@hvgllc/hvgerp-mcp 3.4.0 → 3.5.0

package/hvgerp-mcp.mjs

@@ -3115,6 +3115,7 @@ var require_utils = __commonJS({
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isPort = RegExp.prototype.test.bind(/^\d*$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
     var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
@@ -3580,8 +3581,12 @@ var require_utils = __commonJS({
         uriTokens.push(host);
       }
       if (typeof component.port === "number" || typeof component.port === "string") {
+        const port = String(component.port);
+        if (!isPort(port)) {
+          throw new TypeError("URI port is malformed.");
+        }
         uriTokens.push(":");
-        uriTokens.push(String(component.port));
+        uriTokens.push(port);
       }
       return uriTokens.length ? uriTokens.join("") : void 0;
     }
@@ -4024,12 +4029,15 @@ var require_fast_uri = __commonJS({
       }
       return false;
     }
+    function isIPLiteral(host) {
+      return host[0] === "[" && host[host.length - 1] === "]";
+    }
     function hasMalformedComponentPercentEncoding(matches) {
       const host = matches[4];
-      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !(host[0] === "[" && host[host.length - 1] === "]") && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
     function canonicalizeHost(parsed, options, schemeHandler, isIP) {
-      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && parsed.host[0] !== "[" && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
         try {
           parsed.host = new URL("http://" + parsed.host).hostname;
         } catch (e) {
@@ -4116,10 +4124,11 @@ var require_fast_uri = __commonJS({
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
-            const bracketedIPLiteral = parsed.host[0] === "[" && parsed.host[parsed.host.length - 1] === "]";
+            const bracketedIPLiteral = isIPLiteral(parsed.host);
+            const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
             const ipv6result = normalizeIPv6(parsed.host);
             isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
-            malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true;
+            malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
             parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
               parsed.error = parsed.error || "URI host is malformed.";
@@ -4142,7 +4151,9 @@ var require_fast_uri = __commonJS({
           parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-        malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+        if (!malformedIPLiteral) {
+          malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+        }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (uri.indexOf("%") !== -1) {
             if (parsed.host !== void 0 && !malformedIPLiteral) {
@@ -22951,9 +22962,9 @@ function cloneIssues(issues) {
 }
 var recursive = /* @__PURE__ */ new WeakMap();
 function isRecursive(inst, stack) {
-  const cached3 = recursive.get(inst);
-  if (cached3 !== void 0)
-    return cached3;
+  const cached2 = recursive.get(inst);
+  if (cached2 !== void 0)
+    return cached2;
   if (stack.has(inst))
     return true;
   stack.add(inst);
@@ -32943,13 +32954,14 @@ var Hono = class _Hono {
     const allMethods = [...METHODS, METHOD_NAME_ALL_LOWERCASE];
     allMethods.forEach((method) => {
       this[method] = (args1, ...args) => {
+        const methodName = method.toUpperCase();
         if (typeof args1 === "string") {
           this.#path = args1;
         } else {
-          this.#addRoute(method, this.#path, args1);
+          this.#addRoute(methodName, this.#path, args1);
         }
         args.forEach((handler) => {
-          this.#addRoute(method, this.#path, handler);
+          this.#addRoute(methodName, this.#path, handler);
         });
         return this;
       };
@@ -32958,9 +32970,10 @@ var Hono = class _Hono {
       for (const p of [path].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
-          handlers.map((handler) => {
-            this.#addRoute(m.toUpperCase(), this.#path, handler);
-          });
+          const methodName = m.toUpperCase();
+          for (const handler of handlers) {
+            this.#addRoute(methodName, this.#path, handler);
+          }
         }
       }
       return this;
@@ -33161,7 +33174,6 @@ var Hono = class _Hono {
     return this;
   }
   #addRoute(method, path, handler, baseRoutePath) {
-    method = method.toUpperCase();
     path = mergePath(this._basePath, path);
     const r = {
       basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
@@ -35414,88 +35426,48 @@ var decoder = new TextDecoder();
 var strictDecoder = new TextDecoder("utf-8", { fatal: true });
 var MAX_INT32 = 2 ** 32;
 function concat(...buffers) {
-  const size = buffers.reduce((acc, { length }) => acc + length, 0);
-  const buf = new Uint8Array(size);
+  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
   let i = 0;
-  for (const buffer of buffers) {
-    buf.set(buffer, i);
-    i += buffer.length;
-  }
+  for (const buffer of buffers)
+    buf.set(buffer, i), i += buffer.length;
   return buf;
 }
+var NON_ASCII = /[^\x00-\x7f]/;
 function encode3(string3) {
+  if (typeof string3 == "string" && string3.length >= 128) {
+    if (NON_ASCII.test(string3))
+      throw new TypeError("non-ASCII string encountered in encode()");
+    return encoder.encode(string3);
+  }
   const bytes = new Uint8Array(string3.length);
   for (let i = 0; i < string3.length; i++) {
     const code = string3.charCodeAt(i);
-    if (code > 127) {
+    if (code > 127)
       throw new TypeError("non-ASCII string encountered in encode()");
-    }
     bytes[i] = code;
   }
   return bytes;
 }
-
-// node_modules/jose/dist/webapi/lib/crypto_key.js
-var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-function checkUsage(key, usage) {
-  if (usage && !key.usages.includes(usage)) {
-    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-  }
-}
-function checkModulusLength(alg, key) {
-  const { modulusLength } = key.algorithm;
-  if (typeof modulusLength !== "number" || modulusLength < 2048) {
-    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-  }
-}
-function checkCryptoKey(key, expected, usage) {
-  const algorithm = key.algorithm;
-  if (algorithm.name !== expected.name) {
-    throw unusable(expected.name);
-  }
-  if (expected.hash && algorithm.hash?.name !== expected.hash) {
-    throw unusable(expected.hash, "algorithm.hash");
-  }
-  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve) {
-    throw unusable(expected.namedCurve, "algorithm.namedCurve");
-  }
-  if (expected.length !== void 0 && algorithm.length !== expected.length) {
-    throw unusable(expected.length, "algorithm.length");
-  }
-  checkUsage(key, usage);
-}
-
-// node_modules/jose/dist/webapi/lib/invalid_key_input.js
-function message(msg, actual, ...types) {
-  if (types.length > 2) {
-    const last = types.pop();
-    msg += `one of type ${types.join(", ")}, or ${last}.`;
-  } else if (types.length === 2) {
-    msg += `one of type ${types[0]} or ${types[1]}.`;
-  } else {
-    msg += `of type ${types[0]}.`;
-  }
-  if (actual == null) {
-    msg += ` Received ${actual}`;
-  } else if (typeof actual === "function" && actual.name) {
-    msg += ` Received function ${actual.name}`;
-  } else if (typeof actual === "object" && actual != null) {
-    if (actual.constructor?.name) {
-      msg += ` Received an instance of ${actual.constructor.name}`;
-    }
+function decodeBase64(encoded, url = false) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
+  if (url) {
+    if (encoded.includes("+") || encoded.includes("/"))
+      throw new TypeError("Invalid base64url");
+    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
   }
-  return msg;
+  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
 }
-var withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
 
 // node_modules/jose/dist/webapi/util/errors.js
 var JOSEError = class extends Error {
   static code = "ERR_JOSE_GENERIC";
   code = "ERR_JOSE_GENERIC";
   constructor(message2, options) {
-    super(message2, options);
-    this.name = this.constructor.name;
-    Error.captureStackTrace?.(this, this.constructor);
+    super(message2, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
   }
 };
 var JWTClaimValidationFailed = class extends JOSEError {
@@ -35505,10 +35477,7 @@ var JWTClaimValidationFailed = class extends JOSEError {
   reason;
   payload;
   constructor(message2, payload, claim2 = "unspecified", reason = "unspecified") {
-    super(message2, { cause: { claim: claim2, reason, payload } });
-    this.claim = claim2;
-    this.reason = reason;
-    this.payload = payload;
+    super(message2, { cause: { claim: claim2, reason, payload } }), this.claim = claim2, this.reason = reason, this.payload = payload;
   }
 };
 var JWTExpired = class extends JOSEError {
@@ -35518,10 +35487,7 @@ var JWTExpired = class extends JOSEError {
   reason;
   payload;
   constructor(message2, payload, claim2 = "unspecified", reason = "unspecified") {
-    super(message2, { cause: { claim: claim2, reason, payload } });
-    this.claim = claim2;
-    this.reason = reason;
-    this.payload = payload;
+    super(message2, { cause: { claim: claim2, reason, payload } }), this.claim = claim2, this.reason = reason, this.payload = payload;
   }
 };
 var JOSEAlgNotAllowed = class extends JOSEError {
@@ -35575,73 +35541,37 @@ var JWSSignatureVerificationFailed = class extends JOSEError {
   }
 };
 
-// node_modules/jose/dist/webapi/lib/is_key_like.js
-var isCryptoKey = (key) => {
-  if (key?.[Symbol.toStringTag] === "CryptoKey")
-    return true;
-  try {
-    return key instanceof CryptoKey;
-  } catch {
-    return false;
-  }
-};
-var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
-var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
-
-// node_modules/jose/dist/webapi/lib/base64.js
-function decodeBase64(encoded) {
-  if (Uint8Array.fromBase64) {
-    return Uint8Array.fromBase64(encoded);
-  }
-  const binary = atob(encoded);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes;
-}
-
 // node_modules/jose/dist/webapi/util/base64url.js
 var invalid = "The input to be decoded is not correctly encoded.";
 function decode3(input) {
-  if (Uint8Array.fromBase64) {
-    try {
-      return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), {
-        alphabet: "base64url"
-      });
-    } catch (cause) {
-      throw new TypeError(invalid, { cause });
-    }
-  }
-  let encoded = input;
-  if (encoded instanceof Uint8Array) {
-    encoded = decoder.decode(encoded);
-  }
-  if (encoded.includes("+") || encoded.includes("/")) {
-    throw new TypeError(invalid);
-  }
-  encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
   try {
-    return decodeBase64(encoded);
-  } catch {
-    throw new TypeError(invalid);
+    return decodeBase64(typeof input == "string" ? input : decoder.decode(input), true);
+  } catch (cause) {
+    throw new TypeError(invalid, { cause });
   }
 }
 
-// node_modules/jose/dist/webapi/lib/type_checks.js
+// node_modules/jose/dist/webapi/lib/validate.js
 function isObject2(input) {
-  if (typeof input !== "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]") {
+  if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]")
     return false;
-  }
   const prototype = Object.getPrototypeOf(input);
   return prototype === null || Object.getPrototypeOf(prototype) === null;
 }
 function isJwkSet(input) {
   return isObject2(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject2);
 }
-
-// node_modules/jose/dist/webapi/lib/helpers.js
-var unprotected = Symbol();
+function isDisjoint(...headers) {
+  const parameters = /* @__PURE__ */ new Set();
+  for (const header of headers)
+    if (header)
+      for (const parameter of Object.keys(header)) {
+        if (parameters.has(parameter))
+          return false;
+        parameters.add(parameter);
+      }
+  return true;
+}
 function decodeBase64url(value, label, ErrorClass) {
   try {
     return decode3(value);
@@ -35663,48 +35593,42 @@ function parseJoseHeader(b64, ErrorClass, message2) {
   } catch {
     throw new ErrorClass(message2);
   }
-  if (!isObject2(parsed)) {
+  if (!isObject2(parsed))
     throw new ErrorClass(message2);
-  }
   return parsed;
 }
-
-// node_modules/jose/dist/webapi/lib/jwk_to_key.js
-async function jwkToKey(entry, jwk) {
-  if (jwk.kty === "RSA" && "oth" in jwk && jwk.oth !== void 0) {
-    throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-  }
-  if (!entry.kty.includes(jwk.kty)) {
-    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-  }
-  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle;
-  const isPrivate = !!(jwk.d || jwk.priv);
-  const keyData = { ...jwk };
-  if (keyData.kty !== "AKP") {
-    delete keyData.alg;
-  }
-  delete keyData.use;
-  return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
-}
-
-// node_modules/jose/dist/webapi/lib/jwk_metadata.js
-function snapshotJwk(jwk) {
-  return { __proto__: null, ...jwk };
+var JWS_RECOGNIZED = { __proto__: null, b64: true };
+function validateAlgorithms(option, algorithms) {
+  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string")))
+    throw new TypeError(`"${option}" option must be an array of strings`);
+  return algorithms === void 0 ? void 0 : new Set(algorithms);
 }
-function normalizeJwk(jwk) {
-  const normalized = snapshotJwk(jwk);
-  if (normalized.ext !== void 0 && typeof normalized.ext !== "boolean") {
-    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+  if (!protectedHeader || protectedHeader.crit === void 0)
+    return [];
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0))
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
+  for (const parameter of protectedHeader.crit) {
+    if (!(parameter in recognized))
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
   }
-  if (normalized.key_ops !== void 0) {
-    const value = normalized.key_ops;
-    const keyOps = Array.isArray(value) ? [...value] : void 0;
-    if (!keyOps || keyOps.some((operation) => typeof operation !== "string") || new Set(keyOps).size !== keyOps.length) {
-      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
-    }
-    normalized.key_ops = keyOps;
+  return protectedHeader.crit;
+}
+function validateB64(protectedHeader, extensions) {
+  if (extensions.includes("b64")) {
+    const b64 = protectedHeader.b64;
+    if (typeof b64 != "boolean")
+      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    return b64;
   }
-  return normalized;
+  return true;
 }
 
 // node_modules/jose/dist/webapi/lib/key.js
@@ -35713,60 +35637,55 @@ var jwkMatchesOp = (entry, key, usage) => {
   const { alg } = entry;
   if (key.use !== void 0) {
     const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
-    if (key.use !== expected) {
+    if (key.use !== expected)
       throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-    }
   }
-  if (key.alg !== void 0 && key.alg !== alg) {
+  if (key.alg !== void 0 && key.alg !== alg)
     throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
-  }
   if (Array.isArray(key.key_ops)) {
     const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
-    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) {
+    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))
       throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
-    }
   }
 };
-function checkKeyType(entry, key, usage) {
-  const { alg, secret } = entry;
-  const privateKey = usage === "decrypt" || usage === "sign";
+async function prepareKey(entry, key, usage) {
+  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
   if (secret && key instanceof Uint8Array)
-    return [BYTES, key];
+    return key;
+  let normalized, keyObject;
   if (isObject2(key)) {
-    const normalized = normalizeJwk(key);
-    if (typeof normalized.kty !== "string") {
-      throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
-    }
-    const valid = secret ? normalized.kty === "oct" && typeof normalized.k === "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv === "string" || typeof normalized.d === "string" : normalized.d === void 0 && normalized.priv === void 0);
-    if (!valid) {
-      throw new TypeError(secret ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present` : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
-    }
-    jwkMatchesOp(entry, normalized, usage);
-    return [JWK, key, normalized];
-  }
-  if (!isKeyLike(key)) {
-    throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
-  }
-  if (secret) {
-    if (key.type !== "secret") {
-      throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
+    if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
+      throw invalidKeyType(alg, key, secret);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
+      return decode3(normalized.k);
+    if (!Object.isFrozen(key)) {
+      const { key_ops } = key;
+      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
     }
   } else {
-    if (key.type === "secret") {
-      throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
-    }
-    const expectedType = privateKey ? "private" : "public";
-    if ((key.type === "public" || key.type === "private") && key.type !== expectedType) {
-      const operation = usage === "sign" ? "signing" : usage === "verify" ? "verifying" : `${usage.slice(0, -1)}tion`;
-      throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation} must be of type "${expectedType}"`);
-    }
+    if (!isKeyLike(key))
+      throw invalidKeyType(alg, key, secret);
+    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
+      throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+    if (isCryptoKey(key))
+      return key;
+    if (keyObject = key, keyObject.type === "secret")
+      return keyObject.export();
   }
-  return isCryptoKey(key) ? [CRYPTO, key] : [KEYOBJECT, key];
+  cache ||= /* @__PURE__ */ new WeakMap();
+  const cacheKey2 = key;
+  let cached2 = cache.get(cacheKey2);
+  if (cached2?.[alg])
+    return cached2[alg];
+  if (cached2 || cache.set(cacheKey2, cached2 = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+    const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;
+    return cached2[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+  }
+  return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached2[alg] = await jwkToKey(entry, normalized);
 }
-var BYTES = 0;
-var CRYPTO = 1;
-var KEYOBJECT = 2;
-var JWK = 3;
 var cache;
 var nist = {
   __proto__: null,
@@ -35774,139 +35693,83 @@ var nist = {
   secp384r1: "P-384",
   secp521r1: "P-521"
 };
-function cached2(key, alg, value) {
-  cache ||= /* @__PURE__ */ new WeakMap();
-  const entry = cache.get(key);
-  if (value) {
-    if (entry) {
-      entry[alg] = value;
-    } else {
-      cache.set(key, { [alg]: value });
-    }
+var isCryptoKey = (key) => {
+  if (key?.[Symbol.toStringTag] === "CryptoKey")
+    return true;
+  try {
+    return key instanceof CryptoKey;
+  } catch {
+    return false;
   }
-  return value ?? entry?.[alg];
-}
-var handleJWK = async (key, jwk, entry) => cached2(key, entry.alg) ?? cached2(key, entry.alg, await jwkToKey(entry, { ...jwk, alg: entry.alg }));
-var handleKeyObject = (keyObject, entry) => {
-  const hit = cached2(keyObject, entry.alg);
-  if (hit)
-    return hit;
-  const isPublic = keyObject.type === "public";
-  const usages = entry.usages[isPublic ? 0 : 1];
-  const { asymmetricKeyType } = keyObject;
-  const crv = nist[keyObject.asymmetricKeyDetails?.namedCurve];
-  const params = entry.resolve?.({ crv, asymmetricKeyType }) ?? entry.subtle;
-  return cached2(keyObject, entry.alg, keyObject.toCryptoKey(params, isPublic, usages));
 };
-async function prepareKey(entry, key, usage) {
-  const tagged = checkKeyType(entry, key, usage);
-  switch (tagged[0]) {
-    case BYTES:
-    case CRYPTO:
-      return tagged[1];
-    case JWK: {
-      const key2 = tagged[1];
-      const normalized = tagged[2];
-      if (normalized.kty === "oct") {
-        return decode3(normalized.k);
-      }
-      if (!Object.isFrozen(key2)) {
-        const { key_ops } = key2;
-        if (Array.isArray(key_ops))
-          Object.freeze(key_ops);
-        Object.freeze(key2);
-      }
-      return handleJWK(key2, normalized, entry);
-    }
-    case KEYOBJECT: {
-      const keyObject = tagged[1];
-      if (keyObject.type === "secret") {
-        return keyObject.export();
-      }
-      if ("toCryptoKey" in keyObject && typeof keyObject.toCryptoKey === "function") {
-        return handleKeyObject(keyObject, entry);
-      }
-      return handleJWK(keyObject, keyObject.export({ format: "jwk" }), entry);
-    }
+var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `one of type ${types.join(", ")}, or ${last}.`;
+  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+  return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+function invalidKeyType(alg, actual, secret) {
+  const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
+  return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+}
+var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+  if (usage && !key.usages.includes(usage))
+    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+  const { modulusLength } = key.algorithm;
+  if (typeof modulusLength != "number" || modulusLength < 2048)
+    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+  const algorithm = key.algorithm;
+  if (algorithm.name !== expected.name)
+    throw unusable(expected.name);
+  if (expected.hash && algorithm.hash?.name !== expected.hash)
+    throw unusable(expected.hash, "algorithm.hash");
+  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)
+    throw unusable(expected.namedCurve, "algorithm.namedCurve");
+  if (expected.length !== void 0 && algorithm.length !== expected.length)
+    throw unusable(expected.length, "algorithm.length");
+  checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== void 0 && typeof normalized.ext != "boolean")
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  if (normalized.key_ops !== void 0) {
+    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+    if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length)
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    normalized.key_ops = keyOps;
   }
+  return normalized;
+}
+async function jwkToKey(entry, jwk, extractable) {
+  if (!entry.kty.includes(jwk.kty))
+    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
+  return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+async function rawKey(key, expected, usage, extractable = false) {
+  return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
 }
 
 // node_modules/jose/dist/webapi/lib/key_descriptor.js
 function table(entries) {
   const out = { __proto__: null };
-  for (const alg in entries) {
+  for (const alg in entries)
     out[alg] = { ...entries[alg], alg };
-  }
   return out;
 }
 
-// node_modules/jose/dist/webapi/lib/options.js
-var JWS_RECOGNIZED = { __proto__: null, b64: true };
-function validateAlgorithms(option, algorithms) {
-  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) {
-    throw new TypeError(`"${option}" option must be an array of strings`);
-  }
-  if (!algorithms) {
-    return void 0;
-  }
-  return new Set(algorithms);
-}
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) {
-    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
-  }
-  if (!protectedHeader || protectedHeader.crit === void 0) {
-    return [];
-  }
-  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) {
-    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
-  }
-  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
-  for (const parameter of protectedHeader.crit) {
-    if (!(parameter in recognized)) {
-      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-    }
-    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0) {
-      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-    }
-    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0)) {
-      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-    }
-  }
-  return protectedHeader.crit;
-}
-function validateB64(protectedHeader, extensions) {
-  if (extensions.includes("b64")) {
-    const b64 = protectedHeader.b64;
-    if (typeof b64 !== "boolean") {
-      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-    }
-    return b64;
-  }
-  return true;
-}
-
-// node_modules/jose/dist/webapi/lib/signing.js
-async function getSigKey(entry, key, usage) {
-  if (key instanceof Uint8Array) {
-    return crypto.subtle.importKey("raw", key, entry.subtle, false, [
-      usage
-    ]);
-  }
-  checkCryptoKey(key, entry.subtle, usage);
-  if (entry.minRsaBits)
-    checkModulusLength(entry.alg, key);
-  return key;
-}
-async function verify(entry, key, signature, data) {
-  const cryptoKey = await getSigKey(entry, key, "verify");
-  try {
-    return await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
-  } catch {
-    return false;
-  }
-}
-
 // node_modules/jose/dist/webapi/lib/jws_algorithms.js
 var sig = [["verify"], ["sign"]];
 function hmac(bits) {
@@ -35914,8 +35777,7 @@ function hmac(bits) {
   return { kty: ["oct"], secret: true, subtle, signing: subtle, usages: sig };
 }
 function rsa(bits, saltLength) {
-  const name = saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5";
-  const subtle = { name, hash: `SHA-${bits}` };
+  const subtle = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
   return {
     kty: ["RSA"],
     subtle,
@@ -35944,8 +35806,7 @@ function eddsa() {
   };
 }
 function mldsa(bits) {
-  const name = `ML-DSA-${bits}`;
-  const subtle = { name };
+  const subtle = { name: `ML-DSA-${bits}` };
   return {
     kty: ["AKP"],
     subtle,
@@ -35973,10 +35834,9 @@ var JWS = table({
   "ML-DSA-87": mldsa(87)
 });
 function jwsAlgorithm(alg) {
-  const entry = typeof alg === "string" ? JWS[alg] : void 0;
-  if (!entry) {
+  const entry = typeof alg == "string" ? JWS[alg] : void 0;
+  if (!entry)
     throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-  }
   return entry;
 }
 
@@ -35984,19 +35844,8 @@ function jwsAlgorithm(alg) {
 function prepareVerify(options) {
   return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
 }
-function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid")) {
-  return parsedProtected;
-}
-function validateJwsHeaders(parsedProt, joseHeader, shared) {
-  const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader));
-  const alg = joseHeader.alg;
-  if (typeof alg !== "string" || !alg) {
-    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-  }
-  if (shared[0] && !shared[0].has(alg)) {
-    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-  }
-  return [b64, alg];
+function parseProtectedHeader(encodedProtected) {
+  return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
 }
 function encodeCompactUnencodedPayload(payload) {
   try {
@@ -36005,39 +35854,42 @@ function encodeCompactUnencodedPayload(payload) {
     throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
   }
 }
-async function verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload) {
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+  if (!isDisjoint(parsedProt, header))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  if (shared[0] && !shared[0].has(alg))
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+  if (b64) {
+    if (typeof inputPayload != "string")
+      throw new JWSInvalid("JWS Payload must be a string");
+  } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
+    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+  const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
   let resolvedKey = false;
-  if (typeof key === "function") {
-    key = await key(parsedProt, jws);
-    resolvedKey = true;
-  }
-  const b64 = typeof signingPayload === "string";
-  const entry = jwsAlgorithm(alg);
-  const data = concat(encodedProtected !== void 0 ? encode3(encodedProtected) : new Uint8Array(), encode3("."), b64 ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload);
-  const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
-  const k = await prepareKey(entry, key, "verify");
-  if (!await verify(entry, k, signature, data)) {
-    throw new JWSSignatureVerificationFailed();
+  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
+  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode3(encodedProtected) : new Uint8Array(), encode3("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+  let verified = false;
+  try {
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+  } catch {
   }
-  const payload = b64 ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload;
-  return [payload, parsedProt, b64, k, resolvedKey];
+  if (!verified)
+    throw new JWSSignatureVerificationFailed();
+  const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
 }
 async function verifyCompact(jws, shared, key) {
-  if (jws instanceof Uint8Array) {
-    jws = decoder.decode(jws);
-  }
-  if (typeof jws !== "string") {
+  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string")
     throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
-  }
   const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
-  if (length !== 3) {
+  if (length !== 3)
     throw new JWSInvalid("Invalid Compact JWS");
-  }
-  const compactJws = { payload, protected: protectedHeader, signature };
-  const parsedProt = parseProtectedHeader(protectedHeader);
-  const [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared);
-  const signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
-  return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
+  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
 }
 
 // node_modules/jose/dist/webapi/lib/jwt_claims_set.js
@@ -36056,50 +35908,29 @@ function invalidDuration() {
   throw new TypeError("Invalid time period format");
 }
 function secs(str) {
-  if (typeof str !== "string") {
-    invalidDuration();
-  }
+  typeof str != "string" && invalidDuration();
   const matched = REGEX.exec(str);
-  if (!matched || matched[4] && matched[1]) {
-    invalidDuration();
-  }
-  const value = parseFloat(matched[2]);
-  const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-  if (!Number.isFinite(numericDate)) {
-    invalidDuration();
-  }
-  if (matched[1] === "-" || matched[4] === "ago") {
-    return -numericDate;
-  }
-  return numericDate;
+  (!matched || matched[4] && matched[1]) && invalidDuration();
+  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
 }
 function validateInput(label, input) {
-  if (!Number.isFinite(input)) {
+  if (!Number.isFinite(input))
     throw new TypeError(`Invalid ${label} input`);
-  }
   return input;
 }
 var normalizeTyp = (value) => {
   const normalized = value.toLowerCase();
   return value.includes("/") ? normalized : `application/${normalized}`;
 };
-var checkAudiencePresence = (audPayload, audOption) => {
-  if (typeof audPayload === "string") {
-    return audOption.includes(audPayload);
-  }
-  if (Array.isArray(audPayload)) {
-    return audOption.some((aud) => audPayload.includes(aud));
-  }
-  return false;
-};
+var checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
 function validateNumericDate(payload, claim2, required2 = false) {
   const value = payload[claim2];
-  if (value === void 0 && !required2)
-    return void 0;
-  if (typeof value !== "number") {
-    throw new JWTClaimValidationFailed(`"${claim2}" claim must be a number`, payload, claim2, "invalid");
+  if (!(value === void 0 && !required2)) {
+    if (typeof value != "number")
+      throw new JWTClaimValidationFailed(`"${claim2}" claim must be a number`, payload, claim2, "invalid");
+    return value;
   }
-  return value;
 }
 function unexpectedClaim(payload, claim2) {
   throw new JWTClaimValidationFailed(`unexpected "${claim2}" claim value`, payload, claim2, checkFailed);
@@ -36110,107 +35941,70 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
     payload = JSON.parse(strictDecoder.decode(encodedPayload));
   } catch {
   }
-  if (!isObject2(payload)) {
+  if (!isObject2(payload))
     throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
-  }
   const { typ } = options;
-  if (typ !== void 0 && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+  if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
     throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
-  }
-  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
-  const presenceCheck = [...requiredClaims];
-  if (maxTokenAge !== void 0)
-    presenceCheck.push("iat");
-  if (audience !== void 0)
-    presenceCheck.push("aud");
-  if (subject !== void 0)
-    presenceCheck.push("sub");
-  if (issuer !== void 0)
-    presenceCheck.push("iss");
-  for (const claim2 of new Set(presenceCheck.reverse())) {
-    if (!Object.hasOwn(payload, claim2)) {
+  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+  maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+  for (const claim2 of new Set(presenceCheck.reverse()))
+    if (!Object.hasOwn(payload, claim2))
       throw new JWTClaimValidationFailed(`missing required "${claim2}" claim`, payload, claim2, "missing");
-    }
-  }
-  if (issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-    unexpectedClaim(payload, "iss");
-  }
-  if (subject !== void 0 && payload.sub !== subject) {
-    unexpectedClaim(payload, "sub");
-  }
-  if (audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience === "string" ? [audience] : audience)) {
-    unexpectedClaim(payload, "aud");
-  }
+  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
   const { clockTolerance } = options;
   let tolerance = 0;
-  if (typeof clockTolerance === "string") {
+  if (typeof clockTolerance == "string")
     tolerance = secs(clockTolerance);
-  } else if (clockTolerance !== void 0) {
-    if (typeof clockTolerance !== "number") {
+  else if (clockTolerance !== void 0) {
+    if (typeof clockTolerance != "number")
       throw new TypeError("Invalid clockTolerance option type");
-    }
     tolerance = clockTolerance;
   }
   validateInput("clockTolerance option", tolerance);
-  const { currentDate } = options;
-  const now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate));
-  const iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0);
-  const nbf = validateNumericDate(payload, "nbf");
-  if (nbf !== void 0) {
-    if (nbf > now + tolerance) {
-      throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
-    }
-  }
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+  if (nbf !== void 0 && nbf > now + tolerance)
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
   const exp = validateNumericDate(payload, "exp");
-  if (exp !== void 0) {
-    if (exp <= now - tolerance) {
-      throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
-    }
-  }
+  if (exp !== void 0 && exp <= now - tolerance)
+    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
   if (maxTokenAge !== void 0) {
-    const age = now - iat;
-    const max = validateInput("maxTokenAge option", typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge));
-    if (age - tolerance > max) {
+    const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+    if (age - tolerance > max)
       throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
-    }
-    if (age < -tolerance) {
+    if (age < -tolerance)
       throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
-    }
   }
   return payload;
 }
 
 // node_modules/jose/dist/webapi/jwt/verify.js
 async function jwtVerify(jwt, key, options) {
-  const verified = await verifyCompact(jwt, prepareVerify(options), key);
-  if (!verified[2]) {
+  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+  if (!b64)
     throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-  }
-  const payload = validateClaimsSet(verified[1], verified[0], options);
-  const result = { payload, protectedHeader: verified[1] };
-  if (typeof key === "function") {
-    return { ...result, key: verified[3] };
-  }
-  return result;
+  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+  return { ...verified, payload };
 }
 
 // node_modules/jose/dist/webapi/jwks/local.js
 function isUsableJWK(jwk, entry, alg, kid) {
-  const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk);
-  const keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
-  return (ext === void 0 || typeof ext === "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation === "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid === "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
+  const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
+  return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
 }
 async function importWithAlgCache(cache2, jwk, entry) {
-  const cached3 = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk);
-  const { alg } = entry;
-  if (cached3[alg] === void 0) {
-    const key = await jwkToKey(entry, { ...jwk, alg, ext: true });
-    if (key.type !== "public") {
-      throw new JWKSInvalid("JSON Web Key Set members must be public keys");
-    }
-    cached3[alg] = key;
+  const cached2 = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk), { alg } = entry;
+  if (cached2[alg] === void 0) {
+    const pending = jwkToKey(entry, jwk, true).then((key) => {
+      if (key.type !== "public")
+        throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+      return cached2[alg] = key, key;
+    }).catch((error2) => {
+      throw cached2[alg] === pending && delete cached2[alg], error2;
+    });
+    cached2[alg] = pending;
   }
-  return cached3[alg];
+  return cached2[alg];
 }
 function createLocalJWKSet(jwks) {
   let snapshot;
@@ -36218,51 +36012,42 @@ function createLocalJWKSet(jwks) {
     snapshot = structuredClone(jwks);
   } catch {
   }
-  if (!isJwkSet(snapshot)) {
+  if (!isJwkSet(snapshot))
     throw new JWKSInvalid("JSON Web Key Set malformed");
-  }
-  const cached3 = /* @__PURE__ */ new WeakMap();
-  const localJWKSet = async (protectedHeader, token) => {
-    const { alg, kid } = { ...protectedHeader, ...token?.header };
-    const entry = typeof alg === "string" ? JWS[alg] : void 0;
-    if (!entry || entry.secret) {
+  const metadata = snapshot.keys.map((jwk) => {
+    const normalized = snapshotJwk(jwk);
+    return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
+  }), cached2 = /* @__PURE__ */ new WeakMap();
+  return Object.defineProperty(async (protectedHeader, token) => {
+    const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : void 0;
+    if (!entry || entry.secret)
       throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-    const candidates = snapshot.keys.filter((jwk2) => isUsableJWK(jwk2, entry, alg, kid));
-    const { 0: jwk, length } = candidates;
-    if (!length) {
+    const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
+    if (!length)
       throw new JWKSNoMatchingKey();
-    }
     if (length !== 1) {
       const error2 = new JWKSMultipleMatchingKeys();
-      error2[Symbol.asyncIterator] = async function* () {
-        for (const jwk2 of candidates) {
+      throw error2[Symbol.asyncIterator] = async function* () {
+        for (const jwk2 of candidates)
           try {
-            yield await importWithAlgCache(cached3, jwk2, entry);
+            yield await importWithAlgCache(cached2, jwk2, entry);
           } catch {
           }
-        }
-      };
-      throw error2;
+      }, error2;
     }
-    return importWithAlgCache(cached3, jwk, entry);
-  };
-  return Object.defineProperty(localJWKSet, "jwks", {
+    return importWithAlgCache(cached2, jwk, entry);
+  }, "jwks", {
     value: () => structuredClone(snapshot)
   });
 }
 
 // node_modules/jose/dist/webapi/jwks/remote.js
 function isCloudflareWorkers() {
-  return typeof WebSocketPair !== "undefined" || typeof navigator !== "undefined" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime !== "undefined" && EdgeRuntime === "vercel";
+  return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 var USER_AGENT;
-if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
-  const NAME = "jose";
-  const VERSION2 = "v6.2.10";
-  USER_AGENT = `${NAME}/${VERSION2}`;
-}
-var customFetch = Symbol();
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
+var customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url, {
     method: "GET",
@@ -36270,106 +36055,64 @@ async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
     redirect: "manual",
     headers
   }).catch((err) => {
-    if (err.name === "TimeoutError") {
-      throw new JWKSTimeout();
-    }
-    throw err;
+    throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
   });
-  if (response.status !== 200) {
+  if (response.status !== 200)
     throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
-  }
   try {
     return await response.json();
   } catch {
     throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
   }
 }
-var jwksCache = Symbol();
+var jwksCache = /* @__PURE__ */ Symbol();
 function isFreshFor(timestamp, duration3) {
   return Number.isFinite(timestamp) && Date.now() < timestamp + duration3;
 }
 function validateDuration(value, fallback, option) {
-  if (Number.isNaN(value)) {
+  if (Number.isNaN(value))
     throw new TypeError(`"${option}" option must not be NaN`);
-  }
-  return typeof value === "number" ? value : fallback;
+  return typeof value == "number" ? value : fallback;
 }
 function createRemoteJWKSet(url, options) {
-  if (!(url instanceof URL)) {
+  if (!(url instanceof URL))
     throw new TypeError("url must be an instance of URL");
-  }
-  const href = new URL(url.href).href;
-  const opts = options ?? {};
-  const timeoutOption = opts.timeoutDuration;
-  if (typeof timeoutOption === "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0)) {
+  const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
+  if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))
     throw new TypeError('"timeoutDuration" option must be a non-negative integer');
-  }
-  const timeoutDuration = typeof timeoutOption === "number" ? timeoutOption : 5e3;
-  const cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration");
-  const cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge");
-  const headers = new Headers(opts.headers);
-  if (USER_AGENT && !headers.has("User-Agent")) {
-    headers.set("User-Agent", USER_AGENT);
-  }
-  if (!headers.has("accept")) {
-    headers.set("accept", "application/json, application/jwk-set+json");
-  }
-  const fetchImpl = opts[customFetch];
-  const cache2 = opts[jwksCache];
-  let jwksTimestamp;
-  let pendingFetch;
-  let reloadSequence = 0;
-  let appliedSequence = 0;
-  let local;
-  if (cache2 && typeof cache2 === "object") {
+  const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge"), headers = new Headers(opts.headers);
+  USER_AGENT && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
+  const fetchImpl = opts[customFetch], cache2 = opts[jwksCache];
+  let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
+  if (cache2 && typeof cache2 == "object") {
     const { uat, jwks } = cache2;
-    if (isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks)) {
-      jwksTimestamp = uat;
-      local = createLocalJWKSet(jwks);
-    }
+    isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
   }
   const reload = async () => {
-    if (pendingFetch && isCloudflareWorkers()) {
-      pendingFetch = void 0;
-    }
-    if (!pendingFetch) {
-      const sequence = ++reloadSequence;
-      const current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+    if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {
+      const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
         const next = createLocalJWKSet(json);
-        if (sequence <= appliedSequence) {
+        if (sequence <= appliedSequence)
           return;
-        }
         local = next;
         const updatedAt = Date.now();
-        if (cache2) {
-          cache2.uat = updatedAt;
-          cache2.jwks = json;
-        }
-        jwksTimestamp = updatedAt;
-        appliedSequence = sequence;
+        cache2 && (cache2.uat = updatedAt, cache2.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;
       }).finally(() => {
-        if (pendingFetch === current) {
-          pendingFetch = void 0;
-        }
+        pendingFetch === current && (pendingFetch = void 0);
       });
     }
     await pendingFetch;
   };
-  const remoteJWKSet = async (protectedHeader, token) => {
-    if (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) {
-      await reload();
-    }
+  return Object.defineProperties(async (protectedHeader, token) => {
+    (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
     try {
       return await local(protectedHeader, token);
     } catch (err) {
-      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration)) {
-        await reload();
-        return local(protectedHeader, token);
-      }
+      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))
+        return await reload(), local(protectedHeader, token);
       throw err;
     }
-  };
-  return Object.defineProperties(remoteJWKSet, {
+  }, {
     coolingDown: {
       get: () => isFreshFor(jwksTimestamp, cooldownDuration),
       enumerable: true
@@ -36472,16 +36215,16 @@ var JwtAuthProvider = class _JwtAuthProvider extends AuthProvider {
   }
   async verifyToken(token) {
     const cacheKey2 = await this.hashToken(token);
-    const cached3 = this.tokenCache.get(cacheKey2);
-    if (cached3 && Date.now() < cached3.expiresAt) {
+    const cached2 = this.tokenCache.get(cacheKey2);
+    if (cached2 && Date.now() < cached2.expiresAt) {
       if (isOtelEnabled()) {
         recordAuthEvent("cache_hit", {
-          subject: cached3.authInfo.subject ?? ""
+          subject: cached2.authInfo.subject ?? ""
         });
       }
-      return cached3.authInfo;
+      return cached2.authInfo;
     }
-    if (cached3) this.tokenCache.delete(cacheKey2);
+    if (cached2) this.tokenCache.delete(cacheKey2);
     try {
       const { payload } = await jwtVerify(token, this.jwks, {
         issuer: this.options.issuer,
@@ -41669,6 +41412,13 @@ var createContextStore3 = impl2.createContextStore;
 // src/cache/memory.ts
 var MemoryCache = class {
   store = /* @__PURE__ */ new Map();
+  maxEntries;
+  constructor(maxEntries = 1e3) {
+    if (!Number.isInteger(maxEntries) || maxEntries <= 0) {
+      throw new RangeError("maxEntries must be a positive finite integer");
+    }
+    this.maxEntries = maxEntries;
+  }
   get(key) {
     const entry = this.store.get(key);
     if (!entry) return void 0;
@@ -41679,7 +41429,21 @@ var MemoryCache = class {
     return structuredClone(entry.value);
   }
   set(key, value, ttlMs) {
-    this.store.set(key, { value, expiresAt: Date.now() + ttlMs });
+    const now = Date.now();
+    for (const [storedKey, entry] of this.store) {
+      if (now >= entry.expiresAt) this.store.delete(storedKey);
+    }
+    if (ttlMs <= 0) {
+      this.store.delete(key);
+      return;
+    }
+    const snapshot = structuredClone(value);
+    this.store.delete(key);
+    if (this.store.size >= this.maxEntries) {
+      const oldest = this.store.keys().next();
+      if (!oldest.done) this.store.delete(oldest.value);
+    }
+    this.store.set(key, { value: snapshot, expiresAt: now + ttlMs });
   }
   delete(key) {
     this.store.delete(key);
@@ -41734,6 +41498,20 @@ function getCache() {
   return _cache;
 }
 
+// src/cache/invalidation-generation.ts
+var generations = /* @__PURE__ */ new WeakMap();
+function getInvalidationGeneration(cache2, doctype) {
+  return generations.get(cache2)?.get(doctype);
+}
+function bumpInvalidationGeneration(cache2, doctype) {
+  let byDoctype = generations.get(cache2);
+  if (byDoctype === void 0) {
+    byDoctype = /* @__PURE__ */ new Map();
+    generations.set(cache2, byDoctype);
+  }
+  byDoctype.set(doctype, Symbol());
+}
+
 // src/api/caller-context.ts
 var callerStorage = createContextStore3();
 function runWithCaller(identity, fn) {
@@ -41941,16 +41719,47 @@ var FrappeClient = class {
     const url = `${this.baseUrl}${path}`;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-    let response;
     try {
-      response = await fetch(url, {
+      const response = await fetch(url, {
         method,
         headers: this.buildHeaders(!multipart),
         body: body === void 0 ? void 0 : multipart ? body : JSON.stringify(body),
         signal: controller.signal
       });
+      const rawText = await response.text();
+      const contentType = response.headers.get("content-type") ?? "";
+      let responseBody = rawText;
+      if (contentType.includes("application/json") && rawText.length > 0) {
+        try {
+          responseBody = JSON.parse(rawText);
+        } catch {
+          responseBody = rawText;
+        }
+      }
+      if (!response.ok) {
+        let msg = response.statusText;
+        if (typeof responseBody === "object" && responseBody !== null) {
+          const rb = responseBody;
+          const excType = rb.exc_type;
+          const baseMsg = rb.message ?? excType ?? response.statusText;
+          const serverDetails = extractServerMessages(rb._server_messages);
+          msg = serverDetails ? `${baseMsg}: ${serverDetails}` : baseMsg;
+        } else if (typeof responseBody === "string" && responseBody.length > 0) {
+          msg = responseBody.slice(0, 200);
+        }
+        const retryAfterMs = parseRetryAfter(
+          response.headers.get("retry-after")
+        );
+        throw new FrappeAPIError(
+          `${method} ${path} failed: ${msg}`,
+          response.status,
+          responseBody,
+          retryAfterMs
+        );
+      }
+      return responseBody;
     } catch (err) {
-      clearTimeout(timer);
+      if (err instanceof FrappeAPIError) throw err;
       if (err instanceof Error && err.name === "AbortError") {
         throw new FrappeAPIError(
           `Request timed out after ${this.timeoutMs}ms: ${method} ${path}`,
@@ -41963,40 +41772,9 @@ var FrappeClient = class {
         0,
         null
       );
+    } finally {
+      clearTimeout(timer);
     }
-    clearTimeout(timer);
-    const rawText = await response.text();
-    const contentType = response.headers.get("content-type") ?? "";
-    let responseBody = rawText;
-    if (contentType.includes("application/json") && rawText.length > 0) {
-      try {
-        responseBody = JSON.parse(rawText);
-      } catch {
-        responseBody = rawText;
-      }
-    }
-    if (!response.ok) {
-      let msg = response.statusText;
-      if (typeof responseBody === "object" && responseBody !== null) {
-        const rb = responseBody;
-        const excType = rb.exc_type;
-        const baseMsg = rb.message ?? excType ?? response.statusText;
-        const serverDetails = extractServerMessages(rb._server_messages);
-        msg = serverDetails ? `${baseMsg}: ${serverDetails}` : baseMsg;
-      } else if (typeof responseBody === "string" && responseBody.length > 0) {
-        msg = responseBody.slice(0, 200);
-      }
-      const retryAfterMs = parseRetryAfter(
-        response.headers.get("retry-after")
-      );
-      throw new FrappeAPIError(
-        `${method} ${path} failed: ${msg}`,
-        response.status,
-        responseBody,
-        retryAfterMs
-      );
-    }
-    return responseBody;
   }
   // ── Resource CRUD ───────────────────────────────────────────────────────────
   /**
@@ -42015,8 +41793,8 @@ var FrappeClient = class {
     };
     const cacheKey2 = `list:${doctype}:${stableStringify(options)}`;
     if (!opts.skipCache) {
-      const cached3 = this.cache.get(cacheKey2);
-      if (cached3 !== void 0) return cached3;
+      const cached2 = this.cache.get(cacheKey2);
+      if (cached2 !== void 0) return cached2;
     }
     const params = new URLSearchParams();
     if (options.fields && options.fields.length > 0) {
@@ -42036,12 +41814,15 @@ var FrappeClient = class {
     }
     params.set("as_dict", "1");
     const query = params.toString() ? `?${params.toString()}` : "";
+    const generation = getInvalidationGeneration(this.cache, doctype);
     const res = await this.request(
       "GET",
       `/api/resource/${encodeURIComponent(doctype)}${query}`
     );
     const docs = res.data ?? [];
-    this.cache.set(cacheKey2, docs, getCacheTtlMs());
+    if (generation === getInvalidationGeneration(this.cache, doctype)) {
+      this.cache.set(cacheKey2, docs, getCacheTtlMs());
+    }
     return docs;
   }
   /**
@@ -42056,14 +41837,17 @@ var FrappeClient = class {
   async get(doctype, name, opts = {}) {
     const cacheKey2 = `get:${doctype}:${name}`;
     if (!opts.skipCache) {
-      const cached3 = this.cache.get(cacheKey2);
-      if (cached3 !== void 0) return cached3;
+      const cached2 = this.cache.get(cacheKey2);
+      if (cached2 !== void 0) return cached2;
     }
+    const generation = getInvalidationGeneration(this.cache, doctype);
     const res = await this.request(
       "GET",
       `/api/resource/${encodeURIComponent(doctype)}/${encodeURIComponent(name)}`
     );
-    this.cache.set(cacheKey2, res.data, getCacheTtlMs());
+    if (generation === getInvalidationGeneration(this.cache, doctype)) {
+      this.cache.set(cacheKey2, res.data, getCacheTtlMs());
+    }
     return res.data;
   }
   /**
@@ -42083,6 +41867,7 @@ var FrappeClient = class {
    */
   invalidate(doctype, name) {
     const clear = (cache2) => {
+      bumpInvalidationGeneration(cache2, doctype);
       cache2.deleteByPrefix(`list:${doctype}:`);
       cache2.deleteByPrefix(`resolve:miss:${doctype}:`);
       if (name) cache2.delete(`get:${doctype}:${name}`);
@@ -42350,8 +42135,8 @@ async function currentUserId(client) {
 async function loadCallerProfile(client) {
   const key = cacheKey(client);
   const now = Date.now();
-  for (const [cached3, entry] of profileCache) {
-    if (entry.expiresAt <= now) profileCache.delete(cached3);
+  for (const [cached2, entry] of profileCache) {
+    if (entry.expiresAt <= now) profileCache.delete(cached2);
   }
   const hit = profileCache.get(key);
   if (hit && hit.expiresAt > now) return hit.profile;
@@ -42707,6 +42492,7 @@ async function applyAssignment(doctype, name, assignment, ctx, failureContext) {
     const reason = error2 instanceof Error ? error2.message : String(error2);
     throw new Error(`${failureContext}: ${reason}`, { cause: error2 });
   }
+  invalidateAssignment(doctype, name, nativeResult, ctx);
   const todos = Array.isArray(nativeResult) ? nativeResult.map((todo) => {
     const record2 = todo;
     return { owner: record2.owner, name: record2.name };
@@ -42725,15 +42511,26 @@ async function removeAssignment(doctype, name, assignee, ctx, failureContext) {
     const reason = error2 instanceof Error ? error2.message : String(error2);
     throw new Error(`${failureContext}: ${reason}`, { cause: error2 });
   }
+  invalidateAssignment(doctype, name, nativeResult, ctx);
   const todos = Array.isArray(nativeResult) ? nativeResult.map((todo) => {
     const record2 = todo;
     return { owner: record2.owner, name: record2.name };
   }) : [];
   return { removed: assignee, remaining: todos };
 }
+function invalidateAssignment(doctype, name, nativeResult, ctx) {
+  ctx.client.invalidate(doctype, name);
+  ctx.client.invalidate("ToDo");
+  if (!Array.isArray(nativeResult)) return;
+  for (const todo of nativeResult) {
+    if (typeof todo === "object" && todo !== null && typeof todo.name === "string" && todo.name.trim()) {
+      ctx.client.invalidate("ToDo", todo.name);
+    }
+  }
+}
 async function fetchDocAfterAssignment(doctype, name, ctx, toolName, action = "assignment") {
   try {
-    return await ctx.client.get(doctype, name);
+    return await ctx.client.get(doctype, name, { skipCache: true });
   } catch (error2) {
     const reason = error2 instanceof Error ? error2.message : String(error2);
     throw new Error(
@@ -44141,6 +43938,76 @@ var salesTools = [
 
 // src/tools/inventory.ts
 var inventoryTools = [
+  {
+    name: "erpnext_stock_ledger_list",
+    annotations: { readOnlyHint: true },
+    description: "List recent non-cancelled Stock Ledger Entries for one item and warehouse. Item accepts an ID or name; warehouse must be its exact ID. Returns {data: rows}, newest posting date/time/name first, with voucher and quantity fields.",
+    category: "inventory",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      required: ["item_code", "warehouse"],
+      properties: {
+        item_code: {
+          type: "string",
+          minLength: 1,
+          pattern: "\\S",
+          description: "Item ID or name"
+        },
+        warehouse: {
+          type: "string",
+          minLength: 1,
+          pattern: "\\S",
+          description: "Exact warehouse ID"
+        },
+        limit: {
+          type: "integer",
+          minimum: 1,
+          maximum: 20,
+          default: 5,
+          description: "Max results (default 5, maximum 20)"
+        }
+      }
+    },
+    handler: async (input, ctx) => {
+      for (const field of ["item_code", "warehouse"]) {
+        if (typeof input[field] !== "string" || !input[field].trim()) {
+          throw new Error(`'${field}' must be a non-empty string`);
+        }
+      }
+      const limit = input.limit === void 0 ? 5 : input.limit;
+      if (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1 || limit > 20) {
+        throw new Error("'limit' must be an integer between 1 and 20");
+      }
+      const itemCode = await resolveItem(
+        ctx.client,
+        input.item_code,
+        { inputPath: "item_code" }
+      );
+      const rows = await ctx.client.list("Stock Ledger Entry", {
+        fields: [
+          "name",
+          "item_code",
+          "warehouse",
+          "posting_date",
+          "posting_time",
+          "voucher_type",
+          "voucher_no",
+          "actual_qty",
+          "qty_after_transaction",
+          "stock_uom"
+        ],
+        filters: [["item_code", "=", itemCode], [
+          "warehouse",
+          "=",
+          input.warehouse
+        ], ["is_cancelled", "=", 0]],
+        order_by: "posting_date desc, posting_time desc, name desc",
+        limit
+      }, { skipCache: true });
+      return { data: rows };
+    }
+  },
   // ── Items ─────────────────────────────────────────────────────────────────
   {
     name: "erpnext_item_list",
@@ -44596,6 +44463,63 @@ var inventoryTools = [
   }
 ];
 
+// src/tools/analytics-pagination.ts
+var ANALYTICS_PAGE_SIZE = 1e3;
+var ANALYTICS_MAX_ROWS = 1e5;
+var ANALYTICS_MAX_REQUESTS = 1e3;
+function completePageOptions(options, offset) {
+  const order2 = options.order_by ?? "modified desc";
+  if (!/^[a-z_]+ (?:asc|desc)(?:,\s*[a-z_]+ (?:asc|desc))*$/.test(order2)) {
+    throw new Error("Analytics pagination requires explicit field ordering.");
+  }
+  return {
+    ...options,
+    fields: [.../* @__PURE__ */ new Set([...options.fields ?? [], "name"])],
+    order_by: order2.split(",").some((part) => part.trim().startsWith("name ")) ? order2 : `${order2}, name asc`,
+    limit: ANALYTICS_PAGE_SIZE,
+    limit_start: offset
+  };
+}
+async function listCompleteAnalytics(list, doctype, options, budget = { requests: 0, rows: 0 }) {
+  const result = [];
+  const names = /* @__PURE__ */ new Set();
+  for (let offset = 0; ; offset += ANALYTICS_PAGE_SIZE) {
+    if (budget.requests >= ANALYTICS_MAX_REQUESTS) {
+      throw new Error(
+        `Analytics ${doctype} cannot prove completeness within the ${ANALYTICS_MAX_REQUESTS} request safety limit.`
+      );
+    }
+    budget.requests++;
+    const rows = await list(doctype, completePageOptions(options, offset));
+    if (!Array.isArray(rows) || rows.length > ANALYTICS_PAGE_SIZE) {
+      throw new Error(
+        `Analytics ${doctype} returned an invalid or oversized page.`
+      );
+    }
+    budget.rows += rows.length;
+    if (budget.rows > ANALYTICS_MAX_ROWS) {
+      throw new Error(
+        `Analytics ${doctype} cannot prove completeness within the ${ANALYTICS_MAX_ROWS} row safety limit.`
+      );
+    }
+    for (const row of rows) {
+      if (!row || typeof row !== "object" || Array.isArray(row) || typeof row.name !== "string" || row.name.trim() === "") {
+        throw new Error(
+          `Analytics ${doctype} returned a row without a valid name.`
+        );
+      }
+      if (names.has(row.name)) {
+        throw new Error(
+          `Analytics ${doctype} pagination did not make unique progress; data may have changed during the read.`
+        );
+      }
+      names.add(row.name);
+      result.push(row);
+    }
+    if (rows.length < ANALYTICS_PAGE_SIZE) return result;
+  }
+}
+
 // src/tools/query-report.ts
 var FINANCIAL_REPORTS = [
   "Accounts Payable",
@@ -44663,6 +44587,85 @@ function cellNumber(value) {
   }
   return null;
 }
+async function receivableInvoiceRows(ctx, company, currency, reportDate) {
+  const report = await runQueryReport(ctx, "Accounts Receivable", {
+    company,
+    report_date: reportDate,
+    in_party_currency: 0,
+    based_on_payment_terms: 0,
+    group_by_party: 0
+  });
+  if (report.result.length > ANALYTICS_MAX_ROWS) {
+    throw new Error(
+      `Accounts Receivable exceeds the ${ANALYTICS_MAX_ROWS} row safety limit; no partial balance will be reported.`
+    );
+  }
+  const invoices = [];
+  const voucherKeys = /* @__PURE__ */ new Set();
+  for (const row of report.result) {
+    if (row === null || typeof row !== "object" || Array.isArray(row)) {
+      throw new Error("Accounts Receivable returned an invalid row.");
+    }
+    if (row.voucher_type !== "Sales Invoice") continue;
+    if (typeof row.voucher_no !== "string" || row.voucher_no === "") {
+      throw new Error(
+        "Accounts Receivable returned a Sales Invoice without voucher_no."
+      );
+    }
+    if (typeof row.party_account !== "string" || row.party_account === "" || typeof row.party !== "string" || row.party === "") {
+      throw new Error(
+        `Accounts Receivable invoice '${row.voucher_no}' has no ledger ownership key.`
+      );
+    }
+    const key = JSON.stringify([
+      row.party_account,
+      row.voucher_type,
+      row.voucher_no,
+      row.party
+    ]);
+    if (voucherKeys.has(key)) {
+      throw new Error(
+        `Accounts Receivable returned a duplicate ledger balance for invoice '${row.voucher_no}'.`
+      );
+    }
+    voucherKeys.add(key);
+    if (row.currency !== currency) {
+      throw new Error(
+        `Accounts Receivable invoice '${row.voucher_no}' has missing or unexpected currency; expected ${currency}.`
+      );
+    }
+    const amount = cellNumber(row.outstanding);
+    if (amount === null) {
+      throw new Error(
+        `Accounts Receivable invoice '${row.voucher_no}' has an invalid outstanding amount.`
+      );
+    }
+    if (amount <= 0) continue;
+    const postingDate = row.posting_date;
+    const dueDate = row.due_date || postingDate;
+    for (const value of [postingDate, dueDate]) {
+      if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(value) || !Number.isFinite(Date.parse(value))) {
+        throw new Error(
+          `Accounts Receivable invoice '${row.voucher_no}' has an invalid date.`
+        );
+      }
+    }
+    const name = row.customer_name || row.party_name || row.party;
+    if (typeof name !== "string" || name === "") {
+      throw new Error(
+        `Accounts Receivable invoice '${row.voucher_no}' has no customer identity.`
+      );
+    }
+    invoices.push({
+      voucher_no: row.voucher_no,
+      customer_name: name,
+      outstanding_amount: amount,
+      posting_date: postingDate,
+      due_date: dueDate
+    });
+  }
+  return invoices;
+}
 
 // src/tools/accounting.ts
 var DEFAULT_REPORT_ROWS = 100;
@@ -45187,14 +45190,14 @@ var accountingTools = [
 ];
 
 // src/tools/site-date.ts
-async function siteTimeZone(ctx) {
+async function resolveTimeZone(ctx) {
   try {
     const value = await ctx.client.callMethod(
       "frappe.client.get_value",
       { doctype: "System Settings", fieldname: "time_zone" },
       { httpMethod: "GET" }
     );
-    if (value?.time_zone) return value.time_zone;
+    if (value?.time_zone) return { zone: value.time_zone, authoritative: true };
   } catch {
   }
   try {
@@ -45203,29 +45206,105 @@ async function siteTimeZone(ctx) {
       {},
       { httpMethod: "GET" }
     );
-    if (value?.time_zone) return value.time_zone;
+    if (value?.time_zone) {
+      return { zone: value.time_zone, authoritative: false };
+    }
   } catch {
   }
-  return null;
+  return { zone: null, authoritative: false };
 }
-async function siteToday(ctx) {
-  const timeZone = await siteTimeZone(ctx);
+async function siteNow(ctx) {
+  const { zone, authoritative } = await resolveTimeZone(ctx);
   const now = /* @__PURE__ */ new Date();
-  if (timeZone) {
+  if (zone) {
     try {
-      return new Intl.DateTimeFormat("en-CA", {
-        timeZone,
+      const formatted = new Intl.DateTimeFormat("en-CA", {
+        timeZone: zone,
         year: "numeric",
         month: "2-digit",
-        day: "2-digit"
-      }).format(now);
+        day: "2-digit",
+        hour: "2-digit",
+        minute: "2-digit",
+        second: "2-digit",
+        // `h23` chứ không phải `hour12: false`: nhánh 12 giờ tắt vẫn cho ra "24:00:00" ở
+        // nửa đêm trên một số runtime, và "24" không phải giờ hợp lệ của một chuỗi Datetime.
+        hourCycle: "h23"
+      }).format(now).replace(", ", " ");
+      return { now: formatted, authoritative };
     } catch {
     }
   }
-  return now.toISOString().slice(0, 10);
+  return {
+    now: now.toISOString().slice(0, 19).replace("T", " "),
+    authoritative: false
+  };
+}
+async function siteToday(ctx) {
+  return (await siteNow(ctx)).now.slice(0, 10);
 }
 
 // src/tools/hr.ts
+var MIN_FIX_REASON = 10;
+var REQUIRES_HVG_WORKSPACE = "Requires the 'hvg_workspace' app on the site; without it the call fails and the generic erpnext_doc_* tools are the only route.";
+var METHOD_LOOKUP_FAILURE = /Failed to get method|Method Not Found/i;
+async function callHvgWorkspace(ctx, method, args, tool) {
+  try {
+    return await ctx.client.callMethod(method, args);
+  } catch (err) {
+    const text = err instanceof Error ? err.message : String(err);
+    const body = err instanceof FrappeAPIError && err.body !== null ? JSON.stringify(err.body) : "";
+    if (METHOD_LOOKUP_FAILURE.test(text) || METHOD_LOOKUP_FAILURE.test(body)) {
+      throw new Error(
+        `[${tool}] this site does not expose '${method}'. These attendance repair tools need the 'hvg_workspace' app installed. Original error: ` + text,
+        { cause: err }
+      );
+    }
+    throw err;
+  }
+}
+async function readAttendanceDay(ctx, employee, date3, tool) {
+  return await callHvgWorkspace(
+    ctx,
+    "hvg_workspace.api.hr_get_day_attendance",
+    { employee, date: date3 },
+    tool
+  );
+}
+function nextDayISO(date3, tool) {
+  const parsed = /* @__PURE__ */ new Date(`${date3}T00:00:00Z`);
+  const roundTrip = Number.isNaN(parsed.getTime()) ? null : parsed.toISOString().slice(0, 10);
+  if (roundTrip !== date3) {
+    throw new Error(
+      `[${tool}] '${date3}' is not a real calendar date. Use YYYY-MM-DD.`
+    );
+  }
+  parsed.setUTCDate(parsed.getUTCDate() + 1);
+  return parsed.toISOString().slice(0, 10);
+}
+function normalizeStamp(time3) {
+  return time3.replace("T", " ").slice(0, 19);
+}
+function assertLogType(value, tool) {
+  const text = String(value ?? "").toUpperCase();
+  if (text !== "IN" && text !== "OUT") {
+    throw new Error(
+      `[${tool}] log_type must be 'IN' or 'OUT', got ${JSON.stringify(value)}.`
+    );
+  }
+}
+function orderedPunches(target, tool) {
+  const blank = target.filter((row) => !row.log_type);
+  if (blank.length > 0) {
+    throw new Error(
+      `[${tool}] these punches carry no log_type in ERPNext: ` + blank.map((row) => `${row.name} (${row.time})`).join(", ") + ". The site refuses a save with a blank direction, and this tool does not guess one. Name each of them in 'edit' with the log_type it should carry."
+    );
+  }
+  return [...target].sort((a, b) => a.time.localeCompare(b.time)).map((row) => ({
+    name: row.name,
+    time: row.time,
+    log_type: row.log_type
+  }));
+}
 var hrTools = [
   // ── Employees ─────────────────────────────────────────────────────────────
   {
@@ -45405,6 +45484,345 @@ var hrTools = [
       });
     }
   },
+  // ── Employee Checkins & day repair ────────────────────────────────────────
+  {
+    name: "erpnext_employee_checkin_list",
+    annotations: { readOnlyHint: true },
+    _meta: DOCLIST_META,
+    description: "List Employee Checkin punches for an employee over a date range. This is the raw punch log behind Attendance, so it is where a broken day shows up: a day with an odd number of punches never closed, and a punch whose 'attendance' is empty was never counted. 'skip_auto_attendance' = 1 means auto attendance already refused this punch, which is what happens when a checkin is added to a day that already carries an Attendance record. Fields: name, employee, employee_name, time, log_type, shift, attendance, skip_auto_attendance. Use erpnext_attendance_day_get for the authoritative per-day view, and erpnext_attendance_day_fix to repair a day.",
+    category: "hr",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: {
+          type: "number",
+          minimum: 1,
+          description: "Max results (default 50)"
+        },
+        employee: {
+          type: "string",
+          description: "Filter by employee ID or name (e.g. 'HR-EMP-00001' or 'John Doe')"
+        },
+        log_type: {
+          type: "string",
+          description: "Filter by direction. Devices that do not report a direction leave this empty, so filtering on it can hide real punches.",
+          enum: ["IN", "OUT"]
+        },
+        date_from: {
+          type: "string",
+          description: "Start date filter YYYY-MM-DD (time >=, from 00:00:00)"
+        },
+        date_to: {
+          type: "string",
+          description: "End date filter YYYY-MM-DD (time <=, up to 23:59:59)"
+        }
+      }
+    },
+    handler: async (input, ctx) => {
+      const limit = input.limit ?? 50;
+      const filters = [];
+      if (input.employee) {
+        filters.push([
+          "employee",
+          "=",
+          await resolveEmployee(ctx.client, input.employee, {
+            inputPath: "employee"
+          })
+        ]);
+      }
+      if (input.log_type) {
+        filters.push(["log_type", "=", input.log_type]);
+      }
+      if (input.date_from) {
+        filters.push(["time", ">=", `${input.date_from} 00:00:00`]);
+      }
+      if (input.date_to) {
+        filters.push([
+          "time",
+          "<",
+          `${nextDayISO(
+            input.date_to,
+            "erpnext_employee_checkin_list"
+          )} 00:00:00`
+        ]);
+      }
+      const docs = await ctx.client.list("Employee Checkin", {
+        fields: [
+          "name",
+          "employee",
+          "employee_name",
+          "time",
+          "log_type",
+          "shift",
+          "attendance",
+          "skip_auto_attendance"
+        ],
+        filters,
+        limit,
+        order_by: "time asc"
+      });
+      return await listResult(ctx, "Employee Checkin", docs, {
+        filters,
+        limit
+      });
+    }
+  },
+  {
+    name: "erpnext_attendance_day_get",
+    annotations: { readOnlyHint: true },
+    description: "Read one employee's full attendance picture for ONE day: every punch, the shift that governs it, the minutes worked as this site computes them, and the Attendance record standing in the way of a repair. Read this before calling erpnext_attendance_day_fix: 'locked' true means the day already carries a submitted Attendance, so fixing it CANCELS that record and rebuilds it, and the fix tool will refuse without confirm_cancel_attendance. 'blocked' true means the fix cannot proceed at all (a draft Attendance, or one backed by a still-valid Attendance Request); 'locked_reason' says which. 'is_self' true means the API user may not edit this employee - the site enforces segregation of duties. " + REQUIRES_HVG_WORKSPACE,
+    category: "hr",
+    inputSchema: {
+      type: "object",
+      properties: {
+        employee: {
+          type: "string",
+          description: "Employee ID or name (e.g. 'HR-EMP-00001' or 'John Doe')"
+        },
+        date: { type: "string", description: "The day to read, YYYY-MM-DD" }
+      },
+      required: ["employee", "date"]
+    },
+    handler: async (input, ctx) => {
+      if (!input.employee) {
+        throw new Error("[erpnext_attendance_day_get] 'employee' is required");
+      }
+      if (!input.date) {
+        throw new Error("[erpnext_attendance_day_get] 'date' is required");
+      }
+      const employee = await resolveEmployee(
+        ctx.client,
+        input.employee,
+        { inputPath: "employee" }
+      );
+      const state = await readAttendanceDay(
+        ctx,
+        employee,
+        input.date,
+        "erpnext_attendance_day_get"
+      );
+      return { data: state };
+    }
+  },
+  {
+    name: "erpnext_attendance_day_fix",
+    annotations: {
+      readOnlyHint: false,
+      // Huỷ một bản Attendance đã duyệt là thao tác không hoàn tác được bằng chính tool
+      // này, nên hint phải nói thật kể cả khi phần lớn lượt gọi chỉ thêm một lượt bấm.
+      destructiveHint: true,
+      idempotentHint: false
+    },
+    description: "Repair ONE employee's attendance for ONE day: add the missing punches, correct the wrong ones, and rebuild that day's Attendance from the result. This is the tool for the 'a day is missing its check-out' case. Adding an Employee Checkin on its own does NOT fix such a day - HRMS refuses to build a second Attendance for a day that already has one and silently marks the new punch skipped - so the day is repaired by cancelling the stale Attendance and recomputing, which is what this tool does in a single transaction. Pass punches to create in 'add' and corrections in 'edit'; punches you do not mention are left alone. Deleting a punch is not possible here by design. 'reason' is written to the audit trail and is required. When the day already carries a submitted Attendance, the call is refused unless confirm_cancel_attendance is true, because saving cancels that record. Refuses outright for a future date, a timestamp that has not happened yet, an unusable log_type, a draft Attendance on the day, or an Attendance backed by a still-valid Attendance Request. It also refuses when a punch already on the day carries a blank log_type: name that punch in 'edit' with the direction it should carry, because this tool does not guess one. " + REQUIRES_HVG_WORKSPACE,
+    category: "hr",
+    inputSchema: {
+      type: "object",
+      properties: {
+        employee: {
+          type: "string",
+          description: "Employee ID or name (e.g. 'HR-EMP-00001' or 'John Doe')"
+        },
+        date: { type: "string", description: "The day to repair, YYYY-MM-DD" },
+        reason: {
+          type: "string",
+          description: `Why the punches are being changed, at least ${MIN_FIX_REASON} characters. Stored on the audit trail; it is the only record of why the hours moved.`
+        },
+        add: {
+          type: "array",
+          description: "Punches to create on this day.",
+          items: {
+            type: "object",
+            properties: {
+              log_type: {
+                type: "string",
+                description: "Direction of the punch",
+                enum: ["IN", "OUT"]
+              },
+              time: {
+                type: "string",
+                description: "When the punch happened, 'YYYY-MM-DD HH:MM:SS'. Must fall inside the day's shift window - see 'shift.window_start' / 'shift.window_end' from erpnext_attendance_day_get."
+              }
+            },
+            required: ["log_type", "time"]
+          }
+        },
+        edit: {
+          type: "array",
+          description: "Corrections to punches that already exist. Identify each by its Employee Checkin name from erpnext_attendance_day_get.",
+          items: {
+            type: "object",
+            properties: {
+              name: {
+                type: "string",
+                description: "Employee Checkin ID, e.g. 'EMP-CKIN-08-2026-00123'"
+              },
+              log_type: {
+                type: "string",
+                description: "New direction; omit to keep the current one",
+                enum: ["IN", "OUT"]
+              },
+              time: {
+                type: "string",
+                description: "New timestamp 'YYYY-MM-DD HH:MM:SS'; omit to keep the current one"
+              }
+            },
+            required: ["name"]
+          }
+        },
+        confirm_cancel_attendance: {
+          type: "boolean",
+          description: "Acknowledge that the day's submitted Attendance will be cancelled and rebuilt. Required only when erpnext_attendance_day_get reports 'locked': true.",
+          default: false
+        }
+      },
+      required: ["employee", "date", "reason"]
+    },
+    handler: async (input, ctx) => {
+      const TOOL = "erpnext_attendance_day_fix";
+      if (!input.employee) throw new Error(`[${TOOL}] 'employee' is required`);
+      if (!input.date) throw new Error(`[${TOOL}] 'date' is required`);
+      const reason = String(input.reason ?? "").trim();
+      if (reason.length < MIN_FIX_REASON) {
+        throw new Error(
+          `[${TOOL}] 'reason' must be at least ${MIN_FIX_REASON} characters. It is the only thing that explains the change to whoever reads the audit trail later.`
+        );
+      }
+      const adds = input.add ?? [];
+      const edits = input.edit ?? [];
+      if (adds.length === 0 && edits.length === 0) {
+        throw new Error(
+          `[${TOOL}] nothing to do: pass at least one punch in 'add' or 'edit'.`
+        );
+      }
+      for (const row of adds) {
+        assertLogType(row.log_type, TOOL);
+        if (!row.time) {
+          throw new Error(`[${TOOL}] every entry in 'add' needs a 'time'.`);
+        }
+      }
+      for (const row of edits) {
+        if (!row.name) {
+          throw new Error(
+            `[${TOOL}] every entry in 'edit' needs the Employee Checkin 'name'.`
+          );
+        }
+        if (row.log_type !== void 0) assertLogType(row.log_type, TOOL);
+      }
+      const date3 = input.date;
+      const { now, authoritative: exactClock } = await siteNow(ctx);
+      const today = now.slice(0, 10);
+      if (date3 > today) {
+        throw new Error(
+          `[${TOOL}] '${date3}' is in the future (site today is ${today}). Attendance can only be repaired for a day that has already happened.`
+        );
+      }
+      const employee = await resolveLink(
+        ctx.client,
+        "Employee",
+        input.employee,
+        "employee_name",
+        // Write path — see purchasing.ts: no fuzzy matching on writes.
+        { allowPartialMatch: false, inputPath: "employee" }
+      );
+      const state = await readAttendanceDay(ctx, employee, date3, TOOL);
+      const current = state.rows ?? [];
+      if (state.blocked) {
+        throw new Error(
+          `[${TOOL}] ${date3} cannot be repaired as it stands. ` + (state.locked_reason ?? "The site reports the day as blocked.") + " Resolve that in ERPNext first."
+        );
+      }
+      if (state.locked && input.confirm_cancel_attendance !== true) {
+        throw new Error(
+          `[${TOOL}] ${date3} already has an Attendance record` + (state.attendance?.name ? ` (${state.attendance.name})` : "") + ". Saving cancels it and rebuilds the day from the punches. Pass confirm_cancel_attendance: true to proceed. " + (state.locked_reason ? `Site says: ${state.locked_reason}` : "")
+        );
+      }
+      const byName = new Map(current.map((row) => [row.name, row]));
+      for (const row of edits) {
+        if (!byName.has(row.name)) {
+          throw new Error(
+            `[${TOOL}] checkin '${row.name}' is not one of ${date3}'s punches. Read them with erpnext_attendance_day_get first.`
+          );
+        }
+      }
+      const edited = /* @__PURE__ */ new Map();
+      for (const row of edits) {
+        const name = row.name;
+        if (edited.has(name)) {
+          throw new Error(
+            `[${TOOL}] checkin '${name}' appears twice in 'edit'. Put every change to one punch in a single entry.`
+          );
+        }
+        edited.set(name, row);
+      }
+      const target = current.map((row) => {
+        const patch = edited.get(row.name);
+        return {
+          name: row.name,
+          time: normalizeStamp(patch?.time ?? row.time),
+          log_type: patch?.log_type ?? row.log_type
+        };
+      });
+      for (const row of adds) {
+        target.push({
+          name: "",
+          time: normalizeStamp(row.time),
+          log_type: row.log_type
+        });
+      }
+      const rows = orderedPunches(target, TOOL);
+      const future = exactClock ? rows.filter((row) => row.time > now) : [];
+      if (future.length > 0) {
+        throw new Error(
+          `[${TOOL}] these punches are still in the future (site now is ${now}): ` + future.map((row) => row.time).join(", ") + ". Attendance can only record time that has already been worked."
+        );
+      }
+      const base = {};
+      for (const row of current) {
+        base[row.name] = { time: row.time, log_type: row.log_type ?? "" };
+      }
+      const saved = await callHvgWorkspace(
+        ctx,
+        "hvg_workspace.api.hr_save_day_attendance",
+        { employee, date: date3, reason, rows, base },
+        TOOL
+      );
+      ctx.client.invalidate("Employee Checkin");
+      for (const row of current) {
+        ctx.client.invalidate("Employee Checkin", row.name);
+      }
+      for (const name of saved.cancelled_attendance ?? []) {
+        ctx.client.invalidate("Attendance", name);
+      }
+      ctx.client.invalidate("Attendance", saved.attendance?.name);
+      const cancelled = saved.cancelled_attendance ?? [];
+      const parts = [
+        `Attendance for ${employee} on ${date3} rebuilt`,
+        `${saved.changed_count ?? 0} punch(es) written`
+      ];
+      if (cancelled.length > 0) {
+        parts.push(`cancelled ${cancelled.join(", ")}`);
+      }
+      if (cancelled.length > 0 && input.confirm_cancel_attendance !== true) {
+        parts.push(
+          `WARNING: ${cancelled.join(", ")} was cancelled even though this call did not confirm a cancellation - the record appeared between the read and the save. Check that the rebuilt day is what you expected`
+        );
+      }
+      if (saved.attendance?.name) {
+        parts.push(
+          `now ${saved.attendance.name} ${saved.attendance.status} (${saved.attendance.working_hours ?? 0}h)`
+        );
+      }
+      if (saved.recompute?.skipped) {
+        parts.push(
+          `WARNING: the day could not be recomputed (${saved.recompute.skipped}), so it still has no Attendance record`
+        );
+      }
+      if (saved.no_change) {
+        parts.push("no punch actually differed from what was already stored");
+      }
+      return { data: saved, message: `${parts.join("; ")}.` };
+    }
+  },
   // ── Leave Applications ────────────────────────────────────────────────────
   {
     name: "erpnext_leave_application_list",
@@ -46037,7 +46455,9 @@ var TASK_LIST_FIELDS = [
   "progress"
 ];
 var TASK_SKU_FIELD = "custom_sku";
-var taskSkuSupport = /* @__PURE__ */ new WeakMap();
+var TASK_PRODUCT_TYPE_FIELD = "custom_product_type";
+var TASK_OPTIONAL_FIELDS = [TASK_SKU_FIELD, TASK_PRODUCT_TYPE_FIELD];
+var taskMissingFields = /* @__PURE__ */ new WeakMap();
 var UNKNOWN_COLUMN_RE = /Unknown column \\?['"`]([^'"`\\]+)/i;
 function isUnknownColumnError(error2, field) {
   if (!(error2 instanceof FrappeAPIError)) return false;
@@ -46135,7 +46555,7 @@ var projectTools = [
     name: "erpnext_task_list",
     annotations: { readOnlyHint: true },
     _meta: DOCLIST_META,
-    description: "List Tasks. Filterable by project, status, priority. Fields: name, subject, project, status, priority, exp_start_date, exp_end_date, progress. Sites carrying hvg_workspace also get 'custom_sku'; it is absent elsewhere. Where present it is empty for every Task created before that field shipped and never backfilled, so an empty value means 'not recorded here', never 'no product'.",
+    description: "List Tasks. Filterable by project, status, priority. Fields: name, subject, project, status, priority, exp_start_date, exp_end_date, progress. Sites carrying hvg_workspace also get 'custom_sku' and 'custom_product_type'; both are absent elsewhere, and a site may carry the first without the second. Where present they are empty for every Task created before each field shipped and never backfilled, so an empty value means 'not recorded here', never 'no product'.",
     category: "project",
     inputSchema: {
       type: "object",
@@ -46194,23 +46614,31 @@ var projectTools = [
         filters.push(["exp_end_date", "<=", input.date_to]);
       }
       const query = { filters, limit, order_by: "modified desc" };
-      const askForSku = taskSkuSupport.get(ctx.client) !== false;
+      const missing = taskMissingFields.get(ctx.client);
+      let optional2 = TASK_OPTIONAL_FIELDS.filter(
+        (field) => !missing?.has(field)
+      );
       let docs;
-      try {
-        docs = await ctx.client.list("Task", {
-          fields: askForSku ? [...TASK_LIST_FIELDS, TASK_SKU_FIELD] : TASK_LIST_FIELDS,
-          ...query
-        });
-        if (askForSku) taskSkuSupport.set(ctx.client, true);
-      } catch (error2) {
-        if (!askForSku || !isUnknownColumnError(error2, TASK_SKU_FIELD)) {
-          throw error2;
+      for (; ; ) {
+        try {
+          docs = await ctx.client.list("Task", {
+            fields: [...TASK_LIST_FIELDS, ...optional2],
+            ...query
+          });
+          break;
+        } catch (error2) {
+          const absent = optional2.find(
+            (field) => isUnknownColumnError(error2, field)
+          );
+          if (absent === void 0) throw error2;
+          let known = taskMissingFields.get(ctx.client);
+          if (known === void 0) {
+            known = /* @__PURE__ */ new Set();
+            taskMissingFields.set(ctx.client, known);
+          }
+          known.add(absent);
+          optional2 = optional2.filter((field) => field !== absent);
         }
-        taskSkuSupport.set(ctx.client, false);
-        docs = await ctx.client.list("Task", {
-          fields: TASK_LIST_FIELDS,
-          ...query
-        });
       }
       return await listResult(ctx, "Task", docs, {
         filters,
@@ -49458,11 +49886,205 @@ var setupTools = [
   }
 ];
 
-// src/tools/analytics.ts
-var MAX_RADAR_ITEMS = 8;
-var MAX_PL_MONTHS = 60;
+// src/tools/analytics-dates.ts
+var MONTH_NAMES = [
+  "Jan",
+  "Feb",
+  "Mar",
+  "Apr",
+  "May",
+  "Jun",
+  "Jul",
+  "Aug",
+  "Sep",
+  "Oct",
+  "Nov",
+  "Dec"
+];
+function analyticsDateWindow(today, monthsBack = 1) {
+  const [year, month, day] = today.split("-").map(Number);
+  const date3 = (monthIndex, dayOfMonth = 1) => new Date(Date.UTC(year, monthIndex, dayOfMonth)).toISOString().slice(0, 10);
+  const monthKeys = [];
+  const labels = [];
+  for (let offset = 0; offset < monthsBack; offset++) {
+    const start = date3(month - monthsBack + offset);
+    monthKeys.push(start.slice(0, 7));
+    labels.push(
+      `${MONTH_NAMES[Number(start.slice(5, 7)) - 1]} ${start.slice(2, 4)}`
+    );
+  }
+  return {
+    start: date3(month - monthsBack),
+    end: today,
+    nextDay: date3(month - 1, day + 1),
+    previousStart: date3(month - 2),
+    previousEnd: date3(month - 1, 0),
+    quarterStart: date3(Math.floor((month - 1) / 3) * 3),
+    yearStart: date3(0),
+    monthKeys,
+    labels
+  };
+}
+function analyticsMonthIndex(date3, monthKeys) {
+  return monthKeys.indexOf(date3.slice(0, 7));
+}
+
+// src/tools/analytics-context.ts
+var SCOPE_REQUEST_TARGET_BUDGET = 6e3;
+function listRequestTargetLength(doctype, options) {
+  const params = new URLSearchParams();
+  if (options.fields?.length) {
+    params.set("fields", JSON.stringify(options.fields));
+  }
+  if (options.filters?.length) {
+    params.set("filters", JSON.stringify(options.filters));
+  }
+  if (options.order_by) params.set("order_by", options.order_by);
+  if (options.limit !== void 0) params.set("limit", String(options.limit));
+  if (options.limit_start !== void 0) {
+    params.set("limit_start", String(options.limit_start));
+  }
+  params.set("as_dict", "1");
+  return `/api/resource/${encodeURIComponent(doctype)}?${params}`.length;
+}
+function chunkRequestNames(doctype, names, queryOptions) {
+  const chunks = [];
+  let current = [];
+  for (const name of new Set(names)) {
+    const candidate = [...current, name];
+    if (listRequestTargetLength(doctype, queryOptions(candidate)) <= SCOPE_REQUEST_TARGET_BUDGET) {
+      current = candidate;
+      continue;
+    }
+    if (current.length) chunks.push(current);
+    current = [name];
+    if (listRequestTargetLength(doctype, queryOptions(current)) > SCOPE_REQUEST_TARGET_BUDGET) {
+      throw new Error(
+        `Analytics ${doctype} scope cannot fit within the encoded request budget.`
+      );
+    }
+  }
+  if (current.length) chunks.push(current);
+  return chunks;
+}
+async function listAnalyticsItemUnits(ctx, names) {
+  const queryOptions = (chunk) => ({
+    fields: ["name", "stock_uom"],
+    filters: [["name", "in", chunk]],
+    limit: chunk.length,
+    order_by: "name asc"
+  });
+  const chunks = chunkRequestNames("Item", names, queryOptions);
+  if (names.length > ANALYTICS_MAX_ROWS || chunks.length > ANALYTICS_MAX_REQUESTS) {
+    throw new Error(
+      "Analytics Item UOM lookup exceeds its safety budget; no partial chart will be reported."
+    );
+  }
+  const result = [];
+  for (const chunk of chunks) {
+    const rows = await ctx.client.list("Item", queryOptions(chunk));
+    const remaining = new Set(chunk);
+    for (const row of rows) {
+      if (typeof row?.name !== "string" || !remaining.delete(row.name)) {
+        throw new Error(
+          "Analytics Item lookup returned a duplicate or unrequested name."
+        );
+      }
+    }
+    if (remaining.size) {
+      throw new Error(
+        "Analytics Item lookup is missing a requested item; verified stock UOM is unavailable."
+      );
+    }
+    result.push(...rows);
+  }
+  return result;
+}
+function sortScopedRows(rows, sortField) {
+  const candidates = rows.map((row) => {
+    let value;
+    if (sortField === "modified") {
+      const modified = row.modified;
+      if (typeof modified !== "string" || !/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(?:\.\d{1,6})?$/.test(modified)) {
+        throw new Error(
+          "Analytics scoped row has no valid modified timestamp for ordered merging."
+        );
+      }
+      value = modified.includes(".") ? modified.padEnd(26, "0") : `${modified}.000000`;
+    } else value = analyticsNumber(row, sortField);
+    return { row, value };
+  });
+  candidates.sort((a, b) => a.value < b.value ? 1 : a.value > b.value ? -1 : 0);
+  return candidates.map(({ row }) => row);
+}
+async function listScoped(ctx, doctype, options, scopeField, names, verify, extraFilters = [], completeBudget) {
+  const limit = normalizeLimit(options.limit ?? 20);
+  if (options.limit_start !== void 0 && options.limit_start !== 0) {
+    throw new Error("Analytics scoped reads do not support offsets.");
+  }
+  const orderBy = options.order_by ?? "modified desc";
+  if (!["base_amount desc", "stock_value desc", "modified desc"].includes(orderBy)) {
+    throw new Error(`Unsupported analytics scope order: '${orderBy}'.`);
+  }
+  const sortField = orderBy.split(" ")[0];
+  const queryOptions = (scopeNames) => ({
+    ...options,
+    fields: [.../* @__PURE__ */ new Set([...options.fields ?? [], sortField])],
+    filters: [
+      ...options.filters ?? [],
+      [scopeField, "in", scopeNames],
+      ...extraFilters
+    ],
+    limit,
+    order_by: orderBy
+  });
+  const chunks = chunkRequestNames(
+    doctype,
+    names,
+    (chunk) => completeBudget ? completePageOptions(queryOptions(chunk), ANALYTICS_MAX_ROWS) : queryOptions(chunk)
+  );
+  if (completeBudget) {
+    const result2 = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const chunk of chunks) {
+      const allowed = new Set(chunk);
+      const rows = await listCompleteAnalytics(
+        async (type, page) => {
+          const rows2 = await ctx.client.list(type, page);
+          for (const row of rows2) verify(row, allowed);
+          return rows2;
+        },
+        doctype,
+        queryOptions(chunk),
+        completeBudget
+      );
+      for (const row of rows) {
+        if (seen.has(row.name)) {
+          throw new Error(
+            `Analytics ${doctype} returned a duplicate row across scope chunks.`
+          );
+        }
+        seen.add(row.name);
+        result2.push(row);
+      }
+    }
+    return chunks.length > 1 ? sortScopedRows(result2, sortField) : result2;
+  }
+  let result = [];
+  for (const chunk of chunks) {
+    const rows = await ctx.client.list(doctype, queryOptions(chunk));
+    const allowed = new Set(chunk);
+    for (const row of rows) verify(row, allowed);
+    if (chunks.length === 1) return rows.slice(0, limit);
+    result = sortScopedRows([...result, ...rows], sortField).slice(0, limit);
+  }
+  return result;
+}
 async function resolveReportCompany(ctx, input) {
-  if (typeof input.company === "string" && input.company.trim() !== "") {
+  if (input.company !== void 0) {
+    if (typeof input.company !== "string" || input.company.trim() === "") {
+      throw new Error("'company' must be a non-empty Company name.");
+    }
     return input.company.trim();
   }
   const companies = await ctx.client.list("Company", {
@@ -49470,17 +50092,201 @@ async function resolveReportCompany(ctx, input) {
     limit: 21,
     order_by: "name asc"
   });
-  const names = companies.map((row) => row.name).filter((name) => typeof name === "string");
+  const names = companies.map((row) => row.name);
+  if (names.some((name) => typeof name !== "string" || name.trim() === "")) {
+    throw new Error("Company lookup returned an invalid name.");
+  }
   if (names.length === 1) return names[0];
   if (names.length === 0) {
     throw new Error(
-      "[erpnext_profit_loss] no Company is visible to you, so there is no chart of accounts to report on. Ask an administrator for access to a company."
+      "No Company is visible to you. Ask an administrator for access to a company."
     );
   }
   throw new Error(
-    `[erpnext_profit_loss] this site has ${names.length > 20 ? "more than 20" : names.length} companies, so 'company' is required. Pass one of: ${names.slice(0, 20).join(", ")}${names.length > 20 ? ", ..." : ""}.`
+    `Multiple companies are visible, so 'company' is required. Pass one of: ${names.slice(0, 20).join(", ")}${names.length > 20 ? ", ..." : ""}.`
   );
 }
+function analyticsNumber(row, field) {
+  const value = cellNumber(row[field]);
+  if (value === null) {
+    throw new Error(
+      `Analytics field '${field}' is missing or not a finite number; refusing to report zero.`
+    );
+  }
+  return value;
+}
+async function listOwnershipNames(listDocuments, doctype, filters = []) {
+  const pageSize = 1e3;
+  const maxNames = 1e5;
+  const names = /* @__PURE__ */ new Set();
+  for (let offset = 0; ; offset += pageSize) {
+    const rows = await listDocuments(doctype, {
+      fields: ["name"],
+      filters,
+      limit: pageSize,
+      limit_start: offset,
+      order_by: "name asc"
+    });
+    if (rows.length > pageSize) {
+      throw new Error(
+        `Analytics ${doctype} ownership page exceeds its requested size.`
+      );
+    }
+    for (const row of rows) {
+      const name = row?.name;
+      if (typeof name !== "string" || name.trim() === "") {
+        throw new Error(
+          `Analytics ${doctype} ownership lookup returned an invalid name.`
+        );
+      }
+      if (names.has(name)) {
+        throw new Error(
+          `Analytics ${doctype} ownership pagination did not make unique progress.`
+        );
+      }
+      names.add(name);
+      if (names.size > maxNames) {
+        throw new Error(
+          `Analytics ${doctype} ownership lookup exceeds the ${maxNames} name safety limit.`
+        );
+      }
+    }
+    if (rows.length < pageSize) return [...names];
+  }
+}
+async function resolveAnalyticsContext(ctx, input) {
+  const company = await resolveReportCompany(ctx, input);
+  const doc = await ctx.client.get("Company", company);
+  const currency = doc.default_currency;
+  if (typeof currency !== "string" || !/^[A-Z]{3}$/.test(currency)) {
+    throw new Error(`Company '${company}' has no valid default_currency.`);
+  }
+  const listDocuments = (doctype, options) => ctx.client.list(doctype, {
+    ...options,
+    filters: [...options.filters ?? [], ["company", "=", company]]
+  });
+  let warehouses;
+  const budget = { requests: 0, rows: 0 };
+  const listItems = async (parentType, options, complete = false) => {
+    const parentFilters = (options.filters ?? []).filter(
+      (filter) => filter[0] === "docstatus"
+    );
+    const names = await listOwnershipNames(
+      listDocuments,
+      parentType,
+      parentFilters
+    );
+    if (names.length === 0) return [];
+    return await listScoped(
+      ctx,
+      `${parentType} Item`,
+      {
+        ...options,
+        fields: [
+          .../* @__PURE__ */ new Set([...options.fields ?? [], "parent", "parenttype"])
+        ]
+      },
+      "parent",
+      names,
+      (row, allowed) => {
+        if (typeof row.parent !== "string" || !allowed.has(row.parent) || row.parenttype !== parentType) {
+          throw new Error(
+            `Analytics ${parentType} Item has unverified company ownership.`
+          );
+        }
+      },
+      [["parenttype", "=", parentType]],
+      complete ? budget : void 0
+    );
+  };
+  const listBins = async (options, complete = false) => {
+    warehouses ??= listOwnershipNames(listDocuments, "Warehouse");
+    const names = await warehouses;
+    if (names.length === 0) return [];
+    return await listScoped(
+      ctx,
+      "Bin",
+      {
+        ...options,
+        fields: [.../* @__PURE__ */ new Set([...options.fields ?? [], "warehouse"])]
+      },
+      "warehouse",
+      names,
+      (row, allowed) => {
+        if (typeof row.warehouse !== "string" || !allowed.has(row.warehouse)) {
+          throw new Error("Analytics Bin has unverified company ownership.");
+        }
+      },
+      [],
+      complete ? budget : void 0
+    );
+  };
+  return {
+    company,
+    currency,
+    listDocuments,
+    listItems,
+    listBins,
+    listAllDocuments: (doctype, options) => listCompleteAnalytics(listDocuments, doctype, options, budget),
+    listAllItems: (parentType, options) => listItems(parentType, options, true),
+    listAllBins: (options) => listBins(options, true)
+  };
+}
+function companyAnalyticsTool(tool) {
+  return {
+    ...tool,
+    inputSchema: {
+      ...tool.inputSchema,
+      properties: {
+        ...tool.inputSchema.properties,
+        company: {
+          type: "string",
+          description: "Company name. Optional only when exactly one Company is visible. Monetary values use its default currency."
+        }
+      }
+    },
+    handler: async (input, ctx) => {
+      const maxItems = tool.inputSchema.properties?.items?.maxItems;
+      if (Array.isArray(input.items) && typeof maxItems === "number" && input.items.length > maxItems) {
+        throw new Error(
+          `${tool.name} accepts at most ${maxItems} item codes, received ${input.items.length}.`
+        );
+      }
+      const context2 = await resolveAnalyticsContext(ctx, input);
+      const result = await tool.handler(input, ctx, context2);
+      if (result === null || typeof result !== "object" || Array.isArray(result)) {
+        throw new Error(`${tool.name} returned an invalid analytics result.`);
+      }
+      return {
+        ...result,
+        refreshRequest: {
+          toolName: tool.name,
+          arguments: { ...input, company: context2.company }
+        }
+      };
+    }
+  };
+}
+
+// src/tools/analytics.ts
+var MAX_RADAR_ITEMS = 8;
+var MAX_PL_MONTHS = 60;
+var MAX_REVENUE_MONTHS = 60;
+function revenueTrendTool(tool) {
+  const wrapped = companyAnalyticsTool(tool);
+  return {
+    ...wrapped,
+    handler: async (input, ctx) => {
+      const months = input.months === void 0 ? 6 : input.months;
+      if (typeof months !== "number" || !Number.isInteger(months) || months < 1 || months > MAX_REVENUE_MONTHS) {
+        throw new Error(
+          `[erpnext_revenue_trend] 'months' must be a whole number between 1 and ${MAX_REVENUE_MONTHS}`
+        );
+      }
+      return await wrapped.handler(input, ctx);
+    }
+  };
+}
 function utcDateString(instant) {
   return instant.toISOString().slice(0, 10);
 }
@@ -49525,27 +50331,31 @@ var analyticsTools = [
       }
       let allowedItems = null;
       if (input.item_group) {
-        const groupItems = await ctx.client.list("Item", {
-          fields: ["name"],
-          filters: [["item_group", "=", input.item_group]],
-          limit: 1e3
-        });
+        const groupItems = await listCompleteAnalytics(
+          ctx.client.list.bind(ctx.client),
+          "Item",
+          {
+            fields: ["name"],
+            filters: [["item_group", "=", input.item_group]]
+          }
+        );
         allowedItems = new Set(groupItems.map((i) => i.name));
       }
-      const bins = await ctx.client.list("Bin", {
-        fields: ["item_code", "warehouse", "actual_qty", "stock_value"],
-        filters,
-        // widen the fetch when filtering by group in memory, then slice below
-        limit: allowedItems ? 1e3 : limit,
-        order_by: "actual_qty desc"
-      });
+      const bins = await listCompleteAnalytics(
+        ctx.client.list.bind(ctx.client),
+        "Bin",
+        {
+          fields: ["item_code", "warehouse", "actual_qty"],
+          filters,
+          order_by: "actual_qty desc"
+        }
+      );
       const byItem = {};
       for (const bin of bins) {
         const item = bin.item_code;
         if (allowedItems && !allowedItems.has(item)) continue;
-        if (!byItem[item]) byItem[item] = { qty: 0, value: 0 };
-        byItem[item].qty += Number(bin.actual_qty) || 0;
-        byItem[item].value += Number(bin.stock_value) || 0;
+        if (!byItem[item]) byItem[item] = { qty: 0 };
+        byItem[item].qty += analyticsNumber(bin, "actual_qty");
       }
       const sorted = Object.entries(byItem).sort(([, a], [, b]) => b.qty - a.qty).slice(0, limit);
       const warehouseLabel = input.warehouse ?? "All Warehouses";
@@ -49569,7 +50379,7 @@ var analyticsTools = [
     }
   },
   // ── Sales Chart ───────────────────────────────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_sales_chart",
     annotations: { readOnlyHint: true },
     _meta: CHART_META,
@@ -49594,25 +50404,26 @@ var analyticsTools = [
         }
       }
     },
-    handler: async (input, ctx) => {
+    handler: async (input, _ctx, context2) => {
+      const { currency } = context2;
+      if (input.include_drafts !== void 0 && typeof input.include_drafts !== "boolean") {
+        throw new Error("'include_drafts' must be a boolean");
+      }
       const limit = normalizeLimit(input.limit ?? 10);
       const groupBy = input.group_by ?? "customer";
-      const filters = [];
-      if (!input.include_drafts) {
-        filters.push(["docstatus", "=", 1]);
-      }
+      const filters = [
+        input.include_drafts === true ? ["docstatus", "in", [0, 1]] : ["docstatus", "=", 1]
+      ];
       if (groupBy === "status") {
-        const invoices2 = await ctx.client.list("Sales Invoice", {
-          fields: ["name", "status", "grand_total"],
-          filters: [["docstatus", "!=", 2]],
-          // exclude cancelled
-          limit: 500,
+        const invoices2 = await context2.listAllDocuments("Sales Invoice", {
+          fields: ["name", "status", "base_grand_total"],
+          filters,
           order_by: "modified desc"
         });
         const byStatus = {};
         for (const inv of invoices2) {
           const s = inv.status ?? "Unknown";
-          byStatus[s] = (byStatus[s] ?? 0) + (Number(inv.grand_total) || 0);
+          byStatus[s] = (byStatus[s] ?? 0) + analyticsNumber(inv, "base_grand_total");
         }
         const sorted2 = Object.entries(byStatus).sort(([, a], [, b]) => b - a);
         return {
@@ -49620,17 +50431,16 @@ var analyticsTools = [
           type: "donut",
           labels: sorted2.map(([s]) => s),
           datasets: [{ label: "Revenue", values: sorted2.map(([, v]) => v) }],
-          currency: "EUR",
+          currency,
           generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
           _meta: CHART_META
         };
       }
       if (groupBy === "item") {
-        const items = await ctx.client.list("Sales Invoice Item", {
-          fields: ["item_code", "item_name", "amount"],
-          filters: [["docstatus", "=", 1]],
-          limit: 500,
-          order_by: "amount desc"
+        const items = await context2.listAllItems("Sales Invoice", {
+          fields: ["item_code", "item_name", "base_amount"],
+          filters,
+          order_by: "base_amount desc"
         });
         const byItem = {};
         for (const row of items) {
@@ -49641,7 +50451,7 @@ var analyticsTools = [
               total: 0
             };
           }
-          byItem[code].total += Number(row.amount) || 0;
+          byItem[code].total += analyticsNumber(row, "base_amount");
         }
         const sorted2 = Object.entries(byItem).sort(([, a], [, b]) => b.total - a.total).slice(0, limit);
         return {
@@ -49654,15 +50464,14 @@ var analyticsTools = [
             values: sorted2.map(([, { total }]) => total),
             color: "#c084fc"
           }],
-          currency: "EUR",
+          currency,
           generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
           _meta: CHART_META
         };
       }
-      const invoices = await ctx.client.list("Sales Invoice", {
-        fields: ["customer", "customer_name", "grand_total"],
+      const invoices = await context2.listAllDocuments("Sales Invoice", {
+        fields: ["customer", "customer_name", "base_grand_total"],
         filters,
-        limit: 500,
         order_by: "modified desc"
       });
       const byCustomer = {};
@@ -49674,7 +50483,7 @@ var analyticsTools = [
             total: 0
           };
         }
-        byCustomer[code].total += Number(inv.grand_total) || 0;
+        byCustomer[code].total += analyticsNumber(inv, "base_grand_total");
       }
       const sorted = Object.entries(byCustomer).sort(([, a], [, b]) => b.total - a.total).slice(0, limit);
       return {
@@ -49687,14 +50496,14 @@ var analyticsTools = [
           values: sorted.map(([, { total }]) => total),
           color: "#4ade80"
         }],
-        currency: "EUR",
+        currency,
         generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
         _meta: CHART_META
       };
     }
-  },
+  }),
   // ── Revenue Trend (line / area) ─────────────────────────────────────────
-  {
+  revenueTrendTool({
     name: "erpnext_revenue_trend",
     annotations: { readOnlyHint: true },
     _meta: CHART_META,
@@ -49704,8 +50513,11 @@ var analyticsTools = [
       type: "object",
       properties: {
         months: {
-          type: "number",
-          description: "How many months back to include (default 6)"
+          type: "integer",
+          minimum: 1,
+          maximum: MAX_REVENUE_MONTHS,
+          default: 6,
+          description: `How many months back to include (default 6, max ${MAX_REVENUE_MONTHS})`
         },
         type: {
           type: "string",
@@ -49719,45 +50531,38 @@ var analyticsTools = [
         }
       }
     },
-    handler: async (input, ctx) => {
+    handler: async (input, ctx, context2) => {
+      const { currency } = context2;
       const monthsBack = input.months ?? 6;
       const chartType = input.type ?? "line";
       const groupBy = input.group_by ?? "total";
-      const now = /* @__PURE__ */ new Date();
-      const startDate = new Date(
-        now.getFullYear(),
-        now.getMonth() - monthsBack + 1,
-        1
-      );
-      const startStr = startDate.toISOString().split("T")[0];
-      const orders = await ctx.client.list("Sales Order", {
-        fields: ["customer_name", "grand_total", "transaction_date"],
-        filters: [["transaction_date", ">=", startStr], ["docstatus", "!=", 2]],
-        limit: 1e3,
+      const window2 = analyticsDateWindow(await siteToday(ctx), monthsBack);
+      const orders = await context2.listAllDocuments("Sales Order", {
+        fields: ["customer_name", "base_grand_total", "transaction_date"],
+        filters: [
+          ["transaction_date", ">=", window2.start],
+          ["transaction_date", "<=", window2.end],
+          ["docstatus", "!=", 2]
+        ],
         order_by: "transaction_date asc"
       });
-      const months = [];
-      for (let m = 0; m < monthsBack; m++) {
-        const d = new Date(
-          now.getFullYear(),
-          now.getMonth() - monthsBack + 1 + m,
-          1
-        );
-        months.push(
-          `${d.toLocaleString("en", { month: "short" })} ${d.getFullYear().toString().slice(2)}`
-        );
-      }
+      const months = window2.labels;
       if (groupBy === "customer") {
         const byCustomerMonth = {};
         for (const order2 of orders) {
-          const d = new Date(order2.transaction_date);
-          const mIdx = (d.getFullYear() - startDate.getFullYear()) * 12 + d.getMonth() - startDate.getMonth();
+          const mIdx = analyticsMonthIndex(
+            order2.transaction_date,
+            window2.monthKeys
+          );
           if (mIdx < 0 || mIdx >= monthsBack) continue;
           const cust = order2.customer_name ?? "Unknown";
           if (!byCustomerMonth[cust]) {
             byCustomerMonth[cust] = new Array(monthsBack).fill(0);
           }
-          byCustomerMonth[cust][mIdx] += Number(order2.grand_total) || 0;
+          byCustomerMonth[cust][mIdx] += analyticsNumber(
+            order2,
+            "base_grand_total"
+          );
         }
         const sorted = Object.entries(byCustomerMonth).sort(
           ([, a], [, b]) => b.reduce((s, v) => s + v, 0) - a.reduce((s, v) => s + v, 0)
@@ -49775,17 +50580,19 @@ var analyticsTools = [
             showDots: chartType === "line",
             ...chartType === "stacked-area" ? { stack: "revenue" } : {}
           })),
-          currency: "EUR",
+          currency,
           yAxisLabel: "Revenue",
           _meta: CHART_META
         };
       }
       const monthlyTotals = new Array(monthsBack).fill(0);
       for (const order2 of orders) {
-        const d = new Date(order2.transaction_date);
-        const mIdx = (d.getFullYear() - startDate.getFullYear()) * 12 + d.getMonth() - startDate.getMonth();
+        const mIdx = analyticsMonthIndex(
+          order2.transaction_date,
+          window2.monthKeys
+        );
         if (mIdx >= 0 && mIdx < monthsBack) {
-          monthlyTotals[mIdx] += Number(order2.grand_total) || 0;
+          monthlyTotals[mIdx] += analyticsNumber(order2, "base_grand_total");
         }
       }
       return {
@@ -49799,14 +50606,14 @@ var analyticsTools = [
           color: "#60a5fa",
           showDots: true
         }],
-        currency: "EUR",
+        currency,
         yAxisLabel: "Revenue",
         _meta: CHART_META
       };
     }
-  },
+  }),
   // ── Order Breakdown (stacked bar / pie) ─────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_order_breakdown",
     annotations: { readOnlyHint: true },
     _meta: CHART_META,
@@ -49827,20 +50634,20 @@ var analyticsTools = [
         }
       }
     },
-    handler: async (input, ctx) => {
+    handler: async (input, _ctx, context2) => {
+      const { currency } = context2;
       const chartType = input.type ?? "stacked-bar";
       const limit = normalizeLimit(input.limit ?? 8);
-      const orders = await ctx.client.list("Sales Order", {
-        fields: ["customer_name", "status", "grand_total"],
+      const orders = await context2.listAllDocuments("Sales Order", {
+        fields: ["customer_name", "status", "base_grand_total"],
         filters: [["docstatus", "!=", 2]],
-        limit: 500,
         order_by: "modified desc"
       });
       if (chartType === "pie" || chartType === "donut") {
         const byCustomer = {};
         for (const o of orders) {
           const c = o.customer_name ?? "Unknown";
-          byCustomer[c] = (byCustomer[c] ?? 0) + (Number(o.grand_total) || 0);
+          byCustomer[c] = (byCustomer[c] ?? 0) + analyticsNumber(o, "base_grand_total");
         }
         const sorted = Object.entries(byCustomer).sort(([, a], [, b]) => b - a).slice(0, limit);
         return {
@@ -49848,7 +50655,7 @@ var analyticsTools = [
           type: chartType,
           labels: sorted.map(([c]) => c),
           datasets: [{ label: "Total", values: sorted.map(([, v]) => v) }],
-          currency: "EUR",
+          currency,
           _meta: CHART_META
         };
       }
@@ -49871,7 +50678,7 @@ var analyticsTools = [
         const c = o.customer_name ?? "Unknown";
         const s = o.status ?? "Draft";
         if (!byCustomerStatus[c]) byCustomerStatus[c] = {};
-        byCustomerStatus[c][s] = (byCustomerStatus[c][s] ?? 0) + (Number(o.grand_total) || 0);
+        byCustomerStatus[c][s] = (byCustomerStatus[c][s] ?? 0) + analyticsNumber(o, "base_grand_total");
       }
       const customerTotals = Object.entries(byCustomerStatus).map(([c, statuses]) => ({
         name: c,
@@ -49891,15 +50698,15 @@ var analyticsTools = [
           color: STATUS_COLORS[s] ?? "#94a3b8",
           stack: "status"
         })),
-        currency: "EUR",
+        currency,
         xAxisLabel: "Customer",
         yAxisLabel: "Order Value",
         _meta: CHART_META
       };
     }
-  },
+  }),
   // ── Revenue vs Orders Composed ──────────────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_revenue_vs_orders",
     annotations: { readOnlyHint: true },
     _meta: CHART_META,
@@ -49915,19 +50722,19 @@ var analyticsTools = [
         }
       }
     },
-    handler: async (input, ctx) => {
+    handler: async (input, _ctx, context2) => {
+      const { currency } = context2;
       const limit = normalizeLimit(input.limit ?? 8);
-      const orders = await ctx.client.list("Sales Order", {
-        fields: ["customer_name", "grand_total"],
+      const orders = await context2.listAllDocuments("Sales Order", {
+        fields: ["customer_name", "base_grand_total"],
         filters: [["docstatus", "!=", 2]],
-        limit: 500,
         order_by: "modified desc"
       });
       const byCustomer = {};
       for (const o of orders) {
         const c = o.customer_name ?? "Unknown";
         if (!byCustomer[c]) byCustomer[c] = { total: 0, count: 0 };
-        byCustomer[c].total += Number(o.grand_total) || 0;
+        byCustomer[c].total += analyticsNumber(o, "base_grand_total");
         byCustomer[c].count += 1;
       }
       const sorted = Object.entries(byCustomer).sort(([, a], [, b]) => b.total - a.total).slice(0, limit);
@@ -49953,15 +50760,15 @@ var analyticsTools = [
           }
         ],
         showRightAxis: true,
-        yAxisLabel: "Revenue (\u20AC)",
+        yAxisLabel: `Revenue (${currency})`,
         rightAxisLabel: "# Orders",
-        currency: "EUR",
+        currency,
         _meta: CHART_META
       };
     }
-  },
+  }),
   // ── Stock Value Treemap ─────────────────────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_stock_treemap",
     annotations: { readOnlyHint: true },
     _meta: CHART_META,
@@ -49982,19 +50789,19 @@ var analyticsTools = [
         }
       }
     },
-    handler: async (input, ctx) => {
+    handler: async (input, _ctx, context2) => {
+      const { currency } = context2;
       const groupBy = input.group_by ?? "item";
       const limit = normalizeLimit(input.limit ?? 15);
-      const bins = await ctx.client.list("Bin", {
+      const bins = await context2.listAllBins({
         fields: ["item_code", "warehouse", "stock_value"],
         filters: [["stock_value", ">", 0]],
-        limit: 500,
         order_by: "stock_value desc"
       });
       const grouped = {};
       for (const bin of bins) {
         const key = groupBy === "warehouse" ? bin.warehouse : bin.item_code;
-        grouped[key] = (grouped[key] ?? 0) + (Number(bin.stock_value) || 0);
+        grouped[key] = (grouped[key] ?? 0) + analyticsNumber(bin, "stock_value");
       }
       const sorted = Object.entries(grouped).sort(([, a], [, b]) => b - a).slice(0, limit);
       const COLORS = [
@@ -50021,13 +50828,13 @@ var analyticsTools = [
           value: Math.round(value),
           color: COLORS[i % COLORS.length]
         })),
-        currency: "EUR",
+        currency,
         _meta: CHART_META
       };
     }
-  },
+  }),
   // ── Product Comparison Radar ────────────────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_product_radar",
     annotations: { readOnlyHint: true },
     _meta: CHART_META,
@@ -50047,7 +50854,8 @@ var analyticsTools = [
         }
       }
     },
-    handler: async (input, ctx) => {
+    handler: async (input, _ctx, context2) => {
+      const { currency } = context2;
       let itemCodes = input.items ?? [];
       if (itemCodes.length > MAX_RADAR_ITEMS) {
         throw new Error(
@@ -50055,7 +50863,7 @@ var analyticsTools = [
         );
       }
       if (itemCodes.length === 0) {
-        const topBins = await ctx.client.list("Bin", {
+        const topBins = await context2.listBins({
           fields: ["item_code"],
           filters: [["actual_qty", ">", 0]],
           limit: 4,
@@ -50072,40 +50880,43 @@ var analyticsTools = [
           _meta: CHART_META
         };
       }
-      const dimensions = ["Stock Qty", "Stock Value", "Order Lines", "Revenue"];
+      const dimensions = [
+        "Stock Qty",
+        `Stock Value (${currency})`,
+        "Order Lines",
+        `Revenue (${currency})`
+      ];
       const raw2 = {};
       const binResults = await Promise.all(
         itemCodes.map(
-          (code) => ctx.client.list("Bin", {
+          (code) => context2.listAllBins({
             fields: ["actual_qty", "stock_value"],
-            filters: [["item_code", "=", code]],
-            limit: 100
+            filters: [["item_code", "=", code]]
           })
         )
       );
       itemCodes.forEach((code, i) => {
         const bins = binResults[i];
         const totalQty = bins.reduce(
-          (s, b) => s + (Number(b.actual_qty) || 0),
+          (s, b) => s + analyticsNumber(b, "actual_qty"),
           0
         );
         const totalVal = bins.reduce(
-          (s, b) => s + (Number(b.stock_value) || 0),
+          (s, b) => s + analyticsNumber(b, "stock_value"),
           0
         );
         raw2[code] = [totalQty, totalVal, 0, 0];
       });
-      const soItems = await ctx.client.list("Sales Order Item", {
-        fields: ["item_code", "qty", "amount"],
-        filters: [["docstatus", "!=", 2]],
-        limit: 500
+      const soItems = await context2.listAllItems("Sales Order", {
+        fields: ["item_code", "qty", "base_amount"],
+        filters: [["docstatus", "!=", 2]]
       });
       const itemSet = new Set(itemCodes);
       for (const row of soItems) {
         const code = row.item_code;
         if (itemSet.has(code) && raw2[code]) {
           raw2[code][2] += 1;
-          raw2[code][3] += Number(row.amount) || 0;
+          raw2[code][3] += analyticsNumber(row, "base_amount");
         }
       }
       const maxPerDim = dimensions.map(
@@ -50127,9 +50938,9 @@ var analyticsTools = [
         _meta: CHART_META
       };
     }
-  },
+  }),
   // ── Price vs Quantity Scatter ────────────────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_price_vs_qty",
     annotations: { readOnlyHint: true },
     _meta: CHART_META,
@@ -50145,33 +50956,36 @@ var analyticsTools = [
         }
       }
     },
-    handler: async (input, ctx) => {
+    handler: async (input, ctx, context2) => {
+      const { currency } = context2;
       const limit = normalizeLimit(input.limit ?? 30);
-      const items = await ctx.client.list("Item Price", {
-        fields: ["item_code", "price_list_rate"],
-        filters: [["selling", "=", 1]],
-        limit: 200,
-        order_by: "modified desc"
-      });
+      const items = await listCompleteAnalytics(
+        ctx.client.list.bind(ctx.client),
+        "Item Price",
+        {
+          fields: ["item_code", "price_list_rate", "currency", "uom"],
+          filters: [["selling", "=", 1]],
+          order_by: "modified desc"
+        }
+      );
       const priceMap = {};
       for (const ip of items) {
         const code = ip.item_code;
-        if (!priceMap[code]) priceMap[code] = Number(ip.price_list_rate) || 0;
+        if (!Object.hasOwn(priceMap, code)) priceMap[code] = ip;
       }
-      const soItems = await ctx.client.list("Sales Order Item", {
-        fields: ["item_code", "qty"],
-        filters: [["docstatus", "!=", 2]],
-        limit: 500
+      const soItems = await context2.listAllItems("Sales Order", {
+        fields: ["item_code", "stock_qty"],
+        filters: [["docstatus", "!=", 2]]
       });
       const qtyMap = {};
       for (const row of soItems) {
         const code = row.item_code;
-        qtyMap[code] = (qtyMap[code] ?? 0) + (Number(row.qty) || 0);
+        qtyMap[code] = (qtyMap[code] ?? 0) + analyticsNumber(row, "stock_qty");
       }
       const allItems = Object.keys(priceMap).filter((c) => qtyMap[c] != null);
       const limited = allItems.slice(0, limit);
       if (limited.length === 0) {
-        const bins = await ctx.client.list("Bin", {
+        const bins = await context2.listBins({
           fields: ["item_code", "valuation_rate", "actual_qty"],
           filters: [["actual_qty", ">", 0], ["valuation_rate", ">", 0]],
           limit,
@@ -50186,16 +51000,34 @@ var analyticsTools = [
             label: "Items",
             color: "#818cf8",
             points: bins.map((b) => ({
-              x: Math.round(Number(b.valuation_rate) || 0),
+              x: Math.round(analyticsNumber(b, "valuation_rate")),
               y: Math.round(Number(b.actual_qty) || 0),
               label: b.item_code
             }))
           }],
-          xAxisLabel: "Valuation Rate (\u20AC/unit)",
+          xAxisLabel: `Valuation Rate (${currency}/stock unit)`,
           yAxisLabel: "Stock Qty",
           _meta: CHART_META
         };
       }
+      const itemDocs = await listAnalyticsItemUnits(ctx, limited);
+      const stockUnits = new Map(
+        itemDocs.map((item) => [item.name, item.stock_uom])
+      );
+      for (const code of limited) {
+        const price = priceMap[code];
+        if (price.currency !== currency) {
+          throw new Error(
+            `Item Price for '${code}' has missing or unexpected currency; expected ${currency}. Historical conversion is unavailable.`
+          );
+        }
+        const stockUom = stockUnits.get(code);
+        if (typeof stockUom !== "string" || stockUom === "" || price.uom !== stockUom) {
+          throw new Error(
+            `Item Price for '${code}' must use its verified stock UOM; conversion is unavailable.`
+          );
+        }
+      }
       return {
         title: "Price vs Quantity Ordered",
         type: "scatter",
@@ -50205,44 +51037,44 @@ var analyticsTools = [
           label: "Items",
           color: "#818cf8",
           points: limited.map((code) => ({
-            x: Math.round(priceMap[code]),
+            x: Math.round(analyticsNumber(priceMap[code], "price_list_rate")),
             y: Math.round(qtyMap[code]),
             label: code
           }))
         }],
-        xAxisLabel: "Selling Price (\u20AC)",
-        yAxisLabel: "Total Qty Ordered",
+        xAxisLabel: `Selling Price (${currency}/stock unit)`,
+        yAxisLabel: "Total Stock Qty Ordered",
         _meta: CHART_META
       };
     }
-  },
+  }),
   // ── KPI: Revenue MTD ────────────────────────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_kpi_revenue",
     annotations: { readOnlyHint: true },
     _meta: KPI_META,
     description: "KPI card: total Sales Order revenue for the current month, with delta % vs previous month and sparkline of last 6 months.",
     category: "analytics",
     inputSchema: { type: "object", properties: {} },
-    handler: async (_input, ctx) => {
-      const now = /* @__PURE__ */ new Date();
-      const sixMonthsAgo = new Date(now.getFullYear(), now.getMonth() - 5, 1);
-      const sinceStr = sixMonthsAgo.toISOString().split("T")[0];
-      const allOrders = await ctx.client.list("Sales Order", {
-        fields: ["grand_total", "transaction_date"],
+    handler: async (_input, ctx, context2) => {
+      const { currency } = context2;
+      const window2 = analyticsDateWindow(await siteToday(ctx), 6);
+      const allOrders = await context2.listAllDocuments("Sales Order", {
+        fields: ["base_grand_total", "transaction_date"],
         filters: [
-          ["transaction_date", ">=", sinceStr],
+          ["transaction_date", ">=", window2.start],
+          ["transaction_date", "<=", window2.end],
           ["docstatus", "!=", 2]
-        ],
-        limit: 5e3
+        ]
       });
       const sparkline = [0, 0, 0, 0, 0, 0];
       for (const o of allOrders) {
-        const d = new Date(o.transaction_date);
-        const monthDiff = (now.getFullYear() - d.getFullYear()) * 12 + (now.getMonth() - d.getMonth());
-        const idx = 5 - monthDiff;
+        const idx = analyticsMonthIndex(
+          o.transaction_date,
+          window2.monthKeys
+        );
         if (idx >= 0 && idx < 6) {
-          sparkline[idx] += Number(o.grand_total) || 0;
+          sparkline[idx] += analyticsNumber(o, "base_grand_total");
         }
       }
       const currentTotal = sparkline[5];
@@ -50251,7 +51083,7 @@ var analyticsTools = [
       return {
         label: "Revenue MTD",
         value: currentTotal,
-        currency: "EUR",
+        currency,
         delta: Math.round(delta * 10) / 10,
         deltaLabel: "vs last month",
         trend: delta > 0 ? "up" : delta < 0 ? "down" : "flat",
@@ -50261,74 +51093,77 @@ var analyticsTools = [
         _meta: KPI_META
       };
     }
-  },
+  }),
   // ── KPI: Outstanding Receivables ────────────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_kpi_outstanding",
     annotations: { readOnlyHint: true },
     _meta: KPI_META,
-    description: "KPI card: total outstanding receivables from submitted Sales Invoices with outstanding_amount > 0. Shows count of open invoices.",
+    description: "KPI card: total outstanding receivables from submitted Sales Invoices with positive outstanding balance from Accounts Receivable in company currency. Shows count of open invoices.",
     category: "analytics",
     inputSchema: { type: "object", properties: {} },
-    handler: async (_input, ctx) => {
-      const invoices = await ctx.client.list("Sales Invoice", {
-        fields: ["outstanding_amount"],
-        filters: [
-          ["outstanding_amount", ">", 0],
-          ["docstatus", "=", 1]
-        ],
-        limit: 1e3
-      });
+    handler: async (_input, ctx, context2) => {
+      const { currency } = context2;
+      const reportDate = await siteToday(ctx);
+      const reportRows = await receivableInvoiceRows(
+        ctx,
+        context2.company,
+        currency,
+        reportDate
+      );
+      const invoices = reportRows;
       const total = invoices.reduce(
-        (sum, inv) => sum + (Number(inv.outstanding_amount) || 0),
+        (sum, inv) => sum + inv.outstanding_amount,
         0
       );
-      const count = invoices.length;
+      const count = new Set(invoices.map((row) => row.voucher_no)).size;
       return {
         label: "Outstanding Receivables",
         value: total,
-        formattedValue: `${count} inv. / ${total.toLocaleString("en-US", { style: "currency", currency: "EUR" })}`,
-        currency: "EUR",
+        formattedValue: `${count} inv. / ${total.toLocaleString("en-US", { style: "currency", currency })}`,
+        currency,
         trend: total > 0 ? "up" : "flat",
         trendIsGood: false,
         color: "#fbbf24",
         _meta: KPI_META
       };
     }
-  },
+  }),
   // ── KPI: Orders This Month ──────────────────────────────────────────────
   {
     name: "erpnext_kpi_orders",
     annotations: { readOnlyHint: true },
     _meta: KPI_META,
-    description: "KPI card: count and total value of Sales Orders created this month, with delta % vs last month.",
+    description: "KPI card: count of Sales Orders created this month, with delta % vs last month.",
     category: "analytics",
     inputSchema: { type: "object", properties: {} },
     handler: async (_input, ctx) => {
-      const now = /* @__PURE__ */ new Date();
-      const thisMonthStart = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-01`;
-      const lastMonthStart = new Date(now.getFullYear(), now.getMonth() - 1, 1);
-      const lastMonthEnd = new Date(now.getFullYear(), now.getMonth(), 0);
-      const lastMonthStartStr = lastMonthStart.toISOString().split("T")[0];
-      const lastMonthEndStr = lastMonthEnd.toISOString().split("T")[0];
-      const currentOrders = await ctx.client.list("Sales Order", {
-        fields: ["grand_total"],
-        filters: [
-          ["transaction_date", ">=", thisMonthStart],
-          ["docstatus", "!=", 2]
-        ],
-        limit: 1e3
-      });
+      const window2 = analyticsDateWindow(await siteToday(ctx));
+      const currentOrders = await listCompleteAnalytics(
+        ctx.client.list.bind(ctx.client),
+        "Sales Order",
+        {
+          fields: ["name"],
+          filters: [
+            ["transaction_date", ">=", window2.start],
+            ["transaction_date", "<=", window2.end],
+            ["docstatus", "!=", 2]
+          ]
+        }
+      );
       const currentCount = currentOrders.length;
-      const prevOrders = await ctx.client.list("Sales Order", {
-        fields: ["grand_total"],
-        filters: [
-          ["transaction_date", ">=", lastMonthStartStr],
-          ["transaction_date", "<=", lastMonthEndStr],
-          ["docstatus", "!=", 2]
-        ],
-        limit: 1e3
-      });
+      const prevOrders = await listCompleteAnalytics(
+        ctx.client.list.bind(ctx.client),
+        "Sales Order",
+        {
+          fields: ["name"],
+          filters: [
+            ["transaction_date", ">=", window2.previousStart],
+            ["transaction_date", "<=", window2.previousEnd],
+            ["docstatus", "!=", 2]
+          ]
+        }
+      );
       const prevCount = prevOrders.length;
       const delta = prevCount > 0 ? (currentCount - prevCount) / prevCount * 100 : 0;
       return {
@@ -50346,47 +51181,46 @@ var analyticsTools = [
     }
   },
   // ── KPI: Gross Margin ──────────────────────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_kpi_gross_margin",
     annotations: { readOnlyHint: true },
     _meta: KPI_META,
     description: "KPI card: estimated gross margin % based on Sales Order revenue vs valuation rate from stock (Bin). Margin = (revenue - cost) / revenue * 100.",
     category: "analytics",
     inputSchema: { type: "object", properties: {} },
-    handler: async (_input, ctx) => {
-      const soItems = await ctx.client.list("Sales Order Item", {
-        fields: ["item_code", "qty", "amount"],
+    handler: async (_input, _ctx, context2) => {
+      const soItems = await context2.listAllItems("Sales Order", {
+        fields: ["item_code", "stock_qty", "base_amount"],
         filters: [
           ["docstatus", "!=", 2]
-        ],
-        limit: 1e3
+        ]
       });
       const revenue = soItems.reduce(
-        (sum, row) => sum + (Number(row.amount) || 0),
+        (sum, row) => sum + analyticsNumber(row, "base_amount"),
         0
       );
       const itemQty = {};
       for (const row of soItems) {
         const code = row.item_code;
-        itemQty[code] = (itemQty[code] ?? 0) + (Number(row.qty) || 0);
+        itemQty[code] = (itemQty[code] ?? 0) + analyticsNumber(row, "stock_qty");
       }
-      const bins = await ctx.client.list("Bin", {
+      const bins = await context2.listAllBins({
         fields: ["item_code", "valuation_rate"],
-        filters: [["valuation_rate", ">", 0]],
-        limit: 500
+        filters: [["valuation_rate", ">", 0]]
       });
       const valMap = {};
       for (const bin of bins) {
         const code = bin.item_code;
         if (!valMap[code]) {
-          valMap[code] = Number(bin.valuation_rate) || 0;
+          valMap[code] = analyticsNumber(bin, "valuation_rate");
         }
       }
       let cost = 0;
       for (const [code, qty] of Object.entries(itemQty)) {
-        if (valMap[code]) {
-          cost += valMap[code] * qty;
+        if (valMap[code] === void 0) {
+          throw new Error(`Missing estimated stock cost for item '${code}'.`);
         }
+        cost += valMap[code] * qty;
       }
       const margin = revenue > 0 ? (revenue - cost) / revenue * 100 : 0;
       return {
@@ -50399,48 +51233,47 @@ var analyticsTools = [
         _meta: KPI_META
       };
     }
-  },
+  }),
   // ── KPI: Overdue Invoices ──────────────────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_kpi_overdue",
     annotations: { readOnlyHint: true },
     _meta: KPI_META,
     description: "KPI card: count and total value of overdue Sales Invoices (due_date < today, outstanding_amount > 0, submitted).",
     category: "analytics",
     inputSchema: { type: "object", properties: {} },
-    handler: async (_input, ctx) => {
-      const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-      const invoices = await ctx.client.list("Sales Invoice", {
-        fields: ["outstanding_amount", "due_date"],
-        filters: [
-          ["due_date", "<", today],
-          ["outstanding_amount", ">", 0],
-          ["docstatus", "=", 1]
-        ],
-        limit: 1e3
-      });
-      const count = invoices.length;
+    handler: async (_input, ctx, context2) => {
+      const { currency } = context2;
+      const reportDate = await siteToday(ctx);
+      const reportRows = await receivableInvoiceRows(
+        ctx,
+        context2.company,
+        currency,
+        reportDate
+      );
+      const invoices = reportRows.filter((row) => row.due_date < reportDate);
+      const count = new Set(invoices.map((row) => row.voucher_no)).size;
       const total = invoices.reduce(
-        (sum, inv) => sum + (Number(inv.outstanding_amount) || 0),
+        (sum, inv) => sum + inv.outstanding_amount,
         0
       );
       return {
         label: "Overdue Invoices",
         value: count,
-        formattedValue: `${count} inv. / ${total.toLocaleString("en-US", { style: "currency", currency: "EUR" })}`,
+        formattedValue: `${count} inv. / ${total.toLocaleString("en-US", { style: "currency", currency })}`,
         trend: count > 0 ? "up" : "flat",
         trendIsGood: false,
         color: "#f87171",
         _meta: KPI_META
       };
     }
-  },
+  }),
   // ── Sales Funnel ──────────────────────────────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_sales_funnel",
     annotations: { readOnlyHint: true },
     _meta: FUNNEL_META,
-    description: "Sales funnel from Lead \u2192 Opportunity \u2192 Quotation \u2192 Sales Order. Shows count and value at each stage with conversion rates between stages.",
+    description: "Sales funnel from Lead \u2192 Opportunity \u2192 Quotation \u2192 Sales Order. Shows count and value at each stage with conversion rates between stages. Opportunity, Quotation and Order are scoped to one company; Leads count all visible records.",
     category: "analytics",
     inputSchema: {
       type: "object",
@@ -50452,44 +51285,44 @@ var analyticsTools = [
         }
       }
     },
-    handler: async (_input, ctx) => {
+    handler: async (_input, ctx, context2) => {
+      const { currency } = context2;
       const period = _input.period ?? "all";
-      const now = /* @__PURE__ */ new Date();
-      let sinceDate = null;
-      if (period === "this_month") {
-        sinceDate = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-01`;
-      } else if (period === "this_quarter") {
-        const qMonth = Math.floor(now.getMonth() / 3) * 3 + 1;
-        sinceDate = `${now.getFullYear()}-${String(qMonth).padStart(2, "0")}-01`;
-      } else if (period === "this_year") {
-        sinceDate = `${now.getFullYear()}-01-01`;
-      }
-      const leadFilters = sinceDate ? [["creation", ">=", sinceDate]] : [];
-      const txnFilters = sinceDate ? [["transaction_date", ">=", sinceDate]] : [];
+      const finitePeriod = ["this_month", "this_quarter", "this_year"].includes(
+        period
+      );
+      const window2 = finitePeriod ? analyticsDateWindow(await siteToday(ctx)) : null;
+      const sinceDate = window2 ? period === "this_quarter" ? window2.quarterStart : period === "this_year" ? window2.yearStart : window2.start : null;
+      const leadFilters = sinceDate && window2 ? [["creation", ">=", `${sinceDate} 00:00:00`], [
+        "creation",
+        "<",
+        `${window2.nextDay} 00:00:00`
+      ]] : [];
+      const txnFilters = sinceDate && window2 ? [["transaction_date", ">=", sinceDate], [
+        "transaction_date",
+        "<=",
+        window2.end
+      ]] : [];
       const submittedTxnFilters = [
         ...txnFilters,
         ["docstatus", "!=", 2]
       ];
       const [leads, opps, quots, orders] = await Promise.all([
-        ctx.client.list("Lead", {
+        listCompleteAnalytics(ctx.client.list.bind(ctx.client), "Lead", {
           fields: ["name"],
-          filters: leadFilters,
-          limit: 500
+          filters: leadFilters
         }),
-        ctx.client.list("Opportunity", {
-          fields: ["name", "opportunity_amount"],
-          filters: txnFilters,
-          limit: 500
+        context2.listAllDocuments("Opportunity", {
+          fields: ["name", "base_opportunity_amount"],
+          filters: txnFilters
         }),
-        ctx.client.list("Quotation", {
-          fields: ["name", "grand_total"],
-          filters: submittedTxnFilters,
-          limit: 500
+        context2.listAllDocuments("Quotation", {
+          fields: ["name", "base_grand_total"],
+          filters: submittedTxnFilters
         }),
-        ctx.client.list("Sales Order", {
-          fields: ["name", "grand_total"],
-          filters: submittedTxnFilters,
-          limit: 500
+        context2.listAllDocuments("Sales Order", {
+          fields: ["name", "base_grand_total"],
+          filters: submittedTxnFilters
         })
       ]);
       const stages = [
@@ -50502,7 +51335,7 @@ var analyticsTools = [
           label: "Opportunities",
           count: opps.length,
           value: opps.reduce(
-            (s, o) => s + (Number(o.opportunity_amount) || 0),
+            (s, o) => s + analyticsNumber(o, "base_opportunity_amount"),
             0
           ),
           color: "#60a5fa",
@@ -50511,14 +51344,20 @@ var analyticsTools = [
         {
           label: "Quotations",
           count: quots.length,
-          value: quots.reduce((s, q) => s + (Number(q.grand_total) || 0), 0),
+          value: quots.reduce(
+            (s, q) => s + analyticsNumber(q, "base_grand_total"),
+            0
+          ),
           color: "#4ade80",
           conversionRate: opps.length > 0 ? Math.round(quots.length / opps.length * 100) : 0
         },
         {
           label: "Orders",
           count: orders.length,
-          value: orders.reduce((s, o) => s + (Number(o.grand_total) || 0), 0),
+          value: orders.reduce(
+            (s, o) => s + analyticsNumber(o, "base_grand_total"),
+            0
+          ),
           color: "#fbbf24",
           conversionRate: quots.length > 0 ? Math.round(orders.length / quots.length * 100) : 0
         }
@@ -50531,15 +51370,15 @@ var analyticsTools = [
       };
       return {
         title: "Sales Funnel",
-        subtitle: periodLabels[period] ?? "All Time",
+        subtitle: `${periodLabels[period] ?? "All Time"}; ${context2.company}; Leads: all visible companies`,
         stages,
-        currency: "EUR",
+        currency,
         _meta: FUNNEL_META
       };
     }
-  },
+  }),
   // ── AR Aging ──────────────────────────────────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_ar_aging",
     annotations: { readOnlyHint: true },
     _meta: CHART_META,
@@ -50560,21 +51399,19 @@ var analyticsTools = [
         }
       }
     },
-    handler: async (input, ctx) => {
+    handler: async (input, ctx, context2) => {
+      const { currency } = context2;
       const limit = normalizeLimit(input.limit ?? 10);
       const chartType = input.type ?? "stacked-bar";
-      const invoices = await ctx.client.list("Sales Invoice", {
-        fields: [
-          "customer_name",
-          "outstanding_amount",
-          "due_date",
-          "posting_date"
-        ],
-        filters: [["outstanding_amount", ">", 0], ["docstatus", "=", 1]],
-        limit: 500,
-        order_by: "outstanding_amount desc"
-      });
-      const today = /* @__PURE__ */ new Date();
+      const reportDate = await siteToday(ctx);
+      const reportRows = await receivableInvoiceRows(
+        ctx,
+        context2.company,
+        currency,
+        reportDate
+      );
+      const invoices = reportRows;
+      const today = new Date(reportDate);
       const BUCKETS = [
         { label: "0-30 days", min: 0, max: 30, color: "#4ade80" },
         { label: "31-60 days", min: 31, max: 60, color: "#fbbf24" },
@@ -50597,7 +51434,7 @@ var analyticsTools = [
           (b) => agingDays >= b.min && agingDays <= b.max
         );
         if (bucketIdx >= 0) {
-          byCustomer[customer][bucketIdx] += Number(inv.outstanding_amount) || 0;
+          byCustomer[customer][bucketIdx] += inv.outstanding_amount;
         }
       }
       const sorted = Object.entries(byCustomer).map(([name, buckets]) => ({
@@ -50628,7 +51465,7 @@ var analyticsTools = [
             value: Math.round(total),
             color: COLORS[i % COLORS.length]
           })),
-          currency: "EUR",
+          currency,
           _meta: CHART_META
         };
       }
@@ -50644,15 +51481,15 @@ var analyticsTools = [
           color: bucket.color,
           stack: "aging"
         })),
-        currency: "EUR",
+        currency,
         xAxisLabel: "Customer",
         yAxisLabel: "Outstanding Amount",
         _meta: CHART_META
       };
     }
-  },
+  }),
   // ── Gross Profit ──────────────────────────────────────────────────────────
-  {
+  companyAnalyticsTool({
     name: "erpnext_gross_profit",
     annotations: { readOnlyHint: true },
     _meta: CHART_META,
@@ -50673,29 +51510,33 @@ var analyticsTools = [
         }
       }
     },
-    handler: async (input, ctx) => {
+    handler: async (input, _ctx, context2) => {
+      const { currency } = context2;
       const limit = normalizeLimit(input.limit ?? 10);
       const groupBy = input.group_by ?? "item";
       const needsCustomers = groupBy === "customer";
       const [siItems, bins, invoices] = await Promise.all([
         // Submitted Sales Invoice Items for revenue
-        ctx.client.list("Sales Invoice Item", {
-          fields: ["parent", "item_code", "item_name", "amount", "qty"],
+        context2.listAllItems("Sales Invoice", {
+          fields: [
+            "parent",
+            "item_code",
+            "item_name",
+            "base_amount",
+            "stock_qty"
+          ],
           filters: [["docstatus", "=", 1]],
-          limit: 500,
-          order_by: "amount desc"
+          order_by: "base_amount desc"
         }),
         // Bin for valuation_rate (cost per unit)
-        ctx.client.list("Bin", {
+        context2.listAllBins({
           fields: ["item_code", "valuation_rate"],
-          filters: [["valuation_rate", ">", 0]],
-          limit: 500
+          filters: [["valuation_rate", ">", 0]]
         }),
         // Invoices, to map parent invoice name to customer
-        needsCustomers ? ctx.client.list("Sales Invoice", {
+        needsCustomers ? context2.listAllDocuments("Sales Invoice", {
           fields: ["name", "customer_name"],
-          filters: [["docstatus", "=", 1]],
-          limit: 500
+          filters: [["docstatus", "=", 1]]
         }) : Promise.resolve([])
       ]);
       const costMap = {};
@@ -50703,7 +51544,7 @@ var analyticsTools = [
         const code = bin.item_code;
         costMap[code] = Math.max(
           costMap[code] ?? 0,
-          Number(bin.valuation_rate) || 0
+          analyticsNumber(bin, "valuation_rate")
         );
       }
       if (needsCustomers) {
@@ -50717,9 +51558,14 @@ var analyticsTools = [
           if (!byCustomer[customer]) {
             byCustomer[customer] = { revenue: 0, cost: 0 };
           }
-          const qty = Number(row.qty) || 0;
-          const unitCost = costMap[row.item_code] ?? 0;
-          byCustomer[customer].revenue += Number(row.amount) || 0;
+          const qty = analyticsNumber(row, "stock_qty");
+          const unitCost = costMap[row.item_code];
+          if (unitCost === void 0) {
+            throw new Error(
+              `Missing estimated stock cost for item '${row.item_code}'.`
+            );
+          }
+          byCustomer[customer].revenue += analyticsNumber(row, "base_amount");
           byCustomer[customer].cost += qty * unitCost;
         }
         const sorted2 = Object.entries(byCustomer).sort(([, a], [, b]) => b.revenue - a.revenue).slice(0, limit);
@@ -50730,7 +51576,7 @@ var analyticsTools = [
         );
         return {
           title: "Gross Profit by Customer",
-          subtitle: `Top ${labels2.length} customers`,
+          subtitle: `Top ${labels2.length} customers; estimated cost from current stock valuation`,
           type: "composed",
           labels: labels2,
           datasets: [
@@ -50750,7 +51596,7 @@ var analyticsTools = [
             }
           ],
           showRightAxis: true,
-          currency: "EUR",
+          currency,
           yAxisLabel: "Revenue",
           rightAxisLabel: "Margin %",
           _meta: CHART_META
@@ -50766,9 +51612,12 @@ var analyticsTools = [
             cost: 0
           };
         }
-        const qty = Number(row.qty) || 0;
-        const unitCost = costMap[code] ?? 0;
-        byItem[code].revenue += Number(row.amount) || 0;
+        const qty = analyticsNumber(row, "stock_qty");
+        const unitCost = costMap[code];
+        if (unitCost === void 0) {
+          throw new Error(`Missing estimated stock cost for item '${code}'.`);
+        }
+        byItem[code].revenue += analyticsNumber(row, "base_amount");
         byItem[code].cost += qty * unitCost;
       }
       const sorted = Object.entries(byItem).sort(([, a], [, b]) => b.revenue - a.revenue).slice(0, limit);
@@ -50779,7 +51628,7 @@ var analyticsTools = [
       );
       return {
         title: "Gross Profit by Item",
-        subtitle: `Top ${labels.length} items`,
+        subtitle: `Top ${labels.length} items; estimated cost from current stock valuation`,
         type: "composed",
         labels,
         datasets: [
@@ -50799,13 +51648,13 @@ var analyticsTools = [
           }
         ],
         showRightAxis: true,
-        currency: "EUR",
+        currency,
         yAxisLabel: "Revenue",
         rightAxisLabel: "Margin %",
         _meta: CHART_META
       };
     }
-  },
+  }),
   // ── Profit & Loss ─────────────────────────────────────────────────────────
   {
     name: "erpnext_profit_loss",
@@ -50977,6 +51826,10 @@ var analyticsTools = [
           periodicity: "Monthly",
           cross_check: crossCheck
         },
+        refreshRequest: {
+          toolName: "erpnext_profit_loss",
+          arguments: { ...input, company }
+        },
         _meta: CHART_META
       };
     }
@@ -51268,7 +52121,9 @@ var taskKanbanAdapter = {
     return { allowed: true };
   },
   async executeMove(move, ctx) {
-    const currentTask = await ctx.client.get("Task", move.cardId);
+    const currentTask = await ctx.client.get("Task", move.cardId, {
+      skipCache: true
+    });
     const serverColumn = columnIdForTaskStatus(currentTask.status);
     if (serverColumn !== move.fromColumn) {
       return {
@@ -51299,8 +52154,19 @@ var taskKanbanAdapter = {
         errorMessage: "Unknown Task column"
       };
     }
+    const modified = currentTask.modified;
+    if (typeof modified !== "string" || !modified.trim()) {
+      return {
+        ok: false,
+        cardId: move.cardId,
+        fromColumn: serverColumn,
+        toColumn: move.toColumn,
+        errorMessage: "Cannot move Task without a modified timestamp. Refresh the board and try again."
+      };
+    }
     const serverTask = await ctx.client.update("Task", move.cardId, {
-      status
+      status,
+      modified
     });
     return {
       ok: true,
@@ -51531,7 +52397,8 @@ var opportunityKanbanAdapter = {
   async executeMove(move, ctx) {
     const currentOpportunity = await ctx.client.get(
       "Opportunity",
-      move.cardId
+      move.cardId,
+      { skipCache: true }
     );
     const serverColumn = columnIdForOpportunityStatus(
       currentOpportunity.status
@@ -51565,11 +52432,22 @@ var opportunityKanbanAdapter = {
         errorMessage: "Unknown Opportunity column"
       };
     }
+    const modified = currentOpportunity.modified;
+    if (typeof modified !== "string" || !modified.trim()) {
+      return {
+        ok: false,
+        cardId: move.cardId,
+        fromColumn: serverColumn,
+        toColumn: move.toColumn,
+        errorMessage: "Cannot move Opportunity without a modified timestamp. Refresh the board and try again."
+      };
+    }
     const serverOpportunity = await ctx.client.update(
       "Opportunity",
       move.cardId,
       {
-        status
+        status,
+        modified
       }
     );
     return {
@@ -51742,7 +52620,9 @@ var issueKanbanAdapter = {
     return { allowed: true };
   },
   async executeMove(move, ctx) {
-    const currentIssue = await ctx.client.get("Issue", move.cardId);
+    const currentIssue = await ctx.client.get("Issue", move.cardId, {
+      skipCache: true
+    });
     const serverColumn = columnIdForIssueStatus(currentIssue.status);
     if (serverColumn !== move.fromColumn) {
       return {
@@ -51773,8 +52653,19 @@ var issueKanbanAdapter = {
         errorMessage: "Unknown Issue column"
       };
     }
+    const modified = currentIssue.modified;
+    if (typeof modified !== "string" || !modified.trim()) {
+      return {
+        ok: false,
+        cardId: move.cardId,
+        fromColumn: serverColumn,
+        toColumn: move.toColumn,
+        errorMessage: "Cannot move Issue without a modified timestamp. Refresh the board and try again."
+      };
+    }
     const serverIssue = await ctx.client.update("Issue", move.cardId, {
-      status
+      status,
+      modified
     });
     return {
       ok: true,
@@ -51792,6 +52683,10 @@ var ADAPTERS = {
   opportunity: opportunityKanbanAdapter,
   issue: issueKanbanAdapter
 };
+var FILTER_STATUSES = {
+  Issue: ["Open", "Replied", "On Hold", "Resolved", "Closed"],
+  Opportunity: ["Open", "Replied", "Quotation", "Converted", "Closed", "Lost"]
+};
 function getAdapter(doctype) {
   const definition = getKanbanBoardDefinition(doctype);
   if (!definition) {
@@ -51859,8 +52754,8 @@ var kanbanTools = [
         },
         status: {
           type: "string",
-          description: "Optional Opportunity status filter",
-          enum: ["Open", "Replied", "Quotation", "Converted", "Closed", "Lost"]
+          description: "Optional Issue or Opportunity status filter; not supported for Task. Status must belong to the selected DocType.",
+          enum: [...new Set(Object.values(FILTER_STATUSES).flat())]
         },
         opportunity_owner: {
           type: "string",
@@ -51884,6 +52779,12 @@ var kanbanTools = [
     handler: async (input, ctx) => {
       const doctype = String(input.doctype ?? "");
       const { definition, adapter } = getAdapter(doctype);
+      const statuses = FILTER_STATUSES[doctype];
+      if (statuses && input.status !== void 0 && (typeof input.status !== "string" || !statuses.includes(input.status))) {
+        throw new Error(
+          `[erpnext_kanban_get_board] Invalid status for ${doctype}. Expected one of: ${statuses.join(", ")}`
+        );
+      }
       const limit = normalizeLimit(Number(input.limit ?? 50));
       const offset = Math.max(0, Number(input.offset ?? 0));
       const rows = await ctx.client.list(doctype, {
@@ -52915,12 +53816,17 @@ function unquote(value) {
 }
 function optionalEnvValue(value) {
   const trimmed = value?.trim();
-  return trimmed ? unquote(trimmed) : void 0;
+  if (!trimmed) return void 0;
+  const unquoted = unquote(trimmed);
+  return unquoted.trim() ? unquoted : void 0;
 }
 function loadAuthConfig2() {
   const single = optionalEnvValue(env6("MCP_AUTH_TOKEN"));
   const multi = env6("MCP_AUTH_TOKENS");
   const jwksUrl = optionalEnvValue(env6("MCP_OAUTH_JWKS_URL"));
+  const audience = optionalEnvValue(env6("MCP_OAUTH_AUDIENCE"));
+  const issuer = optionalEnvValue(env6("MCP_OAUTH_ISSUER"));
+  const resource = optionalEnvValue(env6("MCP_AUTH_RESOURCE"));
   const tokens = /* @__PURE__ */ new Set();
   if (single) tokens.add(single);
   if (multi) {
@@ -52929,13 +53835,36 @@ function loadAuthConfig2() {
       if (token) tokens.add(token);
     }
   }
-  if (tokens.size === 0 && !jwksUrl) return null;
+  const oauthConfigured = Boolean(jwksUrl || audience || issuer);
+  if (oauthConfigured) {
+    const requiredOAuthValues = [
+      ["MCP_OAUTH_JWKS_URL", jwksUrl],
+      ["MCP_OAUTH_AUDIENCE", audience],
+      ["MCP_OAUTH_ISSUER", issuer],
+      ["MCP_AUTH_RESOURCE", resource]
+    ];
+    for (const [name, value] of requiredOAuthValues) {
+      if (!value) {
+        throw new Error(
+          `[hvgerp-mcp] ${name} is required when OAuth configuration is present`
+        );
+      }
+    }
+  }
+  if (tokens.size === 0 && !oauthConfigured) {
+    if (resource) {
+      throw new Error(
+        "[hvgerp-mcp] MCP_AUTH_RESOURCE requires a static token or OAuth configuration"
+      );
+    }
+    return null;
+  }
   return {
     tokens,
-    resource: optionalEnvValue(env6("MCP_AUTH_RESOURCE")),
+    resource,
     jwksUrl,
-    audience: optionalEnvValue(env6("MCP_OAUTH_AUDIENCE")),
-    issuer: optionalEnvValue(env6("MCP_OAUTH_ISSUER"))
+    audience,
+    issuer
   };
 }
 function buildAuthProvider(config2) {
@@ -53172,7 +54101,7 @@ function installClaudeCodeStdioCompat(cacheHints) {
 }
 
 // src/version.ts
-var SERVER_VERSION = "3.4.0";
+var SERVER_VERSION = "3.5.0";
 
 // src/instructions.ts
 var HEADER_OPENING = `This server exposes a live ERPNext/Frappe instance (HVG Group).
@@ -53217,13 +54146,37 @@ var PERMISSIONS = {
   have permission" or "you have none" - say the deployment's account could not read it. A refusal
   is still an answer: do not retry the same read through a different tool hoping for a wider view.`
 };
-var WRITES = `WRITES
-- Some tools change live business data, and the NAME does not say which: \`erpnext_doc_assign\`,
-  \`erpnext_doc_unassign\`, \`erpnext_kanban_move_card\`, \`erpnext_file_upload\` and
-  \`erpnext_method_call\` all write without a _create/_update/_submit/_cancel/_delete suffix, and
-  the last of those reaches any allowlisted business method. Every writing tool carries
-  \`readOnlyHint: false\` in its \`tools/list\` annotations - read that rather than the name, and
-  confirm the details with the user before calling one.`;
+var SILENT_WRITES = [
+  { name: "erpnext_doc_assign" },
+  { name: "erpnext_doc_unassign" },
+  { name: "erpnext_kanban_move_card" },
+  { name: "erpnext_file_upload" },
+  {
+    name: "erpnext_attendance_day_fix",
+    note: "`erpnext_attendance_day_fix` goes further still: repairing a day CANCELS the\n  Attendance record already standing on it."
+  },
+  {
+    name: "erpnext_method_call",
+    note: "`erpnext_method_call` reaches any allowlisted business method."
+  }
+];
+var WRITES_RULE = "- Every writing tool carries `readOnlyHint: false` in its `tools/list` annotations - read\n  that rather than the name, and confirm the details with the user before calling one.";
+function buildWrites(loaded) {
+  const present = SILENT_WRITES.filter((tool) => loaded.has(tool.name));
+  const lines = ["WRITES"];
+  if (present.length > 0) {
+    const names = present.map((tool) => `\`${tool.name}\``).join(", ");
+    lines.push(
+      `- Some tools change live business data, and the NAME does not say which: ${names}
+  all write without a _create/_update/_submit/_cancel/_delete suffix.`
+    );
+    for (const tool of present) {
+      if (tool.note) lines.push(`- ${tool.note}`);
+    }
+  }
+  lines.push(WRITES_RULE);
+  return lines.join("\n");
+}
 function buildServerInstructions(mode, loadedToolNames) {
   const loaded = new Set(loadedToolNames);
   const header = [
@@ -53232,7 +54185,7 @@ function buildServerInstructions(mode, loadedToolNames) {
       (line) => line.requires === void 0 || loaded.has(line.requires)
     ).map((line) => line.text)
   ].join("\n");
-  return [header, PERMISSIONS[mode], WRITES].join("\n\n");
+  return [header, PERMISSIONS[mode], buildWrites(loaded)].join("\n\n");
 }
 
 // server.ts