Validate French identifiers offline — SIREN, SIRET and VAT keys (SDK 2.4.0)

Six weeks before France's September mandate, validateInvoice() in the SDK (2.4.0) and getpeppr validate in the CLI (0.5.2) now check French buyer identifiers offline — as advisory warnings that never block a send.

What changed

• SIREN or SIRET in companyId. A French buyer's company ID is accepted as 9 digits (SIREN) or 14 digits (SIRET) and verified with the official checksums. We also fixed the La Poste rule along the way: its head-office SIRET was previously rejected — the digit-sum rule is a fallback for SIREN 356000000, not a replacement for Luhn. The fix benefits 0002 and 0009 Peppol identifier validation too.
• VAT-key verification. Numeric French VAT keys are checked against the DGFiP formula, so a single-digit typo is flagged instantly — with the expected number suggested in the warning. Rare alphanumeric keys remain accepted.
• Scheme-aware. A French company legitimately identified by a GLN (companyIdScheme: "0088") is left alone — the checks only apply to SIREN-based identifiers.

Everything is advisory: warnings guide, the network decides. Pair it with the France guide for the full picture.