@hasna/economy 0.5.3 → 0.5.4

package/dist/server/service-worker.js

@@ -4295,7 +4295,7 @@ import { join as join4, basename } from "path";
 import { existsSync as existsSync4, readFileSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join3 } from "path";
-import { z } from "zod";
+import { z as z2 } from "zod";
 import { resolveClientTransport, resolveCredential } from "@hasna/contracts/client";
 
 // src/lib/cloud-storage.ts
@@ -4314,33 +4314,138 @@ import { createHasnaStorageClient } from "@hasna/contracts/client/storage";
 var LOCAL_STORAGE_OPT_IN_KEYS = ["HASNA_ECONOMY_LOCAL", "ECONOMY_LOCAL"];
 var CONTRACTS_AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
 
-// src/lib/accounts-store.ts
-var ACCOUNTS_APP = "accounts";
-var profileNameSchema = z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "must be lowercase alphanumeric/hyphen and start with a letter or digit");
+// src/lib/subscriptions-registry.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { isAbsolute } from "path";
+import { z } from "zod";
+var execute = promisify(execFile);
+var readSubscriptionsMetadata = async (args, env) => {
+  let stdout;
+  try {
+    const result = await execute("subscriptions", args, {
+      env,
+      encoding: "utf8",
+      timeout: 30000,
+      maxBuffer: 16 * 1024 * 1024,
+      windowsHide: true
+    });
+    stdout = result.stdout;
+  } catch (error) {
+    const code = error?.code;
+    if (code === "ENOENT")
+      throw new Error("subscriptions: CLI not found on PATH; install the Subscriptions CLI to resolve station account metadata");
+    const status = typeof code === "number" && Number.isInteger(code) ? `exit ${code}` : "execution limit or transport failure";
+    throw new Error(`subscriptions: read-only metadata command failed (${status}); verify the installed CLI and its hosted credentials`);
+  }
+  try {
+    return JSON.parse(stdout);
+  } catch {
+    throw new Error("subscriptions: metadata command returned invalid JSON");
+  }
+};
+var nonempty = z.string().min(1);
 var profileSchema = z.object({
-  name: z.string(),
-  tool: z.string(),
+  name: nonempty,
+  tool: nonempty,
   email: z.string().optional(),
   displayName: z.string().optional(),
-  dir: z.string(),
+  dir: nonempty.refine(isAbsolute).refine((value) => !/[\0\r\n]/.test(value)),
+  createdAt: nonempty,
+  lastUsedAt: z.string().optional(),
   description: z.string().optional(),
-  createdAt: z.string(),
-  lastUsedAt: z.string().optional()
+  active: z.boolean(),
+  applied: z.boolean(),
+  switchedAway: z.object({ profile: nonempty, email: z.string().optional() }).optional()
 });
-var toolDefSchema = z.object({
-  id: z.string(),
-  label: z.string(),
-  envVar: z.string(),
-  defaultDir: z.string(),
-  bin: z.string()
+var toolsSchema = z.array(z.object({
+  id: nonempty,
+  label: nonempty,
+  envVar: nonempty,
+  defaultDir: nonempty,
+  bin: nonempty
+}));
+function unique(rows, identity) {
+  if (new Set(rows.map(identity)).size !== rows.length) {
+    throw new Error("subscriptions: duplicate identity in metadata response");
+  }
+  return rows;
+}
+
+class SubscriptionsRegistry {
+  read;
+  transport = "api";
+  registry = "subscriptions";
+  env;
+  profiles;
+  tools;
+  constructor(baseUrl, env, read = readSubscriptionsMetadata) {
+    this.read = read;
+    this.env = { ...env, HASNA_SUBSCRIPTIONS_API_URL: baseUrl.replace(/\/v1\/?$/, "") };
+  }
+  allProfiles() {
+    return this.profiles ??= this.read(["list", "--json"], this.env).then((raw) => {
+      const parsed = z.array(profileSchema).safeParse(raw);
+      if (!parsed.success)
+        throw new Error("subscriptions: invalid profile metadata response");
+      return unique(parsed.data, (row) => JSON.stringify([row.tool, row.name]));
+    });
+  }
+  async listProfiles(tool) {
+    const rows = await this.allProfiles();
+    return rows.filter((row) => !tool || row.tool === tool);
+  }
+  async findProfile(name, tool) {
+    const matches = (await this.listProfiles(tool)).filter((row) => row.name === name);
+    return matches.length === 1 ? matches[0] : undefined;
+  }
+  async appliedProfile(tool) {
+    const matches = (await this.allProfiles()).filter((row) => row.tool === tool && row.applied);
+    if (matches.length > 1)
+      throw new Error("subscriptions: ambiguous station applied-profile binding");
+    return matches[0];
+  }
+  async currentProfile(_tool) {
+    return;
+  }
+  async listTools() {
+    return this.tools ??= this.read(["tools", "list", "--json"], this.env).then((raw) => {
+      const parsed = toolsSchema.safeParse(raw);
+      if (!parsed.success)
+        throw new Error("subscriptions: invalid tool metadata response");
+      return unique(parsed.data, (row) => row.id);
+    });
+  }
+}
+
+// src/lib/accounts-store.ts
+var ACCOUNTS_APP = "accounts";
+var profileNameSchema = z2.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "must be lowercase alphanumeric/hyphen and start with a letter or digit");
+var profileSchema2 = z2.object({
+  name: z2.string(),
+  tool: z2.string(),
+  email: z2.string().optional(),
+  displayName: z2.string().optional(),
+  dir: z2.string(),
+  description: z2.string().optional(),
+  createdAt: z2.string(),
+  lastUsedAt: z2.string().optional(),
+  switchedAway: z2.object({ profile: z2.string().min(1), email: z2.string().optional() }).optional()
+});
+var toolDefSchema = z2.object({
+  id: z2.string(),
+  label: z2.string(),
+  envVar: z2.string(),
+  defaultDir: z2.string(),
+  bin: z2.string()
 });
-var storeSchema = z.object({
-  version: z.literal(1),
-  current: z.record(z.string(), z.string()).default({}),
-  applied: z.record(z.string(), z.string()).default({}),
-  toolLocks: z.record(z.string(), z.string()).default({}),
-  profiles: z.array(profileSchema).default([]),
-  tools: z.array(toolDefSchema).default([])
+var storeSchema = z2.object({
+  version: z2.literal(1),
+  current: z2.record(z2.string(), z2.string()).default({}),
+  applied: z2.record(z2.string(), z2.string()).default({}),
+  toolLocks: z2.record(z2.string(), z2.string()).default({}),
+  profiles: z2.array(profileSchema2).default([]),
+  tools: z2.array(toolDefSchema).default([])
 });
 function localRegistryAllowed(env = process.env) {
   return LOCAL_STORAGE_OPT_IN_KEYS.some((key) => {
@@ -4622,25 +4727,34 @@ class ApiStore {
   }
 }
 function resolveStore(env = process.env, options = {}) {
+  const legacy = resolveRegistryTransport(ACCOUNTS_APP, env, options.credentials);
+  if (legacy)
+    return new ApiStore(legacy.baseUrl, legacy.apiKey);
+  const current = resolveRegistryTransport("subscriptions", env, options.subscriptionsCredentials);
+  if (current)
+    return new SubscriptionsRegistry(current.baseUrl, env, options.readSubscriptionsMetadata);
+  return unconfiguredStore(env);
+}
+function resolveRegistryTransport(app, env, credentials) {
   const clientEnv = env;
-  const credential = resolveCredential(ACCOUNTS_APP, clientEnv, options.credentials);
+  const credential = resolveCredential(app, clientEnv, credentials);
   if (credential === null) {
     try {
-      resolveClientTransport(ACCOUNTS_APP, clientEnv, options.credentials ? { credentials: options.credentials } : {});
+      resolveClientTransport(app, clientEnv, credentials ? { credentials } : {});
     } catch (err) {
       if (isNoAccountsCredentialConfigurationError(err))
-        return unconfiguredStore(env);
+        return null;
       throw err;
     }
-    return unconfiguredStore(env);
+    return null;
   }
   if (credential.tier === "pointer") {
-    throw new Error(`accounts: ${credential.source} names a secrets-vault item, and the local accounts API store resolves ` + "credentials synchronously, so it cannot complete the pointer per request. It is a deliberate " + "selection and is not resolved around. Use a literal tier instead \u2014 the Keychain item " + "hasna.credentials.accounts.api-key, ~/.hasna/accounts/config/credentials, or HASNA_ACCOUNTS_API_KEY.");
+    throw new Error(`${app}: ${credential.source} names a secrets-vault item, and the registry adapter resolves ` + "credentials synchronously, so it cannot complete the pointer per request. It is a deliberate " + "selection and is not resolved around. Use a literal tier instead \u2014 the Keychain item " + `hasna.credentials.${app}.api-key, ~/.hasna/${app}/config/credentials, or HASNA_${app.toUpperCase()}_API_KEY.`);
   }
-  const resolution = resolveClientTransport(ACCOUNTS_APP, clientEnv, {
-    credentials: { ...options.credentials, apiKey: credential.apiKey }
+  const resolution = resolveClientTransport(app, clientEnv, {
+    credentials: { ...credentials, apiKey: credential.apiKey }
   });
-  return new ApiStore(resolution.baseUrl, credential.apiKey);
+  return { baseUrl: resolution.baseUrl, apiKey: credential.apiKey };
 }
 function isNoAccountsCredentialConfigurationError(error) {
   if (typeof error !== "object" || error === null)
@@ -4657,10 +4771,10 @@ function unconfiguredStore(env) {
   return new NoRegistryStore;
 }
 function accountsLocalModeNotice() {
-  return `accounts: LOCAL mode (${LOCAL_STORAGE_OPT_IN_KEYS[0]}=1) \u2014 no Hasna Accounts credential resolved, so ` + "attribution reads the on-box JSON registry (~/.hasna/accounts/accounts.json) instead of accounts-serve. " + "To go hosted, put the fleet key in the Keychain item hasna.credentials.accounts.api-key, write " + "~/.hasna/accounts/config/credentials, or set HASNA_ACCOUNTS_API_KEY.";
+  return `accounts: LOCAL mode (${LOCAL_STORAGE_OPT_IN_KEYS[0]}=1) \u2014 neither Accounts nor Subscriptions credentials resolved, so ` + "attribution reads the on-box JSON registry (~/.hasna/accounts/accounts.json) instead of accounts-serve. " + "For hosted attribution, configure the Subscriptions CLI through its normal sign-in or credential resolver.";
 }
 function accountsRefusalNotice() {
-  return "accounts: no Hasna Accounts credential resolved (Keychain item hasna.credentials.accounts.api-key, " + "~/.hasna/accounts/config/credentials, HASNA_ACCOUNTS_API_KEY), so spend attribution is omitted. The " + `on-box registry (~/.hasna/accounts/accounts.json) is NOT read without ${LOCAL_STORAGE_OPT_IN_KEYS[0]}=1 \u2014 ` + "economy fails closed instead of attributing hosted spend from an on-box file.";
+  return "accounts: neither Accounts nor Subscriptions credentials resolved (legacy hasna.credentials.accounts.api-key, " + "~/.hasna/accounts/config/credentials, HASNA_ACCOUNTS_API_KEY; current hasna.credentials.subscriptions.api-key, " + "~/.hasna/subscriptions/config/credentials, HASNA_SUBSCRIPTIONS_API_KEY), so spend attribution is omitted. The " + `on-box registry (~/.hasna/accounts/accounts.json) is NOT read without ${LOCAL_STORAGE_OPT_IN_KEYS[0]}=1 \u2014 ` + "economy fails closed instead of attributing hosted spend from an on-box file.";
 }
 var accountsLocalNoticePrinted = false;
 function announceAccountsLocalMode() {
@@ -4748,7 +4862,10 @@ async function profileForEnvDir(store, tool, env) {
   if (!configuredDir)
     return null;
   const normalized = normalizeDir(configuredDir);
-  return (await store.listProfiles(tool.id)).find((profile) => normalizeDir(profile.dir) === normalized) ?? null;
+  const matches = (await store.listProfiles(tool.id)).filter((profile) => normalizeDir(profile.dir) === normalized);
+  if (matches.length > 1)
+    throw new Error("account attribution: multiple profiles match the configured directory");
+  return matches[0] ?? null;
 }
 async function resolveAccountForAgent(agent, env = process.env, options = {}) {
   const override = envOverride(agent, env);
@@ -4762,8 +4879,15 @@ async function resolveAccountForAgent(agent, env = process.env, options = {}) {
       continue;
     const envProfile = await profileForEnvDir(store, tool, env);
     if (envProfile)
-      return fromProfile(envProfile, "env");
-    const appliedName = appliedProfileName(toolId);
+      return envProfile.switchedAway ? null : fromProfile(envProfile, "env");
+    if (store.registry === "subscriptions" && env[tool.envVar])
+      return null;
+    if (store.appliedProfile) {
+      const applied = await store.appliedProfile(toolId);
+      if (applied)
+        return applied.switchedAway ? null : fromProfile(applied, "applied");
+    }
+    const appliedName = store.registry === "subscriptions" ? undefined : appliedProfileName(toolId);
     if (appliedName) {
       const applied = await store.findProfile(appliedName, toolId);
       if (applied)
@@ -7305,7 +7429,7 @@ import { randomUUID } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/economy",
-  version: "0.5.3",
+  version: "0.5.4",
   description: "AI coding cost tracker \u2014 CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   repository: {
     type: "git",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/economy",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "AI coding cost tracker — CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   "repository": {
     "type": "git",