@kirjapro/mcp-server 0.5.5 → 0.5.6

package/dist/index.js

@@ -20980,6 +20980,27 @@ async function initLegacyAuth() {
   console.error(
     `[kirjapro-mcp] Authenticated as ${userData.user.email} | Company: ${company.name} | Tier: ${tier}`
   );
+  try {
+    const payload = JSON.parse(
+      Buffer.from(supabaseAccessToken.split(".")[1], "base64url").toString()
+    );
+    if (typeof payload.exp === "number") {
+      const expiresInMs = payload.exp * 1e3 - Date.now();
+      if (expiresInMs > 0 && expiresInMs < 24 * 60 * 60 * 1e3) {
+        const warnMs = Math.max(0, expiresInMs - 5 * 60 * 1e3);
+        const timer = setTimeout(() => {
+          console.error(
+            "[kirjapro-mcp] WARNING: Legacy auth token expires in ~5 minutes. Restart with a fresh token or switch to KIRJAPRO_API_KEY for automatic refresh."
+          );
+        }, warnMs);
+        timer.unref?.();
+        console.error(
+          `[kirjapro-mcp] Token expires in ${Math.round(expiresInMs / 6e4)} minutes. Consider switching to KIRJAPRO_API_KEY for automatic refresh.`
+        );
+      }
+    }
+  } catch {
+  }
 }
 async function initAuth() {
   const apiKey = process.env.KIRJAPRO_API_KEY;
@@ -21020,6 +21041,18 @@ function formatCurrency(amount) {
     currency: "EUR"
   }).format(amount);
 }
+function helsinkiDateString(now = /* @__PURE__ */ new Date()) {
+  const parts = new Intl.DateTimeFormat("fi-FI", {
+    timeZone: "Europe/Helsinki",
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit"
+  }).formatToParts(now);
+  const year = parts.find((p) => p.type === "year")?.value ?? "1970";
+  const month = parts.find((p) => p.type === "month")?.value ?? "01";
+  const day = parts.find((p) => p.type === "day")?.value ?? "01";
+  return `${year}-${month}-${day}`;
+}
 function clampPagination(limit, offset) {
   const safeLimit = Math.min(Math.max(limit ?? 50, 1), 200);
   const safeOffset = Math.max(offset ?? 0, 0);
@@ -21145,6 +21178,18 @@ function tagUntrusted(value, maxLen = 500) {
   const cleaned = value.replace(ZERO_WIDTH, "").replace(CONTROL, " ").replace(INJECTION_MARKERS, "\u27E6redacted\u27E7").replace(/<\/?untrusted-external>/gi, "").slice(0, maxLen);
   return `<untrusted-external>${cleaned}</untrusted-external>`;
 }
+function tagCustomer(row) {
+  if (row == null) return row;
+  const wrapped = { ...row };
+  if ("name" in row) wrapped.name = tagUntrusted(row.name);
+  if ("contact_person" in row)
+    wrapped.contact_person = tagUntrusted(row.contact_person);
+  if ("address" in row) wrapped.address = tagUntrusted(row.address);
+  if ("city" in row) wrapped.city = tagUntrusted(row.city);
+  if ("email" in row) wrapped.email = tagUntrusted(row.email);
+  if ("notes" in row) wrapped.notes = tagUntrusted(row.notes);
+  return wrapped;
+}
 function addDaysToIsoDate(date3, days) {
   const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(date3);
   if (!match) {
@@ -21181,37 +21226,76 @@ function toDryRunResponse(tool, preview) {
 }
 async function withIdempotency(supabase2, companyId2, toolName, key, fn) {
   if (!key) return fn();
+  const CLAIM_STALE_MS = 6e4;
+  const CLAIM_WAIT_MS = 1500;
+  const filter = () => supabase2.from("mcp_idempotency_keys").select("response_payload, created_at").eq("company_id", companyId2).eq("tool_name", toolName).eq("key", key).maybeSingle();
   try {
-    const { data: existing } = await supabase2.from("mcp_idempotency_keys").select("response_payload").eq("company_id", companyId2).eq("key", key).maybeSingle();
+    const { data: existing } = await filter();
     if (existing?.response_payload) {
       return existing.response_payload;
     }
+    if (existing && !existing.response_payload) {
+      const age = Date.now() - new Date(existing.created_at).getTime();
+      if (age > CLAIM_STALE_MS) {
+        await supabase2.from("mcp_idempotency_keys").delete().eq("company_id", companyId2).eq("tool_name", toolName).eq("key", key);
+      } else {
+        await new Promise((r) => setTimeout(r, CLAIM_WAIT_MS));
+        const { data: retried } = await filter();
+        if (retried?.response_payload) {
+          return retried.response_payload;
+        }
+      }
+    }
   } catch (err) {
     console.error("[kirjapro-mcp] idempotency lookup failed:", {
       tool: toolName,
       err: err.message
     });
   }
+  let claimed = false;
+  try {
+    const { error: claimErr } = await supabase2.from("mcp_idempotency_keys").insert({
+      company_id: companyId2,
+      key,
+      tool_name: toolName,
+      response_payload: null
+    });
+    claimed = !claimErr;
+    if (claimErr) {
+      await new Promise((r) => setTimeout(r, CLAIM_WAIT_MS));
+      const { data: retried } = await filter();
+      if (retried?.response_payload) {
+        return retried.response_payload;
+      }
+    }
+  } catch (err) {
+    console.error("[kirjapro-mcp] idempotency claim failed:", {
+      tool: toolName,
+      err: err.message
+    });
+  }
   const result = await fn();
-  if (!result.isError) {
+  if (!result.isError && claimed) {
     try {
-      await supabase2.from("mcp_idempotency_keys").insert({
-        company_id: companyId2,
-        key,
-        tool_name: toolName,
+      await supabase2.from("mcp_idempotency_keys").update({
         response_payload: result
-      });
+      }).eq("company_id", companyId2).eq("tool_name", toolName).eq("key", key);
     } catch (err) {
-      console.error("[kirjapro-mcp] idempotency cache insert failed:", {
+      console.error("[kirjapro-mcp] idempotency cache update failed:", {
         tool: toolName,
         err: err.message
       });
     }
+  } else if (result.isError && claimed) {
+    try {
+      await supabase2.from("mcp_idempotency_keys").delete().eq("company_id", companyId2).eq("tool_name", toolName).eq("key", key);
+    } catch {
+    }
   }
   return result;
 }
 async function resolveOpenFiscalYear(supabase2, companyId2) {
-  const { data, error: error2 } = await supabase2.from("fiscal_years").select("id").eq("company_id", companyId2).eq("is_closed", false);
+  const { data, error: error2 } = await supabase2.from("fiscal_years").select("id").eq("company_id", companyId2).eq("is_closed", false).order("end_date", { ascending: false }).limit(2);
   if (error2) {
     return toErrorContent(sanitizeDbError("Failed to query fiscal years", error2));
   }
@@ -21228,6 +21312,19 @@ async function resolveOpenFiscalYear(supabase2, companyId2) {
   return { id: data[0].id };
 }
 
+// src/schemas.ts
+var PAGINATED_OUTPUT_SHAPE = {
+  results: external_exports.array(external_exports.record(external_exports.unknown())),
+  total_count: external_exports.number(),
+  has_more: external_exports.boolean(),
+  next_offset: external_exports.number()
+};
+var VALIDATION_OUTPUT_SHAPE = {
+  input: external_exports.string(),
+  valid: external_exports.boolean(),
+  error: external_exports.string().optional()
+};
+
 // src/tools/accounts.ts
 function registerAccountTools(server2) {
   server2.registerTool(
@@ -21242,6 +21339,7 @@ function registerAccountTools(server2) {
         activeOnly: external_exports.boolean().default(true).describe("Only show active accounts"),
         includeIds: external_exports.boolean().default(false).describe("Include UUID id and parent_id fields (rarely needed)")
       },
+      outputSchema: PAGINATED_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
@@ -21265,12 +21363,22 @@ function registerAccountTools(server2) {
       if (error2) {
         return toErrorContent(sanitizeDbError("Failed to list accounts", error2));
       }
-      return toTextContent(paginate(data || [], count || 0, offset, limit));
+      return toResult(paginate(data || [], count || 0, offset, limit));
     }
   );
 }
 
 // src/tools/transactions.ts
+var TRANSACTION_DETAIL_OUTPUT_SHAPE = {
+  id: external_exports.string(),
+  transaction_date: external_exports.string(),
+  description: external_exports.string().nullable(),
+  document_number: external_exports.string().nullable(),
+  journal_entries: external_exports.array(external_exports.record(external_exports.unknown())),
+  total_debit: external_exports.number(),
+  total_credit: external_exports.number(),
+  balanced: external_exports.boolean()
+};
 var LIST_TRANSACTIONS_ROW_SHAPE = {
   id: external_exports.string().uuid(),
   transaction_date: external_exports.string(),
@@ -21366,6 +21474,7 @@ function registerTransactionTools(server2) {
         limit: external_exports.number().min(1).max(200).default(50).describe("Max results (default 50)"),
         offset: external_exports.number().min(0).default(0).describe("Skip first N results")
       },
+      outputSchema: PAGINATED_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
@@ -21443,12 +21552,12 @@ function registerTransactionTools(server2) {
         const filteredTotal = results.length;
         const paginatedResults = results.slice(offset, offset + limit);
         const cappedWarning = (count || 0) >= AMOUNT_FILTER_CAP ? " (results capped at 1000 rows \u2014 narrow your date range for complete results)" : "";
-        return toTextContent({
+        return toResult({
           ...paginate(paginatedResults, filteredTotal, offset, limit),
           amount_filter_note: `Filtered client-side from ${count || 0} transactions${cappedWarning}`
         });
       }
-      return toTextContent(paginate(results, count || 0, offset, limit));
+      return toResult(paginate(results, count || 0, offset, limit));
     }
   );
   server2.registerTool(
@@ -21463,8 +21572,8 @@ function registerTransactionTools(server2) {
         entries: external_exports.array(
           external_exports.object({
             accountNumber: external_exports.string().describe('Account number (e.g. "4000") or UUID'),
-            debitAmount: external_exports.number().min(0).default(0).describe("Debit amount in EUR"),
-            creditAmount: external_exports.number().min(0).default(0).describe("Credit amount in EUR")
+            debitAmount: external_exports.number().finite().min(0).max(1e9).default(0).describe("Debit amount in EUR"),
+            creditAmount: external_exports.number().finite().min(0).max(1e9).default(0).describe("Credit amount in EUR")
           })
         ).min(2).describe("Journal entries (min 2, must balance)"),
         idempotencyKey: IDEMPOTENCY_KEY_SCHEMA
@@ -21592,9 +21701,12 @@ function registerTransactionTools(server2) {
   server2.registerTool(
     "kirjapro_create_transactions_batch",
     {
-      description: "Create multiple transactions in one call (up to 50). Each must balance (debits = credits) and is validated independently. Prefer kirjapro_create_from_template_batch for standard patterns.",
+      description: 'Create multiple transactions in one call (up to 50). Default mode "atomic" rolls back ALL on any failure; "best_effort" collects per-row errors. Prefer kirjapro_create_from_template_batch for standard patterns.',
       inputSchema: {
         fiscalYearId: external_exports.string().uuid().optional().describe("Fiscal year UUID (auto-resolved if omitted)"),
+        mode: external_exports.enum(["atomic", "best_effort"]).default("atomic").describe(
+          'Batch mode. "atomic" (default): all-or-nothing, rolls back on any row failure. "best_effort": commits what it can, returns per-row errors.'
+        ),
         transactions: external_exports.array(
           external_exports.object({
             transactionDate: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("Date (YYYY-MM-DD)"),
@@ -21603,8 +21715,8 @@ function registerTransactionTools(server2) {
             entries: external_exports.array(
               external_exports.object({
                 accountNumber: external_exports.string().describe('Account number (e.g. "4000")'),
-                debitAmount: external_exports.number().min(0).default(0),
-                creditAmount: external_exports.number().min(0).default(0)
+                debitAmount: external_exports.number().finite().min(0).max(1e9).default(0),
+                creditAmount: external_exports.number().finite().min(0).max(1e9).default(0)
               })
             ).min(2)
           })
@@ -21644,11 +21756,9 @@ function registerTransactionTools(server2) {
               )
             )
           ];
-          const uuidIdentifiers = allAccountNumbers.filter(
-            (identifier) => isUuid(identifier)
-          );
+          const uuidIdentifiers = allAccountNumbers.filter((id) => isUuid(id));
           const numberIdentifiers = allAccountNumbers.filter(
-            (identifier) => !isUuid(identifier)
+            (id) => !isUuid(id)
           );
           const [accountsByNumber, accountsById] = await Promise.all([
             numberIdentifiers.length > 0 ? supabase2.from("accounts").select("id, account_number").eq("company_id", companyId2).in("account_number", numberIdentifiers) : Promise.resolve({ data: [], error: null }),
@@ -21669,12 +21779,12 @@ function registerTransactionTools(server2) {
             accountMap.set(account.account_number, account.id);
             accountMap.set(account.id, account.id);
           }
-          const created = [];
-          const failed = [];
+          const preValidated = [];
+          const preFailed = [];
           for (let i = 0; i < params.transactions.length; i++) {
             const tx = params.transactions[i];
             if (tx.transactionDate < fy.start_date || tx.transactionDate > fy.end_date) {
-              failed.push({
+              preFailed.push({
                 index: i,
                 error: `Date ${tx.transactionDate} outside fiscal year range.`
               });
@@ -21684,7 +21794,7 @@ function registerTransactionTools(server2) {
               (e) => !accountMap.has(e.accountNumber)
             );
             if (missing.length > 0) {
-              failed.push({
+              preFailed.push({
                 index: i,
                 error: `Unknown accounts: ${missing.map((m) => m.accountNumber).join(", ")}`
               });
@@ -21697,46 +21807,78 @@ function registerTransactionTools(server2) {
               tx.entries.reduce((s, e) => s + e.creditAmount, 0)
             );
             if (totalDebit !== totalCredit) {
-              failed.push({
+              preFailed.push({
                 index: i,
                 error: `Unbalanced: debits ${totalDebit} != credits ${totalCredit}`
               });
               continue;
             }
-            const entries = tx.entries.map((e) => ({
-              account_id: accountMap.get(e.accountNumber),
-              debit_amount: e.debitAmount,
-              credit_amount: e.creditAmount
-            }));
-            const { data: newTxId, error: txErr } = await supabase2.rpc(
-              "create_transaction_with_entries",
-              {
-                p_company_id: companyId2,
-                p_fiscal_year_id: fiscalYearId,
-                p_transaction_date: tx.transactionDate,
-                p_description: tx.description,
-                p_document_number: tx.documentNumber || "",
-                p_entries: entries
-              }
-            );
-            if (txErr || !newTxId) {
-              failed.push({
-                index: i,
-                error: txErr?.message || "No transaction ID returned"
-              });
-              continue;
-            }
-            created.push({
-              id: newTxId,
+            preValidated.push({
+              index: i,
+              transaction_date: tx.transactionDate,
               description: tx.description,
-              date: tx.transactionDate
+              document_number: tx.documentNumber || "",
+              entries: tx.entries.map((e) => ({
+                account_id: accountMap.get(e.accountNumber),
+                debit_amount: e.debitAmount,
+                credit_amount: e.creditAmount
+              }))
+            });
+          }
+          if (params.mode === "atomic" && preFailed.length > 0) {
+            return toErrorContent(
+              `Atomic batch aborted: ${preFailed.length} transaction(s) failed validation. Fix all errors or use mode "best_effort" for partial commits.
+` + preFailed.map((f) => `  [${f.index}] ${f.error}`).join("\n")
+            );
+          }
+          if (preValidated.length === 0) {
+            return toTextContent({
+              mode: params.mode,
+              created_count: 0,
+              failed_count: preFailed.length,
+              created: [],
+              failed: preFailed
             });
           }
+          const rpcTransactions = preValidated.map((v) => ({
+            transaction_date: v.transaction_date,
+            description: v.description,
+            document_number: v.document_number,
+            entries: v.entries
+          }));
+          const { data: rpcResult, error: rpcError } = await supabase2.rpc(
+            "create_transactions_batch_atomic",
+            {
+              p_company_id: companyId2,
+              p_fiscal_year_id: fiscalYearId,
+              p_transactions: rpcTransactions,
+              p_mode: params.mode
+            }
+          );
+          if (rpcError) {
+            return toErrorContent(
+              sanitizeDbError("Batch create failed", rpcError)
+            );
+          }
+          const result = rpcResult;
+          const created = result.created.map((c) => ({
+            id: c.id,
+            description: c.description,
+            date: c.date,
+            index: preValidated[c.index].index
+          }));
+          const rpcFailed = result.failed.map((f) => ({
+            index: preValidated[f.index].index,
+            error: sanitizeDbError("Failed to create transaction", {
+              message: f.error
+            })
+          }));
           return toTextContent({
+            mode: params.mode,
             created_count: created.length,
-            failed_count: failed.length,
+            failed_count: preFailed.length + rpcFailed.length,
             created,
-            failed
+            failed: [...preFailed, ...rpcFailed]
           });
         }
       );
@@ -21749,6 +21891,7 @@ function registerTransactionTools(server2) {
       inputSchema: {
         transactionId: external_exports.string().uuid().describe("Transaction UUID")
       },
+      outputSchema: TRANSACTION_DETAIL_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
@@ -21775,7 +21918,7 @@ function registerTransactionTools(server2) {
       const totalCredit = roundCents(
         entries.reduce((s, e) => s + (e.credit_amount || 0), 0)
       );
-      return toTextContent({
+      return toResult({
         ...transaction,
         total_debit: totalDebit,
         total_credit: totalCredit,
@@ -21875,11 +22018,7 @@ function registerInvoiceTools(server2) {
         has_more: external_exports.boolean(),
         next_offset: external_exports.number()
       },
-      annotations: {
-        readOnlyHint: true,
-        idempotentHint: true,
-        openWorldHint: false
-      }
+      annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
       const supabase2 = getSupabase();
@@ -21901,7 +22040,13 @@ function registerInvoiceTools(server2) {
       if (error2) {
         return toErrorContent(sanitizeDbError("Failed to list invoices", error2));
       }
-      return toResult(paginate(data || [], count || 0, offset, limit));
+      const tagged = (data || []).map((row) => ({
+        ...row,
+        customers: tagCustomer(
+          row.customers
+        )
+      }));
+      return toResult(paginate(tagged, count || 0, offset, limit));
     }
   );
   server2.registerTool(
@@ -21918,7 +22063,7 @@ function registerInvoiceTools(server2) {
             description: external_exports.string().min(1).describe("Line item description"),
             quantity: external_exports.number().min(0).describe("Quantity"),
             unit: external_exports.string().default("kpl").describe("Unit (kpl, h, kk, etc.)"),
-            unitPrice: external_exports.number().describe("Unit price in EUR (excl. VAT)"),
+            unitPrice: external_exports.number().finite().min(-1e9).max(1e9).describe("Unit price in EUR (excl. VAT). Can be negative for credit lines."),
             vatRate: external_exports.enum(["25.5", "13.5", "10", "0"]).default("25.5").describe("VAT rate")
           })
         ).min(1).describe("Invoice line items"),
@@ -22032,7 +22177,7 @@ function registerInvoiceTools(server2) {
       inputSchema: {
         invoiceId: external_exports.string().uuid().describe("Invoice UUID"),
         paymentDate: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("Payment date (YYYY-MM-DD)"),
-        amount: external_exports.number().min(0.01).describe("Payment amount in EUR"),
+        amount: external_exports.number().finite().min(0.01).max(1e9).describe("Payment amount in EUR"),
         paymentMethod: external_exports.string().default("bank_transfer").describe("Payment method (bank_transfer, cash, card)"),
         reference: external_exports.string().optional().describe("Payment reference"),
         notes: external_exports.string().optional().describe("Payment notes"),
@@ -22118,11 +22263,7 @@ function registerInvoiceTools(server2) {
         invoiceId: external_exports.string().uuid().describe("Invoice UUID")
       },
       outputSchema: GET_INVOICE_OUTPUT_SHAPE,
-      annotations: {
-        readOnlyHint: true,
-        idempotentHint: true,
-        openWorldHint: false
-      }
+      annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
       const supabase2 = getSupabase();
@@ -22167,6 +22308,9 @@ function registerInvoiceTools(server2) {
       const remainingBalance = roundCents(invoice.total - paidTotal);
       return toResult({
         ...invoice,
+        customers: tagCustomer(
+          invoice.customers
+        ),
         vat_breakdown: vatBreakdown,
         paid_total: paidTotal,
         remaining_balance: remainingBalance
@@ -22223,14 +22367,19 @@ function registerInvoiceTools(server2) {
         async () => {
           const updateFields = { status: newStatus };
           if (newStatus === "paid") {
-            updateFields.paid_date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+            updateFields.paid_date = helsinkiDateString();
           }
-          const { error: updateError } = await supabase2.from("invoices").update(updateFields).eq("id", params.invoiceId).eq("company_id", companyId2);
+          const { data: updated, error: updateError } = await supabase2.from("invoices").update(updateFields).eq("id", params.invoiceId).eq("company_id", companyId2).eq("status", currentStatus).select("id").maybeSingle();
           if (updateError) {
             return toErrorContent(
               sanitizeDbError("Failed to update invoice status", updateError)
             );
           }
+          if (!updated) {
+            return toErrorContent(
+              `Invoice ${invoice.invoice_number} status changed concurrently (was "${currentStatus}" when read). Re-read with kirjapro_get_invoice and decide whether to retry.`
+            );
+          }
           return toTextContent({
             message: `Invoice ${invoice.invoice_number} status changed from "${currentStatus}" to "${newStatus}"`,
             invoice_number: invoice.invoice_number,
@@ -22279,22 +22428,16 @@ function registerInvoiceTools(server2) {
         "kirjapro_delete_invoice",
         params.idempotencyKey,
         async () => {
-          const { error: paymentsError } = await supabase2.from("invoice_payments").delete().eq("invoice_id", params.invoiceId);
-          if (paymentsError) {
-            return toErrorContent(
-              sanitizeDbError("Failed to delete invoice payments", paymentsError)
-            );
-          }
-          const { error: linesError } = await supabase2.from("invoice_lines").delete().eq("invoice_id", params.invoiceId);
-          if (linesError) {
-            return toErrorContent(
-              sanitizeDbError("Failed to delete invoice lines", linesError)
-            );
-          }
-          const { error: deleteError } = await supabase2.from("invoices").delete().eq("id", params.invoiceId);
-          if (deleteError) {
+          const { error: rpcError } = await supabase2.rpc(
+            "delete_draft_invoice_atomic",
+            {
+              p_company_id: companyId2,
+              p_invoice_id: params.invoiceId
+            }
+          );
+          if (rpcError) {
             return toErrorContent(
-              sanitizeDbError("Failed to delete invoice", deleteError)
+              sanitizeDbError("Failed to delete invoice", rpcError)
             );
           }
           return toTextContent({
@@ -22308,6 +22451,34 @@ function registerInvoiceTools(server2) {
 }
 
 // src/tools/customers.ts
+var CUSTOMER_DETAIL_OUTPUT_SHAPE = {
+  id: external_exports.string(),
+  customer_number: external_exports.number(),
+  name: external_exports.string(),
+  business_id: external_exports.string().nullable(),
+  email: external_exports.string().nullable(),
+  payment_term_days: external_exports.number(),
+  is_active: external_exports.boolean(),
+  stats: external_exports.object({
+    invoice_count: external_exports.number(),
+    total_revenue: external_exports.number(),
+    total_revenue_formatted: external_exports.string(),
+    outstanding_balance: external_exports.number(),
+    outstanding_balance_formatted: external_exports.string()
+  }).passthrough()
+};
+var PRH_LOOKUP_OUTPUT_SHAPE = {
+  business_id: external_exports.string(),
+  name: external_exports.string(),
+  registration_date: external_exports.string().nullable(),
+  company_form: external_exports.string().nullable(),
+  address: external_exports.string().nullable(),
+  postal_code: external_exports.string().nullable(),
+  city: external_exports.string().nullable(),
+  country: external_exports.string().nullable(),
+  website: external_exports.string().nullable(),
+  phone: external_exports.string().nullable()
+};
 function validateFinnishBusinessId(input) {
   const match = input.match(/^(\d{7})-(\d)$/);
   if (!match) return false;
@@ -22336,6 +22507,7 @@ function registerCustomerTools(server2) {
         offset: external_exports.number().min(0).default(0).describe("Skip first N results"),
         search: external_exports.string().optional().describe("Search by name, email, or business ID")
       },
+      outputSchema: PAGINATED_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
@@ -22357,7 +22529,7 @@ function registerCustomerTools(server2) {
       if (error2) {
         return toErrorContent(sanitizeDbError("Failed to list customers", error2));
       }
-      return toTextContent(paginate(data || [], count || 0, offset, limit));
+      return toResult(paginate((data || []).map((c) => tagCustomer(c)), count || 0, offset, limit));
     }
   );
   server2.registerTool(
@@ -22416,13 +22588,13 @@ function registerCustomerTools(server2) {
             city: sanitizeText(params.city),
             country: params.country,
             payment_term_days: params.paymentTermDays
-          }).select().single();
+          }).select("id, customer_number, name, business_id, contact_person, email, phone, address, postal_code, city, country, payment_term_days, notes, created_at").single();
           if (error2) {
             return toErrorContent(sanitizeDbError("Failed to create customer", error2));
           }
           return toTextContent({
             message: `Customer "${params.name}" created with number ${customerNumber}`,
-            customer
+            customer: tagCustomer(customer)
           });
         }
       );
@@ -22435,6 +22607,7 @@ function registerCustomerTools(server2) {
       inputSchema: {
         customerId: external_exports.string().uuid().describe("Customer UUID")
       },
+      outputSchema: CUSTOMER_DETAIL_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
@@ -22456,8 +22629,8 @@ function registerCustomerTools(server2) {
           return s + (i.total || 0) - paid;
         }, 0)
       );
-      return toTextContent({
-        ...customer,
+      return toResult({
+        ...tagCustomer(customer),
         stats: {
           invoice_count: invoiceCount,
           total_revenue: totalRevenue,
@@ -22522,13 +22695,13 @@ function registerCustomerTools(server2) {
         "kirjapro_update_customer",
         params.idempotencyKey,
         async () => {
-          const { data: updated, error: updateError } = await supabase2.from("customers").update(updates).eq("id", params.customerId).eq("company_id", companyId2).select().single();
+          const { data: updated, error: updateError } = await supabase2.from("customers").update(updates).eq("id", params.customerId).eq("company_id", companyId2).select("id, customer_number, name, business_id, contact_person, email, phone, address, postal_code, city, country, payment_term_days, notes, created_at, updated_at").single();
           if (updateError) {
             return toErrorContent(sanitizeDbError("Failed to update customer", updateError));
           }
           return toTextContent({
             message: `Customer "${updated.name}" updated`,
-            customer: updated,
+            customer: tagCustomer(updated),
             fields_changed: Object.keys(updates)
           });
         }
@@ -22542,6 +22715,7 @@ function registerCustomerTools(server2) {
       inputSchema: {
         businessId: external_exports.string().regex(/^\d{7}-\d$/).describe('Finnish Y-tunnus (e.g. "1234567-8")')
       },
+      outputSchema: PRH_LOOKUP_OUTPUT_SHAPE,
       annotations: READ_ONLY_EXTERNAL_ANNOTATIONS
     },
     async (params) => {
@@ -22560,7 +22734,7 @@ function registerCustomerTools(server2) {
         return toErrorContent(result.error);
       }
       const company = result.data.company;
-      return toTextContent({
+      return toResult({
         business_id: company.businessId,
         name: tagUntrusted(company.name),
         registration_date: company.registrationDate,
@@ -22595,8 +22769,11 @@ var DASHBOARD_OUTPUT_SHAPE = {
   invoice_stats: external_exports.object({
     draft: INVOICE_STAT_BUCKET,
     sent: INVOICE_STAT_BUCKET,
+    partial: INVOICE_STAT_BUCKET,
     paid: INVOICE_STAT_BUCKET,
-    overdue: INVOICE_STAT_BUCKET
+    overdue: INVOICE_STAT_BUCKET,
+    cancelled: INVOICE_STAT_BUCKET,
+    no_due_date: INVOICE_STAT_BUCKET
   }),
   bank_summary: external_exports.object({
     accounts: external_exports.array(
@@ -22636,9 +22813,10 @@ var INCOME_STATEMENT_OUTPUT_SHAPE = {
 };
 var ALV_SUMMARY_OUTPUT_SHAPE = {
   period: external_exports.object({ from: external_exports.string(), to: external_exports.string() }),
-  output_vat: external_exports.unknown(),
-  input_vat: external_exports.unknown(),
-  net_vat: external_exports.number().optional(),
+  output_vat: external_exports.unknown().optional(),
+  input_vat: external_exports.unknown().optional(),
+  net_vat_payable: external_exports.number().optional(),
+  net_vat_payable_formatted: external_exports.string().optional(),
   omavero_fields: external_exports.unknown().optional(),
   warning: external_exports.string().optional(),
   message: external_exports.string().optional()
@@ -22687,6 +22865,11 @@ var AGING_BUCKET_SHAPE = external_exports.object({
 });
 var AR_AGING_OUTPUT_SHAPE = {
   buckets: external_exports.array(AGING_BUCKET_SHAPE),
+  no_due_date: external_exports.object({
+    count: external_exports.number(),
+    total: external_exports.number(),
+    invoices: external_exports.array(external_exports.record(external_exports.unknown()))
+  }).passthrough(),
   total_receivables: external_exports.number(),
   total_receivables_formatted: external_exports.string(),
   days_sales_outstanding: external_exports.number()
@@ -22712,7 +22895,9 @@ var GENERAL_LEDGER_OUTPUT_SHAPE = {
   entry_count: external_exports.number(),
   opening_balance: external_exports.number(),
   closing_balance: external_exports.number(),
-  closing_balance_formatted: external_exports.string()
+  closing_balance_formatted: external_exports.string(),
+  capped: external_exports.boolean(),
+  capped_note: external_exports.string().nullable()
 };
 function registerReportTools(server2) {
   server2.registerTool(
@@ -22767,20 +22952,31 @@ function registerReportTools(server2) {
           expenses += (entry.debit_amount || 0) - (entry.credit_amount || 0);
         }
       }
-      const now = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+      const now = helsinkiDateString();
       const invoices = invoiceResult.data || [];
       const invoiceStats = {
         draft: { count: 0, total: 0 },
         sent: { count: 0, total: 0 },
+        partial: { count: 0, total: 0 },
         paid: { count: 0, total: 0 },
-        overdue: { count: 0, total: 0 }
+        overdue: { count: 0, total: 0 },
+        cancelled: { count: 0, total: 0 },
+        no_due_date: { count: 0, total: 0 }
       };
       for (const inv of invoices) {
-        const status = inv.status === "sent" && inv.due_date < now ? "overdue" : inv.status;
-        if (status in invoiceStats) {
-          invoiceStats[status].count++;
-          invoiceStats[status].total += inv.total || 0;
+        const hasDueDate = typeof inv.due_date === "string" && inv.due_date.length > 0;
+        let status;
+        if (inv.status === "sent" && !hasDueDate) {
+          status = "no_due_date";
+        } else if (inv.status === "sent" && hasDueDate && inv.due_date < now) {
+          status = "overdue";
+        } else if (inv.status in invoiceStats) {
+          status = inv.status;
+        } else {
+          continue;
         }
+        invoiceStats[status].count++;
+        invoiceStats[status].total += inv.total || 0;
       }
       const bankAccounts = (bankResult.data || []).map((b) => ({
         name: b.account_name || "Unnamed",
@@ -23012,15 +23208,40 @@ function registerReportTools(server2) {
       ];
       let totalReceivables = 0;
       let weightedDays = 0;
+      const noDueDate = [];
       for (const inv of invoices || []) {
-        const dueDate = new Date(inv.due_date);
-        const daysOverdue = Math.max(0, Math.floor((now.getTime() - dueDate.getTime()) / 864e5));
-        const bucket = buckets.find((b) => daysOverdue >= b.min && daysOverdue <= b.max);
+        if (!inv.due_date) {
+          noDueDate.push({
+            invoice_number: inv.invoice_number,
+            customer: tagUntrusted(inv.customers?.name),
+            total: inv.total || 0
+          });
+          totalReceivables += inv.total || 0;
+          continue;
+        }
+        const dueMs = Date.parse(inv.due_date);
+        if (Number.isNaN(dueMs)) {
+          noDueDate.push({
+            invoice_number: inv.invoice_number,
+            customer: tagUntrusted(inv.customers?.name),
+            total: inv.total || 0
+          });
+          totalReceivables += inv.total || 0;
+          continue;
+        }
+        const daysOverdue = Math.max(
+          0,
+          Math.floor((now.getTime() - dueMs) / 864e5)
+        );
+        const bucket = buckets.find(
+          (b) => daysOverdue >= b.min && daysOverdue <= b.max
+        );
+        if (!bucket) continue;
         bucket.count++;
         bucket.total += inv.total || 0;
         bucket.invoices.push({
           invoice_number: inv.invoice_number,
-          customer: inv.customers?.name,
+          customer: tagUntrusted(inv.customers?.name),
           total: inv.total,
           due_date: inv.due_date,
           days_overdue: daysOverdue
@@ -23037,6 +23258,13 @@ function registerReportTools(server2) {
           total_formatted: formatCurrency(b.total),
           invoices: b.invoices
         })),
+        no_due_date: {
+          count: noDueDate.length,
+          total: roundCents(
+            noDueDate.reduce((s, i) => s + (i.total || 0), 0)
+          ),
+          invoices: noDueDate
+        },
         total_receivables: roundCents(totalReceivables),
         total_receivables_formatted: formatCurrency(totalReceivables),
         days_sales_outstanding: dso
@@ -23073,10 +23301,11 @@ function registerReportTools(server2) {
           `Account "${params.accountNumber}" not found. Use kirjapro_list_accounts to see available accounts.`
         );
       }
+      const LEDGER_FETCH_LIMIT = 5e3;
       let query = supabase2.from("journal_entries").select(`
           debit_amount, credit_amount,
           transaction:transactions!inner(id, transaction_date, description, document_number, fiscal_year_id, company_id)
-        `).eq("account_id", account.id).eq("transaction.fiscal_year_id", fiscalYearId).eq("transaction.company_id", companyId2).order("transaction(transaction_date)", { ascending: true }).order("id", { ascending: true });
+        `).eq("account_id", account.id).eq("transaction.fiscal_year_id", fiscalYearId).eq("transaction.company_id", companyId2).order("transaction(transaction_date)", { ascending: true }).order("id", { ascending: true }).range(0, LEDGER_FETCH_LIMIT);
       if (params.dateFrom) {
         query = query.gte("transaction.transaction_date", params.dateFrom);
       }
@@ -23089,9 +23318,27 @@ function registerReportTools(server2) {
       }
       const debitNormal = ["asset", "expense"];
       const isDebitNormal = debitNormal.includes(account.account_type);
-      let runningBalance = 0;
+      let openingBalance = 0;
+      if (params.dateFrom) {
+        const { data: priorEntries, error: priorErr } = await supabase2.from("journal_entries").select(`
+            debit_amount, credit_amount,
+            transaction:transactions!inner(fiscal_year_id, company_id, transaction_date)
+          `).eq("account_id", account.id).eq("transaction.fiscal_year_id", fiscalYearId).eq("transaction.company_id", companyId2).lt("transaction.transaction_date", params.dateFrom);
+        if (!priorErr && priorEntries) {
+          for (const e of priorEntries) {
+            const d = e.debit_amount || 0;
+            const c = e.credit_amount || 0;
+            openingBalance += isDebitNormal ? d - c : c - d;
+          }
+          openingBalance = roundCents(openingBalance);
+        }
+      }
+      const fetched = entries || [];
+      const capped = fetched.length > LEDGER_FETCH_LIMIT;
+      const consumed = capped ? fetched.slice(0, LEDGER_FETCH_LIMIT) : fetched;
+      let runningBalance = openingBalance;
       const ledgerEntries = [];
-      for (const entry of entries || []) {
+      for (const entry of consumed) {
         const tx = entry.transaction;
         const debit = entry.debit_amount || 0;
         const credit = entry.credit_amount || 0;
@@ -23119,9 +23366,11 @@ function registerReportTools(server2) {
         },
         entries: ledgerEntries,
         entry_count: ledgerEntries.length,
-        opening_balance: 0,
+        opening_balance: openingBalance,
         closing_balance: roundCents(runningBalance),
-        closing_balance_formatted: formatCurrency(runningBalance)
+        closing_balance_formatted: formatCurrency(runningBalance),
+        capped,
+        capped_note: capped ? `Result truncated at ${LEDGER_FETCH_LIMIT} entries. Closing balance is computed from fetched rows only and may not reflect the full fiscal-year total. Narrow the date range with dateFrom/dateTo to see the remainder.` : null
       });
     }
   );
@@ -23253,13 +23502,12 @@ function registerBankingTools(server2) {
               matchError ? sanitizeDbError("Failed to confirm reconciliation match", matchError) : "Failed to confirm reconciliation match."
             );
           }
-          const newPaidTotal = roundCents(paidSoFar + paymentAmount);
-          const newStatus = newPaidTotal >= invoice.total ? "paid" : "partial";
+          const result = matchResult;
           return toTextContent({
             message: `Bank transaction matched to invoice ${invoice.invoice_number}`,
             payment_amount: paymentAmount,
-            invoice_status: newStatus,
-            remaining_balance: roundCents(remaining - paymentAmount),
+            invoice_status: result.invoice_status || "partial",
+            remaining_balance: result.remaining_balance ?? roundCents(remaining - paymentAmount),
             bank_transaction_reconciled: true
           });
         }
@@ -23271,6 +23519,10 @@ function registerBankingTools(server2) {
     {
       description: "List active bank accounts with balances, IBAN, and sync status.",
       inputSchema: {},
+      outputSchema: {
+        accounts: external_exports.array(external_exports.record(external_exports.unknown())),
+        count: external_exports.number()
+      },
       annotations: READ_ONLY_ANNOTATIONS
     },
     async () => {
@@ -23282,7 +23534,7 @@ function registerBankingTools(server2) {
       if (error2) {
         return toErrorContent(sanitizeDbError("Failed to list bank accounts", error2));
       }
-      return toTextContent({
+      return toResult({
         accounts: data || [],
         count: (data || []).length
       });
@@ -23302,6 +23554,7 @@ function registerBankingTools(server2) {
         limit: external_exports.number().min(1).max(200).default(50).describe("Max results (default 50)"),
         offset: external_exports.number().min(0).default(0).describe("Skip first N results")
       },
+      outputSchema: PAGINATED_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
@@ -23343,15 +23596,21 @@ function registerBankingTools(server2) {
       const tagged = (data || []).map((tx) => ({
         ...tx,
         counterparty_name: tagUntrusted(tx.counterparty_name),
+        counterparty_iban: tagUntrusted(tx.counterparty_iban),
         reference: tagUntrusted(tx.reference),
         message: tagUntrusted(tx.message)
       }));
-      return toTextContent(paginate(tagged, count || 0, offset, limit));
+      return toResult(paginate(tagged, count || 0, offset, limit));
     }
   );
 }
 
 // src/tools/validation.ts
+var REFERENCE_OUTPUT_SHAPE = {
+  input: external_exports.string(),
+  reference: external_exports.string(),
+  error: external_exports.string().optional()
+};
 function validateFinnishBusinessId2(input) {
   const match = input.match(/^(\d{7})-(\d)$/);
   if (!match) {
@@ -23419,11 +23678,12 @@ function registerValidationTools(server2) {
       inputSchema: {
         businessId: external_exports.string().describe('Y-tunnus to validate (e.g. "1234567-8")')
       },
+      outputSchema: VALIDATION_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
       const result = validateFinnishBusinessId2(params.businessId);
-      return toTextContent({
+      return toResult({
         input: params.businessId,
         ...result
       });
@@ -23436,11 +23696,12 @@ function registerValidationTools(server2) {
       inputSchema: {
         iban: external_exports.string().describe('Finnish IBAN to validate (e.g. "FI2112345678901234")')
       },
+      outputSchema: VALIDATION_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
       const result = validateFinnishIBAN(params.iban);
-      return toTextContent({
+      return toResult({
         input: params.iban,
         ...result
       });
@@ -23453,11 +23714,12 @@ function registerValidationTools(server2) {
       inputSchema: {
         baseNumber: external_exports.string().describe('Base number (1-19 digits, e.g. invoice number "00042")')
       },
+      outputSchema: REFERENCE_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
       const result = generateReferenceNumber2(params.baseNumber);
-      return toTextContent({
+      return toResult({
         input: params.baseNumber,
         ...result
       });
@@ -23472,6 +23734,16 @@ function registerFiscalYearTools(server2) {
     {
       description: "List fiscal years (tilikaudet) for the company. Shows start/end dates and open/closed status. Many tools require a fiscal year ID \u2014 use this to find the right one.",
       inputSchema: {},
+      outputSchema: {
+        fiscal_years: external_exports.array(external_exports.object({
+          id: external_exports.string().uuid(),
+          start_date: external_exports.string(),
+          end_date: external_exports.string(),
+          is_closed: external_exports.boolean(),
+          created_at: external_exports.string()
+        }).passthrough()),
+        count: external_exports.number()
+      },
       annotations: READ_ONLY_ANNOTATIONS
     },
     async () => {
@@ -23481,7 +23753,7 @@ function registerFiscalYearTools(server2) {
       if (error2) {
         return toErrorContent(sanitizeDbError("Failed to list fiscal years", error2));
       }
-      return toTextContent({
+      return toResult({
         fiscal_years: data || [],
         count: (data || []).length
       });
@@ -23926,6 +24198,13 @@ function registerTemplateTools(server2) {
     {
       description: "List available transaction templates. Templates handle double-entry balancing and VAT splitting automatically.",
       inputSchema: {},
+      outputSchema: {
+        templates: external_exports.array(external_exports.object({
+          id: external_exports.string(),
+          description: external_exports.string(),
+          vatRate: external_exports.number().nullable()
+        }))
+      },
       annotations: READ_ONLY_ANNOTATIONS
     },
     async () => {
@@ -23934,7 +24213,7 @@ function registerTemplateTools(server2) {
         description: t.description,
         vatRate: t.vatRate
       }));
-      return toTextContent({ templates: list });
+      return toResult({ templates: list });
     }
   );
   server2.registerTool(
@@ -23945,7 +24224,7 @@ function registerTemplateTools(server2) {
         template: external_exports.string().describe('Template ID (e.g. "cash_sale_25", "purchase_expense")'),
         fiscalYearId: external_exports.string().uuid().optional().describe("Fiscal year UUID (auto-resolved if omitted)"),
         transactionDate: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("Transaction date (YYYY-MM-DD)"),
-        amount: external_exports.number().positive().describe("Gross amount in EUR"),
+        amount: external_exports.number().finite().positive().max(1e9).describe("Gross amount in EUR"),
         description: external_exports.string().min(1).max(500).describe("Transaction description"),
         documentNumber: external_exports.string().optional().describe("Document/receipt number"),
         withholdingRate: external_exports.number().min(0).max(100).optional().describe("Withholding tax % for salary_payment (default 20)"),
@@ -23995,14 +24274,17 @@ function registerTemplateTools(server2) {
   server2.registerTool(
     "kirjapro_create_from_template_batch",
     {
-      description: "Create multiple transactions from templates in one call (up to 50). Each is validated independently \u2014 valid ones succeed even if others fail.",
+      description: 'Create multiple transactions from templates in one call (up to 50). Default mode "atomic" rolls back ALL on any failure; "best_effort" collects per-row errors.',
       inputSchema: {
         fiscalYearId: external_exports.string().uuid().optional().describe("Fiscal year UUID (auto-resolved if omitted)"),
+        mode: external_exports.enum(["atomic", "best_effort"]).default("atomic").describe(
+          'Batch mode. "atomic" (default): all-or-nothing, rolls back on any row failure. "best_effort": commits what it can, returns per-row errors.'
+        ),
         transactions: external_exports.array(
           external_exports.object({
             template: external_exports.string().describe("Template ID"),
             transactionDate: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("Date (YYYY-MM-DD)"),
-            amount: external_exports.number().positive().describe("Gross amount in EUR"),
+            amount: external_exports.number().finite().positive().max(1e9).describe("Gross amount in EUR"),
             description: external_exports.string().min(1).max(500),
             documentNumber: external_exports.string().optional(),
             withholdingRate: external_exports.number().min(0).max(100).optional(),
@@ -24023,41 +24305,126 @@ function registerTemplateTools(server2) {
         "kirjapro_create_from_template_batch",
         params.idempotencyKey,
         async () => {
-          const created = [];
-          const failed = [];
+          let fiscalYearId = params.fiscalYearId;
+          if (!fiscalYearId) {
+            const resolved = await resolveOpenFiscalYear(supabase2, companyId2);
+            if ("isError" in resolved) return resolved;
+            fiscalYearId = resolved.id;
+          }
+          const { data: fy, error: fyError } = await supabase2.from("fiscal_years").select("id, is_closed, start_date, end_date").eq("id", fiscalYearId).eq("company_id", companyId2).single();
+          if (fyError || !fy) {
+            return toErrorContent(
+              `Fiscal year ${fiscalYearId} not found. Use kirjapro_get_dashboard or read kirjapro://fiscal-years resource.`
+            );
+          }
+          if (fy.is_closed) {
+            return toErrorContent(
+              `Fiscal year is closed (${fy.start_date} to ${fy.end_date}).`
+            );
+          }
+          const expanded = [];
+          const preFailed = [];
           for (let i = 0; i < params.transactions.length; i++) {
             const tx = params.transactions[i];
-            const result = expandTemplate(tx.template, tx.amount, {
+            const result2 = expandTemplate(tx.template, tx.amount, {
               withholdingRate: tx.withholdingRate,
               tyelRate: tx.tyelRate,
               accountOverrides: tx.accountOverrides
             });
-            if ("error" in result) {
-              failed.push({ index: i, error: result.error });
+            if ("error" in result2) {
+              preFailed.push({ index: i, error: result2.error });
               continue;
             }
-            const createResult = await resolveAndCreate({
-              fiscalYearId: params.fiscalYearId,
-              transactionDate: tx.transactionDate,
-              description: tx.description,
-              documentNumber: tx.documentNumber,
-              entries: result.entries
-            });
-            if ("isError" in createResult) {
-              failed.push({ index: i, error: createResult.content[0].text });
+            if (tx.transactionDate < fy.start_date || tx.transactionDate > fy.end_date) {
+              preFailed.push({
+                index: i,
+                error: `Date ${tx.transactionDate} outside fiscal year range (${fy.start_date} to ${fy.end_date}).`
+              });
+              continue;
+            }
+            const totalDebit = roundCents(
+              result2.entries.reduce((s, e) => s + e.debitAmount, 0)
+            );
+            const totalCredit = roundCents(
+              result2.entries.reduce((s, e) => s + e.creditAmount, 0)
+            );
+            if (Math.abs(totalDebit - totalCredit) >= 0.01) {
+              preFailed.push({
+                index: i,
+                error: `Template produced unbalanced entries: debits ${totalDebit.toFixed(2)} != credits ${totalCredit.toFixed(2)}.`
+              });
               continue;
             }
-            created.push({
-              id: createResult.id,
+            expanded.push({
+              index: i,
+              transactionDate: tx.transactionDate,
               description: tx.description,
-              date: tx.transactionDate
+              documentNumber: tx.documentNumber || "",
+              entries: result2.entries
             });
           }
+          if (params.mode === "atomic" && preFailed.length > 0) {
+            return toErrorContent(
+              `Atomic batch aborted: ${preFailed.length} transaction(s) failed validation. Fix all errors or use mode "best_effort" for partial commits.
+` + preFailed.map((f) => `  [${f.index}] ${f.error}`).join("\n")
+            );
+          }
+          if (expanded.length === 0) {
+            return toTextContent({
+              mode: params.mode,
+              created_count: 0,
+              failed_count: preFailed.length,
+              created: [],
+              failed: preFailed
+            });
+          }
+          const allAccountNumbers = [
+            ...new Set(
+              expanded.flatMap((e) => e.entries.map((en) => en.accountNumber))
+            )
+          ];
+          const accountResult = await resolveAccountNumbers(allAccountNumbers);
+          if ("isError" in accountResult) return accountResult;
+          const accountMap = accountResult;
+          const rpcTransactions = expanded.map((e) => ({
+            transaction_date: e.transactionDate,
+            description: e.description,
+            document_number: e.documentNumber,
+            entries: toJournalEntries(e.entries, accountMap)
+          }));
+          const { data: rpcResult, error: rpcError } = await supabase2.rpc(
+            "create_transactions_batch_atomic",
+            {
+              p_company_id: companyId2,
+              p_fiscal_year_id: fiscalYearId,
+              p_transactions: rpcTransactions,
+              p_mode: params.mode
+            }
+          );
+          if (rpcError) {
+            return toErrorContent(
+              sanitizeDbError("Batch create failed", rpcError)
+            );
+          }
+          const result = rpcResult;
+          const created = result.created.map((c) => ({
+            id: c.id,
+            description: c.description,
+            date: c.date,
+            index: expanded[c.index].index
+          }));
+          const rpcFailed = result.failed.map((f) => ({
+            index: expanded[f.index].index,
+            error: sanitizeDbError("Failed to create transaction", {
+              message: f.error
+            })
+          }));
           return toTextContent({
+            mode: params.mode,
             created_count: created.length,
-            failed_count: failed.length,
+            failed_count: preFailed.length + rpcFailed.length,
             created,
-            failed
+            failed: [...preFailed, ...rpcFailed]
           });
         }
       );
@@ -24079,7 +24446,9 @@ function registerBookingTools(server2) {
     {
       description: "Book a purchase (osto) with automatic VAT splitting. Supports reverse charge (AVL 9\xA7) and entertainment (edustus, AVL 114\xA7). Rate rules: food/restaurants 13.5%, insurance 0% (exempt), alcohol 25.5%.",
       inputSchema: {
-        amount: external_exports.number().positive().describe("Gross EUR amount (VAT-inclusive)"),
+        amount: external_exports.number().finite().positive().max(1e9).describe(
+          "EUR amount. Standard purchase: GROSS (VAT-inclusive) \u2014 VAT is split out of this. Reverse charge (reverseCharge=true): NET foreign-invoice amount \u2014 the foreign supplier does not charge Finnish VAT, so the parameter must be net. VAT is self-assessed on top per AVL 9\xA7 producing equal debit to ALV-saamiset and credit to ALV-velka. Entertainment (edustus=true): GROSS (full amount to expense, no VAT deduction per AVL 114\xA7)."
+        ),
         description: external_exports.string().min(1).max(500).describe("Transaction description"),
         date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("Transaction date (YYYY-MM-DD)"),
         vatRate: external_exports.enum(["25.5", "13.5", "10", "0"]).describe("Finnish VAT rate"),
@@ -24164,7 +24533,7 @@ function registerBookingTools(server2) {
     {
       description: "Book salary payment (palkanmaksu). Creates salary + employer cost transactions with withholding, TyEL, TTV, sotu. Default rates are 2026 Finnish social insurance rates.",
       inputSchema: {
-        grossSalary: external_exports.number().positive().describe("Gross salary EUR"),
+        grossSalary: external_exports.number().finite().positive().max(1e8).describe("Gross salary EUR"),
         employeeName: external_exports.string().min(1).describe("Employee name (for description)"),
         date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("Payment date (YYYY-MM-DD)"),
         withholdingRate: external_exports.number().min(0).max(100).describe("Withholding tax % (ennakonpid\xE4tys)"),
@@ -24380,7 +24749,7 @@ function registerBookingTools(server2) {
     {
       description: "Book a sale (myynti) with automatic VAT splitting. Payment types: invoice (default, D Myyntisaamiset), cash (D bank), prepaid.",
       inputSchema: {
-        amount: external_exports.number().positive().describe("Gross EUR amount (VAT-inclusive)"),
+        amount: external_exports.number().finite().positive().max(1e9).describe("Gross EUR amount (VAT-inclusive)"),
         description: external_exports.string().min(1).max(500).describe('Transaction description (e.g. "Konsultointi Acme Oy, 40h \xD7 95 \u20AC")'),
         date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("Transaction date (YYYY-MM-DD)"),
         vatRate: external_exports.enum(["25.5", "13.5", "10", "0"]).describe("Finnish VAT rate"),
@@ -24460,6 +24829,19 @@ function registerBookingTools(server2) {
 }
 
 // src/tools/offers.ts
+var OFFER_DETAIL_OUTPUT_SHAPE = {
+  id: external_exports.string(),
+  offer_number: external_exports.string(),
+  type: external_exports.string(),
+  title: external_exports.string(),
+  status: external_exports.string(),
+  subtotal: external_exports.number(),
+  vat_total: external_exports.number(),
+  total: external_exports.number(),
+  customers: external_exports.record(external_exports.unknown()).nullable(),
+  offer_lines: external_exports.array(external_exports.record(external_exports.unknown())),
+  offer_events: external_exports.array(external_exports.record(external_exports.unknown()))
+};
 function registerOfferTools(server2) {
   server2.registerTool(
     "kirjapro_list_offers",
@@ -24471,6 +24853,7 @@ function registerOfferTools(server2) {
         limit: external_exports.number().min(1).max(200).default(50).describe("Max results (default 50)"),
         offset: external_exports.number().min(0).default(0).describe("Skip first N results")
       },
+      outputSchema: PAGINATED_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
@@ -24493,7 +24876,13 @@ function registerOfferTools(server2) {
       if (error2) {
         return toErrorContent(sanitizeDbError("Failed to list offers", error2));
       }
-      return toTextContent(paginate(data || [], count || 0, offset, limit));
+      const tagged = (data || []).map((row) => ({
+        ...row,
+        customers: tagCustomer(
+          row.customers
+        )
+      }));
+      return toResult(paginate(tagged, count || 0, offset, limit));
     }
   );
   server2.registerTool(
@@ -24503,6 +24892,7 @@ function registerOfferTools(server2) {
       inputSchema: {
         offerId: external_exports.string().uuid().describe("Offer UUID")
       },
+      outputSchema: OFFER_DETAIL_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
@@ -24521,7 +24911,12 @@ function registerOfferTools(server2) {
           `Offer ${params.offerId} not found. Use kirjapro_list_offers to find offer IDs.`
         );
       }
-      return toTextContent(offer);
+      return toResult({
+        ...offer,
+        customers: tagCustomer(
+          offer.customers
+        )
+      });
     }
   );
   server2.registerTool(
@@ -24540,7 +24935,7 @@ function registerOfferTools(server2) {
           description: external_exports.string().min(1).describe("Line item description"),
           quantity: external_exports.number().min(0).describe("Quantity"),
           unit: external_exports.string().default("kpl").describe("Unit (kpl, h, kk, etc.)"),
-          unitPrice: external_exports.number().describe("Unit price in EUR (excl. VAT)"),
+          unitPrice: external_exports.number().finite().min(-1e9).max(1e9).describe("Unit price in EUR (excl. VAT). Can be negative for credit lines."),
           vatRate: external_exports.enum(["25.5", "13.5", "10", "0"]).default("25.5").describe("VAT rate")
         })).min(1).describe("Line items"),
         idempotencyKey: IDEMPOTENCY_KEY_SCHEMA
@@ -24870,7 +25265,7 @@ function registerOfferTools(server2) {
               `Offer ${offer.offer_number} has already been converted to invoice ${offer.invoice_id}.`
             );
           }
-          const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+          const today = helsinkiDateString();
           const { data: result, error: rpcError } = await supabase2.rpc("convert_offer_to_invoice", {
             p_offer_id: params.offerId,
             p_company_id: companyId2,
@@ -24898,6 +25293,16 @@ function registerOfferTools(server2) {
 }
 
 // src/tools/recurring-invoices.ts
+var RECURRING_INVOICE_DETAIL_OUTPUT_SHAPE = {
+  id: external_exports.string(),
+  name: external_exports.string(),
+  frequency: external_exports.string(),
+  next_date: external_exports.string().nullable(),
+  is_active: external_exports.boolean(),
+  template_data: external_exports.record(external_exports.unknown()).nullable(),
+  customer: external_exports.record(external_exports.unknown()).nullable(),
+  recent_logs: external_exports.array(external_exports.record(external_exports.unknown()))
+};
 function registerRecurringInvoiceTools(server2) {
   server2.registerTool(
     "kirjapro_list_recurring_invoices",
@@ -24908,6 +25313,7 @@ function registerRecurringInvoiceTools(server2) {
         offset: external_exports.number().min(0).default(0).describe("Skip first N results"),
         activeOnly: external_exports.boolean().default(true).describe("Only show active templates (default true)")
       },
+      outputSchema: PAGINATED_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
@@ -24926,7 +25332,13 @@ function registerRecurringInvoiceTools(server2) {
       if (error2) {
         return toErrorContent(sanitizeDbError("Failed to list recurring invoices", error2));
       }
-      return toTextContent(paginate(data || [], count || 0, offset, limit));
+      const tagged = (data || []).map((row) => ({
+        ...row,
+        customer: tagCustomer(
+          row.customer
+        )
+      }));
+      return toResult(paginate(tagged, count || 0, offset, limit));
     }
   );
   server2.registerTool(
@@ -24936,13 +25348,14 @@ function registerRecurringInvoiceTools(server2) {
       inputSchema: {
         recurringInvoiceId: external_exports.string().uuid().describe("Recurring invoice UUID")
       },
+      outputSchema: RECURRING_INVOICE_DETAIL_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
       const supabase2 = getSupabase();
       const companyId2 = getCompanyId();
       const { data, error: error2 } = await supabase2.from("recurring_invoices").select(
-        "*, customer:customers(id, name, business_id, email)"
+        "id, company_id, customer_id, name, frequency, next_date, end_date, is_active, auto_send, template_data, last_generated_at, times_generated, created_at, updated_at, customer:customers(id, name, business_id, email)"
       ).eq("id", params.recurringInvoiceId).eq("company_id", companyId2).single();
       if (error2 || !data) {
         return toErrorContent(
@@ -24950,8 +25363,11 @@ function registerRecurringInvoiceTools(server2) {
         );
       }
       const { data: logs } = await supabase2.from("recurring_invoice_logs").select("id, status, scheduled_date, invoice_number, error_message, created_at").eq("recurring_invoice_id", params.recurringInvoiceId).eq("company_id", companyId2).order("created_at", { ascending: false }).limit(10);
-      return toTextContent({
+      return toResult({
         ...data,
+        customer: tagCustomer(
+          data.customer
+        ),
         recent_logs: logs || []
       });
     }
@@ -24971,7 +25387,7 @@ function registerRecurringInvoiceTools(server2) {
           description: external_exports.string().describe("Line item description"),
           quantity: external_exports.number().positive().describe("Quantity"),
           unit: external_exports.string().default("kpl").describe('Unit (default "kpl")'),
-          unitPrice: external_exports.number().describe("Unit price (EUR)"),
+          unitPrice: external_exports.number().finite().min(-1e9).max(1e9).describe("Unit price in EUR (excl. VAT). Can be negative for credit lines."),
           vatRate: external_exports.enum(["25.5", "13.5", "10", "0"]).describe("VAT rate")
         })).min(1).describe("Invoice line items"),
         notes: external_exports.string().optional().describe("Invoice notes"),
@@ -25017,7 +25433,7 @@ function registerRecurringInvoiceTools(server2) {
             is_active: true,
             auto_send: params.autoSend,
             template_data: templateData
-          }).select().single();
+          }).select("id, name, frequency, next_date, end_date, is_active, auto_send, created_at, updated_at").single();
           if (error2) {
             return toErrorContent(sanitizeDbError("Failed to create recurring invoice", error2));
           }
@@ -25045,7 +25461,7 @@ function registerRecurringInvoiceTools(server2) {
           description: external_exports.string().describe("Line item description"),
           quantity: external_exports.number().positive().describe("Quantity"),
           unit: external_exports.string().default("kpl").describe("Unit"),
-          unitPrice: external_exports.number().describe("Unit price (EUR)"),
+          unitPrice: external_exports.number().finite().min(-1e9).max(1e9).describe("Unit price in EUR (excl. VAT). Can be negative for credit lines."),
           vatRate: external_exports.enum(["25.5", "13.5", "10", "0"]).describe("VAT rate")
         })).min(1).optional().describe("Replace all invoice lines"),
         notes: external_exports.string().optional().nullable().describe("Invoice notes (null to remove)"),
@@ -25057,12 +25473,19 @@ function registerRecurringInvoiceTools(server2) {
     async (params) => {
       const supabase2 = getSupabase();
       const companyId2 = getCompanyId();
-      const { data: existing, error: fetchError } = await supabase2.from("recurring_invoices").select("id, name, template_data").eq("id", params.recurringInvoiceId).eq("company_id", companyId2).single();
+      const { data: existing, error: fetchError } = await supabase2.from("recurring_invoices").select("id, name, template_data, next_date, end_date").eq("id", params.recurringInvoiceId).eq("company_id", companyId2).single();
       if (fetchError || !existing) {
         return toErrorContent(
           `Recurring invoice ${params.recurringInvoiceId} not found. Use kirjapro_list_recurring_invoices to find IDs.`
         );
       }
+      const effectiveNext = params.nextDate !== void 0 ? params.nextDate : existing.next_date;
+      const effectiveEnd = params.endDate !== void 0 ? params.endDate : existing.end_date;
+      if (effectiveEnd && effectiveNext && effectiveEnd < effectiveNext) {
+        return toErrorContent(
+          `endDate (${effectiveEnd}) must not be earlier than nextDate (${effectiveNext}). Either clear endDate (set to null) or advance nextDate first.`
+        );
+      }
       const updates = {};
       if (params.name !== void 0) updates.name = params.name;
       if (params.frequency !== void 0) updates.frequency = params.frequency;
@@ -25096,7 +25519,7 @@ function registerRecurringInvoiceTools(server2) {
         "kirjapro_update_recurring_invoice",
         params.idempotencyKey,
         async () => {
-          const { data, error: error2 } = await supabase2.from("recurring_invoices").update(updates).eq("id", params.recurringInvoiceId).eq("company_id", companyId2).select().single();
+          const { data, error: error2 } = await supabase2.from("recurring_invoices").update(updates).eq("id", params.recurringInvoiceId).eq("company_id", companyId2).select("id, name, frequency, next_date, end_date, is_active, auto_send, created_at, updated_at").single();
           if (error2) {
             return toErrorContent(sanitizeDbError("Failed to update recurring invoice", error2));
           }
@@ -25193,7 +25616,8 @@ function registerRecurringInvoiceTools(server2) {
           }
           return toTextContent({
             message: `Invoice generated from "${existing.name}"`,
-            ...result.data
+            invoice_id: result.data.invoice_id,
+            invoice_number: result.data.invoice_number
           });
         }
       );
@@ -25202,6 +25626,23 @@ function registerRecurringInvoiceTools(server2) {
 }
 
 // src/tools/received-invoices.ts
+var RECEIVED_INVOICE_DETAIL_OUTPUT_SHAPE = {
+  id: external_exports.string(),
+  status: external_exports.string(),
+  sender_name: external_exports.string().nullable(),
+  sender_business_id: external_exports.string().nullable(),
+  invoice_number: external_exports.string().nullable(),
+  invoice_date: external_exports.string().nullable(),
+  due_date: external_exports.string().nullable(),
+  total_amount: external_exports.number().nullable(),
+  total_amount_formatted: external_exports.string().nullable(),
+  vat_amount: external_exports.number().nullable(),
+  vat_amount_formatted: external_exports.string().nullable(),
+  currency: external_exports.string().nullable(),
+  transaction_id: external_exports.string().nullable(),
+  pdf_storage_path: external_exports.string().nullable(),
+  linked_transaction: external_exports.record(external_exports.unknown()).nullable()
+};
 function registerReceivedInvoiceTools(server2) {
   server2.registerTool(
     "kirjapro_list_received_invoices",
@@ -25215,6 +25656,7 @@ function registerReceivedInvoiceTools(server2) {
         dateFrom: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional().describe("Invoice date from (YYYY-MM-DD)"),
         dateTo: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional().describe("Invoice date to (YYYY-MM-DD)")
       },
+      outputSchema: PAGINATED_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
@@ -25251,9 +25693,10 @@ function registerReceivedInvoiceTools(server2) {
         sender_business_id: tagUntrusted(inv.sender_business_id),
         invoice_number: tagUntrusted(inv.invoice_number),
         payment_reference: tagUntrusted(inv.payment_reference),
+        iban: tagUntrusted(inv.iban),
         total_amount_formatted: inv.total_amount != null ? formatCurrency(inv.total_amount) : null
       }));
-      return toTextContent(paginate(results, count || 0, offset, limit));
+      return toResult(paginate(results, count || 0, offset, limit));
     }
   );
   server2.registerTool(
@@ -25263,12 +25706,15 @@ function registerReceivedInvoiceTools(server2) {
       inputSchema: {
         receivedInvoiceId: external_exports.string().uuid().describe("Received invoice UUID")
       },
+      outputSchema: RECEIVED_INVOICE_DETAIL_OUTPUT_SHAPE,
       annotations: READ_ONLY_ANNOTATIONS
     },
     async (params) => {
       const supabase2 = getSupabase();
       const companyId2 = getCompanyId();
-      const { data, error: error2 } = await supabase2.from("received_invoices").select("*").eq("id", params.receivedInvoiceId).eq("company_id", companyId2).single();
+      const { data, error: error2 } = await supabase2.from("received_invoices").select(
+        "id, company_id, status, operator, sender_operator, sender_eia, sender_business_id, sender_name, invoice_number, invoice_date, due_date, total_amount, vat_amount, currency, payment_reference, iban, bic, notes, pdf_storage_path, xml_content, transmission_id, transaction_id, purchase_vat_entry_id, received_at, reviewed_at, reviewed_by, created_at, updated_at"
+      ).eq("id", params.receivedInvoiceId).eq("company_id", companyId2).single();
       if (error2 || !data) {
         return toErrorContent(
           `Received invoice ${params.receivedInvoiceId} not found. Use kirjapro_list_received_invoices to find IDs.`
@@ -25279,12 +25725,16 @@ function registerReceivedInvoiceTools(server2) {
         const { data: tx } = await supabase2.from("transactions").select("id, transaction_date, description, document_number").eq("id", data.transaction_id).eq("company_id", companyId2).single();
         linkedTransaction = tx;
       }
-      return toTextContent({
-        ...data,
+      const { xml_content: _xml, ...rest } = data;
+      return toResult({
+        ...rest,
         sender_name: tagUntrusted(data.sender_name),
         sender_business_id: tagUntrusted(data.sender_business_id),
         invoice_number: tagUntrusted(data.invoice_number),
         payment_reference: tagUntrusted(data.payment_reference),
+        iban: tagUntrusted(data.iban),
+        bic: tagUntrusted(data.bic),
+        notes: tagUntrusted(data.notes),
         total_amount_formatted: data.total_amount != null ? formatCurrency(data.total_amount) : null,
         vat_amount_formatted: data.vat_amount != null ? formatCurrency(data.vat_amount) : null,
         linked_transaction: linkedTransaction
@@ -25326,11 +25776,11 @@ var CHART_OF_ACCOUNTS_SUMMARY = {
   ],
   note: "Use kirjapro_list_accounts to get full account list with search/filter."
 };
-var VAT_RATES = [
-  { rate: 25.5, label: "Yleinen verokanta", description: "Standard rate for most goods and services (from 1.9.2024, was 24%)", basis: "AVL 84\xA7" },
-  { rate: 13.5, label: "Alennettu verokanta", description: "Food, animal feed, restaurants, transport, accommodation, books, medicine, sports, culture, performing artists, sanitary products, broadcasting (from 1.1.2026, was 14%)", basis: "AVL 85\xA7, 85a\xA7" },
-  { rate: 10, label: "Lehdet ja aikakauslehdet", description: "Newspapers and magazines (print and digital) only", basis: "AVL 85a\xA7" },
-  { rate: 0, label: "Nollaverokanta", description: "Exports (AVL 70\xA7), intra-EU B2B supplies (AVL 72a\xA7), vessels, international transport. Input VAT deductible", basis: "AVL 55-72h\xA7" },
+var VAT_RATE_METADATA = [
+  { rate: FINNISH_RATES_2026.vat.standard, label: "Yleinen verokanta", description: "Standard rate for most goods and services (from 1.9.2024, was 24%)", basis: "AVL 84\xA7" },
+  { rate: FINNISH_RATES_2026.vat.reduced, label: "Alennettu verokanta", description: "Food, animal feed, restaurants, transport, accommodation, books, medicine, sports, culture, performing artists, sanitary products, broadcasting (from 1.1.2026, was 14%)", basis: "AVL 85\xA7, 85a\xA7" },
+  { rate: FINNISH_RATES_2026.vat.secondReduced, label: "Lehdet ja aikakauslehdet", description: "Newspapers and magazines (print and digital) only", basis: "AVL 85a\xA7" },
+  { rate: FINNISH_RATES_2026.vat.zero, label: "Nollaverokanta", description: "Exports (AVL 70\xA7), intra-EU B2B supplies (AVL 72a\xA7), vessels, international transport. Input VAT deductible", basis: "AVL 55-72h\xA7" },
   { rate: null, label: "Verovapaat myynnit", description: "Healthcare (AVL 34-36\xA7), education (AVL 39-40\xA7), financial services (AVL 41-42\xA7), insurance (AVL 44\xA7). NO input VAT deduction", basis: "AVL 34-44\xA7" }
 ];
 function registerSchemaResources(server2) {
@@ -25360,7 +25810,10 @@ function registerSchemaResources(server2) {
       contents: [{
         uri: uri.href,
         mimeType: "application/json",
-        text: JSON.stringify(VAT_RATES)
+        text: JSON.stringify({
+          rates: VAT_RATE_METADATA,
+          _meta: freshnessMeta(FINNISH_RATES_2026)
+        })
       }]
     })
   );
@@ -25378,12 +25831,23 @@ function registerCompanyResources(server2) {
     async (uri) => {
       const supabase2 = getSupabase();
       const companyId2 = getCompanyId();
-      const { data: company } = await supabase2.from("companies").select("id, name, business_id, address, postal_code, city, country, created_at").eq("id", companyId2).single();
+      const { data: company, error: error2 } = await supabase2.from("companies").select("id, name, business_id, address, postal_code, city, country, created_at").eq("id", companyId2).single();
+      if (error2 || !company) {
+        return {
+          contents: [{
+            uri: uri.href,
+            mimeType: "application/json",
+            text: JSON.stringify({
+              error: error2 ? sanitizeDbError("Failed to read company", error2) : "Company not found for current context."
+            })
+          }]
+        };
+      }
       return {
         contents: [{
           uri: uri.href,
           mimeType: "application/json",
-          text: JSON.stringify(company || {})
+          text: JSON.stringify(company)
         }]
       };
     }
@@ -25398,12 +25862,25 @@ function registerCompanyResources(server2) {
     async (uri) => {
       const supabase2 = getSupabase();
       const companyId2 = getCompanyId();
-      const { data: fiscalYears } = await supabase2.from("fiscal_years").select("id, start_date, end_date, is_closed, created_at").eq("company_id", companyId2).order("start_date", { ascending: false });
-      const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-      const enriched = (fiscalYears || []).map((fy) => ({
-        ...fy,
-        is_current: !fy.is_closed && fy.start_date <= today && fy.end_date >= today
-      }));
+      const { data: fiscalYears, error: error2 } = await supabase2.from("fiscal_years").select("id, start_date, end_date, is_closed, created_at").eq("company_id", companyId2).order("start_date", { ascending: false });
+      if (error2) {
+        return {
+          contents: [{
+            uri: uri.href,
+            mimeType: "application/json",
+            text: JSON.stringify({
+              error: sanitizeDbError("Failed to read fiscal years", error2)
+            })
+          }]
+        };
+      }
+      const today = helsinkiDateString();
+      const enriched = (fiscalYears || []).map(
+        (fy) => ({
+          ...fy,
+          is_current: !fy.is_closed && fy.start_date <= today && fy.end_date >= today
+        })
+      );
       return {
         contents: [{
           uri: uri.href,
@@ -25791,10 +26268,13 @@ function registerResources(server2) {
   registerSecurityResources(server2);
 }
 
+// src/version.ts
+var VERSION = "0.5.6";
+
 // src/index.ts
 var server = new McpServer({
   name: "kirjapro",
-  version: "0.5.0"
+  version: VERSION
 });
 async function main() {
   try {
@@ -25805,13 +26285,23 @@ async function main() {
   }
   registerTools(server);
   registerResources(server);
+  const freshness = freshnessMeta(FINNISH_RATES_2026);
+  if (freshness.stale) {
+    console.error(
+      `[kirjapro-mcp] WARNING: Finnish rates dataset is STALE (valid through ${freshness.valid_through}). Running on expired VAT and social-insurance rates. Upgrade @kirjapro/mcp-server immediately.`
+    );
+  } else if (freshness.days_until_expiry < 30) {
+    console.error(
+      `[kirjapro-mcp] NOTICE: Finnish rates dataset expires in ${freshness.days_until_expiry} days (${freshness.valid_through}). Upgrade @kirjapro/mcp-server before year-end to avoid stale rates.`
+    );
+  }
   const transport = new StdioServerTransport();
   transport.onclose = () => {
     stopTokenRefresh();
     process.exit(0);
   };
   await server.connect(transport);
-  console.error("[kirjapro-mcp] Server started on stdio");
+  console.error(`[kirjapro-mcp] Server v${VERSION} started on stdio`);
 }
 function shutdown() {
   stopTokenRefresh();