@maxwellmezadre/kotas-mcp 0.1.0

package/dist/bin.js

@@ -0,0 +1,3920 @@
+#!/usr/bin/env bun
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/config.ts
+var exports_config = {};
+__export(exports_config, {
+  loadConfig: () => loadConfig,
+  SESSION_KEY_BYTES: () => SESSION_KEY_BYTES,
+  MAX_PAGE_SIZE: () => MAX_PAGE_SIZE,
+  IMPORT_BROWSERS: () => IMPORT_BROWSERS,
+  DEFAULT_BASE_URL: () => DEFAULT_BASE_URL,
+  DEFAULT_APP_VERSION: () => DEFAULT_APP_VERSION,
+  DEFAULT_API_TOKEN: () => DEFAULT_API_TOKEN,
+  ConfigSchema: () => ConfigSchema,
+  ConfigError: () => ConfigError,
+  APP_ORIGIN: () => APP_ORIGIN
+});
+import { homedir } from "os";
+import { join } from "path";
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+function readOptional(env, key) {
+  const raw = env[key]?.trim();
+  return raw ? raw : undefined;
+}
+function expandHome(path) {
+  return path.startsWith("~/") ? join(homedir(), path.slice(2)) : path;
+}
+function readBool(problems, env, key, fallback) {
+  const raw = readOptional(env, key);
+  if (raw === undefined)
+    return fallback;
+  const value = raw.toLowerCase();
+  if (["1", "true", "yes", "on"].includes(value))
+    return true;
+  if (["0", "false", "no", "off"].includes(value))
+    return false;
+  problems.push(`${key} deve ser boolean (1/0, true/false, yes/no, on/off), veio "${raw}"`);
+  return fallback;
+}
+function readInt(problems, env, key, fallback, min) {
+  const raw = readOptional(env, key);
+  if (raw === undefined)
+    return fallback;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < min) {
+    problems.push(`${key} deve ser inteiro >= ${min}, veio "${raw}"`);
+    return fallback;
+  }
+  return parsed;
+}
+function readEnum(problems, env, key, allowed, fallback) {
+  const raw = readOptional(env, key);
+  if (raw === undefined)
+    return fallback;
+  const value = raw.toLowerCase();
+  if (allowed.includes(value))
+    return value;
+  problems.push(`${key} deve ser ${allowed.join("|")}, veio "${raw}"`);
+  return fallback;
+}
+function readSessionKey(problems, env) {
+  const raw = readOptional(env, "KOTAS_SESSION_KEY");
+  if (raw === undefined)
+    return;
+  if (Buffer.from(raw, "base64").length !== SESSION_KEY_BYTES) {
+    problems.push(`KOTAS_SESSION_KEY deve ser base64 de ${SESSION_KEY_BYTES} bytes (gere com: openssl rand -base64 32)`);
+    return;
+  }
+  return raw;
+}
+function readUrl(problems, env, key, fallback) {
+  const raw = readOptional(env, key);
+  if (raw === undefined)
+    return fallback;
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+      throw new Error("protocol");
+  } catch {
+    problems.push(`${key} deve ser uma URL http(s), veio "${raw}"`);
+    return fallback;
+  }
+  return raw.replace(/\/+$/, "");
+}
+function loadConfig(env = process.env) {
+  const problems = [];
+  const configDir = expandHome(readOptional(env, "KOTAS_CONFIG_DIR") ?? join(homedir(), ".config", "kotas-mcp"));
+  const config = {
+    configDir,
+    sessionPath: join(configDir, "session.enc"),
+    keyPath: join(configDir, "session.key"),
+    dbPath: join(configDir, "cache.db"),
+    exportDir: expandHome(readOptional(env, "KOTAS_EXPORT_DIR") ?? join(homedir(), "Downloads", "kotas-export")),
+    sessionKey: readSessionKey(problems, env),
+    readOnly: readBool(problems, env, "KOTAS_READ_ONLY", false),
+    compact: readBool(problems, env, "KOTAS_COMPACT", false),
+    logFile: readOptional(env, "KOTAS_LOG_FILE"),
+    importBrowser: readEnum(problems, env, "KOTAS_IMPORT_BROWSER", IMPORT_BROWSERS, undefined),
+    email: readOptional(env, "KOTAS_EMAIL"),
+    password: readOptional(env, "KOTAS_SENHA") ?? readOptional(env, "KOTAS_PASSWORD"),
+    apiToken: readOptional(env, "KOTAS_API_TOKEN") ?? DEFAULT_API_TOKEN,
+    appVersion: readOptional(env, "KOTAS_APP_VERSION") ?? DEFAULT_APP_VERSION,
+    minIntervalMs: readInt(problems, env, "KOTAS_MIN_INTERVAL_MS", 300, 0),
+    jitterMs: readInt(problems, env, "KOTAS_JITTER_MS", 200, 0),
+    httpTimeoutMs: readInt(problems, env, "KOTAS_HTTP_TIMEOUT_MS", 30000, 1000),
+    baseUrl: readUrl(problems, env, "KOTAS_BASE_URL", DEFAULT_BASE_URL)
+  };
+  if (!Value.Check(ConfigSchema, config)) {
+    for (const error of Value.Errors(ConfigSchema, config)) {
+      problems.push(`${error.path || "/"}: ${error.message}`);
+    }
+  }
+  if (problems.length > 0)
+    throw new ConfigError(problems);
+  return config;
+}
+var IMPORT_BROWSERS, DEFAULT_BASE_URL = "https://api-front.kotas.com.br", APP_ORIGIN = "https://app.kotas.com.br", DEFAULT_API_TOKEN = "72a69d5467f157206616b46624597607424c05bdabcbf83ddbe79625d46efcd1", DEFAULT_APP_VERSION = "1.127.0.0", SESSION_KEY_BYTES = 32, MAX_PAGE_SIZE = 50, ConfigSchema, ConfigError;
+var init_config = __esm(() => {
+  IMPORT_BROWSERS = ["arc", "chrome", "chromium", "brave", "edge"];
+  ConfigSchema = Type.Object({
+    configDir: Type.String({ minLength: 1 }),
+    sessionPath: Type.String({ minLength: 1 }),
+    keyPath: Type.String({ minLength: 1 }),
+    dbPath: Type.String({ minLength: 1 }),
+    exportDir: Type.String({ minLength: 1 }),
+    sessionKey: Type.Optional(Type.String({ minLength: 1 })),
+    readOnly: Type.Boolean(),
+    compact: Type.Boolean(),
+    logFile: Type.Optional(Type.String({ minLength: 1 })),
+    importBrowser: Type.Optional(Type.Union([
+      Type.Literal("arc"),
+      Type.Literal("chrome"),
+      Type.Literal("chromium"),
+      Type.Literal("brave"),
+      Type.Literal("edge")
+    ])),
+    email: Type.Optional(Type.String({ minLength: 3 })),
+    password: Type.Optional(Type.String({ minLength: 1 })),
+    apiToken: Type.String({ minLength: 1 }),
+    appVersion: Type.String({ minLength: 1 }),
+    minIntervalMs: Type.Integer({ minimum: 0 }),
+    jitterMs: Type.Integer({ minimum: 0 }),
+    httpTimeoutMs: Type.Integer({ minimum: 1000 }),
+    baseUrl: Type.String({ minLength: 1 })
+  });
+  ConfigError = class ConfigError extends Error {
+    problems;
+    constructor(problems) {
+      super(`Configura\xE7\xE3o inv\xE1lida do kotas-mcp:
+${problems.map((problem) => `  - ${problem}`).join(`
+`)}`);
+      this.problems = problems;
+      this.name = "ConfigError";
+    }
+  };
+});
+
+// src/core/sqlite.ts
+import { Database } from "bun:sqlite";
+import { chmodSync, existsSync, mkdirSync } from "fs";
+import { dirname } from "path";
+function openDatabase(path) {
+  if (path === ":memory:") {
+    const memory = new Database(":memory:");
+    memory.exec("PRAGMA foreign_keys = ON;");
+    return memory;
+  }
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const previous = process.umask(63);
+  let db;
+  try {
+    db = new Database(path, { create: true });
+    db.exec("PRAGMA journal_mode = WAL;");
+    db.exec("PRAGMA busy_timeout = 5000;");
+    db.exec("PRAGMA foreign_keys = ON;");
+  } finally {
+    process.umask(previous);
+  }
+  for (const suffix of ["", "-wal", "-shm"]) {
+    if (existsSync(path + suffix))
+      chmodSync(path + suffix, 384);
+  }
+  return db;
+}
+function inTx(db, fn) {
+  db.exec("BEGIN IMMEDIATE");
+  try {
+    const result = fn();
+    db.exec("COMMIT");
+    return result;
+  } catch (error) {
+    db.exec("ROLLBACK");
+    throw error;
+  }
+}
+
+class Where {
+  clauses = [];
+  values = [];
+  add(clause, ...values) {
+    this.clauses.push(clause);
+    this.values.push(...values);
+    return this;
+  }
+  maybe(value, clause, ...values) {
+    if (value === undefined || value === null || value === "")
+      return this;
+    return this.add(clause, ...values);
+  }
+  sql() {
+    return this.clauses.length > 0 ? `WHERE ${this.clauses.join(" AND ")}` : "";
+  }
+}
+var init_sqlite = () => {};
+
+// src/cache/db.ts
+function migrate(db) {
+  const row = db.query("PRAGMA user_version").get();
+  for (let version = row.user_version;version < MIGRATIONS.length; version += 1) {
+    const sql = MIGRATIONS[version];
+    db.transaction(() => {
+      db.exec(sql);
+      db.exec(`PRAGMA user_version = ${version + 1}`);
+    })();
+  }
+}
+function openCache(path) {
+  const db = openDatabase(path);
+  migrate(db);
+  return db;
+}
+var MIGRATIONS, META;
+var init_db = __esm(() => {
+  init_sqlite();
+  MIGRATIONS = [
+    `
+  CREATE TABLE invoices (
+    id                    INTEGER PRIMARY KEY,
+    description           TEXT NOT NULL DEFAULT '',
+    /* Parsed out of the description; the only surviving link to a dead group. */
+    product               TEXT,
+    group_id              INTEGER,
+    status_id             INTEGER,
+    status                TEXT,
+    type_id               INTEGER,
+    type                  TEXT,
+    overdue               INTEGER NOT NULL DEFAULT 0,
+    amount_units          INTEGER,
+    interest_units        INTEGER,
+    surcharge_units       INTEGER,
+    discount_units        INTEGER,
+    fee_units             INTEGER,
+    /* What actually left the account. The only column that may be summed. */
+    total_units           INTEGER,
+    due_date              TEXT,
+    paid_date             TEXT,
+    is_group_subscription INTEGER NOT NULL DEFAULT 0,
+    gateway_id            INTEGER,
+    item_count            INTEGER NOT NULL DEFAULT 0,
+    raw_list              TEXT,
+    raw_detail            TEXT,
+    detail_fetched_at     TEXT,
+    detail_error          TEXT,
+    parser_version        INTEGER,
+    updated_at            TEXT NOT NULL
+  );
+
+  CREATE TABLE invoice_items (
+    invoice_id  INTEGER NOT NULL,
+    position    INTEGER NOT NULL,
+    item_id     INTEGER,
+    description TEXT NOT NULL DEFAULT '',
+    quantity    INTEGER NOT NULL DEFAULT 1,
+    amount_units INTEGER,
+    PRIMARY KEY (invoice_id, position),
+    FOREIGN KEY (invoice_id) REFERENCES invoices(id) ON DELETE CASCADE
+  );
+
+  CREATE TABLE groups (
+    id                     INTEGER PRIMARY KEY,
+    name                   TEXT NOT NULL DEFAULT '',
+    service                TEXT,
+    service_id             INTEGER,
+    plan                   TEXT,
+    category_id            INTEGER,
+    category               TEXT,
+    status_id              INTEGER,
+    status                 TEXT,
+    is_administrator       INTEGER NOT NULL DEFAULT 0,
+    admin_name             TEXT,
+    amount_units           INTEGER,
+    service_total_units    INTEGER,
+    amount_without_fee_units INTEGER,
+    fee_units              INTEGER,
+    slots_total            INTEGER,
+    slots_taken            INTEGER,
+    slots_free             INTEGER,
+    loyalty_months         INTEGER,
+    loyalty_ends_at        TEXT,
+    auto_renew             INTEGER,
+    access_method          TEXT,
+    joined_at              TEXT,
+    cancelled_at           TEXT,
+    scheduled_cancellation INTEGER NOT NULL DEFAULT 0,
+    waiting_list           INTEGER NOT NULL DEFAULT 0,
+    private                INTEGER NOT NULL DEFAULT 0,
+    raw_summary            TEXT,
+    raw_detail             TEXT,
+    detail_fetched_at      TEXT,
+    /* A closed group answers HTTP 400; the reason is recorded, not retried. */
+    detail_error           TEXT,
+    parser_version         INTEGER,
+    updated_at             TEXT NOT NULL
+  );
+
+  CREATE TABLE group_participants (
+    group_id       INTEGER NOT NULL,
+    position       INTEGER NOT NULL,
+    name           TEXT,
+    amount_units   INTEGER,
+    slots          INTEGER,
+    joined_at      TEXT,
+    access_sent_at TEXT,
+    left_at        TEXT,
+    waiting_list   INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (group_id, position),
+    FOREIGN KEY (group_id) REFERENCES groups(id) ON DELETE CASCADE
+  );
+
+  CREATE TABLE credits (
+    id              INTEGER PRIMARY KEY,
+    description     TEXT NOT NULL DEFAULT '',
+    status_id       INTEGER,
+    status          TEXT,
+    type_id         INTEGER,
+    type            TEXT,
+    type_label      TEXT,
+    amount_units    INTEGER,
+    available_units INTEGER,
+    fee_units       INTEGER,
+    credited_at     TEXT,
+    invoice_id      INTEGER,
+    group_id        INTEGER,
+    refundable      INTEGER NOT NULL DEFAULT 0,
+    raw             TEXT,
+    updated_at      TEXT NOT NULL
+  );
+
+  /* One row per administered group: the payload's "id" IS the group id. */
+  CREATE TABLE payouts (
+    group_id           INTEGER PRIMARY KEY,
+    description        TEXT NOT NULL DEFAULT '',
+    amount_units       INTEGER,
+    member_share_units INTEGER,
+    status_id          INTEGER,
+    status             TEXT,
+    next_payment_date  TEXT,
+    /* NULL means the statement was never fetched. An empty statement is a fact,
+       so it must be distinguishable from "not fetched yet". */
+    statement_fetched_at TEXT,
+    raw                TEXT,
+    updated_at         TEXT NOT NULL
+  );
+
+  CREATE TABLE payout_entries (
+    group_id     INTEGER NOT NULL,
+    entry_id     INTEGER NOT NULL,
+    description  TEXT NOT NULL DEFAULT '',
+    participant  TEXT,
+    amount_units INTEGER,
+    status_id    INTEGER,
+    status       TEXT,
+    date         TEXT,
+    PRIMARY KEY (group_id, entry_id)
+  );
+
+  CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT);
+
+  CREATE INDEX idx_invoices_paid   ON invoices(paid_date DESC);
+  CREATE INDEX idx_invoices_status ON invoices(status_id);
+  CREATE INDEX idx_invoices_group  ON invoices(group_id);
+  CREATE INDEX idx_invoices_due    ON invoices(due_date DESC);
+  CREATE INDEX idx_items_invoice   ON invoice_items(invoice_id);
+  CREATE INDEX idx_groups_admin    ON groups(is_administrator);
+  CREATE INDEX idx_groups_status   ON groups(status_id);
+  CREATE INDEX idx_credits_type    ON credits(type_id);
+  CREATE INDEX idx_credits_group   ON credits(group_id);
+  CREATE INDEX idx_credits_date    ON credits(credited_at DESC);
+
+  /* remove_diacritics 2 is what makes "credito" find "Cr\xE9dito". */
+  CREATE VIRTUAL TABLE invoices_fts USING fts5(
+    description, product,
+    tokenize = 'unicode61 remove_diacritics 2'
+  );
+  CREATE VIRTUAL TABLE groups_fts USING fts5(
+    name, service, plan,
+    tokenize = 'unicode61 remove_diacritics 2'
+  );
+  `
+  ];
+  META = {
+    cursor: "sync.cursor",
+    lastCompleted: "sync.last_completed_at",
+    lastFull: "sync.last_full_at",
+    balance: "balance.snapshot",
+    balanceAt: "balance.fetched_at"
+  };
+});
+
+// src/domain/enums.ts
+function labelOf(table, code) {
+  if (code === null || code === undefined)
+    return null;
+  const key = Number(code);
+  if (!Number.isFinite(key))
+    return null;
+  return table[key] ?? String(key);
+}
+var INVOICE_STATUS, INVOICE_STATUS_IDS, FINAL_INVOICE_STATUS_IDS, PAID_STATUS_ID = 13, INVOICE_TYPE, CREDIT_STATUS, CREDIT_TYPE, CREDIT_TYPE_LABEL, GROUP_STATUS, PAYOUT_STATUS, ACCESS_METHOD, SOCIAL_AUTH, invoiceStatusOf = (code) => labelOf(INVOICE_STATUS, code), creditStatusOf = (code) => labelOf(CREDIT_STATUS, code), creditTypeOf = (code) => labelOf(CREDIT_TYPE, code), groupStatusOf = (code) => labelOf(GROUP_STATUS, code), payoutStatusOf = (code) => labelOf(PAYOUT_STATUS, code), accessMethodOf = (code) => labelOf(ACCESS_METHOD, code), isFinalInvoice = (statusId) => statusId !== null && FINAL_INVOICE_STATUS_IDS.includes(statusId);
+var init_enums = __esm(() => {
+  INVOICE_STATUS = {
+    11: "pendente",
+    13: "pago",
+    19: "cancelado",
+    63: "atraso",
+    67: "estornado"
+  };
+  INVOICE_STATUS_IDS = [11, 13, 19, 63, 67];
+  FINAL_INVOICE_STATUS_IDS = [13, 19, 67];
+  INVOICE_TYPE = {
+    14: "Cobran\xE7a",
+    37: "Compra de Credito Avulso"
+  };
+  CREDIT_STATUS = {
+    33: "bloqueado",
+    34: "disponivel",
+    35: "utilizado",
+    36: "estornado",
+    41: "pendentePagamento",
+    46: "cancelado",
+    65: "sacado"
+  };
+  CREDIT_TYPE = {
+    94: "adicaoDeSaldo",
+    96: "caucaoDaInscricao",
+    97: "repasseAdministrador",
+    98: "estornoCancelamento"
+  };
+  CREDIT_TYPE_LABEL = {
+    94: "Adi\xE7\xE3o de saldo",
+    96: "Cau\xE7\xE3o da inscri\xE7\xE3o (fica bloqueado enquanto a assinatura durar)",
+    97: "Repasse recebido como administrador",
+    98: "Estorno de cancelamento"
+  };
+  GROUP_STATUS = {
+    1: "aguardandoMembros",
+    3: "aguardandoAssinatura",
+    4: "ativo",
+    50: "pendenteAprovacao",
+    51: "reprovado",
+    52: "assinadoComVagas",
+    55: "cancelado",
+    68: "aguardandoEdicao",
+    69: "aguardandoLiberacao",
+    76: "filaEspera",
+    77: "cancelamentoAgendado",
+    110: "reprovadoAutomaticamente",
+    111: "triagem"
+  };
+  PAYOUT_STATUS = {
+    4: "agendado",
+    55: "cancelado"
+  };
+  ACCESS_METHOD = {
+    239: "loginSenha",
+    240: "convite",
+    241: "codigoAtivacao",
+    242: "cookie",
+    308: "combinar"
+  };
+  SOCIAL_AUTH = { kotas: 1, facebook: 2, google: 3 };
+});
+
+// src/cache/statements.ts
+function prepareStatements(db, stamp) {
+  const upsertInvoiceStmt = db.prepare(`
+    INSERT INTO invoices (
+      id, description, product, group_id, status_id, status, type_id, type, overdue,
+      amount_units, interest_units, surcharge_units, discount_units, fee_units, total_units,
+      due_date, paid_date, is_group_subscription, gateway_id, raw_list, parser_version, updated_at
+    ) VALUES (
+      $id, $description, $product, $group_id, $status_id, $status, $type_id, $type, $overdue,
+      $amount_units, $interest_units, $surcharge_units, $discount_units, $fee_units, $total_units,
+      $due_date, $paid_date, $is_group_subscription, $gateway_id, $raw_list, $parser_version, $updated_at
+    )
+    ON CONFLICT(id) DO UPDATE SET
+      description = excluded.description,
+      product = COALESCE(excluded.product, invoices.product),
+      group_id = COALESCE(excluded.group_id, invoices.group_id),
+      status_id = COALESCE(excluded.status_id, invoices.status_id),
+      status = COALESCE(excluded.status, invoices.status),
+      type_id = COALESCE(excluded.type_id, invoices.type_id),
+      type = COALESCE(excluded.type, invoices.type),
+      overdue = excluded.overdue,
+      amount_units = COALESCE(excluded.amount_units, invoices.amount_units),
+      interest_units = COALESCE(excluded.interest_units, invoices.interest_units),
+      surcharge_units = COALESCE(excluded.surcharge_units, invoices.surcharge_units),
+      discount_units = COALESCE(excluded.discount_units, invoices.discount_units),
+      fee_units = COALESCE(excluded.fee_units, invoices.fee_units),
+      total_units = COALESCE(excluded.total_units, invoices.total_units),
+      due_date = COALESCE(excluded.due_date, invoices.due_date),
+      paid_date = COALESCE(excluded.paid_date, invoices.paid_date),
+      is_group_subscription = excluded.is_group_subscription,
+      gateway_id = COALESCE(excluded.gateway_id, invoices.gateway_id),
+      raw_list = COALESCE(excluded.raw_list, invoices.raw_list),
+      parser_version = excluded.parser_version,
+      updated_at = excluded.updated_at
+  `);
+  const upsertGroupStmt = db.prepare(`
+    INSERT INTO groups (
+      id, name, service, service_id, plan, category_id, category, status_id, status,
+      is_administrator, admin_name, amount_units, service_total_units,
+      amount_without_fee_units, fee_units, slots_total, slots_taken, slots_free,
+      loyalty_months, loyalty_ends_at, auto_renew, access_method, joined_at, cancelled_at,
+      scheduled_cancellation, waiting_list, private, raw_summary, updated_at
+    ) VALUES (
+      $id, $name, $service, $service_id, $plan, $category_id, $category, $status_id, $status,
+      $is_administrator, $admin_name, $amount_units, $service_total_units,
+      $amount_without_fee_units, $fee_units, $slots_total, $slots_taken, $slots_free,
+      $loyalty_months, $loyalty_ends_at, $auto_renew, $access_method, $joined_at, $cancelled_at,
+      $scheduled_cancellation, $waiting_list, $private, $raw_summary, $updated_at
+    )
+    ON CONFLICT(id) DO UPDATE SET
+      name = excluded.name,
+      service = COALESCE(excluded.service, groups.service),
+      service_id = COALESCE(excluded.service_id, groups.service_id),
+      plan = COALESCE(excluded.plan, groups.plan),
+      category_id = COALESCE(excluded.category_id, groups.category_id),
+      category = COALESCE(excluded.category, groups.category),
+      status_id = COALESCE(excluded.status_id, groups.status_id),
+      status = COALESCE(excluded.status, groups.status),
+      is_administrator = excluded.is_administrator,
+      admin_name = COALESCE(excluded.admin_name, groups.admin_name),
+      amount_units = COALESCE(excluded.amount_units, groups.amount_units),
+      service_total_units = COALESCE(excluded.service_total_units, groups.service_total_units),
+      amount_without_fee_units =
+        COALESCE(excluded.amount_without_fee_units, groups.amount_without_fee_units),
+      fee_units = COALESCE(excluded.fee_units, groups.fee_units),
+      slots_total = COALESCE(excluded.slots_total, groups.slots_total),
+      slots_taken = COALESCE(excluded.slots_taken, groups.slots_taken),
+      slots_free = COALESCE(excluded.slots_free, groups.slots_free),
+      loyalty_months = COALESCE(excluded.loyalty_months, groups.loyalty_months),
+      loyalty_ends_at = COALESCE(excluded.loyalty_ends_at, groups.loyalty_ends_at),
+      auto_renew = COALESCE(excluded.auto_renew, groups.auto_renew),
+      access_method = COALESCE(excluded.access_method, groups.access_method),
+      joined_at = COALESCE(excluded.joined_at, groups.joined_at),
+      cancelled_at = COALESCE(excluded.cancelled_at, groups.cancelled_at),
+      scheduled_cancellation = excluded.scheduled_cancellation,
+      waiting_list = excluded.waiting_list,
+      private = excluded.private,
+      raw_summary = COALESCE(excluded.raw_summary, groups.raw_summary),
+      updated_at = excluded.updated_at
+  `);
+  const invoiceParams = (invoice, raw, parserVersion) => ({
+    $id: invoice.id,
+    $description: invoice.description,
+    $product: invoice.product,
+    $group_id: invoice.groupId,
+    $status_id: invoice.statusId,
+    $status: invoice.status,
+    $type_id: invoice.typeId,
+    $type: invoice.type,
+    $overdue: flag(invoice.overdue),
+    $amount_units: invoice.amount,
+    $interest_units: invoice.interest,
+    $surcharge_units: invoice.surcharge,
+    $discount_units: invoice.discount,
+    $fee_units: invoice.fee,
+    $total_units: invoice.total,
+    $due_date: invoice.dueDate,
+    $paid_date: invoice.paidDate,
+    $is_group_subscription: flag(invoice.isGroupSubscription),
+    $gateway_id: invoice.gatewayId,
+    $raw_list: raw,
+    $parser_version: parserVersion,
+    $updated_at: stamp()
+  });
+  const groupParams = (group, raw) => ({
+    $id: group.id,
+    $name: group.name,
+    $service: group.service,
+    $service_id: group.serviceId,
+    $plan: group.plan,
+    $category_id: group.categoryId,
+    $category: group.category,
+    $status_id: group.statusId,
+    $status: group.status,
+    $is_administrator: flag(group.isAdministrator),
+    $admin_name: group.adminName,
+    $amount_units: group.amount,
+    $service_total_units: group.serviceTotal,
+    $amount_without_fee_units: group.amountWithoutFee,
+    $fee_units: group.fee,
+    $slots_total: group.slotsTotal,
+    $slots_taken: group.slotsTaken,
+    $slots_free: group.slotsFree,
+    $loyalty_months: group.loyaltyMonths,
+    $loyalty_ends_at: group.loyaltyEndsAt,
+    $auto_renew: group.autoRenew === null ? null : flag(group.autoRenew),
+    $access_method: group.accessMethod,
+    $joined_at: group.joinedAt,
+    $cancelled_at: group.cancelledAt,
+    $scheduled_cancellation: flag(group.scheduledCancellation),
+    $waiting_list: flag(group.waitingList),
+    $private: flag(group.private),
+    $raw_summary: raw,
+    $updated_at: stamp()
+  });
+  return { upsertInvoiceStmt, upsertGroupStmt, invoiceParams, groupParams };
+}
+var flag = (value) => value ? 1 : 0;
+
+// src/cache/repo.ts
+function invoiceWhere(filters) {
+  const where = new Where;
+  where.maybe(filters.statusId, "status_id = ?", filters.statusId);
+  where.maybe(filters.groupId, "group_id = ?", filters.groupId);
+  where.maybe(filters.from, `${INVOICE_DATE} >= ?`, filters.from);
+  where.maybe(filters.to, `${INVOICE_DATE} <= ?`, filters.to);
+  where.maybe(filters.product, "product = ?", filters.product);
+  if (filters.onlyPaid)
+    where.add("status_id = 13");
+  return where;
+}
+function createCacheRepo(db, now) {
+  const stamp = () => new Date(now()).toISOString();
+  const { upsertInvoiceStmt, upsertGroupStmt, invoiceParams, groupParams } = prepareStatements(db, stamp);
+  return {
+    upsertInvoices(invoices, raws, parserVersion) {
+      return inTx(db, () => {
+        invoices.forEach((invoice, index) => {
+          const raw = raws[index];
+          upsertInvoiceStmt.run(invoiceParams(invoice, raw === undefined ? null : JSON.stringify(raw), parserVersion));
+        });
+        return invoices.length;
+      });
+    },
+    invoicesToReparse(parserVersion) {
+      return db.query(`SELECT id, raw_list FROM invoices
+            WHERE raw_list IS NOT NULL
+              AND (parser_version IS NULL OR parser_version < ?)`).all(parserVersion);
+    },
+    setInvoiceItems(invoiceId, items, raw) {
+      inTx(db, () => {
+        db.query("DELETE FROM invoice_items WHERE invoice_id = ?").run(invoiceId);
+        const insert = db.prepare(`INSERT INTO invoice_items (invoice_id, position, item_id, description, quantity, amount_units)
+           VALUES (?, ?, ?, ?, ?, ?)`);
+        for (const item of items) {
+          insert.run(item.invoiceId, item.position, item.id, item.description, item.quantity, item.amount);
+        }
+        db.query(`UPDATE invoices SET item_count = ?, raw_detail = ?, detail_fetched_at = ?,
+                               detail_error = NULL, updated_at = ? WHERE id = ?`).run(items.length, JSON.stringify(raw ?? null), stamp(), stamp(), invoiceId);
+      });
+    },
+    markInvoiceDetailError(invoiceId, message) {
+      db.query("UPDATE invoices SET detail_error = ?, detail_fetched_at = ?, updated_at = ? WHERE id = ?").run(message.slice(0, 300), stamp(), stamp(), invoiceId);
+    },
+    pendingInvoiceDetails(limit) {
+      const threshold = new Date(now() - DETAIL_TTL_MS).toISOString();
+      const rows = db.query(`SELECT id, status_id, detail_fetched_at FROM invoices
+            WHERE detail_error IS NULL
+              AND (detail_fetched_at IS NULL OR detail_fetched_at < ?)
+            ORDER BY ${INVOICE_DATE} DESC
+            LIMIT ?`).all(threshold, limit * 4);
+      const wanted = [];
+      for (const row of rows) {
+        if (row.detail_fetched_at !== null && isFinalInvoice(row.status_id))
+          continue;
+        wanted.push(row.id);
+        if (wanted.length >= limit)
+          break;
+      }
+      return wanted;
+    },
+    upsertGroups(groups, raws) {
+      return inTx(db, () => {
+        groups.forEach((group, index) => {
+          upsertGroupStmt.run(groupParams(group, JSON.stringify(raws[index] ?? null)));
+        });
+        return groups.length;
+      });
+    },
+    setGroupDetail(group, participants, raw) {
+      inTx(db, () => {
+        upsertGroupStmt.run(groupParams(group, null));
+        db.query("DELETE FROM group_participants WHERE group_id = ?").run(group.id);
+        const insert = db.prepare(`INSERT INTO group_participants
+             (group_id, position, name, amount_units, slots, joined_at, access_sent_at, left_at, waiting_list)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+        for (const person of participants) {
+          insert.run(person.groupId, person.position, person.name, person.amount, person.slots, person.joinedAt, person.accessSentAt, person.leftAt, flag2(person.waitingList));
+        }
+        db.query(`UPDATE groups SET raw_detail = ?, detail_fetched_at = ?, detail_error = NULL,
+                             updated_at = ? WHERE id = ?`).run(JSON.stringify(raw ?? null), stamp(), stamp(), group.id);
+      });
+    },
+    pendingGroupDetails(limit) {
+      return db.query(`SELECT id FROM groups
+              WHERE detail_fetched_at IS NULL AND detail_error IS NULL
+              ORDER BY id LIMIT ?`).all(limit).map((row) => row.id);
+    },
+    markGroupDetailError(groupId, message) {
+      db.query("UPDATE groups SET detail_error = ?, detail_fetched_at = ?, updated_at = ? WHERE id = ?").run(message.slice(0, 300), stamp(), stamp(), groupId);
+    },
+    upsertCredits(credits, raws) {
+      return inTx(db, () => {
+        const insert = db.prepare(`INSERT INTO credits (id, description, status_id, status, type_id, type, type_label,
+                                amount_units, available_units, fee_units, credited_at,
+                                invoice_id, group_id, refundable, raw, updated_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+           ON CONFLICT(id) DO UPDATE SET
+             description = excluded.description, status_id = excluded.status_id,
+             status = excluded.status, type_id = excluded.type_id, type = excluded.type,
+             type_label = excluded.type_label, amount_units = excluded.amount_units,
+             /* The two halves of the ledger are disjoint, but a value already
+                known must never be replaced by an absent one. */
+             available_units = COALESCE(excluded.available_units, credits.available_units),
+             fee_units = excluded.fee_units,
+             credited_at = COALESCE(excluded.credited_at, credits.credited_at),
+             invoice_id = COALESCE(excluded.invoice_id, credits.invoice_id),
+             group_id = COALESCE(excluded.group_id, credits.group_id),
+             refundable = excluded.refundable, raw = excluded.raw,
+             updated_at = excluded.updated_at`);
+        credits.forEach((credit, index) => {
+          insert.run(credit.id, credit.description, credit.statusId, credit.status, credit.typeId, credit.type, credit.typeLabel, credit.amount, credit.available, credit.fee, credit.creditedAt, credit.invoiceId, credit.groupId, flag2(credit.refundable), JSON.stringify(raws[index] ?? null), stamp());
+        });
+        return credits.length;
+      });
+    },
+    upsertPayouts(payouts, raws) {
+      return inTx(db, () => {
+        const insert = db.prepare(`INSERT INTO payouts (group_id, description, amount_units, member_share_units,
+                                status_id, status, next_payment_date, raw, updated_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+           ON CONFLICT(group_id) DO UPDATE SET
+             description = excluded.description, amount_units = excluded.amount_units,
+             member_share_units = excluded.member_share_units, status_id = excluded.status_id,
+             status = excluded.status, next_payment_date = excluded.next_payment_date,
+             raw = excluded.raw, updated_at = excluded.updated_at`);
+        payouts.forEach((payout, index) => {
+          insert.run(payout.groupId, payout.description, payout.amount, payout.memberShare, payout.statusId, payout.status, payout.nextPaymentDate, JSON.stringify(raws[index] ?? null), stamp());
+        });
+        return payouts.length;
+      });
+    },
+    pendingPayoutStatements(limit) {
+      return db.query("SELECT group_id FROM payouts WHERE statement_fetched_at IS NULL ORDER BY group_id LIMIT ?").all(limit).map((row) => row.group_id);
+    },
+    setPayoutEntries(groupId, entries) {
+      inTx(db, () => {
+        db.query("DELETE FROM payout_entries WHERE group_id = ?").run(groupId);
+        const insert = db.prepare(`INSERT INTO payout_entries
+             (group_id, entry_id, description, participant, amount_units, status_id, status, date)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`);
+        for (const entry of entries) {
+          insert.run(entry.groupId, entry.id, entry.description, entry.participant, entry.amount, entry.statusId, entry.status, entry.date);
+        }
+        db.query("UPDATE payouts SET statement_fetched_at = ? WHERE group_id = ?").run(stamp(), groupId);
+      });
+    },
+    listInvoices(filters) {
+      const where = invoiceWhere(filters);
+      return db.query(`SELECT * FROM invoices ${where.sql()}
+            ORDER BY ${INVOICE_DATE} DESC, id DESC LIMIT ? OFFSET ?`).all(...where.values, filters.limit ?? 50, filters.offset ?? 0);
+    },
+    countInvoices(filters) {
+      const where = invoiceWhere(filters);
+      const row = db.query(`SELECT COUNT(*) AS total FROM invoices ${where.sql()}`).get(...where.values);
+      return row.total;
+    },
+    getInvoice(id) {
+      return db.query("SELECT * FROM invoices WHERE id = ?").get(id) ?? null;
+    },
+    getInvoiceItems(invoiceId) {
+      return db.query("SELECT * FROM invoice_items WHERE invoice_id = ? ORDER BY position").all(invoiceId);
+    },
+    listGroups(options = {}) {
+      const where = new Where;
+      where.maybe(options.administrator === undefined ? undefined : 1, "is_administrator = ?", options.administrator ? 1 : 0);
+      where.maybe(options.statusId, "status_id = ?", options.statusId);
+      return db.query(`SELECT * FROM groups ${where.sql()} ORDER BY name COLLATE NOCASE LIMIT ?`).all(...where.values, options.limit ?? 200);
+    },
+    getGroup(id) {
+      return db.query("SELECT * FROM groups WHERE id = ?").get(id) ?? null;
+    },
+    getParticipants(groupId) {
+      return db.query("SELECT * FROM group_participants WHERE group_id = ? ORDER BY position").all(groupId);
+    },
+    listCredits(options = {}) {
+      const where = new Where;
+      where.maybe(options.typeId, "type_id = ?", options.typeId);
+      where.maybe(options.statusId, "status_id = ?", options.statusId);
+      return db.query(`SELECT * FROM credits ${where.sql()} ORDER BY credited_at DESC, id DESC LIMIT ?`).all(...where.values, options.limit ?? 100);
+    },
+    listPayouts() {
+      return db.query("SELECT * FROM payouts ORDER BY next_payment_date IS NULL, next_payment_date").all();
+    },
+    getPayoutEntries(groupId) {
+      return db.query("SELECT * FROM payout_entries WHERE group_id = ? ORDER BY date DESC, entry_id DESC").all(groupId);
+    },
+    rebuildFts() {
+      inTx(db, () => {
+        db.exec("DELETE FROM invoices_fts");
+        db.exec(`INSERT INTO invoices_fts (rowid, description, product)
+             SELECT id, description, COALESCE(product, '') FROM invoices`);
+        db.exec("DELETE FROM groups_fts");
+        db.exec(`INSERT INTO groups_fts (rowid, name, service, plan)
+             SELECT id, name, COALESCE(service, ''), COALESCE(plan, '') FROM groups`);
+      });
+    },
+    getMeta(key) {
+      const row = db.query("SELECT value FROM meta WHERE key = ?").get(key);
+      return row?.value ?? null;
+    },
+    setMeta(key, value) {
+      if (value === null) {
+        db.query("DELETE FROM meta WHERE key = ?").run(key);
+        return;
+      }
+      db.query("INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value);
+    },
+    query(sql, ...values) {
+      return db.query(sql).all(...values);
+    },
+    stats() {
+      const one = (sql) => db.query(sql).get();
+      const counts = one(`SELECT COUNT(*) AS invoices,
+                SUM(CASE WHEN detail_fetched_at IS NOT NULL THEN 1 ELSE 0 END) AS withItems,
+                SUM(CASE WHEN detail_error IS NOT NULL THEN 1 ELSE 0 END) AS errors,
+                MIN(${INVOICE_DATE}) AS oldest, MAX(${INVOICE_DATE}) AS newest
+           FROM invoices`);
+      const groups = one("SELECT COUNT(*) AS total FROM groups").total;
+      const credits = one("SELECT COUNT(*) AS total FROM credits").total;
+      const payouts = one("SELECT COUNT(*) AS total FROM payouts").total;
+      return {
+        invoices: counts.invoices,
+        invoicesWithItems: counts.withItems ?? 0,
+        pendingDetails: this.pendingInvoiceDetails(1e4).length,
+        detailErrors: counts.errors ?? 0,
+        groups,
+        credits,
+        payouts,
+        oldest: counts.oldest,
+        newest: counts.newest,
+        lastSyncAt: this.getMeta(META.lastCompleted),
+        lastFullSyncAt: this.getMeta(META.lastFull)
+      };
+    }
+  };
+}
+var DETAIL_TTL_MS, flag2 = (value) => value ? 1 : 0, INVOICE_DATE = "COALESCE(paid_date, due_date)";
+var init_repo = __esm(() => {
+  init_sqlite();
+  init_enums();
+  init_db();
+  DETAIL_TTL_MS = 24 * 60 * 60 * 1000;
+});
+
+// src/core/errors.ts
+var LOGIN_HINT = "Rode `kotas login` no terminal (e-mail e senha) ou `kotas login --from-browser chrome`.", KotasApiError, KotasHttpError, KotasAuthError, DeviceChallengeError, TwoFactorError, RateLimitError, SessionError, LoginError, ParseError, STATUS_HINTS;
+var init_errors = __esm(() => {
+  KotasApiError = class KotasApiError extends Error {
+    status;
+    apiMessage;
+    path;
+    data;
+    constructor(status, apiMessage, path, hint, data) {
+      super(`O Kotas respondeu ${status} em ${path}: ${apiMessage || "sem mensagem"}` + (hint ? ` \u2014 ${hint}` : ""));
+      this.status = status;
+      this.apiMessage = apiMessage;
+      this.path = path;
+      this.data = data;
+      this.name = "KotasApiError";
+    }
+  };
+  KotasHttpError = class KotasHttpError extends Error {
+    status;
+    constructor(status, message) {
+      super(message);
+      this.status = status;
+      this.name = "KotasHttpError";
+    }
+  };
+  KotasAuthError = class KotasAuthError extends Error {
+    constructor(message) {
+      super(`${message} ${LOGIN_HINT}`);
+      this.name = "KotasAuthError";
+    }
+  };
+  DeviceChallengeError = class DeviceChallengeError extends Error {
+    hash;
+    tipoSolicitacao;
+    constructor(hash, tipoSolicitacao) {
+      const what = tipoSolicitacao === 2 ? "o IP" : tipoSolicitacao === 1 ? "o dispositivo" : "o acesso";
+      super(`O Kotas pediu a libera\xE7\xE3o d${what === "o IP" ? "o" : "o"} ${what}. ` + "Confirme pelo e-mail, SMS ou Telegram que a Kotas acabou de enviar e rode `kotas login` de novo. " + "O identificador do dispositivo foi salvo; n\xE3o apague a sess\xE3o nem troque de m\xE1quina no meio do processo.");
+      this.hash = hash;
+      this.tipoSolicitacao = tipoSolicitacao;
+      this.name = "DeviceChallengeError";
+    }
+  };
+  TwoFactorError = class TwoFactorError extends Error {
+    constructor(message) {
+      super(`${message} Rode \`kotas login --pin 123456\` com o c\xF3digo de 6 d\xEDgitos.`);
+      this.name = "TwoFactorError";
+    }
+  };
+  RateLimitError = class RateLimitError extends Error {
+    attempts;
+    constructor(attempts, message) {
+      super(message);
+      this.attempts = attempts;
+      this.name = "RateLimitError";
+    }
+  };
+  SessionError = class SessionError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "SessionError";
+    }
+  };
+  LoginError = class LoginError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LoginError";
+    }
+  };
+  ParseError = class ParseError extends Error {
+    constructor(message) {
+      super(`${message} Rode \`kotas doctor\` para ver qual camada quebrou.`);
+      this.name = "ParseError";
+    }
+  };
+  STATUS_HINTS = {
+    400: "o Kotas devolve 400 tamb\xE9m para grupo encerrado, que some da API depois do cancelamento",
+    401: "token expirado ou recusado",
+    404: "rota inexistente, ou faltou algum par\xE2metro obrigat\xF3rio de query",
+    412: "libera\xE7\xE3o de dispositivo ou de IP pendente",
+    426: "a vers\xE3o do front (header `versao`) est\xE1 velha demais; ajuste KOTAS_APP_VERSION",
+    429: "limite de requisi\xE7\xF5es"
+  };
+});
+
+// src/session/jwt.ts
+function decodeSegment(segment) {
+  const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
+  return Buffer.from(padded, "base64").toString("utf8");
+}
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[1]) {
+    throw new SessionError("O token salvo n\xE3o \xE9 um JWT (esperado 3 partes separadas por ponto).");
+  }
+  try {
+    const parsed = JSON.parse(decodeSegment(parts[1]));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new Error("not a claims object");
+    }
+    return parsed;
+  } catch {
+    throw new SessionError("O payload do token salvo n\xE3o \xE9 um JSON v\xE1lido.");
+  }
+}
+function expiresAt(token) {
+  const { exp } = decodeJwt(token);
+  return typeof exp === "number" ? exp * 1000 : null;
+}
+function isExpired(token, now, skewMs = REFRESH_SKEW_MS) {
+  const at = expiresAt(token);
+  return at === null || now > at - skewMs;
+}
+function profileFrom(claims) {
+  const flag3 = (value) => value === undefined ? undefined : String(value).toLowerCase() === "true";
+  const count = (value) => {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+  };
+  return {
+    userId: claims.ID_USUARIO,
+    name: claims.NOME_COMPLETO_USUARIO ?? claims.NOME,
+    nickname: claims.TX_NICKNAME,
+    email: claims.TX_EMAIL_USUARIO,
+    purchases: count(claims.QN_COMPRAS),
+    twoFactorEnabled: flag3(claims.TWFAHABILITADO),
+    isMember: flag3(claims.IS_MBA),
+    isAdministrator: flag3(claims.IS_ADA)
+  };
+}
+var REFRESH_SKEW_MS = 30000;
+var init_jwt = __esm(() => {
+  init_errors();
+});
+
+// src/core/http.ts
+function createHttp(opts, deps = {}) {
+  const doFetch = deps.fetch ?? ((url2, init) => fetch(url2, init));
+  const sleep = deps.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+  const now = deps.now ?? (() => Date.now());
+  const random = deps.random ?? Math.random;
+  const { session, log } = opts;
+  let jar = null;
+  let loadedMtime = null;
+  let authDead = false;
+  let requests = 0;
+  let refreshes = 0;
+  let lastRequestAt = null;
+  let refreshing = null;
+  let chain = Promise.resolve();
+  const serial = (fn) => {
+    const run = chain.then(fn);
+    chain = run.then(() => {
+      return;
+    }, () => {
+      return;
+    });
+    return run;
+  };
+  function markAuthDead(message) {
+    authDead = true;
+    throw new KotasAuthError(message);
+  }
+  function ensureSession() {
+    const mtime = session.mtimeMs();
+    if (jar === null || authDead && mtime !== loadedMtime) {
+      jar = session.load();
+      loadedMtime = mtime;
+      authDead = false;
+    }
+    if (jar === null)
+      markAuthDead("Nenhuma sess\xE3o do Kotas salva.");
+    if (authDead)
+      markAuthDead("A sess\xE3o do Kotas expirou ou foi recusada.");
+    return jar;
+  }
+  async function gap() {
+    const earliest = (lastRequestAt ?? 0) + opts.minIntervalMs + random() * opts.jitterMs;
+    const wait = earliest - now();
+    if (wait > 0)
+      await sleep(wait);
+    lastRequestAt = now();
+  }
+  function url(request) {
+    const target = new URL(request.path.replace(/^\/+/, ""), `${opts.baseUrl}/`);
+    for (const [key, value] of Object.entries(request.query ?? {})) {
+      if (value !== undefined && value !== null)
+        target.searchParams.set(key, String(value));
+    }
+    return target.toString();
+  }
+  function headersFor(request, current) {
+    return {
+      "content-type": "application/json",
+      accept: "application/json, text/plain, */*",
+      token: opts.apiToken,
+      versao: opts.appVersion,
+      hashDispositivo: current?.hashDispositivo ?? "",
+      ...current && request.auth !== "none" ? { authorization: `Bearer ${current.accessToken}` } : {},
+      ...request.headers
+    };
+  }
+  async function dispatch(request, current) {
+    const label = request.label ?? request.path;
+    const target = url(request);
+    const started = now();
+    for (let attempt = 1;; attempt += 1) {
+      await gap();
+      let response;
+      try {
+        response = await doFetch(target, {
+          method: request.method,
+          headers: headersFor(request, current),
+          ...request.body === undefined ? {} : { body: JSON.stringify(request.body) },
+          redirect: "manual",
+          signal: AbortSignal.timeout(opts.timeoutMs)
+        });
+      } catch (error) {
+        requests += 1;
+        const reason = error instanceof Error ? error.message : String(error);
+        if (attempt < MAX_ATTEMPTS) {
+          log.warn(`${label} network error on attempt ${attempt}: ${reason}`);
+          await sleep(backoffMs(attempt));
+          continue;
+        }
+        throw new KotasHttpError(0, `Falha de rede ao chamar o Kotas em ${label}: ${reason}`);
+      }
+      requests += 1;
+      if (isTransient(response.status) && attempt < MAX_ATTEMPTS) {
+        log.warn(`${label} HTTP ${response.status} on attempt ${attempt}; backing off`);
+        await sleep(backoffMs(attempt));
+        continue;
+      }
+      if (isTransient(response.status)) {
+        throw new RateLimitError(attempt, `O Kotas respondeu HTTP ${response.status} em ${label} ap\xF3s ${attempt} tentativas. Espere alguns minutos.`);
+      }
+      log.debug(`${label} ${response.status} ${now() - started}ms`);
+      return { status: response.status, headers: response.headers, text: await response.text() };
+    }
+  }
+  async function doRefresh(current) {
+    const response = await dispatch({
+      method: "POST",
+      path: REFRESH_PATH,
+      headers: { role: "refresh-token" },
+      body: { token: current.accessToken, refreshToken: current.refreshToken },
+      label: "autenticacao/refresh-token"
+    }, current);
+    if (response.status !== 200) {
+      markAuthDead(`O Kotas recusou o refresh token (HTTP ${response.status}).`);
+    }
+    const token = parseRefreshBody(response.text);
+    if (!token)
+      markAuthDead("O refresh do Kotas devolveu um corpo que n\xE3o \xE9 um token.");
+    refreshes += 1;
+    const next = { ...current, accessToken: token, savedAt: now() };
+    session.save(next);
+    jar = next;
+    loadedMtime = session.mtimeMs();
+    log.debug("access token refreshed");
+    return next;
+  }
+  function refresh(current) {
+    if (!refreshing) {
+      refreshing = doRefresh(current).finally(() => {
+        refreshing = null;
+      });
+    }
+    return refreshing;
+  }
+  async function ensureToken() {
+    const current = ensureSession();
+    if (!isExpired(current.accessToken, now()))
+      return current;
+    return refresh(current);
+  }
+  async function send(request) {
+    if (request.auth === "none")
+      return serial(() => dispatch(request, jar));
+    return serial(async () => {
+      let current = await ensureToken();
+      let response = await dispatch(request, current);
+      if (response.status === 401) {
+        current = await refresh(current);
+        response = await dispatch(request, current);
+        if (response.status === 401) {
+          markAuthDead("O Kotas recusou a sess\xE3o mesmo depois de renovar o token.");
+        }
+      }
+      return response;
+    });
+  }
+  async function json(request) {
+    const label = request.label ?? request.path;
+    const response = await send(request);
+    const parsed = parseJson(response.text);
+    if (response.status >= 400) {
+      throw new KotasApiError(response.status, messageOf(parsed) ?? response.text.slice(0, 200), label, STATUS_HINTS[response.status], parsed);
+    }
+    return parsed;
+  }
+  return {
+    serial,
+    send,
+    get: (path, query, label) => json({ method: "GET", path, ...query ? { query } : {}, label: label ?? path }),
+    post: (path, body, options = {}) => json({ method: "POST", path, body, label: path, ...options }),
+    adopt(data) {
+      jar = data;
+      loadedMtime = session.mtimeMs();
+      authDead = false;
+    },
+    resetSession() {
+      jar = null;
+      loadedMtime = null;
+      authDead = false;
+    },
+    markAuthDead,
+    state: () => ({ authDead, requests, refreshes, lastRequestAt })
+  };
+}
+function parseRefreshBody(text) {
+  const trimmed = text.trim();
+  if (trimmed === "")
+    return null;
+  const parsed = parseJson(trimmed);
+  if (typeof parsed === "string")
+    return parsed.trim() || null;
+  if (parsed && typeof parsed === "object") {
+    const token = parsed.token;
+    if (typeof token === "string" && token !== "")
+      return token;
+    return null;
+  }
+  return /^[\w-]+\.[\w-]+\.[\w-]+$/.test(trimmed) ? trimmed : null;
+}
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return;
+  }
+}
+function messageOf(parsed) {
+  if (parsed && typeof parsed === "object") {
+    const message = parsed.message;
+    if (typeof message === "string" && message !== "")
+      return message;
+  }
+  return;
+}
+var BACKOFF_BASE_MS = 2000, BACKOFF_MAX_MS = 60000, MAX_ATTEMPTS = 4, REFRESH_PATH = "autenticacao/refresh-token", backoffMs = (attempt) => Math.min(BACKOFF_BASE_MS * 2 ** (attempt - 1), BACKOFF_MAX_MS), isTransient = (status) => status === 429 || status >= 500;
+var init_http = __esm(() => {
+  init_errors();
+  init_jwt();
+});
+
+// src/core/logger.ts
+import { appendFileSync } from "fs";
+function redactSecrets(message, secrets) {
+  let output = message;
+  for (const secret of secrets) {
+    if (secret.length >= MIN_SECRET_LENGTH)
+      output = output.split(secret).join("***");
+  }
+  return output;
+}
+function createLogger(opts) {
+  const source = opts.secrets ?? [];
+  const secrets = () => typeof source === "function" ? source() : source;
+  const emit = (level, message) => {
+    const line = `[${level}] ${redactSecrets(message, secrets())}
+`;
+    (opts.sink ?? ((text) => process.stderr.write(text)))(line);
+    if (opts.logFile) {
+      try {
+        appendFileSync(opts.logFile, line);
+      } catch {}
+    }
+  };
+  return {
+    debug: (message) => emit("debug", message),
+    info: (message) => emit("info", message),
+    warn: (message) => emit("warn", message),
+    error: (message) => emit("error", message)
+  };
+}
+var MIN_SECRET_LENGTH = 8;
+var init_logger = () => {};
+
+// src/kotas/api.ts
+async function fetchPage(http, path, style, page, pageSize, extra = {}) {
+  const size = clampPageSize(pageSize);
+  const payload = await http.get(path, { page, pageSize: size, ...extra }, path);
+  if (style.envelope) {
+    if (!payload || Array.isArray(payload) || !Array.isArray(payload.itens)) {
+      throw new ParseError(`${path} devolveu um envelope sem \`itens\`.`);
+    }
+    const total = typeof payload.totalItens === "number" ? payload.totalItens : null;
+    const hasMore = payload.temProximaPagina ?? (typeof payload.totalPaginas === "number" ? page - style.startPage + 1 < payload.totalPaginas : payload.itens.length >= size);
+    return { items: payload.itens, hasMore, total };
+  }
+  if (!Array.isArray(payload)) {
+    throw new ParseError(`${path} devolveu ${typeof payload} onde era esperado um array.`);
+  }
+  return { items: payload, hasMore: payload.length >= size, total: null };
+}
+function createKotasApi(http) {
+  return {
+    version: () => http.get(ENDPOINTS.version, undefined, ENDPOINTS.version),
+    listGroups: (page, pageSize = MAX_PAGE_SIZE) => fetchPage(http, ENDPOINTS.groups, PAGE_STYLE.groups, page, pageSize),
+    getGroup: (id, as) => http.get(as === "admin" ? ENDPOINTS.groupAsAdmin(id) : ENDPOINTS.groupAsMember(id), undefined, as === "admin" ? "grupo/admin/{id}" : "grupo/membro/{id}"),
+    listInvoices: (statusId, page, pageSize = MAX_PAGE_SIZE) => fetchPage(http, ENDPOINTS.invoices, PAGE_STYLE.invoices, page, pageSize, {
+      statusId
+    }),
+    async getInvoiceItems(invoiceId) {
+      const payload = await http.get(ENDPOINTS.invoiceStatement, { faturaId: invoiceId }, ENDPOINTS.invoiceStatement);
+      if (Array.isArray(payload))
+        return payload;
+      const items = payload?.itens;
+      return Array.isArray(items) ? items : [];
+    },
+    listCredits: (page, pageSize = MAX_PAGE_SIZE, ativos = false) => fetchPage(http, ENDPOINTS.credits, PAGE_STYLE.credits, page, pageSize, {
+      ativos
+    }),
+    getBalance: () => http.get(ENDPOINTS.balance, undefined, ENDPOINTS.balance),
+    getSavings: () => http.get(ENDPOINTS.savings, undefined, ENDPOINTS.savings),
+    listPayouts: (page, pageSize = MAX_PAGE_SIZE) => fetchPage(http, ENDPOINTS.payouts, PAGE_STYLE.payouts, page, pageSize),
+    async getPayoutStatement(groupId) {
+      const payload = await http.get(ENDPOINTS.payoutStatement, { grupoId: groupId }, ENDPOINTS.payoutStatement);
+      return Array.isArray(payload) ? payload : [];
+    },
+    async searchServices(query) {
+      const payload = await http.get(ENDPOINTS.searchServices(query), undefined, "servico/planos/pesquisar/{q}");
+      if (Array.isArray(payload))
+        return payload;
+      return payload ? [payload] : [];
+    },
+    getRaw: (path, query) => http.get(path, query, path)
+  };
+}
+var ENDPOINTS, PAGE_STYLE, clampPageSize = (size) => Math.max(1, Math.min(Math.trunc(size), MAX_PAGE_SIZE));
+var init_api = __esm(() => {
+  init_config();
+  init_errors();
+  ENDPOINTS = {
+    version: "api/versao",
+    groups: "grupo/usuario/",
+    groupAsMember: (id) => `grupo/membro/${id}`,
+    groupAsAdmin: (id) => `grupo/admin/${id}`,
+    invoices: "fatura/obterlista",
+    invoiceStatement: "fatura/extrato",
+    credits: "credito/obterlista",
+    balance: "credito",
+    savings: "credito/economia",
+    payouts: "recebimento/obtergrupos",
+    payoutStatement: "recebimento/extrato",
+    searchServices: (query) => `servico/planos/pesquisar/${encodeURIComponent(query)}`
+  };
+  PAGE_STYLE = {
+    groups: { startPage: 0, envelope: false },
+    payouts: { startPage: 0, envelope: true },
+    invoices: { startPage: 1, envelope: false },
+    credits: { startPage: 1, envelope: false }
+  };
+});
+
+// src/session/store.ts
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { dirname as dirname2 } from "path";
+import { Type as Type2 } from "@sinclair/typebox";
+import { Value as Value2 } from "@sinclair/typebox/value";
+function encrypt(key, plaintext) {
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  return Buffer.concat([Buffer.from([FORMAT_VERSION]), iv, cipher.getAuthTag(), ciphertext]);
+}
+function decrypt(key, blob) {
+  if (blob.length < HEADER_BYTES || blob[0] !== FORMAT_VERSION) {
+    throw new SessionError(`session.enc corrompido ou em formato desconhecido. ${LOGIN_HINT}`);
+  }
+  const iv = blob.subarray(1, 1 + IV_BYTES);
+  const tag = blob.subarray(1 + IV_BYTES, HEADER_BYTES);
+  const ciphertext = blob.subarray(HEADER_BYTES);
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  } catch {
+    throw new SessionError(`N\xE3o foi poss\xEDvel decifrar session.enc: a chave mudou (KOTAS_SESSION_KEY ou session.key). ${LOGIN_HINT}`);
+  }
+}
+function resolveKey(source, createIfMissing) {
+  if (source.sessionKey)
+    return Buffer.from(source.sessionKey, "base64");
+  if (existsSync2(source.keyPath)) {
+    const key2 = Buffer.from(readFileSync(source.keyPath, "utf8").trim(), "base64");
+    if (key2.length !== SESSION_KEY_BYTES) {
+      throw new SessionError(`${source.keyPath} inv\xE1lida: esperado base64 de ${SESSION_KEY_BYTES} bytes. Apague o arquivo e rode \`kotas login\`.`);
+    }
+    return key2;
+  }
+  if (!createIfMissing)
+    return null;
+  const key = randomBytes(SESSION_KEY_BYTES);
+  mkdirSync2(dirname2(source.keyPath), { recursive: true, mode: 448 });
+  writeFileSync(source.keyPath, `${key.toString("base64")}
+`, { mode: 384 });
+  chmodSync2(source.keyPath, 384);
+  return key;
+}
+function createSessionStore(config) {
+  let secrets = [];
+  return {
+    paths: { sessionPath: config.sessionPath, keyPath: config.keyPath },
+    load() {
+      if (!existsSync2(config.sessionPath))
+        return null;
+      const key = resolveKey(config, false);
+      if (!key) {
+        throw new SessionError(`${config.sessionPath} existe, mas n\xE3o h\xE1 chave para decifr\xE1-lo (KOTAS_SESSION_KEY ou ${config.keyPath}). ${LOGIN_HINT}`);
+      }
+      const plaintext = decrypt(key, readFileSync(config.sessionPath));
+      let parsed;
+      try {
+        parsed = JSON.parse(plaintext.toString("utf8"));
+      } catch {
+        throw new SessionError(`session.enc decifrado, mas com conte\xFAdo inv\xE1lido. ${LOGIN_HINT}`);
+      }
+      if (!Value2.Check(SessionSchema, parsed)) {
+        throw new SessionError(`session.enc em vers\xE3o n\xE3o suportada. ${LOGIN_HINT}`);
+      }
+      secrets = secretsOf(parsed);
+      return parsed;
+    },
+    save(data) {
+      mkdirSync2(config.configDir, { recursive: true, mode: 448 });
+      const key = resolveKey(config, true);
+      const temp = `${config.sessionPath}.tmp`;
+      writeFileSync(temp, encrypt(key, Buffer.from(JSON.stringify(data))), { mode: 384 });
+      renameSync(temp, config.sessionPath);
+      chmodSync2(config.sessionPath, 384);
+      secrets = secretsOf(data);
+    },
+    clear() {
+      if (existsSync2(config.sessionPath))
+        unlinkSync(config.sessionPath);
+      secrets = [];
+    },
+    mtimeMs() {
+      try {
+        return statSync(config.sessionPath).mtimeMs;
+      } catch {
+        return null;
+      }
+    },
+    peekSecrets: () => secrets
+  };
+}
+var FORMAT_VERSION = 1, IV_BYTES = 12, TAG_BYTES = 16, HEADER_BYTES, SessionSchema, secretsOf = (data) => [data.accessToken, data.refreshToken, data.hashDispositivo].filter((value) => value !== "");
+var init_store = __esm(() => {
+  init_config();
+  init_errors();
+  HEADER_BYTES = 1 + IV_BYTES + TAG_BYTES;
+  SessionSchema = Type2.Object({
+    version: Type2.Literal(1),
+    accessToken: Type2.String({ minLength: 1 }),
+    refreshToken: Type2.String({ minLength: 1 }),
+    hashDispositivo: Type2.String(),
+    email: Type2.Optional(Type2.String()),
+    savedAt: Type2.Number()
+  });
+});
+
+// src/context.ts
+var exports_context = {};
+__export(exports_context, {
+  createContext: () => createContext,
+  contextFromEnv: () => contextFromEnv
+});
+function createContext(config, deps = {}) {
+  const now = deps.now ?? (() => Date.now());
+  const session = deps.session ?? createSessionStore(config);
+  const log = deps.log ?? createLogger({
+    ...config.logFile ? { logFile: config.logFile } : {},
+    secrets: () => session.peekSecrets()
+  });
+  const http = createHttp({
+    session,
+    baseUrl: config.baseUrl,
+    apiToken: config.apiToken,
+    appVersion: config.appVersion,
+    minIntervalMs: config.minIntervalMs,
+    jitterMs: config.jitterMs,
+    timeoutMs: config.httpTimeoutMs,
+    log
+  }, {
+    ...deps.fetch ? { fetch: deps.fetch } : {},
+    ...deps.sleep ? { sleep: deps.sleep } : {},
+    ...deps.random ? { random: deps.random } : {},
+    now
+  });
+  const api = createKotasApi(http);
+  let db;
+  let repo;
+  const cache = () => {
+    if (!repo) {
+      db = deps.db ?? openCache(config.dbPath);
+      repo = createCacheRepo(db, now);
+    }
+    return repo;
+  };
+  return {
+    config,
+    log,
+    now,
+    session,
+    http,
+    api,
+    cache,
+    dispose: () => {
+      if (deps.db === undefined)
+        db?.close();
+      db = undefined;
+      repo = undefined;
+    }
+  };
+}
+var contextFromEnv = () => createContext(loadConfig());
+var init_context = __esm(() => {
+  init_db();
+  init_repo();
+  init_config();
+  init_http();
+  init_logger();
+  init_api();
+  init_store();
+});
+
+// src/tools/define.ts
+import { Value as Value3 } from "@sinclair/typebox/value";
+function defineTool(tool) {
+  return tool;
+}
+function withDefaults(tool, args, ctx) {
+  if (!ctx.config.compact)
+    return args;
+  const properties = tool.input.properties;
+  if (!properties || !("compact" in properties))
+    return args;
+  const record = args;
+  if (record.compact !== undefined)
+    return args;
+  return { ...record, compact: true };
+}
+async function runTool(tool, rawArgs, ctx) {
+  if (!Value3.Check(tool.input, rawArgs)) {
+    const problems = [...Value3.Errors(tool.input, rawArgs)].map((error) => `${error.path || "/"}: ${error.message}`);
+    throw new ToolInputError(tool.name, problems);
+  }
+  return tool.run(withDefaults(tool, rawArgs, ctx), ctx);
+}
+function compactObject(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined));
+}
+var ToolInputError;
+var init_define = __esm(() => {
+  ToolInputError = class ToolInputError extends Error {
+    tool;
+    problems;
+    constructor(tool, problems) {
+      super(`Argumentos inv\xE1lidos para ${tool}:
+${problems.map((p) => `  - ${p}`).join(`
+`)}`);
+      this.tool = tool;
+      this.problems = problems;
+      this.name = "ToolInputError";
+    }
+  };
+});
+
+// src/domain/money.ts
+function toUnits(value) {
+  if (value === null || value === undefined || value === "")
+    return null;
+  const parsed = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(parsed))
+    return null;
+  return Math.round(parsed * SCALE);
+}
+function pickUnits(precise, fallback) {
+  return toUnits(precise) ?? toUnits(fallback);
+}
+function toDecimal(units) {
+  return Math.round(units) / SCALE;
+}
+function money(units) {
+  return units === null || units === undefined ? null : { amount: toDecimal(units), currency: "BRL" };
+}
+function sumUnits(values) {
+  let total = 0;
+  let seen = false;
+  for (const value of values) {
+    if (value === null || value === undefined)
+      continue;
+    total += value;
+    seen = true;
+  }
+  return seen ? total : null;
+}
+var SCALE = 1e4;
+
+// src/cache/analytics.ts
+function spendingSummary(cache, options) {
+  const expression = GROUP_EXPRESSION[options.by];
+  const clauses = [`${INVOICE_DATE} IS NOT NULL`];
+  const values = [];
+  if (!options.includeUnpaid)
+    clauses.push(`status_id = ${PAID_STATUS_ID}`);
+  if (options.from) {
+    clauses.push(`${INVOICE_DATE} >= ?`);
+    values.push(options.from);
+  }
+  if (options.to) {
+    clauses.push(`${INVOICE_DATE} <= ?`);
+    values.push(options.to);
+  }
+  const where = `WHERE ${clauses.join(" AND ")}`;
+  const rows = cache.query(`SELECT ${expression} AS key, SUM(total_units) AS total, COUNT(*) AS invoices
+       FROM invoices ${where}
+      GROUP BY key
+      ORDER BY ${options.by === "product" || options.by === "status" ? "total DESC" : "key DESC"}`, ...values);
+  let grand = 0;
+  let count = 0;
+  const out = rows.map((row) => {
+    grand += row.total ?? 0;
+    count += row.invoices;
+    const key = row.key ?? "desconhecido";
+    return { key, label: key, total: money(row.total), invoices: row.invoices };
+  });
+  return { rows: out, total: count > 0 ? money(grand) : null, invoices: count };
+}
+function purchaseHistory(cache, options = {}) {
+  const rows = cache.query(`SELECT group_id,
+            COALESCE(product, description) AS product,
+            MIN(${INVOICE_DATE}) AS first,
+            MAX(${INVOICE_DATE}) AS last,
+            COUNT(DISTINCT substr(${INVOICE_DATE}, 1, 7)) AS months,
+            SUM(total_units) AS total
+       FROM invoices
+      WHERE status_id = ${PAID_STATUS_ID} AND ${INVOICE_DATE} IS NOT NULL
+      GROUP BY group_id, product
+      ORDER BY last DESC`);
+  const live = new Map(cache.listGroups({ limit: 1000 }).map((group) => [group.id, group.status]));
+  const deposits = creditTotalsByGroup(cache, 96);
+  const transfers = creditTotalsByGroup(cache, 97);
+  const entries = [];
+  const covered = new Set;
+  for (const row of rows) {
+    if (row.group_id === null && !options.includeCreditPurchases)
+      continue;
+    if (row.group_id !== null)
+      covered.add(row.group_id);
+    const status = row.group_id !== null ? live.get(row.group_id) ?? null : null;
+    const deposit = row.group_id !== null ? deposits.get(row.group_id) : undefined;
+    const received = row.group_id !== null ? transfers.get(row.group_id) : undefined;
+    entries.push({
+      groupId: row.group_id,
+      product: row.product ?? "(sem descri\xE7\xE3o)",
+      firstInvoice: row.first,
+      lastInvoice: row.last,
+      monthsPaid: row.months,
+      totalPaid: money(row.total),
+      activeToday: row.group_id !== null && live.has(row.group_id),
+      status,
+      ...deposit === undefined ? {} : { deposit: money(deposit) },
+      ...received === undefined ? {} : { receivedAsAdmin: money(received) }
+    });
+  }
+  for (const group of cache.listGroups({ limit: 1000 })) {
+    if (covered.has(group.id))
+      continue;
+    const received = transfers.get(group.id);
+    const deposit = deposits.get(group.id);
+    entries.push({
+      groupId: group.id,
+      product: group.service ?? group.name,
+      firstInvoice: group.joined_at,
+      lastInvoice: null,
+      monthsPaid: 0,
+      totalPaid: null,
+      activeToday: true,
+      status: group.status,
+      role: group.is_administrator === 1 ? "administrador" : "membro",
+      ...deposit === undefined ? {} : { deposit: money(deposit) },
+      ...received === undefined ? {} : { receivedAsAdmin: money(received) }
+    });
+  }
+  return entries;
+}
+function creditTotalsByGroup(cache, typeId) {
+  const rows = cache.query("SELECT group_id, SUM(available_units) AS total FROM credits WHERE type_id = ? GROUP BY group_id", typeId);
+  const totals = new Map;
+  for (const row of rows) {
+    if (row.group_id !== null && row.total !== null)
+      totals.set(row.group_id, row.total);
+  }
+  return totals;
+}
+var GROUP_EXPRESSION;
+var init_analytics = __esm(() => {
+  init_enums();
+  init_repo();
+  GROUP_EXPRESSION = {
+    month: `substr(${INVOICE_DATE}, 1, 7)`,
+    year: `substr(${INVOICE_DATE}, 1, 4)`,
+    product: "COALESCE(product, description)",
+    status: "COALESCE(status, 'desconhecido')"
+  };
+});
+
+// src/tools/fields.ts
+import { Type as Type3 } from "@sinclair/typebox";
+var compactField, dayField = (description) => Type3.Optional(Type3.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}$", description })), limitField = (max, fallback) => Type3.Optional(Type3.Integer({ minimum: 1, maximum: max, description: `M\xE1ximo de itens (default ${fallback})` })), offsetField, invoiceIdField, groupIdField, invoiceStatusField, INVOICE_STATUS_BY_NAME;
+var init_fields = __esm(() => {
+  compactField = Type3.Optional(Type3.Boolean({
+    description: "Devolve apenas os campos essenciais, para economizar contexto (default KOTAS_COMPACT)"
+  }));
+  offsetField = Type3.Optional(Type3.Integer({ minimum: 0, description: "Itens a pular (pagina\xE7\xE3o)" }));
+  invoiceIdField = Type3.Integer({
+    minimum: 1,
+    description: "Id da fatura no Kotas, como aparece em `list_invoices`"
+  });
+  groupIdField = Type3.Integer({
+    minimum: 1,
+    description: "Id do grupo no Kotas, como aparece em `list_subscriptions` ou na descri\xE7\xE3o da fatura"
+  });
+  invoiceStatusField = Type3.Optional(Type3.Union([
+    Type3.Literal("pago"),
+    Type3.Literal("pendente"),
+    Type3.Literal("cancelado"),
+    Type3.Literal("atraso"),
+    Type3.Literal("estornado")
+  ], { description: "Filtra por situa\xE7\xE3o da fatura" }));
+  INVOICE_STATUS_BY_NAME = {
+    pendente: 11,
+    pago: 13,
+    cancelado: 19,
+    atraso: 63,
+    estornado: 67
+  };
+});
+
+// src/tools/analytics.ts
+import { Type as Type4 } from "@sinclair/typebox";
+var purchaseHistory2, spendingSummary2;
+var init_analytics2 = __esm(() => {
+  init_analytics();
+  init_define();
+  init_fields();
+  purchaseHistory2 = defineTool({
+    name: "purchase_history",
+    description: "Reconstr\xF3i a linha do tempo de TODAS as assinaturas j\xE1 pagas, inclusive as encerradas, a partir " + "das faturas \u2014 que \xE9 a \xFAnica fonte que sobra, porque um grupo cancelado some da API. Para cada " + "produto devolve a primeira e a \xFAltima fatura, quantos meses foram pagos, o total pago, se ainda " + "est\xE1 ativo, a cau\xE7\xE3o retida e o que foi recebido como administrador. Grupos que o usu\xE1rio " + "ADMINISTRA aparecem com `monthsPaid: 0` e `totalPaid: null`: neles n\xE3o h\xE1 fatura, o administrador " + "paga o servi\xE7o por fora e recebe o rateio dos membros. N\xE3o usa a rede.",
+    readOnly: true,
+    input: Type4.Object({
+      include_credit_purchases: Type4.Optional(Type4.Boolean({
+        description: "Inclui as compras de cr\xE9dito avulso, que n\xE3o pertencem a nenhum grupo (default false)"
+      })),
+      active_only: Type4.Optional(Type4.Boolean({ description: "S\xF3 as assinaturas que ainda existem hoje (default false)" }))
+    }),
+    run: (args, ctx) => {
+      const cache = ctx.cache();
+      const all = purchaseHistory(cache, {
+        includeCreditPurchases: args.include_credit_purchases === true
+      });
+      const entries = args.active_only ? all.filter((entry) => entry.activeToday) : all;
+      return compactObject({
+        total: entries.length,
+        active: all.filter((entry) => entry.activeToday).length,
+        ended: all.filter((entry) => !entry.activeToday).length,
+        history: entries,
+        ...all.length === 0 ? { note: "O cache est\xE1 vazio. Rode `sync` antes de perguntar." } : {}
+      });
+    }
+  });
+  spendingSummary2 = defineTool({
+    name: "spending_summary",
+    description: "Soma os gastos no Kotas agrupados por m\xEAs, ano, produto ou situa\xE7\xE3o. Conta apenas faturas PAGAS " + "por padr\xE3o: cancelada e estornada n\xE3o s\xE3o dinheiro que saiu. N\xE3o usa a rede. A data usada \xE9 a do " + "pagamento e, na falta dela, a do vencimento.",
+    readOnly: true,
+    input: Type4.Object({
+      by: Type4.Union([Type4.Literal("month"), Type4.Literal("year"), Type4.Literal("product"), Type4.Literal("status")], { description: "Como agrupar" }),
+      from: dayField("Data inicial (YYYY-MM-DD)"),
+      to: dayField("Data final (YYYY-MM-DD)"),
+      include_unpaid: Type4.Optional(Type4.Boolean({
+        description: "Inclui faturas n\xE3o pagas \u2014 s\xF3 faz sentido com by=status (default false)"
+      }))
+    }),
+    run: (args, ctx) => {
+      const result = spendingSummary(ctx.cache(), compactObject({
+        by: args.by,
+        from: args.from,
+        to: args.to,
+        includeUnpaid: args.include_unpaid === true
+      }));
+      return compactObject({
+        by: args.by,
+        paidOnly: args.include_unpaid !== true,
+        total: result.total,
+        invoices: result.invoices,
+        rows: result.rows,
+        ...result.invoices === 0 ? { note: "Nenhuma fatura no per\xEDodo. Rode `sync` se o cache estiver vazio." } : {}
+      });
+    }
+  });
+});
+
+// src/tools/auth.ts
+import { Type as Type5 } from "@sinclair/typebox";
+function cacheFacts(ctx) {
+  try {
+    const stats = ctx.cache().stats();
+    return {
+      cache: {
+        invoices: stats.invoices,
+        groups: stats.groups,
+        credits: stats.credits,
+        payouts: stats.payouts,
+        pendingDetails: stats.pendingDetails,
+        lastSyncAt: stats.lastSyncAt,
+        lastFullSyncAt: stats.lastFullSyncAt
+      }
+    };
+  } catch {
+    return { cache: null };
+  }
+}
+var authStatus;
+var init_auth = __esm(() => {
+  init_errors();
+  init_jwt();
+  init_define();
+  authStatus = defineTool({
+    name: "auth_status",
+    description: "Diz se h\xE1 uma sess\xE3o do Kotas salva, de quem ela \xE9 e at\xE9 quando o token vale, e o que j\xE1 est\xE1 no " + "cache local. N\xE3o usa a rede por padr\xE3o. Com verify=true gasta 1 requisi\xE7\xE3o para confirmar que o " + "Kotas ainda aceita a sess\xE3o (renovando o token se preciso). Comece por aqui quando outra tool " + "reclamar de sess\xE3o. Nunca devolve o valor de um token.",
+    readOnly: true,
+    input: Type5.Object({
+      verify: Type5.Optional(Type5.Boolean({
+        description: "Tamb\xE9m faz 1 chamada ao Kotas para confirmar que a sess\xE3o \xE9 aceita"
+      }))
+    }),
+    run: async (args, ctx) => {
+      const { session, http, config } = ctx;
+      let data = null;
+      let loadError;
+      try {
+        data = session.load();
+      } catch (error) {
+        loadError = error instanceof Error ? error.message : String(error);
+      }
+      const state = http.state();
+      const base = {
+        loggedIn: data !== null,
+        sessionFile: config.sessionPath,
+        savedAt: data ? new Date(data.savedAt).toISOString() : null,
+        deviceBound: Boolean(data?.hashDispositivo),
+        refreshes: state.refreshes,
+        ...cacheFacts(ctx)
+      };
+      if (loadError)
+        return compactObject({ ...base, loggedIn: false, error: loadError });
+      if (data === null) {
+        return compactObject({
+          ...base,
+          hint: "Nenhuma sess\xE3o salva. Rode `kotas login` ou `kotas login --from-browser chrome`."
+        });
+      }
+      let profile = {};
+      let expiry = null;
+      let expired;
+      try {
+        profile = profileFrom(decodeJwt(data.accessToken));
+        const at = expiresAt(data.accessToken);
+        expiry = at === null ? null : new Date(at).toISOString();
+        expired = isExpired(data.accessToken, ctx.now(), 0);
+      } catch (error) {
+        return compactObject({
+          ...base,
+          loggedIn: false,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+      const withProfile = compactObject({
+        ...base,
+        email: data.email ?? profile.email,
+        profile: compactObject(profile),
+        accessTokenExpiresAt: expiry,
+        accessTokenExpired: expired
+      });
+      if (!args.verify)
+        return withProfile;
+      try {
+        const balance = await ctx.api.getBalance();
+        return compactObject({
+          ...withProfile,
+          verified: true,
+          refreshes: http.state().refreshes,
+          balanceReachable: balance !== null && typeof balance === "object"
+        });
+      } catch (error) {
+        if (error instanceof KotasAuthError) {
+          return compactObject({ ...withProfile, loggedIn: false, verified: false, error: error.message });
+        }
+        throw error;
+      }
+    }
+  });
+});
+
+// src/cache/rows.ts
+function invoiceOut(row, compact = false) {
+  const base = {
+    id: row.id,
+    description: row.description,
+    product: row.product,
+    groupId: row.group_id,
+    status: row.status,
+    statusId: row.status_id,
+    type: row.type,
+    overdue: yes(row.overdue),
+    total: money(row.total_units),
+    dueDate: row.due_date,
+    paidDate: row.paid_date
+  };
+  if (compact)
+    return base;
+  return {
+    ...base,
+    amount: money(row.amount_units),
+    interest: money(row.interest_units),
+    discount: money(row.discount_units),
+    fee: money(row.fee_units),
+    itemCount: row.item_count,
+    ...row.detail_error ? { detailError: row.detail_error } : {}
+  };
+}
+function invoiceItemOut(row) {
+  return {
+    position: row.position,
+    description: row.description,
+    quantity: row.quantity,
+    amount: money(row.amount_units)
+  };
+}
+function groupOut(row, compact = false) {
+  const base = {
+    id: row.id,
+    name: row.name,
+    service: row.service,
+    plan: row.plan,
+    status: row.status,
+    isAdministrator: yes(row.is_administrator),
+    amount: money(row.amount_units),
+    slots: { total: row.slots_total, taken: row.slots_taken, free: row.slots_free }
+  };
+  if (compact)
+    return base;
+  return {
+    ...base,
+    category: row.category,
+    adminName: row.admin_name,
+    serviceTotal: money(row.service_total_units),
+    amountWithoutFee: money(row.amount_without_fee_units),
+    fee: money(row.fee_units),
+    loyaltyMonths: row.loyalty_months,
+    loyaltyEndsAt: row.loyalty_ends_at,
+    autoRenew: row.auto_renew === null ? null : yes(row.auto_renew),
+    accessMethod: row.access_method,
+    joinedAt: row.joined_at,
+    cancelledAt: row.cancelled_at,
+    scheduledCancellation: yes(row.scheduled_cancellation),
+    waitingList: yes(row.waiting_list),
+    private: yes(row.private),
+    ...row.detail_error ? { detailError: row.detail_error } : {}
+  };
+}
+function participantOut(row) {
+  return {
+    name: row.name,
+    amount: money(row.amount_units),
+    slots: row.slots,
+    joinedAt: row.joined_at,
+    accessSentAt: row.access_sent_at,
+    leftAt: row.left_at,
+    waitingList: yes(row.waiting_list)
+  };
+}
+function creditOut(row) {
+  return {
+    id: row.id,
+    description: row.description,
+    status: row.status,
+    type: row.type,
+    meaning: row.type_label,
+    amount: money(row.amount_units),
+    available: money(row.available_units),
+    creditedAt: row.credited_at,
+    invoiceId: row.invoice_id,
+    groupId: row.group_id,
+    refundable: yes(row.refundable)
+  };
+}
+function payoutOut(row) {
+  return {
+    groupId: row.group_id,
+    description: row.description,
+    amount: money(row.amount_units),
+    memberShare: money(row.member_share_units),
+    status: row.status,
+    nextPaymentDate: row.next_payment_date
+  };
+}
+function payoutEntryOut(row) {
+  return {
+    id: row.entry_id,
+    description: row.description,
+    participant: row.participant,
+    amount: money(row.amount_units),
+    status: row.status,
+    date: row.date
+  };
+}
+var yes = (value) => value === 1;
+var init_rows = () => {};
+
+// src/domain/dates.ts
+function toDay(value) {
+  if (typeof value !== "string" || value === "")
+    return null;
+  const isoMatch = ISO_DAY.exec(value);
+  if (isoMatch)
+    return `${isoMatch[1]}-${isoMatch[2]}-${isoMatch[3]}`;
+  const brMatch = BR_DAY.exec(value.trim());
+  if (brMatch)
+    return `${brMatch[3]}-${brMatch[2]}-${brMatch[1]}`;
+  return null;
+}
+function dayFromEpochMs(ms) {
+  return new Date(ms).toISOString().slice(0, 10);
+}
+var ISO_DAY, BR_DAY;
+var init_dates = __esm(() => {
+  ISO_DAY = /^(\d{4})-(\d{2})-(\d{2})/;
+  BR_DAY = /^(\d{2})\/(\d{2})\/(\d{4})$/;
+});
+
+// src/domain/normalize.ts
+function parseSubject(description) {
+  const match = INVOICE_SUBJECT.exec(description.trim());
+  if (!match?.groups)
+    return { product: null, groupId: null };
+  const groupId = Number(match.groups.groupId);
+  return {
+    product: match.groups.product?.trim() || null,
+    groupId: Number.isSafeInteger(groupId) ? groupId : null
+  };
+}
+function groupIdFrom(description) {
+  const match = GROUP_IN_TEXT.exec(description);
+  if (!match?.[1])
+    return null;
+  const id = Number(match[1]);
+  return Number.isSafeInteger(id) ? id : null;
+}
+function normalizeInvoice(raw) {
+  const id = num(raw.id);
+  if (id === null)
+    return null;
+  const description = str(raw.descricao) ?? "";
+  const statusId = num(raw.statusId);
+  const typeId = num(raw.tipoId);
+  return {
+    id,
+    description,
+    ...parseSubject(description),
+    statusId,
+    status: str(raw.statusDescricao) ?? invoiceStatusOf(statusId),
+    typeId,
+    type: str(raw.tipoDescricao) ?? labelOf(INVOICE_TYPE, typeId),
+    overdue: bool(raw.vencida),
+    amount: pickUnits(raw.valor4Casas, raw.valor),
+    interest: pickUnits(raw.valorJuros4Casas, raw.valorJuros),
+    surcharge: pickUnits(raw.valorReajuste4Casas, raw.valorReajuste),
+    discount: pickUnits(raw.valorDesconto4Casas, raw.valorDesconto),
+    fee: toUnits(raw.valorTaxa),
+    total: pickUnits(raw.valorTotal4Casas, raw.valorTotal) ?? pickUnits(raw.valor4Casas, raw.valor),
+    dueDate: toDay(raw.dataVencimento) ?? toDay(raw.dataVencimentoFormatada),
+    paidDate: toDay(raw.dataPagamento) ?? toDay(raw.dataPagamentoFormatada),
+    isGroupSubscription: bool(raw.ehInscricaoEmGrupo),
+    gatewayId: num(raw.idGatewayPagamento)
+  };
+}
+function normalizeInvoiceItems(invoiceId, raws) {
+  return raws.map((raw, position) => ({
+    invoiceId,
+    position,
+    id: num(raw.id),
+    description: str(raw.descricao) ?? "",
+    quantity: num(raw.quantidade) ?? 1,
+    amount: pickUnits(raw.valor4Casas, raw.valor)
+  }));
+}
+function normalizeGroup(raw) {
+  const id = num(raw.id);
+  if (id === null)
+    return null;
+  const detail = raw;
+  const statusId = num(raw.statusId);
+  const slotsTotal = num(raw.kotasTotais);
+  const slotsTaken = num(raw.kotasAssinadas);
+  return {
+    id,
+    name: str(raw.nome) ?? str(raw.servico) ?? `Grupo #${id}`,
+    service: str(raw.servico),
+    serviceId: num(raw.servicoId),
+    plan: str(detail.plano),
+    categoryId: num(raw.idCategoria),
+    category: str(detail.categoriaDescricao),
+    statusId,
+    status: str(raw.status) ?? groupStatusOf(statusId),
+    isAdministrator: bool(raw.inAdministrador),
+    adminName: str(raw.adminNome),
+    amount: pickUnits(raw.valor4Casas, raw.valor),
+    serviceTotal: pickUnits(detail.valorTotalServico4Casas, detail.valorTotalServico),
+    amountWithoutFee: toUnits(detail.valorSemTaxa),
+    fee: toUnits(detail.valorTaxa),
+    slotsTotal,
+    slotsTaken,
+    slotsFree: num(raw.kotasDisponiveis) ?? (slotsTotal !== null && slotsTaken !== null ? slotsTotal - slotsTaken : null),
+    loyaltyMonths: num(raw.fidelidade),
+    loyaltyEndsAt: toDay(detail.dataTerminoFidelidade),
+    autoRenew: detail.renovacaoAutomatica === undefined ? null : bool(detail.renovacaoAutomatica),
+    accessMethod: accessMethodOf(detail.formaAcessoId),
+    joinedAt: toDay(raw.dataCadastro),
+    cancelledAt: toDay(detail.dataCancelamento),
+    scheduledCancellation: bool(raw.inCancelamentoAgendado),
+    waitingList: bool(raw.inFilaEspera),
+    private: bool(raw.privado)
+  };
+}
+function normalizeParticipants(groupId, raw) {
+  const list = Array.isArray(raw.participantes) ? raw.participantes : [];
+  return list.map((participant, position) => ({
+    groupId,
+    position,
+    name: str(participant.nome),
+    amount: pickUnits(participant.valor4Casas, participant.valor),
+    slots: num(participant.qtdKotas),
+    joinedAt: toDay(participant.dataInscricao),
+    accessSentAt: toDay(participant.dataEnvioAcesso),
+    leftAt: toDay(participant.dataDescadastro),
+    waitingList: bool(participant.inFilaEspera)
+  }));
+}
+function normalizeCredit(raw) {
+  const id = num(raw.id);
+  if (id === null)
+    return null;
+  const description = str(raw.descricao) ?? "";
+  const statusId = num(raw.statusId);
+  const typeId = num(raw.tipoId);
+  const available = pickUnits(raw.valorDisponivel4Casas, raw.valorDisponivel);
+  return {
+    id,
+    description,
+    statusId,
+    status: str(raw.statusDescricao) ?? creditStatusOf(statusId),
+    typeId,
+    type: creditTypeOf(typeId),
+    typeLabel: typeId === null ? null : CREDIT_TYPE_LABEL[typeId] ?? null,
+    amount: pickUnits(raw.valor4Casas, raw.valor),
+    available,
+    fee: toUnits(raw.taxa),
+    creditedAt: toDay(raw.dataCredito) ?? toDay(raw.dataCreditoFormatada),
+    invoiceId: num(raw.faturaId),
+    groupId: num(raw.grupoId) ?? groupIdFrom(description),
+    refundable: bool(raw.disponivelParaEstorno)
+  };
+}
+function normalizeBalance(raw, savings) {
+  return {
+    available: pickUnits(raw.valorDisponivel4Casas, raw.valorDisponivel),
+    blocked: pickUnits(raw.valorBloqueado4Casas, raw.valorBloqueado),
+    pending: pickUnits(raw.valorPendente4Casas, raw.valorPendente),
+    saved: savings ? toUnits(savings.valorEconomizado) : null
+  };
+}
+function normalizePayout(raw) {
+  const groupId = num(raw.id);
+  if (groupId === null)
+    return null;
+  const statusId = num(raw.statusId);
+  return {
+    groupId,
+    description: str(raw.descricao) ?? `Grupo #${groupId}`,
+    amount: pickUnits(raw.valor4Casas, raw.valor),
+    memberShare: toUnits(raw.vl_kota_membro),
+    statusId,
+    status: str(raw.status) ?? payoutStatusOf(statusId),
+    nextPaymentDate: toDay(raw.dataProximoPagamento) ?? toDay(raw.dataProximoPagamentoFormatada)
+  };
+}
+function normalizePayoutEntry(groupId, raw) {
+  const id = num(raw.id);
+  if (id === null)
+    return null;
+  const statusId = num(raw.statusId);
+  return {
+    groupId,
+    id,
+    description: str(raw.descricao) ?? "",
+    participant: str(raw.participante),
+    amount: pickUnits(raw.valor4Casas, raw.valor),
+    statusId,
+    status: str(raw.statusDescricao) ?? payoutStatusOf(statusId),
+    date: toDay(raw.data) ?? toDay(raw.dataFormatada)
+  };
+}
+var INVOICE_SUBJECT, GROUP_IN_TEXT, num = (value) => {
+  if (value === null || value === undefined || value === "")
+    return null;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : null;
+}, str = (value) => typeof value === "string" && value.trim() !== "" ? value.trim() : null, bool = (value) => value === true;
+var init_normalize = __esm(() => {
+  init_dates();
+  init_enums();
+  INVOICE_SUBJECT = /^Fatura grupo\s+(?<product>.+)\s+#(?<groupId>\d+)\s*$/;
+  GROUP_IN_TEXT = /#(\d+)/;
+});
+
+// src/tools/credits.ts
+import { Type as Type6 } from "@sinclair/typebox";
+var balance, listCredits, TYPE_BY_NAME;
+var init_credits = __esm(() => {
+  init_rows();
+  init_enums();
+  init_normalize();
+  init_define();
+  init_fields();
+  balance = defineTool({
+    name: "balance",
+    description: "Saldo da carteira Kotas ao vivo (1\u20132 requisi\xE7\xF5es): dispon\xEDvel, bloqueado (as cau\xE7\xF5es das " + "inscri\xE7\xF5es) e pendente, mais a economia acumulada que a pr\xF3pria Kotas calcula. O saldo bloqueado " + "n\xE3o \xE9 dinheiro perdido: volta quando a assinatura \xE9 encerrada.",
+    readOnly: true,
+    input: Type6.Object({
+      with_savings: Type6.Optional(Type6.Boolean({ description: "Tamb\xE9m busca a economia acumulada (1 requisi\xE7\xE3o extra, default true)" }))
+    }),
+    run: async (args, ctx) => {
+      const raw = await ctx.api.getBalance();
+      const savings = args.with_savings === false ? null : await ctx.api.getSavings().catch(() => null);
+      const parsed = normalizeBalance(raw, savings);
+      return compactObject({
+        available: money(parsed.available),
+        blocked: money(parsed.blocked),
+        pending: money(parsed.pending),
+        saved: money(parsed.saved),
+        note: "`blocked` s\xE3o cau\xE7\xF5es de inscri\xE7\xE3o, devolvidas ao encerrar a assinatura."
+      });
+    }
+  });
+  listCredits = defineTool({
+    name: "list_credits",
+    description: "Lista os lan\xE7amentos de cr\xE9dito do cache com o significado de cada tipo traduzido: adi\xE7\xE3o de " + "saldo, cau\xE7\xE3o da inscri\xE7\xE3o (fica bloqueada), repasse recebido como administrador e estorno de " + "cancelamento. N\xE3o usa a rede. \xC9 aqui que aparece o dinheiro que ENTROU \u2014 as faturas s\xF3 mostram o " + "que saiu. ATEN\xC7\xC3O: use `available`, n\xE3o `amount`. A API zera o valor de face de todo lan\xE7amento " + "j\xE1 consumido, ent\xE3o `amount` vem 0 em quase tudo; `available` \xE9 a cifra que existe de verdade e " + "\xE9 a que soma com o saldo da carteira.",
+    readOnly: true,
+    input: Type6.Object({
+      kind: Type6.Optional(Type6.Union([
+        Type6.Literal("adicaoDeSaldo"),
+        Type6.Literal("caucaoDaInscricao"),
+        Type6.Literal("repasseAdministrador"),
+        Type6.Literal("estornoCancelamento")
+      ], { description: "Filtra pelo tipo do lan\xE7amento" })),
+      limit: limitField(500, 100)
+    }),
+    run: (args, ctx) => {
+      const cache = ctx.cache();
+      const typeId = args.kind ? TYPE_BY_NAME[args.kind] : undefined;
+      const rows = cache.listCredits(compactObject({ typeId, limit: args.limit ?? 100 }));
+      return compactObject({
+        total: rows.length,
+        credits: rows.map(creditOut),
+        legend: CREDIT_TYPE_LABEL,
+        note: "Some por `available`: a API zera `amount` depois que o cr\xE9dito \xE9 usado ou sacado.",
+        ...rows.length === 0 && cache.stats().credits === 0 ? { note: "O cache est\xE1 vazio. Rode `sync` antes de perguntar." } : {}
+      });
+    }
+  });
+  TYPE_BY_NAME = {
+    adicaoDeSaldo: 94,
+    caucaoDaInscricao: 96,
+    repasseAdministrador: 97,
+    estornoCancelamento: 98
+  };
+});
+
+// src/tools/doctor.ts
+import { Type as Type7 } from "@sinclair/typebox";
+function loadSession(ctx, add) {
+  try {
+    const session = ctx.session.load();
+    if (!session) {
+      add("session", false, "Nenhuma sess\xE3o salva. Rode `kotas login`.");
+      return null;
+    }
+    add("session", true, `sess\xE3o de ${new Date(session.savedAt).toISOString()}, dispositivo ${session.hashDispositivo ? "vinculado" : "SEM hashDispositivo (risco de HTTP 412)"}`);
+    return session;
+  } catch (error) {
+    add("session", false, message(error));
+    return null;
+  }
+}
+async function probe(add, name, run) {
+  try {
+    const result = await run();
+    add(name, result.ok, result.detail);
+  } catch (error) {
+    add(name, false, message(error));
+  }
+}
+function report(checks, ctx, deep) {
+  try {
+    const stats = ctx.cache().stats();
+    checks.push({
+      name: "cache",
+      ok: stats.invoices > 0,
+      detail: stats.invoices === 0 ? "cache vazio: rode `sync`" : `${stats.invoices} faturas (${stats.invoicesWithItems} com itens, ${stats.pendingDetails} pendentes), ` + `${stats.groups} grupos, ${stats.credits} cr\xE9ditos, ${stats.payouts} recebimentos, ` + `${stats.oldest} \u2192 ${stats.newest}`
+    });
+  } catch (error) {
+    checks.push({ name: "cache", ok: false, detail: message(error) });
+  }
+  const seen = new Set(checks.map((check) => check.name));
+  const failed = checks.some((check) => !check.ok);
+  for (const name of LAYERS) {
+    if (seen.has(name))
+      continue;
+    checks.push({
+      name,
+      ok: false,
+      detail: !deep ? "pulado: deep=false" : failed ? "pulado: a camada anterior falhou" : "pulado"
+    });
+  }
+  const rank = (name) => {
+    const index = LAYERS.indexOf(name);
+    return index === -1 ? LAYERS.length : index;
+  };
+  const ordered = [...checks].sort((left, right) => rank(left.name) - rank(right.name));
+  return { ok: ordered.every((check) => check.ok), checks: ordered };
+}
+function message(error) {
+  if (error instanceof KotasAuthError)
+    return error.message;
+  return error instanceof Error ? error.message : String(error);
+}
+var LAYERS, doctor;
+var init_doctor = __esm(() => {
+  init_errors();
+  init_jwt();
+  init_define();
+  LAYERS = [
+    "config",
+    "session",
+    "token",
+    "version",
+    "groups",
+    "invoices",
+    "credits",
+    "payouts",
+    "cache"
+  ];
+  doctor = defineTool({
+    name: "doctor",
+    description: "Diagn\xF3stico camada a camada: configura\xE7\xE3o, sess\xE3o salva, renova\xE7\xE3o do token, vers\xE3o do front, " + "grupos, faturas, cr\xE9ditos, recebimentos e cache. Use quando algo falhar de um jeito estranho: ele " + "diz qual camada quebrou. Gasta cerca de 6 requisi\xE7\xF5es (2 com deep=false).",
+    readOnly: true,
+    input: Type7.Object({
+      deep: Type7.Optional(Type7.Boolean({ description: "Tamb\xE9m testa grupos, cr\xE9ditos e recebimentos (default true)" }))
+    }),
+    run: async (args, ctx) => {
+      const checks = [];
+      const add = (name, ok, detail) => checks.push({ name, ok, detail });
+      const deep = args.deep !== false;
+      add("config", true, `dados em ${ctx.config.configDir}, ritmo ${ctx.config.minIntervalMs}+${ctx.config.jitterMs} ms, ` + `versao ${ctx.config.appVersion}, somente leitura ${ctx.config.readOnly ? "ligado" : "desligado"}`);
+      const session = loadSession(ctx, add);
+      if (!session)
+        return report(checks, ctx, deep);
+      let tokenOk = false;
+      try {
+        const at = expiresAt(session.accessToken);
+        const expired = isExpired(session.accessToken, ctx.now(), 0);
+        const claims = decodeJwt(session.accessToken);
+        add("token", true, `JWT de ${claims.TX_EMAIL_USUARIO ?? "conta desconhecida"}, expira ${at ? new Date(at).toISOString() : "sem `exp`"}${expired ? " (expirado \u2014 ser\xE1 renovado na pr\xF3xima chamada)" : ""}`);
+        tokenOk = true;
+      } catch (error) {
+        add("token", false, message(error));
+      }
+      if (!tokenOk)
+        return report(checks, ctx, deep);
+      await probe(add, "version", async () => {
+        const current = await ctx.api.version();
+        const published = typeof current === "string" ? current : current === null || current === undefined ? null : JSON.stringify(current);
+        if (published === null) {
+          return {
+            ok: true,
+            detail: `o header \`versao\` ${ctx.config.appVersion} foi aceito (a rota n\xE3o publica a vers\xE3o atual)`
+          };
+        }
+        return {
+          ok: true,
+          detail: published.includes(ctx.config.appVersion) ? `a API confirma a vers\xE3o ${ctx.config.appVersion}` : `a API publica ${published}, o header \`versao\` manda ${ctx.config.appVersion}. ` + "Se aparecer HTTP 426, ajuste KOTAS_APP_VERSION."
+        };
+      });
+      await probe(add, "invoices", async () => {
+        const page = await ctx.api.listInvoices(13, 1, 5);
+        const withSubject = page.items.filter((raw) => /^Fatura grupo .+ #\d+$/.test(String(raw.descricao ?? ""))).length;
+        return {
+          ok: page.items.length > 0,
+          detail: `${page.items.length} faturas pagas na p\xE1gina 1; ${withSubject} com descri\xE7\xE3o no formato ` + "`Fatura grupo <produto> #<id>` (\xE9 o que reconstr\xF3i o hist\xF3rico dos grupos encerrados)"
+        };
+      });
+      if (deep) {
+        await probe(add, "groups", async () => {
+          const page = await ctx.api.listGroups(0, 5);
+          const admin = page.items.filter((raw) => raw.inAdministrador === true).length;
+          return {
+            ok: true,
+            detail: `${page.items.length} grupos ativos na p\xE1gina 0, ${admin} como administrador`
+          };
+        });
+        await probe(add, "credits", async () => {
+          const balance2 = await ctx.api.getBalance();
+          return {
+            ok: typeof balance2 === "object" && balance2 !== null,
+            detail: "saldo lido; dispon\xEDvel/bloqueado/pendente presentes: " + ["valorDisponivel", "valorBloqueado", "valorPendente"].filter((key) => (key in balance2)).join(", ")
+          };
+        });
+        await probe(add, "payouts", async () => {
+          const page = await ctx.api.listPayouts(0, 5);
+          return { ok: true, detail: `${page.items.length} recebimentos (total ${page.total ?? "?"})` };
+        });
+      }
+      return report(checks, ctx, deep);
+    }
+  });
+});
+
+// src/tools/export.ts
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2, resolve } from "path";
+import { Type as Type8 } from "@sinclair/typebox";
+function resolveInside(dir, name) {
+  const root = resolve(dir);
+  const target = resolve(join2(root, safeName(name)));
+  if (target !== join2(root, safeName(name)) || !target.startsWith(`${root}/`)) {
+    throw new Error(`Caminho fora de KOTAS_EXPORT_DIR (${root}). O export s\xF3 grava nesse diret\xF3rio.`);
+  }
+  return target;
+}
+function collect(ctx, scope, from, to) {
+  const cache = ctx.cache();
+  const amount = (units) => units === null ? null : toDecimal(units);
+  if (scope === "invoices") {
+    const filters = { limit: 1e5, ...from ? { from } : {}, ...to ? { to } : {} };
+    return cache.listInvoices(filters).map((row) => ({
+      id: row.id,
+      date: row.paid_date ?? row.due_date,
+      product: row.product,
+      group_id: row.group_id,
+      status: row.status,
+      total: amount(row.total_units),
+      discount: amount(row.discount_units),
+      interest: amount(row.interest_units),
+      due_date: row.due_date,
+      paid_date: row.paid_date,
+      description: row.description
+    }));
+  }
+  if (scope === "subscriptions") {
+    return cache.listGroups({ limit: 1e5 }).map((row) => ({
+      id: row.id,
+      name: row.name,
+      service: row.service,
+      plan: row.plan,
+      status: row.status,
+      role: row.is_administrator === 1 ? "administrador" : "membro",
+      amount: amount(row.amount_units),
+      service_total: amount(row.service_total_units),
+      slots_total: row.slots_total,
+      slots_taken: row.slots_taken,
+      joined_at: row.joined_at
+    }));
+  }
+  if (scope === "credits") {
+    return cache.listCredits({ limit: 1e5 }).map((row) => ({
+      id: row.id,
+      date: row.credited_at,
+      type: row.type,
+      meaning: row.type_label,
+      status: row.status,
+      amount: amount(row.amount_units),
+      available: amount(row.available_units),
+      group_id: row.group_id,
+      description: row.description
+    }));
+  }
+  if (scope === "payouts") {
+    return cache.listPayouts().map((row) => ({
+      group_id: row.group_id,
+      description: row.description,
+      amount: amount(row.amount_units),
+      member_share: amount(row.member_share_units),
+      status: row.status,
+      next_payment_date: row.next_payment_date
+    }));
+  }
+  return purchaseHistory(cache, { includeCreditPurchases: true }).map((entry) => ({
+    group_id: entry.groupId,
+    product: entry.product,
+    first_invoice: entry.firstInvoice,
+    last_invoice: entry.lastInvoice,
+    months_paid: entry.monthsPaid,
+    total_paid: entry.totalPaid?.amount ?? null,
+    active_today: entry.activeToday ? "sim" : "nao",
+    status: entry.status
+  }));
+}
+function toCsv(rows) {
+  if (rows.length === 0)
+    return "";
+  const headers = Object.keys(rows[0]);
+  const cell = (value) => {
+    if (value === null || value === undefined)
+      return "";
+    const text = String(value);
+    return /[",\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+  };
+  const lines = [headers.join(",")];
+  for (const row of rows)
+    lines.push(headers.map((header) => cell(row[header] ?? null)).join(","));
+  return `${lines.join(`
+`)}
+`;
+}
+var SCOPES, safeName = (name) => name.replace(/[/\\]/g, "_").replace(/^\.+/, ""), exportData;
+var init_export = __esm(() => {
+  init_analytics();
+  init_dates();
+  init_define();
+  init_fields();
+  SCOPES = ["invoices", "subscriptions", "credits", "payouts", "history"];
+  exportData = defineTool({
+    name: "export",
+    description: "Exporta o cache para CSV ou JSON dentro de KOTAS_EXPORT_DIR (por padr\xE3o ~/Downloads/kotas-export). " + "N\xE3o usa a rede e n\xE3o altera nada na conta. Valores saem em reais com 4 casas, do jeito que a " + "Kotas calcula o rateio.",
+    readOnly: false,
+    input: Type8.Object({
+      scope: Type8.Union(SCOPES.map((scope) => Type8.Literal(scope)), { description: "O que exportar" }),
+      format: Type8.Optional(Type8.Union([Type8.Literal("csv"), Type8.Literal("json")], { description: "Formato (default csv)" })),
+      from: dayField("S\xF3 para invoices: data inicial (YYYY-MM-DD)"),
+      to: dayField("S\xF3 para invoices: data final (YYYY-MM-DD)"),
+      filename: Type8.Optional(Type8.String({ description: "Nome do arquivo, sem caminho; default kotas-<scope>-<data>.<formato>" }))
+    }),
+    run: (args, ctx) => {
+      const format = args.format ?? "csv";
+      const rows = collect(ctx, args.scope, args.from, args.to);
+      const stamp = dayFromEpochMs(ctx.now());
+      const target = resolveInside(ctx.config.exportDir, args.filename ?? `kotas-${args.scope}-${stamp}.${format}`);
+      mkdirSync3(ctx.config.exportDir, { recursive: true, mode: 448 });
+      const content = format === "json" ? `${JSON.stringify(rows, null, 2)}
+` : toCsv(rows);
+      writeFileSync2(target, content, { mode: 384 });
+      chmodSync3(target, 384);
+      return { path: target, format, scope: args.scope, rows: rows.length };
+    }
+  });
+});
+
+// src/tools/invoices.ts
+import { Type as Type9 } from "@sinclair/typebox";
+var NO_CACHE = "O cache est\xE1 vazio. Rode `sync` antes de perguntar.", listInvoices, getInvoice;
+var init_invoices = __esm(() => {
+  init_rows();
+  init_normalize();
+  init_define();
+  init_fields();
+  listInvoices = defineTool({
+    name: "list_invoices",
+    description: "Lista as faturas do Kotas a partir do cache local, da mais recente para a mais antiga. N\xE3o usa a " + "rede. ATEN\xC7\xC3O ao somar: s\xF3 fatura com status `pago` \xE9 dinheiro que saiu da conta \u2014 cancelada e " + "estornada n\xE3o s\xE3o gasto. O campo a somar \xE9 `total`, nunca `amount`. Use `product` para saber de " + "qual assinatura a cobran\xE7a era, inclusive de grupos que j\xE1 foram encerrados.",
+    readOnly: true,
+    input: Type9.Object({
+      status: invoiceStatusField,
+      from: dayField("Data inicial (YYYY-MM-DD), sobre a data de pagamento ou vencimento"),
+      to: dayField("Data final (YYYY-MM-DD)"),
+      group_id: Type9.Optional(Type9.Integer({ minimum: 1, description: "S\xF3 as faturas deste grupo" })),
+      product: Type9.Optional(Type9.String({ minLength: 1, description: "Nome exato do produto, como aparece em `product`" })),
+      limit: limitField(500, 50),
+      offset: offsetField,
+      compact: compactField
+    }),
+    run: (args, ctx) => {
+      const cache = ctx.cache();
+      const filters = compactObject({
+        statusId: args.status ? INVOICE_STATUS_BY_NAME[args.status] : undefined,
+        from: args.from,
+        to: args.to,
+        groupId: args.group_id,
+        product: args.product,
+        limit: args.limit ?? 50,
+        offset: args.offset ?? 0
+      });
+      const rows = cache.listInvoices(filters);
+      const total = cache.countInvoices(filters);
+      return compactObject({
+        total,
+        invoices: rows.map((row) => invoiceOut(row, args.compact === true)),
+        ...total === 0 && cache.stats().invoices === 0 ? { note: NO_CACHE } : {}
+      });
+    }
+  });
+  getInvoice = defineTool({
+    name: "get_invoice",
+    description: "Detalha uma fatura, com os itens que a comp\xF5em. L\xEA o cache; se os itens ainda n\xE3o estiverem l\xE1, " + "busca 1 vez na API (`fatura/extrato`), porque a listagem devolve `itens: null`.",
+    readOnly: true,
+    input: Type9.Object({ invoice_id: invoiceIdField }),
+    run: async (args, ctx) => {
+      const cache = ctx.cache();
+      const row = cache.getInvoice(args.invoice_id);
+      if (!row) {
+        throw new Error(`Fatura ${args.invoice_id} n\xE3o est\xE1 no cache. Rode \`sync\` \u2014 a API n\xE3o permite buscar uma fatura avulsa pela listagem.`);
+      }
+      let items = cache.getInvoiceItems(args.invoice_id);
+      if (items.length === 0 && row.detail_fetched_at === null) {
+        const raw = await ctx.api.getInvoiceItems(args.invoice_id);
+        cache.setInvoiceItems(args.invoice_id, normalizeInvoiceItems(args.invoice_id, raw), raw);
+        items = cache.getInvoiceItems(args.invoice_id);
+      }
+      return compactObject({
+        invoice: invoiceOut(row),
+        items: items.map(invoiceItemOut),
+        ...row.detail_error ? { detailError: row.detail_error } : {}
+      });
+    }
+  });
+});
+
+// src/session/browser-import.ts
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+function readUvarint(data, at) {
+  let result = 0;
+  let shift = 0;
+  let index = at;
+  while (index < data.length) {
+    const byte = data[index];
+    result |= (byte & 127) << shift;
+    index += 1;
+    if ((byte & 128) === 0)
+      return { value: result >>> 0, next: index };
+    shift += 7;
+    if (shift > 28)
+      return null;
+  }
+  return null;
+}
+function varintsEndingAt(data, end, count) {
+  for (let width = count;width <= count * 5; width += 1) {
+    const start = end - width;
+    if (start < 0)
+      continue;
+    const values = [];
+    let cursor = start;
+    let ok = true;
+    for (let n = 0;n < count; n += 1) {
+      const read = readUvarint(data, cursor);
+      if (!read) {
+        ok = false;
+        break;
+      }
+      values.push(read.value);
+      cursor = read.next;
+    }
+    if (ok && cursor === end)
+      return values;
+  }
+  return null;
+}
+function decodeValue(raw) {
+  if (raw.length < 2)
+    return null;
+  const body = raw.subarray(1);
+  if (raw[0] === 0)
+    return body.toString("utf16le");
+  if (raw[0] === 1)
+    return body.toString("latin1");
+  return null;
+}
+function scanFile(data, origin) {
+  const prefix = originPrefix(origin);
+  const found = [];
+  let at = data.indexOf(prefix);
+  while (at !== -1) {
+    for (const candidate of framings(data, at, prefix.length))
+      found.push(candidate);
+    at = data.indexOf(prefix, at + 1);
+  }
+  return found;
+}
+function framings(data, at, prefixLength) {
+  const out = [];
+  const push = (nameEnd, valueStart, valueLength) => {
+    if (nameEnd <= at + prefixLength || valueStart + valueLength > data.length)
+      return;
+    const name = data.subarray(at + prefixLength, nameEnd).toString("latin1");
+    if (!PRINTABLE.test(name))
+      return;
+    const value = decodeValue(data.subarray(valueStart, valueStart + valueLength));
+    if (value !== null)
+      out.push({ name, value });
+  };
+  const log = varintsEndingAt(data, at, 1);
+  const keyLength = log?.[0];
+  if (keyLength !== undefined && keyLength >= prefixLength) {
+    const keyEnd = at + keyLength;
+    const valueLength = readUvarint(data, keyEnd);
+    if (valueLength)
+      push(keyEnd, valueLength.next, valueLength.value);
+  }
+  const table = varintsEndingAt(data, at, 3);
+  if (table && table[0] === 0 && table[1] !== undefined && table[2] !== undefined) {
+    for (const trailer of [8, 0]) {
+      push(at + table[1] - trailer, at + table[1], table[2]);
+    }
+  }
+  return out;
+}
+function leveldbFiles(profileDir) {
+  const dir = join3(profileDir, "Local Storage", "leveldb");
+  if (!existsSync3(dir))
+    return [];
+  return readdirSync(dir).filter((name) => name.endsWith(".log") || name.endsWith(".ldb")).map((name) => join3(dir, name)).sort((left, right) => statSync2(left).mtimeMs - statSync2(right).mtimeMs);
+}
+function profileDirs(browser, home = homedir2()) {
+  const base = join3(home, "Library", "Application Support", LOCATIONS[browser].dir);
+  if (!existsSync3(base))
+    return [];
+  return readdirSync(base).filter((name) => name === "Default" || /^Profile \d+$/.test(name)).map((name) => join3(base, name));
+}
+function importFromBrowser(browser, now, options = {}) {
+  const origin = options.origin ?? APP_ORIGIN;
+  const label = LOCATIONS[browser].label;
+  const dirs = profileDirs(browser, options.home);
+  if (dirs.length === 0) {
+    throw new LoginError(`N\xE3o achei um perfil do ${label} nesta m\xE1quina. Rode \`kotas login\` (e-mail e senha) ou \`kotas login --paste\`.`);
+  }
+  const best = {};
+  let profile = "";
+  for (const dir of dirs) {
+    for (const file of leveldbFiles(dir)) {
+      let data;
+      try {
+        data = readFileSync2(file);
+      } catch {
+        continue;
+      }
+      for (const { name, value } of scanFile(data, origin)) {
+        if (!accept(name, value))
+          continue;
+        best[name] = value;
+        profile = dir;
+      }
+    }
+  }
+  const accessToken = best[STORAGE_KEYS.accessToken];
+  const refreshToken = best[STORAGE_KEYS.refreshToken];
+  if (!accessToken || !refreshToken) {
+    throw new LoginError(`N\xE3o encontrei uma sess\xE3o do Kotas no ${label}. Abra ${origin}, entre na conta e rode de novo \u2014 ` + "ou use `kotas login` (e-mail e senha), que n\xE3o depende do navegador.");
+  }
+  return {
+    browser: label,
+    profile,
+    session: {
+      version: 1,
+      accessToken,
+      refreshToken,
+      hashDispositivo: best[STORAGE_KEYS.deviceHash] ?? "",
+      savedAt: now
+    }
+  };
+}
+function accept(name, value) {
+  if (name === STORAGE_KEYS.accessToken)
+    return JWT.test(value);
+  if (name === STORAGE_KEYS.refreshToken)
+    return OPAQUE.test(value);
+  if (name === STORAGE_KEYS.deviceHash)
+    return HEX32.test(value);
+  return false;
+}
+var STORAGE_KEYS, LOCATIONS, originPrefix = (origin) => Buffer.from(`_${origin}\x00\x01`, "latin1"), JWT, OPAQUE, HEX32, PRINTABLE;
+var init_browser_import = __esm(() => {
+  init_config();
+  init_errors();
+  STORAGE_KEYS = {
+    accessToken: "@chave",
+    refreshToken: "@c08cbbfd6eefc83ac6d23c4c791277e4",
+    deviceHash: "SEFTSF9ESVNQT1NJVElWTw=="
+  };
+  LOCATIONS = {
+    arc: { label: "Arc", dir: "Arc/User Data" },
+    chrome: { label: "Google Chrome", dir: "Google/Chrome" },
+    chromium: { label: "Chromium", dir: "Chromium" },
+    brave: { label: "Brave", dir: "BraveSoftware/Brave-Browser" },
+    edge: { label: "Microsoft Edge", dir: "Microsoft Edge" }
+  };
+  JWT = /^eyJ[\w-]+\.[\w-]+\.[\w-]+$/;
+  OPAQUE = /^[A-Za-z0-9+/=_.-]{16,4096}$/;
+  HEX32 = /^[0-9a-f]{32}$/;
+  PRINTABLE = /^[ -~]+$/;
+});
+
+// src/session/login.ts
+function loginBody(input) {
+  return {
+    email: input.email,
+    senha: input.password,
+    socialAuth: SOCIAL_AUTH.kotas,
+    loginViaSocialAuth: false,
+    term: null,
+    medium: null,
+    source: null,
+    content: null,
+    campaign: null,
+    ref: null
+  };
+}
+async function login(ctx, input) {
+  const previous = safeLoad(ctx);
+  const hashDispositivo = input.hashDispositivo ?? previous?.hashDispositivo ?? "";
+  const response = await ctx.http.send({
+    method: "POST",
+    path: LOGIN_PATH,
+    auth: "none",
+    headers: { hashDispositivo },
+    body: loginBody(input),
+    label: LOGIN_PATH
+  });
+  const payload = parse(response.text);
+  if (response.status === 412) {
+    const hash = typeof payload.hash === "string" ? payload.hash : hashDispositivo;
+    if (hash && previous)
+      ctx.session.save({ ...previous, hashDispositivo: hash });
+    throw new DeviceChallengeError(hash, Number(payload.tipoSolicitacao ?? 0));
+  }
+  if (response.status === 401 || response.status === 403) {
+    throw new LoginError(`O Kotas recusou o login (HTTP ${response.status}): ${payload.message ?? "e-mail ou senha incorretos"}.`);
+  }
+  if (response.status !== 200) {
+    throw new LoginError(`O Kotas respondeu HTTP ${response.status} no login: ${payload.message ?? response.text.slice(0, 200)}`);
+  }
+  if (!payload.token || !payload.refreshToken) {
+    throw new LoginError("O login foi aceito, mas a resposta veio sem `token`/`refreshToken`. A API mudou; rode `kotas doctor`.");
+  }
+  let session = {
+    version: 1,
+    accessToken: payload.token,
+    refreshToken: payload.refreshToken,
+    hashDispositivo: payload.hashDispositivo ?? hashDispositivo,
+    email: input.email,
+    savedAt: ctx.now()
+  };
+  if (needsTwoFactor(session.accessToken)) {
+    if (!input.pin) {
+      throw new TwoFactorError("A conta tem verifica\xE7\xE3o em duas etapas ligada.");
+    }
+    session = await validateTwoFactor(ctx, session, input.pin);
+  }
+  ctx.session.save(session);
+  ctx.http.adopt(session);
+  return session;
+}
+function needsTwoFactor(accessToken) {
+  try {
+    return String(decodeJwt(accessToken).TWFAHABILITADO ?? "").toLowerCase() === "true";
+  } catch {
+    return false;
+  }
+}
+async function validateTwoFactor(ctx, session, pin) {
+  if (!/^\d{4,8}$/.test(pin)) {
+    throw new TwoFactorError(`"${pin}" n\xE3o parece um PIN (esperado 6 d\xEDgitos).`);
+  }
+  const response = await ctx.http.send({
+    method: "POST",
+    path: TWO_FACTOR_PATH,
+    auth: "none",
+    headers: {
+      TWFA: pin,
+      authorization: `Bearer ${session.accessToken}`,
+      hashDispositivo: session.hashDispositivo
+    },
+    body: {},
+    label: TWO_FACTOR_PATH
+  });
+  if (response.status !== 200) {
+    const payload2 = parse(response.text);
+    throw new TwoFactorError(`O Kotas recusou o PIN (HTTP ${response.status}): ${payload2.message ?? "c\xF3digo inv\xE1lido ou expirado"}.`);
+  }
+  const payload = parse(response.text);
+  return {
+    ...session,
+    ...payload.token ? { accessToken: payload.token } : {},
+    ...payload.refreshToken ? { refreshToken: payload.refreshToken } : {},
+    savedAt: ctx.now()
+  };
+}
+function safeLoad(ctx) {
+  try {
+    return ctx.session.load();
+  } catch {
+    return null;
+  }
+}
+function parse(text) {
+  try {
+    const parsed = JSON.parse(text);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+var LOGIN_PATH = "autenticacao/token", TWO_FACTOR_PATH = "autenticacao/2fa/pin/validar";
+var init_login = __esm(() => {
+  init_errors();
+  init_enums();
+  init_jwt();
+});
+
+// src/tools/login.ts
+import { Type as Type10 } from "@sinclair/typebox";
+function safeProfile(accessToken) {
+  try {
+    return compactObject(profileFrom(decodeJwt(accessToken)));
+  } catch {
+    return;
+  }
+}
+var login2;
+var init_login2 = __esm(() => {
+  init_config();
+  init_errors();
+  init_browser_import();
+  init_login();
+  init_jwt();
+  init_define();
+  login2 = defineTool({
+    name: "login",
+    description: "Salva uma sess\xE3o do Kotas em disco, cifrada. Tr\xEAs caminhos: e-mail e senha (`email`+`password`, " + "ou as vari\xE1veis KOTAS_EMAIL/KOTAS_SENHA); importando de um navegador j\xE1 logado " + "(`from_browser`); ou colando os tr\xEAs valores do localStorage (`tokens`). A senha \xE9 usada uma vez " + "e nunca \xE9 gravada. Se a conta tiver verifica\xE7\xE3o em duas etapas, passe `pin`.",
+    readOnly: false,
+    input: Type10.Object({
+      email: Type10.Optional(Type10.String({ minLength: 3, description: "E-mail da conta Kotas" })),
+      password: Type10.Optional(Type10.String({ minLength: 1, description: "Senha; usada uma vez, nunca gravada" })),
+      pin: Type10.Optional(Type10.String({ pattern: "^\\d{4,8}$", description: "C\xF3digo de 6 d\xEDgitos da verifica\xE7\xE3o em duas etapas" })),
+      from_browser: Type10.Optional(Type10.Union(IMPORT_BROWSERS.map((browser) => Type10.Literal(browser)), { description: "Importa a sess\xE3o do localStorage deste navegador (macOS)" })),
+      tokens: Type10.Optional(Type10.Object({
+        access_token: Type10.String({ minLength: 20, description: "localStorage `@chave`" }),
+        refresh_token: Type10.String({
+          minLength: 8,
+          description: "localStorage `@c08cbbfd6eefc83ac6d23c4c791277e4`"
+        }),
+        device_hash: Type10.Optional(Type10.String({ description: "localStorage `SEFTSF9ESVNQT1NJVElWTw==`" }))
+      }, { description: "Sess\xE3o colada \xE0 m\xE3o, do DevTools do navegador" }))
+    }),
+    run: async (args, ctx) => {
+      let session;
+      let via;
+      if (args.tokens) {
+        session = {
+          version: 1,
+          accessToken: args.tokens.access_token.trim(),
+          refreshToken: args.tokens.refresh_token.trim(),
+          hashDispositivo: args.tokens.device_hash?.trim() ?? "",
+          savedAt: ctx.now()
+        };
+        ctx.session.save(session);
+        ctx.http.adopt(session);
+        via = "tokens colados";
+      } else if (args.from_browser ?? ctx.config.importBrowser) {
+        const browser = args.from_browser ?? ctx.config.importBrowser;
+        const result = importFromBrowser(browser, ctx.now());
+        session = result.session;
+        ctx.session.save(session);
+        ctx.http.adopt(session);
+        via = `import do ${result.browser}`;
+      } else {
+        const email = args.email ?? ctx.config.email;
+        const password = args.password ?? ctx.config.password;
+        if (!email || !password) {
+          throw new LoginError("Faltou e-mail ou senha. Passe `email` e `password`, defina KOTAS_EMAIL/KOTAS_SENHA, " + "ou use `from_browser` para importar uma sess\xE3o j\xE1 aberta no navegador.");
+        }
+        session = await login(ctx, compactObject({ email, password, pin: args.pin }));
+        via = "e-mail e senha";
+      }
+      const profile = safeProfile(session.accessToken);
+      return compactObject({
+        loggedIn: true,
+        via,
+        sessionFile: ctx.session.paths.sessionPath,
+        deviceBound: Boolean(session.hashDispositivo),
+        profile,
+        ...session.hashDispositivo ? {} : {
+          warning: "Sess\xE3o sem hashDispositivo. O Kotas pode pedir libera\xE7\xE3o de dispositivo (HTTP 412) na pr\xF3xima renova\xE7\xE3o."
+        },
+        next: "Rode `sync` para baixar o hist\xF3rico para o cache local."
+      });
+    }
+  });
+});
+
+// src/tools/payouts.ts
+import { Type as Type11 } from "@sinclair/typebox";
+var listPayouts;
+var init_payouts = __esm(() => {
+  init_rows();
+  init_define();
+  listPayouts = defineTool({
+    name: "list_payouts",
+    description: "Lista os recebimentos como administrador: quanto cada grupo repassa por ciclo, quanto cada membro " + "paga e a data do pr\xF3ximo pagamento. L\xEA o cache, n\xE3o usa a rede. Com group_id devolve tamb\xE9m o " + "extrato daquele grupo, participante por participante. Status `Cancelado` significa que o repasse " + "n\xE3o vai mais acontecer \u2014 n\xE3o some no previsto.",
+    readOnly: true,
+    input: Type11.Object({
+      group_id: Type11.Optional(Type11.Integer({ minimum: 1, description: "Tamb\xE9m traz o extrato deste grupo" })),
+      only_scheduled: Type11.Optional(Type11.Boolean({ description: "S\xF3 os repasses agendados (default false)" }))
+    }),
+    run: (args, ctx) => {
+      const cache = ctx.cache();
+      const all = cache.listPayouts();
+      const rows = args.only_scheduled ? all.filter((row) => row.status_id === 4) : all;
+      const scheduled = all.filter((row) => row.status_id === 4);
+      return compactObject({
+        total: rows.length,
+        scheduledTotal: money(sumUnits(scheduled.map((row) => row.amount_units))),
+        payouts: rows.map(payoutOut),
+        ...args.group_id ? { statement: cache.getPayoutEntries(args.group_id).map(payoutEntryOut) } : {},
+        ...all.length === 0 ? { note: "Nenhum recebimento no cache. Rode `sync` \u2014 ou voc\xEA n\xE3o administra nenhum grupo." } : {}
+      });
+    }
+  });
+});
+
+// src/tools/raw.ts
+import { Type as Type12 } from "@sinclair/typebox";
+function assertAllowed(path) {
+  if (path.includes(".."))
+    throw new Error("path inv\xE1lido: n\xE3o pode conter '..'");
+  if (CREDENTIALS_PATH.test(path)) {
+    throw new Error("Rota bloqueada: `grupo/obter-dados-acesso` devolve o login e a senha do servi\xE7o compartilhado em texto claro. " + "O kotas-mcp nunca exp\xF5e essas credenciais. Pegue-as no app do Kotas.");
+  }
+  if (FORBIDDEN_PATH.test(path)) {
+    throw new Error(`Rota recusada: "${path}" parece uma rota de escrita, e o kotas-mcp \xE9 somente leitura \u2014 nunca altera a conta.`);
+  }
+  const bare = path.split("?")[0] ?? path;
+  const allowed = ALLOWED_EXACT.includes(bare) || ALLOWED_PREFIXES.some((prefix) => path.startsWith(prefix));
+  if (!allowed) {
+    throw new Error(`Rota fora do escopo: "${path}". Aceitas: ${[...ALLOWED_EXACT, ...ALLOWED_PREFIXES].join(", ")}.`);
+  }
+}
+var ALLOWED_EXACT, ALLOWED_PREFIXES, FORBIDDEN_PATH, CREDENTIALS_PATH, MAX_RAW_BYTES, rawGet;
+var init_raw = __esm(() => {
+  init_define();
+  ALLOWED_EXACT = ["credito", "cartao", "identificador", "cupom_indicacao"];
+  ALLOWED_PREFIXES = [
+    "grupo/",
+    "assinatura/restricoes/",
+    "fatura/",
+    "credito/",
+    "recebimento/",
+    "servico/",
+    "notificacoes",
+    "notificacao/",
+    "usuario/cadastro/dados-fiscais",
+    "usuario/obter-endereco-fiscal",
+    "cartao",
+    "meio-pagamento/",
+    "contabanco/",
+    "retirada/mes",
+    "retirada/disponibilidade-boleto",
+    "reclamacao/",
+    "rede/obter",
+    "indicacao/",
+    "loteria/",
+    "api/versao"
+  ];
+  FORBIDDEN_PATH = /(cancelar|cancelamento|pagar|pagamento|retirar|retirada\/retirar|alterar|alterarnome|remover|excluir|deletar|criar|enviar|assinar|comprar|estornar|liberar|reservar|ativar|desativar|bloquear|validar|aceitar|recusar|resetar|checkout|convite)/i;
+  CREDENTIALS_PATH = /obter-dados-acesso|dados-acesso/i;
+  MAX_RAW_BYTES = 64 * 1024;
+  rawGet = defineTool({
+    name: "raw_get",
+    description: "Chama uma rota GET da API do Kotas diretamente, com a mesma sess\xE3o, o mesmo ritmo e os mesmos " + "headers das outras tools. Serve para redescobrir um endpoint quando a API muda. Use com " + "parcim\xF4nia e nunca em rajada. Somente leitura: qualquer rota com verbo de escrita (cancelar, " + "pagar, retirar, alterar\u2026) \xE9 recusada, e as credenciais do servi\xE7o compartilhado " + "(`grupo/obter-dados-acesso`) s\xE3o bloqueadas em qualquer forma.",
+    readOnly: true,
+    input: Type12.Object({
+      path: Type12.String({
+        pattern: "^[A-Za-z0-9][A-Za-z0-9_/.-]*$",
+        description: "Rota relativa, sem barra inicial (ex.: grupo/categorias)"
+      }),
+      query: Type12.Optional(Type12.Record(Type12.String(), Type12.Union([Type12.String(), Type12.Number(), Type12.Boolean()]), {
+        description: 'Par\xE2metros de query (ex.: { "page": 1, "pageSize": 50 })'
+      })),
+      max_bytes: Type12.Optional(Type12.Integer({
+        minimum: 1024,
+        maximum: MAX_RAW_BYTES,
+        description: `Corta a resposta neste tamanho (default ${MAX_RAW_BYTES})`
+      }))
+    }),
+    run: async (args, ctx) => {
+      const path = args.path.trim().replace(/^\/+/, "");
+      assertAllowed(path);
+      const payload = await ctx.api.getRaw(path, args.query ?? {});
+      const limit = args.max_bytes ?? MAX_RAW_BYTES;
+      const serialized = JSON.stringify(payload ?? null);
+      const truncated = serialized.length > limit;
+      return {
+        path,
+        bytes: serialized.length,
+        truncated,
+        data: truncated ? `${serialized.slice(0, limit)}\u2026` : payload ?? null
+      };
+    }
+  });
+});
+
+// src/tools/services.ts
+import { Type as Type13 } from "@sinclair/typebox";
+var searchServices;
+var init_services = __esm(() => {
+  init_define();
+  searchServices = defineTool({
+    name: "search_services",
+    description: "Busca servi\xE7os no cat\xE1logo do Kotas pelo nome (Netflix, Spotify, Google One\u2026) e devolve os planos " + "dispon\xEDveis com o valor cheio e quantas kotas cada um tem. Gasta 1 requisi\xE7\xE3o. Isto \xE9 o CAT\xC1LOGO: " + "para o que voc\xEA j\xE1 assinou ou pagou, use `purchase_history` ou `list_invoices`.",
+    readOnly: true,
+    input: Type13.Object({
+      query: Type13.String({ minLength: 2, description: "Nome ou parte do nome do servi\xE7o" }),
+      limit: Type13.Optional(Type13.Integer({ minimum: 1, maximum: 50, description: "M\xE1ximo de servi\xE7os (default 10)" }))
+    }),
+    run: async (args, ctx) => {
+      const services = await ctx.api.searchServices(args.query.trim());
+      const limited = services.slice(0, args.limit ?? 10);
+      return compactObject({
+        total: services.length,
+        services: limited.map((service) => compactObject({
+          id: service.id,
+          name: service.nome,
+          category: service.nomeCategoria,
+          site: service.site,
+          price: money(toUnits(service.valor)),
+          slots: service.qtdKotas,
+          plans: (service.planos ?? []).map((plan) => compactObject({ id: plan.id, name: plan.nome, price: money(toUnits(plan.valor)) }))
+        })),
+        ...services.length === 0 ? { note: `Nada encontrado para "${args.query}".` } : {}
+      });
+    }
+  });
+});
+
+// src/tools/subscriptions.ts
+import { Type as Type14 } from "@sinclair/typebox";
+var NO_CACHE2 = "O cache est\xE1 vazio. Rode `sync` (ou `kotas sync` no terminal) antes de perguntar.", listSubscriptions, getSubscription;
+var init_subscriptions = __esm(() => {
+  init_normalize();
+  init_rows();
+  init_define();
+  init_fields();
+  listSubscriptions = defineTool({
+    name: "list_subscriptions",
+    description: "Lista as assinaturas compartilhadas (grupos) do Kotas a partir do cache local, com o que voc\xEA paga " + "em cada uma, quantas vagas tem e se voc\xEA \xE9 membro ou administrador. N\xE3o usa a rede. S\xF3 aparecem " + "grupos que ainda existem na API: um grupo encerrado some do Kotas e s\xF3 sobrevive nas faturas \u2014 " + "para o hist\xF3rico completo use `purchase_history`.",
+    readOnly: true,
+    input: Type14.Object({
+      role: Type14.Optional(Type14.Union([Type14.Literal("todos"), Type14.Literal("membro"), Type14.Literal("administrador")], {
+        description: "Filtra pelo seu papel no grupo (default todos)"
+      })),
+      limit: limitField(200, 100),
+      compact: compactField
+    }),
+    run: (args, ctx) => {
+      const cache = ctx.cache();
+      const options = { limit: args.limit ?? 100 };
+      if (args.role === "administrador")
+        options.administrator = true;
+      if (args.role === "membro")
+        options.administrator = false;
+      const rows = cache.listGroups(options);
+      return compactObject({
+        total: rows.length,
+        subscriptions: rows.map((row) => groupOut(row, args.compact === true)),
+        ...rows.length === 0 && cache.stats().groups === 0 ? { note: NO_CACHE2 } : {}
+      });
+    }
+  });
+  getSubscription = defineTool({
+    name: "get_subscription",
+    description: "Detalha uma assinatura: plano, o que voc\xEA paga, o valor cheio do servi\xE7o, a taxa da Kotas, vagas, " + "fidelidade e os participantes com o que cada um paga \u2014 a API devolve os participantes tanto para " + "membro quanto para administrador. L\xEA o cache; se o grupo n\xE3o estiver l\xE1, busca 1 vez na API. N\xC3O " + "devolve login nem senha do servi\xE7o compartilhado: o kotas-mcp nunca exp\xF5e essas credenciais.",
+    readOnly: true,
+    input: Type14.Object({ group_id: groupIdField, compact: compactField }),
+    run: async (args, ctx) => {
+      const cache = ctx.cache();
+      let row = cache.getGroup(args.group_id);
+      if (!row) {
+        const raw = await ctx.api.getGroup(args.group_id, "member").catch(async (error) => {
+          const admin = await ctx.api.getGroup(args.group_id, "admin").catch(() => null);
+          if (admin)
+            return admin;
+          throw error;
+        });
+        const group = normalizeGroup(raw);
+        if (!group)
+          throw new Error(`O Kotas devolveu um grupo sem \`id\` para ${args.group_id}.`);
+        cache.setGroupDetail(group, normalizeParticipants(group.id, raw), raw);
+        row = cache.getGroup(args.group_id);
+      }
+      if (!row)
+        throw new Error(`Grupo ${args.group_id} n\xE3o encontrado.`);
+      const participants = cache.getParticipants(row.id);
+      return compactObject({
+        subscription: groupOut(row, args.compact === true),
+        ...participants.length > 0 ? { participants: participants.map(participantOut) } : { participants: [], note: "Sem participantes no cache; rode `sync`." }
+      });
+    }
+  });
+});
+
+// src/cache/sync.ts
+function resolveMode(cache, requested, cursor) {
+  if (requested === "reparse" || requested === "full")
+    return requested;
+  if (cursor && cursor.mode === "full")
+    return "full";
+  return cache.getMeta(META.lastFull) === null ? "full" : "incremental";
+}
+function readCursor(cache) {
+  const raw = cache.getMeta(META.cursor);
+  if (!raw)
+    return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function reparseAll(cache) {
+  let count = 0;
+  const pending = cache.invoicesToReparse(PARSER_VERSION);
+  const invoices = [];
+  const raws = [];
+  for (const row of pending) {
+    let raw;
+    try {
+      raw = JSON.parse(row.raw_list);
+    } catch {
+      continue;
+    }
+    const invoice = normalizeInvoice(raw);
+    if (!invoice)
+      continue;
+    invoices.push(invoice);
+    raws.push(raw);
+    count += 1;
+  }
+  if (invoices.length > 0)
+    cache.upsertInvoices(invoices, raws, PARSER_VERSION);
+  return count;
+}
+function fatal(error) {
+  return error instanceof KotasAuthError;
+}
+async function runSyncChunk(ctx, options = {}) {
+  const cache = ctx.cache();
+  const budget = options.maxRequests ?? DEFAULT_MAX_REQUESTS;
+  const cursor = readCursor(cache);
+  const mode = resolveMode(cache, options.mode, cursor);
+  const report2 = {
+    mode,
+    done: false,
+    requestsUsed: 0,
+    invoices: 0,
+    invoiceItems: 0,
+    groups: 0,
+    groupErrors: 0,
+    credits: 0,
+    payouts: 0,
+    reparsed: 0,
+    pendingDetails: 0,
+    errors: []
+  };
+  if (mode === "reparse") {
+    report2.reparsed = reparseAll(cache);
+    cache.rebuildFts();
+    report2.done = true;
+    report2.pendingDetails = cache.pendingInvoiceDetails(1e4).length;
+    return report2;
+  }
+  const before = ctx.http.state().requests;
+  const spent = () => ctx.http.state().requests - before;
+  const canSpend = () => spent() < budget;
+  const resumed = cursor?.mode === mode ? cursor : null;
+  let statusIndex = resumed?.statusIndex ?? 0;
+  let page = resumed?.page ?? 1;
+  let invoicesDone = resumed?.invoicesDone ?? false;
+  let groupsListed = resumed?.groupsListed ?? false;
+  let creditsActiveDone = resumed?.creditsActiveDone ?? false;
+  let creditsHistoryDone = resumed?.creditsHistoryDone ?? false;
+  let payoutsListed = resumed?.payoutsListed ?? false;
+  const startedAt = resumed?.startedAt ?? ctx.now();
+  while (!invoicesDone && canSpend()) {
+    const statusId = INVOICE_STATUS_IDS[statusIndex];
+    if (statusId === undefined) {
+      invoicesDone = true;
+      break;
+    }
+    let result;
+    try {
+      result = await ctx.api.listInvoices(statusId, page, PAGE_SIZE);
+    } catch (error) {
+      if (fatal(error))
+        throw error;
+      report2.errors.push(`faturas status ${statusId} p\xE1gina ${page}: ${messageOf2(error)}`);
+      statusIndex += 1;
+      page = 1;
+      continue;
+    }
+    const invoices = [];
+    const raws = [];
+    let fresh = 0;
+    for (const raw of result.items) {
+      const invoice = normalizeInvoice(raw);
+      if (!invoice)
+        continue;
+      const known = cache.getInvoice(invoice.id);
+      if (!known || known.status_id !== invoice.statusId)
+        fresh += 1;
+      invoices.push(invoice);
+      raws.push(raw);
+    }
+    report2.invoices += cache.upsertInvoices(invoices, raws, PARSER_VERSION);
+    const exhausted = !result.hasMore || page >= MAX_PAGES_PER_STATUS || mode === "incremental" && fresh === 0 && result.items.length > 0;
+    if (exhausted) {
+      statusIndex += 1;
+      page = 1;
+      if (statusIndex >= INVOICE_STATUS_IDS.length)
+        invoicesDone = true;
+    } else {
+      page += 1;
+    }
+  }
+  const wantGroups = options.withGroups !== false;
+  if (invoicesDone && wantGroups && !groupsListed && canSpend()) {
+    try {
+      const groups = [];
+      const raws = [];
+      let groupPage = 0;
+      for (;; ) {
+        const result = await ctx.api.listGroups(groupPage, PAGE_SIZE);
+        for (const raw of result.items) {
+          const group = normalizeGroup(raw);
+          if (group) {
+            groups.push(group);
+            raws.push(raw);
+          }
+        }
+        if (!result.hasMore) {
+          groupsListed = true;
+          break;
+        }
+        if (!canSpend())
+          break;
+        groupPage += 1;
+      }
+      report2.groups = cache.upsertGroups(groups, raws);
+    } catch (error) {
+      if (fatal(error))
+        throw error;
+      report2.errors.push(`grupos: ${messageOf2(error)}`);
+      groupsListed = true;
+    }
+  }
+  if (invoicesDone && wantGroups) {
+    while (canSpend()) {
+      const [groupId] = cache.pendingGroupDetails(1);
+      if (groupId === undefined)
+        break;
+      const known = cache.getGroup(groupId);
+      try {
+        const raw = await ctx.api.getGroup(groupId, known?.is_administrator === 1 ? "admin" : "member");
+        const detailed = normalizeGroup({ ...raw, inAdministrador: known?.is_administrator === 1 });
+        if (!detailed)
+          throw new ParseError(`grupo ${groupId} veio sem \`id\`.`);
+        cache.setGroupDetail(detailed, normalizeParticipants(groupId, raw), raw);
+      } catch (error) {
+        if (fatal(error))
+          throw error;
+        report2.groupErrors += 1;
+        cache.markGroupDetailError(groupId, messageOf2(error));
+      }
+    }
+  }
+  const wantCredits = options.withCredits !== false;
+  for (const active of [true, false]) {
+    const alreadyDone = active ? creditsActiveDone : creditsHistoryDone;
+    if (!invoicesDone || !wantCredits || alreadyDone || !canSpend())
+      continue;
+    try {
+      const credits = [];
+      const raws = [];
+      let creditPage = 1;
+      for (;; ) {
+        const result = await ctx.api.listCredits(creditPage, PAGE_SIZE, active);
+        for (const raw of result.items) {
+          const credit = normalizeCredit(raw);
+          if (credit) {
+            credits.push(credit);
+            raws.push(raw);
+          }
+        }
+        if (!result.hasMore || creditPage >= MAX_PAGES_PER_STATUS) {
+          if (active)
+            creditsActiveDone = true;
+          else
+            creditsHistoryDone = true;
+          break;
+        }
+        if (!canSpend())
+          break;
+        creditPage += 1;
+      }
+      report2.credits += cache.upsertCredits(credits, raws);
+    } catch (error) {
+      if (fatal(error))
+        throw error;
+      report2.errors.push(`cr\xE9ditos (ativos=${active}): ${messageOf2(error)}`);
+      if (active)
+        creditsActiveDone = true;
+      else
+        creditsHistoryDone = true;
+    }
+  }
+  const wantPayouts = options.withPayouts !== false;
+  if (invoicesDone && wantPayouts && !payoutsListed && canSpend()) {
+    try {
+      const payouts = [];
+      const raws = [];
+      let payoutPage = 0;
+      for (;; ) {
+        const result = await ctx.api.listPayouts(payoutPage, PAGE_SIZE);
+        for (const raw of result.items) {
+          const payout = normalizePayout(raw);
+          if (payout) {
+            payouts.push(payout);
+            raws.push(raw);
+          }
+        }
+        if (!result.hasMore) {
+          payoutsListed = true;
+          break;
+        }
+        if (!canSpend())
+          break;
+        payoutPage += 1;
+      }
+      report2.payouts = cache.upsertPayouts(payouts, raws);
+    } catch (error) {
+      if (fatal(error))
+        throw error;
+      report2.errors.push(`recebimentos: ${messageOf2(error)}`);
+      payoutsListed = true;
+    }
+  }
+  if (invoicesDone && wantPayouts) {
+    while (canSpend()) {
+      const [groupId] = cache.pendingPayoutStatements(1);
+      if (groupId === undefined)
+        break;
+      try {
+        const entries = await ctx.api.getPayoutStatement(groupId);
+        cache.setPayoutEntries(groupId, entries.map((entry) => normalizePayoutEntry(groupId, entry)).filter((entry) => entry !== null));
+      } catch (error) {
+        if (fatal(error))
+          throw error;
+        report2.errors.push(`extrato do grupo ${groupId}: ${messageOf2(error)}`);
+        cache.setPayoutEntries(groupId, []);
+      }
+    }
+  }
+  if (invoicesDone && options.withInvoiceItems !== false) {
+    while (canSpend()) {
+      const [invoiceId] = cache.pendingInvoiceDetails(1);
+      if (invoiceId === undefined)
+        break;
+      try {
+        const items = await ctx.api.getInvoiceItems(invoiceId);
+        cache.setInvoiceItems(invoiceId, items.map((item, position) => ({
+          invoiceId,
+          position,
+          id: typeof item.id === "number" ? item.id : null,
+          description: typeof item.descricao === "string" ? item.descricao : "",
+          quantity: typeof item.quantidade === "number" ? item.quantidade : 1,
+          amount: typeof item.valor4Casas === "number" ? Math.round(item.valor4Casas * 1e4) : typeof item.valor === "number" ? Math.round(item.valor * 1e4) : null
+        })), items);
+        report2.invoiceItems += items.length;
+      } catch (error) {
+        if (fatal(error))
+          throw error;
+        if (error instanceof KotasApiError || error instanceof ParseError || error instanceof RateLimitError) {
+          cache.markInvoiceDetailError(invoiceId, messageOf2(error));
+          continue;
+        }
+        throw error;
+      }
+    }
+  }
+  report2.requestsUsed = spent();
+  report2.pendingDetails = cache.pendingInvoiceDetails(1e4).length;
+  const enrichmentDone = (!wantGroups || groupsListed && cache.pendingGroupDetails(1).length === 0) && (!wantCredits || creditsActiveDone && creditsHistoryDone) && (!wantPayouts || payoutsListed && cache.pendingPayoutStatements(1).length === 0);
+  report2.done = invoicesDone && enrichmentDone && (options.withInvoiceItems === false || report2.pendingDetails === 0);
+  if (report2.done) {
+    cache.rebuildFts();
+    cache.setMeta(META.cursor, null);
+    const finishedAt = new Date(ctx.now()).toISOString();
+    cache.setMeta(META.lastCompleted, finishedAt);
+    if (mode === "full")
+      cache.setMeta(META.lastFull, finishedAt);
+  } else {
+    cache.setMeta(META.cursor, JSON.stringify({
+      mode,
+      statusIndex,
+      page,
+      invoicesDone,
+      groupsListed,
+      creditsActiveDone,
+      creditsHistoryDone,
+      payoutsListed,
+      startedAt
+    }));
+    report2.hint = invoicesDone ? `Faltam ${report2.pendingDetails} detalhes de fatura. Chame \`sync\` de novo com os mesmos par\xE2metros at\xE9 \`done: true\`.` : "A varredura de faturas n\xE3o terminou. Chame `sync` de novo com os mesmos par\xE2metros at\xE9 `done: true`.";
+  }
+  return report2;
+}
+var PARSER_VERSION = 1, DEFAULT_MAX_REQUESTS = 40, PAGE_SIZE = 50, MAX_PAGES_PER_STATUS = 60, messageOf2 = (error) => error instanceof Error ? error.message : String(error);
+var init_sync = __esm(() => {
+  init_errors();
+  init_enums();
+  init_normalize();
+  init_db();
+});
+
+// src/tools/sync.ts
+import { Type as Type15 } from "@sinclair/typebox";
+var sync;
+var init_sync2 = __esm(() => {
+  init_sync();
+  init_define();
+  sync = defineTool({
+    name: "sync",
+    description: "Baixa o hist\xF3rico do Kotas para o cache local. Trabalha em blocos: faz at\xE9 max_requests chamadas e " + "devolve `done: false` com um `hint`. CHAME DE NOVO com os mesmos par\xE2metros at\xE9 `done: true`. " + "Nunca chame em paralelo nem dispare outras tools de rede junto. Varre as faturas dos cinco status " + "(\xE9 a \xFAnica fonte do hist\xF3rico), depois grupos, cr\xE9ditos e recebimentos. " + "`mode: reparse` reprocessa o que j\xE1 est\xE1 no cache sem usar a rede.",
+    readOnly: false,
+    input: Type15.Object({
+      mode: Type15.Optional(Type15.Union([Type15.Literal("incremental"), Type15.Literal("full"), Type15.Literal("reparse")], {
+        description: "incremental (default depois do primeiro full) para no primeiro bloco sem novidade; full varre tudo; reparse n\xE3o usa a rede"
+      })),
+      max_requests: Type15.Optional(Type15.Integer({
+        minimum: 1,
+        maximum: 200,
+        description: `Or\xE7amento de requisi\xE7\xF5es do bloco (default ${DEFAULT_MAX_REQUESTS})`
+      })),
+      with_groups: Type15.Optional(Type15.Boolean({ description: "Tamb\xE9m sincroniza os grupos (default true)" })),
+      with_credits: Type15.Optional(Type15.Boolean({ description: "Tamb\xE9m sincroniza os cr\xE9ditos (default true)" })),
+      with_payouts: Type15.Optional(Type15.Boolean({ description: "Tamb\xE9m sincroniza os recebimentos de administrador (default true)" })),
+      with_invoice_items: Type15.Optional(Type15.Boolean({ description: "Tamb\xE9m busca os itens de cada fatura, 1 requisi\xE7\xE3o por fatura (default true)" }))
+    }),
+    run: (args, ctx) => runSyncChunk(ctx, {
+      ...args.mode ? { mode: args.mode } : {},
+      ...args.max_requests === undefined ? {} : { maxRequests: args.max_requests },
+      ...args.with_groups === undefined ? {} : { withGroups: args.with_groups },
+      ...args.with_credits === undefined ? {} : { withCredits: args.with_credits },
+      ...args.with_payouts === undefined ? {} : { withPayouts: args.with_payouts },
+      ...args.with_invoice_items === undefined ? {} : { withInvoiceItems: args.with_invoice_items }
+    })
+  });
+});
+
+// src/tools/registry.ts
+function activeTools(config) {
+  return config.readOnly ? allTools.filter((tool) => tool.readOnly) : allTools;
+}
+function toolByName(name) {
+  return allTools.find((tool) => tool.name === name);
+}
+var allTools;
+var init_registry = __esm(() => {
+  init_analytics2();
+  init_auth();
+  init_credits();
+  init_doctor();
+  init_export();
+  init_invoices();
+  init_login2();
+  init_payouts();
+  init_raw();
+  init_services();
+  init_subscriptions();
+  init_sync2();
+  allTools = [
+    authStatus,
+    login2,
+    doctor,
+    sync,
+    listSubscriptions,
+    getSubscription,
+    listInvoices,
+    getInvoice,
+    listCredits,
+    balance,
+    listPayouts,
+    purchaseHistory2,
+    spendingSummary2,
+    searchServices,
+    exportData,
+    rawGet
+  ];
+});
+
+// src/mcp/server.ts
+var exports_server = {};
+__export(exports_server, {
+  startMcpServer: () => startMcpServer,
+  SERVER_NAME: () => SERVER_NAME
+});
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+async function startMcpServer(ctx, version) {
+  const tools = activeTools(ctx.config);
+  const server = new Server({ name: SERVER_NAME, version }, { capabilities: { tools: {} } });
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: tools.map((tool) => ({
+      name: tool.name,
+      description: tool.description,
+      inputSchema: tool.input,
+      annotations: {
+        readOnlyHint: tool.readOnly,
+        destructiveHint: false,
+        idempotentHint: tool.readOnly,
+        openWorldHint: true
+      }
+    }))
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const tool = tools.find((candidate) => candidate.name === request.params.name);
+    if (!tool)
+      return toolError(`Tool desconhecida: ${request.params.name}`);
+    try {
+      const result = await runTool(tool, request.params.arguments ?? {}, ctx);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (error) {
+      return toolError(error instanceof Error ? error.message : String(error));
+    }
+  });
+  await server.connect(new StdioServerTransport);
+  ctx.log.info(`${SERVER_NAME} pronto (${tools.length} tools)`);
+}
+function toolError(message2) {
+  return { isError: true, content: [{ type: "text", text: message2 }] };
+}
+var SERVER_NAME = "kotas-mcp";
+var init_server = __esm(() => {
+  init_define();
+  init_registry();
+});
+
+// src/cli/render.ts
+function format(value) {
+  if (value === null || value === undefined)
+    return "-";
+  if (isMoney(value)) {
+    return value.amount.toLocaleString("pt-BR", {
+      style: "currency",
+      currency: value.currency,
+      minimumFractionDigits: 2
+    });
+  }
+  if (typeof value === "boolean")
+    return value ? "sim" : "n\xE3o";
+  if (Array.isArray(value))
+    return `${value.length} item(ns)`;
+  if (typeof value === "object")
+    return JSON.stringify(value);
+  return String(value);
+}
+function table(rows, columns) {
+  if (rows.length === 0)
+    return "(vazio)";
+  const headers = columns ?? Object.keys(rows[0]);
+  const cells = rows.map((row) => headers.map((header) => format(row[header])));
+  const widths = headers.map((header, index) => Math.max(header.length, ...cells.map((line2) => (line2[index] ?? "").length)));
+  const line = (values) => values.map((value, index) => value.padEnd(widths[index] ?? 0)).join("  ").trimEnd();
+  return [line(headers), line(widths.map((width) => "-".repeat(width))), ...cells.map(line)].join(`
+`);
+}
+function kv(value) {
+  const width = Math.max(...Object.keys(value).map((key) => key.length));
+  return Object.entries(value).map(([key, entry]) => `${key.padEnd(width)}  ${format(entry)}`).join(`
+`);
+}
+function mainList(result) {
+  for (const [key, value] of Object.entries(result)) {
+    if (Array.isArray(value) && value.length > 0 && typeof value[0] === "object") {
+      return { key, rows: value };
+    }
+  }
+  return null;
+}
+var isMoney = (value) => typeof value === "object" && value !== null && typeof value.amount === "number" && typeof value.currency === "string";
+
+// src/cli/index.ts
+var exports_cli = {};
+__export(exports_cli, {
+  runCli: () => runCli
+});
+import { Command } from "commander";
+async function runCli(argv, version) {
+  const program = new Command;
+  program.name("kotas").description("Assinaturas compartilhadas do Kotas: grupos, faturas, cr\xE9ditos e recebimentos").version(version).option("--json", "Imprime o resultado cru em JSON");
+  const withCtx = async (run) => {
+    let ctx;
+    try {
+      ctx = createContext(loadConfig());
+      await run(ctx, program.opts());
+    } catch (error) {
+      if (error instanceof ConfigError)
+        console.error(error.message);
+      else
+        console.error(error instanceof Error ? error.message : String(error));
+      process.exitCode = 1;
+    } finally {
+      ctx?.dispose();
+    }
+  };
+  const call = async (ctx, name, args, options) => {
+    const tool = toolByName(name);
+    if (!tool)
+      throw new Error(`Tool desconhecida: ${name}`);
+    if (ctx.config.readOnly && !tool.readOnly) {
+      throw new Error(`A tool ${name} n\xE3o est\xE1 dispon\xEDvel com KOTAS_READ_ONLY=1.`);
+    }
+    const result = await runTool(tool, prune(args), ctx);
+    print(result, options);
+  };
+  program.command("status").description("Mostra a sess\xE3o salva e o que j\xE1 est\xE1 no cache").option("--verify", "Confirma com o Kotas que a sess\xE3o \xE9 aceita (1 requisi\xE7\xE3o)").action((flags) => withCtx((ctx, options) => call(ctx, "auth_status", { verify: flags.verify }, options)));
+  program.command("login").description("Salva uma sess\xE3o do Kotas, cifrada em disco").option("-e, --email <email>", "E-mail da conta").option("-p, --password <senha>", "Senha (ou defina KOTAS_SENHA)").option("--pin <codigo>", "C\xF3digo de 6 d\xEDgitos da verifica\xE7\xE3o em duas etapas").option("--from-browser <navegador>", "arc | chrome | chromium | brave | edge").option("--paste", "Cola os tr\xEAs valores do localStorage pela entrada padr\xE3o").action((flags) => withCtx(async (ctx, options) => {
+    const args = {
+      email: flags.email,
+      password: flags.password,
+      pin: flags.pin,
+      from_browser: flags.fromBrowser
+    };
+    if (flags.paste)
+      args.tokens = await readPastedTokens();
+    await call(ctx, "login", args, options);
+  }));
+  program.command("doctor").description("Diagn\xF3stico camada a camada").option("--shallow", "N\xE3o testa grupos, cr\xE9ditos e recebimentos").action((flags) => withCtx((ctx, options) => call(ctx, "doctor", { deep: !flags.shallow }, options)));
+  program.command("sync").description("Baixa o hist\xF3rico para o cache local (repete os blocos sozinho)").option("--full", "Varre tudo, n\xE3o s\xF3 o que mudou").option("--reparse", "Reprocessa o cache sem usar a rede").option("--max-requests <n>", "Or\xE7amento por bloco", (value) => Number(value)).action((flags) => withCtx(async (ctx, options) => {
+    const tool = toolByName("sync");
+    if (!tool)
+      throw new Error("Tool sync ausente do registry.");
+    const args = prune({
+      mode: flags.reparse ? "reparse" : flags.full ? "full" : undefined,
+      max_requests: flags.maxRequests
+    });
+    let last = {};
+    const errors = [];
+    for (let chunk = 1;chunk <= 100; chunk += 1) {
+      last = await runTool(tool, args, ctx);
+      errors.push(...last.errors ?? []);
+      console.error(`bloco ${chunk}: ${last.requestsUsed} req, ${last.invoices} faturas, ${last.pendingDetails} detalhes pendentes${last.done ? ", pronto" : ""}`);
+      if (last.done === true)
+        break;
+    }
+    print({ ...last, errors }, options);
+  }));
+  program.command("subscriptions").description("Lista as assinaturas do cache").option("--role <papel>", "todos | membro | administrador").action((flags) => withCtx((ctx, options) => call(ctx, "list_subscriptions", { role: flags.role }, options)));
+  program.command("subscription <groupId>").description("Detalha uma assinatura").action((groupId) => withCtx((ctx, options) => call(ctx, "get_subscription", { group_id: Number(groupId) }, options)));
+  program.command("invoices").description("Lista as faturas do cache").option("--status <situacao>", "pago | pendente | cancelado | atraso | estornado").option("--from <data>", "YYYY-MM-DD").option("--to <data>", "YYYY-MM-DD").option("--product <nome>", "Nome exato do produto").option("--limit <n>", "M\xE1ximo de faturas", (value) => Number(value)).action((flags) => withCtx((ctx, options) => call(ctx, "list_invoices", {
+    status: flags.status,
+    from: flags.from,
+    to: flags.to,
+    product: flags.product,
+    limit: flags.limit
+  }, options)));
+  program.command("invoice <invoiceId>").description("Detalha uma fatura, com os itens").action((invoiceId) => withCtx((ctx, options) => call(ctx, "get_invoice", { invoice_id: Number(invoiceId) }, options)));
+  program.command("credits").description("Lista os lan\xE7amentos de cr\xE9dito").option("--kind <tipo>", "adicaoDeSaldo | caucaoDaInscricao | repasseAdministrador | estornoCancelamento").action((flags) => withCtx((ctx, options) => call(ctx, "list_credits", { kind: flags.kind }, options)));
+  program.command("balance").description("Saldo da carteira e economia acumulada (ao vivo)").action(() => withCtx((ctx, options) => call(ctx, "balance", {}, options)));
+  program.command("payouts").description("Recebimentos como administrador").option("--group <id>", "Tamb\xE9m mostra o extrato deste grupo", (value) => Number(value)).action((flags) => withCtx((ctx, options) => call(ctx, "list_payouts", { group_id: flags.group }, options)));
+  program.command("history").description("Linha do tempo de todas as assinaturas j\xE1 pagas, inclusive as encerradas").option("--active", "S\xF3 as que ainda existem hoje").option("--with-credits", "Inclui as compras de cr\xE9dito avulso").action((flags) => withCtx((ctx, options) => call(ctx, "purchase_history", { active_only: flags.active, include_credit_purchases: flags.withCredits }, options)));
+  program.command("spending").description("Soma os gastos por m\xEAs, ano, produto ou situa\xE7\xE3o").option("--by <criterio>", "month | year | product | status", "month").option("--from <data>", "YYYY-MM-DD").option("--to <data>", "YYYY-MM-DD").action((flags) => withCtx((ctx, options) => call(ctx, "spending_summary", { by: flags.by, from: flags.from, to: flags.to }, options)));
+  program.command("search <termo>").description("Busca servi\xE7os no cat\xE1logo do Kotas").action((termo) => withCtx((ctx, options) => call(ctx, "search_services", { query: termo }, options)));
+  program.command("export <escopo>").description("invoices | subscriptions | credits | payouts | history").option("--format <formato>", "csv | json", "csv").option("--filename <nome>", "Nome do arquivo, sem caminho").action((escopo, flags) => withCtx((ctx, options) => call(ctx, "export", { scope: escopo, format: flags.format, filename: flags.filename }, options)));
+  program.command("raw <rota>").description("GET autenticado numa rota de leitura da API").option("-q, --query <k=v...>", "Par\xE2metros de query, repet\xEDveis (ex.: -q page=1 -q pageSize=50)").action((rota, flags) => withCtx((ctx, options) => call(ctx, "raw_get", { path: rota, query: parseQuery(flags.query) }, options)));
+  program.command("tools").description("Lista as tools registradas").action(() => withCtx(async (ctx, options) => {
+    const rows = activeTools(ctx.config).map((tool) => ({
+      tool: tool.name,
+      escreve: !tool.readOnly
+    }));
+    print({ total: rows.length, tools: rows }, options);
+  }));
+  program.command("mcp").description("Inicia o servidor MCP (stdio)").action(() => {
+    throw new Error("Use `kotas mcp` diretamente: o modo MCP \xE9 tratado antes do CLI.");
+  });
+  await program.parseAsync(argv);
+}
+async function readPastedTokens() {
+  process.stderr.write(`Cole os valores do localStorage de app.kotas.com.br, um por linha:
+` + `  1) @chave
+  2) @c08cbbfd6eefc83ac6d23c4c791277e4
+  3) SEFTSF9ESVNQT1NJVElWTw== (opcional)
+`);
+  const text = await new Response(Bun.stdin.stream()).text();
+  const [accessToken, refreshToken, deviceHash] = text.split(`
+`).map((line) => line.trim()).filter((line) => line !== "");
+  if (!accessToken || !refreshToken) {
+    throw new Error("Faltou o access token ou o refresh token (uma linha para cada).");
+  }
+  return {
+    access_token: accessToken,
+    refresh_token: refreshToken,
+    ...deviceHash ? { device_hash: deviceHash } : {}
+  };
+}
+function parseQuery(pairs) {
+  if (!pairs || pairs.length === 0)
+    return;
+  const query = {};
+  for (const pair of pairs) {
+    const at = pair.indexOf("=");
+    if (at === -1)
+      throw new Error(`Par\xE2metro inv\xE1lido: "${pair}". Use chave=valor.`);
+    query[pair.slice(0, at)] = pair.slice(at + 1);
+  }
+  return query;
+}
+function print(result, options) {
+  if (options.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  const list = mainList(result);
+  if (list) {
+    const rest = Object.fromEntries(Object.entries(result).filter(([key]) => key !== list.key));
+    if (Object.keys(rest).length > 0)
+      console.log(`${kv(rest)}
+`);
+    console.log(table(list.rows));
+    return;
+  }
+  console.log(kv(result));
+}
+var prune = (args) => Object.fromEntries(Object.entries(args).filter(([, value]) => value !== undefined));
+var init_cli = __esm(() => {
+  init_config();
+  init_context();
+  init_config();
+  init_define();
+  init_registry();
+});
+// package.json
+var package_default = {
+  name: "@maxwellmezadre/kotas-mcp",
+  version: "0.1.0",
+  description: "CLI + servidor MCP para as assinaturas compartilhadas do Kotas (grupos, faturas, cr\xE9ditos, recebimentos e hist\xF3rico) sobre um n\xFAcleo compartilhado",
+  type: "module",
+  license: "MIT",
+  repository: { type: "git", url: "git+https://github.com/maxwellmezadre/kotas-mcp.git" },
+  homepage: "https://github.com/maxwellmezadre/kotas-mcp#readme",
+  keywords: ["kotas", "cli", "mcp", "subscriptions", "invoices", "assinaturas", "claude"],
+  bin: { kotas: "dist/bin.js", "kotas-mcp": "dist/mcp-bin.js" },
+  files: ["dist", "SKILL.md", "docs/TOOLS.md", "README.md", "LICENSE"],
+  exports: "./dist/bin.js",
+  publishConfig: { access: "public" },
+  engines: { bun: ">=1.3" },
+  scripts: {
+    start: "bun run src/bin.ts",
+    login: "bun run src/bin.ts login",
+    typecheck: "tsc --noEmit",
+    test: "bun test",
+    verify: "bun run scripts/verify.ts",
+    "docs:tools": "bun run scripts/gen-tools-doc.ts",
+    "build:dist": "bun build src/bin.ts src/mcp-bin.ts --target=bun --packages external --outdir dist",
+    "build:binary": "bun build --compile src/bin.ts --outfile kotas",
+    prepublishOnly: "bun run build:dist",
+    setup: "bun run scripts/install.ts"
+  },
+  dependencies: {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@sinclair/typebox": "^0.34.52",
+    commander: "^15.0.0"
+  },
+  devDependencies: { "@types/bun": "^1.4.1", typescript: "^5" }
+};
+
+// src/bin.ts
+var arg = process.argv[2];
+if (arg === "mcp") {
+  const [{ loadConfig: loadConfig2 }, { createContext: createContext2 }, { startMcpServer: startMcpServer2 }] = await Promise.all([
+    Promise.resolve().then(() => (init_config(), exports_config)),
+    Promise.resolve().then(() => (init_context(), exports_context)),
+    Promise.resolve().then(() => (init_server(), exports_server))
+  ]);
+  await startMcpServer2(createContext2(loadConfig2()), package_default.version);
+} else {
+  const { runCli: runCli2 } = await Promise.resolve().then(() => (init_cli(), exports_cli));
+  await runCli2(process.argv, package_default.version);
+}