paisa-mcp 0.3.1 → 0.4.1

package/dist/index.js

@@ -38033,6 +38033,44 @@ var inputRequired = Object.assign(buildInputRequired, {
     return { method: "roots/list" };
   }
 });
+function acceptedContent(responses, key, schema) {
+  const view = inputResponse(responses, key);
+  if (view.kind !== "elicit" || view.action !== "accept" || view.content === undefined)
+    return;
+  if (schema === undefined)
+    return view.content;
+  const outcome = schema["~standard"].validate(view.content);
+  if (outcome instanceof Promise)
+    throw new TypeError("acceptedContent(responses, key, schema) requires a synchronously-validating schema");
+  return outcome.issues === undefined ? outcome.value : undefined;
+}
+function inputResponse(responses, key) {
+  if (responses === undefined || typeof responses !== "object" || responses === null)
+    return { kind: "missing" };
+  const entry = responses[key];
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry))
+    return { kind: "missing" };
+  const candidate = entry;
+  if (candidate["action"] === "accept" || candidate["action"] === "decline" || candidate["action"] === "cancel") {
+    const content = candidate["content"];
+    return {
+      kind: "elicit",
+      action: candidate["action"],
+      ...content !== null && typeof content === "object" && !Array.isArray(content) && { content }
+    };
+  }
+  if (Array.isArray(candidate["roots"]))
+    return {
+      kind: "roots",
+      roots: candidate["roots"]
+    };
+  if (typeof candidate["role"] === "string" && candidate["content"] !== undefined)
+    return {
+      kind: "sampling",
+      result: candidate
+    };
+  return { kind: "missing" };
+}
 var REQUEST_STATE_ONLY_LEG_PACING_MS = 250;
 function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
@@ -53404,7 +53442,24 @@ async function initCrypto(client, pin, userId) {
 // ../../node_modules/.bun/@modelcontextprotocol+server@2.1.0/node_modules/@modelcontextprotocol/server/dist/index.mjs
 var DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
 
-// ../../node_modules/.bun/@nimit9+signet-server@0.2.3+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/http/status-codes.js
+// ../../node_modules/.bun/@nimit9+signet-server@0.2.6+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/interaction.js
+async function progress(ctx, done, total, message) {
+  const token = ctx.mcp.mcpReq._meta?.progressToken;
+  if (token === undefined)
+    return;
+  try {
+    await ctx.mcp.mcpReq.notify({
+      method: "notifications/progress",
+      params: {
+        progressToken: token,
+        progress: done,
+        ...total !== undefined ? { total } : {},
+        ...message ? { message } : {}
+      }
+    });
+  } catch {}
+}
+// ../../node_modules/.bun/@nimit9+signet-server@0.2.6+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/http/status-codes.js
 var STATUS_CODES = {
   400: "BAD_REQUEST",
   401: "UNAUTHORIZED",
@@ -53418,14 +53473,7 @@ var STATUS_CODES = {
   429: "RATE_LIMITED"
 };
 
-// ../../node_modules/.bun/@nimit9+signet-server@0.2.3+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/server.js
-var RAW = Symbol.for("signet.mcp.rawResult");
-function toolResult(result) {
-  return Object.defineProperty({ ...result }, RAW, { value: true, enumerable: false });
-}
-function defineTool(def) {
-  return def;
-}
+// ../../node_modules/.bun/@nimit9+signet-server@0.2.6+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/errors.js
 function isZodError(err) {
   return err instanceof Error && err.name === "ZodError" && Array.isArray(err.issues);
 }
@@ -53474,10 +53522,10 @@ function toolErrorResult(info) {
   };
 }
 var INTERNAL_ERROR2 = { code: "INTERNAL_ERROR", message: "Internal error" };
-function report(opts, err, tool, c) {
+function report(opts, err, meta3, c) {
   let pending;
   try {
-    pending = opts.onError?.(err, { tool });
+    pending = opts.onError?.(err, meta3);
   } catch {
     return;
   }
@@ -53488,9 +53536,162 @@ function report(opts, err, tool, c) {
     c?.executionCtx.waitUntil(settled);
   } catch {}
 }
-function toResult(value, structured) {
+
+// ../../node_modules/.bun/@nimit9+signet-server@0.2.6+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/primitives.js
+var RAW = Symbol.for("signet.mcp.rawResult");
+function protocolError(err, deps, meta3) {
+  if (ProtocolError.isInstance(err))
+    return err;
+  const info = deps.options.mapError?.(err) ?? describeToolError(err);
+  if (!info) {
+    report(deps.options, err, meta3, deps.context.c);
+    return new ProtocolError(ProtocolErrorCode.InternalError, "Internal error");
+  }
+  const status = isHttpException(err) ? err.status : isZodError(err) ? 400 : undefined;
+  const code = status !== undefined && status >= 500 ? ProtocolErrorCode.InternalError : ProtocolErrorCode.InvalidParams;
+  return new ProtocolError(code, `${info.code}: ${info.message}`, {
+    success: false,
+    error: info.message,
+    code: info.code,
+    ...info.details ? { details: info.details } : {}
+  });
+}
+function checkScopes(scopes, token) {
+  if (!scopes?.length)
+    return;
+  const missing = scopes.filter((s) => !token?.scopes.includes(s));
+  if (!missing.length)
+    return;
+  const message = `This token is missing the scope: ${missing.join(" ")}. Request a new token with it and try again.`;
+  throw new ProtocolError(ProtocolErrorCode.InvalidRequest, `insufficient_scope: ${message}`, {
+    success: false,
+    error: message,
+    code: "insufficient_scope"
+  });
+}
+function baseContext(mcp, deps) {
+  const { c, token } = deps.context;
+  return { signal: mcp.mcpReq.signal, mcp, ...c ? { c } : {}, ...token ? { token } : {} };
+}
+function toContents(uri, value, mimeType) {
   if (value !== null && typeof value === "object" && RAW in value)
     return value;
+  if (typeof value === "string")
+    return { contents: [{ uri: uri.href, mimeType: mimeType ?? "text/plain", text: value }] };
+  if (value instanceof Uint8Array) {
+    let bin = "";
+    for (const b of value)
+      bin += String.fromCharCode(b);
+    return {
+      contents: [
+        { uri: uri.href, mimeType: mimeType ?? "application/octet-stream", blob: btoa(bin) }
+      ]
+    };
+  }
+  return {
+    contents: [
+      { uri: uri.href, mimeType: mimeType ?? "application/json", text: JSON.stringify(value) }
+    ]
+  };
+}
+function registerResources(server, resources, deps) {
+  const register2 = server.registerResource.bind(server);
+  for (const r of resources) {
+    const meta3 = { tool: r.name, kind: "resource" };
+    const ctxOf = (mcp) => ({
+      resource: r.name,
+      ...baseContext(mcp, deps)
+    });
+    const run = async (uri, variables, mcp) => {
+      checkScopes(r.scopes, deps.context.token);
+      let value;
+      try {
+        const read = r.read;
+        value = await read(r.uri !== undefined ? { uri } : { uri, variables }, ctxOf(mcp));
+      } catch (err) {
+        throw protocolError(err, deps, meta3);
+      }
+      if (value === null || value === undefined)
+        throw new ResourceNotFoundError(uri.href);
+      if (isInputRequiredResult(value))
+        return value;
+      return toContents(uri, value, r.mimeType);
+    };
+    const config2 = {
+      ...r.title ? { title: r.title } : {},
+      ...r.description ? { description: r.description } : {},
+      ...r.mimeType ? { mimeType: r.mimeType } : {}
+    };
+    if (r.uri !== undefined) {
+      register2(r.name, r.uri, config2, (uri, mcp) => run(uri, {}, mcp));
+      continue;
+    }
+    const list = r.list;
+    const template = new ResourceTemplate(r.template, {
+      list: list ? async (mcp) => {
+        try {
+          checkScopes(r.scopes, deps.context.token);
+        } catch {
+          return { resources: [] };
+        }
+        try {
+          return { resources: await list(ctxOf(mcp)) };
+        } catch (err) {
+          throw protocolError(err, deps, meta3);
+        }
+      } : undefined
+    });
+    register2(r.name, template, config2, (uri, vars, mcp) => {
+      const variables = {};
+      for (const [k, v] of Object.entries(vars ?? {}))
+        variables[k] = Array.isArray(v) ? v[0] ?? "" : v;
+      return run(uri, variables, mcp);
+    });
+  }
+}
+function toPromptResult(value) {
+  if (isInputRequiredResult(value))
+    return value;
+  if (typeof value === "string")
+    return { messages: [{ role: "user", content: { type: "text", text: value } }] };
+  if (Array.isArray(value))
+    return {
+      messages: value.map((m) => typeof m === "string" ? { role: "user", content: { type: "text", text: m } } : typeof m.content === "string" ? { role: m.role, content: { type: "text", text: m.content } } : m)
+    };
+  return value;
+}
+function registerPrompts(server, prompts, deps) {
+  const register2 = server.registerPrompt.bind(server);
+  for (const p of prompts) {
+    const meta3 = { tool: p.name, kind: "prompt" };
+    const run = async (args, mcp) => {
+      checkScopes(p.scopes, deps.context.token);
+      try {
+        const render = p.render;
+        return toPromptResult(await render(args, { prompt: p.name, ...baseContext(mcp, deps) }));
+      } catch (err) {
+        throw protocolError(err, deps, meta3);
+      }
+    };
+    register2(p.name, {
+      ...p.title ? { title: p.title } : {},
+      ...p.description ? { description: p.description } : {},
+      ...p.args ? { argsSchema: p.args } : {}
+    }, p.args ? (args, mcp) => run(args, mcp) : (mcp) => run({}, mcp));
+  }
+}
+
+// ../../node_modules/.bun/@nimit9+signet-server@0.2.6+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/server.js
+var RAW2 = Symbol.for("signet.mcp.rawResult");
+function toolResult(result) {
+  return Object.defineProperty({ ...result }, RAW2, { value: true, enumerable: false });
+}
+function defineTool(def) {
+  return def;
+}
+function toResult(value, structured) {
+  if (value !== null && typeof value === "object" && RAW2 in value)
+    return value;
   if (isInputRequiredResult(value))
     return value;
   const text = typeof value === "string" ? value : JSON.stringify(value ?? null) ?? "null";
@@ -53503,7 +53704,11 @@ function toResult(value, structured) {
 }
 function createMcpServer(options) {
   const unlisted = new Set(options.tools.filter((t) => t.listed === false).map((t) => t.name));
-  const toolsCapability = { tools: { listChanged: false } };
+  const toolsCapability = {
+    tools: { listChanged: false },
+    ...options.resources?.length ? { resources: { listChanged: false } } : {},
+    ...options.prompts?.length ? { prompts: { listChanged: false } } : {}
+  };
   const server = new McpServer({ name: options.name, version: options.version }, {
     ...unlisted.size ? {} : { capabilities: toolsCapability },
     ...options.instructions ? { instructions: options.instructions } : {}
@@ -53543,7 +53748,7 @@ function createMcpServer(options) {
         } catch {}
         const info = options.mapError?.(err) ?? describeToolError(err);
         if (!info)
-          report(options, err, tool.name, c);
+          report(options, err, { tool: tool.name }, c);
         if (custom2)
           return custom2;
         return toolErrorResult(info ?? INTERNAL_ERROR2);
@@ -53559,6 +53764,11 @@ function createMcpServer(options) {
     restore?.();
     restore = undefined;
   }
+  const deps = { options, context: { ...c ? { c } : {}, ...token ? { token } : {} } };
+  if (options.resources?.length)
+    registerResources(server, options.resources, deps);
+  if (options.prompts?.length)
+    registerPrompts(server, options.prompts, deps);
   return server;
 }
 function hideUnlisted(server, unlisted) {
@@ -53580,7 +53790,6 @@ function hideUnlisted(server, unlisted) {
       throw new Error("signet mcp: could not hide unlisted tools; @modelcontextprotocol/server no longer installs tools/list through setRequestHandler");
   };
 }
-
 // src/annotations.ts
 var RO = { readOnlyHint: true, openWorldHint: false };
 var WI = {
@@ -53656,6 +53865,190 @@ function applyAnnotations(tools) {
     return { ...tool, title: meta3.title, annotations: meta3.annotations };
   });
 }
+
+// src/lib/confirm.ts
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+var ANSWER_KEY = "confirm";
+function clientCanConfirm(mcp, initializeCapabilities) {
+  const envelope = mcp.mcpReq.envelope;
+  const caps = envelope?.[CLIENT_CAPABILITIES_META_KEY] ?? initializeCapabilities();
+  return Boolean(caps?.elicitation);
+}
+function planFingerprint(plan) {
+  const canonical = (v) => Array.isArray(v) ? v.map(canonical) : v && typeof v === "object" ? Object.fromEntries(Object.entries(v).filter(([, x]) => x !== undefined).sort(([a], [b]) => a.localeCompare(b)).map(([k, x]) => [k, canonical(x)])) : v;
+  return createHash("sha256").update(JSON.stringify(canonical(plan))).digest("hex");
+}
+var STATE_KEY = randomBytes(32);
+function sign(nonce, fingerprint) {
+  return createHmac("sha256", STATE_KEY).update(`${nonce}.${fingerprint}`).digest("hex");
+}
+function mintState(fingerprint) {
+  const nonce = randomBytes(16).toString("hex");
+  return `${nonce}.${sign(nonce, fingerprint)}`;
+}
+function verifyState(state, fingerprint) {
+  if (typeof state !== "string")
+    return false;
+  const [nonce, mac3, ...rest] = state.split(".");
+  if (!nonce || !mac3 || rest.length)
+    return false;
+  const expected = Buffer.from(sign(nonce, fingerprint), "hex");
+  const given = Buffer.from(mac3, "hex");
+  return given.length === expected.length && timingSafeEqual(given, expected);
+}
+function confirmPlan(mcp, message, plan, initializeCapabilities = () => {
+  return;
+}) {
+  if (!clientCanConfirm(mcp, initializeCapabilities))
+    return { kind: "unsupported" };
+  const fingerprint = planFingerprint(plan);
+  const responses = mcp.mcpReq.inputResponses;
+  const answered = responses !== undefined && ANSWER_KEY in responses;
+  const echoed = mcp.mcpReq.requestState?.();
+  if (answered && verifyState(echoed, fingerprint)) {
+    const content = acceptedContent(responses, ANSWER_KEY);
+    if (content?.confirm === true)
+      return { kind: "confirmed" };
+    return {
+      kind: "declined",
+      result: { cancelled: true, message: "Cancelled by the user. Nothing was changed." }
+    };
+  }
+  return {
+    kind: "ask",
+    result: inputRequired({
+      inputRequests: {
+        [ANSWER_KEY]: inputRequired.elicit({
+          message,
+          requestedSchema: {
+            type: "object",
+            properties: {
+              confirm: { type: "boolean", title: "Confirm", description: "This can't be undone." }
+            },
+            required: ["confirm"]
+          }
+        })
+      },
+      requestState: mintState(fingerprint)
+    })
+  };
+}
+function withConfirmation(tool, describe3, initializeCapabilities) {
+  const run = tool.handler;
+  return {
+    ...tool,
+    handler: (args, ctx) => {
+      const message = describe3(args);
+      if (message === null || !ctx?.mcp)
+        return run(args, ctx);
+      const outcome = confirmPlan(ctx.mcp, message, { tool: tool.name, args }, initializeCapabilities);
+      if (outcome.kind === "confirmed" || outcome.kind === "unsupported")
+        return run(args, ctx);
+      return outcome.result;
+    }
+  };
+}
+var safeDate = (v) => typeof v === "string" && /^\d{4}-\d{2}-\d{2}$/.test(v) ? v : v === undefined ? "any" : "a date";
+var safeAmount = (v) => typeof v === "string" && /^\d+(\.\d{1,2})?$/.test(v) || typeof v === "number" ? String(v) : null;
+var plural2 = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+function describeTransactionFilters(f) {
+  const parts = [];
+  if (f.startDate || f.endDate)
+    parts.push(`dated ${safeDate(f.startDate)} to ${safeDate(f.endDate)}`);
+  if (f.type)
+    parts.push(`${f.type}s only`);
+  if (f.categoryType)
+    parts.push(`category type ${f.categoryType}`);
+  if (f.categoryId)
+    parts.push("in one category");
+  if (f.uncategorized)
+    parts.push("uncategorized");
+  if (f.amountMin !== undefined || f.amountMax !== undefined)
+    parts.push(`amount ₹${f.amountMin ?? 0} to ${f.amountMax === undefined ? "any" : `₹${f.amountMax}`}`);
+  if (f.owner)
+    parts.push("one owner");
+  if (f.search)
+    parts.push("matching a text search");
+  return parts.length ? parts.join(", ") : "with no filters (ALL transactions)";
+}
+var describeDeletes = {
+  transactions: (a) => {
+    if (a.id)
+      return "Permanently delete 1 transaction?";
+    if (Array.isArray(a.ids))
+      return `Permanently delete ${plural2(a.ids.length, "transaction")}?`;
+    return `Permanently delete every transaction ${describeTransactionFilters(a.filters ?? {})}?`;
+  },
+  entity: (a) => {
+    const entity = String(a.entity ?? "item").replace(/_/g, " ");
+    const n = Array.isArray(a.ids) ? a.ids.length : 1;
+    const extra = a.entity === "merchant" ? " Their transactions are kept but unlinked." : a.entity === "debt" ? " Its history is lost; settling keeps it." : "";
+    return `Permanently delete ${plural2(n, entity)}?${extra}`;
+  },
+  mergeMerchants: (a) => {
+    const n = Array.isArray(a.duplicateIds) ? a.duplicateIds.length : 0;
+    return `Merge ${plural2(n, "duplicate merchant")} into the one you're keeping? Their transactions move over and the duplicates are deleted.`;
+  },
+  encryptionMode: (a) => `Switch encryption mode to ${a.encryptionMode === "private" ? "private" : "standard"}?`,
+  settleDebt: (a) => {
+    if (a.action !== "settle")
+      return null;
+    const amount = a.settledAmount === undefined ? "0" : safeAmount(a.settledAmount);
+    return amount === null ? "Settle this debt? It will be closed with the remaining balance you gave." : `Settle this debt? It will be closed with a remaining balance of ₹${amount}.`;
+  }
+};
+var CONFIRMED_TOOLS = {
+  delete_transactions: describeDeletes.transactions,
+  delete_entity: describeDeletes.entity,
+  merge_merchants: describeDeletes.mergeMerchants,
+  set_encryption_mode: describeDeletes.encryptionMode,
+  manage_debt: describeDeletes.settleDebt
+};
+var BULK_CONFIRM_THRESHOLD = 20;
+var sum = (rows, key) => Array.isArray(rows) ? rows.reduce((n, r) => n + (Number(r?.[key]) || 0), 0) : 0;
+var fromDryRun = (listKey, countKey) => async (args, dryRun) => {
+  const r = await dryRun({ ...args, dryRun: true });
+  return {
+    n: sum(r?.[listKey], countKey),
+    planHash: typeof r?.planHash === "string" ? r.planHash : undefined
+  };
+};
+var BULK_CONFIRMED_TOOLS = {
+  categorize_groups: fromDryRun("applied", "rows"),
+  backfill_persons: fromDryRun("plan", "txnCount"),
+  bulk_categorize_transactions: async (args) => ({
+    n: Array.isArray(args.links) ? args.links.length : 0
+  }),
+  bulk_link_entity: async (args) => ({ n: Array.isArray(args.links) ? args.links.length : 0 })
+};
+var PLAN_CHANGED = {
+  planChanged: true,
+  message: "The transactions changed after they were counted, so nothing was written. Run it again to see the new count."
+};
+function withBulkConfirmation(tool, count, initializeCapabilities) {
+  const run = tool.handler;
+  const runPlanned = async (args, ctx, hash2) => {
+    const result = await run(hash2 === undefined ? args : { ...args, expectedPlanHash: hash2 }, ctx);
+    return result?.planChanged ? PLAN_CHANGED : result;
+  };
+  return {
+    ...tool,
+    handler: async (args, ctx) => {
+      if (args.dryRun === true || !ctx?.mcp || !clientCanConfirm(ctx.mcp, initializeCapabilities))
+        return run(args, ctx);
+      const { n, planHash: hash2 } = await count(args, async (a) => run(a, ctx));
+      if (n <= BULK_CONFIRM_THRESHOLD)
+        return runPlanned(args, ctx, hash2);
+      const message = `Update ${plural2(n, "transaction")} in one go?`;
+      const outcome = confirmPlan(ctx.mcp, message, { tool: tool.name, args, n, planHash: hash2 }, initializeCapabilities);
+      if (outcome.kind === "confirmed")
+        return runPlanned(args, ctx, hash2);
+      if (outcome.kind === "unsupported")
+        return run(args, ctx);
+      return outcome.result;
+    }
+  };
+}
 // src/lib/union-tool.ts
 function variant(input2, run) {
   return { input: input2, run };
@@ -53848,15 +54241,15 @@ var PROMPTS = [
 `)
   }
 ];
-function registerPrompts(server) {
+function registerPrompts2(server2) {
   for (const p of PROMPTS) {
     const cb = (args) => ({
       messages: [{ role: "user", content: { type: "text", text: p.text(args) } }]
     });
     if (p.args) {
-      server.registerPrompt(p.name, { title: p.title, description: p.description, argsSchema: p.args }, (args) => cb(args));
+      server2.registerPrompt(p.name, { title: p.title, description: p.description, argsSchema: p.args }, (args) => cb(args));
     } else {
-      server.registerPrompt(p.name, { title: p.title, description: p.description }, () => cb({}));
+      server2.registerPrompt(p.name, { title: p.title, description: p.description }, () => cb({}));
     }
   }
 }
@@ -58631,6 +59024,12 @@ function parseAmount4(raw) {
   const num = parseFloat(cleaned);
   return Number.isNaN(num) ? 0 : Math.abs(num);
 }
+// src/lib/plan-hash.ts
+import { createHash as createHash2 } from "node:crypto";
+function planHash(ids) {
+  return createHash2("sha256").update([...ids].sort().join(",")).digest("hex");
+}
+
 // src/lib/txn-rows.ts
 function toTxnRow(r2) {
   return {
@@ -58799,6 +59198,20 @@ async function backfillPersons(client, crypto3, opts = {}) {
     else
       newGroups.push({ norm, displayName: g2.displayName, upiHandles });
   }
+  const hash2 = planHash([...groups.values()].flatMap((g2) => g2.txnIds));
+  if (!opts.dryRun && opts.expectedPlanHash !== undefined && opts.expectedPlanHash !== hash2) {
+    return {
+      dryRun: false,
+      truncated,
+      candidatesScanned: candidates.length,
+      created: 0,
+      reused: 0,
+      linked: 0,
+      plan,
+      planHash: hash2,
+      planChanged: true
+    };
+  }
   if (!opts.dryRun && newGroups.length > 0) {
     const bodies = await Promise.all(newGroups.map(async ({ displayName, upiHandles }) => {
       const fields = {
@@ -58832,6 +59245,7 @@ async function backfillPersons(client, crypto3, opts = {}) {
     const CHUNK = 25;
     for (let i2 = 0;i2 < links.length; i2 += CHUNK) {
       await client.post("/api/transactions/bulk-link-entity", { links: links.slice(i2, i2 + CHUNK) });
+      await opts.onProgress?.(Math.min(i2 + CHUNK, links.length), links.length, "Linking transactions to people");
     }
   }
   return {
@@ -58841,7 +59255,8 @@ async function backfillPersons(client, crypto3, opts = {}) {
     created,
     reused,
     linked: links.length,
-    plan
+    plan,
+    planHash: hash2
   };
 }
 
@@ -58968,6 +59383,10 @@ async function applyGroupAssignments(client, crypto3, assignments, opts = {}) {
       plan.push({ group: g2, categoryId: cat.id, slug: cat.slug, learn: a2.learn !== false });
     }
   }
+  result.planHash = planHash(plan.flatMap((p2) => p2.group.rows.map((r2) => r2.id)));
+  if (!opts.dryRun && opts.expectedPlanHash !== undefined && opts.expectedPlanHash !== result.planHash) {
+    return { ...result, planChanged: true };
+  }
   if (opts.dryRun) {
     result.applied = plan.map((p2) => ({
       pattern: p2.group.pattern,
@@ -59055,7 +59474,11 @@ async function applyGroupAssignments(client, crypto3, assignments, opts = {}) {
   }
   if (result.rulesSaved > 0)
     await saveBag(client, bag, version2);
+  const total = links.length + direct.reduce((n2, d2) => n2 + d2.ids.length, 0);
+  let done = 0;
   await postLinks(client, links);
+  done += links.length;
+  await opts.onProgress?.(done, total, "Categorizing transactions");
   for (const { ids, categoryId } of direct) {
     const categoryType = catIndex.byId.get(categoryId)?.type;
     for (let i2 = 0;i2 < ids.length; i2 += 200) {
@@ -59064,11 +59487,20 @@ async function applyGroupAssignments(client, crypto3, assignments, opts = {}) {
         categoryId,
         ...categoryType ? { categoryType } : {}
       });
+      done += Math.min(200, ids.length - i2);
+      await opts.onProgress?.(done, total, "Categorizing transactions");
     }
   }
   return result;
 }
 
+// src/lib/progress.ts
+function progressFor(ctx) {
+  if (!ctx?.mcp)
+    return;
+  return (done, total, message) => progress(ctx, done, total, message);
+}
+
 // src/tools/transactions.ts
 function dedupeKey(date5, description, amount, type) {
   return `${date5}|${description}|${amount.toFixed(2)}|${type}`;
@@ -59116,6 +59548,7 @@ async function importTransactions(client, crypto3, opts) {
       transactions: rows.slice(i2, i2 + CHUNK)
     });
     imported += res.imported ?? 0;
+    await opts.onProgress?.(Math.min(i2 + CHUNK, rows.length), rows.length, "Importing transactions");
   }
   return { imported, duplicatesSkipped, duplicatesFlagged };
 }
@@ -59296,17 +59729,27 @@ function transactionTools(client, crypto3) {
         endDate: exports_external.string().optional(),
         dryRun: exports_external.boolean().optional()
       }),
-      handler: ({ assignments, startDate, endDate, dryRun }) => applyGroupAssignments(client, crypto3, assignments, {
-        dryRun,
-        startDate,
-        endDate
-      })
+      handler: (args, ctx) => {
+        const { assignments, startDate, endDate, dryRun } = args;
+        const { expectedPlanHash } = args;
+        return applyGroupAssignments(client, crypto3, assignments, {
+          dryRun,
+          startDate,
+          endDate,
+          expectedPlanHash,
+          onProgress: progressFor(ctx)
+        });
+      }
     }),
     defineTool({
       name: "backfill_persons",
       description: "Create persons from UPI/IMPS counterparties in unlinked transactions (deduped by name) and link those transactions to them. Idempotent. dryRun previews.",
       input: exports_external.object({ dryRun: exports_external.boolean().optional() }),
-      handler: ({ dryRun }) => backfillPersons(client, crypto3, { dryRun })
+      handler: (args, ctx) => backfillPersons(client, crypto3, {
+        onProgress: progressFor(ctx),
+        dryRun: args.dryRun,
+        expectedPlanHash: args.expectedPlanHash
+      })
     }),
     defineTool({
       name: "update_transaction",
@@ -60033,7 +60476,7 @@ async function fetchReconciliationContext(client, accountId, start, end, budget
   const seen = new Set;
   return [...left, ...right].filter((r2) => r2.id == null ? true : !seen.has(r2.id) && seen.add(r2.id));
 }
-var sum = (rows) => Math.round(rows.reduce((n2, r2) => n2 + r2.amount, 0));
+var sum2 = (rows) => Math.round(rows.reduce((n2, r2) => n2 + r2.amount, 0));
 async function runStatementImport(deps, args) {
   const { client, crypto: crypto3 } = deps;
   const accounts = (await client.get("/api/accounts")).data ?? [];
@@ -60075,8 +60518,8 @@ async function runStatementImport(deps, args) {
     conflictCount: result.conflicts.length,
     new: {
       n: fresh.length,
-      debits: { n: debits.length, total: sum(debits) },
-      credits: { n: credits.length, total: sum(credits) }
+      debits: { n: debits.length, total: sum2(debits) },
+      credits: { n: credits.length, total: sum2(credits) }
     }
   };
   if (!args.confirm) {
@@ -60096,6 +60539,7 @@ async function runStatementImport(deps, args) {
     return { ...summary, dryRun: false, imported: 0 };
   const savings = account.type !== "credit_card";
   const imported = await importTransactions(client, crypto3, {
+    onProgress: deps.onProgress,
     accountId: account.id,
     source: savings ? "bank_statement" : "cc_statement",
     granularity: savings ? 1 : 2,
@@ -60144,7 +60588,13 @@ var statementSource = exports_external.enum([
 ]);
 var granularity = exports_external.number().int().min(1).max(5).describe("1=bank, 2=CC, 3=manual, 4=app export, 5=telegram/AI");
 function statementImportTools(client, crypto3) {
-  const pdf = (confirm) => variant(pdfInput, (args) => runStatementImport({ client, crypto: crypto3, readFile: readFileAsArrayBuffer, parsers: realParsers }, confirm ? { ...args, confirm: true } : args));
+  const pdf = (confirm2) => variant(pdfInput, (args, ctx) => runStatementImport({
+    client,
+    crypto: crypto3,
+    readFile: readFileAsArrayBuffer,
+    parsers: realParsers,
+    onProgress: progressFor(ctx)
+  }, confirm2 ? { ...args, confirm: true } : args));
   const csvParse = variant(exports_external.object({ filePath: exports_external.string() }), async ({ filePath }) => {
     if (crypto3)
       return CSV_PRIVATE_MODE_ERROR;
@@ -60205,8 +60655,9 @@ function statementImportTools(client, crypto3) {
           description: exports_external.string(),
           referenceNumber: exports_external.string().optional()
         }))
-      }), async ({ accountId, source, granularity: granularity2, transactions: txns }) => {
+      }), async ({ accountId, source, granularity: granularity2, transactions: txns }, ctx) => {
         const data = await importTransactions(client, crypto3, {
+          onProgress: progressFor(ctx),
           accountId,
           source,
           granularity: granularity2,
@@ -60220,7 +60671,7 @@ function statementImportTools(client, crypto3) {
         source: statementSource,
         granularity,
         filePath: exports_external.string()
-      }), async ({ accountId, source, granularity: granularity2, filePath }) => {
+      }), async ({ accountId, source, granularity: granularity2, filePath }, ctx) => {
         let txns;
         try {
           const raw = await readFile2(filePath, "utf8");
@@ -60237,6 +60688,7 @@ function statementImportTools(client, crypto3) {
           throw new Error(`Failed to read/parse ${filePath}: ${e2 instanceof Error ? e2.message : String(e2)}`);
         }
         const data = await importTransactions(client, crypto3, {
+          onProgress: progressFor(ctx),
           accountId,
           source,
           granularity: granularity2,
@@ -60363,7 +60815,7 @@ async function runTool(tool, args, mcp) {
 function jsonContents(uri, value) {
   return { contents: [{ uri: uri.href, mimeType: JSON_MIME, text: JSON.stringify(value ?? null) }] };
 }
-function registerResources(server, tools) {
+function registerResources2(server2, tools) {
   const byName = new Map(tools.map((t2) => [t2.name, t2]));
   const need = (name) => {
     const t2 = byName.get(name);
@@ -60373,13 +60825,13 @@ function registerResources(server, tools) {
   };
   for (const r2 of RESOURCES) {
     const tool = need(r2.tool);
-    server.registerResource(r2.name, r2.uri, { title: r2.title, description: r2.description, mimeType: JSON_MIME }, async (uri, mcp) => {
+    server2.registerResource(r2.name, r2.uri, { title: r2.title, description: r2.description, mimeType: JSON_MIME }, async (uri, mcp) => {
       const value = scrubCiphertext(await runTool(tool, r2.args, mcp));
       return jsonContents(uri, r2.shape ? r2.shape(value) : value);
     });
   }
   const getTransaction = need("get_transaction");
-  server.registerResource("transaction", new ResourceTemplate(TRANSACTION_TEMPLATE, { list: undefined }), {
+  server2.registerResource("transaction", new ResourceTemplate(TRANSACTION_TEMPLATE, { list: undefined }), {
     title: "Transaction",
     description: "One transaction by UUID (same as get_transaction; decrypted in private mode).",
     mimeType: JSON_MIME
@@ -60392,7 +60844,7 @@ function registerResources(server, tools) {
 // package.json
 var package_default = {
   name: "paisa-mcp",
-  version: "0.3.1",
+  version: "0.4.1",
   repository: {
     type: "git",
     url: "git+https://github.com/nimit9/paisa.git",
@@ -60421,7 +60873,7 @@ var package_default = {
     "@modelcontextprotocol/server": "^2.1.0",
     "@nimit9/signet-ai": "^0.1.11",
     "@nimit9/signet-lib": "^0.1.15",
-    "@nimit9/signet-server": "^0.2.2",
+    "@nimit9/signet-server": "^0.2.6",
     "@paisa/parsers": "workspace:*",
     "@paisa/reconciliation": "workspace:*",
     "@paisa/types": "workspace:*",
@@ -60448,19 +60900,30 @@ function paisaErrorResult(err) {
   });
 }
 function buildServer(client, crypto3) {
-  const tools = applyAnnotations(REGISTRATIONS.flatMap((group) => group.tools(client, crypto3)));
+  let initializeCapabilities = () => {
+    return;
+  };
+  const tools = applyAnnotations(REGISTRATIONS.flatMap((group) => group.tools(client, crypto3)).map((t2) => {
+    const caps = () => initializeCapabilities();
+    const describe3 = CONFIRMED_TOOLS[t2.name];
+    if (describe3)
+      return withConfirmation(t2, describe3, caps);
+    const count = BULK_CONFIRMED_TOOLS[t2.name];
+    return count ? withBulkConfirmation(t2, count, caps) : t2;
+  }));
   for (const t2 of tools)
     if (t2.input)
       withCompactJsonSchema(t2.input);
-  const server = createMcpServer({
+  const server2 = createMcpServer({
     name: "paisa",
     version: VERSION2,
     tools,
     errorResult: paisaErrorResult
   });
-  registerResources(server, tools);
-  registerPrompts(server);
-  return server;
+  initializeCapabilities = () => server2.server.getClientCapabilities();
+  registerResources2(server2, tools);
+  registerPrompts2(server2);
+  return server2;
 }
 
 // src/index.ts
@@ -60484,5 +60947,5 @@ main().catch((err) => {
   process.exit(1);
 });
 
-//# debugId=E169545C1C52BE7864756E2164756E21
+//# debugId=882108748FF621AF64756E2164756E21
 //# sourceMappingURL=index.js.map