@casys/mcp-erpnext 3.0.2 → 3.1.0-beta.2

package/mcp-erpnext.mjs

@@ -3117,7 +3117,25 @@ var require_utils2 = __commonJS({
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
-    var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+    var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
+    var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
+    var isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
+    var BYTE_HEX = new Array(256);
+    {
+      const HEX_DIGITS = "0123456789ABCDEF";
+      for (let i = 0; i < 256; i++) {
+        BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
+      }
+    }
+    function percentEncodeNonAscii(cp) {
+      if (cp < 2048) {
+        return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
+      }
+      if (cp < 65536) {
+        return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+      }
+      return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+    }
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -3142,91 +3160,105 @@ var require_utils2 = __commonJS({
       }
       return acc;
     }
+    var isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/);
+    var isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/);
+    var isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/);
     var nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
-    function consumeIsZone(buffer) {
-      buffer.length = 0;
-      return true;
-    }
-    function consumeHextets(buffer, address, output) {
-      if (buffer.length) {
-        const hex = stringArrayToHexStripped(buffer);
-        if (hex !== "") {
-          address.push(hex);
-        } else {
-          output.error = true;
-          return false;
+    function isZoneIdentifier(zone) {
+      if (zone.length === 0) return false;
+      for (let i = 0; i < zone.length; i++) {
+        if (isZoneCharacter(zone[i])) continue;
+        if (zone[i] === "%" && i + 2 < zone.length && isHexPair(zone.slice(i + 1, i + 3))) {
+          i += 2;
+          continue;
         }
-        buffer.length = 0;
+        return false;
       }
       return true;
     }
-    function getIPV6(input) {
-      let tokenCount = 0;
-      const output = { error: false, address: "", zone: "" };
-      const address = [];
-      const buffer = [];
-      let endipv6Encountered = false;
-      let endIpv6 = false;
-      let consume = consumeHextets;
-      for (let i = 0; i < input.length; i++) {
-        const cursor = input[i];
-        if (cursor === "[" || cursor === "]") {
-          continue;
-        }
-        if (cursor === ":") {
-          if (endipv6Encountered === true) {
-            endIpv6 = true;
+    function compressIPv6ZeroRun(hextets) {
+      let bestStart = -1;
+      let bestLength = 0;
+      let runStart = -1;
+      let runLength = 0;
+      for (let i = 0; i < hextets.length; i++) {
+        if (hextets[i] === "0") {
+          if (runStart === -1) runStart = i;
+          runLength++;
+          if (runLength > bestLength) {
+            bestLength = runLength;
+            bestStart = runStart;
           }
-          if (!consume(buffer, address, output)) {
-            break;
-          }
-          if (++tokenCount > 7) {
-            output.error = true;
-            break;
-          }
-          if (i > 0 && input[i - 1] === ":") {
-            endipv6Encountered = true;
-          }
-          address.push(":");
-          continue;
-        } else if (cursor === "%") {
-          if (!consume(buffer, address, output)) {
-            break;
-          }
-          consume = consumeIsZone;
         } else {
-          buffer.push(cursor);
+          runStart = -1;
+          runLength = 0;
+        }
+      }
+      if (bestLength < 2) return hextets.join(":");
+      const head = hextets.slice(0, bestStart).join(":");
+      const tail = hextets.slice(bestStart + bestLength).join(":");
+      return head + "::" + tail;
+    }
+    function normalizeIPv6Address(input) {
+      const compression = input.indexOf("::");
+      if (compression !== -1 && input.indexOf("::", compression + 1) !== -1) return void 0;
+      const left = compression === -1 ? input.split(":") : input.slice(0, compression).split(":");
+      const right = compression === -1 ? [] : input.slice(compression + 2).split(":");
+      if (compression !== -1) {
+        if (left.length === 1 && left[0] === "") left.length = 0;
+        if (right.length === 1 && right[0] === "") right.length = 0;
+      }
+      const parts = left.concat(right);
+      let hextetCount = 0;
+      for (let i = 0; i < parts.length; i++) {
+        const part = parts[i];
+        if (part === "") return void 0;
+        if (part.indexOf(".") !== -1) {
+          if (i !== parts.length - 1 || compression !== -1 && right.length === 0 || !isIPv4(part)) return void 0;
+          hextetCount += 2;
           continue;
         }
+        if (!isHextet(part)) return void 0;
+        parts[i] = parseInt(part, 16).toString(16);
+        hextetCount++;
       }
-      if (buffer.length) {
-        if (consume === consumeIsZone) {
-          output.zone = buffer.join("");
-        } else if (endIpv6) {
-          address.push(buffer.join(""));
-        } else {
-          address.push(stringArrayToHexStripped(buffer));
-        }
+      if (compression === -1) {
+        if (hextetCount !== 8) return void 0;
+        return compressIPv6ZeroRun(parts);
       }
-      output.address = address.join("");
-      return output;
+      if (hextetCount >= 8) return void 0;
+      const expanded = parts.slice(0, left.length);
+      for (let i = hextetCount; i < 8; i++) expanded.push("0");
+      for (let i = left.length; i < parts.length; i++) expanded.push(parts[i]);
+      return compressIPv6ZeroRun(expanded);
     }
     function normalizeIPv6(host) {
-      if (findToken(host, ":") < 2) {
-        return { host, isIPV6: false };
-      }
-      const ipv62 = getIPV6(host);
-      if (!ipv62.error) {
-        let newHost = ipv62.address;
-        let escapedHost = ipv62.address;
-        if (ipv62.zone) {
-          newHost += "%" + ipv62.zone;
-          escapedHost += "%25" + ipv62.zone;
-        }
-        return { host: newHost, isIPV6: true, escapedHost };
-      } else {
-        return { host, isIPV6: false };
-      }
+      const bracketed = host[0] === "[" && host[host.length - 1] === "]";
+      const hasBracket = host[0] === "[" || host[host.length - 1] === "]";
+      if (hasBracket && !bracketed) return { host, isIPV6: false, error: true };
+      let input = bracketed ? host.slice(1, -1) : host;
+      if (bracketed && isIPvFuture(input)) {
+        input = input.toLowerCase();
+        return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true };
+      }
+      if (findToken(input, ":") < 2) {
+        return { host, isIPV6: false, error: bracketed };
+      }
+      let zoneIdentifier = "";
+      const zoneSeparator = input.indexOf("%");
+      if (zoneSeparator !== -1) {
+        const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === "%25" ? 3 : 1;
+        zoneIdentifier = input.slice(zoneSeparator + separatorLength);
+        if (!isZoneIdentifier(zoneIdentifier)) return { host, isIPV6: false, error: true };
+        input = input.slice(0, zoneSeparator);
+      }
+      const address = normalizeIPv6Address(input);
+      if (address === void 0) return { host, isIPV6: false, error: true };
+      return {
+        host: address + (zoneIdentifier ? "%" + zoneIdentifier : ""),
+        escapedHost: address + (zoneIdentifier ? "%25" + zoneIdentifier : ""),
+        isIPV6: true
+      };
     }
     function findToken(str, token) {
       let ind = 0;
@@ -3345,7 +3377,8 @@ var require_utils2 = __commonJS({
     function normalizePathEncoding(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
-        if (input[i] === "%" && i + 2 < input.length) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
           const hex = input.slice(i + 1, i + 3);
           if (isHexPair(hex)) {
             const normalizedHex = hex.toUpperCase();
@@ -3359,10 +3392,152 @@ var require_utils2 = __commonJS({
             continue;
           }
         }
-        if (isPathCharacter(input[i])) {
-          output += input[i];
+        if (isPathCharacter(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function serializePathEncoding(input, pathNoScheme = false) {
+      let output = "";
+      let firstSegment = pathNoScheme && input[0] !== "/";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            output += "%" + hex.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        if (ch === "/") {
+          firstSegment = false;
+        }
+        if (isPathCharacter(ch) && (ch !== ":" || !firstSegment)) {
+          output += ch;
         } else {
-          output += escape(input[i]);
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function encodeComponent(input, isAllowed) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            output += "%" + hex.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        if (isAllowed(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function encodeUserinfo(input) {
+      return encodeComponent(input, isUserinfoCharacter);
+    }
+    function encodeQuery(input) {
+      return encodeComponent(input, isQueryFragmentCharacter);
+    }
+    function encodeFragment(input) {
+      return encodeComponent(input, isQueryFragmentCharacter);
+    }
+    function isEscapeSafe(cp) {
+      return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+    }
+    function normalizeQueryFragmentEncoding(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            const normalizedHex = hex.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        if (isQueryFragmentCharacter(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
         }
       }
       return output;
@@ -3385,14 +3560,18 @@ var require_utils2 = __commonJS({
     function recomposeAuthority(component) {
       const uriTokens = [];
       if (component.userinfo !== void 0) {
-        uriTokens.push(component.userinfo);
+        uriTokens.push(encodeUserinfo(component.userinfo));
         uriTokens.push("@");
       }
       if (component.host !== void 0) {
-        let host = unescape(component.host);
+        let host = component.host;
         if (!isIPv4(host)) {
-          const ipV6res = normalizeIPv6(host);
-          if (ipV6res.isIPV6 === true) {
+          let ipV6res = normalizeIPv6(host);
+          if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+            host = normalizePercentEncoding(host, true);
+            ipV6res = normalizeIPv6(host);
+          }
+          if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
             host = reescapeHostDelimiters(host, false);
@@ -3412,6 +3591,11 @@ var require_utils2 = __commonJS({
       reescapeHostDelimiters,
       normalizePercentEncoding,
       normalizePathEncoding,
+      serializePathEncoding,
+      normalizeQueryFragmentEncoding,
+      encodeUserinfo,
+      encodeQuery,
+      encodeFragment,
       escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
@@ -3427,7 +3611,7 @@ var require_schemes2 = __commonJS({
   "node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils2();
-    var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
+    var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
     var supportedSchemeNames = (
       /** @type {const} */
       [
@@ -3488,9 +3672,10 @@ var require_schemes2 = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path, query] = wsComponent.resourceName.split("?");
+        const queryIndex = wsComponent.resourceName.indexOf("?");
+        const path = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
         wsComponent.path = path && path !== "/" ? path : void 0;
-        wsComponent.query = query;
+        wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
       wsComponent.fragment = void 0;
@@ -3502,7 +3687,7 @@ var require_schemes2 = __commonJS({
         return urnComponent;
       }
       const matches = urnComponent.path.match(URN_REG);
-      if (matches) {
+      if (matches && matches[0] === urnComponent.path) {
         const scheme = options.scheme || urnComponent.scheme || "urn";
         urnComponent.nid = matches[1].toLowerCase();
         urnComponent.nss = matches[2];
@@ -3636,8 +3821,17 @@ var require_schemes2 = __commonJS({
 var require_fast_uri2 = __commonJS({
   "node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils2();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils2();
     var { SCHEMES, getSchemeHandler } = require_schemes2();
+    var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
+    var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+    function decodeValidScheme(scheme) {
+      const decodedScheme = unescape(String(scheme));
+      if (!VALID_SCHEME.test(decodedScheme)) {
+        throw new TypeError(MALFORMED_SCHEME_ERROR);
+      }
+      return decodedScheme;
+    }
     function normalize2(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
@@ -3650,12 +3844,34 @@ var require_fast_uri2 = __commonJS({
     }
     function resolve(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
-      const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
-      if (baseMalformed || relativeMalformed) {
+      const {
+        parsed: baseParsed,
+        malformedAuthorityOrPort: baseMalformed,
+        malformedPercentEncoding: baseMalformedPercentEncoding,
+        malformedSchemeSpecific: baseMalformedSchemeSpecific,
+        malformedHost: baseMalformedHost,
+        malformedScheme: baseMalformedScheme
+      } = parseWithStatus(baseURI, schemelessOptions);
+      const {
+        parsed: relativeParsed,
+        malformedAuthorityOrPort: relativeMalformed,
+        malformedPercentEncoding: relativeMalformedPercentEncoding,
+        malformedSchemeSpecific: relativeMalformedSchemeSpecific,
+        malformedHost: relativeMalformedHost,
+        malformedScheme: relativeMalformedScheme
+      } = parseWithStatus(relativeURI, schemelessOptions);
+      if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
         throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
       }
       const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
+      const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
+      const resolvedHost = resolved.host;
+      const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+      canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
+      const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !new RegExp("\\P{ASCII}", "u").test(resolvedHost);
+      if (resolved.error && !encodedASCIIHost) {
+        throw new Error(resolved.error);
+      }
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
@@ -3715,7 +3931,7 @@ var require_fast_uri2 = __commonJS({
     function equal(uriA, uriB, options) {
       const normalizedA = normalizeComparableURI(uriA, options);
       const normalizedB = normalizeComparableURI(uriB, options);
-      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
+      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA === normalizedB;
     }
     function serialize(cmpts, opts) {
       const component = {
@@ -3736,19 +3952,22 @@ var require_fast_uri2 = __commonJS({
       };
       const options = Object.assign({}, opts);
       const uriTokens = [];
+      if (component.scheme) {
+        component.scheme = decodeValidScheme(component.scheme);
+      }
       const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
+      const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
+      const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
       if (component.path !== void 0) {
         if (!options.skipEscape) {
-          component.path = escapePreservingEscapes(component.path);
-          if (component.scheme !== void 0) {
-            component.path = component.path.split("%3A").join(":");
-          }
+          component.path = serializePathEncoding(component.path, pathNoScheme);
         } else {
           component.path = normalizePercentEncoding(component.path);
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
+        component.scheme = decodeValidScheme(component.scheme);
         uriTokens.push(component.scheme, ":");
       }
       const authority = recomposeAuthority(component);
@@ -3766,16 +3985,19 @@ var require_fast_uri2 = __commonJS({
         if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
           s = removeDotSegments(s);
         }
+        if (pathNoScheme) {
+          s = serializePathEncoding(s, true);
+        }
         if (authority === void 0 && s[0] === "/" && s[1] === "/") {
           s = "/%2F" + s.slice(2);
         }
         uriTokens.push(s);
       }
       if (component.query !== void 0) {
-        uriTokens.push("?", component.query);
+        uriTokens.push("?", encodeQuery(component.query));
       }
       if (component.fragment !== void 0) {
-        uriTokens.push("#", component.fragment);
+        uriTokens.push("#", encodeFragment(component.fragment));
       }
       return uriTokens.join("");
     }
@@ -3791,6 +4013,32 @@ var require_fast_uri2 = __commonJS({
       }
       return void 0;
     }
+    function hasMalformedPercentEncoding(component) {
+      if (component === void 0) return false;
+      let percent = component.indexOf("%");
+      while (percent !== -1) {
+        if (percent + 2 >= component.length || !/^[\da-f]{2}$/iu.test(component.slice(percent + 1, percent + 3))) {
+          return true;
+        }
+        percent = component.indexOf("%", percent + 3);
+      }
+      return false;
+    }
+    function hasMalformedComponentPercentEncoding(matches) {
+      const host = matches[4];
+      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !(host[0] === "[" && host[host.length - 1] === "]") && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+    }
+    function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && parsed.host[0] !== "[" && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+        try {
+          parsed.host = new URL("http://" + parsed.host).hostname;
+        } catch (e) {
+          parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+          return true;
+        }
+      }
+      return false;
+    }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
@@ -3803,6 +4051,11 @@ var require_fast_uri2 = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
+      let malformedPercentEncoding = false;
+      let malformedSchemeSpecific = false;
+      let malformedHost = false;
+      let malformedIPLiteral = false;
+      let malformedScheme = false;
       let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
@@ -3839,6 +4092,19 @@ var require_fast_uri2 = __commonJS({
         parsed.path = matches[6] || "";
         parsed.query = matches[7];
         parsed.fragment = matches[8];
+        if (parsed.scheme !== void 0) {
+          const decodedScheme = unescape(parsed.scheme);
+          if (VALID_SCHEME.test(decodedScheme)) {
+            parsed.scheme = decodedScheme.toLowerCase();
+          } else {
+            parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
+            malformedScheme = true;
+          }
+        }
+        malformedPercentEncoding = hasMalformedComponentPercentEncoding(matches);
+        if (malformedPercentEncoding) {
+          parsed.error = parsed.error || "URI contains malformed percent-encoding.";
+        }
         if (isNaN(parsed.port)) {
           parsed.port = matches[5];
         }
@@ -3850,9 +4116,15 @@ var require_fast_uri2 = __commonJS({
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
+            const bracketedIPLiteral = parsed.host[0] === "[" && parsed.host[parsed.host.length - 1] === "]";
             const ipv6result = normalizeIPv6(parsed.host);
-            parsed.host = ipv6result.host.toLowerCase();
-            isIP = ipv6result.isIPV6;
+            isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
+            malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true;
+            parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
+            if (malformedIPLiteral) {
+              parsed.error = parsed.error || "URI host is malformed.";
+              malformedAuthorityOrPort = true;
+            }
           } else {
             isIP = true;
           }
@@ -3870,42 +4142,34 @@ var require_fast_uri2 = __commonJS({
           parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-        if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
-            try {
-              parsed.host = new URL("http://" + parsed.host).hostname;
-            } catch (e) {
-              parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
-            }
-          }
-        }
+        malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (uri.indexOf("%") !== -1) {
-            if (parsed.scheme !== void 0) {
-              parsed.scheme = unescape(parsed.scheme);
-            }
-            if (parsed.host !== void 0) {
-              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+            if (parsed.host !== void 0 && !malformedIPLiteral) {
+              const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+              parsed.host = reescapeHostDelimiters(host, isIP);
             }
           }
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
+          if (parsed.query) {
+            parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+          }
           if (parsed.fragment) {
-            try {
-              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
-            } catch {
-              parsed.error = parsed.error || "URI malformed";
-            }
+            parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
           }
         }
         if (schemeHandler && schemeHandler.parse) {
           schemeHandler.parse(parsed, options);
+          if (schemeHandler === SCHEMES.urn && parsed.nid === void 0) {
+            malformedSchemeSpecific = true;
+          }
         }
       } else {
         parsed.error = parsed.error || "URI can not be parsed.";
       }
-      return { parsed, malformedAuthorityOrPort };
+      return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
     }
     function parse3(uri, opts) {
       return parseWithStatus(uri, opts).parsed;
@@ -3914,20 +4178,28 @@ var require_fast_uri2 = __commonJS({
       return normalizeStringWithStatus(uri, opts).normalized;
     }
     function normalizeStringWithStatus(uri, opts) {
-      const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+      const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
       return {
-        normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
-        malformedAuthorityOrPort
+        normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+        malformedAuthorityOrPort,
+        malformedPercentEncoding,
+        malformedSchemeSpecific,
+        malformedHost,
+        malformedScheme
       };
     }
     function normalizeComparableURI(uri, opts) {
-      if (typeof uri === "string") {
-        const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
-        return malformedAuthorityOrPort ? void 0 : normalized;
+      if (typeof uri !== "string" && typeof uri !== "object") {
+        return void 0;
       }
-      if (typeof uri === "object") {
-        return serialize(uri, opts);
+      let value;
+      try {
+        value = typeof uri === "string" ? uri : serialize(uri, opts);
+      } catch {
+        return void 0;
       }
+      const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
+      return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? void 0 : normalized;
     }
     var fastUri = {
       SCHEMES,
@@ -37072,13 +37344,13 @@ var HonoRequest = class {
     return key ? this.#getDecodedParam(key) : this.#getAllDecodedParams();
   }
   #getDecodedParam(key) {
-    const paramKey = this.#matchResult[0][this.routeIndex][1][key];
+    const paramKey = this.#matchResult[0][this.routeIndex]?.[1][key];
     const param = this.#getParamValue(paramKey);
     return param && tryDecodeURIComponent(param);
   }
   #getAllDecodedParams() {
     const decoded = {};
-    const keys = Object.keys(this.#matchResult[0][this.routeIndex][1]);
+    const keys = Object.keys(this.#matchResult[0][this.routeIndex]?.[1] ?? {});
     for (const key of keys) {
       const value = this.#getParamValue(this.#matchResult[0][this.routeIndex][1][key]);
       if (value !== void 0) {
@@ -38165,6 +38437,9 @@ var Hono = class _Hono {
   };
 };
 
+// node_modules/hono/dist/router/utils.js
+var createNullObject = () => /* @__PURE__ */ Object.create(null);
+
 // node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
 function match(method, path) {
@@ -38215,7 +38490,7 @@ var Node = class _Node {
   // handler index of a dynamic path, or -1 for a static path terminal
   #index;
   #varIndex;
-  #children = /* @__PURE__ */ Object.create(null);
+  #children = createNullObject();
   insert(tokens, index, paramMap, context2, isStatic) {
     let node = this;
     for (let i = 0, len = tokens.length; i < len; i++) {
@@ -38299,7 +38574,7 @@ var Trie = class {
   #root = new Node();
   #index = 0;
   // dynamic path -> [handler index, param assoc]; static paths are not registered
-  paths = /* @__PURE__ */ Object.create(null);
+  paths = createNullObject();
   insert(path, isStatic) {
     if (isStatic) {
       this.#root.insert(path.split(""), 0, [], this.#context, true);
@@ -38358,22 +38633,16 @@ var Trie = class {
 };
 
 // node_modules/hono/dist/router/reg-exp-router/router.js
-var wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
+var wildcardRegExpCache = createNullObject();
 function buildWildcardRegExp(path) {
   return wildcardRegExpCache[path] ??= new RegExp(
-    path === "*" ? "" : `^${path.replace(
-      /\/\*$|([.\\+*[^\]$()])/g,
-      (_, metaChar) => metaChar ? `\\${metaChar}` : "(?:|/.*)"
+    `^${path.replace(
+      /\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,
+      (match2, metaChar) => metaChar ? `\\${metaChar}` : match2 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match2 === "*" ? ONLY_WILDCARD_REG_EXP_STR : `/:${LABEL_REG_EXP_STR}`
     )}$`
   );
 }
-function clearWildcardRegExpCache() {
-  wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
-}
 function findMiddleware(middleware, path) {
-  if (!middleware) {
-    return void 0;
-  }
   for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) {
     if (buildWildcardRegExp(k).test(path)) {
       return [...middleware[k]];
@@ -38387,8 +38656,8 @@ var RegExpRouter = class {
   #routes;
   #tries;
   constructor() {
-    this.#middleware = { [METHOD_NAME_ALL]: /* @__PURE__ */ Object.create(null) };
-    this.#routes = { [METHOD_NAME_ALL]: /* @__PURE__ */ Object.create(null) };
+    this.#middleware = { [METHOD_NAME_ALL]: createNullObject() };
+    this.#routes = { [METHOD_NAME_ALL]: createNullObject() };
     this.#tries = { [METHOD_NAME_ALL]: new Trie() };
   }
   #insertPath(method, path) {
@@ -38401,117 +38670,86 @@ var RegExpRouter = class {
   add(method, path, handler) {
     const middleware = this.#middleware;
     const routes = this.#routes;
-    if (!middleware || !routes) {
+    if (!middleware) {
       throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
     }
     if (!middleware[method]) {
       this.#tries[method] = new Trie();
-      [middleware, routes].forEach((handlerMap) => {
-        handlerMap[method] = /* @__PURE__ */ Object.create(null);
-        Object.keys(handlerMap[METHOD_NAME_ALL]).forEach((p) => {
+      for (const handlerMap of [middleware, routes]) {
+        handlerMap[method] = createNullObject();
+        for (const p in handlerMap[METHOD_NAME_ALL]) {
           handlerMap[method][p] = [...handlerMap[METHOD_NAME_ALL][p]];
           this.#insertPath(method, p);
-        });
-      });
+        }
+      }
     }
     if (path === "/*") {
       path = "*";
     }
-    const paramCount = (path.match(/\/:/g) || []).length;
+    const methods = method === METHOD_NAME_ALL ? Object.keys(middleware) : [method];
     if (/\*$/.test(path)) {
       const re2 = buildWildcardRegExp(path);
-      Object.keys(middleware).forEach((m) => {
-        if ((method === METHOD_NAME_ALL || method === m) && !middleware[m][path]) {
+      for (const m of methods) {
+        if (!middleware[m][path]) {
           this.#insertPath(m, path);
           middleware[m][path] = findMiddleware(middleware[m], path) || findMiddleware(middleware[METHOD_NAME_ALL], path) || [];
         }
-      });
-      Object.keys(middleware).forEach((m) => {
-        if (method === METHOD_NAME_ALL || method === m) {
-          Object.keys(middleware[m]).forEach((p) => {
-            re2.test(p) && middleware[m][p].push([handler, paramCount]);
-          });
-        }
-      });
-      Object.keys(routes).forEach((m) => {
-        if (method === METHOD_NAME_ALL || method === m) {
-          Object.keys(routes[m]).forEach(
-            (p) => re2.test(p) && routes[m][p].push([handler, paramCount])
-          );
+      }
+      for (const handlerMap of [middleware, routes]) {
+        for (const m of methods) {
+          for (const p in handlerMap[m]) {
+            re2.test(p) && handlerMap[m][p].push([handler, path]);
+          }
         }
-      });
+      }
       return;
     }
     const paths = checkOptionalParameter(path) || [path];
-    for (let i = 0, len = paths.length; i < len; i++) {
-      const path2 = paths[i];
-      Object.keys(routes).forEach((m) => {
-        if (method === METHOD_NAME_ALL || method === m) {
-          if (!routes[m][path2]) {
-            this.#insertPath(m, path2);
-            routes[m][path2] = [
-              ...findMiddleware(middleware[m], path2) || findMiddleware(middleware[METHOD_NAME_ALL], path2) || []
-            ];
-          }
-          routes[m][path2].push([handler, paramCount - len + i + 1]);
+    for (const path2 of paths) {
+      for (const m of methods) {
+        if (!routes[m][path2]) {
+          this.#insertPath(m, path2);
+          routes[m][path2] = findMiddleware(middleware[m], path2) || findMiddleware(middleware[METHOD_NAME_ALL], path2) || [];
         }
-      });
+        routes[m][path2].push([handler, path2]);
+      }
     }
   }
   match = match;
   buildAllMatchers() {
-    const matchers = /* @__PURE__ */ Object.create(null);
-    Object.keys(this.#routes).concat(Object.keys(this.#middleware)).forEach((method) => {
-      matchers[method] ||= this.#buildMatcher(method);
-    });
+    const matchers = createNullObject();
+    for (const method of Object.keys(this.#routes)) {
+      matchers[method] = this.#buildMatcher(method);
+    }
     this.#middleware = this.#routes = this.#tries = void 0;
-    clearWildcardRegExpCache();
+    wildcardRegExpCache = createNullObject();
     return matchers;
   }
   #buildMatcher(method) {
     const middleware = this.#middleware[method];
     const routes = this.#routes[method];
     const trie = this.#tries[method];
-    const staticMap = /* @__PURE__ */ Object.create(null);
+    const staticMap = createNullObject();
     const handlerData = [];
-    [middleware, routes].forEach((r) => {
+    const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
+    for (const r of [middleware, routes]) {
       for (const path in r) {
         const handlers = r[path];
         const pathData = trie.paths[path];
         if (!pathData) {
-          staticMap[path] = [handlers.map(([h]) => [h, /* @__PURE__ */ Object.create(null)]), emptyParam];
-          continue;
-        }
-        const paramAssoc = pathData[1];
-        handlerData[pathData[0]] = handlers.map(([h, paramCount]) => {
-          const paramIndexMap = /* @__PURE__ */ Object.create(null);
-          paramCount -= 1;
-          for (; paramCount >= 0; paramCount--) {
-            const [key, value] = paramAssoc[paramCount];
-            paramIndexMap[key] = value;
-          }
-          return [h, paramIndexMap];
-        });
-      }
-    });
-    const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
-    for (let i = 0, len = handlerData.length; i < len; i++) {
-      for (let j = 0, len2 = handlerData[i].length; j < len2; j++) {
-        const map = handlerData[i][j]?.[1];
-        if (!map) {
+          staticMap[path] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
           continue;
         }
-        const keys = Object.keys(map);
-        for (let k = 0, len3 = keys.length; k < len3; k++) {
-          map[keys[k]] = paramReplacementMap[map[keys[k]]];
-        }
+        handlerData[pathData[0]] = handlers.map(([h, handlerPath]) => [
+          h,
+          trie.paths[handlerPath][1].reduceRight((map, [key], i) => {
+            map[key] = paramReplacementMap[pathData[1][i][1]];
+            return map;
+          }, createNullObject())
+        ]);
       }
     }
-    const handlerMap = [];
-    for (const i in indexReplacementMap) {
-      handlerMap[i] = handlerData[indexReplacementMap[i]];
-    }
-    return [regexp, handlerMap, staticMap];
+    return [regexp, indexReplacementMap.map((i) => handlerData[i]), staticMap];
   }
 };
 
@@ -38571,11 +38809,11 @@ var SmartRouter = class {
 };
 
 // node_modules/hono/dist/router/trie-router/node.js
-var emptyParams = /* @__PURE__ */ Object.create(null);
+var emptyParams = createNullObject();
 var order = 0;
 var Node2 = class _Node2 {
   #methods = [];
-  #children = /* @__PURE__ */ Object.create(null);
+  #children = createNullObject();
   #patterns = [];
   #pattern;
   #params = emptyParams;
@@ -38612,7 +38850,7 @@ var Node2 = class _Node2 {
       const m = node.#methods[i];
       const handlerSet = m[method] || m[METHOD_NAME_ALL];
       if (handlerSet) {
-        handlerSet.params = /* @__PURE__ */ Object.create(null);
+        handlerSet.params = createNullObject();
         handlerSets.push(handlerSet);
         for (let i2 = 0, len2 = handlerSet.possibleKeys.length; i2 < len2; i2++) {
           const key = handlerSet.possibleKeys[i2];
@@ -40550,33 +40788,11 @@ function isObject2(input) {
     return false;
   }
   const prototype = Object.getPrototypeOf(input);
-  if (prototype === null) {
-    return true;
-  }
-  let proto = prototype;
-  while (Object.getPrototypeOf(proto) !== null) {
-    proto = Object.getPrototypeOf(proto);
-  }
-  return prototype === proto;
+  return prototype === null || Object.getPrototypeOf(prototype) === null;
 }
-function isDisjoint(...headers) {
-  const parameters = /* @__PURE__ */ new Set();
-  for (const header of headers) {
-    if (!header)
-      continue;
-    for (const parameter of Object.keys(header)) {
-      if (parameters.has(parameter)) {
-        return false;
-      }
-      parameters.add(parameter);
-    }
-  }
-  return true;
+function isJwkSet(input) {
+  return isObject2(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject2);
 }
-var isJWK = (key) => isObject2(key) && typeof key.kty === "string";
-var isPrivateJWK = (key) => key.kty !== "oct" && (key.kty === "AKP" && typeof key.priv === "string" || typeof key.d === "string");
-var isPublicJWK = (key) => key.kty !== "oct" && key.d === void 0 && key.priv === void 0;
-var isSecretJWK = (key) => key.kty === "oct" && typeof key.k === "string";
 
 // node_modules/jose/dist/webapi/lib/helpers.js
 var unprotected = Symbol();
@@ -40625,6 +40841,26 @@ async function jwkToKey(entry, jwk) {
   return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
 }
 
+// node_modules/jose/dist/webapi/lib/jwk_metadata.js
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== void 0 && typeof normalized.ext !== "boolean") {
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  }
+  if (normalized.key_ops !== void 0) {
+    const value = normalized.key_ops;
+    const keyOps = Array.isArray(value) ? [...value] : void 0;
+    if (!keyOps || keyOps.some((operation) => typeof operation !== "string") || new Set(keyOps).size !== keyOps.length) {
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    }
+    normalized.key_ops = keyOps;
+  }
+  return normalized;
+}
+
 // node_modules/jose/dist/webapi/lib/key.js
 var tag = (key) => key[Symbol.toStringTag];
 var jwkMatchesOp = (entry, key, usage) => {
@@ -40650,12 +40886,17 @@ function checkKeyType(entry, key, usage) {
   const privateKey = usage === "decrypt" || usage === "sign";
   if (secret && key instanceof Uint8Array)
     return [BYTES, key];
-  if (isJWK(key)) {
-    if (secret ? !isSecretJWK(key) : !(privateKey ? isPrivateJWK(key) : isPublicJWK(key))) {
+  if (isObject2(key)) {
+    const normalized = normalizeJwk(key);
+    if (typeof normalized.kty !== "string") {
+      throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
+    }
+    const valid = secret ? normalized.kty === "oct" && typeof normalized.k === "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv === "string" || typeof normalized.d === "string" : normalized.d === void 0 && normalized.priv === void 0);
+    if (!valid) {
       throw new TypeError(secret ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present` : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
     }
-    jwkMatchesOp(entry, key, usage);
-    return [JWK, key];
+    jwkMatchesOp(entry, normalized, usage);
+    return [JWK, key, normalized];
   }
   if (!isKeyLike(key)) {
     throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
@@ -40694,7 +40935,7 @@ function cached2(key, alg, value) {
     if (entry) {
       entry[alg] = value;
     } else {
-      cache.set(key, { __proto__: null, [alg]: value });
+      cache.set(key, { [alg]: value });
     }
   }
   return value ?? entry?.[alg];
@@ -40719,8 +40960,9 @@ async function prepareKey(entry, key, usage) {
       return tagged[1];
     case JWK: {
       const key2 = tagged[1];
-      if (key2.k) {
-        return decode2(key2.k);
+      const normalized = tagged[2];
+      if (normalized.kty === "oct") {
+        return decode2(normalized.k);
       }
       if (!Object.isFrozen(key2)) {
         const { key_ops } = key2;
@@ -40728,7 +40970,7 @@ async function prepareKey(entry, key, usage) {
           Object.freeze(key_ops);
         Object.freeze(key2);
       }
-      return handleJWK(key2, key2, entry);
+      return handleJWK(key2, normalized, entry);
     }
     case KEYOBJECT: {
       const keyObject = tagged[1];
@@ -40787,6 +41029,16 @@ function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader,
   }
   return protectedHeader.crit;
 }
+function validateB64(protectedHeader, extensions) {
+  if (extensions.includes("b64")) {
+    const b64 = protectedHeader.b64;
+    if (typeof b64 !== "boolean") {
+      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    }
+    return b64;
+  }
+  return true;
+}
 
 // node_modules/jose/dist/webapi/lib/signing.js
 async function getSigKey(entry, key, usage) {
@@ -40886,64 +41138,42 @@ function jwsAlgorithm(alg) {
 function prepareVerify(options) {
   return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
 }
-async function verifySignature(jws, shared, key) {
-  const { protected: encodedProtected, header, payload: inputPayload } = jws;
-  let parsedProt = {};
-  if (encodedProtected) {
-    parsedProt = parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
-  }
-  let joseHeader;
-  if (header !== void 0) {
-    if (!isDisjoint(parsedProt, header)) {
-      throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-    }
-    joseHeader = { ...parsedProt, ...header };
-  } else {
-    joseHeader = parsedProt;
-  }
-  const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader);
-  let b64 = true;
-  if (extensions.includes("b64")) {
-    b64 = parsedProt.b64;
-    if (typeof b64 !== "boolean") {
-      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-    }
-  }
-  const { alg } = joseHeader;
+function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid")) {
+  return parsedProtected;
+}
+function validateJwsHeaders(parsedProt, joseHeader, shared) {
+  const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader));
+  const alg = joseHeader.alg;
   if (typeof alg !== "string" || !alg) {
     throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
   }
   if (shared[0] && !shared[0].has(alg)) {
     throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
   }
-  if (b64) {
-    if (typeof inputPayload !== "string") {
-      throw new JWSInvalid("JWS Payload must be a string");
-    }
-  } else if (typeof inputPayload !== "string" && !(inputPayload instanceof Uint8Array)) {
-    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+  return [b64, alg];
+}
+function encodeCompactUnencodedPayload(payload) {
+  try {
+    return encode2(payload);
+  } catch {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
   }
+}
+async function verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload) {
   let resolvedKey = false;
   if (typeof key === "function") {
     key = await key(parsedProt, jws);
     resolvedKey = true;
   }
+  const b64 = typeof signingPayload === "string";
   const entry = jwsAlgorithm(alg);
-  const data = concat(encodedProtected !== void 0 ? encode2(encodedProtected) : new Uint8Array(), encode2("."), typeof inputPayload === "string" ? b64 ? shared[2] ??= encodeBase64url(inputPayload, "payload", JWSInvalid) : encoder.encode(inputPayload) : inputPayload);
+  const data = concat(encodedProtected !== void 0 ? encode2(encodedProtected) : new Uint8Array(), encode2("."), b64 ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload);
   const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
   const k = await prepareKey(entry, key, "verify");
-  const verified = await verify(entry, k, signature, data);
-  if (!verified) {
+  if (!await verify(entry, k, signature, data)) {
     throw new JWSSignatureVerificationFailed();
   }
-  let payload;
-  if (b64) {
-    payload = decodeBase64url(inputPayload, "payload", JWSInvalid);
-  } else if (typeof inputPayload === "string") {
-    payload = encoder.encode(inputPayload);
-  } else {
-    payload = inputPayload;
-  }
+  const payload = b64 ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload;
   return [payload, parsedProt, b64, k, resolvedKey];
 }
 async function verifyCompact(jws, shared, key) {
@@ -40957,7 +41187,11 @@ async function verifyCompact(jws, shared, key) {
   if (length !== 3) {
     throw new JWSInvalid("Invalid Compact JWS");
   }
-  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key);
+  const compactJws = { payload, protected: protectedHeader, signature };
+  const parsedProt = parseProtectedHeader(protectedHeader);
+  const [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared);
+  const signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
+  return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
 }
 
 // node_modules/jose/dist/webapi/lib/jwt_claims_set.js
@@ -40972,13 +41206,22 @@ var multipliers = {
 };
 var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
 var checkFailed = "check_failed";
+function invalidDuration() {
+  throw new TypeError("Invalid time period format");
+}
 function secs(str) {
+  if (typeof str !== "string") {
+    invalidDuration();
+  }
   const matched = REGEX.exec(str);
   if (!matched || matched[4] && matched[1]) {
-    throw new TypeError("Invalid time period format");
+    invalidDuration();
   }
   const value = parseFloat(matched[2]);
   const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  if (!Number.isFinite(numericDate)) {
+    invalidDuration();
+  }
   if (matched[1] === "-" || matched[4] === "ago") {
     return -numericDate;
   }
@@ -40991,10 +41234,8 @@ function validateInput(label, input) {
   return input;
 }
 var normalizeTyp = (value) => {
-  if (value.includes("/")) {
-    return value.toLowerCase();
-  }
-  return `application/${value.toLowerCase()}`;
+  const normalized = value.toLowerCase();
+  return value.includes("/") ? normalized : `application/${normalized}`;
 };
 var checkAudiencePresence = (audPayload, audOption) => {
   if (typeof audPayload === "string") {
@@ -41027,7 +41268,7 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
     throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
   }
   const { typ } = options;
-  if (typ && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+  if (typ !== void 0 && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
     throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
   }
   const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
@@ -41066,7 +41307,7 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
   }
   validateInput("clockTolerance option", tolerance);
   const { currentDate } = options;
-  const now = validateInput("currentDate option", epoch(currentDate || /* @__PURE__ */ new Date()));
+  const now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate));
   const iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0);
   const nbf = validateNumericDate(payload, "nbf");
   if (nbf !== void 0) {
@@ -41082,11 +41323,11 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
   }
   if (maxTokenAge !== void 0) {
     const age = now - iat;
-    const max = typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge);
+    const max = validateInput("maxTokenAge option", typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge));
     if (age - tolerance > max) {
       throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
     }
-    if (age < 0 - tolerance) {
+    if (age < -tolerance) {
       throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
     }
   }
@@ -41108,74 +41349,61 @@ async function jwtVerify(jwt, key, options) {
 }
 
 // node_modules/jose/dist/webapi/jwks/local.js
-function signatureAlgorithm(alg) {
-  const entry = typeof alg === "string" ? JWS[alg] : void 0;
-  if (!entry || entry.secret) {
-    throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-  }
-  return entry;
+function isUsableJWK(jwk, entry, alg, kid) {
+  const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk);
+  const keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
+  return (ext === void 0 || typeof ext === "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation === "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid === "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
 }
-function isJWKSLike(jwks) {
-  if (!jwks || typeof jwks !== "object") {
-    return false;
+async function importWithAlgCache(cache2, jwk, entry) {
+  const cached3 = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk);
+  const { alg } = entry;
+  if (cached3[alg] === void 0) {
+    const key = await jwkToKey(entry, { ...jwk, alg, ext: true });
+    if (key.type !== "public") {
+      throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+    }
+    cached3[alg] = key;
   }
-  const { keys } = jwks;
-  return Array.isArray(keys) && keys.every(isObject2);
+  return cached3[alg];
 }
-var LocalJWKSetImpl = class {
-  #jwks;
-  #cached = /* @__PURE__ */ new WeakMap();
-  constructor(jwks) {
-    if (!isJWKSLike(jwks)) {
-      throw new JWKSInvalid("JSON Web Key Set malformed");
-    }
-    this.#jwks = structuredClone(jwks);
+function createLocalJWKSet(jwks) {
+  let snapshot;
+  try {
+    snapshot = structuredClone(jwks);
+  } catch {
   }
-  jwks() {
-    return this.#jwks;
+  if (!isJwkSet(snapshot)) {
+    throw new JWKSInvalid("JSON Web Key Set malformed");
   }
-  async getKey(protectedHeader, token) {
+  const cached3 = /* @__PURE__ */ new WeakMap();
+  const localJWKSet = async (protectedHeader, token) => {
     const { alg, kid } = { ...protectedHeader, ...token?.header };
-    const entry = signatureAlgorithm(alg);
-    const candidates = this.#jwks.keys.filter((jwk2) => entry.kty.includes(jwk2.kty) && (typeof kid !== "string" || kid === jwk2.kid) && (!(typeof jwk2.alg === "string" || jwk2.kty === "AKP") || alg === jwk2.alg) && (typeof jwk2.use !== "string" || jwk2.use === "sig") && (!Array.isArray(jwk2.key_ops) || jwk2.key_ops.includes("verify")) && (!entry.crv || jwk2.crv === entry.crv));
+    const entry = typeof alg === "string" ? JWS[alg] : void 0;
+    if (!entry || entry.secret) {
+      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    }
+    const candidates = snapshot.keys.filter((jwk2) => isUsableJWK(jwk2, entry, alg, kid));
     const { 0: jwk, length } = candidates;
-    if (length === 0) {
+    if (!length) {
       throw new JWKSNoMatchingKey();
     }
     if (length !== 1) {
       const error2 = new JWKSMultipleMatchingKeys();
-      const _cached = this.#cached;
       error2[Symbol.asyncIterator] = async function* () {
         for (const jwk2 of candidates) {
           try {
-            yield await importWithAlgCache(_cached, jwk2, entry);
+            yield await importWithAlgCache(cached3, jwk2, entry);
           } catch {
           }
         }
       };
       throw error2;
     }
-    return importWithAlgCache(this.#cached, jwk, entry);
-  }
-};
-async function importWithAlgCache(cache2, jwk, entry) {
-  const cached3 = cache2.get(jwk) || cache2.set(jwk, { __proto__: null }).get(jwk);
-  if (cached3[entry.alg] === void 0) {
-    const key = await jwkToKey(entry, { ...jwk, alg: entry.alg, ext: true });
-    if (key.type !== "public") {
-      throw new JWKSInvalid("JSON Web Key Set members must be public keys");
-    }
-    cached3[entry.alg] = key;
-  }
-  return cached3[entry.alg];
-}
-function createLocalJWKSet(jwks) {
-  const set = new LocalJWKSetImpl(jwks);
-  const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-  Object.defineProperty(localJWKSet, "jwks", {
-    value: () => structuredClone(set.jwks())
+    return importWithAlgCache(cached3, jwk, entry);
+  };
+  return Object.defineProperty(localJWKSet, "jwks", {
+    value: () => structuredClone(snapshot)
   });
-  return localJWKSet;
 }
 
 // node_modules/jose/dist/webapi/jwks/remote.js
@@ -41185,7 +41413,7 @@ function isCloudflareWorkers() {
 var USER_AGENT;
 if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
   const NAME = "jose";
-  const VERSION2 = "v6.2.9";
+  const VERSION2 = "v6.2.10";
   USER_AGENT = `${NAME}/${VERSION2}`;
 }
 var customFetch = Symbol();
@@ -41211,130 +41439,112 @@ async function fetchJwks(url2, headers, signal, fetchImpl = fetch) {
   }
 }
 var jwksCache = Symbol();
-function isFreshJwksCache(input, cacheMaxAge) {
-  if (typeof input !== "object" || input === null) {
-    return false;
-  }
-  if (!("uat" in input) || typeof input.uat !== "number" || Date.now() - input.uat >= cacheMaxAge) {
-    return false;
-  }
-  if (!("jwks" in input) || !isObject2(input.jwks) || !Array.isArray(input.jwks.keys) || !Array.prototype.every.call(input.jwks.keys, isObject2)) {
-    return false;
+function isFreshFor(timestamp, duration3) {
+  return Number.isFinite(timestamp) && Date.now() < timestamp + duration3;
+}
+function validateDuration(value, fallback, option) {
+  if (Number.isNaN(value)) {
+    throw new TypeError(`"${option}" option must not be NaN`);
   }
-  return true;
+  return typeof value === "number" ? value : fallback;
 }
-var RemoteJWKSetImpl = class {
-  #url;
-  #timeoutDuration;
-  #cooldownDuration;
-  #cacheMaxAge;
-  #jwksTimestamp;
-  #pendingFetch;
-  #headers;
-  #customFetch;
-  #local;
-  #cache;
-  constructor(url2, options) {
-    if (!(url2 instanceof URL)) {
-      throw new TypeError("url must be an instance of URL");
-    }
-    this.#url = new URL(url2.href);
-    const opts = options ?? {};
-    this.#timeoutDuration = typeof opts.timeoutDuration === "number" ? opts.timeoutDuration : 5e3;
-    this.#cooldownDuration = typeof opts.cooldownDuration === "number" ? opts.cooldownDuration : 3e4;
-    this.#cacheMaxAge = typeof opts.cacheMaxAge === "number" ? opts.cacheMaxAge : 6e5;
-    this.#headers = new Headers(opts.headers);
-    if (USER_AGENT && !this.#headers.has("User-Agent")) {
-      this.#headers.set("User-Agent", USER_AGENT);
-    }
-    if (!this.#headers.has("accept")) {
-      this.#headers.set("accept", "application/json");
-      this.#headers.append("accept", "application/jwk-set+json");
-    }
-    this.#customFetch = opts[customFetch];
-    const cache2 = opts[jwksCache];
-    if (cache2 !== void 0) {
-      this.#cache = cache2;
-      if (isFreshJwksCache(cache2, this.#cacheMaxAge)) {
-        this.#jwksTimestamp = this.#cache.uat;
-        this.#local = createLocalJWKSet(this.#cache.jwks);
-      }
-    }
-  }
-  pendingFetch() {
-    return !!this.#pendingFetch;
-  }
-  #validFor(duration3) {
-    return typeof this.#jwksTimestamp === "number" && Date.now() < this.#jwksTimestamp + duration3;
-  }
-  coolingDown() {
-    return this.#validFor(this.#cooldownDuration);
-  }
-  fresh() {
-    return this.#validFor(this.#cacheMaxAge);
-  }
-  jwks() {
-    return this.#local?.jwks();
-  }
-  async getKey(protectedHeader, token) {
-    if (!this.#local || !this.fresh()) {
-      await this.reload();
+function createRemoteJWKSet(url2, options) {
+  if (!(url2 instanceof URL)) {
+    throw new TypeError("url must be an instance of URL");
+  }
+  const href = new URL(url2.href).href;
+  const opts = options ?? {};
+  const timeoutOption = opts.timeoutDuration;
+  if (typeof timeoutOption === "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0)) {
+    throw new TypeError('"timeoutDuration" option must be a non-negative integer');
+  }
+  const timeoutDuration = typeof timeoutOption === "number" ? timeoutOption : 5e3;
+  const cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration");
+  const cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge");
+  const headers = new Headers(opts.headers);
+  if (USER_AGENT && !headers.has("User-Agent")) {
+    headers.set("User-Agent", USER_AGENT);
+  }
+  if (!headers.has("accept")) {
+    headers.set("accept", "application/json, application/jwk-set+json");
+  }
+  const fetchImpl = opts[customFetch];
+  const cache2 = opts[jwksCache];
+  let jwksTimestamp;
+  let pendingFetch;
+  let reloadSequence = 0;
+  let appliedSequence = 0;
+  let local;
+  if (cache2 && typeof cache2 === "object") {
+    const { uat, jwks } = cache2;
+    if (isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks)) {
+      jwksTimestamp = uat;
+      local = createLocalJWKSet(jwks);
+    }
+  }
+  const reload = async () => {
+    if (pendingFetch && isCloudflareWorkers()) {
+      pendingFetch = void 0;
+    }
+    if (!pendingFetch) {
+      const sequence = ++reloadSequence;
+      const current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+        const next = createLocalJWKSet(json);
+        if (sequence <= appliedSequence) {
+          return;
+        }
+        local = next;
+        const updatedAt = Date.now();
+        if (cache2) {
+          cache2.uat = updatedAt;
+          cache2.jwks = json;
+        }
+        jwksTimestamp = updatedAt;
+        appliedSequence = sequence;
+      }).finally(() => {
+        if (pendingFetch === current) {
+          pendingFetch = void 0;
+        }
+      });
+    }
+    await pendingFetch;
+  };
+  const remoteJWKSet = async (protectedHeader, token) => {
+    if (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) {
+      await reload();
     }
     try {
-      return await this.#local(protectedHeader, token);
+      return await local(protectedHeader, token);
     } catch (err) {
-      if (err instanceof JWKSNoMatchingKey) {
-        if (this.coolingDown() === false) {
-          await this.reload();
-          return this.#local(protectedHeader, token);
-        }
+      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration)) {
+        await reload();
+        return local(protectedHeader, token);
       }
       throw err;
     }
-  }
-  async reload() {
-    if (this.#pendingFetch && isCloudflareWorkers()) {
-      this.#pendingFetch = void 0;
-    }
-    this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch).then((json) => {
-      this.#local = createLocalJWKSet(json);
-      if (this.#cache) {
-        this.#cache.uat = Date.now();
-        this.#cache.jwks = json;
-      }
-      this.#jwksTimestamp = Date.now();
-    }).finally(() => {
-      this.#pendingFetch = void 0;
-    });
-    await this.#pendingFetch;
-  }
-};
-function createRemoteJWKSet(url2, options) {
-  const set = new RemoteJWKSetImpl(url2, options);
-  const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-  Object.defineProperties(remoteJWKSet, {
+  };
+  return Object.defineProperties(remoteJWKSet, {
     coolingDown: {
-      get: () => set.coolingDown(),
+      get: () => isFreshFor(jwksTimestamp, cooldownDuration),
       enumerable: true
     },
     fresh: {
-      get: () => set.fresh(),
+      get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
       enumerable: true
     },
     reload: {
-      value: () => set.reload(),
+      value: reload,
       enumerable: true
     },
     reloading: {
-      get: () => set.pendingFetch(),
+      get: () => !!pendingFetch,
       enumerable: true
     },
     jwks: {
-      value: () => set.jwks(),
+      value: () => local?.jwks(),
       enumerable: true
     }
   });
-  return remoteJWKSet;
 }
 
 // node_modules/@casys/mcp-server/src/auth/provider.ts
@@ -46975,6 +47185,7 @@ var viewer = (name) => ({
   ui: { resourceUri: `ui://mcp-erpnext/${name}` }
 });
 var DOCLIST_META = viewer("doclist-viewer");
+var DOC_META = viewer("doc-viewer");
 var INVOICE_META = viewer("invoice-viewer");
 var STOCK_META = viewer("stock-viewer");
 var CHART_META = viewer("chart-viewer");
@@ -47074,6 +47285,115 @@ function stableStringify(value) {
 var DEFAULT_RETRY_STATUSES = [408, 429, 502, 503, 504];
 var DEFAULT_RETRY_METHODS = ["GET"];
 var DEFAULT_MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
+var DEFAULT_MAX_DOWNLOAD_BYTES = 10 * 1024 * 1024;
+var MAX_ERROR_BODY_BYTES = 64 * 1024;
+var ResponseBodyLimitError = class extends Error {
+  constructor(label, size, limit) {
+    super(
+      `[FrappeClient] ${label} size ${size} bytes exceeds the ${limit}-byte limit`
+    );
+    this.name = "ResponseBodyLimitError";
+  }
+};
+async function readResponseBytes(response, maxBytes, label) {
+  const declaredLength = response.headers.get("content-length")?.trim();
+  if (declaredLength && /^\d+$/.test(declaredLength)) {
+    const size = Number(declaredLength);
+    if (size > maxBytes) {
+      try {
+        await response.body?.cancel();
+      } catch {
+      }
+      throw new ResponseBodyLimitError(label, size, maxBytes);
+    }
+  }
+  if (!response.body) return new Uint8Array();
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        try {
+          await reader.cancel();
+        } catch {
+        }
+        throw new ResponseBodyLimitError(label, total, maxBytes);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
+function isUnsafeControl(character) {
+  const codePoint = character.codePointAt(0) ?? 0;
+  return codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint >= 8234 && codePoint <= 8238 || codePoint >= 8294 && codePoint <= 8297;
+}
+function validateLocalFileUrl(fileUrl, isPrivate) {
+  if (typeof fileUrl !== "string" || fileUrl.length === 0) {
+    throw new Error("[FrappeClient] File.file_url must be a non-empty string");
+  }
+  if (fileUrl !== fileUrl.trim()) {
+    throw new Error(
+      "[FrappeClient] File.file_url must not contain whitespace padding"
+    );
+  }
+  const expectedPrefix = isPrivate ? "/private/files/" : "/files/";
+  let decoded = fileUrl;
+  for (let depth = 0; depth < 5; depth++) {
+    if (Array.from(decoded).some(isUnsafeControl) || decoded.includes("\\") || decoded.includes("?") || decoded.includes("#")) {
+      throw new Error(
+        "[FrappeClient] File.file_url must be a local Frappe file path without query, fragment, NUL, or backslash"
+      );
+    }
+    if (!decoded.startsWith(expectedPrefix)) {
+      throw new Error(
+        `[FrappeClient] File.file_url does not match is_private=${isPrivate ? 1 : 0}`
+      );
+    }
+    const fileSegment = decoded.slice(expectedPrefix.length);
+    if (!fileSegment || fileSegment === "." || fileSegment === ".." || fileSegment.includes("/")) {
+      throw new Error(
+        "[FrappeClient] File.file_url must contain exactly one safe file segment"
+      );
+    }
+    let next;
+    try {
+      next = decodeURIComponent(decoded);
+    } catch {
+      throw new Error(
+        "[FrappeClient] File.file_url contains malformed percent encoding"
+      );
+    }
+    if (next === decoded) return fileUrl;
+    decoded = next;
+  }
+  throw new Error(
+    "[FrappeClient] File.file_url contains excessive nested percent encoding"
+  );
+}
+function sanitizeDownloadFileName(raw2, fileId) {
+  const fallbackId = fileId.replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 80) || "file";
+  if (typeof raw2 !== "string") return `erpnext-${fallbackId}`;
+  const normalized = Array.from(raw2.normalize("NFC")).filter((character) => !isUnsafeControl(character)).join("").replace(/[\\/:*?"<>|]/g, "_").trim().replace(/[. ]+$/g, "");
+  const bounded = Array.from(normalized).slice(0, 255).join("");
+  return !bounded || bounded === "." || bounded === ".." ? `erpnext-${fallbackId}` : bounded;
+}
+function normalizeMimeType(raw2) {
+  const candidate = (raw2 ?? "").split(";", 1)[0].trim().toLowerCase();
+  return /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/i.test(candidate) && candidate !== "application/unknown" ? candidate : "application/octet-stream";
+}
 function decodeBase64File(contentBase64, maxBytes) {
   if (contentBase64.length === 0) {
     throw new Error("[FrappeClient] File content must not be empty");
@@ -47159,6 +47479,7 @@ var FrappeClient = class {
   authHeader;
   timeoutMs;
   maxUploadBytes;
+  maxDownloadBytes;
   retries;
   retryStatuses;
   retryBackoffMs;
@@ -47174,6 +47495,12 @@ var FrappeClient = class {
         "[FrappeClient] maxUploadBytes must be a positive integer"
       );
     }
+    this.maxDownloadBytes = config2.maxDownloadBytes ?? DEFAULT_MAX_DOWNLOAD_BYTES;
+    if (!Number.isInteger(this.maxDownloadBytes) || this.maxDownloadBytes <= 0) {
+      throw new Error(
+        "[FrappeClient] maxDownloadBytes must be a positive integer"
+      );
+    }
     this.retries = config2.retries ?? 3;
     this.retryStatuses = config2.retryStatuses ?? DEFAULT_RETRY_STATUSES;
     this.retryBackoffMs = config2.retryBackoffMs ?? 200;
@@ -47288,6 +47615,152 @@ var FrappeClient = class {
     }
     return responseBody;
   }
+  buildSameOriginUrl(path) {
+    if (!path.startsWith("/")) {
+      throw new Error("[FrappeClient] Download path must be root-relative");
+    }
+    let base;
+    let target;
+    try {
+      base = new URL(this.baseUrl);
+      target = new URL(`${this.baseUrl}${path}`);
+    } catch {
+      throw new Error("[FrappeClient] baseUrl must be a valid absolute URL");
+    }
+    if (target.origin !== base.origin) {
+      throw new Error("[FrappeClient] Refusing a cross-origin download");
+    }
+    return target.href;
+  }
+  async requestBinary(path) {
+    let lastError;
+    for (let attempt = 0; attempt <= this.retries; attempt++) {
+      try {
+        return await this.requestBinaryOnce(path);
+      } catch (err) {
+        lastError = err;
+        if (attempt === this.retries || !this.isRetryable(err, "GET")) {
+          throw err;
+        }
+        const delay = this.computeBackoff(attempt, err);
+        if (delay > 0) {
+          await new Promise((resolve) => setTimeout(resolve, delay));
+        }
+      }
+    }
+    throw lastError;
+  }
+  async requestBinaryOnce(path) {
+    const url2 = this.buildSameOriginUrl(path);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let response;
+    try {
+      response = await fetch(url2, {
+        method: "GET",
+        headers: {
+          "Authorization": this.authHeader,
+          "Accept": "*/*",
+          "Cache-Control": "no-store"
+        },
+        cache: "no-store",
+        redirect: "manual",
+        signal: controller.signal
+      });
+    } catch (err) {
+      clearTimeout(timer);
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new FrappeAPIError(
+          `Request timed out after ${this.timeoutMs}ms: GET ${path}`,
+          408,
+          null
+        );
+      }
+      throw new FrappeAPIError(
+        `Network error on GET ${path}: ${err.message}`,
+        0,
+        null
+      );
+    }
+    try {
+      if (response.redirected || response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) {
+        try {
+          await response.body?.cancel();
+        } catch {
+        }
+        throw new FrappeAPIError(
+          `GET ${path} refused an HTTP redirect`,
+          response.status,
+          null
+        );
+      }
+      if (!response.ok) {
+        let rawText;
+        try {
+          const errorBytes = await readResponseBytes(
+            response,
+            MAX_ERROR_BODY_BYTES,
+            "Error response body"
+          );
+          rawText = new TextDecoder().decode(errorBytes);
+        } catch (err) {
+          if (!(err instanceof ResponseBodyLimitError)) throw err;
+          rawText = err.message;
+        }
+        const contentType = response.headers.get("content-type") ?? "";
+        let responseBody = rawText;
+        if (contentType.includes("application/json") && rawText.length > 0) {
+          try {
+            responseBody = JSON.parse(rawText);
+          } catch {
+            responseBody = rawText;
+          }
+        }
+        let message2 = response.statusText;
+        if (typeof responseBody === "object" && responseBody !== null) {
+          const body = responseBody;
+          const baseMessage = body.message ?? body.exc_type ?? response.statusText;
+          const serverDetails = extractServerMessages(body._server_messages);
+          message2 = serverDetails ? `${baseMessage}: ${serverDetails}` : baseMessage;
+        } else if (typeof responseBody === "string" && responseBody.length > 0) {
+          message2 = responseBody.slice(0, 200);
+        }
+        throw new FrappeAPIError(
+          `GET ${path} failed: ${message2}`,
+          response.status,
+          responseBody,
+          parseRetryAfter(response.headers.get("retry-after"))
+        );
+      }
+      const bytes = await readResponseBytes(
+        response,
+        this.maxDownloadBytes,
+        "Downloaded file"
+      );
+      return {
+        bytes,
+        mimeType: normalizeMimeType(response.headers.get("content-type"))
+      };
+    } catch (err) {
+      if (err instanceof FrappeAPIError || err instanceof ResponseBodyLimitError) {
+        throw err;
+      }
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new FrappeAPIError(
+          `Request timed out after ${this.timeoutMs}ms: GET ${path}`,
+          408,
+          null
+        );
+      }
+      throw new FrappeAPIError(
+        `Network error while reading GET ${path}: ${err.message}`,
+        0,
+        null
+      );
+    } finally {
+      clearTimeout(timer);
+    }
+  }
   // ── Resource CRUD ───────────────────────────────────────────────────────────
   /**
    * List documents of a DocType.
@@ -47409,6 +47882,73 @@ var FrappeClient = class {
     );
     this.invalidate(doctype, name);
   }
+  /**
+   * Download one File row through Frappe's authenticated download handler.
+   *
+   * The caller supplies the expected attachment owner as a confused-deputy
+   * guard. The File row is fetched fresh, its local path is validated, and the
+   * response stream is stopped as soon as it exceeds `maxDownloadBytes`.
+   */
+  async downloadFile(input) {
+    const fileId = input.fileId.trim();
+    const attachedToDoctype = input.attachedToDoctype.trim();
+    const attachedToName = input.attachedToName.trim();
+    if (!fileId) {
+      throw new Error("[FrappeClient] fileId must not be empty");
+    }
+    if (!attachedToDoctype) {
+      throw new Error("[FrappeClient] attachedToDoctype must not be empty");
+    }
+    if (!attachedToName) {
+      throw new Error("[FrappeClient] attachedToName must not be empty");
+    }
+    const metadata = await this.request(
+      "GET",
+      `/api/resource/File/${encodeURIComponent(fileId)}`
+    );
+    const file = metadata.data;
+    if (file.name !== fileId) {
+      throw new Error("[FrappeClient] File response identity mismatch");
+    }
+    if (file.attached_to_doctype !== attachedToDoctype || file.attached_to_name !== attachedToName) {
+      throw new Error(
+        "[FrappeClient] File is not attached to the requested document"
+      );
+    }
+    if (file.is_private !== 0 && file.is_private !== 1) {
+      throw new Error("[FrappeClient] File.is_private must be 0 or 1");
+    }
+    const fileUrl = validateLocalFileUrl(
+      file.file_url,
+      file.is_private === 1
+    );
+    const fileSize = file.file_size;
+    if (fileSize !== void 0 && fileSize !== null) {
+      if (typeof fileSize !== "number" || !Number.isInteger(fileSize) || fileSize < 0) {
+        throw new Error(
+          "[FrappeClient] File.file_size must be a non-negative integer"
+        );
+      }
+      if (fileSize > this.maxDownloadBytes) {
+        throw new ResponseBodyLimitError(
+          "File metadata",
+          fileSize,
+          this.maxDownloadBytes
+        );
+      }
+    }
+    const params = new URLSearchParams({ file_url: fileUrl });
+    const download = await this.requestBinary(
+      `/api/method/frappe.handler.download_file?${params.toString()}`
+    );
+    return {
+      fileId,
+      fileName: sanitizeDownloadFileName(file.file_name, fileId),
+      mimeType: download.mimeType,
+      bytes: download.bytes,
+      isPrivate: file.is_private === 1
+    };
+  }
   /**
    * Upload file bytes and attach the native File document to another document.
    * POST /api/method/upload_file
@@ -47479,6 +48019,7 @@ function getFrappeClient() {
   const apiKey = env6("ERPNEXT_API_KEY");
   const apiSecret = env6("ERPNEXT_API_SECRET");
   const maxUploadBytesRaw = env6("ERPNEXT_MAX_UPLOAD_BYTES");
+  const maxDownloadBytesRaw = env6("ERPNEXT_MAX_DOWNLOAD_BYTES");
   if (!url2) {
     throw new Error(
       "[lib/erpnext] ERPNEXT_URL is required. Set it to your ERPNext instance URL, e.g. http://localhost:8000"
@@ -47494,7 +48035,8 @@ function getFrappeClient() {
     apiKey,
     apiSecret,
     cache: getCache(),
-    maxUploadBytes: maxUploadBytesRaw?.trim() ? Number(maxUploadBytesRaw) : void 0
+    maxUploadBytes: maxUploadBytesRaw?.trim() ? Number(maxUploadBytesRaw) : void 0,
+    maxDownloadBytes: maxDownloadBytesRaw?.trim() ? Number(maxDownloadBytesRaw) : void 0
   });
   return _client;
 }
@@ -47626,6 +48168,14 @@ function roundedTotalFallbackWarning(original, patched) {
 }
 
 // src/tools/sales.ts
+function viewerDocument(value, doctype, name) {
+  const record2 = typeof value === "object" && value !== null ? value : {};
+  return {
+    ...record2,
+    ...typeof record2.name === "string" || !name ? {} : { name },
+    doctype
+  };
+}
 function mapLineItems(items, options) {
   if (!Array.isArray(items) || items.length === 0) {
     throw new Error(
@@ -47711,6 +48261,7 @@ var salesTools = [
   {
     name: "erpnext_customer_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single ERPNext customer by name (ID). Returns all fields including contact details.",
     category: "sales",
     inputSchema: {
@@ -47725,7 +48276,7 @@ var salesTools = [
         throw new Error("[erpnext_customer_get] 'name' is required");
       }
       const doc = await ctx.client.get("Customer", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Customer" } };
     }
   },
   {
@@ -47906,7 +48457,7 @@ var salesTools = [
         throw new Error("[erpnext_sales_order_get] 'name' is required");
       }
       const doc = await ctx.client.get("Sales Order", input.name);
-      return { data: doc };
+      return { data: viewerDocument(doc, "Sales Order", input.name) };
     }
   },
   {
@@ -47987,8 +48538,12 @@ var salesTools = [
       }
       const doc = await ctx.client.create("Sales Order", data);
       return {
-        data: doc,
-        message: `Sales Order ${doc.name} created successfully`
+        data: viewerDocument(doc, "Sales Order"),
+        message: `Sales Order ${doc.name} created successfully`,
+        refreshRequest: {
+          toolName: "erpnext_sales_order_get",
+          arguments: { name: doc.name }
+        }
       };
     }
   },
@@ -48078,8 +48633,16 @@ var salesTools = [
       ctx.client.invalidate("Sales Order", input.name);
       const warnings = roundedTotalFallbackWarning(docWithDoctype, patchedDoc);
       return {
-        data: result,
+        data: viewerDocument(
+          result,
+          "Sales Order",
+          input.name
+        ),
         message: `Sales Order ${input.name} submitted successfully`,
+        refreshRequest: {
+          toolName: "erpnext_sales_order_get",
+          arguments: { name: input.name }
+        },
         ...warnings.length > 0 ? { warnings } : {}
       };
     }
@@ -48205,7 +48768,11 @@ var salesTools = [
       }
       const doc = await ctx.client.get("Sales Invoice", input.name);
       return {
-        data: doc,
+        data: viewerDocument(
+          doc,
+          "Sales Invoice",
+          input.name
+        ),
         _meta: INVOICE_META
       };
     }
@@ -48291,9 +48858,13 @@ var salesTools = [
       }
       const doc = await ctx.client.create("Sales Invoice", data);
       return {
-        data: doc,
+        data: viewerDocument(doc, "Sales Invoice"),
         message: `Sales Invoice ${doc.name} created successfully`,
-        _meta: INVOICE_META
+        _meta: INVOICE_META,
+        refreshRequest: {
+          toolName: "erpnext_sales_invoice_get",
+          arguments: { name: doc.name }
+        }
       };
     }
   },
@@ -48327,9 +48898,17 @@ var salesTools = [
       ctx.client.invalidate("Sales Invoice", input.name);
       const warnings = roundedTotalFallbackWarning(docWithDoctype, patchedDoc);
       return {
-        data: result,
+        data: viewerDocument(
+          result,
+          "Sales Invoice",
+          input.name
+        ),
         message: `Sales Invoice ${input.name} submitted successfully`,
         _meta: INVOICE_META,
+        refreshRequest: {
+          toolName: "erpnext_sales_invoice_get",
+          arguments: { name: input.name }
+        },
         ...warnings.length > 0 ? { warnings } : {}
       };
     }
@@ -48435,7 +49014,7 @@ var salesTools = [
         throw new Error("[erpnext_quotation_get] 'name' is required");
       }
       const doc = await ctx.client.get("Quotation", input.name);
-      return { data: doc };
+      return { data: viewerDocument(doc, "Quotation", input.name) };
     }
   },
   {
@@ -48529,8 +49108,12 @@ var salesTools = [
       }
       const doc = await ctx.client.create("Quotation", data);
       return {
-        data: doc,
-        message: `Quotation ${doc.name} created successfully`
+        data: viewerDocument(doc, "Quotation"),
+        message: `Quotation ${doc.name} created successfully`,
+        refreshRequest: {
+          toolName: "erpnext_quotation_get",
+          arguments: { name: doc.name }
+        }
       };
     }
   }
@@ -48601,6 +49184,7 @@ var inventoryTools = [
   {
     name: "erpnext_item_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single ERPNext Item by name/item_code. Returns all fields including pricing and stock details.",
     category: "inventory",
     inputSchema: {
@@ -48615,7 +49199,7 @@ var inventoryTools = [
         throw new Error("[erpnext_item_get] 'name' is required");
       }
       const doc = await ctx.client.get("Item", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Item" } };
     }
   },
   {
@@ -48816,12 +49400,16 @@ var inventoryTools = [
     name: "erpnext_stock_entry_list",
     annotations: { readOnlyHint: true },
     _meta: DOCLIST_META,
-    description: "List Stock Entries (material transfers, receipts, issues). Fields: name, stock_entry_type, posting_date, from_warehouse, to_warehouse, total_amount. Filterable by stock_entry_type, date range.",
+    description: "List Stock Entries (material transfers, receipts, issues). Fields: name, stock_entry_type, posting_date, from_warehouse, to_warehouse, total_amount. Filterable by item_code, stock_entry_type, date range.",
     category: "inventory",
     inputSchema: {
       type: "object",
       properties: {
         limit: { type: "number", description: "Max results (default 20)" },
+        item_code: {
+          type: "string",
+          description: "Exact item code present in a Stock Entry line"
+        },
         stock_entry_type: {
           type: "string",
           description: "Filter by type (Material Issue, Material Receipt, Material Transfer, etc.)"
@@ -48836,6 +49424,14 @@ var inventoryTools = [
     handler: async (input, ctx) => {
       const limit = input.limit ?? 20;
       const filters = [];
+      if (input.item_code) {
+        filters.push([
+          "Stock Entry Detail",
+          "item_code",
+          "=",
+          input.item_code
+        ]);
+      }
       if (input.stock_entry_type) {
         filters.push([
           "stock_entry_type",
@@ -48873,6 +49469,7 @@ var inventoryTools = [
   {
     name: "erpnext_stock_entry_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Stock Entry by name. Returns full document with item details.",
     category: "inventory",
     inputSchema: {
@@ -48890,7 +49487,7 @@ var inventoryTools = [
         throw new Error("[erpnext_stock_entry_get] 'name' is required");
       }
       const doc = await ctx.client.get("Stock Entry", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Stock Entry" } };
     }
   },
   {
@@ -49085,6 +49682,7 @@ var accountingTools = [
   {
     name: "erpnext_journal_entry_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Journal Entry by name (e.g. JV-00001). Returns full document with accounts.",
     category: "accounting",
     inputSchema: {
@@ -49102,7 +49700,7 @@ var accountingTools = [
         throw new Error("[erpnext_journal_entry_get] 'name' is required");
       }
       const doc = await ctx.client.get("Journal Entry", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Journal Entry" } };
     }
   },
   // ── Payment Entries ───────────────────────────────────────────────────────
@@ -49190,6 +49788,7 @@ var accountingTools = [
   {
     name: "erpnext_payment_entry_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Payment Entry by name (e.g. PE-00001). Returns full document including references.",
     category: "accounting",
     inputSchema: {
@@ -49207,7 +49806,7 @@ var accountingTools = [
         throw new Error("[erpnext_payment_entry_get] 'name' is required");
       }
       const doc = await ctx.client.get("Payment Entry", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Payment Entry" } };
     }
   },
   {
@@ -49333,6 +49932,7 @@ var hrTools = [
   {
     name: "erpnext_employee_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Employee by name/ID (e.g. HR-EMP-00001). Returns all fields.",
     category: "hr",
     inputSchema: {
@@ -49357,7 +49957,7 @@ var hrTools = [
         { allowPartialMatch: false, inputPath: "name" }
       );
       const doc = await ctx.client.get("Employee", employeeId);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Employee" } };
     }
   },
   // ── Attendance ────────────────────────────────────────────────────────────
@@ -49508,6 +50108,7 @@ var hrTools = [
   {
     name: "erpnext_leave_application_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Leave Application by name. Returns full document.",
     category: "hr",
     inputSchema: {
@@ -49525,7 +50126,7 @@ var hrTools = [
         "Leave Application",
         input.name
       );
-      return { data: doc };
+      return { data: { ...doc, doctype: "Leave Application" } };
     }
   },
   {
@@ -49671,6 +50272,7 @@ var hrTools = [
   {
     name: "erpnext_salary_slip_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Salary Slip by name/ID. Returns all fields including earnings and deductions.",
     category: "hr",
     inputSchema: {
@@ -49688,7 +50290,7 @@ var hrTools = [
         throw new Error("[erpnext_salary_slip_get] 'name' is required");
       }
       const doc = await ctx.client.get("Salary Slip", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Salary Slip" } };
     }
   },
   // ── Payroll Entries ───────────────────────────────────────────────────────
@@ -50179,6 +50781,7 @@ var projectTools = [
   {
     name: "erpnext_project_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Project by name. Returns full document including tasks summary.",
     category: "project",
     inputSchema: {
@@ -50193,7 +50796,7 @@ var projectTools = [
         throw new Error("[erpnext_project_get] 'name' is required");
       }
       const doc = await ctx.client.get("Project", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Project" } };
     }
   },
   // ── Tasks ─────────────────────────────────────────────────────────────────
@@ -50358,6 +50961,7 @@ var projectTools = [
   {
     name: "erpnext_task_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Task by name. Returns full document including description and dependencies.",
     category: "project",
     inputSchema: {
@@ -50372,7 +50976,7 @@ var projectTools = [
         throw new Error("[erpnext_task_get] 'name' is required");
       }
       const doc = await ctx.client.get("Task", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Task" } };
     }
   },
   {
@@ -50548,6 +51152,7 @@ var projectTools = [
   {
     name: "erpnext_timesheet_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Timesheet by name. Returns full document with time log details.",
     category: "project",
     inputSchema: {
@@ -50562,7 +51167,7 @@ var projectTools = [
         throw new Error("[erpnext_timesheet_get] 'name' is required");
       }
       const doc = await ctx.client.get("Timesheet", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Timesheet" } };
     }
   },
   {
@@ -50684,6 +51289,7 @@ var purchasingTools = [
   {
     name: "erpnext_supplier_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single ERPNext supplier by name (ID). Returns all fields including contact details.",
     category: "purchasing",
     inputSchema: {
@@ -50698,7 +51304,7 @@ var purchasingTools = [
         throw new Error("[erpnext_supplier_get] 'name' is required");
       }
       const doc = await ctx.client.get("Supplier", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Supplier" } };
     }
   },
   {
@@ -50827,6 +51433,7 @@ var purchasingTools = [
   {
     name: "erpnext_purchase_order_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Purchase Order by name (e.g. PO-00001). Returns full document with line items.",
     category: "purchasing",
     inputSchema: {
@@ -50844,7 +51451,7 @@ var purchasingTools = [
         throw new Error("[erpnext_purchase_order_get] 'name' is required");
       }
       const doc = await ctx.client.get("Purchase Order", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Purchase Order" } };
     }
   },
   {
@@ -50995,6 +51602,7 @@ var purchasingTools = [
   {
     name: "erpnext_purchase_invoice_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Purchase Invoice by name (e.g. PINV-00001). Returns full document with line items.",
     category: "purchasing",
     inputSchema: {
@@ -51015,7 +51623,7 @@ var purchasingTools = [
         "Purchase Invoice",
         input.name
       );
-      return { data: doc };
+      return { data: { ...doc, doctype: "Purchase Invoice" } };
     }
   },
   // ── Purchase Receipts ─────────────────────────────────────────────────────
@@ -51089,6 +51697,7 @@ var purchasingTools = [
   {
     name: "erpnext_purchase_receipt_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Purchase Receipt by name (e.g. MAT-PRE-00001). Returns full document with received items.",
     category: "purchasing",
     inputSchema: {
@@ -51109,7 +51718,7 @@ var purchasingTools = [
         "Purchase Receipt",
         input.name
       );
-      return { data: doc };
+      return { data: { ...doc, doctype: "Purchase Receipt" } };
     }
   },
   // ── Supplier Quotations ───────────────────────────────────────────────────
@@ -51254,6 +51863,7 @@ var deliveryTools = [
   {
     name: "erpnext_delivery_note_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Delivery Note by name (e.g. MAT-DN-00001). Returns full document with delivered items.",
     category: "delivery",
     inputSchema: {
@@ -51271,7 +51881,7 @@ var deliveryTools = [
         throw new Error("[erpnext_delivery_note_get] 'name' is required");
       }
       const doc = await ctx.client.get("Delivery Note", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Delivery Note" } };
     }
   },
   {
@@ -51404,6 +52014,7 @@ var deliveryTools = [
   {
     name: "erpnext_shipment_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Shipment by name. Returns full shipment details including parcels.",
     category: "delivery",
     inputSchema: {
@@ -51418,7 +52029,7 @@ var deliveryTools = [
         throw new Error("[erpnext_shipment_get] 'name' is required");
       }
       const doc = await ctx.client.get("Shipment", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Shipment" } };
     }
   }
 ];
@@ -51498,6 +52109,7 @@ var manufacturingTools = [
   {
     name: "erpnext_bom_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single BOM by name (e.g. BOM-ITEM-00001). Returns full document with raw materials and operations.",
     category: "manufacturing",
     inputSchema: {
@@ -51512,7 +52124,7 @@ var manufacturingTools = [
         throw new Error("[erpnext_bom_get] 'name' is required");
       }
       const doc = await ctx.client.get("BOM", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "BOM" } };
     }
   },
   // ── Work Orders ───────────────────────────────────────────────────────────
@@ -51590,6 +52202,7 @@ var manufacturingTools = [
   {
     name: "erpnext_work_order_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Work Order by name (e.g. MFG-WO-00001). Returns full document with operations and materials.",
     category: "manufacturing",
     inputSchema: {
@@ -51607,7 +52220,7 @@ var manufacturingTools = [
         throw new Error("[erpnext_work_order_get] 'name' is required");
       }
       const doc = await ctx.client.get("Work Order", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Work Order" } };
     }
   },
   {
@@ -51723,6 +52336,7 @@ var manufacturingTools = [
   {
     name: "erpnext_job_card_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Job Card by name. Returns full document with time logs and material transfers.",
     category: "manufacturing",
     inputSchema: {
@@ -51737,7 +52351,7 @@ var manufacturingTools = [
         throw new Error("[erpnext_job_card_get] 'name' is required");
       }
       const doc = await ctx.client.get("Job Card", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Job Card" } };
     }
   }
 ];
@@ -51799,6 +52413,7 @@ var crmTools = [
   {
     name: "erpnext_lead_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single CRM Lead by name. Returns all lead details including contact info.",
     category: "crm",
     inputSchema: {
@@ -51813,7 +52428,7 @@ var crmTools = [
         throw new Error("[erpnext_lead_get] 'name' is required");
       }
       const doc = await ctx.client.get("Lead", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Lead" } };
     }
   },
   {
@@ -51945,6 +52560,7 @@ var crmTools = [
   {
     name: "erpnext_opportunity_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single CRM Opportunity by name. Returns full details including items and competitors.",
     category: "crm",
     inputSchema: {
@@ -51959,7 +52575,7 @@ var crmTools = [
         throw new Error("[erpnext_opportunity_get] 'name' is required");
       }
       const doc = await ctx.client.get("Opportunity", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Opportunity" } };
     }
   },
   // ── Contacts ──────────────────────────────────────────────────────────────
@@ -52014,6 +52630,7 @@ var crmTools = [
   {
     name: "erpnext_contact_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Contact by name. Returns all contact details.",
     category: "crm",
     inputSchema: {
@@ -52028,7 +52645,7 @@ var crmTools = [
         throw new Error("[erpnext_contact_get] 'name' is required");
       }
       const doc = await ctx.client.get("Contact", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Contact" } };
     }
   },
   // ── Campaigns ─────────────────────────────────────────────────────────────
@@ -52178,6 +52795,7 @@ var assetsTools = [
   {
     name: "erpnext_asset_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Asset by name. Returns full details including depreciation schedule and maintenance logs.",
     category: "assets",
     inputSchema: {
@@ -52192,7 +52810,7 @@ var assetsTools = [
         throw new Error("[erpnext_asset_get] 'name' is required");
       }
       const doc = await ctx.client.get("Asset", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Asset" } };
     }
   },
   {
@@ -52328,6 +52946,7 @@ var assetsTools = [
   {
     name: "erpnext_asset_movement_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Asset Movement by name. Returns full details including assets moved.",
     category: "assets",
     inputSchema: {
@@ -52342,7 +52961,7 @@ var assetsTools = [
         throw new Error("[erpnext_asset_movement_get] 'name' is required");
       }
       const doc = await ctx.client.get("Asset Movement", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Asset Movement" } };
     }
   },
   // ── Asset Maintenance ─────────────────────────────────────────────────────
@@ -52399,6 +53018,7 @@ var assetsTools = [
   {
     name: "erpnext_asset_maintenance_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Asset Maintenance record by name. Returns full details including maintenance tasks.",
     category: "assets",
     inputSchema: {
@@ -52416,7 +53036,7 @@ var assetsTools = [
         "Asset Maintenance",
         input.name
       );
-      return { data: doc };
+      return { data: { ...doc, doctype: "Asset Maintenance" } };
     }
   },
   // ── Asset Categories ──────────────────────────────────────────────────────
@@ -52451,8 +53071,161 @@ var assetsTools = [
 ];
 
 // src/tools/operations.ts
+function bytesToBase64(bytes) {
+  const chunkSize = 32 * 1024;
+  let binary = "";
+  for (let offset = 0; offset < bytes.byteLength; offset += chunkSize) {
+    binary += String.fromCharCode(
+      ...bytes.subarray(offset, Math.min(offset + chunkSize, bytes.byteLength))
+    );
+  }
+  return btoa(binary);
+}
 var operationsTools = [
   // ── File Attachments ───────────────────────────────────────────────────────
+  {
+    name: "erpnext_file_list",
+    annotations: { readOnlyHint: true },
+    description: "List the files attached to an ERPNext document. Returns name, size, privacy and URL for each attachment. Pairs with erpnext_file_upload: that one attaches, this one reads back.",
+    category: "operations",
+    inputSchema: {
+      type: "object",
+      properties: {
+        attached_to_doctype: {
+          type: "string",
+          description: "DocType of the document whose attachments to list.",
+          minLength: 1
+        },
+        attached_to_name: {
+          type: "string",
+          description: "Name/ID of the document whose attachments to list.",
+          minLength: 1
+        },
+        limit: {
+          type: "number",
+          description: "Maximum number of files to return. Defaults to 50.",
+          minimum: 1,
+          maximum: 500
+        }
+      },
+      required: ["attached_to_doctype", "attached_to_name"]
+    },
+    handler: async (input, ctx) => {
+      for (const field of ["attached_to_doctype", "attached_to_name"]) {
+        if (typeof input[field] !== "string" || !input[field].trim()) {
+          throw new Error(
+            `[erpnext_file_list] '${field}' must be a non-empty string`
+          );
+        }
+      }
+      if (input.limit !== void 0 && (typeof input.limit !== "number" || !Number.isInteger(input.limit) || input.limit < 1 || input.limit > 500)) {
+        throw new Error(
+          "[erpnext_file_list] 'limit' must be an integer between 1 and 500"
+        );
+      }
+      const files = await ctx.client.list("File", {
+        fields: [
+          "name",
+          "file_name",
+          "file_url",
+          "file_size",
+          "is_private",
+          "attached_to_field",
+          "creation",
+          "modified",
+          "owner"
+        ],
+        filters: [
+          ["attached_to_doctype", "=", input.attached_to_doctype],
+          ["attached_to_name", "=", input.attached_to_name]
+        ],
+        order_by: "creation desc",
+        limit: input.limit ?? 50
+      });
+      return {
+        count: files.length,
+        data: files.map((file) => ({
+          name: file.name,
+          file_name: file.file_name,
+          file_url: file.file_url,
+          file_size: file.file_size ?? null,
+          is_private: file.is_private === 1,
+          attached_to_field: file.attached_to_field ?? null,
+          creation: file.creation,
+          modified: file.modified,
+          owner: file.owner
+        }))
+      };
+    }
+  },
+  {
+    name: "erpnext_file_download",
+    annotations: { readOnlyHint: true },
+    _meta: {
+      ui: {
+        resourceUri: DOC_META.ui.resourceUri,
+        visibility: ["app"]
+      }
+    },
+    description: "Download one ERPNext attachment for the document viewer. The tool accepts a File ID, verifies its document attachment, and returns one embedded binary resource.",
+    category: "operations",
+    inputSchema: {
+      type: "object",
+      properties: {
+        file_id: {
+          type: "string",
+          description: "Native ERPNext File.name identifier, never a URL.",
+          minLength: 1
+        },
+        attached_to_doctype: {
+          type: "string",
+          description: "Expected parent document DocType.",
+          minLength: 1
+        },
+        attached_to_name: {
+          type: "string",
+          description: "Expected parent document name/ID.",
+          minLength: 1
+        }
+      },
+      required: ["file_id", "attached_to_doctype", "attached_to_name"],
+      additionalProperties: false
+    },
+    handler: async (input, ctx) => {
+      for (const field of [
+        "file_id",
+        "attached_to_doctype",
+        "attached_to_name"
+      ]) {
+        if (typeof input[field] !== "string" || !input[field].trim()) {
+          throw new Error(
+            `[erpnext_file_download] '${field}' must be a non-empty string`
+          );
+        }
+      }
+      const file = await ctx.client.downloadFile({
+        fileId: input.file_id.trim(),
+        attachedToDoctype: input.attached_to_doctype.trim(),
+        attachedToName: input.attached_to_name.trim()
+      });
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Prepared ${file.fileName} for download (${file.bytes.byteLength} bytes).`
+          },
+          {
+            type: "resource",
+            resource: {
+              uri: `file:///${encodeURIComponent(file.fileName)}`,
+              mimeType: file.mimeType,
+              blob: bytesToBase64(file.bytes)
+            }
+          }
+        ]
+      };
+    }
+  },
   {
     name: "erpnext_file_upload",
     annotations: { destructiveHint: true },
@@ -52754,6 +53527,7 @@ var operationsTools = [
   {
     name: "erpnext_doc_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get any ERPNext document by DocType and name. Useful for DocTypes not covered by dedicated tools. Returns the full document with all fields.",
     category: "operations",
     inputSchema: {
@@ -52771,17 +53545,18 @@ var operationsTools = [
       required: ["doctype", "name"]
     },
     handler: async (input, ctx) => {
-      if (!input.doctype) {
+      if (typeof input.doctype !== "string" || !input.doctype.trim()) {
         throw new Error("[erpnext_doc_get] 'doctype' is required");
       }
-      if (!input.name) {
+      if (typeof input.name !== "string" || !input.name.trim()) {
         throw new Error("[erpnext_doc_get] 'name' is required");
       }
+      const doctype = input.doctype.trim();
       const doc = await ctx.client.get(
-        input.doctype,
-        input.name
+        doctype,
+        input.name.trim()
       );
-      return { data: doc };
+      return { data: { ...doc, doctype } };
     }
   },
   // ── Generic List ──────────────────────────────────────────────────────────
@@ -52805,10 +53580,52 @@ var operationsTools = [
         },
         filters: {
           type: "array",
-          description: 'Frappe filters as array of [fieldname, operator, value] tuples. Example: [["status","=","Open"],["company","=","Acme"]]',
+          description: 'Frappe filters as array of [fieldname, operator, value] tuples, or [child doctype, fieldname, operator, value] to filter on a child table. Values may be strings, numbers, booleans, null, or string/number arrays for in/not in. Example: [["status","=","Open"],["company","=","Acme"]]',
           items: {
             type: "array",
-            items: { type: "string" }
+            anyOf: [
+              {
+                prefixItems: [
+                  { type: "string", minLength: 1 },
+                  { type: "string", minLength: 1 },
+                  {
+                    oneOf: [
+                      { type: ["string", "number", "boolean", "null"] },
+                      {
+                        type: "array",
+                        items: { type: ["string", "number"] }
+                      }
+                    ]
+                  }
+                ],
+                minItems: 3,
+                maxItems: 3
+              },
+              {
+                prefixItems: [
+                  { type: "string", minLength: 1 },
+                  { type: "string", minLength: 1 },
+                  { type: "string", minLength: 1 },
+                  {
+                    oneOf: [
+                      { type: ["string", "number", "boolean", "null"] },
+                      {
+                        type: "array",
+                        items: { type: ["string", "number"] }
+                      }
+                    ]
+                  }
+                ],
+                minItems: 4,
+                maxItems: 4
+              },
+              {
+                // 3.0.x advertised arbitrary string arrays. Keep accepting
+                // that legacy surface while describing real 3/4-part Frappe
+                // tuples precisely for modern clients.
+                items: { type: "string" }
+              }
+            ]
           }
         },
         limit: { type: "number", description: "Max results (default 20)" },
@@ -53215,7 +54032,6 @@ var analyticsTools = [
         const invoices2 = await ctx.client.list("Sales Invoice", {
           fields: ["name", "status", "grand_total"],
           filters: [["docstatus", "!=", 2]],
-          // exclude cancelled
           limit: 500,
           order_by: "modified desc"
         });
@@ -53551,6 +54367,7 @@ var analyticsTools = [
             color: "#fbbf24",
             type: "line",
             yAxisId: "right",
+            unit: "orders",
             showDots: true
           }
         ],
@@ -54006,7 +54823,9 @@ var analyticsTools = [
     category: "analytics",
     inputSchema: { type: "object", properties: {} },
     handler: async (_input, ctx) => {
-      const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+      const now = /* @__PURE__ */ new Date();
+      const pad = (n) => String(n).padStart(2, "0");
+      const today = `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`;
       const invoices = await ctx.client.list("Sales Invoice", {
         fields: ["outstanding_amount", "due_date"],
         filters: [
@@ -55616,46 +56435,190 @@ var DOCTYPE_GET_TOOLS = {
 };
 var DOCTYPE_SEND_MESSAGE_HINTS = {
   "Customer": [
-    { label: "Orders", message: "Show sales orders for customer {id}" },
-    { label: "Invoices", message: "Show sales invoices for customer {id}" }
+    {
+      key: "orders",
+      label: "Orders",
+      message: "Show sales orders for customer {id}",
+      tool: "erpnext_sales_order_list",
+      args: { customer: "{id}", limit: 20 }
+    },
+    {
+      key: "invoices",
+      label: "Invoices",
+      message: "Show sales invoices for customer {id}",
+      tool: "erpnext_sales_invoice_list",
+      args: { customer: "{id}", limit: 20 }
+    }
   ],
   "Sales Order": [
-    { label: "Invoice", message: "Show invoices linked to sales order {id}" },
-    { label: "Delivery", message: "Show delivery notes for sales order {id}" }
+    {
+      key: "invoice",
+      label: "Invoice",
+      message: "Show invoices linked to sales order {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Sales Invoice",
+        fields: ["name", "customer", "posting_date", "status", "grand_total"],
+        filters: [["Sales Invoice Item", "sales_order", "=", "{id}"]],
+        limit: 20
+      }
+    },
+    {
+      key: "delivery",
+      label: "Delivery",
+      message: "Show delivery notes for sales order {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Delivery Note",
+        fields: ["name", "customer", "posting_date", "status"],
+        filters: [["Delivery Note Item", "against_sales_order", "=", "{id}"]],
+        limit: 20
+      }
+    }
   ],
   "Sales Invoice": [
-    { label: "Payments", message: "Show payment entries for invoice {id}" }
+    {
+      key: "payments",
+      label: "Payments",
+      message: "Show payment entries for invoice {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Payment Entry",
+        fields: [
+          "name",
+          "posting_date",
+          "paid_amount",
+          "mode_of_payment",
+          "docstatus"
+        ],
+        filters: [["Payment Entry Reference", "reference_name", "=", "{id}"]],
+        limit: 20
+      }
+    }
   ],
   "Item": [
-    { label: "Stock", message: "Show stock balance for item {id}" },
-    { label: "Orders", message: "Show sales orders containing item {id}" }
+    {
+      key: "stock",
+      label: "Stock",
+      message: "Show stock balance for item {id}",
+      tool: "erpnext_stock_balance",
+      args: { item_code: "{id}" }
+    },
+    {
+      key: "orders",
+      label: "Orders",
+      message: "Show sales orders containing item {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Sales Order",
+        fields: ["name", "customer", "transaction_date", "status"],
+        filters: [["Sales Order Item", "item_code", "=", "{id}"]],
+        limit: 20
+      }
+    }
   ],
   "Supplier": [
-    { label: "PO", message: "Show purchase orders for supplier {id}" },
-    { label: "Invoices", message: "Show purchase invoices for supplier {id}" }
+    {
+      key: "po",
+      label: "PO",
+      message: "Show purchase orders for supplier {id}",
+      tool: "erpnext_purchase_order_list",
+      args: { supplier: "{id}", limit: 20 }
+    },
+    {
+      key: "invoices",
+      label: "Invoices",
+      message: "Show purchase invoices for supplier {id}",
+      tool: "erpnext_purchase_invoice_list",
+      args: { supplier: "{id}", limit: 20 }
+    }
   ],
   "Purchase Order": [
-    { label: "Receipt", message: "Show purchase receipts for order {id}" },
-    { label: "Invoice", message: "Show purchase invoices for order {id}" }
+    {
+      key: "receipt",
+      label: "Receipt",
+      message: "Show purchase receipts for order {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Purchase Receipt",
+        fields: ["name", "supplier", "posting_date", "status"],
+        filters: [["Purchase Receipt Item", "purchase_order", "=", "{id}"]],
+        limit: 20
+      }
+    },
+    {
+      key: "invoice",
+      label: "Invoice",
+      message: "Show purchase invoices for order {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Purchase Invoice",
+        fields: ["name", "supplier", "posting_date", "status", "grand_total"],
+        filters: [["Purchase Invoice Item", "purchase_order", "=", "{id}"]],
+        limit: 20
+      }
+    }
   ],
   "Employee": [
-    { label: "Attendance", message: "Show attendance for employee {id}" },
-    { label: "Leaves", message: "Show leave applications for employee {id}" }
+    {
+      key: "attendance",
+      label: "Attendance",
+      message: "Show attendance for employee {id}",
+      tool: "erpnext_attendance_list",
+      args: { employee: "{id}", limit: 20 }
+    },
+    {
+      key: "leaves",
+      label: "Leaves",
+      message: "Show leave applications for employee {id}",
+      tool: "erpnext_leave_application_list",
+      args: { employee: "{id}", limit: 20 }
+    }
   ],
   "Project": [
-    { label: "Tasks", message: "Show tasks for project {id}" },
-    { label: "Timesheets", message: "Show timesheets for project {id}" }
+    {
+      key: "tasks",
+      label: "Tasks",
+      message: "Show tasks for project {id}",
+      tool: "erpnext_task_list",
+      args: { project: "{id}", limit: 20 }
+    },
+    {
+      key: "timesheets",
+      label: "Timesheets",
+      message: "Show timesheets for project {id}",
+      tool: "erpnext_timesheet_list",
+      args: { project: "{id}", limit: 20 }
+    }
   ],
   "Task": [
-    { label: "Timesheets", message: "Show timesheets for task {id}" }
+    {
+      key: "timesheets",
+      label: "Timesheets",
+      message: "Show timesheets for task {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Timesheet",
+        fields: ["name", "employee", "start_date", "total_hours", "status"],
+        filters: [["Timesheet Detail", "task", "=", "{id}"]],
+        limit: 20
+      }
+    }
   ],
   "Lead": [
-    { label: "Opportunities", message: "Show opportunities for lead {id}" }
+    {
+      key: "opportunities",
+      label: "Opportunities",
+      message: "Show opportunities for lead {id}",
+      tool: "erpnext_opportunity_list",
+      // Le handler exige opportunity_from avec party_name.
+      args: { opportunity_from: "Lead", party_name: "{id}", limit: 20 }
+    }
   ]
 };
 var KPI_DRILL_DOWN = {
   "erpnext_kpi_revenue": {
-    _drillDown: "Show all sales invoices for this month",
+    _drillDown: "Show all sales orders for this month",
     _trendDrillDown: "Show revenue trend chart for the last 12 months"
   },
   "erpnext_kpi_outstanding": {
@@ -55667,7 +56630,7 @@ var KPI_DRILL_DOWN = {
     _trendDrillDown: "Show order breakdown chart for the last 6 months"
   },
   "erpnext_kpi_gross_margin": {
-    _drillDown: "Show gross profit breakdown by item",
+    _drillDown: "Show the non-cancelled Sales Order Items and Bin valuation rates used to estimate this gross margin",
     _trendDrillDown: "Show profit and loss chart for the last 12 months"
   },
   "erpnext_kpi_overdue": {
@@ -55678,12 +56641,521 @@ var KPI_DRILL_DOWN = {
 var CHART_DRILL_DOWN = {
   "erpnext_sales_chart": "Show sales invoices for {label}",
   "erpnext_stock_chart": "Show stock balance for item {label}",
-  "erpnext_revenue_trend": "Show sales invoices for month {label}",
+  "erpnext_revenue_trend": "Show sales orders for month {label}",
   "erpnext_order_breakdown": "Show sales orders for {label}",
-  "erpnext_ar_aging": "Show overdue sales invoices in the {label} aging bucket",
+  "erpnext_ar_aging": "Show outstanding sales invoices for customer {label}",
   "erpnext_gross_profit": "Show gross profit details for {label}",
-  "erpnext_profit_loss": "Show accounting details for month {label}"
+  "erpnext_profit_loss": "Show submitted sales and purchase orders for month {label}"
+};
+var INVOICE_ITEM_HINTS = [
+  {
+    key: "item",
+    label: "Item",
+    message: "Show item {item}",
+    tool: "erpnext_item_get",
+    args: { name: "{item}" },
+    kind: "record"
+  },
+  {
+    key: "stock",
+    label: "Stock",
+    message: "Show stock balance for item {item}",
+    tool: "erpnext_stock_balance",
+    args: { item_code: "{item}", limit: 50 },
+    kind: "list"
+  }
+];
+var INVOICE_HINTS = {
+  "Sales Invoice": [
+    {
+      key: "payments",
+      label: "Payments",
+      message: "Show payment entries for invoice {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Payment Entry",
+        fields: [
+          "name",
+          "posting_date",
+          "paid_amount",
+          "mode_of_payment",
+          "docstatus"
+        ],
+        filters: [["Payment Entry Reference", "reference_name", "=", "{id}"]],
+        limit: 20
+      },
+      kind: "list"
+    },
+    {
+      key: "customer",
+      label: "Customer",
+      message: "Show customer {party}",
+      tool: "erpnext_customer_get",
+      args: { name: "{party}" },
+      kind: "record"
+    },
+    ...INVOICE_ITEM_HINTS
+  ],
+  "Purchase Invoice": [
+    {
+      key: "payments",
+      label: "Payments",
+      message: "Show payment entries for invoice {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Payment Entry",
+        fields: [
+          "name",
+          "posting_date",
+          "paid_amount",
+          "mode_of_payment",
+          "docstatus"
+        ],
+        filters: [["Payment Entry Reference", "reference_name", "=", "{id}"]],
+        limit: 20
+      },
+      kind: "list"
+    },
+    {
+      key: "supplier",
+      label: "Supplier",
+      message: "Show supplier {party}",
+      tool: "erpnext_supplier_get",
+      args: { name: "{party}" },
+      kind: "record"
+    },
+    ...INVOICE_ITEM_HINTS
+  ]
+};
+var STOCK_HINTS = [
+  {
+    key: "item",
+    label: "Item",
+    message: "Show item {id}",
+    tool: "erpnext_item_get",
+    args: { name: "{id}" },
+    kind: "record"
+  },
+  {
+    key: "movements",
+    label: "Stock entries",
+    message: "Show stock entries for item {id}",
+    tool: "erpnext_doc_list",
+    args: {
+      doctype: "Stock Entry",
+      fields: ["name", "posting_date", "stock_entry_type", "docstatus"],
+      filters: [["Stock Entry Detail", "item_code", "=", "{id}"]],
+      limit: 20
+    },
+    kind: "list"
+  },
+  {
+    key: "warehouse",
+    label: "Warehouse stock",
+    message: "Show stock chart for warehouse {warehouse}",
+    tool: "erpnext_stock_chart",
+    args: { warehouse: "{warehouse}", limit: 10 },
+    kind: "chart"
+  }
+];
+function monthRange(now) {
+  const y = now.getFullYear();
+  const m = now.getMonth();
+  const pad = (n) => String(n).padStart(2, "0");
+  const last = new Date(y, m + 1, 0).getDate();
+  return {
+    from: `${y}-${pad(m + 1)}-01`,
+    to: `${y}-${pad(m + 1)}-${pad(last)}`,
+    today: `${y}-${pad(m + 1)}-${pad(now.getDate())}`
+  };
+}
+var INVOICE_LIST_FIELDS = [
+  "name",
+  "customer",
+  "posting_date",
+  "due_date",
+  "status",
+  "outstanding_amount"
+];
+var KPI_JUMPS = {
+  "erpnext_kpi_revenue": (r) => ({
+    number: {
+      key: "sales_orders_month",
+      label: "Sales orders this month",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Sales Order",
+        fields: [
+          "name",
+          "customer",
+          "transaction_date",
+          "status",
+          "grand_total"
+        ],
+        filters: [
+          ["transaction_date", ">=", r.from],
+          ["transaction_date", "<=", r.to],
+          // comme le KPI : les commandes annulées ne comptent pas
+          ["docstatus", "<", 2]
+        ],
+        limit: 20
+      },
+      kind: "list"
+    },
+    trend: {
+      key: "revenue_trend",
+      label: "Revenue trend",
+      tool: "erpnext_revenue_trend",
+      args: { months: 12 },
+      kind: "chart"
+    }
+  }),
+  "erpnext_kpi_outstanding": () => ({
+    number: {
+      key: "unpaid_invoices",
+      label: "Unpaid invoices",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Sales Invoice",
+        fields: INVOICE_LIST_FIELDS,
+        filters: [["outstanding_amount", ">", 0], ["docstatus", "=", 1]],
+        limit: 20
+      },
+      kind: "list"
+    },
+    trend: {
+      key: "receivables_aging",
+      label: "Receivables aging",
+      tool: "erpnext_ar_aging",
+      args: {},
+      kind: "chart"
+    }
+  }),
+  "erpnext_kpi_orders": (r) => ({
+    number: {
+      key: "sales_orders_month",
+      label: "Sales orders this month",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Sales Order",
+        fields: [
+          "name",
+          "customer",
+          "transaction_date",
+          "status",
+          "grand_total"
+        ],
+        filters: [
+          ["transaction_date", ">=", r.from],
+          ["transaction_date", "<=", r.to],
+          // comme le KPI : les commandes annulées ne comptent pas
+          ["docstatus", "<", 2]
+        ],
+        limit: 20
+      },
+      kind: "list"
+    },
+    trend: {
+      key: "order_breakdown",
+      label: "Order breakdown",
+      tool: "erpnext_order_breakdown",
+      args: {},
+      kind: "chart"
+    }
+  }),
+  "erpnext_kpi_gross_margin": () => ({
+    trend: {
+      key: "profit_loss",
+      label: "Profit and loss",
+      tool: "erpnext_profit_loss",
+      args: { months: 12 },
+      kind: "chart"
+    }
+  }),
+  "erpnext_kpi_overdue": (r) => ({
+    number: {
+      key: "overdue_invoices",
+      label: "Overdue invoices",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Sales Invoice",
+        fields: INVOICE_LIST_FIELDS,
+        filters: [
+          ["due_date", "<", r.today],
+          ["outstanding_amount", ">", 0],
+          ["docstatus", "=", 1]
+        ],
+        limit: 20
+      },
+      kind: "list"
+    },
+    trend: {
+      key: "receivables_aging",
+      label: "Receivables aging",
+      tool: "erpnext_ar_aging",
+      args: {},
+      kind: "chart"
+    }
+  })
+};
+var FUNNEL_LIST_FIELDS = {
+  "Leads": [
+    "name",
+    "lead_name",
+    "company_name",
+    "status",
+    "lead_owner",
+    "creation"
+  ],
+  "Opportunities": [
+    "name",
+    "opportunity_from",
+    "party_name",
+    "status",
+    "opportunity_amount",
+    "currency",
+    "probability",
+    "opportunity_owner",
+    "transaction_date"
+  ],
+  "Quotations": [
+    "name",
+    "party_name",
+    "transaction_date",
+    "status",
+    "grand_total"
+  ],
+  "Orders": [
+    "name",
+    "customer",
+    "transaction_date",
+    "status",
+    "grand_total"
+  ]
+};
+var FUNNEL_STAGE_JUMPS = {
+  "Leads": {
+    key: "leads",
+    label: "Leads",
+    tool: "erpnext_lead_list",
+    args: { limit: 20 },
+    kind: "list"
+  },
+  "Opportunities": {
+    key: "opportunities",
+    label: "Opportunities",
+    tool: "erpnext_opportunity_list",
+    args: { limit: 20 },
+    kind: "list"
+  },
+  "Quotations": {
+    key: "quotations",
+    label: "Quotations",
+    tool: "erpnext_doc_list",
+    args: {
+      doctype: "Quotation",
+      fields: FUNNEL_LIST_FIELDS.Quotations,
+      filters: [["docstatus", "!=", 2]],
+      limit: 20
+    },
+    kind: "list"
+  },
+  "Orders": {
+    key: "sales_orders",
+    label: "Sales orders",
+    tool: "erpnext_doc_list",
+    args: {
+      doctype: "Sales Order",
+      fields: FUNNEL_LIST_FIELDS.Orders,
+      filters: [["docstatus", "!=", 2]],
+      limit: 20
+    },
+    kind: "list"
+  }
 };
+function funnelPeriodStart(period, now) {
+  const year = now.getFullYear();
+  const pad = (value) => String(value).padStart(2, "0");
+  if (period === "this_month") {
+    return `${year}-${pad(now.getMonth() + 1)}-01`;
+  }
+  if (period === "this_quarter") {
+    const firstMonth = Math.floor(now.getMonth() / 3) * 3 + 1;
+    return `${year}-${pad(firstMonth)}-01`;
+  }
+  if (period === "this_year") return `${year}-01-01`;
+  return void 0;
+}
+function funnelStageJumps(args, now) {
+  const since = funnelPeriodStart(args.period, now);
+  if (!since) return FUNNEL_STAGE_JUMPS;
+  const scopedJump = (stage, doctype, dateField) => {
+    const base = FUNNEL_STAGE_JUMPS[stage];
+    const baseFilters = Array.isArray(base.args.filters) ? base.args.filters : [];
+    return {
+      ...base,
+      tool: "erpnext_doc_list",
+      args: {
+        doctype,
+        fields: FUNNEL_LIST_FIELDS[stage],
+        filters: [[dateField, ">=", since], ...baseFilters],
+        limit: 20
+      }
+    };
+  };
+  return {
+    "Leads": scopedJump("Leads", "Lead", "creation"),
+    "Opportunities": scopedJump(
+      "Opportunities",
+      "Opportunity",
+      "transaction_date"
+    ),
+    "Quotations": scopedJump(
+      "Quotations",
+      "Quotation",
+      "transaction_date"
+    ),
+    "Orders": scopedJump("Orders", "Sales Order", "transaction_date")
+  };
+}
+var SALES_ORDER_LIST_FIELDS = [
+  "name",
+  "customer",
+  "transaction_date",
+  "status",
+  "grand_total"
+];
+var PURCHASE_ORDER_LIST_FIELDS = [
+  "name",
+  "supplier",
+  "transaction_date",
+  "status",
+  "grand_total"
+];
+function monthLabel(d) {
+  return `${d.toLocaleString("en", { month: "short" })} ${d.getFullYear().toString().slice(2)}`;
+}
+function monthBuckets(monthsBack, now) {
+  const buckets = [];
+  for (let m = 0; m < monthsBack; m++) {
+    const d = new Date(
+      now.getFullYear(),
+      now.getMonth() - monthsBack + 1 + m,
+      1
+    );
+    buckets.push({ label: monthLabel(d), range: monthRange(d) });
+  }
+  return buckets;
+}
+var docList = (label, doctype, fields, filters) => ({
+  label,
+  tool: "erpnext_doc_list",
+  args: { doctype, fields, filters, limit: 20 },
+  kind: "list"
+});
+function chartPointJumps(toolName, args, labels, now) {
+  const jumps = {};
+  const byLabel = (make) => {
+    for (const label of labels) {
+      if (label === "Unknown") continue;
+      jumps[label] = make(label);
+    }
+  };
+  switch (toolName) {
+    case "erpnext_revenue_trend": {
+      const months = Number(args.months ?? 6);
+      for (const { label, range } of monthBuckets(months, now)) {
+        if (!labels.includes(label)) continue;
+        jumps[label] = docList(label, "Sales Order", SALES_ORDER_LIST_FIELDS, [
+          ["transaction_date", ">=", range.from],
+          ["transaction_date", "<=", range.to],
+          ["docstatus", "<", 2]
+        ]);
+      }
+      break;
+    }
+    case "erpnext_sales_chart": {
+      const groupBy = String(args.group_by ?? "customer");
+      byLabel((label) => {
+        const filters = [
+          groupBy === "item" ? ["Sales Invoice Item", "item_name", "=", label] : groupBy === "status" ? ["status", "=", label] : ["customer_name", "=", label]
+        ];
+        if (groupBy === "status") {
+          filters.push(["docstatus", "!=", 2]);
+        } else if (groupBy === "item" || args.include_drafts !== true) {
+          filters.push(["docstatus", "=", 1]);
+        }
+        return docList(label, "Sales Invoice", INVOICE_LIST_FIELDS, filters);
+      });
+      break;
+    }
+    case "erpnext_order_breakdown":
+    case "erpnext_revenue_vs_orders":
+      byLabel(
+        (label) => docList(label, "Sales Order", SALES_ORDER_LIST_FIELDS, [
+          ["customer_name", "=", label],
+          ["docstatus", "<", 2]
+        ])
+      );
+      break;
+    case "erpnext_ar_aging":
+    case "erpnext_profit_loss":
+      return void 0;
+    case "erpnext_gross_profit": {
+      const groupBy = String(args.group_by ?? "item");
+      byLabel(
+        (label) => docList(label, "Sales Invoice", INVOICE_LIST_FIELDS, [
+          groupBy === "customer" ? ["customer_name", "=", label] : ["Sales Invoice Item", "item_name", "=", label],
+          ["docstatus", "=", 1]
+        ])
+      );
+      break;
+    }
+    case "erpnext_stock_chart":
+      byLabel((label) => ({
+        label,
+        tool: "erpnext_stock_balance",
+        args: {
+          item_code: label,
+          ...typeof args.warehouse === "string" ? { warehouse: args.warehouse } : {},
+          limit: 50
+        },
+        kind: "list"
+      }));
+      break;
+    default:
+      return void 0;
+  }
+  return Object.keys(jumps).length > 0 ? jumps : void 0;
+}
+function chartSeriesPointJumps(toolName, args, labels, now) {
+  if (toolName !== "erpnext_profit_loss") return void 0;
+  const jumps = {};
+  const months = Number(args.months ?? 6);
+  for (const { label, range } of monthBuckets(months, now)) {
+    if (!labels.includes(label)) continue;
+    const filters = [
+      ["transaction_date", ">=", range.from],
+      ["transaction_date", "<=", range.to],
+      ["docstatus", "=", 1]
+    ];
+    jumps[label] = {
+      "Income": docList(
+        `${label} \xB7 Income`,
+        "Sales Order",
+        SALES_ORDER_LIST_FIELDS,
+        filters
+      ),
+      "Expenses": docList(
+        `${label} \xB7 Expenses`,
+        "Purchase Order",
+        PURCHASE_ORDER_LIST_FIELDS,
+        filters
+      )
+    };
+  }
+  return Object.keys(jumps).length > 0 ? jumps : void 0;
+}
 function isChartViewer(result) {
   const uri = result._meta?.ui?.resourceUri;
   return uri === "ui://mcp-erpnext/chart-viewer";
@@ -55692,6 +57164,28 @@ function isKpiViewer(result) {
   const uri = result._meta?.ui?.resourceUri;
   return uri === "ui://mcp-erpnext/kpi-viewer";
 }
+function isFunnelViewer(result) {
+  const uri = result._meta?.ui?.resourceUri;
+  return uri === "ui://mcp-erpnext/funnel-viewer";
+}
+function resultDoctype(result) {
+  if (typeof result.doctype === "string") return result.doctype;
+  const data = result.data;
+  if (isRecord7(data) && typeof data.doctype === "string") return data.doctype;
+  return void 0;
+}
+function isInvoiceViewer(result) {
+  const uri = result._meta?.ui?.resourceUri;
+  return uri === "ui://mcp-erpnext/invoice-viewer";
+}
+function isStockViewer(result) {
+  const uri = result._meta?.ui?.resourceUri;
+  return uri === "ui://mcp-erpnext/stock-viewer";
+}
+function isKanbanViewer(result) {
+  const uri = result._meta?.ui?.resourceUri;
+  return uri === "ui://mcp-erpnext/kanban-viewer";
+}
 function isDoclistResult(result) {
   return typeof result.doctype === "string" && Array.isArray(result.data);
 }
@@ -55699,7 +57193,193 @@ function isDoclistViewer(result) {
   const uri = result._meta?.ui?.resourceUri;
   return uri === "ui://mcp-erpnext/doclist-viewer";
 }
-function withUiRefreshRequest(result, toolName, args) {
+function isDocViewer(result) {
+  const uri = result._meta?.ui?.resourceUri;
+  return uri === "ui://mcp-erpnext/doc-viewer";
+}
+var VIEWER_TOOL_CANDIDATES = {
+  "ui://mcp-erpnext/invoice-viewer": [
+    "erpnext_item_get",
+    "erpnext_stock_balance",
+    "erpnext_file_list",
+    "erpnext_file_upload",
+    "erpnext_file_download"
+  ],
+  "ui://mcp-erpnext/doclist-viewer": [],
+  "ui://mcp-erpnext/doc-viewer": [
+    "erpnext_file_list",
+    "erpnext_file_upload",
+    "erpnext_file_download"
+  ],
+  "ui://mcp-erpnext/kanban-viewer": [
+    "erpnext_doc_get",
+    "erpnext_doc_update",
+    "erpnext_user_list",
+    "erpnext_doc_assign",
+    "erpnext_doc_unassign"
+  ],
+  "ui://mcp-erpnext/stock-viewer": [
+    "erpnext_item_get",
+    "erpnext_stock_entry_list"
+  ]
+};
+var SUBMITTABLE_VIEWER_DOCTYPES = /* @__PURE__ */ new Set([
+  "Quotation",
+  "Sales Order",
+  "Delivery Note",
+  "Sales Invoice",
+  "Purchase Order",
+  "Purchase Receipt",
+  "Purchase Invoice",
+  "Stock Entry",
+  "Journal Entry",
+  "Payment Entry",
+  "Timesheet",
+  "Leave Application",
+  "Salary Slip",
+  "BOM",
+  "Work Order",
+  "Job Card",
+  "Asset",
+  "Asset Movement",
+  "Shipment"
+]);
+var INVOICE_DEDICATED_MUTATION_TOOLS = {
+  "Sales Order": [
+    "erpnext_sales_order_submit",
+    "erpnext_sales_order_cancel"
+  ],
+  "Sales Invoice": ["erpnext_sales_invoice_submit"]
+};
+function addDoctypeMutationCandidates(target, uri, doctype) {
+  if (!doctype || !SUBMITTABLE_VIEWER_DOCTYPES.has(doctype)) return;
+  if (uri === "ui://mcp-erpnext/invoice-viewer" || uri === "ui://mcp-erpnext/doclist-viewer" || uri === "ui://mcp-erpnext/doc-viewer") {
+    target.add("erpnext_doc_submit");
+    target.add("erpnext_doc_cancel");
+  }
+  if (uri === "ui://mcp-erpnext/invoice-viewer") {
+    for (const tool of INVOICE_DEDICATED_MUTATION_TOOLS[doctype] ?? []) {
+      target.add(tool);
+    }
+  }
+}
+function addJumpTools(target, jumps) {
+  if (!jumps) return;
+  for (const jump of Object.values(jumps)) target.add(jump.tool);
+}
+function addSeriesJumpTools(target, jumps) {
+  if (!jumps) return;
+  for (const seriesJumps of Object.values(jumps)) {
+    addJumpTools(target, seriesJumps);
+  }
+}
+function availableViewerToolNames(result, availableToolNames) {
+  const candidates = /* @__PURE__ */ new Set();
+  const uri = result._meta?.ui?.resourceUri;
+  for (const name of uri ? VIEWER_TOOL_CANDIDATES[uri] ?? [] : []) {
+    candidates.add(name);
+  }
+  addDoctypeMutationCandidates(candidates, uri, resultDoctype(result));
+  if (result.refreshRequest) candidates.add(result.refreshRequest.toolName);
+  if (result._rowAction) candidates.add(result._rowAction.toolName);
+  for (const hint of result._sendMessageHints ?? []) {
+    if (hint.tool) candidates.add(hint.tool);
+  }
+  addJumpTools(
+    candidates,
+    result._jumps ? Object.fromEntries(
+      Object.entries(result._jumps).filter(
+        (entry) => entry[1] !== void 0
+      )
+    ) : void 0
+  );
+  addJumpTools(candidates, result._stageJumps);
+  addJumpTools(candidates, result._pointJumps);
+  addSeriesJumpTools(candidates, result._seriesPointJumps);
+  if (typeof result.moveToolName === "string") {
+    candidates.add(result.moveToolName);
+  }
+  return [...candidates].filter((name) => availableToolNames.has(name)).sort();
+}
+function filterJumpMap(jumps, availableToolNames) {
+  const available = Object.fromEntries(
+    Object.entries(jumps).filter(
+      ([, jump]) => availableToolNames.has(jump.tool)
+    )
+  );
+  return Object.keys(available).length > 0 ? available : void 0;
+}
+function filterSeriesJumpMap(jumps, availableToolNames) {
+  const available = {};
+  for (const [label, seriesJumps] of Object.entries(jumps)) {
+    const filtered = filterJumpMap(seriesJumps, availableToolNames);
+    if (filtered) available[label] = filtered;
+  }
+  return Object.keys(available).length > 0 ? available : void 0;
+}
+function filterNavJumpsByAvailableTools(result, availableToolNames) {
+  if (!availableToolNames) return result;
+  const filtered = { ...result };
+  if (result._jumps) {
+    const jumps = filterJumpMap(
+      Object.fromEntries(
+        Object.entries(result._jumps).filter(
+          (entry) => entry[1] !== void 0
+        )
+      ),
+      availableToolNames
+    );
+    if (jumps) filtered._jumps = jumps;
+    else delete filtered._jumps;
+  }
+  if (result._stageJumps) {
+    const jumps = filterJumpMap(result._stageJumps, availableToolNames);
+    if (jumps) filtered._stageJumps = jumps;
+    else delete filtered._stageJumps;
+  }
+  if (result._pointJumps) {
+    const jumps = filterJumpMap(result._pointJumps, availableToolNames);
+    if (jumps) filtered._pointJumps = jumps;
+    else delete filtered._pointJumps;
+  }
+  if (result._seriesPointJumps) {
+    const jumps = filterSeriesJumpMap(
+      result._seriesPointJumps,
+      availableToolNames
+    );
+    if (jumps) filtered._seriesPointJumps = jumps;
+    else delete filtered._seriesPointJumps;
+  }
+  if (result._rowAction && !availableToolNames.has(result._rowAction.toolName)) {
+    const doctype = resultDoctype(result);
+    if (doctype && availableToolNames.has("erpnext_doc_get")) {
+      filtered._rowAction = {
+        toolName: "erpnext_doc_get",
+        idField: "name",
+        argName: "name",
+        extraArgs: { doctype }
+      };
+    } else {
+      delete filtered._rowAction;
+    }
+  }
+  if (result._sendMessageHints) {
+    filtered._sendMessageHints = result._sendMessageHints.map((hint) => {
+      if (!hint.tool || availableToolNames.has(hint.tool)) return hint;
+      return { key: hint.key, label: hint.label, message: hint.message };
+    });
+  }
+  filtered._availableTools = availableViewerToolNames(
+    filtered,
+    availableToolNames
+  );
+  return filtered;
+}
+function withViewerToolCapabilities(result, availableToolNames) {
+  if (!isRecord7(result) || !hasUiResource(result)) return result;
+  return filterNavJumpsByAvailableTools(result, availableToolNames);
+}
+function withUiRefreshRequest(result, toolName, args, now = /* @__PURE__ */ new Date(), availableToolNames) {
   if (!isRecord7(result) || !hasUiResource(result)) {
     return result;
   }
@@ -55749,10 +57429,92 @@ function withUiRefreshRequest(result, toolName, args) {
       }
     }
   }
-  return enriched;
+  if (isKpiViewer(enriched) && !enriched._jumps) {
+    const jumps = KPI_JUMPS[toolName];
+    if (jumps) enriched._jumps = jumps(monthRange(now));
+  }
+  if (isFunnelViewer(enriched) && !enriched._stageJumps) {
+    enriched._stageJumps = funnelStageJumps(args, now);
+  }
+  if (isChartViewer(enriched) && Array.isArray(enriched.labels)) {
+    const labels = enriched.labels.map(String);
+    if (!enriched._pointJumps) {
+      const jumps = chartPointJumps(toolName, args, labels, now);
+      if (jumps) enriched._pointJumps = jumps;
+    }
+    if (!enriched._seriesPointJumps) {
+      const jumps = chartSeriesPointJumps(toolName, args, labels, now);
+      if (jumps) enriched._seriesPointJumps = jumps;
+    }
+  }
+  if (!enriched._sendMessageHints) {
+    const doctype = resultDoctype(enriched);
+    if (isInvoiceViewer(enriched) && doctype) {
+      const hints = INVOICE_HINTS[doctype];
+      if (hints) enriched._sendMessageHints = hints;
+    } else if (isStockViewer(enriched)) {
+      enriched._sendMessageHints = STOCK_HINTS;
+    } else if ((isKanbanViewer(enriched) || isDocViewer(enriched)) && doctype) {
+      const hints = DOCTYPE_SEND_MESSAGE_HINTS[doctype];
+      if (hints) enriched._sendMessageHints = hints;
+    }
+  }
+  return filterNavJumpsByAvailableTools(enriched, availableToolNames);
 }
 
 // src/client.ts
+function isRecord8(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSingleEmbeddedBlobResult(value) {
+  if (!isRecord8(value) || !Array.isArray(value.content)) return false;
+  if (Object.keys(value).some((key) => key !== "content")) return false;
+  if (value.content.length !== 2) return false;
+  const [summary, embedded] = value.content;
+  if (!isRecord8(summary) || summary.type !== "text" || typeof summary.text !== "string") {
+    return false;
+  }
+  if (!isRecord8(embedded) || embedded.type !== "resource") return false;
+  if (!isRecord8(embedded.resource)) return false;
+  const resource = embedded.resource;
+  return typeof resource.uri === "string" && resource.uri.startsWith("file:///") && typeof resource.mimeType === "string" && typeof resource.blob === "string";
+}
+function withSafeUiRefresh(result, tool, args, availableToolNames) {
+  const readOnly = tool.annotations?.readOnlyHint === true;
+  if (!isRecord8(result)) {
+    return result;
+  }
+  const resultMeta = isRecord8(result._meta) ? result._meta : {};
+  const declaredUi = tool._meta?.ui;
+  const viewerResult = declaredUi && !isRecord8(resultMeta.ui) ? {
+    ...result,
+    _meta: { ...resultMeta, ...tool._meta, ui: declaredUi }
+  } : result;
+  const request = isRecord8(viewerResult.refreshRequest) ? viewerResult.refreshRequest : null;
+  const target = request && typeof request.toolName === "string" ? getToolByName(request.toolName) : void 0;
+  const hasSafeExplicitRefresh = request !== null && typeof request.toolName === "string" && availableToolNames.has(request.toolName) && isRecord8(request.arguments) && (request.toolName === tool.name ? readOnly : target?.annotations?.readOnlyHint === true);
+  if (hasSafeExplicitRefresh) {
+    return withUiRefreshRequest(
+      viewerResult,
+      tool.name,
+      args,
+      /* @__PURE__ */ new Date(),
+      availableToolNames
+    );
+  }
+  let sanitized = viewerResult;
+  if ("refreshRequest" in viewerResult) {
+    sanitized = { ...viewerResult };
+    delete sanitized.refreshRequest;
+  }
+  return readOnly ? withUiRefreshRequest(
+    sanitized,
+    tool.name,
+    args,
+    /* @__PURE__ */ new Date(),
+    availableToolNames
+  ) : withViewerToolCapabilities(sanitized, availableToolNames);
+}
 var ErpNextToolsClient = class {
   tools;
   enableLinkDisambiguation;
@@ -55793,6 +57555,7 @@ var ErpNextToolsClient = class {
    */
   buildHandlersMap() {
     const handlers = /* @__PURE__ */ new Map();
+    const availableToolNames = new Set(this.tools.map((tool) => tool.name));
     for (const tool of this.tools) {
       const toolMeta = tool._meta;
       handlers.set(tool.name, async (args, mcpContext) => {
@@ -55815,10 +57578,14 @@ var ErpNextToolsClient = class {
         if (execution.result !== null && typeof execution.result === "object" && !Array.isArray(execution.result) && execution.result.resultType === "input_required") {
           return execution.result;
         }
-        const result = withUiRefreshRequest(
+        if (tool.name === "erpnext_file_download" && isSingleEmbeddedBlobResult(execution.result)) {
+          return execution.result;
+        }
+        const result = withSafeUiRefresh(
           execution.result,
-          tool.name,
-          execution.args
+          tool,
+          execution.args,
+          availableToolNames
         );
         const r = result !== null && typeof result === "object" && !Array.isArray(result) ? result : null;
         const resultUi = r?._meta && typeof r._meta === "object" && r._meta.ui;
@@ -55845,7 +57612,15 @@ var ErpNextToolsClient = class {
     }
     const client = getFrappeClient();
     const result = await tool.handler(args, { client });
-    return withUiRefreshRequest(result, tool.name, args);
+    if (tool.name === "erpnext_file_download" && isSingleEmbeddedBlobResult(result)) {
+      return result;
+    }
+    return withSafeUiRefresh(
+      result,
+      tool,
+      args,
+      new Set(this.tools.map((candidate) => candidate.name))
+    );
   }
   /** Get tool count */
   get count() {
@@ -55859,6 +57634,7 @@ var UI_VIEWERS = [
   "invoice-viewer",
   "stock-viewer",
   "doclist-viewer",
+  "doc-viewer",
   "chart-viewer",
   "kpi-viewer",
   "funnel-viewer",
@@ -56102,7 +57878,7 @@ async function main() {
   );
   const server = new McpApp({
     name: "mcp-erpnext",
-    version: "3.0.2",
+    version: "3.1.0-beta.2",
     transport: "stateless",
     cache: {
       ttlMs: 36e5,