lambda-erp 0.8.12__tar.gz → 0.8.13__tar.gz

{lambda_erp-0.8.12 → lambda_erp-0.8.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lambda-erp
-Version: 0.8.12
+Version: 0.8.13
 Summary: Core ERP logic - accounting, sales, purchasing, inventory
 Author: TORUS INVESTMENTS AG
 License-Expression: Apache-2.0

{lambda_erp-0.8.12 → lambda_erp-0.8.13}/api/chat.py

@@ -1260,8 +1260,8 @@ def _chat_doctype_section() -> str:
     )
 
 
-def build_tools():
-    """TOOLS with the doctype/master enums widened from the live registries.
+def build_tools(user_info: dict | None = None):
+    """TOOLS widened with live plugin types and registered business actions.
 
     Plugins register doctypes and masters at startup — after this module is
     imported — so the static TOOLS constant can't know about them. The tool
@@ -1274,7 +1274,14 @@ def build_tools():
     """
     extra_docs = _extra_document_slugs()
     extra_masters = _extra_master_types()
-    if not extra_docs and not extra_masters:
+    action_tools = services.registered_action_tools()
+    if user_info is not None:
+        role = user_info.get("role")
+        action_tools = [
+            tool for tool in action_tools
+            if services.registered_action_allowed(tool["function"]["name"], role)
+        ]
+    if not extra_docs and not extra_masters and not action_tools:
         return TOOLS
     tools = copy.deepcopy(TOOLS)
     for tool in tools:
@@ -1284,6 +1291,8 @@ def build_tools():
                 schema["enum"] = DOCUMENT_SLUGS + extra_docs
             elif schema.get("enum") == MASTER_TYPES:
                 schema["enum"] = MASTER_TYPES + extra_masters
+    existing_names = {tool["function"]["name"] for tool in tools}
+    tools.extend(tool for tool in action_tools if tool["function"]["name"] not in existing_names)
     return tools
 
 
@@ -2053,11 +2062,20 @@ def build_system_prompt(user_info: dict | None = None, channel: str = "web"):
         f"\n- **Extensions (deployment-specific):** {', '.join(extra_docs)}" if extra_docs else ""
     )
     master_types_line = ", ".join(MASTER_TYPES + extra_masters)
-    extension_master_keys = "".join(
-        f"\n- **{services.MASTER_TABLES[m][0]}** (master_type `{m}`): key = `name`, "
-        f"display = `{services.MASTER_TABLES[m][1]}`"
-        for m in extra_masters
-    )
+    extension_master_keys = ""
+    for master in extra_masters:
+        meta = services.MASTER_METADATA.get(master, {})
+        extension_master_keys += (
+            f"\n- **{services.MASTER_TABLES[master][0]}** (master_type `{master}`): "
+            f"key = `name`, display = `{services.MASTER_TABLES[master][1]}`"
+        )
+        if meta.get("description"):
+            extension_master_keys += f". {meta['description']}"
+        if meta.get("fields"):
+            extension_master_keys += (
+                ". Key fields: "
+                + ", ".join(f"`{field}`" for field in meta["fields"])
+            )
     chat_doctype_section = _chat_doctype_section()
 
     # Channel-aware link guidance. On the "web" channel the reader is a browser
@@ -2974,6 +2992,7 @@ async def run_thinking_loop(
     # delete_master needs the caller's role (admin-only) — scoped here rather
     # than in TOOL_HANDLERS, whose handlers are called with (args) only.
     tool_handlers["delete_master"] = lambda args: _handle_delete_master(args, user_info)
+    tool_handlers.update(services.registered_action_handlers(user_info))
 
     user_role = user_info.get("role") if user_info else None
     demo_mode = is_demo_role(user_role)
@@ -3075,7 +3094,7 @@ async def run_thinking_loop(
                 # Responses API (ERP_CHAT_API=responses). Returns Chat-shaped
                 # (message, usage) either way, so everything below is unchanged.
                 message, usage = await asyncio.to_thread(
-                    _orchestrator_turn, openai_client, messages, build_tools(), max_completion,
+                    _orchestrator_turn, openai_client, messages, build_tools(user_info), max_completion,
                 )
             except Exception as e:
                 await on_event({"type": "error", "content": f"Error calling LLM: {e}"})

{lambda_erp-0.8.12 → lambda_erp-0.8.13}/api/main.py

@@ -19,7 +19,7 @@ from api.auth import router as auth_router, COOKIE_NAME, decode_token
 from api.oauth import router as oauth_router
 from api.attachments import router as attachments_router
 from api.chat import chat_websocket, router as chat_router
-from api.routers import admin, documents, masters, reports, setup as setup_router, bank_reconciliation, analytics, accounting, proposals, chat_api, mcp, availability
+from api.routers import admin, documents, masters, reports, setup as setup_router, bank_reconciliation, analytics, accounting, proposals, chat_api, mcp, availability, actions
 
 
 def load_plugins() -> None:
@@ -106,6 +106,7 @@ app.include_router(attachments_router, prefix="/api")
 app.include_router(documents.router, prefix="/api")
 app.include_router(proposals.router, prefix="/api")
 app.include_router(masters.router, prefix="/api")
+app.include_router(actions.router, prefix="/api")
 app.include_router(availability.router, prefix="/api")
 app.include_router(reports.router, prefix="/api")
 app.include_router(analytics.router, prefix="/api")

lambda_erp-0.8.13/api/routers/actions.py

@@ -0,0 +1,23 @@
+"""REST surface for deployment-registered business actions."""
+
+from fastapi import APIRouter, Depends, HTTPException
+
+from api import services
+from api.auth import require_role
+
+
+router = APIRouter(prefix="/actions", tags=["actions"])
+_viewer = Depends(require_role("viewer"))
+
+
+@router.post("/{action_name}")
+def run_action(action_name: str, data: dict, user: dict = _viewer):
+    """Execute the same registered action exposed to chat and MCP."""
+    try:
+        return services.run_registered_action(action_name, data, user)
+    except KeyError:
+        raise HTTPException(status_code=404, detail=f"Unknown action: {action_name}")
+    except PermissionError as exc:
+        raise HTTPException(status_code=403, detail=str(exc))
+    except ValueError as exc:
+        raise HTTPException(status_code=422, detail=str(exc))

{lambda_erp-0.8.12 → lambda_erp-0.8.13}/api/routers/masters.py

@@ -4,12 +4,13 @@ import re
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from lambda_erp.database import get_db
-from lambda_erp.utils import _dict
+from lambda_erp.utils import _dict, now
 # The per-type registries live in api.services so `register_master` can extend
 # them; imported here (not moved) so existing `from api.routers.masters import
 # MASTER_IDENTITY_ALIAS`-style imports keep working.
 from api.services import (
     MASTER_TABLES, MASTER_NAME_PREFIXES, MASTER_IDENTITY_ALIAS,
+    MASTER_REFERENCE_CHECKS,
     _search_clause, _where_from_filters, master_search_columns, count_query_cached,
 )
 from api.auth import require_role, require_non_public_manager
@@ -145,7 +146,11 @@ def _with_active_filter(db, doctype: str, filters: dict | None = None) -> dict |
 
 def _find_reference(master_type: str, name: str) -> str | None:
     db = get_db()
-    for query, label in DELETE_REFERENCE_CHECKS.get(master_type, []):
+    checks = [
+        *DELETE_REFERENCE_CHECKS.get(master_type, []),
+        *MASTER_REFERENCE_CHECKS.get(master_type, []),
+    ]
+    for query, label in checks:
         params = [name] if query.count("?") == 1 else [name] * query.count("?")
         try:
             if db.sql(query, params):
@@ -223,6 +228,13 @@ def create_master_record(master_type: str, data: dict) -> dict:
     if db.exists(doctype, doc["name"]):
         raise HTTPException(status_code=409, detail=f"{doctype} {doc['name']} already exists")
 
+    columns = db._get_table_columns(doctype)
+    stamp = now()
+    if "creation" in columns and not doc.get("creation"):
+        doc["creation"] = stamp
+    if "modified" in columns and not doc.get("modified"):
+        doc["modified"] = stamp
+
     # Party masters inherit the company's base currency when none is specified.
     # Otherwise the Customer/Supplier default_currency column default ('USD')
     # wins, so a non-USD company (e.g. CHF) gets USD customers that then force
@@ -261,6 +273,8 @@ def update_master_record(master_type: str, name: str, data: dict) -> dict:
             )
 
     update_fields = {k: v for k, v in normalized.items() if k != "name"}
+    if "modified" in db._get_table_columns(doctype) and "modified" not in update_fields:
+        update_fields["modified"] = now()
     if update_fields:
         db.set_value(doctype, name, update_fields)
 
@@ -273,7 +287,7 @@ def update_master_record(master_type: str, name: str, data: dict) -> dict:
 # Query params list_masters consumes itself — anything else is treated as an
 # ad-hoc equality field filter (validated against the master's real columns).
 _MASTER_LIST_RESERVED = {
-    "limit", "offset", "include_disabled", "search", "search_fields",
+    "limit", "offset", "include_disabled", "search", "search_fields", "fields",
 }
 
 
@@ -308,6 +322,7 @@ def list_masters(
     include_disabled: bool = False,
     search: str | None = None,
     search_fields: str | None = None,
+    fields: str | None = None,
     _user: dict = _viewer,
 ):
     doctype, _ = _get_table(master_type)
@@ -354,7 +369,17 @@ def list_masters(
 
     # Deterministic order by the `name` PK (already indexed) — required for
     # OFFSET pagination and the /adjacent prev/next contract.
-    query = f'SELECT * FROM "{doctype}"{where} ORDER BY name LIMIT {int(limit)}'
+    requested_fields = [f.strip() for f in (fields or "").split(",") if f.strip()]
+    if requested_fields:
+        unknown = [f for f in requested_fields if f not in columns]
+        if unknown:
+            raise HTTPException(status_code=400, detail=f"Unknown list fields: {', '.join(unknown)}")
+        if "name" not in requested_fields:
+            requested_fields.insert(0, "name")
+        projection = ", ".join(f'"{f}"' for f in requested_fields)
+    else:
+        projection = "*"
+    query = f'SELECT {projection} FROM "{doctype}"{where} ORDER BY name LIMIT {int(limit)}'
     if offset:
         query += f" OFFSET {int(offset)}"
     rows = db.sql(query, params)

{lambda_erp-0.8.12 → lambda_erp-0.8.13}/api/routers/mcp.py

@@ -22,6 +22,7 @@ from fastapi.responses import JSONResponse, Response
 
 from lambda_erp import get_app_version
 from api.auth import get_current_user
+from api import services
 from api import chat as chat_mod
 from api.chat import TOOL_HANDLERS, build_tools
 
@@ -58,6 +59,8 @@ def _can_write(role) -> bool:
 def _allowed(name: str, role) -> bool:
     if name in _EXCLUDE:
         return False
+    if name in services.REGISTERED_ACTIONS:
+        return services.registered_action_allowed(name, role)
     if name in _ADMIN:
         return role == "admin"
     if name in _WRITE:
@@ -96,6 +99,7 @@ def _call(name: str, args: dict, user: dict):
     # delete_master needs the caller's role (admin-only); handled by the chat's
     # role-aware variant.
     handlers["delete_master"] = lambda a: chat_mod._handle_delete_master(a, user)
+    handlers.update(services.registered_action_handlers(user))
     handler = handlers.get(name)
     if handler is None:
         raise KeyError(name)

{lambda_erp-0.8.12 → lambda_erp-0.8.13}/api/services.py

@@ -1,5 +1,6 @@
 """Bridge between FastAPI request data and lambda_erp Document classes."""
 
+import re
 import time
 
 from lambda_erp.utils import _dict, now
@@ -98,6 +99,17 @@ MASTER_IDENTITY_ALIAS = {
     "item": "item_code",
 }
 
+# Optional metadata for plugin masters. Backend consumers use the descriptions
+# to teach chat/MCP about deployment-specific records; the frontend has a
+# parallel build-time registry because Python plugin state is not available to
+# the browser bundle.
+MASTER_METADATA: dict[str, dict] = {}
+
+# Reference checks registered alongside plugin masters. Each entry has the same
+# shape as the core checks in api.routers.masters: (query, human label). Keeping
+# this registry here avoids making plugins mutate router-private globals.
+MASTER_REFERENCE_CHECKS: dict[str, list[tuple[str, str]]] = {}
+
 # Slug <-> doctype name mapping
 SLUG_TO_DOCTYPE = {}
 DOCTYPE_TO_SLUG = {}
@@ -201,7 +213,10 @@ def document_columns(doctype_slug: str) -> set:
 
 def register_master(slug: str, table: str, name_field: str, *,
                     name_prefix: str | None = None,
-                    identity_alias: str | None = None) -> None:
+                    identity_alias: str | None = None,
+                    description: str | None = None,
+                    fields: list[str] | None = None,
+                    reference_checks: list[tuple[str, str]] | None = None) -> None:
     """Register (or override) a master type — the master-side counterpart of
     `register_doctype`.
 
@@ -223,6 +238,93 @@ def register_master(slug: str, table: str, name_field: str, *,
         MASTER_NAME_PREFIXES[slug] = name_prefix
     if identity_alias:
         MASTER_IDENTITY_ALIAS[slug] = identity_alias
+    if description or fields:
+        MASTER_METADATA[slug] = {
+            "description": description or "",
+            "fields": list(fields or []),
+        }
+    if reference_checks is not None:
+        MASTER_REFERENCE_CHECKS[slug] = list(reference_checks)
+
+
+# --- Registered actions ----------------------------------------------------
+#
+# Plugins sometimes need one deliberate transition that is richer than CRUD
+# (for example, promoting reference data into a workflow document). Register it
+# once here and it becomes available through REST, AI chat, and MCP. The
+# frontend's master registry can point a button at the same action name.
+
+REGISTERED_ACTIONS: dict[str, dict] = {}
+_ACTION_NAME_RE = re.compile(r"^[a-z][a-z0-9_]*$")
+_ROLE_LEVEL = {"viewer": 1, "manager": 2, "public_manager": 2, "admin": 3}
+
+
+def register_action(name: str, handler, *, description: str,
+                    parameters: dict | None = None,
+                    minimum_role: str = "manager",
+                    allow_public_manager: bool = False) -> None:
+    """Register a deployment action across REST, chat, and MCP.
+
+    ``handler`` receives one JSON-compatible argument dict and returns a
+    JSON-compatible result. ``parameters`` is a JSON Schema object for that
+    dict. Mutating actions should keep the default manager requirement; demo
+    ``public_manager`` users are excluded unless explicitly opted in.
+    """
+    if not _ACTION_NAME_RE.fullmatch(name):
+        raise ValueError(f"Invalid action name: {name!r}")
+    if minimum_role not in _ROLE_LEVEL:
+        raise ValueError(f"Invalid minimum action role: {minimum_role!r}")
+    REGISTERED_ACTIONS[name] = {
+        "handler": handler,
+        "description": description,
+        "parameters": parameters or {"type": "object", "properties": {}},
+        "minimum_role": minimum_role,
+        "allow_public_manager": allow_public_manager,
+    }
+
+
+def registered_action_allowed(name: str, role: str | None) -> bool:
+    meta = REGISTERED_ACTIONS.get(name)
+    if not meta:
+        return False
+    if role == "public_manager" and not meta["allow_public_manager"]:
+        return False
+    return _ROLE_LEVEL.get(role or "", 0) >= _ROLE_LEVEL[meta["minimum_role"]]
+
+
+def registered_action_tools() -> list[dict]:
+    """OpenAI-style function tool schemas for all live registered actions."""
+    return [
+        {
+            "type": "function",
+            "function": {
+                "name": name,
+                "description": meta["description"],
+                "parameters": meta["parameters"],
+            },
+        }
+        for name, meta in REGISTERED_ACTIONS.items()
+    ]
+
+
+def run_registered_action(name: str, args: dict | None, user_info: dict | None = None):
+    meta = REGISTERED_ACTIONS.get(name)
+    if not meta:
+        raise KeyError(name)
+    role = (user_info or {}).get("role")
+    if not registered_action_allowed(name, role):
+        raise PermissionError(
+            f"Action '{name}' requires {meta['minimum_role']} access."
+        )
+    return meta["handler"](args or {})
+
+
+def registered_action_handlers(user_info: dict | None = None) -> dict:
+    """Handlers bound to one caller, used by both chat and MCP dispatch."""
+    return {
+        name: (lambda args, action=name: run_registered_action(action, args, user_info))
+        for name in REGISTERED_ACTIONS
+    }
 
 
 # Chat guidance for registered doctypes: slug -> {"description", "fields"}. The

{lambda_erp-0.8.12 → lambda_erp-0.8.13}/frontend/src/api/client.ts

@@ -284,6 +284,12 @@ export const api = {
       body: JSON.stringify(data),
     }),
 
+  runAction: (action: string, data: Record<string, any>) =>
+    request<any>(`/actions/${encodeURIComponent(action)}`, {
+      method: "POST",
+      body: JSON.stringify(data),
+    }),
+
   deleteMaster: (type: string, name: string) =>
     request<any>(`/masters/${type}/${encodeURIComponent(name)}`, { method: "DELETE" }),
 

{lambda_erp-0.8.12 → lambda_erp-0.8.13}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lambda-erp"
-version = "0.8.12"
+version = "0.8.13"
 description = "Core ERP logic - accounting, sales, purchasing, inventory"
 readme = "README.md"
 license = "Apache-2.0"