feat(mcp): accept article_id on gnubok_create_invoice lines (#1638)

* feat(mcp): accept article_id on gnubok_create_invoice lines

Invoice lines staged via MCP can now reference a catalog article
(artikelregister). Staging prefills description, unit, unit_price,
vat_rate and revenue account from the article with explicit-wins
semantics, mirroring the web line picker. Unknown, foreign-company and
deactivated articles are refused at staging, as is a price prefill from
an article priced in another currency. The approval executor gains a
company-scope gate for staged article_id values: the FK on
invoice_items.article_id proves existence, not tenancy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(mcp): adopt article VAT rate only from the customer's default set

Web line picker parity (InvoiceEditor's applyArticle guard): an article's
stored vat_rate is its domestic rate. The prefill previously staged it
unconditionally, and the staging/commit gates check the wider permitted
set (which includes 25/12/6 for taxed-where-performed supplies), so
{article_id, quantity} to a validated EU business staged 25% Swedish VAT
onto a reverse-charge invoice. The customer is now fetched before the
prefill and the article rate is adopted only when it is in the
customer's default rate set; foreign-business lines fall back to the 0%
reverse-charge/export default unless the agent sets vat_rate explicitly.
Prefill logic extracted into resolveInvoiceLineFromArticle (CodeRabbit).

Found by the skeptic review pass (two independent refutations) and the
Swedish accounting compliance bot, all converging on the same defect.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(invoices): name the article VAT adoption set in vat-rules, not the MCP server

The vat-rate-gate-parity guard pins that no invoice write path mentions
getAvailableVatRates: gating on the picker default is the bug it exists
to prevent. The article-rate adoption in gnubok_create_invoice needs the
default set for a different purpose (prefill, not gating), so the
semantics move into lib/invoices/vat-rules.ts as
getArticleVatRateAdoptionSet(), with tests pinning that adoption is
empty for single-rate foreign customers and always a subset of the
permitted set. server.ts keeps gating on getPermittedVatRates.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/invoices/__tests__/vat-rules.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect } from 'vitest'
 import {
   getAvailableVatRates,
+  getArticleVatRateAdoptionSet,
   getPermittedVatRates,
   getVatTreatmentForRate,
   getVatRules,
@@ -355,3 +356,43 @@ describe('getMomsRutaDescription', () => {
     expect(getMomsRutaDescription('99')).toBe('99')
   })
 })
+
+// ============================================================
+// getArticleVatRateAdoptionSet
+// ============================================================
+
+describe('getArticleVatRateAdoptionSet', () => {
+  it('adopts nothing for a VAT-validated EU business (single locked 0% reverse charge)', () => {
+    expect(getArticleVatRateAdoptionSet('eu_business', true).size).toBe(0)
+  })
+
+  it('adopts nothing for a non-EU business (single locked 0% export)', () => {
+    expect(getArticleVatRateAdoptionSet('non_eu_business', false).size).toBe(0)
+  })
+
+  it('adopts the full domestic set for a Swedish business', () => {
+    const set = getArticleVatRateAdoptionSet('swedish_business', false)
+    expect([...set].sort((a, b) => a - b)).toEqual([0, 6, 12, 25])
+  })
+
+  it('adopts the full domestic set for an EU business WITHOUT validated VAT', () => {
+    const set = getArticleVatRateAdoptionSet('eu_business', false)
+    expect(set.has(25)).toBe(true)
+  })
+
+  it('is always a subset of the permitted set (adoption can never stage an unlawful rate)', () => {
+    const combos: Array<['individual' | 'swedish_business' | 'eu_business' | 'non_eu_business', boolean]> = [
+      ['individual', false],
+      ['swedish_business', false],
+      ['eu_business', false],
+      ['eu_business', true],
+      ['non_eu_business', false],
+    ]
+    for (const [type, validated] of combos) {
+      const permitted = new Set(getPermittedVatRates(type, validated).map((r) => r.rate))
+      for (const rate of getArticleVatRateAdoptionSet(type, validated)) {
+        expect(permitted.has(rate)).toBe(true)
+      }
+    }
+  })
+})

lib/invoices/vat-rules.ts

@@ -48,6 +48,24 @@ export function getAvailableVatRates(
   ]
 }
 
+/**
+ * The set of VAT rates an article's stored rate may be ADOPTED from when the
+ * article prefills an invoice line (web line picker parity: the picker only
+ * adopts a rate the customer could have picked themselves). Empty when the
+ * customer is locked to a single rate (foreign business 0% reverse charge /
+ * export): an article's stored rate is its DOMESTIC rate, and adopting it
+ * there would silently put Swedish VAT on a reverse-charge or export invoice
+ * even though the wider permitted set would accept it. This governs PREFILL
+ * only; every validation gate keeps using getPermittedVatRates().
+ */
+export function getArticleVatRateAdoptionSet(
+  customerType: CustomerType,
+  vatNumberValidated: boolean = false,
+): ReadonlySet<number> {
+  const offered = getAvailableVatRates(customerType, vatNumberValidated)
+  return new Set(offered.length > 1 ? offered.map((r) => r.rate) : [])
+}
+
 /**
  * Get the VAT rates that may LEGALLY appear on an invoice line for this
  * customer type. This is the set validation must gate on.