@casys/mcp-erpnext 3.1.0 → 3.2.0-beta.1

package/mcp-erpnext.mjs

@@ -1784,14 +1784,14 @@ var require_code3 = __commonJS({
     }
     exports.callValidateCode = callValidateCode;
     var newRegExp = (0, codegen_1._)`new RegExp`;
-    function usePattern({ gen, it: { opts } }, pattern) {
+    function usePattern({ gen, it: { opts } }, pattern2) {
       const u = opts.unicodeRegExp ? "u" : "";
       const { regExp } = opts.code;
-      const rx = regExp(pattern, u);
+      const rx = regExp(pattern2, u);
       return gen.scopeValue("pattern", {
         key: rx.toString(),
         ref: rx,
-        code: (0, codegen_1._)`${regExp.code === "new RegExp" ? newRegExp : (0, util_2.useFunc)(gen, regExp)}(${pattern}, ${u})`
+        code: (0, codegen_1._)`${regExp.code === "new RegExp" ? newRegExp : (0, util_2.useFunc)(gen, regExp)}(${pattern2}, ${u})`
       });
     }
     exports.usePattern = usePattern;
@@ -6902,7 +6902,7 @@ var require_discriminator2 = __commonJS({
       error: error2,
       code(cxt) {
         const { gen, data, schema, parentSchema, it } = cxt;
-        const { oneOf } = parentSchema;
+        const { oneOf: oneOf2 } = parentSchema;
         if (!it.opts.discriminator) {
           throw new Error("discriminator: requires discriminator option");
         }
@@ -6911,7 +6911,7 @@ var require_discriminator2 = __commonJS({
           throw new Error("discriminator: requires propertyName");
         if (schema.mapping)
           throw new Error("discriminator: mapping is not supported");
-        if (!oneOf)
+        if (!oneOf2)
           throw new Error("discriminator: requires oneOf keyword");
         const valid = gen.let("valid", false);
         const tag2 = gen.const("tag", (0, codegen_1._)`${data}${(0, codegen_1.getProperty)(tagName)}`);
@@ -6939,8 +6939,8 @@ var require_discriminator2 = __commonJS({
           const oneOfMapping = {};
           const topRequired = hasRequired(parentSchema);
           let tagRequired = true;
-          for (let i = 0; i < oneOf.length; i++) {
-            let sch = oneOf[i];
+          for (let i = 0; i < oneOf2.length; i++) {
+            let sch = oneOf2[i];
             if ((sch === null || sch === void 0 ? void 0 : sch.$ref) && !(0, util_1.schemaHasRulesButRef)(sch, it.self.RULES)) {
               const ref = sch.$ref;
               sch = compile_1.resolveRef.call(it.self, it.schemaEnv.root, it.baseId, ref);
@@ -9022,9 +9022,9 @@ ${indent}`) + "'";
         return quotedString(value, ctx);
       }
       const indent = ctx.indent || (ctx.forceBlockIndent || containsDocumentMarker(value) ? "  " : "");
-      const literal2 = blockQuote === "literal" ? true : blockQuote === "folded" || type === Scalar.Scalar.BLOCK_FOLDED ? false : type === Scalar.Scalar.BLOCK_LITERAL ? true : !lineLengthOverLimit(value, lineWidth, indent.length);
+      const literal3 = blockQuote === "literal" ? true : blockQuote === "folded" || type === Scalar.Scalar.BLOCK_FOLDED ? false : type === Scalar.Scalar.BLOCK_LITERAL ? true : !lineLengthOverLimit(value, lineWidth, indent.length);
       if (!value)
-        return literal2 ? "|\n" : ">\n";
+        return literal3 ? "|\n" : ">\n";
       let chomp;
       let endStart;
       for (endStart = value.length; endStart > 0; --endStart) {
@@ -9073,7 +9073,7 @@ ${indent}`) + "'";
         if (onComment)
           onComment();
       }
-      if (!literal2) {
+      if (!literal3) {
         const foldedValue = value.replace(/\n+/g, "\n$&").replace(/(?:^|\n)([\t ].*)(?:([\n\t ]*)\n(?![\n\t ]))?/g, "$1$2").replace(/\n+/g, `$&${indent}`);
         let literalFallback = false;
         const foldOptions = getFoldOptions(ctx, true);
@@ -16837,8 +16837,8 @@ var $ZodCheckUpperCase = /* @__PURE__ */ $constructor("$ZodCheckUpperCase", (ins
 var $ZodCheckIncludes = /* @__PURE__ */ $constructor("$ZodCheckIncludes", (inst, def) => {
   $ZodCheck.init(inst, def);
   const escapedRegex = escapeRegex(def.includes);
-  const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position},}${escapedRegex}` : escapedRegex);
-  def.pattern = pattern;
+  const pattern2 = new RegExp(typeof def.position === "number" ? `^.{${def.position},}${escapedRegex}` : escapedRegex);
+  def.pattern = pattern2;
   inst._zod.check = (payload) => {
     if (payload.value.includes(def.includes, def.position))
       return;
@@ -16855,8 +16855,8 @@ var $ZodCheckIncludes = /* @__PURE__ */ $constructor("$ZodCheckIncludes", (inst,
 });
 var $ZodCheckStartsWith = /* @__PURE__ */ $constructor("$ZodCheckStartsWith", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
-  def.pattern ?? (def.pattern = pattern);
+  const pattern2 = new RegExp(`^${escapeRegex(def.prefix)}.*`);
+  def.pattern ?? (def.pattern = pattern2);
   inst._zod.check = (payload) => {
     if (payload.value.startsWith(def.prefix))
       return;
@@ -16873,8 +16873,8 @@ var $ZodCheckStartsWith = /* @__PURE__ */ $constructor("$ZodCheckStartsWith", (i
 });
 var $ZodCheckEndsWith = /* @__PURE__ */ $constructor("$ZodCheckEndsWith", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
-  def.pattern ?? (def.pattern = pattern);
+  const pattern2 = new RegExp(`.*${escapeRegex(def.suffix)}$`);
+  def.pattern ?? (def.pattern = pattern2);
   inst._zod.check = (payload) => {
     if (payload.value.endsWith(def.suffix))
       return;
@@ -18435,8 +18435,8 @@ var $ZodOptional = /* @__PURE__ */ $constructor("$ZodOptional", (inst, def) => {
     return values ? /* @__PURE__ */ new Set([...values, void 0]) : void 0;
   });
   defineLazyInternal(inst, "pattern", (zod) => {
-    const pattern = zod.def.innerType._zod.pattern;
-    return pattern ? new RegExp(`^(${cleanRegex(pattern.source)})?$`) : void 0;
+    const pattern2 = zod.def.innerType._zod.pattern;
+    return pattern2 ? new RegExp(`^(${cleanRegex(pattern2.source)})?$`) : void 0;
   });
   inst._zod.parse = (payload, ctx) => {
     if (payload.value === void 0) {
@@ -18463,8 +18463,8 @@ var $ZodNullable = /* @__PURE__ */ $constructor("$ZodNullable", (inst, def) => {
   defineLazyInternal(inst, "optin", (zod) => zod.def.innerType._zod.optin);
   defineLazyInternal(inst, "optout", (zod) => zod.def.innerType._zod.optout);
   defineLazyInternal(inst, "pattern", (zod) => {
-    const pattern = zod.def.innerType._zod.pattern;
-    return pattern ? new RegExp(`^(${cleanRegex(pattern.source)}|null)$`) : void 0;
+    const pattern2 = zod.def.innerType._zod.pattern;
+    return pattern2 ? new RegExp(`^(${cleanRegex(pattern2.source)}|null)$`) : void 0;
   });
   defineLazyInternal(inst, "values", (zod) => {
     return zod.def.innerType._zod.values ? /* @__PURE__ */ new Set([...zod.def.innerType._zod.values, null]) : void 0;
@@ -19545,12 +19545,12 @@ function _length(length, params) {
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _regex(pattern, params) {
+function _regex(pattern2, params) {
   return new $ZodCheckRegex({
     check: "string_format",
     format: "regex",
     ...normalizeParams(params),
-    pattern
+    pattern: pattern2
   });
 }
 // @__NO_SIDE_EFFECTS__
@@ -20236,9 +20236,9 @@ var addDivisor = (agg, value) => {
   if (!agg.multipleOf.includes(value))
     agg.multipleOf.push(value);
 };
-var addPattern = (agg, pattern) => {
+var addPattern = (agg, pattern2) => {
   agg.patterns ?? (agg.patterns = /* @__PURE__ */ new Set());
-  agg.patterns.add(pattern);
+  agg.patterns.add(pattern2);
 };
 var intersectMime = (agg, mime) => {
   agg.mime = agg.mime ? agg.mime.filter((m) => mime.includes(m)) : [...mime];
@@ -20303,8 +20303,8 @@ function aggregateChecks(schema) {
   }
   if (bag.mime)
     intersectMime(agg, bag.mime);
-  for (const pattern of bag.patterns ?? [])
-    addPattern(agg, pattern);
+  for (const pattern2 of bag.patterns ?? [])
+    addPattern(agg, pattern2);
   return agg;
 }
 var formatMap = {
@@ -20486,11 +20486,11 @@ var nanProcessor = (schema, ctx, json, params) => {
 };
 var templateLiteralProcessor = (schema, _ctx, json, _params) => {
   const _json = json;
-  const pattern = schema._zod.pattern;
-  if (!pattern)
+  const pattern2 = schema._zod.pattern;
+  if (!pattern2)
     throw new Error("Pattern not found in template literal");
   _json.type = "string";
-  _json.pattern = pattern.source;
+  _json.pattern = pattern2.source;
 };
 var fileProcessor = (schema, _ctx, json, _params) => {
   const _json = json;
@@ -20730,8 +20730,8 @@ function rewriteKeyNames(ctx) {
       bySchema.set(entry.schema, entry);
   }
   const rewrites = /* @__PURE__ */ new Map();
-  for (const record2 of pendingRecords.get(ctx) ?? []) {
-    const seen = ctx.seen.get(record2);
+  for (const record3 of pendingRecords.get(ctx) ?? []) {
+    const seen = ctx.seen.get(record3);
     const names = (seen?.def ?? seen?.schema)?.propertyNames;
     if (!names || names === true || rewrites.has(names))
       continue;
@@ -20761,8 +20761,8 @@ var recordProcessor = (schema, ctx, _json, params) => {
       path: [...params.path, "patternProperties", "*"]
     });
     json.patternProperties = {};
-    for (const pattern of patterns) {
-      assignProp(json.patternProperties, exactPattern(pattern).source, valueSchema);
+    for (const pattern2 of patterns) {
+      assignProp(json.patternProperties, exactPattern(pattern2).source, valueSchema);
     }
   } else {
     if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") {
@@ -26313,8 +26313,8 @@ function zodEmittedPattern(schema) {
   return typeof jsonSchema.pattern === "string" ? jsonSchema.pattern : void 0;
 }
 var DATETIME_FRACTION_DIGITS = /\\\.\\d\{(\d+)\}/;
-function datetimeReferenceSchemas(pattern) {
-  const fractionDigits = DATETIME_FRACTION_DIGITS.exec(pattern);
+function datetimeReferenceSchemas(pattern2) {
+  const fractionDigits = DATETIME_FRACTION_DIGITS.exec(pattern2);
   const precisions = [
     void 0,
     -1,
@@ -26327,7 +26327,7 @@ function datetimeReferenceSchemas(pattern) {
     precision
   }))));
 }
-function referencePatternsForFormat(format, pattern) {
+function referencePatternsForFormat(format, pattern2) {
   let referenceSchemas;
   switch (format) {
     case "email":
@@ -26340,14 +26340,14 @@ function referencePatternsForFormat(format, pattern) {
       referenceSchemas = [iso_exports.date()];
       break;
     case "date-time":
-      referenceSchemas = datetimeReferenceSchemas(pattern);
+      referenceSchemas = datetimeReferenceSchemas(pattern2);
       break;
   }
   return new Set(referenceSchemas.map((schema) => zodEmittedPattern(schema)).filter((emitted) => emitted !== void 0));
 }
-function isLibraryFormatPattern(format, pattern, vendor) {
+function isLibraryFormatPattern(format, pattern2, vendor) {
   if (vendor !== "zod") return true;
-  return referencePatternsForFormat(format, pattern).has(pattern);
+  return referencePatternsForFormat(format, pattern2).has(pattern2);
 }
 function promptArgumentsFromStandardSchema(schema) {
   const jsonSchema = standardSchemaToJsonSchema(schema, "input");
@@ -29295,14 +29295,14 @@ var require_code = /* @__PURE__ */ __commonJSMin(((exports) => {
   }
   exports.callValidateCode = callValidateCode;
   const newRegExp = (0, codegen_1._)`new RegExp`;
-  function usePattern({ gen, it: { opts } }, pattern) {
+  function usePattern({ gen, it: { opts } }, pattern2) {
     const u = opts.unicodeRegExp ? "u" : "";
     const { regExp } = opts.code;
-    const rx = regExp(pattern, u);
+    const rx = regExp(pattern2, u);
     return gen.scopeValue("pattern", {
       key: rx.toString(),
       ref: rx,
-      code: (0, codegen_1._)`${regExp.code === "new RegExp" ? newRegExp : (0, util_2.useFunc)(gen, regExp)}(${pattern}, ${u})`
+      code: (0, codegen_1._)`${regExp.code === "new RegExp" ? newRegExp : (0, util_2.useFunc)(gen, regExp)}(${pattern2}, ${u})`
     });
   }
   exports.usePattern = usePattern;
@@ -32965,12 +32965,12 @@ var require_discriminator = /* @__PURE__ */ __commonJSMin(((exports) => {
     },
     code(cxt) {
       const { gen, data, schema, parentSchema, it } = cxt;
-      const { oneOf } = parentSchema;
+      const { oneOf: oneOf2 } = parentSchema;
       if (!it.opts.discriminator) throw new Error("discriminator: requires discriminator option");
       const tagName = schema.propertyName;
       if (typeof tagName != "string") throw new Error("discriminator: requires propertyName");
       if (schema.mapping) throw new Error("discriminator: mapping is not supported");
-      if (!oneOf) throw new Error("discriminator: requires oneOf keyword");
+      if (!oneOf2) throw new Error("discriminator: requires oneOf keyword");
       const valid = gen.let("valid", false);
       const tag2 = gen.const("tag", (0, codegen_1._)`${data}${(0, codegen_1.getProperty)(tagName)}`);
       gen.if((0, codegen_1._)`typeof ${tag2} == "string"`, () => validateMapping(), () => cxt.error(false, {
@@ -33008,8 +33008,8 @@ var require_discriminator = /* @__PURE__ */ __commonJSMin(((exports) => {
         const oneOfMapping = {};
         const topRequired = hasRequired(parentSchema);
         let tagRequired = true;
-        for (let i = 0; i < oneOf.length; i++) {
-          let sch = oneOf[i];
+        for (let i = 0; i < oneOf2.length; i++) {
+          let sch = oneOf2[i];
           if ((sch === null || sch === void 0 ? void 0 : sch.$ref) && !(0, util_1.schemaHasRulesButRef)(sch, it.self.RULES)) {
             const ref = sch.$ref;
             sch = compile_1.resolveRef.call(it.self, it.schemaEnv.root, it.baseId, ref);
@@ -39676,7 +39676,7 @@ var Node = class Node2 {
     let node2 = this;
     for (let i = 0, len = tokens.length; i < len; i++) {
       const token = tokens[i];
-      const pattern = token.length === 1 ? token === "*" ? i === len - 1 ? [
+      const pattern2 = token.length === 1 ? token === "*" ? i === len - 1 ? [
         "",
         "",
         ".*"
@@ -39690,10 +39690,10 @@ var Node = class Node2 {
         TAIL_WILDCARD_REG_EXP_STR
       ] : token.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);
       let nextNode;
-      if (pattern) {
-        const name = pattern[1];
-        let regexpStr = pattern[2] || "[^/]+";
-        if (name && pattern[2]) {
+      if (pattern2) {
+        const name = pattern2[1];
+        let regexpStr = pattern2[2] || "[^/]+";
+        if (name && pattern2[2]) {
           if (regexpStr === ".*") throw PATH_ERROR;
           regexpStr = regexpStr.replace(/^\((?!\?:)(?=[^)]+\)$)/, "(?:");
           if (/\((?!\?:)/.test(regexpStr)) throw PATH_ERROR;
@@ -39957,16 +39957,16 @@ var Node3 = class Node4 {
     let i = 0;
     for (const p of parts) {
       const nextP = parts[++i];
-      const pattern = getPattern(p, nextP) || (nextP === void 0 && p && p.indexOf("*") === p.length - 1 ? p : null);
-      const isParam = Array.isArray(pattern);
-      const key = isParam ? pattern[0] : pattern || p;
+      const pattern2 = getPattern(p, nextP) || (nextP === void 0 && p && p.indexOf("*") === p.length - 1 ? p : null);
+      const isParam = Array.isArray(pattern2);
+      const key = isParam ? pattern2[0] : pattern2 || p;
       const child = curNode.#children[key] ||= new Node4();
-      if (pattern && !child.#pattern) {
-        child.#pattern = pattern;
+      if (pattern2 && !child.#pattern) {
+        child.#pattern = pattern2;
         curNode.#patterns.push(child);
       }
       curNode = child;
-      if (isParam) possibleKeys.add(pattern[1]);
+      if (isParam) possibleKeys.add(pattern2[1]);
     }
     curNode.#methods.push({ [method]: {
       handler,
@@ -40011,19 +40011,19 @@ var Node3 = class Node4 {
           } else tempNodes.push(nextNode);
         }
         for (const child of node2.#patterns) {
-          const pattern = child.#pattern;
+          const pattern2 = child.#pattern;
           const params = node2.#params === emptyParams ? {} : { ...node2.#params };
-          if (typeof pattern === "string") {
-            if (pattern === "*" || part.startsWith(pattern.slice(0, -1))) {
+          if (typeof pattern2 === "string") {
+            if (pattern2 === "*" || part.startsWith(pattern2.slice(0, -1))) {
               this.#pushHandlerSets(handlerSets, child, method, node2.#params);
-              if (pattern === "*") {
+              if (pattern2 === "*") {
                 child.#params = params;
                 tempNodes.push(child);
               }
             }
             continue;
           }
-          const [, name, matcher] = pattern;
+          const [, name, matcher] = pattern2;
           if (!part && matcher === true) continue;
           if (matcher !== true) {
             if (!partOffsets) {
@@ -48086,6 +48086,115 @@ function stableStringify(value) {
 var DEFAULT_RETRY_STATUSES = [408, 429, 502, 503, 504];
 var DEFAULT_RETRY_METHODS = ["GET"];
 var DEFAULT_MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
+var DEFAULT_MAX_DOWNLOAD_BYTES = 10 * 1024 * 1024;
+var MAX_ERROR_BODY_BYTES = 64 * 1024;
+var ResponseBodyLimitError = class extends Error {
+  constructor(label, size, limit) {
+    super(
+      `[FrappeClient] ${label} size ${size} bytes exceeds the ${limit}-byte limit`
+    );
+    this.name = "ResponseBodyLimitError";
+  }
+};
+async function readResponseBytes(response, maxBytes, label) {
+  const declaredLength = response.headers.get("content-length")?.trim();
+  if (declaredLength && /^\d+$/.test(declaredLength)) {
+    const size = Number(declaredLength);
+    if (size > maxBytes) {
+      try {
+        await response.body?.cancel();
+      } catch {
+      }
+      throw new ResponseBodyLimitError(label, size, maxBytes);
+    }
+  }
+  if (!response.body) return new Uint8Array();
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        try {
+          await reader.cancel();
+        } catch {
+        }
+        throw new ResponseBodyLimitError(label, total, maxBytes);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
+function isUnsafeControl(character) {
+  const codePoint = character.codePointAt(0) ?? 0;
+  return codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint >= 8234 && codePoint <= 8238 || codePoint >= 8294 && codePoint <= 8297;
+}
+function validateLocalFileUrl(fileUrl, isPrivate) {
+  if (typeof fileUrl !== "string" || fileUrl.length === 0) {
+    throw new Error("[FrappeClient] File.file_url must be a non-empty string");
+  }
+  if (fileUrl !== fileUrl.trim()) {
+    throw new Error(
+      "[FrappeClient] File.file_url must not contain whitespace padding"
+    );
+  }
+  const expectedPrefix = isPrivate ? "/private/files/" : "/files/";
+  let decoded = fileUrl;
+  for (let depth = 0; depth < 5; depth++) {
+    if (Array.from(decoded).some(isUnsafeControl) || decoded.includes("\\") || decoded.includes("?") || decoded.includes("#")) {
+      throw new Error(
+        "[FrappeClient] File.file_url must be a local Frappe file path without query, fragment, NUL, or backslash"
+      );
+    }
+    if (!decoded.startsWith(expectedPrefix)) {
+      throw new Error(
+        `[FrappeClient] File.file_url does not match is_private=${isPrivate ? 1 : 0}`
+      );
+    }
+    const fileSegment = decoded.slice(expectedPrefix.length);
+    if (!fileSegment || fileSegment === "." || fileSegment === ".." || fileSegment.includes("/")) {
+      throw new Error(
+        "[FrappeClient] File.file_url must contain exactly one safe file segment"
+      );
+    }
+    let next;
+    try {
+      next = decodeURIComponent(decoded);
+    } catch {
+      throw new Error(
+        "[FrappeClient] File.file_url contains malformed percent encoding"
+      );
+    }
+    if (next === decoded) return fileUrl;
+    decoded = next;
+  }
+  throw new Error(
+    "[FrappeClient] File.file_url contains excessive nested percent encoding"
+  );
+}
+function sanitizeDownloadFileName(raw2, fileId) {
+  const fallbackId = fileId.replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 80) || "file";
+  if (typeof raw2 !== "string") return `erpnext-${fallbackId}`;
+  const normalized = Array.from(raw2.normalize("NFC")).filter((character) => !isUnsafeControl(character)).join("").replace(/[\\/:*?"<>|]/g, "_").trim().replace(/[. ]+$/g, "");
+  const bounded = Array.from(normalized).slice(0, 255).join("");
+  return !bounded || bounded === "." || bounded === ".." ? `erpnext-${fallbackId}` : bounded;
+}
+function normalizeMimeType(raw2) {
+  const candidate = (raw2 ?? "").split(";", 1)[0].trim().toLowerCase();
+  return /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/i.test(candidate) && candidate !== "application/unknown" ? candidate : "application/octet-stream";
+}
 function decodeBase64File(contentBase64, maxBytes) {
   if (contentBase64.length === 0) {
     throw new Error("[FrappeClient] File content must not be empty");
@@ -48113,6 +48222,24 @@ function decodeBase64File(contentBase64, maxBytes) {
   }
   return Uint8Array.from(binary, (character) => character.charCodeAt(0));
 }
+function normalizeFrappeSiteUrl(baseUrl) {
+  if (typeof baseUrl !== "string" || baseUrl.trim() === "") {
+    throw new Error(
+      "[FrappeClient] baseUrl is required to derive site identity"
+    );
+  }
+  let url2;
+  try {
+    url2 = new URL(baseUrl);
+  } catch {
+    throw new Error("[FrappeClient] baseUrl must be an absolute URL");
+  }
+  if (url2.protocol !== "http:" && url2.protocol !== "https:") {
+    throw new Error("[FrappeClient] baseUrl must be http or https");
+  }
+  const path = url2.pathname.replace(/\/+$/, "");
+  return `${url2.protocol}//${url2.host}${path}`;
+}
 var FrappeAPIError = class extends Error {
   /**
    * @param message - Human-readable error description
@@ -48171,6 +48298,7 @@ var FrappeClient = class {
   authHeader;
   timeoutMs;
   maxUploadBytes;
+  maxDownloadBytes;
   retries;
   retryStatuses;
   retryBackoffMs;
@@ -48186,12 +48314,29 @@ var FrappeClient = class {
         "[FrappeClient] maxUploadBytes must be a positive integer"
       );
     }
+    this.maxDownloadBytes = config2.maxDownloadBytes ?? DEFAULT_MAX_DOWNLOAD_BYTES;
+    if (!Number.isInteger(this.maxDownloadBytes) || this.maxDownloadBytes <= 0) {
+      throw new Error(
+        "[FrappeClient] maxDownloadBytes must be a positive integer"
+      );
+    }
     this.retries = config2.retries ?? 3;
     this.retryStatuses = config2.retryStatuses ?? DEFAULT_RETRY_STATUSES;
     this.retryBackoffMs = config2.retryBackoffMs ?? 200;
     this.retryMethods = config2.retryMethods ?? DEFAULT_RETRY_METHODS;
     this.cache = config2.cache ?? new MemoryCache();
   }
+  /**
+   * Normalized site URL of this configured client: origin + site path, with
+   * credentials, query, and fragment stripped, and without a trailing slash.
+   *
+   * This is the preimage of the Buy capture `sourceInstance.siteId` SHA-256.
+   * It is not an ERP database UUID and must not be copied onto the wire when
+   * the opaque site identifier is sufficient.
+   */
+  normalizedSiteUrl() {
+    return normalizeFrappeSiteUrl(this.baseUrl);
+  }
   // ── Private HTTP helpers ────────────────────────────────────────────────────
   buildHeaders(includeJsonContentType = true) {
     const headers = {
@@ -48300,6 +48445,152 @@ var FrappeClient = class {
     }
     return responseBody;
   }
+  buildSameOriginUrl(path) {
+    if (!path.startsWith("/")) {
+      throw new Error("[FrappeClient] Download path must be root-relative");
+    }
+    let base;
+    let target;
+    try {
+      base = new URL(this.baseUrl);
+      target = new URL(`${this.baseUrl}${path}`);
+    } catch {
+      throw new Error("[FrappeClient] baseUrl must be a valid absolute URL");
+    }
+    if (target.origin !== base.origin) {
+      throw new Error("[FrappeClient] Refusing a cross-origin download");
+    }
+    return target.href;
+  }
+  async requestBinary(path) {
+    let lastError;
+    for (let attempt = 0; attempt <= this.retries; attempt++) {
+      try {
+        return await this.requestBinaryOnce(path);
+      } catch (err) {
+        lastError = err;
+        if (attempt === this.retries || !this.isRetryable(err, "GET")) {
+          throw err;
+        }
+        const delay = this.computeBackoff(attempt, err);
+        if (delay > 0) {
+          await new Promise((resolve) => setTimeout(resolve, delay));
+        }
+      }
+    }
+    throw lastError;
+  }
+  async requestBinaryOnce(path) {
+    const url2 = this.buildSameOriginUrl(path);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let response;
+    try {
+      response = await fetch(url2, {
+        method: "GET",
+        headers: {
+          "Authorization": this.authHeader,
+          "Accept": "*/*",
+          "Cache-Control": "no-store"
+        },
+        cache: "no-store",
+        redirect: "manual",
+        signal: controller.signal
+      });
+    } catch (err) {
+      clearTimeout(timer);
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new FrappeAPIError(
+          `Request timed out after ${this.timeoutMs}ms: GET ${path}`,
+          408,
+          null
+        );
+      }
+      throw new FrappeAPIError(
+        `Network error on GET ${path}: ${err.message}`,
+        0,
+        null
+      );
+    }
+    try {
+      if (response.redirected || response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) {
+        try {
+          await response.body?.cancel();
+        } catch {
+        }
+        throw new FrappeAPIError(
+          `GET ${path} refused an HTTP redirect`,
+          response.status,
+          null
+        );
+      }
+      if (!response.ok) {
+        let rawText;
+        try {
+          const errorBytes = await readResponseBytes(
+            response,
+            MAX_ERROR_BODY_BYTES,
+            "Error response body"
+          );
+          rawText = new TextDecoder().decode(errorBytes);
+        } catch (err) {
+          if (!(err instanceof ResponseBodyLimitError)) throw err;
+          rawText = err.message;
+        }
+        const contentType = response.headers.get("content-type") ?? "";
+        let responseBody = rawText;
+        if (contentType.includes("application/json") && rawText.length > 0) {
+          try {
+            responseBody = JSON.parse(rawText);
+          } catch {
+            responseBody = rawText;
+          }
+        }
+        let message2 = response.statusText;
+        if (typeof responseBody === "object" && responseBody !== null) {
+          const body = responseBody;
+          const baseMessage = body.message ?? body.exc_type ?? response.statusText;
+          const serverDetails = extractServerMessages(body._server_messages);
+          message2 = serverDetails ? `${baseMessage}: ${serverDetails}` : baseMessage;
+        } else if (typeof responseBody === "string" && responseBody.length > 0) {
+          message2 = responseBody.slice(0, 200);
+        }
+        throw new FrappeAPIError(
+          `GET ${path} failed: ${message2}`,
+          response.status,
+          responseBody,
+          parseRetryAfter(response.headers.get("retry-after"))
+        );
+      }
+      const bytes = await readResponseBytes(
+        response,
+        this.maxDownloadBytes,
+        "Downloaded file"
+      );
+      return {
+        bytes,
+        mimeType: normalizeMimeType(response.headers.get("content-type"))
+      };
+    } catch (err) {
+      if (err instanceof FrappeAPIError || err instanceof ResponseBodyLimitError) {
+        throw err;
+      }
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new FrappeAPIError(
+          `Request timed out after ${this.timeoutMs}ms: GET ${path}`,
+          408,
+          null
+        );
+      }
+      throw new FrappeAPIError(
+        `Network error while reading GET ${path}: ${err.message}`,
+        0,
+        null
+      );
+    } finally {
+      clearTimeout(timer);
+    }
+  }
   // ── Resource CRUD ───────────────────────────────────────────────────────────
   /**
    * List documents of a DocType.
@@ -48421,6 +48712,73 @@ var FrappeClient = class {
     );
     this.invalidate(doctype, name);
   }
+  /**
+   * Download one File row through Frappe's authenticated download handler.
+   *
+   * The caller supplies the expected attachment owner as a confused-deputy
+   * guard. The File row is fetched fresh, its local path is validated, and the
+   * response stream is stopped as soon as it exceeds `maxDownloadBytes`.
+   */
+  async downloadFile(input) {
+    const fileId = input.fileId.trim();
+    const attachedToDoctype = input.attachedToDoctype.trim();
+    const attachedToName = input.attachedToName.trim();
+    if (!fileId) {
+      throw new Error("[FrappeClient] fileId must not be empty");
+    }
+    if (!attachedToDoctype) {
+      throw new Error("[FrappeClient] attachedToDoctype must not be empty");
+    }
+    if (!attachedToName) {
+      throw new Error("[FrappeClient] attachedToName must not be empty");
+    }
+    const metadata = await this.request(
+      "GET",
+      `/api/resource/File/${encodeURIComponent(fileId)}`
+    );
+    const file = metadata.data;
+    if (file.name !== fileId) {
+      throw new Error("[FrappeClient] File response identity mismatch");
+    }
+    if (file.attached_to_doctype !== attachedToDoctype || file.attached_to_name !== attachedToName) {
+      throw new Error(
+        "[FrappeClient] File is not attached to the requested document"
+      );
+    }
+    if (file.is_private !== 0 && file.is_private !== 1) {
+      throw new Error("[FrappeClient] File.is_private must be 0 or 1");
+    }
+    const fileUrl = validateLocalFileUrl(
+      file.file_url,
+      file.is_private === 1
+    );
+    const fileSize = file.file_size;
+    if (fileSize !== void 0 && fileSize !== null) {
+      if (typeof fileSize !== "number" || !Number.isInteger(fileSize) || fileSize < 0) {
+        throw new Error(
+          "[FrappeClient] File.file_size must be a non-negative integer"
+        );
+      }
+      if (fileSize > this.maxDownloadBytes) {
+        throw new ResponseBodyLimitError(
+          "File metadata",
+          fileSize,
+          this.maxDownloadBytes
+        );
+      }
+    }
+    const params = new URLSearchParams({ file_url: fileUrl });
+    const download = await this.requestBinary(
+      `/api/method/frappe.handler.download_file?${params.toString()}`
+    );
+    return {
+      fileId,
+      fileName: sanitizeDownloadFileName(file.file_name, fileId),
+      mimeType: download.mimeType,
+      bytes: download.bytes,
+      isPrivate: file.is_private === 1
+    };
+  }
   /**
    * Upload file bytes and attach the native File document to another document.
    * POST /api/method/upload_file
@@ -48510,6 +48868,7 @@ function getFrappeClient() {
   const apiKey = env6("ERPNEXT_API_KEY");
   const apiSecret = env6("ERPNEXT_API_SECRET");
   const maxUploadBytesRaw = env6("ERPNEXT_MAX_UPLOAD_BYTES");
+  const maxDownloadBytesRaw = env6("ERPNEXT_MAX_DOWNLOAD_BYTES");
   if (!url2) {
     throw new Error(
       "[lib/erpnext] ERPNEXT_URL is required. Set it to your ERPNext instance URL, e.g. http://localhost:8000"
@@ -48525,7 +48884,8 @@ function getFrappeClient() {
     apiKey,
     apiSecret,
     cache: getCache(),
-    maxUploadBytes: maxUploadBytesRaw?.trim() ? Number(maxUploadBytesRaw) : void 0
+    maxUploadBytes: maxUploadBytesRaw?.trim() ? Number(maxUploadBytesRaw) : void 0,
+    maxDownloadBytes: maxDownloadBytesRaw?.trim() ? Number(maxDownloadBytesRaw) : void 0
   });
   return _client;
 }
@@ -48644,12 +49004,14 @@ var viewer = (name) => ({
   ui: { resourceUri: `ui://mcp-erpnext/${name}` }
 });
 var DOCLIST_META = viewer("doclist-viewer");
+var DOC_META = viewer("doc-viewer");
 var INVOICE_META = viewer("invoice-viewer");
 var STOCK_META = viewer("stock-viewer");
 var CHART_META = viewer("chart-viewer");
 var KANBAN_META = viewer("kanban-viewer");
 var KPI_META = viewer("kpi-viewer");
 var FUNNEL_META = viewer("funnel-viewer");
+var BUY_EVIDENCE_META = viewer("buy-evidence-viewer");
 
 // src/api/resolve.ts
 var NEGATIVE_CACHE_TTL_MS = 15e3;
@@ -48779,10 +49141,10 @@ function roundedTotalFallbackWarning(original, patched) {
 
 // src/tools/sales.ts
 function viewerDocument(value, doctype, name) {
-  const record2 = typeof value === "object" && value !== null ? value : {};
+  const record3 = typeof value === "object" && value !== null ? value : {};
   return {
-    ...record2,
-    ...typeof record2.name === "string" || !name ? {} : { name },
+    ...record3,
+    ...typeof record3.name === "string" || !name ? {} : { name },
     doctype
   };
 }
@@ -48871,6 +49233,7 @@ var salesTools = [
   {
     name: "erpnext_customer_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single ERPNext customer by name (ID). Returns all fields including contact details.",
     category: "sales",
     inputSchema: {
@@ -48885,7 +49248,7 @@ var salesTools = [
         throw new Error("[erpnext_customer_get] 'name' is required");
       }
       const doc = await ctx.client.get("Customer", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Customer" } };
     }
   },
   {
@@ -49797,6 +50160,7 @@ var inventoryTools = [
   {
     name: "erpnext_item_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single ERPNext Item by name/item_code. Returns all fields including pricing and stock details.",
     category: "inventory",
     inputSchema: {
@@ -49811,7 +50175,7 @@ var inventoryTools = [
         throw new Error("[erpnext_item_get] 'name' is required");
       }
       const doc = await ctx.client.get("Item", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Item" } };
     }
   },
   {
@@ -50012,12 +50376,16 @@ var inventoryTools = [
     name: "erpnext_stock_entry_list",
     annotations: { readOnlyHint: true },
     _meta: DOCLIST_META,
-    description: "List Stock Entries (material transfers, receipts, issues). Fields: name, stock_entry_type, posting_date, from_warehouse, to_warehouse, total_amount. Filterable by stock_entry_type, date range.",
+    description: "List Stock Entries (material transfers, receipts, issues). Fields: name, stock_entry_type, posting_date, from_warehouse, to_warehouse, total_amount. Filterable by item_code, stock_entry_type, date range.",
     category: "inventory",
     inputSchema: {
       type: "object",
       properties: {
         limit: { type: "number", description: "Max results (default 20)" },
+        item_code: {
+          type: "string",
+          description: "Exact item code present in a Stock Entry line"
+        },
         stock_entry_type: {
           type: "string",
           description: "Filter by type (Material Issue, Material Receipt, Material Transfer, etc.)"
@@ -50032,6 +50400,14 @@ var inventoryTools = [
     handler: async (input, ctx) => {
       const limit = input.limit ?? 20;
       const filters = [];
+      if (input.item_code) {
+        filters.push([
+          "Stock Entry Detail",
+          "item_code",
+          "=",
+          input.item_code
+        ]);
+      }
       if (input.stock_entry_type) {
         filters.push([
           "stock_entry_type",
@@ -50069,6 +50445,7 @@ var inventoryTools = [
   {
     name: "erpnext_stock_entry_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Stock Entry by name. Returns full document with item details.",
     category: "inventory",
     inputSchema: {
@@ -50086,7 +50463,7 @@ var inventoryTools = [
         throw new Error("[erpnext_stock_entry_get] 'name' is required");
       }
       const doc = await ctx.client.get("Stock Entry", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Stock Entry" } };
     }
   },
   {
@@ -50281,6 +50658,7 @@ var accountingTools = [
   {
     name: "erpnext_journal_entry_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Journal Entry by name (e.g. JV-00001). Returns full document with accounts.",
     category: "accounting",
     inputSchema: {
@@ -50298,7 +50676,7 @@ var accountingTools = [
         throw new Error("[erpnext_journal_entry_get] 'name' is required");
       }
       const doc = await ctx.client.get("Journal Entry", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Journal Entry" } };
     }
   },
   // ── Payment Entries ───────────────────────────────────────────────────────
@@ -50386,6 +50764,7 @@ var accountingTools = [
   {
     name: "erpnext_payment_entry_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Payment Entry by name (e.g. PE-00001). Returns full document including references.",
     category: "accounting",
     inputSchema: {
@@ -50403,7 +50782,7 @@ var accountingTools = [
         throw new Error("[erpnext_payment_entry_get] 'name' is required");
       }
       const doc = await ctx.client.get("Payment Entry", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Payment Entry" } };
     }
   },
   {
@@ -50529,6 +50908,7 @@ var hrTools = [
   {
     name: "erpnext_employee_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Employee by name/ID (e.g. HR-EMP-00001). Returns all fields.",
     category: "hr",
     inputSchema: {
@@ -50553,7 +50933,7 @@ var hrTools = [
         { allowPartialMatch: false, inputPath: "name" }
       );
       const doc = await ctx.client.get("Employee", employeeId);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Employee" } };
     }
   },
   // ── Attendance ────────────────────────────────────────────────────────────
@@ -50704,6 +51084,7 @@ var hrTools = [
   {
     name: "erpnext_leave_application_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Leave Application by name. Returns full document.",
     category: "hr",
     inputSchema: {
@@ -50721,7 +51102,7 @@ var hrTools = [
         "Leave Application",
         input.name
       );
-      return { data: doc };
+      return { data: { ...doc, doctype: "Leave Application" } };
     }
   },
   {
@@ -50867,6 +51248,7 @@ var hrTools = [
   {
     name: "erpnext_salary_slip_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Salary Slip by name/ID. Returns all fields including earnings and deductions.",
     category: "hr",
     inputSchema: {
@@ -50884,7 +51266,7 @@ var hrTools = [
         throw new Error("[erpnext_salary_slip_get] 'name' is required");
       }
       const doc = await ctx.client.get("Salary Slip", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Salary Slip" } };
     }
   },
   // ── Payroll Entries ───────────────────────────────────────────────────────
@@ -51274,8 +51656,8 @@ async function applyAssignment(doctype, name, assignment, ctx, failureContext) {
     throw new Error(`${failureContext}: ${reason}`, { cause: error2 });
   }
   const todos = Array.isArray(nativeResult) ? nativeResult.map((todo) => {
-    const record2 = todo;
-    return { owner: record2.owner, name: record2.name };
+    const record3 = todo;
+    return { owner: record3.owner, name: record3.name };
   }) : [];
   return { notify_user: true, assignees: assignment.assignees, todos };
 }
@@ -51292,8 +51674,8 @@ async function removeAssignment(doctype, name, assignee, ctx, failureContext) {
     throw new Error(`${failureContext}: ${reason}`, { cause: error2 });
   }
   const todos = Array.isArray(nativeResult) ? nativeResult.map((todo) => {
-    const record2 = todo;
-    return { owner: record2.owner, name: record2.name };
+    const record3 = todo;
+    return { owner: record3.owner, name: record3.name };
   }) : [];
   return { removed: assignee, remaining: todos };
 }
@@ -51375,6 +51757,7 @@ var projectTools = [
   {
     name: "erpnext_project_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Project by name. Returns full document including tasks summary.",
     category: "project",
     inputSchema: {
@@ -51389,7 +51772,7 @@ var projectTools = [
         throw new Error("[erpnext_project_get] 'name' is required");
       }
       const doc = await ctx.client.get("Project", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Project" } };
     }
   },
   // ── Tasks ─────────────────────────────────────────────────────────────────
@@ -51554,6 +51937,7 @@ var projectTools = [
   {
     name: "erpnext_task_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Task by name. Returns full document including description and dependencies.",
     category: "project",
     inputSchema: {
@@ -51568,7 +51952,7 @@ var projectTools = [
         throw new Error("[erpnext_task_get] 'name' is required");
       }
       const doc = await ctx.client.get("Task", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Task" } };
     }
   },
   {
@@ -51744,6 +52128,7 @@ var projectTools = [
   {
     name: "erpnext_timesheet_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Timesheet by name. Returns full document with time log details.",
     category: "project",
     inputSchema: {
@@ -51758,7 +52143,7 @@ var projectTools = [
         throw new Error("[erpnext_timesheet_get] 'name' is required");
       }
       const doc = await ctx.client.get("Timesheet", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Timesheet" } };
     }
   },
   {
@@ -51880,6 +52265,7 @@ var purchasingTools = [
   {
     name: "erpnext_supplier_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single ERPNext supplier by name (ID). Returns all fields including contact details.",
     category: "purchasing",
     inputSchema: {
@@ -51894,7 +52280,7 @@ var purchasingTools = [
         throw new Error("[erpnext_supplier_get] 'name' is required");
       }
       const doc = await ctx.client.get("Supplier", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Supplier" } };
     }
   },
   {
@@ -52023,6 +52409,7 @@ var purchasingTools = [
   {
     name: "erpnext_purchase_order_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Purchase Order by name (e.g. PO-00001). Returns full document with line items.",
     category: "purchasing",
     inputSchema: {
@@ -52040,7 +52427,7 @@ var purchasingTools = [
         throw new Error("[erpnext_purchase_order_get] 'name' is required");
       }
       const doc = await ctx.client.get("Purchase Order", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Purchase Order" } };
     }
   },
   {
@@ -52191,6 +52578,7 @@ var purchasingTools = [
   {
     name: "erpnext_purchase_invoice_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Purchase Invoice by name (e.g. PINV-00001). Returns full document with line items.",
     category: "purchasing",
     inputSchema: {
@@ -52211,7 +52599,7 @@ var purchasingTools = [
         "Purchase Invoice",
         input.name
       );
-      return { data: doc };
+      return { data: { ...doc, doctype: "Purchase Invoice" } };
     }
   },
   // ── Purchase Receipts ─────────────────────────────────────────────────────
@@ -52285,6 +52673,7 @@ var purchasingTools = [
   {
     name: "erpnext_purchase_receipt_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Purchase Receipt by name (e.g. MAT-PRE-00001). Returns full document with received items.",
     category: "purchasing",
     inputSchema: {
@@ -52305,7 +52694,7 @@ var purchasingTools = [
         "Purchase Receipt",
         input.name
       );
-      return { data: doc };
+      return { data: { ...doc, doctype: "Purchase Receipt" } };
     }
   },
   // ── Supplier Quotations ───────────────────────────────────────────────────
@@ -52450,6 +52839,7 @@ var deliveryTools = [
   {
     name: "erpnext_delivery_note_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Delivery Note by name (e.g. MAT-DN-00001). Returns full document with delivered items.",
     category: "delivery",
     inputSchema: {
@@ -52467,7 +52857,7 @@ var deliveryTools = [
         throw new Error("[erpnext_delivery_note_get] 'name' is required");
       }
       const doc = await ctx.client.get("Delivery Note", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Delivery Note" } };
     }
   },
   {
@@ -52600,6 +52990,7 @@ var deliveryTools = [
   {
     name: "erpnext_shipment_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Shipment by name. Returns full shipment details including parcels.",
     category: "delivery",
     inputSchema: {
@@ -52614,7 +53005,7 @@ var deliveryTools = [
         throw new Error("[erpnext_shipment_get] 'name' is required");
       }
       const doc = await ctx.client.get("Shipment", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Shipment" } };
     }
   }
 ];
@@ -52694,6 +53085,7 @@ var manufacturingTools = [
   {
     name: "erpnext_bom_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single BOM by name (e.g. BOM-ITEM-00001). Returns full document with raw materials and operations.",
     category: "manufacturing",
     inputSchema: {
@@ -52708,7 +53100,7 @@ var manufacturingTools = [
         throw new Error("[erpnext_bom_get] 'name' is required");
       }
       const doc = await ctx.client.get("BOM", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "BOM" } };
     }
   },
   // ── Work Orders ───────────────────────────────────────────────────────────
@@ -52786,6 +53178,7 @@ var manufacturingTools = [
   {
     name: "erpnext_work_order_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Work Order by name (e.g. MFG-WO-00001). Returns full document with operations and materials.",
     category: "manufacturing",
     inputSchema: {
@@ -52803,7 +53196,7 @@ var manufacturingTools = [
         throw new Error("[erpnext_work_order_get] 'name' is required");
       }
       const doc = await ctx.client.get("Work Order", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Work Order" } };
     }
   },
   {
@@ -52919,6 +53312,7 @@ var manufacturingTools = [
   {
     name: "erpnext_job_card_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Job Card by name. Returns full document with time logs and material transfers.",
     category: "manufacturing",
     inputSchema: {
@@ -52933,7 +53327,7 @@ var manufacturingTools = [
         throw new Error("[erpnext_job_card_get] 'name' is required");
       }
       const doc = await ctx.client.get("Job Card", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Job Card" } };
     }
   }
 ];
@@ -52995,6 +53389,7 @@ var crmTools = [
   {
     name: "erpnext_lead_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single CRM Lead by name. Returns all lead details including contact info.",
     category: "crm",
     inputSchema: {
@@ -53009,7 +53404,7 @@ var crmTools = [
         throw new Error("[erpnext_lead_get] 'name' is required");
       }
       const doc = await ctx.client.get("Lead", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Lead" } };
     }
   },
   {
@@ -53141,6 +53536,7 @@ var crmTools = [
   {
     name: "erpnext_opportunity_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single CRM Opportunity by name. Returns full details including items and competitors.",
     category: "crm",
     inputSchema: {
@@ -53155,7 +53551,7 @@ var crmTools = [
         throw new Error("[erpnext_opportunity_get] 'name' is required");
       }
       const doc = await ctx.client.get("Opportunity", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Opportunity" } };
     }
   },
   // ── Contacts ──────────────────────────────────────────────────────────────
@@ -53210,6 +53606,7 @@ var crmTools = [
   {
     name: "erpnext_contact_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Contact by name. Returns all contact details.",
     category: "crm",
     inputSchema: {
@@ -53224,7 +53621,7 @@ var crmTools = [
         throw new Error("[erpnext_contact_get] 'name' is required");
       }
       const doc = await ctx.client.get("Contact", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Contact" } };
     }
   },
   // ── Campaigns ─────────────────────────────────────────────────────────────
@@ -53374,6 +53771,7 @@ var assetsTools = [
   {
     name: "erpnext_asset_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Asset by name. Returns full details including depreciation schedule and maintenance logs.",
     category: "assets",
     inputSchema: {
@@ -53388,7 +53786,7 @@ var assetsTools = [
         throw new Error("[erpnext_asset_get] 'name' is required");
       }
       const doc = await ctx.client.get("Asset", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Asset" } };
     }
   },
   {
@@ -53524,6 +53922,7 @@ var assetsTools = [
   {
     name: "erpnext_asset_movement_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Asset Movement by name. Returns full details including assets moved.",
     category: "assets",
     inputSchema: {
@@ -53538,7 +53937,7 @@ var assetsTools = [
         throw new Error("[erpnext_asset_movement_get] 'name' is required");
       }
       const doc = await ctx.client.get("Asset Movement", input.name);
-      return { data: doc };
+      return { data: { ...doc, doctype: "Asset Movement" } };
     }
   },
   // ── Asset Maintenance ─────────────────────────────────────────────────────
@@ -53595,6 +53994,7 @@ var assetsTools = [
   {
     name: "erpnext_asset_maintenance_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get a single Asset Maintenance record by name. Returns full details including maintenance tasks.",
     category: "assets",
     inputSchema: {
@@ -53612,7 +54012,7 @@ var assetsTools = [
         "Asset Maintenance",
         input.name
       );
-      return { data: doc };
+      return { data: { ...doc, doctype: "Asset Maintenance" } };
     }
   },
   // ── Asset Categories ──────────────────────────────────────────────────────
@@ -53729,11 +54129,166 @@ function isEmptyPartyAccountCurrencyNone(text) {
 }
 
 // src/tools/operations.ts
+var DOC_LIST_MAX_LIMIT = 5e3;
+var DOC_LIST_MAX_OFFSET = 1e5;
+function bytesToBase64(bytes) {
+  const chunkSize = 32 * 1024;
+  let binary = "";
+  for (let offset = 0; offset < bytes.byteLength; offset += chunkSize) {
+    binary += String.fromCharCode(
+      ...bytes.subarray(offset, Math.min(offset + chunkSize, bytes.byteLength))
+    );
+  }
+  return btoa(binary);
+}
 async function withPiAccountHintsIfNeeded(doctype, fn) {
   return isPurchaseInvoiceDoctype(doctype) ? await withPurchaseInvoiceAccountHints(fn) : await fn();
 }
 var operationsTools = [
   // ── File Attachments ───────────────────────────────────────────────────────
+  {
+    name: "erpnext_file_list",
+    annotations: { readOnlyHint: true },
+    description: "List the files attached to an ERPNext document. Returns name, size, privacy and URL for each attachment. Pairs with erpnext_file_upload: that one attaches, this one reads back.",
+    category: "operations",
+    inputSchema: {
+      type: "object",
+      properties: {
+        attached_to_doctype: {
+          type: "string",
+          description: "DocType of the document whose attachments to list.",
+          minLength: 1
+        },
+        attached_to_name: {
+          type: "string",
+          description: "Name/ID of the document whose attachments to list.",
+          minLength: 1
+        },
+        limit: {
+          type: "number",
+          description: "Maximum number of files to return. Defaults to 50.",
+          minimum: 1,
+          maximum: 500
+        }
+      },
+      required: ["attached_to_doctype", "attached_to_name"]
+    },
+    handler: async (input, ctx) => {
+      for (const field of ["attached_to_doctype", "attached_to_name"]) {
+        if (typeof input[field] !== "string" || !input[field].trim()) {
+          throw new Error(
+            `[erpnext_file_list] '${field}' must be a non-empty string`
+          );
+        }
+      }
+      if (input.limit !== void 0 && (typeof input.limit !== "number" || !Number.isInteger(input.limit) || input.limit < 1 || input.limit > 500)) {
+        throw new Error(
+          "[erpnext_file_list] 'limit' must be an integer between 1 and 500"
+        );
+      }
+      const files = await ctx.client.list("File", {
+        fields: [
+          "name",
+          "file_name",
+          "file_url",
+          "file_size",
+          "is_private",
+          "attached_to_field",
+          "creation",
+          "modified",
+          "owner"
+        ],
+        filters: [
+          ["attached_to_doctype", "=", input.attached_to_doctype],
+          ["attached_to_name", "=", input.attached_to_name]
+        ],
+        order_by: "creation desc",
+        limit: input.limit ?? 50
+      });
+      return {
+        count: files.length,
+        data: files.map((file) => ({
+          name: file.name,
+          file_name: file.file_name,
+          file_url: file.file_url,
+          file_size: file.file_size ?? null,
+          is_private: file.is_private === 1,
+          attached_to_field: file.attached_to_field ?? null,
+          creation: file.creation,
+          modified: file.modified,
+          owner: file.owner
+        }))
+      };
+    }
+  },
+  {
+    name: "erpnext_file_download",
+    annotations: { readOnlyHint: true },
+    _meta: {
+      ui: {
+        resourceUri: DOC_META.ui.resourceUri,
+        visibility: ["app"]
+      }
+    },
+    description: "Download one ERPNext attachment for the document viewer. The tool accepts a File ID, verifies its document attachment, and returns one embedded binary resource.",
+    category: "operations",
+    inputSchema: {
+      type: "object",
+      properties: {
+        file_id: {
+          type: "string",
+          description: "Native ERPNext File.name identifier, never a URL.",
+          minLength: 1
+        },
+        attached_to_doctype: {
+          type: "string",
+          description: "Expected parent document DocType.",
+          minLength: 1
+        },
+        attached_to_name: {
+          type: "string",
+          description: "Expected parent document name/ID.",
+          minLength: 1
+        }
+      },
+      required: ["file_id", "attached_to_doctype", "attached_to_name"],
+      additionalProperties: false
+    },
+    handler: async (input, ctx) => {
+      for (const field of [
+        "file_id",
+        "attached_to_doctype",
+        "attached_to_name"
+      ]) {
+        if (typeof input[field] !== "string" || !input[field].trim()) {
+          throw new Error(
+            `[erpnext_file_download] '${field}' must be a non-empty string`
+          );
+        }
+      }
+      const file = await ctx.client.downloadFile({
+        fileId: input.file_id.trim(),
+        attachedToDoctype: input.attached_to_doctype.trim(),
+        attachedToName: input.attached_to_name.trim()
+      });
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Prepared ${file.fileName} for download (${file.bytes.byteLength} bytes).`
+          },
+          {
+            type: "resource",
+            resource: {
+              uri: `file:///${encodeURIComponent(file.fileName)}`,
+              mimeType: file.mimeType,
+              blob: bytesToBase64(file.bytes)
+            }
+          }
+        ]
+      };
+    }
+  },
   {
     name: "erpnext_file_upload",
     annotations: { destructiveHint: true },
@@ -54047,6 +54602,7 @@ var operationsTools = [
   {
     name: "erpnext_doc_get",
     annotations: { readOnlyHint: true },
+    _meta: DOC_META,
     description: "Get any ERPNext document by DocType and name. Useful for DocTypes not covered by dedicated tools. Returns the full document with all fields.",
     category: "operations",
     inputSchema: {
@@ -54064,17 +54620,18 @@ var operationsTools = [
       required: ["doctype", "name"]
     },
     handler: async (input, ctx) => {
-      if (!input.doctype) {
+      if (typeof input.doctype !== "string" || !input.doctype.trim()) {
         throw new Error("[erpnext_doc_get] 'doctype' is required");
       }
-      if (!input.name) {
+      if (typeof input.name !== "string" || !input.name.trim()) {
         throw new Error("[erpnext_doc_get] 'name' is required");
       }
+      const doctype = input.doctype.trim();
       const doc = await ctx.client.get(
-        input.doctype,
-        input.name
+        doctype,
+        input.name.trim()
       );
-      return { data: doc };
+      return { data: { ...doc, doctype } };
     }
   },
   // ── Generic List ──────────────────────────────────────────────────────────
@@ -54082,7 +54639,7 @@ var operationsTools = [
     name: "erpnext_doc_list",
     annotations: { readOnlyHint: true },
     _meta: DOCLIST_META,
-    description: "List any ERPNext documents by DocType. Useful for DocTypes not covered by dedicated tools. Supports field selection, filters (as JSON array), and limit.",
+    description: "List any ERPNext documents by DocType. Useful for DocTypes not covered by dedicated tools. Supports field selection, filters (as JSON array), bounded pagination, and an optional fresh read.",
     category: "operations",
     inputSchema: {
       type: "object",
@@ -54098,13 +54655,70 @@ var operationsTools = [
         },
         filters: {
           type: "array",
-          description: 'Frappe filters as array of [fieldname, operator, value] tuples. Example: [["status","=","Open"],["company","=","Acme"]]',
+          description: 'Frappe filters as array of [fieldname, operator, value] tuples, or [child doctype, fieldname, operator, value] to filter on a child table. Values may be strings, numbers, booleans, null, or string/number arrays for in/not in. Example: [["status","=","Open"],["company","=","Acme"]]',
           items: {
             type: "array",
-            items: { type: "string" }
+            anyOf: [
+              {
+                prefixItems: [
+                  { type: "string", minLength: 1 },
+                  { type: "string", minLength: 1 },
+                  {
+                    oneOf: [
+                      { type: ["string", "number", "boolean", "null"] },
+                      {
+                        type: "array",
+                        items: { type: ["string", "number"] }
+                      }
+                    ]
+                  }
+                ],
+                minItems: 3,
+                maxItems: 3
+              },
+              {
+                prefixItems: [
+                  { type: "string", minLength: 1 },
+                  { type: "string", minLength: 1 },
+                  { type: "string", minLength: 1 },
+                  {
+                    oneOf: [
+                      { type: ["string", "number", "boolean", "null"] },
+                      {
+                        type: "array",
+                        items: { type: ["string", "number"] }
+                      }
+                    ]
+                  }
+                ],
+                minItems: 4,
+                maxItems: 4
+              },
+              {
+                // 3.0.x advertised arbitrary string arrays. Keep accepting
+                // that legacy surface while describing real 3/4-part Frappe
+                // tuples precisely for modern clients.
+                items: { type: "string" }
+              }
+            ]
           }
         },
-        limit: { type: "number", description: "Max results (default 20)" },
+        limit: {
+          type: "integer",
+          minimum: 1,
+          maximum: DOC_LIST_MAX_LIMIT,
+          description: "Max results (default 20, maximum 5000)"
+        },
+        offset: {
+          type: "integer",
+          minimum: 0,
+          maximum: DOC_LIST_MAX_OFFSET,
+          description: "Pagination offset (default 0, maximum 100000)"
+        },
+        skip_cache: {
+          type: "boolean",
+          description: "Force a fresh ERPNext read instead of using the short-lived list cache"
+        },
         order_by: {
           type: "string",
           description: "Order by clause (e.g. 'modified desc', 'name asc')"
@@ -54116,16 +54730,34 @@ var operationsTools = [
       if (!input.doctype) {
         throw new Error("[erpnext_doc_list] 'doctype' is required");
       }
+      if (input.limit !== void 0 && (typeof input.limit !== "number" || !Number.isInteger(input.limit) || input.limit < 1 || input.limit > DOC_LIST_MAX_LIMIT)) {
+        throw new Error(
+          `[erpnext_doc_list] 'limit' must be an integer between 1 and ${DOC_LIST_MAX_LIMIT}`
+        );
+      }
+      if (input.offset !== void 0 && (typeof input.offset !== "number" || !Number.isInteger(input.offset) || input.offset < 0 || input.offset > DOC_LIST_MAX_OFFSET)) {
+        throw new Error(
+          `[erpnext_doc_list] 'offset' must be an integer between 0 and ${DOC_LIST_MAX_OFFSET}`
+        );
+      }
+      if (input.skip_cache !== void 0 && typeof input.skip_cache !== "boolean") {
+        throw new Error("[erpnext_doc_list] 'skip_cache' must be a boolean");
+      }
       const limit = input.limit ?? 20;
       const fields = input.fields ?? ["name", "modified"];
       const filters = input.filters ?? [];
       const order_by = input.order_by ?? "modified desc";
-      const docs = await ctx.client.list(input.doctype, {
+      const offset = input.offset;
+      const listOptions = {
         fields,
         filters,
         limit,
+        ...offset !== void 0 ? { limit_start: offset } : {},
         order_by
-      });
+      };
+      const docs = input.skip_cache === true ? await ctx.client.list(input.doctype, listOptions, {
+        skipCache: true
+      }) : await ctx.client.list(input.doctype, listOptions);
       return {
         doctype: input.doctype,
         count: docs.length,
@@ -54368,11 +55000,11 @@ var setupTools = [
         filters.push(["enabled", "=", 1]);
       }
       if (input.search) {
-        const literal2 = input.search.replace(
+        const literal3 = input.search.replace(
           /[\\%_]/g,
           (match2) => `\\${match2}`
         );
-        filters.push(["full_name", "like", `%${literal2}%`]);
+        filters.push(["full_name", "like", `%${literal3}%`]);
       }
       const docs = await ctx.client.list("User", {
         fields: ["name", "full_name", "enabled"],
@@ -54477,14 +55109,14 @@ var setupTools = [
 // src/tools/analytics.ts
 var MAX_RADAR_ITEMS = 8;
 function monthlyLabels(now, count) {
-  return Array.from({ length: count }, (_, index) => {
-    const month = new Date(
-      now.getFullYear(),
-      now.getMonth() - count + index + 1,
-      1
+  const labels = [];
+  for (let offset = count - 1; offset >= 0; offset--) {
+    const month = new Date(now.getFullYear(), now.getMonth() - offset, 1);
+    labels.push(
+      `${month.toLocaleString("en", { month: "short" })} ${month.getFullYear().toString().slice(2)}`
     );
-    return `${month.toLocaleString("en", { month: "short" })} ${String(month.getFullYear()).slice(-2)}`;
-  });
+  }
+  return labels;
 }
 function frappeCalendarMonth(value) {
   if (typeof value !== "string") return null;
@@ -54615,7 +55247,6 @@ var analyticsTools = [
         const invoices2 = await ctx.client.list("Sales Invoice", {
           fields: ["name", "status", "grand_total"],
           filters: [["docstatus", "!=", 2]],
-          // exclude cancelled
           limit: 500,
           order_by: "modified desc"
         });
@@ -54746,17 +55377,7 @@ var analyticsTools = [
         limit: 1e3,
         order_by: "transaction_date asc"
       });
-      const months = [];
-      for (let m = 0; m < monthsBack; m++) {
-        const d = new Date(
-          now.getFullYear(),
-          now.getMonth() - monthsBack + 1 + m,
-          1
-        );
-        months.push(
-          `${d.toLocaleString("en", { month: "short" })} ${d.getFullYear().toString().slice(2)}`
-        );
-      }
+      const months = monthlyLabels(now, monthsBack);
       if (groupBy === "customer") {
         const byCustomerMonth = {};
         for (const order2 of orders) {
@@ -54953,6 +55574,7 @@ var analyticsTools = [
             color: "#fbbf24",
             type: "line",
             yAxisId: "right",
+            unit: "orders",
             showDots: true
           }
         ],
@@ -55236,6 +55858,7 @@ var analyticsTools = [
         limit: 5e3
       });
       const sparkline = [0, 0, 0, 0, 0, 0];
+      const sparklineLabels = monthlyLabels(now, sparkline.length);
       for (const o of allOrders) {
         const calendarMonth = frappeCalendarMonth(o.transaction_date);
         if (!calendarMonth) continue;
@@ -55257,7 +55880,7 @@ var analyticsTools = [
         trend: delta > 0 ? "up" : delta < 0 ? "down" : "flat",
         trendIsGood: true,
         sparkline,
-        sparklineLabels: monthlyLabels(now, sparkline.length),
+        sparklineLabels,
         color: "#60a5fa",
         _meta: KPI_META
       };
@@ -55410,7 +56033,9 @@ var analyticsTools = [
     category: "analytics",
     inputSchema: { type: "object", properties: {} },
     handler: async (_input, ctx) => {
-      const today = localCalendarDate(/* @__PURE__ */ new Date());
+      const now = /* @__PURE__ */ new Date();
+      const pad = (n) => String(n).padStart(2, "0");
+      const today = `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`;
       const invoices = await ctx.client.list("Sales Invoice", {
         fields: ["outstanding_amount", "due_date"],
         filters: [
@@ -56890,6 +57515,1350 @@ var kanbanTools = [
   }
 ];
 
+// src/buy/identities.ts
+var BUY_SOURCE_CAPTURE_SCHEMA = "io.casys.mcp-erpnext.buy-source-capture/1.0";
+var BUY_RECORDED_RESULT_SCHEMA = "io.casys.mcp-erpnext.buy-recorded-result/1.0";
+var BUY_RECORDED_RESULT_SCHEMA_V2 = "io.casys.mcp-erpnext.buy-recorded-result/2.0";
+var BUY_RECORDED_SESSION_SCHEMA = "io.casys.mcp-erpnext.buy-recorded-session/1.0";
+var BUY_EVIDENCE_VIEWER_URI = "ui://mcp-erpnext/buy-evidence-viewer";
+var BUY_VIEW_APP_MANIFEST_URI = "ui://mcp-erpnext/buy-evidence-manifest";
+var BUY_VIEW_APP_ID = "io.casys.mcp-erpnext.buy-evidence";
+var BUY_VIEW_APP_TITLE = "ERPNext Buy Evidence";
+var BUY_VIEW_APP_VERSION = "3.2.0-beta.1";
+var BUY_SOURCE_INSTANCE_KIND = "erpnext-site";
+var BUY_CAPTURE_DOCTYPE = [
+  "Item",
+  "BOM",
+  "Item Price",
+  "Supplier Quotation",
+  "Supplier",
+  "Price List",
+  "UOM",
+  "Currency Exchange"
+];
+var BUY_CAPTURE_MAX_DOCUMENTS = 32;
+var BUY_CAPTURE_MAX_CHILD_ROWS = 200;
+var BUY_CAPTURE_MAX_CANONICAL_BYTES = 262144;
+var BUY_CAPTURE_MAX_NAME_LENGTH = 140;
+var BUY_DOCTYPE_SOURCE_CATEGORY = {
+  Item: "item",
+  BOM: "bom",
+  "Item Price": "catalogue-price",
+  "Supplier Quotation": "supplier-quotation",
+  Supplier: "supplier",
+  "Price List": "price-list",
+  UOM: "uom",
+  "Currency Exchange": "currency-exchange"
+};
+var BUY_CONSISTENCY_KIND = "repeated-read";
+var BUY_CONSISTENCY_READS = 2;
+
+// src/buy/errors.ts
+var BuyCaptureError = class extends Error {
+  code;
+  retryable;
+  context;
+  recovery;
+  constructor(code, message2, options) {
+    super(message2);
+    this.name = "BuyCaptureError";
+    this.code = code;
+    this.retryable = options.retryable === true;
+    this.context = Object.freeze({ ...options.context ?? {} });
+    this.recovery = options.recovery;
+  }
+};
+
+// src/buy/json.ts
+var FINGERPRINT = /^sha256:[a-f0-9]{64}$/;
+var ISO_MILLISECONDS = /^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3}Z$/;
+var CALENDAR_DATE = /^[0-9]{4}-[0-9]{2}-[0-9]{2}$/;
+var FRAPPE_DATETIME = /^[0-9]{4}-[0-9]{2}-[0-9]{2}[ T][0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]+)?$/;
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+  "api_key",
+  "api_secret",
+  "authorization",
+  "baseUrl",
+  "command",
+  "commands",
+  "cookie",
+  "credentials",
+  "endpoint",
+  "password",
+  "source_path",
+  "sourcePath",
+  "stagedPath"
+]);
+function record2(value, name) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${name} must be an object.`);
+  }
+  return value;
+}
+function exactKeys(value, keys, name) {
+  const ownKeys = Reflect.ownKeys(value);
+  if (ownKeys.some((key) => typeof key !== "string")) {
+    throw new TypeError(`${name} contains missing or unsupported fields.`);
+  }
+  for (const key of ownKeys) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor?.enumerable || !("value" in descriptor)) {
+      throw new TypeError(`${name} contains missing or unsupported fields.`);
+    }
+  }
+  const actual = ownKeys.toSorted();
+  const expected = [...keys].toSorted();
+  if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
+    throw new TypeError(`${name} contains missing or unsupported fields.`);
+  }
+}
+function exactRecord(value, keys, name) {
+  const root = record2(value, name);
+  exactKeys(root, keys, name);
+  rejectForbiddenKeys(root, name);
+  return root;
+}
+function denseArray(value, name) {
+  if (!Array.isArray(value)) throw new TypeError(`${name} must be an array.`);
+  const allowed = /* @__PURE__ */ new Set(["length"]);
+  for (let index = 0; index < value.length; index += 1) {
+    allowed.add(String(index));
+  }
+  const ownKeys = Reflect.ownKeys(value);
+  if (ownKeys.length !== allowed.size || ownKeys.some((key) => typeof key !== "string" || !allowed.has(key))) {
+    throw new TypeError(`${name} must be a dense, unadorned array.`);
+  }
+  for (let index = 0; index < value.length; index += 1) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+    if (!descriptor?.enumerable || !("value" in descriptor)) {
+      throw new TypeError(`${name} must be a dense, unadorned array.`);
+    }
+  }
+  return value;
+}
+function literal2(value, expected, name) {
+  if (value !== expected) throw new TypeError(`${name} must be ${expected}.`);
+  return expected;
+}
+function oneOf(value, allowed, name) {
+  if (typeof value !== "string" || !allowed.includes(value)) {
+    throw new TypeError(`${name} must be one of ${allowed.join(", ")}.`);
+  }
+  return value;
+}
+function nonEmpty(value, name) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new TypeError(`${name} must be a non-empty string.`);
+  }
+  if (value.trim() !== value) {
+    throw new TypeError(`${name} must not contain whitespace padding.`);
+  }
+  return value;
+}
+function pattern(value, expected, name) {
+  if (typeof value !== "string" || !expected.test(value)) {
+    throw new TypeError(`${name} has an invalid format.`);
+  }
+  return value;
+}
+function fingerprint(value, name) {
+  return pattern(value, FINGERPRINT, name);
+}
+function canonicalTimestamp(value, name) {
+  const timestamp = pattern(value, ISO_MILLISECONDS, name);
+  try {
+    if (new Date(timestamp).toISOString() !== timestamp) {
+      throw new TypeError(`${name} is not canonical UTC.`);
+    }
+  } catch {
+    throw new TypeError(`${name} is not canonical UTC.`);
+  }
+  return timestamp;
+}
+function calendarDate(value, name) {
+  const date4 = pattern(value, CALENDAR_DATE, name);
+  const parsed = /* @__PURE__ */ new Date(`${date4}T00:00:00.000Z`);
+  if (Number.isNaN(parsed.getTime()) || parsed.toISOString().slice(0, 10) !== date4) {
+    throw new TypeError(`${name} is not a real calendar date.`);
+  }
+  return date4;
+}
+function frappeDatetime(value, name) {
+  const datetime3 = pattern(value, FRAPPE_DATETIME, name);
+  calendarDate(datetime3.slice(0, 10), name);
+  const [hour, minute, second] = datetime3.slice(11, 19).split(":").map(Number);
+  if (hour > 23 || minute > 59 || second > 59) {
+    throw new TypeError(`${name} is not a real Frappe datetime.`);
+  }
+  return datetime3;
+}
+function boundedArray(value, max, name) {
+  const items = denseArray(value, name);
+  if (items.length > max) {
+    throw new TypeError(`${name} exceeds the ${max}-entry bound.`);
+  }
+  return items;
+}
+function rejectForbiddenKeys(value, name) {
+  if (Array.isArray(value)) {
+    const items = denseArray(value, name);
+    for (let index = 0; index < items.length; index += 1) {
+      rejectForbiddenKeys(items[index], `${name}[${index}]`);
+    }
+    return;
+  }
+  if (typeof value !== "object" || value === null) return;
+  const root = record2(value, name);
+  for (const key of Object.keys(root)) {
+    if (FORBIDDEN_KEYS.has(key)) {
+      throw new TypeError(
+        `${name}.${key} is a private credential, path, or command field and must not appear in the Buy contract.`
+      );
+    }
+    rejectForbiddenKeys(root[key], `${name}.${key}`);
+  }
+}
+function canonicalJson2(value, name) {
+  if (value === null || typeof value === "boolean" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError(`${name} must contain only finite JSON numbers.`);
+    }
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    const items = denseArray(value, name);
+    return `[${items.map((item, index) => canonicalJson2(item, `${name}[${index}]`)).join(",")}]`;
+  }
+  const root = record2(value, name);
+  const prototype = Object.getPrototypeOf(root);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new TypeError(`${name} must contain only plain JSON objects.`);
+  }
+  const ownKeys = Reflect.ownKeys(root);
+  if (ownKeys.some((key) => typeof key !== "string")) {
+    throw new TypeError(`${name} must contain only string-keyed JSON objects.`);
+  }
+  const keys = ownKeys.toSorted();
+  const fields = keys.map((key) => {
+    const descriptor = Object.getOwnPropertyDescriptor(root, key);
+    if (!descriptor?.enumerable || !("value" in descriptor)) {
+      throw new TypeError(`${name}.${key} must be an enumerable JSON value.`);
+    }
+    if (descriptor.value === void 0) {
+      throw new TypeError(`${name}.${key} must not be undefined.`);
+    }
+    return `${JSON.stringify(key)}:${canonicalJson2(descriptor.value, `${name}.${key}`)}`;
+  });
+  return `{${fields.join(",")}}`;
+}
+function utf8ByteCount(text) {
+  return new TextEncoder().encode(text).byteLength;
+}
+async function sha256HexOfUtf8(text) {
+  const bytes = new TextEncoder().encode(text);
+  const digestBytes = new Uint8Array(
+    await crypto.subtle.digest("SHA-256", bytes)
+  );
+  return Array.from(digestBytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function sha256FingerprintOfUtf8(text) {
+  return `sha256:${await sha256HexOfUtf8(text)}`;
+}
+
+// src/buy/projection.ts
+var DECIMAL = /^-?(?:0|[1-9]\d*)(?:\.\d+)?$/;
+var CURRENCY = /^[A-Z]{3}$/;
+var SENSITIVE_FIELDS = /* @__PURE__ */ new Set([
+  "api_key",
+  "api_secret",
+  "password",
+  "email_id",
+  "email",
+  "mobile_no",
+  "phone",
+  "cell_number"
+]);
+var ITEM_FIELDS = [
+  { key: "item_code", kind: "string", required: true },
+  { key: "item_name", kind: "string" },
+  { key: "item_group", kind: "string" },
+  { key: "stock_uom", kind: "string" },
+  { key: "is_purchase_item", kind: "boolean" },
+  { key: "is_stock_item", kind: "boolean" },
+  { key: "disabled", kind: "boolean" }
+];
+var BOM_FIELDS = [
+  { key: "item", kind: "string", required: true },
+  { key: "item_name", kind: "string" },
+  { key: "quantity", kind: "decimal", required: true },
+  { key: "uom", kind: "string", required: true },
+  { key: "is_active", kind: "boolean" },
+  { key: "is_default", kind: "boolean" },
+  { key: "company", kind: "string" },
+  { key: "currency", kind: "currency" },
+  { key: "with_operations", kind: "boolean" }
+];
+var BOM_ITEM_FIELDS = [
+  { key: "item_code", kind: "string", required: true },
+  { key: "item_name", kind: "string" },
+  { key: "qty", kind: "decimal", required: true },
+  { key: "uom", kind: "string", required: true },
+  { key: "rate", kind: "decimal" },
+  { key: "amount", kind: "decimal" },
+  { key: "sourced_by_supplier", kind: "boolean" }
+];
+var BOM_OPERATION_FIELDS = [
+  { key: "operation", kind: "string", required: true },
+  { key: "time_in_mins", kind: "decimal" },
+  { key: "hour_rate", kind: "decimal" }
+];
+var ITEM_PRICE_FIELDS = [
+  { key: "item_code", kind: "string", required: true },
+  { key: "item_name", kind: "string" },
+  { key: "price_list", kind: "string" },
+  { key: "price_list_rate", kind: "decimal", required: true },
+  { key: "currency", kind: "currency", required: true },
+  { key: "uom", kind: "string" },
+  { key: "min_qty", kind: "decimal" },
+  { key: "valid_from", kind: "date" },
+  { key: "valid_upto", kind: "date" },
+  { key: "supplier", kind: "string" },
+  { key: "buying", kind: "boolean" },
+  { key: "selling", kind: "boolean" }
+];
+var SUPPLIER_QUOTATION_FIELDS = [
+  { key: "supplier", kind: "string", required: true },
+  { key: "supplier_name", kind: "string" },
+  { key: "transaction_date", kind: "date", required: true },
+  { key: "valid_till", kind: "date" },
+  { key: "currency", kind: "currency", required: true },
+  { key: "conversion_rate", kind: "decimal" },
+  { key: "status", kind: "string" },
+  { key: "company", kind: "string" },
+  { key: "price_list", kind: "string" }
+];
+var SUPPLIER_QUOTATION_ITEM_FIELDS = [
+  { key: "item_code", kind: "string", required: true },
+  { key: "item_name", kind: "string" },
+  { key: "qty", kind: "decimal", required: true },
+  { key: "uom", kind: "string", required: true },
+  { key: "rate", kind: "decimal" },
+  { key: "amount", kind: "decimal" },
+  { key: "price_list_rate", kind: "decimal" },
+  { key: "discount_percentage", kind: "decimal" },
+  { key: "supplier_part_no", kind: "string" }
+];
+var SUPPLIER_FIELDS = [
+  { key: "supplier_name", kind: "string", required: true },
+  { key: "supplier_group", kind: "string" },
+  { key: "supplier_type", kind: "string" },
+  { key: "country", kind: "string" },
+  { key: "default_currency", kind: "currency" },
+  { key: "disabled", kind: "boolean" }
+];
+var PRICE_LIST_FIELDS = [
+  { key: "currency", kind: "currency", required: true },
+  { key: "enabled", kind: "boolean" },
+  { key: "buying", kind: "boolean" },
+  { key: "selling", kind: "boolean" },
+  { key: "price_not_uom_dependent", kind: "boolean" }
+];
+var UOM_FIELDS = [
+  { key: "uom_name", kind: "string" },
+  { key: "must_be_whole_number", kind: "boolean" }
+];
+var CURRENCY_EXCHANGE_FIELDS = [
+  { key: "from_currency", kind: "currency", required: true },
+  { key: "to_currency", kind: "currency", required: true },
+  { key: "exchange_rate", kind: "decimal", required: true },
+  { key: "date", kind: "date", required: true }
+];
+var BUY_DOCTYPE_CHILD_TABLES = {
+  BOM: [
+    { table: "items", fields: BOM_ITEM_FIELDS },
+    { table: "operations", fields: BOM_OPERATION_FIELDS }
+  ],
+  "Supplier Quotation": [
+    { table: "items", fields: SUPPLIER_QUOTATION_ITEM_FIELDS }
+  ]
+};
+var BUY_DOCTYPE_FIELD_SPECS = {
+  Item: ITEM_FIELDS,
+  BOM: BOM_FIELDS,
+  "Item Price": ITEM_PRICE_FIELDS,
+  "Supplier Quotation": SUPPLIER_QUOTATION_FIELDS,
+  Supplier: SUPPLIER_FIELDS,
+  "Price List": PRICE_LIST_FIELDS,
+  UOM: UOM_FIELDS,
+  "Currency Exchange": CURRENCY_EXCHANGE_FIELDS
+};
+function isBuyCaptureDoctype(value) {
+  return BUY_CAPTURE_DOCTYPE.includes(value);
+}
+async function projectBuyDocument(doctype, raw2) {
+  const name = requiredName(raw2.name, `${doctype}.name`);
+  const modified = requiredModified(raw2.modified, `${doctype}.modified`);
+  const fields = projectFields(
+    raw2,
+    BUY_DOCTYPE_FIELD_SPECS[doctype],
+    `${doctype}`
+  );
+  const children = projectChildren(doctype, raw2);
+  const docstatus = optionalDocstatus(raw2.docstatus, `${doctype}.docstatus`);
+  const status = optionalStatus(raw2.status, `${doctype}.status`);
+  const identity = {
+    doctype,
+    name,
+    modified,
+    ...docstatus !== void 0 ? { docstatus } : {},
+    ...status !== void 0 ? { status } : {},
+    sourceCategory: BUY_DOCTYPE_SOURCE_CATEGORY[doctype],
+    fields,
+    ...children !== void 0 ? { children } : {}
+  };
+  const fingerprint2 = await sha256FingerprintOfUtf8(
+    canonicalJson2(identity, `${doctype}:${name} projection`)
+  );
+  return { ...identity, fingerprint: fingerprint2 };
+}
+function projectChildren(doctype, raw2) {
+  const specs = BUY_DOCTYPE_CHILD_TABLES[doctype];
+  if (!specs) return void 0;
+  const tables = [];
+  for (const spec of specs) {
+    const value = raw2[spec.table];
+    if (value === void 0 || value === null) continue;
+    if (!Array.isArray(value)) {
+      throw new BuyCaptureError(
+        "BUY_CAPTURE_INVALID_PROJECTION",
+        `${doctype}.${spec.table} must be a child table array.`,
+        {
+          recovery: "Capture only closed child tables with exact row identities.",
+          context: { doctype, table: spec.table }
+        }
+      );
+    }
+    if (value.length > BUY_CAPTURE_MAX_CHILD_ROWS) {
+      throw new BuyCaptureError(
+        "BUY_CAPTURE_BOUNDS_EXCEEDED",
+        `${doctype}.${spec.table} exceeds the ${BUY_CAPTURE_MAX_CHILD_ROWS}-row bound.`,
+        {
+          recovery: "Narrow the capture to fewer child rows.",
+          context: {
+            doctype,
+            table: spec.table,
+            limit: BUY_CAPTURE_MAX_CHILD_ROWS,
+            actual: value.length
+          }
+        }
+      );
+    }
+    if (value.length === 0) continue;
+    const rows = value.map(
+      (row, index) => projectChildRow(
+        row,
+        spec.fields,
+        `${doctype}.${spec.table}[${index}]`
+      )
+    );
+    tables.push({ table: spec.table, rows });
+  }
+  return tables.length > 0 ? tables : void 0;
+}
+function projectChildRow(row, specs, path) {
+  if (typeof row !== "object" || row === null || Array.isArray(row)) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_PROJECTION",
+      `${path} must be a child row object.`,
+      {
+        recovery: "Child rows must keep their exact Frappe name identity.",
+        context: { path }
+      }
+    );
+  }
+  const record3 = row;
+  const name = requiredName(record3.name, `${path}.name`);
+  const idx = optionalIdx(record3.idx, `${path}.idx`);
+  return {
+    name,
+    ...idx !== void 0 ? { idx } : {},
+    fields: projectFields(record3, specs, path)
+  };
+}
+function projectFields(raw2, specs, path) {
+  for (const key of Object.keys(raw2)) {
+    if (SENSITIVE_FIELDS.has(key)) {
+      continue;
+    }
+  }
+  const fields = {};
+  for (const spec of specs) {
+    const value = projectField(raw2[spec.key], spec, `${path}.${spec.key}`);
+    if (value !== void 0) fields[spec.key] = value;
+  }
+  return fields;
+}
+function projectField(value, spec, path) {
+  if (value === void 0 || value === null || value === "") {
+    if (spec.required) {
+      throw new BuyCaptureError(
+        "BUY_CAPTURE_INVALID_PROJECTION",
+        `${path} is required on the closed commercial projection.`,
+        {
+          recovery: "The ERP document is missing a field later consumed as cost evidence.",
+          context: { path, field: spec.key }
+        }
+      );
+    }
+    return void 0;
+  }
+  switch (spec.kind) {
+    case "string":
+      return requiredString(value, path);
+    case "decimal":
+      return requiredDecimal(value, path);
+    case "boolean":
+      return requiredBoolean(value, path);
+    case "currency":
+      return requiredCurrency(value, path);
+    case "date":
+      return requiredDate(value, path);
+    case "integer":
+      return requiredInteger(value, path);
+  }
+}
+function requiredName(value, path) {
+  const name = requiredString(value, path);
+  if (name.length > BUY_CAPTURE_MAX_NAME_LENGTH) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_BOUNDS_EXCEEDED",
+      `${path} exceeds the ${BUY_CAPTURE_MAX_NAME_LENGTH}-character bound.`,
+      {
+        recovery: "Use the exact ERP document name; do not pass a description.",
+        context: {
+          path,
+          limit: BUY_CAPTURE_MAX_NAME_LENGTH,
+          actual: name.length
+        }
+      }
+    );
+  }
+  return name;
+}
+function requiredModified(value, path) {
+  try {
+    return frappeDatetime(value, path);
+  } catch {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_PROJECTION",
+      `${path} is not a Frappe datetime.`,
+      {
+        recovery: "Capture the document's exact modified timestamp.",
+        context: { path }
+      }
+    );
+  }
+}
+function requiredString(value, path) {
+  if (typeof value !== "string" || value.trim() === "" || value.trim() !== value) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_PROJECTION",
+      `${path} must be a non-empty unpadded string.`,
+      {
+        recovery: "Use the exact ERP string; do not invent a label.",
+        context: { path }
+      }
+    );
+  }
+  return value;
+}
+function requiredDecimal(value, path) {
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new BuyCaptureError(
+        "BUY_CAPTURE_INVALID_PROJECTION",
+        `${path} must be a finite decimal.`,
+        {
+          recovery: "Refuse non-finite commercial amounts rather than coerce them.",
+          context: { path }
+        }
+      );
+    }
+    return JSON.stringify(value);
+  }
+  if (typeof value === "string") {
+    if (!DECIMAL.test(value)) {
+      throw new BuyCaptureError(
+        "BUY_CAPTURE_INVALID_PROJECTION",
+        `${path} must be a canonical decimal string.`,
+        {
+          recovery: "Keep the ERP decimal; do not fill absence with zero.",
+          context: { path }
+        }
+      );
+    }
+    return value;
+  }
+  throw new BuyCaptureError(
+    "BUY_CAPTURE_INVALID_PROJECTION",
+    `${path} must be a decimal.`,
+    {
+      recovery: "Keep the ERP decimal; do not fill absence with zero.",
+      context: { path }
+    }
+  );
+}
+function requiredBoolean(value, path) {
+  if (value === true || value === 1) return true;
+  if (value === false || value === 0) return false;
+  throw new BuyCaptureError(
+    "BUY_CAPTURE_INVALID_PROJECTION",
+    `${path} must be a boolean or Frappe 0/1.`,
+    {
+      recovery: "Do not coerce missing flags to false.",
+      context: { path }
+    }
+  );
+}
+function requiredCurrency(value, path) {
+  const code = requiredString(value, path);
+  if (!CURRENCY.test(code)) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_PROJECTION",
+      `${path} must be a 3-letter currency code.`,
+      {
+        recovery: "Capture the document currency; do not guess a conversion.",
+        context: { path }
+      }
+    );
+  }
+  return code;
+}
+function requiredDate(value, path) {
+  try {
+    return calendarDate(value, path);
+  } catch {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_PROJECTION",
+      `${path} must be a real YYYY-MM-DD date.`,
+      {
+        recovery: "Keep the ERP calendar date; do not localize it.",
+        context: { path }
+      }
+    );
+  }
+}
+function requiredInteger(value, path) {
+  if (!Number.isSafeInteger(value)) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_PROJECTION",
+      `${path} must be a safe integer.`,
+      { recovery: "Keep the ERP integer identity.", context: { path } }
+    );
+  }
+  return value;
+}
+function optionalDocstatus(value, path) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  if (value !== 0 && value !== 1 && value !== 2) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_PROJECTION",
+      `${path} must be 0, 1, or 2.`,
+      { recovery: "Keep the ERP docstatus.", context: { path } }
+    );
+  }
+  return value;
+}
+function optionalStatus(value, path) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  return requiredString(value, path);
+}
+function optionalIdx(value, path) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  return requiredInteger(value, path);
+}
+function parseClosedWireFields(value, specs, path) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${path} must be an object.`);
+  }
+  const root = value;
+  const allowed = new Map(specs.map((spec) => [spec.key, spec]));
+  for (const key of Object.keys(root)) {
+    if (!allowed.has(key)) {
+      throw new TypeError(`${path}.${key} is not a closed commercial field.`);
+    }
+  }
+  const fields = {};
+  for (const spec of specs) {
+    const raw2 = root[spec.key];
+    if (raw2 === void 0 || raw2 === null || raw2 === "") {
+      if (spec.required) {
+        throw new TypeError(`${path}.${spec.key} is required.`);
+      }
+      continue;
+    }
+    fields[spec.key] = parseWireValue(raw2, spec, `${path}.${spec.key}`);
+  }
+  return fields;
+}
+function parseClosedWireChildren(doctype, value, path) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) {
+    throw new TypeError(`${path} must be an array.`);
+  }
+  const specs = BUY_DOCTYPE_CHILD_TABLES[doctype] ?? [];
+  if (specs.length === 0) {
+    throw new TypeError(`${path} is not admitted for ${doctype}.`);
+  }
+  if (value.length === 0) {
+    throw new TypeError(`${path} must be omitted when empty.`);
+  }
+  const known = new Map(specs.map((spec) => [spec.table, spec]));
+  const seenTables = /* @__PURE__ */ new Set();
+  return value.map((item, index) => {
+    const tablePath = `${path}[${index}]`;
+    if (typeof item !== "object" || item === null || Array.isArray(item)) {
+      throw new TypeError(`${tablePath} must be an object.`);
+    }
+    const table2 = item;
+    const keys = Object.keys(table2).toSorted();
+    if (keys.length !== 2 || keys[0] !== "rows" || keys[1] !== "table") {
+      throw new TypeError(
+        `${tablePath} contains missing or unsupported fields.`
+      );
+    }
+    if (typeof table2.table !== "string" || !known.has(table2.table)) {
+      throw new TypeError(
+        `${tablePath}.table is not a closed child table for ${doctype}.`
+      );
+    }
+    if (seenTables.has(table2.table)) {
+      throw new TypeError(`${tablePath}.table duplicates ${table2.table}.`);
+    }
+    seenTables.add(table2.table);
+    const spec = known.get(table2.table);
+    if (!Array.isArray(table2.rows)) {
+      throw new TypeError(`${tablePath}.rows must be an array.`);
+    }
+    if (table2.rows.length > BUY_CAPTURE_MAX_CHILD_ROWS) {
+      throw new TypeError(
+        `${tablePath}.rows exceeds the ${BUY_CAPTURE_MAX_CHILD_ROWS}-row bound.`
+      );
+    }
+    const seenRows = /* @__PURE__ */ new Set();
+    const rows = table2.rows.map((row, rowIndex) => {
+      const rowPath = `${tablePath}.rows[${rowIndex}]`;
+      const parsed = parseClosedWireRow(row, spec.fields, rowPath);
+      if (seenRows.has(parsed.name)) {
+        throw new TypeError(`${rowPath} duplicates child row ${parsed.name}.`);
+      }
+      seenRows.add(parsed.name);
+      return parsed;
+    });
+    return { table: spec.table, rows };
+  });
+}
+function parseClosedWireRow(value, specs, path) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${path} must be an object.`);
+  }
+  const root = value;
+  const keys = Object.keys(root).toSorted();
+  const allowed = root.idx === void 0 ? ["fields", "name"] : ["fields", "idx", "name"];
+  if (keys.length !== allowed.length || keys.some((key, index) => key !== allowed[index])) {
+    throw new TypeError(`${path} contains missing or unsupported fields.`);
+  }
+  const name = requiredWireName(root.name, `${path}.name`);
+  return {
+    name,
+    ...root.idx === void 0 ? {} : {
+      idx: requiredWireIdx(root.idx, `${path}.idx`)
+    },
+    fields: parseClosedWireFields(root.fields, specs, `${path}.fields`)
+  };
+}
+function parseWireValue(value, spec, path) {
+  switch (spec.kind) {
+    case "string":
+      if (typeof value !== "string" || value.trim() === "" || value.trim() !== value) {
+        throw new TypeError(`${path} must be a non-empty unpadded string.`);
+      }
+      return value;
+    case "decimal":
+      if (typeof value !== "string" || !DECIMAL.test(value)) {
+        throw new TypeError(`${path} must be a canonical decimal string.`);
+      }
+      return value;
+    case "boolean":
+      if (value !== true && value !== false) {
+        throw new TypeError(`${path} must be a boolean.`);
+      }
+      return value;
+    case "currency":
+      if (typeof value !== "string" || !CURRENCY.test(value)) {
+        throw new TypeError(`${path} must be a 3-letter currency code.`);
+      }
+      return value;
+    case "date":
+      return calendarDate(value, path);
+    case "integer":
+      if (!Number.isSafeInteger(value)) {
+        throw new TypeError(`${path} must be a safe integer.`);
+      }
+      return value;
+  }
+}
+function requiredWireName(value, path) {
+  if (typeof value !== "string" || value.trim() === "" || value.trim() !== value) {
+    throw new TypeError(`${path} must be a non-empty unpadded string.`);
+  }
+  if (value.length > BUY_CAPTURE_MAX_NAME_LENGTH) {
+    throw new TypeError(
+      `${path} exceeds the ${BUY_CAPTURE_MAX_NAME_LENGTH}-character bound.`
+    );
+  }
+  return value;
+}
+function requiredWireIdx(value, path) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new TypeError(`${path} must be a non-negative integer.`);
+  }
+  return value;
+}
+
+// src/buy/site.ts
+async function sourceInstanceFromClient(client) {
+  const normalized = client.normalizedSiteUrl();
+  return {
+    kind: BUY_SOURCE_INSTANCE_KIND,
+    siteId: await sha256FingerprintOfUtf8(normalized)
+  };
+}
+
+// src/buy/capture.ts
+var CALLER_AUTHORITY_KEYS = [
+  "sourceInstance",
+  "capturedAt",
+  "fingerprint",
+  "canonicalText",
+  "byteCount",
+  "endpoint",
+  "uri",
+  "credentials",
+  "baseUrl",
+  "siteId",
+  "attestedTimestamp",
+  "digest"
+];
+function parseBuyCaptureInput(value) {
+  const root = asRecord(value, "buy capture input");
+  for (const key of CALLER_AUTHORITY_KEYS) {
+    if (key in root) {
+      throw new BuyCaptureError(
+        "BUY_CAPTURE_CALLER_AUTHORITY_REJECTED",
+        `buy capture input must not include caller-supplied ${key}.`,
+        {
+          recovery: "Omit sourceInstance, capturedAt, fingerprints, endpoints, and credentials; the configured FrappeClient and server clock own those fields.",
+          context: { key }
+        }
+      );
+    }
+  }
+  const keys = Object.keys(root);
+  if (keys.length !== 1 || keys[0] !== "documents") {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_INPUT",
+      "buy capture input must contain only documents.",
+      {
+        recovery: "Pass a bounded list of exact {doctype, name, expectedModified?} references.",
+        context: { keys }
+      }
+    );
+  }
+  if (!Array.isArray(root.documents)) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_INPUT",
+      "buy capture input.documents must be an array.",
+      {
+        recovery: "Pass a dense list of exact document references."
+      }
+    );
+  }
+  if (root.documents.length === 0) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_INPUT",
+      "buy capture input.documents must not be empty.",
+      {
+        recovery: "Name the exact documents to capture."
+      }
+    );
+  }
+  if (root.documents.length > BUY_CAPTURE_MAX_DOCUMENTS) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_BOUNDS_EXCEEDED",
+      `buy capture input.documents exceeds the ${BUY_CAPTURE_MAX_DOCUMENTS}-document bound.`,
+      {
+        recovery: "Narrow the capture; silent pagination is not allowed.",
+        context: {
+          limit: BUY_CAPTURE_MAX_DOCUMENTS,
+          actual: root.documents.length
+        }
+      }
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const documents = root.documents.map(
+    (item, index) => parseDocumentRef(item, index, seen)
+  );
+  return { documents };
+}
+async function parseBuySourceCapture(value) {
+  const root = exactRecord(value, [
+    "schemaVersion",
+    "sourceInstance",
+    "capturedAt",
+    "documents",
+    "consistency"
+  ], "buy source capture");
+  literal2(
+    root.schemaVersion,
+    BUY_SOURCE_CAPTURE_SCHEMA,
+    "buy source capture.schemaVersion"
+  );
+  const source = exactRecord(
+    root.sourceInstance,
+    ["kind", "siteId"],
+    "buy source capture.sourceInstance"
+  );
+  literal2(
+    source.kind,
+    BUY_SOURCE_INSTANCE_KIND,
+    "buy source capture.sourceInstance.kind"
+  );
+  const documents = [];
+  const rawDocuments = boundedArray(
+    root.documents,
+    BUY_CAPTURE_MAX_DOCUMENTS,
+    "buy source capture.documents"
+  );
+  if (rawDocuments.length === 0) {
+    throw new TypeError("buy source capture.documents must not be empty.");
+  }
+  const seenDocuments = /* @__PURE__ */ new Set();
+  for (let index = 0; index < rawDocuments.length; index += 1) {
+    const parsed = await parseCapturedDocument(rawDocuments[index], index);
+    const id = `${parsed.doctype}:${parsed.name}`;
+    if (seenDocuments.has(id)) {
+      throw new TypeError(
+        `buy source capture.documents[${index}] duplicates ${id}.`
+      );
+    }
+    seenDocuments.add(id);
+    documents.push(parsed);
+  }
+  const consistency = exactRecord(
+    root.consistency,
+    ["kind", "reads", "consistent"],
+    "buy source capture.consistency"
+  );
+  literal2(
+    consistency.kind,
+    BUY_CONSISTENCY_KIND,
+    "buy source capture.consistency.kind"
+  );
+  if (consistency.reads !== BUY_CONSISTENCY_READS) {
+    throw new TypeError(
+      "buy source capture.consistency.reads must be 2."
+    );
+  }
+  if (consistency.consistent !== true) {
+    throw new TypeError(
+      "buy source capture.consistency.consistent must be true; inconsistent captures are not a usable payload."
+    );
+  }
+  return {
+    schemaVersion: BUY_SOURCE_CAPTURE_SCHEMA,
+    sourceInstance: {
+      kind: BUY_SOURCE_INSTANCE_KIND,
+      siteId: fingerprint(
+        source.siteId,
+        "buy source capture.sourceInstance.siteId"
+      )
+    },
+    capturedAt: canonicalTimestamp(
+      root.capturedAt,
+      "buy source capture.capturedAt"
+    ),
+    documents,
+    consistency: {
+      kind: BUY_CONSISTENCY_KIND,
+      reads: BUY_CONSISTENCY_READS,
+      consistent: true
+    }
+  };
+}
+async function sealBuySourceCapture(capture) {
+  const parsed = await parseBuySourceCapture(capture);
+  const canonicalText = canonicalJson2(parsed, "buy source capture");
+  const byteCount = utf8ByteCount(canonicalText);
+  if (byteCount > BUY_CAPTURE_MAX_CANONICAL_BYTES) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_BOUNDS_EXCEEDED",
+      `buy source capture exceeds the ${BUY_CAPTURE_MAX_CANONICAL_BYTES}-byte bound.`,
+      {
+        recovery: "Narrow the capture; silent pagination is not allowed.",
+        context: { limit: BUY_CAPTURE_MAX_CANONICAL_BYTES, actual: byteCount }
+      }
+    );
+  }
+  return {
+    schemaVersion: BUY_SOURCE_CAPTURE_SCHEMA,
+    capture: parsed,
+    canonicalText,
+    fingerprint: await sha256FingerprintOfUtf8(canonicalText),
+    byteCount
+  };
+}
+async function runBuyCapture(input, deps) {
+  const parsedInput = parseBuyCaptureInput(input);
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const capturedAt = canonicalTimestamp(
+    now().toISOString(),
+    "buy source capture.capturedAt"
+  );
+  const sourceInstance = await sourceInstanceFromClient(deps.client);
+  const first = await readAll(parsedInput.documents, deps.client);
+  const documents = await Promise.all(
+    first.map((row) => projectBuyDocument(row.doctype, row.doc))
+  );
+  for (let index = 0; index < parsedInput.documents.length; index += 1) {
+    const expected = parsedInput.documents[index].expectedModified;
+    if (expected !== void 0 && documents[index].modified !== expected) {
+      throw new BuyCaptureError(
+        "BUY_CAPTURE_EXPECTED_MODIFIED_MISMATCH",
+        `Document ${documents[index].doctype}:${documents[index].name} modified does not match expectedModified.`,
+        {
+          recovery: "Re-resolve the exact document revision before capturing.",
+          context: {
+            doctype: documents[index].doctype,
+            name: documents[index].name,
+            modified: documents[index].modified,
+            expectedModified: expected
+          }
+        }
+      );
+    }
+  }
+  const second = await readAll(parsedInput.documents, deps.client);
+  const reread = await Promise.all(
+    second.map((row) => projectBuyDocument(row.doctype, row.doc))
+  );
+  for (let index = 0; index < documents.length; index += 1) {
+    const a = documents[index];
+    const b = reread[index];
+    if (a.modified !== b.modified || a.fingerprint !== b.fingerprint) {
+      throw new BuyCaptureError(
+        "BUY_CAPTURE_INCONSISTENT",
+        `Document ${a.doctype}:${a.name} changed between the two skipCache reads.`,
+        {
+          retryable: true,
+          recovery: "Retry the capture. Repeated-read consistency failed; this is not a transactional snapshot.",
+          context: {
+            doctype: a.doctype,
+            name: a.name,
+            firstModified: a.modified,
+            secondModified: b.modified,
+            firstFingerprint: a.fingerprint,
+            secondFingerprint: b.fingerprint
+          }
+        }
+      );
+    }
+  }
+  return await sealBuySourceCapture({
+    schemaVersion: BUY_SOURCE_CAPTURE_SCHEMA,
+    sourceInstance,
+    capturedAt,
+    documents,
+    consistency: {
+      kind: BUY_CONSISTENCY_KIND,
+      reads: BUY_CONSISTENCY_READS,
+      consistent: true
+    }
+  });
+}
+async function readAll(refs, client) {
+  const docs = [];
+  for (const ref of refs) {
+    let doc;
+    try {
+      doc = await client.get(ref.doctype, ref.name, { skipCache: true });
+    } catch (error2) {
+      if (error2 instanceof FrappeAPIError && error2.status === 404) {
+        throw new BuyCaptureError(
+          "BUY_CAPTURE_MISSING_SOURCE",
+          `Document ${ref.doctype}:${ref.name} was not found.`,
+          {
+            recovery: "Capture only documents that currently exist on the configured site.",
+            context: { doctype: ref.doctype, name: ref.name }
+          }
+        );
+      }
+      throw error2;
+    }
+    assertExactReturnedIdentity(ref, doc);
+    docs.push({ doctype: ref.doctype, doc });
+  }
+  return docs;
+}
+function assertExactReturnedIdentity(ref, doc) {
+  if (doc.name !== ref.name) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_IDENTITY_MISMATCH",
+      `Requested ${ref.doctype}:${ref.name} but the client returned name ${String(doc.name)}.`,
+      {
+        recovery: "Refuse the response; do not relabel a different ERP document as the requested identity.",
+        context: {
+          requestedDoctype: ref.doctype,
+          requestedName: ref.name,
+          returnedName: doc.name
+        }
+      }
+    );
+  }
+  if (doc.doctype !== void 0 && doc.doctype !== null && doc.doctype !== "" && doc.doctype !== ref.doctype) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_IDENTITY_MISMATCH",
+      `Requested ${ref.doctype}:${ref.name} but the client returned doctype ${String(doc.doctype)}.`,
+      {
+        recovery: "Refuse the response; do not relabel a different ERP document as the requested identity.",
+        context: {
+          requestedDoctype: ref.doctype,
+          requestedName: ref.name,
+          returnedDoctype: doc.doctype
+        }
+      }
+    );
+  }
+}
+function parseDocumentRef(value, index, seen) {
+  const path = `buy capture input.documents[${index}]`;
+  const root = asRecord(value, path);
+  const keys = Object.keys(root).toSorted();
+  const allowed = root.expectedModified === void 0 ? ["doctype", "name"] : ["doctype", "expectedModified", "name"];
+  if (keys.length !== allowed.length || keys.some((key, keyIndex) => key !== allowed[keyIndex])) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_INPUT",
+      `${path} must contain only doctype, name, and optional expectedModified.`,
+      {
+        recovery: "Do not pass endpoints, sourceInstance, or extra ERP fields.",
+        context: { keys }
+      }
+    );
+  }
+  if (typeof root.doctype !== "string" || !isBuyCaptureDoctype(root.doctype)) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_UNSUPPORTED_DOCTYPE",
+      `${path}.doctype is not a closed Buy capture DocType.`,
+      {
+        recovery: `Use one of ${BUY_CAPTURE_DOCTYPE.join(", ")}. Generic doctypes cannot masquerade as a price.`,
+        context: { doctype: root.doctype }
+      }
+    );
+  }
+  if (typeof root.name !== "string" || root.name.trim() === "" || root.name.trim() !== root.name) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_INPUT",
+      `${path}.name must be the exact ERP document name.`,
+      { recovery: "Pass the exact document name, not a label." }
+    );
+  }
+  if (root.name.length > BUY_CAPTURE_MAX_NAME_LENGTH) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_BOUNDS_EXCEEDED",
+      `${path}.name exceeds the ${BUY_CAPTURE_MAX_NAME_LENGTH}-character bound.`,
+      {
+        recovery: "Use the exact ERP document name.",
+        context: {
+          limit: BUY_CAPTURE_MAX_NAME_LENGTH,
+          actual: root.name.length
+        }
+      }
+    );
+  }
+  const id = `${root.doctype}:${root.name}`;
+  if (seen.has(id)) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_INPUT",
+      `${path} duplicates ${id}.`,
+      { recovery: "Each exact document reference may appear once." }
+    );
+  }
+  seen.add(id);
+  const expectedModified = root.expectedModified === void 0 ? void 0 : parseExpectedModified(root.expectedModified, `${path}.expectedModified`);
+  return {
+    doctype: root.doctype,
+    name: root.name,
+    ...expectedModified !== void 0 ? { expectedModified } : {}
+  };
+}
+function parseExpectedModified(value, path) {
+  if (typeof value !== "string" || value.trim() === "" || value.trim() !== value) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_INPUT",
+      `${path} must be the exact Frappe modified timestamp.`,
+      { recovery: "Pass the document's modified value, not a caller digest." }
+    );
+  }
+  try {
+    frappeDatetime(value, path);
+  } catch {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_INPUT",
+      `${path} is not a Frappe datetime.`,
+      { recovery: "Pass the document's modified value." }
+    );
+  }
+  return value;
+}
+async function parseCapturedDocument(value, index) {
+  const path = `buy source capture.documents[${index}]`;
+  const root = record2(value, path);
+  const keys = Object.keys(root).toSorted();
+  const optional2 = /* @__PURE__ */ new Set(["docstatus", "status", "children"]);
+  const required2 = [
+    "doctype",
+    "fields",
+    "fingerprint",
+    "modified",
+    "name",
+    "sourceCategory"
+  ];
+  const actualRequired = keys.filter((key) => !optional2.has(key)).toSorted();
+  if (actualRequired.length !== required2.length || actualRequired.some((key, keyIndex) => key !== required2[keyIndex])) {
+    throw new TypeError(`${path} contains missing or unsupported fields.`);
+  }
+  const extra = keys.filter(
+    (key) => !required2.includes(key) && !optional2.has(key)
+  );
+  if (extra.length > 0) {
+    throw new TypeError(`${path} contains missing or unsupported fields.`);
+  }
+  const doctype = oneOf(
+    root.doctype,
+    BUY_CAPTURE_DOCTYPE,
+    `${path}.doctype`
+  );
+  const document = {
+    doctype,
+    name: nonEmpty(root.name, `${path}.name`),
+    modified: frappeDatetime(root.modified, `${path}.modified`),
+    ...root.docstatus === void 0 ? {} : {
+      docstatus: parseDocstatus(root.docstatus, `${path}.docstatus`)
+    },
+    ...root.status === void 0 ? {} : { status: nonEmpty(root.status, `${path}.status`) },
+    sourceCategory: nonEmpty(
+      root.sourceCategory,
+      `${path}.sourceCategory`
+    ),
+    fields: parseClosedWireFields(
+      root.fields,
+      BUY_DOCTYPE_FIELD_SPECS[doctype],
+      `${path}.fields`
+    ),
+    ...root.children === void 0 ? {} : {
+      children: parseClosedWireChildren(
+        doctype,
+        root.children,
+        `${path}.children`
+      )
+    },
+    fingerprint: fingerprint(root.fingerprint, `${path}.fingerprint`)
+  };
+  if (document.sourceCategory !== BUY_DOCTYPE_SOURCE_CATEGORY[doctype]) {
+    throw new TypeError(
+      `${path}.sourceCategory must match the closed DocType; a generic document cannot masquerade as a price.`
+    );
+  }
+  const { fingerprint: _ignored, ...identity } = document;
+  const expectedFingerprint = await sha256FingerprintOfUtf8(
+    canonicalJson2(identity, `${path} identity`)
+  );
+  if (document.fingerprint !== expectedFingerprint) {
+    throw new TypeError(
+      `${path}.fingerprint must be SHA-256 of the document projection without fingerprint.`
+    );
+  }
+  return document;
+}
+function parseDocstatus(value, path) {
+  if (value !== 0 && value !== 1 && value !== 2) {
+    throw new TypeError(`${path} must be 0, 1, or 2.`);
+  }
+  return value;
+}
+function asRecord(value, name) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new BuyCaptureError(
+      "BUY_CAPTURE_INVALID_INPUT",
+      `${name} must be an object.`,
+      { recovery: "Pass a JSON object with exact keys." }
+    );
+  }
+  return value;
+}
+
+// src/tools/buy.ts
+var buyTools = [
+  {
+    name: "erpnext_buy_capture",
+    annotations: { readOnlyHint: true },
+    description: "Read-only bounded capture of exact ERPNext commercial documents (Item, BOM, Item Price, Supplier Quotation, Supplier, Price List, UOM, Currency Exchange). Two skipCache reads must agree on modified and the closed projection fingerprint. Returns canonical JSON + SHA-256; does not store CAS, create BOM/RFQ/PO, compute a cost total, or qualify a live ERP. Not a registered purchase capability.",
+    category: "buy",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      required: ["documents"],
+      properties: {
+        documents: {
+          type: "array",
+          minItems: 1,
+          maxItems: BUY_CAPTURE_MAX_DOCUMENTS,
+          description: "Exact document references. Do not pass sourceInstance, URL, credentials, capturedAt, or a caller digest.",
+          items: {
+            type: "object",
+            additionalProperties: false,
+            required: ["doctype", "name"],
+            properties: {
+              doctype: {
+                type: "string",
+                enum: [...BUY_CAPTURE_DOCTYPE],
+                description: "Closed Buy capture DocType"
+              },
+              name: {
+                type: "string",
+                minLength: 1,
+                maxLength: 140,
+                description: "Exact ERP document name"
+              },
+              expectedModified: {
+                type: "string",
+                description: "Optional exact Frappe modified timestamp to match"
+              }
+            }
+          }
+        }
+      }
+    },
+    handler: async (input, ctx) => {
+      return await runBuyCapture(input, { client: ctx.client });
+    }
+  }
+];
+
 // src/tools/mod.ts
 var toolsByCategory = {
   sales: salesTools,
@@ -56905,7 +58874,8 @@ var toolsByCategory = {
   operations: operationsTools,
   setup: setupTools,
   analytics: analyticsTools,
-  kanban: kanbanTools
+  kanban: kanbanTools,
+  buy: buyTools
 };
 var allTools = [
   ...salesTools,
@@ -56921,7 +58891,8 @@ var allTools = [
   ...operationsTools,
   ...setupTools,
   ...analyticsTools,
-  ...kanbanTools
+  ...kanbanTools,
+  ...buyTools
 ];
 function getToolsByCategory(category) {
   return toolsByCategory[category] ?? [];
@@ -57071,46 +59042,211 @@ var DOCTYPE_GET_TOOLS = {
 };
 var DOCTYPE_SEND_MESSAGE_HINTS = {
   "Customer": [
-    { label: "Orders", message: "Show sales orders for customer {id}" },
-    { label: "Invoices", message: "Show sales invoices for customer {id}" }
+    {
+      key: "orders",
+      label: "Orders",
+      message: "Show sales orders for customer {id}",
+      tool: "erpnext_sales_order_list",
+      args: { customer: "{id}", limit: 20 }
+    },
+    {
+      key: "invoices",
+      label: "Invoices",
+      message: "Show sales invoices for customer {id}",
+      tool: "erpnext_sales_invoice_list",
+      args: { customer: "{id}", limit: 20 }
+    }
   ],
   "Sales Order": [
-    { label: "Invoice", message: "Show invoices linked to sales order {id}" },
-    { label: "Delivery", message: "Show delivery notes for sales order {id}" }
+    {
+      key: "invoices",
+      label: "Invoices",
+      message: "Show invoices linked to sales order {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Sales Invoice",
+        fields: ["name", "customer", "posting_date", "status", "grand_total"],
+        filters: [["Sales Invoice Item", "sales_order", "=", "{id}"]],
+        limit: 20
+      }
+    },
+    {
+      key: "deliveries",
+      label: "Delivery notes",
+      message: "Show delivery notes for sales order {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Delivery Note",
+        fields: ["name", "customer", "posting_date", "status"],
+        filters: [["Delivery Note Item", "against_sales_order", "=", "{id}"]],
+        limit: 20
+      }
+    }
   ],
   "Sales Invoice": [
-    { label: "Payments", message: "Show payment entries for invoice {id}" }
+    {
+      key: "payments",
+      label: "Payments",
+      message: "Show payment entries for invoice {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Payment Entry",
+        fields: [
+          "name",
+          "posting_date",
+          "paid_amount",
+          "mode_of_payment",
+          "docstatus"
+        ],
+        filters: [["Payment Entry Reference", "reference_name", "=", "{id}"]],
+        limit: 20
+      }
+    }
+  ],
+  "Purchase Invoice": [
+    {
+      key: "payments",
+      label: "Payments",
+      message: "Show payment entries for purchase invoice {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Payment Entry",
+        fields: [
+          "name",
+          "posting_date",
+          "paid_amount",
+          "mode_of_payment",
+          "docstatus"
+        ],
+        filters: [["Payment Entry Reference", "reference_name", "=", "{id}"]],
+        limit: 20
+      },
+      kind: "list"
+    }
   ],
   "Item": [
-    { label: "Stock", message: "Show stock balance for item {id}" },
-    { label: "Orders", message: "Show sales orders containing item {id}" }
+    {
+      key: "stock",
+      label: "Stock",
+      message: "Show stock balance for item {id}",
+      tool: "erpnext_stock_balance",
+      args: { item_code: "{id}" }
+    },
+    {
+      key: "orders",
+      label: "Orders",
+      message: "Show sales orders containing item {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Sales Order",
+        fields: ["name", "customer", "transaction_date", "status"],
+        filters: [["Sales Order Item", "item_code", "=", "{id}"]],
+        limit: 20
+      }
+    }
   ],
   "Supplier": [
-    { label: "PO", message: "Show purchase orders for supplier {id}" },
-    { label: "Invoices", message: "Show purchase invoices for supplier {id}" }
+    {
+      key: "po",
+      label: "PO",
+      message: "Show purchase orders for supplier {id}",
+      tool: "erpnext_purchase_order_list",
+      args: { supplier: "{id}", limit: 20 }
+    },
+    {
+      key: "invoices",
+      label: "Invoices",
+      message: "Show purchase invoices for supplier {id}",
+      tool: "erpnext_purchase_invoice_list",
+      args: { supplier: "{id}", limit: 20 }
+    }
   ],
   "Purchase Order": [
-    { label: "Receipt", message: "Show purchase receipts for order {id}" },
-    { label: "Invoice", message: "Show purchase invoices for order {id}" }
+    {
+      key: "receipt",
+      label: "Receipt",
+      message: "Show purchase receipts for order {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Purchase Receipt",
+        fields: ["name", "supplier", "posting_date", "status"],
+        filters: [["Purchase Receipt Item", "purchase_order", "=", "{id}"]],
+        limit: 20
+      }
+    },
+    {
+      key: "invoice",
+      label: "Invoice",
+      message: "Show purchase invoices for order {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Purchase Invoice",
+        fields: ["name", "supplier", "posting_date", "status", "grand_total"],
+        filters: [["Purchase Invoice Item", "purchase_order", "=", "{id}"]],
+        limit: 20
+      }
+    }
   ],
   "Employee": [
-    { label: "Attendance", message: "Show attendance for employee {id}" },
-    { label: "Leaves", message: "Show leave applications for employee {id}" }
+    {
+      key: "attendance",
+      label: "Attendance",
+      message: "Show attendance for employee {id}",
+      tool: "erpnext_attendance_list",
+      args: { employee: "{id}", limit: 20 }
+    },
+    {
+      key: "leaves",
+      label: "Leaves",
+      message: "Show leave applications for employee {id}",
+      tool: "erpnext_leave_application_list",
+      args: { employee: "{id}", limit: 20 }
+    }
   ],
   "Project": [
-    { label: "Tasks", message: "Show tasks for project {id}" },
-    { label: "Timesheets", message: "Show timesheets for project {id}" }
+    {
+      key: "tasks",
+      label: "Tasks",
+      message: "Show tasks for project {id}",
+      tool: "erpnext_task_list",
+      args: { project: "{id}", limit: 20 }
+    },
+    {
+      key: "timesheets",
+      label: "Timesheets",
+      message: "Show timesheets for project {id}",
+      tool: "erpnext_timesheet_list",
+      args: { project: "{id}", limit: 20 }
+    }
   ],
   "Task": [
-    { label: "Timesheets", message: "Show timesheets for task {id}" }
+    {
+      key: "timesheets",
+      label: "Timesheets",
+      message: "Show timesheets for task {id}",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Timesheet",
+        fields: ["name", "employee", "start_date", "total_hours", "status"],
+        filters: [["Timesheet Detail", "task", "=", "{id}"]],
+        limit: 20
+      }
+    }
   ],
   "Lead": [
-    { label: "Opportunities", message: "Show opportunities for lead {id}" }
+    {
+      key: "opportunities",
+      label: "Opportunities",
+      message: "Show opportunities for lead {id}",
+      tool: "erpnext_opportunity_list",
+      // Le handler exige opportunity_from avec party_name.
+      args: { opportunity_from: "Lead", party_name: "{id}", limit: 20 }
+    }
   ]
 };
 var KPI_DRILL_DOWN = {
   "erpnext_kpi_revenue": {
-    _drillDown: "Show all sales invoices for this month",
+    _drillDown: "Show all sales orders for this month",
     _trendDrillDown: "Show revenue trend chart for the last 12 months"
   },
   "erpnext_kpi_outstanding": {
@@ -57122,7 +59258,7 @@ var KPI_DRILL_DOWN = {
     _trendDrillDown: "Show order breakdown chart for the last 6 months"
   },
   "erpnext_kpi_gross_margin": {
-    _drillDown: "Show gross profit breakdown by item",
+    _drillDown: "Show the non-cancelled Sales Order Items and Bin valuation rates used to estimate this gross margin",
     _trendDrillDown: "Show profit and loss chart for the last 12 months"
   },
   "erpnext_kpi_overdue": {
@@ -57133,12 +59269,522 @@ var KPI_DRILL_DOWN = {
 var CHART_DRILL_DOWN = {
   "erpnext_sales_chart": "Show sales invoices for {label}",
   "erpnext_stock_chart": "Show stock balance for item {label}",
-  "erpnext_revenue_trend": "Show sales invoices for month {label}",
+  "erpnext_revenue_trend": "Show sales orders for month {label}",
   "erpnext_order_breakdown": "Show sales orders for {label}",
-  "erpnext_ar_aging": "Show overdue sales invoices in the {label} aging bucket",
+  "erpnext_ar_aging": "Show outstanding sales invoices for customer {label}",
   "erpnext_gross_profit": "Show gross profit details for {label}",
-  "erpnext_profit_loss": "Show accounting details for month {label}"
+  "erpnext_profit_loss": "Show submitted sales and purchase orders for month {label}"
 };
+var INVOICE_ITEM_HINTS = [
+  {
+    key: "item",
+    label: "Item",
+    message: "Show item {item}",
+    tool: "erpnext_item_get",
+    args: { name: "{item}" },
+    kind: "record"
+  },
+  {
+    key: "stock",
+    label: "Stock",
+    message: "Show stock balance for item {item}",
+    tool: "erpnext_stock_balance",
+    args: { item_code: "{item}", limit: 50 },
+    kind: "list"
+  }
+];
+function nonEmptyDocumentString(document, key) {
+  const value = document?.[key];
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function documentPartyHint(doctype, document) {
+  if (doctype === "Sales Order" || doctype === "Sales Invoice") {
+    const customer = nonEmptyDocumentString(document, "customer");
+    return customer ? {
+      key: "customer",
+      label: "Customer",
+      message: `Show customer ${customer}`,
+      tool: "erpnext_customer_get",
+      args: { name: customer },
+      kind: "record"
+    } : null;
+  }
+  if (doctype === "Purchase Invoice") {
+    const supplier = nonEmptyDocumentString(document, "supplier");
+    return supplier ? {
+      key: "supplier",
+      label: "Supplier",
+      message: `Show supplier ${supplier}`,
+      tool: "erpnext_supplier_get",
+      args: { name: supplier },
+      kind: "record"
+    } : null;
+  }
+  if (doctype !== "Quotation") return null;
+  const party = nonEmptyDocumentString(document, "party_name");
+  const target = nonEmptyDocumentString(document, "quotation_to");
+  if (!party || target !== "Customer" && target !== "Lead") return null;
+  return target === "Customer" ? {
+    key: "customer",
+    label: "Customer",
+    message: `Show customer ${party}`,
+    tool: "erpnext_customer_get",
+    args: { name: party },
+    kind: "record"
+  } : {
+    key: "lead",
+    label: "Lead",
+    message: `Show lead ${party}`,
+    tool: "erpnext_lead_get",
+    args: { name: party },
+    kind: "record"
+  };
+}
+function documentNavigationHints(doctype, document) {
+  const base = DOCTYPE_SEND_MESSAGE_HINTS[doctype] ?? [];
+  const party = documentPartyHint(doctype, document);
+  if (!party) return [...base];
+  return doctype === "Sales Order" ? [party, ...base] : [...base, party];
+}
+var INVOICE_LINE_ITEM_DOCTYPES = /* @__PURE__ */ new Set([
+  "Sales Order",
+  "Sales Invoice",
+  "Purchase Invoice",
+  "Quotation"
+]);
+function invoiceNavigationHints(doctype, document) {
+  const documentHints = documentNavigationHints(doctype, document);
+  return INVOICE_LINE_ITEM_DOCTYPES.has(doctype) ? [...documentHints, ...INVOICE_ITEM_HINTS] : documentHints;
+}
+var STOCK_HINTS = [
+  {
+    key: "item",
+    label: "Item",
+    message: "Show item {id}",
+    tool: "erpnext_item_get",
+    args: { name: "{id}" },
+    kind: "record"
+  },
+  {
+    key: "movements",
+    label: "Stock entries",
+    message: "Show stock entries for item {id}",
+    tool: "erpnext_doc_list",
+    args: {
+      doctype: "Stock Entry",
+      fields: ["name", "posting_date", "stock_entry_type", "docstatus"],
+      filters: [["Stock Entry Detail", "item_code", "=", "{id}"]],
+      limit: 20
+    },
+    kind: "list"
+  },
+  {
+    key: "warehouse",
+    label: "Warehouse stock",
+    message: "Show stock chart for warehouse {warehouse}",
+    tool: "erpnext_stock_chart",
+    args: { warehouse: "{warehouse}", limit: 10 },
+    kind: "chart"
+  }
+];
+function monthRange(now) {
+  const y = now.getFullYear();
+  const m = now.getMonth();
+  const pad = (n) => String(n).padStart(2, "0");
+  const last = new Date(y, m + 1, 0).getDate();
+  return {
+    from: `${y}-${pad(m + 1)}-01`,
+    to: `${y}-${pad(m + 1)}-${pad(last)}`,
+    today: `${y}-${pad(m + 1)}-${pad(now.getDate())}`
+  };
+}
+var INVOICE_LIST_FIELDS = [
+  "name",
+  "customer",
+  "posting_date",
+  "due_date",
+  "status",
+  "outstanding_amount"
+];
+var KPI_JUMPS = {
+  "erpnext_kpi_revenue": (r) => ({
+    number: {
+      key: "sales_orders_month",
+      label: "Sales orders this month",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Sales Order",
+        fields: [
+          "name",
+          "customer",
+          "transaction_date",
+          "status",
+          "grand_total"
+        ],
+        filters: [
+          ["transaction_date", ">=", r.from],
+          ["transaction_date", "<=", r.to],
+          // comme le KPI : les commandes annulées ne comptent pas
+          ["docstatus", "<", 2]
+        ],
+        limit: 20
+      },
+      kind: "list"
+    },
+    trend: {
+      key: "revenue_trend",
+      label: "Revenue trend",
+      tool: "erpnext_revenue_trend",
+      args: { months: 12 },
+      kind: "chart"
+    }
+  }),
+  "erpnext_kpi_outstanding": () => ({
+    number: {
+      key: "unpaid_invoices",
+      label: "Unpaid invoices",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Sales Invoice",
+        fields: INVOICE_LIST_FIELDS,
+        filters: [["outstanding_amount", ">", 0], ["docstatus", "=", 1]],
+        limit: 20
+      },
+      kind: "list"
+    },
+    trend: {
+      key: "receivables_aging",
+      label: "Receivables aging",
+      tool: "erpnext_ar_aging",
+      args: {},
+      kind: "chart"
+    }
+  }),
+  "erpnext_kpi_orders": (r) => ({
+    number: {
+      key: "sales_orders_month",
+      label: "Sales orders this month",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Sales Order",
+        fields: [
+          "name",
+          "customer",
+          "transaction_date",
+          "status",
+          "grand_total"
+        ],
+        filters: [
+          ["transaction_date", ">=", r.from],
+          ["transaction_date", "<=", r.to],
+          // comme le KPI : les commandes annulées ne comptent pas
+          ["docstatus", "<", 2]
+        ],
+        limit: 20
+      },
+      kind: "list"
+    },
+    trend: {
+      key: "order_breakdown",
+      label: "Order breakdown",
+      tool: "erpnext_order_breakdown",
+      args: {},
+      kind: "chart"
+    }
+  }),
+  "erpnext_kpi_gross_margin": () => ({
+    trend: {
+      key: "profit_loss",
+      label: "Profit and loss",
+      tool: "erpnext_profit_loss",
+      args: { months: 12 },
+      kind: "chart"
+    }
+  }),
+  "erpnext_kpi_overdue": (r) => ({
+    number: {
+      key: "overdue_invoices",
+      label: "Overdue invoices",
+      tool: "erpnext_doc_list",
+      args: {
+        doctype: "Sales Invoice",
+        fields: INVOICE_LIST_FIELDS,
+        filters: [
+          ["due_date", "<", r.today],
+          ["outstanding_amount", ">", 0],
+          ["docstatus", "=", 1]
+        ],
+        limit: 20
+      },
+      kind: "list"
+    },
+    trend: {
+      key: "receivables_aging",
+      label: "Receivables aging",
+      tool: "erpnext_ar_aging",
+      args: {},
+      kind: "chart"
+    }
+  })
+};
+var FUNNEL_LIST_FIELDS = {
+  "Leads": [
+    "name",
+    "lead_name",
+    "company_name",
+    "status",
+    "lead_owner",
+    "creation"
+  ],
+  "Opportunities": [
+    "name",
+    "opportunity_from",
+    "party_name",
+    "status",
+    "opportunity_amount",
+    "currency",
+    "probability",
+    "opportunity_owner",
+    "transaction_date"
+  ],
+  "Quotations": [
+    "name",
+    "party_name",
+    "transaction_date",
+    "status",
+    "grand_total"
+  ],
+  "Orders": [
+    "name",
+    "customer",
+    "transaction_date",
+    "status",
+    "grand_total"
+  ]
+};
+var FUNNEL_STAGE_JUMPS = {
+  "Leads": {
+    key: "leads",
+    label: "Leads",
+    tool: "erpnext_lead_list",
+    args: { limit: 20 },
+    kind: "list"
+  },
+  "Opportunities": {
+    key: "opportunities",
+    label: "Opportunities",
+    tool: "erpnext_opportunity_list",
+    args: { limit: 20 },
+    kind: "list"
+  },
+  "Quotations": {
+    key: "quotations",
+    label: "Quotations",
+    tool: "erpnext_doc_list",
+    args: {
+      doctype: "Quotation",
+      fields: FUNNEL_LIST_FIELDS.Quotations,
+      filters: [["docstatus", "!=", 2]],
+      limit: 20
+    },
+    kind: "list"
+  },
+  "Orders": {
+    key: "sales_orders",
+    label: "Sales orders",
+    tool: "erpnext_doc_list",
+    args: {
+      doctype: "Sales Order",
+      fields: FUNNEL_LIST_FIELDS.Orders,
+      filters: [["docstatus", "!=", 2]],
+      limit: 20
+    },
+    kind: "list"
+  }
+};
+function funnelPeriodStart(period, now) {
+  const year = now.getFullYear();
+  const pad = (value) => String(value).padStart(2, "0");
+  if (period === "this_month") {
+    return `${year}-${pad(now.getMonth() + 1)}-01`;
+  }
+  if (period === "this_quarter") {
+    const firstMonth = Math.floor(now.getMonth() / 3) * 3 + 1;
+    return `${year}-${pad(firstMonth)}-01`;
+  }
+  if (period === "this_year") return `${year}-01-01`;
+  return void 0;
+}
+function funnelStageJumps(args, now) {
+  const since = funnelPeriodStart(args.period, now);
+  if (!since) return FUNNEL_STAGE_JUMPS;
+  const scopedJump = (stage, doctype, dateField) => {
+    const base = FUNNEL_STAGE_JUMPS[stage];
+    const baseFilters = Array.isArray(base.args.filters) ? base.args.filters : [];
+    return {
+      ...base,
+      tool: "erpnext_doc_list",
+      args: {
+        doctype,
+        fields: FUNNEL_LIST_FIELDS[stage],
+        filters: [[dateField, ">=", since], ...baseFilters],
+        limit: 20
+      }
+    };
+  };
+  return {
+    "Leads": scopedJump("Leads", "Lead", "creation"),
+    "Opportunities": scopedJump(
+      "Opportunities",
+      "Opportunity",
+      "transaction_date"
+    ),
+    "Quotations": scopedJump(
+      "Quotations",
+      "Quotation",
+      "transaction_date"
+    ),
+    "Orders": scopedJump("Orders", "Sales Order", "transaction_date")
+  };
+}
+var SALES_ORDER_LIST_FIELDS = [
+  "name",
+  "customer",
+  "transaction_date",
+  "status",
+  "grand_total"
+];
+var PURCHASE_ORDER_LIST_FIELDS = [
+  "name",
+  "supplier",
+  "transaction_date",
+  "status",
+  "grand_total"
+];
+function monthLabel(d) {
+  return `${d.toLocaleString("en", { month: "short" })} ${d.getFullYear().toString().slice(2)}`;
+}
+function monthBuckets(monthsBack, now) {
+  const buckets = [];
+  for (let m = 0; m < monthsBack; m++) {
+    const d = new Date(
+      now.getFullYear(),
+      now.getMonth() - monthsBack + 1 + m,
+      1
+    );
+    buckets.push({ label: monthLabel(d), range: monthRange(d) });
+  }
+  return buckets;
+}
+var docList = (label, doctype, fields, filters) => ({
+  label,
+  tool: "erpnext_doc_list",
+  args: { doctype, fields, filters, limit: 20 },
+  kind: "list"
+});
+function chartPointJumps(toolName, args, labels, now) {
+  const jumps = {};
+  const byLabel = (make) => {
+    for (const label of labels) {
+      if (label === "Unknown") continue;
+      jumps[label] = make(label);
+    }
+  };
+  switch (toolName) {
+    case "erpnext_revenue_trend": {
+      const months = Number(args.months ?? 6);
+      for (const { label, range } of monthBuckets(months, now)) {
+        if (!labels.includes(label)) continue;
+        jumps[label] = docList(label, "Sales Order", SALES_ORDER_LIST_FIELDS, [
+          ["transaction_date", ">=", range.from],
+          ["transaction_date", "<=", range.to],
+          ["docstatus", "<", 2]
+        ]);
+      }
+      break;
+    }
+    case "erpnext_sales_chart": {
+      const groupBy = String(args.group_by ?? "customer");
+      byLabel((label) => {
+        const filters = [
+          groupBy === "item" ? ["Sales Invoice Item", "item_name", "=", label] : groupBy === "status" ? ["status", "=", label] : ["customer_name", "=", label]
+        ];
+        if (groupBy === "status") {
+          filters.push(["docstatus", "!=", 2]);
+        } else if (groupBy === "item" || args.include_drafts !== true) {
+          filters.push(["docstatus", "=", 1]);
+        }
+        return docList(label, "Sales Invoice", INVOICE_LIST_FIELDS, filters);
+      });
+      break;
+    }
+    case "erpnext_order_breakdown":
+    case "erpnext_revenue_vs_orders":
+      byLabel(
+        (label) => docList(label, "Sales Order", SALES_ORDER_LIST_FIELDS, [
+          ["customer_name", "=", label],
+          ["docstatus", "<", 2]
+        ])
+      );
+      break;
+    case "erpnext_ar_aging":
+    case "erpnext_profit_loss":
+      return void 0;
+    case "erpnext_gross_profit": {
+      const groupBy = String(args.group_by ?? "item");
+      byLabel(
+        (label) => docList(label, "Sales Invoice", INVOICE_LIST_FIELDS, [
+          groupBy === "customer" ? ["customer_name", "=", label] : ["Sales Invoice Item", "item_name", "=", label],
+          ["docstatus", "=", 1]
+        ])
+      );
+      break;
+    }
+    case "erpnext_stock_chart":
+      byLabel((label) => ({
+        label,
+        tool: "erpnext_stock_balance",
+        args: {
+          item_code: label,
+          ...typeof args.warehouse === "string" ? { warehouse: args.warehouse } : {},
+          limit: 50
+        },
+        kind: "list"
+      }));
+      break;
+    default:
+      return void 0;
+  }
+  return Object.keys(jumps).length > 0 ? jumps : void 0;
+}
+function chartSeriesPointJumps(toolName, args, labels, now) {
+  if (toolName !== "erpnext_profit_loss") return void 0;
+  const jumps = {};
+  const months = Number(args.months ?? 6);
+  for (const { label, range } of monthBuckets(months, now)) {
+    if (!labels.includes(label)) continue;
+    const filters = [
+      ["transaction_date", ">=", range.from],
+      ["transaction_date", "<=", range.to],
+      ["docstatus", "=", 1]
+    ];
+    jumps[label] = {
+      "Income": docList(
+        `${label} \xB7 Income`,
+        "Sales Order",
+        SALES_ORDER_LIST_FIELDS,
+        filters
+      ),
+      "Expenses": docList(
+        `${label} \xB7 Expenses`,
+        "Purchase Order",
+        PURCHASE_ORDER_LIST_FIELDS,
+        filters
+      )
+    };
+  }
+  return Object.keys(jumps).length > 0 ? jumps : void 0;
+}
 function isChartViewer(result) {
   const uri = result._meta?.ui?.resourceUri;
   return uri === "ui://mcp-erpnext/chart-viewer";
@@ -57147,6 +59793,31 @@ function isKpiViewer(result) {
   const uri = result._meta?.ui?.resourceUri;
   return uri === "ui://mcp-erpnext/kpi-viewer";
 }
+function isFunnelViewer(result) {
+  const uri = result._meta?.ui?.resourceUri;
+  return uri === "ui://mcp-erpnext/funnel-viewer";
+}
+function resultDoctype(result) {
+  if (typeof result.doctype === "string") return result.doctype;
+  const data = result.data;
+  if (isRecord8(data) && typeof data.doctype === "string") return data.doctype;
+  return void 0;
+}
+function resultDocument(result) {
+  return isRecord8(result.data) ? result.data : void 0;
+}
+function isInvoiceViewer(result) {
+  const uri = result._meta?.ui?.resourceUri;
+  return uri === "ui://mcp-erpnext/invoice-viewer";
+}
+function isStockViewer(result) {
+  const uri = result._meta?.ui?.resourceUri;
+  return uri === "ui://mcp-erpnext/stock-viewer";
+}
+function isKanbanViewer(result) {
+  const uri = result._meta?.ui?.resourceUri;
+  return uri === "ui://mcp-erpnext/kanban-viewer";
+}
 function isDoclistResult(result) {
   return typeof result.doctype === "string" && Array.isArray(result.data);
 }
@@ -57154,7 +59825,193 @@ function isDoclistViewer(result) {
   const uri = result._meta?.ui?.resourceUri;
   return uri === "ui://mcp-erpnext/doclist-viewer";
 }
-function withUiRefreshRequest(result, toolName, args) {
+function isDocViewer(result) {
+  const uri = result._meta?.ui?.resourceUri;
+  return uri === "ui://mcp-erpnext/doc-viewer";
+}
+var VIEWER_TOOL_CANDIDATES = {
+  "ui://mcp-erpnext/invoice-viewer": [
+    "erpnext_item_get",
+    "erpnext_stock_balance",
+    "erpnext_file_list",
+    "erpnext_file_upload",
+    "erpnext_file_download"
+  ],
+  "ui://mcp-erpnext/doclist-viewer": [],
+  "ui://mcp-erpnext/doc-viewer": [
+    "erpnext_file_list",
+    "erpnext_file_upload",
+    "erpnext_file_download"
+  ],
+  "ui://mcp-erpnext/kanban-viewer": [
+    "erpnext_doc_get",
+    "erpnext_doc_update",
+    "erpnext_user_list",
+    "erpnext_doc_assign",
+    "erpnext_doc_unassign"
+  ],
+  "ui://mcp-erpnext/stock-viewer": [
+    "erpnext_item_get",
+    "erpnext_stock_entry_list"
+  ]
+};
+var SUBMITTABLE_VIEWER_DOCTYPES = /* @__PURE__ */ new Set([
+  "Quotation",
+  "Sales Order",
+  "Delivery Note",
+  "Sales Invoice",
+  "Purchase Order",
+  "Purchase Receipt",
+  "Purchase Invoice",
+  "Stock Entry",
+  "Journal Entry",
+  "Payment Entry",
+  "Timesheet",
+  "Leave Application",
+  "Salary Slip",
+  "BOM",
+  "Work Order",
+  "Job Card",
+  "Asset",
+  "Asset Movement",
+  "Shipment"
+]);
+var INVOICE_DEDICATED_MUTATION_TOOLS = {
+  "Sales Order": [
+    "erpnext_sales_order_submit",
+    "erpnext_sales_order_cancel"
+  ],
+  "Sales Invoice": ["erpnext_sales_invoice_submit"]
+};
+function addDoctypeMutationCandidates(target, uri, doctype) {
+  if (!doctype || !SUBMITTABLE_VIEWER_DOCTYPES.has(doctype)) return;
+  if (uri === "ui://mcp-erpnext/invoice-viewer" || uri === "ui://mcp-erpnext/doclist-viewer" || uri === "ui://mcp-erpnext/doc-viewer") {
+    target.add("erpnext_doc_submit");
+    target.add("erpnext_doc_cancel");
+  }
+  if (uri === "ui://mcp-erpnext/invoice-viewer") {
+    for (const tool of INVOICE_DEDICATED_MUTATION_TOOLS[doctype] ?? []) {
+      target.add(tool);
+    }
+  }
+}
+function addJumpTools(target, jumps) {
+  if (!jumps) return;
+  for (const jump of Object.values(jumps)) target.add(jump.tool);
+}
+function addSeriesJumpTools(target, jumps) {
+  if (!jumps) return;
+  for (const seriesJumps of Object.values(jumps)) {
+    addJumpTools(target, seriesJumps);
+  }
+}
+function availableViewerToolNames(result, availableToolNames) {
+  const candidates = /* @__PURE__ */ new Set();
+  const uri = result._meta?.ui?.resourceUri;
+  for (const name of uri ? VIEWER_TOOL_CANDIDATES[uri] ?? [] : []) {
+    candidates.add(name);
+  }
+  addDoctypeMutationCandidates(candidates, uri, resultDoctype(result));
+  if (result.refreshRequest) candidates.add(result.refreshRequest.toolName);
+  if (result._rowAction) candidates.add(result._rowAction.toolName);
+  for (const hint of result._sendMessageHints ?? []) {
+    if (hint.tool) candidates.add(hint.tool);
+  }
+  addJumpTools(
+    candidates,
+    result._jumps ? Object.fromEntries(
+      Object.entries(result._jumps).filter(
+        (entry) => entry[1] !== void 0
+      )
+    ) : void 0
+  );
+  addJumpTools(candidates, result._stageJumps);
+  addJumpTools(candidates, result._pointJumps);
+  addSeriesJumpTools(candidates, result._seriesPointJumps);
+  if (typeof result.moveToolName === "string") {
+    candidates.add(result.moveToolName);
+  }
+  return [...candidates].filter((name) => availableToolNames.has(name)).sort();
+}
+function filterJumpMap(jumps, availableToolNames) {
+  const available = Object.fromEntries(
+    Object.entries(jumps).filter(
+      ([, jump]) => availableToolNames.has(jump.tool)
+    )
+  );
+  return Object.keys(available).length > 0 ? available : void 0;
+}
+function filterSeriesJumpMap(jumps, availableToolNames) {
+  const available = {};
+  for (const [label, seriesJumps] of Object.entries(jumps)) {
+    const filtered = filterJumpMap(seriesJumps, availableToolNames);
+    if (filtered) available[label] = filtered;
+  }
+  return Object.keys(available).length > 0 ? available : void 0;
+}
+function filterNavJumpsByAvailableTools(result, availableToolNames) {
+  if (!availableToolNames) return result;
+  const filtered = { ...result };
+  if (result._jumps) {
+    const jumps = filterJumpMap(
+      Object.fromEntries(
+        Object.entries(result._jumps).filter(
+          (entry) => entry[1] !== void 0
+        )
+      ),
+      availableToolNames
+    );
+    if (jumps) filtered._jumps = jumps;
+    else delete filtered._jumps;
+  }
+  if (result._stageJumps) {
+    const jumps = filterJumpMap(result._stageJumps, availableToolNames);
+    if (jumps) filtered._stageJumps = jumps;
+    else delete filtered._stageJumps;
+  }
+  if (result._pointJumps) {
+    const jumps = filterJumpMap(result._pointJumps, availableToolNames);
+    if (jumps) filtered._pointJumps = jumps;
+    else delete filtered._pointJumps;
+  }
+  if (result._seriesPointJumps) {
+    const jumps = filterSeriesJumpMap(
+      result._seriesPointJumps,
+      availableToolNames
+    );
+    if (jumps) filtered._seriesPointJumps = jumps;
+    else delete filtered._seriesPointJumps;
+  }
+  if (result._rowAction && !availableToolNames.has(result._rowAction.toolName)) {
+    const doctype = resultDoctype(result);
+    if (doctype && availableToolNames.has("erpnext_doc_get")) {
+      filtered._rowAction = {
+        toolName: "erpnext_doc_get",
+        idField: "name",
+        argName: "name",
+        extraArgs: { doctype }
+      };
+    } else {
+      delete filtered._rowAction;
+    }
+  }
+  if (result._sendMessageHints) {
+    filtered._sendMessageHints = result._sendMessageHints.map((hint) => {
+      if (!hint.tool || availableToolNames.has(hint.tool)) return hint;
+      return { key: hint.key, label: hint.label, message: hint.message };
+    });
+  }
+  filtered._availableTools = availableViewerToolNames(
+    filtered,
+    availableToolNames
+  );
+  return filtered;
+}
+function withViewerToolCapabilities(result, availableToolNames) {
+  if (!isRecord8(result) || !hasUiResource(result)) return result;
+  return filterNavJumpsByAvailableTools(result, availableToolNames);
+}
+function withUiRefreshRequest(result, toolName, args, now = /* @__PURE__ */ new Date(), availableToolNames) {
   if (!isRecord8(result) || !hasUiResource(result)) {
     return result;
   }
@@ -57184,8 +60041,8 @@ function withUiRefreshRequest(result, toolName, args) {
     }
   }
   if (isDoclistResult(enriched) && isDoclistViewer(enriched) && !enriched._sendMessageHints) {
-    const hints = DOCTYPE_SEND_MESSAGE_HINTS[enriched.doctype];
-    if (hints) {
+    const hints = documentNavigationHints(enriched.doctype);
+    if (hints.length > 0) {
       enriched._sendMessageHints = hints;
     }
   }
@@ -57204,10 +60061,92 @@ function withUiRefreshRequest(result, toolName, args) {
       }
     }
   }
-  return enriched;
+  if (isKpiViewer(enriched) && !enriched._jumps) {
+    const jumps = KPI_JUMPS[toolName];
+    if (jumps) enriched._jumps = jumps(monthRange(now));
+  }
+  if (isFunnelViewer(enriched) && !enriched._stageJumps) {
+    enriched._stageJumps = funnelStageJumps(args, now);
+  }
+  if (isChartViewer(enriched) && Array.isArray(enriched.labels)) {
+    const labels = enriched.labels.map(String);
+    if (!enriched._pointJumps) {
+      const jumps = chartPointJumps(toolName, args, labels, now);
+      if (jumps) enriched._pointJumps = jumps;
+    }
+    if (!enriched._seriesPointJumps) {
+      const jumps = chartSeriesPointJumps(toolName, args, labels, now);
+      if (jumps) enriched._seriesPointJumps = jumps;
+    }
+  }
+  if (!enriched._sendMessageHints) {
+    const doctype = resultDoctype(enriched);
+    if (isInvoiceViewer(enriched) && doctype) {
+      const hints = invoiceNavigationHints(doctype, resultDocument(enriched));
+      if (hints.length > 0) enriched._sendMessageHints = hints;
+    } else if (isStockViewer(enriched)) {
+      enriched._sendMessageHints = STOCK_HINTS;
+    } else if ((isKanbanViewer(enriched) || isDocViewer(enriched)) && doctype) {
+      const hints = isDocViewer(enriched) ? invoiceNavigationHints(doctype, resultDocument(enriched)) : documentNavigationHints(doctype, resultDocument(enriched));
+      if (hints.length > 0) enriched._sendMessageHints = hints;
+    }
+  }
+  return filterNavJumpsByAvailableTools(enriched, availableToolNames);
 }
 
 // src/client.ts
+function isRecord9(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSingleEmbeddedBlobResult(value) {
+  if (!isRecord9(value) || !Array.isArray(value.content)) return false;
+  if (Object.keys(value).some((key) => key !== "content")) return false;
+  if (value.content.length !== 2) return false;
+  const [summary, embedded] = value.content;
+  if (!isRecord9(summary) || summary.type !== "text" || typeof summary.text !== "string") {
+    return false;
+  }
+  if (!isRecord9(embedded) || embedded.type !== "resource") return false;
+  if (!isRecord9(embedded.resource)) return false;
+  const resource = embedded.resource;
+  return typeof resource.uri === "string" && resource.uri.startsWith("file:///") && typeof resource.mimeType === "string" && typeof resource.blob === "string";
+}
+function withSafeUiRefresh(result, tool, args, availableToolNames) {
+  const readOnly = tool.annotations?.readOnlyHint === true;
+  if (!isRecord9(result)) {
+    return result;
+  }
+  const resultMeta = isRecord9(result._meta) ? result._meta : {};
+  const declaredUi = tool._meta?.ui;
+  const viewerResult = declaredUi && !isRecord9(resultMeta.ui) ? {
+    ...result,
+    _meta: { ...resultMeta, ...tool._meta, ui: declaredUi }
+  } : result;
+  const request = isRecord9(viewerResult.refreshRequest) ? viewerResult.refreshRequest : null;
+  const target = request && typeof request.toolName === "string" ? getToolByName(request.toolName) : void 0;
+  const hasSafeExplicitRefresh = request !== null && typeof request.toolName === "string" && availableToolNames.has(request.toolName) && isRecord9(request.arguments) && (request.toolName === tool.name ? readOnly : target?.annotations?.readOnlyHint === true);
+  if (hasSafeExplicitRefresh) {
+    return withUiRefreshRequest(
+      viewerResult,
+      tool.name,
+      args,
+      /* @__PURE__ */ new Date(),
+      availableToolNames
+    );
+  }
+  let sanitized = viewerResult;
+  if ("refreshRequest" in viewerResult) {
+    sanitized = { ...viewerResult };
+    delete sanitized.refreshRequest;
+  }
+  return readOnly ? withUiRefreshRequest(
+    sanitized,
+    tool.name,
+    args,
+    /* @__PURE__ */ new Date(),
+    availableToolNames
+  ) : withViewerToolCapabilities(sanitized, availableToolNames);
+}
 var ErpNextToolsClient = class {
   tools;
   enableLinkDisambiguation;
@@ -57248,6 +60187,7 @@ var ErpNextToolsClient = class {
    */
   buildHandlersMap() {
     const handlers = /* @__PURE__ */ new Map();
+    const availableToolNames = new Set(this.tools.map((tool) => tool.name));
     for (const tool of this.tools) {
       const toolMeta = tool._meta;
       handlers.set(tool.name, async (args, mcpContext) => {
@@ -57270,10 +60210,14 @@ var ErpNextToolsClient = class {
         if (execution.result !== null && typeof execution.result === "object" && !Array.isArray(execution.result) && execution.result.resultType === "input_required") {
           return execution.result;
         }
-        const result = withUiRefreshRequest(
+        if (tool.name === "erpnext_file_download" && isSingleEmbeddedBlobResult(execution.result)) {
+          return execution.result;
+        }
+        const result = withSafeUiRefresh(
           execution.result,
-          tool.name,
-          execution.args
+          tool,
+          execution.args,
+          availableToolNames
         );
         const r = result !== null && typeof result === "object" && !Array.isArray(result) ? result : null;
         const resultUi = r?._meta && typeof r._meta === "object" && r._meta.ui;
@@ -57300,7 +60244,15 @@ var ErpNextToolsClient = class {
     }
     const client = getFrappeClient();
     const result = await tool.handler(args, { client });
-    return withUiRefreshRequest(result, tool.name, args);
+    if (tool.name === "erpnext_file_download" && isSingleEmbeddedBlobResult(result)) {
+      return result;
+    }
+    return withSafeUiRefresh(
+      result,
+      tool,
+      args,
+      new Set(this.tools.map((candidate) => candidate.name))
+    );
   }
   /** Get tool count */
   get count() {
@@ -57314,11 +60266,128 @@ var UI_VIEWERS = [
   "invoice-viewer",
   "stock-viewer",
   "doclist-viewer",
+  "doc-viewer",
   "chart-viewer",
   "kpi-viewer",
   "funnel-viewer",
-  "kanban-viewer"
+  "kanban-viewer",
+  "buy-evidence-viewer"
 ];
+var VIEWER_RESOURCE_META = {
+  ui: {
+    csp: {
+      resourceDomains: ["blob:"],
+      frameDomains: ["blob:"]
+    }
+  }
+};
+function withViewerResourceMeta(resource) {
+  return { ...resource, _meta: VIEWER_RESOURCE_META };
+}
+
+// src/buy/manifest.ts
+var VIEW_APP_MANIFEST_SCHEMA = "io.casys.mcp.view-app-manifest/1.0";
+var VIEWER_SESSION_APPLY_ACTION = "viewer.session.apply";
+var BUY_VIEW_APP_MANIFEST = {
+  schemaVersion: VIEW_APP_MANIFEST_SCHEMA,
+  app: {
+    id: BUY_VIEW_APP_ID,
+    title: BUY_VIEW_APP_TITLE,
+    version: BUY_VIEW_APP_VERSION
+  },
+  resources: [{
+    uri: BUY_EVIDENCE_VIEWER_URI,
+    ownership: "whole-view",
+    resultSchemas: [BUY_RECORDED_RESULT_SCHEMA, BUY_RECORDED_RESULT_SCHEMA_V2],
+    acceptedActions: [VIEWER_SESSION_APPLY_ACTION],
+    sessionSchemas: [BUY_RECORDED_SESSION_SCHEMA]
+  }]
+};
+var BUY_VIEW_APP_MANIFEST_JSON = `${JSON.stringify(BUY_VIEW_APP_MANIFEST)}
+`;
+function parseBuyViewAppManifest(value) {
+  const root = exactRecord(
+    value,
+    ["schemaVersion", "app", "resources"],
+    "Buy View App manifest"
+  );
+  literal2(
+    root.schemaVersion,
+    VIEW_APP_MANIFEST_SCHEMA,
+    "Buy View App manifest.schemaVersion"
+  );
+  const app = exactRecord(
+    root.app,
+    ["id", "title", "version"],
+    "Buy View App manifest.app"
+  );
+  literal2(app.id, BUY_VIEW_APP_ID, "Buy View App manifest.app.id");
+  literal2(app.title, BUY_VIEW_APP_TITLE, "Buy View App manifest.app.title");
+  literal2(
+    app.version,
+    BUY_VIEW_APP_VERSION,
+    "Buy View App manifest.app.version"
+  );
+  const resources = denseArray(
+    root.resources,
+    "Buy View App manifest.resources"
+  );
+  if (resources.length !== 1) {
+    throw new TypeError(
+      "Buy View App manifest.resources must contain exactly one whole view."
+    );
+  }
+  const resource = exactRecord(
+    resources[0],
+    [
+      "uri",
+      "ownership",
+      "resultSchemas",
+      "acceptedActions",
+      "sessionSchemas"
+    ],
+    "Buy View App manifest.resources[0]"
+  );
+  literal2(
+    resource.uri,
+    BUY_EVIDENCE_VIEWER_URI,
+    "Buy View App manifest.resources[0].uri"
+  );
+  literal2(
+    resource.ownership,
+    "whole-view",
+    "Buy View App manifest.resources[0].ownership"
+  );
+  const resultSchemas = denseArray(
+    resource.resultSchemas,
+    "Buy View App manifest.resources[0].resultSchemas"
+  );
+  if (resultSchemas.length !== 2 || resultSchemas[0] !== BUY_RECORDED_RESULT_SCHEMA || resultSchemas[1] !== BUY_RECORDED_RESULT_SCHEMA_V2) {
+    throw new TypeError(
+      "Buy View App manifest result schemas must list buy-recorded-result/1.0 then /2.0 exactly."
+    );
+  }
+  const acceptedActions = denseArray(
+    resource.acceptedActions,
+    "Buy View App manifest.resources[0].acceptedActions"
+  );
+  if (acceptedActions.length !== 1 || acceptedActions[0] !== VIEWER_SESSION_APPLY_ACTION) {
+    throw new TypeError(
+      "Buy View App manifest must accept viewer.session.apply exactly."
+    );
+  }
+  const sessionSchemas = denseArray(
+    resource.sessionSchemas,
+    "Buy View App manifest.resources[0].sessionSchemas"
+  );
+  if (sessionSchemas.length !== 1 || sessionSchemas[0] !== BUY_RECORDED_SESSION_SCHEMA) {
+    throw new TypeError(
+      "Buy View App manifest must bind buy-recorded-session/1.0 exactly."
+    );
+  }
+  return BUY_VIEW_APP_MANIFEST;
+}
+parseBuyViewAppManifest(BUY_VIEW_APP_MANIFEST);
 
 // src/ui/viewer-errors.ts
 var ViewerResourceError = class extends Error {
@@ -57667,6 +60736,28 @@ function loadMrtrConfig() {
 
 // server.ts
 var DEFAULT_HTTP_PORT = 3012;
+function registerBuyViewAppManifest(server) {
+  const bytes = new TextEncoder().encode(BUY_VIEW_APP_MANIFEST_JSON);
+  server.registerResource(
+    {
+      uri: BUY_VIEW_APP_MANIFEST_URI,
+      name: "ERPNext Buy Evidence App manifest",
+      description: `Exact ${BUY_VIEW_APP_MANIFEST.app.id}@${BUY_VIEW_APP_MANIFEST.app.version} whole-view and recorded-session contract.`,
+      mimeType: "application/json",
+      size: bytes.byteLength
+    },
+    (requested) => {
+      if (requested.toString() !== BUY_VIEW_APP_MANIFEST_URI) {
+        throw new Error("Requested URI does not match the Buy App manifest.");
+      }
+      return {
+        uri: BUY_VIEW_APP_MANIFEST_URI,
+        mimeType: "application/json",
+        text: BUY_VIEW_APP_MANIFEST_JSON
+      };
+    }
+  );
+}
 async function main() {
   const args = getArgs3();
   if (args.includes("--inspect")) {
@@ -57696,7 +60787,7 @@ async function main() {
   );
   const server = new McpApp({
     name: "mcp-erpnext",
-    version: "3.1.0",
+    version: "3.2.0-beta.1",
     transport: "stateless",
     cache: {
       ttlMs: 36e5,
@@ -57717,6 +60808,7 @@ async function main() {
   const mcpTools = toolsClient.toMCPFormat();
   const handlers = toolsClient.buildHandlersMap();
   server.registerTools(mcpTools, handlers);
+  registerBuyViewAppManifest(server);
   const skippedRemoteViewers = [];
   let skippedRemoteHost = "";
   for (const viewerName of UI_VIEWERS) {
@@ -57733,15 +60825,19 @@ async function main() {
       skippedRemoteHost = new URL(distPath).hostname;
     } else if (distPath) {
       server.registerResource(
-        {
+        withViewerResourceMeta({
           uri: resourceUri,
           name: `ERPNext ${humanName}`,
           description: `ERPNext UI: ${viewerName}`,
           mimeType: MCP_APP_MIME_TYPE
-        },
+        }),
         async () => {
           const html = await readViewerDist(distPath, readTextFile6);
-          return { uri: resourceUri, mimeType: MCP_APP_MIME_TYPE, text: html };
+          return withViewerResourceMeta({
+            uri: resourceUri,
+            mimeType: MCP_APP_MIME_TYPE,
+            text: html
+          });
         }
       );
       console.error(`[mcp-erpnext] Registered UI resource: ${resourceUri}`);