lambda-erp 1.1.0__tar.gz → 1.1.2__tar.gz

{lambda_erp-1.1.0 → lambda_erp-1.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lambda-erp
-Version: 1.1.0
+Version: 1.1.2
 Summary: Core ERP logic - accounting, sales, purchasing, inventory
 Author: TORUS INVESTMENTS AG
 License-Expression: Apache-2.0

{lambda_erp-1.1.0 → lambda_erp-1.1.2}/api/chat.py

@@ -28,6 +28,7 @@ from openai import OpenAI
 
 from api.time_filters import TIME_FILTER_SCHEMA, time_filter_fields
 from api import services
+from api.chat_links import with_record_view_urls
 from api.tool_permissions import tool_allowed, tool_permission_error
 from api.demo_limits import (
     demo_call_reserve_usd,
@@ -37,7 +38,8 @@ from api.demo_limits import (
     limiter as demo_limiter,
 )
 from api.providers import cost_of_openai_call, cost_of_transcription
-from api.routers.masters import create_master_record, update_master_record, delete_master_record, MASTER_IDENTITY_ALIAS
+from api.routers.masters import create_master_record, update_master_record, delete_master_record
+from api.routers.analytics import DATASET_FILTER_DESCRIPTION
 from lambda_erp.database import get_db
 from lambda_erp.utils import flt, now, nowdate
 
@@ -682,17 +684,17 @@ TOOLS = [
                     },
                     "filters": {
                         "type": "object",
-                        "description": "Optional deterministic filters on any real column, ANDed together and with `query`. Scalar values are exact: {\"disabled\": 0}. Text substring: {\"legal_form\": [\"contains\", \"AG\"]}. Comparisons and NULL checks use the same forms as list_documents. `contains` is only valid for schema-confirmed text fields.",
+                        "description": "Optional deterministic filters on any real column or registered alias (item_code = name), ANDed together and with `query`. Scalar values are exact: {\"disabled\": 0}. Text substring: {\"legal_form\": [\"contains\", \"AG\"]}. Comparisons and NULL checks use the same forms as list_documents. `contains` is only valid for schema-confirmed text fields.",
                         "default": {},
                     },
-                    "order_by": {"type": "string", "description": "Optional real column to sort by. Defaults to the time_filter field when supplied, otherwise name."},
+                    "order_by": {"type": "string", "description": "Optional real column or registered alias (item_code = name) to sort by. Defaults to the time_filter field when supplied, otherwise name."},
                     "order": {"type": "string", "enum": ["asc", "desc"], "description": "Sort direction (default asc).", "default": "asc"},
                     "limit": {"type": "integer", "description": "Maximum results. With time_filter/include_meta: default 50, range 1–500. Legacy simple lookups have no cap when omitted."},
                     "offset": {"type": "integer", "description": "Skip this many matching rows. Use with limit for pagination.", "default": 0},
                     "result_fields": {
                         "type": "array",
                         "items": {"type": "string"},
-                        "description": "Optional result projection. Returns only these real columns plus name. This is separate from `fields`, which selects columns searched by `query`.",
+                        "description": "Optional result projection. Returns requested columns plus name. Registered aliases are accepted: item_code resolves to name and is also returned as item_code when requested. This is separate from `fields`, which selects columns searched by `query`.",
                     },
                     "include_disabled": {"type": "boolean", "description": "Default false (active records only). Set true to ALSO return disabled/archived records — needed to find a record you must inspect, re-enable, or reference, or to answer 'what's disabled'. Retry with this if a lookup for a record you know exists comes back empty."},
                 },
@@ -704,7 +706,7 @@ TOOLS = [
         "type": "function",
         "function": {
             "name": "get_master_fields",
-            "description": "List the available columns of a master type (customer, supplier, item, ...). Call this WHENEVER you're unsure which columns exist: before passing `fields` or `filters` to search_masters, and before building a create/update payload. Returns all fields, text fields (the columns that support `contains`), default free-text search fields, and bulk text fields that are searched only when explicitly named.",
+            "description": "List the available columns of a master type (customer, supplier, item, ...). Call this WHENEVER you're unsure which columns exist: before passing `fields`, `filters`, `result_fields` or `order_by` to search_masters, and before building a create/update payload. Returns real fields, field_aliases (e.g. item_code maps to name), text fields (the columns that support `contains`), default free-text search fields, and bulk text fields that are searched only when explicitly named.",
             "parameters": {
                 "type": "object",
                 "properties": {
@@ -719,11 +721,11 @@ TOOLS = [
         "function": {
             "name": "create_master",
             "description": (
-                "Create a new master record. You MUST include the full `data` object using the EXACT field names listed below — unknown fields are silently dropped.\n\n"
-                "Every record's id is `name`. Customer/Supplier/Item/Warehouse auto-generate it (CUST-/SUPP-/ITEM-/WH-NNN) when omitted; Company/Account/Cost Center have NO auto-id, so `name` is required for them.\n\n"
-                "**Customer fields:** name (optional custom id; auto CUST-NNN), customer_name (required), customer_group, territory, default_currency, credit_limit, email, phone, address, city, zip_code, country, tax_id, contact_person (named contact at the customer), contact_email, contact_phone.\n"
+                "Create a new master record. You MUST include the full `data` object using the EXACT field names listed below — unknown fields are rejected. Call get_master_fields for the live schema, including extension fields.\n\n"
+                "Every record's id is `name`. Customer/Supplier/Item/Warehouse auto-generate it (CUST-/SUPP-/ITEM-/WH-NNN) when omitted; Company defaults it to company_name. Account/Cost Center require an explicit `name`.\n\n"
+                "**Customer fields:** name (optional custom id; auto CUST-NNN), customer_name (required), customer_group, territory, default_currency, credit_limit, website, email, phone, address, city, zip_code, country, tax_id, contact_person (named contact at the customer), contact_email, contact_phone.\n"
                 "**Supplier fields:** name (optional custom id; auto SUPP-NNN), supplier_name (required), supplier_group, default_currency, email, phone, address, city, zip_code, country, tax_id.\n"
-                "**Item fields:** item_code (the unique item code/id, e.g. \"SVC-SPARK\" — optional, may use ANY prefix, not just ITEM; auto-generated as ITEM-NNN if omitted), item_name (required, the human-readable name), item_group, stock_uom (prefer one of the units listed under 'Item Units' in the system context — exact spelling; a new unit is allowed when none fits), standard_rate, is_stock_item, default_warehouse, description.\n"
+                "**Item fields:** name (the unique item code/id, e.g. \"SVC-SPARK\" — optional, may use ANY prefix, not just ITEM; auto-generated as ITEM-NNN if omitted), item_name (required, the human-readable name), item_group, stock_uom (prefer one of the units listed under 'Item Units' in the system context — exact spelling; a new unit is allowed when none fits), standard_rate, is_stock_item, default_warehouse, description.\n"
                 "**Warehouse fields:** name (optional custom id; auto WH-NNN), warehouse_name (required), company, parent_warehouse (omit or null when not needed), address, city, zip_code, country.\n"
                 "**Company fields:** name (the company id — optional, defaults to company_name), company_name (required), default_currency, email, phone, address, city, zip_code, country, tax_id.\n"
                 "**Account fields:** name (REQUIRED — full account id, conventionally \"<account_name> - <company abbr>\", e.g. \"Marketing Expenses - LAMB\"), account_name (required), company (required), root_type (Asset/Liability/Equity/Income/Expense), report_type (\"Balance Sheet\" or \"Profit and Loss\"), account_type (e.g. Receivable, Payable, Bank, Cash, Stock, Tax), parent_account, account_currency, is_group (0/1).\n"
@@ -731,7 +733,7 @@ TOOLS = [
                 "zip_code is free text (e.g. \"8400\", \"ZH 8400\", \"59123\"), never numeric.\n"
                 "When the user names a contact person at a customer (e.g. \"Kontakt/Ansprechpartner ist Marlene Voss, 079 123 45 67\"), put the person's name in contact_person and their phone/email in contact_phone/contact_email — NOT in the company-level phone/email. There is no separate contact tool; contact-person data lives on these Customer columns, so never claim you cannot store a contact person.\n"
                 "Supplier example: {\"master_type\":\"supplier\",\"data\":{\"supplier_name\":\"Schlafteq\",\"email\":\"jacob@schlafteq.ch\",\"phone\":\"+1 555-0104\",\"address\":\"145 Harbor Rd\",\"city\":\"Seattle\",\"zip_code\":\"98101\",\"country\":\"US\",\"tax_id\":\"98-7654321\"}}\n"
-                "Item example (custom code): {\"master_type\":\"item\",\"data\":{\"item_code\":\"SVC-SPARK\",\"item_name\":\"Spark\",\"item_group\":\"Services\",\"is_stock_item\":0,\"standard_rate\":310}}\n"
+                "Item example (custom code): {\"master_type\":\"item\",\"data\":{\"name\":\"SVC-SPARK\",\"item_name\":\"Spark\",\"item_group\":\"Services\",\"is_stock_item\":0,\"standard_rate\":310}}\n"
                 "Customer example (with contact person): {\"master_type\":\"customer\",\"data\":{\"customer_name\":\"Foglio AG\",\"address\":\"Seeweg 12\",\"city\":\"Bramblewick\",\"zip_code\":\"9999\",\"contact_person\":\"Marlene Voss\",\"contact_phone\":\"079 123 45 67\"}}"
             ),
             "parameters": {
@@ -749,7 +751,7 @@ TOOLS = [
         "function": {
             "name": "update_master",
             "description": (
-                "Update an existing master record. You MUST include the `name` of the existing record and a `data` object with the fields to change. Use the same field names listed in create_master (customer: customer_name, email, phone, address, city, zip_code, country, tax_id, contact_person, contact_email, contact_phone, etc.). Example: {\"master_type\":\"customer\",\"name\":\"CUST-001\",\"data\":{\"address\":\"123 New Street\",\"city\":\"Boston\",\"zip_code\":\"02110\"}}"
+                "Update an existing master record. You MUST include the `name` of the existing record and a `data` object with the fields to change. Use the same field names listed in create_master (customer: customer_name, website, email, phone, address, city, zip_code, country, tax_id, contact_person, contact_email, contact_phone, etc.). Example: {\"master_type\":\"customer\",\"name\":\"CUST-001\",\"data\":{\"address\":\"123 New Street\",\"city\":\"Boston\",\"zip_code\":\"02110\"}}"
             ),
             "parameters": {
                 "type": "object",
@@ -1022,8 +1024,9 @@ TOOLS = [
                 "`measures` is an object of `{alias: [op, field]}` where `op` "
                 "is one of sum, count, avg, min, max (count may omit field). "
                 "`filters` is a dict keyed by field name — same shape as for "
-                "`create_custom_analytics_report` (equality, list for IN, "
-                "`{from, to}` for ranges). `order_by` is a list of "
+                "`create_custom_analytics_report` (equality, [\"in\", [values]] or a flat list for IN, "
+                "[\"not in\", [values]], `{from, to}` for ranges). Invalid filter shapes "
+                "are errors, not evidence of zero stock or activity. `order_by` is a list of "
                 "`{field, direction}` where `field` is a group_by field or a "
                 "measure alias and `direction` is asc/desc.\n\n"
                 "Example — top 5 customers by revenue:\n"
@@ -1069,7 +1072,7 @@ TOOLS = [
                         "type": "object",
                         "description": "Map of alias -> [op, field]. op ∈ sum|count|avg|min|max.",
                     },
-                    "filters": {"type": "object"},
+                    "filters": {"type": "object", "description": DATASET_FILTER_DESCRIPTION},
                     "order_by": {
                         "type": "array",
                         "items": {
@@ -1146,7 +1149,7 @@ TOOLS = [
                                     ],
                                 },
                                 "fields": {"type": "array", "items": {"type": "string"}},
-                                "filters": {"type": "object"},
+                                "filters": {"type": "object", "description": DATASET_FILTER_DESCRIPTION},
                                 "limit": {"type": "integer"},
                             },
                             "required": ["dataset"],
@@ -1232,7 +1235,7 @@ TOOLS = [
                                     ],
                                 },
                                 "fields": {"type": "array", "items": {"type": "string"}},
-                                "filters": {"type": "object"},
+                                "filters": {"type": "object", "description": DATASET_FILTER_DESCRIPTION},
                                 "limit": {"type": "integer"},
                             },
                             "required": ["dataset"],
@@ -1459,6 +1462,7 @@ def _validate_filter_columns(doctype_slug, filters) -> str | None:
     return None
 
 
+@with_record_view_urls("doctype")
 def _handle_list_documents(args):
     doctype = args["doctype"]
     try:
@@ -1497,10 +1501,12 @@ def _handle_get_document_fields(args):
     return services.document_field_metadata(args["doctype"])
 
 
+@with_record_view_urls("doctype")
 def _handle_get_document(args):
     return services.load_document(args["doctype"], args["name"])
 
 
+@with_record_view_urls("doctype")
 def _handle_create_document(args):
     data = args.get("data")
     if not data:
@@ -1508,10 +1514,12 @@ def _handle_create_document(args):
     return services.create_document(args["doctype"], data)
 
 
+@with_record_view_urls("doctype")
 def _handle_update_document(args):
     return services.update_document(args["doctype"], args["name"], args.get("data", {}))
 
 
+@with_record_view_urls("doctype")
 def _handle_batch_update_documents(args):
     try:
         return services.batch_update_documents(args["doctype"], args.get("updates"))
@@ -1519,18 +1527,22 @@ def _handle_batch_update_documents(args):
         return {"error": str(e)}
 
 
+@with_record_view_urls("doctype")
 def _handle_submit_document(args):
     return services.submit_document(args["doctype"], args["name"])
 
 
+@with_record_view_urls("doctype")
 def _handle_cancel_document(args):
     return services.cancel_document(args["doctype"], args["name"])
 
 
+@with_record_view_urls("doctype")
 def _handle_discard_document(args):
     return services.discard_document(args["doctype"], args["name"])
 
 
+@with_record_view_urls("target_doctype")
 def _handle_convert_document(args):
     return services.convert_document(args["doctype"], args["name"], args["target_doctype"])
 
@@ -1593,6 +1605,7 @@ def _handle_get_master_fields(args):
     cls = services.DOCUMENT_CLASSES.get(doctype)
     return {
         "master_type": master_type,
+        "field_aliases": services.master_field_aliases(master_type),
         "time_filter_fields": time_filter_fields(db, doctype),
         "fields": sorted(db._get_table_columns(doctype)),
         "text_fields": sorted(db._get_text_columns(doctype)),
@@ -1603,10 +1616,11 @@ def _handle_get_master_fields(args):
         "requirements": master_requirements(master_type),
         "link_fields": dict(cls.LINK_FIELDS) if cls else MASTER_LINK_FIELDS.get(master_type, {}),
         "dynamic_link_fields": dict(cls.DYNAMIC_LINK_FIELDS) if cls else {},
-        "input_fields": sorted(set(cls.INPUT_FIELDS if cls else ()) | ({services.MASTER_IDENTITY_ALIAS[master_type]} if master_type in services.MASTER_IDENTITY_ALIAS else set())),
+        "input_fields": sorted(set(cls.INPUT_FIELDS if cls else ()) | set(services.master_field_aliases(master_type))),
     }
 
 
+@with_record_view_urls("master_type", master=True)
 def _handle_search_masters(args):
     db = get_db()
     meta = bool(args.get("include_meta")) or args.get("time_filter") is not None
@@ -1650,18 +1664,13 @@ def _handle_search_masters(args):
     requested = args.get("fields") or []
     if requested:
         valid = columns
-        # The identity alias (e.g. "item_code") is what the model calls the code
-        # everywhere else — create_master, document lines, the asset/reservation
-        # prompt — so it naturally passes fields=["item_code"]. But the real
-        # column is the `name` PK; resolve the alias to `name` so that lookup
-        # works instead of erroring "None of fields ['item_code'] exist".
-        alias = MASTER_IDENTITY_ALIAS.get(master_type)
+        aliases = services.master_field_aliases(master_type)
         search_cols = []
         for c in requested:
             if c in valid:
                 search_cols.append(c)
-            elif alias and c == alias and "name" in valid:
-                search_cols.append("name")
+            elif c in aliases:
+                search_cols.append(aliases[c])
         search_cols = sorted(set(search_cols))
         # Nothing resolved (all names unknown) — degrade to the default text
         # search rather than erroring: the value the caller meant is almost
@@ -1708,22 +1717,7 @@ def _handle_search_masters(args):
     return _fuzzy_master_search(db, doctype, search_cols, query, filter_disabled, limit=limit)
 
 
-def _ignored_master_fields(master_type: str, data: dict) -> list[str]:
-    """Return field names in `data` that aren't valid columns on the master's table."""
-    entry = services.MASTER_TABLES.get(master_type)
-    if not entry:
-        return []
-    doctype, _ = entry
-    from lambda_erp.database import get_db
-    valid = set(get_db()._get_table_columns(doctype))
-    # item_code is a recognized alias for the Item's `name` PK, not an unknown
-    # field — don't warn that it was ignored when it was actually honored.
-    alias = MASTER_IDENTITY_ALIAS.get(master_type)
-    if alias:
-        valid.add(alias)
-    return [k for k in data.keys() if k not in valid]
-
-
+@with_record_view_urls("master_type", master=True)
 def _handle_create_master(args):
     master_type = args["master_type"]
     data = args.get("data")
@@ -1733,23 +1727,16 @@ def _handle_create_master(args):
     if master_type == "warehouse" and data.get("parent_warehouse") in ("", "-", "none", "None", None):
         data = {k: v for k, v in data.items() if k != "parent_warehouse"}
 
-    ignored = _ignored_master_fields(master_type, data)
-
     try:
         result = dict(create_master_record(master_type, data))
     except Exception as exc:
         detail = getattr(exc, "detail", None)
         return {"error": detail or str(exc)}
 
-    if ignored:
-        result["_warning"] = (
-            f"These fields were IGNORED because they are not valid columns on the {master_type}: "
-            f"{ignored}. Call get_master_fields(master_type=\"{master_type}\") to see the real columns, "
-            f"then retry mapping those values onto valid field names."
-        )
     return result
 
 
+@with_record_view_urls("master_type", master=True)
 def _handle_update_master(args):
     master_type = args["master_type"]
     name = args.get("name")
@@ -1762,19 +1749,12 @@ def _handle_update_master(args):
     if master_type == "warehouse" and data.get("parent_warehouse") in ("", "-", "none", "None", None):
         data = {k: v for k, v in data.items() if k != "parent_warehouse"}
 
-    ignored = _ignored_master_fields(master_type, data)
-
     try:
         result = dict(update_master_record(master_type, name, data))
     except Exception as exc:
         detail = getattr(exc, "detail", None)
         return {"error": detail or str(exc)}
 
-    if ignored:
-        result["_warning"] = (
-            f"These fields were IGNORED because they are not valid columns on the {master_type}: "
-            f"{ignored}. Retry the call using the correct field names."
-        )
     return result
 
 
@@ -2130,7 +2110,7 @@ def _handle_query_dataset(args):
             dataset=dataset,
             group_by=args.get("group_by") or [],
             measures=measures,
-            filters=args.get("filters") or {},
+            filters=args.get("filters"),
             order_by=args.get("order_by") or [],
             limit=args.get("limit"),
         )
@@ -2464,18 +2444,11 @@ Examples:
 - Correct: `[SINV-0012](/app/sales-invoice/SINV-0012)`
 - Avoid:   `/reports/analytics?report_id=RPT-AB12CD34` (bare URL)"""
         document_links_section = """## Document & Master Links
-When referencing records, always use clickable markdown links so the user can open them directly.
-
-**Documents** (quotations, invoices, orders, deliveries, receipts, payments, journal entries, stock entries):
-- **View/edit link:** `/app/{doctype-slug}/{name}` — e.g. [SINV-0001](/app/sales-invoice/SINV-0001)
-- **PDF files:** call generate_document_pdf. Only link the returned download_url after successful generation; never construct PDF links yourself.
-The doctype slug is the lowercase, hyphenated form: sales-invoice, purchase-order, delivery-note, etc.
-
-**Master records** (customer, supplier, item, warehouse, company):
-- **View/edit link:** `/masters/{master-type}/{name}` — e.g. [SUPP-001](/masters/supplier/SUPP-001), [CUST-003](/masters/customer/CUST-003), [ITEM-001](/masters/item/ITEM-001)
-- NEVER use `/app/...` for masters — that path is only for transactional documents.
-
-Always include the view link after creating, submitting, converting, or updating a record. Call generate_document_pdf when a printable file is requested. Only confirm and link a successfully generated file."""
+Document and master tools return a canonical `view_url` on each record, including list/search rows and successful batch results. When linking a record, copy that exact value into a markdown link `[label](view_url)`. Never construct a record URL yourself, add a `#`, change the path, or re-encode the returned URL.
+`view_url` is tool output metadata, not a document/master field; never include it in create/update data.
+If `view_url` is null, refer to the record in plain text. For a projected document list or batch result missing parent-page information, call get_document to obtain its view_url if a link is needed. Some records have no page at all.
+Always include the returned view link, when available, after creating, submitting, converting, or updating a record.
+For PDF files, call generate_document_pdf and copy its returned download_url only after successful generation. Never construct PDF links yourself."""
 
     if user_role == "admin":
         role_desc = "You have **admin** access — full permissions to create, edit, submit, cancel documents, manage master data, run reports, and manage users."
@@ -2832,8 +2805,8 @@ When creating a payment-entry, the `data` object MUST include:
 
 ## Master keys vs display names — CRITICAL
 
-Every master record has a primary key (the `name` column) and a human-readable display field:
-- **Item:** key = `item_code` (e.g. `SVC-005`), display = `item_name` (e.g. "Project Management")
+Every master record has a primary key (the `name` column) and a human-readable display field. `get_master_fields` lists real columns separately from `field_aliases`. Prefer canonical `name` in new master calls and result projections; aliases remain for compatibility. Registered aliases work in master search fields, filters, sorting and result projection; requesting an alias returns it alongside `name`. Unknown result fields are errors:
+- **Item:** stored key = `name` (e.g. `SVC-005`); `item_code` is its registered alias and the item-reference field on document lines; display = `item_name` (e.g. "Project Management")
 - **Customer:** key = `name` (e.g. `CUST-007`), display = `customer_name` (e.g. "Redstone Automotive")
 - **Supplier:** key = `name` (e.g. `SUPP-003`), display = `supplier_name`
 - **Warehouse / Company / Account / Cost Center:** key = `name`{extension_master_keys}

lambda_erp-1.1.2/api/chat_links.py

@@ -0,0 +1,59 @@
+"""Canonical record links on chat/MCP tool results, never persisted fields."""
+
+from functools import wraps
+from urllib.parse import quote, urlencode
+
+from api import services
+
+
+def record_view_url(record_type: str, record: dict, *, master: bool = False) -> str | None:
+    name = record.get("name")
+    if not name:
+        return None
+    if master:
+        if record_type not in services.MASTER_TABLES or record_type == "cost-center":
+            return None
+        if record_type == "account":
+            return "/reports/general-ledger?" + urlencode({"account": name})
+        return f"/masters/{quote(record_type, safe='')}/{quote(str(name), safe='')}"
+
+    slug = services.DOCTYPE_TO_SLUG.get(record_type, record_type)
+    if slug not in services.SLUG_TO_DOCTYPE:
+        return None
+    page = services.chat_doctype_page_info(slug)
+    if page:
+        if page["kind"] == "none":
+            return None
+        if page["kind"] == "via":
+            name = record.get(page["link_field"])
+            if not name:
+                # Projected list/batch results may omit the parent. The model
+                # can get_document to obtain it; do not guess a destination.
+                return None
+            slug = page["parent_slug"]
+    return f"/app/{quote(slug, safe='')}/{quote(str(name), safe='')}"
+
+
+def with_record_view_urls(type_arg: str, *, master: bool = False):
+    """Enrich records and list/batch envelopes without changing service data."""
+    def decorate(handler):
+        @wraps(handler)
+        def wrapped(args):
+            result = handler(args)
+
+            def enrich(row):
+                if not isinstance(row, dict) or "error" in row or row.get("ok") is False:
+                    return row
+                return {**row, "view_url": record_view_url(args.get(type_arg), row, master=master)}
+
+            if isinstance(result, list):
+                return [enrich(row) for row in result]
+            if isinstance(result, dict) and "error" not in result:
+                if "name" not in result:
+                    for key in ("rows", "results"):
+                        if isinstance(result.get(key), list):
+                            return {**result, key: [enrich(row) for row in result[key]]}
+                return enrich(result)
+            return result
+        return wrapped
+    return decorate

{lambda_erp-1.1.0 → lambda_erp-1.1.2}/api/routers/analytics.py

@@ -9,7 +9,9 @@ This module now exposes two layers:
 """
 
 import json
+import math
 import uuid
+from datetime import date
 from typing import Any, Literal
 
 from fastapi import APIRouter, Depends, HTTPException, Query
@@ -308,11 +310,25 @@ def analytics(
 # ---------------------------------------------------------------------------
 
 
+DATASET_FILTER_DESCRIPTION = (
+    'Filters keyed by allowed dataset field. Scalar = equality. For membership prefer '
+    '{"item_code": ["in", ["ART-1", "ART-2"]]}; ["not in", [values]] is also supported. '
+    'Legacy flat lists remain literal IN lists (even values named "in"). '
+    'Lists contain at most 500 non-null scalar values; deeper nesting and other '
+    'operator forms are rejected. Empty IN lists match nothing; empty NOT IN lists '
+    'exclude nothing. Ranges use {"from": value, "to": value}, with either bound '
+    'optional; date fields require real YYYY-MM-DD dates and from <= to. '
+    'No other range keys are accepted. Omit unused filters; null/empty-string '
+    'filters and blank from/to bounds are ignored. Invalid filters return errors, '
+    'not zero counts; correct the request before making a factual claim.'
+)
+
+
 class RuntimeDataRequest(BaseModel):
     name: str | None = Field(default=None, pattern=r"^[A-Za-z_][A-Za-z0-9_]{0,63}$")
     dataset: str
     fields: list[str] | None = Field(default=None, max_length=64)
-    filters: dict[str, Any] = Field(default_factory=dict, max_length=32)
+    filters: dict[str, Any] = Field(default_factory=dict, max_length=32, description=DATASET_FILTER_DESCRIPTION)
     limit: int | None = None
 
 
@@ -438,6 +454,10 @@ class ReportDraftPayload(StrictReportModel):
                 raise ValueError(
                     f"Unknown fields for dataset '{request.dataset}': {', '.join(sorted(unknown))}"
                 )
+            try:
+                _build_dataset_filter_clauses(dataset, request.filters, [])
+            except HTTPException as exc:
+                raise ValueError(str(exc.detail)) from exc
             request_fields[source] = fields
 
         source_fields = dict(request_fields)
@@ -937,30 +957,80 @@ SEMANTIC_DATASETS: dict[str, dict[str, Any]] = {
 
 
 def _build_dataset_filter_clauses(spec: dict[str, Any], filters: dict[str, Any], params: list[Any]) -> list[str]:
+    if filters is None:
+        filters = {}
+    if not isinstance(filters, dict):
+        raise HTTPException(400, "Dataset filters must be an object keyed by field name")
     clauses = list(spec.get("default_where", []))
-    for field, value in (filters or {}).items():
+    for field, value in filters.items():
         if field not in spec["filter_fields"]:
             raise HTTPException(400, f"Dataset '{spec['label']}' does not allow filtering on '{field}'")
         column = spec["field_sql"][field]
+
+        def invalid(reason):
+            raise HTTPException(400, f"Invalid filter for '{field}': {reason}")
+
+        def scalar(value):
+            if not isinstance(value, (str, int, float, bool)) or (
+                isinstance(value, float) and not math.isfinite(value)
+            ):
+                invalid("expected a non-null scalar value, not an object or nested list")
+            if spec["fields"][field] == "date":
+                try:
+                    if not isinstance(value, str) or date.fromisoformat(value).isoformat() != value:
+                        raise ValueError()
+                except ValueError:
+                    invalid("expected a valid ISO date (YYYY-MM-DD)")
+            return value
+
         if value is None or value == "":
             continue
         if isinstance(value, dict):
-            if "from" in value and value["from"] not in (None, ""):
+            if not value or set(value) - {"from", "to"}:
+                invalid("range objects may contain only 'from' and 'to'")
+            lower = value.get("from")
+            upper = value.get("to")
+            has_lower, has_upper = lower not in (None, ""), upper not in (None, "")
+            if has_lower:
+                scalar(lower)
+            if has_upper:
+                scalar(upper)
+            if has_lower and has_upper:
+                try:
+                    if lower > upper:
+                        invalid("range 'from' must not be after 'to'")
+                except TypeError:
+                    invalid("range bounds must have comparable types")
+            if has_lower:
                 clauses.append(f"{column} >= ?")
-                params.append(value["from"])
-            if "to" in value and value["to"] not in (None, ""):
+                params.append(lower)
+            if has_upper:
                 clauses.append(f"{column} <= ?")
-                params.append(value["to"])
+                params.append(upper)
             continue
         if isinstance(value, list):
+            # Flat lists are the existing literal-IN contract, even if a code
+            # happens to be named 'in'. Only a nested list identifies the
+            # explicit [operator, values] form used by other ERP tools.
+            op = "IN"
+            if any(isinstance(part, (list, dict)) for part in value):
+                if (len(value) != 2 or not isinstance(value[0], str)
+                        or value[0].lower() not in {"in", "not in"}
+                        or not isinstance(value[1], list)):
+                    invalid('use a flat value list or ["in", [values]] / ["not in", [values]]')
+                op, value = value[0].upper(), value[1]
+            if len(value) > 500:
+                invalid("membership lists may contain at most 500 values")
+            values = [scalar(part) for part in value]
             if not value:
+                clauses.append("1=0" if op == "IN" else "1=1")
                 continue
-            placeholders = ", ".join("?" for _ in value)
-            clauses.append(f"{column} IN ({placeholders})")
-            params.extend(value)
+            placeholders = ", ".join("?" for _ in values)
+            clauses.append(f"{column} {op} ({placeholders})")
+            params.extend(values)
             continue
         clauses.append(f"{column} = ?")
-        params.append(value)
+        params.append(scalar(value))
     return clauses
 
 
@@ -1067,7 +1137,7 @@ def aggregate_semantic_dataset(
         select_parts.append(f'{op.upper()}({spec["field_sql"][field]}) AS "{sql_name}"')
 
     params: list[Any] = []
-    where = _build_dataset_filter_clauses(spec, filters or {}, params)
+    where = _build_dataset_filter_clauses(spec, filters, params)
 
     order_clauses: list[str] = []
     for entry in order_by or []:

{lambda_erp-1.1.0 → lambda_erp-1.1.2}/api/routers/masters.py

@@ -14,7 +14,7 @@ from api.services import (
     MASTER_IDENTITY_ALIAS,
     MASTER_REFERENCE_CHECKS,
     _filter_atom, _search_clause, _where_from_filters,
-    list_master_records, master_search_columns, parse_list_filter,
+    list_master_records, master_search_columns, parse_list_filter, master_field_aliases,
 )
 from api.auth import require_role, require_non_public_manager
 from api.list_values import distinct_list_values
@@ -31,9 +31,10 @@ _admin = Depends(require_role("admin"))
 
 def _echo_identity_alias(master_type: str, row):
     """Mirror the master's `name` back under its intuitive alias (item_code)."""
-    alias = MASTER_IDENTITY_ALIAS.get(master_type)
-    if alias and isinstance(row, dict) and row.get("name") is not None:
-        row[alias] = row["name"]
+    if isinstance(row, dict):
+        for alias, column in master_field_aliases(master_type).items():
+            if row.get(column) is not None:
+                row[alias] = row[column]
     return row
 
 DELETE_REFERENCE_CHECKS = {
@@ -313,11 +314,11 @@ def _create_master_record(master_type: str, data: dict) -> dict:
     doc.pop("modified", None)
 
     # Let callers set the code under its intuitive alias (item_code -> name).
-    # An explicit `name` still wins; the alias key is consumed either way so it
-    # isn't reported as an ignored field.
-    alias = MASTER_IDENTITY_ALIAS.get(master_type)
-    if alias:
+    # Conflicting identities must never silently select one of the records.
+    for alias in master_field_aliases(master_type):
         alias_val = doc.pop(alias, None)
+        if alias_val and doc.get("name") and alias_val != doc["name"]:
+            raise ValidationError(f"Conflicting name and {alias}; both must identify the same {master_type}")
         if alias_val and not doc.get("name"):
             doc["name"] = alias_val
 
@@ -386,9 +387,8 @@ def _update_master_record(master_type: str, name: str, data: dict) -> dict:
     # The alias (item_code) is the identity, not a mutable column. Allow it as a
     # no-op when it matches the record being updated, but reject a rename — the
     # code is a primary key referenced across every transaction.
-    alias = MASTER_IDENTITY_ALIAS.get(master_type)
-    if alias and alias in normalized:
-        alias_val = normalized.pop(alias)
+    for alias in master_field_aliases(master_type):
+        alias_val = normalized.pop(alias, None)
         if alias_val and alias_val != name:
             raise HTTPException(
                 status_code=422,
@@ -454,24 +454,15 @@ def _master_list_where(db, doctype: str, master_type: str, request: Request,
         where_parts += wp
         params += ps
 
-    for key, value in request.query_params.items():
-        if key in _MASTER_LIST_RESERVED:
-            continue
-        try:
-            field, parsed_value = parse_list_filter(db, doctype, key, value)
-        except KeyError:
-            raise HTTPException(status_code=400, detail=f"Unknown filter field: {key}")
-        except TypeError:
-            raise HTTPException(
-                status_code=400,
-                detail=f"Contains filter is only supported for text fields: {key}",
-            )
+    for field, parsed_value in _master_request_filters(db, doctype, request, master_type).items():
         clause, clause_params = _filter_atom(field, parsed_value)
         where_parts.append(clause)
         params.extend(clause_params)
 
     if search:
         requested = [f.strip() for f in (search_fields or "").split(",") if f.strip()]
+        aliases = master_field_aliases(master_type)
+        requested = list(dict.fromkeys(aliases.get(f, f) for f in requested))
         unknown = [f for f in requested if f not in columns]
         if unknown:
             raise HTTPException(status_code=400, detail=f"Unknown search field(s): {', '.join(unknown)}")
@@ -484,7 +475,7 @@ def _master_list_where(db, doctype: str, master_type: str, request: Request,
     try:
         window = resolve_time_filter(db, doctype, request_time_filter(request))
         if window:
-            if window["field"] in _master_request_filters(db, doctype, request):
+            if window["field"] in _master_request_filters(db, doctype, request, master_type):
                 raise ValueError("Do not combine time_filter with a filter on the same timestamp field")
             clause, bounds = time_predicate(window)
             where_parts.append(clause)
@@ -494,14 +485,17 @@ def _master_list_where(db, doctype: str, master_type: str, request: Request,
     return where_parts, params, columns
 
 
-def _master_request_filters(db, doctype: str, request: Request) -> dict:
+def _master_request_filters(db, doctype: str, request: Request, master_type: str) -> dict:
     """Parse the REST query-string field filters into the shared internal form."""
     filters = {}
+    aliases = master_field_aliases(master_type)
     for key, value in request.query_params.items():
         if key in _MASTER_LIST_RESERVED:
             continue
         try:
-            field, parsed_value = parse_list_filter(db, doctype, key, value)
+            suffix = "__contains" if key.endswith("__contains") else ""
+            base = key[:-len(suffix)] if suffix else key
+            field, parsed_value = parse_list_filter(db, doctype, aliases.get(base, base) + suffix, value)
         except KeyError:
             raise HTTPException(status_code=400, detail=f"Unknown filter field: {key}")
         except TypeError:
@@ -509,6 +503,8 @@ def _master_request_filters(db, doctype: str, request: Request) -> dict:
                 status_code=400,
                 detail=f"Contains filter is only supported for text fields: {key}",
             )
+        if field in filters and filters[field] != parsed_value:
+            raise HTTPException(status_code=400, detail=f"Conflicting filters for {field} and its alias")
         filters[field] = parsed_value
     return filters
 
@@ -552,7 +548,7 @@ def master_filter_values(
         raise HTTPException(status_code=404, detail=f"Unknown master type: {master_type}")
     db = get_db()
     try:
-        values = distinct_list_values(db, doctype, field, q, limit)
+        values = distinct_list_values(db, doctype, master_field_aliases(master_type).get(field, field), q, limit)
     except KeyError:
         raise HTTPException(status_code=400, detail=f"Unknown field: {field}")
     return {"values": values}
@@ -577,7 +573,7 @@ def list_masters(
     if not doctype:
         return {"detail": f"Unknown master type: {master_type}"}
     db = get_db()
-    field_filters = _master_request_filters(db, doctype, request)
+    field_filters = _master_request_filters(db, doctype, request, master_type)
     requested_search_fields = [
         field.strip() for field in (search_fields or "").split(",") if field.strip()
     ]
@@ -647,6 +643,7 @@ def adjacent_master(
         db, doctype, master_type, request, include_disabled, search, search_fields,
     )
     window = resolve_time_filter(db, doctype, request_time_filter(request))
+    order_by = master_field_aliases(master_type).get(order_by, order_by)
     sort_column, sort_direction = _master_order(columns, order_by or (window["field"] if window else None), order)
     sort_expression = f'"{sort_column}"'
     if window and sort_column == window["field"]:

{lambda_erp-1.1.0 → lambda_erp-1.1.2}/api/services.py

@@ -1066,6 +1066,27 @@ def _master_sort_sql(column: str, direction: str) -> str:
     return sql
 
 
+def master_field_aliases(master_type: str) -> dict[str, str]:
+    """Registered virtual fields only; a real column always keeps its meaning."""
+    entry = MASTER_TABLES.get(master_type)
+    if not entry:
+        return {}
+    columns = get_db()._get_table_columns(entry[0])
+    alias = MASTER_IDENTITY_ALIAS.get(master_type)
+    return {alias: "name"} if alias and alias not in columns and "name" in columns else {}
+
+
+def resolve_master_filters(master_type: str, filters: dict) -> dict:
+    aliases = master_field_aliases(master_type)
+    resolved = {}
+    for key, value in filters.items():
+        column = aliases.get(key, key)
+        if column in resolved and resolved[column] != value:
+            raise ValueError(f"Conflicting filters for {column} and its alias")
+        resolved[column] = value
+    return resolved
+
+
 def list_master_records(
     master_type: str,
     *,
@@ -1095,11 +1116,12 @@ def list_master_records(
     window = resolve_time_filter(db, doctype, time_filter)
     columns = db._get_table_columns(doctype)
     text_fields = sorted(db._get_text_columns(doctype))
+    aliases = master_field_aliases(master_type)
 
-    db_filters = {
+    db_filters = resolve_master_filters(master_type, {
         key: value for key, value in (filters or {}).items()
         if value is not None and value != ""
-    }
+    })
     unknown_filters = [key for key in db_filters if key not in columns]
     if unknown_filters:
         raise ValueError(
@@ -1114,7 +1136,7 @@ def list_master_records(
         where_parts.insert(0, '"disabled" = ?')
         params.insert(0, 0)
 
-    requested_search_fields = list(search_fields or [])
+    requested_search_fields = list(dict.fromkeys(aliases.get(field, field) for field in (search_fields or [])))
     unknown_search = [field for field in requested_search_fields if field not in columns]
     if unknown_search:
         raise ValueError(f"Unknown search field(s): {', '.join(unknown_search)}")
@@ -1126,14 +1148,15 @@ def list_master_records(
         where_parts.append(search_where)
         params.extend(search_params)
 
-    sort_column = order_by or "name"
+    sort_column = aliases.get(order_by, order_by) or "name"
     if sort_column not in columns:
         raise ValueError(f"Unknown order_by column for {master_type}: {sort_column}")
     direction = str(order).lower()
     if direction not in ("asc", "desc"):
         raise ValueError("order must be 'asc' or 'desc'")
 
-    requested_fields = list(fields or [])
+    requested_aliases = {field: aliases[field] for field in (fields or []) if field in aliases}
+    requested_fields = list(dict.fromkeys(aliases.get(field, field) for field in (fields or [])))
     unknown_fields = [field for field in requested_fields if field not in columns]
     if unknown_fields:
         raise ValueError(f"Unknown result field(s): {', '.join(unknown_fields)}")
@@ -1169,6 +1192,9 @@ def list_master_records(
         query += f" OFFSET {max(0, int(offset))}"
 
     rows = db.sql(query, params)
+    for row in rows:
+        for alias, column in requested_aliases.items():
+            row[alias] = row[column]
     result = page_metadata(rows, total, limit, max(0, int(offset)), window, unknown) if total is not None else {"rows": rows}
     return {**result, "text_fields": text_fields}
 

{lambda_erp-1.1.0 → lambda_erp-1.1.2}/lambda_erp/database.py

@@ -408,6 +408,7 @@ class Database:
                 default_currency TEXT DEFAULT 'USD',
                 default_price_list TEXT,
                 credit_limit REAL DEFAULT 0,
+                website TEXT,
                 email TEXT,
                 phone TEXT,
                 address TEXT,
@@ -2850,6 +2851,10 @@ def _m037_pricing_record_lifecycle(db: "Database") -> None:
         db.ensure_column(table, "discarded", "INTEGER DEFAULT 0")
 
 
+def _m038_customer_website(db: "Database") -> None:
+    db.ensure_column("Customer", "website", "TEXT")
+
+
 Database.MIGRATIONS = [
     (1, "chat_message_session_id", _m001_chat_message_session_id),
     (2, "chat_session_user_id", _m002_chat_session_user_id),
@@ -2888,6 +2893,7 @@ Database.MIGRATIONS = [
     (35, "pricing_rule_dimensions", _m035_pricing_rule_dimensions),
     (36, "external_identity_integrity", _m036_external_identity_integrity),
     (37, "pricing_record_lifecycle", _m037_pricing_record_lifecycle),
+    (38, "customer_website", _m038_customer_website),
 ]
 
 

{lambda_erp-1.1.0 → lambda_erp-1.1.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lambda-erp"
-version = "1.1.0"
+version = "1.1.2"
 description = "Core ERP logic - accounting, sales, purchasing, inventory"
 readme = "README.md"
 license = "Apache-2.0"