@kirjapro/mcp-server 0.16.1 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## [0.17.0] - Unreleased
+
+Needs database migration `20261013030000` before publication: until it is deployed the new
+tool answers a permission error and its telemetry is refused. Every other tool keeps its
+fingerprint; 0.16.x keeps working unchanged against the migrated database.
+
+- New read tool `kirjapro_get_report_entries` (full surface): the ledger entries behind the
+  income statement's expense or revenue lines for one fiscal year, largest first, optionally
+  for one account and a date range inside the year, 1-20 per page with the whole-selection
+  `total` and `total_count` and `next_offset`. It reads the database function that AI
+  Chat's `getReportEntries` uses, so the same selection sums to the income statement; the
+  closing voucher of a closed year is excluded. Account names, voucher text and voucher
+  numbers are wrapped in `<untrusted-external>`.
+- `kirjapro_get_dashboard` counts every invoice of the fiscal year. The invoice statistics
+  read the year's invoices without a limit, so a year above the Data API row cap was
+  silently undercounted; they are now read in pages with an exact count, and a page that
+  fails or changes mid-read fails the tool instead of returning partial statistics.
+- `kirjapro_create_offer` checks each line's VAT treatment with the same check as
+  `kirjapro_create_invoice` and AI Chat, before an offer number is allocated, and answers
+  its `CODE: viesti` (for example `VAT_SELLER_NOT_REGISTERED` or `VAT_RATE_NOT_IN_FORCE`)
+  instead of the earlier English sentence.
+- `kirjapro_create_recurring_invoice` and `kirjapro_update_recurring_invoice` (with new
+  `lines`) refuse a template whose invoices the database would refuse: each line's
+  generated treatment (the standard treatment of its rate, `exempt_other` for 0 %) goes
+  through the same check for the seller, the customer and the next generation date. A
+  seller outside the VAT register gets `VAT_SELLER_NOT_REGISTERED`.
+
 ## [0.16.1] - 2026-10-11
 
 No database migration, and no tool definition changes: every fingerprint is unchanged and

package/README.md

@@ -135,7 +135,7 @@ A few prompts to feel out the daily workflows the agent handles cleanly:
 
 ## What's included
 
-**29 tools** in the default `core` surface, focused on the daily-use workflows: read your books, invoice flow, transactions + banking, contract create / send / convert, Finnish validators. The full 55-tool catalog (booking shortcuts, recurring invoices, templates, batch tools, etc.) is available via opt-in:
+**29 tools** in the default `core` surface, focused on the daily-use workflows: read your books, invoice flow, transactions + banking, contract create / send / convert, Finnish validators. The full 56-tool catalog (booking shortcuts, recurring invoices, templates, batch tools, etc.) is available via opt-in:
 
 ```jsonc
 {
@@ -145,14 +145,14 @@ A few prompts to feel out the daily workflows the agent handles cleanly:
       "args": ["-y", "@kirjapro/mcp-server"],
       "env": {
         "KIRJAPRO_API_KEY": "kp_your_key_here",
-        "KIRJAPRO_MCP_SURFACE": "full"   // 55 tools instead of 29
+        "KIRJAPRO_MCP_SURFACE": "full"   // 56 tools instead of 29
       }
     }
   }
 }
 ```
 
-**Why default to 29 instead of 55:** large catalogs with overlapping tools cost
+**Why default to 29 instead of 56:** large catalogs with overlapping tools cost
 more context and can make selection harder, but there is no universal tool-count
 cliff that applies to every model and task. Twenty-seven is a conservative
 launch default for Kirjapro's daily workflows. Its own usage and error data,

package/dist/index.js

@@ -33089,6 +33089,9 @@ var Protocol = class {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
         const handleTaskResult = async () => {
           const taskId = request.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -33119,12 +33122,12 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -33161,7 +33164,7 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
+          this._clearTaskQueue(request.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
@@ -33289,6 +33292,19 @@ var Protocol = class {
     const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== void 0) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler === void 0) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -33298,7 +33314,10 @@ var Protocol = class {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error61) => this._onerror(new Error(`Failed to send an error response: ${error61}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -33349,7 +33368,10 @@ var Protocol = class {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request.method);
       }
@@ -33384,7 +33406,7 @@ var Protocol = class {
           ...error61["data"] !== void 0 && { data: error61["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -33864,7 +33886,7 @@ var Protocol = class {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   /**
    * Clears the message queue for a task and rejects any pending request resolvers.
@@ -33893,12 +33915,13 @@ var Protocol = class {
    * Uses polling to check for updates at the task's configured poll interval.
    * @param taskId The task ID to wait for
    * @param signal Abort signal to cancel the wait
+   * @param sessionId Session of the request that waits, passed to the task store
    * @returns Promise that resolves when an update occurs or rejects if aborted
    */
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1e3;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -34777,6 +34800,42 @@ var ExperimentalMcpServerTasks = class {
 };
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+function toolInputElementCount(value, max) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length > 0) {
+    const node2 = stack.pop();
+    if (node2 === null || typeof node2 !== "object")
+      continue;
+    if (Array.isArray(node2)) {
+      for (const child of node2) {
+        if (++count > max)
+          return count;
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    } else {
+      for (const key in node2) {
+        if (!Object.prototype.hasOwnProperty.call(node2, key))
+          continue;
+        if (++count > max)
+          return count;
+        const child = node2[key];
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    }
+  }
+  return count;
+}
+function resolveMaxToolInputElements(value) {
+  if (value === void 0 || value === Infinity)
+    return void 0;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 1) {
+    throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+  }
+  return value;
+}
 var McpServer = class {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -34788,6 +34847,7 @@ var McpServer = class {
     this._resourceHandlersInitialized = false;
     this._promptHandlersInitialized = false;
     this.server = new Server(serverInfo, options);
+    this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
   }
   /**
    * Access experimental features.
@@ -34918,12 +34978,15 @@ var McpServer = class {
    * Validates tool input arguments against the tool's input schema.
    */
   async validateToolInput(tool2, args, toolName) {
+    if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) {
+      throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
+    }
     if (!tool2.inputSchema) {
       return void 0;
     }
     const inputObj = normalizeObjectSchema(tool2.inputSchema);
     const schemaToParse = inputObj ?? tool2.inputSchema;
-    const parseResult = await safeParseAsync2(schemaToParse, args);
+    const parseResult = await safeParseAsync2(schemaToParse, args ?? {});
     if (!parseResult.success) {
       const error61 = "error" in parseResult ? parseResult.error : "Unknown error";
       const errorMessage = getParseErrorMessage(error61);
@@ -35161,7 +35224,7 @@ var McpServer = class {
       }
       if (prompt.argsSchema) {
         const argsObj = normalizeObjectSchema(prompt.argsSchema);
-        const parseResult = await safeParseAsync2(argsObj, request.params.arguments);
+        const parseResult = await safeParseAsync2(argsObj, request.params.arguments ?? {});
         if (!parseResult.success) {
           const error61 = "error" in parseResult ? parseResult.error : "Unknown error";
           const errorMessage = getParseErrorMessage(error61);
@@ -35679,7 +35742,7 @@ var StdioServerTransport = class {
 import { createClient } from "@supabase/supabase-js";
 
 // src/version.ts
-var VERSION = "0.16.1";
+var VERSION = "0.17.0";
 
 // src/auth.ts
 var SUPABASE_PROJECT_URL = "https://tifewzsimmyoiepblhld.supabase.co";
@@ -36175,6 +36238,31 @@ function parseDashboardStats(data) {
     return null;
   return { revenue, expenses, transaction_count: transactionCount };
 }
+var DASHBOARD_INVOICE_PAGE_SIZE = 1e3;
+var DASHBOARD_INVOICE_MAX_PAGES = 50;
+function inconsistentPage(state, page) {
+  const { data, count } = page;
+  return !data || count === null || !Number.isInteger(count) || count < 0 || state.expectedCount !== void 0 && count !== state.expectedCount || state.offset + data.length > count || data.length === 0 && state.offset < count;
+}
+function addDashboardInvoicePage(state, page) {
+  if (inconsistentPage(state, page) || !page.data || page.count === null) {
+    return {
+      kind: "error",
+      message: "The invoice statistics could not be read completely. Try again."
+    };
+  }
+  const rows = [...state.rows, ...page.data];
+  const offset = state.offset + page.data.length;
+  const pages = (state.pages ?? 0) + 1;
+  if (offset === page.count) return { kind: "done", rows };
+  if (pages >= DASHBOARD_INVOICE_MAX_PAGES || page.count > DASHBOARD_INVOICE_MAX_PAGES * DASHBOARD_INVOICE_PAGE_SIZE) {
+    return {
+      kind: "error",
+      message: `The fiscal year has too many invoices (${page.count}) for the dashboard statistics. Use kirjapro_list_invoices with a status filter.`
+    };
+  }
+  return { kind: "next", state: { offset, rows, expectedCount: page.count, pages } };
+}
 function toDashboardReport(stats, invoices, bankAccounts, today) {
   const { revenue, expenses, transaction_count } = stats;
   const invoiceStats = {
@@ -36243,7 +36331,7 @@ function tagPayments(payments) {
 var CREDIT_PAGE_SIZE = 500;
 function addCreditPage(state, page) {
   const { data, count } = page;
-  if (!data || count === null || !Number.isInteger(count) || count < 0 || state.expectedCount !== void 0 && count !== state.expectedCount || state.offset + data.length > count || data.length === 0 && state.offset < count) {
+  if (inconsistentPage(state, page) || !data || count === null) {
     return {
       kind: "error",
       message: "The complete finalized credit balance could not be read. Refresh the invoice and try again."
@@ -39222,6 +39310,17 @@ async function resolveDefaultIncomeStatementTemplate(supabase2) {
   cachedDefaultTemplateId = data.id;
   return data.id;
 }
+async function readDashboardInvoices(supabase2, companyId2, from, to) {
+  let state = { offset: 0, rows: [] };
+  for (; ; ) {
+    const { data, count, error: error61 } = await supabase2.from("invoices").select(DASHBOARD_INVOICE_COLUMNS, { count: "exact" }).eq("company_id", companyId2).gte("invoice_date", from).lte("invoice_date", to).order("id", { ascending: true }).range(state.offset, state.offset + DASHBOARD_INVOICE_PAGE_SIZE - 1);
+    if (error61) return { rows: null, error: sanitizeDbError("Failed to read dashboard", error61) };
+    const step = addDashboardInvoicePage(state, { data, count });
+    if (step.kind === "error") return { rows: null, error: step.message };
+    if (step.kind === "done") return { rows: step.rows, error: null };
+    state = step.state;
+  }
+}
 var INVOICE_STAT_BUCKET = external_exports.object({
   count: external_exports.number(),
   total: external_exports.number()
@@ -39405,6 +39504,59 @@ var GENERAL_LEDGER_OUTPUT_SHAPE = {
     snapshot_at: external_exports.string()
   })
 };
+var REPORT_ENTRY_SHAPE = external_exports.object({
+  transaction_id: external_exports.string(),
+  date: external_exports.string(),
+  document_number: external_exports.string().nullable(),
+  description: external_exports.string().nullable(),
+  account_number: external_exports.string(),
+  account_name: external_exports.string(),
+  amount: external_exports.number()
+});
+var REPORT_ENTRIES_OUTPUT_SHAPE = {
+  kind: external_exports.enum(["expense", "revenue"]),
+  fiscal_year_id: external_exports.string(),
+  account: external_exports.object({ account_number: external_exports.string(), account_name: external_exports.string() }).nullable(),
+  period: external_exports.object({ from: external_exports.string(), to: external_exports.string() }),
+  total: external_exports.number(),
+  total_formatted: external_exports.string(),
+  total_count: external_exports.number(),
+  shown_total: external_exports.number(),
+  shown_count: external_exports.number(),
+  offset: external_exports.number(),
+  limit: external_exports.number(),
+  truncated: external_exports.boolean(),
+  next_offset: external_exports.number().nullable(),
+  items: external_exports.array(REPORT_ENTRY_SHAPE)
+};
+var REPORT_ENTRIES_RPC = external_exports.object({
+  status: external_exports.literal("ok"),
+  companyId: external_exports.string(),
+  fiscalYearId: external_exports.string(),
+  kind: external_exports.enum(["expense", "revenue"]),
+  account: external_exports.object({ accountNumber: external_exports.string(), accountName: external_exports.string() }).nullable(),
+  period: external_exports.object({ from: external_exports.string(), to: external_exports.string() }),
+  offset: external_exports.number().int(),
+  limit: external_exports.number().int(),
+  total: external_exports.number(),
+  totalCount: external_exports.number().int(),
+  shownTotal: external_exports.number(),
+  shownCount: external_exports.number().int(),
+  truncated: external_exports.boolean(),
+  nextOffset: external_exports.number().int().nullable(),
+  items: external_exports.array(
+    external_exports.object({
+      transactionId: external_exports.string(),
+      date: external_exports.string(),
+      documentNumber: external_exports.string().nullable(),
+      description: external_exports.string().nullable(),
+      accountNumber: external_exports.string(),
+      accountName: external_exports.string(),
+      amount: external_exports.number()
+    })
+  )
+});
+var REPORT_ENTRIES_DESCRIPTION = "Get the ledger entries behind the expense or revenue lines of the income statement for one fiscal year, largest amount first: optionally only one expense or revenue account (accountNumber) and a date range inside the year (dateFrom and dateTo together). total and total_count cover the whole selection; items is one page of 1-20 entries whose sum and count are shown_total and shown_count. For the next page pass next_offset as offset, and tell the user if total changed between pages. Amounts are the expense or revenue account amounts (deductible VAT is on its own account), so the same selection sums to the income statement. The closing voucher of a closed year is excluded, unlike in kirjapro_get_general_ledger. Each item names its voucher (transaction_id) for kirjapro_get_transaction. If fiscalYearId is omitted, the single open fiscal year is used.";
 function registerReportTools(server2) {
   server2.registerTool(
     DASHBOARD_TOOL.name,
@@ -39438,18 +39590,19 @@ function registerReportTools(server2) {
           p_company_id: companyId2,
           p_fiscal_year_id: fiscalYearId
         }),
-        // Invoice stats scoped to fiscal year date range
-        supabase2.from("invoices").select(DASHBOARD_INVOICE_COLUMNS).eq("company_id", companyId2).gte("invoice_date", fiscalYear.start_date).lte("invoice_date", fiscalYear.end_date),
+        // Invoice stats scoped to the fiscal year date range, every page (U-64)
+        readDashboardInvoices(supabase2, companyId2, fiscalYear.start_date, fiscalYear.end_date),
         // Bank balances
         supabase2.from("bank_accounts").select(BANK_BALANCE_COLUMNS).eq("company_id", companyId2).eq("is_active", true)
       ]);
       const stats = parseDashboardStats(statsResult.data);
-      const readError = statsResult.error || invoiceResult.error || bankResult.error;
+      const readError = statsResult.error || bankResult.error;
       if (readError || !stats) {
         return toErrorContent(readError ? sanitizeDbError("Failed to read dashboard", readError) : "Invalid dashboard response");
       }
+      if (invoiceResult.error !== null) return toErrorContent(invoiceResult.error);
       return toResult(
-        toDashboardReport(stats, invoiceResult.data || [], bankResult.data || [], helsinkiDateString())
+        toDashboardReport(stats, invoiceResult.rows, bankResult.data || [], helsinkiDateString())
       );
     }
   );
@@ -39672,6 +39825,97 @@ function registerReportTools(server2) {
       );
     }
   );
+  server2.registerTool(
+    "kirjapro_get_report_entries",
+    {
+      description: REPORT_ENTRIES_DESCRIPTION,
+      inputSchema: {
+        kind: external_exports.enum(["expense", "revenue"]).default("expense").describe("expense = the expense lines (kulut), revenue = the revenue lines (tuotot)"),
+        accountNumber: external_exports.string().regex(/^\d{3,8}$/).optional().describe('Only this expense or revenue account (e.g. "4000"); all of the kind when omitted'),
+        fiscalYearId: external_exports.string().uuid().optional().describe("Fiscal year UUID (auto-resolved to the open fiscal year if omitted)"),
+        dateFrom: ISO_DATE_SCHEMA.optional().describe("Start date inside the fiscal year (YYYY-MM-DD); give dateTo too"),
+        dateTo: ISO_DATE_SCHEMA.optional().describe("End date inside the fiscal year (YYYY-MM-DD); give dateFrom too"),
+        limit: external_exports.number().int().min(1).max(20).default(10).describe("Entries per page (default 10, max 20)"),
+        offset: external_exports.number().int().min(0).max(1e6).default(0).describe("Entries to skip; next_offset of the previous page")
+      },
+      outputSchema: REPORT_ENTRIES_OUTPUT_SHAPE,
+      annotations: READ_ONLY_ANNOTATIONS
+    },
+    async (params) => {
+      const supabase2 = getSupabase();
+      const companyId2 = getCompanyId();
+      if (params.dateFrom === void 0 !== (params.dateTo === void 0)) {
+        return toErrorContent("Give both dateFrom and dateTo, or neither (the whole fiscal year).");
+      }
+      if (params.dateFrom && params.dateTo) {
+        const rangeError = assertDateRange(params.dateFrom, params.dateTo);
+        if (rangeError) return rangeError;
+      }
+      let fiscalYearId;
+      if (params.fiscalYearId) {
+        fiscalYearId = params.fiscalYearId;
+      } else {
+        const resolved = await resolveOpenFiscalYear(supabase2, companyId2);
+        if ("isError" in resolved) return resolved;
+        fiscalYearId = resolved.id;
+      }
+      const { data, error: error61 } = await supabase2.rpc("get_report_entries", {
+        p_company_id: companyId2,
+        p_fiscal_year_id: fiscalYearId,
+        p_kind: params.kind,
+        p_account_number: params.accountNumber,
+        p_date_from: params.dateFrom,
+        p_date_to: params.dateTo,
+        p_limit: params.limit,
+        p_offset: params.offset
+      });
+      if (error61) {
+        if (error61.code === "P0002" && params.accountNumber) {
+          return toErrorContent(
+            `Account "${params.accountNumber}" is not ${params.kind === "revenue" ? "a revenue" : "an expense"} account of this company. Use kirjapro_list_accounts to see the accounts and their types.`
+          );
+        }
+        if (error61.code === "22023") {
+          return toErrorContent(
+            `Failed to get report entries: ${error61.message}. Read kirjapro://fiscal-years for the fiscal years and their dates.`
+          );
+        }
+        return toErrorContent(sanitizeDbError("Failed to get report entries", error61));
+      }
+      const parsed = REPORT_ENTRIES_RPC.safeParse(data);
+      if (!parsed.success || parsed.data.companyId !== companyId2 || parsed.data.fiscalYearId !== fiscalYearId) {
+        return toErrorContent("Failed to get report entries: unexpected response. Please try again.");
+      }
+      const report = parsed.data;
+      return toResult({
+        kind: report.kind,
+        fiscal_year_id: report.fiscalYearId,
+        account: report.account ? {
+          account_number: report.account.accountNumber,
+          account_name: tagUntrusted(report.account.accountName)
+        } : null,
+        period: { from: report.period.from, to: report.period.to },
+        total: report.total,
+        total_formatted: formatCurrency(report.total),
+        total_count: report.totalCount,
+        shown_total: report.shownTotal,
+        shown_count: report.shownCount,
+        offset: report.offset,
+        limit: report.limit,
+        truncated: report.truncated,
+        next_offset: report.nextOffset,
+        items: report.items.map((item) => ({
+          transaction_id: item.transactionId,
+          date: item.date,
+          document_number: tagUntrusted(item.documentNumber),
+          description: tagUntrustedText(item.description),
+          account_number: item.accountNumber,
+          account_name: tagUntrusted(item.accountName),
+          amount: item.amount
+        }))
+      });
+    }
+  );
 }
 
 // src/tools/banking.ts
@@ -41953,82 +42197,8 @@ function registerBookingTools(server2) {
   );
 }
 
-// src/vat.ts
-var EU_COUNTRY_CODES2 = /* @__PURE__ */ new Set([
-  "AT",
-  "BE",
-  "BG",
-  "HR",
-  "CY",
-  "CZ",
-  "DE",
-  "DK",
-  "EE",
-  "ES",
-  "FI",
-  "FR",
-  "GR",
-  "HU",
-  "IE",
-  "IT",
-  "LT",
-  "LU",
-  "LV",
-  "MT",
-  "NL",
-  "PL",
-  "PT",
-  "RO",
-  "SE",
-  "SI",
-  "SK"
-]);
-function normalizedVatNumber(value) {
-  return (value ?? "").toUpperCase().replace(/[^A-Z0-9]/g, "");
-}
-function validateVatTreatmentEligibility({
-  code,
-  sellerAlvRegistered,
-  customer,
-  documentDate
-}) {
-  if (!sellerAlvRegistered && code !== "not_vat_registered") {
-    return "A seller outside the VAT register can only use not_vat_registered.";
-  }
-  if (sellerAlvRegistered && code === "not_vat_registered") {
-    return "A VAT-registered seller cannot use not_vat_registered.";
-  }
-  if (code === "standard_25_5" && documentDate < "2024-09-01") {
-    return "standard_25_5 is not valid before 2024-09-01.";
-  }
-  if (code === "standard_13_5" && documentDate < "2026-01-01") {
-    return "standard_13_5 is not valid before 2026-01-01.";
-  }
-  const requiresBusiness = code.startsWith("reverse_") || code === "intra_eu_goods" || code === "service_outside_eu";
-  if (requiresBusiness && customer?.customer_kind !== "business") {
-    return "The selected VAT treatment requires a business customer.";
-  }
-  if ((code === "reverse_construction" || code === "reverse_scrap") && !isValidFinnishBusinessId(customer?.business_id ?? "")) {
-    return "Domestic reverse charge requires a Finnish buyer business ID in the form 1234567-8.";
-  }
-  if (code === "reverse_eu_service" || code === "intra_eu_goods") {
-    const country = (customer?.country ?? "").trim().toUpperCase();
-    const vatNumber = normalizedVatNumber(customer?.vat_number);
-    const expectedPrefix = country === "GR" ? "EL" : country;
-    if (!EU_COUNTRY_CODES2.has(country) || country === "FI" || !/^[A-Z]{2}[A-Z0-9]{2,12}$/.test(vatNumber) || !vatNumber.startsWith(expectedPrefix)) {
-      return "EU sale requires a non-Finnish EU country and a matching buyer VAT number.";
-    }
-  }
-  if (code === "export_outside_eu" || code === "service_outside_eu") {
-    const country = (customer?.country ?? "").trim().toUpperCase();
-    if (!country || EU_COUNTRY_CODES2.has(country)) {
-      return "Export outside the EU requires a buyer country outside the EU.";
-    }
-  }
-  return null;
-}
-
 // src/tools/offers.ts
+var NO_CUSTOMER = { customer_kind: "none", business_id: null, vat_number: null, country: null };
 var OFFER_DETAIL_OUTPUT_SHAPE = {
   id: external_exports.string(),
   offer_number: external_exports.string(),
@@ -42239,16 +42409,6 @@ function registerOfferTools(server2) {
               `validUntil (${params.validUntil}) must not be earlier than validFrom (${params.validFrom}).`
             );
           }
-          const { data: offerNumberRaw, error: numberError } = await supabase2.rpc(
-            "get_next_offer_number",
-            { p_company_id: companyId2, p_type: params.type }
-          );
-          if (numberError || !offerNumberRaw) {
-            return toErrorContent(
-              numberError ? sanitizeDbError("Failed to generate offer number", numberError) : "Failed to generate offer number"
-            );
-          }
-          const offerNumber = offerNumberRaw;
           const resolveTreatment = (line) => {
             const inputRate = parseFloat(line.vatRate);
             return line.vatTreatmentCode ?? (inputRate === 25.5 ? "standard_25_5" : inputRate === 13.5 ? "standard_13_5" : inputRate === 10 ? "standard_10" : null);
@@ -42259,14 +42419,24 @@ function registerOfferTools(server2) {
           for (const line of params.lines) {
             const code = resolveTreatment(line);
             if (!code) continue;
-            const eligibilityError = validateVatTreatmentEligibility({
+            const ineligible = invoiceVatTreatmentError(
               code,
-              sellerAlvRegistered: company.alv_registered,
-              customer,
-              documentDate: params.validFrom ?? helsinkiDateString()
-            });
-            if (eligibilityError) return toErrorContent(eligibilityError);
+              company.alv_registered,
+              customer ?? NO_CUSTOMER,
+              params.validFrom ?? helsinkiDateString()
+            );
+            if (ineligible) return toErrorContent(`${ineligible.code}: ${ineligible.message}`);
+          }
+          const { data: offerNumberRaw, error: numberError } = await supabase2.rpc(
+            "get_next_offer_number",
+            { p_company_id: companyId2, p_type: params.type }
+          );
+          if (numberError || !offerNumberRaw) {
+            return toErrorContent(
+              numberError ? sanitizeDbError("Failed to generate offer number", numberError) : "Failed to generate offer number"
+            );
           }
+          const offerNumber = offerNumberRaw;
           const calculatedLines = params.lines.map((line, i) => {
             const vatTreatmentCode = resolveTreatment(line) ?? "exempt_other";
             const vatRate = vatTreatmentCode === "standard_25_5" ? 25.5 : vatTreatmentCode === "standard_13_5" ? 13.5 : vatTreatmentCode === "standard_10" ? 10 : 0;
@@ -42600,6 +42770,36 @@ function registerOfferTools(server2) {
 }
 
 // src/tools/recurring-invoices.ts
+function generatedTreatment(line, supplyDate) {
+  const stored = typeof line.vat_rate === "number" ? line.vat_rate : Number.NaN;
+  const rate = stored === 24 ? supplyDate <= "2024-08-31" ? 24 : 25.5 : stored === 14 ? supplyDate <= "2025-12-31" ? 14 : 13.5 : [25.5, 13.5, 10, 0].includes(stored) ? stored : 25.5;
+  const code = typeof line.vat_treatment_code === "string" ? line.vat_treatment_code : void 0;
+  if (code === "legacy_standard_14" && rate === 13.5) return "standard_13_5";
+  if (code === "legacy_standard_24" && rate === 25.5) return "standard_25_5";
+  if (code) return code;
+  if (rate === 25.5) return "standard_25_5";
+  if (rate === 13.5) return "standard_13_5";
+  if (rate === 10) return "standard_10";
+  return "exempt_other";
+}
+var toTemplateLines = (lines) => lines.map((line) => ({ vat_rate: parseFloat(line.vatRate) }));
+async function recurringVatError(supabase2, companyId2, customer, lines, supplyDate) {
+  const { data: company, error: error61 } = await supabase2.from("companies").select("alv_registered").eq("id", companyId2).single();
+  if (error61 || !company) return "Failed to verify the seller VAT registration status.";
+  for (const line of lines) {
+    const ineligible = invoiceVatTreatmentError(
+      generatedTreatment(line, supplyDate),
+      company.alv_registered,
+      customer,
+      supplyDate
+    );
+    if (ineligible?.code === "VAT_SELLER_NOT_REGISTERED") {
+      return `${ineligible.code}: ${ineligible.message} Toistuvan laskun pohja ALV-rekisteriin kuulumattomalle myyj\xE4lle tehd\xE4\xE4n Kirjapron verkkosovelluksessa (Laskut \u2192 Toistuvat laskut).`;
+    }
+    if (ineligible) return `${ineligible.code}: ${ineligible.message}`;
+  }
+  return null;
+}
 var RECURRING_INVOICE_DETAIL_OUTPUT_SHAPE = {
   id: external_exports.string(),
   name: external_exports.string(),
@@ -42727,7 +42927,7 @@ function registerRecurringInvoiceTools(server2) {
         params.idempotencyKey,
         params,
         async () => {
-          const { data: customer, error: custError } = await supabase2.from("customers").select("id, name").eq("id", params.customerId).eq("company_id", companyId2).maybeSingle();
+          const { data: customer, error: custError } = await supabase2.from("customers").select("id, name, customer_kind, business_id, vat_number, country").eq("id", params.customerId).eq("company_id", companyId2).maybeSingle();
           if (custError || !customer) {
             return toErrorContent(
               `Customer ${params.customerId} not found. Use kirjapro_list_customers to find customer IDs.`
@@ -42738,6 +42938,14 @@ function registerRecurringInvoiceTools(server2) {
               `endDate (${params.endDate}) must not be earlier than nextDate (${params.nextDate}). A template with endDate before nextDate would never generate an invoice.`
             );
           }
+          const vatError = await recurringVatError(
+            supabase2,
+            companyId2,
+            customer,
+            toTemplateLines(params.lines),
+            params.nextDate
+          );
+          if (vatError) return toErrorContent(vatError);
           const templateData = {
             lines: params.lines.map((l, i) => ({
               line_number: i + 1,
@@ -42800,7 +43008,7 @@ function registerRecurringInvoiceTools(server2) {
     async (params) => {
       const supabase2 = getSupabase();
       const companyId2 = getCompanyId();
-      const { data: existing, error: fetchError } = await supabase2.from("recurring_invoices").select("id, name, template_data, next_date, end_date").eq("id", params.recurringInvoiceId).eq("company_id", companyId2).single();
+      const { data: existing, error: fetchError } = await supabase2.from("recurring_invoices").select("id, name, customer_id, template_data, next_date, end_date").eq("id", params.recurringInvoiceId).eq("company_id", companyId2).single();
       if (fetchError || !existing) {
         return toErrorContent(
           `Recurring invoice ${params.recurringInvoiceId} not found. Use kirjapro_list_recurring_invoices to find IDs.`
@@ -42813,6 +43021,24 @@ function registerRecurringInvoiceTools(server2) {
           `endDate (${effectiveEnd}) must not be earlier than nextDate (${effectiveNext}). Either clear endDate (set to null) or advance nextDate first.`
         );
       }
+      const storedLines = existing.template_data?.lines;
+      const checkedLines = params.lines !== void 0 ? toTemplateLines(params.lines) : params.nextDate !== void 0 && Array.isArray(storedLines) ? storedLines : null;
+      if (checkedLines && checkedLines.length > 0) {
+        const { data: customer, error: custError } = await supabase2.from("customers").select("customer_kind, business_id, vat_number, country").eq("id", existing.customer_id).eq("company_id", companyId2).maybeSingle();
+        if (custError || !customer) {
+          return toErrorContent(
+            "The customer of this recurring invoice was not found. Use kirjapro_get_recurring_invoice to check it."
+          );
+        }
+        const vatError = await recurringVatError(
+          supabase2,
+          companyId2,
+          customer,
+          checkedLines,
+          effectiveNext ?? helsinkiDateString()
+        );
+        if (vatError) return toErrorContent(vatError);
+      }
       const updates = {};
       if (params.name !== void 0) updates.name = params.name;
       if (params.frequency !== void 0) updates.frequency = params.frequency;
@@ -43330,7 +43556,8 @@ var TOOL_REGISTRATION_ORDER = [
   "kirjapro_get_received_invoice",
   "kirjapro_get_financial_notes",
   "kirjapro_get_general_ledger",
-  "kirjapro_unreconcile_bank_transaction"
+  "kirjapro_unreconcile_bank_transaction",
+  "kirjapro_get_report_entries"
 ];
 var CORE_TOOL_NAMES = new Set(
   TOOL_REGISTRATION_ORDER.slice(0, 29)
@@ -43342,7 +43569,7 @@ function resolveSurface(explicit) {
   if (env === "core") return "core";
   if (env && env !== "core") {
     console.error(
-      `[kirjapro-mcp] Unknown KIRJAPRO_MCP_SURFACE="${env}" \u2014 falling back to "core". Valid values: "core" (default, 29 tools), "full" (55 tools).`
+      `[kirjapro-mcp] Unknown KIRJAPRO_MCP_SURFACE="${env}" \u2014 falling back to "core". Valid values: "core" (default, 29 tools), "full" (56 tools).`
     );
   }
   return "core";
@@ -43411,7 +43638,7 @@ function registerTools(server2, options = {}) {
     );
   } else {
     console.error(
-      `[kirjapro-mcp] surface=full \u2014 registered all 55 tools (CORE_TOOL_NAMES bypass active).`
+      `[kirjapro-mcp] surface=full \u2014 registered all 56 tools (CORE_TOOL_NAMES bypass active).`
     );
   }
 }
@@ -43959,6 +44186,7 @@ var DATA_HANDLING = {
     { tool: "kirjapro_list_transactions / kirjapro_search_transactions", fields: ["description", "document_number", "entries[].account (the account name part)"], source: "Typed or imported by users; a bank reconciliation match persists the counterparty name into the description" },
     { tool: "kirjapro_get_transaction", fields: ["description", "document_number", "journal_entries[].description", "journal_entries[].accounts.name"], source: "As above" },
     { tool: "kirjapro_get_general_ledger", fields: ["account.name", "entries[].description", "entries[].document_number"], source: "As above" },
+    { tool: "kirjapro_get_report_entries", fields: ["account.account_name", "items[].account_name", "items[].description", "items[].document_number"], source: "As above" },
     { tool: "kirjapro_list_bank_accounts", fields: ["account_name", "bank_name", "bic"], source: "Typed by users or provided by the bank (the IBAN is validated by the database and not wrapped)" },
     { tool: "kirjapro_list_bank_transactions", fields: ["counterparty_name", "counterparty_iban", "reference", "message", "currency"], source: "Paying party via CAMT.053 bank feed (the currency has no database constraint, as on received invoices)" },
     { tool: "kirjapro_list_bank_link_candidates", fields: ["label", "document_number"], source: "Purchase-invoice sender name and number, invoice number or voucher description and number of the link candidate" },
@@ -44244,6 +44472,7 @@ Faster than composing journal entries via \`kirjapro_create_transaction\`:
 
 ### Extended Reports
 - \`kirjapro_get_general_ledger\` (p\xE4\xE4kirja) \u2014 exact full-period summary plus a creation-time-pinned seek-cursor page (max 100 entries); pass \`next_cursor\` unchanged while \`has_more\`
+- \`kirjapro_get_report_entries\` \u2014 the entries behind the income statement's expense or revenue lines (largest first, 1-20 per page, optionally one account or a date range); pass \`next_offset\` as \`offset\`
 - \`kirjapro_search_transactions\` \u2014 text + date + amount range search
 - \`kirjapro_get_transaction\` \u2014 single transaction with all journal entries
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kirjapro/mcp-server",
-  "version": "0.16.1",
+  "version": "0.17.0",
   "description": "MCP server for Finnish accounting — exposes Kirjapro bookkeeping, invoicing, and reporting tools to Claude, ChatGPT, Mistral, and other MCP clients.",
   "type": "module",
   "bin": {
@@ -52,7 +52,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "@supabase/supabase-js": "^2.105.4",
     "zod": "^4.4.3"
   },

package/server.json

@@ -2,7 +2,7 @@
   "name": "@kirjapro/mcp-server",
   "displayName": "Kirjapro - Finnish Accounting",
   "description": "Finnish double-entry bookkeeping, invoicing, and financial reporting for growing businesses. Create transactions, generate invoices with VAT calculation, produce income statements and balance sheets, and validate Finnish business identifiers.",
-  "version": "0.16.1",
+  "version": "0.17.0",
   "homepage": "https://kirjapro.fi",
   "repository": "https://github.com/Jaollo/kirja-pro",
   "license": "MIT",
@@ -16,7 +16,7 @@
       "required": true
     },
     "KIRJAPRO_MCP_SURFACE": {
-      "description": "Tool surface: \"core\" (default, 29 daily-use tools) or \"full\" (all 55 tools).",
+      "description": "Tool surface: \"core\" (default, 29 daily-use tools) or \"full\" (all 56 tools).",
       "required": false
     },
     "KIRJAPRO_TELEMETRY": {

package/tool-fingerprints.json

@@ -112,6 +112,10 @@
       "name": "kirjapro_get_recurring_invoice",
       "hash": "0e6c6a29c1f06fc6"
     },
+    {
+      "name": "kirjapro_get_report_entries",
+      "hash": "bd721bb442565288"
+    },
     {
       "name": "kirjapro_get_transaction",
       "hash": "676af0ec73d52cba"