@chaprola/mcp-server 1.4.2 → 1.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chaprola/mcp-server",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "description": "MCP server for Chaprola — agent-first data platform. Gives AI agents 46 tools for structured data storage, record CRUD, querying, schema inspection, web search, URL fetching, scheduled jobs, and execution via plain HTTP.",
   "type": "module",
   "main": "dist/index.js",

package/references/auth.md

@@ -33,16 +33,14 @@ POST /login {"username": "my-agent", "passcode": "a-long-secure-passcode-16-char
 
 ## BAA (Business Associate Agreement)
 
-All data endpoints require a signed BAA. Without it, requests return 403.
+**Only needed for PHI (Protected Health Information).** Non-PHI data works without a BAA. If your data contains no patient names, SSNs, dates of birth, or other HIPAA identifiers, skip the BAA entirely.
 
-**Flow:**
+If you do handle PHI, sign the BAA once per account:
 1. `POST /baa-text` → get BAA text (show to human)
 2. Human reviews and agrees
 3. `POST /sign-baa` → sign it (one-time per account)
 4. `POST /baa-status` → verify signing status
 
-**Exempt endpoints** (no BAA required): /hello, /register, /login, /check-username, /delete-account, /sign-baa, /baa-status, /baa-text, /report, /email/inbound
-
 ## MCP Server Environment Variables
 
 | Variable | Description |

package/references/cookbook.md

@@ -83,6 +83,77 @@ POST /run/status {userid, project, job_id}
 # Response: {status: "done", output: "..."}
 ```
 
+## Parameterized Reports (PARAM.name)
+
+Programs can accept named parameters from URL query strings. Use this for dynamic reports.
+
+```chaprola
+// Report that accepts &deck=kanji&level=3 as URL params
+MOVE PARAM.deck U.1 20       // string param → U buffer
+LET lvl = PARAM.level        // numeric param → R variable
+SEEK 1
+100 IF EOF GOTO 900
+    MOVE P.deck U.30 10
+    IF EQUAL PARAM.deck U.30 GOTO 200   // filter by deck param
+    GOTO 300
+200 GET cardlvl FROM P.level
+    IF cardlvl NE lvl GOTO 300           // filter by level param
+    MOVE P.kanji U.1 4
+    MOVE P.reading U.6 10
+    PRINT 0
+300 LET rec = rec + 1
+    SEEK rec
+    GOTO 100
+900 END
+```
+
+Publish with: `POST /publish {userid, project, name, primary_file, acl: "authenticated"}`
+Call with: `GET /report?userid=X&project=Y&name=Z&deck=kanji&level=3`
+Discover params: `POST /report/params {userid, project, name}` → returns .PF schema (field names, types, widths)
+
+## Named Output Positions (U.name)
+
+Instead of `U.1`, `U.12`, etc., use named positions for readable code:
+
+```chaprola
+// U.name positions are auto-allocated by the compiler
+MOVE P.name U.name 20
+MOVE P.dept U.dept 10
+PUT sal INTO U.salary 10 D 0
+PRINT 0
+```
+
+## GROUP BY with Pivot (via /query)
+
+Chaprola's pivot IS GROUP BY. Set `row` = grouping field, `values` = aggregate functions.
+
+```bash
+# SQL: SELECT department, COUNT(*), AVG(salary) FROM staff GROUP BY department
+POST /query {
+  userid, project, file: "STAFF",
+  pivot: {
+    row: "department",
+    values: [
+      {field: "department", function: "count"},
+      {field: "salary", function: "avg"}
+    ]
+  }
+}
+
+# SQL: SELECT department, year, SUM(revenue) FROM sales GROUP BY department, year
+POST /query {
+  userid, project, file: "SALES",
+  pivot: {
+    row: "department",
+    column: "year",
+    values: [{field: "revenue", function: "sum"}],
+    totals: true
+  }
+}
+```
+
+Supported aggregate functions: `count`, `sum`, `avg`, `min`, `max`, `stddev`.
+
 ## PUT Format Codes
 
 | Code | Description | Example |

package/references/endpoints.md

@@ -14,7 +14,7 @@ Auth: `Authorization: Bearer chp_your_api_key` on all protected endpoints.
 | `POST /check-username` | `{username}` → `{available: bool}` |
 | `POST /delete-account` | `{username, passcode}` → deletes account + all data |
 | `POST /baa-text` | `{}` → `{baa_version, text}`. Get BAA for human review |
-| `POST /report` | `{userid, project, name}` → program output. Program must be published |
+| `POST /report` | `{userid, project, name, &param=value}` → program output. Accepts named params via URL query strings. Use `/report/params` to discover schema. Program must be published |
 
 ## Protected Endpoints (auth required)
 
@@ -41,7 +41,7 @@ Auth: `Authorization: Bearer chp_your_api_key` on all protected endpoints.
 | `POST /compile` | `{userid, project, name, source, primary_format?, secondary_format?}` | `{instructions, bytes}` |
 | `POST /run` | `{userid, project, name, primary_file?, record?, async?, nophi?}` | `{output, registers}` or `{job_id}` |
 | `POST /run/status` | `{userid, project, job_id}` | `{status: "running"/"done", output?}` |
-| `POST /publish` | `{userid, project, name, primary_file?, record?}` | `{report_url}` |
+| `POST /publish` | `{userid, project, name, primary_file?, record?, acl?}` | `{report_url}`. ACL: `public` (default), `authenticated`, `owner`, `token` |
 | `POST /unpublish` | `{userid, project, name}` | `{status: "ok"}` |
 | `POST /export-report` | `{userid, project, name, primary_file?, format?, title?, nophi?}` | `{output, files_written}` |
 
@@ -83,5 +83,5 @@ Auth: `Authorization: Bearer chp_your_api_key` on all protected endpoints.
 
 - `userid` in every request body must match the authenticated user (403 if not)
 - API keys never expire. Login generates a new key and invalidates the old one
-- Data endpoints require a signed BAA (403 if unsigned)
-- All `.DA` files expire after 90 days by default
+- BAA only required for PHI data. Non-PHI data works without signing a BAA
+- All `.DA` files expire after 90 days by default. Set `expires_in_days` on import to override (up to 36500 days)

package/references/gotchas.md

@@ -52,8 +52,8 @@ Every request body's `userid` must equal your username. 403 on mismatch.
 ### Login invalidates the old key
 `POST /login` generates a new API key. The old one is dead. Save the new one immediately.
 
-### BAA required for data operations
-All import/export/compile/run/query/email endpoints return 403 without a signed BAA. Check with `/baa-status` first.
+### BAA only required for PHI
+The BAA is only needed if your data contains Protected Health Information (patient names, SSNs, dates of birth, etc.). Non-PHI data works without signing a BAA. If you get a 403 on a PHI-flagged field, either sign the BAA or rename the field to avoid PHI auto-detection.
 
 ### Async for large datasets
 `POST /run` with `async: true` for >100K records. API Gateway has a 30-second timeout; async bypasses it. Poll `/run/status` until `status: "done"`.