lambda-erp 0.4.0__tar.gz → 0.6.0__tar.gz

{lambda_erp-0.4.0 → lambda_erp-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lambda-erp
-Version: 0.4.0
+Version: 0.6.0
 Summary: Core ERP logic - accounting, sales, purchasing, inventory
 Author: TORUS INVESTMENTS AG
 License-Expression: Apache-2.0
@@ -112,6 +112,7 @@ Each of those is hours of skilled work today. With a capable LLM in the loop, th
 **Key design choices:**
 
 - **Chat-first, not chat-bolted-on.** The chat isn't a copilot sidebar - it's the primary way to interact with the system. Every document type, every report, every master record is reachable from tool-use.
+- **Extensions are first-class to the AI.** A customer deployment registers its own doctypes and master types through plugin seams (`register_doctype`, `register_master`) and the chat discovers them automatically - tool schemas and the system prompt are built per request from the live registries, and fields are introspected from the live table, so there is nothing to teach per type. A CRM lead added by a plugin is searchable in chat from day one, with zero prompt or tool edits.
 - **One shape for every document.** Invoices, sales orders, stock entries, payments - all share a single `Document` base class and the same three-state lifecycle (Draft → Submitted → Cancelled) with `on_submit`/`on_cancel` hooks. The LLM learns the pattern once and drives every doctype the same way. Leading open-source and commercial ERPs have per-model action verbs spread across 150+ core models; each one is a separate tool the model has to get right.
 - **Metadata-driven UI, shared with the LLM.** A single React form component renders every doctype from `frontend/src/lib/doctypes.ts`. The schema the model reasons over and the schema the user sees are literally the same file. Adding a field is two lines - one in the Python class, one in the config - not a new module with hand-written views and inheritance overlays.
 - **Two-model orchestration.** A planner model handles reasoning and tool-use. When it needs to generate code for a custom report, it delegates to a code-specialist sub-agent. This keeps each model doing what it's best at and keeps latency down on simple turns.
@@ -259,10 +260,15 @@ Open `http://localhost:5173`. Vite proxies `/api/*` to the backend.
 OPENAI_API_KEY=sk-...
 ANTHROPIC_API_KEY=sk-ant-...    # optional, used for the code-specialist sub-agent
 ANTHROPIC_CODE_MODEL=claude-opus-4-7   # optional, default shown
+LAMBDA_ERP_ADMIN_EMAIL=admin@example.com   # optional, seeds the admin at boot
+LAMBDA_ERP_ADMIN_PASSWORD=...              # optional, required with the line above
+LAMBDA_ERP_ADMIN_NAME=Administrator        # optional, display name for the seeded admin
 ```
 
 Chat needs `OPENAI_API_KEY`. Custom-report code generation uses `ANTHROPIC_API_KEY` when set; otherwise it falls back and the chat will tell you it can't generate reports.
 
+**Seeded admin.** By default the first person to register becomes the admin. Set `LAMBDA_ERP_ADMIN_EMAIL` + `LAMBDA_ERP_ADMIN_PASSWORD` to instead provision that admin automatically at startup — useful when the database is recreated on every deploy, so a redeployed instance can't be claimed by whoever visits first. It's create-if-missing and idempotent (an existing account with that email is promoted to an enabled admin; its password is left untouched), and the password is only ever read from the environment.
+
 ### Run the validation suite
 
 ```bash
@@ -353,12 +359,13 @@ for side-effects/integrations).
 
 ```python
 # acme/plugin.py
-from api.services import register_doctype, register_converter
+from api.services import register_doctype, register_master, register_converter
 from lambda_erp.hooks import register_hook
 from .sales_invoice import AcmeSalesInvoice
 
 def register():
     register_doctype("Sales Invoice", AcmeSalesInvoice)
+    register_master("gadget", "Gadget", "gadget_name", name_prefix="GAD")
     register_hook("Sales Invoice:after_submit", push_to_external_system)
     # register_converter(source, target, fn)   # only to replace conversion *logic*
 ```
@@ -367,6 +374,14 @@ Point the deployment at it with `LAMBDA_ERP_PLUGINS=acme` (comma-separated for
 several). On startup the core imports each module and calls `register()`. Unset
 = the core runs unchanged.
 
+A `register_master` type (core 0.5.0+) is served at `/api/masters/{slug}` and
+**discovered by the AI chat automatically**: `search_masters` (with fuzzy
+fallback), `get_master_fields`, and `create/update/delete_master` accept it
+from day one. The chat tool schemas and system prompt are built per request
+from the live registries, and fields are introspected from the live table — no
+per-type declarations. Details and caveats:
+[`docs/core-extension-architecture.md`](docs/core-extension-architecture.md).
+
 **Frontend overrides — the `@lambda-development/erp-core` library**
 
 The frontend ships as a library. The customer app depends on it, registers its

{lambda_erp-0.4.0 → lambda_erp-0.6.0}/README.md

@@ -85,6 +85,7 @@ Each of those is hours of skilled work today. With a capable LLM in the loop, th
 **Key design choices:**
 
 - **Chat-first, not chat-bolted-on.** The chat isn't a copilot sidebar - it's the primary way to interact with the system. Every document type, every report, every master record is reachable from tool-use.
+- **Extensions are first-class to the AI.** A customer deployment registers its own doctypes and master types through plugin seams (`register_doctype`, `register_master`) and the chat discovers them automatically - tool schemas and the system prompt are built per request from the live registries, and fields are introspected from the live table, so there is nothing to teach per type. A CRM lead added by a plugin is searchable in chat from day one, with zero prompt or tool edits.
 - **One shape for every document.** Invoices, sales orders, stock entries, payments - all share a single `Document` base class and the same three-state lifecycle (Draft → Submitted → Cancelled) with `on_submit`/`on_cancel` hooks. The LLM learns the pattern once and drives every doctype the same way. Leading open-source and commercial ERPs have per-model action verbs spread across 150+ core models; each one is a separate tool the model has to get right.
 - **Metadata-driven UI, shared with the LLM.** A single React form component renders every doctype from `frontend/src/lib/doctypes.ts`. The schema the model reasons over and the schema the user sees are literally the same file. Adding a field is two lines - one in the Python class, one in the config - not a new module with hand-written views and inheritance overlays.
 - **Two-model orchestration.** A planner model handles reasoning and tool-use. When it needs to generate code for a custom report, it delegates to a code-specialist sub-agent. This keeps each model doing what it's best at and keeps latency down on simple turns.
@@ -232,10 +233,15 @@ Open `http://localhost:5173`. Vite proxies `/api/*` to the backend.
 OPENAI_API_KEY=sk-...
 ANTHROPIC_API_KEY=sk-ant-...    # optional, used for the code-specialist sub-agent
 ANTHROPIC_CODE_MODEL=claude-opus-4-7   # optional, default shown
+LAMBDA_ERP_ADMIN_EMAIL=admin@example.com   # optional, seeds the admin at boot
+LAMBDA_ERP_ADMIN_PASSWORD=...              # optional, required with the line above
+LAMBDA_ERP_ADMIN_NAME=Administrator        # optional, display name for the seeded admin
 ```
 
 Chat needs `OPENAI_API_KEY`. Custom-report code generation uses `ANTHROPIC_API_KEY` when set; otherwise it falls back and the chat will tell you it can't generate reports.
 
+**Seeded admin.** By default the first person to register becomes the admin. Set `LAMBDA_ERP_ADMIN_EMAIL` + `LAMBDA_ERP_ADMIN_PASSWORD` to instead provision that admin automatically at startup — useful when the database is recreated on every deploy, so a redeployed instance can't be claimed by whoever visits first. It's create-if-missing and idempotent (an existing account with that email is promoted to an enabled admin; its password is left untouched), and the password is only ever read from the environment.
+
 ### Run the validation suite
 
 ```bash
@@ -326,12 +332,13 @@ for side-effects/integrations).
 
 ```python
 # acme/plugin.py
-from api.services import register_doctype, register_converter
+from api.services import register_doctype, register_master, register_converter
 from lambda_erp.hooks import register_hook
 from .sales_invoice import AcmeSalesInvoice
 
 def register():
     register_doctype("Sales Invoice", AcmeSalesInvoice)
+    register_master("gadget", "Gadget", "gadget_name", name_prefix="GAD")
     register_hook("Sales Invoice:after_submit", push_to_external_system)
     # register_converter(source, target, fn)   # only to replace conversion *logic*
 ```
@@ -340,6 +347,14 @@ Point the deployment at it with `LAMBDA_ERP_PLUGINS=acme` (comma-separated for
 several). On startup the core imports each module and calls `register()`. Unset
 = the core runs unchanged.
 
+A `register_master` type (core 0.5.0+) is served at `/api/masters/{slug}` and
+**discovered by the AI chat automatically**: `search_masters` (with fuzzy
+fallback), `get_master_fields`, and `create/update/delete_master` accept it
+from day one. The chat tool schemas and system prompt are built per request
+from the live registries, and fields are introspected from the live table — no
+per-type declarations. Details and caveats:
+[`docs/core-extension-architecture.md`](docs/core-extension-architecture.md).
+
 **Frontend overrides — the `@lambda-development/erp-core` library**
 
 The frontend ships as a library. The customer app depends on it, registers its

{lambda_erp-0.4.0 → lambda_erp-0.6.0}/api/auth.py

@@ -630,6 +630,65 @@ def _setting_enabled(db, key: str) -> bool:
     return str(value) == "1"
 
 
+def ensure_seed_admin() -> dict | None:
+    """Idempotently provision an admin account from the environment.
+
+    When both LAMBDA_ERP_ADMIN_EMAIL and LAMBDA_ERP_ADMIN_PASSWORD are set,
+    guarantee an enabled admin with that email exists *before* the first
+    visitor can register. This closes the "first user to sign up becomes
+    admin" bootstrap window (see `register`) on any deployment whose
+    database is recreated on every rollout — e.g. the ephemeral-SQLite demo
+    container, where otherwise whichever stranger loads the login page first
+    after a redeploy would silently own the instance.
+
+    Create-if-missing: an existing account with that email is promoted to an
+    enabled admin if needed, but its password is left untouched so a redeploy
+    never clobbers a credential changed inside a live instance. The password
+    is read only from the environment and is never logged.
+
+    No-op (returns None) when either variable is unset — this is a general
+    ops seam, not demo-only.
+    """
+    email = os.environ.get("LAMBDA_ERP_ADMIN_EMAIL")
+    password = os.environ.get("LAMBDA_ERP_ADMIN_PASSWORD")
+    if not email or not password:
+        return None
+
+    email = email.strip().lower()
+    db = get_db()
+
+    existing = db.sql('SELECT name, role, enabled FROM "User" WHERE email = ?', [email])
+    if existing:
+        row = existing[0]
+        updates = {}
+        if row["role"] != "admin":
+            updates["role"] = "admin"
+        if not row["enabled"]:
+            updates["enabled"] = 1
+        if updates:
+            updates["modified"] = now()
+            db.set_value("User", row["name"], updates)
+            print(f"[seed-admin] promoted existing user to enabled admin: {email}", flush=True)
+        else:
+            print(f"[seed-admin] admin already present: {email}", flush=True)
+        return {"name": row["name"], "status": "exists"}
+
+    user_name = f"USR-{uuid.uuid4().hex[:8]}"
+    full_name = os.environ.get("LAMBDA_ERP_ADMIN_NAME", "Administrator")
+    db.insert("User", {
+        "name": user_name,
+        "email": email,
+        "full_name": full_name,
+        "hashed_password": hash_password(password),
+        "role": "admin",
+        "enabled": 1,
+        "creation": now(),
+        "modified": now(),
+    })
+    print(f"[seed-admin] created admin account: {email}", flush=True)
+    return {"name": user_name, "status": "created"}
+
+
 @router.get("/settings")
 def get_settings(user: dict = Depends(get_current_user)):
     db = get_db()

{lambda_erp-0.4.0 → lambda_erp-0.6.0}/api/bootstrap.py

@@ -58,6 +58,16 @@ SETTING_DEMO_REDSTONE_SINV_DATE = "demo_chat_redstone_sinv_date"
 SETTING_DEMO_REDSTONE_DUE_DATE = "demo_chat_redstone_due_date"
 
 
+def _seed_setting_on(db, key: str) -> None:
+    """Turn a boolean Settings flag on, but only if it has never been set —
+    so an admin who later toggles it off in a persistent instance isn't
+    overridden on the next boot. On the ephemeral demo DB the key is always
+    absent at boot, so this reliably enables it there."""
+    if not db.sql('SELECT 1 FROM "Settings" WHERE key = ?', [key]):
+        db.sql('INSERT INTO "Settings" (key, value) VALUES (?, ?)', [key, "1"])
+        db.conn.commit()
+
+
 def bootstrap_demo() -> None:
     """Idempotent demo bootstrap. Logs each phase to stdout so a
     `docker compose up` user sees steady progress during the ~3-minute
@@ -131,7 +141,12 @@ def bootstrap_demo() -> None:
         create_public_manager(user=None)
         ensure_demo_chat_records(company)
     else:
-        print("[bootstrap] public demo disabled — first visitor registers as admin via the login page", flush=True)
+        # No public-manager replay: let visitors self-register as viewers so
+        # the demo is still hands-on. Admin is provisioned separately from the
+        # environment (see api.auth.ensure_seed_admin), so open signup here only
+        # ever mints viewers — nobody can grab admin off the login page.
+        _seed_setting_on(db, "allow_public_signup")
+        print("[bootstrap] public demo disabled — open viewer signup enabled; admin comes from LAMBDA_ERP_ADMIN_* env", flush=True)
 
     elapsed = time.monotonic() - t0
     # Recommend 127.0.0.1 — on WSL2 + Docker Desktop, browsers can stall

{lambda_erp-0.4.0 → lambda_erp-0.6.0}/api/chat.py

@@ -10,6 +10,7 @@ Supports multiple chat sessions, each with their own history and auto-generated
 
 import asyncio
 import base64
+import copy
 import difflib
 import io
 import json
@@ -1163,6 +1164,44 @@ TOOLS = [
     },
 ]
 
+
+def _extra_document_slugs():
+    """Doctype slugs registered beyond the core list (via register_doctype)."""
+    return sorted(s for s in services.SLUG_TO_DOCTYPE if s not in DOCUMENT_SLUGS)
+
+
+def _extra_master_types():
+    """Master types registered beyond the core list (via register_master)."""
+    return sorted(m for m in services.MASTER_TABLES if m not in MASTER_TYPES)
+
+
+def build_tools():
+    """TOOLS with the doctype/master enums widened from the live registries.
+
+    Plugins register doctypes and masters at startup — after this module is
+    imported — so the static TOOLS constant can't know about them. The tool
+    handlers already resolve through the live registries; the enums in the
+    schemas were the only thing shutting registered types out of chat. Built
+    per request (cheap next to the LLM call), which also makes plugin load
+    order irrelevant. Only enums that exactly match the core lists are
+    widened, so any differently-constrained doctype/master param (e.g. a
+    curated subset) is left alone.
+    """
+    extra_docs = _extra_document_slugs()
+    extra_masters = _extra_master_types()
+    if not extra_docs and not extra_masters:
+        return TOOLS
+    tools = copy.deepcopy(TOOLS)
+    for tool in tools:
+        props = tool["function"].get("parameters", {}).get("properties", {})
+        for schema in props.values():
+            if schema.get("enum") == DOCUMENT_SLUGS:
+                schema["enum"] = DOCUMENT_SLUGS + extra_docs
+            elif schema.get("enum") == MASTER_TYPES:
+                schema["enum"] = MASTER_TYPES + extra_masters
+    return tools
+
+
 # ---------------------------------------------------------------------------
 # Tool handlers — dispatch to existing service functions
 # ---------------------------------------------------------------------------
@@ -1845,6 +1884,21 @@ def build_system_prompt(user_info: dict | None = None, channel: str = "web"):
     analytics_context = _prompt_analytics_context()
     uom_context = _prompt_uom_context()
 
+    # Deployment-registered types (register_doctype / register_master). Folded
+    # into the type lists below so the assistant knows they exist and can act
+    # on them from day one — the tool schemas widen the same way (build_tools).
+    extra_docs = _extra_document_slugs()
+    extra_masters = _extra_master_types()
+    extension_doctypes_line = (
+        f"\n- **Extensions (deployment-specific):** {', '.join(extra_docs)}" if extra_docs else ""
+    )
+    master_types_line = ", ".join(MASTER_TYPES + extra_masters)
+    extension_master_keys = "".join(
+        f"\n- **{services.MASTER_TABLES[m][0]}** (master_type `{m}`): key = `name`, "
+        f"display = `{services.MASTER_TABLES[m][1]}`"
+        for m in extra_masters
+    )
+
     # Channel-aware link guidance. On the "web" channel the reader is a browser
     # inside the ERP, so web-relative links are clickable. On the "api" channel the
     # reply is relayed to an EXTERNAL app (lambda-web / the Lambda app) that is not
@@ -1952,7 +2006,7 @@ When a user asks you to do something they don't have permission for, explain wha
 - **Buying:** purchase-order, purchase-invoice
 - **Accounting:** payment-entry, journal-entry, budget, subscription, bank-transaction
 - **Stock:** stock-entry, delivery-note, purchase-receipt
-- **Settings:** pricing-rule
+- **Settings:** pricing-rule{extension_doctypes_line}
 
 ## Document Workflow & What Each Document Does
 
@@ -2076,7 +2130,7 @@ For purchased goods, prefer Purchase Receipt when receiving separately from bill
 - Cancelled documents cannot be re-submitted or modified.
 
 ## Master Data Types
-customer, supplier, item, warehouse, account, company, cost-center
+{master_types_line}
 
 ## Master Data Deletion
 Master records CAN be deleted — use the `delete_master` tool (ADMIN role only). It is reference-protected: an unreferenced record (e.g. a mistakenly created or duplicate one) is permanently deleted; a record referenced by any document, GL entry, or stock data is NOT deleted but automatically disabled/archived instead, and the result names the blocking reference — relay that reason to the user. When the user merely wants a record out of the way (not destroyed), prefer `update_master` with `{{"disabled": 1}}`. Non-admin users: explain that deletion needs an admin and offer to disable instead.
@@ -2153,7 +2207,7 @@ Every master record has a primary key (the `name` column) and a human-readable d
 - **Item:** key = `item_code` (e.g. `SVC-005`), display = `item_name` (e.g. "Project Management")
 - **Customer:** key = `name` (e.g. `CUST-007`), display = `customer_name` (e.g. "Redstone Automotive")
 - **Supplier:** key = `name` (e.g. `SUPP-003`), display = `supplier_name`
-- **Warehouse / Company / Account / Cost Center:** key = `name`
+- **Warehouse / Company / Account / Cost Center:** key = `name`{extension_master_keys}
 
 When you fill in `item_code`, `customer`, `supplier`, `warehouse`, `company`, etc. in a document or child-table row, you MUST use the **primary key**, never the display name. `"item_code": "Project Management"` is ALWAYS wrong — it's a name, not a code.
 
@@ -2646,7 +2700,7 @@ async def run_thinking_loop(
                     openai_client.chat.completions.create,
                     model=model_name,
                     messages=messages,
-                    tools=TOOLS,
+                    tools=build_tools(),
                     tool_choice="auto",
                     max_completion_tokens=max_completion,
                     # gpt-5.6-terra rejects function tools on /v1/chat/completions

{lambda_erp-0.4.0 → lambda_erp-0.6.0}/api/main.py

@@ -11,6 +11,7 @@ from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import FileResponse
 from fastapi.staticfiles import StaticFiles
 
+from lambda_erp import get_app_version
 from lambda_erp.database import setup
 
 from api.errors import register_exception_handlers
@@ -54,10 +55,22 @@ async def lifespan(app: FastAPI):
     # Load customer extension plugins before anything creates documents.
     load_plugins()
 
+    # Create plugin-registered tables and run their pending migrations. Must be
+    # after load_plugins() (registrations happen in register()) and before any
+    # document is created.
+    from api.services import apply_plugin_schema
+    apply_plugin_schema()
+
     # Ensure the demo spend log table exists before any LLM call happens.
     from api.demo_limits import init_schema as init_demo_spend_schema
     init_demo_spend_schema()
 
+    # Seed a deterministic admin from the environment (if configured) before
+    # anyone can register. On deployments whose DB is recreated each rollout
+    # this stops the first visitor after a redeploy from grabbing admin.
+    from api.auth import ensure_seed_admin
+    ensure_seed_admin()
+
     # When packaged as a demo container, land visitors straight in demo mode.
     if os.environ.get("LAMBDA_ERP_AUTO_DEMO") == "1":
         from api.bootstrap import bootstrap_demo
@@ -70,7 +83,7 @@ async def lifespan(app: FastAPI):
 
 app = FastAPI(
     title="Lambda ERP",
-    version="0.1.0",
+    version=get_app_version(),
     lifespan=lifespan,
 )
 
@@ -105,7 +118,7 @@ app.include_router(chat_api.router, prefix="/api")
 
 @app.get("/api/health")
 def health():
-    return {"status": "ok"}
+    return {"status": "ok", "version": get_app_version()}
 
 
 @app.websocket("/ws/chat")

{lambda_erp-0.4.0 → lambda_erp-0.6.0}/api/routers/documents.py

@@ -1,6 +1,6 @@
 """Generic CRUD routes for all document types."""
 
-from fastapi import APIRouter, Depends, Query
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from fastapi.responses import Response
 from api.services import (
     create_document,
@@ -12,6 +12,7 @@ from api.services import (
     convert_document,
     list_documents,
     count_documents,
+    document_columns,
 )
 from api.pdf import generate_pdf
 from api.auth import require_role
@@ -21,16 +22,26 @@ router = APIRouter(prefix="/documents", tags=["documents"])
 _viewer = Depends(require_role("viewer"))
 _manager = Depends(require_role("manager"))
 
+# Query params the list endpoint interprets itself — everything else is treated
+# as an ad-hoc column=value filter (validated against the doctype's columns).
+_LIST_RESERVED = {
+    "status", "party", "from_date", "to_date", "docstatus",
+    "include_discarded", "limit", "offset", "order_by", "order",
+}
+
 
 @router.get("/{doctype_slug}")
 def list_docs(
     doctype_slug: str,
+    request: Request,
     status: str | None = None,
     party: str | None = None,
     from_date: str | None = None,
     to_date: str | None = None,
     docstatus: int | None = None,
     include_discarded: bool = False,
+    order_by: str | None = None,
+    order: str = "desc",
     limit: int = Query(default=50, le=500),
     offset: int = Query(default=0, ge=0),
     _user: dict = _viewer,
@@ -46,8 +57,25 @@ def list_docs(
         filters["from_date"] = from_date
     if to_date:
         filters["to_date"] = to_date
+
+    # Ad-hoc equality filters: any remaining query param that names a real column
+    # of this doctype (e.g. /documents/activity?lead_id=LEAD-3316). Validate
+    # against the live columns so an unknown field is a 400, never interpolated.
+    columns = document_columns(doctype_slug)
+    for key, value in request.query_params.items():
+        if key in _LIST_RESERVED:
+            continue
+        if key not in columns:
+            raise HTTPException(status_code=400, detail=f"Unknown filter field: {key}")
+        filters[key] = value
+
+    if order_by is not None and order_by not in columns:
+        raise HTTPException(status_code=400, detail=f"Unknown order_by field: {order_by}")
+    if order.lower() not in ("asc", "desc"):
+        raise HTTPException(status_code=400, detail="order must be 'asc' or 'desc'")
+
     rows = list_documents(doctype_slug, filters=filters, limit=limit, offset=offset,
-                          include_discarded=include_discarded)
+                          include_discarded=include_discarded, order_by=order_by, order=order)
     total = count_documents(doctype_slug, filters=filters, include_discarded=include_discarded)
     return {"rows": rows, "total": total, "limit": limit, "offset": offset}
 

{lambda_erp-0.4.0 → lambda_erp-0.6.0}/api/routers/masters.py

@@ -5,7 +5,10 @@ import re
 from fastapi import APIRouter, Depends, HTTPException, Query
 from lambda_erp.database import get_db
 from lambda_erp.utils import _dict
-from api.services import MASTER_TABLES
+# The per-type registries live in api.services so `register_master` can extend
+# them; imported here (not moved) so existing `from api.routers.masters import
+# MASTER_IDENTITY_ALIAS`-style imports keep working.
+from api.services import MASTER_TABLES, MASTER_NAME_PREFIXES, MASTER_IDENTITY_ALIAS
 from api.auth import require_role, require_non_public_manager
 
 router = APIRouter(prefix="/masters", tags=["masters"])
@@ -14,22 +17,6 @@ _viewer = Depends(require_role("viewer"))
 _manager = Depends(require_non_public_manager)
 _admin = Depends(require_role("admin"))
 
-MASTER_NAME_PREFIXES = {
-    "customer": "CUST",
-    "supplier": "SUPP",
-    "item": "ITEM",
-    "warehouse": "WH",
-}
-
-# An Item's code is stored in the primary-key column `name`, but every
-# transaction line and report references it as
-# `item_code`. Accept that intuitive alias on the master API so callers
-# (LLM tools, REST clients) can set and read the code under the name they
-# already use everywhere else, instead of silently falling back to ITEM-NNN.
-MASTER_IDENTITY_ALIAS = {
-    "item": "item_code",
-}
-
 
 def _echo_identity_alias(master_type: str, row):
     """Mirror the master's `name` back under its intuitive alias (item_code)."""

{lambda_erp-0.4.0 → lambda_erp-0.6.0}/api/services.py

@@ -1,6 +1,6 @@
 """Bridge between FastAPI request data and lambda_erp Document classes."""
 
-from lambda_erp.utils import _dict
+from lambda_erp.utils import _dict, now
 from lambda_erp.database import get_db
 
 from lambda_erp.selling.quotation import (
@@ -70,6 +70,25 @@ MASTER_TABLES = {
     "cost-center": ("Cost Center", "cost_center_name"),
 }
 
+# Auto-naming prefixes: masters created without an explicit `name` get a
+# generated PREFIX-NNN id (see masters.create_master_record). Types without an
+# entry require an explicit name (or derive it, like company).
+MASTER_NAME_PREFIXES = {
+    "customer": "CUST",
+    "supplier": "SUPP",
+    "item": "ITEM",
+    "warehouse": "WH",
+}
+
+# An Item's code is stored in the primary-key column `name`, but every
+# transaction line and report references it as `item_code`. Accept that
+# intuitive alias on the master API so callers (LLM tools, REST clients) can
+# set and read the code under the name they already use everywhere else,
+# instead of silently falling back to ITEM-NNN.
+MASTER_IDENTITY_ALIAS = {
+    "item": "item_code",
+}
+
 # Slug <-> doctype name mapping
 SLUG_TO_DOCTYPE = {}
 DOCTYPE_TO_SLUG = {}
@@ -95,6 +114,108 @@ def register_doctype(doctype: str, cls, slug: str | None = None) -> None:
     DOCTYPE_TO_SLUG[doctype] = slug
 
 
+# --- Plugin schema seam ---
+#
+# Core tables are created by database.setup(); plugin tables have no home there
+# (setup() runs before plugins load). These two registries let a plugin declare
+# its own tables and one-time migrations from register(); the core applies them
+# via apply_plugin_schema() in the app lifespan, right after load_plugins() and
+# before any document is created. See docs/core-extension-architecture.md.
+
+_PLUGIN_TABLES: list[str] = []
+_PLUGIN_MIGRATIONS: list = []  # list[tuple[str, Callable[[DB], None]]]
+
+
+def register_table(ddl: str) -> None:
+    """Register a CREATE TABLE (use IF NOT EXISTS) for a plugin table. The DDL is
+    the SQLite-flavoured subset the core's own DDL uses; apply_plugin_schema()
+    translates it per backend via db._ddl(). Idempotent — safe on every boot."""
+    _PLUGIN_TABLES.append(ddl)
+
+
+def register_migration(migration_id: str, fn) -> None:
+    """Register a one-shot migration run exactly once per database, recorded in
+    _PluginMigrations by `migration_id` (namespace it, e.g. "internal:0001_x").
+    `fn(db)` receives the DB; use db.ensure_column(...) for idempotent ALTERs
+    and plain db.sql(...) for backfills. Runs after registered tables exist, in
+    registration order. Must be idempotent and self-contained (single logical
+    unit — it commits on success)."""
+    _PLUGIN_MIGRATIONS.append((migration_id, fn))
+
+
+def apply_plugin_schema() -> None:
+    """Create registered plugin tables, then run pending plugin migrations once
+    each. Call from the app lifespan after load_plugins(). Table creation always
+    runs (IF NOT EXISTS); each migration runs only if its id isn't already in
+    _PluginMigrations. A failing migration is rolled back and left unrecorded so
+    it retries next boot; it does not abort startup (mirrors the core migrator)."""
+    db = get_db()
+    for ddl in _PLUGIN_TABLES:
+        db.conn.execute(db._ddl(ddl))
+    db.conn.commit()
+
+    if not _PLUGIN_MIGRATIONS:
+        return
+
+    db.conn.execute(
+        'CREATE TABLE IF NOT EXISTS "_PluginMigrations" '
+        "(migration_id TEXT PRIMARY KEY, applied_at TEXT NOT NULL)"
+    )
+    db.conn.commit()
+    applied = {r["migration_id"] for r in db.sql('SELECT migration_id FROM "_PluginMigrations"')}
+
+    for migration_id, fn in _PLUGIN_MIGRATIONS:
+        if migration_id in applied:
+            continue
+        try:
+            fn(db)
+            db.sql(
+                'INSERT INTO "_PluginMigrations" (migration_id, applied_at) VALUES (?, ?)',
+                [migration_id, now()],
+            )
+            db.conn.commit()
+            print(f"[plugin-migration] applied {migration_id}", flush=True)
+        except Exception as e:
+            db.conn.rollback()
+            print(f"[plugin-migration] FAILED {migration_id}: {e!r} — will retry next boot", flush=True)
+
+
+def document_columns(doctype_slug: str) -> set:
+    """The real column names of a registered doctype's table, or empty set if the
+    slug is unknown. Used to validate ad-hoc list filters against actual columns
+    (see the documents router) so an unknown field is a 400, never SQL."""
+    doctype = SLUG_TO_DOCTYPE.get(doctype_slug)
+    if not doctype:
+        return set()
+    return get_db()._get_table_columns(doctype)
+
+
+def register_master(slug: str, table: str, name_field: str, *,
+                    name_prefix: str | None = None,
+                    identity_alias: str | None = None) -> None:
+    """Register (or override) a master type — the master-side counterpart of
+    `register_doctype`.
+
+    A plugin calls this at startup and the master becomes a first-class type
+    everywhere `MASTER_TABLES` is consulted: the REST CRUD surface
+    (`/api/masters/{slug}`) and the chat tools (search_masters,
+    get_master_fields, create/update/delete_master — their schemas and the
+    system prompt are built from the live registry per request). Fields are
+    never declared: they're introspected from the table at call time, so every
+    text column of `table` is immediately searchable.
+
+    `name_field` is the human display column (e.g. "company_name").
+    `name_prefix` enables auto-generated ids (prefix "LEAD" -> LEAD-001) when a
+    record is created without an explicit `name`. `identity_alias` lets callers
+    address the `name` PK under a friendlier key, like item's `item_code`.
+    """
+    MASTER_TABLES[slug] = (table, name_field)
+    if name_prefix:
+        MASTER_NAME_PREFIXES[slug] = name_prefix
+    if identity_alias:
+        MASTER_IDENTITY_ALIAS[slug] = identity_alias
+
+
 def get_document_class(doctype_slug: str):
     """Get document class from URL slug."""
     doctype = SLUG_TO_DOCTYPE.get(doctype_slug)
@@ -227,8 +348,18 @@ def _exclude_discarded(db, doctype: str, db_filters: dict, include_discarded: bo
         db_filters["discarded"] = 0
 
 
+def _order_clause(order_by: str = None, order: str = "desc") -> str:
+    """ORDER BY clause for list queries. Defaults to newest-created first.
+    `order_by`, when given, must already be a validated column name (the
+    documents router checks it against document_columns) — it is quoted here."""
+    if not order_by:
+        return "creation DESC"
+    direction = "ASC" if str(order).lower() == "asc" else "DESC"
+    return f'"{order_by}" {direction}'
+
+
 def list_documents(doctype_slug: str, filters: dict = None, limit: int = 50, offset: int = 0,
-                   include_discarded: bool = False) -> list:
+                   include_discarded: bool = False, order_by: str = None, order: str = "desc") -> list:
     doctype = SLUG_TO_DOCTYPE.get(doctype_slug)
     if not doctype:
         raise ValueError(f"Unknown document type: {doctype_slug}")
@@ -270,15 +401,17 @@ def list_documents(doctype_slug: str, filters: dict = None, limit: int = 50, off
             db, doctype, doctype_slug, db_filters, date_field, from_date, to_date, limit, offset
         )
 
+    order_clause = _order_clause(order_by, order)
+
     # get_all doesn't support offset, so use raw SQL when needed
     if offset:
-        return _list_with_offset(db, doctype, doctype_slug, db_filters, limit, offset)
+        return _list_with_offset(db, doctype, doctype_slug, db_filters, limit, offset, order_clause)
 
     rows = db.get_all(
         doctype,
         filters=db_filters if db_filters else None,
         fields=["*"],
-        order_by="creation DESC",
+        order_by=order_clause,
         limit=limit,
     )
 
@@ -333,7 +466,7 @@ def count_documents(doctype_slug: str, filters: dict = None, include_discarded:
     return int(rows[0]["c"]) if rows else 0
 
 
-def _list_with_offset(db, doctype, doctype_slug, db_filters, limit, offset):
+def _list_with_offset(db, doctype, doctype_slug, db_filters, limit, offset, order_clause="creation DESC"):
     where_parts = []
     params = []
     for k, v in db_filters.items():
@@ -347,7 +480,7 @@ def _list_with_offset(db, doctype, doctype_slug, db_filters, limit, offset):
     query = f'SELECT * FROM "{doctype}"'
     if where_parts:
         query += " WHERE " + " AND ".join(where_parts)
-    query += " ORDER BY creation DESC"
+    query += f" ORDER BY {order_clause}"
     if limit:
         query += f" LIMIT {int(limit)}"
     if offset:

{lambda_erp-0.4.0 → lambda_erp-0.6.0}/frontend/src/api/client.ts

@@ -447,6 +447,7 @@ export const api = {
   getPublicManagerStatus: () => request<{ active: boolean; user?: any }>("/auth/public-manager"),
   createPublicManager: () => request<any>("/auth/public-manager", { method: "POST" }),
   removePublicManager: () => request<any>("/auth/public-manager", { method: "DELETE" }),
+  getHealth: () => request<{ status: string; version: string }>("/health"),
   getSettings: () => request<Record<string, string>>("/auth/settings"),
   updateSettings: (data: Record<string, string>) =>
     request<Record<string, string>>("/auth/settings", { method: "PUT", body: JSON.stringify(data) }),

lambda_erp-0.6.0/lambda_erp/__init__.py

@@ -0,0 +1,33 @@
+"""Lambda ERP - Core ERP logic packaged as a standalone library."""
+
+
+def get_app_version() -> str:
+    """Runtime version of the ERP core.
+
+    The single human-edited source is the packaging version in `pyproject.toml`,
+    which the release process bumps. A wheel/pip install doesn't ship
+    `pyproject.toml`, so there we read the installed package metadata (populated
+    from that same version at build time). A source checkout (incl. editable
+    dev) reads `pyproject.toml` directly, so it's correct without a reinstall.
+    Falls back to "dev" when neither is available.
+    """
+    import re
+    from pathlib import Path
+
+    pyproject = Path(__file__).resolve().parent.parent / "pyproject.toml"
+    if pyproject.is_file():
+        match = re.search(
+            r'^version\s*=\s*"([^"]+)"', pyproject.read_text(encoding="utf-8"), re.MULTILINE
+        )
+        if match:
+            return match.group(1)
+
+    try:
+        from importlib.metadata import version
+
+        return version("lambda-erp")
+    except Exception:
+        return "dev"
+
+
+__version__ = get_app_version()

{lambda_erp-0.4.0 → lambda_erp-0.6.0}/lambda_erp/database.py

@@ -1391,6 +1391,14 @@ class Database:
             self._col_cache.pop(table, None)
             self._text_col_cache.pop(table, None)
 
+    def ensure_column(self, table: str, column: str, definition: str) -> None:
+        """Idempotently add a column if it's missing. Public helper for plugin
+        migrations registered via api.services.register_migration — the same
+        backend-portable, PRAGMA/information_schema-guarded add the core's own
+        migrations use. `definition` is the SQLite-flavoured column type (e.g.
+        "TEXT", "INTEGER DEFAULT 0"); it is translated per dialect via _ddl."""
+        self._add_column_if_missing(table, column, definition)
+
     def _migrate(self):
         """Run each pending migration in order, tracking applied versions."""
         self.conn.execute(

{lambda_erp-0.4.0 → lambda_erp-0.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lambda-erp"
-version = "0.4.0"
+version = "0.6.0"
 description = "Core ERP logic - accounting, sales, purchasing, inventory"
 readme = "README.md"
 license = "Apache-2.0"

lambda_erp-0.4.0/lambda_erp/__init__.py

@@ -1,3 +0,0 @@
-"""Lambda ERP - Core ERP logic packaged as a standalone library."""
-
-__version__ = "0.1.0"