@kirjapro/mcp-server 0.6.3 → 0.8.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kirjapro/mcp-server",
-  "version": "0.6.3",
-  "description": "MCP server for Finnish accounting — exposes Kirjapro bookkeeping, invoicing, and reporting tools to Claude Code, Claude Desktop, and any MCP client.",
+  "version": "0.8.0",
+  "description": "MCP server for Finnish accounting — exposes Kirjapro bookkeeping, invoicing, and reporting tools to Claude, ChatGPT, Mistral, and other MCP clients.",
   "type": "module",
   "bin": {
     "kirjapro-mcp": "dist/index.js"
@@ -30,7 +30,10 @@
     "finnish",
     "kirjanpito",
     "bookkeeping",
-    "claude"
+    "claude",
+    "chatgpt",
+    "openai",
+    "mistral"
   ],
   "license": "MIT",
   "repository": {
@@ -74,5 +77,8 @@
     "server.json",
     "CHANGELOG.md",
     "tool-fingerprints.json"
-  ]
+  ],
+  "allowScripts": {
+    "esbuild@0.28.1": true
+  }
 }

package/server.json

@@ -2,7 +2,7 @@
   "name": "@kirjapro/mcp-server",
   "displayName": "Kirjapro - Finnish Accounting",
   "description": "Finnish double-entry bookkeeping, invoicing, and financial reporting for growing businesses. Create transactions, generate invoices with VAT calculation, produce income statements and balance sheets, and validate Finnish business identifiers.",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "homepage": "https://kirjapro.fi",
   "repository": "https://github.com/Jaollo/kirja-pro",
   "license": "MIT",
@@ -16,7 +16,11 @@
       "required": true
     },
     "KIRJAPRO_MCP_SURFACE": {
-      "description": "Tool surface: \"core\" (default, 26 daily-use tools) or \"full\" (all 52 tools).",
+      "description": "Tool surface: \"core\" (default, 27 daily-use tools) or \"full\" (all 52 tools).",
+      "required": false
+    },
+    "KIRJAPRO_TELEMETRY": {
+      "description": "First-party operational metadata attributed to the company/API key (default on). Set to false to opt out; arguments and results are never sent.",
       "required": false
     }
   }

package/tool-fingerprints.json

@@ -2,207 +2,211 @@
   "fingerprints": [
     {
       "name": "kirjapro_book_purchase",
-      "hash": "ddb30ea742fd64ef"
+      "hash": "21897b2fd6bd8809"
     },
     {
       "name": "kirjapro_book_sale",
-      "hash": "9ce00f1687fc23e0"
+      "hash": "a7ad4daef0e9947b"
     },
     {
       "name": "kirjapro_book_vat_settlement",
-      "hash": "f40e4169493e0557"
+      "hash": "48ab541acbce9e66"
     },
     {
       "name": "kirjapro_convert_offer_to_invoice",
-      "hash": "04dab36268da64df"
+      "hash": "d4873b388fdd1e16"
     },
     {
       "name": "kirjapro_create_customer",
-      "hash": "7b616c8ca38f3eb4"
+      "hash": "d382f2e3ea84fe5b"
     },
     {
       "name": "kirjapro_create_from_template",
-      "hash": "d5544fb7b65148b4"
+      "hash": "62d7241dbdba511c"
     },
     {
       "name": "kirjapro_create_from_template_batch",
-      "hash": "a6290b31dc0a430e"
+      "hash": "f10cad13dc519c7c"
     },
     {
       "name": "kirjapro_create_invoice",
-      "hash": "e9845043b62de019"
+      "hash": "94cdf7ec101a6b74"
     },
     {
       "name": "kirjapro_create_offer",
-      "hash": "8233acaf2cb9c212"
+      "hash": "c86cde0b4bff6e46"
     },
     {
       "name": "kirjapro_create_recurring_invoice",
-      "hash": "1b600c2f29000b48"
+      "hash": "49732c922c66ea55"
     },
     {
       "name": "kirjapro_create_transaction",
-      "hash": "c54ff7f1258036cf"
+      "hash": "88b052da9babfc50"
     },
     {
       "name": "kirjapro_create_transactions_batch",
-      "hash": "35c6a2e1b60f0ec0"
+      "hash": "da853c41adf6e4dd"
     },
     {
       "name": "kirjapro_delete_invoice",
-      "hash": "e9b3dca7fb361763"
+      "hash": "5fe36a25590a8494"
     },
     {
       "name": "kirjapro_delete_offer",
-      "hash": "aada845caa19d45f"
+      "hash": "9134fb798c745d2d"
     },
     {
       "name": "kirjapro_delete_recurring_invoice",
-      "hash": "9555352655837d73"
+      "hash": "ebc063d2d2551dfd"
     },
     {
       "name": "kirjapro_generate_reference",
-      "hash": "0e616015d5f5a4f2"
+      "hash": "1a7d5bf6cd61e3f4"
     },
     {
       "name": "kirjapro_get_alv_summary",
-      "hash": "f36b009641a17c59"
+      "hash": "139628cea5a3df31"
     },
     {
       "name": "kirjapro_get_ar_aging",
-      "hash": "9601f79d7db1a35b"
+      "hash": "a464f8e3e9efbd1f"
     },
     {
       "name": "kirjapro_get_balance_sheet",
-      "hash": "56a22899912ffd12"
+      "hash": "aed695790d4da869"
     },
     {
       "name": "kirjapro_get_customer",
-      "hash": "39c9a6f9b0446f19"
+      "hash": "cdd2e39e19f61c8d"
     },
     {
       "name": "kirjapro_get_dashboard",
-      "hash": "c83a87bcdc6523f8"
+      "hash": "3d1f3f399e400628"
     },
     {
       "name": "kirjapro_get_financial_notes",
-      "hash": "477d0c8c04cfd0b2"
+      "hash": "316891e91e4a8698"
     },
     {
       "name": "kirjapro_get_general_ledger",
-      "hash": "bada080775580e51"
+      "hash": "fe253675298e02f6"
     },
     {
       "name": "kirjapro_get_income_statement",
-      "hash": "b1b464406991a361"
+      "hash": "73686bc7a3aa90e8"
     },
     {
       "name": "kirjapro_get_invoice",
-      "hash": "9f8f69f9f5646def"
+      "hash": "2bb3ae27a2136c28"
     },
     {
       "name": "kirjapro_get_offer",
-      "hash": "3fea3e2c4fd188ec"
+      "hash": "bfe46a1864c4d14f"
     },
     {
       "name": "kirjapro_get_received_invoice",
-      "hash": "b0ba869440b8318b"
+      "hash": "2f811b393288346a"
     },
     {
       "name": "kirjapro_get_recurring_invoice",
-      "hash": "16b2137a601da075"
+      "hash": "829312eba65633d4"
     },
     {
       "name": "kirjapro_get_transaction",
-      "hash": "a1d566d6590bd988"
+      "hash": "93acf150d5b45774"
     },
     {
       "name": "kirjapro_list_accounts",
-      "hash": "d6f1b1de2ce6ff72"
+      "hash": "9e6a405ee8cff0b0"
     },
     {
       "name": "kirjapro_list_bank_accounts",
-      "hash": "073893513a866469"
+      "hash": "f2d180b545f08c9d"
     },
     {
       "name": "kirjapro_list_bank_transactions",
-      "hash": "25f103b3515af680"
+      "hash": "30ca863fb3d5d31d"
     },
     {
       "name": "kirjapro_list_customers",
-      "hash": "10e3851faf9980a8"
+      "hash": "c62ec9d70a7f8a20"
     },
     {
       "name": "kirjapro_list_fiscal_years",
-      "hash": "ee5c509c5d88c0e4"
+      "hash": "c705a269c962276a"
     },
     {
       "name": "kirjapro_list_invoices",
-      "hash": "a74c83969ca428af"
+      "hash": "30146c7b6bcea7c2"
     },
     {
       "name": "kirjapro_list_offers",
-      "hash": "31679473cc8afb1b"
+      "hash": "eae55636427f4cf0"
     },
     {
       "name": "kirjapro_list_received_invoices",
-      "hash": "a9caf9458f2aab6c"
+      "hash": "02c27793894292dc"
     },
     {
       "name": "kirjapro_list_recurring_invoices",
-      "hash": "8f0baf7557842360"
+      "hash": "38c9d669f87f939f"
     },
     {
       "name": "kirjapro_list_templates",
-      "hash": "dd3d7e1221e657a3"
+      "hash": "97a385984b65329e"
     },
     {
       "name": "kirjapro_list_transactions",
-      "hash": "acaa9235ab2d4b07"
+      "hash": "657aa2665aeaceb6"
     },
     {
       "name": "kirjapro_lookup_business",
-      "hash": "7371b3ee63037037"
+      "hash": "a2bfa16d727293c1"
     },
     {
       "name": "kirjapro_match_bank_transaction",
-      "hash": "c3ada52caa379518"
+      "hash": "d2ea52636cb0bdb3"
     },
     {
       "name": "kirjapro_record_payment",
-      "hash": "f889803ddba97cba"
+      "hash": "be17f36d07cf7b41"
     },
     {
       "name": "kirjapro_search_transactions",
-      "hash": "2c6afe63e538e0e8"
+      "hash": "9813b26329bfbeba"
+    },
+    {
+      "name": "kirjapro_send_invoice",
+      "hash": "ec584d23c747d458"
     },
     {
       "name": "kirjapro_send_offer",
-      "hash": "363ba364cb4cba81"
+      "hash": "e515ef53ccb2d0b6"
     },
     {
       "name": "kirjapro_update_customer",
-      "hash": "f381091d34a3723d"
+      "hash": "1e7215f8860013d9"
     },
     {
       "name": "kirjapro_update_invoice_status",
-      "hash": "188f0fdacf8b2ba0"
+      "hash": "a459597647665a70"
     },
     {
       "name": "kirjapro_update_offer_status",
-      "hash": "7eec2e13f8e8f866"
+      "hash": "8e59d492424854ea"
     },
     {
       "name": "kirjapro_update_recurring_invoice",
-      "hash": "ffc77d2d6f71ac77"
+      "hash": "44b516ba8a070796"
     },
     {
       "name": "kirjapro_validate_business_id",
-      "hash": "f6c099222e793332"
+      "hash": "529251f6d37c64f5"
     },
     {
       "name": "kirjapro_validate_iban",
-      "hash": "b1422a07075b34e9"
+      "hash": "d0acc26c1d1e2ba3"
     }
   ]
 }

package/dist/accounts.d.ts

@@ -1,40 +0,0 @@
-/**
- * Standard Finnish Chart of Accounts (YSE 2017) — commonly used account constants.
- *
- * MIRROR of src/lib/accounts.ts — kept in sync via mcp-server/src/accounts.test.ts.
- * Do not modify without updating the source file.
- */
-export declare const ACCOUNTS: {
-    readonly MYYNTISAAMISET: "2210";
-    readonly ALV_SAAMISET: "2320";
-    readonly KASSA: "2910";
-    readonly PANKKITILI: "2920";
-    readonly OSTOVELAT: "4130";
-    readonly ALV_VELKA: "4210";
-    readonly ENNAKONPIDATYSVELKA: "4220";
-    readonly TYEL_VELKA: "4240";
-    readonly SOTU_VELKA: "4230";
-    readonly TTV_VELKA: "4250";
-    readonly PALKKAVELKA: "4420";
-    readonly MYYNTI_25_5: "5010";
-    readonly MYYNTI_13_5: "5020";
-    readonly MYYNTI_10: "5030";
-    readonly MYYNTI_0: "5040";
-    readonly EU_TAVARAT: "5050";
-    readonly EU_PALVELUT: "5060";
-    readonly VIENTI: "5070";
-    readonly OSTOT: "6010";
-    readonly OSTOT_PALVELUT: "6030";
-    readonly PALKAT: "7010";
-    readonly ELAKEKULUT: "7100";
-    readonly SOSIAALITURVAMAKSUT: "7210";
-    readonly TOIMITILAVUOKRAT: "7420";
-    readonly SAHKO: "7510";
-    readonly POLTTOAINEET: "7610";
-    readonly EDUSTUSKULUT: "7810";
-    readonly PUHELIN: "7951";
-    readonly TOIMISTOTARVIKKEET: "7952";
-    readonly OHJELMISTOT: "7954";
-    readonly PANKKIKULUT: "7957";
-    readonly VAKUUTUKSET: "7970";
-};

package/dist/accounts.js

@@ -1,45 +0,0 @@
-/**
- * Standard Finnish Chart of Accounts (YSE 2017) — commonly used account constants.
- *
- * MIRROR of src/lib/accounts.ts — kept in sync via mcp-server/src/accounts.test.ts.
- * Do not modify without updating the source file.
- */
-export const ACCOUNTS = {
-    // ── Assets (2xxx) ──
-    MYYNTISAAMISET: '2210',
-    ALV_SAAMISET: '2320',
-    KASSA: '2910',
-    PANKKITILI: '2920',
-    // ── Liabilities (4xxx) ──
-    OSTOVELAT: '4130',
-    ALV_VELKA: '4210',
-    ENNAKONPIDATYSVELKA: '4220',
-    TYEL_VELKA: '4240',
-    SOTU_VELKA: '4230',
-    TTV_VELKA: '4250',
-    PALKKAVELKA: '4420',
-    // ── Revenue (5xxx) ──
-    MYYNTI_25_5: '5010',
-    MYYNTI_13_5: '5020',
-    MYYNTI_10: '5030',
-    MYYNTI_0: '5040',
-    EU_TAVARAT: '5050',
-    EU_PALVELUT: '5060',
-    VIENTI: '5070',
-    // ── Materials & Services (6xxx) ──
-    OSTOT: '6010',
-    OSTOT_PALVELUT: '6030',
-    // ── Expenses (7xxx) ──
-    PALKAT: '7010',
-    ELAKEKULUT: '7100',
-    SOSIAALITURVAMAKSUT: '7210',
-    TOIMITILAVUOKRAT: '7420',
-    SAHKO: '7510',
-    POLTTOAINEET: '7610',
-    EDUSTUSKULUT: '7810',
-    PUHELIN: '7951',
-    TOIMISTOTARVIKKEET: '7952',
-    OHJELMISTOT: '7954',
-    PANKKIKULUT: '7957',
-    VAKUUTUKSET: '7970',
-};

package/dist/auth.d.ts

@@ -1,17 +0,0 @@
-import { SupabaseClient } from '@supabase/supabase-js';
-import type { Database } from './database.types.js';
-/**
- * Cancel any pending token refresh and release the event loop.
- * Call from `transport.onclose` so the MCP process exits cleanly.
- */
-export declare function stopTokenRefresh(): void;
-/**
- * Initialize authenticated Supabase client.
- *
- * Supports two auth modes:
- * 1. API key (recommended): Set KIRJAPRO_API_KEY
- * 2. Legacy (development): Set SUPABASE_URL + SUPABASE_ACCESS_TOKEN + KIRJAPRO_COMPANY_ID
- */
-export declare function initAuth(): Promise<void>;
-export declare function getSupabase(): SupabaseClient<Database>;
-export declare function getCompanyId(): string;

package/dist/auth.js

@@ -1,245 +0,0 @@
-import { createClient } from '@supabase/supabase-js';
-const SUPABASE_PROJECT_URL = 'https://tifewzsimmyoiepblhld.supabase.co';
-let supabase = null;
-let companyId = null;
-let refreshTimer = null;
-/**
- * Authenticate via API key by calling the mcp-auth edge function.
- * Returns the auth response containing a short-lived JWT.
- */
-async function authenticateWithApiKey(apiKey) {
-    const url = `${SUPABASE_PROJECT_URL}/functions/v1/mcp-auth`;
-    const response = await fetch(url, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ api_key: apiKey }),
-    });
-    if (!response.ok) {
-        const body = await response.json().catch(() => ({ error: 'Unknown error' }));
-        throw new Error(`API key authentication failed (${response.status}): ${body.error || 'Unknown error'}`);
-    }
-    return response.json();
-}
-/**
- * Create a Supabase client from an mcp-auth response.
- */
-function createClientFromAuth(auth) {
-    return createClient(auth.supabase_url, auth.anon_key, {
-        auth: {
-            persistSession: false,
-            autoRefreshToken: false,
-        },
-        global: {
-            headers: {
-                Authorization: `Bearer ${auth.access_token}`,
-            },
-        },
-    });
-}
-/**
- * Schedule automatic token refresh before the JWT expires.
- *
- * Hardening (see audit M2):
- * - Jitter 75–90% of TTL: multiple concurrent agents sharing one API key
- *   don't hit `mcp-auth` in lockstep (10 req/min rate limit).
- * - Recursive `setTimeout`: re-arms with the *new* `expires_in` after every
- *   successful refresh (can't do that with `setInterval`).
- * - Exponential backoff (capped at 60s, jittered) on refresh failure.
- * - `.unref()`: doesn't keep the event loop alive if stdio transport closes.
- */
-function scheduleTokenRefresh(apiKey, expiresIn) {
-    if (refreshTimer) {
-        clearTimeout(refreshTimer);
-    }
-    const ttlMs = expiresIn * 1000;
-    // Refresh at 75–90% of TTL, clamped to [60s, ttl-60s]
-    const target = ttlMs * (0.75 + Math.random() * 0.15);
-    const refreshMs = Math.max(60_000, Math.min(target, ttlMs - 60_000));
-    const tick = async (attempt) => {
-        try {
-            console.error('[kirjapro-mcp] Refreshing API key token...');
-            const auth = await authenticateWithApiKey(apiKey);
-            supabase = createClientFromAuth(auth);
-            companyId = auth.company_id;
-            console.error('[kirjapro-mcp] Token refreshed successfully');
-            scheduleTokenRefresh(apiKey, auth.expires_in);
-        }
-        catch (error) {
-            console.error('[kirjapro-mcp] Token refresh failed:', error.message);
-            // Exponential backoff with jitter: 1s, 2s, 4s, …, capped at 60s.
-            const backoff = Math.min(60_000, 2 ** attempt * 1000) + Math.random() * 1000;
-            refreshTimer = setTimeout(() => {
-                void tick(attempt + 1);
-            }, backoff);
-            refreshTimer.unref?.();
-        }
-    };
-    refreshTimer = setTimeout(() => {
-        void tick(0);
-    }, refreshMs);
-    refreshTimer.unref?.();
-}
-/**
- * Cancel any pending token refresh and release the event loop.
- * Call from `transport.onclose` so the MCP process exits cleanly.
- */
-export function stopTokenRefresh() {
-    if (refreshTimer) {
-        clearTimeout(refreshTimer);
-        refreshTimer = null;
-    }
-}
-/**
- * Initialize using KIRJAPRO_API_KEY (recommended).
- * Calls the mcp-auth edge function to exchange the API key for a JWT.
- */
-async function initApiKeyAuth(apiKey) {
-    const auth = await authenticateWithApiKey(apiKey);
-    supabase = createClientFromAuth(auth);
-    companyId = auth.company_id;
-    // Validate the connection by fetching company info
-    const { data: company, error: companyError } = await supabase
-        .from('companies')
-        .select('id, name')
-        .eq('id', companyId)
-        .single();
-    if (companyError || !company) {
-        throw new Error(`Cannot access company ${companyId}. ${companyError?.message || ''}`);
-    }
-    console.error(`[kirjapro-mcp] Authenticated via API key | Company: ${company.name}`);
-    // Schedule automatic token refresh
-    scheduleTokenRefresh(apiKey, auth.expires_in);
-}
-/**
- * Initialize using legacy env vars (for development).
- * Requires SUPABASE_URL, SUPABASE_ACCESS_TOKEN, KIRJAPRO_COMPANY_ID.
- */
-async function initLegacyAuth() {
-    const supabaseUrl = process.env.SUPABASE_URL;
-    const supabaseAccessToken = process.env.SUPABASE_ACCESS_TOKEN;
-    const kirjaproCompanyId = process.env.KIRJAPRO_COMPANY_ID;
-    if (!supabaseUrl) {
-        throw new Error('SUPABASE_URL environment variable is required.');
-    }
-    if (!supabaseAccessToken) {
-        throw new Error('SUPABASE_ACCESS_TOKEN environment variable is required.');
-    }
-    if (!kirjaproCompanyId) {
-        throw new Error('KIRJAPRO_COMPANY_ID environment variable is required.');
-    }
-    // Use anon key if available, otherwise fall back to access token (works but semantically wrong)
-    const anonKey = process.env.SUPABASE_ANON_KEY || supabaseAccessToken;
-    supabase = createClient(supabaseUrl, anonKey, {
-        auth: {
-            persistSession: false,
-            autoRefreshToken: false,
-        },
-        global: {
-            headers: {
-                Authorization: `Bearer ${supabaseAccessToken}`,
-            },
-        },
-    });
-    // Validate the token
-    const { data: userData, error: authError } = await supabase.auth.getUser();
-    if (authError || !userData.user) {
-        throw new Error('Failed to authenticate with Supabase. ' +
-            'Token may be expired. Refresh your access token and restart the MCP server. ' +
-            (authError?.message || ''));
-    }
-    // Verify company access
-    const { data: company, error: companyError } = await supabase
-        .from('companies')
-        .select('id, name')
-        .eq('id', kirjaproCompanyId)
-        .single();
-    if (companyError || !company) {
-        throw new Error(`Cannot access company ${kirjaproCompanyId}. ` +
-            'Verify the KIRJAPRO_COMPANY_ID is correct and your user has access. ' +
-            (companyError?.message || ''));
-    }
-    // Check subscription tier for API access (subscriptions are user-keyed)
-    const { data: subscription } = await supabase
-        .from('subscriptions')
-        .select('tier')
-        .eq('user_id', userData.user.id)
-        .single();
-    const tier = subscription?.tier || 'free';
-    // Keep in sync with feature-gates.ts (hasApiAccess) + supabase/functions/mcp-auth.
-    // 'growth' (Kasvu) is a paid tier with API access — DT-073.
-    const apiTiers = ['entrepreneur', 'growth', 'company', 'custom'];
-    if (!apiTiers.includes(tier)) {
-        throw new Error(`API access requires a Yrittäjä, Kasvu, Tilitoimisto, or Räätälöity subscription. ` +
-            `Current tier: ${tier}. Upgrade at https://kirjapro.fi/settings/billing`);
-    }
-    companyId = kirjaproCompanyId;
-    console.error(`[kirjapro-mcp] Authenticated | Company: ${company.name} | Tier: ${tier}`);
-    // Parse JWT exp and schedule an expiry warning — legacy auth has no
-    // refresh path, so warn the user before the session silently dies.
-    try {
-        const payload = JSON.parse(Buffer.from(supabaseAccessToken.split('.')[1], 'base64url').toString());
-        if (typeof payload.exp === 'number') {
-            const expiresInMs = payload.exp * 1000 - Date.now();
-            if (expiresInMs > 0 && expiresInMs < 24 * 60 * 60 * 1000) {
-                const warnMs = Math.max(0, expiresInMs - 5 * 60 * 1000);
-                const timer = setTimeout(() => {
-                    console.error('[kirjapro-mcp] WARNING: Legacy auth token expires in ~5 minutes. ' +
-                        'Restart with a fresh token or switch to KIRJAPRO_API_KEY for automatic refresh.');
-                }, warnMs);
-                timer.unref?.();
-                console.error(`[kirjapro-mcp] Token expires in ${Math.round(expiresInMs / 60_000)} minutes. ` +
-                    'Consider switching to KIRJAPRO_API_KEY for automatic refresh.');
-            }
-        }
-    }
-    catch {
-        // Not a JWT or unparseable — service_role keys don't expire
-    }
-}
-/**
- * Initialize authenticated Supabase client.
- *
- * Supports two auth modes:
- * 1. API key (recommended): Set KIRJAPRO_API_KEY
- * 2. Legacy (development): Set SUPABASE_URL + SUPABASE_ACCESS_TOKEN + KIRJAPRO_COMPANY_ID
- */
-export async function initAuth() {
-    const apiKey = process.env.KIRJAPRO_API_KEY;
-    if (apiKey) {
-        if (!apiKey.startsWith('kp_')) {
-            throw new Error('Invalid KIRJAPRO_API_KEY format. Keys start with "kp_". ' +
-                'Generate one at https://kirjapro.fi/settings/api-keys');
-        }
-        await initApiKeyAuth(apiKey);
-        return;
-    }
-    // Legacy env vars present?
-    if (process.env.SUPABASE_URL && process.env.SUPABASE_ACCESS_TOKEN && process.env.KIRJAPRO_COMPANY_ID) {
-        if (process.env.ALLOW_LEGACY_AUTH !== 'true') {
-            throw new Error('Legacy auth (SUPABASE_URL + SUPABASE_ACCESS_TOKEN + KIRJAPRO_COMPANY_ID) is disabled.\n\n' +
-                'Legacy auth bypasses the mcp-auth exchange — no audit log, no IP trail, no key rotation signal.\n' +
-                'Switch to KIRJAPRO_API_KEY: generate a key at https://kirjapro.fi/settings/api-keys.\n\n' +
-                'If you must use legacy auth temporarily (e.g. local development against a dev project),\n' +
-                'set ALLOW_LEGACY_AUTH=true to opt in. This path will be removed in a future release.');
-        }
-        console.error('[kirjapro-mcp] WARNING: Using legacy auth. This bypasses audit logging and will be removed ' +
-            'in a future release. Migrate to KIRJAPRO_API_KEY: https://kirjapro.fi/settings/api-keys');
-        await initLegacyAuth();
-        return;
-    }
-    throw new Error('Missing authentication configuration.\n\n' +
-        'Set KIRJAPRO_API_KEY (recommended):\n' +
-        '  Generate an API key at https://kirjapro.fi/settings/api-keys');
-}
-export function getSupabase() {
-    if (!supabase) {
-        throw new Error('Supabase client not initialized. Call initAuth() first.');
-    }
-    return supabase;
-}
-export function getCompanyId() {
-    if (!companyId) {
-        throw new Error('Company ID not set. Call initAuth() first.');
-    }
-    return companyId;
-}