@ekwo-ai/mcp 0.4.0

package/dist/sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAML,KAAK,OAAO,EAKb,MAAM,cAAc,CAAC;AAEtB,gEAAgE;AAChE,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AA+CD,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AA4BD,wBAAgB,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAsH7E;AAED,qDAAqD;AACrD,wBAAsB,OAAO,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CA4C1E"}

package/dist/sql.js

@@ -0,0 +1,214 @@
+/**
+ * The direct-Postgres backend.
+ *
+ * For a self-hosted installation where PostgREST is not in front of the
+ * database, and for the tests, which run the real schema in Postgres compiled
+ * to WebAssembly. It is the second route, not the privileged one: every call
+ * runs inside a transaction that sets `request.jwt.claims` and switches to
+ * the `authenticated` role, so row level security binds exactly as it does
+ * over the API. A connection that could bypass the policies would make this
+ * server a way round them, which is the one thing it must never be.
+ *
+ * The driver is behind `SqlClient` — thirty lines with nothing to decide — so
+ * the tests plug PGlite in and never load a network driver.
+ */
+import { EkwoMcpError, columnName, explain, identifier, qualified, } from './backend.js';
+/** Builds `where` with $n placeholders, appending to `params`. */
+function whereClause(filters, params) {
+    if (filters === undefined || filters.length === 0)
+        return '';
+    const parts = filters.map((filter) => {
+        const column = identifier(filter.column);
+        switch (filter.op) {
+            case 'is':
+                return `${column} is null`;
+            case 'in': {
+                if (filter.value.length === 0)
+                    return 'false';
+                const slots = filter.value.map((value) => {
+                    params.push(value);
+                    return `$${params.length}`;
+                });
+                return `${column} in (${slots.join(', ')})`;
+            }
+            case 'ilike':
+                params.push(filter.value);
+                return `${column} ilike $${params.length}`;
+            default: {
+                const operator = { eq: '=', neq: '<>', gt: '>', gte: '>=', lt: '<', lte: '<=' }[filter.op];
+                params.push(filter.value);
+                return `${column} ${operator} $${params.length}`;
+            }
+        }
+    });
+    return ` where ${parts.join(' and ')}`;
+}
+/** `amount::text` is selected as `amount::text as amount`, so keys never shift. */
+function selectList(columns) {
+    return columns
+        .map((column) => {
+        const cast = column.indexOf('::');
+        if (cast === -1)
+            return identifier(column);
+        const name = columnName(column);
+        const type = column.slice(cast + 2);
+        if (!/^[a-z ]+$/.test(type)) {
+            throw new EkwoMcpError(`bad_identifier: ${column} is not a column and a cast`);
+        }
+        return `${name}::${type} as ${name}`;
+    })
+        .join(', ');
+}
+/** `fn(p_a => $1, p_b => $2)` and the parameters in that order. */
+/**
+ * An argument that is an object or an array is JSON, and is sent as JSON.
+ *
+ * PostgREST posts the arguments as a JSON body, so a `jsonb` parameter
+ * receives a real array on that route. A Postgres driver does not: handed a
+ * JavaScript array it builds a Postgres *array* literal, and `node-postgres`
+ * turns an array of objects into `{"[object Object]"}`. So the value is
+ * stringified here and the placeholder carries an explicit `::jsonb`, which
+ * makes the two routes agree instead of agreeing by accident on one driver.
+ */
+function callOf(fn, args, schema) {
+    const entries = Object.entries(args);
+    const params = [];
+    const parts = entries.map(([name, value], index) => {
+        const json = typeof value === 'object' && value !== null;
+        params.push(json ? JSON.stringify(value) : value);
+        return `${identifier(name)} => $${index + 1}${json ? '::jsonb' : ''}`;
+    });
+    return { call: `${qualified(schema, fn)}(${parts.join(', ')})`, params };
+}
+export function sqlBackend(db, options) {
+    const claims = JSON.stringify({
+        ...(options.claims ?? {}),
+        sub: options.userId,
+        role: 'authenticated',
+    });
+    /**
+     * One statement, as the user.
+     *
+     * `set_config(..., true)` and `set local role` are both transaction-scoped,
+     * so nothing leaks into the next call even on a pooled connection.
+     */
+    async function asUser(run) {
+        try {
+            return await db.transaction(async (tx) => {
+                await tx.query('select set_config($1, $2, true)', ['request.jwt.claims', claims]);
+                await tx.exec('set local role authenticated');
+                return run(tx);
+            });
+        }
+        catch (error) {
+            throw explain(error.message);
+        }
+    }
+    return {
+        mode: 'sql',
+        actingAs: options.userId,
+        async rpc(fn, args = {}, schema) {
+            const { call, params } = callOf(fn, args, schema);
+            // Aggregated as JSON so the shape matches what PostgREST returns for the
+            // same function, instead of depending on how a driver types a column.
+            const rows = await asUser((tx) => tx.query(`select coalesce(jsonb_agg(to_jsonb(f)), '[]'::jsonb) as value from ${call} f`, params));
+            return (rows[0]?.value ?? []);
+        },
+        async rpcVoid(fn, args = {}, schema) {
+            const { call, params } = callOf(fn, args, schema);
+            await asUser((tx) => tx.query(`select ${call}`, params));
+        },
+        async select(query) {
+            const params = [];
+            let sql = `select ${selectList(query.columns)} from ${qualified(query.schema, query.table)}`;
+            sql += whereClause(query.where, params);
+            if (query.order !== undefined && query.order.length > 0) {
+                const parts = query.order.map((order) => `${identifier(order.column)} ${order.ascending === false ? 'desc' : 'asc'}`);
+                sql += ` order by ${parts.join(', ')}`;
+            }
+            if (query.limit !== undefined) {
+                params.push(query.limit);
+                sql += ` limit $${params.length}`;
+            }
+            return asUser((tx) => tx.query(sql, params));
+        },
+        async insert(table, rows, returning = ['*'], schema) {
+            if (rows.length === 0)
+                return [];
+            const columns = Object.keys(rows[0]).map(identifier);
+            const params = [];
+            const tuples = rows.map((row) => {
+                const slots = columns.map((column) => {
+                    params.push(row[column]);
+                    return `$${params.length}`;
+                });
+                return `(${slots.join(', ')})`;
+            });
+            const sql = `insert into ${qualified(schema, table)} (${columns.join(', ')}) values ${tuples.join(', ')}` +
+                ` returning ${returning[0] === '*' ? '*' : selectList(returning)}`;
+            return asUser((tx) => tx.query(sql, params));
+        },
+        async update(table, patch, where, returning = ['*'], schema) {
+            const params = [];
+            const assignments = Object.keys(patch).map((column) => {
+                params.push(patch[column]);
+                return `${identifier(column)} = $${params.length}`;
+            });
+            if (assignments.length === 0) {
+                throw new EkwoMcpError(`empty_update: nothing to change on ${table}`);
+            }
+            const sql = `update ${qualified(schema, table)} set ${assignments.join(', ')}` +
+                whereClause(where, params) +
+                ` returning ${returning[0] === '*' ? '*' : selectList(returning)}`;
+            return asUser((tx) => tx.query(sql, params));
+        },
+        async remove(table, where, schema) {
+            const params = [];
+            const sql = `delete from ${qualified(schema, table)}` + whereClause(where, params);
+            await asUser((tx) => tx.query(sql, params));
+        },
+        async close() {
+            await db.close();
+        },
+    };
+}
+/** Opens a connection with the `postgres` driver. */
+export async function connect(connectionString) {
+    // Imported lazily, and declared as an optional peer dependency: the
+    // recommended route needs no Postgres driver at all, so an operator who
+    // never sets EKWO_DB_URL should not have to install one.
+    const { default: postgres } = await import('postgres').catch(() => {
+        throw new EkwoMcpError('missing_driver: EKWO_DB_URL needs the `postgres` package. Install it alongside this server, or use SUPABASE_URL with a user session instead.');
+    });
+    const sql = postgres(connectionString, {
+        max: 1,
+        prepare: false,
+        idle_timeout: 20,
+        connect_timeout: 30,
+        onnotice: () => { },
+    });
+    const wrap = (handle) => ({
+        async query(text, params = []) {
+            const result = await handle.unsafe(text, params);
+            return result;
+        },
+        async exec(text) {
+            await handle.unsafe(text).simple();
+        },
+        async transaction(fn) {
+            return (await handle.begin(async (tx) => fn(wrap(tx))));
+        },
+        async close() {
+            await sql.end({ timeout: 5 });
+        },
+    });
+    try {
+        await sql `select 1`;
+    }
+    catch (error) {
+        await sql.end({ timeout: 5 }).catch(() => { });
+        throw error;
+    }
+    return wrap(sql);
+}
+//# sourceMappingURL=sql.js.map

package/dist/sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,YAAY,EACZ,UAAU,EACV,OAAO,EACP,UAAU,EACV,SAAS,GAMV,MAAM,cAAc,CAAC;AAUtB,kEAAkE;AAClE,SAAS,WAAW,CAAC,OAA6B,EAAE,MAAiB;IACnE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,QAAQ,MAAM,CAAC,EAAE,EAAE,CAAC;YAClB,KAAK,IAAI;gBACP,OAAO,GAAG,MAAM,UAAU,CAAC;YAC7B,KAAK,IAAI,CAAC,CAAC,CAAC;gBACV,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,OAAO,CAAC;gBAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;oBACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnB,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC7B,CAAC,CAAC,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9C,CAAC;YACD,KAAK,OAAO;gBACV,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO,GAAG,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7C,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,QAAQ,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO,GAAG,MAAM,IAAI,QAAQ,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,OAAiB;IACnC,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,CAAC,CAAC;YAAE,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,YAAY,CAAC,mBAAmB,MAAM,6BAA6B,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,GAAG,IAAI,KAAK,IAAI,OAAO,IAAI,EAAE,CAAC;IACvC,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAaD,mEAAmE;AACnE;;;;;;;;;GASG;AACH,SAAS,MAAM,CACb,EAAU,EACV,IAA6B,EAC7B,MAAe;IAEf,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAa,EAAE,OAA0B;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACzB,GAAG,EAAE,OAAO,CAAC,MAAM;QACnB,IAAI,EAAE,eAAe;KACtB,CAAC,CAAC;IAEH;;;;;OAKG;IACH,KAAK,UAAU,MAAM,CAAI,GAAkC;QACzD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACvC,MAAM,EAAE,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC;gBAClF,MAAM,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;gBAC9C,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,OAAO,CAAC,MAAM;QAExB,KAAK,CAAC,GAAG,CAAI,EAAU,EAAE,OAAgC,EAAE,EAAE,MAAe;YAC1E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAClD,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAC/B,EAAE,CAAC,KAAK,CACN,sEAAsE,IAAI,IAAI,EAC9E,MAAM,CACP,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAQ,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,OAAgC,EAAE,EAAE,MAAe;YAC3E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,KAAK,CAAC,MAAM,CAAI,KAAkB;YAChC,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,GAAG,GAAG,UAAU,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7F,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CACvF,CAAC;gBACF,GAAG,IAAI,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzB,GAAG,IAAI,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC;YACpC,CAAC;YACD,OAAO,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,IAAW,EACX,YAAsB,CAAC,GAAG,CAAC,EAC3B,MAAe;YAEf,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAQ,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;oBACnC,MAAM,CAAC,IAAI,CAAE,GAAW,CAAC,MAAM,CAAU,CAAC,CAAC;oBAC3C,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC7B,CAAC,CAAC,CAAC;gBACH,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,MAAM,GAAG,GACP,eAAe,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC7F,cAAc,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrE,OAAO,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,KAAU,EACV,KAAe,EACf,YAAsB,CAAC,GAAG,CAAC,EAC3B,MAAe;YAEf,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBACpD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAU,CAAC,CAAC;gBACpC,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC;YACrD,CAAC,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,YAAY,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,GAAG,GACP,UAAU,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAClE,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC;gBAC1B,cAAc,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrE,OAAO,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAe,EAAE,MAAe;YAC1D,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,eAAe,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACnF,MAAM,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,KAAK;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,gBAAwB;IACpD,oEAAoE;IACpE,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QAChE,MAAM,IAAI,YAAY,CACpB,8IAA8I,CAC/I,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,QAAQ,CAAC,gBAAgB,EAAE;QACrC,GAAG,EAAE,CAAC;QACN,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,EAAE;QAChB,eAAe,EAAE,EAAE;QACnB,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;KACnB,CAAC,CAAC;IAIH,MAAM,IAAI,GAAG,CAAC,MAAW,EAAa,EAAE,CAAC,CAAC;QACxC,KAAK,CAAC,KAAK,CAA8B,IAAY,EAAE,SAAoB,EAAE;YAC3E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAiB,CAAC,CAAC;YAC5D,OAAO,MAAwB,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAY;YACrB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,WAAW,CAAI,EAAiC;YACpD,OAAO,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAoB,CAAC,CAAC,CAAC,CAAM,CAAC;QACjF,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,GAAG,CAAA,UAAU,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC"}

package/dist/tools/modules.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The tools of the modules, and the loader that puts them on the server.
+ *
+ * A module is a schema of its own, so its tools are named after it —
+ * `assets_list`, `budgets_variance` — and a model reading a tool list can tell
+ * which module answers for what. The prefix is in `module.json`, and a test
+ * holds the tool names to it.
+ *
+ * **Nothing here decides what is installed.** `public.modules` does, and the
+ * server asks it at startup: a module whose migrations have never run has no
+ * row, so its tools are not offered, and a tool a model cannot use is worse
+ * than a tool it cannot see. What the registry below carries is the other
+ * half — the handlers this release knows how to write — and a module installed
+ * in the database that this release has no handlers for is simply not exposed.
+ *
+ * **PostgREST has to be told.** A schema other than `public` is served only
+ * once the project lists it under its exposed schemas, which no migration can
+ * set. The refusal that comes back is a 406 about a profile, which says
+ * nothing useful to a model, so every module tool turns it into the sentence
+ * that names the setting.
+ */
+import { z } from 'zod';
+import { type Backend } from '../backend.js';
+/** One module's tools, as the loader sees them. */
+export interface ModuleToolset {
+    /** The module code, and the key of `public.modules`. */
+    code: string;
+    /** Every tool of this module is `<prefix>_<verb>`. */
+    prefix: string;
+    /** The schema its objects live in, for the message when it is not exposed. */
+    schema: string;
+    tools: ModuleTool[];
+}
+export interface ModuleTool {
+    /** Without the prefix: `list`, `create`, `variance`. */
+    verb: string;
+    title: string;
+    description: string;
+    input: z.ZodObject<z.ZodRawShape>;
+    readOnly: boolean;
+    run(backend: Backend, args: Record<string, never>): Promise<unknown>;
+}
+/**
+ * A schema the project has not exposed answers with a profile error, which
+ * reads like a bug in this server. It is a setting, so say which one.
+ */
+export declare function inSchema<T>(schema: string, run: () => Promise<T>): Promise<T>;
+/** Every module this release knows how to expose, by module code. */
+export declare const MODULE_TOOLSETS: readonly ModuleToolset[];
+/** The toolsets for a set of installed module codes, in a fixed order. */
+export declare function toolsetsFor(installed: readonly string[]): ModuleToolset[];
+/**
+ * Which modules this installation carries.
+ *
+ * `public.modules` is the registry, and it is readable by anyone signed in —
+ * it says what exists here, not what any company holds. A database that
+ * predates the module framework has no such table, and the answer is then no
+ * modules rather than an error.
+ */
+export declare function installedModules(backend: Backend): Promise<string[]>;
+//# sourceMappingURL=modules.d.ts.map

package/dist/tools/modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../../src/tools/modules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgB,KAAK,OAAO,EAAY,MAAM,eAAe,CAAC;AAIrE,mDAAmD;AACnD,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtE;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAcnF;AAwUD,qEAAqE;AACrE,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EAAsB,CAAC;AAE3E,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,EAAE,CAGzE;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAW1E"}

package/dist/tools/modules.js

@@ -0,0 +1,335 @@
+/**
+ * The tools of the modules, and the loader that puts them on the server.
+ *
+ * A module is a schema of its own, so its tools are named after it —
+ * `assets_list`, `budgets_variance` — and a model reading a tool list can tell
+ * which module answers for what. The prefix is in `module.json`, and a test
+ * holds the tool names to it.
+ *
+ * **Nothing here decides what is installed.** `public.modules` does, and the
+ * server asks it at startup: a module whose migrations have never run has no
+ * row, so its tools are not offered, and a tool a model cannot use is worse
+ * than a tool it cannot see. What the registry below carries is the other
+ * half — the handlers this release knows how to write — and a module installed
+ * in the database that this release has no handlers for is simply not exposed.
+ *
+ * **PostgREST has to be told.** A schema other than `public` is served only
+ * once the project lists it under its exposed schemas, which no migration can
+ * set. The refusal that comes back is a 406 about a profile, which says
+ * nothing useful to a model, so every module tool turns it into the sentence
+ * that names the setting.
+ */
+import { z } from 'zod';
+import { EkwoMcpError } from '../backend.js';
+import { money } from '@ekwo-ai/core';
+import { companyId, isoDate, uuid } from './read.js';
+/**
+ * A schema the project has not exposed answers with a profile error, which
+ * reads like a bug in this server. It is a setting, so say which one.
+ */
+export async function inSchema(schema, run) {
+    try {
+        return await run();
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (/profile|schema must be one of|PGRST106|acceptable/i.test(message)) {
+            throw new EkwoMcpError(`schema_not_exposed: the \`${schema}\` schema is not served by this project's API. ` +
+                `Add it in Supabase → Project Settings → API → Exposed schemas, or to \`[api] schemas\` ` +
+                `in supabase/config.toml, and try again. ${message}`);
+        }
+        throw error;
+    }
+}
+// ---------------------------------------------------------------------------
+// assets
+// ---------------------------------------------------------------------------
+const ASSETS = {
+    code: 'assets',
+    prefix: 'assets',
+    schema: 'assets',
+    tools: [
+        {
+            verb: 'list',
+            title: 'Fixed assets',
+            readOnly: true,
+            description: 'The register of fixed assets of a company at a date: what each one cost, what has been written off it and what is left. It reads what has been *booked*, so it ties back to the accumulated depreciation account on the balance sheet. An asset disposed of before that date is not in it.',
+            input: z.object({
+                company_id: companyId,
+                at: isoDate.describe('The date to read the register at.'),
+            }),
+            async run(backend, args) {
+                const at = args['at'];
+                const rows = await inSchema('assets', () => backend.rpc('register', { p_company_id: args['company_id'], p_at: at }, 'assets'));
+                return {
+                    at,
+                    assets: rows.map((row) => ({
+                        ...row,
+                        cost: money(row['cost']),
+                        accumulated: money(row['accumulated']),
+                        net_book_value: money(row['net_book_value']),
+                    })),
+                };
+            },
+        },
+        {
+            verb: 'create',
+            title: 'Record a fixed asset',
+            readOnly: false,
+            description: 'Creates a fixed asset and writes its depreciation schedule in one call. Give a `category_code` from the country pack — assets_categories lists them — and the method, the duration and the coefficient come from it; anything you pass yourself wins over the category. The three accounts are the asset account, the accumulated depreciation account and the depreciation charge. Nothing is booked here: assets_run_depreciation is what posts.',
+            input: z.object({
+                company_id: companyId,
+                code: z.string().min(1).describe('Your own reference for the asset. Unique in the company.'),
+                name: z.string().min(1),
+                acquisition_date: isoDate,
+                cost: z.number().positive().describe('What it cost, excluding recoverable tax.'),
+                asset_account: z.string().describe('Account code the asset itself sits on.'),
+                depreciation_account: z.string().describe('Account code of the accumulated depreciation.'),
+                expense_account: z.string().describe('Account code the depreciation charge lands on.'),
+                category_code: z.string().optional().describe('A category of the country pack.'),
+                duration_months: z.number().int().positive().optional(),
+                method: z.enum(['straight_line', 'declining_balance']).optional(),
+                coefficient: z.number().positive().optional().describe('Required by a declining balance.'),
+                residual_value: z.number().min(0).optional(),
+                in_service_date: isoDate.optional().describe('When it started being used, if not the day it was bought.'),
+                description: z.string().optional(),
+            }),
+            async run(backend, args) {
+                // A function returning a scalar comes back as the scalar, on either
+                // backend: `opening_balance` is read the same way.
+                const created = await inSchema('assets', () => backend.rpc('create_asset', {
+                    p_company_id: args['company_id'],
+                    p_code: args['code'],
+                    p_name: args['name'],
+                    p_acquisition_date: args['acquisition_date'],
+                    p_cost: args['cost'],
+                    p_asset_account: args['asset_account'],
+                    p_depreciation_account: args['depreciation_account'],
+                    p_expense_account: args['expense_account'],
+                    p_category_code: args['category_code'] ?? null,
+                    p_duration_months: args['duration_months'] ?? null,
+                    p_method: args['method'] ?? null,
+                    p_coefficient: args['coefficient'] ?? null,
+                    p_residual_value: args['residual_value'] ?? 0,
+                    p_in_service_date: args['in_service_date'] ?? null,
+                    p_description: args['description'] ?? null,
+                }, 'assets'));
+                return { asset_id: created[0] ?? null };
+            },
+        },
+        {
+            verb: 'schedule',
+            title: 'Depreciation schedule',
+            readOnly: true,
+            description: 'The planned depreciation of one asset, period by period, with the amount, the accumulated total and the net book value after each one, and the entry that booked it where it has been booked. The schedule always sums to exactly the cost less the residual value: the last line takes the remainder.',
+            input: z.object({ company_id: companyId, asset_id: uuid }),
+            async run(backend, args) {
+                const lines = await inSchema('assets', () => backend.select({
+                    schema: 'assets',
+                    table: 'depreciation_lines',
+                    columns: [
+                        'sequence',
+                        'period_start',
+                        'period_end',
+                        'amount::text',
+                        'accumulated::text',
+                        'net_book_value::text',
+                        'entry_id',
+                        'posted_at',
+                    ],
+                    where: [
+                        { column: 'company_id', op: 'eq', value: args['company_id'] },
+                        { column: 'asset_id', op: 'eq', value: args['asset_id'] },
+                    ],
+                    order: [{ column: 'sequence' }],
+                }));
+                return { lines };
+            },
+        },
+        {
+            verb: 'run_depreciation',
+            title: 'Book the depreciation',
+            readOnly: false,
+            description: 'Books every planned period that ends on or before a date, one ledger entry per period, through the socle\'s own posting function. It is idempotent: a period already booked is skipped, and the database refuses a second entry for it anyway. A closed financial year or a locked period refuses the posting — report the refusal, do not move the date.',
+            input: z.object({
+                company_id: companyId,
+                period_end: isoDate.describe('Book everything up to and including this date.'),
+            }),
+            async run(backend, args) {
+                const result = await inSchema('assets', () => backend.rpc('run_depreciation', { p_company_id: args['company_id'], p_period_end: args['period_end'] }, 'assets'));
+                return result[0] ?? { entries: [] };
+            },
+        },
+        {
+            verb: 'dispose',
+            title: 'Dispose of a fixed asset',
+            readOnly: false,
+            description: 'Takes an asset off the books on a date: clears its cost and its accumulated depreciation, books the proceeds against the account you name, and presents the result the way the country pack says — one gain or loss line, or the value sold and the proceeds in full. Run assets_run_depreciation first: a disposal is refused while a period that has already ended is still unbooked. There is no undo.',
+            input: z.object({
+                company_id: companyId,
+                asset_id: uuid,
+                disposal_date: isoDate,
+                proceeds: z.number().min(0).default(0).describe('What it was sold for, excluding tax. Zero when it was scrapped.'),
+                counterpart_account: z
+                    .string()
+                    .optional()
+                    .describe('Account code the proceeds are owed on. The receivable account of the company by default.'),
+                contact_id: uuid.optional().describe('Who bought it.'),
+            }),
+            async run(backend, args) {
+                const result = await inSchema('assets', () => backend.rpc('dispose_asset', {
+                    p_asset_id: args['asset_id'],
+                    p_date: args['disposal_date'],
+                    p_proceeds: args['proceeds'] ?? 0,
+                    p_counterpart_account: args['counterpart_account'] ?? null,
+                    p_contact_id: args['contact_id'] ?? null,
+                }, 'assets'));
+                return { entry_id: result[0] ?? null };
+            },
+        },
+    ],
+};
+// ---------------------------------------------------------------------------
+// budgets
+// ---------------------------------------------------------------------------
+const BUDGETS = {
+    code: 'budgets',
+    prefix: 'budgets',
+    schema: 'budgets',
+    tools: [
+        {
+            verb: 'list',
+            title: 'Budgets',
+            readOnly: true,
+            description: 'The budgets of a company, with the financial year each one is for and whether it is a draft, approved or closed. Start here: budgets_variance needs a budget_id.',
+            input: z.object({ company_id: companyId }),
+            async run(backend, args) {
+                const budgets = await inSchema('budgets', () => backend.select({
+                    schema: 'budgets',
+                    table: 'budgets',
+                    columns: ['id', 'code', 'name', 'state', 'fiscal_year_id', 'notes'],
+                    where: [{ column: 'company_id', op: 'eq', value: args['company_id'] }],
+                    order: [{ column: 'code' }],
+                }));
+                return { budgets };
+            },
+        },
+        {
+            verb: 'upsert_lines',
+            title: 'Write budget lines',
+            readOnly: false,
+            description: 'Adds lines to a budget: one figure per account and per period. State the amount the way a business says it out loud — an income and a cost are both positive — and the comparison flips the ledger, not you. A line already there for the same account and period is replaced.',
+            input: z.object({
+                company_id: companyId,
+                budget_id: uuid,
+                lines: z
+                    .array(z.object({
+                    account_code: z.string(),
+                    period_start: isoDate,
+                    period_end: isoDate,
+                    amount: z.number(),
+                    note: z.string().optional(),
+                }))
+                    .min(1),
+            }),
+            async run(backend, args) {
+                const companyIdValue = args['company_id'];
+                const budgetIdValue = args['budget_id'];
+                const lines = args['lines'];
+                const codes = [...new Set(lines.map((line) => line.account_code))];
+                const accounts = await backend.select({
+                    table: 'accounts',
+                    columns: ['id', 'code'],
+                    where: [
+                        { column: 'company_id', op: 'eq', value: companyIdValue },
+                        { column: 'code', op: 'in', value: codes },
+                    ],
+                });
+                const byCode = new Map(accounts.map((account) => [account.code, account.id]));
+                const missing = codes.filter((code) => !byCode.has(code));
+                if (missing.length > 0) {
+                    throw new EkwoMcpError(`unknown_account: ${missing.join(', ')} — not an account of this company. Use list_accounts to find the right code.`);
+                }
+                return inSchema('budgets', async () => {
+                    for (const line of lines) {
+                        await backend.remove('lines', [
+                            { column: 'budget_id', op: 'eq', value: budgetIdValue },
+                            { column: 'account_id', op: 'eq', value: byCode.get(line.account_code) },
+                            { column: 'period_start', op: 'eq', value: line.period_start },
+                            { column: 'period_end', op: 'eq', value: line.period_end },
+                        ], 'budgets');
+                    }
+                    const written = await backend.insert('lines', lines.map((line) => ({
+                        budget_id: budgetIdValue,
+                        company_id: companyIdValue,
+                        account_id: byCode.get(line.account_code),
+                        period_start: line.period_start,
+                        period_end: line.period_end,
+                        amount: line.amount,
+                        note: line.note ?? null,
+                    })), ['id'], 'budgets');
+                    return { written: written.length };
+                });
+            },
+        },
+        {
+            verb: 'variance',
+            title: 'Budget against ledger',
+            readOnly: true,
+            description: 'What was planned against what was booked, per account, over a period. Both figures are in the sign a business states them in, and the variance is the actual less the plan — so a negative figure on an income account is revenue that did not arrive, and a positive one on a cost account is overspending. It reads posted entries of kind `normal`: a closing or appropriation entry is not what a period earned. A budget line is taken whole or not at all, so ask for a window that contains the periods the budget was written in.',
+            input: z.object({
+                company_id: companyId,
+                budget_id: uuid,
+                from: isoDate,
+                to: isoDate,
+            }),
+            async run(backend, args) {
+                const rows = await inSchema('budgets', () => backend.rpc('variance', {
+                    p_company_id: args['company_id'],
+                    p_budget_id: args['budget_id'],
+                    p_from: args['from'],
+                    p_to: args['to'],
+                }, 'budgets'));
+                return {
+                    from: args['from'],
+                    to: args['to'],
+                    lines: rows.map((row) => ({
+                        ...row,
+                        budget: money(row['budget']),
+                        actual: money(row['actual']),
+                        variance: money(row['variance']),
+                    })),
+                };
+            },
+        },
+    ],
+};
+/** Every module this release knows how to expose, by module code. */
+export const MODULE_TOOLSETS = [ASSETS, BUDGETS];
+/** The toolsets for a set of installed module codes, in a fixed order. */
+export function toolsetsFor(installed) {
+    const wanted = new Set(installed);
+    return MODULE_TOOLSETS.filter((toolset) => wanted.has(toolset.code));
+}
+/**
+ * Which modules this installation carries.
+ *
+ * `public.modules` is the registry, and it is readable by anyone signed in —
+ * it says what exists here, not what any company holds. A database that
+ * predates the module framework has no such table, and the answer is then no
+ * modules rather than an error.
+ */
+export async function installedModules(backend) {
+    try {
+        const rows = await backend.select({
+            table: 'modules',
+            columns: ['code', 'status'],
+            order: [{ column: 'code' }],
+        });
+        return rows.filter((row) => row.status !== 'draft').map((row) => row.code);
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=modules.js.map