@hasna/economy 0.5.5 → 0.5.7

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.5.7
+
+### Patch Changes
+
+- Support first-phone QR setup through private owner-Terminal login or explicitly confirmed signup. Accept signup HTTP 201 and attempt cleanup on catchable Terminal shutdown while preserving supplied sessions.
+
+## 0.5.6
+
+### Patch Changes
+
+- Transfer preserved original rows and temporary restore rehearsals in bounded queries while retaining complete-session checks and exact PostgreSQL row bytes.
+- Accept current Apple iPhone development profiles that list iOS alongside xrOS and visionOS, while retaining exact signing identity, bundle, device and expiry checks.
+- Connect iPhone with QR scanning or secure Paste, and approve a Mac's expiring QR from the phone. Store independent Economy-only device sessions and retain workspace, scope and revocation checks.
+
+  Include the Terminal pairing launcher and renderer in the installed package so an agent can open the owner's QR window using a Secrets reference.
+
+- Pass the exact Apple team and bundle verification requirement as literal codesign source for native release checks.
+
 ## 0.5.5
 
 ### Patch Changes

package/dist/chunks/{index-7k1xt8mj.js → index-6yr4hb72.js}

@@ -4,7 +4,7 @@ import {
 } from "./index-w3bvv0ns.js";
 import {
   getStore
-} from "./index-z9psed59.js";
+} from "./index-z2n5y111.js";
 import {
   formatReportedUsd,
   formatSummaryCoverage,

package/dist/chunks/{index-pnnqdv3r.js → index-b6c649mq.js}

@@ -20,7 +20,7 @@ import {
 // package.json
 var package_default = {
   name: "@hasna/economy",
-  version: "0.5.5",
+  version: "0.5.7",
   description: "AI coding cost tracker \u2014 CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   repository: {
     type: "git",
@@ -53,6 +53,8 @@ var package_default = {
   files: [
     "dist",
     "docs",
+    "native/Tools/pair-qr.py",
+    "native/Tools/pair-qr.swift",
     "postinstall.js",
     "LICENSE",
     "README.md",

package/dist/chunks/{index-61c0vz9p.js → index-wq7c4wqs.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   LOCAL_STORAGE_OPT_IN_KEYS
-} from "./index-pnnqdv3r.js";
+} from "./index-b6c649mq.js";
 import {
   assessCostFromDb,
   getIngestState,

package/dist/chunks/{index-z9psed59.js → index-z2n5y111.js}

@@ -14,7 +14,7 @@ import {
   querySavingsSummary,
   requireCurrentBillingDiffSummary,
   requireCurrentSavingsReport
-} from "./index-pnnqdv3r.js";
+} from "./index-b6c649mq.js";
 import {
   deleteBudget,
   deleteGoal,

package/dist/chunks/{serve-zp5a3qzw.js → serve-ms8dvf7e.js}

@@ -5,7 +5,7 @@ import {
 } from "./index-w3bvv0ns.js";
 import {
   syncAll
-} from "./index-61c0vz9p.js";
+} from "./index-wq7c4wqs.js";
 import {
   buildBrief,
   packageMetadata,
@@ -16,7 +16,7 @@ import {
   queryProjectDetail,
   queryRangeStats,
   querySavingsSummary
-} from "./index-pnnqdv3r.js";
+} from "./index-b6c649mq.js";
 import {
   AGENTS,
   INGEST_SCHEMA_SQL,

package/dist/chunks/{tui-2yea642b.js → tui-9t7340wd.js}

@@ -6,10 +6,10 @@ import {
   printStatusLine,
   printWaybarJson,
   runTui
-} from "./index-7k1xt8mj.js";
+} from "./index-6yr4hb72.js";
 import"./index-w3bvv0ns.js";
-import"./index-z9psed59.js";
-import"./index-pnnqdv3r.js";
+import"./index-z2n5y111.js";
+import"./index-b6c649mq.js";
 import"./index-f5jv6q5q.js";
 import"./index-p35cyhc4.js";
 export {

package/dist/chunks/{watch-811vncjz.js → watch-t6ssnx30.js}

@@ -2,12 +2,12 @@
 import {
   agentPaths,
   syncAll
-} from "./index-61c0vz9p.js";
+} from "./index-wq7c4wqs.js";
 import {
   getStore,
   isCloudStore
-} from "./index-z9psed59.js";
-import"./index-pnnqdv3r.js";
+} from "./index-z2n5y111.js";
+import"./index-b6c649mq.js";
 import {
   formatSummaryValue
 } from "./index-f5jv6q5q.js";

package/dist/cli/index.js

@@ -8,22 +8,22 @@ import {
 import {
   buildStatusLine,
   gatherStatusData
-} from "../chunks/index-7k1xt8mj.js";
+} from "../chunks/index-6yr4hb72.js";
 import"../chunks/index-w3bvv0ns.js";
 import {
   agentPaths,
   syncAll
-} from "../chunks/index-61c0vz9p.js";
+} from "../chunks/index-wq7c4wqs.js";
 import {
   getStore,
   isCloudStore
-} from "../chunks/index-z9psed59.js";
+} from "../chunks/index-z2n5y111.js";
 import {
   billingDriftCheck,
   economyCloudStorage,
   economyTransportReport,
   packageMetadata
-} from "../chunks/index-pnnqdv3r.js";
+} from "../chunks/index-b6c649mq.js";
 import {
   AGENTS,
   MAX_INGEST_BYTES,
@@ -1357,23 +1357,23 @@ function registerExtendedCommands(program) {
     console.log();
   });
   program.command("tui").description("Terminal status dashboard (Linux/SSH friendly)").option("--watch", "Live refresh").option("--interval <seconds>", "Refresh interval", "30").action(async (opts) => {
-    const { runTui } = await import("../chunks/tui-2yea642b.js");
+    const { runTui } = await import("../chunks/tui-9t7340wd.js");
     await runTui({
       watch: Boolean(opts.watch),
       interval: Number(opts.interval ?? 30)
     });
   });
   program.command("waybar").description("Print waybar-compatible JSON status line").action(async () => {
-    const { printWaybarJson } = await import("../chunks/tui-2yea642b.js");
+    const { printWaybarJson } = await import("../chunks/tui-9t7340wd.js");
     await printWaybarJson();
   });
   const barCmd = program.command("bar").description("Status bar helpers (Linux)");
   barCmd.command("tui").description("Alias for economy tui").option("--watch", "Live refresh").action(async (opts) => {
-    const { runTui } = await import("../chunks/tui-2yea642b.js");
+    const { runTui } = await import("../chunks/tui-9t7340wd.js");
     await runTui({ watch: Boolean(opts.watch) });
   });
   barCmd.command("waybar").description("Alias for economy waybar").action(async () => {
-    const { printWaybarJson } = await import("../chunks/tui-2yea642b.js");
+    const { printWaybarJson } = await import("../chunks/tui-9t7340wd.js");
     await printWaybarJson();
   });
   program.command("estimate").description("Estimate cost for token counts").requiredOption("--model <model>", "Model name").option("--input <n>", "Input tokens", "0").option("--output <n>", "Output tokens", "0").action(async (opts) => {
@@ -3198,7 +3198,7 @@ program.command("accounts [period]").description("List account usage by email ad
   console.log();
 });
 program.command("watch").description("Live stream of incoming costs").option("--interval <seconds>", "Poll interval in seconds", "10").option("--daemon", "Watch agent data directories and sync on change").option("--agent <agent>", `Filter by agent (${AGENTS.join("|")})`).option("--notify <amount>", "Fire macOS notification when cumulative cost crosses this USD threshold").action(async (opts) => {
-  const { watchCosts } = await import("../chunks/watch-811vncjz.js");
+  const { watchCosts } = await import("../chunks/watch-t6ssnx30.js");
   await watchCosts({
     interval: parsePositiveCliInteger(opts.interval ?? "10", "--interval"),
     daemon: Boolean(opts.daemon),
@@ -3434,7 +3434,7 @@ pricingCmd.command("remove <model>").description("Remove pricing for a model").a
 });
 program.command("serve").description("Start the REST API server").option("-p, --port <port>", "Port", "3456").action(async (opts) => {
   const port = parseCliPort(opts.port ?? "3456", "--port");
-  const { startServer } = await import("../chunks/serve-zp5a3qzw.js");
+  const { startServer } = await import("../chunks/serve-ms8dvf7e.js");
   startServer(port);
 });
 program.command("mcp").description("Show MCP server install commands").option("--claude", "Install into Claude Code").option("--codex", "Install into Codex").option("--gemini", "Install into Gemini CLI").option("--all", "Install into all agents").action(async (opts) => {

package/dist/index.js

@@ -62,7 +62,7 @@ import { randomUUID } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/economy",
-  version: "0.5.5",
+  version: "0.5.7",
   description: "AI coding cost tracker \u2014 CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   repository: {
     type: "git",
@@ -95,6 +95,8 @@ var package_default = {
   files: [
     "dist",
     "docs",
+    "native/Tools/pair-qr.py",
+    "native/Tools/pair-qr.swift",
     "postinstall.js",
     "LICENSE",
     "README.md",

package/dist/mcp/index.js

@@ -85,7 +85,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 // package.json
 var package_default = {
   name: "@hasna/economy",
-  version: "0.5.5",
+  version: "0.5.7",
   description: "AI coding cost tracker \u2014 CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   repository: {
     type: "git",
@@ -118,6 +118,8 @@ var package_default = {
   files: [
     "dist",
     "docs",
+    "native/Tools/pair-qr.py",
+    "native/Tools/pair-qr.swift",
     "postinstall.js",
     "LICENSE",
     "README.md",

package/dist/otel/index.js

@@ -3480,7 +3480,7 @@ async function pushIngestRows(cloud, scratch) {
 // package.json
 var package_default = {
   name: "@hasna/economy",
-  version: "0.5.5",
+  version: "0.5.7",
   description: "AI coding cost tracker \u2014 CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   repository: {
     type: "git",
@@ -3513,6 +3513,8 @@ var package_default = {
   files: [
     "dist",
     "docs",
+    "native/Tools/pair-qr.py",
+    "native/Tools/pair-qr.swift",
     "postinstall.js",
     "LICENSE",
     "README.md",

package/dist/server/index.js

@@ -4909,6 +4909,48 @@ function assertLegacyPlanCurrent(expected, current) {
   if (!same(state(expected), state(current)))
     fail("Legacy plan is stale or belongs to a different store or schema");
 }
+async function originalPages(load, count3) {
+  const originals = [];
+  let after = null;
+  for (;; ) {
+    const page = await load(after);
+    if (!Array.isArray(page) || page.length > ORIGINAL_PAGE_ROWS)
+      fail("Invalid original transfer page");
+    for (const value of page) {
+      const row = record(value);
+      fields(row, ["id", "original"]);
+      if (typeof row.original !== "string")
+        fail("Invalid original transfer row");
+      const id = identifier3(row.id);
+      if (after !== null && cOrder(after, id) >= 0)
+        fail("Original transfer cursor did not advance");
+      after = id;
+      originals.push({ id, original: row.original });
+      if (originals.length > count3)
+        fail("Original transfer exceeds the complete population");
+    }
+    if (page.length < ORIGINAL_PAGE_ROWS) {
+      if (originals.length !== count3)
+        fail("Original transfer omitted part of the complete population");
+      return originals;
+    }
+  }
+}
+function* restoreBatches(originals) {
+  let rows = [], bytes = 2;
+  for (const row of originals) {
+    const size = Buffer.byteLength(row.original);
+    if (rows.length && (rows.length === ORIGINAL_PAGE_ROWS || bytes + 1 + size > RESTORE_BATCH_BYTES)) {
+      yield "[" + rows.join(",") + "]";
+      rows = [];
+      bytes = 2;
+    }
+    bytes += size + (rows.length ? 1 : 0);
+    rows.push(row.original);
+  }
+  if (rows.length)
+    yield "[" + rows.join(",") + "]";
+}
 function parseLegacyCapsule(value) {
   const c = record(value);
   const mode = legacyMode("capsule", c.schema);
@@ -4981,7 +5023,12 @@ async function preserveLegacyOriginals(client, input) {
       (SELECT COALESCE(SUM(octet_length(row_to_json(sessions)::text)),0) FROM sessions WHERE id=ANY($1::text[]))::text AS session_bytes`, [ids])).rows[0];
     if (!sizes || !/^[0-9]+$/.test(sizes.request_bytes) || !/^[0-9]+$/.test(sizes.session_bytes) || BigInt(sizes.request_bytes) + BigInt(sizes.session_bytes) > BigInt(mode.originalBytes))
       fail(`Preservation exceeds ${mode.originalBytes / 1024 / 1024} MiB of original row text; complete sessions cannot be truncated`);
-    const requests = (await client.query(`SELECT id,row_to_json(requests)::text AS original FROM requests WHERE session_id=ANY($1::text[]) ORDER BY session_id COLLATE "C",id COLLATE "C" LIMIT ${mode.members + 1}`, [ids])).rows;
+    const requests = [];
+    for (const session of current.sessions) {
+      requests.push(...await originalPages(async (after) => (await client.query(`SELECT id,row_to_json(requests)::text AS original FROM requests
+         WHERE session_id=$1::text AND ($2::text IS NULL OR id COLLATE "C" > $2::text COLLATE "C")
+         ORDER BY id COLLATE "C" LIMIT ${ORIGINAL_PAGE_ROWS}`, [session.id, after])).rows, session.request_count));
+    }
     const sessions = (await client.query(`SELECT id,row_to_json(sessions)::text AS original FROM sessions WHERE id=ANY($1::text[]) ORDER BY id COLLATE "C" LIMIT ${mode.sessions + 1}`, [ids])).rows;
     const body = { schema: mode.capsule, plan: expected, captured_at: current.snapshot.at, requests, sessions };
     return parseLegacyCapsule({ ...body, capsule_sha256: sha2(JSON.stringify(body)) });
@@ -5114,9 +5161,10 @@ async function rehearseLegacyRestore(client, input, scope = "transaction") {
     if ((await client.query("SELECT current_setting('transaction_read_only') AS read_only")).rows[0]?.read_only !== "on")
       fail("Restore reconstruction requires a read-only transaction");
     for (const { source, temp, originals } of restoreTables) {
-      const payload = "[" + originals.map((x) => x.original).join(",") + "]";
-      await client.query("INSERT INTO pg_temp." + temp + " SELECT * FROM json_populate_recordset(NULL::" + source + ",$1::json)", [payload]);
-      const restored = (await client.query("SELECT id,row_to_json(t)::text AS original FROM pg_temp." + temp + ' t ORDER BY id COLLATE "C"')).rows;
+      for (const payload of restoreBatches(originals)) {
+        await client.query("INSERT INTO pg_temp." + temp + " SELECT * FROM json_populate_recordset(NULL::" + source + ",$1::json)", [payload]);
+      }
+      const restored = await originalPages(async (after) => (await client.query("SELECT id,row_to_json(t)::text AS original FROM pg_temp." + temp + ' t WHERE ($1::text IS NULL OR id COLLATE "C" > $1::text COLLATE "C") ORDER BY id COLLATE "C" LIMIT ' + ORIGINAL_PAGE_ROWS, [after])).rows, originals.length);
       const expectedRows = [...originals].sort((a, b) => cOrder(a.id, b.id));
       if (!same(restored, expectedRows))
         fail("Restored original bytes differ from preservation");
@@ -5170,11 +5218,12 @@ var MAX_BYTES, sha2 = (s) => createHash7("sha256").update(s).digest("hex"), fail
 }, record = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : fail("Expected a JSON object"), hash = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v) ? v : fail("Expected a lowercase SHA-256 digest"), identifier3 = (v) => typeof v === "string" && v.length > 0 && v.length <= 1024 && !v.includes("\x00") ? v : fail("Expected a nonempty identifier of at most 1024 characters without NUL"), fields = (o, names) => {
   if (Object.keys(o).sort().join(",") !== [...names].sort().join(","))
     fail("Unexpected or missing preservation fields");
-}, cOrder = (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)), same = (a, b) => JSON.stringify(a) === JSON.stringify(b), quote3 = (s) => '"' + s.replaceAll('"', '""') + '"';
+}, cOrder = (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)), same = (a, b) => JSON.stringify(a) === JSON.stringify(b), quote3 = (s) => '"' + s.replaceAll('"', '""') + '"', ORIGINAL_PAGE_ROWS = 1000, RESTORE_BATCH_BYTES;
 var init_legacy_preservation = __esm(() => {
   init_legacy_plan();
   init_legacy_limits();
   MAX_BYTES = LEGACY_SINGLE_SESSION.capsuleBytes;
+  RESTORE_BATCH_BYTES = 1024 * 1024;
 });
 
 // src/server/legacy-operations.ts
@@ -5529,7 +5578,7 @@ function isAuthorizedRequest(req, path) {
 // package.json
 var package_default = {
   name: "@hasna/economy",
-  version: "0.5.5",
+  version: "0.5.7",
   description: "AI coding cost tracker \u2014 CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   repository: {
     type: "git",
@@ -5562,6 +5611,8 @@ var package_default = {
   files: [
     "dist",
     "docs",
+    "native/Tools/pair-qr.py",
+    "native/Tools/pair-qr.swift",
     "postinstall.js",
     "LICENSE",
     "README.md",

package/dist/server/legacy-preservation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"legacy-preservation.d.ts","sourceRoot":"","sources":["../../src/server/legacy-preservation.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgD,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACnH,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAc,MAAM,oBAAoB,CAAA;AAevF,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CA8C1D;AAOD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,CAEvF;AAED,UAAU,QAAQ;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AACnD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,OAAO,eAAe,CAAC,OAAO,GAAG,OAAO,qBAAqB,CAAC,OAAO,CAAA;IAC7E,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,QAAQ,EAAE,CAAA;IACpB,QAAQ,EAAE,QAAQ,EAAE,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CA4ChE;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAkB1G;AAmBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,SAAU,GAAG,OAAO,CAS5E;AAED;sFACsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAC,MAAM,EAAC,KAAK,EAAC,OAAO;;;;;;;;;;;EAwB3D;AAED;;kFAEkF;AAClF,wBAAsB,qBAAqB,CAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,OAAO,EAAC,KAAK,GAAC,aAAa,GAAC,WAAyB;;;;;;;;;;GAwD1H;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAC,MAAM,EAAC,IAAI,EAAC,MAAM,EAAE,GAAG;IAAC,KAAK,EAAC,MAAM,CAAC;IAAA,MAAM,CAAC,EAAC,MAAM,CAAA;CAAC,CAM1G;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAC,MAAM,EAAC,OAAO,EAAC;IAAC,KAAK,EAAC,MAAM,CAAC;IAAA,MAAM,CAAC,EAAC,MAAM,CAAA;CAAC,iBAgB/F"}
+{"version":3,"file":"legacy-preservation.d.ts","sourceRoot":"","sources":["../../src/server/legacy-preservation.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgD,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACnH,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAc,MAAM,oBAAoB,CAAA;AAevF,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CA8C1D;AAOD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,CAEvF;AAED,UAAU,QAAQ;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AA6CnD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,OAAO,eAAe,CAAC,OAAO,GAAG,OAAO,qBAAqB,CAAC,OAAO,CAAA;IAC7E,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,QAAQ,EAAE,CAAA;IACpB,QAAQ,EAAE,QAAQ,EAAE,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CA4ChE;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAwB1G;AAmBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,SAAU,GAAG,OAAO,CAS5E;AAED;sFACsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAC,MAAM,EAAC,KAAK,EAAC,OAAO;;;;;;;;;;;EAwB3D;AAED;;kFAEkF;AAClF,wBAAsB,qBAAqB,CAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,OAAO,EAAC,KAAK,GAAC,aAAa,GAAC,WAAyB;;;;;;;;;;GA2D1H;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAC,MAAM,EAAC,IAAI,EAAC,MAAM,EAAE,GAAG;IAAC,KAAK,EAAC,MAAM,CAAC;IAAA,MAAM,CAAC,EAAC,MAAM,CAAA;CAAC,CAM1G;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAC,MAAM,EAAC,OAAO,EAAC;IAAC,KAAK,EAAC,MAAM,CAAC;IAAA,MAAM,CAAC,EAAC,MAAM,CAAA;CAAC,iBAgB/F"}

package/dist/server/service-worker.js

@@ -7426,7 +7426,7 @@ import { randomUUID } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/economy",
-  version: "0.5.5",
+  version: "0.5.7",
   description: "AI coding cost tracker \u2014 CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   repository: {
     type: "git",
@@ -7459,6 +7459,8 @@ var package_default = {
   files: [
     "dist",
     "docs",
+    "native/Tools/pair-qr.py",
+    "native/Tools/pair-qr.swift",
     "postinstall.js",
     "LICENSE",
     "README.md",

package/native/README.md

@@ -0,0 +1,151 @@
+# Economy native applications
+
+Shared Swift models, canonical HTTPS clients and SwiftUI reports for the Mac
+menu bar (`../menubar/App`) and iPhone (`../ios`). Minimum macOS 14 / iOS 17;
+system glass controls on OS 26. Opaque data cards/lists, semantic fonts, Dynamic
+Type and native navigation retain the approved Usage / Spend direction.
+
+## Authentication and activation
+
+iPhone sign-in uses Scan pairing code, with a secure Paste fallback. The Mac
+shows a five-minute QR code; the signed-in iPhone inspects the computer and
+workspace and explicitly approves read-only access. Each device gets its own
+Economy-only Identities session. Scanning never approves a Mac automatically.
+
+The native adapter calls the pinned `economy-pairing` routes at
+`https://api.hasna.com/identities/v1`, selects the returned workspace, exchanges
+short-lived Economy tokens, refreshes and revokes the exact session on logout.
+The session stays in device-only Keychain storage after first unlock. The
+Economy access token stays in memory and goes only to
+`https://api.hasna.com/economy/v1`. Redirects, foreign QR authorities and responses
+with another app or tenant are refused. No station key importer, local server
+fallback or connect URL scheme is registered.
+
+An already authorized human session bootstraps the iPhone through
+`python3 native/Tools/pair-qr.py --tenant <workspace-id> --session-ref <human-session-reference>`.
+The launcher opens the owner's Terminal and projects the named Secrets reference
+there as `ECONOMY_HUMAN_SESSION`; it returns no Terminal output. Both issuer and
+renderer verify the direct Terminal ancestry and refuse captured harness PTYs.
+Never run real codes in a captured agent terminal. The helper obtains a
+single-use code, hands only that temporary code to the CoreImage renderer and
+clears the display within five minutes. `--self-test` decodes a synthetic QR;
+`test_pair_qr.py` proves transcript/agent-key refusal and credential confinement.
+Without a saved human session, use
+`python3 native/Tools/pair-qr.py --tenant <workspace-id> --login-email <human-email>`.
+The helper opens the owner's Terminal, asks for confirmation before requesting
+one sign-in email, and reads the verification code there with echo disabled.
+It verifies a human principal and the selected workspace before displaying the
+one-use QR. The new setup session stays in memory. On renderer exit or catchable
+Terminal shutdown (HUP, TERM or Ctrl-C), setup makes one timeout-limited logout
+attempt and reports an unconfirmed result as a failure. Force-kill, a reboot,
+network failure or an interrupted verification response can prevent confirmation;
+check the account's sessions before retrying in those cases. An existing session
+supplied with `--session-ref` is retained.
+Only the temporary QR code reaches the renderer, and no response or verification
+code is returned to the agent terminal.
+
+For a first account, `--create-account` offers signup through the existing
+Identities flow instead of login. It requires direct confirmation in the owner
+Terminal before account creation or email delivery. It does not create an
+organization, grant an owner role, alter memberships or configure Economy's
+store binding. An existing-account refusal is not retried as login, and failed
+delivery/verification is not retried automatically. Never type the owner's code
+for them or copy it into an agent session. A source/fixture test does not prove
+real email delivery, account authority or a successful phone connection.
+
+The adapter verifies Economy's `/auth/session` subject, tenant, effective scopes
+and integer expiry. Viewer sign-in never requests write access. Refresh and period
+changes cannot orphan an active send-code/verify/workspace operation. Write-only users
+remain signed in with a specific no-report-read-access state; native Save needs
+both write permission and the readback used to confirm the rule. Refresh and
+account/period changes fence pending responses. Sign-out clears local state first
+and reports unconfirmed remote revocation. A stale logout cannot clear a new login.
+
+**Hosted activation is off by default.** A reviewed delivery build passes
+`auth-enabled`; the build receipt records the exact activation value, version and
+build. An inactive artifact is not completed native delivery. Activation also
+requires the reviewed human audience, independently verified store tenant and
+principal allowlist, live grants, deployed server changes and owner-initiated
+sign-in acceptance. No automated real OTP/email operation was performed here.
+
+## Reports and exact budget recovery
+
+Reports use a captured session with generation/expiry checks before and after
+network work. Responses are capped at 8 MiB with at most four concurrent reads.
+Session and period changes cancel old work and clear the report. A failed refresh
+retains the original acquisition time; a 401/403 clears private data. Report cache
+is memory-only. Persistent offline reports are not implemented.
+
+Subscriptions, account breakdowns and quota observations use current unpaginated
+server arrays. Sessions traverse 100-row offset pages to a short final page, with
+a 2,000-record bound and visible truncation. Duplicate pages fail closed. Offset
+traversal is not a consistent snapshot; open records do not establish live work.
+Totals cover the complete returned population independently of search/visible
+rows. Known valuation subtotals distinguish missing prices/bases from affirmative
+known zero; exact acquired UTC calendar bounds remain separate from local timestamp
+display, including cached reports. Unknown fees and provider coverage remain explicit.
+Quota selection uses source time before station recording time, expires at reset or
+15 minutes, and a native one-second view timeline reevaluates it without network
+activity. Historical readings remain labeled. Budget scope labels include every
+project, agent and cost-center restriction conjunctively. Station timestamps
+are reported observations, not proof of a complete online fleet.
+
+Copy prompt is the first budget control. Its prominent action uses an explicit
+foreground/background pair in both appearances. Secondary Save requires current
+read and write permission again before dispatch/retry, and creates one immutable
+`metered_api_usd` rule through `/ingest`, then verifies its actor-bound receipt
+and authoritative budget status. It excludes subscriptions, estimates, unknown
+cost bases and provider billing. Calendar windows are UTC; weeks start Sunday.
+Saved rules are alert thresholds, never spending enforcement or verified delivery.
+
+Before POST, the complete command, stable UUID key and canonical body hash are
+persisted and read back in account-bound Keychain recovery storage. After response
+loss or restart, only explicit receipt checks and exact same-command retries are
+offered. An absent receipt does not prove an earlier request cannot commit. A new
+key never resolves an uncertain command. Retained recovery history is bounded to
+40 commands per account and fails closed at the bound. This is operational intent,
+not a local authoritative report store. The typed canonical JSON writer has hash
+parity vectors from the actual server, including Unicode and scalar edge cases.
+
+## Build and test
+
+Use an exact committed source copy on an Xcode 26 Mac. The dependency-free runner
+creates synthetic HOME/cache/DerivedData, kernel-enforces read-only station/source
+files, denies network, runs positive/negative write controls and checks source
+hashes. It invokes installed Apple `swiftc`, SDK and XCTest directly. Refused
+Xcode/SwiftPM shared temporary writes remain in task evidence; no boundary was
+relaxed to make those paths work.
+
+```sh
+python3 apps/economy/native/Tools/build-isolated.py test /absolute/.hasna/scratchpad/scratch/session/test-1
+python3 apps/economy/native/Tools/build-isolated.py mac /absolute/.hasna/scratchpad/scratch/session/mac-1 Release auth-disabled
+python3 apps/economy/native/Tools/build-isolated.py ios /absolute/.hasna/scratchpad/scratch/session/ios-1 Debug
+python3 apps/economy/native/Tools/build-isolated.py device /absolute/.hasna/scratchpad/scratch/session/device-1 Release auth-disabled
+# Reviewed delivery preparation supplies both actual release metadata values:
+# ... mac FRESH_PATH Release auth-enabled VERSION BUILD
+```
+
+Omitted version/build use fixture-only `0.1.0` / `1`, clearly recorded in the
+receipt. The existing macOS identifier is `com.hasna.economy-bar`, product
+`HasnaEconomy.app`, display name `HasnaEconomy`, and LSUIElement is true. No new
+identifier or signing registration is created. Signed iPhone identity, signing,
+notarization, installation and distribution remain coordinator operations.
+
+Debug apps accept `-demo -demoRoute usage|spend|unknown|account|budget|offline|empty|loading|error`.
+The 125-subscription fixture uses distinct provider/account IDs and no files,
+network or credential storage, even in an auth-enabled Debug build. Release
+must exclude fixture markers and arguments, using Debug as the positive control.
+The former localhost menu-bar Sources/Tests/Tools/Resources are retained but
+excluded by the replacement Package.swift target.
+
+`Tools/capture-ios.py` requires an explicit owned simulator/device set/name,
+captures light/dark and largest Dynamic Type, then shuts down only that device.
+The Mac helper captures only its own fresh fixture application's windows; its
+station14 SSH window-discovery failure remains open. A fixture window is not
+menu-bar interaction acceptance. Actual Mac interaction, keyboard/VoiceOver,
+minimum-OS fallback and signed-device acceptance are separate from compiler and
+fixture checks. Owner-facing screen captures go through Designs.
+
+Apple references: [MenuBarExtra](https://developer.apple.com/documentation/swiftui/menubarextra),
+[native design adoption](https://developer.apple.com/videos/play/wwdc2025/323/),
+[application delegate adaptor](https://developer.apple.com/documentation/swiftui/nsapplicationdelegateadaptor).

package/native/Tools/pair-qr.py

@@ -0,0 +1,222 @@
+#!/usr/bin/env python3
+"""Show a one-use Economy connection code only in the owner's Terminal.
+
+Pass an existing authorized human Identities session's Secrets reference using
+--session-ref. The launcher opens Terminal and projects it there. The server
+verifies the session and selected tenant; no station agent key works.
+"""
+import argparse
+import getpass
+import json
+import os
+from pathlib import Path
+import re
+import shlex
+import signal
+import subprocess
+import sys
+import urllib.request
+import warnings
+
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args, **kwargs):
+        return None
+
+
+def owner_terminal():
+    """Refuse captured harness PTYs, including a CLI inside a Terminal window.
+
+    This prevents accidental transcript delivery; it is not a privilege boundary
+    against another process running as the owner. Never screen-capture the code.
+    """
+    if not sys.stdout.isatty() or not sys.stdin.isatty():
+        return False
+    if any(os.environ.get(key) for key in ['CODEX_THREAD_ID', 'CODEX_INTERNAL_ORIGINATOR_OVERRIDE',
+                                          'CLAUDECODE', 'SUMI_SESSION_ID', 'OPENCODE_SESSION_ID']):
+        return False
+    pid = os.getppid()
+    for _ in range(12):
+        try:
+            result = subprocess.run(['/bin/ps', '-p', str(pid), '-o', 'ppid=', '-o', 'comm='],
+                                    capture_output=True, text=True, timeout=3)
+        except (OSError, subprocess.TimeoutExpired):
+            return False
+        if result.returncode:
+            return False
+        fields = result.stdout.strip().split(None, 1)
+        if len(fields) != 2 or not fields[0].isdigit():
+            return False
+        parent, executable = int(fields[0]), fields[1]
+        if executable == '/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal':
+            return True
+        if Path(executable).name not in ['Python', 'python3', 'bash', 'zsh', 'login', 'bun', 'secrets']:
+            return False
+        if parent <= 1 or parent == pid:
+            return False
+        pid = parent
+    return False
+
+
+def launch_owner_terminal(reference, tenant, email=None, create_account=False):
+    if reference is not None and not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9_./-]{0,254}', reference):
+        print('Invalid Secrets reference.', file=sys.stderr)
+        return 2
+    # AppleScript receives references and paths only. Its returned text never
+    # contains Terminal output. No QR or credential is returned to this process.
+    arguments = ['/usr/bin/python3', str(Path(__file__).resolve()), '--owner-terminal', '--tenant', tenant]
+    if email is not None:
+        arguments += ['--login-email', email]
+        if create_account:
+            arguments.append('--create-account')
+    else:
+        arguments = ['secrets', 'exec', reference, '--as', 'ECONOMY_HUMAN_SESSION', '--', *arguments]
+    command = shlex.join(arguments)
+    script = 'tell application "Terminal"\nactivate\ndo script ' + json.dumps(command) + '\nend tell\n'
+    try:
+        result = subprocess.run(['/usr/bin/osascript', '-'], input=script, text=True, capture_output=True, timeout=30)
+    except (OSError, subprocess.TimeoutExpired):
+        print('Could not confirm the owner Terminal window. Check Terminal before retrying.', file=sys.stderr)
+        return 1
+    if result.returncode:
+        print('Could not open the owner Terminal window. No code was displayed by this process.', file=sys.stderr)
+        return 1
+    print('Opened Economy setup in Terminal on this Mac. Complete the steps there, then scan its QR code.')
+    return 0
+
+
+def identity_request(action, body, bearer=None):
+    if action not in ['signup', 'login', 'verify', 'logout', 'economy-pairing/issue']:
+        raise ValueError('Unsupported identity operation')
+    headers = {'Content-Type': 'application/json', 'Accept': 'application/json',
+               'User-Agent': 'Hasna-Economy-Pairing/1.0'}
+    if bearer is not None:
+        headers['Authorization'] = 'Bearer ' + bearer
+    request = urllib.request.Request('https://api.hasna.com/identities/v1/auth/' + action,
+        data=json.dumps(body).encode(), headers=headers, method='POST')
+    with urllib.request.build_opener(NoRedirect).open(request, timeout=15) as response:
+        raw = response.read(16385)
+        if response.status != (201 if action == 'signup' else 200) or len(raw) > 16384:
+            raise ValueError('Invalid identity response')
+    value = json.loads(raw)
+    if not isinstance(value, dict):
+        raise ValueError('Invalid identity response')
+    return value
+
+
+def login_in_owner_terminal(email, create_account):
+    action = 'Create your Hasna sign-in and send one verification email to' if create_account else 'Send one sign-in email to'
+    if input(action + ' ' + email + '? Type yes to continue: ').strip().lower() != 'yes':
+        print('Cancelled. No email was requested.')
+        return None
+    challenge = identity_request('signup' if create_account else 'login', {'email': email})
+    if challenge.get('challenge') is not True or challenge.get('email_sent') is False:
+        raise ValueError('Email challenge unavailable')
+    with warnings.catch_warnings():
+        warnings.simplefilter('error', getpass.GetPassWarning)
+        code = getpass.getpass('Verification code (hidden; enter only in this Terminal): ')
+    if not re.fullmatch(r'[0-9]{6}', code):
+        raise ValueError('Invalid verification code')
+    try:
+        return identity_request('verify', {'email': email, 'code': code})
+    finally:
+        code = None
+
+
+def render_pairing_code(human, tenant, renderer):
+    value = identity_request('economy-pairing/issue', {'tenant_id': tenant, 'device_name': 'Your iPhone'}, human)
+    if not re.fullmatch(r'hec_[A-Za-z0-9_-]{43}', value.get('code', '')) or not 1 <= value.get('expires_in', 0) <= 300:
+        raise ValueError('Invalid pairing response')
+    environment = {k: v for k, v in os.environ.items() if k in
+                   ['PATH', 'HOME', 'TMPDIR', 'LANG', 'TERM', 'DEVELOPER_DIR', 'CLANG_MODULE_CACHE_PATH']}
+    environment['ECONOMY_PAIR_CODE'] = value['code']
+    environment['ECONOMY_PAIR_SERVER'] = 'https://api.hasna.com/economy'
+    environment['ECONOMY_PAIR_TTL'] = str(value['expires_in'])
+    return subprocess.run(['/usr/bin/swift', str(renderer)], env=environment).returncode
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--tenant', help='Exact workspace ID, resolved through Identities')
+    parser.add_argument('--self-test', action='store_true')
+    source = parser.add_mutually_exclusive_group()
+    source.add_argument('--session-ref', help='Authorized human-session reference in Secrets; never a value')
+    source.add_argument('--login-email', help='Sign in privately in the owner Terminal before displaying the QR code')
+    parser.add_argument('--create-account', action='store_true', help='Offer first-account signup in the owner Terminal; requires --login-email and direct confirmation')
+    parser.add_argument('--owner-terminal', action='store_true', help=argparse.SUPPRESS)
+    args = parser.parse_args()
+    human = os.environ.pop('ECONOMY_HUMAN_SESSION', None)
+    renderer = Path(__file__).with_name('pair-qr.swift')
+    if args.self_test:
+        return subprocess.run(['/usr/bin/swift', str(renderer), '--self-test']).returncode
+    if not args.tenant or not re.fullmatch(r'[A-Za-z0-9_-]{1,255}', args.tenant):
+        print('Provide the exact authorized workspace with --tenant.', file=sys.stderr)
+        return 2
+    if args.create_account and not args.login_email:
+        print('--create-account requires --login-email.', file=sys.stderr)
+        return 2
+    if args.login_email is not None and (len(args.login_email) > 320 or not re.fullmatch(r'[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+', args.login_email)):
+        print('Provide a valid sign-in email address.', file=sys.stderr)
+        return 2
+    if not args.owner_terminal:
+        if not args.session_ref and not args.login_email:
+            print('Use --session-ref or --login-email to open the owner Terminal. Credential values are not accepted here.', file=sys.stderr)
+            return 3
+        return launch_owner_terminal(args.session_ref, args.tenant, args.login_email, args.create_account)
+    if args.session_ref or not owner_terminal():
+        print('Refusing to show a connection code outside the direct owner Terminal path.', file=sys.stderr)
+        return 3
+    if args.login_email and human:
+        print('Choose either a saved session or interactive sign-in.', file=sys.stderr)
+        return 2
+    if not args.login_email and (not human or not re.fullmatch(r'hst_[A-Za-z0-9_-]{43}', human)):
+        print('An existing human Identities session is required via ECONOMY_HUMAN_SESSION. Station keys are refused.', file=sys.stderr)
+        return 2
+    created_session = None
+    result = 1
+    previous_handlers = {}
+    cleaning_up = False
+    def shutdown(signum, frame):
+        if not cleaning_up:
+            raise KeyboardInterrupt
+    try:
+        for sig in [signal.SIGHUP, signal.SIGTERM, signal.SIGINT]:
+            previous_handlers[sig] = signal.signal(sig, shutdown)
+        if args.login_email:
+            identity = login_in_owner_terminal(args.login_email, args.create_account)
+            if identity is None:
+                return 0
+            human = identity.get('session')
+            if not isinstance(human, str) or not re.fullmatch(r'hst_[A-Za-z0-9_-]{43}', human):
+                raise ValueError('Invalid human session')
+            created_session = human
+            if identity.get('principal', {}).get('kind') != 'human' or not any(
+                    isinstance(row, dict) and row.get('tenant_id') == args.tenant for row in identity.get('tenants', [])):
+                raise ValueError('Human or workspace mismatch')
+            identity = None
+            print('Scan this code before closing its window. Setup will then try to sign out its temporary session.')
+        result = render_pairing_code(human, args.tenant, renderer)
+    except (Exception, KeyboardInterrupt):
+        print('Unable to complete setup. No automatic email or sign-in retry was made. Check your account and workspace before trying again.', file=sys.stderr)
+    finally:
+        # Catchable Terminal shutdown unwinds into cleanup. Further catchable
+        # signals cannot interrupt the single timeout-limited logout attempt.
+        cleaning_up = True
+        try:
+            if created_session:
+                try:
+                    if identity_request('logout', {}, created_session).get('signed_out') is not True:
+                        raise ValueError('Sign-out unconfirmed')
+                except Exception:
+                    print('Setup session sign-out could not be confirmed. Check your account sessions before retrying.', file=sys.stderr)
+                    result = 1
+        finally:
+            human = None
+            created_session = None
+            for sig, handler in previous_handlers.items():
+                signal.signal(sig, handler)
+    return result
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())

package/native/Tools/pair-qr.swift

@@ -0,0 +1,223 @@
+// Shows the Economy pairing code as a QR code in the terminal, for the iPhone app's Connect → Scan code.
+// Run it through native/Tools/pair-qr.py. The one-use code is issued inside the owner's Terminal:
+// it is never an argument, never written to a file, and the screen and its
+// scrollback are cleared once the code has been scanned.
+//
+// QR codes come from CoreImage's built-in CIQRCodeGenerator, so no extra tool is needed.
+// `--self-test` renders a synthetic code the same way and decodes it with CoreImage's detector.
+import CoreImage
+import Foundation
+
+/// The same text as Pairing.code(server:key:) in the app.
+func pairingCode(server: String, key: String) -> String {
+    let unreserved = CharacterSet(charactersIn: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~")
+    func escaped(_ text: String) -> String { text.addingPercentEncoding(withAllowedCharacters: unreserved) ?? "" }
+    return "hasna-economy://connect?server=\(escaped(server))&key=\(escaped(key))"
+}
+
+/// The QR modules, row by row from the top, true for dark. One pixel per module from CoreImage.
+func qrModules(_ text: String) -> [[Bool]]? {
+    guard let filter = CIFilter(name: "CIQRCodeGenerator") else { return nil }
+    filter.setValue(Data(text.utf8), forKey: "inputMessage")
+    filter.setValue("M", forKey: "inputCorrectionLevel")
+    guard let image = filter.outputImage else { return nil }
+    let extent = image.extent.integral
+    let width = Int(extent.width)
+    let height = Int(extent.height)
+    var pixels = [UInt8](repeating: 0, count: width * height * 4)
+    CIContext().render(image, toBitmap: &pixels, rowBytes: width * 4, bounds: extent, format: .RGBA8,
+                       colorSpace: CGColorSpaceCreateDeviceRGB())
+    return (0..<height).map { y in (0..<width).map { x in pixels[(y * width + x) * 4] < 128 } }
+}
+
+/// Adds a light margin of `quiet` modules on every side.
+func withQuietZone(_ modules: [[Bool]], _ quiet: Int = 4) -> [[Bool]] {
+    let width = (modules.first?.count ?? 0) + quiet * 2
+    let blank = [Bool](repeating: false, count: width)
+    let pad = [Bool](repeating: false, count: quiet)
+    return Array(repeating: blank, count: quiet) + modules.map { pad + $0 + pad } + Array(repeating: blank, count: quiet)
+}
+
+/// Two module rows per text line with half blocks, black on white whatever the terminal theme.
+func terminalLines(_ modules: [[Bool]]) -> [String] {
+    var rows = modules
+    if rows.count % 2 == 1 { rows.append([Bool](repeating: false, count: rows.first?.count ?? 0)) }
+    return stride(from: 0, to: rows.count, by: 2).map { y in
+        let line = zip(rows[y], rows[y + 1]).map { top, bottom -> String in
+            switch (top, bottom) {
+            case (true, true): "█"
+            case (true, false): "▀"
+            case (false, true): "▄"
+            case (false, false): " "
+            }
+        }.joined()
+        return "\u{1B}[30;107m" + line + "\u{1B}[0m"
+    }
+}
+
+/// Reads the modules back from the terminal lines, to prove they encode exactly the code.
+func modulesFromLines(_ lines: [String]) -> [[Bool]] {
+    lines.flatMap { line -> [[Bool]] in
+        let body = line.replacingOccurrences(of: "\u{1B}[30;107m", with: "").replacingOccurrences(of: "\u{1B}[0m", with: "")
+        let top = body.map { $0 == "█" || $0 == "▀" }
+        let bottom = body.map { $0 == "█" || $0 == "▄" }
+        return [top, bottom]
+    }
+}
+
+/// Decodes a module grid with CoreImage's QR detector, drawn as the terminal shows it.
+func decode(_ modules: [[Bool]]) -> String? {
+    let scale = 8
+    let height = modules.count
+    let width = modules.first?.count ?? 0
+    var pixels = [UInt8](repeating: 255, count: width * scale * height * scale)
+    for (y, row) in modules.enumerated() {
+        for (x, dark) in row.enumerated() where dark {
+            for dy in 0..<scale {
+                for dx in 0..<scale { pixels[(y * scale + dy) * width * scale + x * scale + dx] = 0 }
+            }
+        }
+    }
+    guard let provider = CGDataProvider(data: Data(pixels) as CFData),
+          let cgImage = CGImage(width: width * scale, height: height * scale, bitsPerComponent: 8, bitsPerPixel: 8,
+                                bytesPerRow: width * scale, space: CGColorSpaceCreateDeviceGray(),
+                                bitmapInfo: CGBitmapInfo(rawValue: CGImageAlphaInfo.none.rawValue),
+                                provider: provider, decode: nil, shouldInterpolate: false, intent: .defaultIntent),
+          let detector = CIDetector(ofType: CIDetectorTypeQRCode, context: nil, options: [CIDetectorAccuracy: CIDetectorAccuracyHigh])
+    else { return nil }
+    return (detector.features(in: CIImage(cgImage: cgImage)).first as? CIQRCodeFeature)?.messageString
+}
+
+/// A QR finder pattern sits in the top-left, top-right and bottom-left corners, never bottom-right.
+func isUpright(_ modules: [[Bool]]) -> Bool {
+    let size = modules.count
+    func finder(_ x: Int, _ y: Int) -> Bool {
+        (0..<7).allSatisfy { i in modules[y][x + i] && modules[y + 6][x + i] && modules[y + i][x] && modules[y + i][x + 6] }
+            && modules[y + 3][x + 3]
+    }
+    guard size >= 21, modules.allSatisfy({ $0.count == size }) else { return false }
+    return finder(0, 0) && finder(size - 7, 0) && finder(0, size - 7) && !finder(size - 7, size - 7)
+}
+
+func fail(_ message: String, _ code: Int32) -> Never {
+    FileHandle.standardError.write(Data((message + "\n").utf8))
+    exit(code)
+}
+
+/// Check the real ancestry as well as the TTY: a captured harness PTY is still a TTY.
+/// This prevents accidental transcript output, not access by other owner processes.
+func ownerTerminal(environment: [String: String], tty: Bool, parent: Int32,
+                   lookup: (Int32) -> (Int32, String)?) -> Bool {
+    guard tty else { return false }
+    for key in ["CODEX_THREAD_ID", "CODEX_INTERNAL_ORIGINATOR_OVERRIDE", "CLAUDECODE", "SUMI_SESSION_ID", "OPENCODE_SESSION_ID"] {
+        if let value = environment[key], !value.isEmpty { return false }
+    }
+    var pid = parent
+    for _ in 0..<12 {
+        guard let (next, executable) = lookup(pid) else { return false }
+        if executable == "/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal" { return true }
+        guard ["Python", "python3", "bash", "zsh", "login", "bun", "secrets", "swift", "swift-frontend"]
+                .contains(URL(fileURLWithPath: executable).lastPathComponent), next > 1, next != pid else { return false }
+        pid = next
+    }
+    return false
+}
+
+func parentProcess(_ pid: Int32) -> (Int32, String)? {
+    let process = Process()
+    let output = Pipe()
+    process.executableURL = URL(fileURLWithPath: "/bin/ps")
+    process.arguments = ["-p", String(pid), "-o", "ppid=", "-o", "comm="]
+    process.standardOutput = output
+    process.standardError = FileHandle.nullDevice
+    do { try process.run() } catch { return nil }
+    let data = output.fileHandleForReading.readDataToEndOfFile()
+    process.waitUntilExit()
+    guard process.terminationStatus == 0, data.count <= 4096,
+          let text = String(data: data, encoding: .utf8) else { return nil }
+    let fields = text.trimmingCharacters(in: .whitespacesAndNewlines).split(maxSplits: 1, whereSeparator: { $0.isWhitespace })
+    guard fields.count == 2, let next = Int32(fields[0]) else { return nil }
+    return (next, String(fields[1]))
+}
+
+func selfTest() {
+    let terminal = "/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal"
+    guard !ownerTerminal(environment: [:], tty: true, parent: 100, lookup: { _ in (200, "/runtime/codex") }),
+          !ownerTerminal(environment: [:], tty: false, parent: 100, lookup: { _ in (200, terminal) }),
+          !ownerTerminal(environment: ["CODEX_THREAD_ID": "fixture"], tty: true, parent: 100, lookup: { _ in (200, terminal) }),
+          !ownerTerminal(environment: [:], tty: true, parent: 100, lookup: { _ in nil }),
+          ownerTerminal(environment: [:], tty: true, parent: 100, lookup: { pid in
+              pid == 100 ? (200, "/usr/bin/python3") : (300, terminal)
+          }) else { fail("pair-qr self-test: FAIL (owner Terminal boundary)", 1) }
+    // A synthetic key with characters that need escaping; not a credential.
+    let key = "selftest-" + UUID().uuidString + "+/=&"
+    let code = pairingCode(server: "https://api.hasna.com/economy", key: key)
+    guard let modules = qrModules(code) else { fail("pair-qr self-test: FAIL (CoreImage made no QR code)", 1) }
+    let trimmed = trimQuietZone(modules)
+    guard isUpright(trimmed) else { fail("pair-qr self-test: FAIL (the code is mirrored or rotated)", 1) }
+    let lines = terminalLines(withQuietZone(trimmed))
+    guard decode(modulesFromLines(lines)) == code else { fail("pair-qr self-test: FAIL (the terminal rendering does not decode to the code)", 1) }
+    print("pair-qr self-test: PASS (\(trimmed.count)x\(trimmed.count) modules, \(lines.count) terminal lines, decoded to the exact pairing code)")
+}
+
+/// CoreImage adds its own margin; drop it so the finder patterns sit at the edges.
+func trimQuietZone(_ modules: [[Bool]]) -> [[Bool]] {
+    let rows = modules.indices.filter { modules[$0].contains(true) }
+    let columns = (0..<(modules.first?.count ?? 0)).filter { x in modules.contains { $0[x] } }
+    guard let top = rows.first, let bottom = rows.last, let left = columns.first, let right = columns.last else { return modules }
+    return modules[top...bottom].map { Array($0[left...right]) }
+}
+
+/// Clears the screen and the terminal's scrollback.
+let clearSequence = "\u{1B}[2J\u{1B}[3J\u{1B}[H"
+
+/// Ctrl-C, a hang-up or a kill also clear the code before exiting. Kept alive for the whole run.
+var signalSources: [DispatchSourceSignal] = []
+
+func clearOnSignals() {
+    for number in [SIGINT, SIGTERM, SIGHUP] {
+        signal(number, SIG_IGN)
+        let source = DispatchSource.makeSignalSource(signal: number, queue: .global())
+        source.setEventHandler {
+            FileHandle.standardOutput.write(Data(clearSequence.utf8))
+            exit(128 + number)
+        }
+        source.resume()
+        signalSources.append(source)
+    }
+}
+
+func show() {
+    let environment = ProcessInfo.processInfo.environment
+    guard let key = environment["ECONOMY_PAIR_CODE"], !key.isEmpty else { fail("ECONOMY_PAIR_CODE is not set", 2) }
+    unsetenv("ECONOMY_PAIR_CODE")
+    let server = environment["ECONOMY_PAIR_SERVER"] ?? "https://api.hasna.com/economy"
+    guard ownerTerminal(environment: environment, tty: isatty(STDOUT_FILENO) != 0 && isatty(STDIN_FILENO) != 0,
+                        parent: getppid(), lookup: parentProcess) else {
+        fail("Refusing to show a connection code outside the direct owner Terminal path.", 3)
+    }
+    guard let modules = qrModules(pairingCode(server: server, key: key)) else { fail("CoreImage made no QR code", 1) }
+    let lines = terminalLines(withQuietZone(trimQuietZone(modules)))
+    guard key.range(of: "^hec_[A-Za-z0-9_-]{43}$", options: .regularExpression) != nil,
+          server == "https://api.hasna.com/economy" else { fail("Invalid Economy pairing request", 2) }
+    clearOnSignals()
+    let lifetime = max(1, min(290, Int(environment["ECONOMY_PAIR_TTL"] ?? "290") ?? 290))
+    DispatchQueue.global().asyncAfter(deadline: .now() + .seconds(lifetime)) {
+        FileHandle.standardOutput.write(Data(clearSequence.utf8))
+        exit(0)
+    }
+    print("")
+    lines.forEach { print("  " + $0) }
+    print("\n  Economy → Connect → Scan code. Server: \(server)")
+    print("  Press Return when the iPhone has connected; the screen and scrollback are then cleared (Ctrl-C clears too). This screen closes within five minutes.")
+    if let tty = FileHandle(forReadingAtPath: "/dev/tty") {
+        _ = tty.availableData
+    }
+    print(clearSequence, terminator: "")
+}
+
+if CommandLine.arguments.contains("--self-test") {
+    selfTest()
+} else {
+    show()
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/economy",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "description": "AI coding cost tracker — CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   "repository": {
     "type": "git",
@@ -33,6 +33,8 @@
   "files": [
     "dist",
     "docs",
+    "native/Tools/pair-qr.py",
+    "native/Tools/pair-qr.swift",
     "postinstall.js",
     "LICENSE",
     "README.md",