@frihet/mcp-server 1.17.0 → 2.0.1

package/dist/demo-client.d.ts

@@ -19,9 +19,10 @@
  */
 import type { IFrihetClient } from "./client-interface.js";
 import type { CreateWebhookInput, CreateWebhookResult, PaginatedResponse, UpdateWebhookInput, Webhook } from "./types.js";
-import type { BinaryDocument, EInvoiceDocument } from "./client.js";
+import { type BinaryDocument, type EInvoiceDocument, type EInvoiceExportResult, type McpEInvoiceExportFormat } from "./client.js";
 type Rec = Record<string, unknown>;
 export declare class DemoFrihetClient implements IFrihetClient {
+    readonly isDemoClient: true;
     listInvoices(params?: {
         limit?: number;
         offset?: number;
@@ -99,6 +100,21 @@ export declare class DemoFrihetClient implements IFrihetClient {
     createWebhook(data: CreateWebhookInput): Promise<CreateWebhookResult>;
     updateWebhook(id: string, data: UpdateWebhookInput): Promise<Webhook>;
     deleteWebhook(_id: string): Promise<void>;
+    globalSearch(params: {
+        q: string;
+        types?: ReadonlyArray<"invoices" | "expenses" | "vendors" | "clients" | "products">;
+        limit?: number;
+        offset?: number;
+    }): Promise<{
+        data: Record<string, unknown>[];
+        total: number;
+        limit: number;
+        offset: number;
+        hasMore: boolean;
+        query: string;
+        types: ReadonlyArray<"invoices" | "expenses" | "vendors" | "clients" | "products">;
+        truncated?: boolean;
+    }>;
     listClientContacts(_clientId: string, params?: {
         limit?: number;
         offset?: number;
@@ -173,14 +189,9 @@ export declare class DemoFrihetClient implements IFrihetClient {
     }>;
     exportEInvoice(params: {
         invoiceId: string;
-        format: string;
+        format: McpEInvoiceExportFormat;
         signed?: boolean;
-    }): Promise<{
-        xmlUrl: string;
-        filename: string;
-        format: string;
-        signed: boolean;
-    }>;
+    }): Promise<EInvoiceExportResult>;
     faceSubmit(params: {
         invoiceId: string;
         mode: "mock" | "sandbox" | "production";
@@ -314,7 +325,7 @@ export declare class DemoFrihetClient implements IFrihetClient {
     updateTeamMemberRole(memberId: string, role: string): Promise<Rec>;
     removeTeamMember(_memberId: string): Promise<void>;
     approveGLEntry(entryId: string, notes?: string): Promise<Rec>;
-    rejectGLEntry(entryId: string, reason: string): Promise<Rec>;
+    rejectGLEntry(entryId: string, note: string): Promise<Rec>;
     getGLEntryAuditLog(entryId: string): Promise<Rec>;
     addCustomPortalDomain(data: {
         domain: string;
@@ -355,15 +366,13 @@ export declare class DemoFrihetClient implements IFrihetClient {
     }): Promise<PaginatedResponse<Rec>>;
     createBankRule(data: {
         name: string;
-        conditions: Array<{
+        bankConditions: Array<{
             field: string;
             operator: string;
             value: string;
         }>;
-        actions: Array<{
-            type: string;
-            value: string;
-        }>;
+        action: string;
+        actionConfig: Record<string, unknown>;
         isActive?: boolean;
     }): Promise<Rec>;
     sendGestoriaMessage(data: {
@@ -406,7 +415,9 @@ export declare class DemoFrihetClient implements IFrihetClient {
         };
     }): Promise<Rec>;
     getGestoriaAgingConsolidated(_params?: {
-        ownerUid?: string;
+        workspaceIds?: string[];
+        asOf?: string;
+        bustCache?: boolean;
     }): Promise<Rec>;
     listLeaves(params?: {
         limit?: number;
@@ -430,8 +441,8 @@ export declare class DemoFrihetClient implements IFrihetClient {
         employeeId: string;
         mood?: string;
         location?: string;
-    }): Promise<Rec>;
-    attendanceClockOut(entryId: string): Promise<Rec>;
+    }, _idempotencyKey?: string): Promise<Rec>;
+    attendanceClockOut(entryId: string, _idempotencyKey?: string): Promise<Rec>;
     getOvertimeReport(params: {
         period: string;
         employeeId?: string;
@@ -450,10 +461,6 @@ export declare class DemoFrihetClient implements IFrihetClient {
     getPayrollChecklist(params: {
         month: string;
     }): Promise<Rec>;
-    getOnboardingStatus(): Promise<Rec>;
-    setOnboardingPersona(data: {
-        persona: "autonomo" | "empresa" | "agencia" | "gestoria";
-    }): Promise<Rec>;
     getPermissionsMatrix(): Promise<Rec>;
     getMyPermissions(): Promise<Rec>;
     getCurrentPeriod(params?: {

package/dist/demo-client.js

@@ -17,6 +17,7 @@
  *   - delete / remove methods → resolve void (interface return type forbids a
  *     stamp; this is the one accepted, documented gap).
  */
+import { toApiEInvoiceExportFormat, } from "./client.js";
 import { Buffer } from "node:buffer";
 import { READ_STAMP, FISCAL_STAMP, DEMO_NOW, demoPage, demoEmptyPage, findOrStub, demoId, simulateWrite, simulateAction, demoClients, demoProducts, demoInvoices, demoExpenses, demoQuotes, demoVendors, demoBankAccounts, demoTransactions, } from "./demo-fixtures.js";
 const DEMO_RBAC_ROLES = ["owner", "admin", "manager", "sales", "accountant", "employee", "viewer"];
@@ -74,6 +75,7 @@ const DEMO_OWNER_CAPABILITIES = Object.entries(DEMO_PERMISSION_MATRIX.owner)
     .flatMap(([resource, actions]) => actions.map((action) => `${resource}:${action}`))
     .sort();
 export class DemoFrihetClient {
+    isDemoClient = true;
     // ---------------------------------------------------------------- Invoices
     async listInvoices(params) {
         return demoPage(demoInvoices, params);
@@ -299,6 +301,20 @@ export class DemoFrihetClient {
     async deleteWebhook(_id) {
         return;
     }
+    // ---------------------------------------------------------------- Cross-resource search
+    // ----------------------------------------------------------------
+    async globalSearch(params) {
+        return {
+            data: [],
+            total: 0,
+            limit: params.limit ?? 25,
+            offset: params.offset ?? 0,
+            hasMore: false,
+            query: params.q,
+            types: params.types ?? ["invoices", "expenses", "vendors", "clients", "products"],
+            truncated: false,
+        };
+    }
     // ---------------------------------------------------------------- CRM: Contacts
     async listClientContacts(_clientId, params) {
         return demoEmptyPage(params);
@@ -426,7 +442,15 @@ export class DemoFrihetClient {
         return { fileUrl: "https://app.frihet.io/demo/datev.csv", filename: "demo-datev.csv", rowCount: 24, fiscalPeriod: `${params.periodStart}..${params.periodEnd}`, encoding: "cp1252", ...FISCAL_STAMP };
     }
     async exportEInvoice(params) {
-        return { xmlUrl: "https://app.frihet.io/demo/einvoice.xml", filename: `${params.invoiceId}.xml`, format: params.format, signed: params.signed ?? false, ...FISCAL_STAMP };
+        const format = toApiEInvoiceExportFormat(params.format);
+        return {
+            xml: `<?xml version="1.0" encoding="UTF-8"?><DemoEInvoice format="${format}"/>`,
+            contentType: "application/xml",
+            filename: `${params.invoiceId}.xml`,
+            format,
+            signed: params.signed ?? false,
+            ...FISCAL_STAMP,
+        };
     }
     async faceSubmit(params) {
         return { registroFACe: "DEMO-FACE-0001", status: "submitted", submittedAt: DEMO_NOW, mode: params.mode, ...FISCAL_STAMP };
@@ -503,7 +527,8 @@ export class DemoFrihetClient {
     }
     // ---------------------------------------------------------------- Fiscal (simulated / read summaries)
     async getFiscalModeloSummary(modeloCode, period) {
-        return { model: modeloCode, period: period ?? "2026-Q2", readonly: true, summary: { totalRevenue: 3960.4, totalExpenses: 405.6 }, ...FISCAL_STAMP };
+        const defaultPeriod = modeloCode === "390" || modeloCode === "347" ? "2026" : "2026-Q2";
+        return { model: modeloCode, period: period ?? defaultPeriod, readonly: true, summary: { totalRevenue: 3960.4, totalExpenses: 405.6 }, ...FISCAL_STAMP };
     }
     async getVerifactuStatus(invoiceId) {
         return { invoiceId, status: "accepted", accepted: true, submittedAt: DEMO_NOW, ...FISCAL_STAMP };
@@ -575,8 +600,8 @@ export class DemoFrihetClient {
     async approveGLEntry(entryId, notes) {
         return simulateAction(entryId, { status: "approved", ...(notes ? { notes } : {}) });
     }
-    async rejectGLEntry(entryId, reason) {
-        return simulateAction(entryId, { status: "rejected", reason });
+    async rejectGLEntry(entryId, note) {
+        return simulateAction(entryId, { status: "rejected", note });
     }
     async getGLEntryAuditLog(entryId) {
         return { entryId, log: [], ...READ_STAMP };
@@ -614,7 +639,7 @@ export class DemoFrihetClient {
         return demoEmptyPage(params);
     }
     async createBankRule(data) {
-        return simulateWrite("demo_rule", { name: data.name, conditions: data.conditions, actions: data.actions }, { isActive: data.isActive ?? true });
+        return simulateWrite("demo_rule", { name: data.name, bankConditions: data.bankConditions, action: data.action, actionConfig: data.actionConfig }, { isActive: data.isActive ?? true });
     }
     // ---------------------------------------------------------------- Gestoria
     async sendGestoriaMessage(data) {
@@ -648,10 +673,10 @@ export class DemoFrihetClient {
     async cancelLeave(leaveId) {
         return simulateAction(leaveId, { status: "cancelled" });
     }
-    async attendanceClockIn(data) {
+    async attendanceClockIn(data, _idempotencyKey) {
         return simulateWrite("demo_att", { employeeId: data.employeeId, ...(data.mood ? { mood: data.mood } : {}), ...(data.location ? { location: data.location } : {}) }, { status: "open", clockInAt: DEMO_NOW });
     }
-    async attendanceClockOut(entryId) {
+    async attendanceClockOut(entryId, _idempotencyKey) {
         return simulateAction(entryId, { status: "closed", clockOutAt: DEMO_NOW });
     }
     async getOvertimeReport(params) {
@@ -692,13 +717,6 @@ export class DemoFrihetClient {
             ...READ_STAMP,
         };
     }
-    // ---------------------------------------------------------------- Onboarding
-    async getOnboardingStatus() {
-        return { workspaceId: "demo_ws_001", persona: "autonomo", completedSteps: ["profile"], pendingSteps: ["bank", "invoice"], percentComplete: 33, startedAt: DEMO_NOW, ...READ_STAMP };
-    }
-    async setOnboardingPersona(data) {
-        return { workspaceId: "demo_ws_001", persona: data.persona, updatedAt: DEMO_NOW, ...READ_STAMP };
-    }
     // ---------------------------------------------------------------- Permissions
     async getPermissionsMatrix() {
         return {

package/dist/deposit-contract.d.ts

@@ -0,0 +1,29 @@
+import { z } from "zod/v4";
+/** Locally generated guidance only: never includes input values or provider text. */
+export declare class DepositInputError extends Error {
+    readonly statusCode = 400;
+    readonly errorCode = "invalid_deposit_input";
+    constructor(message: string);
+}
+/** Writable fields accepted by publicApi v132's strict deposits schema. */
+export declare const depositFields: {
+    clientId: z.ZodString;
+    clientName: z.ZodString;
+    amount: z.ZodNumber;
+    currency: z.ZodString;
+    description: z.ZodString;
+    receivedDate: z.ZodString;
+    paymentMethod: z.ZodOptional<z.ZodString>;
+    paymentReference: z.ZodOptional<z.ZodString>;
+};
+/** Writable fields accepted by publicApi v132's strict /deposits/:id/apply schema. */
+export declare const applyDepositFields: {
+    invoiceId: z.ZodString;
+    invoiceNumber: z.ZodString;
+    amount: z.ZodNumber;
+};
+/** Validate deposit application payload against the strict backend contract before request I/O. */
+export declare function normalizeApplyDepositBody(input?: Record<string, unknown>): Record<string, unknown>;
+/** Preserve the established MCP date/reference names on the canonical API wire. */
+export declare function normalizeDepositBody(input: Record<string, unknown>, partial: boolean): Record<string, unknown>;
+//# sourceMappingURL=deposit-contract.d.ts.map

package/dist/deposit-contract.js

@@ -0,0 +1,76 @@
+import { z } from "zod/v4";
+/** Locally generated guidance only: never includes input values or provider text. */
+export class DepositInputError extends Error {
+    statusCode = 400;
+    errorCode = "invalid_deposit_input";
+    constructor(message) {
+        super(message);
+        this.name = "DepositInputError";
+    }
+}
+/** Writable fields accepted by publicApi v132's strict deposits schema. */
+export const depositFields = {
+    clientId: z.string().min(1).max(128),
+    clientName: z.string().min(1).max(500),
+    amount: z.number().positive(),
+    currency: z.string().length(3),
+    description: z.string().min(1).max(2000),
+    receivedDate: z.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+    paymentMethod: z.string().max(200).optional(),
+    paymentReference: z.string().max(200).optional(),
+};
+/** Writable fields accepted by publicApi v132's strict /deposits/:id/apply schema. */
+export const applyDepositFields = {
+    invoiceId: z.string().min(1).max(128),
+    invoiceNumber: z.string().min(1).max(200),
+    amount: z.number().positive(),
+};
+const applyDepositBody = z.object(applyDepositFields).strict();
+/** Validate deposit application payload against the strict backend contract before request I/O. */
+export function normalizeApplyDepositBody(input = {}) {
+    if (Object.prototype.hasOwnProperty.call(input, "notes")) {
+        throw new DepositInputError("Deposit application field 'notes' is not writable; the API does not accept it. / El campo 'notes' no se puede guardar al aplicar el depósito.");
+    }
+    const parsed = applyDepositBody.safeParse(input);
+    if (!parsed.success) {
+        const known = new Set(Object.keys(applyDepositFields));
+        const fields = [...new Set(parsed.error.issues.map((issue) => issue.path[0]).filter((field) => typeof field === "string" && known.has(field)))];
+        throw new DepositInputError(`Invalid deposit application input${fields.length ? ` (${fields.join(", ")})` : ""}. Provide invoiceId, invoiceNumber and a positive amount. / Indica invoiceId, invoiceNumber y un importe positivo.`);
+    }
+    return parsed.data;
+}
+const createDepositBody = z.object({
+    ...depositFields,
+    currency: depositFields.currency.default("EUR"),
+}).strict();
+// PATCH must not inject the create default or turn an empty update into a write.
+const updateDepositBody = z.object(depositFields).partial().strict().refine((fields) => Object.values(fields).some((value) => value !== undefined), { message: "Provide at least one writable deposit field / Indica al menos un campo del depósito" });
+/** Preserve the established MCP date/reference names on the canonical API wire. */
+export function normalizeDepositBody(input, partial) {
+    const body = { ...input };
+    for (const unsupported of ["status", "notes"]) {
+        if (Object.prototype.hasOwnProperty.call(body, unsupported)) {
+            throw new DepositInputError(`Deposit field '${unsupported}' is not writable; the API does not accept it. / El campo '${unsupported}' no se puede guardar en el depósito.`);
+        }
+    }
+    for (const [alias, canonical] of [["date", "receivedDate"], ["reference", "paymentReference"]]) {
+        if (body[alias] !== undefined) {
+            if (body[canonical] !== undefined && body[canonical] !== body[alias]) {
+                throw new DepositInputError(`Conflicting deposit fields '${alias}' and '${canonical}'. / Los campos '${alias}' y '${canonical}' no coinciden.`);
+            }
+            body[canonical] = body[alias];
+        }
+        delete body[alias];
+    }
+    const parsed = (partial ? updateDepositBody : createDepositBody).safeParse(body);
+    if (!parsed.success) {
+        const known = new Set(Object.keys(depositFields));
+        const fields = [...new Set(parsed.error.issues.map((issue) => issue.path[0]).filter((field) => typeof field === "string" && known.has(field)))];
+        const guidance = partial
+            ? "Provide at least one valid writable deposit field; date uses YYYY-MM-DD. / Indica al menos un campo editable válido; date usa YYYY-MM-DD."
+            : "Provide clientId, clientName, a positive amount, description and receivedDate (date) in YYYY-MM-DD format. / Indica clientId, clientName, un importe positivo, description y receivedDate (date) con formato YYYY-MM-DD.";
+        throw new DepositInputError(`Invalid deposit input${fields.length ? ` (${fields.join(", ")})` : ""}. ${guidance}`);
+    }
+    return parsed.data;
+}
+//# sourceMappingURL=deposit-contract.js.map

package/dist/fetch-no-redirect.d.ts

@@ -0,0 +1,3 @@
+/** Validate a manual-mode fetch response without owning any network authority. */
+export declare function rejectRedirectResponse(response: Response): Promise<Response>;
+//# sourceMappingURL=fetch-no-redirect.d.ts.map

package/dist/fetch-no-redirect.js

@@ -0,0 +1,16 @@
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Validate a manual-mode fetch response without owning any network authority. */
+export async function rejectRedirectResponse(response) {
+    if (REDIRECT_STATUSES.has(response.status)) {
+        try {
+            await response.body?.cancel();
+        }
+        catch {
+            /* Best effort; still reject. */
+        }
+        // Never include Location, URL, headers or body in the error.
+        throw new TypeError("Redirect responses are not allowed");
+    }
+    return response;
+}
+//# sourceMappingURL=fetch-no-redirect.js.map

package/dist/fiscal-aliases.d.ts

@@ -18,12 +18,12 @@
  * pointing an alias key at the SAME registered-tool object makes it callable
  * with zero duplication and zero drift risk.
  *
- * This intentionally does NOT touch `src/tools/*.ts` (where the 157-tool
+ * This intentionally does NOT touch `src/tools/*.ts` (where the 158-tool
  * audit / pin tests count literal `registerTool(` call sites) and is applied
  * to the REAL `McpServer` instance only, AFTER `registerAllTools()` — the
  * `tool-exposure.test.ts` / `openai-*.test.ts` suites exercise
  * `registerAllTools()` against a bare `StubMcpServer` and never call
- * `applyFiscalAliases`, so the 157-tool pins are untouched by design.
+ * `applyFiscalAliases`, so the 158-tool pins are untouched by design.
  *
  * KNOWN LIMITATION: this relies on the SDK's internal (unprefixed-by-type,
  * but underscore-private) `_registeredTools` field. It is FAIL-OPEN — if a

package/dist/fiscal-aliases.js

@@ -18,12 +18,12 @@
  * pointing an alias key at the SAME registered-tool object makes it callable
  * with zero duplication and zero drift risk.
  *
- * This intentionally does NOT touch `src/tools/*.ts` (where the 157-tool
+ * This intentionally does NOT touch `src/tools/*.ts` (where the 158-tool
  * audit / pin tests count literal `registerTool(` call sites) and is applied
  * to the REAL `McpServer` instance only, AFTER `registerAllTools()` — the
  * `tool-exposure.test.ts` / `openai-*.test.ts` suites exercise
  * `registerAllTools()` against a bare `StubMcpServer` and never call
- * `applyFiscalAliases`, so the 157-tool pins are untouched by design.
+ * `applyFiscalAliases`, so the 158-tool pins are untouched by design.
  *
  * KNOWN LIMITATION: this relies on the SDK's internal (unprefixed-by-type,
  * but underscore-private) `_registeredTools` field. It is FAIL-OPEN — if a

package/dist/fiscal-period.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Period contract for the READ-ONLY fiscal modelo summaries.
+ *
+ * Single source for BOTH the client (which query param to send) and the tools
+ * (what to validate before calling, what to compare after). Mirrors the
+ * deployed Frihet-ERP backend (functions/src/publicApi.ts):
+ *   - 303/130 read `?quarter=YYYY-Q[1-4]`, default current quarter
+ *   - 390     reads `?year=YYYY`, default current year
+ *   - 347     reads `?year=YYYY`, default current year
+ * Every other modelo code has no backend route (404 "Unknown fiscal model").
+ * The backend silently answers the CURRENT period for any param it does not
+ * read, so the param name here is load-bearing.
+ */
+export interface FiscalPeriodRule {
+    /** Query param the backend reads. */
+    param: "quarter" | "year";
+    pattern: RegExp;
+    format: string;
+}
+export declare const FISCAL_PERIOD_RULES: Readonly<Record<string, FiscalPeriodRule>>;
+/**
+ * Query object for GET /fiscal/modelo/{code}. Throws for a modelo code without
+ * a backend rule so no caller can fall back to an ignored `?period=` param.
+ */
+export declare function fiscalModeloQuery(modeloCode: string, period?: string): Record<string, string | undefined>;
+//# sourceMappingURL=fiscal-period.d.ts.map

package/dist/fiscal-period.js

@@ -0,0 +1,31 @@
+/**
+ * Period contract for the READ-ONLY fiscal modelo summaries.
+ *
+ * Single source for BOTH the client (which query param to send) and the tools
+ * (what to validate before calling, what to compare after). Mirrors the
+ * deployed Frihet-ERP backend (functions/src/publicApi.ts):
+ *   - 303/130 read `?quarter=YYYY-Q[1-4]`, default current quarter
+ *   - 390     reads `?year=YYYY`, default current year
+ *   - 347     reads `?year=YYYY`, default current year
+ * Every other modelo code has no backend route (404 "Unknown fiscal model").
+ * The backend silently answers the CURRENT period for any param it does not
+ * read, so the param name here is load-bearing.
+ */
+export const FISCAL_PERIOD_RULES = {
+    "303": { param: "quarter", pattern: /^\d{4}-Q[1-4]$/, format: "YYYY-Q1..YYYY-Q4" },
+    "130": { param: "quarter", pattern: /^\d{4}-Q[1-4]$/, format: "YYYY-Q1..YYYY-Q4" },
+    "390": { param: "year", pattern: /^\d{4}$/, format: "YYYY" },
+    "347": { param: "year", pattern: /^\d{4}$/, format: "YYYY" },
+};
+/**
+ * Query object for GET /fiscal/modelo/{code}. Throws for a modelo code without
+ * a backend rule so no caller can fall back to an ignored `?period=` param.
+ */
+export function fiscalModeloQuery(modeloCode, period) {
+    const rule = FISCAL_PERIOD_RULES[modeloCode];
+    if (!rule) {
+        throw new Error(`No deployed fiscal summary backend for Modelo ${modeloCode}`);
+    }
+    return { [rule.param]: period };
+}
+//# sourceMappingURL=fiscal-period.js.map

package/dist/google-profile.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Google Connected Apps Profile for the Frihet MCP Server.
+ *
+ * Implements the curated 18-tool financial management surface submitted
+ * for the Google Connected Apps Platform Developer Preview (Gemini app & Google Search).
+ *
+ * Requirements:
+ * - Curated catalogue: 18 high-value small business & freelancer tools.
+ * - Human-in-the-loop: Invoices and financial documents are created strictly in draft status.
+ * - Zero unconfirmed destructive actions (no direct AEAT / VeriFactu fiscal submissions).
+ * - Standard output redaction for sensitive fields.
+ */
+export declare const GOOGLE_CANDIDATE_TOOLS: ReadonlySet<string>;
+export declare const GOOGLE_CANDIDATE_TOOL_COUNT: number;
+export declare const GOOGLE_INSTRUCTIONS = "Frihet ERP \u2014 natural-language business and financial management for Google Connected Apps (Gemini & Search).\nUse get_business_context for complete company health and plan limits.\nQuery and review invoices, expenses, quotes, clients, and products with pagination.\nAll created invoices are drafts. Confirm parameters with the user before creating records.";
+export declare function googleToolResult(result: unknown): unknown;
+export declare const GOOGLE_FORCED_INPUT_VALUES: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+export declare function applyGoogleProfile(server: any): void;
+//# sourceMappingURL=google-profile.d.ts.map

package/dist/google-profile.js

@@ -0,0 +1,122 @@
+/**
+ * Google Connected Apps Profile for the Frihet MCP Server.
+ *
+ * Implements the curated 18-tool financial management surface submitted
+ * for the Google Connected Apps Platform Developer Preview (Gemini app & Google Search).
+ *
+ * Requirements:
+ * - Curated catalogue: 18 high-value small business & freelancer tools.
+ * - Human-in-the-loop: Invoices and financial documents are created strictly in draft status.
+ * - Zero unconfirmed destructive actions (no direct AEAT / VeriFactu fiscal submissions).
+ * - Standard output redaction for sensitive fields.
+ */
+import { deepRedact, redactText } from "./redaction.js";
+export const GOOGLE_CANDIDATE_TOOLS = new Set([
+    "get_business_context",
+    "get_monthly_summary",
+    "get_quarterly_taxes",
+    "list_invoices",
+    "get_invoice",
+    "search_invoices",
+    "list_expenses",
+    "get_expense",
+    "create_expense",
+    "list_clients",
+    "get_client",
+    "create_client",
+    "list_products",
+    "get_product",
+    "list_quotes",
+    "get_quote",
+    "create_quote",
+    "create_invoice",
+]);
+export const GOOGLE_CANDIDATE_TOOL_COUNT = GOOGLE_CANDIDATE_TOOLS.size; // 18
+export const GOOGLE_INSTRUCTIONS = `Frihet ERP — natural-language business and financial management for Google Connected Apps (Gemini & Search).
+Use get_business_context for complete company health and plan limits.
+Query and review invoices, expenses, quotes, clients, and products with pagination.
+All created invoices are drafts. Confirm parameters with the user before creating records.`;
+export function googleToolResult(result) {
+    if (result === null || typeof result !== "object")
+        return result;
+    const res = result;
+    // Deep-redact structured output if present (in-place deletion of sensitive fields)
+    if (res.structuredContent && typeof res.structuredContent === "object") {
+        deepRedact(res.structuredContent);
+    }
+    // Redact text content items
+    if (Array.isArray(res.content)) {
+        res.content = res.content.map((item) => {
+            if (item && typeof item === "object" && "text" in item && typeof item.text === "string") {
+                return {
+                    ...item,
+                    text: redactText(item.text),
+                };
+            }
+            return item;
+        });
+    }
+    return res;
+}
+export const GOOGLE_FORCED_INPUT_VALUES = {
+    create_invoice: { status: "draft" },
+    create_quote: { status: "draft" },
+};
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function applyGoogleProfile(server) {
+    const registerTool = server.registerTool.bind(server);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    server.registerTool = (name, config, handler) => {
+        if (!GOOGLE_CANDIDATE_TOOLS.has(name))
+            return undefined;
+        let description = config.description ?? "";
+        let inputSchema = config.inputSchema;
+        if (name === "create_invoice") {
+            description = `${description} [Google Connected Apps: Generates an invoice strictly in 'draft' status for human review. No irreversible fiscal submission occurs.]`;
+            if (inputSchema && typeof inputSchema === "object" && "status" in inputSchema) {
+                const { status: _omittedStatus, ...rest } = inputSchema;
+                inputSchema = rest;
+            }
+        }
+        else if (name === "create_quote") {
+            description = `${description} [Google Connected Apps: Generates a quote strictly in 'draft' status for human review.]`;
+            if (inputSchema && typeof inputSchema === "object" && "status" in inputSchema) {
+                const { status: _omittedStatus, ...rest } = inputSchema;
+                inputSchema = rest;
+            }
+        }
+        return registerTool(name, {
+            ...config,
+            description,
+            inputSchema,
+            annotations: {
+                ...config.annotations,
+                ...(config.annotations?.readOnlyHint !== true ? { destructiveHint: true } : {}),
+            },
+        }, 
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        async (...args) => {
+            try {
+                let input = args[0];
+                if (input && typeof input === "object") {
+                    const forced = GOOGLE_FORCED_INPUT_VALUES[name];
+                    if (forced) {
+                        input = { ...input, ...forced };
+                    }
+                }
+                const res = await handler(input, ...args.slice(1));
+                return googleToolResult(res);
+            }
+            catch {
+                return googleToolResult({
+                    isError: true,
+                    _meta: { "io.frihet/operationOutcomeUnknown": true },
+                });
+            }
+        });
+    };
+    // Google Connected Apps profile intentionally registers 0 raw prompts or dynamic resources
+    server.registerResource = () => undefined;
+    server.registerPrompt = () => undefined;
+}
+//# sourceMappingURL=google-profile.js.map

package/dist/index.js

@@ -30,6 +30,9 @@ const PKG_VERSION = (() => {
     }
 })();
 import { OPENAI_ALLOWED_TOOL_COUNT, OPENAI_EXCLUDED_COUNT, OPENAI_EXCLUDED_RESOURCE_COUNT } from "./openai-profile.js";
+import { CLAUDE_CANDIDATE_INSTRUCTIONS, CLAUDE_CANDIDATE_TOOLS } from "./claude-profile.js";
+import { GOOGLE_INSTRUCTIONS, GOOGLE_CANDIDATE_TOOL_COUNT } from "./google-profile.js";
+import { MUSE_INSTRUCTIONS, MUSE_CANDIDATE_TOOL_COUNT } from "./muse-profile.js";
 import { resolveToolMode, GROUPED_META_TOOL_COUNT } from "./tool-exposure.js";
 import { localMcpSurfaceComposition, registerMcpSurface, } from "./server-composition.js";
 import { AGENT_SERVER_INSTRUCTIONS, API_KEY_LOCATION, } from "./agent-onboarding.js";
@@ -37,6 +40,15 @@ import { log } from "./logger.js";
 import { registerShutdownHook } from "./metrics.js";
 import { setTraceContext } from "./observability.js";
 function main() {
+    const openaiMode = process.env.FRIHET_OPENAI_MODE === "true";
+    const claudeMode = process.env.FRIHET_CLAUDE_MODE === "true";
+    const googleMode = process.env.FRIHET_GOOGLE_MODE === "true";
+    const museMode = process.env.FRIHET_MUSE_MODE === "true";
+    const activeModes = [openaiMode, claudeMode, googleMode, museMode].filter(Boolean).length;
+    if (activeModes > 1) {
+        console.error("Error: FRIHET_OPENAI_MODE, FRIHET_CLAUDE_MODE, FRIHET_GOOGLE_MODE, and FRIHET_MUSE_MODE are mutually exclusive");
+        process.exit(1);
+    }
     const apiKey = process.env.FRIHET_API_KEY;
     // Demo mode: FRIHET_DEMO=1|true serves fixture-backed example data with NO
     // network calls and NO API key required. It's an explicit opt-in, so it wins
@@ -95,17 +107,29 @@ function main() {
     const server = new McpServer({
         name: "frihet-erp",
         version: PKG_VERSION,
-        description: "AI-native MCP server for Frihet ERP — invoices, expenses, clients, products, quotes, webhooks, and deposits. " +
-            "Provides a catalogue of 157 canonical operations; fiscal aliases and optional grouped discovery names are reported separately. " +
-            "The local package serves 11 resources (7 static + 4 API-backed) and 10 workflow prompts " +
-            "with full Spanish tax compliance (IVA, IGIC, IPSI).",
+        description: claudeMode
+            ? `Local Claude candidate for Frihet: ${CLAUDE_CANDIDATE_TOOLS.size} canonical operations with reviewed fiscal aliases, 1 currencies resource and 2 receivables prompts. Optional grouped discovery adds 3 names. API-dependent operations require live workspace verification; this is not a published Directory connector.`
+            : googleMode
+                ? `Frihet ERP profile for Google Connected Apps (Gemini & Search): ${GOOGLE_CANDIDATE_TOOL_COUNT} canonical operations with draft-only human-in-the-loop protection.`
+                : museMode
+                    ? `Frihet ERP connector for Meta Muse: ${MUSE_CANDIDATE_TOOL_COUNT} canonical operations with draft-only human-in-the-loop protection.`
+                    :
+                        "AI-native MCP server for Frihet ERP — invoices, expenses, clients, products, quotes, webhooks, and deposits. " +
+                            "Provides a catalogue of 158 canonical operations; fiscal aliases and optional grouped discovery names are reported separately. " +
+                            "The local package serves 11 resources (7 static + 4 API-backed) and 10 workflow prompts " +
+                            "with full Spanish tax compliance (IVA, IGIC, IPSI).",
     }, {
         // Delivered by `initialize` to every MCP client, which hands it to the model
         // before the first tool call. This is the only onboarding channel that costs
         // the operator zero configuration. Source: src/agent-onboarding.ts.
-        instructions: AGENT_SERVER_INSTRUCTIONS,
+        instructions: claudeMode
+            ? CLAUDE_CANDIDATE_INSTRUCTIONS
+            : googleMode
+                ? GOOGLE_INSTRUCTIONS
+                : museMode
+                    ? MUSE_INSTRUCTIONS
+                    : AGENT_SERVER_INSTRUCTIONS,
     });
-    const openaiMode = process.env.FRIHET_OPENAI_MODE === "true";
     const toolMode = resolveToolMode();
     if (toolMode === "grouped") {
         log({
@@ -121,7 +145,7 @@ function main() {
             operation: "startup",
         });
     }
-    registerMcpSurface(server, client, localMcpSurfaceComposition(openaiMode, toolMode === "grouped"));
+    registerMcpSurface(server, client, localMcpSurfaceComposition(openaiMode, toolMode === "grouped", claudeMode, googleMode, museMode));
     // Register shutdown hook to log final metrics summary
     registerShutdownHook();
     // Connect via stdio transport