@hasna/treasury 0.1.2

package/dist/server/index.js

@@ -0,0 +1,2094 @@
+#!/usr/bin/env bun
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/generated/storage-kit/mode.ts
+function normalizeStorageMode(value) {
+  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
+  if (normalized === "local")
+    return { mode: "local", deprecatedAlias: null };
+  if (normalized === "cloud")
+    return { mode: "cloud", deprecatedAlias: null };
+  if (DEPRECATED_STORAGE_MODE_ALIASES.includes(normalized)) {
+    return { mode: "cloud", deprecatedAlias: normalized };
+  }
+  throw new Error(`Unknown storage mode: ${value}. Use local or cloud.`);
+}
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function storageEnvKeys(name) {
+  const token = envToken(name);
+  return {
+    modeKeys: [`HASNA_${token}_STORAGE_MODE`, `${token}_STORAGE_MODE`],
+    databaseUrlKeys: [`HASNA_${token}_DATABASE_URL`, `${token}_DATABASE_URL`]
+  };
+}
+function firstEnv2(env, keys) {
+  for (const key of keys) {
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+function resolveStorageMode2(name, env = process.env) {
+  const { modeKeys, databaseUrlKeys } = storageEnvKeys(name);
+  const dbHit = firstEnv2(env, databaseUrlKeys);
+  const databaseUrlPresent2 = Boolean(dbHit);
+  const databaseUrlSource = dbHit ? dbHit.key : null;
+  const modeHit = firstEnv2(env, modeKeys);
+  if (!modeHit) {
+    return {
+      mode: "local",
+      source: "default",
+      deprecatedAlias: null,
+      databaseUrlPresent: databaseUrlPresent2,
+      databaseUrlSource,
+      warning: null
+    };
+  }
+  const { mode, deprecatedAlias } = normalizeStorageMode(modeHit.value);
+  const warnings = [];
+  if (deprecatedAlias) {
+    warnings.push(`Deprecated storage mode '${deprecatedAlias}' from ${modeHit.key} is treated as 'cloud'. Set ${modeKeys[0]}=cloud instead.`);
+  }
+  if (mode === "cloud" && !databaseUrlPresent2) {
+    warnings.push(`cloud mode needs ${databaseUrlKeys[0]} (PURE REMOTE: reads and writes go to cloud Postgres).`);
+  }
+  if (modeHit.key !== modeKeys[0]) {
+    warnings.push(`Using alias env ${modeHit.key}; the canonical key is ${modeKeys[0]}.`);
+  }
+  return {
+    mode,
+    source: modeHit.key,
+    deprecatedAlias,
+    databaseUrlPresent: databaseUrlPresent2,
+    databaseUrlSource,
+    warning: warnings.length > 0 ? warnings.join(" ") : null
+  };
+}
+function resolveDatabaseUrl2(name, env = process.env) {
+  const { databaseUrlKeys } = storageEnvKeys(name);
+  const hit = firstEnv2(env, databaseUrlKeys);
+  return hit ? hit.value : null;
+}
+var DEPRECATED_STORAGE_MODE_ALIASES;
+var init_mode = __esm(() => {
+  DEPRECATED_STORAGE_MODE_ALIASES = [
+    "remote",
+    "hybrid",
+    "self_hosted"
+  ];
+});
+
+// src/generated/storage-kit/tls.ts
+import { readFileSync as readFileSync2 } from "fs";
+function sslModeFromConnectionString(connectionString) {
+  const queryStart = connectionString.indexOf("?");
+  const params = new URLSearchParams(queryStart === -1 ? "" : connectionString.slice(queryStart + 1));
+  const sslmode = params.get("sslmode")?.trim().toLowerCase();
+  if (sslmode) {
+    switch (sslmode) {
+      case "disable":
+      case "prefer":
+      case "require":
+      case "verify-ca":
+      case "verify-full":
+        return sslmode;
+      case "allow":
+        return "prefer";
+      default:
+        throw new Error(`Unknown sslmode '${sslmode}' in connection string.`);
+    }
+  }
+  const ssl = params.get("ssl")?.trim().toLowerCase();
+  if (ssl && ["1", "true", "yes", "on", "require"].includes(ssl))
+    return "require";
+  return "disable";
+}
+function loadCaBundle(options) {
+  const env = options.env ?? process.env;
+  if (options.ca && options.ca.trim())
+    return options.ca;
+  const path = options.caCertPath ?? env.PGSSLROOTCERT ?? env.NODE_EXTRA_CA_CERTS;
+  if (path && path.trim())
+    return readFileSync2(path.trim(), "utf8");
+  return null;
+}
+function resolveTlsConfig(connectionString, options = {}) {
+  const mode = sslModeFromConnectionString(connectionString);
+  if (mode === "disable" || mode === "prefer") {
+    return;
+  }
+  const ca = loadCaBundle(options);
+  if (mode === "require") {
+    return ca ? { rejectUnauthorized: false, ca } : { rejectUnauthorized: false };
+  }
+  if (!ca) {
+    throw new Error(`sslmode=${mode} requires a CA bundle. Set PGSSLROOTCERT (or pass caCertPath/ca) to the ` + `Amazon RDS global bundle: https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem`);
+  }
+  return { rejectUnauthorized: true, ca };
+}
+var init_tls = () => {};
+
+// src/generated/storage-kit/query.ts
+var exports_query = {};
+__export(exports_query, {
+  wrapExecutor: () => wrapExecutor,
+  createQueryClient: () => createQueryClient
+});
+function wrapExecutor(executor) {
+  return {
+    async query(sql, params) {
+      const result = await executor.query(sql, params);
+      return { rows: result.rows, rowCount: result.rowCount ?? result.rows.length };
+    },
+    async many(sql, params) {
+      const result = await executor.query(sql, params);
+      return result.rows;
+    },
+    async get(sql, params) {
+      const result = await executor.query(sql, params);
+      return result.rows[0] ?? null;
+    },
+    async one(sql, params) {
+      const result = await executor.query(sql, params);
+      if (result.rows.length !== 1) {
+        throw new Error(`Expected exactly one row, got ${result.rows.length}.`);
+      }
+      return result.rows[0];
+    },
+    async execute(sql, params) {
+      await executor.query(sql, params);
+    }
+  };
+}
+function createQueryClient(pool) {
+  const base = wrapExecutor(pool);
+  return {
+    ...base,
+    pool,
+    async transaction(fn) {
+      const client = await pool.connect();
+      try {
+        await client.query("BEGIN");
+        const result = await fn(wrapExecutor(client));
+        await client.query("COMMIT");
+        return result;
+      } catch (error) {
+        try {
+          await client.query("ROLLBACK");
+        } catch {}
+        throw error;
+      } finally {
+        client.release();
+      }
+    },
+    async close() {
+      await pool.end();
+    }
+  };
+}
+
+// src/generated/storage-kit/pool.ts
+var exports_pool = {};
+__export(exports_pool, {
+  createPgPool: () => createPgPool,
+  createCloudPoolFromEnv: () => createCloudPoolFromEnv
+});
+import pg from "pg";
+function createPgPool(options) {
+  const ssl = resolveTlsConfig(options.connectionString, {
+    ...options.ca !== undefined ? { ca: options.ca } : {},
+    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
+    ...options.env !== undefined ? { env: options.env } : {}
+  });
+  const config = { connectionString: options.connectionString };
+  if (ssl !== undefined)
+    config.ssl = ssl;
+  if (options.max !== undefined)
+    config.max = options.max;
+  if (options.idleTimeoutMillis !== undefined)
+    config.idleTimeoutMillis = options.idleTimeoutMillis;
+  if (options.connectionTimeoutMillis !== undefined)
+    config.connectionTimeoutMillis = options.connectionTimeoutMillis;
+  if (options.applicationName !== undefined)
+    config.application_name = options.applicationName;
+  return new pg.Pool(config);
+}
+function createCloudPoolFromEnv(appName, options = {}) {
+  const env = options.env ?? process.env;
+  const resolution = resolveStorageMode2(appName, env);
+  if (resolution.mode !== "cloud") {
+    throw new Error(`createCloudPoolFromEnv requires ${appName} storage mode 'cloud', got '${resolution.mode}'. ` + `Set HASNA_${appName.toUpperCase().replace(/-/g, "_")}_STORAGE_MODE=cloud.`);
+  }
+  const connectionString = resolveDatabaseUrl2(appName, env);
+  if (!connectionString) {
+    throw new Error(`cloud mode for ${appName} needs a database URL. Set ` + `HASNA_${appName.toUpperCase().replace(/-/g, "_")}_DATABASE_URL.`);
+  }
+  const pool = createPgPool({
+    connectionString,
+    ...options.ca !== undefined ? { ca: options.ca } : {},
+    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
+    env,
+    ...options.max !== undefined ? { max: options.max } : {},
+    ...options.idleTimeoutMillis !== undefined ? { idleTimeoutMillis: options.idleTimeoutMillis } : {},
+    ...options.connectionTimeoutMillis !== undefined ? { connectionTimeoutMillis: options.connectionTimeoutMillis } : {},
+    ...options.applicationName !== undefined ? { applicationName: options.applicationName } : {}
+  });
+  return {
+    client: createQueryClient(pool),
+    connectionSource: resolution.databaseUrlSource ?? "unknown"
+  };
+}
+var init_pool = __esm(() => {
+  init_mode();
+  init_tls();
+});
+
+// src/server/app.ts
+import { Hono } from "hono";
+
+// src/server/auth.ts
+import { Buffer } from "buffer";
+import { timingSafeEqual } from "crypto";
+
+// src/types/index.ts
+class TreasuryError extends Error {
+  static suggestion = "";
+  code = "INTERNAL_ERROR";
+  constructor(message) {
+    super(message);
+    this.name = new.target.name;
+  }
+}
+
+class EntityNotFoundError extends TreasuryError {
+  static suggestion = "Use `treasury entities list` to find the correct entity_id.";
+  code = "ENTITY_NOT_FOUND";
+  constructor(id) {
+    super(`Entity not found: ${id}`);
+  }
+}
+
+class SweepNotFoundError extends TreasuryError {
+  static suggestion = "Use `treasury sweeps list` to find the correct sweep id.";
+  code = "SWEEP_NOT_FOUND";
+  constructor(id) {
+    super(`Sweep recommendation not found: ${id}`);
+  }
+}
+
+class ValidationError extends TreasuryError {
+  static suggestion = "Check the request fields and retry.";
+  code = "VALIDATION_ERROR";
+  constructor(message) {
+    super(message);
+  }
+}
+
+class PermissionDeniedError extends TreasuryError {
+  static suggestion = "Your credential lacks the required scope or entity access.";
+  code = "PERMISSION_DENIED";
+  constructor(action, resource) {
+    super(`Permission denied for '${action}'${resource ? ` on ${resource}` : ""}.`);
+  }
+}
+
+// src/services/authorization-constants.ts
+var allActions = ["read", "write", "recommend", "export", "admin"];
+var rolePermissions = {
+  system: new Set(allActions),
+  owner: new Set(allActions),
+  admin: new Set(allActions),
+  treasurer: new Set(["read", "write", "recommend", "export"]),
+  analyst: new Set(["read", "recommend"]),
+  auditor: new Set(["read", "export"]),
+  integration: new Set(["read", "write"])
+};
+
+// src/services/authorization.ts
+var SYSTEM_AUTHORIZATION_CONTEXT = {
+  actor_id: "system",
+  roles: ["system"],
+  bypass: true
+};
+function allowedEntitySet(context) {
+  const ids = new Set;
+  if (context.entity_id)
+    ids.add(context.entity_id);
+  for (const id of context.entity_ids ?? [])
+    ids.add(id);
+  if (context.org_id)
+    ids.add(context.org_id);
+  for (const id of context.org_ids ?? [])
+    ids.add(id);
+  return ids;
+}
+function hasEntityAccess(context, entityId) {
+  if (context.bypass)
+    return true;
+  if (!entityId)
+    return true;
+  return allowedEntitySet(context).has(entityId);
+}
+function hasAllEntityAccess(context, entityIds) {
+  return entityIds.every((id) => hasEntityAccess(context, id));
+}
+function roleAllows(role, action) {
+  return rolePermissions[role].has(action);
+}
+function authorize(action, context, resource = {}) {
+  const principal = context ?? SYSTEM_AUTHORIZATION_CONTEXT;
+  if (!hasEntityAccess(principal, resource.entity_id)) {
+    throw new PermissionDeniedError(action, resource.resource || resource.entity_id);
+  }
+  if (resource.entity_ids && !hasAllEntityAccess(principal, resource.entity_ids)) {
+    throw new PermissionDeniedError(action, resource.resource || "entity-group");
+  }
+  if (principal.bypass || principal.roles.some((role) => roleAllows(role, action))) {
+    return;
+  }
+  throw new PermissionDeniedError(action, resource.resource);
+}
+
+// src/server/auth-constants.ts
+var apiScopes = [
+  "treasury:read",
+  "treasury:write",
+  "treasury:recommend",
+  "treasury:export",
+  "treasury:admin",
+  "storage:admin"
+];
+var allScopes = [...apiScopes];
+var AUTH_CONSTANTS = {
+  apiScopes,
+  knownRoles: ["system", "owner", "admin", "treasurer", "analyst", "auditor", "integration"],
+  roleScopes: {
+    system: allScopes,
+    owner: allScopes,
+    admin: allScopes,
+    treasurer: ["treasury:read", "treasury:write", "treasury:recommend", "treasury:export"],
+    analyst: ["treasury:read", "treasury:recommend"],
+    auditor: ["treasury:read", "treasury:export"],
+    integration: ["treasury:read", "treasury:write"]
+  },
+  actionScope: {
+    read: "treasury:read",
+    write: "treasury:write",
+    recommend: "treasury:recommend",
+    export: "treasury:export",
+    admin: "treasury:admin"
+  },
+  defaultAction: "treasury:admin",
+  env: {
+    apiKey: ["HASNA_TREASURY_API_KEY", "TREASURY_API_KEY"],
+    credentials: ["HASNA_TREASURY_API_CREDENTIALS", "TREASURY_API_CREDENTIALS"]
+  }
+};
+
+// src/server/auth.ts
+var allScopes2 = [...AUTH_CONSTANTS.apiScopes];
+var knownScopes = new Set(allScopes2);
+var knownRoles = new Set(AUTH_CONSTANTS.knownRoles);
+var roleScopes = AUTH_CONSTANTS.roleScopes;
+var actionScope = AUTH_CONSTANTS.actionScope;
+function scopesForRoles(roles) {
+  return Array.from(new Set(roles.flatMap((role) => roleScopes[role] || [])));
+}
+function legacyApiKey() {
+  for (const name of AUTH_CONSTANTS.env.apiKey) {
+    const value = process.env[name]?.trim();
+    if (value)
+      return value;
+  }
+  return;
+}
+function credentialsRaw() {
+  for (const name of AUTH_CONSTANTS.env.credentials) {
+    const value = process.env[name];
+    if (value)
+      return value;
+  }
+  return;
+}
+function isApiAuthConfigured() {
+  return Boolean(legacyApiKey() || credentialsRaw());
+}
+function configuredApiCredentials() {
+  const raw = credentialsRaw();
+  if (!raw)
+    return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  const list = Array.isArray(parsed) ? parsed : [parsed];
+  return list.filter((cred) => Boolean((cred.token || cred.key) && cred.id));
+}
+function bearerToken(input) {
+  const header = typeof input === "object" && input !== null && "headers" in input ? input.headers.get("Authorization") : input;
+  const auth = (header || "").trim();
+  if (!auth)
+    return "";
+  return auth.startsWith("Bearer ") ? auth.slice(7).trim() : auth;
+}
+function credentialEntityIds(credential) {
+  const ids = new Set;
+  if (credential.entity_id)
+    ids.add(credential.entity_id);
+  for (const id of credential.entity_ids ?? [])
+    ids.add(id);
+  if (credential.org_id)
+    ids.add(credential.org_id);
+  for (const id of credential.org_ids ?? [])
+    ids.add(id);
+  return ids.size > 0 ? [...ids] : undefined;
+}
+function authenticateToken(token) {
+  if (!token)
+    return null;
+  const legacy = legacyApiKey();
+  if (legacy && safeEqual(token, legacy)) {
+    return {
+      actor_id: "legacy-api-key",
+      credential_id: "legacy-api-key",
+      credential_type: "api_key",
+      roles: ["owner"],
+      scopes: allScopes2
+    };
+  }
+  for (const credential of configuredApiCredentials()) {
+    const secret = credential.token || credential.key || "";
+    if (!safeEqual(token, secret) || credential.revoked || isExpired(credential.expires_at))
+      continue;
+    const roles = normalizeRoles(credential.roles);
+    const scopes = normalizeScopes(credential.scopes) || scopesForRoles(roles);
+    const entity_ids = credentialEntityIds(credential);
+    return {
+      actor_id: credential.actor_id || `${credential.type || "api_key"}:${credential.id}`,
+      credential_id: credential.id,
+      credential_type: credential.type || "api_key",
+      roles,
+      scopes,
+      ...entity_ids ? { entity_ids } : {}
+    };
+  }
+  const verify = AUTH_CONSTANTS.verifyToken;
+  if (verify && token.split(".").length === 3) {
+    try {
+      const verified = verify(token);
+      return {
+        actor_id: verified.identity_id,
+        credential_id: verified.jti,
+        credential_type: "session",
+        roles: [],
+        scopes: normalizeScopes(verified.scopes) ?? [],
+        ...verified.entity_ids ? { entity_ids: verified.entity_ids } : {}
+      };
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function authenticateApiRequest(req) {
+  return authenticateToken(bearerToken(req.headers.get("Authorization")));
+}
+function normalizeRoles(roles = ["integration"]) {
+  const normalized = roles.filter((role) => knownRoles.has(role));
+  return normalized.length > 0 ? Array.from(new Set(normalized)) : ["integration"];
+}
+function normalizeScopes(scopes) {
+  if (!scopes)
+    return null;
+  return Array.from(new Set(scopes.filter((scope) => knownScopes.has(scope))));
+}
+function safeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function isExpired(expiresAt) {
+  return Boolean(expiresAt && Date.parse(expiresAt) <= Date.now());
+}
+
+// src/db/database.ts
+import { Database } from "bun:sqlite";
+import { mkdirSync as mkdirSync3 } from "fs";
+import { dirname } from "path";
+
+// src/config.ts
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var APP_NAME = "treasury";
+var ENV_TOKEN = "TREASURY";
+var DEPRECATED_CLOUD_ALIASES = new Set(["remote", "hybrid", "self_hosted"]);
+var MODE_KEYS = [`HASNA_${ENV_TOKEN}_STORAGE_MODE`, `${ENV_TOKEN}_STORAGE_MODE`];
+var DB_URL_KEYS = [`HASNA_${ENV_TOKEN}_DATABASE_URL`, `${ENV_TOKEN}_DATABASE_URL`];
+var DB_URL_FILE_KEYS = [`HASNA_${ENV_TOKEN}_DATABASE_URL_FILE`, `${ENV_TOKEN}_DATABASE_URL_FILE`];
+var DB_PATH_KEYS = [`HASNA_${ENV_TOKEN}_DB_PATH`, `${ENV_TOKEN}_DB_PATH`];
+function firstEnv(env, keys) {
+  for (const key of keys) {
+    const value = env[key]?.trim();
+    if (value)
+      return value;
+  }
+  return;
+}
+function resolveStorageMode(env = process.env) {
+  const raw = firstEnv(env, MODE_KEYS);
+  const dsnPresent = databaseUrlPresent(env);
+  let mode;
+  if (!raw) {
+    mode = "local";
+  } else {
+    const normalized = raw.toLowerCase().replace(/-/g, "_");
+    if (normalized === "local")
+      mode = "local";
+    else if (normalized === "cloud" || DEPRECATED_CLOUD_ALIASES.has(normalized))
+      mode = "cloud";
+    else
+      throw new Error(`Unknown storage mode: ${raw}. Use local or cloud.`);
+  }
+  if (mode === "local" && dsnPresent) {
+    throw new Error(`Fail-closed misconfig: a ${ENV_TOKEN} DATABASE_URL is present but storage mode is 'local'. ` + `Set HASNA_${ENV_TOKEN}_STORAGE_MODE=cloud (PURE REMOTE) or unset the DATABASE_URL. ` + `Refusing to silently write money/audit data to SQLite while a cloud DB is configured.`);
+  }
+  if (mode === "cloud" && !dsnPresent) {
+    console.warn(`[treasury] cloud mode needs HASNA_${ENV_TOKEN}_DATABASE_URL (or *_FILE); ` + `PURE REMOTE reads/writes go to cloud Postgres.`);
+  }
+  return mode;
+}
+function databaseUrlPresent(env = process.env) {
+  return firstEnv(env, DB_URL_KEYS) !== undefined || firstEnv(env, DB_URL_FILE_KEYS) !== undefined;
+}
+function resolveDatabaseUrl(env = process.env) {
+  const filePath = firstEnv(env, DB_URL_FILE_KEYS);
+  if (filePath && existsSync(filePath))
+    return readFileSync(filePath, "utf8").trim();
+  return firstEnv(env, DB_URL_KEYS) ?? null;
+}
+function scrubDatabaseUrl(env = process.env) {
+  for (const key of DB_URL_KEYS)
+    delete env[key];
+}
+function defaultSqlitePath() {
+  return join(homedir(), ".hasna", APP_NAME, `${APP_NAME}.db`);
+}
+function resolveDbPath(env = process.env) {
+  return firstEnv(env, DB_PATH_KEYS) ?? defaultSqlitePath();
+}
+
+// src/core/app-home.ts
+import { existsSync as existsSync2, mkdirSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2, resolve } from "path";
+var TREASURY_APP_SUBDIRS = ["config", "data", "exports", "backups", "logs", "tmp"];
+function homeDir() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir2();
+}
+function getTreasuryAppHome() {
+  return resolve(process.env["HASNA_TREASURY_HOME"] ?? process.env["TREASURY_HOME"] ?? join2(homeDir(), ".hasna", APP_NAME));
+}
+function getTreasuryAppDir(name) {
+  return join2(getTreasuryAppHome(), name);
+}
+function ensureTreasuryAppHome() {
+  const root = getTreasuryAppHome();
+  mkdirSync(root, { recursive: true, mode: 448 });
+  const dirs = { root };
+  for (const name of TREASURY_APP_SUBDIRS) {
+    const dir = getTreasuryAppDir(name);
+    if (!existsSync2(dir))
+      mkdirSync(dir, { recursive: true, mode: 448 });
+    dirs[name] = dir;
+  }
+  return dirs;
+}
+function getDefaultTreasuryBackupDir() {
+  return getTreasuryAppDir("backups");
+}
+
+// src/db/backup.ts
+import { chmodSync, copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, statSync, unlinkSync } from "fs";
+import { basename, join as join3, resolve as resolve2 } from "path";
+var RETENTION = 10;
+function backupsDisabled() {
+  const raw = process.env["HASNA_TREASURY_BACKUP_BEFORE_MIGRATION"] ?? process.env["TREASURY_BACKUP_BEFORE_MIGRATION"];
+  if (!raw)
+    return false;
+  return ["0", "false", "no", "off"].includes(raw.toLowerCase());
+}
+function backupDirFor(dbPath) {
+  const override = process.env["HASNA_TREASURY_BACKUP_DIR"] ?? process.env["TREASURY_BACKUP_DIR"];
+  if (override)
+    return resolve2(override);
+  const resolved = resolve2(dbPath);
+  if (resolved === resolve2(getDefaultTreasuryBackupDir(), "..", "data", "treasury.db")) {
+    return getDefaultTreasuryBackupDir();
+  }
+  return getDefaultTreasuryBackupDir();
+}
+function maybeBackupBeforeMigration(dbPath) {
+  if (backupsDisabled())
+    return { skipped: true, reason: "disabled" };
+  if (dbPath === ":memory:")
+    return { skipped: true, reason: "memory database" };
+  if (!existsSync3(dbPath))
+    return { skipped: true, reason: "no existing database" };
+  if (statSync(dbPath).size === 0)
+    return { skipped: true, reason: "empty database" };
+  const dir = backupDirFor(dbPath);
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const backupPath = join3(dir, `${basename(dbPath)}-${stamp}-pre-migration.db`);
+  copyFileSync(dbPath, backupPath);
+  chmodSync(backupPath, 384);
+  pruneOldBackups(dir, basename(dbPath));
+  return { skipped: false, backup_path: backupPath };
+}
+function pruneOldBackups(dir, dbBase) {
+  const prefix = `${dbBase}-`;
+  const entries = readdirSync(dir).filter((n) => n.startsWith(prefix) && n.endsWith("-pre-migration.db")).map((n) => ({ name: n, path: join3(dir, n), mtime: statSync(join3(dir, n)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  for (const stale of entries.slice(RETENTION)) {
+    try {
+      unlinkSync(stale.path);
+    } catch {}
+  }
+}
+
+// src/db/schema.ts
+var SQLITE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS schema_migrations (
+  id INTEGER PRIMARY KEY,
+  applied_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS entities (
+  entity_id TEXT PRIMARY KEY,
+  entity_slug TEXT UNIQUE,
+  name TEXT NOT NULL,
+  base_currency TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS balance_snapshots (
+  id TEXT PRIMARY KEY,
+  entity_id TEXT NOT NULL REFERENCES entities(entity_id),
+  account_ref TEXT NOT NULL,
+  account_kind TEXT NOT NULL,
+  currency TEXT NOT NULL,
+  amount_minor INTEGER NOT NULL,
+  as_of TEXT NOT NULL,
+  source TEXT NOT NULL,
+  captured_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_balances_entity ON balance_snapshots(entity_id);
+
+CREATE TABLE IF NOT EXISTS fx_rates (
+  id TEXT PRIMARY KEY,
+  base_currency TEXT NOT NULL,
+  quote_currency TEXT NOT NULL,
+  rate REAL NOT NULL,
+  as_of TEXT NOT NULL,
+  source TEXT NOT NULL,
+  captured_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_fx_pair ON fx_rates(base_currency, quote_currency);
+
+CREATE TABLE IF NOT EXISTS cost_feeds (
+  id TEXT PRIMARY KEY,
+  entity_id TEXT NOT NULL REFERENCES entities(entity_id),
+  currency TEXT NOT NULL,
+  monthly_burn_minor INTEGER NOT NULL,
+  as_of TEXT NOT NULL,
+  source TEXT NOT NULL,
+  captured_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_cost_entity ON cost_feeds(entity_id);
+
+CREATE TABLE IF NOT EXISTS sweep_recommendations (
+  id TEXT PRIMARY KEY,
+  from_entity_id TEXT NOT NULL REFERENCES entities(entity_id),
+  to_entity_id TEXT NOT NULL REFERENCES entities(entity_id),
+  currency TEXT NOT NULL,
+  amount_minor INTEGER NOT NULL,
+  rationale TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'recommended',
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_sweeps_from ON sweep_recommendations(from_entity_id);
+
+CREATE TABLE IF NOT EXISTS audit_log (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  entity_id TEXT,
+  actor_id TEXT NOT NULL,
+  action TEXT NOT NULL,
+  detail TEXT NOT NULL,
+  prev_hash TEXT NOT NULL,
+  row_hash TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+-- Keep the hash chain strictly linear under concurrent writers: each row's
+-- prev_hash is the previous row's row_hash, so it is unique by construction.
+-- A concurrent fork (two appends reading the same prev_hash) then loses the
+-- race with a unique-violation instead of silently forking the chain (\xA74.7).
+CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_prev_hash ON audit_log(prev_hash);
+
+CREATE TRIGGER IF NOT EXISTS audit_log_no_update
+BEFORE UPDATE ON audit_log
+BEGIN
+  SELECT RAISE(ABORT, 'audit_log is append-only');
+END;
+
+CREATE TRIGGER IF NOT EXISTS audit_log_no_delete
+BEFORE DELETE ON audit_log
+BEGIN
+  SELECT RAISE(ABORT, 'audit_log is append-only');
+END;
+`;
+function runSqliteMigrations(db) {
+  db.run(SQLITE_SCHEMA);
+  db.run("INSERT OR IGNORE INTO schema_migrations (id) VALUES (1)");
+}
+var POSTGRES_MIGRATIONS = [
+  `CREATE TABLE IF NOT EXISTS schema_migrations (
+     id INTEGER PRIMARY KEY,
+     applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+   )`,
+  `INSERT INTO schema_migrations (id) VALUES (1) ON CONFLICT DO NOTHING`,
+  `CREATE TABLE IF NOT EXISTS entities (
+     entity_id TEXT PRIMARY KEY,
+     entity_slug TEXT UNIQUE,
+     name TEXT NOT NULL,
+     base_currency TEXT NOT NULL,
+     created_at TEXT NOT NULL,
+     updated_at TEXT NOT NULL
+   )`,
+  `CREATE TABLE IF NOT EXISTS balance_snapshots (
+     id TEXT PRIMARY KEY,
+     entity_id TEXT NOT NULL REFERENCES entities(entity_id),
+     account_ref TEXT NOT NULL,
+     account_kind TEXT NOT NULL,
+     currency TEXT NOT NULL,
+     amount_minor BIGINT NOT NULL,
+     as_of TEXT NOT NULL,
+     source TEXT NOT NULL,
+     captured_at TEXT NOT NULL
+   )`,
+  `CREATE INDEX IF NOT EXISTS idx_balances_entity ON balance_snapshots(entity_id)`,
+  `CREATE TABLE IF NOT EXISTS fx_rates (
+     id TEXT PRIMARY KEY,
+     base_currency TEXT NOT NULL,
+     quote_currency TEXT NOT NULL,
+     rate DOUBLE PRECISION NOT NULL,
+     as_of TEXT NOT NULL,
+     source TEXT NOT NULL,
+     captured_at TEXT NOT NULL
+   )`,
+  `CREATE INDEX IF NOT EXISTS idx_fx_pair ON fx_rates(base_currency, quote_currency)`,
+  `CREATE TABLE IF NOT EXISTS cost_feeds (
+     id TEXT PRIMARY KEY,
+     entity_id TEXT NOT NULL REFERENCES entities(entity_id),
+     currency TEXT NOT NULL,
+     monthly_burn_minor BIGINT NOT NULL,
+     as_of TEXT NOT NULL,
+     source TEXT NOT NULL,
+     captured_at TEXT NOT NULL
+   )`,
+  `CREATE INDEX IF NOT EXISTS idx_cost_entity ON cost_feeds(entity_id)`,
+  `CREATE TABLE IF NOT EXISTS sweep_recommendations (
+     id TEXT PRIMARY KEY,
+     from_entity_id TEXT NOT NULL REFERENCES entities(entity_id),
+     to_entity_id TEXT NOT NULL REFERENCES entities(entity_id),
+     currency TEXT NOT NULL,
+     amount_minor BIGINT NOT NULL,
+     rationale TEXT NOT NULL,
+     status TEXT NOT NULL DEFAULT 'recommended',
+     created_at TEXT NOT NULL,
+     updated_at TEXT NOT NULL
+   )`,
+  `CREATE INDEX IF NOT EXISTS idx_sweeps_from ON sweep_recommendations(from_entity_id)`,
+  `CREATE TABLE IF NOT EXISTS audit_log (
+     id BIGSERIAL PRIMARY KEY,
+     entity_id TEXT,
+     actor_id TEXT NOT NULL,
+     action TEXT NOT NULL,
+     detail TEXT NOT NULL,
+     prev_hash TEXT NOT NULL,
+     row_hash TEXT NOT NULL,
+     created_at TEXT NOT NULL
+   )`,
+  `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_prev_hash ON audit_log(prev_hash)`,
+  `CREATE OR REPLACE FUNCTION treasury_audit_immutable() RETURNS trigger AS $$
+   BEGIN RAISE EXCEPTION 'audit_log is append-only'; END; $$ LANGUAGE plpgsql`,
+  `DROP TRIGGER IF EXISTS audit_log_no_mutate ON audit_log`,
+  `CREATE TRIGGER audit_log_no_mutate BEFORE UPDATE OR DELETE ON audit_log
+     FOR EACH ROW EXECUTE FUNCTION treasury_audit_immutable()`
+];
+
+// src/db/database.ts
+class SqliteClient {
+  db;
+  mode = "local";
+  constructor(db) {
+    this.db = db;
+  }
+  async all(sql, params = []) {
+    return this.db.query(sql).all(...params);
+  }
+  async get(sql, params = []) {
+    return this.db.query(sql).get(...params) ?? null;
+  }
+  async run(sql, params = []) {
+    this.db.query(sql).run(...params);
+  }
+  async transaction(fn) {
+    this.db.run("BEGIN");
+    try {
+      const result = await fn(this);
+      this.db.run("COMMIT");
+      return result;
+    } catch (error) {
+      try {
+        this.db.run("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  }
+  async close() {
+    this.db.close();
+  }
+  raw() {
+    return this.db;
+  }
+}
+function toPgSql(sql) {
+  let i = 0;
+  return sql.replace(/\?/g, () => `$${++i}`);
+}
+
+class PostgresClient {
+  client;
+  full;
+  mode = "cloud";
+  constructor(client, full) {
+    this.client = client;
+    this.full = full;
+  }
+  async all(sql, params = []) {
+    return this.client.many(toPgSql(sql), params);
+  }
+  async get(sql, params = []) {
+    return this.client.get(toPgSql(sql), params);
+  }
+  async run(sql, params = []) {
+    await this.client.execute(toPgSql(sql), params);
+  }
+  async transaction(fn) {
+    if (!this.full)
+      throw new Error("Nested transaction is not supported.");
+    return this.full.transaction((c) => fn(new PostgresClient(c)));
+  }
+  async close() {
+    await this.full?.close();
+  }
+}
+var _client = null;
+async function openDatabase(opts = {}) {
+  if (_client && !opts.fresh && !opts.path && !opts.mode)
+    return _client;
+  const mode = opts.mode ?? resolveStorageMode();
+  const client = opts.path !== undefined ? openLocal(opts.path) : mode === "cloud" ? await openCloud() : openLocal(resolveLocalPath());
+  if (!opts.path && !opts.fresh && !opts.mode)
+    _client = client;
+  return client;
+}
+function resolveLocalPath() {
+  ensureTreasuryAppHome();
+  return resolveDbPath();
+}
+function openLocal(path) {
+  if (path !== ":memory:") {
+    mkdirSync3(dirname(path), { recursive: true, mode: 448 });
+    maybeBackupBeforeMigration(path);
+  }
+  const db = new Database(path);
+  db.run("PRAGMA journal_mode = WAL;");
+  db.run("PRAGMA busy_timeout = 5000;");
+  db.run("PRAGMA foreign_keys = ON;");
+  runSqliteMigrations(db);
+  return new SqliteClient(db);
+}
+async function openCloud() {
+  const dsn = resolveDatabaseUrl();
+  if (!dsn) {
+    throw new Error("cloud storage mode requires HASNA_TREASURY_DATABASE_URL (or *_FILE). " + "PURE REMOTE refuses to fall back to local/in-memory SQLite.");
+  }
+  if (!/sslmode=verify-full/.test(dsn)) {
+    throw new Error("cloud DSN must use sslmode=verify-full (BUILD-SPEC \xA74.8); sslmode=require is forbidden.");
+  }
+  const { createPgPool: createPgPool2 } = await Promise.resolve().then(() => (init_pool(), exports_pool));
+  const { createQueryClient: createQueryClient2 } = await Promise.resolve().then(() => exports_query);
+  const pool = createPgPool2({ connectionString: dsn, env: process.env, applicationName: "treasury" });
+  const client = createQueryClient2(pool);
+  for (const sql of POSTGRES_MIGRATIONS) {
+    await client.execute(sql);
+  }
+  scrubDatabaseUrl();
+  return new PostgresClient(client, client);
+}
+function now() {
+  return new Date().toISOString();
+}
+function uuid() {
+  return crypto.randomUUID();
+}
+
+// src/services/context.ts
+function contextFromPrincipal(db, principal) {
+  return {
+    db,
+    auth: {
+      actor_id: principal.actor_id,
+      roles: principal.roles,
+      ...principal.entity_ids ? { entity_ids: principal.entity_ids } : {},
+      ...principal.bypass ? { bypass: true } : {}
+    },
+    scopes: principal.scopes
+  };
+}
+function localOwnerContext(db) {
+  return {
+    db,
+    auth: SYSTEM_AUTHORIZATION_CONTEXT,
+    scopes: ["treasury:read", "treasury:write", "treasury:recommend", "treasury:export", "treasury:admin", "storage:admin"]
+  };
+}
+function guard(rc, scope, action, entity_id) {
+  if (!rc.auth.bypass && !rc.scopes.includes(scope)) {
+    throw new PermissionDeniedError(action, `missing scope ${scope}`);
+  }
+  authorize(action, rc.auth, entity_id ? { entity_id } : {});
+}
+
+// src/db/audit.ts
+import { createHash } from "crypto";
+var GENESIS = "0".repeat(64);
+function canonical(fields) {
+  return JSON.stringify([fields.entity_id, fields.actor_id, fields.action, fields.detail, fields.created_at]);
+}
+async function appendAudit(db, input) {
+  await db.transaction(async (tx) => {
+    const last = await tx.get("SELECT row_hash FROM audit_log ORDER BY id DESC LIMIT 1");
+    const prev_hash = last?.row_hash ?? GENESIS;
+    const created_at = now();
+    const fields = { entity_id: input.entity_id, actor_id: input.actor_id, action: input.action, detail: input.detail, created_at };
+    const row_hash = createHash("sha256").update(prev_hash + canonical(fields)).digest("hex");
+    await tx.run("INSERT INTO audit_log (entity_id, actor_id, action, detail, prev_hash, row_hash, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)", [fields.entity_id, fields.actor_id, fields.action, fields.detail, prev_hash, row_hash, created_at]);
+  });
+}
+
+// src/services/entities.ts
+async function createEntity(rc, input) {
+  guard(rc, "treasury:admin", "admin");
+  if (!input.name?.trim())
+    throw new ValidationError("name is required.");
+  if (!/^[A-Z]{3}$/.test(input.base_currency ?? ""))
+    throw new ValidationError("base_currency must be an ISO-4217 code (e.g. USD).");
+  const ts = now();
+  const row = {
+    entity_id: uuid(),
+    entity_slug: input.entity_slug?.trim() || null,
+    name: input.name.trim(),
+    base_currency: input.base_currency,
+    created_at: ts,
+    updated_at: ts
+  };
+  await rc.db.run("INSERT INTO entities (entity_id, entity_slug, name, base_currency, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)", [row.entity_id, row.entity_slug, row.name, row.base_currency, row.created_at, row.updated_at]);
+  await appendAudit(rc.db, { entity_id: row.entity_id, actor_id: rc.auth.actor_id, action: "entity.create", detail: `name=${row.name}` });
+  return row;
+}
+async function listEntities(rc) {
+  guard(rc, "treasury:read", "read");
+  const rows = await rc.db.all("SELECT * FROM entities ORDER BY name ASC");
+  if (rc.auth.bypass || rc.auth.entity_ids === undefined) {
+    return rc.auth.bypass ? rows : [];
+  }
+  const allowed = new Set(rc.auth.entity_ids);
+  return rows.filter((r) => allowed.has(r.entity_id));
+}
+async function getEntity(rc, input) {
+  guard(rc, "treasury:read", "read", input.entity_id);
+  return requireEntity(rc, input.entity_id);
+}
+async function requireEntity(rc, entity_id) {
+  const row = await rc.db.get("SELECT * FROM entities WHERE entity_id = ?", [entity_id]);
+  if (!row)
+    throw new EntityNotFoundError(entity_id);
+  return row;
+}
+
+// src/services/fx.ts
+async function recordFxRate(rc, input) {
+  guard(rc, "treasury:write", "write");
+  if (!/^[A-Z]{3}$/.test(input.base_currency) || !/^[A-Z]{3}$/.test(input.quote_currency)) {
+    throw new ValidationError("base_currency and quote_currency must be ISO-4217 codes.");
+  }
+  if (!(input.rate > 0))
+    throw new ValidationError("rate must be a positive number.");
+  const captured_at = now();
+  const row = {
+    id: uuid(),
+    base_currency: input.base_currency,
+    quote_currency: input.quote_currency,
+    rate: input.rate,
+    as_of: input.as_of ?? captured_at,
+    source: input.source ?? "manual",
+    captured_at
+  };
+  await rc.db.run("INSERT INTO fx_rates (id, base_currency, quote_currency, rate, as_of, source, captured_at) VALUES (?, ?, ?, ?, ?, ?, ?)", [row.id, row.base_currency, row.quote_currency, row.rate, row.as_of, row.source, row.captured_at]);
+  await appendAudit(rc.db, { entity_id: null, actor_id: rc.auth.actor_id, action: "fx.record", detail: `${row.base_currency}/${row.quote_currency}=${row.rate}` });
+  return row;
+}
+async function listFxRates(rc) {
+  guard(rc, "treasury:read", "read");
+  return rc.db.all("SELECT * FROM fx_rates ORDER BY captured_at DESC");
+}
+async function convertMinor(db, amountMinor, from, to) {
+  if (from === to)
+    return amountMinor;
+  const direct = await db.get("SELECT rate FROM fx_rates WHERE base_currency = ? AND quote_currency = ? ORDER BY captured_at DESC LIMIT 1", [to, from]);
+  if (direct)
+    return Math.round(amountMinor / direct.rate);
+  const inverse = await db.get("SELECT rate FROM fx_rates WHERE base_currency = ? AND quote_currency = ? ORDER BY captured_at DESC LIMIT 1", [from, to]);
+  if (inverse)
+    return Math.round(amountMinor * inverse.rate);
+  throw new ValidationError(`No FX rate available to convert ${from} -> ${to}. Record a rate first.`);
+}
+async function fxExposure(rc, input) {
+  guard(rc, "treasury:read", "read");
+  const base = (input.base ?? "USD").toUpperCase();
+  if (!/^[A-Z]{3}$/.test(base))
+    throw new ValidationError("base must be an ISO-4217 code.");
+  const rows = await visibleBalanceSums(rc);
+  const exposures = [];
+  let totalInBase = 0;
+  for (const { currency, total_minor } of rows) {
+    const in_base_minor = await convertMinor(rc.db, total_minor, currency, base);
+    totalInBase += in_base_minor;
+    exposures.push({ currency, total_minor, in_base_minor });
+  }
+  exposures.sort((a, b) => b.in_base_minor - a.in_base_minor);
+  return { base_currency: base, as_of: now(), total_in_base_minor: totalInBase, exposures };
+}
+async function visibleBalanceSums(rc) {
+  const { clause, params } = entityFilter(rc);
+  return rc.db.all(`SELECT currency, SUM(amount_minor) AS total_minor FROM balance_snapshots ${clause} GROUP BY currency`, params);
+}
+function entityFilter(rc, column = "entity_id") {
+  if (rc.auth.bypass)
+    return { clause: "", params: [] };
+  const ids = rc.auth.entity_ids ?? [];
+  if (ids.length === 0)
+    return { clause: "WHERE 1=0", params: [] };
+  const placeholders = ids.map(() => "?").join(", ");
+  return { clause: `WHERE ${column} IN (${placeholders})`, params: [...ids] };
+}
+
+// src/services/balances.ts
+async function recordBalance(rc, input) {
+  guard(rc, "treasury:write", "write", input.entity_id);
+  await requireEntity(rc, input.entity_id);
+  if (!/^[A-Z]{3}$/.test(input.currency))
+    throw new ValidationError("currency must be an ISO-4217 code.");
+  if (!Number.isInteger(input.amount_minor))
+    throw new ValidationError("amount_minor must be an integer (minor units).");
+  if (input.account_kind !== "bank" && input.account_kind !== "wallet")
+    throw new ValidationError("account_kind must be 'bank' or 'wallet'.");
+  const captured_at = now();
+  const row = {
+    id: uuid(),
+    entity_id: input.entity_id,
+    account_ref: input.account_ref,
+    account_kind: input.account_kind,
+    currency: input.currency,
+    amount_minor: input.amount_minor,
+    as_of: input.as_of ?? captured_at,
+    source: input.source ?? "manual",
+    captured_at
+  };
+  await rc.db.run("INSERT INTO balance_snapshots (id, entity_id, account_ref, account_kind, currency, amount_minor, as_of, source, captured_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", [row.id, row.entity_id, row.account_ref, row.account_kind, row.currency, row.amount_minor, row.as_of, row.source, row.captured_at]);
+  await appendAudit(rc.db, { entity_id: row.entity_id, actor_id: rc.auth.actor_id, action: "balance.record", detail: `${row.currency} ${row.amount_minor} @ ${row.account_ref}` });
+  return row;
+}
+async function listBalances(rc, input) {
+  guard(rc, "treasury:read", "read", input.entity_id);
+  if (input.entity_id) {
+    return rc.db.all("SELECT * FROM balance_snapshots WHERE entity_id = ? ORDER BY captured_at DESC", [input.entity_id]);
+  }
+  const { clause, params } = entityFilter(rc);
+  return rc.db.all(`SELECT * FROM balance_snapshots ${clause} ORDER BY captured_at DESC`, params);
+}
+async function consolidatedBalances(rc, input) {
+  guard(rc, "treasury:read", "read");
+  const base = (input.base ?? "USD").toUpperCase();
+  if (!/^[A-Z]{3}$/.test(base))
+    throw new ValidationError("base must be an ISO-4217 code.");
+  const { clause, params } = entityFilter(rc);
+  const rows = await rc.db.all(`SELECT currency, SUM(amount_minor) AS total_minor FROM balance_snapshots ${clause} GROUP BY currency`, params);
+  let total = 0;
+  const by_currency = [];
+  for (const r of rows) {
+    const in_base_minor = await convertMinor(rc.db, r.total_minor, r.currency, base);
+    total += in_base_minor;
+    by_currency.push({ currency: r.currency, total_minor: r.total_minor, in_base_minor });
+  }
+  by_currency.sort((a, b) => b.in_base_minor - a.in_base_minor);
+  return { base_currency: base, as_of: now(), total_in_base_minor: total, by_currency };
+}
+
+// src/services/runway.ts
+async function recordCostFeed(rc, input) {
+  guard(rc, "treasury:write", "write", input.entity_id);
+  await requireEntity(rc, input.entity_id);
+  if (!/^[A-Z]{3}$/.test(input.currency))
+    throw new ValidationError("currency must be an ISO-4217 code.");
+  if (!Number.isInteger(input.monthly_burn_minor))
+    throw new ValidationError("monthly_burn_minor must be an integer (minor units).");
+  const captured_at = now();
+  const row = {
+    id: uuid(),
+    entity_id: input.entity_id,
+    currency: input.currency,
+    monthly_burn_minor: input.monthly_burn_minor,
+    as_of: input.as_of ?? captured_at,
+    source: input.source ?? "manual",
+    captured_at
+  };
+  await rc.db.run("INSERT INTO cost_feeds (id, entity_id, currency, monthly_burn_minor, as_of, source, captured_at) VALUES (?, ?, ?, ?, ?, ?, ?)", [row.id, row.entity_id, row.currency, row.monthly_burn_minor, row.as_of, row.source, row.captured_at]);
+  await appendAudit(rc.db, { entity_id: row.entity_id, actor_id: rc.auth.actor_id, action: "cost.record", detail: `${row.currency} ${row.monthly_burn_minor}/mo` });
+  return row;
+}
+async function listCostFeeds(rc, input) {
+  guard(rc, "treasury:read", "read", input.entity_id);
+  if (input.entity_id) {
+    return rc.db.all("SELECT * FROM cost_feeds WHERE entity_id = ? ORDER BY captured_at DESC", [input.entity_id]);
+  }
+  const { clause, params } = entityFilter(rc);
+  return rc.db.all(`SELECT * FROM cost_feeds ${clause} ORDER BY captured_at DESC`, params);
+}
+async function latestCostFeeds(rc, entity_id) {
+  const rows = entity_id ? await rc.db.all("SELECT * FROM cost_feeds WHERE entity_id = ? ORDER BY captured_at DESC", [entity_id]) : await (async () => {
+    const { clause, params } = entityFilter(rc);
+    return rc.db.all(`SELECT * FROM cost_feeds ${clause} ORDER BY captured_at DESC`, params);
+  })();
+  const seen = new Set;
+  const latest = [];
+  for (const r of rows) {
+    const key = `${r.entity_id}:${r.currency}`;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    latest.push(r);
+  }
+  return latest;
+}
+async function sumBalancesInBase(rc, base, entity_id) {
+  const rows = entity_id ? await rc.db.all("SELECT currency, SUM(amount_minor) AS total_minor FROM balance_snapshots WHERE entity_id = ? GROUP BY currency", [entity_id]) : await (async () => {
+    const { clause, params } = entityFilter(rc);
+    return rc.db.all(`SELECT currency, SUM(amount_minor) AS total_minor FROM balance_snapshots ${clause} GROUP BY currency`, params);
+  })();
+  let total = 0;
+  for (const r of rows)
+    total += await convertMinor(rc.db, r.total_minor, r.currency, base);
+  return total;
+}
+function runwayMonths(cash, burn) {
+  if (burn <= 0)
+    return null;
+  return Math.round(cash / burn * 100) / 100;
+}
+async function entityRunway(rc, input) {
+  guard(rc, "treasury:read", "read", input.entity_id);
+  const entity = await requireEntity(rc, input.entity_id);
+  const base = (input.base ?? entity.base_currency).toUpperCase();
+  const cash = await sumBalancesInBase(rc, base, input.entity_id);
+  const feeds = await latestCostFeeds(rc, input.entity_id);
+  let burn = 0;
+  for (const f of feeds)
+    burn += await convertMinor(rc.db, f.monthly_burn_minor, f.currency, base);
+  return {
+    scope: "entity",
+    entity_id: input.entity_id,
+    base_currency: base,
+    cash_in_base_minor: cash,
+    monthly_burn_in_base_minor: burn,
+    runway_months: runwayMonths(cash, burn),
+    as_of: now()
+  };
+}
+async function groupRunway(rc, input) {
+  guard(rc, "treasury:read", "read");
+  const base = (input.base ?? "USD").toUpperCase();
+  if (!/^[A-Z]{3}$/.test(base))
+    throw new ValidationError("base must be an ISO-4217 code.");
+  const cash = await sumBalancesInBase(rc, base);
+  const feeds = await latestCostFeeds(rc);
+  let burn = 0;
+  for (const f of feeds)
+    burn += await convertMinor(rc.db, f.monthly_burn_minor, f.currency, base);
+  return {
+    scope: "group",
+    entity_id: null,
+    base_currency: base,
+    cash_in_base_minor: cash,
+    monthly_burn_in_base_minor: burn,
+    runway_months: runwayMonths(cash, burn),
+    as_of: now()
+  };
+}
+
+// src/services/forecast.ts
+var MAX_HORIZON = 36;
+function monthLabel(offset) {
+  const d = new Date;
+  d.setUTCDate(1);
+  d.setUTCMonth(d.getUTCMonth() + offset);
+  return `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, "0")}`;
+}
+function project(starting, burn, horizon) {
+  const points = [];
+  for (let m = 0;m <= horizon; m++) {
+    points.push({ month_index: m, month: monthLabel(m), projected_cash_in_base_minor: starting - burn * m });
+  }
+  return points;
+}
+async function cashForecast(rc, input) {
+  guard(rc, "treasury:read", "read", input.entity_id);
+  const horizon = input.horizon_months ?? 6;
+  if (!Number.isInteger(horizon) || horizon < 1 || horizon > MAX_HORIZON) {
+    throw new ValidationError(`horizon_months must be an integer in 1..${MAX_HORIZON}.`);
+  }
+  const runway = input.entity_id ? await entityRunway(rc, { entity_id: input.entity_id, ...input.base ? { base: input.base } : {} }) : await groupRunway(rc, { ...input.base ? { base: input.base } : {} });
+  return {
+    scope: runway.scope,
+    entity_id: runway.entity_id,
+    base_currency: runway.base_currency,
+    horizon_months: horizon,
+    starting_cash_in_base_minor: runway.cash_in_base_minor,
+    monthly_burn_in_base_minor: runway.monthly_burn_in_base_minor,
+    points: project(runway.cash_in_base_minor, runway.monthly_burn_in_base_minor, horizon),
+    as_of: now()
+  };
+}
+
+// src/services/sweeps.ts
+function hydrate(row) {
+  return { ...row, requires_controls_authorization: true };
+}
+async function listSweeps(rc, input = {}) {
+  guard(rc, "treasury:read", "read");
+  const from = entityFilter(rc, "from_entity_id");
+  const to = entityFilter(rc, "to_entity_id");
+  let clause = "";
+  const args = [];
+  if (from.clause && to.clause) {
+    clause = `${from.clause} AND ${to.clause.replace(/^WHERE\s+/, "")}`;
+    args.push(...from.params, ...to.params);
+  }
+  let sql = `SELECT * FROM sweep_recommendations ${clause}`;
+  if (input.status) {
+    sql += clause ? " AND status = ?" : "WHERE status = ?";
+    args.push(input.status);
+  }
+  sql += " ORDER BY created_at DESC";
+  const rows = await rc.db.all(sql, args);
+  return rows.map(hydrate);
+}
+async function getSweep(rc, input) {
+  guard(rc, "treasury:read", "read");
+  const row = await rc.db.get("SELECT * FROM sweep_recommendations WHERE id = ?", [input.id]);
+  if (!row)
+    throw new SweepNotFoundError(input.id);
+  authorize("read", rc.auth, { entity_ids: [row.from_entity_id, row.to_entity_id] });
+  return hydrate(row);
+}
+async function generateSweeps(rc, input) {
+  guard(rc, "treasury:recommend", "recommend");
+  const base = (input.base ?? "USD").toUpperCase();
+  if (!/^[A-Z]{3}$/.test(base))
+    throw new ValidationError("base must be an ISO-4217 code.");
+  const minRunway = input.min_runway_months ?? 3;
+  const healthy = input.healthy_runway_months ?? 12;
+  if (minRunway <= 0 || healthy <= minRunway)
+    throw new ValidationError("healthy_runway_months must be greater than min_runway_months (> 0).");
+  const entities = await listEntities(rc);
+  const needy = [];
+  const donors = [];
+  for (const e of entities) {
+    const r = await entityRunway(rc, { entity_id: e.entity_id, base });
+    const burn = r.monthly_burn_in_base_minor;
+    const cash = r.cash_in_base_minor;
+    if (burn > 0) {
+      const need = Math.max(0, Math.round(minRunway * burn) - cash);
+      const surplus = Math.max(0, cash - Math.round(healthy * burn));
+      if (need > 0)
+        needy.push({ id: e.entity_id, need });
+      else if (surplus > 0)
+        donors.push({ id: e.entity_id, surplus });
+    } else if (cash > 0) {
+      donors.push({ id: e.entity_id, surplus: cash });
+    }
+  }
+  const { clause, params } = entityFilter(rc, "from_entity_id");
+  await rc.db.run(`DELETE FROM sweep_recommendations ${clause}${clause ? " AND" : "WHERE"} status = 'recommended'`, [...params]);
+  needy.sort((a, b) => b.need - a.need);
+  donors.sort((a, b) => b.surplus - a.surplus);
+  const recs = [];
+  let di = 0;
+  for (const n of needy) {
+    let remaining = n.need;
+    while (remaining > 0 && di < donors.length) {
+      const donor = donors[di];
+      if (donor.surplus <= 0) {
+        di++;
+        continue;
+      }
+      const amount = Math.min(remaining, donor.surplus);
+      donor.surplus -= amount;
+      remaining -= amount;
+      const ts = now();
+      const rec = {
+        id: uuid(),
+        from_entity_id: donor.id,
+        to_entity_id: n.id,
+        currency: base,
+        amount_minor: amount,
+        rationale: `Lift ${n.id} toward ${input.min_runway_months ?? 3}mo runway from ${donor.id} surplus.`,
+        status: "recommended",
+        requires_controls_authorization: true,
+        created_at: ts,
+        updated_at: ts
+      };
+      await rc.db.run("INSERT INTO sweep_recommendations (id, from_entity_id, to_entity_id, currency, amount_minor, rationale, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", [rec.id, rec.from_entity_id, rec.to_entity_id, rec.currency, rec.amount_minor, rec.rationale, rec.status, rec.created_at, rec.updated_at]);
+      await appendAudit(rc.db, { entity_id: donor.id, actor_id: rc.auth.actor_id, action: "sweep.recommend", detail: `${donor.id}->${n.id} ${base} ${amount}` });
+      recs.push(rec);
+      if (donor.surplus <= 0)
+        di++;
+    }
+  }
+  return recs;
+}
+async function updateSweepStatus(rc, input) {
+  guard(rc, "treasury:recommend", "recommend");
+  if (!["recommended", "acknowledged", "dismissed"].includes(input.status)) {
+    throw new ValidationError("status must be one of: recommended, acknowledged, dismissed.");
+  }
+  const row = await rc.db.get("SELECT * FROM sweep_recommendations WHERE id = ?", [input.id]);
+  if (!row)
+    throw new SweepNotFoundError(input.id);
+  authorize("recommend", rc.auth, { entity_ids: [row.from_entity_id, row.to_entity_id] });
+  const updated_at = now();
+  await rc.db.run("UPDATE sweep_recommendations SET status = ?, updated_at = ? WHERE id = ?", [input.status, updated_at, input.id]);
+  await appendAudit(rc.db, { entity_id: row.from_entity_id, actor_id: rc.auth.actor_id, action: "sweep.status", detail: `${input.id} -> ${input.status}` });
+  return hydrate({ ...row, status: input.status, updated_at });
+}
+
+// src/services/ingest.ts
+async function ingestFromAdapters(rc, adapters) {
+  guard(rc, "treasury:write", "write");
+  const entities = await listEntities(rc);
+  const ids = entities.map((e) => e.entity_id);
+  const rates = await adapters.fx.fetchRates();
+  for (const r of rates) {
+    await recordFxRate(rc, { base_currency: r.base_currency, quote_currency: r.quote_currency, rate: r.rate, as_of: r.as_of, source: adapters.fx.source });
+  }
+  const balances = await adapters.balances.fetchBalances(ids);
+  for (const b of balances) {
+    await recordBalance(rc, { entity_id: b.entity_id, account_ref: b.account_ref, account_kind: b.account_kind, currency: b.currency, amount_minor: b.amount_minor, as_of: b.as_of, source: adapters.balances.source });
+  }
+  const feeds = await adapters.cost.fetchCostFeeds(ids);
+  for (const f of feeds) {
+    await recordCostFeed(rc, { entity_id: f.entity_id, currency: f.currency, monthly_burn_minor: f.monthly_burn_minor, as_of: f.as_of, source: adapters.cost.source });
+  }
+  return {
+    balances_ingested: balances.length,
+    fx_rates_ingested: rates.length,
+    cost_feeds_ingested: feeds.length,
+    sources: { balances: adapters.balances.source, fx: adapters.fx.source, cost: adapters.cost.source }
+  };
+}
+
+// src/adapters/fixtures.ts
+var AS_OF = "2026-07-01T00:00:00.000Z";
+
+class FixtureBalancesAdapter {
+  rows;
+  source = "fixture:banking";
+  constructor(rows) {
+    this.rows = rows;
+  }
+  async fetchBalances(entityIds) {
+    const set = new Set(entityIds);
+    return this.rows.filter((r) => set.has(r.entity_id));
+  }
+}
+
+class FixtureFxAdapter {
+  rows;
+  source = "fixture:fx";
+  constructor(rows) {
+    this.rows = rows;
+  }
+  async fetchRates() {
+    return [...this.rows];
+  }
+}
+
+class FixtureCostAdapter {
+  rows;
+  source = "fixture:cost";
+  constructor(rows) {
+    this.rows = rows;
+  }
+  async fetchCostFeeds(entityIds) {
+    const set = new Set(entityIds);
+    return this.rows.filter((r) => set.has(r.entity_id));
+  }
+}
+function buildFixtureAdapters(usEntityId, roEntityId) {
+  const balances = [
+    { entity_id: usEntityId, account_ref: "mercury-1010", account_kind: "bank", currency: "USD", amount_minor: 25000000, as_of: AS_OF },
+    { entity_id: usEntityId, account_ref: "wallet-usdc", account_kind: "wallet", currency: "USD", amount_minor: 3000000, as_of: AS_OF },
+    { entity_id: roEntityId, account_ref: "bcr-2020", account_kind: "bank", currency: "EUR", amount_minor: 1500000, as_of: AS_OF }
+  ];
+  const fx = [
+    { base_currency: "USD", quote_currency: "EUR", rate: 0.92, as_of: AS_OF }
+  ];
+  const cost = [
+    { entity_id: usEntityId, currency: "USD", monthly_burn_minor: 1e6, as_of: AS_OF },
+    { entity_id: roEntityId, currency: "EUR", monthly_burn_minor: 2000000, as_of: AS_OF }
+  ];
+  return {
+    balances: new FixtureBalancesAdapter(balances),
+    fx: new FixtureFxAdapter(fx),
+    cost: new FixtureCostAdapter(cost)
+  };
+}
+
+// src/services/registry.ts
+var R = ["minimal", "standard", "full"];
+var SF = ["standard", "full"];
+var F = ["full"];
+var OPS = [
+  {
+    name: "list_entities",
+    description: "List entities the caller is authorized to see.",
+    scope: "treasury:read",
+    action: "read",
+    mutating: false,
+    http: { method: "GET", path: "/v1/entities" },
+    operationId: "listEntities",
+    cli: ["entities", "list"],
+    fields: [],
+    profiles: R,
+    run: (rc) => listEntities(rc)
+  },
+  {
+    name: "get_entity",
+    description: "Get a single entity by entity_id.",
+    scope: "treasury:read",
+    action: "read",
+    mutating: false,
+    http: { method: "GET", path: "/v1/entities/:entity_id" },
+    operationId: "getEntity",
+    cli: ["entities", "get"],
+    fields: [{ name: "entity_id", type: "string", required: true, location: "path" }],
+    profiles: R,
+    run: (rc, i) => getEntity(rc, i)
+  },
+  {
+    name: "create_entity",
+    description: "Create (cache) an entity anchor.",
+    scope: "treasury:admin",
+    action: "admin",
+    mutating: true,
+    http: { method: "POST", path: "/v1/entities" },
+    operationId: "createEntity",
+    cli: ["entities", "create"],
+    fields: [
+      { name: "name", type: "string", required: true, location: "body" },
+      { name: "base_currency", type: "string", required: true, location: "body" },
+      { name: "entity_slug", type: "string", location: "body" }
+    ],
+    profiles: R,
+    run: (rc, i) => createEntity(rc, i)
+  },
+  {
+    name: "list_balances",
+    description: "List cached balance snapshots (optionally for one entity).",
+    scope: "treasury:read",
+    action: "read",
+    mutating: false,
+    http: { method: "GET", path: "/v1/balances" },
+    operationId: "listBalances",
+    cli: ["balances", "list"],
+    fields: [{ name: "entity_id", type: "string", location: "query" }],
+    profiles: R,
+    run: (rc, i) => listBalances(rc, i)
+  },
+  {
+    name: "record_balance",
+    description: "Cache a balance snapshot with provenance.",
+    scope: "treasury:write",
+    action: "write",
+    mutating: true,
+    http: { method: "POST", path: "/v1/balances" },
+    operationId: "recordBalance",
+    cli: ["balances", "record"],
+    fields: [
+      { name: "entity_id", type: "string", required: true, location: "body" },
+      { name: "account_ref", type: "string", required: true, location: "body" },
+      { name: "account_kind", type: "string", required: true, location: "body" },
+      { name: "currency", type: "string", required: true, location: "body" },
+      { name: "amount_minor", type: "int", required: true, location: "body" },
+      { name: "source", type: "string", location: "body" }
+    ],
+    profiles: R,
+    run: (rc, i) => recordBalance(rc, i)
+  },
+  {
+    name: "consolidated_balances",
+    description: "Consolidated balances across visible entities, converted to a base.",
+    scope: "treasury:read",
+    action: "read",
+    mutating: false,
+    http: { method: "GET", path: "/v1/balances/consolidated" },
+    operationId: "consolidatedBalances",
+    cli: ["balances", "consolidated"],
+    fields: [{ name: "base", type: "string", location: "query" }],
+    profiles: R,
+    run: (rc, i) => consolidatedBalances(rc, i)
+  },
+  {
+    name: "list_fx_rates",
+    description: "List cached FX rates.",
+    scope: "treasury:read",
+    action: "read",
+    mutating: false,
+    http: { method: "GET", path: "/v1/fx-rates" },
+    operationId: "listFxRates",
+    cli: ["fx", "list"],
+    fields: [],
+    profiles: SF,
+    run: (rc) => listFxRates(rc)
+  },
+  {
+    name: "record_fx_rate",
+    description: "Cache an FX rate (1 base = rate quote).",
+    scope: "treasury:write",
+    action: "write",
+    mutating: true,
+    http: { method: "POST", path: "/v1/fx-rates" },
+    operationId: "recordFxRate",
+    cli: ["fx", "record"],
+    fields: [
+      { name: "base_currency", type: "string", required: true, location: "body" },
+      { name: "quote_currency", type: "string", required: true, location: "body" },
+      { name: "rate", type: "number", required: true, location: "body" },
+      { name: "source", type: "string", location: "body" }
+    ],
+    profiles: SF,
+    run: (rc, i) => recordFxRate(rc, i)
+  },
+  {
+    name: "fx_exposure",
+    description: "FX exposure across visible balances, converted to a base.",
+    scope: "treasury:read",
+    action: "read",
+    mutating: false,
+    http: { method: "GET", path: "/v1/exposure" },
+    operationId: "fxExposure",
+    cli: ["fx", "exposure"],
+    fields: [{ name: "base", type: "string", location: "query" }],
+    profiles: SF,
+    run: (rc, i) => fxExposure(rc, i)
+  },
+  {
+    name: "record_cost_feed",
+    description: "Record an entity's monthly net cash burn.",
+    scope: "treasury:write",
+    action: "write",
+    mutating: true,
+    http: { method: "POST", path: "/v1/cost-feeds" },
+    operationId: "recordCostFeed",
+    cli: ["cost", "record"],
+    fields: [
+      { name: "entity_id", type: "string", required: true, location: "body" },
+      { name: "currency", type: "string", required: true, location: "body" },
+      { name: "monthly_burn_minor", type: "int", required: true, location: "body" },
+      { name: "source", type: "string", location: "body" }
+    ],
+    profiles: SF,
+    run: (rc, i) => recordCostFeed(rc, i)
+  },
+  {
+    name: "list_cost_feeds",
+    description: "List cached cost feeds (optionally for one entity).",
+    scope: "treasury:read",
+    action: "read",
+    mutating: false,
+    http: { method: "GET", path: "/v1/cost-feeds" },
+    operationId: "listCostFeeds",
+    cli: ["cost", "list"],
+    fields: [{ name: "entity_id", type: "string", location: "query" }],
+    profiles: SF,
+    run: (rc, i) => listCostFeeds(rc, i)
+  },
+  {
+    name: "entity_runway",
+    description: "Runway (months) for a single entity.",
+    scope: "treasury:read",
+    action: "read",
+    mutating: false,
+    http: { method: "GET", path: "/v1/runway/:entity_id" },
+    operationId: "entityRunway",
+    cli: ["runway", "entity"],
+    fields: [
+      { name: "entity_id", type: "string", required: true, location: "path" },
+      { name: "base", type: "string", location: "query" }
+    ],
+    profiles: R,
+    run: (rc, i) => entityRunway(rc, i)
+  },
+  {
+    name: "group_runway",
+    description: "Consolidated group runway (months).",
+    scope: "treasury:read",
+    action: "read",
+    mutating: false,
+    http: { method: "GET", path: "/v1/runway" },
+    operationId: "groupRunway",
+    cli: ["runway", "group"],
+    fields: [{ name: "base", type: "string", location: "query" }],
+    profiles: R,
+    run: (rc, i) => groupRunway(rc, i)
+  },
+  {
+    name: "cash_forecast",
+    description: "Short-horizon cash projection (entity or group).",
+    scope: "treasury:read",
+    action: "read",
+    mutating: false,
+    http: { method: "GET", path: "/v1/forecast" },
+    operationId: "cashForecast",
+    cli: ["forecast", "run"],
+    fields: [
+      { name: "entity_id", type: "string", location: "query" },
+      { name: "base", type: "string", location: "query" },
+      { name: "horizon_months", type: "int", location: "query" }
+    ],
+    profiles: SF,
+    run: (rc, i) => cashForecast(rc, i)
+  },
+  {
+    name: "list_sweeps",
+    description: "List sweep / intercompany-funding recommendations.",
+    scope: "treasury:read",
+    action: "read",
+    mutating: false,
+    http: { method: "GET", path: "/v1/sweeps" },
+    operationId: "listSweeps",
+    cli: ["sweeps", "list"],
+    fields: [{ name: "status", type: "string", location: "query" }],
+    profiles: SF,
+    run: (rc, i) => listSweeps(rc, i)
+  },
+  {
+    name: "get_sweep",
+    description: "Get a single sweep recommendation.",
+    scope: "treasury:read",
+    action: "read",
+    mutating: false,
+    http: { method: "GET", path: "/v1/sweeps/:id" },
+    operationId: "getSweep",
+    cli: ["sweeps", "get"],
+    fields: [{ name: "id", type: "string", required: true, location: "path" }],
+    profiles: SF,
+    run: (rc, i) => getSweep(rc, i)
+  },
+  {
+    name: "generate_sweeps",
+    description: "Generate intercompany-funding recommendations (advisory only).",
+    scope: "treasury:recommend",
+    action: "recommend",
+    mutating: true,
+    http: { method: "POST", path: "/v1/sweeps/generate" },
+    operationId: "generateSweeps",
+    cli: ["sweeps", "generate"],
+    fields: [
+      { name: "base", type: "string", location: "body" },
+      { name: "min_runway_months", type: "number", location: "body" },
+      { name: "healthy_runway_months", type: "number", location: "body" }
+    ],
+    profiles: F,
+    run: (rc, i) => generateSweeps(rc, i)
+  },
+  {
+    name: "update_sweep_status",
+    description: "Acknowledge or dismiss a sweep recommendation (advisory only).",
+    scope: "treasury:recommend",
+    action: "recommend",
+    mutating: true,
+    http: { method: "PATCH", path: "/v1/sweeps/:id" },
+    operationId: "updateSweepStatus",
+    cli: ["sweeps", "update"],
+    fields: [
+      { name: "id", type: "string", required: true, location: "path" },
+      { name: "status", type: "string", required: true, location: "body" }
+    ],
+    profiles: F,
+    run: (rc, i) => updateSweepStatus(rc, i)
+  },
+  {
+    name: "ingest_fixtures",
+    description: "Ingest balances/FX/cost from the v0 fixture adapters for two demo entities.",
+    scope: "treasury:write",
+    action: "write",
+    mutating: true,
+    http: { method: "POST", path: "/v1/ingest" },
+    operationId: "ingestFixtures",
+    cli: ["ingest", "fixtures"],
+    fields: [
+      { name: "us_entity_id", type: "string", required: true, location: "body" },
+      { name: "ro_entity_id", type: "string", required: true, location: "body" }
+    ],
+    profiles: F,
+    run: (rc, i) => {
+      const input = i;
+      return ingestFromAdapters(rc, buildFixtureAdapters(input.us_entity_id, input.ro_entity_id));
+    }
+  }
+];
+function coerceField(field, raw) {
+  if (raw === undefined || raw === null || raw === "")
+    return;
+  switch (field.type) {
+    case "int": {
+      const n = typeof raw === "number" ? raw : Number.parseInt(String(raw), 10);
+      return Number.isFinite(n) ? n : raw;
+    }
+    case "number": {
+      const n = typeof raw === "number" ? raw : Number.parseFloat(String(raw));
+      return Number.isFinite(n) ? n : raw;
+    }
+    case "bool":
+      return raw === true || raw === "true" || raw === "1";
+    default:
+      return String(raw);
+  }
+}
+
+// src/core/errors.ts
+function normalizeError(error) {
+  if (error instanceof Error) {
+    const code = "code" in error && typeof error.code === "string" ? error.code : "INTERNAL_ERROR";
+    const ctor = error.constructor;
+    const suggestion = typeof ctor.suggestion === "string" ? ctor.suggestion : "";
+    return { code, message: error.message, suggestion };
+  }
+  return { code: "UNKNOWN_ERROR", message: String(error), suggestion: "An unexpected error occurred." };
+}
+var STATUS_BY_CODE = {
+  UNAUTHORIZED: 401,
+  PERMISSION_DENIED: 403,
+  ENTITY_NOT_FOUND: 404,
+  SWEEP_NOT_FOUND: 404,
+  VALIDATION_ERROR: 422,
+  INVALID_LIST_QUERY: 400,
+  RATE_LIMITED: 429
+};
+function httpStatusForCode(code) {
+  return STATUS_BY_CODE[code] ?? 500;
+}
+// package.json
+var package_default = {
+  name: "@hasna/treasury",
+  version: "0.1.2",
+  description: "Multi-entity cash/treasury cockpit: consolidated balances, FX exposure, per-entity & group runway, sweep/intercompany-funding recommendations, short-horizon cash forecast. CLI + MCP + serve over a Hasna-contract store.",
+  type: "module",
+  main: "dist/index.js",
+  types: "dist/index.d.ts",
+  bin: {
+    treasury: "dist/cli/index.js",
+    "treasury-mcp": "dist/mcp/index.js",
+    "treasury-serve": "dist/server/index.js"
+  },
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      import: "./dist/index.js"
+    },
+    "./sdk": {
+      types: "./dist/index.d.ts",
+      import: "./dist/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "hasna.contract.json",
+    "openapi.json",
+    "docker-compose.yml",
+    "LICENSE",
+    "README.md"
+  ],
+  scripts: {
+    build: "bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external hono --external pg && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external pg && bun build src/server/index.ts --outdir dist/server --target bun --external hono --external pg && bun build src/index.ts --outdir dist --target bun --external pg && tsc --emitDeclarationOnly --outDir dist",
+    typecheck: "tsc --noEmit",
+    test: "bun test",
+    conformance: "bunx @hasna/contracts@0.4.1 vendor-kit --check && bunx @hasna/contracts@0.4.1 repo-conformance",
+    verify: "bun run typecheck && bun run test && bun run build && bun run conformance",
+    "openapi:generate": "bun run src/cli/index.tsx openapi generate --out openapi.json",
+    "openapi:check": "bun run src/cli/index.tsx openapi check --path openapi.json",
+    "smoke:package": "bun run src/release/package-smoke.ts",
+    "dev:cli": "bun run src/cli/index.tsx",
+    "dev:mcp": "bun run src/mcp/index.ts --http --port 8890",
+    "dev:serve": "bun run src/server/index.ts",
+    postinstall: `node -e "try{const os=require('os'),fs=require('fs'),p=require('path');const b=p.join(os.homedir(),'.hasna','treasury');for(const d of ['','config','data','exports','backups','logs','tmp']) fs.mkdirSync(p.join(b,d),{recursive:true});}catch(e){}"`
+  },
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/hasna/treasury.git"
+  },
+  homepage: "https://github.com/hasna/treasury#readme",
+  bugs: {
+    url: "https://github.com/hasna/treasury/issues"
+  },
+  engines: {
+    bun: ">=1.1.0"
+  },
+  author: "Andrei Hasna <andrei@hasna.com>",
+  license: "Apache-2.0",
+  dependencies: {
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    hono: "^4.6.0",
+    commander: "^13.1.0",
+    ink: "^5.2.0",
+    react: "^18.3.1",
+    chalk: "^5.4.1",
+    zod: "^3.24.2",
+    pg: "^8.13.1"
+  },
+  devDependencies: {
+    "@hasna/contracts": "0.4.1",
+    "@types/pg": "^8.11.10",
+    "@types/bun": "^1.2.4",
+    "@types/react": "^18.3.18",
+    typescript: "^5.7.3",
+    "bun-types": "1.3.14"
+  }
+};
+
+// src/version.ts
+var APP_VERSION = package_default.version;
+
+// src/server/health.ts
+function versionPayload() {
+  return { status: "ok", version: APP_VERSION, mode: resolveStorageMode() };
+}
+function healthPayload() {
+  return { status: "ok", version: APP_VERSION, mode: resolveStorageMode() };
+}
+async function readyPayload() {
+  try {
+    const db = await openDatabase();
+    await db.get("SELECT 1 AS ok");
+    return { ok: true, body: { status: "ready" } };
+  } catch {
+    return { ok: false, body: { status: "unavailable" } };
+  }
+}
+
+// src/server/app.ts
+var rateLimitMap = new Map;
+var RATE_LIMIT_WINDOW = 60000;
+function rateLimitMax() {
+  return Number.parseInt(process.env["HASNA_TREASURY_RATE_LIMIT"] || process.env["TREASURY_RATE_LIMIT"] || "120", 10);
+}
+function checkRateLimit(ip) {
+  const now2 = Date.now();
+  const entry = rateLimitMap.get(ip);
+  if (!entry || now2 > entry.resetAt) {
+    rateLimitMap.set(ip, { count: 1, resetAt: now2 + RATE_LIMIT_WINDOW });
+    return true;
+  }
+  entry.count++;
+  return entry.count <= rateLimitMax();
+}
+function corsOrigins() {
+  const raw = process.env["HASNA_TREASURY_CORS_ORIGINS"] || process.env["TREASURY_CORS_ORIGINS"] || "";
+  return raw.split(",").map((o) => o.trim()).filter(Boolean);
+}
+function getBindHost() {
+  return process.env["HASNA_TREASURY_BIND_HOST"] || process.env["TREASURY_BIND_HOST"] || "127.0.0.1";
+}
+function isLoopback(host = getBindHost()) {
+  return host === "127.0.0.1" || host === "localhost";
+}
+function clientIp(c) {
+  const server = c.env;
+  const peer = server?.requestIP?.(c.req.raw)?.address;
+  if (peer)
+    return peer;
+  const xff = c.req.header("x-forwarded-for");
+  if (xff) {
+    const hops = xff.split(",").map((h) => h.trim()).filter(Boolean);
+    if (hops.length > 0)
+      return `xff:${hops[hops.length - 1]}`;
+  }
+  return "conn";
+}
+function buildInput(op, c, body) {
+  const input = {};
+  for (const f of op.fields) {
+    let raw;
+    if (f.location === "path")
+      raw = c.req.param(f.name);
+    else if (f.location === "query")
+      raw = c.req.query(f.name);
+    else
+      raw = body[f.name];
+    const v = coerceField(f, raw);
+    if (v !== undefined)
+      input[f.name] = v;
+  }
+  return input;
+}
+function honoPath(op) {
+  return op.http.path;
+}
+function createApp() {
+  const app = new Hono;
+  app.use("*", async (c, next) => {
+    const origin = c.req.header("Origin");
+    const allowed = corsOrigins();
+    if (origin && allowed.includes(origin)) {
+      c.header("Access-Control-Allow-Origin", origin);
+      c.header("Vary", "Origin");
+      c.header("Access-Control-Allow-Credentials", "true");
+      c.header("Access-Control-Allow-Headers", "Authorization, Content-Type");
+      c.header("Access-Control-Allow-Methods", "GET, POST, PATCH, DELETE, OPTIONS");
+    }
+    if (c.req.method === "OPTIONS")
+      return c.body(null, 204);
+    const ip = clientIp(c);
+    if (!checkRateLimit(ip)) {
+      return c.json({ code: "RATE_LIMITED", message: "Too many requests", suggestion: "Slow down and retry." }, 429);
+    }
+    await next();
+  });
+  app.get("/health", (c) => c.json(healthPayload()));
+  app.get("/version", (c) => c.json(versionPayload()));
+  app.get("/ready", async (c) => {
+    const { ok, body } = await readyPayload();
+    return c.json(body, ok ? 200 : 503);
+  });
+  for (const op of OPS) {
+    const handler = async (c) => {
+      const authConfigured = isApiAuthConfigured();
+      let principal = null;
+      if (authConfigured) {
+        principal = authenticateApiRequest(c.req.raw);
+        if (!principal) {
+          return c.json({ code: "UNAUTHORIZED", message: "Invalid or missing API credential.", suggestion: "Provide a valid Bearer token." }, 401);
+        }
+      }
+      let body = {};
+      if (op.http.method === "POST" || op.http.method === "PATCH") {
+        try {
+          body = await c.req.json();
+        } catch {
+          body = {};
+        }
+      }
+      try {
+        const db = await openDatabase();
+        const rc = principal ? contextFromPrincipal(db, principal) : localOwnerContext(db);
+        const result = await op.run(rc, buildInput(op, c, body));
+        return c.json(result);
+      } catch (error) {
+        const env = normalizeError(error);
+        return c.json(env, httpStatusForCode(env.code));
+      }
+    };
+    const path = honoPath(op);
+    if (op.http.method === "GET")
+      app.get(path, handler);
+    else if (op.http.method === "POST")
+      app.post(path, handler);
+    else if (op.http.method === "PATCH")
+      app.patch(path, handler);
+    else if (op.http.method === "DELETE")
+      app.delete(path, handler);
+  }
+  app.notFound((c) => c.json({ code: "NOT_FOUND", message: `No route: ${c.req.method} ${c.req.path}`, suggestion: "Check the API path." }, 404));
+  return app;
+}
+
+// src/server/index.ts
+function getPort() {
+  return Number.parseInt(process.env["HASNA_TREASURY_PORT"] || process.env["TREASURY_PORT"] || "3486", 10);
+}
+function assertServeSafety() {
+  const host = getBindHost();
+  const mode = resolveStorageMode();
+  const openOk = isLoopback(host) && mode === "local";
+  if (!openOk && !isApiAuthConfigured()) {
+    throw new Error(`Refusing to start: bind=${host} mode=${mode} requires API credentials. ` + `Set HASNA_TREASURY_API_CREDENTIALS (or HASNA_TREASURY_API_KEY). ` + `Unauthenticated /v1 is only allowed on 127.0.0.1 in local mode.`);
+  }
+}
+function startServer() {
+  assertServeSafety();
+  const app = createApp();
+  const port = getPort();
+  const hostname = getBindHost();
+  const server = Bun.serve({ port, hostname, fetch: app.fetch });
+  console.log(`treasury-serve v${APP_VERSION} on http://${hostname}:${port} (mode=${resolveStorageMode()})`);
+  console.log(`API auth ${isApiAuthConfigured() ? "enabled" : "disabled (loopback+local dev only)"}`);
+  return server;
+}
+if (import.meta.main) {
+  startServer();
+}
+export {
+  startServer,
+  getPort,
+  assertServeSafety
+};