@hasna/treasury 0.1.2

package/dist/cli/namespaces.d.ts

@@ -0,0 +1,7 @@
+import { Command } from "commander";
+export interface EmitOptions {
+    json: () => boolean;
+}
+/** Build one command namespace per domain resource, generated from the registry. */
+export declare function registerOpCommands(program: Command, emitOpts: EmitOptions): void;
+//# sourceMappingURL=namespaces.d.ts.map

package/dist/cli/namespaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespaces.d.ts","sourceRoot":"","sources":["../../src/cli/namespaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,OAAO,CAAC;CACrB;AAmBD,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,GAAG,IAAI,CA4BhF"}

package/dist/config.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Canonical Hasna Service Contract v1 storage config for treasury.
+ *
+ * Runtime storage modes are `local | cloud` ONLY (Amendment A1, PURE REMOTE):
+ *   - local: SQLite at ~/.hasna/treasury/treasury.db is authoritative.
+ *   - cloud: reads AND writes go directly to the app-owned cloud Postgres.
+ *
+ * The legacy words `remote`, `hybrid`, and `self_hosted` are accepted only as
+ * deprecated aliases that normalize to `cloud`.
+ */
+export declare const APP_NAME = "treasury";
+export declare const ENV_TOKEN = "TREASURY";
+export type StorageMode = "local" | "cloud";
+type Env = Record<string, string | undefined>;
+/**
+ * Resolve the storage mode from the environment; defaults to `local`.
+ *
+ * Fail-closed misconfig guard (BUILD-SPEC §2.3): a DATABASE_URL present while
+ * mode resolves to `local` is almost certainly a mis-deploy that would silently
+ * write to SQLite while a cloud DB is configured — that is a hard startup error.
+ */
+export declare function resolveStorageMode(env?: Env): StorageMode;
+/** Whether a cloud database URL is present (presence only — the value is never read to pick a mode). */
+export declare function databaseUrlPresent(env?: Env): boolean;
+/**
+ * Resolve the DSN value (BUILD-SPEC §2.4): prefer a `0400` file mount
+ * (`*_DATABASE_URL_FILE`), else the env var (local/dev only). Secrets-Manager
+ * fetch is a cloud-runtime concern handled by the deploy module; here we only
+ * read a file mount or env var. Never logs the value.
+ */
+export declare function resolveDatabaseUrl(env?: Env): string | null;
+/**
+ * Scrub the DSN from process.env after the store has connected so child
+ * processes and `/proc/<pid>/environ` introspection cannot read it (§2.4).
+ */
+export declare function scrubDatabaseUrl(env?: Env): void;
+/** Canonical local SQLite path: ~/.hasna/treasury/treasury.db */
+export declare function defaultSqlitePath(): string;
+/** Resolve the SQLite path, honoring the HASNA_TREASURY_DB_PATH override (used by tests). */
+export declare function resolveDbPath(env?: Env): string;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,SAAS,aAAa,CAAC;AAEpC,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,CAAC;AAS5C,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAU9C;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,GAAiB,GAAG,WAAW,CA0BtE;AAED,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,GAAiB,GAAG,OAAO,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,GAAG,IAAI,CAIxE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,GAAiB,GAAG,IAAI,CAE7D;AAED,iEAAiE;AACjE,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,CAE5D"}

package/dist/core/app-home.d.ts

@@ -0,0 +1,9 @@
+export declare const TREASURY_APP_SUBDIRS: readonly ["config", "data", "exports", "backups", "logs", "tmp"];
+export type TreasuryAppSubdir = (typeof TREASURY_APP_SUBDIRS)[number];
+/** Root: ~/.hasna/treasury (dirs are created mode 0700). */
+export declare function getTreasuryAppHome(): string;
+export declare function getTreasuryAppDir(name: TreasuryAppSubdir): string;
+/** Create ~/.hasna/treasury and all subdirs with mode 0700 (deny-by-default perms). */
+export declare function ensureTreasuryAppHome(): Record<TreasuryAppSubdir | "root", string>;
+export declare function getDefaultTreasuryBackupDir(): string;
+//# sourceMappingURL=app-home.d.ts.map

package/dist/core/app-home.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-home.d.ts","sourceRoot":"","sources":["../../src/core/app-home.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,oBAAoB,kEAAmE,CAAC;AACrG,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAMtE,4DAA4D;AAC5D,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAEjE;AAED,uFAAuF;AACvF,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,iBAAiB,GAAG,MAAM,EAAE,MAAM,CAAC,CAUlF;AAED,wBAAgB,2BAA2B,IAAI,MAAM,CAEpD"}

package/dist/core/errors.d.ts

@@ -0,0 +1,8 @@
+export interface ErrorEnvelope {
+    code: string;
+    message: string;
+    suggestion: string;
+}
+export declare function normalizeError(error: unknown): ErrorEnvelope;
+export declare function httpStatusForCode(code: string): number;
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAW5D;AAYD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD"}

package/dist/db/audit.d.ts

@@ -0,0 +1,16 @@
+import type { QueryClient } from "./database.js";
+import type { AuditEvent } from "../types/index.js";
+export interface AppendAuditInput {
+    entity_id: string | null;
+    actor_id: string;
+    action: string;
+    detail: string;
+}
+export declare function appendAudit(db: QueryClient, input: AppendAuditInput): Promise<void>;
+export declare function listAudit(db: QueryClient, limit?: number): Promise<AuditEvent[]>;
+/** Recompute the chain and report the first row whose hash does not verify. */
+export declare function verifyAuditChain(db: QueryClient): Promise<{
+    ok: boolean;
+    brokenAt: number | null;
+}>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/db/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/db/audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAcpD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBzF;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAEnF;AAED,+EAA+E;AAC/E,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAazG"}

package/dist/db/backup.d.ts

@@ -0,0 +1,14 @@
+export declare function backupsDisabled(): boolean;
+export interface BackupResult {
+    skipped: boolean;
+    reason?: string;
+    backup_path?: string;
+}
+/**
+ * Snapshot an existing local DB before applying migrations (BUILD-SPEC §4.4).
+ * File mode 0600; backups dir 0700; retains the last N=10 snapshots.
+ * Refuses to proceed if it cannot write the required snapshot.
+ */
+export declare function maybeBackupBeforeMigration(dbPath: string): BackupResult;
+export declare function listBackups(dbPath: string): string[];
+//# sourceMappingURL=backup.d.ts.map

package/dist/db/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/db/backup.ts"],"names":[],"mappings":"AAMA,wBAAgB,eAAe,IAAI,OAAO,CAIzC;AAYD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAcvE;AAiBD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAOpD"}

package/dist/db/database.d.ts

@@ -0,0 +1,40 @@
+import { type StorageMode } from "../config.js";
+/**
+ * A tiny dialect-agnostic async query surface shared by every service so the
+ * SAME domain code runs over local SQLite and cloud Postgres. Services write
+ * `?`-placeholder SQL; the Postgres client rewrites to `$n`.
+ */
+export interface QueryClient {
+    readonly mode: StorageMode;
+    all<T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T[]>;
+    get<T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T | null>;
+    run(sql: string, params?: unknown[]): Promise<void>;
+    transaction<T>(fn: (tx: QueryClient) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+}
+export interface OpenOptions {
+    /** Explicit path/`:memory:` for local tests. */
+    path?: string;
+    /** Force a fresh client (ignore singleton). */
+    fresh?: boolean;
+    /**
+     * Force a specific storage mode instead of resolving it from env. Used by the
+     * storage push/pull/sync tools to open the OPPOSITE (counterpart) store so a
+     * transfer truly crosses local<->cloud. Cloud still fails closed without a DSN.
+     */
+    mode?: StorageMode;
+}
+/**
+ * Open the treasury store.
+ *
+ * - local: bun:sqlite at the resolved path (`:memory:` for tests) — authoritative.
+ * - cloud: PURE REMOTE — a real pg pool built from the vendored storage-kit with
+ *   `sslmode=verify-full`. It NEVER silently falls back to in-memory/SQLite; a
+ *   missing DSN or connection failure is a hard fail-closed error.
+ */
+export declare function openDatabase(opts?: OpenOptions): Promise<QueryClient>;
+export declare function closeDatabase(): void;
+export declare function resetDatabaseSingleton(): void;
+export declare function now(): string;
+export declare function uuid(): string;
+//# sourceMappingURL=database.d.ts.map

package/dist/db/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/db/database.ts"],"names":[],"mappings":"AAGA,OAAO,EAA2E,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAKzH;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAChF,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACrF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAgFD,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAQ/E;AA6DD,wBAAgB,aAAa,IAAI,IAAI,CAKpC;AAED,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED,wBAAgB,GAAG,IAAI,MAAM,CAE5B;AAED,wBAAgB,IAAI,IAAI,MAAM,CAE7B"}

package/dist/db/migration-plan.d.ts

@@ -0,0 +1,14 @@
+export interface MigrationPlanEntry {
+    id: string;
+    name: string;
+    status: "applied" | "planned";
+    description: string;
+}
+export interface MigrationPlan {
+    version: string;
+    current_schema_id: string;
+    entries: MigrationPlanEntry[];
+}
+export declare const CURRENT_MIGRATION_PLAN: MigrationPlan;
+export declare function getCurrentMigrationPlan(): MigrationPlan;
+//# sourceMappingURL=migration-plan.d.ts.map

package/dist/db/migration-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-plan.d.ts","sourceRoot":"","sources":["../../src/db/migration-plan.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAED,eAAO,MAAM,sBAAsB,EAAE,aAYpC,CAAC;AAEF,wBAAgB,uBAAuB,IAAI,aAAa,CAEvD"}

package/dist/db/schema.d.ts

@@ -0,0 +1,8 @@
+import type { Database } from "bun:sqlite";
+export declare function runSqliteMigrations(db: Database): void;
+/**
+ * Logical migrations for cloud Postgres. Applied in order through the vendored
+ * storage-kit executor. Kept in lockstep with the SQLite schema above.
+ */
+export declare const POSTGRES_MIGRATIONS: string[];
+//# sourceMappingURL=schema.d.ts.map

package/dist/db/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAmG3C,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAGtD;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,EA0EvC,CAAC"}

package/dist/generated/storage-kit/health.d.ts

@@ -0,0 +1,20 @@
+import type { TypedQueryClient } from "./query.js";
+import { type Migration, type MigrationRunnerOptions } from "./migrations.js";
+export interface HealthResult {
+    ok: boolean;
+    /** Round-trip latency of the probe query, in milliseconds. */
+    latencyMs: number;
+    error?: string;
+}
+/** Cheap reachability probe: `SELECT 1`. Never throws — reports `ok: false`. */
+export declare function checkHealth(client: TypedQueryClient): Promise<HealthResult>;
+export interface ReadyResult extends HealthResult {
+    /** Migration ids that are defined but not yet applied. */
+    pendingMigrations: string[];
+}
+/**
+ * Readiness probe: reachable AND fully migrated. Reports `ok: false` with the
+ * list of pending migration ids when the schema is behind.
+ */
+export declare function checkReady(client: TypedQueryClient, migrations: readonly Migration[], options?: MigrationRunnerOptions): Promise<ReadyResult>;
+//# sourceMappingURL=health.d.ts.map

package/dist/generated/storage-kit/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/health.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAmB,KAAK,SAAS,EAAE,KAAK,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAE/F,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,gFAAgF;AAChF,wBAAsB,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAYjF;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,0DAA0D;IAC1D,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,WAAW,CAAC,CAetB"}

package/dist/generated/storage-kit/index.d.ts

@@ -0,0 +1,8 @@
+export declare const KIT_VERSION = "0.4.1";
+export * from "./mode.js";
+export * from "./tls.js";
+export * from "./query.js";
+export * from "./pool.js";
+export * from "./migrations.js";
+export * from "./health.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/generated/storage-kit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/index.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}

package/dist/generated/storage-kit/migrations.d.ts

@@ -0,0 +1,48 @@
+import type { TypedQueryClient } from "./query.js";
+/** Default ledger table name. Override per app if a legacy name exists. */
+export declare const DEFAULT_MIGRATION_LEDGER_TABLE = "schema_migrations";
+export interface Migration {
+    readonly id: string;
+    readonly sql: string;
+    readonly checksum: string;
+}
+export type MigrationState = "already_applied" | "pending";
+export interface MigrationPlanItem {
+    readonly migration: Migration;
+    readonly state: MigrationState;
+}
+export interface AppliedMigration {
+    readonly id: string;
+    readonly checksum: string;
+    readonly appliedAt: string;
+}
+export interface MigrationResult {
+    readonly dryRun: boolean;
+    readonly applied: AppliedMigration[];
+    readonly plan: MigrationPlanItem[];
+}
+/** Stable sha256 checksum for a migration's SQL text. */
+export declare function checksumSql(sql: string): string;
+/** Freeze a migration definition, computing its checksum from the SQL. */
+export declare function defineMigration(id: string, sql: string): Migration;
+export interface MigrationRunnerOptions {
+    ledgerTable?: string;
+}
+export declare class MigrationLedger {
+    private readonly client;
+    private readonly migrations;
+    private readonly ledgerTable;
+    constructor(client: TypedQueryClient, migrations: readonly Migration[], options?: MigrationRunnerOptions);
+    ensureLedger(): Promise<void>;
+    listApplied(): Promise<AppliedMigration[]>;
+    private readApplied;
+    /** Compute the migration plan and guard against drift/downgrade. */
+    private buildPlan;
+    /** Apply all pending migrations. With `dryRun`, report the plan only. */
+    migrate(opts?: {
+        dryRun?: boolean;
+    }): Promise<MigrationResult>;
+}
+/** Convenience: build a ledger and run all pending migrations. */
+export declare function createMigrationLedger(client: TypedQueryClient, migrations: readonly Migration[], options?: MigrationRunnerOptions): MigrationLedger;
+//# sourceMappingURL=migrations.d.ts.map

package/dist/generated/storage-kit/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/migrations.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,sBAAsB,CAAC;AAElE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED,yDAAyD;AACzD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAElE;AAQD,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJ7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAGlB,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,SAAS,SAAS,EAAE,EACjD,OAAO,GAAE,sBAA2B;IAUhC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAU7B,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAKlC,WAAW;IAWzB,oEAAoE;IACpE,OAAO,CAAC,SAAS;IAsBjB,yEAAyE;IACnE,OAAO,CAAC,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,eAAe,CAAC;CAiBzE;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,OAAO,GAAE,sBAA2B,GACnC,eAAe,CAEjB"}

package/dist/generated/storage-kit/mode.d.ts

@@ -0,0 +1,48 @@
+export declare const STORAGE_MODES: readonly ["local", "cloud"];
+export type StorageMode = (typeof STORAGE_MODES)[number];
+export declare const DEPRECATED_STORAGE_MODE_ALIASES: readonly ["remote", "hybrid", "self_hosted"];
+export type Env = Record<string, string | undefined>;
+export interface StorageModeNormalization {
+    mode: StorageMode;
+    /** The deprecated alias that was normalized to `cloud`, if any. */
+    deprecatedAlias: string | null;
+}
+/**
+ * Normalize a raw storage-mode string to the `local | cloud` runtime enum.
+ * Accepts deprecated aliases (`remote`, `hybrid`, `self_hosted`) and maps them
+ * to `cloud`. Throws on any other value.
+ */
+export declare function normalizeStorageMode(value: string): StorageModeNormalization;
+/** Upper-snake env token for an app name, e.g. `todos` -> `TODOS`. */
+export declare function envToken(name: string): string;
+export interface StorageEnvKeys {
+    /** `HASNA_<NAME>_STORAGE_MODE` then the optional `<NAME>_STORAGE_MODE` alias. */
+    modeKeys: string[];
+    /** `HASNA_<NAME>_DATABASE_URL` then the optional `<NAME>_DATABASE_URL` alias. */
+    databaseUrlKeys: string[];
+}
+/** Resolve the canonical env-key spec for an app's storage config. */
+export declare function storageEnvKeys(name: string): StorageEnvKeys;
+export interface StorageModeResolution {
+    mode: StorageMode;
+    /** Env key the mode came from, or `"default"`. */
+    source: string;
+    deprecatedAlias: string | null;
+    databaseUrlPresent: boolean;
+    /** Env key the database URL came from, or `null`. */
+    databaseUrlSource: string | null;
+    warning: string | null;
+}
+/**
+ * Resolve an app's storage mode from the environment per the contract env spec.
+ * Precedence: `HASNA_<NAME>_STORAGE_MODE`, then `<NAME>_STORAGE_MODE`, else
+ * `local`. Never reads secret values — only detects DATABASE_URL presence.
+ */
+export declare function resolveStorageMode(name: string, env?: Env): StorageModeResolution;
+/**
+ * Resolve the database URL value for an app, honoring the canonical then alias
+ * env keys. Returns `null` when unset. The caller is responsible for never
+ * logging the returned value.
+ */
+export declare function resolveDatabaseUrl(name: string, env?: Env): string | null;
+//# sourceMappingURL=mode.d.ts.map

package/dist/generated/storage-kit/mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/mode.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,aAAa,6BAA8B,CAAC;AACzD,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,eAAO,MAAM,+BAA+B,8CAIlC,CAAC;AAEX,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAErD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,WAAW,CAAC;IAClB,mEAAmE;IACnE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,wBAAwB,CAQ5E;AAED,sEAAsE;AACtE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,iFAAiF;IACjF,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAM3D;AAUD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,WAAW,CAAC;IAClB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,GAAiB,GAAG,qBAAqB,CAwC9F;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,GAAiB,GAAG,MAAM,GAAG,IAAI,CAItF"}

package/dist/generated/storage-kit/pool.d.ts

@@ -0,0 +1,34 @@
+import type { Pool } from "pg";
+import { type TlsResolveOptions } from "./tls.js";
+import { type PoolQueryClient } from "./query.js";
+export interface CreatePgPoolOptions extends TlsResolveOptions {
+    connectionString: string;
+    /** Max clients in the pool. Defaults to pg's default (10). */
+    max?: number;
+    /** Idle client timeout (ms). */
+    idleTimeoutMillis?: number;
+    /** Connection acquisition timeout (ms). */
+    connectionTimeoutMillis?: number;
+    /** Application name reported to Postgres (shows in pg_stat_activity). */
+    applicationName?: string;
+}
+/** Build a `pg.Pool` with fleet-standard TLS handling. */
+export declare function createPgPool(options: CreatePgPoolOptions): Pool;
+export interface CreateCloudPoolFromEnvOptions extends TlsResolveOptions {
+    max?: number;
+    idleTimeoutMillis?: number;
+    connectionTimeoutMillis?: number;
+    applicationName?: string;
+}
+export interface CloudPoolFromEnv {
+    client: PoolQueryClient;
+    connectionSource: string;
+}
+/**
+ * Resolve mode + database URL from the environment and build a cloud pool.
+ *
+ * Throws when the resolved mode is not `cloud` (PURE REMOTE has no Postgres in
+ * `local` mode) or when the database URL is missing. Never logs the URL.
+ */
+export declare function createCloudPoolFromEnv(appName: string, options?: CreateCloudPoolFromEnvOptions): CloudPoolFromEnv;
+//# sourceMappingURL=pool.d.ts.map

package/dist/generated/storage-kit/pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/pool.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAE3C,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAErE,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAe/D;AAED,MAAM,WAAW,6BAA8B,SAAQ,iBAAiB;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,eAAe,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,6BAAkC,GAC1C,gBAAgB,CAgClB"}

package/dist/generated/storage-kit/query.d.ts

@@ -0,0 +1,36 @@
+import type { Pool, QueryResultRow } from "pg";
+export interface QueryResult<T extends QueryResultRow> {
+    rows: T[];
+    rowCount: number;
+}
+/**
+ * Minimal executor contract. `pg.Pool` and `pg.PoolClient` both satisfy the
+ * `query` method; the wrapper builds the rest on top so tests can substitute a
+ * lightweight shim without pulling in a live Postgres.
+ */
+export interface PgExecutor {
+    query<T extends QueryResultRow>(sql: string, params?: readonly unknown[]): Promise<{
+        rows: T[];
+        rowCount: number | null;
+    }>;
+}
+export interface TypedQueryClient {
+    query<T extends QueryResultRow>(sql: string, params?: readonly unknown[]): Promise<QueryResult<T>>;
+    many<T extends QueryResultRow>(sql: string, params?: readonly unknown[]): Promise<T[]>;
+    /** First row or `null`. Restored here after open-knowledge dropped it. */
+    get<T extends QueryResultRow>(sql: string, params?: readonly unknown[]): Promise<T | null>;
+    /** Exactly one row; throws if zero or more than one row is returned. */
+    one<T extends QueryResultRow>(sql: string, params?: readonly unknown[]): Promise<T>;
+    execute(sql: string, params?: readonly unknown[]): Promise<void>;
+}
+/** Wrap any `PgExecutor` (a Pool, a PoolClient, or a test shim) with the typed vocabulary. */
+export declare function wrapExecutor(executor: PgExecutor): TypedQueryClient;
+export interface PoolQueryClient extends TypedQueryClient {
+    readonly pool: Pool;
+    /** Run a callback inside a `BEGIN`/`COMMIT` transaction on a dedicated client. */
+    transaction<T>(fn: (client: TypedQueryClient) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+}
+/** Build a `PoolQueryClient` around a live `pg.Pool`. */
+export declare function createQueryClient(pool: Pool): PoolQueryClient;
+//# sourceMappingURL=query.d.ts.map

package/dist/generated/storage-kit/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/query.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,IAAI,EAAc,cAAc,EAAE,MAAM,IAAI,CAAC;AAE3D,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,cAAc;IACnD,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,SAAS,cAAc,EAC5B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,0EAA0E;IAC1E,GAAG,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3F,wEAAwE;IACxE,GAAG,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,8FAA8F;AAC9F,wBAAgB,YAAY,CAAC,QAAQ,EAAE,UAAU,GAAG,gBAAgB,CAyBnE;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,kFAAkF;IAClF,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe,CA2B7D"}

package/dist/generated/storage-kit/tls.d.ts

@@ -0,0 +1,26 @@
+/** The `ssl` field shape accepted by `pg.Pool` / `pg.Client`. */
+export type PgSslConfig = boolean | {
+    rejectUnauthorized: boolean;
+    ca?: string;
+};
+export interface TlsResolveOptions {
+    /** Inline CA bundle (PEM). Wins over every other CA source. */
+    ca?: string;
+    /** Path to a CA bundle PEM file, e.g. the Amazon RDS global bundle. */
+    caCertPath?: string;
+    /** Environment used to discover PGSSLROOTCERT / NODE_EXTRA_CA_CERTS. */
+    env?: Record<string, string | undefined>;
+}
+export type SslMode = "disable" | "prefer" | "require" | "verify-ca" | "verify-full";
+/**
+ * Extract the effective `sslmode` from a Postgres connection string. Honors the
+ * `sslmode` query param and the legacy `ssl=true` boolean. Returns `disable`
+ * when TLS is not requested.
+ */
+export declare function sslModeFromConnectionString(connectionString: string): SslMode;
+/**
+ * Resolve the `pg` ssl config for a connection string. See the module header
+ * for the full mode table. Returns `undefined` when TLS should be off.
+ */
+export declare function resolveTlsConfig(connectionString: string, options?: TlsResolveOptions): PgSslConfig | undefined;
+//# sourceMappingURL=tls.d.ts.map

package/dist/generated/storage-kit/tls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/tls.ts"],"names":[],"mappings":"AAkCA,iEAAiE;AACjE,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG;IAAE,kBAAkB,EAAE,OAAO,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAErF;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAwB7E;AAUD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,iBAAsB,GAC9B,WAAW,GAAG,SAAS,CA2BzB"}

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+export * from "./version.js";
+export * from "./config.js";
+export * from "./types/index.js";
+export * from "./db/database.js";
+export * from "./db/audit.js";
+export { getCurrentMigrationPlan } from "./db/migration-plan.js";
+export * from "./services/context.js";
+export * from "./services/authorization.js";
+export * as auth from "./server/auth.js";
+export * from "./services/entities.js";
+export * from "./services/balances.js";
+export * from "./services/fx.js";
+export * from "./services/runway.js";
+export * from "./services/forecast.js";
+export * from "./services/sweeps.js";
+export * from "./services/ingest.js";
+export * from "./services/storage.js";
+export { OPS } from "./services/registry.js";
+export { openApiDocument } from "./api/index.js";
+export { buildServer } from "./mcp/index.js";
+export { createApp } from "./server/app.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC"}