@comando.one/mcp-server 0.2.0 → 0.3.1

package/README.md

@@ -51,7 +51,7 @@ Ambos expõem o **mesmo conjunto de ferramentas** (50 curadas + `lookups` + `com
 
 ## Como funciona
 
-- **~70 tools curadas** (gerados a partir do OpenAPI canônico, zero drift) cobrindo as operações de maior valor — `customers_list`, `invoices_create`/`invoices_delete`, `charges_create`, `nfse_emit`, `payouts_create`, `contracts_pause`/`contracts_resume`, `service_categories_create`, `reports_aging_actions`/`reports_cashflow_forecast`, `audit_timeline`, `cost_centers_create`, etc.
+- **126 tools curadas** (gerados a partir do OpenAPI canônico, zero drift) cobrindo as operações de maior valor — `customers_list`, `invoices_create`/`invoices_delete`, `charges_create`, `nfse_emit`, `payouts_create`, `contracts_pause`/`contracts_resume`, `service_categories_create`, `reports_aging_actions`/`reports_cashflow_forecast`, `audit_timeline`, `cost_centers_create`, etc.
 - **`comando_request`** — escape hatch genérico (`method`, `path`, `query`, `body`) que cobre 100% dos endpoints restantes.
 - **`lookups`** — catálogos read-only (centros de custo, condições/métodos de pagamento, naturezas, contas bancárias).
 - **`whoami`** — identidade, empresas acessíveis e scopes da chave.

package/dist/index.js

@@ -223,7 +223,65 @@ var MANIFEST = [
   { operationId: "listReminders", tool: "reminders_list" },
   { operationId: "createReminder", tool: "reminders_create", write: true },
   { operationId: "updateReminder", tool: "reminders_update", write: true },
-  { operationId: "deleteReminder", tool: "reminders_delete", write: true, destructive: true }
+  { operationId: "deleteReminder", tool: "reminders_delete", write: true, destructive: true },
+  // ── Cobertura completa da API (2026-08-14) ──────────────────────────────
+  // 43 operações que já existiam na API pública e não tinham tool: um agente
+  // conseguia criar cliente mas não editar endereço, listar fatura mas não
+  // apagar despesa. Deriva do MANIFEST curado, não decisão de projeto.
+  // Flags seguem a convenção: mutação = write; remoção = write + destructive.
+  // Identidade e empresa
+  { operationId: "getMe", tool: "me_get" },
+  { operationId: "getCompany", tool: "companies_get" },
+  // Clientes — sub-recursos e edição
+  { operationId: "listCustomerAddresses", tool: "customers_list_addresses" },
+  { operationId: "updateCustomerAddress", tool: "customers_update_address", write: true },
+  { operationId: "deleteCustomerAddress", tool: "customers_delete_address", write: true, destructive: true },
+  { operationId: "listCustomerContacts", tool: "customers_list_contacts" },
+  { operationId: "updateCustomerContact", tool: "customers_update_contact", write: true },
+  { operationId: "deleteCustomerContact", tool: "customers_delete_contact", write: true, destructive: true },
+  { operationId: "listCustomerContracts", tool: "customers_list_contracts" },
+  { operationId: "listCustomerProposals", tool: "customers_list_proposals" },
+  // Propostas e contratos — edição e exclusão
+  { operationId: "updateProposal", tool: "proposals_update", write: true },
+  { operationId: "deleteProposal", tool: "proposals_delete", write: true, destructive: true },
+  { operationId: "updateContract", tool: "contracts_update", write: true },
+  { operationId: "deleteContract", tool: "contracts_delete", write: true, destructive: true },
+  // Fornecedores — edição e formas de pagamento
+  { operationId: "updateSupplier", tool: "suppliers_update", write: true },
+  { operationId: "deleteSupplier", tool: "suppliers_delete", write: true, destructive: true },
+  { operationId: "listSupplierPaymentMethods", tool: "suppliers_list_payment_methods" },
+  { operationId: "createSupplierPaymentMethod", tool: "suppliers_add_payment_method", write: true },
+  { operationId: "updateSupplierPaymentMethod", tool: "suppliers_update_payment_method", write: true },
+  { operationId: "deleteSupplierPaymentMethod", tool: "suppliers_delete_payment_method", write: true, destructive: true },
+  // Serviços
+  { operationId: "getService", tool: "services_get" },
+  { operationId: "updateService", tool: "services_update", write: true },
+  { operationId: "deleteService", tool: "services_delete", write: true, destructive: true },
+  { operationId: "listServiceUnits", tool: "service_units_list" },
+  // Despesas
+  { operationId: "getExpense", tool: "expenses_get" },
+  { operationId: "updateExpense", tool: "expenses_update", write: true },
+  { operationId: "deleteExpense", tool: "expenses_delete", write: true, destructive: true },
+  // Financeiro e contas bancárias
+  { operationId: "listFinancialNatures", tool: "finance_list_natures" },
+  { operationId: "deleteFinancialMovement", tool: "finance_delete_movement", write: true, destructive: true },
+  { operationId: "listBankAccounts", tool: "bank_accounts_list" },
+  { operationId: "getBankAccount", tool: "bank_accounts_get" },
+  // Dados de referência de pagamento
+  { operationId: "listPaymentConditions", tool: "payment_conditions_list" },
+  { operationId: "listPaymentMethods", tool: "payment_methods_list" },
+  { operationId: "listPaymentMethodsAp", tool: "payment_methods_ap_list" },
+  // Repasses
+  { operationId: "syncPayout", tool: "payouts_sync", write: true },
+  // Webhooks — edição, teste e entregas
+  { operationId: "updateWebhook", tool: "webhooks_update", write: true },
+  { operationId: "deleteWebhook", tool: "webhooks_delete", write: true, destructive: true },
+  { operationId: "getWebhook", tool: "webhooks_get_config" },
+  { operationId: "upsertWebhook", tool: "webhooks_upsert_config", write: true },
+  { operationId: "testWebhook", tool: "webhooks_test", write: true },
+  { operationId: "listWebhookDeliveries", tool: "webhooks_list_deliveries" },
+  { operationId: "listWebhookEvents", tool: "webhooks_list_events" },
+  { operationId: "redeliverWebhook", tool: "webhooks_redeliver", write: true }
 ];
 
 // ../../src/lib/openApiSpec.ts
@@ -3048,7 +3106,7 @@ var API_MODULES = [
     permissions: [
       { key: "read", label: "Listar e visualizar", description: "Consultar propostas comerciais" },
       { key: "write", label: "Criar e editar", description: "Criar e editar propostas" },
-      { key: "send", label: "Enviar", description: "Enviar propostas por e-mail ou WhatsApp" },
+      { key: "send", label: "Enviar", description: "Enviar propostas por e-mail" },
       { key: "delete", label: "Excluir", description: "Excluir propostas" }
     ]
   },
@@ -3357,6 +3415,22 @@ function augmentInputSchema(schema, opts) {
   }
   return { ...schema, properties };
 }
+function coerceObjectArg(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    return value;
+  }
+  if (typeof value === "string" && value.trim()) {
+    try {
+      const parsed = JSON.parse(value);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        return parsed;
+      }
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
 function destructiveBlocked(args) {
   if (args.confirm === true) return null;
   return fail(
@@ -3405,7 +3479,7 @@ function buildCuratedTools(api, heldScopes) {
             if (blocked && args.dry_run !== true) return blocked;
           }
           const path = buildPath(desc, args);
-          const body = desc.hasBody ? args.body : void 0;
+          const body = desc.hasBody ? coerceObjectArg(args.body) : void 0;
           if (args.dry_run === true) {
             return ok({
               dry_run: true,
@@ -3452,7 +3526,8 @@ function buildRequestTool(api) {
         body: { type: "object", description: "Corpo JSON (para POST/PATCH/PUT).", additionalProperties: true },
         company_id: { type: "string", description: "Opcional: UUID da empresa (header X-Company-Id)." },
         idempotency_key: { type: "string", description: "Opcional: chave de idempot\xEAncia (POST)." },
-        dry_run: { type: "boolean", description: "Se true, n\xE3o executa \u2014 s\xF3 mostra o que seria enviado." }
+        dry_run: { type: "boolean", description: "Se true, n\xE3o executa \u2014 s\xF3 mostra o que seria enviado." },
+        confirm: { type: "boolean", description: "Obrigat\xF3rio para DELETE: confirma a exclus\xE3o." }
       }
     },
     handler: async (args) => {
@@ -3461,17 +3536,23 @@ function buildRequestTool(api) {
         if (!METHODS.includes(method)) {
           return fail(`M\xE9todo inv\xE1lido: ${args.method}. Use um de: ${METHODS.join(", ")}.`);
         }
+        if (method === "DELETE" && args.confirm !== true && args.dry_run !== true) {
+          return fail(
+            "A\xE7\xE3o destrutiva bloqueada. Passe confirm: true para executar, ou dry_run: true para pr\xE9-visualizar."
+          );
+        }
         let path = String(args.path ?? "");
         if (!path.startsWith("/")) return fail("path deve come\xE7ar com / (ex.: /customers).");
-        if (args.query && typeof args.query === "object") {
+        const queryArg = coerceObjectArg(args.query);
+        if (queryArg) {
           const u = new URLSearchParams();
-          for (const [k, v] of Object.entries(args.query)) {
+          for (const [k, v] of Object.entries(queryArg)) {
             if (v !== void 0 && v !== null && v !== "") u.set(k, String(v));
           }
           const s = u.toString();
           if (s) path += (path.includes("?") ? "&" : "?") + s;
         }
-        const body = args.body && typeof args.body === "object" ? args.body : void 0;
+        const body = coerceObjectArg(args.body);
         if (args.dry_run === true) {
           return ok({ dry_run: true, method, path, body: body ?? null });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@comando.one/mcp-server",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Servidor MCP (Model Context Protocol) para a API pública do Comando.One — opere seu ERP por linguagem natural.",
   "type": "module",
   "license": "MIT",