@beliq/sdk 0.3.1 → 0.4.1

package/CHANGELOG.md

@@ -0,0 +1,68 @@
+# Changelog
+
+`@beliq/sdk` is on a 0.x line, so a caret range pins the minor: `^0.4.0`
+resolves 0.4.x and never reaches 0.5.0. Additive spec syncs ship as patches for
+that reason, and a minor is reserved for a change that needs consumers to opt in.
+
+## 0.4.1 - 2026-09-21
+
+- Invoice lines carry the item's price detail and identity: `grossPrice`
+  (BT-148) with the per-unit `priceDiscount` (BT-147), `priceBaseQuantity`
+  (BT-149/150), `standardItemId` (BT-157), `classifications` (BT-158),
+  `originCountryCode` (BT-159) and `attributes` (BG-32). A discount needs a
+  gross price and `unitPrice` must equal `grossPrice` minus `priceDiscount`, or
+  the API answers 400. With a base quantity the line net (BT-131) is quantity x
+  (`unitPrice` / `priceBaseQuantity`), which is what lets a caller who prices
+  per 100 units pass PEPPOL-EN16931-R120. The fatturapa, facturae and eslog
+  targets read none of these fields.
+- The release workflow refuses a tag whose version disagrees with
+  `package.json`. Tagging v0.4.1 against a manifest reading 0.4.0 used to
+  publish 0.4.0 and exit green, leaving a tag naming a version that never
+  shipped.
+
+## 0.4.0 - 2026-09-19
+
+- `GET /v1/rulesets` reports retained ruleset versions, so a caller can see
+  which older rule sets are still servable rather than only the current one.
+- Participant enrollment codes and the invoice delivery fields are typed.
+- BT-6 (VAT accounting currency) and BT-111 (VAT amount in the accounting
+  currency) are typed on the invoice.
+- A scheduled ruleset change reports its capabilities.
+- The README's quick-start invoice is one the API accepts as-is.
+- An em-dash scrub gate runs over the whole tree before publish, and the
+  release workflow carries job timeouts and refuses a tag that is not on `main`.
+- The `js-yaml` override floor is raised above GHSA-2883-xcg3-v3hh.
+
+## 0.3.1 - 2026-09-02
+
+- A spent monthly quota is raised, not retried. A 429 carrying
+  `QUOTA_EXCEEDED` is terminal, so the SDK makes exactly one attempt; a 429
+  carrying `RATE_LIMITED` or `ACCOUNT_THROTTLED` still retries. Retrying an
+  exhausted quota only burned the caller's own backoff window.
+- The France transmission verdict fields and pre-flight error codes are typed.
+- GitHub Actions are pinned to commit SHAs.
+
+## 0.3.0 - 2026-08-30
+
+- A per-standard profile map: which profile each standard accepts, and which
+  standards pin their own and reject one sent by the caller.
+- A per-attempt deadline, and transient failures are retried.
+- The transport defaults are exported from the package entry point, so a caller
+  can read the timeout and retry values the SDK ships with.
+- The vendored `openapi.json` is asserted byte-identical to what beliq-api
+  generates, and the drift check is directional in the code rather than only in
+  its comment. Ten Peppol emit error codes, the 413 responses, the verdict
+  verification tier and the `/v1/me` response shape are typed; two error codes
+  the API no longer declares are dropped.
+- eslint 10 and flat config.
+
+## 0.2.0 - 2026-07-24
+
+- Types refreshed to API 0.2.0: the generate seal, `livemode`, and the NLCIUS
+  preset.
+
+## 0.1.1 - 2026-06-30
+
+- First published release. TypeScript/JavaScript SDK for the beliq e-invoice
+  API: generate, validate, parse and convert, ESM and CommonJS with bundled
+  type declarations.

package/README.md

@@ -26,13 +26,33 @@ const account = await beliq.me();
 const generated = await beliq.generate({
   standard: 'xrechnung',
   verify: true,
+  // The XRechnung CIUS asks for more than plain EN 16931: a seller contact
+  // (BR-DE-2), payment instructions (BR-DE-1), a VAT breakdown (BR-CO-18) and an
+  // electronic address for each party. examples/invoice.json is this same shape.
   invoice: {
     number: 'INV-2026-001',
     issueDate: '2026-01-15',
     currencyCode: 'EUR',
-    seller: { name: 'Seller GmbH', address: { city: 'Berlin', postalCode: '10115', countryCode: 'DE' } },
-    buyer: { name: 'Buyer GmbH', address: { city: 'Munich', postalCode: '80331', countryCode: 'DE' } },
+    buyerReference: '04011000-12345-06',
+    seller: {
+      name: 'Seller GmbH',
+      vatId: 'DE123456789',
+      contactName: 'Anna Muster',
+      email: 'billing@seller.example',
+      phone: '+49 30 1234567',
+      address: { street: 'Hauptstr. 1', city: 'Berlin', postalCode: '10115', countryCode: 'DE' },
+      peppol: { schemeId: '9930', id: 'DE123456789' },
+    },
+    buyer: {
+      name: 'Buyer GmbH',
+      vatId: 'DE987654321',
+      email: 'ap@buyer.example',
+      address: { street: 'Marktweg 2', city: 'Munich', postalCode: '80331', countryCode: 'DE' },
+      peppol: { schemeId: '9930', id: 'DE987654321' },
+    },
     lines: [{ description: 'Consulting', quantity: 10, unitCode: 'HUR', unitPrice: 100, lineTotal: 1000, vatRate: 19, vatCategoryCode: 'S' }],
+    taxSummary: [{ vatCategoryCode: 'S', vatRate: 19, taxableAmount: 1000, taxAmount: 190 }],
+    paymentMeans: { typeCode: '58', iban: 'DE89370400440532013000' },
     totalNetAmount: 1000,
     totalTaxAmount: 190,
     totalGrossAmount: 1190,
@@ -165,13 +185,14 @@ npm install
 npm run build       # tsup: dual ESM + CJS + d.ts
 npm run typecheck
 npm run lint
+npm run scrub:check   # no em-dash in any tracked file
 npm test            # unit tests (no network)
 BELIQ_API_KEY=blq_xxx npm run test:integration   # hits the live API; draws quota
 ```
 
 ## Publishing
 
-Released to npm as [`@beliq/sdk`](https://www.npmjs.com/package/@beliq/sdk). Releases run from `.github/workflows/release.yml` via npm Trusted Publishing (OIDC, with provenance): push a `v*.*.*` tag to publish. No npm token is stored in the repo.
+Released to npm as [`@beliq/sdk`](https://www.npmjs.com/package/@beliq/sdk). Releases run from `.github/workflows/release.yml` via npm Trusted Publishing (OIDC, with provenance): bump `version` in `package.json`, run `npm install --package-lock-only`, add the release's entry to [`CHANGELOG.md`](CHANGELOG.md), merge, then push a `v*.*.*` tag on the merge commit to publish. No npm token is stored in the repo.
 
 ## License