@kirjapro/mcp-server 0.6.1 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.7.0] - 2026-07-16
+
+Adds invoice delivery as a first-class MCP workflow.
+
+### Added
+
+- **`kirjapro_send_invoice`** sends a draft invoice through an explicit `email` or `einvoice` channel. The tool calls the authenticated `dispatch-invoice` Edge Function, keeps provider credentials server-side, and returns the delivery identifier.
+- Invoice create → send guidance now uses the delivery tool instead of redirecting users to the web UI.
+
+### Changed
+
+- The default `core` surface now contains 27 tools; the complete catalog remains 52 tools.
+- Package, server manifest, and MCPB versions are aligned at 0.7.0.
+- Client setup now documents native local `stdio` use with Mistral Vibe and ChatGPT access through OpenAI Secure MCP Tunnel. Mistral Le Chat is explicitly marked as requiring a separately hosted remote endpoint.
+
+### Fixed
+
+- Server instructions no longer list e-invoice sending as web-only now that `kirjapro_send_invoice` supports the explicit `einvoice` channel.
+
 ## [0.6.1] - 2026-05-29
 
 Hardening release from a full server audit (12 dimensions, adversarially verified). No new tools; tightens input validation, closes two security gaps, and corrects compliance guidance + tool descriptions. `tool-fingerprints.json` regenerated for the description/input-schema changes.

package/README.md

@@ -1,13 +1,13 @@
 # @kirjapro/mcp-server
 
-MCP server for Finnish accounting. Exposes Kirjapro bookkeeping, invoicing, and reporting tools to Claude Code, Claude Desktop, and any MCP client.
+MCP server for Finnish accounting. Exposes Kirjapro bookkeeping, invoicing, and reporting tools to Claude Code, Claude Desktop, Mistral Vibe, ChatGPT through Secure MCP Tunnel, and other MCP clients.
 
 **Full documentation:** [kirjapro.fi/docs/mcp](https://kirjapro.fi/docs/mcp/)
 
 ## Requirements
 
 - Node.js 20+
-- Kirjapro account on a paid tier with API access — **Yrittäjä**, **Kasvu**, **Tilitoimisto**, or **Räätälöity**
+- Kirjapro account on a paid tier with API access — **Yrittäjä** or **Kasvu**
 - API key (generate at Settings > API-avaimet)
 
 ## Quick Start
@@ -72,9 +72,30 @@ Add to `claude_desktop_config.json`:
 
 Restart Claude Desktop after saving.
 
+#### Mistral Vibe
+
+Add to `~/.vibe/config.toml`:
+
+```toml
+[[mcp_servers]]
+name = "kirjapro"
+transport = "stdio"
+command = "npx"
+args = ["-y", "@kirjapro/mcp-server"]
+env = { KIRJAPRO_API_KEY = "kp_your_key_here" }
+```
+
+Restart Vibe and verify the connection from `/mcp`.
+
+#### ChatGPT
+
+ChatGPT requires a remote MCP connection and cannot launch this local `stdio` package directly. Use [OpenAI Secure MCP Tunnel](https://developers.openai.com/api/docs/guides/secure-mcp-tunnels) to bridge ChatGPT to `npx -y @kirjapro/mcp-server`. Full write/modify support currently requires ChatGPT Business or Enterprise/Edu; see the [full setup guide](https://kirjapro.fi/docs/mcp/) for the tunnel commands and plan limitations.
+
+Mistral Le Chat likewise requires a remote MCP server URL. The local npm package works directly with Mistral Vibe; Le Chat support requires a separately hosted remote endpoint.
+
 #### Other clients
 
-See [full setup guide](https://kirjapro.fi/docs/mcp/) for Cursor, VS Code / Copilot, Windsurf, and generic stdio.
+See [full setup guide](https://kirjapro.fi/docs/mcp/) for ChatGPT, Mistral Vibe, Cursor, VS Code / Copilot, Windsurf, and generic stdio.
 
 ### 3. Verify
 
@@ -86,6 +107,7 @@ A few prompts to feel out the daily workflows the agent handles cleanly:
 
 - *"Show my dashboard"* — financial snapshot of the current fiscal year
 - *"Create an invoice for Acme Oy, 5000 € for consulting in March"* — full lifecycle from customer lookup to draft invoice
+- *"Send invoice #42 by email"* — server-rendered PDF delivery with an explicit channel
 - *"Draft a contract for Acme Oy and email it to john@acme.fi, 3-month retainer at 5000 € / month"* — `tarjous`/`sopimus` create + customer-visible email link
 - *"Record that invoice #42 was paid yesterday"* — payment recording + auto status transition
 - *"What's my VAT for this quarter?"* — `kirjapro_get_alv_summary` with OmaVero field codes
@@ -94,7 +116,7 @@ A few prompts to feel out the daily workflows the agent handles cleanly:
 
 ## What's included
 
-**26 tools** in the default `core` surface, focused on the daily-use workflows: read your books, invoice flow, transactions + banking, contract create / send / convert, Finnish validators. The full 52-tool catalog (booking shortcuts, recurring invoices, templates, batch tools, etc.) is available via opt-in:
+**27 tools** in the default `core` surface, focused on the daily-use workflows: read your books, invoice flow, transactions + banking, contract create / send / convert, Finnish validators. The full 52-tool catalog (booking shortcuts, recurring invoices, templates, batch tools, etc.) is available via opt-in:
 
 ```jsonc
 {
@@ -104,14 +126,14 @@ A few prompts to feel out the daily workflows the agent handles cleanly:
       "args": ["-y", "@kirjapro/mcp-server"],
       "env": {
         "KIRJAPRO_API_KEY": "kp_your_key_here",
-        "KIRJAPRO_MCP_SURFACE": "full"   // 52 tools instead of 26
+        "KIRJAPRO_MCP_SURFACE": "full"   // 52 tools instead of 27
       }
     }
   }
 }
 ```
 
-**Why default to 26 instead of 52:** 2025-2026 SOTA research on tool catalog scaling (Anthropic, OpenAI, MCP authors) shows tool-selection accuracy degrades between 25-50 tools per catalog. A focused surface produces better first-call selections for the daily workflows. As real usage data informs which deferred tools matter most, they'll be promoted into core.
+**Why default to 27 instead of 52:** 2025-2026 SOTA research on tool catalog scaling (Anthropic, OpenAI, MCP authors) shows tool-selection accuracy degrades between 25-50 tools per catalog. A focused surface produces better first-call selections for the daily workflows. As real usage data informs which deferred tools matter most, they'll be promoted into core.
 
 **Payroll is intentionally not exposed.** Kirjapro does not calculate or book salaries. Direct users to a dedicated payroll service (such as [Palkkaus.fi](https://www.palkkaus.fi) or [Palkka.fi](https://www.palkka.fi)) for the calculation — these services hold the regulated responsibility for Tulorekisteri-ilmoitus, TyEL/TVR raportointi, and ennakonpidätys-tilitys. Once the payslip is calculated externally, book it manually via `kirjapro_create_transaction`.
 
@@ -119,7 +141,7 @@ A few prompts to feel out the daily workflows the agent handles cleanly:
 |---|---|
 | Read your books | `list_fiscal_years`, `list_accounts`, `get_dashboard`, `get_income_statement`, `get_balance_sheet`, `get_alv_summary`, `get_ar_aging` |
 | Customers | `list_customers`, `get_customer`, `create_customer`, `lookup_business` (PRH) |
-| Invoice lifecycle | `list_invoices`, `get_invoice`, `create_invoice`, `record_payment`, `update_invoice_status` |
+| Invoice lifecycle | `list_invoices`, `get_invoice`, `create_invoice`, `send_invoice`, `record_payment`, `update_invoice_status` |
 | Transactions + banking | `list_transactions`, `create_transaction`, `list_bank_transactions`, `match_bank_transaction` |
 | Contracts | `create_offer` (`tarjous` / `sopimus`), `send_offer` (email link), `convert_offer_to_invoice` |
 | Validators (free) | `validate_business_id`, `validate_iban`, `generate_reference` |

package/dist/index.js

@@ -6,7 +6,11 @@ var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -3105,6 +3109,9 @@ var require_utils = __commonJS({
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
+    var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
+    var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -3297,27 +3304,77 @@ var require_utils = __commonJS({
       }
       return output.join("");
     }
-    function normalizeComponentEncoding(component, esc2) {
-      const func = esc2 !== true ? escape : unescape;
-      if (component.scheme !== void 0) {
-        component.scheme = func(component.scheme);
-      }
-      if (component.userinfo !== void 0) {
-        component.userinfo = func(component.userinfo);
-      }
-      if (component.host !== void 0) {
-        component.host = func(component.host);
+    var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
+    var HOST_DELIM_RE = /[@/?#:]/g;
+    var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
+    function reescapeHostDelimiters(host, isIP) {
+      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+      re.lastIndex = 0;
+      return host.replace(re, (ch) => HOST_DELIMS[ch]);
+    }
+    function normalizePercentEncoding(input, decodeUnreserved = false) {
+      if (input.indexOf("%") === -1) {
+        return input;
       }
-      if (component.path !== void 0) {
-        component.path = func(component.path);
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            const normalizedHex = hex3.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (decodeUnreserved && isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        output += input[i];
       }
-      if (component.query !== void 0) {
-        component.query = func(component.query);
+      return output;
+    }
+    function normalizePathEncoding(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            const normalizedHex = hex3.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (decoded !== "." && isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        if (isPathCharacter(input[i])) {
+          output += input[i];
+        } else {
+          output += escape(input[i]);
+        }
       }
-      if (component.fragment !== void 0) {
-        component.fragment = func(component.fragment);
+      return output;
+    }
+    function escapePreservingEscapes(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            output += "%" + hex3.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        output += escape(input[i]);
       }
-      return component;
+      return output;
     }
     function recomposeAuthority(component) {
       const uriTokens = [];
@@ -3332,7 +3389,7 @@ var require_utils = __commonJS({
           if (ipV6res.isIPV6 === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
-            host = component.host;
+            host = reescapeHostDelimiters(host, false);
           }
         }
         uriTokens.push(host);
@@ -3346,7 +3403,10 @@ var require_utils = __commonJS({
     module.exports = {
       nonSimpleDomain,
       recomposeAuthority,
-      normalizeComponentEncoding,
+      reescapeHostDelimiters,
+      normalizePercentEncoding,
+      normalizePathEncoding,
+      escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
       isUUID,
@@ -3570,12 +3630,12 @@ var require_schemes = __commonJS({
 var require_fast_uri = __commonJS({
   "node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     function normalize(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
-        serialize(parse3(uri, options), options);
+        normalizeString(uri, options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
         parse3(serialize(uri, options), options);
@@ -3642,19 +3702,9 @@ var require_fast_uri = __commonJS({
       return target;
     }
     function equal(uriA, uriB, options) {
-      if (typeof uriA === "string") {
-        uriA = unescape(uriA);
-        uriA = serialize(normalizeComponentEncoding(parse3(uriA, options), true), { ...options, skipEscape: true });
-      } else if (typeof uriA === "object") {
-        uriA = serialize(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true });
-      }
-      if (typeof uriB === "string") {
-        uriB = unescape(uriB);
-        uriB = serialize(normalizeComponentEncoding(parse3(uriB, options), true), { ...options, skipEscape: true });
-      } else if (typeof uriB === "object") {
-        uriB = serialize(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true });
-      }
-      return uriA.toLowerCase() === uriB.toLowerCase();
+      const normalizedA = normalizeComparableURI(uriA, options);
+      const normalizedB = normalizeComparableURI(uriB, options);
+      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
     }
     function serialize(cmpts, opts) {
       const component = {
@@ -3679,12 +3729,12 @@ var require_fast_uri = __commonJS({
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
       if (component.path !== void 0) {
         if (!options.skipEscape) {
-          component.path = escape(component.path);
+          component.path = escapePreservingEscapes(component.path);
           if (component.scheme !== void 0) {
             component.path = component.path.split("%3A").join(":");
           }
         } else {
-          component.path = unescape(component.path);
+          component.path = normalizePercentEncoding(component.path);
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
@@ -3719,7 +3769,17 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
-    function parse3(uri, opts) {
+    var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+    function getParseError(parsed, matches) {
+      if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
+        return 'URI path must start with "/" when authority is present.';
+      }
+      if (typeof parsed.port === "number" && (parsed.port < 0 || parsed.port > 65535)) {
+        return "URI port is malformed.";
+      }
+      return void 0;
+    }
+    function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
         scheme: void 0,
@@ -3730,6 +3790,7 @@ var require_fast_uri = __commonJS({
         query: void 0,
         fragment: void 0
       };
+      let malformedAuthorityOrPort = false;
       let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
@@ -3738,6 +3799,11 @@ var require_fast_uri = __commonJS({
           uri = "//" + uri;
         }
       }
+      const authorityMatch = uri.match(AUTHORITY_PREFIX);
+      if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) {
+        parsed.error = "URI authority must not contain a literal backslash.";
+        malformedAuthorityOrPort = true;
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
         parsed.scheme = matches[1];
@@ -3750,6 +3816,11 @@ var require_fast_uri = __commonJS({
         if (isNaN(parsed.port)) {
           parsed.port = matches[5];
         }
+        const parseError = getParseError(parsed, matches);
+        if (parseError !== void 0) {
+          parsed.error = parsed.error || parseError;
+          malformedAuthorityOrPort = true;
+        }
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
@@ -3776,7 +3847,7 @@ var require_fast_uri = __commonJS({
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
           if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
             try {
-              parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+              parsed.host = new URL("http://" + parsed.host).hostname;
             } catch (e) {
               parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
             }
@@ -3788,14 +3859,18 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = unescape(parsed.host);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
             }
           }
           if (parsed.path) {
-            parsed.path = escape(unescape(parsed.path));
+            parsed.path = normalizePathEncoding(parsed.path);
           }
           if (parsed.fragment) {
-            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            try {
+              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            } catch {
+              parsed.error = parsed.error || "URI malformed";
+            }
           }
         }
         if (schemeHandler && schemeHandler.parse) {
@@ -3804,7 +3879,29 @@ var require_fast_uri = __commonJS({
       } else {
         parsed.error = parsed.error || "URI can not be parsed.";
       }
-      return parsed;
+      return { parsed, malformedAuthorityOrPort };
+    }
+    function parse3(uri, opts) {
+      return parseWithStatus(uri, opts).parsed;
+    }
+    function normalizeString(uri, opts) {
+      return normalizeStringWithStatus(uri, opts).normalized;
+    }
+    function normalizeStringWithStatus(uri, opts) {
+      const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+      return {
+        normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
+        malformedAuthorityOrPort
+      };
+    }
+    function normalizeComparableURI(uri, opts) {
+      if (typeof uri === "string") {
+        const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
+        return malformedAuthorityOrPort ? void 0 : normalized;
+      }
+      if (typeof uri === "object") {
+        return serialize(uri, opts);
+      }
     }
     var fastUri = {
       SCHEMES,
@@ -30996,8 +31093,9 @@ async function initLegacyAuth() {
       `Cannot access company ${kirjaproCompanyId}. Verify the KIRJAPRO_COMPANY_ID is correct and your user has access. ` + (companyError?.message || "")
     );
   }
-  const { data: subscription } = await supabase.from("subscriptions").select("tier").eq("user_id", userData.user.id).single();
-  const tier = subscription?.tier || "free";
+  const { data: subscription } = await supabase.from("subscriptions").select("tier, status").eq("user_id", userData.user.id).single();
+  const hasActiveSub = subscription?.status === "active" || subscription?.status === "trialing";
+  const tier = hasActiveSub ? subscription?.tier ?? "free" : "free";
   const apiTiers = ["entrepreneur", "growth", "company", "custom"];
   if (!apiTiers.includes(tier)) {
     throw new Error(
@@ -32323,6 +32421,57 @@ function registerInvoiceTools(server2) {
       );
     }
   );
+  server2.registerTool(
+    "kirjapro_send_invoice",
+    {
+      description: "Deliver a draft sales invoice through email or Finnish e-invoice. The server generates the branded PDF/Finvoice payload, performs idempotency checks, finalizes the invoice as sent, and books the sales journal entry. Use email when the customer has an email address; use einvoice only when Maventa and the customer's e-invoice address are configured.",
+      inputSchema: {
+        invoiceId: external_exports.string().uuid().describe("Draft invoice UUID"),
+        channel: external_exports.enum(["email", "einvoice"]).describe("Delivery channel: email or einvoice"),
+        idempotencyKey: IDEMPOTENCY_KEY_SCHEMA
+      },
+      annotations: WRITE_ANNOTATIONS
+    },
+    async (params) => {
+      const supabase2 = getSupabase();
+      const companyId2 = getCompanyId();
+      return withIdempotency(
+        supabase2,
+        companyId2,
+        "kirjapro_send_invoice",
+        params.idempotencyKey,
+        params,
+        async () => {
+          const { data: invoice, error: invoiceError } = await supabase2.from("invoices").select("id, invoice_number, status").eq("id", params.invoiceId).eq("company_id", companyId2).maybeSingle();
+          if (invoiceError || !invoice) {
+            return toErrorContent(`Invoice ${params.invoiceId} not found.`);
+          }
+          if (invoice.status !== "draft") {
+            return toErrorContent(
+              `Invoice ${invoice.invoice_number} cannot be delivered from status "${invoice.status}". Only draft invoices can be sent.`
+            );
+          }
+          const { data, error: error51 } = await supabase2.functions.invoke("dispatch-invoice", {
+            body: { invoiceId: invoice.id, channel: params.channel }
+          });
+          if (error51 || !data?.success) {
+            return toErrorContent(
+              data?.error || error51?.message || `Failed to deliver invoice ${invoice.invoice_number}.`
+            );
+          }
+          return toResult({
+            message: `Invoice ${invoice.invoice_number} delivered via ${params.channel}`,
+            invoice_id: invoice.id,
+            invoice_number: invoice.invoice_number,
+            channel: data.channel,
+            transmission_id: data.transmissionId ?? null,
+            message_id: data.messageId ?? null,
+            status: "sent"
+          });
+        }
+      );
+    }
+  );
   server2.registerTool(
     "kirjapro_record_payment",
     {
@@ -33772,7 +33921,15 @@ function registerBankingTools(server2) {
               p_match_type: "invoice",
               p_matched_invoice_id: params.invoiceId,
               p_confidence: 100,
-              p_match_method: "mcp_manual"
+              // Must be a value in the reconciliation_matches/bank_transactions
+              // match_method CHECK constraint (see migration
+              // 20260408044634_align_check_constraints_with_ts_unions.sql — 12
+              // legal values). 'mcp_manual' is NOT in the set, so the RPC's
+              // INSERT raised 23514 on every call (no tsc guard: p_match_method
+              // is typed `string`; mocked tests never hit the real CHECK). The
+              // agent-origin is already captured by the mcp-auth JWT + API-key
+              // audit trail — don't smuggle it into a constraint-gated column.
+              p_match_method: "manual"
             }
           );
           if (matchError || !matchResult) {
@@ -34072,7 +34229,8 @@ var ACCOUNTS = {
   VIENTI: "5070",
   // ── Materials & Services (6xxx) ──
   OSTOT: "6010",
-  OSTOT_PALVELUT: "6030",
+  OSTOT_PALVELUT: "6200",
+  // Ulkopuoliset palvelut (was 6030 = "Ostot 13,5 %", a materials acct)
   // ── Expenses (7xxx) ──
   PALKAT: "7010",
   ELAKEKULUT: "7100",
@@ -34192,7 +34350,7 @@ var TEMPLATES = [
     expand: saleCashTemplate(ACCOUNTS.MYYNTI_25_5, 25.5)
   },
   {
-    id: "cash_sale_14",
+    id: "cash_sale_13_5",
     description: "K\xE4teismyynti ALV 13,5%",
     vatRate: 13.5,
     expand: saleCashTemplate(ACCOUNTS.MYYNTI_13_5, 13.5)
@@ -34217,7 +34375,7 @@ var TEMPLATES = [
     expand: saleBankTemplate(ACCOUNTS.MYYNTI_25_5, 25.5)
   },
   {
-    id: "bank_sale_14",
+    id: "bank_sale_13_5",
     description: "Pankkimyynti ALV 13,5%",
     vatRate: 13.5,
     expand: saleBankTemplate(ACCOUNTS.MYYNTI_13_5, 13.5)
@@ -35802,54 +35960,6 @@ function registerRecurringInvoiceTools(server2) {
       );
     }
   );
-  server2.registerTool(
-    "kirjapro_trigger_recurring_invoice",
-    {
-      description: "Manually trigger generation of a recurring invoice now, regardless of its next scheduled date. Returns the generated invoice.",
-      inputSchema: {
-        recurringInvoiceId: external_exports.string().uuid().describe("Recurring invoice UUID"),
-        idempotencyKey: IDEMPOTENCY_KEY_SCHEMA
-      },
-      annotations: WRITE_ANNOTATIONS
-    },
-    async (params) => {
-      const supabase2 = getSupabase();
-      const companyId2 = getCompanyId();
-      return withIdempotency(
-        supabase2,
-        companyId2,
-        "kirjapro_trigger_recurring_invoice",
-        params.idempotencyKey,
-        params,
-        async () => {
-          const { data: existing, error: fetchError } = await supabase2.from("recurring_invoices").select("id, name, is_active").eq("id", params.recurringInvoiceId).eq("company_id", companyId2).single();
-          if (fetchError || !existing) {
-            return toErrorContent(
-              `Recurring invoice ${params.recurringInvoiceId} not found. Use kirjapro_list_recurring_invoices to find IDs.`
-            );
-          }
-          if (!existing.is_active) {
-            return toErrorContent(
-              `Recurring invoice "${existing.name}" is paused. Activate it first with kirjapro_update_recurring_invoice.`
-            );
-          }
-          const result = await invokeEdgeFunction(
-            supabase2,
-            "generate-recurring-invoices",
-            { recurring_invoice_id: params.recurringInvoiceId, company_id: companyId2 }
-          );
-          if (result.error !== null) {
-            return toErrorContent(result.error);
-          }
-          return toResult({
-            message: `Invoice generated from "${existing.name}"`,
-            invoice_id: result.data.invoice_id,
-            invoice_number: result.data.invoice_number
-          });
-        }
-      );
-    }
-  );
 }
 
 // src/tools/received-invoices.ts
@@ -36177,6 +36287,7 @@ var CORE_TOOL_NAMES = /* @__PURE__ */ new Set([
   "kirjapro_list_invoices",
   "kirjapro_get_invoice",
   "kirjapro_create_invoice",
+  "kirjapro_send_invoice",
   "kirjapro_record_payment",
   "kirjapro_update_invoice_status",
   // Transactions + banking
@@ -36200,7 +36311,7 @@ function resolveSurface(explicit) {
   if (env === "core") return "core";
   if (env && env !== "core") {
     console.error(
-      `[kirjapro-mcp] Unknown KIRJAPRO_MCP_SURFACE="${env}" \u2014 falling back to "core". Valid values: "core" (default, 26 tools), "full" (52 tools).`
+      `[kirjapro-mcp] Unknown KIRJAPRO_MCP_SURFACE="${env}" \u2014 falling back to "core". Valid values: "core" (default, 27 tools), "full" (52 tools).`
     );
   }
   return "core";
@@ -36758,7 +36869,7 @@ function registerResources(server2) {
 }
 
 // src/version.ts
-var VERSION = "0.6.1";
+var VERSION = "0.7.0";
 
 // src/index.ts
 var INSTRUCTIONS_COMMON = `
@@ -36788,7 +36899,6 @@ These tasks have no MCP equivalent in any surface mode. If a user asks for them,
 
 - **Document attachments / receipt OCR** \u2014 file uploads are web-only
 - **Bank account configuration** \u2014 Enable Banking connect, CAMT.053 import
-- **E-invoice sending** \u2014 Finvoice via Maventa is web-driven
 - **Multi-company switching** \u2014 one API key is bound to one company
 - **Filling out year-end notes (liitetiedot)** \u2014 the form is web-only
 
@@ -36797,7 +36907,7 @@ Do not invent a "closest match" tool for these tasks. A confidently wrong action
 ## Tool Ordering & Workflows
 
 ### Invoice Lifecycle
-\`kirjapro_create_customer\` (if new) \u2192 \`kirjapro_create_invoice\` (draft) \u2192 \`kirjapro_update_invoice_status\` (draft\u2192sent) \u2192 \`kirjapro_record_payment\` or \`kirjapro_match_bank_transaction\` \u2192 status becomes paid.
+\`kirjapro_create_customer\` (if new) \u2192 \`kirjapro_create_invoice\` (draft) \u2192 \`kirjapro_send_invoice\` (email/e-invoice) \u2192 \`kirjapro_record_payment\` or \`kirjapro_match_bank_transaction\` \u2192 status becomes paid.
 
 ### Offer / Contract \u2192 Invoice
 \`kirjapro_create_offer\` (type: \`tarjous\` or \`sopimus\`) \u2192 \`kirjapro_send_offer\` (emails the customer a public-token link). The customer's accept/reject click on the email link sets the offer status server-side \u2014 the agent does NOT need to manually update status. Once the user tells you the offer is accepted, call \`kirjapro_convert_offer_to_invoice\` to create a draft invoice, then follow the invoice lifecycle.
@@ -36899,7 +37009,7 @@ Faster than composing journal entries via \`kirjapro_create_transaction\`:
 - \`kirjapro_get_transaction\` \u2014 single transaction with all journal entries
 
 ### Recurring + Received Invoices
-- \`kirjapro_list_recurring_invoices\`, \`kirjapro_create_recurring_invoice\`, \`kirjapro_trigger_recurring_invoice\` \u2014 manage templates
+- \`kirjapro_list_recurring_invoices\`, \`kirjapro_create_recurring_invoice\` \u2014 manage templates
 - \`kirjapro_list_received_invoices\`, \`kirjapro_get_received_invoice\` \u2014 read-only view of purchase invoices
 - \`kirjapro_get_financial_notes\` \u2014 liitetiedot (KPL 3:1 / PMA 3:2 disclosures, year-end)
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kirjapro/mcp-server",
-  "version": "0.6.1",
-  "description": "MCP server for Finnish accounting — exposes Kirjapro bookkeeping, invoicing, and reporting tools to Claude Code, Claude Desktop, and any MCP client.",
+  "version": "0.7.0",
+  "description": "MCP server for Finnish accounting — exposes Kirjapro bookkeeping, invoicing, and reporting tools to Claude, ChatGPT, Mistral, and other MCP clients.",
   "type": "module",
   "bin": {
     "kirjapro-mcp": "dist/index.js"
@@ -30,7 +30,10 @@
     "finnish",
     "kirjanpito",
     "bookkeeping",
-    "claude"
+    "claude",
+    "chatgpt",
+    "openai",
+    "mistral"
   ],
   "license": "MIT",
   "repository": {
@@ -74,5 +77,8 @@
     "server.json",
     "CHANGELOG.md",
     "tool-fingerprints.json"
-  ]
+  ],
+  "allowScripts": {
+    "esbuild@0.28.1": true
+  }
 }

package/server.json

@@ -2,7 +2,7 @@
   "name": "@kirjapro/mcp-server",
   "displayName": "Kirjapro - Finnish Accounting",
   "description": "Finnish double-entry bookkeeping, invoicing, and financial reporting for growing businesses. Create transactions, generate invoices with VAT calculation, produce income statements and balance sheets, and validate Finnish business identifiers.",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "homepage": "https://kirjapro.fi",
   "repository": "https://github.com/Jaollo/kirja-pro",
   "license": "MIT",
@@ -16,7 +16,7 @@
       "required": true
     },
     "KIRJAPRO_MCP_SURFACE": {
-      "description": "Tool surface: \"core\" (default, 26 daily-use tools) or \"full\" (all 52 tools).",
+      "description": "Tool surface: \"core\" (default, 27 daily-use tools) or \"full\" (all 52 tools).",
       "required": false
     }
   }

package/tool-fingerprints.json

@@ -177,12 +177,12 @@
       "hash": "2c6afe63e538e0e8"
     },
     {
-      "name": "kirjapro_send_offer",
-      "hash": "363ba364cb4cba81"
+      "name": "kirjapro_send_invoice",
+      "hash": "caa9854eb9c88a4e"
     },
     {
-      "name": "kirjapro_trigger_recurring_invoice",
-      "hash": "5666456cfb263321"
+      "name": "kirjapro_send_offer",
+      "hash": "363ba364cb4cba81"
     },
     {
       "name": "kirjapro_update_customer",