangeError("Invalid reporting unit");
+    start.setUTCDate(start.getUTCDate() - interval.count + 1);
+    end.setUTCDate(end.getUTCDate() + 1);
+    if (!Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime()))
+      throw new RangeError("Invalid reporting window");
+    return { time_zone: "UTC", start: ymd(start), end_exclusive: ymd(end) };
+  }
+  if (interval.kind !== "calendar")
+    throw new RangeError("Invalid reporting interval");
+  switch (interval.period) {
     case "today":
       end.setUTCDate(end.getUTCDate() + 1);
       break;
@@ -1146,11 +1166,15 @@ function calendarPeriodBounds(period, now = new Date) {
       end.setUTCFullYear(end.getUTCFullYear() + 1);
       break;
     case "all":
-      return { time_zone: "UTC", start_date: null, end_date_exclusive: null };
+      return { time_zone: "UTC", start: null, end_exclusive: null };
     default:
       throw new RangeError("Invalid reporting period");
   }
-  return { time_zone: "UTC", start_date: ymd(start), end_date_exclusive: ymd(end) };
+  return { time_zone: "UTC", start: ymd(start), end_exclusive: ymd(end) };
+}
+function calendarPeriodBounds(period, now = new Date) {
+  const bounds = resolveReportingInterval({ kind: "calendar", period }, now);
+  return { time_zone: bounds.time_zone, start_date: bounds.start, end_date_exclusive: bounds.end_exclusive };
 }
 function calendarPeriodWhere(period, column, now = new Date) {
   if (!/^[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)?$/i.test(column)) {
@@ -2209,20 +2233,22 @@ function queryAccountBreakdownSince(db, since) {
     ORDER BY api_equivalent_usd DESC
   `).all(since, since);
 }
-function queryDailyBreakdown(db, days = 30, machine) {
+function queryDailyBreakdown(db, days = 30, machine, now = new Date) {
+  const bounds = resolveReportingInterval({ kind: "rolling", unit: "day", count: days }, now);
   const machineClause = machine ? " AND machine_id = ?" : "";
-  const params = machine ? [`-${days}`, machine] : [`-${days}`];
+  const params = machine ? [bounds.start, bounds.end_exclusive, machine] : [bounds.start, bounds.end_exclusive];
   return db.prepare(`
     SELECT DATE(timestamp) as date, agent, COALESCE(SUM(cost_usd), 0) as cost_usd
     FROM economy_effective_requests
-    WHERE timestamp >= DATE('now', ? || ' days')${machineClause}
+    WHERE timestamp >= ? AND timestamp < ?${machineClause}
     GROUP BY DATE(timestamp), agent
     ORDER BY date ASC
   `).all(...params);
 }
-function queryHourlyBreakdown(db, machine, hours) {
-  const clauses = hours == null ? [`DATE(timestamp) = DATE('now')`] : [`DATETIME(timestamp) >= DATETIME('now', ?)`];
-  const params = hours == null ? [] : [`-${hours} hours`];
+function queryHourlyBreakdown(db, machine, hours, now = new Date) {
+  const bounds = resolveReportingInterval(hours == null ? { kind: "calendar", period: "today" } : { kind: "rolling", unit: "hour", count: hours }, now);
+  const clauses = hours == null ? ["timestamp >= ? AND timestamp < ?"] : ["STRFTIME('%Y-%m-%dT%H:%M:%fZ', timestamp) >= ? AND STRFTIME('%Y-%m-%dT%H:%M:%fZ', timestamp) < ?"];
+  const params = [bounds.start, bounds.end_exclusive];
   if (machine) {
     clauses.push("machine_id = ?");
     params.push(machine);
@@ -3143,15 +3169,16 @@ function translateSqliteDates(sql) {
   s = s.replace(/DATE\('now',\s*(\$\d+)\s*\|\|\s*' days'\)/gi, (_m, p) => isoDate(`now() + ((${p}) || ' days')::interval`));
   s = s.replace(/DATETIME\('now',\s*(\$\d+)\)/gi, (_m, p) => `(now() + (${p})::interval)`);
   s = s.replace(/DATETIME\('now',\s*'([^']+)'\)/gi, (_m, lit) => `(now() + interval '${lit}')`);
+  s = s.replace(/STRFTIME\('%Y-%m-%dT%H:%M:%fZ',\s*([A-Za-z_][A-Za-z0-9_]*)\)/gi, (_m, col) => `to_char(CAST("${col}" AS timestamptz) AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`);
   const strftimeMap = { "%H": "HH24", "%Y": "YYYY", "%m": "MM", "%d": "DD", "%M": "MI", "%S": "SS" };
   s = s.replace(/STRFTIME\('([^']+)',\s*([A-Za-z_][A-Za-z0-9_]*)\)/gi, (_m, fmt, col) => {
     const pgFmt = Object.entries(strftimeMap).reduce((acc, [k, v]) => acc.split(k).join(v), fmt);
-    return `to_char(CAST("${col}" AS timestamptz), '${pgFmt}')`;
+    return `to_char(CAST("${col}" AS timestamptz) AT TIME ZONE 'UTC', '${pgFmt}')`;
   });
   s = s.replace(/\bDATE\('now'\)/gi, isoDate("now()"));
   s = s.replace(/\bDATETIME\('now'\)/gi, "now()");
   s = s.replace(/\bDATETIME\(\s*([A-Za-z_][A-Za-z0-9_]*)\s*\)/gi, (_m, col) => `CAST("${col}" AS timestamptz)`);
-  s = s.replace(/\bDATE\(\s*([A-Za-z_][A-Za-z0-9_]*)\s*\)/gi, (_m, col) => `substr("${col}", 1, 10)`);
+  s = s.replace(/\bDATE\(\s*([A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?)\s*\)/gi, (_m, col) => `substr(${col.split(".").map((part) => `"${part}"`).join(".")}, 1, 10)`);
   return s;
 }
 function resolveWorkerPath() {
@@ -4029,12 +4056,21 @@ var init_config = __esm(() => {
 function detectCostSpikes(dailyTotals, opts) {
   const windowDays = opts?.windowDays ?? 7;
   const multiplier = opts?.multiplier ?? 2;
+  if (!Number.isSafeInteger(windowDays) || windowDays < 1)
+    throw new RangeError("Invalid spike window");
+  if (!Number.isFinite(multiplier) || multiplier <= 0)
+    throw new RangeError("Invalid spike multiplier");
   const sorted = [...dailyTotals].sort((a, b) => a.date.localeCompare(b.date));
   const spikes = [];
   for (let i = windowDays;i < sorted.length; i++) {
     const window = sorted.slice(i - windowDays, i);
-    const avg = window.reduce((s, d) => s + d.cost_usd, 0) / window.length;
     const current = sorted[i];
+    const previous = new Date(current.date + "T00:00:00.000Z");
+    previous.setUTCDate(previous.getUTCDate() - 1);
+    const bounds = resolveReportingInterval({ kind: "rolling", unit: "day", count: windowDays }, previous);
+    if (window[0].date !== bounds.start || window[window.length - 1].date !== previous.toISOString().slice(0, 10) || new Set(window.map((day) => day.date)).size !== windowDays)
+      continue;
+    const avg = window.reduce((s, d) => s + d.cost_usd, 0) / window.length;
     if (avg > 0 && current.cost_usd > avg * multiplier) {
       spikes.push({
         date: current.date,
@@ -4046,21 +4082,23 @@ function detectCostSpikes(dailyTotals, opts) {
   }
   return spikes;
 }
-function queryRecentSpikes(db, days = 14) {
+function queryRecentSpikes(db, days = 14, now = new Date) {
+  const bounds = resolveReportingInterval({ kind: "rolling", unit: "day", count: days }, now);
   const rows = db.prepare(`
     SELECT DATE(timestamp) as date, COALESCE(SUM(cost_usd), 0) as cost_usd
     FROM economy_effective_requests
-    WHERE timestamp >= DATE('now', ? || ' days')
+    WHERE timestamp >= ? AND timestamp < ?
     GROUP BY DATE(timestamp)
     ORDER BY date ASC
-  `).all(-days);
+  `).all(bounds.start, bounds.end_exclusive);
   return detectCostSpikes(rows);
 }
-function getTodaySpike(db) {
-  const today = new Date().toISOString().substring(0, 10);
-  const spikes = queryRecentSpikes(db, 14);
+function getTodaySpike(db, now = new Date) {
+  const today = resolveReportingInterval({ kind: "calendar", period: "today" }, now).start;
+  const spikes = queryRecentSpikes(db, 14, now);
   return spikes.find((s) => s.date === today) ?? null;
 }
+var init_spikes = () => {};
 
 // src/lib/webhooks.ts
 var exports_webhooks = {};
@@ -4127,6 +4165,7 @@ async function fireWebhook(url, payload) {
 var init_webhooks = __esm(() => {
   init_config();
   init_database();
+  init_spikes();
 });
 
 // src/db/pg-migrate.ts
@@ -4581,7 +4620,7 @@ __export(exports_legacy_plan, {
 });
 import { createHash as createHash6 } from "crypto";
 import { closeSync, constants, fstatSync, openSync, readSync } from "fs";
-import { isAbsolute } from "path";
+import { isAbsolute as isAbsolute2 } from "path";
 function object(value, fields, label) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).sort().join(",") !== fields.sort().join(","))
     throw Error(`${label} has unsupported or missing fields`);
@@ -4634,7 +4673,7 @@ function parseLegacySelection(value) {
   return { schema: mode.selection, items };
 }
 function readLegacySelectionFile(path) {
-  if (!isAbsolute(path) || path.includes("\x00"))
+  if (!isAbsolute2(path) || path.includes("\x00"))
     throw Error("--input must be an absolute path to a regular JSON file");
   let fd;
   try {
@@ -4669,7 +4708,7 @@ function readLegacySelectionFile(path) {
   }
 }
 function parseLegacyPlanOptions(args) {
-  if (args.length !== 2 || args[0] !== "--input" || !args[1] || !isAbsolute(args[1]) || args[1].includes("\x00"))
+  if (args.length !== 2 || args[0] !== "--input" || !args[1] || !isAbsolute2(args[1]) || args[1].includes("\x00"))
     throw Error("legacy-plan accepts exactly --input <absolute JSON file>");
   return args[1];
 }
@@ -4798,7 +4837,7 @@ __export(exports_legacy_preservation, {
 });
 import { createHash as createHash7, randomUUID as randomUUID3 } from "crypto";
 import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, fsyncSync, lstatSync, openSync as openSync2, readSync as readSync2, realpathSync, writeSync } from "fs";
-import { basename as basename4, dirname as dirname4, isAbsolute as isAbsolute2 } from "path";
+import { basename as basename4, dirname as dirname4, isAbsolute as isAbsolute3 } from "path";
 function parseLegacyPlan(value) {
   const p = record(value);
   const mode = legacyMode("plan", p.schema);
@@ -4949,7 +4988,7 @@ async function preserveLegacyOriginals(client, input) {
   });
 }
 function readLegacyBytes(path, maxBytes = MAX_BYTES) {
-  if (!isAbsolute2(path) || path.includes("\x00"))
+  if (!isAbsolute3(path) || path.includes("\x00"))
     fail("Artifact path must be absolute");
   let fd;
   try {
@@ -4988,7 +5027,7 @@ function readLegacyArtifact(path, maxBytes = MAX_BYTES) {
 }
 function writeLegacyCapsule(path, input) {
   const capsule = parseLegacyCapsule(input);
-  if (!isAbsolute2(path) || path.includes("\x00") || realpathSync(dirname4(path)) !== dirname4(path))
+  if (!isAbsolute3(path) || path.includes("\x00") || realpathSync(dirname4(path)) !== dirname4(path))
     fail("Output requires an absolute path with a real parent directory");
   const parent = lstatSync(dirname4(path));
   if (!parent.isDirectory() || parent.uid !== process.getuid?.() || (parent.mode & 63) !== 0)
@@ -5102,7 +5141,7 @@ async function rehearseLegacyRestore(client, input, scope = "transaction") {
 }
 function parseLegacyPreservationOptions(command, args) {
   const preserve = command === "legacy-preserve";
-  if (!preserve && command !== "legacy-rehearse" || args.length !== (preserve ? 4 : 2) || args[0] !== "--input" || !args[1] || !isAbsolute2(args[1]) || preserve && (args[2] !== "--output" || !args[3] || !isAbsolute2(args[3])) || args.some((x) => x.includes("\x00")))
+  if (!preserve && command !== "legacy-rehearse" || args.length !== (preserve ? 4 : 2) || args[0] !== "--input" || !args[1] || !isAbsolute3(args[1]) || preserve && (args[2] !== "--output" || !args[3] || !isAbsolute3(args[3])) || args.some((x) => x.includes("\x00")))
     fail("Expected " + command + " --input <absolute JSON file>" + (preserve ? " --output <new file in an owner-only directory>" : ""));
   return { input: args[1], ...preserve ? { output: args[3] } : {} };
 }
@@ -5151,7 +5190,7 @@ __export(exports_legacy_operations, {
   LegacyOperationInputError: () => LegacyOperationInputError
 });
 import { createHash as createHash8 } from "crypto";
-import { isAbsolute as isAbsolute3 } from "path";
+import { isAbsolute as isAbsolute4 } from "path";
 function parseLegacyIntent(action, value) {
   try {
     if (!value || typeof value !== "object" || Array.isArray(value))
@@ -5396,7 +5435,7 @@ function parseLegacyOperationOptions(command, args) {
   const apply = command === "legacy-apply";
   if (!apply && command !== "legacy-rollback")
     fail2("Unknown legacy operation or arguments");
-  if (args.length !== (apply ? 4 : 2) || args[0] !== "--input" || !args[1] || !isAbsolute3(args[1]) || apply && (args[2] !== "--capsule" || !args[3] || !isAbsolute3(args[3])) || args.some((s) => s.includes("\x00")))
+  if (args.length !== (apply ? 4 : 2) || args[0] !== "--input" || !args[1] || !isAbsolute4(args[1]) || apply && (args[2] !== "--capsule" || !args[3] || !isAbsolute4(args[3])) || args.some((s) => s.includes("\x00")))
     fail2("Expected " + command + " --input <absolute intent JSON>" + (apply ? " --capsule <absolute preservation JSON>" : ""));
   return { input: args[1], ...apply ? { capsule: args[3] } : {} };
 }
@@ -5490,7 +5529,7 @@ function isAuthorizedRequest(req, path) {
 // package.json
 var package_default = {
   name: "@hasna/economy",
-  version: "0.5.2",
+  version: "0.5.4",
   description: "AI coding cost tracker \u2014 CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   repository: {
     type: "git",
@@ -8780,7 +8819,7 @@ import { join as join5, basename } from "path";
 import { existsSync as existsSync3, readFileSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join4 } from "path";
-import { z } from "zod";
+import { z as z2 } from "zod";
 import { resolveClientTransport, resolveCredential } from "@hasna/contracts/client";
 
 // src/lib/cloud-storage.ts
@@ -8799,33 +8838,138 @@ import { createHasnaStorageClient } from "@hasna/contracts/client/storage";
 var LOCAL_STORAGE_OPT_IN_KEYS = ["HASNA_ECONOMY_LOCAL", "ECONOMY_LOCAL"];
 var CONTRACTS_AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
 
-// src/lib/accounts-store.ts
-var ACCOUNTS_APP = "accounts";
-var profileNameSchema = z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "must be lowercase alphanumeric/hyphen and start with a letter or digit");
+// src/lib/subscriptions-registry.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { isAbsolute } from "path";
+import { z } from "zod";
+var execute = promisify(execFile);
+var readSubscriptionsMetadata = async (args, env) => {
+  let stdout;
+  try {
+    const result = await execute("subscriptions", args, {
+      env,
+      encoding: "utf8",
+      timeout: 30000,
+      maxBuffer: 16 * 1024 * 1024,
+      windowsHide: true
+    });
+    stdout = result.stdout;
+  } catch (error) {
+    const code = error?.code;
+    if (code === "ENOENT")
+      throw new Error("subscriptions: CLI not found on PATH; install the Subscriptions CLI to resolve station account metadata");
+    const status = typeof code === "number" && Number.isInteger(code) ? `exit ${code}` : "execution limit or transport failure";
+    throw new Error(`subscriptions: read-only metadata command failed (${status}); verify the installed CLI and its hosted credentials`);
+  }
+  try {
+    return JSON.parse(stdout);
+  } catch {
+    throw new Error("subscriptions: metadata command returned invalid JSON");
+  }
+};
+var nonempty = z.string().min(1);
 var profileSchema = z.object({
-  name: z.string(),
-  tool: z.string(),
+  name: nonempty,
+  tool: nonempty,
   email: z.string().optional(),
   displayName: z.string().optional(),
-  dir: z.string(),
+  dir: nonempty.refine(isAbsolute).refine((value) => !/[\0\r\n]/.test(value)),
+  createdAt: nonempty,
+  lastUsedAt: z.string().optional(),
   description: z.string().optional(),
-  createdAt: z.string(),
-  lastUsedAt: z.string().optional()
+  active: z.boolean(),
+  applied: z.boolean(),
+  switchedAway: z.object({ profile: nonempty, email: z.string().optional() }).optional()
+});
+var toolsSchema = z.array(z.object({
+  id: nonempty,
+  label: nonempty,
+  envVar: nonempty,
+  defaultDir: nonempty,
+  bin: nonempty
+}));
+function unique(rows, identity) {
+  if (new Set(rows.map(identity)).size !== rows.length) {
+    throw new Error("subscriptions: duplicate identity in metadata response");
+  }
+  return rows;
+}
+
+class SubscriptionsRegistry {
+  read;
+  transport = "api";
+  registry = "subscriptions";
+  env;
+  profiles;
+  tools;
+  constructor(baseUrl, env, read = readSubscriptionsMetadata) {
+    this.read = read;
+    this.env = { ...env, HASNA_SUBSCRIPTIONS_API_URL: baseUrl.replace(/\/v1\/?$/, "") };
+  }
+  allProfiles() {
+    return this.profiles ??= this.read(["list", "--json"], this.env).then((raw) => {
+      const parsed = z.array(profileSchema).safeParse(raw);
+      if (!parsed.success)
+        throw new Error("subscriptions: invalid profile metadata response");
+      return unique(parsed.data, (row) => JSON.stringify([row.tool, row.name]));
+    });
+  }
+  async listProfiles(tool) {
+    const rows = await this.allProfiles();
+    return rows.filter((row) => !tool || row.tool === tool);
+  }
+  async findProfile(name, tool) {
+    const matches = (await this.listProfiles(tool)).filter((row) => row.name === name);
+    return matches.length === 1 ? matches[0] : undefined;
+  }
+  async appliedProfile(tool) {
+    const matches = (await this.allProfiles()).filter((row) => row.tool === tool && row.applied);
+    if (matches.length > 1)
+      throw new Error("subscriptions: ambiguous station applied-profile binding");
+    return matches[0];
+  }
+  async currentProfile(_tool) {
+    return;
+  }
+  async listTools() {
+    return this.tools ??= this.read(["tools", "list", "--json"], this.env).then((raw) => {
+      const parsed = toolsSchema.safeParse(raw);
+      if (!parsed.success)
+        throw new Error("subscriptions: invalid tool metadata response");
+      return unique(parsed.data, (row) => row.id);
+    });
+  }
+}
+
+// src/lib/accounts-store.ts
+var ACCOUNTS_APP = "accounts";
+var profileNameSchema = z2.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "must be lowercase alphanumeric/hyphen and start with a letter or digit");
+var profileSchema2 = z2.object({
+  name: z2.string(),
+  tool: z2.string(),
+  email: z2.string().optional(),
+  displayName: z2.string().optional(),
+  dir: z2.string(),
+  description: z2.string().optional(),
+  createdAt: z2.string(),
+  lastUsedAt: z2.string().optional(),
+  switchedAway: z2.object({ profile: z2.string().min(1), email: z2.string().optional() }).optional()
 });
-var toolDefSchema = z.object({
-  id: z.string(),
-  label: z.string(),
-  envVar: z.string(),
-  defaultDir: z.string(),
-  bin: z.string()
+var toolDefSchema = z2.object({
+  id: z2.string(),
+  label: z2.string(),
+  envVar: z2.string(),
+  defaultDir: z2.string(),
+  bin: z2.string()
 });
-var storeSchema = z.object({
-  version: z.literal(1),
-  current: z.record(z.string(), z.string()).default({}),
-  applied: z.record(z.string(), z.string()).default({}),
-  toolLocks: z.record(z.string(), z.string()).default({}),
-  profiles: z.array(profileSchema).default([]),
-  tools: z.array(toolDefSchema).default([])
+var storeSchema = z2.object({
+  version: z2.literal(1),
+  current: z2.record(z2.string(), z2.string()).default({}),
+  applied: z2.record(z2.string(), z2.string()).default({}),
+  toolLocks: z2.record(z2.string(), z2.string()).default({}),
+  profiles: z2.array(profileSchema2).default([]),
+  tools: z2.array(toolDefSchema).default([])
 });
 function localRegistryAllowed(env = process.env) {
   return LOCAL_STORAGE_OPT_IN_KEYS.some((key) => {
@@ -9107,25 +9251,34 @@ class ApiStore {
   }
 }
 function resolveStore(env = process.env, options = {}) {
+  const legacy = resolveRegistryTransport(ACCOUNTS_APP, env, options.credentials);
+  if (legacy)
+    return new ApiStore(legacy.baseUrl, legacy.apiKey);
+  const current = resolveRegistryTransport("subscriptions", env, options.subscriptionsCredentials);
+  if (current)
+    return new SubscriptionsRegistry(current.baseUrl, env, options.readSubscriptionsMetadata);
+  return unconfiguredStore(env);
+}
+function resolveRegistryTransport(app, env, credentials) {
   const clientEnv = env;
-  const credential = resolveCredential(ACCOUNTS_APP, clientEnv, options.credentials);
+  const credential = resolveCredential(app, clientEnv, credentials);
   if (credential === null) {
     try {
-      resolveClientTransport(ACCOUNTS_APP, clientEnv, options.credentials ? { credentials: options.credentials } : {});
+      resolveClientTransport(app, clientEnv, credentials ? { credentials } : {});
     } catch (err) {
       if (isNoAccountsCredentialConfigurationError(err))
-        return unconfiguredStore(env);
+        return null;
       throw err;
     }
-    return unconfiguredStore(env);
+    return null;
   }
   if (credential.tier === "pointer") {
-    throw new Error(`accounts: ${credential.source} names a secrets-vault item, and the local accounts API store resolves ` + "credentials synchronously, so it cannot complete the pointer per request. It is a deliberate " + "selection and is not resolved around. Use a literal tier instead \u2014 the Keychain item " + "hasna.credentials.accounts.api-key, ~/.hasna/accounts/config/credentials, or HASNA_ACCOUNTS_API_KEY.");
+    throw new Error(`${app}: ${credential.source} names a secrets-vault item, and the registry adapter resolves ` + "credentials synchronously, so it cannot complete the pointer per request. It is a deliberate " + "selection and is not resolved around. Use a literal tier instead \u2014 the Keychain item " + `hasna.credentials.${app}.api-key, ~/.hasna/${app}/config/credentials, or HASNA_${app.toUpperCase()}_API_KEY.`);
   }
-  const resolution = resolveClientTransport(ACCOUNTS_APP, clientEnv, {
-    credentials: { ...options.credentials, apiKey: credential.apiKey }
+  const resolution = resolveClientTransport(app, clientEnv, {
+    credentials: { ...credentials, apiKey: credential.apiKey }
   });
-  return new ApiStore(resolution.baseUrl, credential.apiKey);
+  return { baseUrl: resolution.baseUrl, apiKey: credential.apiKey };
 }
 function isNoAccountsCredentialConfigurationError(error) {
   if (typeof error !== "object" || error === null)
@@ -9142,10 +9295,10 @@ function unconfiguredStore(env) {
   return new NoRegistryStore;
 }
 function accountsLocalModeNotice() {
-  return `accounts: LOCAL mode (${LOCAL_STORAGE_OPT_IN_KEYS[0]}=1) \u2014 no Hasna Accounts credential resolved, so ` + "attribution reads the on-box JSON registry (~/.hasna/accounts/accounts.json) instead of accounts-serve. " + "To go hosted, put the fleet key in the Keychain item hasna.credentials.accounts.api-key, write " + "~/.hasna/accounts/config/credentials, or set HASNA_ACCOUNTS_API_KEY.";
+  return `accounts: LOCAL mode (${LOCAL_STORAGE_OPT_IN_KEYS[0]}=1) \u2014 neither Accounts nor Subscriptions credentials resolved, so ` + "attribution reads the on-box JSON registry (~/.hasna/accounts/accounts.json) instead of accounts-serve. " + "For hosted attribution, configure the Subscriptions CLI through its normal sign-in or credential resolver.";
 }
 function accountsRefusalNotice() {
-  return "accounts: no Hasna Accounts credential resolved (Keychain item hasna.credentials.accounts.api-key, " + "~/.hasna/accounts/config/credentials, HASNA_ACCOUNTS_API_KEY), so spend attribution is omitted. The " + `on-box registry (~/.hasna/accounts/accounts.json) is NOT read without ${LOCAL_STORAGE_OPT_IN_KEYS[0]}=1 \u2014 ` + "economy fails closed instead of attributing hosted spend from an on-box file.";
+  return "accounts: neither Accounts nor Subscriptions credentials resolved (legacy hasna.credentials.accounts.api-key, " + "~/.hasna/accounts/config/credentials, HASNA_ACCOUNTS_API_KEY; current hasna.credentials.subscriptions.api-key, " + "~/.hasna/subscriptions/config/credentials, HASNA_SUBSCRIPTIONS_API_KEY), so spend attribution is omitted. The " + `on-box registry (~/.hasna/accounts/accounts.json) is NOT read without ${LOCAL_STORAGE_OPT_IN_KEYS[0]}=1 \u2014 ` + "economy fails closed instead of attributing hosted spend from an on-box file.";
 }
 var accountsLocalNoticePrinted = false;
 function announceAccountsLocalMode() {
@@ -9233,7 +9386,10 @@ async function profileForEnvDir(store, tool, env) {
   if (!configuredDir)
     return null;
   const normalized = normalizeDir(configuredDir);
-  return (await store.listProfiles(tool.id)).find((profile) => normalizeDir(profile.dir) === normalized) ?? null;
+  const matches = (await store.listProfiles(tool.id)).filter((profile) => normalizeDir(profile.dir) === normalized);
+  if (matches.length > 1)
+    throw new Error("account attribution: multiple profiles match the configured directory");
+  return matches[0] ?? null;
 }
 async function resolveAccountForAgent(agent, env = process.env, options = {}) {
   const override = envOverride(agent, env);
@@ -9247,8 +9403,15 @@ async function resolveAccountForAgent(agent, env = process.env, options = {}) {
       continue;
     const envProfile = await profileForEnvDir(store, tool, env);
     if (envProfile)
-      return fromProfile(envProfile, "env");
-    const appliedName = appliedProfileName(toolId);
+      return envProfile.switchedAway ? null : fromProfile(envProfile, "env");
+    if (store.registry === "subscriptions" && env[tool.envVar])
+      return null;
+    if (store.appliedProfile) {
+      const applied = await store.appliedProfile(toolId);
+      if (applied)
+        return applied.switchedAway ? null : fromProfile(applied, "applied");
+    }
+    const appliedName = store.registry === "subscriptions" ? undefined : appliedProfileName(toolId);
     if (appliedName) {
       const applied = await store.findProfile(appliedName, toolId);
       if (applied)
@@ -11629,7 +11792,8 @@ function buildBrief(db, opts = {}) {
 }
 
 // src/lib/analytics.ts
-function queryProjectDetail(db, nameOrPath) {
+function queryProjectDetail(db, nameOrPath, now = new Date) {
+  const dailyBounds = resolveReportingInterval({ kind: "rolling", unit: "day", count: 14 }, now);
   const like = `%${nameOrPath}%`;
   const sessions = db.prepare(`SELECT id, project_name, project_path, total_cost_usd, total_tokens, started_at
      FROM economy_effective_sessions
@@ -11643,8 +11807,8 @@ function queryProjectDetail(db, nameOrPath) {
   const daily = db.prepare(`SELECT DATE(r.timestamp) as date, COALESCE(SUM(r.cost_usd), 0) as cost_usd
      FROM economy_effective_requests r JOIN economy_effective_sessions s ON r.session_id = s.id
      WHERE (s.project_name LIKE ? OR s.project_path LIKE ?)
-       AND r.timestamp >= DATE('now', '-14 days')
-     GROUP BY date ORDER BY date ASC`).all(like, like);
+       AND r.timestamp >= ? AND r.timestamp < ?
+     GROUP BY date ORDER BY date ASC`).all(like, like, dailyBounds.start, dailyBounds.end_exclusive);
   const models = db.prepare(`SELECT r.model as model, COUNT(*) as requests, COALESCE(SUM(r.cost_usd), 0) as cost_usd
      FROM economy_effective_requests r JOIN economy_effective_sessions s ON r.session_id = s.id
      WHERE s.project_name LIKE ? OR s.project_path LIKE ?
@@ -11683,18 +11847,17 @@ function queryRangeStats(db, from, to) {
   return { cost: r.cost, requests: r.requests, tokens: r.tokens, sessions: s.sessions };
 }
 function queryForecast(db, now = new Date) {
-  const daysInMonth = new Date(now.getFullYear(), now.getMonth() + 1, 0).getDate();
-  const dayOfMonth = now.getDate();
-  const monthStart = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-01`;
-  const monthSoFar = db.prepare(`SELECT COALESCE(SUM(cost_usd),0) as cost FROM economy_effective_requests WHERE DATE(timestamp) >= ?`).get(monthStart);
+  const month = resolveReportingInterval({ kind: "calendar", period: "month" }, now);
+  const recent = resolveReportingInterval({ kind: "rolling", unit: "day", count: 7 }, now);
+  const daysInMonth = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 0)).getUTCDate();
+  const dayOfMonth = now.getUTCDate();
+  const monthSoFar = db.prepare(`SELECT COALESCE(SUM(cost_usd),0) as cost FROM economy_effective_requests WHERE timestamp >= ? AND timestamp < ?`).get(month.start, recent.end_exclusive);
   const dailyAvg = dayOfMonth > 0 ? monthSoFar.cost / dayOfMonth : 0;
   const projected = dailyAvg * daysInMonth;
-  const sevenDaysAgo = new Date(now);
-  sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 7);
-  const last7 = db.prepare(`SELECT COALESCE(SUM(cost_usd),0) as cost FROM economy_effective_requests WHERE DATE(timestamp) >= ?`).get(sevenDaysAgo.toISOString().substring(0, 10));
+  const last7 = db.prepare(`SELECT COALESCE(SUM(cost_usd),0) as cost FROM economy_effective_requests WHERE timestamp >= ? AND timestamp < ?`).get(recent.start, recent.end_exclusive);
   const last7DailyAvg = last7.cost / 7;
   const dailyCosts = db.prepare(`SELECT DATE(timestamp) as date, COALESCE(SUM(cost_usd),0) as cost_usd
-     FROM economy_effective_requests WHERE DATE(timestamp) >= ? GROUP BY date ORDER BY cost_usd ASC`).all(monthStart);
+     FROM economy_effective_requests WHERE timestamp >= ? AND timestamp < ? GROUP BY date ORDER BY cost_usd ASC`).all(month.start, recent.end_exclusive);
   return {
     day_of_month: dayOfMonth,
     days_in_month: daysInMonth,
@@ -11871,7 +12034,13 @@ function createDataHandler(db, actorId) {
     if (path === "/api/daily" && method === "GET") {
       const days = Number(url.searchParams.get("days") ?? 30);
       const machine = url.searchParams.get("machine") ?? undefined;
-      return ok(queryDailyBreakdown(db, days, machine));
+      const now = new Date;
+      try {
+        resolveReportingInterval({ kind: "rolling", unit: "day", count: days }, now);
+      } catch {
+        return err("days must be a positive integer within the supported UTC date range");
+      }
+      return ok(queryDailyBreakdown(db, days, machine, now));
     }
     if (path === "/api/hourly" && method === "GET") {
       const machine = url.searchParams.get("machine") ?? undefined;

package/dist/server/service-operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-operations.d.ts","sourceRoot":"","sources":["../../src/server/service-operations.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,IAAI,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAuCxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AA6jB5E,gHAAgH;AAChH,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAe/G"}
+{"version":3,"file":"service-operations.d.ts","sourceRoot":"","sources":["../../src/server/service-operations.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,IAAI,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAuCxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAgkB5E,gHAAgH;AAChH,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAe/G"}