@bbookmind/mcp 1.0.0

package/src/lib/db.ts

@@ -0,0 +1,212 @@
+import initSqlJs, { Database } from "sql.js";
+import { resolve } from "path";
+import { fileURLToPath } from "url";
+import { dirname } from "path";
+import { promises as fs } from "fs";
+import { activeCompanyId } from "../types.js";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const DATA_DIR = resolve(__dirname, "..", "..", "data");
+
+let sqlJs: any = null;
+let dbInstances: Record<string, Database> = {};
+
+function dbPath(companyId: string): string {
+  return resolve(DATA_DIR, `bookmind-${companyId}.sqlite`);
+}
+
+export async function getDb(): Promise<Database> {
+  const cid = activeCompanyId.current || "default";
+  if (dbInstances[cid]) return dbInstances[cid];
+
+  if (!sqlJs) {
+    sqlJs = await initSqlJs({ locateFile: () => "sql-wasm.wasm" });
+  }
+
+  const path = dbPath(cid);
+  try {
+    const data = await fs.readFile(path);
+    const uint8Array = new Uint8Array(data);
+    dbInstances[cid] = new sqlJs.Database(uint8Array);
+  } catch {
+    dbInstances[cid] = new sqlJs.Database();
+  }
+  dbInstances[cid].exec("PRAGMA journal_mode=WAL;");
+  dbInstances[cid].exec("PRAGMA synchronous=NORMAL;");
+  initSchema(dbInstances[cid]);
+  await saveDb();
+  return dbInstances[cid];
+}
+
+export function getCurrentCompanyId(): string {
+  return activeCompanyId.current || "default";
+}
+
+function initSchema(db: Database) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS companies (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      realm_id TEXT,
+      created_at TEXT DEFAULT (datetime('now'))
+    );
+
+    CREATE TABLE IF NOT EXISTS qbo_tokens (
+      id TEXT PRIMARY KEY,
+      company_id TEXT NOT NULL,
+      access_token TEXT NOT NULL,
+      refresh_token TEXT NOT NULL,
+      realm_id TEXT NOT NULL,
+      expires_at INTEGER NOT NULL,
+      token_type TEXT,
+      updated_at TEXT DEFAULT (datetime('now'))
+    );
+
+    CREATE TABLE IF NOT EXISTS transactions (
+      id TEXT PRIMARY KEY,
+      company_id TEXT DEFAULT 'default',
+      qbo_id TEXT,
+      date TEXT NOT NULL,
+      amount REAL NOT NULL,
+      description TEXT,
+      vendor TEXT,
+      account_id TEXT,
+      category TEXT,
+      confidence REAL,
+      status TEXT DEFAULT 'uncategorized',
+      approved INTEGER DEFAULT 0,
+      created_at TEXT DEFAULT (datetime('now')),
+      updated_at TEXT DEFAULT (datetime('now'))
+    );
+
+    CREATE TABLE IF NOT EXISTS categorization_rules (
+      id TEXT PRIMARY KEY,
+      company_id TEXT DEFAULT 'default',
+      vendor_pattern TEXT,
+      description_pattern TEXT,
+      category TEXT NOT NULL,
+      account_id TEXT,
+      confidence REAL DEFAULT 0.9,
+      priority INTEGER DEFAULT 0,
+      uses INTEGER DEFAULT 0,
+      overrides INTEGER DEFAULT 0,
+      last_applied TEXT,
+      created_at TEXT DEFAULT (datetime('now')),
+      updated_at TEXT DEFAULT (datetime('now'))
+    );
+
+    CREATE TABLE IF NOT EXISTS anomalies (
+      id TEXT PRIMARY KEY,
+      company_id TEXT DEFAULT 'default',
+      type TEXT NOT NULL,
+      severity TEXT NOT NULL,
+      description TEXT,
+      transaction_id TEXT,
+      vendor TEXT,
+      amount REAL,
+      detected_at TEXT DEFAULT (datetime('now')),
+      acknowledged INTEGER DEFAULT 0
+    );
+
+    CREATE TABLE IF NOT EXISTS invoices (
+      id TEXT PRIMARY KEY,
+      company_id TEXT DEFAULT 'default',
+      qbo_id TEXT UNIQUE,
+      customer_id TEXT,
+      customer_name TEXT,
+      customer_email TEXT,
+      amount REAL,
+      due_date TEXT,
+      status TEXT,
+      invoice_number TEXT,
+      balance REAL,
+      created_at TEXT DEFAULT (datetime('now'))
+    );
+
+    CREATE TABLE IF NOT EXISTS bills (
+      id TEXT PRIMARY KEY,
+      company_id TEXT DEFAULT 'default',
+      qbo_id TEXT UNIQUE,
+      vendor_id TEXT,
+      vendor_name TEXT,
+      amount REAL,
+      due_date TEXT,
+      status TEXT,
+      created_at TEXT DEFAULT (datetime('now'))
+    );
+
+    CREATE TABLE IF NOT EXISTS audit_log (
+      id TEXT PRIMARY KEY,
+      company_id TEXT DEFAULT 'default',
+      entity_type TEXT NOT NULL,
+      entity_id TEXT NOT NULL,
+      field TEXT NOT NULL,
+      old_value TEXT,
+      new_value TEXT,
+      source TEXT,
+      created_at TEXT DEFAULT (datetime('now'))
+    );
+
+    CREATE TABLE IF NOT EXISTS license_keys (
+      id TEXT PRIMARY KEY,
+      key_hash TEXT UNIQUE NOT NULL,
+      tier TEXT NOT NULL,
+      email TEXT,
+      created_at TEXT DEFAULT (datetime('now')),
+      expires_at TEXT,
+      active INTEGER DEFAULT 1
+    );
+
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_companies_name ON companies(name);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_qbo_tokens_company ON qbo_tokens(company_id);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_transactions_qbo ON transactions(company_id, qbo_id);
+    CREATE INDEX IF NOT EXISTS idx_transactions_date ON transactions(company_id, date);
+    CREATE INDEX IF NOT EXISTS idx_transactions_vendor ON transactions(company_id, vendor);
+    CREATE INDEX IF NOT EXISTS idx_transactions_status ON transactions(company_id, status);
+    CREATE INDEX IF NOT EXISTS idx_transactions_category ON transactions(company_id, category);
+    CREATE INDEX IF NOT EXISTS idx_transactions_approved ON transactions(company_id, approved);
+    CREATE INDEX IF NOT EXISTS idx_rules_company ON categorization_rules(company_id);
+    CREATE INDEX IF NOT EXISTS idx_rules_vendor ON categorization_rules(vendor_pattern);
+    CREATE INDEX IF NOT EXISTS idx_rules_priority ON categorization_rules(priority);
+    CREATE INDEX IF NOT EXISTS idx_anomalies_type ON anomalies(company_id, type);
+    CREATE INDEX IF NOT EXISTS idx_anomalies_severity ON anomalies(company_id, severity);
+    CREATE INDEX IF NOT EXISTS idx_invoices_company ON invoices(company_id);
+    CREATE INDEX IF NOT EXISTS idx_bills_company ON bills(company_id);
+    CREATE INDEX IF NOT EXISTS idx_audit_log_entity ON audit_log(company_id, entity_type, entity_id);
+    CREATE INDEX IF NOT EXISTS idx_audit_log_created ON audit_log(created_at);
+  `);
+}
+
+export async function saveDb(): Promise<void> {
+  const cid = activeCompanyId.current || "default";
+  if (dbInstances[cid] && sqlJs) {
+    const data = dbInstances[cid].export();
+    const dir = DATA_DIR;
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(dbPath(cid), Buffer.from(data));
+  }
+}
+
+export function auditChange(db: Database, entityType: string, entityId: string, field: string, oldValue: string | null, newValue: string, source: string) {
+  const cid = activeCompanyId.current || "default";
+  const id = crypto.randomUUID();
+  db.exec(`INSERT INTO audit_log (id, company_id, entity_type, entity_id, field, old_value, new_value, source) VALUES ('${id}', '${cid}', '${entityType}', '${entityId}', '${field}', ${oldValue !== null ? `'${oldValue.replace(/'/g, "''")}'` : "NULL"}, '${newValue.replace(/'/g, "''")}', '${source}')`);
+}
+
+setInterval(async () => { await saveDb(); }, 30000);
+
+process.on("SIGINT", async () => {
+  for (const [, db] of Object.entries(dbInstances)) {
+    const data = db.export();
+    try { await fs.writeFile(dbPath(""), Buffer.from(data)); } catch {}
+  }
+  process.exit(0);
+});
+process.on("SIGTERM", async () => {
+  for (const [, db] of Object.entries(dbInstances)) {
+    const data = db.export();
+    try { await fs.writeFile(dbPath(""), Buffer.from(data)); } catch {}
+  }
+  process.exit(0);
+});

package/src/lib/llm.ts

@@ -0,0 +1,140 @@
+import axios from "axios";
+
+export interface LLMConfig {
+  provider: "groq" | "nvidia" | "google" | "mistral" | "openai" | "anthropic" | "ollama";
+  baseUrl?: string;
+  apiKey?: string;
+  model: string;
+}
+
+const PROVIDERS: Record<string, { key: string; url: string; model: string }> = {
+  groq: { key: "GROQ_API_KEY", url: "https://api.groq.com/openai/v1", model: "llama-3.3-70b-versatile" },
+  nvidia: { key: "NVIDIA_API_KEY", url: "https://integrate.api.nvidia.com/v1", model: "meta/llama-3.1-70b-instruct" },
+  google: { key: "GOOGLE_API_KEY", url: "https://generativelanguage.googleapis.com/v1beta", model: "gemini-1.5-flash" },
+  mistral: { key: "MISTRAL_API_KEY", url: "https://api.mistral.ai/v1", model: "mistral-small-latest" },
+  openai: { key: "OPENAI_API_KEY", url: "https://api.openai.com/v1", model: "gpt-4o-mini" },
+  anthropic: { key: "ANTHROPIC_API_KEY", url: "https://api.anthropic.com/v1", model: "claude-3-5-sonnet-20241022" },
+  ollama: { key: "", url: "http://localhost:11434", model: "llama3.2" },
+};
+
+let activeProvider: LLMConfig | null = null;
+
+function detectProvider(): LLMConfig | null {
+  for (const [name, cfg] of Object.entries(PROVIDERS)) {
+    if (cfg.key && process.env[cfg.key]) {
+      return {
+        provider: name as any,
+        baseUrl: process.env[`${cfg.key.replace("_API_KEY", "_BASE_URL")}`] || cfg.url,
+        apiKey: process.env[cfg.key],
+        model: process.env[`${cfg.key.replace("_API_KEY", "_MODEL")}`] || cfg.model,
+      };
+    }
+  }
+  if (process.env.OLLAMA_BASE_URL) {
+    return {
+      provider: "ollama",
+      baseUrl: process.env.OLLAMA_BASE_URL,
+      model: process.env.OLLAMA_MODEL || PROVIDERS.ollama.model,
+    };
+  }
+  return null;
+}
+
+export function getProvider(): LLMConfig | null {
+  if (!activeProvider) activeProvider = detectProvider();
+  return activeProvider;
+}
+
+export function isLLMEnabled(): boolean {
+  return getProvider() !== null;
+}
+
+export async function callLLM(prompt: string, systemPrompt?: string): Promise<string> {
+  const cfg = getProvider();
+  if (!cfg) throw new Error("No AI provider configured");
+
+  const messages = [
+    ...(systemPrompt ? [{ role: "system", content: systemPrompt }] : []),
+    { role: "user", content: prompt },
+  ];
+
+  try {
+    if (cfg.provider === "anthropic") {
+      const res = await axios.post(
+        `${cfg.baseUrl}/messages`,
+        {
+          model: cfg.model,
+          messages: messages.filter((m) => m.role !== "system"),
+          system: systemPrompt,
+          max_tokens: 2000,
+          temperature: 0.1,
+        },
+        {
+          headers: {
+            "x-api-key": cfg.apiKey!,
+            "anthropic-version": "2023-06-01",
+            "Content-Type": "application/json",
+          },
+        }
+      );
+      return res.data.content?.[0]?.text || "";
+    }
+
+    if (cfg.provider === "google") {
+      const res = await axios.post(
+        `${cfg.baseUrl}/models/${cfg.model}:generateContent?key=${cfg.apiKey}`,
+        {
+          contents: messages.map((m) => ({ role: m.role === "system" ? "user" : m.role, parts: [{ text: m.content }] })),
+          generationConfig: { temperature: 0.1, maxOutputTokens: 2000 },
+        }
+      );
+      return res.data.candidates?.[0]?.content?.parts?.[0]?.text || "";
+    }
+
+    const res = await axios.post(
+      `${cfg.baseUrl}/chat/completions`,
+      {
+        model: cfg.model,
+        messages,
+        temperature: 0.1,
+        max_tokens: 2000,
+      },
+      {
+        headers: {
+          Authorization: `Bearer ${cfg.apiKey}`,
+          "Content-Type": "application/json",
+        },
+      }
+    );
+    return res.data.choices?.[0]?.message?.content || "";
+  } catch (error) {
+    console.error("LLM call failed:", error);
+    throw error;
+  }
+}
+
+export async function categorizeTransaction(
+  description: string,
+  vendor: string,
+  amount: number,
+  knownCategories: string[]
+): Promise<{ category: string; confidence: number }> {
+  const cfg = getProvider();
+  if (!cfg) return { category: "Uncategorized Expenses", confidence: 0.3 };
+
+  const prompt = `Categorize this transaction:
+Description: "${description}"
+Vendor: "${vendor}"
+Amount: $${amount}
+
+Available categories: ${knownCategories.join(", ")}
+
+Return JSON: {"category": "...", "confidence": 0.0-1.0}`;
+
+  const result = await callLLM(prompt, "You are an expert bookkeeper. Categorize accurately.");
+  try {
+    return JSON.parse(result);
+  } catch {
+    return { category: "Uncategorized Expenses", confidence: 0.3 };
+  }
+}

package/src/lib/qbo.ts

@@ -0,0 +1,187 @@
+import axios from "axios";
+import { resolve } from "path";
+import { fileURLToPath } from "url";
+import { dirname } from "path";
+import { promises as fs } from "fs";
+import { getDb } from "./db.js";
+import { activeCompanyId } from "../types.js";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const TOKEN_DIR = resolve(__dirname, "..", "..", "data");
+
+export interface QBOAuthTokens {
+  access_token: string;
+  refresh_token: string;
+  realm_id: string;
+  expires_at: number;
+  token_type: string;
+}
+
+function escapeQuery(value: string): string {
+  return value.replace(/'/g, "\\'");
+}
+
+export class QBOClient {
+  private tokens: QBOAuthTokens | null = null;
+  private clientId: string;
+  private clientSecret: string;
+  private redirectUri: string;
+  private environment: "sandbox" | "production";
+  private baseUrl: string;
+
+  constructor() {
+    this.clientId = process.env.QBO_CLIENT_ID || "";
+    this.clientSecret = process.env.QBO_CLIENT_SECRET || "";
+    this.redirectUri = process.env.QBO_REDIRECT_URI || "http://localhost:3000/callback";
+    this.environment = (process.env.QBO_ENVIRONMENT as "sandbox" | "production") || "sandbox";
+    this.baseUrl = this.environment === "sandbox"
+      ? "https://sandbox-quickbooks.api.intuit.com"
+      : "https://quickbooks.api.intuit.com";
+    this.loadTokens();
+  }
+
+  private tokenFilePath(): string {
+    const cid = activeCompanyId.current || "default";
+    return resolve(TOKEN_DIR, `qbo_tokens_${cid}.json`);
+  }
+
+  private async loadTokens() {
+    try {
+      const data = await fs.readFile(this.tokenFilePath(), "utf-8");
+      this.tokens = JSON.parse(data);
+    } catch {}
+  }
+
+  private async saveTokens() {
+    await fs.mkdir(TOKEN_DIR, { recursive: true });
+    await fs.writeFile(this.tokenFilePath(), JSON.stringify(this.tokens, null, 2));
+  }
+
+  getAuthUrl(): string {
+    const scopes = ["com.intuit.quickbooks.accounting"].join(" ");
+    const params = new URLSearchParams({
+      client_id: this.clientId,
+      redirect_uri: this.redirectUri,
+      scope: scopes,
+      response_type: "code",
+      access_type: "offline",
+      state: "bookmind-" + (activeCompanyId.current || "default"),
+    });
+    return `https://appcenter.intuit.com/connect/oauth2?${params.toString()}`;
+  }
+
+  async handleCallback(code: string): Promise<QBOAuthTokens> {
+    const res = await axios.post("https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer",
+      new URLSearchParams({ grant_type: "authorization_code", code, redirect_uri: this.redirectUri }),
+      { headers: { "Content-Type": "application/x-www-form-urlencoded", Authorization: `Basic ${Buffer.from(`${this.clientId}:${this.clientSecret}`).toString("base64")}` } }
+    );
+    this.tokens = {
+      access_token: res.data.access_token,
+      refresh_token: res.data.refresh_token,
+      realm_id: res.data.realmId,
+      expires_at: Date.now() + res.data.expires_in * 1000,
+      token_type: res.data.token_type,
+    };
+    await this.saveTokens();
+    const db = await getDb();
+    const rows = db.exec(`SELECT 1 FROM companies WHERE id='${activeCompanyId.current || "default"}'`);
+    if (!rows.length) {
+      db.exec(`INSERT INTO companies (id, name, realm_id) VALUES ('${activeCompanyId.current || "default"}', '${activeCompanyId.current || "Default"}', '${this.tokens.realm_id}')`);
+    } else {
+      db.run(`UPDATE companies SET realm_id=? WHERE id=?`, [this.tokens.realm_id, activeCompanyId.current || "default"] as any);
+    }
+    return this.tokens;
+  }
+
+  async refreshAccessToken(): Promise<string> {
+    if (!this.tokens?.refresh_token) throw new Error("QBO_NOT_AUTHENTICATED");
+    const res = await axios.post("https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer",
+      new URLSearchParams({ grant_type: "refresh_token", refresh_token: this.tokens.refresh_token }),
+      { headers: { "Content-Type": "application/x-www-form-urlencoded", Authorization: `Basic ${Buffer.from(`${this.clientId}:${this.clientSecret}`).toString("base64")}` } }
+    );
+    this.tokens = {
+      ...this.tokens!,
+      access_token: res.data.access_token,
+      refresh_token: res.data.refresh_token || this.tokens!.refresh_token,
+      expires_at: Date.now() + res.data.expires_in * 1000,
+    };
+    await this.saveTokens();
+    return this.tokens.access_token;
+  }
+
+  private async getValidToken(): Promise<string> {
+    if (!this.tokens) throw new Error("QBO_NOT_AUTHENTICATED");
+    if (Date.now() >= this.tokens.expires_at - 300000) {
+      return this.refreshAccessToken();
+    }
+    return this.tokens.access_token;
+  }
+
+  isAuthenticated(): boolean {
+    return this.tokens !== null;
+  }
+
+  private async request<T>(method: string, endpoint: string, data?: any, attempt = 0): Promise<T> {
+    const token = await this.getValidToken();
+    const url = `${this.baseUrl}/v3/company/${this.tokens!.realm_id}${endpoint}`;
+    try {
+      const response = await axios.request<T>({
+        method, url, data,
+        headers: { Authorization: `Bearer ${token}`, Accept: "application/json", "Content-Type": "application/json" },
+      });
+      return response.data;
+    } catch (error: any) {
+      if (error.response?.status === 429 && attempt < 3) {
+        const delay = Math.pow(2, attempt) * 1000;
+        await new Promise((r) => setTimeout(r, delay));
+        return this.request<T>(method, endpoint, data, attempt + 1);
+      }
+      if (error.response?.status === 401 && attempt < 1) {
+        await this.refreshAccessToken();
+        return this.request<T>(method, endpoint, data, attempt + 1);
+      }
+      throw error;
+    }
+  }
+
+  async getTransactions(startDate: string, endDate: string, maxResults = 500) {
+    const sd = escapeQuery(startDate);
+    const ed = escapeQuery(endDate);
+    const query = `SELECT * FROM Transaction WHERE TxnDate >= '${sd}' AND TxnDate <= '${ed}' ORDER BY TxnDate MAXRESULTS ${maxResults}`;
+    return this.request("POST", "/query", { query });
+  }
+
+  async getInvoices(status?: string) {
+    const query = status ? `SELECT * FROM Invoice WHERE DocStatus = '${escapeQuery(status)}'` : "SELECT * FROM Invoice";
+    return this.request("POST", "/query", { query });
+  }
+
+  async getBills(status?: string) {
+    const query = status ? `SELECT * FROM Bill WHERE DocStatus = '${escapeQuery(status)}'` : "SELECT * FROM Bill";
+    return this.request("POST", "/query", { query });
+  }
+
+  async getAccounts() {
+    return this.request("POST", "/query", { query: "SELECT * FROM Account" });
+  }
+
+  async getVendors() {
+    return this.request("POST", "/query", { query: "SELECT * FROM Vendor" });
+  }
+
+  async getCustomers() {
+    return this.request("POST", "/query", { query: "SELECT * FROM Customer" });
+  }
+
+  async updateTransaction(transactionId: string, sparse: Record<string, any>) {
+    const body = { sparse, Id: transactionId, SyncToken: "0" };
+    return this.request("POST", "/transaction", body);
+  }
+
+  async createJournalEntry(entry: any) {
+    return this.request("POST", "/journalentry", entry);
+  }
+}
+
+export const qboClient = new QBOClient();

package/src/tools/anomalies.ts

@@ -0,0 +1,144 @@
+import { ToolDefinition } from "../types.js";
+import { Database } from "sql.js";
+import { getCurrentCompanyId } from "../lib/db.js";
+
+export const anomaliesTool: ToolDefinition = {
+  name: "bookmind.anomalies",
+  description:
+    "Statistical anomaly detection: duplicate payments (Map-based O(n)), vendor cost drift (>25%), IQR outliers, frequency spikes (>10/mo), round numbers (>=$100), large weekend transactions (>=$500). Returns flagged items with severity. Persists to SQLite for review.",
+  schema: {
+    type: "object",
+    properties: {
+      transactions: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: { id: { type: "string" }, date: { type: "string" }, amount: { type: "number" }, description: { type: "string" }, vendor: { type: "string" }, category: { type: "string" } },
+          required: ["id", "date", "amount", "vendor"],
+        },
+      },
+      lookback_days: { type: "number", default: 90 },
+      min_amount: { type: "number", default: 10 },
+      rules: {
+        type: "array",
+        items: { type: "string", enum: ["duplicates", "vendor_drift", "unusual_amount", "frequency", "round_numbers", "weekend"] },
+        default: ["duplicates", "vendor_drift", "unusual_amount", "frequency", "round_numbers", "weekend"],
+      },
+    },
+    required: ["transactions"],
+  },
+  handler: async (args, db: Database) => {
+    const coId = getCurrentCompanyId();
+    const { transactions, lookback_days = 90, min_amount = 10, rules = ["duplicates", "vendor_drift", "unusual_amount", "frequency", "round_numbers", "weekend"] } = args as any;
+    const since = new Date(Date.now() - lookback_days * 24 * 60 * 60 * 1000).toISOString().split("T")[0];
+    const historical = transactions.filter((t: any) => new Date(t.date) >= new Date(since));
+
+    const anomalies: any[] = [];
+
+    if (rules.includes("duplicates")) {
+      const groups = new Map<string, any[]>();
+      for (const t of historical) {
+        const key = `${t.vendor.toLowerCase()}|${Math.round(t.amount * 100)}`;
+        const g = groups.get(key) || [];
+        g.push(t);
+        groups.set(key, g);
+      }
+      for (const [, group] of groups) {
+        if (group.length < 2) continue;
+        for (let i = 0; i < group.length; i++) {
+          for (let j = i + 1; j < group.length; j++) {
+            const a = group[i], b = group[j];
+            const daysDiff = Math.abs(new Date(a.date).getTime() - new Date(b.date).getTime()) / (1000 * 60 * 60 * 24);
+            if (daysDiff <= 7) {
+              anomalies.push({
+                id: `dup-${a.id}-${b.id}`,
+                type: "duplicate_payment",
+                severity: "high",
+                description: `Duplicate payment to ${a.vendor}: $${a.amount} on ${a.date} and ${b.date} (${daysDiff.toFixed(1)} days apart)`,
+                transaction_ids: [a.id, b.id], vendor: a.vendor, amount: a.amount,
+              });
+            }
+          }
+        }
+      }
+    }
+
+    if (rules.includes("vendor_drift")) {
+      const vendorStats: Record<string, { amounts: number[]; count: number }> = {};
+      for (const t of historical) {
+        if (!vendorStats[t.vendor]) vendorStats[t.vendor] = { amounts: [], count: 0 };
+        vendorStats[t.vendor].amounts.push(Math.abs(t.amount));
+        vendorStats[t.vendor].count++;
+      }
+      for (const [vendor, stats] of Object.entries(vendorStats)) {
+        if (stats.count < 3) continue;
+        const avg = stats.amounts.reduce((a: number, b: number) => a + b, 0) / stats.amounts.length;
+        for (const t of historical) {
+          if (t.vendor === vendor && Math.abs(t.amount) > avg * 1.25) {
+            anomalies.push({
+              id: `drift-${vendor}-${t.id}`, type: "vendor_cost_drift", severity: "medium",
+              description: `${vendor} charge $${t.amount} is ${((Math.abs(t.amount) - avg) / avg * 100).toFixed(1)}% above avg of $${avg.toFixed(2)}`,
+              transaction_id: t.id, vendor, amount: t.amount, average: avg,
+              increase_pct: ((Math.abs(t.amount) - avg) / avg * 100).toFixed(1), date: t.date,
+            });
+          }
+        }
+      }
+    }
+
+    if (rules.includes("unusual_amount")) {
+      const amts = historical.map((t: any) => Math.abs(t.amount)).sort((a: number, b: number) => a - b);
+      if (amts.length >= 4) {
+        const q1 = amts[Math.floor(amts.length * 0.25)];
+        const q3 = amts[Math.floor(amts.length * 0.75)];
+        const iqr = q3 - q1;
+        const upper = q3 + 1.5 * iqr;
+        for (const t of historical) {
+          if (Math.abs(t.amount) > upper) {
+            anomalies.push({
+              id: `outlier-${t.id}`, type: "unusual_amount", severity: "medium",
+              description: `$${t.amount} to ${t.vendor || t.description} exceeds fence ($${upper.toFixed(2)})`,
+              transaction_id: t.id, amount: t.amount, threshold: upper,
+            });
+          }
+        }
+      }
+    }
+
+    if (rules.includes("frequency")) {
+      const thisMonth = new Date().toISOString().slice(0, 7);
+      const counts: Record<string, number> = {};
+      for (const t of historical) { if (t.date.startsWith(thisMonth)) counts[t.vendor] = (counts[t.vendor] || 0) + 1; }
+      for (const [v, c] of Object.entries(counts)) {
+        if (c > 10) anomalies.push({ id: `freq-${v}-${thisMonth}`, type: "high_frequency", severity: "low", description: `${v} paid ${c} times this month`, vendor: v, count: c, month: thisMonth });
+      }
+    }
+
+    if (rules.includes("round_numbers")) {
+      for (const t of historical) {
+        const a = Math.abs(t.amount);
+        if (a >= 100 && a % 100 === 0) anomalies.push({ id: `round-${t.id}`, type: "round_number", severity: "low", description: `Round amount $${t.amount} to ${t.vendor || t.description}`, transaction_id: t.id, amount: t.amount });
+      }
+    }
+
+    if (rules.includes("weekend")) {
+      for (const t of historical) {
+        const day = new Date(t.date).getDay();
+        if ((day === 0 || day === 6) && Math.abs(t.amount) > 500) anomalies.push({ id: `weekend-${t.id}`, type: "weekend_transaction", severity: "low", description: `Weekend $${t.amount} to ${t.vendor || t.description}`, transaction_id: t.id, amount: t.amount, day: day === 0 ? "Sunday" : "Saturday" });
+      }
+    }
+
+    for (const a of anomalies) {
+      const txnId = a.transaction_id || (a.transaction_ids?.[0] || "");
+      const rows = db.exec(`SELECT 1 FROM anomalies WHERE company_id='${coId}' AND transaction_id=? AND type=?`);
+      const existing = rows.filter((r: any) => r.values?.length);
+      if (!existing.length) {
+        db.exec(`INSERT INTO anomalies (id, company_id, transaction_id, type, severity, description, vendor, amount) VALUES ('${a.id.replace(/'/g, "''")}', '${coId}', '${(txnId || "").replace(/'/g, "''")}', '${(a.type || "").replace(/'/g, "''")}', '${(a.severity || "low").replace(/'/g, "''")}', '${(a.description || "").replace(/'/g, "''")}', ${a.vendor ? `'${String(a.vendor).replace(/'/g, "''")}'` : "NULL"}, ${a.amount || "NULL"})`);
+      }
+    }
+
+    const bySev: Record<string, number> = {};
+    for (const a of anomalies) bySev[a.severity] = (bySev[a.severity] || 0) + 1;
+    return `Scan complete (${historical.length} txns, ${lookback_days}d). ${anomalies.length} anomalies: ${Object.entries(bySev).map(([k, v]) => `${v} ${k}`).join(", ")}.\n\n${JSON.stringify(anomalies, null, 2)}`;
+  },
+};