@casys/mcp-erpnext 3.0.3 → 3.0.4

package/mcp-erpnext.mjs

@@ -3115,6 +3115,7 @@ var require_utils2 = __commonJS({
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isPort = RegExp.prototype.test.bind(/^\d*$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
     var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
@@ -3580,8 +3581,12 @@ var require_utils2 = __commonJS({
         uriTokens.push(host);
       }
       if (typeof component.port === "number" || typeof component.port === "string") {
+        const port = String(component.port);
+        if (!isPort(port)) {
+          throw new TypeError("URI port is malformed.");
+        }
         uriTokens.push(":");
-        uriTokens.push(String(component.port));
+        uriTokens.push(port);
       }
       return uriTokens.length ? uriTokens.join("") : void 0;
     }
@@ -4024,12 +4029,15 @@ var require_fast_uri2 = __commonJS({
       }
       return false;
     }
+    function isIPLiteral(host) {
+      return host[0] === "[" && host[host.length - 1] === "]";
+    }
     function hasMalformedComponentPercentEncoding(matches) {
       const host = matches[4];
-      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !(host[0] === "[" && host[host.length - 1] === "]") && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
     function canonicalizeHost(parsed, options, schemeHandler, isIP) {
-      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && parsed.host[0] !== "[" && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
         try {
           parsed.host = new URL("http://" + parsed.host).hostname;
         } catch (e) {
@@ -4116,10 +4124,11 @@ var require_fast_uri2 = __commonJS({
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
-            const bracketedIPLiteral = parsed.host[0] === "[" && parsed.host[parsed.host.length - 1] === "]";
+            const bracketedIPLiteral = isIPLiteral(parsed.host);
+            const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
             const ipv6result = normalizeIPv6(parsed.host);
             isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
-            malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true;
+            malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
             parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
               parsed.error = parsed.error || "URI host is malformed.";
@@ -4142,7 +4151,9 @@ var require_fast_uri2 = __commonJS({
           parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-        malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+        if (!malformedIPLiteral) {
+          malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+        }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (uri.indexOf("%") !== -1) {
             if (parsed.host !== void 0 && !malformedIPLiteral) {
@@ -18595,9 +18606,9 @@ function cloneIssues(issues) {
 }
 var recursive = /* @__PURE__ */ new WeakMap();
 function isRecursive(inst, stack) {
-  const cached3 = recursive.get(inst);
-  if (cached3 !== void 0)
-    return cached3;
+  const cached2 = recursive.get(inst);
+  if (cached2 !== void 0)
+    return cached2;
   if (stack.has(inst))
     return true;
   stack.add(inst);
@@ -39108,13 +39119,14 @@ var Hono = class _Hono {
     const allMethods = [...METHODS, METHOD_NAME_ALL_LOWERCASE];
     allMethods.forEach((method) => {
       this[method] = (args1, ...args) => {
+        const methodName = method.toUpperCase();
         if (typeof args1 === "string") {
           this.#path = args1;
         } else {
-          this.#addRoute(method, this.#path, args1);
+          this.#addRoute(methodName, this.#path, args1);
         }
         args.forEach((handler) => {
-          this.#addRoute(method, this.#path, handler);
+          this.#addRoute(methodName, this.#path, handler);
         });
         return this;
       };
@@ -39123,9 +39135,10 @@ var Hono = class _Hono {
       for (const p of [path].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
-          handlers.map((handler) => {
-            this.#addRoute(m.toUpperCase(), this.#path, handler);
-          });
+          const methodName = m.toUpperCase();
+          for (const handler of handlers) {
+            this.#addRoute(methodName, this.#path, handler);
+          }
         }
       }
       return this;
@@ -39326,7 +39339,6 @@ var Hono = class _Hono {
     return this;
   }
   #addRoute(method, path, handler, baseRoutePath) {
-    method = method.toUpperCase();
     path = mergePath(this._basePath, path);
     const r = {
       basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
@@ -41579,88 +41591,48 @@ var decoder = new TextDecoder();
 var strictDecoder = new TextDecoder("utf-8", { fatal: true });
 var MAX_INT32 = 2 ** 32;
 function concat(...buffers) {
-  const size = buffers.reduce((acc, { length }) => acc + length, 0);
-  const buf = new Uint8Array(size);
+  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
   let i = 0;
-  for (const buffer of buffers) {
-    buf.set(buffer, i);
-    i += buffer.length;
-  }
+  for (const buffer of buffers)
+    buf.set(buffer, i), i += buffer.length;
   return buf;
 }
+var NON_ASCII = /[^\x00-\x7f]/;
 function encode2(string4) {
+  if (typeof string4 == "string" && string4.length >= 128) {
+    if (NON_ASCII.test(string4))
+      throw new TypeError("non-ASCII string encountered in encode()");
+    return encoder.encode(string4);
+  }
   const bytes = new Uint8Array(string4.length);
   for (let i = 0; i < string4.length; i++) {
     const code = string4.charCodeAt(i);
-    if (code > 127) {
+    if (code > 127)
       throw new TypeError("non-ASCII string encountered in encode()");
-    }
     bytes[i] = code;
   }
   return bytes;
 }
-
-// node_modules/jose/dist/webapi/lib/crypto_key.js
-var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-function checkUsage(key, usage) {
-  if (usage && !key.usages.includes(usage)) {
-    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-  }
-}
-function checkModulusLength(alg, key) {
-  const { modulusLength } = key.algorithm;
-  if (typeof modulusLength !== "number" || modulusLength < 2048) {
-    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+function decodeBase64(encoded, url2 = false) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(encoded, { alphabet: url2 ? "base64url" : "base64" });
+  if (url2) {
+    if (encoded.includes("+") || encoded.includes("/"))
+      throw new TypeError("Invalid base64url");
+    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
   }
+  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
 }
-function checkCryptoKey(key, expected, usage) {
-  const algorithm = key.algorithm;
-  if (algorithm.name !== expected.name) {
-    throw unusable(expected.name);
-  }
-  if (expected.hash && algorithm.hash?.name !== expected.hash) {
-    throw unusable(expected.hash, "algorithm.hash");
-  }
-  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve) {
-    throw unusable(expected.namedCurve, "algorithm.namedCurve");
-  }
-  if (expected.length !== void 0 && algorithm.length !== expected.length) {
-    throw unusable(expected.length, "algorithm.length");
-  }
-  checkUsage(key, usage);
-}
-
-// node_modules/jose/dist/webapi/lib/invalid_key_input.js
-function message(msg, actual, ...types) {
-  if (types.length > 2) {
-    const last = types.pop();
-    msg += `one of type ${types.join(", ")}, or ${last}.`;
-  } else if (types.length === 2) {
-    msg += `one of type ${types[0]} or ${types[1]}.`;
-  } else {
-    msg += `of type ${types[0]}.`;
-  }
-  if (actual == null) {
-    msg += ` Received ${actual}`;
-  } else if (typeof actual === "function" && actual.name) {
-    msg += ` Received function ${actual.name}`;
-  } else if (typeof actual === "object" && actual != null) {
-    if (actual.constructor?.name) {
-      msg += ` Received an instance of ${actual.constructor.name}`;
-    }
-  }
-  return msg;
-}
-var withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
 
 // node_modules/jose/dist/webapi/util/errors.js
 var JOSEError = class extends Error {
   static code = "ERR_JOSE_GENERIC";
   code = "ERR_JOSE_GENERIC";
   constructor(message2, options) {
-    super(message2, options);
-    this.name = this.constructor.name;
-    Error.captureStackTrace?.(this, this.constructor);
+    super(message2, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
   }
 };
 var JWTClaimValidationFailed = class extends JOSEError {
@@ -41670,10 +41642,7 @@ var JWTClaimValidationFailed = class extends JOSEError {
   reason;
   payload;
   constructor(message2, payload, claim2 = "unspecified", reason = "unspecified") {
-    super(message2, { cause: { claim: claim2, reason, payload } });
-    this.claim = claim2;
-    this.reason = reason;
-    this.payload = payload;
+    super(message2, { cause: { claim: claim2, reason, payload } }), this.claim = claim2, this.reason = reason, this.payload = payload;
   }
 };
 var JWTExpired = class extends JOSEError {
@@ -41683,10 +41652,7 @@ var JWTExpired = class extends JOSEError {
   reason;
   payload;
   constructor(message2, payload, claim2 = "unspecified", reason = "unspecified") {
-    super(message2, { cause: { claim: claim2, reason, payload } });
-    this.claim = claim2;
-    this.reason = reason;
-    this.payload = payload;
+    super(message2, { cause: { claim: claim2, reason, payload } }), this.claim = claim2, this.reason = reason, this.payload = payload;
   }
 };
 var JOSEAlgNotAllowed = class extends JOSEError {
@@ -41740,73 +41706,37 @@ var JWSSignatureVerificationFailed = class extends JOSEError {
   }
 };
 
-// node_modules/jose/dist/webapi/lib/is_key_like.js
-var isCryptoKey = (key) => {
-  if (key?.[Symbol.toStringTag] === "CryptoKey")
-    return true;
-  try {
-    return key instanceof CryptoKey;
-  } catch {
-    return false;
-  }
-};
-var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
-var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
-
-// node_modules/jose/dist/webapi/lib/base64.js
-function decodeBase64(encoded) {
-  if (Uint8Array.fromBase64) {
-    return Uint8Array.fromBase64(encoded);
-  }
-  const binary = atob(encoded);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes;
-}
-
 // node_modules/jose/dist/webapi/util/base64url.js
 var invalid = "The input to be decoded is not correctly encoded.";
 function decode2(input) {
-  if (Uint8Array.fromBase64) {
-    try {
-      return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), {
-        alphabet: "base64url"
-      });
-    } catch (cause) {
-      throw new TypeError(invalid, { cause });
-    }
-  }
-  let encoded = input;
-  if (encoded instanceof Uint8Array) {
-    encoded = decoder.decode(encoded);
-  }
-  if (encoded.includes("+") || encoded.includes("/")) {
-    throw new TypeError(invalid);
-  }
-  encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
   try {
-    return decodeBase64(encoded);
-  } catch {
-    throw new TypeError(invalid);
+    return decodeBase64(typeof input == "string" ? input : decoder.decode(input), true);
+  } catch (cause) {
+    throw new TypeError(invalid, { cause });
   }
 }
 
-// node_modules/jose/dist/webapi/lib/type_checks.js
+// node_modules/jose/dist/webapi/lib/validate.js
 function isObject2(input) {
-  if (typeof input !== "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]") {
+  if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]")
     return false;
-  }
   const prototype = Object.getPrototypeOf(input);
   return prototype === null || Object.getPrototypeOf(prototype) === null;
 }
 function isJwkSet(input) {
   return isObject2(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject2);
 }
-
-// node_modules/jose/dist/webapi/lib/helpers.js
-var unprotected = Symbol();
+function isDisjoint(...headers) {
+  const parameters = /* @__PURE__ */ new Set();
+  for (const header of headers)
+    if (header)
+      for (const parameter of Object.keys(header)) {
+        if (parameters.has(parameter))
+          return false;
+        parameters.add(parameter);
+      }
+  return true;
+}
 function decodeBase64url(value, label, ErrorClass) {
   try {
     return decode2(value);
@@ -41828,48 +41758,42 @@ function parseJoseHeader(b64, ErrorClass, message2) {
   } catch {
     throw new ErrorClass(message2);
   }
-  if (!isObject2(parsed)) {
+  if (!isObject2(parsed))
     throw new ErrorClass(message2);
-  }
   return parsed;
 }
-
-// node_modules/jose/dist/webapi/lib/jwk_to_key.js
-async function jwkToKey(entry, jwk) {
-  if (jwk.kty === "RSA" && "oth" in jwk && jwk.oth !== void 0) {
-    throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-  }
-  if (!entry.kty.includes(jwk.kty)) {
-    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-  }
-  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle;
-  const isPrivate = !!(jwk.d || jwk.priv);
-  const keyData = { ...jwk };
-  if (keyData.kty !== "AKP") {
-    delete keyData.alg;
-  }
-  delete keyData.use;
-  return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
-}
-
-// node_modules/jose/dist/webapi/lib/jwk_metadata.js
-function snapshotJwk(jwk) {
-  return { __proto__: null, ...jwk };
+var JWS_RECOGNIZED = { __proto__: null, b64: true };
+function validateAlgorithms(option, algorithms) {
+  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string")))
+    throw new TypeError(`"${option}" option must be an array of strings`);
+  return algorithms === void 0 ? void 0 : new Set(algorithms);
 }
-function normalizeJwk(jwk) {
-  const normalized = snapshotJwk(jwk);
-  if (normalized.ext !== void 0 && typeof normalized.ext !== "boolean") {
-    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+  if (!protectedHeader || protectedHeader.crit === void 0)
+    return [];
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0))
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
+  for (const parameter of protectedHeader.crit) {
+    if (!(parameter in recognized))
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
   }
-  if (normalized.key_ops !== void 0) {
-    const value = normalized.key_ops;
-    const keyOps = Array.isArray(value) ? [...value] : void 0;
-    if (!keyOps || keyOps.some((operation) => typeof operation !== "string") || new Set(keyOps).size !== keyOps.length) {
-      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
-    }
-    normalized.key_ops = keyOps;
+  return protectedHeader.crit;
+}
+function validateB64(protectedHeader, extensions) {
+  if (extensions.includes("b64")) {
+    const b64 = protectedHeader.b64;
+    if (typeof b64 != "boolean")
+      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    return b64;
   }
-  return normalized;
+  return true;
 }
 
 // node_modules/jose/dist/webapi/lib/key.js
@@ -41878,60 +41802,55 @@ var jwkMatchesOp = (entry, key, usage) => {
   const { alg } = entry;
   if (key.use !== void 0) {
     const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
-    if (key.use !== expected) {
+    if (key.use !== expected)
       throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-    }
   }
-  if (key.alg !== void 0 && key.alg !== alg) {
+  if (key.alg !== void 0 && key.alg !== alg)
     throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
-  }
   if (Array.isArray(key.key_ops)) {
     const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
-    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) {
+    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))
       throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
-    }
   }
 };
-function checkKeyType(entry, key, usage) {
-  const { alg, secret } = entry;
-  const privateKey = usage === "decrypt" || usage === "sign";
+async function prepareKey(entry, key, usage) {
+  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
   if (secret && key instanceof Uint8Array)
-    return [BYTES, key];
+    return key;
+  let normalized, keyObject;
   if (isObject2(key)) {
-    const normalized = normalizeJwk(key);
-    if (typeof normalized.kty !== "string") {
-      throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
-    }
-    const valid = secret ? normalized.kty === "oct" && typeof normalized.k === "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv === "string" || typeof normalized.d === "string" : normalized.d === void 0 && normalized.priv === void 0);
-    if (!valid) {
-      throw new TypeError(secret ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present` : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
-    }
-    jwkMatchesOp(entry, normalized, usage);
-    return [JWK, key, normalized];
-  }
-  if (!isKeyLike(key)) {
-    throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
-  }
-  if (secret) {
-    if (key.type !== "secret") {
-      throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
+    if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
+      throw invalidKeyType(alg, key, secret);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
+      return decode2(normalized.k);
+    if (!Object.isFrozen(key)) {
+      const { key_ops } = key;
+      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
     }
   } else {
-    if (key.type === "secret") {
-      throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
-    }
-    const expectedType = privateKey ? "private" : "public";
-    if ((key.type === "public" || key.type === "private") && key.type !== expectedType) {
-      const operation = usage === "sign" ? "signing" : usage === "verify" ? "verifying" : `${usage.slice(0, -1)}tion`;
-      throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation} must be of type "${expectedType}"`);
-    }
+    if (!isKeyLike(key))
+      throw invalidKeyType(alg, key, secret);
+    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
+      throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+    if (isCryptoKey(key))
+      return key;
+    if (keyObject = key, keyObject.type === "secret")
+      return keyObject.export();
   }
-  return isCryptoKey(key) ? [CRYPTO, key] : [KEYOBJECT, key];
+  cache ||= /* @__PURE__ */ new WeakMap();
+  const cacheKey = key;
+  let cached2 = cache.get(cacheKey);
+  if (cached2?.[alg])
+    return cached2[alg];
+  if (cached2 || cache.set(cacheKey, cached2 = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+    const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;
+    return cached2[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+  }
+  return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached2[alg] = await jwkToKey(entry, normalized);
 }
-var BYTES = 0;
-var CRYPTO = 1;
-var KEYOBJECT = 2;
-var JWK = 3;
 var cache;
 var nist = {
   __proto__: null,
@@ -41939,139 +41858,83 @@ var nist = {
   secp384r1: "P-384",
   secp521r1: "P-521"
 };
-function cached2(key, alg, value) {
-  cache ||= /* @__PURE__ */ new WeakMap();
-  const entry = cache.get(key);
-  if (value) {
-    if (entry) {
-      entry[alg] = value;
-    } else {
-      cache.set(key, { [alg]: value });
-    }
-  }
-  return value ?? entry?.[alg];
-}
-var handleJWK = async (key, jwk, entry) => cached2(key, entry.alg) ?? cached2(key, entry.alg, await jwkToKey(entry, { ...jwk, alg: entry.alg }));
-var handleKeyObject = (keyObject, entry) => {
-  const hit = cached2(keyObject, entry.alg);
-  if (hit)
-    return hit;
-  const isPublic = keyObject.type === "public";
-  const usages = entry.usages[isPublic ? 0 : 1];
-  const { asymmetricKeyType } = keyObject;
-  const crv = nist[keyObject.asymmetricKeyDetails?.namedCurve];
-  const params = entry.resolve?.({ crv, asymmetricKeyType }) ?? entry.subtle;
-  return cached2(keyObject, entry.alg, keyObject.toCryptoKey(params, isPublic, usages));
+var isCryptoKey = (key) => {
+  if (key?.[Symbol.toStringTag] === "CryptoKey")
+    return true;
+  try {
+    return key instanceof CryptoKey;
+  } catch {
+    return false;
+  }
 };
-async function prepareKey(entry, key, usage) {
-  const tagged = checkKeyType(entry, key, usage);
-  switch (tagged[0]) {
-    case BYTES:
-    case CRYPTO:
-      return tagged[1];
-    case JWK: {
-      const key2 = tagged[1];
-      const normalized = tagged[2];
-      if (normalized.kty === "oct") {
-        return decode2(normalized.k);
-      }
-      if (!Object.isFrozen(key2)) {
-        const { key_ops } = key2;
-        if (Array.isArray(key_ops))
-          Object.freeze(key_ops);
-        Object.freeze(key2);
-      }
-      return handleJWK(key2, normalized, entry);
-    }
-    case KEYOBJECT: {
-      const keyObject = tagged[1];
-      if (keyObject.type === "secret") {
-        return keyObject.export();
-      }
-      if ("toCryptoKey" in keyObject && typeof keyObject.toCryptoKey === "function") {
-        return handleKeyObject(keyObject, entry);
-      }
-      return handleJWK(keyObject, keyObject.export({ format: "jwk" }), entry);
-    }
+var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `one of type ${types.join(", ")}, or ${last}.`;
+  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+  return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+function invalidKeyType(alg, actual, secret) {
+  const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
+  return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+}
+var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+  if (usage && !key.usages.includes(usage))
+    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+  const { modulusLength } = key.algorithm;
+  if (typeof modulusLength != "number" || modulusLength < 2048)
+    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+  const algorithm = key.algorithm;
+  if (algorithm.name !== expected.name)
+    throw unusable(expected.name);
+  if (expected.hash && algorithm.hash?.name !== expected.hash)
+    throw unusable(expected.hash, "algorithm.hash");
+  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)
+    throw unusable(expected.namedCurve, "algorithm.namedCurve");
+  if (expected.length !== void 0 && algorithm.length !== expected.length)
+    throw unusable(expected.length, "algorithm.length");
+  checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== void 0 && typeof normalized.ext != "boolean")
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  if (normalized.key_ops !== void 0) {
+    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+    if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length)
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    normalized.key_ops = keyOps;
   }
+  return normalized;
+}
+async function jwkToKey(entry, jwk, extractable) {
+  if (!entry.kty.includes(jwk.kty))
+    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
+  return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+async function rawKey(key, expected, usage, extractable = false) {
+  return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
 }
 
 // node_modules/jose/dist/webapi/lib/key_descriptor.js
 function table(entries) {
   const out = { __proto__: null };
-  for (const alg in entries) {
+  for (const alg in entries)
     out[alg] = { ...entries[alg], alg };
-  }
   return out;
 }
 
-// node_modules/jose/dist/webapi/lib/options.js
-var JWS_RECOGNIZED = { __proto__: null, b64: true };
-function validateAlgorithms(option, algorithms) {
-  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) {
-    throw new TypeError(`"${option}" option must be an array of strings`);
-  }
-  if (!algorithms) {
-    return void 0;
-  }
-  return new Set(algorithms);
-}
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) {
-    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
-  }
-  if (!protectedHeader || protectedHeader.crit === void 0) {
-    return [];
-  }
-  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) {
-    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
-  }
-  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
-  for (const parameter of protectedHeader.crit) {
-    if (!(parameter in recognized)) {
-      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-    }
-    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0) {
-      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-    }
-    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0)) {
-      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-    }
-  }
-  return protectedHeader.crit;
-}
-function validateB64(protectedHeader, extensions) {
-  if (extensions.includes("b64")) {
-    const b64 = protectedHeader.b64;
-    if (typeof b64 !== "boolean") {
-      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-    }
-    return b64;
-  }
-  return true;
-}
-
-// node_modules/jose/dist/webapi/lib/signing.js
-async function getSigKey(entry, key, usage) {
-  if (key instanceof Uint8Array) {
-    return crypto.subtle.importKey("raw", key, entry.subtle, false, [
-      usage
-    ]);
-  }
-  checkCryptoKey(key, entry.subtle, usage);
-  if (entry.minRsaBits)
-    checkModulusLength(entry.alg, key);
-  return key;
-}
-async function verify(entry, key, signature, data) {
-  const cryptoKey = await getSigKey(entry, key, "verify");
-  try {
-    return await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
-  } catch {
-    return false;
-  }
-}
-
 // node_modules/jose/dist/webapi/lib/jws_algorithms.js
 var sig = [["verify"], ["sign"]];
 function hmac(bits) {
@@ -42079,8 +41942,7 @@ function hmac(bits) {
   return { kty: ["oct"], secret: true, subtle, signing: subtle, usages: sig };
 }
 function rsa(bits, saltLength) {
-  const name = saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5";
-  const subtle = { name, hash: `SHA-${bits}` };
+  const subtle = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
   return {
     kty: ["RSA"],
     subtle,
@@ -42109,8 +41971,7 @@ function eddsa() {
   };
 }
 function mldsa(bits) {
-  const name = `ML-DSA-${bits}`;
-  const subtle = { name };
+  const subtle = { name: `ML-DSA-${bits}` };
   return {
     kty: ["AKP"],
     subtle,
@@ -42138,10 +41999,9 @@ var JWS = table({
   "ML-DSA-87": mldsa(87)
 });
 function jwsAlgorithm(alg) {
-  const entry = typeof alg === "string" ? JWS[alg] : void 0;
-  if (!entry) {
+  const entry = typeof alg == "string" ? JWS[alg] : void 0;
+  if (!entry)
     throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-  }
   return entry;
 }
 
@@ -42149,19 +42009,8 @@ function jwsAlgorithm(alg) {
 function prepareVerify(options) {
   return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
 }
-function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid")) {
-  return parsedProtected;
-}
-function validateJwsHeaders(parsedProt, joseHeader, shared) {
-  const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader));
-  const alg = joseHeader.alg;
-  if (typeof alg !== "string" || !alg) {
-    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-  }
-  if (shared[0] && !shared[0].has(alg)) {
-    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-  }
-  return [b64, alg];
+function parseProtectedHeader(encodedProtected) {
+  return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
 }
 function encodeCompactUnencodedPayload(payload) {
   try {
@@ -42170,39 +42019,42 @@ function encodeCompactUnencodedPayload(payload) {
     throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
   }
 }
-async function verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload) {
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+  if (!isDisjoint(parsedProt, header))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  if (shared[0] && !shared[0].has(alg))
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+  if (b64) {
+    if (typeof inputPayload != "string")
+      throw new JWSInvalid("JWS Payload must be a string");
+  } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
+    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+  const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
   let resolvedKey = false;
-  if (typeof key === "function") {
-    key = await key(parsedProt, jws);
-    resolvedKey = true;
-  }
-  const b64 = typeof signingPayload === "string";
-  const entry = jwsAlgorithm(alg);
-  const data = concat(encodedProtected !== void 0 ? encode2(encodedProtected) : new Uint8Array(), encode2("."), b64 ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload);
-  const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
-  const k = await prepareKey(entry, key, "verify");
-  if (!await verify(entry, k, signature, data)) {
-    throw new JWSSignatureVerificationFailed();
+  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
+  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode2(encodedProtected) : new Uint8Array(), encode2("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+  let verified = false;
+  try {
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+  } catch {
   }
-  const payload = b64 ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload;
-  return [payload, parsedProt, b64, k, resolvedKey];
+  if (!verified)
+    throw new JWSSignatureVerificationFailed();
+  const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
 }
 async function verifyCompact(jws, shared, key) {
-  if (jws instanceof Uint8Array) {
-    jws = decoder.decode(jws);
-  }
-  if (typeof jws !== "string") {
+  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string")
     throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
-  }
   const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
-  if (length !== 3) {
+  if (length !== 3)
     throw new JWSInvalid("Invalid Compact JWS");
-  }
-  const compactJws = { payload, protected: protectedHeader, signature };
-  const parsedProt = parseProtectedHeader(protectedHeader);
-  const [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared);
-  const signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
-  return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
+  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
 }
 
 // node_modules/jose/dist/webapi/lib/jwt_claims_set.js
@@ -42221,50 +42073,29 @@ function invalidDuration() {
   throw new TypeError("Invalid time period format");
 }
 function secs(str) {
-  if (typeof str !== "string") {
-    invalidDuration();
-  }
+  typeof str != "string" && invalidDuration();
   const matched = REGEX.exec(str);
-  if (!matched || matched[4] && matched[1]) {
-    invalidDuration();
-  }
-  const value = parseFloat(matched[2]);
-  const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-  if (!Number.isFinite(numericDate)) {
-    invalidDuration();
-  }
-  if (matched[1] === "-" || matched[4] === "ago") {
-    return -numericDate;
-  }
-  return numericDate;
+  (!matched || matched[4] && matched[1]) && invalidDuration();
+  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
 }
 function validateInput(label, input) {
-  if (!Number.isFinite(input)) {
+  if (!Number.isFinite(input))
     throw new TypeError(`Invalid ${label} input`);
-  }
   return input;
 }
 var normalizeTyp = (value) => {
   const normalized = value.toLowerCase();
   return value.includes("/") ? normalized : `application/${normalized}`;
 };
-var checkAudiencePresence = (audPayload, audOption) => {
-  if (typeof audPayload === "string") {
-    return audOption.includes(audPayload);
-  }
-  if (Array.isArray(audPayload)) {
-    return audOption.some((aud) => audPayload.includes(aud));
-  }
-  return false;
-};
+var checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
 function validateNumericDate(payload, claim2, required2 = false) {
   const value = payload[claim2];
-  if (value === void 0 && !required2)
-    return void 0;
-  if (typeof value !== "number") {
-    throw new JWTClaimValidationFailed(`"${claim2}" claim must be a number`, payload, claim2, "invalid");
+  if (!(value === void 0 && !required2)) {
+    if (typeof value != "number")
+      throw new JWTClaimValidationFailed(`"${claim2}" claim must be a number`, payload, claim2, "invalid");
+    return value;
   }
-  return value;
 }
 function unexpectedClaim(payload, claim2) {
   throw new JWTClaimValidationFailed(`unexpected "${claim2}" claim value`, payload, claim2, checkFailed);
@@ -42275,107 +42106,70 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
     payload = JSON.parse(strictDecoder.decode(encodedPayload));
   } catch {
   }
-  if (!isObject2(payload)) {
+  if (!isObject2(payload))
     throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
-  }
   const { typ } = options;
-  if (typ !== void 0 && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+  if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
     throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
-  }
-  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
-  const presenceCheck = [...requiredClaims];
-  if (maxTokenAge !== void 0)
-    presenceCheck.push("iat");
-  if (audience !== void 0)
-    presenceCheck.push("aud");
-  if (subject !== void 0)
-    presenceCheck.push("sub");
-  if (issuer !== void 0)
-    presenceCheck.push("iss");
-  for (const claim2 of new Set(presenceCheck.reverse())) {
-    if (!Object.hasOwn(payload, claim2)) {
+  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+  maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+  for (const claim2 of new Set(presenceCheck.reverse()))
+    if (!Object.hasOwn(payload, claim2))
       throw new JWTClaimValidationFailed(`missing required "${claim2}" claim`, payload, claim2, "missing");
-    }
-  }
-  if (issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-    unexpectedClaim(payload, "iss");
-  }
-  if (subject !== void 0 && payload.sub !== subject) {
-    unexpectedClaim(payload, "sub");
-  }
-  if (audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience === "string" ? [audience] : audience)) {
-    unexpectedClaim(payload, "aud");
-  }
+  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
   const { clockTolerance } = options;
   let tolerance = 0;
-  if (typeof clockTolerance === "string") {
+  if (typeof clockTolerance == "string")
     tolerance = secs(clockTolerance);
-  } else if (clockTolerance !== void 0) {
-    if (typeof clockTolerance !== "number") {
+  else if (clockTolerance !== void 0) {
+    if (typeof clockTolerance != "number")
       throw new TypeError("Invalid clockTolerance option type");
-    }
     tolerance = clockTolerance;
   }
   validateInput("clockTolerance option", tolerance);
-  const { currentDate } = options;
-  const now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate));
-  const iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0);
-  const nbf = validateNumericDate(payload, "nbf");
-  if (nbf !== void 0) {
-    if (nbf > now + tolerance) {
-      throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
-    }
-  }
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+  if (nbf !== void 0 && nbf > now + tolerance)
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
   const exp = validateNumericDate(payload, "exp");
-  if (exp !== void 0) {
-    if (exp <= now - tolerance) {
-      throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
-    }
-  }
+  if (exp !== void 0 && exp <= now - tolerance)
+    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
   if (maxTokenAge !== void 0) {
-    const age = now - iat;
-    const max = validateInput("maxTokenAge option", typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge));
-    if (age - tolerance > max) {
+    const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+    if (age - tolerance > max)
       throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
-    }
-    if (age < -tolerance) {
+    if (age < -tolerance)
       throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
-    }
   }
   return payload;
 }
 
 // node_modules/jose/dist/webapi/jwt/verify.js
 async function jwtVerify(jwt, key, options) {
-  const verified = await verifyCompact(jwt, prepareVerify(options), key);
-  if (!verified[2]) {
+  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+  if (!b64)
     throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-  }
-  const payload = validateClaimsSet(verified[1], verified[0], options);
-  const result = { payload, protectedHeader: verified[1] };
-  if (typeof key === "function") {
-    return { ...result, key: verified[3] };
-  }
-  return result;
+  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+  return { ...verified, payload };
 }
 
 // node_modules/jose/dist/webapi/jwks/local.js
 function isUsableJWK(jwk, entry, alg, kid) {
-  const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk);
-  const keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
-  return (ext === void 0 || typeof ext === "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation === "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid === "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
+  const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
+  return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
 }
 async function importWithAlgCache(cache2, jwk, entry) {
-  const cached3 = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk);
-  const { alg } = entry;
-  if (cached3[alg] === void 0) {
-    const key = await jwkToKey(entry, { ...jwk, alg, ext: true });
-    if (key.type !== "public") {
-      throw new JWKSInvalid("JSON Web Key Set members must be public keys");
-    }
-    cached3[alg] = key;
+  const cached2 = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk), { alg } = entry;
+  if (cached2[alg] === void 0) {
+    const pending = jwkToKey(entry, jwk, true).then((key) => {
+      if (key.type !== "public")
+        throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+      return cached2[alg] = key, key;
+    }).catch((error2) => {
+      throw cached2[alg] === pending && delete cached2[alg], error2;
+    });
+    cached2[alg] = pending;
   }
-  return cached3[alg];
+  return cached2[alg];
 }
 function createLocalJWKSet(jwks) {
   let snapshot;
@@ -42383,51 +42177,42 @@ function createLocalJWKSet(jwks) {
     snapshot = structuredClone(jwks);
   } catch {
   }
-  if (!isJwkSet(snapshot)) {
+  if (!isJwkSet(snapshot))
     throw new JWKSInvalid("JSON Web Key Set malformed");
-  }
-  const cached3 = /* @__PURE__ */ new WeakMap();
-  const localJWKSet = async (protectedHeader, token) => {
-    const { alg, kid } = { ...protectedHeader, ...token?.header };
-    const entry = typeof alg === "string" ? JWS[alg] : void 0;
-    if (!entry || entry.secret) {
+  const metadata = snapshot.keys.map((jwk) => {
+    const normalized = snapshotJwk(jwk);
+    return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
+  }), cached2 = /* @__PURE__ */ new WeakMap();
+  return Object.defineProperty(async (protectedHeader, token) => {
+    const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : void 0;
+    if (!entry || entry.secret)
       throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-    const candidates = snapshot.keys.filter((jwk2) => isUsableJWK(jwk2, entry, alg, kid));
-    const { 0: jwk, length } = candidates;
-    if (!length) {
+    const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
+    if (!length)
       throw new JWKSNoMatchingKey();
-    }
     if (length !== 1) {
       const error2 = new JWKSMultipleMatchingKeys();
-      error2[Symbol.asyncIterator] = async function* () {
-        for (const jwk2 of candidates) {
+      throw error2[Symbol.asyncIterator] = async function* () {
+        for (const jwk2 of candidates)
           try {
-            yield await importWithAlgCache(cached3, jwk2, entry);
+            yield await importWithAlgCache(cached2, jwk2, entry);
           } catch {
           }
-        }
-      };
-      throw error2;
+      }, error2;
     }
-    return importWithAlgCache(cached3, jwk, entry);
-  };
-  return Object.defineProperty(localJWKSet, "jwks", {
+    return importWithAlgCache(cached2, jwk, entry);
+  }, "jwks", {
     value: () => structuredClone(snapshot)
   });
 }
 
 // node_modules/jose/dist/webapi/jwks/remote.js
 function isCloudflareWorkers() {
-  return typeof WebSocketPair !== "undefined" || typeof navigator !== "undefined" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime !== "undefined" && EdgeRuntime === "vercel";
+  return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 var USER_AGENT;
-if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
-  const NAME = "jose";
-  const VERSION2 = "v6.2.10";
-  USER_AGENT = `${NAME}/${VERSION2}`;
-}
-var customFetch = Symbol();
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
+var customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url2, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url2, {
     method: "GET",
@@ -42435,106 +42220,64 @@ async function fetchJwks(url2, headers, signal, fetchImpl = fetch) {
     redirect: "manual",
     headers
   }).catch((err) => {
-    if (err.name === "TimeoutError") {
-      throw new JWKSTimeout();
-    }
-    throw err;
+    throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
   });
-  if (response.status !== 200) {
+  if (response.status !== 200)
     throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
-  }
   try {
     return await response.json();
   } catch {
     throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
   }
 }
-var jwksCache = Symbol();
+var jwksCache = /* @__PURE__ */ Symbol();
 function isFreshFor(timestamp, duration3) {
   return Number.isFinite(timestamp) && Date.now() < timestamp + duration3;
 }
 function validateDuration(value, fallback, option) {
-  if (Number.isNaN(value)) {
+  if (Number.isNaN(value))
     throw new TypeError(`"${option}" option must not be NaN`);
-  }
-  return typeof value === "number" ? value : fallback;
+  return typeof value == "number" ? value : fallback;
 }
 function createRemoteJWKSet(url2, options) {
-  if (!(url2 instanceof URL)) {
+  if (!(url2 instanceof URL))
     throw new TypeError("url must be an instance of URL");
-  }
-  const href = new URL(url2.href).href;
-  const opts = options ?? {};
-  const timeoutOption = opts.timeoutDuration;
-  if (typeof timeoutOption === "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0)) {
+  const href = new URL(url2.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
+  if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))
     throw new TypeError('"timeoutDuration" option must be a non-negative integer');
-  }
-  const timeoutDuration = typeof timeoutOption === "number" ? timeoutOption : 5e3;
-  const cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration");
-  const cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge");
-  const headers = new Headers(opts.headers);
-  if (USER_AGENT && !headers.has("User-Agent")) {
-    headers.set("User-Agent", USER_AGENT);
-  }
-  if (!headers.has("accept")) {
-    headers.set("accept", "application/json, application/jwk-set+json");
-  }
-  const fetchImpl = opts[customFetch];
-  const cache2 = opts[jwksCache];
-  let jwksTimestamp;
-  let pendingFetch;
-  let reloadSequence = 0;
-  let appliedSequence = 0;
-  let local;
-  if (cache2 && typeof cache2 === "object") {
+  const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge"), headers = new Headers(opts.headers);
+  USER_AGENT && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
+  const fetchImpl = opts[customFetch], cache2 = opts[jwksCache];
+  let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
+  if (cache2 && typeof cache2 == "object") {
     const { uat, jwks } = cache2;
-    if (isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks)) {
-      jwksTimestamp = uat;
-      local = createLocalJWKSet(jwks);
-    }
+    isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
   }
   const reload = async () => {
-    if (pendingFetch && isCloudflareWorkers()) {
-      pendingFetch = void 0;
-    }
-    if (!pendingFetch) {
-      const sequence = ++reloadSequence;
-      const current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+    if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {
+      const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
         const next = createLocalJWKSet(json);
-        if (sequence <= appliedSequence) {
+        if (sequence <= appliedSequence)
           return;
-        }
         local = next;
         const updatedAt = Date.now();
-        if (cache2) {
-          cache2.uat = updatedAt;
-          cache2.jwks = json;
-        }
-        jwksTimestamp = updatedAt;
-        appliedSequence = sequence;
+        cache2 && (cache2.uat = updatedAt, cache2.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;
       }).finally(() => {
-        if (pendingFetch === current) {
-          pendingFetch = void 0;
-        }
+        pendingFetch === current && (pendingFetch = void 0);
       });
     }
     await pendingFetch;
   };
-  const remoteJWKSet = async (protectedHeader, token) => {
-    if (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) {
-      await reload();
-    }
+  return Object.defineProperties(async (protectedHeader, token) => {
+    (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
     try {
       return await local(protectedHeader, token);
     } catch (err) {
-      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration)) {
-        await reload();
-        return local(protectedHeader, token);
-      }
+      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))
+        return await reload(), local(protectedHeader, token);
       throw err;
     }
-  };
-  return Object.defineProperties(remoteJWKSet, {
+  }, {
     coolingDown: {
       get: () => isFreshFor(jwksTimestamp, cooldownDuration),
       enumerable: true
@@ -42637,16 +42380,16 @@ var JwtAuthProvider = class _JwtAuthProvider extends AuthProvider {
   }
   async verifyToken(token) {
     const cacheKey = await this.hashToken(token);
-    const cached3 = this.tokenCache.get(cacheKey);
-    if (cached3 && Date.now() < cached3.expiresAt) {
+    const cached2 = this.tokenCache.get(cacheKey);
+    if (cached2 && Date.now() < cached2.expiresAt) {
       if (isOtelEnabled()) {
         recordAuthEvent("cache_hit", {
-          subject: cached3.authInfo.subject ?? ""
+          subject: cached2.authInfo.subject ?? ""
         });
       }
-      return cached3.authInfo;
+      return cached2.authInfo;
     }
-    if (cached3) this.tokenCache.delete(cacheKey);
+    if (cached2) this.tokenCache.delete(cacheKey);
     try {
       const { payload } = await jwtVerify(token, this.jwks, {
         issuer: this.options.issuer,
@@ -48522,8 +48265,8 @@ var FrappeClient = class {
   async list(doctype, options = {}, opts = {}) {
     const cacheKey = `list:${doctype}:${stableStringify(options)}`;
     if (!opts.skipCache) {
-      const cached3 = this.cache.get(cacheKey);
-      if (cached3 !== void 0) return cached3;
+      const cached2 = this.cache.get(cacheKey);
+      if (cached2 !== void 0) return cached2;
     }
     const params = new URLSearchParams();
     if (options.fields && options.fields.length > 0) {
@@ -48563,8 +48306,8 @@ var FrappeClient = class {
   async get(doctype, name, opts = {}) {
     const cacheKey = `get:${doctype}:${name}`;
     if (!opts.skipCache) {
-      const cached3 = this.cache.get(cacheKey);
-      if (cached3 !== void 0) return cached3;
+      const cached2 = this.cache.get(cacheKey);
+      if (cached2 !== void 0) return cached2;
     }
     const res = await this.request(
       "GET",
@@ -53716,7 +53459,66 @@ function loadMethodAllowlist() {
   return parseAllowlist(env6("ERPNEXT_METHOD_ALLOWLIST"));
 }
 
+// src/tools/purchase-invoice-hints.ts
+var PURCHASE_INVOICE_DOCTYPE = "Purchase Invoice";
+var PARTY_ACCOUNT_HINT = "Set data.credit_to, or configure Supplier/Supplier Group accounts, or Company.default_payable_account.";
+var GRNI_HINT = "Company.stock_received_but_not_billed is required with perpetual inventory even if update_stock is 0.";
+function isPurchaseInvoiceDoctype(doctype) {
+  return doctype === PURCHASE_INVOICE_DOCTYPE;
+}
+function stripHtml(text) {
+  return text.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+}
+function purchaseInvoiceAccountHint(text) {
+  const haystack = stripHtml(text);
+  if (isEmptyPartyAccountCurrencyNone(haystack)) {
+    return PARTY_ACCOUNT_HINT;
+  }
+  if (/please set default stock received but not billed in company/i.test(
+    haystack
+  )) {
+    return GRNI_HINT;
+  }
+  return void 0;
+}
+function annotateKnownPurchaseInvoiceAccountError(error2) {
+  if (error2 instanceof FrappeAPIError && error2.status === 417) {
+    let hint = purchaseInvoiceAccountHint(error2.message);
+    if (!hint) {
+      const bodyMessage = readErrorBodyMessage(error2.body);
+      if (bodyMessage) {
+        hint = purchaseInvoiceAccountHint(bodyMessage);
+      }
+    }
+    if (hint && !error2.message.includes(hint)) {
+      error2.message = `${error2.message} ${hint}`;
+    }
+  }
+  throw error2;
+}
+async function withPurchaseInvoiceAccountHints(fn) {
+  try {
+    return await fn();
+  } catch (error2) {
+    annotateKnownPurchaseInvoiceAccountError(error2);
+  }
+}
+function readErrorBodyMessage(body) {
+  if (typeof body === "string") return body;
+  if (body === null || typeof body !== "object" || Array.isArray(body)) {
+    return void 0;
+  }
+  const message2 = body.message;
+  return typeof message2 === "string" ? message2 : void 0;
+}
+function isEmptyPartyAccountCurrencyNone(text) {
+  return /party account\s+(?:none\s+)?currency\s*\(\s*none\s*\)\s+and document currency\s*\([^)]*\)\s+should be same/i.test(text);
+}
+
 // src/tools/operations.ts
+async function withPiAccountHintsIfNeeded(doctype, fn) {
+  return isPurchaseInvoiceDoctype(doctype) ? await withPurchaseInvoiceAccountHints(fn) : await fn();
+}
 var operationsTools = [
   // ── File Attachments ───────────────────────────────────────────────────────
   {
@@ -53835,9 +53637,12 @@ var operationsTools = [
           "[erpnext_doc_create] 'data' must be an object with document fields"
         );
       }
-      const doc = await ctx.client.create(
+      const doc = await withPiAccountHintsIfNeeded(
         input.doctype,
-        input.data
+        () => ctx.client.create(
+          input.doctype,
+          input.data
+        )
       );
       return {
         data: doc,
@@ -53881,10 +53686,13 @@ var operationsTools = [
           "[erpnext_doc_update] 'data' must be an object with fields to update"
         );
       }
-      const doc = await ctx.client.update(
+      const doc = await withPiAccountHintsIfNeeded(
         input.doctype,
-        input.name,
-        input.data
+        () => ctx.client.update(
+          input.doctype,
+          input.name,
+          input.data
+        )
       );
       return {
         data: doc,
@@ -53955,25 +53763,30 @@ var operationsTools = [
       if (!input.name) {
         throw new Error("[erpnext_doc_submit] 'name' is required");
       }
-      const doc = await ctx.client.get(
-        input.doctype,
-        input.name,
-        { skipCache: true }
-      );
-      const docWithDoctype = { ...doc, doctype: input.doctype };
-      const patchedDoc = withRoundedTotalFallback(docWithDoctype);
-      const result = await ctx.client.callMethod("frappe.client.submit", {
-        doc: patchedDoc
+      return await withPiAccountHintsIfNeeded(input.doctype, async () => {
+        const doc = await ctx.client.get(
+          input.doctype,
+          input.name,
+          { skipCache: true }
+        );
+        const docWithDoctype = { ...doc, doctype: input.doctype };
+        const patchedDoc = withRoundedTotalFallback(docWithDoctype);
+        const result = await ctx.client.callMethod("frappe.client.submit", {
+          doc: patchedDoc
+        });
+        ctx.client.invalidate(input.doctype, input.name);
+        const warnings = roundedTotalFallbackWarning(
+          docWithDoctype,
+          patchedDoc
+        );
+        return {
+          data: result,
+          message: `${input.doctype} ${input.name} submitted successfully`,
+          doctype: input.doctype,
+          name: input.name,
+          ...warnings.length > 0 ? { warnings } : {}
+        };
       });
-      ctx.client.invalidate(input.doctype, input.name);
-      const warnings = roundedTotalFallbackWarning(docWithDoctype, patchedDoc);
-      return {
-        data: result,
-        message: `${input.doctype} ${input.name} submitted successfully`,
-        doctype: input.doctype,
-        name: input.name,
-        ...warnings.length > 0 ? { warnings } : {}
-      };
     }
   },
   // ── Generic Cancel ────────────────────────────────────────────────────────
@@ -57452,7 +57265,7 @@ async function main() {
   );
   const server = new McpApp({
     name: "mcp-erpnext",
-    version: "3.0.3",
+    version: "3.0.4",
     transport: "stateless",
     cache: {
       ttlMs: 36e5,