plm-upload-mcp 1.1.0 → 1.2.0

package/index.mjs

@@ -1,496 +1,771 @@
-#!/usr/bin/env node
-/**
- * plm-upload-mcp — read the LionsBot PLM and bulk-upload local files
- * (SolidWorks STEP/PDF exports) into it, matched to a component by SKU.
- *
- * Runs locally on each engineer's machine (stdio), so it reads their exported
- * files straight off disk. It authenticates as the engineer with their own PLM
- * login (GoTrue password grant) and every uploaded file is tagged with who
- * uploaded it, server-side, by the plm-edge `upload` action. The read-only
- * tools query PostgREST directly with the engineer's token, so RLS applies
- * exactly as it does in the PLM web app — they only ever see what they may see.
- *
- * Config (env):
- *   PLM_EMAIL, PLM_PASSWORD   — the engineer's PLM/hub login (required)
- *   PLM_GATEWAY, PLM_ANON_KEY, PLM_EDGE_URL — override the baked prod defaults
- */
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
-import { z } from 'zod'
-import { readFile } from 'node:fs/promises'
-import { basename, extname } from 'node:path'
-
-// Prod defaults — same values the PLM web app ships with. Overridable via env.
-const GATEWAY = process.env.PLM_GATEWAY || 'https://gateway-production-c13d.up.railway.app'
-const ANON_KEY =
-  process.env.PLM_ANON_KEY ||
-  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiIsImlzcyI6InN1cGFiYXNlIiwiaWF0IjoxNzg0NzE1NTExLCJleHAiOjIxMDAwNzU1MTF9.kqtdfumqx4EjRyJ15Ld0gSZBYdeE0VnpmlnJy68qQT0'
-const EDGE = process.env.PLM_EDGE_URL || 'https://plm-edge-production.up.railway.app'
-const EMAIL = process.env.PLM_EMAIL
-const PASSWORD = process.env.PLM_PASSWORD
-
-const MIME = {
-  '.step': 'application/step',
-  '.stp': 'application/step',
-  '.pdf': 'application/pdf',
-  '.sldprt': 'application/octet-stream',
-  '.sldasm': 'application/octet-stream',
-  '.dxf': 'application/dxf',
-  '.dwg': 'application/acad',
-  '.igs': 'model/iges',
-  '.iges': 'model/iges',
-  '.png': 'image/png',
-  '.jpg': 'image/jpeg',
-  '.jpeg': 'image/jpeg',
-}
-const mimeFor = (name) => MIME[extname(name).toLowerCase()] || 'application/octet-stream'
-
-// Supabase Storage rejects object keys with chars outside its safe set (notably
-// '[' ']', which the common "[SKU] Name" convention starts with) -> the store
-// call 400s with "storage upload failed: 400". The key is internal/UUID-prefixed
-// and never shown, so sanitize it to the safe set; the Drive display name (the
-// separate `upload` filename) keeps the original, brackets and all.
-const storageKeyName = (name) => name.replace(/[^\w !\-.*'()&$@=;:+,?/]/g, '_')
-
-// --- Auth: cache one access token, re-grant when it's near expiry. -----------
-let cached = { token: null, exp: 0 }
-async function getToken() {
-  if (cached.token && Date.now() < cached.exp - 60_000) return cached.token
-  if (!EMAIL || !PASSWORD) throw new Error('PLM_EMAIL and PLM_PASSWORD must be set in the MCP config env.')
-  const resp = await fetch(`${GATEWAY}/auth/v1/token?grant_type=password`, {
-    method: 'POST',
-    headers: { 'content-type': 'application/json', apikey: ANON_KEY },
-    body: JSON.stringify({ email: EMAIL, password: PASSWORD }),
-  })
-  const data = await resp.json().catch(() => null)
-  if (!resp.ok || !data?.access_token) {
-    throw new Error(`PLM sign-in failed for ${EMAIL}: ${data?.error_description || data?.msg || resp.status}`)
-  }
-  cached = { token: data.access_token, exp: Date.now() + (data.expires_in ?? 3600) * 1000 }
-  return cached.token
-}
-
-async function edgeJson(body) {
-  const token = await getToken()
-  const resp = await fetch(`${EDGE}/drive-library`, {
-    method: 'POST',
-    headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
-    body: JSON.stringify(body),
-  })
-  const data = await resp.json().catch(() => null)
-  if (!resp.ok) throw new Error(data?.error || `edge ${body.action} failed: http ${resp.status}`)
-  return data
-}
-
-// --- Read path: PostgREST GET with the engineer's token (RLS-enforced). -------
-// Same data path the PLM web app uses (supabase-js -> /rest/v1). The anon key is
-// the gateway apikey; the bearer token is the signed-in engineer, so row-level
-// security decides what comes back — these tools can never read past the user.
-async function restGet(table, params = {}, { count = false } = {}) {
-  const token = await getToken()
-  const qs = new URLSearchParams(params).toString()
-  const headers = { apikey: ANON_KEY, authorization: `Bearer ${token}` }
-  if (count) headers['prefer'] = 'count=exact'
-  const resp = await fetch(`${GATEWAY}/rest/v1/${table}?${qs}`, { headers })
-  const data = await resp.json().catch(() => null)
-  if (!resp.ok) throw new Error(data?.message || data?.error || `read ${table} failed: http ${resp.status}`)
-  // content-range is "start-end/total" (or "*/total") when count=exact.
-  const total = count ? Number((resp.headers.get('content-range') || '').split('/')[1]) || null : null
-  return { rows: Array.isArray(data) ? data : [], total }
-}
-
-// bucket -> components.staging filter. 'main' = confirmed, 'staging' = unconfirmed.
-const stagingFilter = (bucket) =>
-  bucket === 'staging' ? { staging: 'eq.true' } : bucket === 'main' ? { staging: 'eq.false' } : {}
-
-/** store bytes → storagePath, then upload → mirror into the SKU's Drive folder. */
-async function uploadOne({ path, sku, skuName, category, bucket }) {
-  const bytes = await readFile(path) // throws ENOENT with the path — surfaced per-file below
-  const filename = basename(path)
-  const mimeType = mimeFor(filename)
-  const token = await getToken()
-
-  // Store under a storage-safe key; the Drive file keeps the original filename below.
-  const params = new URLSearchParams({ action: 'store', sku, filename: storageKeyName(filename), mimeType })
-  const sResp = await fetch(`${EDGE}/drive-library?${params}`, {
-    method: 'POST',
-    headers: { 'content-type': mimeType, authorization: `Bearer ${token}` },
-    body: bytes,
-  })
-  const stored = await sResp.json().catch(() => null)
-  if (!sResp.ok || !stored?.storagePath) {
-    throw new Error(stored?.error || `store failed: http ${sResp.status}`)
-  }
-
-  const synced = await edgeJson({
-    action: 'upload',
-    sku,
-    skuName: skuName ?? '',
-    storagePath: stored.storagePath,
-    filename,
-    mimeType,
-    bucket,
-  })
-  if (synced?.error) throw new Error(synced.error)
-
-  if (category && category !== 'Default' && synced?.driveFileId) {
-    await edgeJson({ action: 'set-category', fileId: synced.driveFileId, category }).catch(() => {})
-  }
-
-  return {
-    file: filename,
-    sku,
-    driveFileId: synced.driveFileId,
-    driveWebViewLink: synced.driveWebViewLink,
-    replaced: !!synced.replaced,
-    category: category && category !== 'Default' ? category : undefined,
-  }
-}
-
-// --- Server ------------------------------------------------------------------
-const server = new McpServer({ name: 'plm-upload', version: '1.1.0' })
-
-server.registerTool(
-  'upload_files',
-  {
-    title: 'Upload files to PLM by SKU',
-    description:
-      "Bulk-upload local files (e.g. SolidWorks STEP/PDF exports) into the LionsBot PLM. " +
-      "Each file is attached to a component by its SKU: it lands in PLM storage and is mirrored " +
-      "into that SKU's Google Drive folder (folder auto-created if missing). Re-uploading a file " +
-      "with the same name replaces it in place rather than duplicating. You must supply the SKU " +
-      "for each file — the caller's own tooling (e.g. a SolidWorks MCP) already knows each part's SKU.",
-    inputSchema: {
-      files: z
-        .array(
-          z.object({
-            path: z.string().describe('Absolute local path to the file to upload.'),
-            sku: z.string().describe('Component SKU this file belongs to, e.g. MNT-1234-A0.'),
-            skuName: z
-              .string()
-              .optional()
-              .describe("Component display name — used only if the SKU's Drive folder must be created."),
-            category: z
-              .enum(['Default', 'Archive', 'Compliance', 'Ops'])
-              .optional()
-              .describe('PLM file category tag. Defaults to Default.'),
-          }),
-        )
-        .min(1)
-        .describe('The files to upload, each paired with its target SKU.'),
-      bucket: z
-        .enum(['main', 'staging'])
-        .optional()
-        .describe("Which shared drive: 'main' (confirmed components, default) or 'staging' (unconfirmed)."),
-    },
-    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
-  },
-  async ({ files, bucket = 'main' }) => {
-    const results = []
-    for (const f of files) {
-      try {
-        results.push({ ok: true, ...(await uploadOne({ ...f, bucket })) })
-      } catch (e) {
-        results.push({ ok: false, file: basename(f.path), sku: f.sku, error: e instanceof Error ? e.message : String(e) })
-      }
-    }
-    const ok = results.filter((r) => r.ok).length
-    const lines = results.map((r) =>
-      r.ok
-        ? `✓ ${r.file} → ${r.sku}${r.replaced ? ' (replaced)' : ''}${r.category ? ` [${r.category}]` : ''}`
-        : `✗ ${r.file} → ${r.sku}: ${r.error}`,
-    )
-    return {
-      content: [{ type: 'text', text: `Uploaded ${ok}/${results.length} to ${bucket}.\n${lines.join('\n')}` }],
-      structuredContent: { uploaded: ok, total: results.length, bucket, results },
-    }
-  },
-)
-
-server.registerTool(
-  'list_component_files',
-  {
-    title: 'List a component\'s PLM files',
-    description: "Lists the files currently in a component's Google Drive folder in the PLM, by SKU.",
-    inputSchema: {
-      sku: z.string().describe('Component SKU, e.g. MNT-1234-A0.'),
-      bucket: z.enum(['main', 'staging']).optional().describe("'main' (default) or 'staging'."),
-    },
-    annotations: { readOnlyHint: true, openWorldHint: true },
-  },
-  async ({ sku, bucket = 'main' }) => {
-    const data = await edgeJson({ action: 'list', sku, bucket })
-    const files = Array.isArray(data?.files) ? data.files : []
-    if (!data?.connected) {
-      return { content: [{ type: 'text', text: `Drive not connected or no folder for ${sku}.` }], structuredContent: { connected: false, files: [] } }
-    }
-    const lines = files.map((x) => `• ${x.name}${x.appProperties?.plmCategory ? ` [${x.appProperties.plmCategory}]` : ''}`)
-    return {
-      content: [{ type: 'text', text: files.length ? `${sku} — ${files.length} file(s):\n${lines.join('\n')}` : `${sku} — folder is empty.` }],
-      structuredContent: { connected: true, folder: data.folder ?? null, files },
-    }
-  },
-)
-
-// === Read-only tools (RLS-enforced via the engineer's token) =================
-
-server.registerTool(
-  'list_sku_folders',
-  {
-    title: 'List all SKU folders',
-    description:
-      "List every component SKU in the PLM with its Google Drive folder — the SKU→folder map. " +
-      "Returns SKU, name, category, type, revision, status, whether it is a staging (unconfirmed) " +
-      "or main (confirmed) part, and the Drive folder id/URL. Read-only. Use it to discover which " +
-      "SKUs exist and where each part's files live, or to find the folder for a SKU before uploading.",
-    inputSchema: {
-      bucket: z
-        .enum(['main', 'staging', 'all'])
-        .optional()
-        .describe("Filter by drive: 'main' (confirmed), 'staging' (unconfirmed), or 'all' (default)."),
-      category: z.string().optional().describe('Optional exact category code filter, e.g. MNT.'),
-      with_folder_only: z
-        .boolean()
-        .optional()
-        .describe('If true, only SKUs that already have a Drive folder. Default false.'),
-      limit: z.number().int().min(1).max(2000).optional().describe('Max rows (default 1000).'),
-      offset: z.number().int().min(0).optional().describe('Row offset for paging (default 0).'),
-    },
-    annotations: { readOnlyHint: true, openWorldHint: true },
-  },
-  async ({ bucket = 'all', category, with_folder_only = false, limit = 1000, offset = 0 }) => {
-    const params = {
-      select: 'sku,name,category,sku_type,revision,status,staging,drive_folder_id,drive_folder_url',
-      order: 'sku.asc',
-      limit: String(limit),
-      offset: String(offset),
-      ...stagingFilter(bucket),
-    }
-    if (category) params.category = `eq.${category}`
-    if (with_folder_only) params.drive_folder_id = 'not.is.null'
-    const { rows, total } = await restGet('components', params, { count: true })
-    const withFolder = rows.filter((r) => r.drive_folder_id).length
-    const lines = rows
-      .slice(0, 50)
-      .map((r) => `• ${r.sku} — ${r.name}${r.staging ? ' [staging]' : ''}${r.drive_folder_id ? '' : ' (no folder)'}`)
-    const more = rows.length > 50 ? `\n… ${rows.length - 50} more (of ${total ?? rows.length}).` : ''
-    return {
-      content: [
-        {
-          type: 'text',
-          text: `${rows.length} SKU(s) (${withFolder} with a Drive folder) of ${total ?? '?'} total in ${bucket}.\n${lines.join('\n')}${more}`,
-        },
-      ],
-      structuredContent: { bucket, count: rows.length, total, folders: rows },
-    }
-  },
-)
-
-server.registerTool(
-  'get_component_metadata',
-  {
-    title: 'Get component metadata',
-    description:
-      "Read full component metadata from the PLM component database. Every column — identity " +
-      "(sku, name, category, type, revision, status), cost/supply (unit_cost, moq, lead time, " +
-      "preferred_supplier), drawing-extracted fields (material, colour, manufacturing_method, " +
-      "release_status), CAD provenance, compliance (RoHS/REACH/CE), and Drive folder — plus the " +
-      "extract_meta provenance block. Pass a single `sku` for one part, or omit it to page through " +
-      "all parts. Read-only.",
-    inputSchema: {
-      sku: z.string().optional().describe('Exact SKU for a single component, e.g. MNT-1234-A0.'),
-      search: z.string().optional().describe('Case-insensitive substring match on SKU or name.'),
-      bucket: z.enum(['main', 'staging', 'all']).optional().describe("'main', 'staging', or 'all' (default)."),
-      category: z.string().optional().describe('Optional exact category code filter, e.g. MNT.'),
-      status: z.enum(['active', 'obsolete']).optional().describe('Optional lifecycle status filter.'),
-      limit: z.number().int().min(1).max(500).optional().describe('Max rows when listing (default 100).'),
-      offset: z.number().int().min(0).optional().describe('Row offset for paging (default 0).'),
-    },
-    annotations: { readOnlyHint: true, openWorldHint: true },
-  },
-  async ({ sku, search, bucket = 'all', category, status, limit = 100, offset = 0 }) => {
-    const params = { select: '*', order: 'sku.asc', ...stagingFilter(bucket) }
-    if (sku) {
-      params.sku = `eq.${sku}`
-      params.limit = '1'
-    } else {
-      params.limit = String(limit)
-      params.offset = String(offset)
-      if (search) params.or = `(sku.ilike.*${search}*,name.ilike.*${search}*)`
-      if (category) params.category = `eq.${category}`
-      if (status) params.status = `eq.${status}`
-    }
-    const { rows, total } = await restGet('components', params, { count: !sku })
-    if (sku) {
-      const c = rows[0]
-      if (!c) return { content: [{ type: 'text', text: `No component with SKU ${sku}.` }], structuredContent: { component: null } }
-      return {
-        content: [{ type: 'text', text: `${c.sku} — ${c.name} (${c.category}, rev ${c.revision ?? '—'}, ${c.status}${c.staging ? ', staging' : ''}).` }],
-        structuredContent: { component: c },
-      }
-    }
-    const lines = rows.slice(0, 50).map((c) => `• ${c.sku} — ${c.name} (${c.status}${c.staging ? ', staging' : ''})`)
-    const more = rows.length > 50 ? `\n… ${rows.length - 50} more shown truncated (of ${total ?? rows.length}).` : ''
-    return {
-      content: [{ type: 'text', text: `${rows.length} component(s) of ${total ?? '?'} total in ${bucket}.\n${lines.join('\n')}${more}` }],
-      structuredContent: { bucket, count: rows.length, total, components: rows },
-    }
-  },
-)
-
-server.registerTool(
-  'list_bom_extract_metadata',
-  {
-    title: 'List extracted BOM/drawing metadata',
-    description:
-      "List the metadata machine-extracted from each part's drawing/BOM PDF (the PLM `extract` step) " +
-      "across all components. For each SKU returns its extract_meta: the Lionsbot-custom-drawing flag, " +
-      "the SKU/drawing match check, the per-field extracted values (release status, material, colour, " +
-      "manufacturing method, CAD revision, drawn/designed by), and the source file + who/when it was " +
-      "extracted. Only parts that have been extracted are returned. Read-only.",
-    inputSchema: {
-      sku: z.string().optional().describe('Restrict to a single SKU, e.g. MNT-1234-A0.'),
-      bucket: z.enum(['main', 'staging', 'all']).optional().describe("'main', 'staging', or 'all' (default)."),
-      limit: z.number().int().min(1).max(2000).optional().describe('Max rows (default 1000).'),
-      offset: z.number().int().min(0).optional().describe('Row offset for paging (default 0).'),
-    },
-    annotations: { readOnlyHint: true, openWorldHint: true },
-  },
-  async ({ sku, bucket = 'all', limit = 1000, offset = 0 }) => {
-    const params = {
-      select: 'sku,name,category,staging,material,colour,manufacturing_method,release_status,cad_revision,cad_drawn_by,cad_designed_by,extract_meta',
-      order: 'sku.asc',
-      limit: String(limit),
-      offset: String(offset),
-      ...stagingFilter(bucket),
-    }
-    // extract_meta '{}' means never extracted — exclude it.
-    params.extract_meta = 'neq.{}'
-    if (sku) params.sku = `eq.${sku}`
-    const { rows, total } = await restGet('components', params, { count: true })
-    const lines = rows.slice(0, 50).map((r) => {
-      const lb = r.extract_meta?.is_lionsbot === true ? ' [LB]' : ''
-      const m = r.extract_meta?.sku_check?.match === true ? ' ✓match' : r.extract_meta?.sku_check ? ' ✗mismatch' : ''
-      return `• ${r.sku} — ${r.name}${lb}${m}`
-    })
-    const more = rows.length > 50 ? `\n… ${rows.length - 50} more (of ${total ?? rows.length}).` : ''
-    return {
-      content: [{ type: 'text', text: `${rows.length} extracted part(s) of ${total ?? '?'} in ${bucket}.\n${lines.join('\n')}${more}` }],
-      structuredContent: { bucket, count: rows.length, total, extracted: rows },
-    }
-  },
-)
-
-server.registerTool(
-  'list_boms',
-  {
-    title: 'List all BOMs (products + staging)',
-    description:
-      "List the bills of materials across all products. Each product carries its BOM(s) with the line " +
-      "items — component SKU, name, quantity, unit, reference designator — and a derived `staging` flag: " +
-      "a product is 'staging' while its working BOM still contains any staging (unconfirmed) component, " +
-      "otherwise 'main'. By default returns working BOMs only (set include_snapshots to include saved " +
-      "snapshots) with their rows. Filter to one product with product_sku. Read-only.",
-    inputSchema: {
-      product_sku: z.string().optional().describe('Restrict to one product by its SAL SKU, e.g. SAL-0R3-3001.'),
-      classification: z
-        .enum(['main', 'staging', 'all'])
-        .optional()
-        .describe("Only products in this derived class: 'main', 'staging', or 'all' (default)."),
-      include_snapshots: z.boolean().optional().describe('Include saved snapshot BOMs, not just the working BOM. Default false.'),
-      include_rows: z.boolean().optional().describe('Include BOM line items. Default true.'),
-      max_rows_per_bom: z.number().int().min(1).max(5000).optional().describe('Cap rows fetched per BOM (default 2000).'),
-    },
-    annotations: { readOnlyHint: true, openWorldHint: true },
-  },
-  async ({ product_sku, classification = 'all', include_snapshots = false, include_rows = true, max_rows_per_bom = 2000 }) => {
-    // 1) BOM headers + their product.
-    const bomParams = {
-      select: 'id,name,is_snapshot,snapshot_label,product_id,created_at,product:products(sku,name,status)',
-      order: 'created_at.asc',
-    }
-    if (!include_snapshots) bomParams.is_snapshot = 'eq.false'
-    const { rows: boms } = await restGet('boms', bomParams, {})
-    let scoped = product_sku ? boms.filter((b) => b.product?.sku === product_sku) : boms
-    if (!scoped.length) {
-      return { content: [{ type: 'text', text: product_sku ? `No BOMs for product ${product_sku}.` : 'No BOMs found.' }], structuredContent: { products: [] } }
-    }
-
-    // 2) Rows for those BOMs, embedding each component's SKU + staging flag.
-    const byBom = new Map(scoped.map((b) => [b.id, []]))
-    if (include_rows) {
-      const ids = scoped.map((b) => b.id)
-      // Chunk the in-list so the URL stays a sane length.
-      for (let i = 0; i < ids.length; i += 50) {
-        const chunk = ids.slice(i, i + 50)
-        const { rows } = await restGet('bom_rows', {
-          select:
-            'bom_id,quantity,unit,reference_designator,sort_order,row_type,component:components(sku,name,category,revision,status,staging)',
-          bom_id: `in.(${chunk.join(',')})`,
-          order: 'bom_id.asc,sort_order.asc',
-          limit: String(max_rows_per_bom * chunk.length),
-        })
-        for (const r of rows) if (byBom.has(r.bom_id)) byBom.get(r.bom_id).push(r)
-      }
-    }
-
-    // 3) Group by product; derive staging from the working BOM's rows.
-    const products = new Map()
-    for (const b of scoped) {
-      const key = b.product?.sku ?? b.product_id
-      if (!products.has(key)) {
-        products.set(key, { product: b.product ?? { sku: null, id: b.product_id }, staging: false, boms: [] })
-      }
-      const rows = byBom.get(b.id) ?? []
-      const bomStaging = rows.some((r) => r.component?.staging === true)
-      // A product's class is decided by its working (non-snapshot) BOM.
-      if (!b.is_snapshot && bomStaging) products.get(key).staging = true
-      products.get(key).boms.push({
-        id: b.id,
-        name: b.name,
-        is_snapshot: b.is_snapshot,
-        snapshot_label: b.snapshot_label,
-        row_count: rows.length,
-        rows: include_rows ? rows : undefined,
-      })
-    }
-
-    let list = [...products.values()]
-    if (classification !== 'all') list = list.filter((p) => (classification === 'staging' ? p.staging : !p.staging))
-
-    const stagingCount = list.filter((p) => p.staging).length
-    const lines = list
-      .slice(0, 60)
-      .map((p) => `• ${p.product.sku ?? p.product.id} — ${p.product.name ?? ''} [${p.staging ? 'staging' : 'main'}] · ${p.boms.reduce((n, b) => n + b.row_count, 0)} rows`)
-    const more = list.length > 60 ? `\n… ${list.length - 60} more.` : ''
-    return {
-      content: [
-        {
-          type: 'text',
-          text: `${list.length} product(s): ${stagingCount} staging, ${list.length - stagingCount} main.\n${lines.join('\n')}${more}`,
-        },
-      ],
-      structuredContent: { classification, product_count: list.length, staging_products: stagingCount, products: list },
-    }
-  },
-)
-
-// `node index.mjs --selftest` — verify the storage-key sanitizer without a server.
-if (process.argv.includes('--selftest')) {
-  const assert = (c, m) => { if (!c) { console.error('FAIL:', m); process.exit(1) } }
-  assert(storageKeyName('[MNT-0930-X0] HANDLEBAR MOUNT LEFT_260908.STEP')
-    === '_MNT-0930-X0_ HANDLEBAR MOUNT LEFT_260908.STEP', 'brackets -> _')
-  assert(storageKeyName('BRG-0245-X0 Bushing_260908.pdf')
-    === 'BRG-0245-X0 Bushing_260908.pdf', 'safe name unchanged')
-  const SAFE = /^[\w !\-.*'()&$@=;:+,?/]*$/
-  assert(SAFE.test(storageKeyName('a[b]c#d%e\\f"g<h>i.STEP')), 'all unsafe chars replaced')
-  // stagingFilter mapping
-  assert(JSON.stringify(stagingFilter('main')) === '{"staging":"eq.false"}', 'main -> staging=false')
-  assert(JSON.stringify(stagingFilter('staging')) === '{"staging":"eq.true"}', 'staging -> staging=true')
-  assert(JSON.stringify(stagingFilter('all')) === '{}', 'all -> no filter')
-  console.log('selftest ok')
-  process.exit(0)
-}
-
-const transport = new StdioServerTransport()
-await server.connect(transport)
+#!/usr/bin/env node
+/**
+ * plm-upload-mcp — read the LionsBot PLM, bulk-upload local files
+ * (SolidWorks STEP/PDF exports) into it matched to a component by SKU, make
+ * components' Drive folders and uprev staging prototypes.
+ *
+ * Runs locally on each engineer's machine (stdio), so it reads their exported
+ * files straight off disk. It authenticates as the engineer with their own PLM
+ * login (GoTrue password grant) and every uploaded file is tagged with who
+ * uploaded it, server-side, by the plm-edge `upload` action. The read-only
+ * tools query PostgREST directly with the engineer's token, so RLS applies
+ * exactly as it does in the PLM web app — they only ever see what they may see.
+ *
+ * Config (env):
+ *   PLM_EMAIL, PLM_PASSWORD   — the engineer's PLM/hub login (required)
+ *   PLM_GATEWAY, PLM_ANON_KEY, PLM_EDGE_URL — override the baked prod defaults
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
+import { z } from 'zod'
+import { readFile, stat } from 'node:fs/promises'
+import { basename, extname } from 'node:path'
+
+// Prod defaults — same values the PLM web app ships with. Overridable via env.
+const GATEWAY = process.env.PLM_GATEWAY || 'https://gateway-production-c13d.up.railway.app'
+const ANON_KEY =
+  process.env.PLM_ANON_KEY ||
+  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiIsImlzcyI6InN1cGFiYXNlIiwiaWF0IjoxNzg0NzE1NTExLCJleHAiOjIxMDAwNzU1MTF9.kqtdfumqx4EjRyJ15Ld0gSZBYdeE0VnpmlnJy68qQT0'
+const EDGE = process.env.PLM_EDGE_URL || 'https://plm-edge-production.up.railway.app'
+const EMAIL = process.env.PLM_EMAIL
+const PASSWORD = process.env.PLM_PASSWORD
+
+const MIME = {
+  '.step': 'application/step',
+  '.stp': 'application/step',
+  '.pdf': 'application/pdf',
+  '.sldprt': 'application/octet-stream',
+  '.sldasm': 'application/octet-stream',
+  '.dxf': 'application/dxf',
+  '.dwg': 'application/acad',
+  '.igs': 'model/iges',
+  '.iges': 'model/iges',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+}
+const mimeFor = (name) => MIME[extname(name).toLowerCase()] || 'application/octet-stream'
+
+// Supabase Storage rejects object keys with chars outside its safe set (notably
+// '[' ']', which the common "[SKU] Name" convention starts with) -> the store
+// call 400s with "storage upload failed: 400". The key is internal/UUID-prefixed
+// and never shown, so sanitize it to the safe set; the Drive display name (the
+// separate `upload` filename) keeps the original, brackets and all.
+const storageKeyName = (name) => name.replace(/[^\w !\-.*'()&$@=;:+,?/]/g, '_')
+
+// --- Auth: cache one access token, re-grant when it's near expiry. -----------
+let cached = { token: null, exp: 0 }
+async function getToken() {
+  if (cached.token && Date.now() < cached.exp - 60_000) return cached.token
+  if (!EMAIL || !PASSWORD) throw new Error('PLM_EMAIL and PLM_PASSWORD must be set in the MCP config env.')
+  const resp = await fetch(`${GATEWAY}/auth/v1/token?grant_type=password`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', apikey: ANON_KEY },
+    body: JSON.stringify({ email: EMAIL, password: PASSWORD }),
+  })
+  const data = await resp.json().catch(() => null)
+  if (!resp.ok || !data?.access_token) {
+    throw new Error(`PLM sign-in failed for ${EMAIL}: ${data?.error_description || data?.msg || resp.status}`)
+  }
+  cached = { token: data.access_token, exp: Date.now() + (data.expires_in ?? 3600) * 1000 }
+  return cached.token
+}
+
+async function edgeJson(body) {
+  const token = await getToken()
+  const resp = await fetch(`${EDGE}/drive-library`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+    body: JSON.stringify(body),
+  })
+  const data = await resp.json().catch(() => null)
+  if (!resp.ok) throw new Error(data?.error || `edge ${body.action} failed: http ${resp.status}`)
+  return data
+}
+
+// The engineer's PLM user id: PLM users.id is the auth uid, the token's `sub`.
+const userId = async () => JSON.parse(Buffer.from((await getToken()).split('.')[1], 'base64url').toString()).sub
+
+/** A part-history row, the same shape the PLM web app writes. Best effort:
+ * a failed history write never undoes or blocks the work it records. */
+async function audit(entity_id, action, after_value) {
+  try {
+    const token = await getToken()
+    const resp = await fetch(`${GATEWAY}/rest/v1/audit_log`, {
+      method: 'POST',
+      headers: { apikey: ANON_KEY, authorization: `Bearer ${token}`, 'content-type': 'application/json', prefer: 'return=minimal' },
+      body: JSON.stringify({ entity_type: 'component', entity_id, action, actor_user_id: await userId(), actor_type: 'user', after_value }),
+    })
+    if (!resp.ok) console.error(`[audit] ${action}: http ${resp.status}`)
+  } catch (e) {
+    console.error(`[audit] ${action}:`, e instanceof Error ? e.message : e)
+  }
+}
+
+// --- Read path: PostgREST GET with the engineer's token (RLS-enforced). -------
+// Same data path the PLM web app uses (supabase-js -> /rest/v1). The anon key is
+// the gateway apikey; the bearer token is the signed-in engineer, so row-level
+// security decides what comes back — these tools can never read past the user.
+async function restGet(table, params = {}, { count = false } = {}) {
+  const token = await getToken()
+  const qs = new URLSearchParams(params).toString()
+  const headers = { apikey: ANON_KEY, authorization: `Bearer ${token}` }
+  if (count) headers['prefer'] = 'count=exact'
+  const resp = await fetch(`${GATEWAY}/rest/v1/${table}?${qs}`, { headers })
+  const data = await resp.json().catch(() => null)
+  if (!resp.ok) throw new Error(data?.message || data?.error || `read ${table} failed: http ${resp.status}`)
+  // content-range is "start-end/total" (or "*/total") when count=exact.
+  const total = count ? Number((resp.headers.get('content-range') || '').split('/')[1]) || null : null
+  return { rows: Array.isArray(data) ? data : [], total }
+}
+
+// bucket -> components.staging filter. 'main' = confirmed, 'staging' = unconfirmed.
+const stagingFilter = (bucket) =>
+  bucket === 'staging' ? { staging: 'eq.true' } : bucket === 'main' ? { staging: 'eq.false' } : {}
+
+/** The component with this SKU, or null. Writes only go to SKUs the PLM has:
+ * a stray `[SKU]` Drive folder would be read as a new part by the reconcile. */
+async function findComponent(sku) {
+  const { rows } = await restGet('components', {
+    select: 'id,sku,name,staging,cad_revision,drive_folder_id,drive_folder_url',
+    sku: `eq.${sku.trim().toUpperCase()}`,
+  })
+  return rows[0] ?? null
+}
+const driveOf = (c) => (c.staging ? 'staging' : 'main')
+
+// --- Injection Mold rules: a port of the PLM's src/lib/injectionMould.ts and
+// planUprev (src/lib/promotion.ts). Change both together. ---------------------
+const IM_METHOD = /\binjection\b|\bmou?ld(ed|ing)?\s+plastic/i
+const isXRev = (sku) => /-X\d+$/.test(sku)
+const familyOf = (sku) => sku.replace(/-(X\d+|[A-Z]\d|\d\d)$/, '')
+
+/** Next prototype revision, same rule as the edge `uprev` (X0–X8 only). */
+function nextRev(sku) {
+  const m = /^([A-Z]{3})-(\d{4})-X(\d)$/.exec(sku)
+  if (!m) return { error: `${sku}: only staging prototype revisions (X0–X8) can be uprevved` }
+  if (Number(m[3]) >= 9) return { error: 'X9 is the last prototype revision — release to A0 instead' }
+  return { newSku: `${m[1]}-${m[2]}-X${Number(m[3]) + 1}` }
+}
+
+/** The file name carrying `sku`: an older revision's SKU in it is swapped,
+ * else the SKU is put in front, so a STEP sent to a supplier names its part. */
+function nameWithSku(name, sku) {
+  if (name.toUpperCase().includes(sku.toUpperCase())) return name
+  const older = new RegExp(`${familyOf(sku).replace(/-/g, '\\-')}-(X\\d+|[A-Z]\\d)`, 'i')
+  return older.test(name) ? name.replace(older, sku) : `[${sku}] ${name}`
+}
+
+/** Warnings for a drawing about to be uploaded as `newSku`, compared with the
+ * revision it replaces. They are prompts: the uploader may still go ahead. */
+function drawingWarnings(read, newSku, prev) {
+  if (!read) return ['The PDF could not be read, so its SKU and REV were not checked.']
+  if (!read.is_lionsbot) return ['This is not a LionsBot drawing title block, so nothing can be checked or extracted.']
+  const out = []
+  const sameSku = !!read.sku && read.sku === prev.sku
+  const sameRev = !!read.rev && read.rev === prev.drawing_rev
+  if (sameSku && (sameRev || !read.rev)) {
+    out.push(`No difference found: the drawing still reads ${prev.sku}${read.rev ? ` REV ${read.rev}` : ''}, the same as the current revision.`)
+  } else if (!read.sku) {
+    out.push('No SKU was found on the drawing.')
+  } else if (familyOf(read.sku) !== familyOf(newSku)) {
+    out.push(`The drawing is for ${read.sku}, a different part.`)
+  } else if (read.sku !== newSku) {
+    out.push(`The drawing reads ${read.sku}; this revision will be ${newSku}.`)
+  }
+  if (!read.rev) out.push('No REV was found on the drawing.')
+  else if (sameRev && !sameSku) out.push(`Drawing REV ${read.rev} is unchanged from the current revision.`)
+  return out
+}
+
+/** What reading an uploaded drawing did; `listed` = it is now in Injection Mold Staging. */
+function readOutcome(res, sku) {
+  if (res.error) return { ok: false, text: res.error, listed: false }
+  if (!res.written) {
+    const text = res.extracted?.is_lionsbot === false
+      ? 'Not a LionsBot drawing, nothing read'
+      : `Drawing says ${res.sku_check?.drawing_sku ?? 'no SKU'}, not ${sku}: nothing read`
+    return { ok: false, text, listed: false }
+  }
+  return {
+    ok: true,
+    text: `Drawing read${res.extracted?.rev ? ` · REV ${res.extracted.rev}` : ''}`,
+    listed: IM_METHOD.test(res.extracted?.manufacturing_method ?? '') && isXRev(sku),
+  }
+}
+
+/** store bytes → storagePath, then upload → mirror into the SKU's Drive folder. */
+async function uploadOne({ path, sku, skuName, category, bucket, filename = basename(path) }) {
+  const bytes = await readFile(path) // throws ENOENT with the path — surfaced per-file below
+  const mimeType = mimeFor(filename)
+  const token = await getToken()
+
+  // Store under a storage-safe key; the Drive file keeps the original filename below.
+  const params = new URLSearchParams({ action: 'store', sku, filename: storageKeyName(filename), mimeType })
+  const sResp = await fetch(`${EDGE}/drive-library?${params}`, {
+    method: 'POST',
+    headers: { 'content-type': mimeType, authorization: `Bearer ${token}` },
+    body: bytes,
+  })
+  const stored = await sResp.json().catch(() => null)
+  if (!sResp.ok || !stored?.storagePath) {
+    throw new Error(stored?.error || `store failed: http ${sResp.status}`)
+  }
+
+  const synced = await edgeJson({
+    action: 'upload',
+    sku,
+    skuName: skuName ?? '',
+    storagePath: stored.storagePath,
+    filename,
+    mimeType,
+    bucket,
+  })
+  if (synced?.error) throw new Error(synced.error)
+
+  if (category && category !== 'Default' && synced?.driveFileId) {
+    await edgeJson({ action: 'set-category', fileId: synced.driveFileId, category }).catch(() => {})
+  }
+
+  return {
+    file: filename,
+    sku,
+    bucket,
+    driveFileId: synced.driveFileId,
+    driveWebViewLink: synced.driveWebViewLink,
+    replaced: !!synced.replaced,
+    category: category && category !== 'Default' ? category : undefined,
+  }
+}
+
+/** Reads an uploaded drawing PDF into the component (title-block fields), the
+ * same step the PLM runs after a Files-tab upload. The edge writes only a
+ * LionsBot drawing of this SKU. */
+async function readDrawing(componentId, sku, fileId, filename) {
+  let res
+  try {
+    res = await edgeJson({ action: 'extract', componentId, fileId, filename })
+  } catch (e) {
+    res = { error: e instanceof Error ? e.message : String(e) }
+  }
+  if (res.written) await audit(componentId, 'component.drawing_extracted', { file: filename, extracted: res.extracted ?? null })
+  return readOutcome(res, sku)
+}
+
+/** The drawing's title block, read without storing or writing anything. */
+async function previewDrawing(bytes, filename) {
+  try {
+    const token = await getToken()
+    const resp = await fetch(`${EDGE}/drive-library?${new URLSearchParams({ action: 'extract-preview', filename })}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/pdf', authorization: `Bearer ${token}` },
+      body: bytes,
+    })
+    const data = await resp.json().catch(() => null)
+    return resp.ok ? data?.extracted ?? null : null
+  } catch {
+    return null
+  }
+}
+
+const isPdf = (name) => /\.pdf$/i.test(name)
+const readLine = (read) => (read ? ` · ${read.text}${read.listed ? ' · now in Injection Mold Staging' : ''}` : '')
+
+// --- Server ------------------------------------------------------------------
+const server = new McpServer({ name: 'plm-upload', version: '1.2.0' })
+
+server.registerTool(
+  'upload_files',
+  {
+    title: 'Upload files to PLM by SKU',
+    description:
+      "Bulk-upload local files (e.g. SolidWorks STEP/PDF exports) into the LionsBot PLM. " +
+      "Each file is attached to an existing component by its SKU: it lands in PLM storage and is " +
+      "mirrored into that SKU's Google Drive folder on the part's own drive (staging or main; folder " +
+      "auto-created if missing). A SKU that is not in the PLM is refused. Re-uploading a file with " +
+      "the same name replaces it in place rather than duplicating. A PDF is then read like a PLM " +
+      "upload: a LionsBot drawing of that SKU fills the part's title-block fields (material, colour, " +
+      "drawing REV, method), which lists an injection moulded X revision in Injection Mold Staging. " +
+      "You must supply the SKU for each file — the caller's own tooling (e.g. a SolidWorks MCP) " +
+      "already knows each part's SKU.",
+    inputSchema: {
+      files: z
+        .array(
+          z.object({
+            path: z.string().describe('Absolute local path to the file to upload.'),
+            sku: z.string().describe('Component SKU this file belongs to, e.g. MNT-1234-A0.'),
+            category: z
+              .enum(['Default', 'Archive', 'Compliance', 'Ops'])
+              .optional()
+              .describe('PLM file category tag. Defaults to Default.'),
+          }),
+        )
+        .min(1)
+        .describe('The files to upload, each paired with its target SKU.'),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  },
+  async ({ files }) => {
+    const parts = new Map()
+    const results = []
+    for (const f of files) {
+      const sku = f.sku.trim().toUpperCase()
+      try {
+        if (!parts.has(sku)) parts.set(sku, await findComponent(sku))
+        const c = parts.get(sku)
+        if (!c) throw new Error('not in the PLM, nothing uploaded (create the component first)')
+        const up = await uploadOne({ path: f.path, sku: c.sku, skuName: c.name, category: f.category, bucket: driveOf(c) })
+        const read = isPdf(up.file) && up.driveFileId ? await readDrawing(c.id, c.sku, up.driveFileId, up.file) : undefined
+        results.push({ ok: true, ...up, read })
+      } catch (e) {
+        results.push({ ok: false, file: basename(f.path), sku, error: e instanceof Error ? e.message : String(e) })
+      }
+    }
+    const ok = results.filter((r) => r.ok).length
+    const lines = results.map((r) =>
+      r.ok
+        ? `✓ ${r.file} → ${r.sku} (${r.bucket})${r.replaced ? ' (replaced)' : ''}${r.category ? ` [${r.category}]` : ''}${readLine(r.read)}`
+        : `✗ ${r.file} → ${r.sku}: ${r.error}`,
+    )
+    return {
+      content: [{ type: 'text', text: `Uploaded ${ok}/${results.length}.\n${lines.join('\n')}` }],
+      structuredContent: { uploaded: ok, total: results.length, results },
+    }
+  },
+)
+
+server.registerTool(
+  'list_component_files',
+  {
+    title: 'List a component\'s PLM files',
+    description: "Lists the files currently in a component's Google Drive folder in the PLM, by SKU.",
+    inputSchema: {
+      sku: z.string().describe('Component SKU, e.g. MNT-1234-A0.'),
+      bucket: z.enum(['main', 'staging']).optional().describe("'main' (default) or 'staging'."),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: true },
+  },
+  async ({ sku, bucket = 'main' }) => {
+    const data = await edgeJson({ action: 'list', sku, bucket })
+    const files = Array.isArray(data?.files) ? data.files : []
+    if (!data?.connected) {
+      return { content: [{ type: 'text', text: `Drive not connected or no folder for ${sku}.` }], structuredContent: { connected: false, files: [] } }
+    }
+    const lines = files.map((x) => `• ${x.name}${x.appProperties?.plmCategory ? ` [${x.appProperties.plmCategory}]` : ''}`)
+    return {
+      content: [{ type: 'text', text: files.length ? `${sku} — ${files.length} file(s):\n${lines.join('\n')}` : `${sku} — folder is empty.` }],
+      structuredContent: { connected: true, folder: data.folder ?? null, files },
+    }
+  },
+)
+
+server.registerTool(
+  'create_folder',
+  {
+    title: "Create components' Drive folders",
+    description:
+      "Finds or creates the `[SKU] Name` Google Drive folder of components that already exist in the " +
+      "PLM, on each part's own drive (staging or main), and links the folder to the component. SKUs " +
+      "not in the PLM are refused: a stray folder would later be read as a new part. Uploading a file " +
+      "also creates the folder, so this is only needed for an empty one.",
+    inputSchema: {
+      skus: z.array(z.string()).min(1).describe('Component SKUs, e.g. MNT-1234-X0.'),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+  },
+  async ({ skus }) => {
+    const results = []
+    for (const s of skus) {
+      const sku = s.trim().toUpperCase()
+      try {
+        const c = await findComponent(sku)
+        if (!c) throw new Error('not in the PLM, no folder made')
+        const bucket = driveOf(c)
+        const r = await edgeJson({ action: 'ensure', sku: c.sku, skuName: c.name, componentId: c.id, bucket })
+        if (!r?.connected) throw new Error('Drive is not connected')
+        if (r.error || !r.folderId) throw new Error(r.error || 'no folder returned')
+        results.push({ ok: true, sku: c.sku, bucket, created: !!r.created, folderId: r.folderId, folderUrl: r.folderUrl ?? null })
+      } catch (e) {
+        results.push({ ok: false, sku, error: e instanceof Error ? e.message : String(e) })
+      }
+    }
+    const lines = results.map((r) =>
+      r.ok ? `✓ ${r.sku} (${r.bucket}): ${r.created ? 'folder created' : 'folder already there'} ${r.folderUrl ?? ''}`.trim() : `✗ ${r.sku}: ${r.error}`,
+    )
+    return {
+      content: [{ type: 'text', text: lines.join('\n') }],
+      structuredContent: { results },
+    }
+  },
+)
+
+server.registerTool(
+  'uprev_component',
+  {
+    title: 'Uprev a staging prototype',
+    description:
+      "Uprevs a staging prototype part to its next X revision (MNT-1234-X1 -> MNT-1234-X2), the same as " +
+      "Uprev in the PLM: a new component with the old one's details and its own staging Drive folder; " +
+      "the old revision stays as history. Optionally uploads the new revision's drawing PDF and STEP in " +
+      "the same step (renamed to carry the new SKU) and reads the drawing into the PLM, which lists an " +
+      "injection moulded part in Injection Mold Staging. The PDF is checked BEFORE anything is created: " +
+      "if its title block shows no SKU/REV change, no SKU/REV, or another part, NOTHING is uprevved and " +
+      "the warnings come back. Show them to the user and only call again with " +
+      "proceed_despite_warnings: true if they say to go ahead. Only staging X0-X8 parts can be uprevved; " +
+      "releasing to A0 is a promotion request in the PLM.",
+    inputSchema: {
+      sku: z.string().describe('Current SKU of the staging part, e.g. MNT-1234-X1.'),
+      drawing_pdf: z.string().optional().describe("Absolute local path to the new revision's drawing PDF."),
+      step: z.string().optional().describe("Absolute local path to the new revision's STEP model."),
+      proceed_despite_warnings: z
+        .boolean()
+        .optional()
+        .describe('Uprev even though the drawing check warned. Only after the user has seen the warnings and said yes.'),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  },
+  async ({ sku, drawing_pdf, step, proceed_despite_warnings = false }) => {
+    const reply = (text, data, isError = false) => ({ content: [{ type: 'text', text }], structuredContent: data, isError })
+    const stop = (text) => reply(text, { uprevved: false, error: text }, true)
+
+    const c = await findComponent(sku)
+    if (!c) return stop(`${sku.trim().toUpperCase()} is not in the PLM.`)
+    if (!c.staging) return stop(`${c.sku} is not a staging part; only staging prototypes can be uprevved.`)
+    const plan = nextRev(c.sku)
+    if (plan.error) return stop(plan.error)
+
+    // Both files must be readable before anything is created.
+    let pdfBytes = null
+    try {
+      if (drawing_pdf) pdfBytes = await readFile(drawing_pdf)
+      if (step) await stat(step)
+    } catch (e) {
+      return stop(`Nothing uprevved: ${e instanceof Error ? e.message : e}`)
+    }
+
+    let drawing = null
+    let warnings = []
+    if (pdfBytes) {
+      drawing = await previewDrawing(pdfBytes, basename(drawing_pdf))
+      warnings = drawingWarnings(drawing, plan.newSku, { sku: c.sku, drawing_rev: c.cad_revision })
+      if (warnings.length && !proceed_despite_warnings) {
+        return reply(
+          `Not uprevved yet. Checking the drawing against ${plan.newSku} found:\n- ${warnings.join('\n- ')}\n` +
+            'Show this to the user. Only if they say to go ahead, call again with proceed_despite_warnings: true.',
+          { uprevved: false, new_sku: plan.newSku, warnings, drawing },
+        )
+      }
+    }
+
+    let created
+    try {
+      created = await edgeJson({ action: 'uprev', componentId: c.id })
+    } catch (e) {
+      return stop(`Uprev failed: ${e instanceof Error ? e.message : e}`)
+    }
+    if (!created?.new_id) return stop(`Uprev failed: ${created?.error ?? 'no new component returned'}`)
+    await audit(created.new_id, 'component_uprevved', { old_sku: c.sku, new_sku: created.new_sku })
+
+    const lines = [`Uprevved ${c.sku} -> ${created.new_sku}, with its own staging Drive folder; ${c.sku} stays as history.`]
+    const files = []
+    let read
+    try {
+      for (const [path, kind] of [[drawing_pdf, 'DRAWING'], [step, 'STEP']]) {
+        if (!path) continue
+        const original = basename(path)
+        const name = nameWithSku(original, created.new_sku)
+        const up = await uploadOne({ path, sku: created.new_sku, skuName: c.name, bucket: 'staging', filename: name })
+        files.push(up)
+        await audit(created.new_id, 'component.file_uploaded', {
+          file: name,
+          original_name: name !== original ? original : undefined,
+          ...(kind === 'DRAWING' ? { drawing_sku: drawing?.sku ?? null, drawing_rev: drawing?.rev ?? null, warnings } : {}),
+        })
+        if (kind === 'DRAWING' && up.driveFileId) read = await readDrawing(created.new_id, created.new_sku, up.driveFileId, name)
+        lines.push(`✓ ${name}${kind === 'DRAWING' ? readLine(read) : ''}`)
+      }
+    } catch (e) {
+      lines.push(`✗ Upload failed: ${e instanceof Error ? e.message : e}. ${created.new_sku} was created; finish with upload_files.`)
+      return reply(lines.join('\n'), { uprevved: true, ...created, files, read, warnings }, true)
+    }
+    if (warnings.length) lines.push(`Uploaded despite the drawing check (kept in the part's history): ${warnings.join(' ')}`)
+    return reply(lines.join('\n'), { uprevved: true, ...created, files, read, warnings })
+  },
+)
+
+// === Read-only tools (RLS-enforced via the engineer's token) =================
+
+server.registerTool(
+  'list_sku_folders',
+  {
+    title: 'List all SKU folders',
+    description:
+      "List every component SKU in the PLM with its Google Drive folder — the SKU→folder map. " +
+      "Returns SKU, name, category, type, revision, status, whether it is a staging (unconfirmed) " +
+      "or main (confirmed) part, and the Drive folder id/URL. Read-only. Use it to discover which " +
+      "SKUs exist and where each part's files live, or to find the folder for a SKU before uploading.",
+    inputSchema: {
+      bucket: z
+        .enum(['main', 'staging', 'all'])
+        .optional()
+        .describe("Filter by drive: 'main' (confirmed), 'staging' (unconfirmed), or 'all' (default)."),
+      category: z.string().optional().describe('Optional exact category code filter, e.g. MNT.'),
+      with_folder_only: z
+        .boolean()
+        .optional()
+        .describe('If true, only SKUs that already have a Drive folder. Default false.'),
+      limit: z.number().int().min(1).max(2000).optional().describe('Max rows (default 1000).'),
+      offset: z.number().int().min(0).optional().describe('Row offset for paging (default 0).'),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: true },
+  },
+  async ({ bucket = 'all', category, with_folder_only = false, limit = 1000, offset = 0 }) => {
+    const params = {
+      select: 'sku,name,category,sku_type,revision,status,staging,drive_folder_id,drive_folder_url',
+      order: 'sku.asc',
+      limit: String(limit),
+      offset: String(offset),
+      ...stagingFilter(bucket),
+    }
+    if (category) params.category = `eq.${category}`
+    if (with_folder_only) params.drive_folder_id = 'not.is.null'
+    const { rows, total } = await restGet('components', params, { count: true })
+    const withFolder = rows.filter((r) => r.drive_folder_id).length
+    const lines = rows
+      .slice(0, 50)
+      .map((r) => `• ${r.sku} — ${r.name}${r.staging ? ' [staging]' : ''}${r.drive_folder_id ? '' : ' (no folder)'}`)
+    const more = rows.length > 50 ? `\n… ${rows.length - 50} more (of ${total ?? rows.length}).` : ''
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `${rows.length} SKU(s) (${withFolder} with a Drive folder) of ${total ?? '?'} total in ${bucket}.\n${lines.join('\n')}${more}`,
+        },
+      ],
+      structuredContent: { bucket, count: rows.length, total, folders: rows },
+    }
+  },
+)
+
+server.registerTool(
+  'get_component_metadata',
+  {
+    title: 'Get component metadata',
+    description:
+      "Read full component metadata from the PLM component database. Every column — identity " +
+      "(sku, name, category, type, revision, status), cost/supply (unit_cost, moq, lead time, " +
+      "preferred_supplier), drawing-extracted fields (material, colour, manufacturing_method, " +
+      "release_status), CAD provenance, compliance (RoHS/REACH/CE), and Drive folder — plus the " +
+      "extract_meta provenance block. Pass a single `sku` for one part, or omit it to page through " +
+      "all parts. Read-only.",
+    inputSchema: {
+      sku: z.string().optional().describe('Exact SKU for a single component, e.g. MNT-1234-A0.'),
+      search: z.string().optional().describe('Case-insensitive substring match on SKU or name.'),
+      bucket: z.enum(['main', 'staging', 'all']).optional().describe("'main', 'staging', or 'all' (default)."),
+      category: z.string().optional().describe('Optional exact category code filter, e.g. MNT.'),
+      status: z.enum(['active', 'obsolete']).optional().describe('Optional lifecycle status filter.'),
+      limit: z.number().int().min(1).max(500).optional().describe('Max rows when listing (default 100).'),
+      offset: z.number().int().min(0).optional().describe('Row offset for paging (default 0).'),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: true },
+  },
+  async ({ sku, search, bucket = 'all', category, status, limit = 100, offset = 0 }) => {
+    const params = { select: '*', order: 'sku.asc', ...stagingFilter(bucket) }
+    if (sku) {
+      params.sku = `eq.${sku}`
+      params.limit = '1'
+    } else {
+      params.limit = String(limit)
+      params.offset = String(offset)
+      if (search) params.or = `(sku.ilike.*${search}*,name.ilike.*${search}*)`
+      if (category) params.category = `eq.${category}`
+      if (status) params.status = `eq.${status}`
+    }
+    const { rows, total } = await restGet('components', params, { count: !sku })
+    if (sku) {
+      const c = rows[0]
+      if (!c) return { content: [{ type: 'text', text: `No component with SKU ${sku}.` }], structuredContent: { component: null } }
+      return {
+        content: [{ type: 'text', text: `${c.sku} — ${c.name} (${c.category}, rev ${c.revision ?? '—'}, ${c.status}${c.staging ? ', staging' : ''}).` }],
+        structuredContent: { component: c },
+      }
+    }
+    const lines = rows.slice(0, 50).map((c) => `• ${c.sku} — ${c.name} (${c.status}${c.staging ? ', staging' : ''})`)
+    const more = rows.length > 50 ? `\n… ${rows.length - 50} more shown truncated (of ${total ?? rows.length}).` : ''
+    return {
+      content: [{ type: 'text', text: `${rows.length} component(s) of ${total ?? '?'} total in ${bucket}.\n${lines.join('\n')}${more}` }],
+      structuredContent: { bucket, count: rows.length, total, components: rows },
+    }
+  },
+)
+
+server.registerTool(
+  'list_bom_extract_metadata',
+  {
+    title: 'List extracted BOM/drawing metadata',
+    description:
+      "List the metadata machine-extracted from each part's drawing/BOM PDF (the PLM `extract` step) " +
+      "across all components. For each SKU returns its extract_meta: the Lionsbot-custom-drawing flag, " +
+      "the SKU/drawing match check, the per-field extracted values (release status, material, colour, " +
+      "manufacturing method, CAD revision, drawn/designed by), and the source file + who/when it was " +
+      "extracted. Only parts that have been extracted are returned. Read-only.",
+    inputSchema: {
+      sku: z.string().optional().describe('Restrict to a single SKU, e.g. MNT-1234-A0.'),
+      bucket: z.enum(['main', 'staging', 'all']).optional().describe("'main', 'staging', or 'all' (default)."),
+      limit: z.number().int().min(1).max(2000).optional().describe('Max rows (default 1000).'),
+      offset: z.number().int().min(0).optional().describe('Row offset for paging (default 0).'),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: true },
+  },
+  async ({ sku, bucket = 'all', limit = 1000, offset = 0 }) => {
+    const params = {
+      select: 'sku,name,category,staging,material,colour,manufacturing_method,release_status,cad_revision,cad_drawn_by,cad_designed_by,extract_meta',
+      order: 'sku.asc',
+      limit: String(limit),
+      offset: String(offset),
+      ...stagingFilter(bucket),
+    }
+    // extract_meta '{}' means never extracted — exclude it.
+    params.extract_meta = 'neq.{}'
+    if (sku) params.sku = `eq.${sku}`
+    const { rows, total } = await restGet('components', params, { count: true })
+    const lines = rows.slice(0, 50).map((r) => {
+      const lb = r.extract_meta?.is_lionsbot === true ? ' [LB]' : ''
+      const m = r.extract_meta?.sku_check?.match === true ? ' ✓match' : r.extract_meta?.sku_check ? ' ✗mismatch' : ''
+      return `• ${r.sku} — ${r.name}${lb}${m}`
+    })
+    const more = rows.length > 50 ? `\n… ${rows.length - 50} more (of ${total ?? rows.length}).` : ''
+    return {
+      content: [{ type: 'text', text: `${rows.length} extracted part(s) of ${total ?? '?'} in ${bucket}.\n${lines.join('\n')}${more}` }],
+      structuredContent: { bucket, count: rows.length, total, extracted: rows },
+    }
+  },
+)
+
+server.registerTool(
+  'list_boms',
+  {
+    title: 'List all BOMs (products + staging)',
+    description:
+      "List the bills of materials across all products. Each product carries its BOM(s) with the line " +
+      "items — component SKU, name, quantity, unit, reference designator — and a derived `staging` flag: " +
+      "a product is 'staging' while its working BOM still contains any staging (unconfirmed) component, " +
+      "otherwise 'main'. By default returns working BOMs only (set include_snapshots to include saved " +
+      "snapshots) with their rows. Filter to one product with product_sku. Read-only.",
+    inputSchema: {
+      product_sku: z.string().optional().describe('Restrict to one product by its SAL SKU, e.g. SAL-0R3-3001.'),
+      classification: z
+        .enum(['main', 'staging', 'all'])
+        .optional()
+        .describe("Only products in this derived class: 'main', 'staging', or 'all' (default)."),
+      include_snapshots: z.boolean().optional().describe('Include saved snapshot BOMs, not just the working BOM. Default false.'),
+      include_rows: z.boolean().optional().describe('Include BOM line items. Default true.'),
+      max_rows_per_bom: z.number().int().min(1).max(5000).optional().describe('Cap rows fetched per BOM (default 2000).'),
+    },
+    annotations: { readOnlyHint: true, openWorldHint: true },
+  },
+  async ({ product_sku, classification = 'all', include_snapshots = false, include_rows = true, max_rows_per_bom = 2000 }) => {
+    // 1) BOM headers + their product.
+    const bomParams = {
+      select: 'id,name,is_snapshot,snapshot_label,product_id,created_at,product:products(sku,name,status)',
+      order: 'created_at.asc',
+    }
+    if (!include_snapshots) bomParams.is_snapshot = 'eq.false'
+    const { rows: boms } = await restGet('boms', bomParams, {})
+    let scoped = product_sku ? boms.filter((b) => b.product?.sku === product_sku) : boms
+    if (!scoped.length) {
+      return { content: [{ type: 'text', text: product_sku ? `No BOMs for product ${product_sku}.` : 'No BOMs found.' }], structuredContent: { products: [] } }
+    }
+
+    // 2) Rows for those BOMs, embedding each component's SKU + staging flag.
+    const byBom = new Map(scoped.map((b) => [b.id, []]))
+    if (include_rows) {
+      const ids = scoped.map((b) => b.id)
+      // Chunk the in-list so the URL stays a sane length.
+      for (let i = 0; i < ids.length; i += 50) {
+        const chunk = ids.slice(i, i + 50)
+        const { rows } = await restGet('bom_rows', {
+          select:
+            'bom_id,quantity,unit,reference_designator,sort_order,row_type,component:components(sku,name,category,revision,status,staging)',
+          bom_id: `in.(${chunk.join(',')})`,
+          order: 'bom_id.asc,sort_order.asc',
+          limit: String(max_rows_per_bom * chunk.length),
+        })
+        for (const r of rows) if (byBom.has(r.bom_id)) byBom.get(r.bom_id).push(r)
+      }
+    }
+
+    // 3) Group by product; derive staging from the working BOM's rows.
+    const products = new Map()
+    for (const b of scoped) {
+      const key = b.product?.sku ?? b.product_id
+      if (!products.has(key)) {
+        products.set(key, { product: b.product ?? { sku: null, id: b.product_id }, staging: false, boms: [] })
+      }
+      const rows = byBom.get(b.id) ?? []
+      const bomStaging = rows.some((r) => r.component?.staging === true)
+      // A product's class is decided by its working (non-snapshot) BOM.
+      if (!b.is_snapshot && bomStaging) products.get(key).staging = true
+      products.get(key).boms.push({
+        id: b.id,
+        name: b.name,
+        is_snapshot: b.is_snapshot,
+        snapshot_label: b.snapshot_label,
+        row_count: rows.length,
+        rows: include_rows ? rows : undefined,
+      })
+    }
+
+    let list = [...products.values()]
+    if (classification !== 'all') list = list.filter((p) => (classification === 'staging' ? p.staging : !p.staging))
+
+    const stagingCount = list.filter((p) => p.staging).length
+    const lines = list
+      .slice(0, 60)
+      .map((p) => `• ${p.product.sku ?? p.product.id} — ${p.product.name ?? ''} [${p.staging ? 'staging' : 'main'}] · ${p.boms.reduce((n, b) => n + b.row_count, 0)} rows`)
+    const more = list.length > 60 ? `\n… ${list.length - 60} more.` : ''
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `${list.length} product(s): ${stagingCount} staging, ${list.length - stagingCount} main.\n${lines.join('\n')}${more}`,
+        },
+      ],
+      structuredContent: { classification, product_count: list.length, staging_products: stagingCount, products: list },
+    }
+  },
+)
+
+// `node index.mjs --selftest` — verify the storage-key sanitizer without a server.
+if (process.argv.includes('--selftest')) {
+  const assert = (c, m) => { if (!c) { console.error('FAIL:', m); process.exit(1) } }
+  assert(storageKeyName('[MNT-0930-X0] HANDLEBAR MOUNT LEFT_260908.STEP')
+    === '_MNT-0930-X0_ HANDLEBAR MOUNT LEFT_260908.STEP', 'brackets -> _')
+  assert(storageKeyName('BRG-0245-X0 Bushing_260908.pdf')
+    === 'BRG-0245-X0 Bushing_260908.pdf', 'safe name unchanged')
+  const SAFE = /^[\w !\-.*'()&$@=;:+,?/]*$/
+  assert(SAFE.test(storageKeyName('a[b]c#d%e\\f"g<h>i.STEP')), 'all unsafe chars replaced')
+  // stagingFilter mapping
+  assert(JSON.stringify(stagingFilter('main')) === '{"staging":"eq.false"}', 'main -> staging=false')
+  assert(JSON.stringify(stagingFilter('staging')) === '{"staging":"eq.true"}', 'staging -> staging=true')
+  assert(JSON.stringify(stagingFilter('all')) === '{}', 'all -> no filter')
+  // ported rules (same cases as the PLM's injectionMould.test.ts)
+  assert(nameWithSku('Bracket.STEP', 'MNT-1234-X2') === '[MNT-1234-X2] Bracket.STEP', 'sku put in front')
+  assert(nameWithSku('MNT-1234-X1 Bracket.pdf', 'MNT-1234-X2') === 'MNT-1234-X2 Bracket.pdf', 'older rev swapped')
+  assert(nameWithSku('[MNT-1234-X2] Bracket.pdf', 'MNT-1234-X2') === '[MNT-1234-X2] Bracket.pdf', 'already named')
+  assert(nextRev('MNT-1234-X1').newSku === 'MNT-1234-X2', 'X1 -> X2')
+  assert(nextRev('MNT-1234-X9').error && nextRev('MNT-1234-A0').error, 'X9 and A0 refused')
+  const prev = { sku: 'MNT-1234-X1', drawing_rev: '01' }
+  assert(drawingWarnings({ is_lionsbot: true, sku: 'MNT-1234-X2', rev: '02' }, 'MNT-1234-X2', prev).length === 0, 'clean drawing')
+  assert(/No difference/.test(drawingWarnings({ is_lionsbot: true, sku: 'MNT-1234-X1', rev: '01' }, 'MNT-1234-X2', prev)[0]), 'same sku + rev')
+  assert(/different part/.test(drawingWarnings({ is_lionsbot: true, sku: 'BOX-0001-X0', rev: '02' }, 'MNT-1234-X2', prev)[0]), 'other part')
+  assert(/could not be read/.test(drawingWarnings(null, 'MNT-1234-X2', prev)[0]), 'unreadable')
+  assert(readOutcome({ written: true, extracted: { rev: '02', manufacturing_method: 'MOULD PLASTIC AND RUBBER' } }, 'MNT-1234-X2').listed, 'IM X rev listed')
+  assert(!readOutcome({ written: true, extracted: { manufacturing_method: 'MOULD PLASTIC AND RUBBER' } }, 'MNT-1234-A0').listed, 'released not listed')
+  assert(readOutcome({ written: false, extracted: { is_lionsbot: false } }, 'X').text === 'Not a LionsBot drawing, nothing read', 'not LB')
+  console.log('selftest ok')
+  process.exit(0)
+}
+
+const transport = new StdioServerTransport()
+await server.connect(transport)