@ekwo-ai/mcp 0.7.0 → 0.9.0

package/README.md

@@ -1,7 +1,7 @@
 # @ekwo-ai/mcp
 
 The [Model Context Protocol](https://modelcontextprotocol.io) server for
-[Ekwo OS](https://github.com/Ekwo-ai/ekwo-os). It lets an AI assistant work on
+[Ekwo OS](https://github.com/Ekwo-ai/ekwo-os). It lets an AI agent work on
 the books in your own Postgres: read the ledger, raise an invoice, post it, match
 a payment, pull the VAT return or the French FEC — **as you**, under the row
 level security of your own installation.
@@ -38,7 +38,7 @@ Three things it will never do:
   accounting has always worked. `unreconcile` is the only undo here, and
   matching changes no account.
 - **Use a `service_role` key.** It would work, and that is the objection: it
-  bypasses every policy, so the assistant would answer for companies its user
+  bypasses every policy, so the agent would answer for companies its user
   was never invited to. The server refuses to start with one.
 
 ## Configuration
@@ -95,7 +95,7 @@ alongside the server; the recommended route needs no driver at all.
 |---|---|
 | `SUPABASE_URL` | `https://<ref>.supabase.co` |
 | `SUPABASE_ANON_KEY` | The anon (publishable) key. A `service_role` key is refused. |
-| `EKWO_EMAIL` / `EKWO_PASSWORD` | The user this assistant acts as |
+| `EKWO_EMAIL` / `EKWO_PASSWORD` | The user this agent acts as |
 | `EKWO_ACCESS_TOKEN` | A session already in hand, instead of the two above |
 | `EKWO_DB_URL` | A direct Postgres connection, for a self-hosted installation |
 | `EKWO_ACT_AS_USER_ID` | Required with `EKWO_DB_URL`: the `auth.users` id to act for |
@@ -123,6 +123,75 @@ The `Dockerfile` at the root of the repository builds the same server from the
 checkout; `docker run -i --rm <image>` speaks MCP over stdio, with the variables
 passed as `-e`.
 
+## Over HTTP: hosting it for others
+
+The same server, reached by URL instead of started by a client:
+`handleHttpRequest` answers the **Streamable HTTP** transport of MCP. It is
+**stateless** — each request builds a server, answers in JSON and closes it,
+with no session id and nothing kept — so it runs on a function platform,
+behind a load balancer, or in one process. A `GET` is answered `405`: this
+server never speaks first, so there is no stream to open.
+
+What it does not do is decide who is calling. That is the host's job, and the
+whole of it: the host authenticates the request its own way, then hands in
+**the connection that request may use**.
+
+```ts
+import { handleHttpRequest } from '@ekwo-ai/mcp';
+
+export default async function (request: Request): Promise<Response> {
+  const who = await yourOwnAuthentication(request);      // a token you issued
+  if (who === undefined) return new Response(null, { status: 401 });
+  return handleHttpRequest(request, {
+    supabaseUrl: who.supabaseUrl,                         // https://<ref>.supabase.co
+    anonKey: who.publishableKey,                          // never the service_role key
+    apiKey: who.ekwoKey,                                  // or: accessToken: who.session
+  });
+}
+```
+
+A connection is one of two things, never both:
+
+- **A person's access token** on the instance. Row level security decides,
+  exactly as for that person in a browser.
+- **A key of Ekwo OS**, as `create_api_key()` issues it. It travels in the
+  `X-Ekwo-Api-Key` header with no `Authorization` beside it, the schema's
+  pre-request hook presents it (decision
+  [0062](../../docs/decisions/0062-a-key-reaches-the-api.md)), and the caller
+  is on that key's one company with that key's capabilities. A key issued
+  without a capability that writes gives an agent that reads.
+
+A `service_role` key is refused in all three slots, as on stdio. For
+`node:http` (or anything built on it), `handleNodeRequest(req, res,
+connection, { origin })` is the same handler.
+
+### Putting it in front of people: authorization
+
+A remote MCP client — Claude and the others — expects the server to follow
+the [authorization part of the MCP
+specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization):
+OAuth 2.1 with PKCE. That belongs to the host, not to this package, and a
+host that wants the clients to connect on their own serves:
+
+1. **`401` with `WWW-Authenticate: Bearer resource_metadata="…"`** on the MCP
+   endpoint when there is no valid token.
+2. **Protected resource metadata** (RFC 9728) at
+   `/.well-known/oauth-protected-resource`, naming the endpoint as the
+   `resource` and the authorization server.
+3. **Authorization server metadata** (RFC 8414) at
+   `/.well-known/oauth-authorization-server`, with `S256` in
+   `code_challenge_methods_supported`.
+4. **Dynamic client registration** (RFC 7591), or client metadata documents,
+   so a client registers itself.
+5. **An authorization page** where the person signs in the host's way and
+   chooses what the client may reach; then a token endpoint that issues short
+   access tokens and rotating refresh tokens.
+
+Each access token the host issues maps to a connection — for instance to a
+key of Ekwo OS the person issued on their own installation for this purpose,
+held by the host encrypted and opened in memory for the one request. The
+database stays the only place that decides what may be read or written.
+
 ## The tools
 
 Every write names its company explicitly.

package/dist/bin.js

@@ -45,7 +45,7 @@ in claude_desktop_config.json or .mcp.json with:
 
   SUPABASE_URL            https://<ref>.supabase.co
   SUPABASE_ANON_KEY       the anon (publishable) key — never the service_role key
-  EKWO_EMAIL              the user this assistant acts as
+  EKWO_EMAIL              the user this agent acts as
   EKWO_PASSWORD           their password
   EKWO_ACCESS_TOKEN       an access token, instead of the two above
 

package/dist/columns.d.ts

@@ -0,0 +1,59 @@
+/**
+ * What each tool reads back, written once.
+ *
+ * Two rules run through every list. A `numeric` column is asked for as
+ * `amount::text`, so the exact decimal arrives rather than a float; a `date`
+ * or a timestamp likewise, so `2026-06-15` is a string on both routes instead
+ * of whatever a driver decided a date object should be. Everything else —
+ * uuid, text, boolean, integer — crosses unchanged.
+ */
+export declare const COMPANY: string[];
+export declare const FISCAL_YEAR: string[];
+export declare const ACCOUNT: string[];
+export declare const JOURNAL: string[];
+export declare const CONTACT: string[];
+export declare const TAX: string[];
+export declare const DOCUMENT: string[];
+/**
+ * The mentions the law of a country puts on one document, from the view that
+ * decides which of them apply. `text_i18n` crosses as it is: a renderer picks
+ * the language, and the server has no business choosing one.
+ */
+export declare const DOCUMENT_LEGAL_MENTION: string[];
+/**
+ * What the country of a document requires of it, beside the mentions: the
+ * payment term the law sets, how the number is built, when the tax falls due
+ * and how the document is exchanged. Read from `country_defaults`, which
+ * holds null wherever the pack has said nothing — and null is the answer, not
+ * an invitation to substitute another country's.
+ */
+export declare const COUNTRY_DOCUMENT_RULES: string[];
+/**
+ * The header of a document, from the view that assembles it: the seller, the
+ * buyer, the amounts, where it is paid and what the country of the document
+ * requires. `document_line_items` is the lines and `document_legal_mentions`
+ * the sentences — three reads, and no client holding a copy of the
+ * letterhead.
+ */
+export declare const DOCUMENT_HEADER: string[];
+export declare const PRODUCT: string[];
+export declare const DOCUMENT_LINE: string[];
+export declare const ENTRY: string[];
+export declare const ENTRY_LINE: string[];
+export declare const BANK_ACCOUNT: string[];
+export declare const BANK_TRANSACTION: string[];
+export declare const PAYMENT: string[];
+/**
+ * An invitation, without its secret. `token_hash` is deliberately absent: it
+ * is of no use to a client, and a list of hashes is a thing to leak rather
+ * than a thing to show.
+ */
+/** What one person chose for themselves. Null everywhere is the fresh state. */
+export declare const USER_PREFERENCES: string[];
+export declare const INVITATION: string[];
+/** A machine key, without its hash. The secret is returned once, elsewhere. */
+export declare const API_KEY: string[];
+export declare const INSTANCE: string[];
+export declare const RECONCILIATION: string[];
+export declare const AUDIT_LOG: string[];
+//# sourceMappingURL=columns.d.ts.map

package/dist/columns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"columns.d.ts","sourceRoot":"","sources":["../src/columns.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,OAAO,UAqCnB,CAAC;AAEF,eAAO,MAAM,WAAW,UAAoE,CAAC;AAE7F,eAAO,MAAM,OAAO,UASnB,CAAC;AAEF,eAAO,MAAM,OAAO,UAAmD,CAAC;AAExE,eAAO,MAAM,OAAO,UAYnB,CAAC;AAEF,eAAO,MAAM,GAAG,UAsBf,CAAC;AAEF,eAAO,MAAM,QAAQ,UAqBpB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,UAOlC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,UAWlC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,UAmE3B,CAAC;AAEF,eAAO,MAAM,OAAO,UAgBnB,CAAC;AAEF,eAAO,MAAM,aAAa,UAiBzB,CAAC;AAEF,eAAO,MAAM,KAAK,UAejB,CAAC;AAEF,eAAO,MAAM,UAAU,UAsBtB,CAAC;AAEF,eAAO,MAAM,YAAY,UAUxB,CAAC;AAEF,eAAO,MAAM,gBAAgB,UAiB5B,CAAC;AAEF,eAAO,MAAM,OAAO,UAcnB,CAAC;AAEF;;;;GAIG;AACH,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,UAS5B,CAAC;AAEF,eAAO,MAAM,UAAU,UAYtB,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,OAAO,UAWnB,CAAC;AAEF,eAAO,MAAM,QAAQ,UAQpB,CAAC;AAEF,eAAO,MAAM,cAAc,UAa1B,CAAC;AAEF,eAAO,MAAM,SAAS,UAarB,CAAC"}

package/dist/columns.js

@@ -0,0 +1,422 @@
+/**
+ * What each tool reads back, written once.
+ *
+ * Two rules run through every list. A `numeric` column is asked for as
+ * `amount::text`, so the exact decimal arrives rather than a float; a `date`
+ * or a timestamp likewise, so `2026-06-15` is a string on both routes instead
+ * of whatever a driver decided a date object should be. Everything else —
+ * uuid, text, boolean, integer — crosses unchanged.
+ */
+export const COMPANY = [
+    'id',
+    'name',
+    'trade_name',
+    'legal_name',
+    'legal_form',
+    'country',
+    'fiscal_country',
+    'vat_number',
+    'registration_number',
+    'address_line1',
+    'address_line2',
+    'postal_code',
+    'city',
+    'country',
+    'region',
+    'email',
+    'phone',
+    'website',
+    'logo_url',
+    'share_capital::text',
+    'share_capital_currency',
+    'activity_code',
+    'activity_scheme',
+    'document_template',
+    'default_bank_account_id',
+    'language',
+    'currency_code',
+    'lock_date::text',
+    'tax_lock_date::text',
+    'receivable_account_id',
+    'payable_account_id',
+    'suspense_account_id',
+    'retained_earnings_account_id',
+    'sales_journal_id',
+    'purchase_journal_id',
+    'miscellaneous_journal_id',
+];
+export const FISCAL_YEAR = ['id', 'name', 'start_date::text', 'end_date::text', 'is_closed'];
+export const ACCOUNT = [
+    'id',
+    'code',
+    'name',
+    'account_type',
+    'internal_group',
+    'reconcilable',
+    'currency_code',
+    'deprecated',
+];
+export const JOURNAL = ['id', 'code', 'name', 'journal_type', 'active'];
+export const CONTACT = [
+    'id',
+    'name',
+    'contact_type',
+    'vat_number',
+    'auxiliary_code',
+    'email',
+    'country',
+    'payment_terms_days',
+    'receivable_account_id',
+    'payable_account_id',
+    'active',
+];
+export const TAX = [
+    'id',
+    'code',
+    'name',
+    'amount::text',
+    'amount_type',
+    'applies_to',
+    'treatment',
+    'vat_category',
+    'valid_from::text',
+    'valid_to::text',
+    'legal_reference',
+    // The generalised engine. `tax_kind` and `jurisdiction` say what a tax is
+    // where the code alone would have to be guessed at; `recoverable` and
+    // `price_include` change what a client should show; `cash_basis` is here so
+    // a reader is not surprised by it once cash-basis VAT starts writing it.
+    'tax_kind',
+    'recoverable',
+    'jurisdiction',
+    'price_include',
+    'cash_basis',
+    'active',
+];
+export const DOCUMENT = [
+    'id',
+    'company_id',
+    'doc_type',
+    'state',
+    'payment_state',
+    'number',
+    'supplier_reference',
+    'contact_id',
+    'journal_id',
+    'document_date::text',
+    'accounting_date::text',
+    'due_date::text',
+    'currency_code',
+    'amount_untaxed::text',
+    'amount_tax::text',
+    'amount_total::text',
+    'amount_paid::text',
+    'amount_residual::text',
+    'entry_id',
+    'sent_at::text',
+];
+/**
+ * The mentions the law of a country puts on one document, from the view that
+ * decides which of them apply. `text_i18n` crosses as it is: a renderer picks
+ * the language, and the server has no business choosing one.
+ */
+export const DOCUMENT_LEGAL_MENTION = [
+    'code',
+    'applies_when',
+    'text',
+    'text_i18n',
+    'sequence',
+    'legal_reference',
+];
+/**
+ * What the country of a document requires of it, beside the mentions: the
+ * payment term the law sets, how the number is built, when the tax falls due
+ * and how the document is exchanged. Read from `country_defaults`, which
+ * holds null wherever the pack has said nothing — and null is the answer, not
+ * an invitation to substitute another country's.
+ */
+export const COUNTRY_DOCUMENT_RULES = [
+    'country',
+    'numbering_gapless',
+    'number_format',
+    'legal_payment_days',
+    'late_payment_reference',
+    'tax_point_rule',
+    'einvoice_profile',
+    'einvoice_mandatory_from::text',
+    'party_scheme',
+    'vat_scheme',
+];
+/**
+ * The header of a document, from the view that assembles it: the seller, the
+ * buyer, the amounts, where it is paid and what the country of the document
+ * requires. `document_line_items` is the lines and `document_legal_mentions`
+ * the sentences — three reads, and no client holding a copy of the
+ * letterhead.
+ */
+export const DOCUMENT_HEADER = [
+    'document_id',
+    'company_id',
+    'doc_type',
+    'state',
+    'payment_state',
+    'number',
+    'supplier_reference',
+    'document_date::text',
+    'accounting_date::text',
+    'due_date::text',
+    'delivery_date::text',
+    'currency_code',
+    'amount_untaxed::text',
+    'amount_tax::text',
+    'amount_total::text',
+    'amount_paid::text',
+    'amount_residual::text',
+    'payment_terms',
+    'payment_means_code',
+    'payment_reference',
+    'buyer_reference',
+    'order_reference',
+    'contract_reference',
+    'project_reference',
+    'note',
+    'payee_iban',
+    'payee_bic',
+    'seller_name',
+    'seller_legal_name',
+    'seller_legal_form',
+    'seller_vat_number',
+    'seller_registration_number',
+    'seller_address_line1',
+    'seller_address_line2',
+    'seller_postal_code',
+    'seller_city',
+    'seller_country',
+    'seller_email',
+    'seller_phone',
+    'seller_website',
+    'seller_logo_url',
+    'seller_share_capital::text',
+    'seller_share_capital_currency',
+    'seller_activity_code',
+    'seller_activity_scheme',
+    'document_template',
+    'buyer_id',
+    'buyer_name',
+    'buyer_vat_number',
+    'buyer_registration_number',
+    'buyer_address_line1',
+    'buyer_address_line2',
+    'buyer_postal_code',
+    'buyer_city',
+    'buyer_country',
+    'buyer_email',
+    'country',
+    'number_format',
+    'numbering_gapless',
+    'legal_payment_days',
+    'late_payment_reference',
+    'tax_point_rule',
+    'einvoice_profile',
+    'einvoice_mandatory_from::text',
+    'party_scheme',
+    'vat_scheme',
+];
+export const PRODUCT = [
+    'id',
+    'company_id',
+    'code',
+    'name',
+    'description',
+    'kind',
+    'unit_code',
+    'currency_code',
+    'sale_price::text',
+    'purchase_price::text',
+    'sale_account_id',
+    'purchase_account_id',
+    'sale_tax_id',
+    'purchase_tax_id',
+    'active',
+];
+export const DOCUMENT_LINE = [
+    'id',
+    'document_id',
+    'sequence',
+    'line_type',
+    'name',
+    'description',
+    'product_id',
+    'quantity::text',
+    'unit_code',
+    'unit_price::text',
+    'discount_percent::text',
+    'tax_id',
+    'account_id',
+    'vat_category',
+    'vat_rate::text',
+    'amount_untaxed::text',
+];
+export const ENTRY = [
+    'id',
+    'company_id',
+    'journal_id',
+    'number',
+    'entry_date::text',
+    'reference',
+    'description',
+    'state',
+    'kind',
+    'document_id',
+    'total_debit::text',
+    'total_credit::text',
+    'is_balanced',
+    'posted_at::text',
+];
+export const ENTRY_LINE = [
+    'id',
+    'entry_id',
+    'account_id',
+    'sequence',
+    'name',
+    'debit::text',
+    'credit::text',
+    'balance::text',
+    'contact_id',
+    'date_maturity::text',
+    'tax_id',
+    'tax_line',
+    'declaration_box',
+    'box_amount::text',
+    'matching_number',
+    'matched_amount::text',
+    // The currency of the line and its amount in it, written whenever that
+    // currency is not the company's. A client matching two foreign lines needs
+    // both: that is the scale the matching is worked out on.
+    'currency_code',
+    'amount_currency::text',
+];
+export const BANK_ACCOUNT = [
+    'id',
+    'name',
+    'iban',
+    'bic',
+    'bank_name',
+    'currency_code',
+    'account_id',
+    'journal_id',
+    'active',
+];
+export const BANK_TRANSACTION = [
+    'id',
+    'company_id',
+    'bank_account_id',
+    'statement_id',
+    'transaction_date::text',
+    'value_date::text',
+    'amount::text',
+    'currency_code',
+    'description',
+    'counterpart_name',
+    'counterpart_iban',
+    'reference',
+    'structured_reference',
+    'contact_id',
+    'entry_id',
+    'state',
+];
+export const PAYMENT = [
+    'id',
+    'company_id',
+    'direction',
+    'payment_date::text',
+    'amount::text',
+    'currency_code',
+    'contact_id',
+    'journal_id',
+    'bank_account_id',
+    'entry_id',
+    'reference',
+    'memo',
+    'state',
+];
+/**
+ * An invitation, without its secret. `token_hash` is deliberately absent: it
+ * is of no use to a client, and a list of hashes is a thing to leak rather
+ * than a thing to show.
+ */
+/** What one person chose for themselves. Null everywhere is the fresh state. */
+export const USER_PREFERENCES = [
+    'user_id',
+    'preferred_company_id',
+    'language',
+    'timezone',
+    'date_display_format',
+    'number_display_format',
+    'theme',
+    'updated_at::text',
+];
+export const INVITATION = [
+    'id',
+    'company_id',
+    'email',
+    'role',
+    'capabilities_granted',
+    'invited_by',
+    'created_at::text',
+    'expires_at::text',
+    'accepted_at::text',
+    'accepted_by',
+    'revoked_at::text',
+];
+/** A machine key, without its hash. The secret is returned once, elsewhere. */
+export const API_KEY = [
+    'id',
+    'company_id',
+    'name',
+    'prefix',
+    'capabilities',
+    'created_by',
+    'created_at::text',
+    'expires_at::text',
+    'last_used_at::text',
+    'revoked_at::text',
+];
+export const INSTANCE = [
+    'instance_id',
+    'organization_name',
+    'country',
+    'edition',
+    'schema_version',
+    'installed_at::text',
+    'registered_at::text',
+];
+export const RECONCILIATION = [
+    'id',
+    'debit_line_id',
+    'credit_line_id',
+    'amount::text',
+    'matching_number',
+    'matched_at::text',
+    // What the matching revealed, when it revealed something: the entry that
+    // booked the realised exchange difference, and the one that moved the share
+    // of a cash-basis tax the settlement made due. A client that shows a
+    // matching shows what it caused.
+    'fx_entry_id',
+    'tax_transfer_entry_id',
+];
+export const AUDIT_LOG = [
+    'id',
+    'occurred_at::text',
+    'actor_id',
+    'api_key_id',
+    'company_id',
+    'table_name',
+    'record_id',
+    'record_key',
+    'operation',
+    'action',
+    'old_values',
+    'new_values',
+];
+//# sourceMappingURL=columns.js.map

package/dist/columns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"columns.js","sourceRoot":"","sources":["../src/columns.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,IAAI;IACJ,MAAM;IACN,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,gBAAgB;IAChB,YAAY;IACZ,qBAAqB;IACrB,eAAe;IACf,eAAe;IACf,aAAa;IACb,MAAM;IACN,SAAS;IACT,QAAQ;IACR,OAAO;IACP,OAAO;IACP,SAAS;IACT,UAAU;IACV,qBAAqB;IACrB,wBAAwB;IACxB,eAAe;IACf,iBAAiB;IACjB,mBAAmB;IACnB,yBAAyB;IACzB,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,qBAAqB;IACrB,uBAAuB;IACvB,oBAAoB;IACpB,qBAAqB;IACrB,8BAA8B;IAC9B,kBAAkB;IAClB,qBAAqB;IACrB,0BAA0B;CAC3B,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAE7F,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,IAAI;IACJ,MAAM;IACN,MAAM;IACN,cAAc;IACd,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,YAAY;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,IAAI;IACJ,MAAM;IACN,cAAc;IACd,YAAY;IACZ,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,oBAAoB;IACpB,uBAAuB;IACvB,oBAAoB;IACpB,QAAQ;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,IAAI;IACJ,MAAM;IACN,MAAM;IACN,cAAc;IACd,aAAa;IACb,YAAY;IACZ,WAAW;IACX,cAAc;IACd,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,0EAA0E;IAC1E,sEAAsE;IACtE,4EAA4E;IAC5E,yEAAyE;IACzE,UAAU;IACV,aAAa;IACb,cAAc;IACd,eAAe;IACf,YAAY;IACZ,QAAQ;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,IAAI;IACJ,YAAY;IACZ,UAAU;IACV,OAAO;IACP,eAAe;IACf,QAAQ;IACR,oBAAoB;IACpB,YAAY;IACZ,YAAY;IACZ,qBAAqB;IACrB,uBAAuB;IACvB,gBAAgB;IAChB,eAAe;IACf,sBAAsB;IACtB,kBAAkB;IAClB,oBAAoB;IACpB,mBAAmB;IACnB,uBAAuB;IACvB,UAAU;IACV,eAAe;CAChB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,MAAM;IACN,cAAc;IACd,MAAM;IACN,WAAW;IACX,UAAU;IACV,iBAAiB;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,SAAS;IACT,mBAAmB;IACnB,eAAe;IACf,oBAAoB;IACpB,wBAAwB;IACxB,gBAAgB;IAChB,kBAAkB;IAClB,+BAA+B;IAC/B,cAAc;IACd,YAAY;CACb,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,aAAa;IACb,YAAY;IACZ,UAAU;IACV,OAAO;IACP,eAAe;IACf,QAAQ;IACR,oBAAoB;IACpB,qBAAqB;IACrB,uBAAuB;IACvB,gBAAgB;IAChB,qBAAqB;IACrB,eAAe;IACf,sBAAsB;IACtB,kBAAkB;IAClB,oBAAoB;IACpB,mBAAmB;IACnB,uBAAuB;IACvB,eAAe;IACf,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;IACnB,MAAM;IACN,YAAY;IACZ,WAAW;IACX,aAAa;IACb,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,4BAA4B;IAC5B,sBAAsB;IACtB,sBAAsB;IACtB,oBAAoB;IACpB,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,4BAA4B;IAC5B,+BAA+B;IAC/B,sBAAsB;IACtB,wBAAwB;IACxB,mBAAmB;IACnB,UAAU;IACV,YAAY;IACZ,kBAAkB;IAClB,2BAA2B;IAC3B,qBAAqB;IACrB,qBAAqB;IACrB,mBAAmB;IACnB,YAAY;IACZ,eAAe;IACf,aAAa;IACb,SAAS;IACT,eAAe;IACf,mBAAmB;IACnB,oBAAoB;IACpB,wBAAwB;IACxB,gBAAgB;IAChB,kBAAkB;IAClB,+BAA+B;IAC/B,cAAc;IACd,YAAY;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,IAAI;IACJ,YAAY;IACZ,MAAM;IACN,MAAM;IACN,aAAa;IACb,MAAM;IACN,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,sBAAsB;IACtB,iBAAiB;IACjB,qBAAqB;IACrB,aAAa;IACb,iBAAiB;IACjB,QAAQ;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI;IACJ,aAAa;IACb,UAAU;IACV,WAAW;IACX,MAAM;IACN,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,WAAW;IACX,kBAAkB;IAClB,wBAAwB;IACxB,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,sBAAsB;CACvB,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI;IACJ,YAAY;IACZ,YAAY;IACZ,QAAQ;IACR,kBAAkB;IAClB,WAAW;IACX,aAAa;IACb,OAAO;IACP,MAAM;IACN,aAAa;IACb,mBAAmB;IACnB,oBAAoB;IACpB,aAAa;IACb,iBAAiB;CAClB,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI;IACJ,UAAU;IACV,YAAY;IACZ,UAAU;IACV,MAAM;IACN,aAAa;IACb,cAAc;IACd,eAAe;IACf,YAAY;IACZ,qBAAqB;IACrB,QAAQ;IACR,UAAU;IACV,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,sBAAsB;IACtB,uEAAuE;IACvE,2EAA2E;IAC3E,yDAAyD;IACzD,eAAe;IACf,uBAAuB;CACxB,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI;IACJ,MAAM;IACN,MAAM;IACN,KAAK;IACL,WAAW;IACX,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,QAAQ;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,IAAI;IACJ,YAAY;IACZ,iBAAiB;IACjB,cAAc;IACd,wBAAwB;IACxB,kBAAkB;IAClB,cAAc;IACd,eAAe;IACf,aAAa;IACb,kBAAkB;IAClB,kBAAkB;IAClB,WAAW;IACX,sBAAsB;IACtB,YAAY;IACZ,UAAU;IACV,OAAO;CACR,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,IAAI;IACJ,YAAY;IACZ,WAAW;IACX,oBAAoB;IACpB,cAAc;IACd,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,WAAW;IACX,MAAM;IACN,OAAO;CACR,CAAC;AAEF;;;;GAIG;AACH,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,SAAS;IACT,sBAAsB;IACtB,UAAU;IACV,UAAU;IACV,qBAAqB;IACrB,uBAAuB;IACvB,OAAO;IACP,kBAAkB;CACnB,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI;IACJ,YAAY;IACZ,OAAO;IACP,MAAM;IACN,sBAAsB;IACtB,YAAY;IACZ,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,aAAa;IACb,kBAAkB;CACnB,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,IAAI;IACJ,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,cAAc;IACd,YAAY;IACZ,kBAAkB;IAClB,kBAAkB;IAClB,oBAAoB;IACpB,kBAAkB;CACnB,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,aAAa;IACb,mBAAmB;IACnB,SAAS;IACT,SAAS;IACT,gBAAgB;IAChB,oBAAoB;IACpB,qBAAqB;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,IAAI;IACJ,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,kBAAkB;IAClB,yEAAyE;IACzE,4EAA4E;IAC5E,qEAAqE;IACrE,iCAAiC;IACjC,aAAa;IACb,uBAAuB;CACxB,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI;IACJ,mBAAmB;IACnB,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,YAAY;CACb,CAAC"}

package/dist/config.d.ts

@@ -11,7 +11,7 @@
  *
  * The one thing this file exists to refuse is a `service_role` key. It would
  * work — that is the problem. Every policy in the schema would be bypassed,
- * and an assistant that can read every company of an installation is not the
+ * and an agent that can read every company of an installation is not the
  * thing anybody asked for. It is refused wherever it can arrive, and there are
  * two doors, not one: `SUPABASE_ANON_KEY` is the obvious paste, and
  * `EKWO_ACCESS_TOKEN` is the quiet one — it goes into the `Authorization`

package/dist/config.js

@@ -11,7 +11,7 @@
  *
  * The one thing this file exists to refuse is a `service_role` key. It would
  * work — that is the problem. Every policy in the schema would be bypassed,
- * and an assistant that can read every company of an installation is not the
+ * and an agent that can read every company of an installation is not the
  * thing anybody asked for. It is refused wherever it can arrive, and there are
  * two doors, not one: `SUPABASE_ANON_KEY` is the obvious paste, and
  * `EKWO_ACCESS_TOKEN` is the quiet one — it goes into the `Authorization`

package/dist/format.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Amounts as decimal strings, everywhere, in both directions.
+ *
+ * Postgres holds `numeric` exactly and hands it over as text; a table read
+ * asks for `amount::text` so that is what arrives. The one place a float can
+ * appear is a function result crossing PostgREST as JSON, where `1210.00`
+ * becomes a number before any code of ours sees it. `money()` puts it back to
+ * two decimals, which is exact for every amount a ledger holds, and a model
+ * reading `"1210.00"` never has to wonder whether `1210.0000000001` was the
+ * VAT rounding or the transport.
+ */
+export type Decimal = string;
+/** A numeric, as the decimal string the ledger holds. */
+export declare function money(value: unknown): Decimal | null;
+/** The same, for a quantity or a rate, where two decimals would be a lie. */
+export declare function decimal(value: unknown): Decimal | null;
+/** Applies `money()` to the named keys of every row. */
+export declare function moneyFields<T extends Record<string, unknown>>(rows: T[], keys: string[]): T[];
+/** An amount on its way into the database: `"1210.00"`, never 1210.0000001. */
+export declare function amountIn(value: string | number): string;
+//# sourceMappingURL=format.d.ts.map

package/dist/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../src/format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,yDAAyD;AACzD,wBAAgB,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAKpD;AAED,6EAA6E;AAC7E,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAItD;AAED,wDAAwD;AACxD,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAQ7F;AAED,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAMvD"}