@ericrisco/rsc 3.7.3 → 3.7.5

package/skills/connect-tool/bridge-kit/sqlserver/01-login-servidor.sql

@@ -0,0 +1,25 @@
+/*
+  Kit puente · 01 · Login de solo lectura (nivel de SERVIDOR). Se ejecuta UNA vez.
+
+  Quién: el informático, con un usuario administrador de SQL Server.
+  Antes: confirma con el distribuidor del programa (Sage, ICG, Prevengos, CONTPAQi,
+  Wolters Kluwer…) que crear un login y vistas no afecta al soporte. Pídelo por escrito.
+
+  Requisito: el servidor debe admitir autenticación de SQL Server (modo mixto).
+  Si solo admite Windows, usa una cuenta de Windows dedicada en lugar de este login.
+
+  La contraseña NO se guarda en ningún repositorio: genérala larga y aleatoria y
+  guárdala solo en el dbhub.toml protegido del servidor (ver ../dbhub/).
+*/
+USE [master];
+GO
+
+IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = N'ia_lectura')
+    CREATE LOGIN [ia_lectura]
+        WITH PASSWORD = N'<<PON AQUÍ UNA CONTRASEÑA LARGA Y ALEATORIA>>',
+             CHECK_POLICY = ON,
+             DEFAULT_DATABASE = [master];
+GO
+
+-- Nada de roles de servidor: ia_lectura NO es sysadmin, ni securityadmin, ni nada más.
+-- Los permisos se dan en la base de datos con 02-usuario-y-vistas.sql.

package/skills/connect-tool/bridge-kit/sqlserver/02-usuario-y-vistas.sql

@@ -0,0 +1,69 @@
+/*
+  Kit puente · 02 · Usuario, esquema "ia" y vistas (nivel de BASE DE DATOS).
+
+  Se ejecuta en la base que lee el agente. Por defecto es la COPIA "ERP_IA".
+  Es IDEMPOTENTE: copia-nocturna.ps1 lo vuelve a lanzar después de cada restauración,
+  porque restaurar la copia borra el usuario, el esquema y las vistas.
+
+  Las vistas son PLANTILLAS: los nombres de tablas y columnas dependen del programa
+  y de su versión. Complétalos con el distribuidor o con la documentación del esquema.
+  Regla: solo las columnas necesarias. Sin IBAN, sin datos de salud, sin nóminas.
+*/
+-- Cambia el nombre si no usas la copia:
+USE [ERP_IA];
+GO
+
+IF NOT EXISTS (SELECT 1 FROM sys.schemas WHERE name = N'ia')
+    EXEC (N'CREATE SCHEMA [ia] AUTHORIZATION [dbo]');
+GO
+
+IF NOT EXISTS (SELECT 1 FROM sys.database_principals WHERE name = N'ia_lectura')
+    CREATE USER [ia_lectura] FOR LOGIN [ia_lectura] WITH DEFAULT_SCHEMA = [ia];
+GO
+
+-- Solo lectura sobre el esquema de vistas. Las vistas son de dbo (dueño del esquema),
+-- así que la cadena de propiedad deja leer las tablas a través de ellas sin dar
+-- permiso directo sobre las tablas.
+GRANT SELECT ON SCHEMA::[ia] TO [ia_lectura];
+ALTER ROLE [db_denydatawriter] ADD MEMBER [ia_lectura];
+DENY CREATE TABLE TO [ia_lectura];
+DENY CREATE VIEW TO [ia_lectura];
+DENY CREATE PROCEDURE TO [ia_lectura];
+DENY CREATE FUNCTION TO [ia_lectura];
+GO
+
+/* ----------------------------------------------------------------------------
+   VISTAS (plantillas). Sustituye <…> por las tablas y columnas reales.
+   Una vista por "pregunta de negocio". DBHub expone cada una como herramienta.
+---------------------------------------------------------------------------- */
+
+CREATE OR ALTER VIEW [ia].[ventas_por_dia] AS
+SELECT
+    CAST(f.<columna_fecha> AS date)       AS fecha,
+    SUM(f.<columna_base_imponible>)       AS base_imponible,
+    COUNT(*)                              AS facturas
+FROM [dbo].[<tabla_facturas_emitidas>] AS f
+GROUP BY CAST(f.<columna_fecha> AS date);
+GO
+
+CREATE OR ALTER VIEW [ia].[cobros_pendientes] AS
+SELECT
+    c.<columna_codigo_cliente>            AS cliente,
+    c.<columna_nombre_cliente>            AS nombre,
+    v.<columna_vencimiento>               AS vencimiento,
+    v.<columna_importe_pendiente>         AS pendiente
+FROM [dbo].[<tabla_vencimientos>] AS v
+JOIN [dbo].[<tabla_clientes>]     AS c ON c.<columna_codigo_cliente> = v.<columna_codigo_cliente>
+WHERE v.<columna_importe_pendiente> > 0;
+GO
+
+CREATE OR ALTER VIEW [ia].[stock_bajo_minimos] AS
+SELECT
+    a.<columna_codigo_articulo>           AS articulo,
+    a.<columna_descripcion>               AS descripcion,
+    s.<columna_stock>                     AS stock,
+    a.<columna_stock_minimo>              AS minimo
+FROM [dbo].[<tabla_articulos>] AS a
+JOIN [dbo].[<tabla_stock>]     AS s ON s.<columna_codigo_articulo> = a.<columna_codigo_articulo>
+WHERE s.<columna_stock> < a.<columna_stock_minimo>;
+GO

package/skills/connect-tool/bridge-kit/sqlserver/03-prueba-solo-lectura.sql

@@ -0,0 +1,65 @@
+/*
+  Kit puente · 03 · Prueba de aceptación: ia_lectura LEE y NO ESCRIBE.
+
+  Sin esta prueba el puente no se entrega. Se ejecuta como administrador; el script
+  se hace pasar por ia_lectura (EXECUTE AS) y todo va dentro de una transacción
+  que se deshace al final, así que no cambia nada aunque algo fallara.
+
+  Sustituye <tabla_facturas_emitidas> por una tabla real del programa.
+  DELETE/UPDATE con TOP (0) no tocan ninguna fila, pero SQL Server comprueba igualmente
+  el permiso: si ia_lectura lo tuviera, la prueba lo detecta.
+*/
+USE [ERP_IA];
+GO
+
+BEGIN TRANSACTION;
+EXECUTE AS USER = N'ia_lectura';
+
+DECLARE @fallos int = 0;
+
+BEGIN TRY
+    SELECT TOP (1) * FROM [ia].[ventas_por_dia];
+    PRINT N'OK    · puede leer las vistas del esquema ia';
+END TRY
+BEGIN CATCH
+    SET @fallos += 1; PRINT N'FALLO · no puede leer ia.ventas_por_dia: ' + ERROR_MESSAGE();
+END CATCH;
+
+BEGIN TRY
+    SELECT TOP (1) * FROM [dbo].[<tabla_facturas_emitidas>];
+    SET @fallos += 1; PRINT N'FALLO · puede leer las tablas directamente (solo debería ver el esquema ia)';
+END TRY
+BEGIN CATCH
+    PRINT N'OK    · no puede leer las tablas directamente';
+END CATCH;
+
+BEGIN TRY
+    DELETE TOP (0) FROM [dbo].[<tabla_facturas_emitidas>];
+    SET @fallos += 1; PRINT N'FALLO · tiene permiso de DELETE';
+END TRY
+BEGIN CATCH
+    PRINT N'OK    · no puede borrar';
+END CATCH;
+
+BEGIN TRY
+    UPDATE TOP (0) [dbo].[<tabla_facturas_emitidas>] SET <columna_fecha> = <columna_fecha>;
+    SET @fallos += 1; PRINT N'FALLO · tiene permiso de UPDATE';
+END TRY
+BEGIN CATCH
+    PRINT N'OK    · no puede modificar';
+END CATCH;
+
+BEGIN TRY
+    EXEC (N'CREATE TABLE [ia].[prueba_escritura] (x int)');
+    SET @fallos += 1; PRINT N'FALLO · puede crear tablas';
+END TRY
+BEGIN CATCH
+    PRINT N'OK    · no puede crear tablas';
+END CATCH;
+
+REVERT;
+ROLLBACK TRANSACTION;
+
+IF @fallos = 0 PRINT N'RESULTADO: OK — ia_lectura es de solo lectura.';
+ELSE PRINT N'RESULTADO: REVISAR — hay ' + CAST(@fallos AS nvarchar(10)) + N' fallos. No conectes el agente.';
+GO

package/skills/connect-tool/bridge-kit/sqlserver/copia-nocturna.ps1

@@ -0,0 +1,68 @@
+<#
+  Kit puente · Copia nocturna de la base del programa a "ERP_IA" (SQL Server, Express incluido).
+
+  Qué hace, en este orden:
+    1. BACKUP ... WITH COPY_ONLY de la base de producción. COPY_ONLY no rompe la cadena
+       de copias del programa.
+    2. RESTORE en ERP_IA (la sobrescribe), moviendo los ficheros a la carpeta de datos.
+    3. Vuelve a crear el usuario, el esquema "ia" y las vistas con 02-usuario-y-vistas.sql,
+       porque la restauración los borra.
+    4. Pasa la prueba de solo lectura (03-prueba-solo-lectura.sql) y deja un registro.
+
+  SQL Server Express no tiene SQL Server Agent: se programa con el Programador de tareas
+  de Windows (ver el README del kit). Se ejecuta con una cuenta de Windows que sea
+  administradora de SQL Server, NUNCA con ia_lectura.
+
+  Uso:
+    powershell -ExecutionPolicy Bypass -File copia-nocturna.ps1 -Origen "<BD_DEL_PROGRAMA>"
+#>
+param(
+    [Parameter(Mandatory = $true)][string]$Origen,
+    [string]$Servidor = ".\SQLEXPRESS",
+    [string]$Copia = "ERP_IA",
+    [string]$CarpetaBackup = "C:\KitPuente\backups",
+    [string]$CarpetaDatos = "C:\KitPuente\datos",
+    [string]$CarpetaScripts = $PSScriptRoot,
+    [int]$DiasRetencion = 3
+)
+$ErrorActionPreference = "Stop"
+New-Item -ItemType Directory -Force -Path $CarpetaBackup, $CarpetaDatos | Out-Null
+$registro = Join-Path $CarpetaBackup "copia-nocturna.log"
+function Log($texto) { "$(Get-Date -Format s)  $texto" | Tee-Object -FilePath $registro -Append }
+
+$bak = Join-Path $CarpetaBackup ("{0}-{1}.bak" -f $Origen, (Get-Date -Format yyyyMMdd))
+Log "Backup de [$Origen] a $bak"
+sqlcmd -S $Servidor -E -b -Q "BACKUP DATABASE [$Origen] TO DISK = N'$bak' WITH COPY_ONLY, INIT, CHECKSUM"
+if ($LASTEXITCODE -ne 0) { Log "ERROR en el backup"; exit 1 }
+
+# Nombres lógicos de los ficheros para el MOVE.
+$lista = sqlcmd -S $Servidor -E -b -h -1 -W -s "|" -Q "SET NOCOUNT ON; RESTORE FILELISTONLY FROM DISK = N'$bak'"
+$moves = @()
+foreach ($linea in $lista) {
+    $campos = $linea -split "\|"
+    if ($campos.Count -lt 3) { continue }
+    $logico = $campos[0].Trim(); $tipo = $campos[2].Trim()
+    $ext = if ($tipo -eq "L") { "ldf" } else { "mdf" }
+    $moves += "MOVE N'$logico' TO N'$(Join-Path $CarpetaDatos "$Copia-$logico.$ext")'"
+}
+if ($moves.Count -eq 0) { Log "ERROR: no se han leído los ficheros del backup"; exit 1 }
+
+Log "Restaurando en [$Copia]"
+$restore = "IF DB_ID(N'$Copia') IS NOT NULL ALTER DATABASE [$Copia] SET SINGLE_USER WITH ROLLBACK IMMEDIATE; " +
+           "RESTORE DATABASE [$Copia] FROM DISK = N'$bak' WITH REPLACE, RECOVERY, " + ($moves -join ", ") + "; " +
+           "ALTER DATABASE [$Copia] SET MULTI_USER;"
+sqlcmd -S $Servidor -E -b -Q $restore
+if ($LASTEXITCODE -ne 0) { Log "ERROR en la restauración"; exit 1 }
+
+Log "Usuario, esquema ia y vistas"
+sqlcmd -S $Servidor -E -b -d $Copia -i (Join-Path $CarpetaScripts "02-usuario-y-vistas.sql")
+if ($LASTEXITCODE -ne 0) { Log "ERROR al crear usuario o vistas"; exit 1 }
+
+Log "Prueba de solo lectura"
+$prueba = sqlcmd -S $Servidor -E -b -d $Copia -i (Join-Path $CarpetaScripts "03-prueba-solo-lectura.sql")
+$prueba | ForEach-Object { Log $_ }
+if (-not ($prueba -match "RESULTADO: OK")) { Log "ERROR: la prueba de solo lectura no ha dado OK"; exit 1 }
+
+Get-ChildItem $CarpetaBackup -Filter "$Origen-*.bak" |
+    Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-$DiasRetencion) } | Remove-Item -Force
+Log "OK — copia lista en [$Copia]"

package/skills/connect-tool/evals/cases.yaml

@@ -1,9 +1,11 @@
 skill: connect-tool
 
 # Cases for connect-tool: the user names ONE tool to connect to the agent. The skill researches the
-# vendor's real docs, picks the least dangerous route (MCP, API, integration, export, read-only copy
-# of the database, RPA last), builds 01-TOOLS/<TOOL>/ with a test that proves it (and proves writes
-# fail when read-only), guides the user and records it in 02-DOCS. It is NOT the typed API client
+# vendor's real docs FIRST, picks the least dangerous route (MCP, API, integration, vendor module,
+# file exchange, read-only copy of the database; never RPA or scraping), builds 01-TOOLS/<TOOL>/ with
+# a test that proves it (and proves writes fail when read-only), guides the user and records it in
+# 02-DOCS. Only when nothing is documented does it take option 2: diagnose the program in
+# conversation, find who holds the key, and keep going. It is NOT the typed API client
 # (api-connector-builder), NOT the whole-workspace scan (harness), NOT whether to automate a process
 # (automation-strategy), NOT chaining services (automation-flows).
 
@@ -24,7 +26,10 @@ should_trigger:
     why: "A legacy file database. Copy the .mdb/.accdb, read it with mdbtools or convert it, and never write into the program's file."
 
   - prompt: "¿Se puede conectar InstalWin? No sé ni por dónde empezar."
-    why: "An obscure vertical program nobody has catalogued: the method (search vendor docs, export features, the database it installs) works for it, and if nothing reliable exists the skill says so."
+    why: "An obscure vertical program nobody has catalogued: the method (search vendor docs, export features, the database it installs) works for it, and if nothing reliable exists the skill says so and goes to option 2."
+
+  - prompt: "Quiero que el agente meta los asientos de las facturas de proveedores en nuestro Sage 50."
+    why: "Writing into an installed accounting program: the route is the official import file the user's program exports as a sample, validated and imported by a person into the test company first, never the database."
 
 should_not_trigger:
   - prompt: "Write a TypeScript client for the Holded API with pagination, retries and token refresh."
@@ -56,3 +61,35 @@ capability:
       - "Proposes reading a nightly copy with a SELECT-only user, reached privately, never the live database exposed to the internet"
       - "Builds 01-TOOLS/<TOOL>/ from the template with a test_connection that proves reading works AND that a write is refused, telling a permission error apart from any other failure"
       - "Explains the chosen route in plain words and records the connection in 02-DOCS"
+
+  - scenario: "A small-business owner says: 'Quiero conectar Geyce, nuestro programa de gestión de hace veinte años. No sé qué tipo de programa es ni a quién preguntar.' Research finds no public API, MCP or technical documentation. Show what the agent does."
+    must_include:
+      - "Researches first (vendor docs, MCP registry, exports and imports in the manual) and cites what it searched and the date, saying plainly that nothing reliable was found"
+      - "Only then takes option 2 and does not stop: asks the plain diagnosis questions (website login, works offline, several PCs share data, remote desktop, data-folder extensions, who they call when it breaks)"
+      - "Says which program type it looks like and how sure it is, what can be tried, and what the user must confirm"
+      - "Finds out who holds the key (distributor, IT person or accounting firm) and lists the closed questions for them: database engine, read-only user on a copy, scheduled export to a folder, whether the contract allows reading the database, cost"
+      - "Leaves the case open in 02-DOCS with what was asked, to whom and when, so another session can pick it up"
+      - "Never proposes screen automation (RPA) or scraping"
+
+  - scenario: "The user answers the diagnosis: 'Entramos al programa por un escritorio remoto que nos da el distribuidor; en la oficina no hay nada instalado.' Show what the agent concludes and proposes."
+    must_include:
+      - "Recognises a program hosted by the distributor: there is no database to copy and no folder the agent can reach"
+      - "States that the only door is the provider and does not try to reach their servers any other way"
+      - "Proposes asking the distributor for a scheduled export to a folder the client can reach, an integration module or API, or a read-only user on their side, with the cost question"
+      - "Offers the message for the distributor from the messages section, read-only and with nothing opened to the internet"
+      - "If the provider offers nothing, says the honest options are to keep asking the vendor or to weigh migrating, not RPA"
+
+  - scenario: "The user says: 'Llevamos la contabilidad en ContaSOL instalado. Quiero que el agente registre los asientos de las facturas de compra que llegan al correo.' Show the route from the first answer to the first import."
+    must_include:
+      - "Chooses file exchange for writing: the agent generates ContaSOL's official import file in 01-TOOLS/<TOOL>/out/ and a person reviews and imports it; never writes into the program's database"
+      - "Asks for a sample file exported from the user's own ContaSOL and copies its structure, instead of a remembered format"
+      - "Describes the format (columns, encoding, separator, decimal mark, dates) in the tool's README"
+      - "Validates before releasing the file: entries balance, accounts exist in the current chart, no duplicates against a batch log"
+      - "Makes the first import into the program's test company, not the real books"
+
+  - scenario: "The user says: 'Mi ERP no tiene API. ¿Podemos poner un robot que haga clic en las pantallas, o que el agente lea la web del programa?'"
+    must_include:
+      - "Declines screen automation (RPA) and scraping: they act with a person's permissions, break on every update and cannot prove they only read"
+      - "Researches the other routes first: vendor or distributor module, cloud edition with an API, scheduled export, official import file, read-only copy of the database"
+      - "If one exists, proposes it; if none exists, says so and offers asking the vendor or weighing migration with the connect-or-migrate signals"
+

package/skills/connect-tool/references/connect-or-migrate.md

@@ -0,0 +1,96 @@
+# Connect, or migrate?
+
+The agent is only as good as the data it reaches. If the main program lets nothing out (no API, no
+export, no readable database), every automation goes through copy and paste. Sometimes the answer
+is to **connect it with a bridge** (a nightly export, a read-only database user, the distributor's
+module). Sometimes it is to **migrate** to something that connects out of the box. Rarely, it is to
+**build** a replacement. Give one verdict, in one line:
+
+- **Connect as is**: a route from SKILL.md section 2 exists and is good enough.
+- **Connect with a bridge**: file exchange or a read-only copy ([database bridge](database-bridge.md)).
+- **Consider migrating**: with the sum below.
+- **Consider building**: only under the conditions below.
+
+Whether a process deserves automating at all is `automation-strategy`'s question, not this one.
+
+## Signals that the program holds you back (the more, the stronger the case to migrate)
+
+1. **No way to get data out** without a person: no API, no automatic export, no readable database.
+2. **Unsupported version**: the vendor no longer updates it, or it only runs on one office PC.
+3. **The bridge costs more than the change**: an integrator, a module or consulting hours every year
+   for what another program includes.
+4. **Daily copy and paste** between this program and others. More than 3–4 hours a week is over 150
+   hours a year.
+5. **Regulation it does not cover**: in Spain, Veri\*factu and B2B e-invoicing ([Spain](spain.md)).
+   If the vendor does not adapt it, or charges extra, the business has to move anyway.
+6. **Only one person can use it**, or the data ends up in parallel spreadsheets.
+7. **It does not grow**: more users, another site, mobile access.
+
+## Signals not to migrate (yet)
+
+1. **Sector software with unique functions**: construction measurement and BC3, legal health and
+   safety obligations, installer software, a point of sale integrated with its hardware. Generic
+   ERPs do not cover them the same way. **Connect with a bridge.**
+2. **The accounting firm works with this program** and you exchange files. Changing alone breaks
+   that flow. Decide together.
+3. **Mid financial year.** Migrating accounting mid-year complicates the close. The good window is
+   **1 January**, or the start of a quarter for invoicing only.
+4. **The pain is small.** If a nightly export to Excel solves 80 % of what is wanted, do not migrate
+   for the other 20 %.
+5. **Nobody can lead the change** inside the company for one to three months.
+
+## The sum, over two years
+
+**Cost of staying** (per year): hours of copy and paste × the hourly cost; plus bridges, modules or
+consulting to connect it; plus the regulatory risk (forced adaptation, penalties).
+
+**Cost of migrating** (once, plus the difference in fees): first-year licences minus what stops
+being paid; implementation and data migration; training and weeks of lower productivity; the risk
+of data that does not move well or sector modules the target lacks.
+
+**Rule of thumb:** if migrating pays for itself in **18–24 months** and there is a **window**
+(start of the financial year, licence renewal, forced adaptation), recommend it, with one to three
+targets that have a documented API and, ideally, an MCP. If not, **connect with a bridge** and redo
+the sum at the next renewal.
+
+## If migrating: seven steps not to lose anything
+
+1. **Inventory**: which data (customers, items, invoices, accounting) and which processes depend on
+   the program.
+2. **Choose the target with the agent in mind**: a documented API and, if possible, an MCP.
+3. **Export the history** and **keep the old system read-only**. Accounting and invoices must be
+   kept for years: do not delete it.
+4. **Start on a clean date**: start of the year or quarter. Opening balances rather than every
+   movement, unless the target imports them well.
+5. **One month in parallel** with a real process (invoicing, for instance) before switching off.
+6. **Connect the target from day one** (`01-TOOLS/<TARGET>/` and its `test_connection`), so the
+   value shows immediately.
+7. **Train the team** and name who owns the new system.
+
+## The third way: building it
+
+Some businesses replace a program with their own, built with Claude Code: a custom CRM, a simple
+ERP, a bakery's point of sale. Sometimes it is a very good idea; sometimes it is expensive to keep.
+
+Worth it only if **all** of these hold:
+
+- **Small, stable scope**: one function, not "the whole ERP".
+- **Someone maintains it**: code in a repository, backups, security updates, and someone who
+  understands it when the builder is away.
+- **It starts by reading** the old system's data (export or bridge), and both coexist for a while.
+- **It does not invoice.** A program that issues invoices must comply with the invoicing
+  regulations itself ([Spain](spain.md)). Building invoicing almost never pays: connect it.
+
+Not worth it when the program is sector software with legal obligations (health and safety,
+payroll, official accounting), or when only one person understands it.
+
+## Typical targets
+
+| If you have… | Targets to consider | Why |
+|---|---|---|
+| A closed desktop ERP or accounting program, unsupported | Odoo, Holded, Business Central, Sage Active | Cloud with a documented API |
+| Excel as the "ERP" | First Google Sheets or Excel on OneDrive (already connectable); an ERP when volume demands it | Moving the file to the cloud already makes it reachable, at no cost |
+| The WhatsApp Business app for orders or bookings | WhatsApp Business Platform (Cloud API), directly with Meta or a provider | Not a change of tool: the edition with an API |
+| Notion or Airtable as a CRM | A CRM with API and MCP when there are more than two or three salespeople | While small, Notion and Airtable connect well |
+
+Check each target's current API, MCP and price before recommending it ([what to find out](what-to-find-out.md)).

package/skills/connect-tool/references/database-bridge.md

@@ -0,0 +1,159 @@
+# Database bridge: reading an installed program, read-only
+
+Goal: the agent **reads** the data of a desktop or office program (SQL Server or Access) **without
+being able to write**, **without opening ports** and **without losing the vendor's support**. Writing
+never goes through the bridge: it goes through the [official import file](file-exchange.md).
+
+The real "read-only" guarantee lives **in the database**: a login with minimal permissions over
+curated views. The "read-only mode" of an MCP server is almost always a statement filter. It helps;
+it is not enough.
+
+The scripts are in [`../bridge-kit/`](../bridge-kit/README.md), shipped unmodified from their source
+(Spanish comments and file names; see `../THIRD_PARTY.md`). This page is how to use them.
+
+## Architecture
+
+```
+[Program's server or PC]                                       [Agent]
+  SQL Server (production)
+     └─ nightly backup → restore into ERP_IA (copy)       ┌─ Claude Code on a laptop ── Tailscale (grant to the MCP port only)
+           └─ schema "ia": curated views                  │
+                └─ login ia_lectura (SELECT on "ia")      │
+                     └─ DBHub (readonly, predefined SQL) ─┤
+                        listening on 127.0.0.1            └─ claude.ai connector / cloud n8n ── Cloudflare Tunnel + Access
+```
+
+## Step by step
+
+### 0. Permission first
+
+Ask the distributor (Sage, ICG, Prevengos, CONTPAQi, Wolters Kluwer…) whether creating a login and
+views affects support, **in writing** ([messages](messages.md), B). If it does, work **only on the
+copy** (step 1). Some vendors put database reading outside support altogether (Prevengos, for one).
+
+### 1. Isolate the data: a nightly copy
+
+- **SQL Server, Express included.** Express has **no SQL Server Agent**. The pattern is the Windows
+  Task Scheduler plus `sqlcmd`: a `BACKUP ... WITH COPY_ONLY` of production (it does not break the
+  program's own backup chain) and a `RESTORE` into a separate database, `ERP_IA`, every night off
+  hours. `bridge-kit/sqlserver/copia-nocturna.ps1` does it: backup, restore with the file moves,
+  recreate the user and views (the restore wipes them), run the acceptance test, keep three days
+  of backups, log every step.
+- **Access** (`.mdb`/`.accdb`, e.g. FactuSOL local): copy the file off hours and convert the copy to
+  SQLite: `bridge-kit/access/access_a_sqlite.py --origen <file> --destino <file.sqlite>`. It copies
+  first, skips binary attachments and replaces the target atomically. **Never** connect an MCP to
+  the live `.mdb`.
+- **Production** only when real time is truly needed, and then with the login of step 2 and row and
+  time limits.
+
+Schedule the copy with an account that administers SQL Server, **never** with the reader:
+
+```powershell
+$accion = New-ScheduledTaskAction -Execute "powershell.exe" -Argument '-ExecutionPolicy Bypass -File C:\KitPuente\sqlserver\copia-nocturna.ps1 -Origen "<PROGRAM_DB>"'
+$cuando = New-ScheduledTaskTrigger -Daily -At 2am
+Register-ScheduledTask -TaskName "KitPuente copia nocturna" -Action $accion -Trigger $cuando -RunLevel Highest
+```
+
+### 2. A read-only login over views
+
+`bridge-kit/sqlserver/01-login-servidor.sql` (once, server level) and `02-usuario-y-vistas.sql`
+(database level, idempotent):
+
+1. A schema `ia` with **curated views**: only the columns needed. No IBANs, no health data, no
+   payroll. One view per business question.
+2. A login `ia_lectura` that is **not** `sa`, `db_owner` or `sysadmin`, with a long random password
+   kept only on the server.
+3. `GRANT SELECT ON SCHEMA::ia`. The views belong to `dbo`, so ownership chaining lets the login read
+   the tables **through** them without any permission on the tables. Plus `db_denydatawriter` and
+   `DENY CREATE TABLE/VIEW/PROCEDURE/FUNCTION`.
+4. The view templates use placeholders (`<tabla_facturas_emitidas>`, `<columna_fecha>`…). Table and
+   column names depend on the program and its version and are **not public**: confirm them with the
+   distributor.
+
+If the server only allows Windows authentication, use a dedicated Windows account instead of the
+SQL login.
+
+### 3. The acceptance test
+
+`bridge-kit/sqlserver/03-prueba-solo-lectura.sql` impersonates `ia_lectura` inside a transaction it
+rolls back, and checks: it **can** read the `ia` views; it **cannot** read the tables directly,
+delete, update or create a table. It must end in `RESULTADO: OK`. Without it, the agent is not
+connected.
+
+> **Check this before trusting an OK.** The script counts *any* error on the forbidden statements
+> as a pass. If a placeholder such as `<tabla_facturas_emitidas>` was not replaced, or the table
+> name is wrong, those statements fail with "invalid object name", not with a permission error,
+> and the test reports OK without proving anything. Replace every placeholder with a real table,
+> and confirm that the errors are permission errors (`Msg 229` / `Msg 262`), the same rule as the
+> `test_connection` probes in SKILL.md.
+
+### 4. The database MCP server
+
+| Option | When | Read-only | Limiting tables | Notes |
+|---|---|---|---|---|
+| **DBHub** (Bytebase, MIT) — the kit's choice | SQL Server, PostgreSQL, MySQL/MariaDB, Oracle, SQLite | `readonly=true` per tool in `dbhub.toml`: only SELECT, SHOW, DESCRIBE, EXPLAIN, PRAGMA. A filter: combine it with the login | **Predefined SQL tools** with typed parameters | npx or Docker; several sources in one TOML; `max_rows`; SSH tunnel. Over HTTP, a shared bearer token. No Windows integrated auth |
+| **SQL MCP Server** (Microsoft, Data API builder 2.x, MIT) | SQL Server, Azure SQL, PostgreSQL, MySQL | Per-role permissions (e.g. `anonymous:read`), no free SQL | Only the entities declared in `dab-config.json` | Over HTTP everything enters as **anonymous** by default: put JWT/Entra ID or Cloudflare Access in front. Needs .NET |
+| **mcpFirebird** (MIT) | Firebird | `allowedOperations=['SELECT']`, no free SQL | `allowedTables` | Low-to-medium maturity |
+| Access | — | — | — | No mature MCP: **copy → SQLite → DBHub** |
+
+SQL Server MCP servers with no read-only mode do not belong in the bridge.
+
+`bridge-kit/dbhub/dbhub.toml.ejemplo` has one tool per business question ("sales per day",
+"pending collections", "stock below minimum"), each a `SELECT` on the `ia` views, so the agent does
+not improvise SQL against the program. `execute_sql` cannot be removed according to DBHub's docs:
+it stays `readonly` with a row cap. The file holds the reader's password: keep it on the program's
+server, readable only by the account that runs DBHub, never in git or on a laptop. **DBHub listens
+on `0.0.0.0` by default: always pass `--host`**, and pin the npm version.
+
+### 5. The network: no open ports
+
+**Rule:** port 1433 (and any database or MCP port) is **never** opened on the router. MS-SQL servers
+exposed to the internet are a classic ransomware entry for small businesses.
+
+| If the agent is… | Use | How it is limited | Indicative cost |
+|---|---|---|---|
+| Claude Code on the owner's laptop | **Tailscale** | Tag `tag:erp` on the server and a grant that lets only the owner reach **the MCP port** (not 1433). `bridge-kit/red/tailscale-grants.hujson` | Standard plan per user per month; the Personal plan is non-commercial only. Check current pricing |
+| A claude.ai remote connector, Cowork or cloud n8n | **Cloudflare Tunnel + Access** in front of the MCP's HTTP endpoint | Access application with an email policy, service tokens for machines; the MCP listens on 127.0.0.1 with its own token. `bridge-kit/red/cloudflared-config.yml.ejemplo` | Zero Trust has a free tier (check the current limit). Needs a domain on Cloudflare |
+
+Remote claude.ai connectors leave from Anthropic's infrastructure and **do not reach a VPN or
+Tailscale**. Using the bridge from claude.ai or Cowork needs the Cloudflare tunnel.
+
+### 6. In the harness
+
+`01-TOOLS/<PROGRAM>/`, from `bridge-kit/01-TOOLS-plantilla/`:
+
+- `.env`: the MCP URL and token (`ERP_MCP_URL`, `ERP_MCP_TOKEN`), **not** the database password,
+  which stays on the program's server. The kit's README mentions an `.env.example` that the source
+  does not ship: write it with those two variables.
+- `test_connection.sh`: initialises the MCP, lists its tools and warns about any tool the kit did
+  not expect. It proves the bridge answers; the read-only proof is test 03 on the server.
+- `CREDENTIALS.md`: who created the login, where the copy lives, when the token rotates (every
+  quarter).
+
+Plus the entry in `.mcp.json`.
+
+## Plan B: an export folder
+
+When no database is reachable: a nightly CSV export to a folder (Task Scheduler with `sqlcmd`/`bcp`
+over the views, or the program's own export) and the harness reads the folder. Details in
+[file exchange](file-exchange.md). With n8n: version 2 disables the Local File Trigger and Execute
+Command by default; re-enable them deliberately and restrict paths with
+`N8N_RESTRICT_FILE_ACCESS_TO`, and keep n8n updated.
+
+## When to pay instead of building: unified APIs
+
+| Service | Spanish coverage (check current list) | Local or cloud | MCP | Watch for |
+|---|---|---|---|---|
+| **Chift** | Holded, ContaSOL (cloud only), a3ERP, Sage 200 ES, Odoo, Ágora, Revo, Business Central… | Both: Sage 200 ES and a3ERP through a local Windows agent (outbound, no ports) | Yes, official | Asks for broad permissions (read and write). Price not public |
+| Apideck | Holded, Odoo | Cloud | Yes | Expensive for a small business |
+| Unified.to | Holded, Odoo, Sage 200 (beta) | Cloud | Yes | — |
+
+For a single small business the own bridge is usually cheaper. Check coverage and prices at the
+source before recommending one.
+
+## What the bridge does not do
+
+- It does not write into the program: that is the import file.
+- It ships no table schemas of commercial programs.
+- It does not replace the vendor's support: when the program updates and changes its tables, the
+  views need review. Test 03 and `test_connection` detect it.