paisa-mcp 0.4.1 → 0.4.2

package/dist/index.js

@@ -38033,17 +38033,6 @@ var inputRequired = Object.assign(buildInputRequired, {
     return { method: "roots/list" };
   }
 });
-function acceptedContent(responses, key, schema) {
-  const view = inputResponse(responses, key);
-  if (view.kind !== "elicit" || view.action !== "accept" || view.content === undefined)
-    return;
-  if (schema === undefined)
-    return view.content;
-  const outcome = schema["~standard"].validate(view.content);
-  if (outcome instanceof Promise)
-    throw new TypeError("acceptedContent(responses, key, schema) requires a synchronously-validating schema");
-  return outcome.issues === undefined ? outcome.value : undefined;
-}
 function inputResponse(responses, key) {
   if (responses === undefined || typeof responses !== "object" || responses === null)
     return { kind: "missing" };
@@ -53439,10 +53428,153 @@ async function initCrypto(client, pin, userId) {
   return { key };
 }
 
+// src/server.ts
+import { randomBytes } from "node:crypto";
+
 // ../../node_modules/.bun/@modelcontextprotocol+server@2.1.0/node_modules/@modelcontextprotocol/server/dist/index.mjs
 var DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
+var PREFIX = "v1.";
+function bytesToBase64Url(bytes) {
+  let bin = "";
+  for (const b of bytes)
+    bin += String.fromCodePoint(b);
+  return btoa(bin).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function constantTimeTagEqual(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let r = 0;
+  for (let i = 0;i < a.length; i++)
+    r |= a.codePointAt(i) ^ b.codePointAt(i);
+  return r === 0;
+}
+function base64UrlToBytes(s) {
+  const b64 = s.replaceAll("-", "+").replaceAll("_", "/");
+  const bin = atob(b64);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0;i < bin.length; i++)
+    bytes[i] = bin.codePointAt(i);
+  return bytes;
+}
+function createRequestStateCodec(options) {
+  const subtle = globalThis.crypto?.subtle;
+  if (subtle === undefined)
+    throw new TypeError("createRequestStateCodec requires the Web Crypto API (globalThis.crypto.subtle); see https://ts.sdk.modelcontextprotocol.io/v2/troubleshooting for the Node.js polyfill instructions");
+  const keyBytes = typeof options.key === "string" ? new TextEncoder().encode(options.key) : Uint8Array.from(options.key);
+  if (keyBytes.byteLength < 32)
+    throw new RangeError(`createRequestStateCodec: key must be at least 32 bytes (got ${keyBytes.byteLength})`);
+  const ttlSeconds = options.ttlSeconds ?? 600;
+  if (!Number.isFinite(ttlSeconds))
+    throw new RangeError("createRequestStateCodec: ttlSeconds must be a finite number");
+  const bind2 = options.bind;
+  let cryptoKey;
+  const importedKey = () => cryptoKey ??= subtle.importKey("raw", keyBytes, {
+    name: "HMAC",
+    hash: "SHA-256"
+  }, false, ["sign", "verify"]);
+  const utf8 = new TextEncoder;
+  const BIND_LABEL = "mcp.requestState.bind:";
+  const bindTag = async (value) => {
+    return bytesToBase64Url(new Uint8Array(await subtle.sign("HMAC", await importedKey(), utf8.encode(BIND_LABEL + value))).slice(0, 16));
+  };
+  return {
+    async mint(payload, ctx) {
+      const envelope = {
+        p: payload,
+        exp: Math.floor(Date.now() / 1000) + ttlSeconds
+      };
+      if (bind2 !== undefined) {
+        if (ctx === undefined)
+          throw new TypeError("createRequestStateCodec: mint() requires ctx when a bind callback is configured");
+        envelope.b = await bindTag(bind2(ctx));
+      }
+      const body = bytesToBase64Url(utf8.encode(JSON.stringify(envelope)));
+      return `${PREFIX}${body}.${bytesToBase64Url(new Uint8Array(await subtle.sign("HMAC", await importedKey(), utf8.encode(PREFIX + body))))}`;
+    },
+    async verify(state, ctx) {
+      const dot = state.lastIndexOf(".");
+      if (!state.startsWith(PREFIX) || dot <= 3)
+        throw new Error("malformed");
+      const body = state.slice(3, dot);
+      let macBytes;
+      try {
+        macBytes = base64UrlToBytes(state.slice(dot + 1));
+      } catch {
+        throw new Error("malformed");
+      }
+      if (!await subtle.verify("HMAC", await importedKey(), macBytes, utf8.encode(PREFIX + body)))
+        throw new Error("mac");
+      let envelope;
+      try {
+        envelope = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(base64UrlToBytes(body)));
+      } catch {
+        throw new Error("malformed");
+      }
+      if (typeof envelope.exp !== "number" || envelope.exp < Math.floor(Date.now() / 1000))
+        throw new Error("expired");
+      if (bind2 !== undefined) {
+        const expected = await bindTag(bind2(ctx));
+        if (envelope.b === undefined || !constantTimeTagEqual(envelope.b, expected))
+          throw new Error("bind");
+      } else if (envelope.b !== undefined)
+        throw new Error("bind");
+      return envelope.p;
+    }
+  };
+}
 
-// ../../node_modules/.bun/@nimit9+signet-server@0.2.6+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/interaction.js
+// ../../node_modules/.bun/@nimit9+signet-server@0.2.7+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/interaction.js
+var CONFIRM_KEY = "signet_confirm";
+function canonicalize(value) {
+  if (Array.isArray(value))
+    return value.map(canonicalize);
+  if (value !== null && typeof value === "object") {
+    const obj = value;
+    return Object.fromEntries(Object.keys(obj).sort().map((k) => [k, canonicalize(obj[k])]));
+  }
+  return value;
+}
+async function fingerprint(args) {
+  const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(canonicalize(args ?? null))));
+  return [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function confirm(ctx, { message, detail, args, key }) {
+  const id = key ?? `${CONFIRM_KEY}:${ctx.tool}`;
+  const view = inputResponse(ctx.mcp.mcpReq.inputResponses, id);
+  if (view.kind === "missing") {
+    if (!ctx.confirmSupport.getClientCapabilities()?.elicitation)
+      return "unsupported";
+    const payload = { tool: ctx.tool, id, fp: await fingerprint(args) };
+    const requestState = await ctx.confirmSupport.mint?.(payload);
+    return inputRequired({
+      inputRequests: {
+        [id]: inputRequired.elicit({
+          message: detail ? `${message}
+
+${detail}` : message,
+          requestedSchema: {
+            type: "object",
+            properties: { confirm: { type: "boolean", title: "Confirm" } },
+            required: ["confirm"]
+          }
+        })
+      },
+      ...requestState ? { requestState } : {}
+    });
+  }
+  if (view.kind !== "elicit" || view.action !== "accept" || view.content?.confirm !== true) {
+    return "declined";
+  }
+  if (ctx.confirmSupport.mint) {
+    const state = ctx.mcp.mcpReq.requestState();
+    if (!state || state.tool !== ctx.tool || state.id !== id || state.fp !== await fingerprint(args))
+      return "declined";
+  }
+  return "confirmed";
+}
+function isConfirmPending(value) {
+  return isInputRequiredResult(value);
+}
 async function progress(ctx, done, total, message) {
   const token = ctx.mcp.mcpReq._meta?.progressToken;
   if (token === undefined)
@@ -53459,7 +53591,7 @@ async function progress(ctx, done, total, message) {
     });
   } catch {}
 }
-// ../../node_modules/.bun/@nimit9+signet-server@0.2.6+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/http/status-codes.js
+// ../../node_modules/.bun/@nimit9+signet-server@0.2.7+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/http/status-codes.js
 var STATUS_CODES = {
   400: "BAD_REQUEST",
   401: "UNAUTHORIZED",
@@ -53473,7 +53605,7 @@ var STATUS_CODES = {
   429: "RATE_LIMITED"
 };
 
-// ../../node_modules/.bun/@nimit9+signet-server@0.2.6+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/errors.js
+// ../../node_modules/.bun/@nimit9+signet-server@0.2.7+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/errors.js
 function isZodError(err) {
   return err instanceof Error && err.name === "ZodError" && Array.isArray(err.issues);
 }
@@ -53537,7 +53669,7 @@ function report(opts, err, meta3, c) {
   } catch {}
 }
 
-// ../../node_modules/.bun/@nimit9+signet-server@0.2.6+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/primitives.js
+// ../../node_modules/.bun/@nimit9+signet-server@0.2.7+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/primitives.js
 var RAW = Symbol.for("signet.mcp.rawResult");
 function protocolError(err, deps, meta3) {
   if (ProtocolError.isInstance(err))
@@ -53570,8 +53702,14 @@ function checkScopes(scopes, token) {
   });
 }
 function baseContext(mcp, deps) {
-  const { c, token } = deps.context;
-  return { signal: mcp.mcpReq.signal, mcp, ...c ? { c } : {}, ...token ? { token } : {} };
+  const { c, token, confirmSupport } = deps.context;
+  return {
+    signal: mcp.mcpReq.signal,
+    mcp,
+    confirmSupport,
+    ...c ? { c } : {},
+    ...token ? { token } : {}
+  };
 }
 function toContents(uri, value, mimeType) {
   if (value !== null && typeof value === "object" && RAW in value)
@@ -53681,7 +53819,7 @@ function registerPrompts(server, prompts, deps) {
   }
 }
 
-// ../../node_modules/.bun/@nimit9+signet-server@0.2.6+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/server.js
+// ../../node_modules/.bun/@nimit9+signet-server@0.2.7+e803b2305afdb064/node_modules/@nimit9/signet-server/dist/mcp/server.js
 var RAW2 = Symbol.for("signet.mcp.rawResult");
 function toolResult(result) {
   return Object.defineProperty({ ...result }, RAW2, { value: true, enumerable: false });
@@ -53709,9 +53847,14 @@ function createMcpServer(options) {
     ...options.resources?.length ? { resources: { listChanged: false } } : {},
     ...options.prompts?.length ? { prompts: { listChanged: false } } : {}
   };
+  const confirmCodec = options.confirm ? createRequestStateCodec({
+    key: options.confirm.key,
+    ...options.confirm.ttlSeconds !== undefined ? { ttlSeconds: options.confirm.ttlSeconds } : {}
+  }) : undefined;
   const server = new McpServer({ name: options.name, version: options.version }, {
     ...unlisted.size ? {} : { capabilities: toolsCapability },
-    ...options.instructions ? { instructions: options.instructions } : {}
+    ...options.instructions ? { instructions: options.instructions } : {},
+    ...confirmCodec ? { requestState: { verify: confirmCodec.verify } } : {}
   });
   let restore;
   if (unlisted.size) {
@@ -53726,6 +53869,10 @@ function createMcpServer(options) {
         tool: tool.name,
         signal: mcp.mcpReq.signal,
         mcp,
+        confirmSupport: {
+          getClientCapabilities: () => server.server.getClientCapabilities(),
+          ...confirmCodec ? { mint: (payload) => confirmCodec.mint(payload, mcp) } : {}
+        },
         ...c ? { c } : {},
         ...token ? { token } : {}
       };
@@ -53764,7 +53911,14 @@ function createMcpServer(options) {
     restore?.();
     restore = undefined;
   }
-  const deps = { options, context: { ...c ? { c } : {}, ...token ? { token } : {} } };
+  const confirmSupport = {
+    getClientCapabilities: () => server.server.getClientCapabilities(),
+    ...confirmCodec ? { mint: (payload) => confirmCodec.mint(payload) } : {}
+  };
+  const deps = {
+    options,
+    context: { confirmSupport, ...c ? { c } : {}, ...token ? { token } : {} }
+  };
   if (options.resources?.length)
     registerResources(server, options.resources, deps);
   if (options.prompts?.length)
@@ -53867,84 +54021,34 @@ function applyAnnotations(tools) {
 }
 
 // src/lib/confirm.ts
-import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
-var ANSWER_KEY = "confirm";
-function clientCanConfirm(mcp, initializeCapabilities) {
-  const envelope = mcp.mcpReq.envelope;
-  const caps = envelope?.[CLIENT_CAPABILITIES_META_KEY] ?? initializeCapabilities();
-  return Boolean(caps?.elicitation);
-}
-function planFingerprint(plan) {
-  const canonical = (v) => Array.isArray(v) ? v.map(canonical) : v && typeof v === "object" ? Object.fromEntries(Object.entries(v).filter(([, x]) => x !== undefined).sort(([a], [b]) => a.localeCompare(b)).map(([k, x]) => [k, canonical(x)])) : v;
-  return createHash("sha256").update(JSON.stringify(canonical(plan))).digest("hex");
-}
-var STATE_KEY = randomBytes(32);
-function sign(nonce, fingerprint) {
-  return createHmac("sha256", STATE_KEY).update(`${nonce}.${fingerprint}`).digest("hex");
-}
-function mintState(fingerprint) {
-  const nonce = randomBytes(16).toString("hex");
-  return `${nonce}.${sign(nonce, fingerprint)}`;
-}
-function verifyState(state, fingerprint) {
-  if (typeof state !== "string")
-    return false;
-  const [nonce, mac3, ...rest] = state.split(".");
-  if (!nonce || !mac3 || rest.length)
-    return false;
-  const expected = Buffer.from(sign(nonce, fingerprint), "hex");
-  const given = Buffer.from(mac3, "hex");
-  return given.length === expected.length && timingSafeEqual(given, expected);
+var CANCELLED = { cancelled: true, message: "Cancelled by the user. Nothing was changed." };
+var PLAN_CHANGED = {
+  planChanged: true,
+  message: "The request changed after you confirmed, so nothing was changed. Run it again to see the new plan."
+};
+function acceptedDifferentPlan(ctx) {
+  const view = inputResponse(ctx.mcp.mcpReq.inputResponses, `signet_confirm:${ctx.tool}`);
+  return view.kind === "elicit" && view.action === "accept" && view.content?.confirm === true;
 }
-function confirmPlan(mcp, message, plan, initializeCapabilities = () => {
-  return;
-}) {
-  if (!clientCanConfirm(mcp, initializeCapabilities))
-    return { kind: "unsupported" };
-  const fingerprint = planFingerprint(plan);
-  const responses = mcp.mcpReq.inputResponses;
-  const answered = responses !== undefined && ANSWER_KEY in responses;
-  const echoed = mcp.mcpReq.requestState?.();
-  if (answered && verifyState(echoed, fingerprint)) {
-    const content = acceptedContent(responses, ANSWER_KEY);
-    if (content?.confirm === true)
-      return { kind: "confirmed" };
-    return {
-      kind: "declined",
-      result: { cancelled: true, message: "Cancelled by the user. Nothing was changed." }
-    };
-  }
-  return {
-    kind: "ask",
-    result: inputRequired({
-      inputRequests: {
-        [ANSWER_KEY]: inputRequired.elicit({
-          message,
-          requestedSchema: {
-            type: "object",
-            properties: {
-              confirm: { type: "boolean", title: "Confirm", description: "This can't be undone." }
-            },
-            required: ["confirm"]
-          }
-        })
-      },
-      requestState: mintState(fingerprint)
-    })
-  };
+async function askThenRun(ctx, message, plan, run, fallback = run) {
+  const answer = await confirm(ctx, { message, args: plan });
+  if (isConfirmPending(answer))
+    return answer;
+  if (answer === "confirmed")
+    return run();
+  if (answer === "unsupported")
+    return fallback();
+  return acceptedDifferentPlan(ctx) ? PLAN_CHANGED : CANCELLED;
 }
-function withConfirmation(tool, describe3, initializeCapabilities) {
+function withConfirmation(tool, describe3) {
   const run = tool.handler;
   return {
     ...tool,
-    handler: (args, ctx) => {
+    handler: async (args, ctx) => {
       const message = describe3(args);
       if (message === null || !ctx?.mcp)
         return run(args, ctx);
-      const outcome = confirmPlan(ctx.mcp, message, { tool: tool.name, args }, initializeCapabilities);
-      if (outcome.kind === "confirmed" || outcome.kind === "unsupported")
-        return run(args, ctx);
-      return outcome.result;
+      return askThenRun(ctx, message, { tool: tool.name, args }, () => run(args, ctx));
     }
   };
 }
@@ -54021,11 +54125,7 @@ var BULK_CONFIRMED_TOOLS = {
   }),
   bulk_link_entity: async (args) => ({ n: Array.isArray(args.links) ? args.links.length : 0 })
 };
-var PLAN_CHANGED = {
-  planChanged: true,
-  message: "The transactions changed after they were counted, so nothing was written. Run it again to see the new count."
-};
-function withBulkConfirmation(tool, count, initializeCapabilities) {
+function withBulkConfirmation(tool, count) {
   const run = tool.handler;
   const runPlanned = async (args, ctx, hash2) => {
     const result = await run(hash2 === undefined ? args : { ...args, expectedPlanHash: hash2 }, ctx);
@@ -54034,18 +54134,13 @@ function withBulkConfirmation(tool, count, initializeCapabilities) {
   return {
     ...tool,
     handler: async (args, ctx) => {
-      if (args.dryRun === true || !ctx?.mcp || !clientCanConfirm(ctx.mcp, initializeCapabilities))
+      const canAsk = Boolean(ctx?.confirmSupport?.getClientCapabilities()?.elicitation);
+      if (args.dryRun === true || !ctx?.mcp || !canAsk)
         return run(args, ctx);
       const { n, planHash: hash2 } = await count(args, async (a) => run(a, ctx));
       if (n <= BULK_CONFIRM_THRESHOLD)
         return runPlanned(args, ctx, hash2);
-      const message = `Update ${plural2(n, "transaction")} in one go?`;
-      const outcome = confirmPlan(ctx.mcp, message, { tool: tool.name, args, n, planHash: hash2 }, initializeCapabilities);
-      if (outcome.kind === "confirmed")
-        return runPlanned(args, ctx, hash2);
-      if (outcome.kind === "unsupported")
-        return run(args, ctx);
-      return outcome.result;
+      return askThenRun(ctx, `Update ${plural2(n, "transaction")} in one go?`, { tool: tool.name, args, n, planHash: hash2 }, () => runPlanned(args, ctx, hash2), () => run(args, ctx));
     }
   };
 }
@@ -54718,7 +54813,7 @@ function goalTools(client) {
   return [
     defineTool({
       name: "upsert_savings",
-      description: "Create (omit id) or update (pass id; all fields optional) a savings goal, EMI or sinking fund. Amounts are ₹ decimal strings, dates YYYY-MM-DD. Required on create — " + "goal: goalType, name, targetAmount. emi: name, totalAmount, emiAmount (monthly), startDate, endDate (last payment), totalMonths, owner. " + "sinking_fund: name, targetAmount, targetDate (due), monthlyContribution.",
+      description: "Create (omit id) or update (pass id; all fields optional) a savings goal, EMI or sinking fund. Amounts are ₹ decimal strings, dates YYYY-MM-DD. Required on create — " + "goal: goalType, name, targetAmount. emi: name, totalAmount, emiAmount (monthly), startDate, endDate (last payment), totalMonths, owner. " + "sinking_fund: name, targetAmount, targetDate (due), monthlyContribution. " + "status — goal: active|paused|completed|cancelled; emi: active|completed|foreclosed; sinking funds have none.",
       input: exports_external.object({
         type: exports_external.enum(["goal", "emi", "sinking_fund"]),
         id: exports_external.string().optional(),
@@ -54739,7 +54834,8 @@ function goalTools(client) {
         startDate: exports_external.string().optional(),
         endDate: exports_external.string().optional(),
         totalMonths: exports_external.number().optional(),
-        paidMonths: exports_external.number().optional()
+        paidMonths: exports_external.number().optional(),
+        status: exports_external.enum(["active", "paused", "completed", "cancelled", "foreclosed"]).optional().describe("goal: active|paused|completed|cancelled; emi: active|completed|foreclosed")
       }),
       handler: async ({ type, ...fields }) => {
         const require2 = (keys) => {
@@ -54748,6 +54844,14 @@ function goalTools(client) {
             throw new Error(`upsert_savings type='${type}' requires: ${missing.join(", ")}`);
           }
         };
+        const allowedStatus = {
+          goal: ["active", "paused", "completed", "cancelled"],
+          emi: ["active", "completed", "foreclosed"],
+          sinking_fund: []
+        };
+        if (fields.status !== undefined && !allowedStatus[type].includes(fields.status)) {
+          throw new Error(type === "sinking_fund" ? "upsert_savings type='sinking_fund' has no status" : `upsert_savings type='${type}' status must be one of: ${allowedStatus[type].join(", ")}`);
+        }
         if (type === "goal") {
           const {
             id: id2,
@@ -54760,7 +54864,8 @@ function goalTools(client) {
             owner,
             icon,
             color,
-            notes
+            notes,
+            status
           } = fields;
           const body2 = {
             type: goalType,
@@ -54772,7 +54877,8 @@ function goalTools(client) {
             owner,
             icon,
             color,
-            notes
+            notes,
+            status
           };
           if (!id2)
             require2(["name", "targetAmount", "goalType"]);
@@ -54790,7 +54896,8 @@ function goalTools(client) {
             totalMonths,
             paidMonths,
             interestRate,
-            outstandingPrincipal
+            outstandingPrincipal,
+            status
           } = fields;
           const { owner } = fields;
           if (!id2) {
@@ -54814,7 +54921,8 @@ function goalTools(client) {
             paidMonths,
             interestRate,
             outstandingPrincipal,
-            owner
+            owner,
+            status
           };
           const data2 = id2 ? await client.patch(`/api/goals/emis/${id2}`, body2) : await client.post("/api/goals/emis", body2);
           return data2;
@@ -59025,9 +59133,9 @@ function parseAmount4(raw) {
   return Number.isNaN(num) ? 0 : Math.abs(num);
 }
 // src/lib/plan-hash.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash } from "node:crypto";
 function planHash(ids) {
-  return createHash2("sha256").update([...ids].sort().join(",")).digest("hex");
+  return createHash("sha256").update([...ids].sort().join(",")).digest("hex");
 }
 
 // src/lib/txn-rows.ts
@@ -59105,6 +59213,9 @@ function toLeanRow(r2, personNames) {
 function normalizePersonName(name) {
   return name.toLowerCase().trim().replace(/\s+/g, " ");
 }
+function normalizeUpiHandle(handle) {
+  return handle.toLowerCase().trim().split("@")[0];
+}
 async function loadDecryptedPersons(client, crypto3) {
   const res = await client.get("/api/persons");
   const persons = [];
@@ -59116,7 +59227,7 @@ async function loadDecryptedPersons(client, crypto3) {
       } catch {}
     }
     if (name)
-      persons.push({ id: p2.id, name });
+      persons.push({ id: p2.id, name, upiHandles: p2.upiHandles ?? [] });
   }
   return persons;
 }
@@ -59156,10 +59267,15 @@ function isPersonLikeNarration(description) {
 async function backfillPersons(client, crypto3, opts = {}) {
   const existing = await loadDecryptedPersons(client, crypto3);
   const personIdByNorm = new Map;
-  for (const p2 of existing)
+  const personIdByHandle = new Map;
+  for (const p2 of existing) {
     personIdByNorm.set(normalizePersonName(p2.name), p2.id);
+    for (const h2 of p2.upiHandles)
+      personIdByHandle.set(normalizeUpiHandle(h2), p2.id);
+  }
   const { rows, truncated } = await fetchAllRowsPaged(client, crypto3, { unresolved: "true" });
   const candidates = rows.filter((r2) => !r2.merchantId && !r2.personId && !r2.isTransfer && !r2.isIgnored);
+  const directLinks = [];
   const groups = new Map;
   for (const t2 of candidates) {
     const { name, upiId, paymentMethod } = parseNarration(t2.description);
@@ -59167,6 +59283,11 @@ async function backfillPersons(client, crypto3, opts = {}) {
       continue;
     if (classifyEntity({ paymentMethod, extractedName: name }) !== "person")
       continue;
+    const handlePersonId = upiId ? personIdByHandle.get(normalizeUpiHandle(upiId)) : undefined;
+    if (handlePersonId) {
+      directLinks.push({ transactionId: t2.id, personId: handlePersonId, upiHandle: upiId });
+      continue;
+    }
     const norm = normalizePersonName(name);
     if (!norm)
       continue;
@@ -59182,7 +59303,7 @@ async function backfillPersons(client, crypto3, opts = {}) {
   }
   const plan = [];
   const newGroups = [];
-  let reused = 0;
+  const reusedPersonIds = new Set;
   for (const [norm, g2] of groups) {
     const upiHandles = [...g2.upiHandles];
     const isReuse = personIdByNorm.has(norm);
@@ -59194,11 +59315,34 @@ async function backfillPersons(client, crypto3, opts = {}) {
       action: isReuse ? "reuse" : "create"
     });
     if (isReuse)
-      reused++;
+      reusedPersonIds.add(personIdByNorm.get(norm));
     else
       newGroups.push({ norm, displayName: g2.displayName, upiHandles });
   }
-  const hash2 = planHash([...groups.values()].flatMap((g2) => g2.txnIds));
+  const directByPerson = new Map;
+  for (const d2 of directLinks) {
+    const e2 = directByPerson.get(d2.personId) ?? { txnIds: [], handles: new Set };
+    e2.txnIds.push(d2.transactionId);
+    if (d2.upiHandle)
+      e2.handles.add(d2.upiHandle);
+    directByPerson.set(d2.personId, e2);
+  }
+  for (const [personId, e2] of directByPerson) {
+    const person = existing.find((p2) => p2.id === personId);
+    plan.push({
+      name: person?.name ?? personId,
+      normalized: person ? normalizePersonName(person.name) : personId,
+      txnCount: e2.txnIds.length,
+      upiHandles: [...e2.handles],
+      action: "reuse"
+    });
+    reusedPersonIds.add(personId);
+  }
+  const reused = reusedPersonIds.size;
+  const hash2 = planHash([
+    ...[...groups.values()].flatMap((g2) => g2.txnIds),
+    ...directLinks.map((d2) => d2.transactionId)
+  ]);
   if (!opts.dryRun && opts.expectedPlanHash !== undefined && opts.expectedPlanHash !== hash2) {
     return {
       dryRun: false,
@@ -59240,6 +59384,7 @@ async function backfillPersons(client, crypto3, opts = {}) {
       for (const txnId of g2.txnIds)
         links.push({ transactionId: txnId, personId });
     }
+    links.push(...directLinks);
   }
   if (!opts.dryRun && links.length > 0) {
     const CHUNK = 25;
@@ -59380,7 +59525,13 @@ async function applyGroupAssignments(client, crypto3, assignments, opts = {}) {
     }
     for (const g2 of hits) {
       claimed.add(g2);
-      plan.push({ group: g2, categoryId: cat.id, slug: cat.slug, learn: a2.learn !== false });
+      plan.push({
+        group: g2,
+        categoryId: cat.id,
+        slug: cat.slug,
+        learn: a2.learn !== false,
+        confirmMerchant: !!a2.confirmMerchant
+      });
     }
   }
   result.planHash = planHash(plan.flatMap((p2) => p2.group.rows.map((r2) => r2.id)));
@@ -59414,10 +59565,10 @@ async function applyGroupAssignments(client, crypto3, assignments, opts = {}) {
   const learnPlans = [];
   const directPlans = [];
   for (const p2 of plan) {
-    const { group, learn } = p2;
+    const { group, learn, confirmMerchant } = p2;
     if (!learn || group.pattern === UNPARSED) {
       directPlans.push({ p: p2, reason: learn ? UNPARSED : undefined });
-    } else if (crypto3 && group.rows.some((r2) => isPersonLikeNarration(r2.description))) {
+    } else if (crypto3 && !confirmMerchant && group.rows.some((r2) => isPersonLikeNarration(r2.description))) {
       directPlans.push({ p: p2, reason: `${group.pattern} (private mode: person-like)` });
     } else if (taught.has(group.pattern) && taught.get(group.pattern) !== p2.categoryId) {
       directPlans.push({ p: p2, reason: `${group.pattern} (conflicting category for same pattern)` });
@@ -59723,7 +59874,8 @@ function transactionTools(client, crypto3) {
           pattern: exports_external.string().describe("Exactly as returned"),
           type: exports_external.enum(["debit", "credit"]).optional(),
           categorySlug: exports_external.string(),
-          learn: exports_external.boolean().optional().describe("false = no rule (short/generic patterns)")
+          learn: exports_external.boolean().optional().describe("false = no rule (short/generic patterns)"),
+          confirmMerchant: exports_external.boolean().optional().describe("true = you've confirmed this pattern is a real business (brand lookup, web search, etc), not a person — skips the private-mode person-like block that would otherwise refuse to save a merchant rule")
         })).min(1).max(100),
         startDate: exports_external.string().optional().describe("Same range as the listing"),
         endDate: exports_external.string().optional(),
@@ -60809,7 +60961,14 @@ function scrubCiphertext(value) {
 }
 async function runTool(tool, args, mcp) {
   const input2 = tool.input ? await tool.input.parseAsync(args) : args;
-  const ctx = { tool: tool.name, signal: mcp.mcpReq.signal, mcp };
+  const ctx = {
+    tool: tool.name,
+    signal: mcp.mcpReq.signal,
+    mcp,
+    confirmSupport: { getClientCapabilities: () => {
+      return;
+    } }
+  };
   return tool.handler(input2, ctx);
 }
 function jsonContents(uri, value) {
@@ -60844,7 +61003,7 @@ function registerResources2(server2, tools) {
 // package.json
 var package_default = {
   name: "paisa-mcp",
-  version: "0.4.1",
+  version: "0.4.2",
   repository: {
     type: "git",
     url: "git+https://github.com/nimit9/paisa.git",
@@ -60873,7 +61032,7 @@ var package_default = {
     "@modelcontextprotocol/server": "^2.1.0",
     "@nimit9/signet-ai": "^0.1.11",
     "@nimit9/signet-lib": "^0.1.15",
-    "@nimit9/signet-server": "^0.2.6",
+    "@nimit9/signet-server": "^0.2.7",
     "@paisa/parsers": "workspace:*",
     "@paisa/reconciliation": "workspace:*",
     "@paisa/types": "workspace:*",
@@ -60899,17 +61058,14 @@ function paisaErrorResult(err) {
     content: [{ type: "text", text: err instanceof Error ? err.message : String(err) }]
   });
 }
+var CONFIRM_KEY2 = randomBytes(32);
 function buildServer(client, crypto3) {
-  let initializeCapabilities = () => {
-    return;
-  };
   const tools = applyAnnotations(REGISTRATIONS.flatMap((group) => group.tools(client, crypto3)).map((t2) => {
-    const caps = () => initializeCapabilities();
     const describe3 = CONFIRMED_TOOLS[t2.name];
     if (describe3)
-      return withConfirmation(t2, describe3, caps);
+      return withConfirmation(t2, describe3);
     const count = BULK_CONFIRMED_TOOLS[t2.name];
-    return count ? withBulkConfirmation(t2, count, caps) : t2;
+    return count ? withBulkConfirmation(t2, count) : t2;
   }));
   for (const t2 of tools)
     if (t2.input)
@@ -60918,9 +61074,9 @@ function buildServer(client, crypto3) {
     name: "paisa",
     version: VERSION2,
     tools,
-    errorResult: paisaErrorResult
+    errorResult: paisaErrorResult,
+    confirm: { key: CONFIRM_KEY2 }
   });
-  initializeCapabilities = () => server2.server.getClientCapabilities();
   registerResources2(server2, tools);
   registerPrompts2(server2);
   return server2;
@@ -60947,5 +61103,5 @@ main().catch((err) => {
   process.exit(1);
 });
 
-//# debugId=882108748FF621AF64756E2164756E21
+//# debugId=24F552E300AC132164756E2164756E21
 //# sourceMappingURL=index.js.map