@casys/mcp-erpnext 3.1.0-beta.2 → 3.1.0-beta.4

package/README.md

@@ -10,9 +10,9 @@ English | [繁體中文](README.zh-TW.md)
 
 > [!IMPORTANT]
 > **Installing the 3.1 beta:** pin the prerelease while this UX is being
-> validated. For npm/Node use `npx -y @casys/mcp-erpnext@3.1.0-beta.2`; for Deno
-> use `deno run -A jsr:@casys/mcp-erpnext@3.1.0-beta.2/server`. The moving npm
-> alias is `@next`. Beta 2 adds the generic document viewer and attachment
+> validated. For npm/Node use `npx -y @casys/mcp-erpnext@3.1.0-beta.3`; for Deno
+> use `deno run -A jsr:@casys/mcp-erpnext@3.1.0-beta.3/server`. The moving npm
+> alias is `@next`. The beta adds the generic document viewer and attachment
 > workflows, so test it with the MCP host your users actually run before
 > replacing a stable deployment.
 
@@ -80,7 +80,7 @@ See the [CHANGELOG](CHANGELOG.md) for the full release history, or the
 [latest release](https://github.com/Casys-AI/mcp-erpnext/releases/latest) for
 the current version's highlights.
 
-> **3.1 beta 2 preview:** the beta keeps the 3.0 tool surface and adds a generic
+> **3.1 beta preview:** the beta keeps the 3.0 tool surface and adds a generic
 > document viewer, child tables, document attachments, in-view navigation, and
 > active context. Features remain capability-gated by the MCP host. In
 > particular, downloads require both proxied server tools and the MCP Apps
@@ -235,7 +235,7 @@ tool is never replayed automatically. Overlapping or stale responses are ignored
 when a newer host payload or mutation has already won. A confirmed document
 change marks every potentially derived snapshot in the current navigation stack
 as stale; each marker is removed only when that surface has actually been read
-again. Separate MCP Apps are not synchronized automatically in beta 2.
+again. Separate MCP Apps are not synchronized automatically in the 3.1 beta.
 
 ### Building UI viewers
 

package/mcp-erpnext.mjs

@@ -37013,6 +37013,8 @@ var bufferToFormData = (arrayBuffer, contentType) => {
 };
 
 // node_modules/hono/dist/utils/body.js
+var MAX_NESTING_DEPTH = 32;
+var MAX_NESTED_OBJECTS = 1e4;
 var isRawRequest = (request) => "headers" in request;
 var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
@@ -37045,6 +37047,7 @@ async function parseFormData(request, options) {
 }
 function convertFormDataToBodyData(formData, options) {
   const form = /* @__PURE__ */ Object.create(null);
+  const nestingState = { count: 0 };
   formData.forEach((value, key) => {
     const shouldParseAllValues = options.all || key.endsWith("[]");
     if (!shouldParseAllValues) {
@@ -37057,7 +37060,7 @@ function convertFormDataToBodyData(formData, options) {
     Object.entries(form).forEach(([key, value]) => {
       const shouldParseDotValues = key.includes(".");
       if (shouldParseDotValues) {
-        handleParsingNestedValues(form, key, value);
+        handleParsingNestedValues(form, key, value, nestingState);
         delete form[key];
       }
     });
@@ -37080,23 +37083,32 @@ var handleParsingAllValues = (form, key, value) => {
     }
   }
 };
-var handleParsingNestedValues = (form, key, value) => {
+var handleParsingNestedValues = (form, key, value, state) => {
   if (/(?:^|\.)__proto__\./.test(key)) {
     return;
   }
   let nestedForm = form;
-  const keys = key.split(".");
+  const keys = key.split(".", MAX_NESTING_DEPTH + 2);
+  if (keys.length > MAX_NESTING_DEPTH + 1) {
+    throwNestingLimitExceeded();
+  }
   keys.forEach((key2, index) => {
     if (index === keys.length - 1) {
       nestedForm[key2] = value;
     } else {
       if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        if (state.count++ >= MAX_NESTED_OBJECTS) {
+          throwNestingLimitExceeded();
+        }
         nestedForm[key2] = /* @__PURE__ */ Object.create(null);
       }
       nestedForm = nestedForm[key2];
     }
   });
 };
+var throwNestingLimitExceeded = () => {
+  throw new Error("Nesting limit exceeded");
+};
 
 // node_modules/hono/dist/utils/url.js
 var splitPath = (path) => {
@@ -37228,6 +37240,10 @@ var _decodeURI = (value) => {
   return tryDecodeURIComponent(value);
 };
 var _getQueryParam = (url2, key, multiple) => {
+  const hashIndex = url2.indexOf("#", 8);
+  if (hashIndex !== -1) {
+    url2 = url2.slice(0, hashIndex);
+  }
   let encoded;
   if (!multiple && key && key.indexOf("%") === -1 && key.indexOf("+") === -1) {
     let keyIndex2 = url2.indexOf("?", 8);
@@ -56452,8 +56468,8 @@ var DOCTYPE_SEND_MESSAGE_HINTS = {
   ],
   "Sales Order": [
     {
-      key: "invoice",
-      label: "Invoice",
+      key: "invoices",
+      label: "Invoices",
       message: "Show invoices linked to sales order {id}",
       tool: "erpnext_doc_list",
       args: {
@@ -56464,8 +56480,8 @@ var DOCTYPE_SEND_MESSAGE_HINTS = {
       }
     },
     {
-      key: "delivery",
-      label: "Delivery",
+      key: "deliveries",
+      label: "Delivery notes",
       message: "Show delivery notes for sales order {id}",
       tool: "erpnext_doc_list",
       args: {
@@ -56496,6 +56512,27 @@ var DOCTYPE_SEND_MESSAGE_HINTS = {
       }
     }
   ],
+  "Purchase Invoice": [
+    {
+      key: "payments",
+      label: "Payments",
+      message: "Show payment entries for purchase invoice {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Payment Entry",
+        fields: [
+          "name",
+          "posting_date",
+          "paid_amount",
+          "mode_of_payment",
+          "docstatus"
+        ],
+        filters: [["Payment Entry Reference", "reference_name", "=", "{id}"]],
+        limit: 20
+      },
+      kind: "list"
+    }
+  ],
   "Item": [
     {
       key: "stock",
@@ -56665,68 +56702,69 @@ var INVOICE_ITEM_HINTS = [
     kind: "list"
   }
 ];
-var INVOICE_HINTS = {
-  "Sales Invoice": [
-    {
-      key: "payments",
-      label: "Payments",
-      message: "Show payment entries for invoice {id}",
-      tool: "erpnext_doc_list",
-      args: {
-        doctype: "Payment Entry",
-        fields: [
-          "name",
-          "posting_date",
-          "paid_amount",
-          "mode_of_payment",
-          "docstatus"
-        ],
-        filters: [["Payment Entry Reference", "reference_name", "=", "{id}"]],
-        limit: 20
-      },
-      kind: "list"
-    },
-    {
+function nonEmptyDocumentString(document, key) {
+  const value = document?.[key];
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function documentPartyHint(doctype, document) {
+  if (doctype === "Sales Order" || doctype === "Sales Invoice") {
+    const customer = nonEmptyDocumentString(document, "customer");
+    return customer ? {
       key: "customer",
       label: "Customer",
-      message: "Show customer {party}",
+      message: `Show customer ${customer}`,
       tool: "erpnext_customer_get",
-      args: { name: "{party}" },
+      args: { name: customer },
       kind: "record"
-    },
-    ...INVOICE_ITEM_HINTS
-  ],
-  "Purchase Invoice": [
-    {
-      key: "payments",
-      label: "Payments",
-      message: "Show payment entries for invoice {id}",
-      tool: "erpnext_doc_list",
-      args: {
-        doctype: "Payment Entry",
-        fields: [
-          "name",
-          "posting_date",
-          "paid_amount",
-          "mode_of_payment",
-          "docstatus"
-        ],
-        filters: [["Payment Entry Reference", "reference_name", "=", "{id}"]],
-        limit: 20
-      },
-      kind: "list"
-    },
-    {
+    } : null;
+  }
+  if (doctype === "Purchase Invoice") {
+    const supplier = nonEmptyDocumentString(document, "supplier");
+    return supplier ? {
       key: "supplier",
       label: "Supplier",
-      message: "Show supplier {party}",
+      message: `Show supplier ${supplier}`,
       tool: "erpnext_supplier_get",
-      args: { name: "{party}" },
+      args: { name: supplier },
       kind: "record"
-    },
-    ...INVOICE_ITEM_HINTS
-  ]
-};
+    } : null;
+  }
+  if (doctype !== "Quotation") return null;
+  const party = nonEmptyDocumentString(document, "party_name");
+  const target = nonEmptyDocumentString(document, "quotation_to");
+  if (!party || target !== "Customer" && target !== "Lead") return null;
+  return target === "Customer" ? {
+    key: "customer",
+    label: "Customer",
+    message: `Show customer ${party}`,
+    tool: "erpnext_customer_get",
+    args: { name: party },
+    kind: "record"
+  } : {
+    key: "lead",
+    label: "Lead",
+    message: `Show lead ${party}`,
+    tool: "erpnext_lead_get",
+    args: { name: party },
+    kind: "record"
+  };
+}
+function documentNavigationHints(doctype, document) {
+  const base = DOCTYPE_SEND_MESSAGE_HINTS[doctype] ?? [];
+  const party = documentPartyHint(doctype, document);
+  if (!party) return [...base];
+  return doctype === "Sales Order" ? [party, ...base] : [...base, party];
+}
+var INVOICE_LINE_ITEM_DOCTYPES = /* @__PURE__ */ new Set([
+  "Sales Order",
+  "Sales Invoice",
+  "Purchase Invoice",
+  "Quotation"
+]);
+function invoiceNavigationHints(doctype, document) {
+  const documentHints = documentNavigationHints(doctype, document);
+  return INVOICE_LINE_ITEM_DOCTYPES.has(doctype) ? [...documentHints, ...INVOICE_ITEM_HINTS] : documentHints;
+}
 var STOCK_HINTS = [
   {
     key: "item",
@@ -57174,6 +57212,9 @@ function resultDoctype(result) {
   if (isRecord7(data) && typeof data.doctype === "string") return data.doctype;
   return void 0;
 }
+function resultDocument(result) {
+  return isRecord7(result.data) ? result.data : void 0;
+}
 function isInvoiceViewer(result) {
   const uri = result._meta?.ui?.resourceUri;
   return uri === "ui://mcp-erpnext/invoice-viewer";
@@ -57409,8 +57450,8 @@ function withUiRefreshRequest(result, toolName, args, now = /* @__PURE__ */ new
     }
   }
   if (isDoclistResult(enriched) && isDoclistViewer(enriched) && !enriched._sendMessageHints) {
-    const hints = DOCTYPE_SEND_MESSAGE_HINTS[enriched.doctype];
-    if (hints) {
+    const hints = documentNavigationHints(enriched.doctype);
+    if (hints.length > 0) {
       enriched._sendMessageHints = hints;
     }
   }
@@ -57450,13 +57491,13 @@ function withUiRefreshRequest(result, toolName, args, now = /* @__PURE__ */ new
   if (!enriched._sendMessageHints) {
     const doctype = resultDoctype(enriched);
     if (isInvoiceViewer(enriched) && doctype) {
-      const hints = INVOICE_HINTS[doctype];
-      if (hints) enriched._sendMessageHints = hints;
+      const hints = invoiceNavigationHints(doctype, resultDocument(enriched));
+      if (hints.length > 0) enriched._sendMessageHints = hints;
     } else if (isStockViewer(enriched)) {
       enriched._sendMessageHints = STOCK_HINTS;
     } else if ((isKanbanViewer(enriched) || isDocViewer(enriched)) && doctype) {
-      const hints = DOCTYPE_SEND_MESSAGE_HINTS[doctype];
-      if (hints) enriched._sendMessageHints = hints;
+      const hints = documentNavigationHints(doctype, resultDocument(enriched));
+      if (hints.length > 0) enriched._sendMessageHints = hints;
     }
   }
   return filterNavJumpsByAvailableTools(enriched, availableToolNames);
@@ -57640,6 +57681,17 @@ var UI_VIEWERS = [
   "funnel-viewer",
   "kanban-viewer"
 ];
+var VIEWER_RESOURCE_META = {
+  ui: {
+    csp: {
+      resourceDomains: ["blob:"],
+      frameDomains: ["blob:"]
+    }
+  }
+};
+function withViewerResourceMeta(resource) {
+  return { ...resource, _meta: VIEWER_RESOURCE_META };
+}
 
 // src/ui/viewer-resource-paths.ts
 function fileUrlToPath2(url2) {
@@ -57652,9 +57704,19 @@ function fileUrlToPath2(url2) {
   }
   return decodedPath;
 }
+function isRemoteUrl(url2) {
+  return url2.protocol === "http:" || url2.protocol === "https:";
+}
 function resolveViewerDistPath2(moduleUrl, viewerName, exists) {
+  const sourceDistUrl = new URL(
+    `./src/ui/dist/${viewerName}/index.html`,
+    moduleUrl
+  );
+  if (isRemoteUrl(sourceDistUrl)) {
+    return sourceDistUrl.href;
+  }
   const candidates = [
-    fileUrlToPath2(new URL(`./src/ui/dist/${viewerName}/index.html`, moduleUrl)),
+    fileUrlToPath2(sourceDistUrl),
     fileUrlToPath2(new URL(`./ui-dist/${viewerName}/index.html`, moduleUrl))
   ];
   for (const candidate of candidates) {
@@ -57664,6 +57726,19 @@ function resolveViewerDistPath2(moduleUrl, viewerName, exists) {
   }
   return null;
 }
+async function readViewerDist(location, readLocal, fetchRemote = fetch) {
+  const url2 = new URL(location, "file:///");
+  if (!isRemoteUrl(url2)) {
+    return await readLocal(location);
+  }
+  const response = await fetchRemote(location);
+  if (!response.ok) {
+    throw new Error(
+      `Viewer resource fetch failed (${response.status} ${response.statusText})`
+    );
+  }
+  return await response.text();
+}
 
 // src/auth/composite-provider.ts
 var CompositeAuthProvider = class extends AuthProvider {
@@ -57878,7 +57953,7 @@ async function main() {
   );
   const server = new McpApp({
     name: "mcp-erpnext",
-    version: "3.1.0-beta.2",
+    version: "3.1.0-beta.4",
     transport: "stateless",
     cache: {
       ttlMs: 36e5,
@@ -57909,15 +57984,19 @@ async function main() {
     const humanName = viewerName.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
     if (distPath) {
       server.registerResource(
-        {
+        withViewerResourceMeta({
           uri: resourceUri,
           name: `ERPNext ${humanName}`,
           description: `ERPNext UI: ${viewerName}`,
           mimeType: MCP_APP_MIME_TYPE
-        },
+        }),
         async () => {
-          const html = await readTextFile6(distPath);
-          return { uri: resourceUri, mimeType: MCP_APP_MIME_TYPE, text: html };
+          const html = await readViewerDist(distPath, readTextFile6);
+          return withViewerResourceMeta({
+            uri: resourceUri,
+            mimeType: MCP_APP_MIME_TYPE,
+            text: html
+          });
         }
       );
       console.error(`[mcp-erpnext] Registered UI resource: ${resourceUri}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@casys/mcp-erpnext",
-  "version": "3.1.0-beta.2",
+  "version": "3.1.0-beta.4",
   "description": "MCP server for ERPNext with interactive UI viewers",
   "type": "module",
   "bin": {