noxctl 0.1.0 → 0.3.0

package/dist/cli.js

@@ -2,19 +2,130 @@
 import { Command, Option } from 'commander';
 import { readFileSync } from 'node:fs';
 import { createInterface } from 'node:readline/promises';
-import { isJsonMode, outputList, outputDetail, outputConfirmation, formatTaxReport, formatFinancialReport, } from './formatter.js';
-import { invoiceListColumns, invoiceDetailColumns, invoiceConfirmColumns, customerListColumns, customerDetailColumns, voucherListColumns, voucherDetailColumns, voucherRowColumns, accountListColumns, companyDetailColumns, articleListColumns, articleDetailColumns, supplierListColumns, supplierDetailColumns, supplierInvoiceListColumns, supplierInvoiceDetailColumns, supplierInvoiceConfirmColumns, } from './views.js';
+import { isJsonMode, outputList, outputDetail, outputConfirmation, formatTaxReport, formatFinancialReport, errorEnvelope, } from './formatter.js';
+import { readActivePointer, readActivePointerOutcome, writeActivePointer, deleteActivePointer, readProfileIndex, resolveProfile, } from './profiles.js';
+import { setResolvedProfile } from './auth.js';
+import { applyPeriod } from './date-periods.js';
+import { DEFAULT_PROFILE, InvalidProfileNameError } from './profile-name.js';
+import { invoiceListColumns, invoiceDetailColumns, invoiceConfirmColumns, customerListColumns, customerDetailColumns, voucherListColumns, voucherDetailColumns, voucherRowColumns, accountListColumns, companyDetailColumns, articleListColumns, articleDetailColumns, supplierListColumns, supplierDetailColumns, supplierInvoiceListColumns, supplierInvoiceDetailColumns, supplierInvoiceConfirmColumns, invoicePaymentListColumns, invoicePaymentDetailColumns, supplierInvoicePaymentListColumns, supplierInvoicePaymentDetailColumns, offerListColumns, offerDetailColumns, orderListColumns, orderDetailColumns, projectListColumns, projectDetailColumns, costCenterListColumns, costCenterDetailColumns, taxReductionListColumns, taxReductionDetailColumns, priceListListColumns, priceListDetailColumns, priceListColumns, priceDetailColumns, financialYearListColumns, financialYearDetailColumns, lockedPeriodDetailColumns, contractListColumns, contractDetailColumns, topCustomerColumns, monthlyRevenueColumns, voucherAttachmentColumns, } from './views.js';
 const program = new Command();
 program
     .name('noxctl')
     .description('CLI and MCP server for Fortnox accounting')
-    .version('0.1.0')
-    .addOption(new Option('-o, --output <format>', 'Output format')
+    .version('0.3.0')
+    .addOption(new Option('-o, --output <format>', 'Output format (default: table on TTY, json when piped)')
     .choices(['json', 'table'])
-    .default(undefined));
+    .default(undefined))
+    .option('--profile <name>', 'Profile to operate on (overrides NOXCTL_PROFILE and active pointer)');
 function json() {
     return isJsonMode(program.opts());
 }
+// Suppress Commander's own plain-text usage errors (unknown command, missing
+// required option, ...) when in JSON mode, so the top-level catch can emit a
+// structured error envelope instead of leaving non-JSON on stderr. In table
+// mode, keep Commander's friendly usage message.
+//
+// Both configureOutput and exitOverride must be set HERE, before the command
+// tree is built: Commander only copies these settings into subcommands created
+// *after* they're configured on the parent. Set at the bottom, a subcommand's
+// parse error would call process.exit() directly and bypass the catch below
+// (leaving JSON-mode failures with no envelope).
+program.configureOutput({
+    outputError: (str, write) => {
+        if (!json())
+            write(str);
+    },
+});
+program.exitOverride();
+// Emit a fatal error honoring -o json mode (structured envelope to stderr) vs
+// plain text, then exit. Validation failures inside command actions must go
+// through this so they don't bypass the JSON error contract the way a bare
+// console.error would. The top-level catch handles thrown errors the same way;
+// this is for the cases where we want a specific non-1 exit code.
+function fail(message, exitCode = 1) {
+    if (json()) {
+        console.error(JSON.stringify(errorEnvelope(new Error(message)), null, 2));
+    }
+    else {
+        console.error(message);
+    }
+    process.exit(exitCode);
+}
+function fromToParams(opts) {
+    const { from, to } = applyPeriod(opts);
+    return { fromDate: from, toDate: to };
+}
+let resolvedProfileInfo = { name: DEFAULT_PROFILE, source: 'default' };
+export function getResolvedProfileInfo() {
+    return resolvedProfileInfo;
+}
+// Commands that don't need (and shouldn't require) a resolved profile.
+const PROFILE_RESOLUTION_SKIP = new Set(['help', 'completion']);
+program.hook('preAction', async (thisCommand, actionCommand) => {
+    const name = actionCommand.name();
+    if (PROFILE_RESOLUTION_SKIP.has(name))
+        return;
+    const flag = program.opts().profile ?? undefined;
+    const env = process.env['NOXCTL_PROFILE'] ?? undefined;
+    // Typed pointer resolution so we can distinguish "no pointer" (silent
+    // default) from "pointer unreadable/corrupt" (must surface). 2s bound
+    // catches wedged filesystems; the AbortSignal cancels the underlying read.
+    const outcome = await readActivePointerOutcome({ timeoutMs: 2000 });
+    let pointer = null;
+    if (outcome.kind === 'valid') {
+        pointer = outcome.name;
+    }
+    else if (outcome.kind !== 'missing') {
+        const desc = describePointerFault(outcome);
+        // Only fail closed when the pointer is the winning source (no flag/env)
+        // AND we're about to start the MCP server. For any other command, warn
+        // loudly but continue so `doctor` / `profile use` can repair the state.
+        const wouldRelyOnPointer = !flag && !env;
+        if (wouldRelyOnPointer && name === 'serve') {
+            fail(`Active profile pointer ${desc}. Refusing to start MCP server with ambiguous profile. Run \`noxctl doctor\` or set NOXCTL_PROFILE explicitly.`, 2);
+        }
+        process.stderr.write(`[warning: active-profile pointer ${desc}; ignoring]\n`);
+    }
+    try {
+        resolvedProfileInfo = resolveProfile({ flag, env, pointer });
+    }
+    catch (err) {
+        if (err instanceof InvalidProfileNameError) {
+            fail(err.message, 2);
+        }
+        throw err;
+    }
+    setResolvedProfile(resolvedProfileInfo.name);
+    // Banner ownership: MCP `serve` prints its own banner in bindStartupProfile
+    // so host logs (Claude Desktop) always see it. Suppress here to avoid a
+    // duplicate on TTY invocations like `noxctl --profile X serve`.
+    if (resolvedProfileInfo.name.toLowerCase() !== DEFAULT_PROFILE &&
+        process.stderr.isTTY &&
+        name !== 'current' &&
+        name !== 'serve') {
+        process.stderr.write(`[profile: ${resolvedProfileInfo.name}]\n`);
+    }
+});
+function describePointerFault(outcome) {
+    switch (outcome.kind) {
+        case 'invalid-content':
+            return `contains an invalid profile name: "${outcome.raw}"`;
+        case 'read-error':
+            return `could not be read (${outcome.error.message})`;
+        case 'timeout':
+            return 'read timed out';
+    }
+}
+async function fetchCompanyHint() {
+    try {
+        const { loadCredentials } = await import('./auth.js');
+        const creds = await loadCredentials();
+        return creds?.company_name;
+    }
+    catch {
+        return undefined;
+    }
+}
 async function confirmMutation(action, opts, payload) {
     if (opts.dryRun) {
         console.log(`Dry run: ${action}. No request was sent to Fortnox.`);
@@ -29,12 +140,41 @@ async function confirmMutation(action, opts, payload) {
     if (!process.stdin.isTTY || !process.stdout.isTTY) {
         throw new Error(`Confirmation required to ${action}. Re-run with --yes, or --dry-run first.`);
     }
+    const company = await fetchCompanyHint();
+    const suffix = company ? ` (${company})` : '';
+    // Show what will actually be sent so the user can verify before confirming.
+    if (payload !== undefined) {
+        console.log('Request payload:');
+        console.log(JSON.stringify(payload, null, 2));
+        console.log();
+    }
     const rl = createInterface({
         input: process.stdin,
         output: process.stdout,
     });
     try {
-        const answer = await rl.question(`${action}. Continue? [y/N] `);
+        const answer = await rl.question(`${action}. Continue?${suffix} [y/N] `);
+        return ['y', 'yes'].includes(answer.trim().toLowerCase());
+    }
+    finally {
+        rl.close();
+    }
+}
+function requireDarwin() {
+    if (process.platform !== 'darwin') {
+        fail('The dedicated YubiKey-locked keychain is a macOS-only feature.', 2);
+    }
+}
+// Confirmation for local, irreversible operations (not Fortnox mutations).
+async function localConfirm(question, yes) {
+    if (yes)
+        return true;
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new Error('Confirmation required. Re-run with --yes.');
+    }
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await rl.question(`${question} [y/N] `);
         return ['y', 'yes'].includes(answer.trim().toLowerCase());
     }
     finally {
@@ -45,10 +185,28 @@ async function confirmMutation(action, opts, payload) {
 program
     .command('init')
     .description('Interactive setup wizard — recommended onboarding path')
-    .action(async () => {
+    .option('--profile <name>', 'Profile to create/re-auth (defaults to resolved profile or "default")')
+    .action(async (initOpts) => {
     const { loadCredentials, runOAuthSetup } = await import('./auth.js');
+    const { validateProfileName } = await import('./profile-name.js');
+    let targetProfile;
+    try {
+        targetProfile = validateProfileName(initOpts.profile ?? resolvedProfileInfo.name);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(2);
+    }
+    // If `init --profile <name>` names a different profile than the preAction
+    // hook resolved, rebind the in-process resolved profile so downstream work
+    // (verification via getCompanyInfo, runOAuthSetup's internal saveCredentials
+    // call chain) targets the profile being initialized — not a stale pointer.
+    if (targetProfile.toLowerCase() !== resolvedProfileInfo.name.toLowerCase()) {
+        setResolvedProfile(targetProfile);
+        resolvedProfileInfo = { name: targetProfile, source: 'flag' };
+    }
     // Step 1: Check if already configured
-    const existing = await loadCredentials();
+    const existing = await loadCredentials(targetProfile);
     if (existing) {
         console.log('Existing credentials found.');
         if (process.stdin.isTTY && process.stdout.isTTY) {
@@ -181,7 +339,20 @@ program
         }
     }
     // Step 6: Run OAuth flow
-    await runOAuthSetup({ clientId, clientSecret, serviceAccount });
+    await runOAuthSetup({ clientId, clientSecret, serviceAccount }, targetProfile);
+    // Step 6b: Set the active pointer if this is the first profile or no pointer exists.
+    try {
+        const idx = await readProfileIndex();
+        const existingPointer = await readActivePointer();
+        const firstProfile = idx.profiles.length <= 1;
+        if (firstProfile || !existingPointer) {
+            await writeActivePointer(targetProfile);
+        }
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.warn(`Warning: could not update active profile pointer: ${msg}`);
+    }
     // Step 7: Verify by fetching company info
     try {
         const { getCompanyInfo } = await import('./operations/company.js');
@@ -267,28 +438,139 @@ program
 // --- logout ---
 program
     .command('logout')
-    .description('Remove stored Fortnox credentials')
+    .description('Remove stored Fortnox credentials for the resolved profile')
     .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--all', 'Remove credentials for every profile (and the legacy slot)')
     .action(async (opts) => {
-    const { loadCredentials } = await import('./auth.js');
     const { deleteCredentialBlob } = await import('./credentials-store.js');
-    const existing = await loadCredentials();
+    const { removeProfile } = await import('./profiles.js');
+    if (opts.all) {
+        if (!(await confirmMutation('Remove stored Fortnox credentials for ALL profiles', opts))) {
+            return;
+        }
+        const idx = await readProfileIndex();
+        const names = new Set(idx.profiles.map((p) => p.name));
+        names.add(DEFAULT_PROFILE);
+        let removedAny = false;
+        for (const name of names) {
+            const deleted = await deleteCredentialBlob(name);
+            if (deleted)
+                removedAny = true;
+            try {
+                await removeProfile(name);
+            }
+            catch {
+                // best-effort — index cleanup must not abort logout
+            }
+        }
+        try {
+            await deleteActivePointer();
+        }
+        catch {
+            // ignore
+        }
+        if (removedAny) {
+            console.log('Removed credentials for all profiles.');
+        }
+        else {
+            console.log('No credentials found to remove.');
+        }
+        return;
+    }
+    const target = resolvedProfileInfo.name;
+    const { loadCredentials } = await import('./auth.js');
+    const existing = await loadCredentials(target);
     if (!existing) {
-        console.log('No credentials found. Nothing to remove.');
+        console.log(`No credentials found for profile "${target}". Nothing to remove.`);
         return;
     }
-    if (!(await confirmMutation('Remove stored Fortnox credentials', opts))) {
+    if (!(await confirmMutation(`Remove stored credentials for profile "${target}"`, opts))) {
         return;
     }
-    const deleted = await deleteCredentialBlob();
+    const deleted = await deleteCredentialBlob(target);
+    try {
+        await removeProfile(target);
+    }
+    catch {
+        // best-effort
+    }
+    try {
+        const pointer = await readActivePointer();
+        if (pointer && pointer.toLowerCase() === target.toLowerCase()) {
+            await deleteActivePointer();
+        }
+    }
+    catch {
+        // ignore
+    }
     if (deleted) {
-        console.log('Credentials removed.');
+        console.log(`Credentials for profile "${target}" removed.`);
     }
     else {
         console.log('Could not remove credentials from the system keychain.');
         console.log('They may have already been removed, or you may need to remove them manually.');
     }
 });
+// --- profile ---
+const profile = program.command('profile').description('Manage noxctl profiles');
+profile
+    .command('use <name>')
+    .description('Set the active profile (writes ~/.fortnox-mcp/active-profile)')
+    .action(async (name) => {
+    const { validateProfileName } = await import('./profile-name.js');
+    let validated;
+    try {
+        validated = validateProfileName(name);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(2);
+    }
+    const { loadCredentials } = await import('./auth.js');
+    const creds = await loadCredentials(validated);
+    if (!creds) {
+        console.error(`No credentials found for profile "${validated}". Run \`noxctl init --profile ${validated}\` first.`);
+        process.exit(1);
+    }
+    await writeActivePointer(validated);
+    if (json()) {
+        console.log(JSON.stringify({ name: validated, source: 'pointer' }));
+    }
+    else {
+        console.log(`Active profile set to "${validated}".`);
+    }
+});
+profile
+    .command('current')
+    .description('Show the currently resolved profile and where it came from')
+    .action(() => {
+    if (json()) {
+        console.log(JSON.stringify(resolvedProfileInfo));
+    }
+    else {
+        console.log(`${resolvedProfileInfo.name} (source: ${resolvedProfileInfo.source})`);
+    }
+});
+profile
+    .command('list')
+    .description('List known profiles from the index')
+    .action(async () => {
+    const idx = await readProfileIndex();
+    if (json()) {
+        console.log(JSON.stringify(idx.profiles, null, 2));
+        return;
+    }
+    if (idx.profiles.length === 0) {
+        console.log('No profiles registered. Run `noxctl init` to create one.');
+        return;
+    }
+    for (const p of idx.profiles) {
+        const marker = p.name.toLowerCase() === resolvedProfileInfo.name.toLowerCase() ? '*' : ' ';
+        const company = p.company_name ? ` — ${p.company_name}` : '';
+        const tenant = p.tenant_id ? ` [tenant ${p.tenant_id}]` : '';
+        console.log(`${marker} ${p.name}${company}${tenant}`);
+    }
+});
 // --- doctor ---
 program
     .command('doctor')
@@ -320,14 +602,81 @@ program
             ? 'Windows DPAPI'
             : 'Linux Secret Service';
     pass('Credential store', storeBackend);
+    // 2a. Dedicated YubiKey-locked keychain (macOS only)
+    if (process.platform === 'darwin') {
+        const kt = await import('./keychain-target.js');
+        const activePath = kt.activeKeychainPath();
+        if (activePath) {
+            const state = kt.keychainLockState(activePath);
+            if (state === 'locked') {
+                fail('Dedicated keychain', 'locked — run `noxctl keychain unlock` (tap your YubiKey)');
+            }
+            else {
+                pass('Dedicated keychain', `active, ${state} (${activePath})`);
+            }
+            pass('ykman', kt.ykmanAvailable() ? 'installed' : 'not installed (brew install ykman)');
+        }
+        else {
+            pass('Dedicated keychain', 'not enabled (using login keychain)');
+        }
+    }
+    // 2b. Profile resolution
+    pass('Profile', `${resolvedProfileInfo.name} (source: ${resolvedProfileInfo.source})`);
+    // 2c. Active pointer health — surface a corrupt pointer file even though
+    // readActivePointer() degrades silently.
+    try {
+        const { paths } = await import('./profiles.js');
+        const fsp = await import('node:fs/promises');
+        const raw = await fsp.readFile(paths.activePointerFile, 'utf-8').catch(() => null);
+        if (raw !== null) {
+            const trimmed = raw.trim();
+            if (trimmed.length > 0) {
+                const { validateProfileName } = await import('./profile-name.js');
+                try {
+                    validateProfileName(trimmed);
+                    const idx = await readProfileIndex();
+                    const known = idx.profiles.some((p) => p.name.toLowerCase() === trimmed.toLowerCase());
+                    if (known) {
+                        pass('Active pointer', trimmed);
+                    }
+                    else {
+                        fail('Active pointer', `points to unknown profile "${trimmed}" — run \`noxctl profile use <name>\` to fix`);
+                    }
+                }
+                catch {
+                    fail('Active pointer', 'contains an invalid name — delete to reset');
+                }
+            }
+        }
+    }
+    catch {
+        // best-effort diagnostic — don't block doctor on filesystem issues
+    }
     // 3. Credentials exist
-    const creds = await loadCredentials();
+    let creds;
+    try {
+        creds = await loadCredentials();
+    }
+    catch (err) {
+        const { KeychainLockedError } = await import('./keychain-target.js');
+        if (err instanceof KeychainLockedError) {
+            fail('Credentials', err.message);
+            console.log(`\n${ok ? 'All checks passed.' : 'Some checks failed.'}`);
+            return;
+        }
+        throw err;
+    }
     if (!creds) {
-        fail('Credentials', 'not found — run `noxctl init` to set up');
+        fail('Credentials', `not found for profile "${resolvedProfileInfo.name}" — run \`noxctl init${resolvedProfileInfo.name === DEFAULT_PROFILE
+            ? ''
+            : ` --profile ${resolvedProfileInfo.name}`}\` to set up`);
         console.log(`\n${ok ? 'All checks passed.' : 'Some checks failed.'}`);
         return;
     }
     pass('Credentials', 'found');
+    if (creds.company_name) {
+        pass('Company (cached)', creds.company_name);
+    }
     // 4. Client ID present
     if (creds.client_id) {
         pass('Client ID', `${creds.client_id.slice(0, 8)}...`);
@@ -372,11 +721,14 @@ program
         article: 'articles?limit=1',
         customer: 'customers?limit=1',
         invoice: 'invoices?limit=1',
+        payment: 'invoicepayments?limit=1',
         supplier: 'suppliers?limit=1',
         supplierinvoice: 'supplierinvoices?limit=1',
         bookkeeping: 'vouchers?limit=1',
         companyinformation: 'companyinformation',
         settings: 'settings/company',
+        inbox: 'inbox',
+        connectfile: 'voucherfileconnections?limit=1',
     };
     const required = SCOPES.split(' ');
     const missing = [];
@@ -388,10 +740,13 @@ program
             await fortnoxRequest(endpoint);
         }
         catch (err) {
-            if (err instanceof FortnoxApiError && err.statusCode === 403) {
+            // A missing scope shows up as a 403, OR (for some endpoints, e.g. the
+            // archive/inbox family) a 400 whose message names the scope. Treat both
+            // as "not authorized"; other errors (500, etc.) aren't scope problems.
+            if (err instanceof FortnoxApiError &&
+                (err.statusCode === 403 || /scope/i.test(err.fortnoxMessage ?? ''))) {
                 missing.push(scope);
             }
-            // Non-403 errors (e.g. 500) are not scope problems — ignore here
         }
     }
     if (missing.length === 0) {
@@ -402,13 +757,252 @@ program
     }
     console.log(`\n${ok ? 'All checks passed.' : 'Some checks failed.'}`);
 });
+// --- keychain (dedicated YubiKey-locked credential store, macOS only) ---
+const keychain = program
+    .command('keychain')
+    .description('Manage the dedicated YubiKey-locked credential keychain (macOS)');
+keychain
+    .command('status')
+    .description('Show dedicated-keychain mode, lock state, and YubiKey availability')
+    .action(async () => {
+    const kt = await import('./keychain-target.js');
+    const onDarwin = process.platform === 'darwin';
+    console.log('Keychain status\n');
+    console.log(`  Platform          ${process.platform}${onDarwin ? '' : ' (dedicated keychain is macOS-only)'}`);
+    if (!onDarwin)
+        return;
+    const activePath = kt.activeKeychainPath();
+    const kcPath = activePath ?? kt.dedicatedKeychainPath();
+    const lockState = kt.keychainLockState(kcPath);
+    console.log(`  Dedicated mode    ${activePath ? 'active' : 'inactive (using login keychain)'}`);
+    console.log(`  Keychain file     ${kcPath} (${lockState})`);
+    console.log(`  Challenge file    ${kt.readChallenge() ? kt.challengeFilePath() : 'not present'}`);
+    console.log(`  ykman installed   ${kt.ykmanAvailable() ? 'yes' : 'no (brew install ykman)'}`);
+    console.log(`  YubiKey present   ${kt.yubikeyPresent() ? 'yes' : 'no'}`);
+    const enrolledSerial = kt.readEnrolledSerial();
+    console.log(`  Enrolled serial   ${enrolledSerial ?? 'not recorded'}`);
+    if (enrolledSerial) {
+        const mismatch = kt.diagnoseSerialMismatch(enrolledSerial, kt.listYubikeySerials());
+        if (mismatch)
+            console.log(`\n  ${mismatch}`);
+    }
+    if (activePath && lockState === 'locked') {
+        console.log('\n  Locked — run `noxctl keychain unlock` (tap your YubiKey).');
+    }
+});
+keychain
+    .command('unlock')
+    .description('Unlock the dedicated keychain for this session (tap your YubiKey)')
+    .action(async () => {
+    requireDarwin();
+    const kt = await import('./keychain-target.js');
+    const kcPath = kt.activeKeychainPath() ?? kt.dedicatedKeychainPath();
+    const state = kt.keychainLockState(kcPath);
+    if (state === 'missing') {
+        console.error('No dedicated keychain found. Run `noxctl keychain init` first.');
+        process.exit(1);
+    }
+    if (state === 'unlocked') {
+        console.log('Keychain is already unlocked.');
+        return;
+    }
+    const challenge = kt.readChallenge();
+    if (!challenge) {
+        console.error('Challenge file missing — cannot derive the unlock password. Re-run `noxctl keychain init`.');
+        process.exit(1);
+    }
+    // Preflight: a wrong/absent key is diagnosable from serials alone, before
+    // burning a tap on a challenge that can only fail.
+    const mismatch = kt.diagnoseSerialMismatch(kt.readEnrolledSerial(), kt.listYubikeySerials());
+    if (mismatch) {
+        console.error(mismatch);
+        process.exit(1);
+    }
+    console.log('Tap your YubiKey when it blinks...');
+    let password;
+    try {
+        password = kt.computeChallengeResponse(challenge);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+    try {
+        kt.unlockDedicatedKeychain(kcPath, password);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+    console.log('Keychain unlocked — open until your Mac sleeps.');
+});
+keychain
+    .command('lock')
+    .description('Lock the dedicated keychain now')
+    .action(async () => {
+    requireDarwin();
+    const kt = await import('./keychain-target.js');
+    const kcPath = kt.activeKeychainPath() ?? kt.dedicatedKeychainPath();
+    if (kt.keychainLockState(kcPath) === 'missing') {
+        console.error('No dedicated keychain found.');
+        process.exit(1);
+    }
+    kt.lockKeychain(kcPath);
+    console.log('Keychain locked.');
+});
+keychain
+    .command('init')
+    .description('Create the YubiKey-locked keychain and copy in existing credentials')
+    .action(async () => {
+    requireDarwin();
+    const kt = await import('./keychain-target.js');
+    if (!kt.ykmanAvailable()) {
+        console.error('ykman not found — install it with `brew install ykman`, then re-run.');
+        process.exit(1);
+    }
+    if (!kt.yubikeyPresent()) {
+        console.error('No YubiKey detected — insert it and re-run.');
+        process.exit(1);
+    }
+    const kcPath = kt.dedicatedKeychainPath();
+    if (kt.readChallenge()) {
+        console.error('Already initialized. Use `noxctl keychain unlock` or `noxctl keychain status`.');
+        process.exit(1);
+    }
+    if (kt.keychainLockState(kcPath) !== 'missing') {
+        console.error(`A keychain already exists at ${kcPath} but no challenge file is present.\n` +
+            `Remove the stale keychain (\`security delete-keychain "${kcPath}"\`) and re-run.`);
+        process.exit(1);
+    }
+    console.log('This creates a dedicated, lock-on-sleep keychain whose password is derived');
+    console.log('from your YubiKey (OTP slot 2 challenge-response). You unlock it once per');
+    console.log('session with a tap. Existing credentials are copied in; the login-keychain');
+    console.log('originals are left in place (run `noxctl keychain seal` to remove them later).');
+    console.log('');
+    console.log('Slot 2 must already be programmed: `ykman otp chalresp --generate --touch 2`.');
+    console.log('');
+    // Collect existing credentials from the LOGIN keychain BEFORE activating
+    // dedicated mode (challenge file absent -> activeKeychainPath() is null).
+    const { readProfileIndex } = await import('./profiles.js');
+    const { loadCredentialBlob, saveCredentialBlob } = await import('./credentials-store.js');
+    const idx = await readProfileIndex();
+    const names = new Set([DEFAULT_PROFILE, ...idx.profiles.map((p) => p.name)]);
+    const blobs = [];
+    for (const name of names) {
+        const { blob } = await loadCredentialBlob(name);
+        if (blob)
+            blobs.push({ profile: name, blob });
+    }
+    console.log(`Found ${blobs.length} credential set(s) to copy: ${blobs.map((b) => b.profile).join(', ') || '(none)'}`);
+    console.log('');
+    // Derive the keychain password from the YubiKey (requires a tap). Done
+    // before creating the keychain so a missed tap leaves nothing behind.
+    const challenge = kt.generateChallenge();
+    console.log('Tap your YubiKey when it blinks...');
+    let password;
+    try {
+        password = kt.computeChallengeResponse(challenge);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+    const created = kt.createDedicatedKeychain(kcPath, password);
+    if (created === 'exists') {
+        console.error(`Unexpected: keychain already exists at ${kcPath}. Aborting.`);
+        process.exit(1);
+    }
+    kt.setLockOnSleep(kcPath);
+    // Activate dedicated mode: now activeKeychainPath() resolves to kcPath and
+    // saveCredentialBlob targets the new (still-unlocked) keychain.
+    kt.writeChallenge(challenge);
+    // Remember which physical key answered the enrollment challenge so unlock
+    // can distinguish "wrong key inserted" from "missed tap" later.
+    const serials = kt.listYubikeySerials();
+    if (serials.length === 1) {
+        kt.writeEnrolledSerial(serials[0]);
+        console.log(`Enrolled against YubiKey serial ${serials[0]}.`);
+    }
+    else if (serials.length > 1) {
+        console.log(`Multiple YubiKeys present (${serials.join(', ')}) — not recording an enrolled serial.`);
+    }
+    let copied = 0;
+    for (const { profile, blob } of blobs) {
+        try {
+            await saveCredentialBlob(blob, profile);
+            copied++;
+        }
+        catch (err) {
+            console.error(`  ! failed to copy "${profile}": ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    console.log('');
+    console.log(`Done. Created ${kcPath}, copied ${copied}/${blobs.length} credential set(s).`);
+    console.log('The keychain is unlocked now and will lock when your Mac sleeps.');
+    console.log('Next session: `noxctl keychain unlock` (one tap).');
+    console.log('When you trust it: `noxctl keychain seal` to delete the login-keychain copies.');
+});
+keychain
+    .command('seal')
+    .description('Delete the login-keychain credential copies left by `init` (irreversible)')
+    .option('--yes', 'Skip the confirmation prompt')
+    .action(async (opts) => {
+    requireDarwin();
+    const kt = await import('./keychain-target.js');
+    const activePath = kt.activeKeychainPath();
+    if (!activePath) {
+        console.error('Dedicated keychain mode is not active — nothing to seal. Run `noxctl keychain init` first.');
+        process.exit(1);
+    }
+    if (kt.keychainLockState(activePath) === 'locked') {
+        console.error('Dedicated keychain is locked — run `noxctl keychain unlock` first so the copies can be verified before the originals are deleted.');
+        process.exit(1);
+    }
+    const { readProfileIndex } = await import('./profiles.js');
+    const { LEGACY_KEYCHAIN_ACCOUNT, keychainAccount } = await import('./profile-name.js');
+    const { loadCredentialBlob } = await import('./credentials-store.js');
+    const idx = await readProfileIndex();
+    const uniqueNames = [
+        ...new Set([DEFAULT_PROFILE, ...idx.profiles.map((p) => p.name)].map((n) => n.toLowerCase())),
+    ];
+    // Verify the dedicated keychain actually holds each profile's creds before
+    // deleting the login originals — never strand the user with no copy.
+    const verified = [];
+    for (const name of uniqueNames) {
+        const { blob } = await loadCredentialBlob(name);
+        if (blob)
+            verified.push(name);
+    }
+    if (verified.length === 0) {
+        console.error('The dedicated keychain holds no credentials — refusing to delete the login copies.');
+        process.exit(1);
+    }
+    console.log(`Verified ${verified.length} credential set(s) in the dedicated keychain: ${verified.join(', ')}`);
+    const confirmed = await localConfirm('Delete the login-keychain copies now? This cannot be undone.', opts.yes);
+    if (!confirmed) {
+        console.log('Aborted. Login-keychain copies left in place.');
+        return;
+    }
+    // Accounts init may have written to the login keychain: the legacy
+    // "default" account plus profile:<name> for every known profile.
+    const accounts = new Set([LEGACY_KEYCHAIN_ACCOUNT]);
+    for (const name of uniqueNames)
+        accounts.add(keychainAccount(name));
+    let deleted = 0;
+    for (const account of accounts) {
+        if (kt.deleteLoginSecret(account))
+            deleted++;
+    }
+    console.log(`Deleted ${deleted} login-keychain entr${deleted === 1 ? 'y' : 'ies'}.`);
+    console.log('Credentials now live only in the YubiKey-locked keychain.');
+});
 // --- serve (default command) ---
 program
     .command('serve', { isDefault: true })
     .description('Start the MCP server (stdio transport)')
     .action(async () => {
     const { startMcpServer } = await import('./index.js');
-    await startMcpServer();
+    await startMcpServer({ profile: resolvedProfileInfo.name });
 });
 // --- invoices ---
 const invoices = program.command('invoices').description('Invoice operations');
@@ -419,6 +1013,7 @@ invoices
     .option('--customer <number>', 'Filter by customer number')
     .option('--from <date>', 'From date (YYYY-MM-DD)')
     .option('--to <date>', 'To date (YYYY-MM-DD)')
+    .option('--period <period>', 'Natural period (calendar-year): Q1, 2025-Q3, march/mars, this-quarter, last-quarter, this-month, last-month, ytd, this-year, last-year, or a bare year. Mutually exclusive with --from/--to.')
     .option('--page <number>', 'Page number', parseInt)
     .option('--limit <number>', 'Results per page', parseInt)
     .option('-a, --all', 'Fetch all pages')
@@ -427,8 +1022,7 @@ invoices
     const data = await listInvoices({
         filter: opts.filter,
         customerNumber: opts.customer,
-        fromDate: opts.from,
-        toDate: opts.to,
+        ...fromToParams(opts),
         page: opts.page,
         limit: opts.limit,
         all: opts.all,
@@ -442,7 +1036,7 @@ invoices
     .action(async (documentNumber) => {
     const { getInvoice } = await import('./operations/invoices.js');
     const data = await getInvoice(documentNumber);
-    outputDetail(data, invoiceDetailColumns, json());
+    outputDetail(data, invoiceDetailColumns, json(), 'Invoice');
 });
 invoices
     .command('create')
@@ -468,7 +1062,7 @@ Examples:
         return;
     }
     const data = await createInvoice(params);
-    outputDetail(data, invoiceDetailColumns, json());
+    outputDetail(data, invoiceDetailColumns, json(), 'Invoice');
 });
 invoices
     .command('update <documentNumber>')
@@ -488,7 +1082,7 @@ Examples:
         return;
     }
     const data = await updateInvoice(documentNumber, fields);
-    outputDetail(data, invoiceDetailColumns, json());
+    outputDetail(data, invoiceDetailColumns, json(), 'Invoice');
 });
 invoices
     .command('send <documentNumber>')
@@ -510,7 +1104,7 @@ invoices
         ? { subject: opts.subject, body: opts.body, bcc: opts.bcc }
         : undefined;
     const data = await sendInvoice(documentNumber, opts.method, emailOptions);
-    outputConfirmation(`Invoice ${documentNumber} sent via ${opts.method}.`, json(), data, invoiceConfirmColumns);
+    outputConfirmation(`Invoice ${documentNumber} sent via ${opts.method}.`, json(), data, invoiceConfirmColumns, 'Invoice');
 });
 invoices
     .command('bookkeep <documentNumber>')
@@ -523,7 +1117,7 @@ invoices
         return;
     }
     const data = await bookkeepInvoice(documentNumber);
-    outputConfirmation(`Invoice ${documentNumber} bookkeept.`, json(), data, invoiceConfirmColumns);
+    outputConfirmation(`Invoice ${documentNumber} bookkeept.`, json(), data, invoiceConfirmColumns, 'Invoice');
 });
 invoices
     .command('credit <documentNumber>')
@@ -536,21 +1130,26 @@ invoices
         return;
     }
     const data = await creditInvoice(documentNumber);
-    outputConfirmation(`Invoice ${documentNumber} credited.`, json(), data, invoiceConfirmColumns);
+    outputConfirmation(`Invoice ${documentNumber} credited.`, json(), data, invoiceConfirmColumns, 'Invoice');
 });
 // --- tax ---
 const tax = program.command('tax').description('Tax operations');
 tax
     .command('report')
     .description('Generate VAT tax report for a period')
-    .requiredOption('--from <date>', 'From date (YYYY-MM-DD)')
-    .requiredOption('--to <date>', 'To date (YYYY-MM-DD)')
+    .option('--from <date>', 'From date (YYYY-MM-DD)')
+    .option('--to <date>', 'To date (YYYY-MM-DD)')
+    .option('--period <period>', 'Natural period (calendar-year): Q1, 2025-Q3, march/mars, this-quarter, last-quarter, this-month, last-month, ytd, this-year, last-year, or a bare year. Mutually exclusive with --from/--to.')
     .option('--year <number>', 'Financial year', parseInt)
     .action(async (opts) => {
     const { generateTaxReport } = await import('./operations/tax.js');
+    const range = fromToParams(opts);
+    if (!range.fromDate || !range.toDate) {
+        fail('tax report requires a period: --from/--to or --period.', 2);
+    }
     const data = await generateTaxReport({
-        fromDate: opts.from,
-        toDate: opts.to,
+        fromDate: range.fromDate,
+        toDate: range.toDate,
         financialYear: opts.year,
     });
     if (json()) {
@@ -571,12 +1170,12 @@ reports
     .option('--year <number>', 'Financial year', parseInt)
     .option('--from <date>', 'From date (YYYY-MM-DD)')
     .option('--to <date>', 'To date (YYYY-MM-DD)')
+    .option('--period <period>', 'Natural period (calendar-year): Q1, 2025-Q3, march/mars, this-quarter, last-quarter, this-month, last-month, ytd, this-year, last-year, or a bare year. Mutually exclusive with --from/--to.')
     .action(async (opts) => {
     const { getIncomeStatement } = await import('./operations/financial-reports.js');
     const data = await getIncomeStatement({
         financialYear: opts.year,
-        fromDate: opts.from,
-        toDate: opts.to,
+        ...fromToParams(opts),
     });
     if (json()) {
         console.log(JSON.stringify(data, null, 2));
@@ -648,7 +1247,7 @@ customers
     .action(async (customerNumber) => {
     const { getCustomer } = await import('./operations/customers.js');
     const data = await getCustomer(customerNumber);
-    outputDetail(data, customerDetailColumns, json());
+    outputDetail(data, customerDetailColumns, json(), 'Customer');
 });
 customers
     .command('create')
@@ -673,7 +1272,7 @@ Examples:
         return;
     }
     const data = await createCustomer(params);
-    outputDetail(data, customerDetailColumns, json());
+    outputDetail(data, customerDetailColumns, json(), 'Customer');
 });
 customers
     .command('update <customerNumber>')
@@ -692,7 +1291,7 @@ Examples:
         return;
     }
     const data = await updateCustomer(customerNumber, fields);
-    outputDetail(data, customerDetailColumns, json());
+    outputDetail(data, customerDetailColumns, json(), 'Customer');
 });
 // --- articles ---
 const articles = program.command('articles').description('Article operations');
@@ -720,7 +1319,7 @@ articles
     .action(async (articleNumber) => {
     const { getArticle } = await import('./operations/articles.js');
     const data = await getArticle(articleNumber);
-    outputDetail(data, articleDetailColumns, json());
+    outputDetail(data, articleDetailColumns, json(), 'Article');
 });
 articles
     .command('create')
@@ -748,7 +1347,7 @@ Examples:
         return;
     }
     const data = await createArticle(params);
-    outputDetail(data, articleDetailColumns, json());
+    outputDetail(data, articleDetailColumns, json(), 'Article');
 });
 articles
     .command('update <articleNumber>')
@@ -767,7 +1366,7 @@ Examples:
         return;
     }
     const data = await updateArticle(articleNumber, fields);
-    outputDetail(data, articleDetailColumns, json());
+    outputDetail(data, articleDetailColumns, json(), 'Article');
 });
 // --- suppliers ---
 const suppliers = program.command('suppliers').description('Supplier operations');
@@ -795,7 +1394,7 @@ suppliers
     .action(async (supplierNumber) => {
     const { getSupplier } = await import('./operations/suppliers.js');
     const data = await getSupplier(supplierNumber);
-    outputDetail(data, supplierDetailColumns, json());
+    outputDetail(data, supplierDetailColumns, json(), 'Supplier');
 });
 suppliers
     .command('create')
@@ -820,7 +1419,7 @@ Examples:
         return;
     }
     const data = await createSupplier(params);
-    outputDetail(data, supplierDetailColumns, json());
+    outputDetail(data, supplierDetailColumns, json(), 'Supplier');
 });
 suppliers
     .command('update <supplierNumber>')
@@ -839,7 +1438,7 @@ Examples:
         return;
     }
     const data = await updateSupplier(supplierNumber, fields);
-    outputDetail(data, supplierDetailColumns, json());
+    outputDetail(data, supplierDetailColumns, json(), 'Supplier');
 });
 // --- supplier-invoices ---
 const supplierInvoices = program
@@ -853,6 +1452,7 @@ supplierInvoices
     .option('--supplier <number>', 'Filter by supplier number')
     .option('--from <date>', 'From date (YYYY-MM-DD)')
     .option('--to <date>', 'To date (YYYY-MM-DD)')
+    .option('--period <period>', 'Natural period (calendar-year): Q1, 2025-Q3, march/mars, this-quarter, last-quarter, this-month, last-month, ytd, this-year, last-year, or a bare year. Mutually exclusive with --from/--to.')
     .option('--page <number>', 'Page number', parseInt)
     .option('--limit <number>', 'Results per page', parseInt)
     .option('-a, --all', 'Fetch all pages')
@@ -861,8 +1461,7 @@ supplierInvoices
     const data = await listSupplierInvoices({
         filter: opts.filter,
         supplierNumber: opts.supplier,
-        fromDate: opts.from,
-        toDate: opts.to,
+        ...fromToParams(opts),
         page: opts.page,
         limit: opts.limit,
         all: opts.all,
@@ -876,7 +1475,7 @@ supplierInvoices
     .action(async (givenNumber) => {
     const { getSupplierInvoice } = await import('./operations/supplier-invoices.js');
     const data = await getSupplierInvoice(givenNumber);
-    outputDetail(data, supplierInvoiceDetailColumns, json());
+    outputDetail(data, supplierInvoiceDetailColumns, json(), 'SupplierInvoice');
 });
 supplierInvoices
     .command('create')
@@ -899,7 +1498,7 @@ Examples:
         return;
     }
     const data = await createSupplierInvoice(params);
-    outputDetail(data, supplierInvoiceDetailColumns, json());
+    outputDetail(data, supplierInvoiceDetailColumns, json(), 'SupplierInvoice');
 });
 supplierInvoices
     .command('bookkeep <givenNumber>')
@@ -912,7 +1511,7 @@ supplierInvoices
         return;
     }
     const data = await bookkeepSupplierInvoice(givenNumber);
-    outputConfirmation(`Supplier invoice ${givenNumber} bookkeept.`, json(), data, supplierInvoiceConfirmColumns);
+    outputConfirmation(`Supplier invoice ${givenNumber} bookkeept.`, json(), data, supplierInvoiceConfirmColumns, 'SupplierInvoice');
 });
 // --- company ---
 const company = program.command('company').description('Company operations');
@@ -922,7 +1521,7 @@ company
     .action(async () => {
     const { getCompanyInfo } = await import('./operations/company.js');
     const data = await getCompanyInfo();
-    outputDetail(data, companyDetailColumns, json());
+    outputDetail(data, companyDetailColumns, json(), 'CompanyInformation');
 });
 // --- vouchers ---
 const vouchers = program.command('vouchers').description('Voucher operations');
@@ -932,6 +1531,7 @@ vouchers
     .option('--series <series>', 'Voucher series (e.g. "A")')
     .option('--from <date>', 'From date (YYYY-MM-DD)')
     .option('--to <date>', 'To date (YYYY-MM-DD)')
+    .option('--period <period>', 'Natural period (calendar-year): Q1, 2025-Q3, march/mars, this-quarter, last-quarter, this-month, last-month, ytd, this-year, last-year, or a bare year. Mutually exclusive with --from/--to.')
     .option('--year <number>', 'Financial year', parseInt)
     .option('--page <number>', 'Page number', parseInt)
     .option('--limit <number>', 'Results per page', parseInt)
@@ -940,8 +1540,7 @@ vouchers
     const { listVouchers } = await import('./operations/vouchers.js');
     const data = await listVouchers({
         series: opts.series,
-        fromDate: opts.from,
-        toDate: opts.to,
+        ...fromToParams(opts),
         financialYear: opts.year,
         page: opts.page,
         limit: opts.limit,
@@ -958,7 +1557,7 @@ vouchers
     const { getVoucher } = await import('./operations/vouchers.js');
     const data = await getVoucher(series, voucherNumber, opts.year);
     if (json()) {
-        console.log(JSON.stringify(data, null, 2));
+        console.log(JSON.stringify({ Voucher: data }, null, 2));
     }
     else {
         outputDetail(data, voucherDetailColumns, false);
@@ -988,25 +1587,996 @@ Examples:
         return;
     }
     const data = await createVoucher(params);
-    outputDetail(data, voucherDetailColumns, json());
+    outputDetail(data, voucherDetailColumns, json(), 'Voucher');
 });
-// Error handling
-program.exitOverride();
-try {
-    await program.parseAsync(process.argv);
-}
-catch (err) {
-    if (err instanceof Error && 'code' in err) {
-        const code = err.code;
-        // Commander throws for --help and --version with exitCode 0
-        if (code === 'commander.helpDisplayed' || code === 'commander.version') {
-            process.exit(0);
-        }
-        if (code === 'commander.unknownCommand' || code === 'commander.missingMandatoryOptionValue') {
-            process.exit(1);
-        }
+vouchers
+    .command('attach <series> <number> <files...>')
+    .description('Upload receipt/underlag files and link them to a voucher')
+    .option('--year <number>', 'Financial year (resolved from the voucher date if omitted)', parseInt)
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview without uploading')
+    .addHelpText('after', `
+Examples:
+  noxctl vouchers attach A 60 receipt.pdf
+  noxctl vouchers attach A 61 ica.pdf lunch.jpg --year 4`)
+    .action(async (series, voucherNumber, files, opts) => {
+    const { attachVoucherFiles } = await import('./operations/vouchers.js');
+    if (!(await confirmMutation(`Attach ${files.length} file(s) to voucher ${series}/${voucherNumber}`, opts, { files, year: opts.year }))) {
+        return;
+    }
+    const results = await attachVoucherFiles({
+        series,
+        voucherNumber,
+        filePaths: files,
+        financialYear: opts.year,
+    });
+    if (json()) {
+        console.log(JSON.stringify({ Attachments: results }, null, 2));
+    }
+    else {
+        outputList(results, voucherAttachmentColumns, false, results);
+    }
+});
+// --- invoice-payments ---
+const invoicePayments = program
+    .command('invoice-payments')
+    .alias('ip')
+    .description('Invoice payment operations (inbetalningar)');
+invoicePayments
+    .command('list')
+    .description('List invoice payments')
+    .option('--invoice <number>', 'Filter by invoice number')
+    .option('--page <number>', 'Page number', parseInt)
+    .option('--limit <number>', 'Results per page', parseInt)
+    .option('-a, --all', 'Fetch all pages')
+    .action(async (opts) => {
+    const { listInvoicePayments } = await import('./operations/invoice-payments.js');
+    const data = await listInvoicePayments({
+        invoiceNumber: opts.invoice,
+        page: opts.page,
+        limit: opts.limit,
+        all: opts.all,
+    });
+    const envelope = data;
+    outputList(envelope.InvoicePayments ?? [], invoicePaymentListColumns, json(), data, envelope.MetaInformation);
+});
+invoicePayments
+    .command('get <paymentNumber>')
+    .description('Get a single invoice payment')
+    .action(async (paymentNumber) => {
+    const { getInvoicePayment } = await import('./operations/invoice-payments.js');
+    const data = await getInvoicePayment(paymentNumber);
+    outputDetail(data, invoicePaymentDetailColumns, json(), 'InvoicePayment');
+});
+invoicePayments
+    .command('create')
+    .description('Register a payment against an invoice')
+    .requiredOption('--invoice <number>', 'Invoice number')
+    .requiredOption('--amount <amount>', 'Payment amount', parseFloat)
+    .requiredOption('--date <date>', 'Payment date (YYYY-MM-DD)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .addHelpText('after', `
+Examples:
+  noxctl invoice-payments create --invoice 1001 --amount 5000 --date 2026-03-20 --dry-run
+  noxctl ip create --invoice 1001 --amount 5000 --date 2026-03-20 --yes`)
+    .action(async (opts) => {
+    const { createInvoicePayment } = await import('./operations/invoice-payments.js');
+    const params = {
+        InvoiceNumber: parseInt(opts.invoice, 10),
+        Amount: opts.amount,
+        PaymentDate: opts.date,
+    };
+    if (!(await confirmMutation(`Register payment of ${opts.amount} for invoice ${opts.invoice}`, opts, {
+        InvoicePayment: params,
+    }))) {
+        return;
+    }
+    const data = await createInvoicePayment(params);
+    outputDetail(data, invoicePaymentDetailColumns, json(), 'InvoicePayment');
+});
+invoicePayments
+    .command('delete <paymentNumber>')
+    .description('Delete an invoice payment')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the action without sending it')
+    .action(async (paymentNumber, opts) => {
+    const { deleteInvoicePayment } = await import('./operations/invoice-payments.js');
+    if (!(await confirmMutation(`Delete invoice payment ${paymentNumber}`, opts))) {
+        return;
+    }
+    await deleteInvoicePayment(paymentNumber);
+    outputConfirmation(`Invoice payment ${paymentNumber} deleted.`, json(), { Number: paymentNumber, deleted: true }, undefined, 'InvoicePayment');
+});
+invoicePayments
+    .command('bookkeep <paymentNumber>')
+    .description('Bookkeep an invoice payment')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the action without sending it')
+    .action(async (paymentNumber, opts) => {
+    const { bookkeepInvoicePayment } = await import('./operations/invoice-payments.js');
+    if (!(await confirmMutation(`Bookkeep invoice payment ${paymentNumber}`, opts))) {
+        return;
+    }
+    const result = await bookkeepInvoicePayment(paymentNumber);
+    outputConfirmation(`Invoice payment ${paymentNumber} bookkeept.`, json(), result, undefined, 'InvoicePayment');
+});
+// --- supplier-invoice-payments ---
+const supplierInvoicePayments = program
+    .command('supplier-invoice-payments')
+    .alias('sip')
+    .description('Supplier invoice payment operations (utbetalningar)');
+supplierInvoicePayments
+    .command('list')
+    .description('List supplier invoice payments')
+    .option('--invoice <number>', 'Filter by invoice number')
+    .option('--page <number>', 'Page number', parseInt)
+    .option('--limit <number>', 'Results per page', parseInt)
+    .option('-a, --all', 'Fetch all pages')
+    .action(async (opts) => {
+    const { listSupplierInvoicePayments } = await import('./operations/supplier-invoice-payments.js');
+    const data = await listSupplierInvoicePayments({
+        invoiceNumber: opts.invoice,
+        page: opts.page,
+        limit: opts.limit,
+        all: opts.all,
+    });
+    const envelope = data;
+    outputList(envelope.SupplierInvoicePayments ?? [], supplierInvoicePaymentListColumns, json(), data, envelope.MetaInformation);
+});
+supplierInvoicePayments
+    .command('get <paymentNumber>')
+    .description('Get a single supplier invoice payment')
+    .action(async (paymentNumber) => {
+    const { getSupplierInvoicePayment } = await import('./operations/supplier-invoice-payments.js');
+    const data = await getSupplierInvoicePayment(paymentNumber);
+    outputDetail(data, supplierInvoicePaymentDetailColumns, json(), 'SupplierInvoicePayment');
+});
+supplierInvoicePayments
+    .command('create')
+    .description('Register a payment against a supplier invoice')
+    .requiredOption('--invoice <number>', 'Supplier invoice number')
+    .requiredOption('--amount <amount>', 'Payment amount', parseFloat)
+    .requiredOption('--date <date>', 'Payment date (YYYY-MM-DD)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .addHelpText('after', `
+Examples:
+  noxctl supplier-invoice-payments create --invoice 501 --amount 3000 --date 2026-03-20 --dry-run
+  noxctl sip create --invoice 501 --amount 3000 --date 2026-03-20 --yes`)
+    .action(async (opts) => {
+    const { createSupplierInvoicePayment } = await import('./operations/supplier-invoice-payments.js');
+    const params = {
+        InvoiceNumber: opts.invoice,
+        Amount: opts.amount,
+        PaymentDate: opts.date,
+    };
+    if (!(await confirmMutation(`Register payment of ${opts.amount} for supplier invoice ${opts.invoice}`, opts, { SupplierInvoicePayment: params }))) {
+        return;
+    }
+    const data = await createSupplierInvoicePayment(params);
+    outputDetail(data, supplierInvoicePaymentDetailColumns, json(), 'SupplierInvoicePayment');
+});
+supplierInvoicePayments
+    .command('delete <paymentNumber>')
+    .description('Delete a supplier invoice payment')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the action without sending it')
+    .action(async (paymentNumber, opts) => {
+    const { deleteSupplierInvoicePayment } = await import('./operations/supplier-invoice-payments.js');
+    if (!(await confirmMutation(`Delete supplier invoice payment ${paymentNumber}`, opts))) {
+        return;
+    }
+    await deleteSupplierInvoicePayment(paymentNumber);
+    outputConfirmation(`Supplier invoice payment ${paymentNumber} deleted.`, json(), { Number: paymentNumber, deleted: true }, undefined, 'SupplierInvoicePayment');
+});
+// --- offers ---
+const offers = program.command('offers').description('Offer/quote operations (offerter)');
+offers
+    .command('list')
+    .description('List/filter offers')
+    .option('--filter <filter>', 'Filter: cancelled, expired, ordercreated, invoicecreated')
+    .option('--customer <number>', 'Filter by customer number')
+    .option('--from <date>', 'From date (YYYY-MM-DD)')
+    .option('--to <date>', 'To date (YYYY-MM-DD)')
+    .option('--period <period>', 'Natural period (calendar-year): Q1, 2025-Q3, march/mars, this-quarter, last-quarter, this-month, last-month, ytd, this-year, last-year, or a bare year. Mutually exclusive with --from/--to.')
+    .option('--page <number>', 'Page number', parseInt)
+    .option('--limit <number>', 'Results per page', parseInt)
+    .option('-a, --all', 'Fetch all pages')
+    .action(async (opts) => {
+    const { listOffers } = await import('./operations/offers.js');
+    const data = await listOffers({
+        filter: opts.filter,
+        customerNumber: opts.customer,
+        ...fromToParams(opts),
+        page: opts.page,
+        limit: opts.limit,
+        all: opts.all,
+    });
+    const envelope = data;
+    outputList(envelope.Offers ?? [], offerListColumns, json(), data, envelope.MetaInformation);
+});
+offers
+    .command('get <documentNumber>')
+    .description('Get a single offer')
+    .action(async (documentNumber) => {
+    const { getOffer } = await import('./operations/offers.js');
+    const data = await getOffer(documentNumber);
+    outputDetail(data, offerDetailColumns, json(), 'Offer');
+});
+offers
+    .command('create')
+    .description('Create an offer')
+    .requiredOption('--customer <number>', 'Customer number')
+    .requiredOption('--input <file>', 'Offer data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .addHelpText('after', `
+Examples:
+  echo '{"OfferRows":[{"Description":"Consulting","DeliveredQuantity":10,"Price":1200}]}' | noxctl offers create --customer 25 --input - --dry-run`)
+    .action(async (opts) => {
+    const { createOffer } = await import('./operations/offers.js');
+    const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+    const input = JSON.parse(raw);
+    const params = { CustomerNumber: opts.customer, ...input };
+    if (!(await confirmMutation(`Create offer for customer ${opts.customer}`, opts, {
+        Offer: params,
+    }))) {
+        return;
+    }
+    const data = await createOffer(params);
+    outputDetail(data, offerDetailColumns, json(), 'Offer');
+});
+offers
+    .command('update <documentNumber>')
+    .description('Update an offer')
+    .requiredOption('--input <file>', 'Offer data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .action(async (documentNumber, opts) => {
+    const { updateOffer } = await import('./operations/offers.js');
+    const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+    const fields = JSON.parse(raw);
+    if (!(await confirmMutation(`Update offer ${documentNumber}`, opts, { Offer: fields }))) {
+        return;
+    }
+    const data = await updateOffer(documentNumber, fields);
+    outputDetail(data, offerDetailColumns, json(), 'Offer');
+});
+offers
+    .command('create-invoice <documentNumber>')
+    .description('Create an invoice from an offer')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the action without sending it')
+    .action(async (documentNumber, opts) => {
+    const { createInvoiceFromOffer } = await import('./operations/offers.js');
+    if (!(await confirmMutation(`Create invoice from offer ${documentNumber}`, opts))) {
+        return;
+    }
+    const data = await createInvoiceFromOffer(documentNumber);
+    outputConfirmation(`Invoice created from offer ${documentNumber}.`, json(), data, invoiceConfirmColumns, 'Invoice');
+});
+offers
+    .command('create-order <documentNumber>')
+    .description('Create an order from an offer')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the action without sending it')
+    .action(async (documentNumber, opts) => {
+    const { createOrderFromOffer } = await import('./operations/offers.js');
+    if (!(await confirmMutation(`Create order from offer ${documentNumber}`, opts))) {
+        return;
+    }
+    const data = await createOrderFromOffer(documentNumber);
+    outputConfirmation(`Order created from offer ${documentNumber}.`, json(), data, undefined, 'Order');
+});
+// --- orders ---
+const orders = program.command('orders').description('Order operations (ordrar)');
+orders
+    .command('list')
+    .description('List/filter orders')
+    .option('--filter <filter>', 'Filter: cancelled, invoicecreated, invoicenotcreated')
+    .option('--customer <number>', 'Filter by customer number')
+    .option('--from <date>', 'From date (YYYY-MM-DD)')
+    .option('--to <date>', 'To date (YYYY-MM-DD)')
+    .option('--period <period>', 'Natural period (calendar-year): Q1, 2025-Q3, march/mars, this-quarter, last-quarter, this-month, last-month, ytd, this-year, last-year, or a bare year. Mutually exclusive with --from/--to.')
+    .option('--page <number>', 'Page number', parseInt)
+    .option('--limit <number>', 'Results per page', parseInt)
+    .option('-a, --all', 'Fetch all pages')
+    .action(async (opts) => {
+    const { listOrders } = await import('./operations/orders.js');
+    const data = await listOrders({
+        filter: opts.filter,
+        customerNumber: opts.customer,
+        ...fromToParams(opts),
+        page: opts.page,
+        limit: opts.limit,
+        all: opts.all,
+    });
+    const envelope = data;
+    outputList(envelope.Orders ?? [], orderListColumns, json(), data, envelope.MetaInformation);
+});
+orders
+    .command('get <documentNumber>')
+    .description('Get a single order')
+    .action(async (documentNumber) => {
+    const { getOrder } = await import('./operations/orders.js');
+    const data = await getOrder(documentNumber);
+    outputDetail(data, orderDetailColumns, json(), 'Order');
+});
+orders
+    .command('create')
+    .description('Create an order')
+    .requiredOption('--customer <number>', 'Customer number')
+    .requiredOption('--input <file>', 'Order data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .addHelpText('after', `
+Examples:
+  echo '{"OrderRows":[{"Description":"Consulting","DeliveredQuantity":10,"Price":1200}]}' | noxctl orders create --customer 25 --input - --dry-run`)
+    .action(async (opts) => {
+    const { createOrder } = await import('./operations/orders.js');
+    const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+    const input = JSON.parse(raw);
+    const params = { CustomerNumber: opts.customer, ...input };
+    if (!(await confirmMutation(`Create order for customer ${opts.customer}`, opts, {
+        Order: params,
+    }))) {
+        return;
+    }
+    const data = await createOrder(params);
+    outputDetail(data, orderDetailColumns, json(), 'Order');
+});
+orders
+    .command('update <documentNumber>')
+    .description('Update an order')
+    .requiredOption('--input <file>', 'Order data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .action(async (documentNumber, opts) => {
+    const { updateOrder } = await import('./operations/orders.js');
+    const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+    const fields = JSON.parse(raw);
+    if (!(await confirmMutation(`Update order ${documentNumber}`, opts, { Order: fields }))) {
+        return;
+    }
+    const data = await updateOrder(documentNumber, fields);
+    outputDetail(data, orderDetailColumns, json(), 'Order');
+});
+orders
+    .command('create-invoice <documentNumber>')
+    .description('Create an invoice from an order')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the action without sending it')
+    .action(async (documentNumber, opts) => {
+    const { createInvoiceFromOrder } = await import('./operations/orders.js');
+    if (!(await confirmMutation(`Create invoice from order ${documentNumber}`, opts))) {
+        return;
+    }
+    const data = await createInvoiceFromOrder(documentNumber);
+    outputConfirmation(`Invoice created from order ${documentNumber}.`, json(), data, invoiceConfirmColumns, 'Invoice');
+});
+// --- projects ---
+const projects = program.command('projects').description('Project operations');
+projects
+    .command('list')
+    .description('List projects')
+    .option('--page <number>', 'Page number', parseInt)
+    .option('--limit <number>', 'Results per page', parseInt)
+    .option('-a, --all', 'Fetch all pages')
+    .action(async (opts) => {
+    const { listProjects } = await import('./operations/projects.js');
+    const data = await listProjects({
+        page: opts.page,
+        limit: opts.limit,
+        all: opts.all,
+    });
+    const envelope = data;
+    outputList(envelope.Projects ?? [], projectListColumns, json(), data, envelope.MetaInformation);
+});
+projects
+    .command('get <projectNumber>')
+    .description('Get a single project')
+    .action(async (projectNumber) => {
+    const { getProject } = await import('./operations/projects.js');
+    const data = await getProject(projectNumber);
+    outputDetail(data, projectDetailColumns, json(), 'Project');
+});
+projects
+    .command('create')
+    .description('Create a project')
+    .requiredOption('--description <text>', 'Project description')
+    .option('--project-number <number>', 'Project number (auto-generated if omitted)')
+    .option('--status <status>', 'Status (ONGOING or COMPLETED)')
+    .option('--input <file>', 'Project data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .action(async (opts) => {
+    const { createProject } = await import('./operations/projects.js');
+    let input = {};
+    if (opts.input) {
+        const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+        input = JSON.parse(raw);
+    }
+    const params = { ...input, Description: opts.description };
+    if (opts.projectNumber)
+        params.ProjectNumber = opts.projectNumber;
+    if (opts.status)
+        params.Status = opts.status;
+    if (!(await confirmMutation(`Create project "${opts.description}"`, opts, { Project: params }))) {
+        return;
+    }
+    const data = await createProject(params);
+    outputDetail(data, projectDetailColumns, json(), 'Project');
+});
+projects
+    .command('update <projectNumber>')
+    .description('Update a project')
+    .requiredOption('--input <file>', 'Project data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .action(async (projectNumber, opts) => {
+    const { updateProject } = await import('./operations/projects.js');
+    const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+    const fields = JSON.parse(raw);
+    if (!(await confirmMutation(`Update project ${projectNumber}`, opts, { Project: fields }))) {
+        return;
+    }
+    const data = await updateProject(projectNumber, fields);
+    outputDetail(data, projectDetailColumns, json(), 'Project');
+});
+// --- cost centers ---
+const costcenters = program.command('costcenters').description('Cost center operations');
+costcenters
+    .command('list')
+    .description('List cost centers')
+    .option('--page <number>', 'Page number', parseInt)
+    .option('--limit <number>', 'Results per page', parseInt)
+    .option('-a, --all', 'Fetch all pages')
+    .action(async (opts) => {
+    const { listCostCenters } = await import('./operations/costcenters.js');
+    const data = await listCostCenters({
+        page: opts.page,
+        limit: opts.limit,
+        all: opts.all,
+    });
+    const envelope = data;
+    outputList(envelope.CostCenters ?? [], costCenterListColumns, json(), data, envelope.MetaInformation);
+});
+costcenters
+    .command('get <code>')
+    .description('Get a single cost center')
+    .action(async (code) => {
+    const { getCostCenter } = await import('./operations/costcenters.js');
+    const data = await getCostCenter(code);
+    outputDetail(data, costCenterDetailColumns, json(), 'CostCenter');
+});
+costcenters
+    .command('create')
+    .description('Create a cost center')
+    .requiredOption('--code <code>', 'Cost center code')
+    .requiredOption('--description <text>', 'Description')
+    .option('--input <file>', 'Cost center data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .action(async (opts) => {
+    const { createCostCenter } = await import('./operations/costcenters.js');
+    let input = {};
+    if (opts.input) {
+        const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+        input = JSON.parse(raw);
+    }
+    const params = {
+        ...input,
+        Code: opts.code,
+        Description: opts.description,
+    };
+    if (!(await confirmMutation(`Create cost center "${opts.code}"`, opts, { CostCenter: params }))) {
+        return;
+    }
+    const data = await createCostCenter(params);
+    outputDetail(data, costCenterDetailColumns, json(), 'CostCenter');
+});
+costcenters
+    .command('update <code>')
+    .description('Update a cost center')
+    .requiredOption('--input <file>', 'Cost center data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .action(async (code, opts) => {
+    const { updateCostCenter } = await import('./operations/costcenters.js');
+    const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+    const fields = JSON.parse(raw);
+    if (!(await confirmMutation(`Update cost center ${code}`, opts, { CostCenter: fields }))) {
+        return;
+    }
+    const data = await updateCostCenter(code, fields);
+    outputDetail(data, costCenterDetailColumns, json(), 'CostCenter');
+});
+costcenters
+    .command('delete <code>')
+    .description('Delete a cost center')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .action(async (code, opts) => {
+    const { deleteCostCenter } = await import('./operations/costcenters.js');
+    if (!(await confirmMutation(`Delete cost center ${code}`, opts))) {
+        return;
+    }
+    await deleteCostCenter(code);
+    outputConfirmation(`Cost center ${code} deleted.`, json(), { Code: code, deleted: true }, undefined, 'CostCenter');
+});
+// --- tax reductions (ROT/RUT) ---
+const taxreductions = program
+    .command('tax-reductions')
+    .description('Tax reduction (ROT/RUT) operations');
+taxreductions
+    .command('list')
+    .description('List tax reductions')
+    .option('--filter <type>', 'Filter by document type (invoices, offers, orders)')
+    .option('--page <number>', 'Page number', parseInt)
+    .option('--limit <number>', 'Results per page', parseInt)
+    .option('-a, --all', 'Fetch all pages')
+    .action(async (opts) => {
+    const { listTaxReductions } = await import('./operations/taxreductions.js');
+    const data = await listTaxReductions({
+        filter: opts.filter,
+        page: opts.page,
+        limit: opts.limit,
+        all: opts.all,
+    });
+    const envelope = data;
+    outputList(envelope.TaxReductions ?? [], taxReductionListColumns, json(), data, envelope.MetaInformation);
+});
+taxreductions
+    .command('get <id>')
+    .description('Get a single tax reduction')
+    .action(async (id) => {
+    const { getTaxReduction } = await import('./operations/taxreductions.js');
+    const data = await getTaxReduction(parseInt(id, 10));
+    outputDetail(data, taxReductionDetailColumns, json(), 'TaxReduction');
+});
+taxreductions
+    .command('create')
+    .description('Create a tax reduction (ROT/RUT)')
+    .requiredOption('--reference <number>', 'Reference number (e.g. invoice number)')
+    .requiredOption('--type <type>', 'Type of reduction (rot or rut)')
+    .requiredOption('--document-type <type>', 'Document type (INVOICE, OFFER, ORDER)')
+    .requiredOption('--customer-name <name>', 'Customer name')
+    .requiredOption('--amount <amount>', 'Asked amount in öre', parseInt)
+    .option('--property <designation>', 'Property designation (required for ROT)')
+    .option('--input <file>', 'Tax reduction data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .action(async (opts) => {
+    const { createTaxReduction } = await import('./operations/taxreductions.js');
+    let input = {};
+    if (opts.input) {
+        const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+        input = JSON.parse(raw);
+    }
+    const params = {
+        ...input,
+        ReferenceNumber: opts.reference,
+        ReferenceDocumentType: opts.documentType,
+        TypeOfReduction: opts.type,
+        CustomerName: opts.customerName,
+        AskedAmount: opts.amount,
+    };
+    if (opts.property)
+        params.PropertyDesignation = opts.property;
+    if (!(await confirmMutation(`Create ${opts.type.toUpperCase()} tax reduction for ref ${opts.reference}`, opts, { TaxReduction: params }))) {
+        return;
+    }
+    const data = await createTaxReduction(params);
+    outputDetail(data, taxReductionDetailColumns, json(), 'TaxReduction');
+});
+// --- price lists ---
+const pricelists = program.command('pricelists').description('Price list operations');
+pricelists
+    .command('list')
+    .description('List price lists')
+    .option('--page <number>', 'Page number', parseInt)
+    .option('--limit <number>', 'Results per page', parseInt)
+    .option('-a, --all', 'Fetch all pages')
+    .action(async (opts) => {
+    const { listPriceLists } = await import('./operations/pricelists.js');
+    const data = await listPriceLists({
+        page: opts.page,
+        limit: opts.limit,
+        all: opts.all,
+    });
+    const envelope = data;
+    outputList(envelope.PriceLists ?? [], priceListListColumns, json(), data, envelope.MetaInformation);
+});
+pricelists
+    .command('get <code>')
+    .description('Get a single price list')
+    .action(async (code) => {
+    const { getPriceList } = await import('./operations/pricelists.js');
+    const data = await getPriceList(code);
+    outputDetail(data, priceListDetailColumns, json(), 'PriceList');
+});
+pricelists
+    .command('create')
+    .description('Create a price list')
+    .requiredOption('--code <code>', 'Price list code')
+    .requiredOption('--description <text>', 'Description')
+    .option('--input <file>', 'Price list data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .action(async (opts) => {
+    const { createPriceList } = await import('./operations/pricelists.js');
+    let input = {};
+    if (opts.input) {
+        const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+        input = JSON.parse(raw);
+    }
+    const params = {
+        ...input,
+        Code: opts.code,
+        Description: opts.description,
+    };
+    if (!(await confirmMutation(`Create price list "${opts.code}"`, opts, { PriceList: params }))) {
+        return;
+    }
+    const data = await createPriceList(params);
+    outputDetail(data, priceListDetailColumns, json(), 'PriceList');
+});
+pricelists
+    .command('update <code>')
+    .description('Update a price list')
+    .requiredOption('--input <file>', 'Price list data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .action(async (code, opts) => {
+    const { updatePriceList } = await import('./operations/pricelists.js');
+    const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+    const fields = JSON.parse(raw);
+    if (!(await confirmMutation(`Update price list ${code}`, opts, { PriceList: fields }))) {
+        return;
+    }
+    const data = await updatePriceList(code, fields);
+    outputDetail(data, priceListDetailColumns, json(), 'PriceList');
+});
+// --- prices ---
+const prices = program.command('prices').description('Price operations within price lists');
+prices
+    .command('list')
+    .description('List prices in a price list')
+    .requiredOption('--pricelist <code>', 'Price list code')
+    .option('--article <number>', 'Filter by article number')
+    .option('--page <number>', 'Page number', parseInt)
+    .option('--limit <number>', 'Results per page', parseInt)
+    .action(async (opts) => {
+    const { listPrices } = await import('./operations/pricelists.js');
+    const data = await listPrices({
+        priceListCode: opts.pricelist,
+        articleNumber: opts.article,
+        page: opts.page,
+        limit: opts.limit,
+    });
+    const envelope = data;
+    outputList(envelope.Prices ?? [], priceListColumns, json(), data, envelope.MetaInformation);
+});
+prices
+    .command('get')
+    .description('Get a specific price')
+    .requiredOption('--pricelist <code>', 'Price list code')
+    .requiredOption('--article <number>', 'Article number')
+    .option('--from-quantity <number>', 'From quantity (default 0)', parseInt)
+    .action(async (opts) => {
+    const { getPrice } = await import('./operations/pricelists.js');
+    const data = await getPrice(opts.pricelist, opts.article, opts.fromQuantity);
+    outputDetail(data, priceDetailColumns, json(), 'Price');
+});
+prices
+    .command('update')
+    .description('Update a price')
+    .requiredOption('--pricelist <code>', 'Price list code')
+    .requiredOption('--article <number>', 'Article number')
+    .option('--from-quantity <number>', 'From quantity (default 0)', parseInt)
+    .requiredOption('--input <file>', 'Price data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .action(async (opts) => {
+    const { updatePrice } = await import('./operations/pricelists.js');
+    const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+    const fields = JSON.parse(raw);
+    if (!(await confirmMutation(`Update price ${opts.pricelist}/${opts.article}`, opts, {
+        Price: fields,
+    }))) {
+        return;
+    }
+    const data = await updatePrice(opts.pricelist, opts.article, fields, opts.fromQuantity);
+    outputDetail(data, priceDetailColumns, json(), 'Price');
+});
+// --- contracts ---
+const contracts = program
+    .command('contracts')
+    .description('Contract operations (avtal — recurring invoicing)');
+contracts
+    .command('list')
+    .description('List/filter contracts')
+    .option('--filter <filter>', 'Filter: active, inactive, finished')
+    .option('--page <number>', 'Page number', parseInt)
+    .option('--limit <number>', 'Results per page', parseInt)
+    .option('-a, --all', 'Fetch all pages')
+    .action(async (opts) => {
+    const { listContracts } = await import('./operations/contracts.js');
+    const data = await listContracts({
+        filter: opts.filter,
+        page: opts.page,
+        limit: opts.limit,
+        all: opts.all,
+    });
+    outputList(data.Contracts ?? [], contractListColumns, json(), data, data.MetaInformation);
+});
+contracts
+    .command('get <documentNumber>')
+    .description('Get a single contract')
+    .action(async (documentNumber) => {
+    const { getContract } = await import('./operations/contracts.js');
+    const data = await getContract(documentNumber);
+    outputDetail(data, contractDetailColumns, json(), 'Contract');
+});
+contracts
+    .command('create')
+    .description('Create a contract (recurring invoicing)')
+    .requiredOption('--customer <number>', 'Customer number')
+    .requiredOption('--input <file>', 'Contract data as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .addHelpText('after', `
+Examples:
+  echo '{"InvoiceRows":[{"Description":"Hosting","DeliveredQuantity":1,"Price":500,"AccountNumber":3001,"VAT":25}],"PeriodStart":"2026-07-01","PeriodEnd":"2027-06-30","InvoiceInterval":3,"ContractLength":12}' | noxctl contracts create --customer 25 --input - --dry-run`)
+    .action(async (opts) => {
+    const { createContract } = await import('./operations/contracts.js');
+    const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+    const input = JSON.parse(raw);
+    const params = { CustomerNumber: opts.customer, ...input };
+    if (!(await confirmMutation(`Create contract for customer ${opts.customer}`, opts, {
+        Contract: params,
+    }))) {
+        return;
+    }
+    const data = await createContract(params);
+    outputDetail(data, contractDetailColumns, json(), 'Contract');
+});
+contracts
+    .command('update <documentNumber>')
+    .description('Update a contract')
+    .requiredOption('--input <file>', 'Fields to update as JSON file (or - for stdin)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the request without sending it')
+    .action(async (documentNumber, opts) => {
+    const { updateContract } = await import('./operations/contracts.js');
+    const raw = opts.input === '-' ? readFileSync(0, 'utf-8') : readFileSync(opts.input, 'utf-8');
+    const fields = JSON.parse(raw);
+    if (!(await confirmMutation(`Update contract ${documentNumber}`, opts, { Contract: fields }))) {
+        return;
+    }
+    const data = await updateContract(documentNumber, fields);
+    outputDetail(data, contractDetailColumns, json(), 'Contract');
+});
+contracts
+    .command('finish <documentNumber>')
+    .description('Finish a contract — no further invoices will be created')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the action without sending it')
+    .action(async (documentNumber, opts) => {
+    const { finishContract } = await import('./operations/contracts.js');
+    if (!(await confirmMutation(`Finish contract ${documentNumber}`, opts))) {
+        return;
+    }
+    const data = await finishContract(documentNumber);
+    outputConfirmation(`Contract ${documentNumber} finished.`, json(), data, contractDetailColumns, 'Contract');
+});
+contracts
+    .command('create-invoice <documentNumber>')
+    .description('Create the next invoice from a contract immediately')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the action without sending it')
+    .action(async (documentNumber, opts) => {
+    const { createInvoiceFromContract } = await import('./operations/contracts.js');
+    if (!(await confirmMutation(`Create invoice from contract ${documentNumber}`, opts))) {
+        return;
+    }
+    const data = await createInvoiceFromContract(documentNumber);
+    outputConfirmation(`Invoice created from contract ${documentNumber}.`, json(), data, invoiceConfirmColumns, 'Invoice');
+});
+contracts
+    .command('increase-invoice-count <documentNumber>')
+    .description('Extend a non-continuous contract by one invoice')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--dry-run', 'Preview the action without sending it')
+    .action(async (documentNumber, opts) => {
+    const { increaseInvoiceCount } = await import('./operations/contracts.js');
+    if (!(await confirmMutation(`Increase invoice count for contract ${documentNumber}`, opts))) {
+        return;
+    }
+    const data = await increaseInvoiceCount(documentNumber);
+    outputConfirmation(`Invoice count increased for contract ${documentNumber}.`, json(), data, contractDetailColumns, 'Contract');
+});
+// --- financial years ---
+const financialYears = program
+    .command('financial-years')
+    .description('Financial year and locked period operations');
+financialYears
+    .command('list')
+    .description('List financial years (räkenskapsår)')
+    .option('--date <date>', 'Find the financial year containing this date (YYYY-MM-DD)')
+    .action(async (opts) => {
+    const { listFinancialYears } = await import('./operations/financial-years.js');
+    const data = await listFinancialYears({ date: opts.date });
+    outputList(data.FinancialYears ?? [], financialYearListColumns, json(), data, data.MetaInformation);
+});
+financialYears
+    .command('get <id>')
+    .description('Get a single financial year')
+    .action(async (id) => {
+    const { getFinancialYear } = await import('./operations/financial-years.js');
+    const data = await getFinancialYear(parseInt(id, 10));
+    outputDetail(data, financialYearDetailColumns, json(), 'FinancialYear');
+});
+financialYears
+    .command('locked-period')
+    .description('Show the locked period (bokföring låst t.o.m.)')
+    .action(async () => {
+    const { getLockedPeriod } = await import('./operations/financial-years.js');
+    const data = await getLockedPeriod();
+    if (json()) {
+        console.log(JSON.stringify({ LockedPeriod: data }, null, 2));
+        return;
+    }
+    if (!data.EndDate) {
+        console.log('No period is locked.');
+        return;
+    }
+    outputDetail(data, lockedPeriodDetailColumns, false);
+});
+// --- analytics ---
+const analytics = program
+    .command('analytics')
+    .description('Precomputed analytics views (overdue, unpaid, top customers, VAT)');
+analytics
+    .command('overdue')
+    .description('Overdue invoices summary')
+    .action(async () => {
+    const { getOverdueSummary } = await import('./operations/analytics.js');
+    const summary = await getOverdueSummary();
+    if (json()) {
+        console.log(JSON.stringify(summary, null, 2));
+        return;
+    }
+    if (summary.count === 0) {
+        console.log('No overdue invoices.');
+        return;
+    }
+    console.log(`Overdue: ${summary.count} invoice(s), ${summary.totalBalance.toFixed(2)} outstanding. Oldest due ${summary.oldestDueDate}.\n`);
+    outputList(summary.invoices, invoiceListColumns, false, summary.invoices);
+});
+analytics
+    .command('unpaid')
+    .description('Unpaid totals (outstanding receivables)')
+    .action(async () => {
+    const { getUnpaidTotals } = await import('./operations/analytics.js');
+    const s = await getUnpaidTotals();
+    if (json()) {
+        console.log(JSON.stringify(s, null, 2));
+        return;
+    }
+    console.log(`Unpaid:  ${s.count} invoice(s), ${s.totalBalance.toFixed(2)} outstanding.`);
+    console.log(`Overdue: ${s.overdueCount} invoice(s), ${s.overdueBalance.toFixed(2)}.`);
+});
+analytics
+    .command('top-customers')
+    .description('Top customers by invoiced amount')
+    .option('--from <date>', 'From date (YYYY-MM-DD)')
+    .option('--to <date>', 'To date (YYYY-MM-DD)')
+    .option('--period <period>', 'Natural period (calendar-year): Q1, 2025-Q3, march/mars, last-quarter, ytd, ... Mutually exclusive with --from/--to.')
+    .option('--limit <number>', 'Number of customers (default 10)', parseInt)
+    .action(async (opts) => {
+    const { getTopCustomers } = await import('./operations/analytics.js');
+    const range = fromToParams(opts);
+    const result = await getTopCustomers({
+        fromDate: range.fromDate,
+        toDate: range.toDate,
+        limit: opts.limit,
+    });
+    if (json()) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    outputList(result.customers.map((c) => ({ ...c })), topCustomerColumns, false, result.customers);
+});
+analytics
+    .command('vat')
+    .description('VAT summary for a period (net VAT position)')
+    .option('--from <date>', 'From date (YYYY-MM-DD)')
+    .option('--to <date>', 'To date (YYYY-MM-DD)')
+    .option('--period <period>', 'Natural period (calendar-year): Q1, 2025-Q3, march/mars, last-quarter, ytd, ... Mutually exclusive with --from/--to.')
+    .option('--year <number>', 'Financial year', parseInt)
+    .action(async (opts) => {
+    const { getVatSummary } = await import('./operations/analytics.js');
+    const range = fromToParams(opts);
+    if (!range.fromDate || !range.toDate) {
+        fail('analytics vat requires a period: --from/--to or --period.', 2);
+    }
+    const summary = await getVatSummary({
+        fromDate: range.fromDate,
+        toDate: range.toDate,
+        financialYear: opts.year,
+    });
+    if (json()) {
+        console.log(JSON.stringify(summary, null, 2));
+        return;
+    }
+    console.log(formatTaxReport(summary));
+    console.log(`\nNet VAT: ${summary.netVat.toFixed(2)} (negative = owed to Skatteverket)`);
+});
+// --- dashboard ---
+program
+    .command('dashboard')
+    .description('At-a-glance summary: recent invoices, outstanding, overdue, monthly revenue')
+    .option('--months <number>', 'Months of revenue history (default 6)', parseInt)
+    .action(async (opts) => {
+    const { getDashboard } = await import('./operations/analytics.js');
+    const dash = await getDashboard({ months: opts.months });
+    if (json()) {
+        console.log(JSON.stringify(dash, null, 2));
+        return;
+    }
+    console.log('OUTSTANDING');
+    console.log(`  Unpaid:  ${dash.unpaid.count} invoice(s), ${dash.unpaid.totalBalance.toFixed(2)}`);
+    console.log(`  Overdue: ${dash.overdue.count} invoice(s), ${dash.overdue.totalBalance.toFixed(2)}` +
+        (dash.overdue.oldestDueDate ? ` (oldest due ${dash.overdue.oldestDueDate})` : ''));
+    if (dash.overdue.count > 0) {
+        console.log('\nOVERDUE INVOICES');
+        outputList(dash.overdue.invoices, invoiceListColumns, false, dash.overdue.invoices);
+    }
+    console.log('\nRECENT INVOICES');
+    outputList(dash.recentInvoices, invoiceListColumns, false, dash.recentInvoices);
+    console.log('\nMONTHLY INVOICED');
+    outputList(dash.monthlyRevenue.map((m) => ({ ...m })), monthlyRevenueColumns, false, dash.monthlyRevenue);
+});
+// --- completion ---
+program
+    .command('completion <shell>')
+    .description('Generate shell completion script (bash, zsh, fish)')
+    .addHelpText('after', `
+Examples:
+  noxctl completion bash > /usr/local/etc/bash_completion.d/noxctl
+  noxctl completion zsh > "\${fpath[1]}/_noxctl"
+  noxctl completion fish > ~/.config/fish/completions/noxctl.fish`)
+    .action(async (shell) => {
+    const { extractCommandTree, renderCompletion } = await import('./completions.js');
+    console.log(renderCompletion(shell, extractCommandTree(program)));
+});
+// Error handling (configureOutput + exitOverride set above, before the command
+// tree, so subcommands inherit them).
+try {
+    await program.parseAsync(process.argv);
+}
+catch (err) {
+    const code = err instanceof Error && 'code' in err ? err.code : undefined;
+    // Commander throws these for --help and --version after writing output; exit 0.
+    if (code === 'commander.helpDisplayed' || code === 'commander.version') {
+        process.exit(0);
+    }
+    // Commander parse errors (unknownCommand, missingMandatoryOptionValue,
+    // excessArguments, ...) carry a `commander.*` code. configureOutput above
+    // already wrote their plain-text usage message in table mode, so we must not
+    // print it again here; in JSON mode that output was suppressed, so we emit
+    // the structured envelope below instead.
+    const isCommanderParseError = typeof code === 'string' && code.startsWith('commander.');
+    if (json()) {
+        // Structured mode fails structured: scripted callers branch on .error
+        // instead of string-scraping stderr.
+        console.error(JSON.stringify(errorEnvelope(err), null, 2));
+    }
+    else if (!isCommanderParseError) {
+        console.error(err instanceof Error ? err.message : err);
     }
-    console.error(err instanceof Error ? err.message : err);
     process.exit(1);
 }
 //# sourceMappingURL=cli.js.map