komplian 0.4.7 → 0.5.0

package/KOMPLIAN_DATABASE_URLS.env.example

@@ -0,0 +1,26 @@
+# Copia a KOMPLIAN_DATABASE_URLS.env (raíz del monorepo) y rellena.
+# No commitees URLs con contraseña. Hosts: Neon (*.neon.tech).
+
+# --- App DB (Prisma en app/, raw SQL en api/) ---
+KOMPLIAN_DATABASE_URL_APP_DEVELOPMENT=
+KOMPLIAN_DATABASE_URL_APP_STAGING=
+KOMPLIAN_DATABASE_URL_APP_PRODUCTION=
+
+# --- Admin DB ---
+KOMPLIAN_DATABASE_URL_ADMIN_DEVELOPMENT=
+KOMPLIAN_DATABASE_URL_ADMIN_STAGING=
+KOMPLIAN_DATABASE_URL_ADMIN_PRODUCTION=
+
+# --- Web / pilot DB ---
+KOMPLIAN_DATABASE_URL_WEB_DEVELOPMENT=
+KOMPLIAN_DATABASE_URL_WEB_STAGING=
+KOMPLIAN_DATABASE_URL_WEB_PRODUCTION=
+
+# Producción: solo @komplian.com; lista separada por comas (opcional; por defecto josue.santana@komplian.com).
+# KOMPLIAN_DATABASE_PRODUCTION_ALLOWLIST=josue.santana@komplian.com,otro@komplian.com
+
+# Operador para comprobar acceso a producción (alternativa: git config user.email).
+# KOMPLIAN_DATABASE_OPERATOR_EMAIL=josue.santana@komplian.com
+
+# Solo si NO usas Neon (p. ej. Postgres local en Docker):
+# KOMPLIAN_DATABASE_ALLOW_NON_NEON=1

package/komplian-db.mjs

@@ -0,0 +1,451 @@
+#!/usr/bin/env node
+/**
+ * Komplian db — psql contra Neon (PostgreSQL). Convención KOMPLIAN_* para URLs y acceso.
+ *
+ * Sintaxis recomendada:
+ *   npx komplian db:app:development
+ *   npx komplian db:admin:staging
+ *   npx komplian db:web:production
+ *
+ * URLs (prioridad: process.env → KOMPLIAN_DATABASE_URLS.env → KOMPLIAN_LOCALHOST_SECRETS.env → .env.local solo development):
+ *   KOMPLIAN_DATABASE_URL_APP_DEVELOPMENT | _STAGING | _PRODUCTION
+ *   KOMPLIAN_DATABASE_URL_ADMIN_*
+ *   KOMPLIAN_DATABASE_URL_WEB_*
+ * Legacy development: KOMPLIAN_LOCALHOST_*_DATABASE_URL
+ *
+ * Producción: solo emails @komplian.com en KOMPLIAN_DATABASE_PRODUCTION_ALLOWLIST
+ * (por defecto josue.santana@komplian.com). Operador: KOMPLIAN_DATABASE_OPERATOR_EMAIL o git config user.email.
+ *
+ * Neon: host debe ser *.neon.tech salvo KOMPLIAN_DATABASE_ALLOW_NON_NEON=1
+ */
+
+import { spawn, spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+
+const c = {
+  reset: "\x1b[0m",
+  dim: "\x1b[2m",
+  bold: "\x1b[1m",
+  cyan: "\x1b[36m",
+  red: "\x1b[31m",
+  yellow: "\x1b[33m",
+};
+
+function log(s = "") {
+  console.log(s);
+}
+
+const PLATFORMS = new Set([
+  "app",
+  "admin",
+  "web",
+  "api-app",
+  "api-admin",
+  "api-web",
+]);
+
+const ENVIRONMENTS = new Set(["development", "staging", "production"]);
+
+/** Lista por defecto si no configuras KOMPLIAN_DATABASE_PRODUCTION_ALLOWLIST */
+const DEFAULT_PRODUCTION_ALLOWLIST = ["josue.santana@komplian.com"];
+
+function parseEnvFile(content) {
+  const out = {};
+  for (const line of content.split(/\r?\n/)) {
+    const t = line.trim();
+    if (!t || t.startsWith("#")) continue;
+    const eq = t.indexOf("=");
+    if (eq === -1) continue;
+    const key = t.slice(0, eq).trim();
+    let val = t.slice(eq + 1).trim();
+    if (
+      (val.startsWith('"') && val.endsWith('"')) ||
+      (val.startsWith("'") && val.endsWith("'"))
+    ) {
+      val = val.slice(1, -1);
+    }
+    out[key] = val;
+  }
+  return out;
+}
+
+function loadMergedEnvFiles(workspaceRoot) {
+  const out = {};
+  const paths = [
+    join(workspaceRoot, "KOMPLIAN_DATABASE_URLS.env"),
+    join(workspaceRoot, ".komplian", "KOMPLIAN_DATABASE_URLS.env"),
+    join(workspaceRoot, "KOMPLIAN_LOCALHOST_SECRETS.env"),
+    join(workspaceRoot, ".komplian", "KOMPLIAN_LOCALHOST_SECRETS.env"),
+    join(workspaceRoot, "komplian-localhost.secrets.env"),
+    join(workspaceRoot, ".komplian", "localhost-secrets.env"),
+  ];
+  for (const p of paths) {
+    if (!existsSync(p)) continue;
+    try {
+      Object.assign(out, parseEnvFile(readFileSync(p, "utf8")));
+    } catch {
+      /* ignore */
+    }
+  }
+  return out;
+}
+
+function readEnvLocalKey(workspaceRoot, project, keys) {
+  const p = join(workspaceRoot, project, ".env.local");
+  if (!existsSync(p)) return "";
+  let map;
+  try {
+    map = parseEnvFile(readFileSync(p, "utf8"));
+  } catch {
+    return "";
+  }
+  for (const k of keys) {
+    const v = map[k];
+    if (v && String(v).trim()) return String(v).trim();
+  }
+  return "";
+}
+
+function findWorkspaceRoot(start) {
+  let dir = resolve(start);
+  for (let i = 0; i < 8; i++) {
+    if (
+      existsSync(join(dir, "api", "package.json")) &&
+      existsSync(join(dir, "app", "package.json"))
+    ) {
+      return dir;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return resolve(start);
+}
+
+function maskDatabaseUrl(url) {
+  try {
+    const u = new URL(url);
+    if (u.password) u.password = "***";
+    return u.toString();
+  } catch {
+    return "[URL inválida]";
+  }
+}
+
+/** api-app → APP (misma base que app). */
+function platformToDbKey(platform) {
+  const p = platform.toLowerCase();
+  if (p === "app" || p === "api-app") return "APP";
+  if (p === "admin" || p === "api-admin") return "ADMIN";
+  if (p === "web" || p === "api-web") return "WEB";
+  return null;
+}
+
+function loadProductionAllowlist(workspaceRoot) {
+  const raw = process.env.KOMPLIAN_DATABASE_PRODUCTION_ALLOWLIST?.trim();
+  if (raw) {
+    return raw
+      .split(",")
+      .map((s) => s.trim().toLowerCase())
+      .filter(Boolean);
+  }
+  const p = join(
+    workspaceRoot,
+    ".komplian",
+    "KOMPLIAN_DATABASE_PRODUCTION_ALLOWLIST"
+  );
+  if (existsSync(p)) {
+    try {
+      return readFileSync(p, "utf8")
+        .split(/\r?\n/)
+        .map((l) => l.trim().toLowerCase())
+        .filter((l) => l && !l.startsWith("#"));
+    } catch {
+      /* ignore */
+    }
+  }
+  return DEFAULT_PRODUCTION_ALLOWLIST.map((e) => e.toLowerCase());
+}
+
+function assertNeonHost(url) {
+  if (process.env.KOMPLIAN_DATABASE_ALLOW_NON_NEON === "1") return;
+  try {
+    const u = new URL(url);
+    const h = u.hostname.toLowerCase();
+    if (!h.includes("neon.tech")) {
+      log(
+        `${c.red}✗${c.reset} Solo hosts Neon (postgresql://*.neon.tech). Para excepciones: ${c.dim}KOMPLIAN_DATABASE_ALLOW_NON_NEON=1${c.reset}`
+      );
+      process.exit(1);
+    }
+  } catch {
+    log(`${c.red}✗${c.reset} URL de base de datos inválida.`);
+    process.exit(1);
+  }
+}
+
+async function resolveOperatorEmail() {
+  const fromEnv = process.env.KOMPLIAN_DATABASE_OPERATOR_EMAIL?.trim();
+  if (fromEnv) return fromEnv;
+  try {
+    const r = spawnSync("git", ["config", "user.email"], {
+      encoding: "utf8",
+      shell: false,
+    });
+    if (r.status === 0 && r.stdout?.trim()) return r.stdout.trim();
+  } catch {
+    /* ignore */
+  }
+  const rl = createInterface({ input, output });
+  const ans = await rl.question(
+    `${c.bold}Email operador (@komplian.com) para acceso producción:${c.reset} `
+  );
+  rl.close();
+  return (ans || "").trim();
+}
+
+function assertProductionAccess(email, allowlist) {
+  const e = email.toLowerCase();
+  if (!e || !e.endsWith("@komplian.com")) {
+    log(
+      `${c.red}✗${c.reset} Producción: solo cuentas ${c.bold}@komplian.com${c.reset}. Define ${c.dim}KOMPLIAN_DATABASE_OPERATOR_EMAIL${c.reset} o ${c.dim}git config user.email${c.reset}.`
+    );
+    process.exit(1);
+  }
+  if (!allowlist.includes(e)) {
+    log(
+      `${c.red}✗${c.reset} Producción: este email no está autorizado. Añádelo en ${c.bold}KOMPLIAN_DATABASE_PRODUCTION_ALLOWLIST${c.reset} o en ${c.dim}.komplian/KOMPLIAN_DATABASE_PRODUCTION_ALLOWLIST${c.reset}.`
+    );
+    process.exit(1);
+  }
+}
+
+function resolveDatabaseUrl(workspaceRoot, platform, environment) {
+  const dbKey = platformToDbKey(platform);
+  if (!dbKey) return "";
+  const file = loadMergedEnvFiles(workspaceRoot);
+  const envU = environment.toUpperCase();
+  const primaryKey = `KOMPLIAN_DATABASE_URL_${dbKey}_${envU}`;
+
+  let url =
+    process.env[primaryKey]?.trim() || file[primaryKey]?.trim() || "";
+
+  if (environment === "development" && !url) {
+    const single =
+      process.env.KOMPLIAN_LOCALHOST_DATABASE_URL?.trim() ||
+      file.KOMPLIAN_LOCALHOST_DATABASE_URL?.trim();
+    if (dbKey === "APP") {
+      url =
+        process.env.KOMPLIAN_LOCALHOST_APP_DATABASE_URL?.trim() ||
+        file.KOMPLIAN_LOCALHOST_APP_DATABASE_URL?.trim() ||
+        single ||
+        readEnvLocalKey(workspaceRoot, "app", ["DATABASE_URL"]) ||
+        readEnvLocalKey(workspaceRoot, "api", ["APP_DATABASE_URL"]);
+    } else if (dbKey === "ADMIN") {
+      url =
+        process.env.KOMPLIAN_LOCALHOST_ADMIN_DATABASE_URL?.trim() ||
+        file.KOMPLIAN_LOCALHOST_ADMIN_DATABASE_URL?.trim() ||
+        single ||
+        readEnvLocalKey(workspaceRoot, "admin", ["DATABASE_URL"]) ||
+        readEnvLocalKey(workspaceRoot, "api", ["ADMIN_DATABASE_URL"]);
+    } else if (dbKey === "WEB") {
+      url =
+        process.env.KOMPLIAN_LOCALHOST_WEB_DATABASE_URL?.trim() ||
+        file.KOMPLIAN_LOCALHOST_WEB_DATABASE_URL?.trim() ||
+        single ||
+        readEnvLocalKey(workspaceRoot, "web", ["DATABASE_URL"]) ||
+        readEnvLocalKey(workspaceRoot, "api", ["WEB_DATABASE_URL"]);
+    }
+  }
+
+  return url;
+}
+
+function findPsqlBinary() {
+  const candidates = [
+    "psql",
+    "/opt/homebrew/opt/libpq/bin/psql",
+    "/usr/local/opt/libpq/bin/psql",
+  ];
+  for (const p of candidates) {
+    if (p !== "psql" && !existsSync(p)) continue;
+    const r = spawnSync(p, ["--version"], {
+      encoding: "utf8",
+      shell: false,
+      windowsHide: true,
+    });
+    if (!r.error && r.status === 0) return p;
+  }
+  return null;
+}
+
+function parseDbArgs(argv) {
+  const opts = {
+    platform: "app",
+    environment: "development",
+    workspace: "",
+    command: "",
+    url: "",
+    quiet: false,
+    help: false,
+  };
+
+  let rest = argv;
+  if (
+    argv.length >= 2 &&
+    PLATFORMS.has(argv[0].toLowerCase()) &&
+    ENVIRONMENTS.has(argv[1].toLowerCase())
+  ) {
+    opts.platform = argv[0].toLowerCase();
+    opts.environment = argv[1].toLowerCase();
+    rest = argv.slice(2);
+  }
+
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "-h" || a === "--help") opts.help = true;
+    else if (a === "--quiet" || a === "-q") opts.quiet = true;
+    else if (a === "--target" || a === "--platform" || a === "-t") {
+      opts.platform = (rest[++i] || "app").toLowerCase();
+    } else if (a === "--env" || a === "-e") {
+      opts.environment = (rest[++i] || "development").toLowerCase();
+    } else if (a === "--workspace" || a === "-w") {
+      opts.workspace = rest[++i] || "";
+    } else if (a === "-c" || a === "--command") {
+      opts.command = rest[++i] || "";
+    } else if (a === "--url" || a === "-u") {
+      opts.url = rest[++i] || "";
+    } else if (a.startsWith("-")) {
+      log(`${c.red}✗${c.reset} Opción desconocida: ${a}`);
+      process.exit(1);
+    } else if (!opts.workspace) opts.workspace = a;
+  }
+
+  return opts;
+}
+
+function usageDb() {
+  log(`Uso:`);
+  log(`  ${c.bold}npx komplian db:app:development${c.reset}`);
+  log(`  ${c.bold}npx komplian db:admin:staging${c.reset}`);
+  log(`  ${c.bold}npx komplian db:web:production${c.reset}   ${c.dim}(solo @komplian.com + allowlist)${c.reset}`);
+  log(`  npx komplian db --platform app --env development`);
+  log(`  npx komplian db -c "SELECT 1" --platform web --env development`);
+  log(``);
+  log(`  Plataformas: ${c.dim}app | admin | web | api-app | api-admin | api-web${c.reset}`);
+  log(`  Entornos:    ${c.dim}development | staging | production${c.reset}`);
+  log(``);
+  log(`  Variables KOMPLIAN (recomendado):`);
+  log(`  ${c.dim}KOMPLIAN_DATABASE_URL_APP_DEVELOPMENT${c.reset}`);
+  log(`  ${c.dim}KOMPLIAN_DATABASE_URL_APP_STAGING / _PRODUCTION${c.reset} (idem ADMIN, WEB)`);
+  log(`  Archivo opcional: ${c.dim}KOMPLIAN_DATABASE_URLS.env${c.reset} (gitignored)`);
+  log(``);
+  log(`  Producción:`);
+  log(`  ${c.dim}KOMPLIAN_DATABASE_OPERATOR_EMAIL${c.reset} o git user.email`);
+  log(`  ${c.dim}KOMPLIAN_DATABASE_PRODUCTION_ALLOWLIST${c.reset} (coma) o .komplian/KOMPLIAN_DATABASE_PRODUCTION_ALLOWLIST`);
+  log(``);
+  log(`  -c, --command   SQL no interactivo`);
+  log(`  -u, --url       URL explícita (sigue reglas Neon / producción)`);
+  log(`  -w, --workspace Raíz monorepo`);
+  log(`  -q, --quiet`);
+  log(`  -h, --help`);
+  log(``);
+  log(`  Requisito: ${c.bold}psql${c.reset} (${c.dim}brew install libpq${c.reset} en macOS).`);
+}
+
+export async function runDb(argv) {
+  const opts = parseDbArgs(argv);
+  if (opts.help) {
+    usageDb();
+    return;
+  }
+
+  if (!PLATFORMS.has(opts.platform)) {
+    log(`${c.red}✗${c.reset} Plataforma inválida: ${opts.platform}`);
+    usageDb();
+    process.exit(1);
+  }
+  if (!ENVIRONMENTS.has(opts.environment)) {
+    log(`${c.red}✗${c.reset} Entorno inválido: ${opts.environment}`);
+    usageDb();
+    process.exit(1);
+  }
+
+  const workspaceRoot = opts.workspace.trim()
+    ? resolve(opts.workspace.replace(/^~(?=$|[/\\])/, process.env.HOME || ""))
+    : findWorkspaceRoot(process.cwd());
+
+  const allowlist = loadProductionAllowlist(workspaceRoot);
+
+  if (opts.environment === "production") {
+    const email = await resolveOperatorEmail();
+    assertProductionAccess(email, allowlist);
+    if (!opts.quiet) {
+      log(
+        `${c.yellow}⚠${c.reset} Producción · operador ${c.bold}${email.toLowerCase()}${c.reset} (allowlist Komplian)`
+      );
+    }
+  }
+
+  if (
+    !(opts.url || "").trim() &&
+    !existsSync(join(workspaceRoot, "api", "package.json"))
+  ) {
+    log(`${c.red}✗${c.reset} No parece un monorepo Komplian: ${workspaceRoot}`);
+    process.exit(1);
+  }
+
+  let url =
+    (opts.url || "").trim() ||
+    resolveDatabaseUrl(workspaceRoot, opts.platform, opts.environment);
+
+  if (!url) {
+    log(`${c.red}✗${c.reset} Sin URL para ${opts.platform} / ${opts.environment}.`);
+    log(
+      `  Define ${c.bold}KOMPLIAN_DATABASE_URL_${platformToDbKey(opts.platform)}_${opts.environment.toUpperCase()}${c.reset} o ${c.dim}KOMPLIAN_DATABASE_URLS.env${c.reset}.`
+    );
+    process.exit(1);
+  }
+
+  assertNeonHost(url);
+
+  const psql = findPsqlBinary();
+  if (!psql) {
+    log(`${c.red}✗${c.reset} No se encontró ${c.bold}psql${c.reset}.`);
+    log(`  macOS: ${c.dim}brew install libpq${c.reset}`);
+    process.exit(1);
+  }
+
+  if (!opts.quiet) {
+    log(
+      `${c.cyan}→${c.reset} ${c.bold}${opts.platform}${c.reset} / ${c.bold}${opts.environment}${c.reset}  ${maskDatabaseUrl(url)}`
+    );
+    log(`${c.dim}  ${psql}${c.reset}`);
+  }
+
+  const args = [url];
+  if (opts.command) {
+    args.push("-c", opts.command, "-X");
+  }
+
+  const child = spawn(psql, args, {
+    stdio: "inherit",
+    shell: false,
+    env: { ...process.env, PAGER: process.env.PAGER || "less" },
+  });
+
+  child.on("error", (err) => {
+    if (err && err.code === "ENOENT") {
+      log(`${c.red}✗${c.reset} No se pudo ejecutar psql.`);
+      process.exit(1);
+    }
+    throw err;
+  });
+
+  child.on("exit", (code) => {
+    process.exit(code ?? 0);
+  });
+}

package/komplian-mcp-tools.mjs

@@ -38,6 +38,15 @@ const KOMPLIAN_MCP_PRESET = {
         GITHUB_PERSONAL_ACCESS_TOKEN: "",
       },
     },
+    "KOMPLIAN-atlassian": {
+      command: "npx",
+      args: ["-y", "mcp-atlassian"],
+      env: {
+        ATLASSIAN_BASE_URL: "https://komplian.atlassian.net",
+        ATLASSIAN_EMAIL: "",
+        ATLASSIAN_API_TOKEN: "",
+      },
+    },
     "KOMPLIAN-sentry": {
       command: "npx",
       args: ["-y", "@sentry/mcp-server@latest"],
@@ -50,6 +59,11 @@ const KOMPLIAN_MCP_PRESET = {
         STRIPE_SECRET_KEY: "",
       },
     },
+    "KOMPLIAN-chrome-devtools": {
+      command: "npx",
+      args: ["-y", "chrome-devtools-mcp@latest"],
+      env: {},
+    },
   },
 };
 
@@ -59,28 +73,27 @@ Este archivo lo genera \`npx komplian mcp-tools\`. **No commitees** tokens; \`.c
 
 ## 1. Servidores en \`.cursor/mcp.json\` (stdio / npx)
 
-| ID | Qué es | Rellena |
-|----|--------|---------|
-| **KOMPLIAN-github** | GitHub API (issues, PRs) | \`GITHUB_PERSONAL_ACCESS_TOKEN\` en el bloque \`env\` del servidor (PAT con scopes repo/workflow según necesidad). El paquete npm está deprecado a favor del servidor oficial; si falla, sustituye por la config que indique [github/github-mcp-server](https://github.com/github/github-mcp-server). |
-| **KOMPLIAN-sentry** | Sentry (issues, trazas) | Primera vez: login por navegador (device code). **Komplian:** \`organizationSlug\` = \`komplian\`, \`regionUrl\` = \`https://de.sentry.io\`. Proyectos: \`komplian-api\`, \`komplian-app\`. |
-| **KOMPLIAN-stripe** | Stripe API | \`STRIPE_SECRET_KEY\` en \`env\` (mejor **Restricted key** / test en dev). Modo test vs live según [docs Stripe MCP](https://docs.stripe.com/mcp). |
+Activa cada fila en **Cursor → Settings → MCP** (interruptor). Rellena \`env\` según la tabla.
 
-## 2. Solo en Cursor (plugins / integraciones)
+| ID | Paquete | Qué es | Rellena / notas |
+|----|---------|--------|-----------------|
+| **KOMPLIAN-github** | \`@modelcontextprotocol/server-github\` | GitHub API | \`GITHUB_PERSONAL_ACCESS_TOKEN\` (PAT). El paquete npm está deprecado; alternativa: [github/github-mcp-server](https://github.com/github/github-mcp-server). |
+| **KOMPLIAN-atlassian** | \`mcp-atlassian\` | Jira + Confluence (Cloud) | \`ATLASSIAN_EMAIL\` + \`ATLASSIAN_API_TOKEN\` ([crear token](https://id.atlassian.com/manage-profile/security/api-tokens)). \`ATLASSIAN_BASE_URL\` ya apunta a \`https://komplian.atlassian.net\`. Jira proyecto **KAPP**. |
+| **KOMPLIAN-sentry** | \`@sentry/mcp-server\` | Sentry | Primera vez: login en navegador. **Komplian:** org \`komplian\`, \`regionUrl\` \`https://de.sentry.io\`, proyectos \`komplian-api\` / \`komplian-app\`. |
+| **KOMPLIAN-stripe** | \`@stripe/mcp\` | Stripe API | \`STRIPE_SECRET_KEY\` (restricted key / test en dev). [Docs Stripe MCP](https://docs.stripe.com/mcp). |
+| **KOMPLIAN-chrome-devtools** | \`chrome-devtools-mcp\` | Chrome (red, consola, screenshots) | Requiere **Node 20.19+** y Chrome estable. Ver [Chrome DevTools MCP](https://developer.chrome.com/blog/chrome-devtools-mcp). |
 
-Estos **no** se instalan con npx en este JSON; actívalos en **Cursor → Settings → MCP** (o integraciones) e inicia sesión:
+## 2. Opcional: integraciones nativas de Cursor
 
-| Integración | Uso en Komplian |
-|-------------|-----------------|
-| **Atlassian** (Jira + Confluence) | Site \`komplian.atlassian.net\`, proyecto Jira **KAPP**. Plugin \`plugin-atlassian-atlassian\` / \`user-mcp-atlassian\`. |
-| **Chrome DevTools** | Depuración del navegador (\`user-chrome-devtools\`). |
+Si además quieres los conectores de Cursor (OAuth / UI): **Settings → MCP** y busca **Atlassian**, **Sentry**, **Stripe**, **Chrome DevTools** — pueden coexistir con las entradas **KOMPLIAN-***; evita duplicar la misma acción en dos servidores.
 
 ## 3. Reinicio
 
-Tras editar \`mcp.json\`, **reinicia Cursor** (o recarga ventana) para cargar MCP.
+Tras editar \`mcp.json\`, **reinicia Cursor** para cargar MCP.
 
 ## 4. Referencia interna
 
-Ver \`.cursor/rules/mcp-integrations.mdc\` en el monorepo (org Sentry, Stripe, reglas KAPP).
+\`.cursor/rules/mcp-integrations.mdc\` (org Sentry, Stripe, KAPP).
 `;
 
 function findWorkspaceRoot(start) {
@@ -143,8 +156,8 @@ function parseMcpArgs(argv) {
 function usageMcpTools() {
   log(`Uso: npx komplian mcp-tools [opciones] [carpeta-monorepo]`);
   log(``);
-  log(`  Añade servidores MCP KOMPLIAN-* en .cursor/mcp.json (GitHub, Sentry, Stripe)`);
-  log(`  y genera .cursor/KOMPLIAN_MCP_SETUP.md (Atlassian + Chrome DevTools = solo Cursor).`);
+  log(`  Añade servidores MCP KOMPLIAN-* en .cursor/mcp.json (GitHub, Atlassian, Sentry, Stripe, Chrome).`);
+  log(`  y genera .cursor/KOMPLIAN_MCP_SETUP.md.`);
   log(``);
   log(`  ${c.dim}Secretos: vacíos en JSON; no se publican en el paquete npm komplian.${c.reset}`);
   log(``);

package/komplian-onboard.mjs

@@ -394,12 +394,13 @@ function npmInstallEach(workspace) {
 }
 
 function usage() {
-  log(`Uso: komplian onboard | postman | localhost | mcp-tools [opciones]`);
+  log(`Uso: komplian onboard | postman | localhost | mcp-tools | db [opciones]`);
   log(`  npx komplian onboard --yes`);
   log(`  npx komplian postman login   ${c.dim}(una vez · guarda API key)${c.reset}`);
   log(`  npx komplian postman --yes    ${c.dim}(email @komplian.com)${c.reset}`);
   log(`  npx komplian localhost --yes  ${c.dim}(env local + api app web admin docs)${c.reset}`);
   log(`  npx komplian mcp-tools --yes  ${c.dim}(.cursor/mcp.json + guía MCP Komplian)${c.reset}`);
+  log(`  npx komplian db:app:development  ${c.dim}(psql Neon · KOMPLIAN_DATABASE_URL_*)${c.reset}`);
   log(``);
   log(`  Antes (una vez): gh auth login -h github.com -s repo -s read:org -w`);
   log(`  Requisitos: Node 18+, git, GitHub CLI (gh)`);
@@ -498,6 +499,25 @@ async function main() {
     await runMcpTools(rawArgv.slice(1));
     return;
   }
+  if (rawArgv[0]?.startsWith("db:")) {
+    const { runDb } = await import("./komplian-db.mjs");
+    const seg = rawArgv[0].split(":").filter(Boolean);
+    if (seg.length === 3 && seg[0] === "db") {
+      await runDb([
+        seg[1].toLowerCase(),
+        seg[2].toLowerCase(),
+        ...rawArgv.slice(1),
+      ]);
+      return;
+    }
+    log(`${c.red}✗${c.reset} Uso: npx komplian db:app:development`);
+    process.exit(1);
+  }
+  if (rawArgv[0] === "db") {
+    const { runDb } = await import("./komplian-db.mjs");
+    await runDb(rawArgv.slice(1));
+    return;
+  }
 
   const configPath = join(__dirname, "komplian-team-repos.json");
   const { argv, fromOnboardSubcommand } = normalizeArgv(rawArgv);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "komplian",
-  "version": "0.4.7",
-  "description": "Komplian CLI: onboard, Postman, localhost, mcp-tools (Cursor MCP). Node 18+. Published tarball has no .env / secrets.",
+  "version": "0.5.0",
+  "description": "Komplian CLI: onboard, Postman, localhost, mcp-tools, db (psql). Node 18+. Published tarball has no .env / secrets.",
   "type": "module",
   "engines": {
     "node": ">=18"
@@ -14,6 +14,8 @@
     "komplian-postman.mjs",
     "komplian-localhost.mjs",
     "komplian-mcp-tools.mjs",
+    "komplian-db.mjs",
+    "KOMPLIAN_DATABASE_URLS.env.example",
     "komplian-team-repos.json",
     "README.md"
   ],
@@ -21,7 +23,7 @@
     "access": "public"
   },
   "scripts": {
-    "prepublishOnly": "node --check komplian-onboard.mjs && node --check komplian-postman.mjs && node --check komplian-localhost.mjs && node --check komplian-mcp-tools.mjs"
+    "prepublishOnly": "node --check komplian-onboard.mjs && node --check komplian-postman.mjs && node --check komplian-localhost.mjs && node --check komplian-mcp-tools.mjs && node --check komplian-db.mjs"
   },
   "keywords": [
     "komplian",