Add/ai native supp (#385)

* feat(branding): implement dynamic branding in service worker and reports

* feat(auth): enhance API key scopes and add bookkeeping write scope

- Updated transaction write scope description to include additional tools.
- Enhanced reports read scope description to reflect new functionality.
- Introduced bookkeeping write scope with relevant description.
- Updated SCOPE_GROUPS to include bookkeeping domain.
- Modified TOOL_SCOPE_MAP to include new bookkeeping operations.
- Updated validateApiKey function to return api_key_id and api_key_name for better actor attribution.

feat(tests): add unit tests for MCP resource registry

- Created tests for data resources to ensure all required fields are present.
- Added tests for resource query parsing and retrieval.

feat(resources): implement MCP resources for company and accounting data

- Added capabilities resource to expose API key capabilities based on granted scopes.
- Implemented chart of accounts resource to retrieve active BAS chart.
- Created company current resource to fetch active company details.
- Developed active fiscal period resource to check posting eligibility.
- Implemented recent activity resource to fetch latest journal entries, invoices, and transactions.
- Added VAT treatments resource to provide available VAT rates per customer type.

feat(pending-operations): introduce risk tiers for operations

- Added risk level classification for pending operations to determine auto-commit eligibility.
- Implemented functions to classify operation risk levels and identify high-risk operations.

feat(migrations): add actor model and risk tier to pending operations

- Updated pending_operations table to include actor type and risk level columns.
- Enhanced audit_log to mirror actor information for compliance.
- Modified validate_and_increment_api_key function to return actor details.
- Expanded operation types in pending_operations to include new high-risk operations.

* feat: add auto-commit functionality for low-risk pending operations

- Implemented shouldAutoCommit function to determine eligibility for auto-commit based on operation type, actor type, and company settings.
- Created commitPendingOperation function to handle execution of pending operations with consistent status updates.
- Added tests for shouldAutoCommit to cover various scenarios including high-risk operations, user actors, company opt-in status, and monetary thresholds.
- Introduced new columns in company_settings for agent_auto_commit_enabled and agent_auto_commit_max_amount to allow companies to opt-in for auto-commit functionality.
- Added SQL migration to update the database schema for new auto-commit settings.

* feat(idempotency): implement idempotency key handling for safe retries and cleanup

* feat: expand API key scopes and pending operations for bookkeeping

- Added 'suppliers:write' scope to API key scopes for supplier invoice management.
- Updated SCOPE_GROUPS to include the new 'suppliers:write' scope.
- Introduced new pending operation types for bookkeeping: close_period, lock_period, run_year_end, set_opening_balances, run_currency_revaluation, explain_voucher_gap, uncategorize_transaction, approve_supplier_invoice, credit_supplier_invoice, and convert_invoice.
- Implemented corresponding commit functions for the new operations in the pending operations module.
- Enhanced PendingOperation type to include actor model and risk level attributes.
- Added tests for new functionality, ensuring proper behavior and constraints in the database.

* feat: implement unlockPeriod functionality and related tests

* feat: add agent auto-commit settings and related functionality

* feat: add attention resource with comprehensive summary of outstanding tasks

* feat: enhance pending operations with 'committing' status and immutability checks, improve idempotency handling, and add original voucher reference for credit notes

types/index.ts

@@ -262,6 +262,12 @@ export interface CompanySettings {
   ai_flow_enabled: boolean
   ai_backfill_cancel_requested: boolean
 
+  // Agent auto-commit. When enabled, low-risk pending_operations staged by
+  // trusted agents (api_key, mcp_oauth) skip human review. High-risk ops
+  // (period close, year-end, send_invoice, etc.) always require approval.
+  agent_auto_commit_enabled: boolean
+  agent_auto_commit_max_amount: number | null
+
   // Timestamps
   created_at: string
   updated_at: string
@@ -1310,8 +1316,37 @@ export interface CreateFiscalPeriodInput {
 
 // ── Pending Operations ────────────────────────────────────────
 
-export type PendingOperationType = 'categorize_transaction' | 'create_customer' | 'create_invoice' | 'mark_invoice_paid' | 'send_invoice' | 'mark_invoice_sent' | 'match_transaction_invoice'
-export type PendingOperationStatus = 'pending' | 'committed' | 'rejected'
+export type PendingOperationType =
+  | 'categorize_transaction'
+  | 'create_customer'
+  | 'create_invoice'
+  | 'mark_invoice_paid'
+  | 'send_invoice'
+  | 'mark_invoice_sent'
+  | 'match_transaction_invoice'
+  // Stream 1 Phase 1: bookkeeping period operations
+  | 'close_period'
+  | 'lock_period'
+  | 'unlock_period'
+  | 'set_opening_balances'
+  | 'run_year_end'
+  | 'run_currency_revaluation'
+  // Stream 1 Phase 1: SIE import (export is read-only)
+  | 'import_sie'
+  // Stream 1 Phase 1: voucher gap explanations
+  | 'explain_voucher_gap'
+  // Stream 1 Phase 1: transaction reversal
+  | 'uncategorize_transaction'
+  // Stream 1 Phase 1: supplier invoice lifecycle
+  | 'approve_supplier_invoice'
+  | 'credit_supplier_invoice'
+  // Stream 1 Phase 1: invoice operations beyond simple create/send
+  | 'credit_invoice'
+  | 'convert_invoice'
+export type PendingOperationStatus = 'pending' | 'committing' | 'committed' | 'rejected'
+
+export type PendingOperationActorType = 'user' | 'api_key' | 'mcp_oauth' | 'cron'
+export type PendingOperationRiskLevel = 'low' | 'medium' | 'high'
 
 export interface PendingOperation {
   id: string
@@ -1323,6 +1358,14 @@ export interface PendingOperation {
   params: Record<string, unknown>
   preview_data: Record<string, unknown>
   result_data: Record<string, unknown> | null
+  // Stream 2 Phase 1: actor model
+  actor_type: PendingOperationActorType
+  actor_id: string | null
+  actor_label: string | null
+  risk_level: PendingOperationRiskLevel
+  // Stream 2 Phase 2: auto-commit tracking
+  auto_commit_eligible: boolean
+  auto_committed_at: string | null
   created_at: string
   resolved_at: string | null
   updated_at: string
@@ -2146,6 +2189,8 @@ export interface AuditLogEntry {
   table_name: string | null
   record_id: string | null
   actor_id: string | null
+  actor_type: 'user' | 'api_key' | 'mcp_oauth' | 'cron' | 'system' | null
+  actor_label: string | null
   old_state: Record<string, unknown> | null
   new_state: Record<string, unknown> | null
   description: string | null