@getpeppr/cli 0.11.1 → 0.12.1

package/CHANGELOG.md

@@ -4,6 +4,41 @@ All notable changes to `@getpeppr/cli` are documented here.
 
 The CLI bundles `@getpeppr/sdk` into its published artifact (tsup `noExternal`), so `validate`, `convert` and `init` run the SDK's validators, country rules and UBL builder locally — an SDK release only reaches CLI users once the CLI is rebundled. Rebundle-only releases are listed with the SDK version they ship.
 
+## [0.12.1] — 2026-09-06
+
+Rebundles `@getpeppr/sdk` 5.3.0 (GPR-1280).
+
+- 0.12.0 was published with a stale SDK 5.2.0 bundle: its `validate` did not
+  enforce the billing-profile rules and its `structure` rule IDs predated
+  GPR-1267. Version 0.12.0 is deprecated on the registry; 0.12.1 carries the
+  intended bundle and the changes below as originally described.
+
+## [0.12.0] — 2026-09-06 (deprecated — stale SDK bundle, superseded by 0.12.1)
+
+Rebundles `@getpeppr/sdk` 5.3.0 (GPR-1280).
+
+- `getpeppr validate` and `getpeppr convert --validate` now enforce the three
+  Peppol billing-profile rules on `invoiceTypeCode` (`P0100`, `P0101`,
+  `P0112`) because they validate or build UBL locally (GPR-884, GPR-1273).
+  Documents outside the profile now fail these commands where they previously
+  passed — pipelines gating on the exit code change verdict, hence the minor.
+- The `structure` section rule IDs now designate the rules they actually
+  verify (GPR-1267): buyer name `BR-06` → `BR-07`, buyer street/city/postal
+  code → `GETPEPPR-BUYER-ADDRESS`, line VAT rate `BR-CO-17` →
+  `GETPEPPR-LINE-VAT-RATE`, `taxCurrencyRate` `BR-53` →
+  `GETPEPPR-TAX-CURRENCY-RATE`, the buyer-reference warning `BR-10` →
+  `PEPPOL-EN16931-R003`, and the due-date warning carries no id.
+- The `structure` section no longer repeats the country advisory warnings
+  that the `countryRules` section already reports: every warning is
+  displayed and counted once, and `totalWarnings` drops accordingly
+  (GPR-1267). Scripts that relied on the duplicated entries in
+  `structure.warnings` must read them from `countryRules.warnings`.
+- `getpeppr send` now uses an explicit JSON-send preflight aligned with
+  `POST /v1/invoices` (GPR-1285). Because that route currently ignores
+  `invoiceTypeCode`, profile rules `P0100`, `P0101`, and `P0112` no longer
+  block that inert field before sending. Structured `BR-CL-01` validation
+  and all other applicable offline and country checks remain active.
+
 ## [0.11.1] — 2026-09-04
 
 Rebundles `@getpeppr/sdk` 5.2.0 (GPR-1084).

package/README.md

@@ -126,6 +126,14 @@ API key resolution order: `--key` flag → `GETPEPPR_API_KEY` env var → stored
 
 Send an invoice through the getpeppr API to the Peppol network. Targets sandbox by default; pass `--prod` for production.
 
+`getpeppr send` runs a JSON preflight aligned with `POST /v1/invoices`. That
+endpoint currently ignores `invoiceTypeCode` and lets the provider generate the
+UBL, so the send preflight does not apply `P0100`, `P0101`, or `P0112` to that
+inert field. Structure checks including `BR-CL-01`, plus every other applicable
+offline and country check, remain active. Use `getpeppr validate` or
+`getpeppr convert --validate` for full local-UBL semantics; both retain those
+profile checks because they validate or build the UBL locally.
+
 ```bash
 # Send a JSON file
 getpeppr send invoice.json
@@ -154,7 +162,7 @@ getpeppr send invoice.json --prod
 | `--attachment` | Attach the bundled test PDF |
 | `--watch` | Poll status until terminal (60s timeout) |
 | `-y, --yes` | Skip the `--prod` confirmation prompt |
-| `--no-validate` | Skip local pre-validation |
+| `--no-validate` | Skip the JSON send preflight |
 | `--json` | Machine-readable JSON output |
 | `--quiet` | Exit code only, no output |
 
@@ -232,10 +240,11 @@ GETPEPPR_API_KEY=$SANDBOX_KEY getpeppr send invoice.json --json
 
 ## What it validates
 
-The CLI runs three validation engines from the [@getpeppr/sdk](https://www.npmjs.com/package/@getpeppr/sdk):
+`getpeppr validate` and `getpeppr convert --validate` run three validation
+engines from the [@getpeppr/sdk](https://www.npmjs.com/package/@getpeppr/sdk):
 
 1. **Structure** — Required fields, type checks, format validation
-2. **Offline Checks** — 37 registered partial pre-flight checks: exact network-rule equivalents plus explicit `GETPEPPR-*` diagnostics. The legacy provider-capability diagnostic `unsupported_vat_category` can also appear, but is outside that count. This is not a Peppol conformance verdict.
+2. **Offline Checks** — 40 registered partial pre-flight checks: exact network-rule equivalents plus explicit `GETPEPPR-*` diagnostics. The legacy provider-capability diagnostic `unsupported_vat_category` can also appear, but is outside that count. This is not a Peppol conformance verdict.
 3. **Country Rules** — Belgium (BE), France (FR), Italy (IT), Netherlands (NL), Germany (DE)
 
 Scaffolding (`init`), validation, and conversion run fully offline — no API key or network connection required. Only `lookup`, `send`, and `whoami` need a network connection. Before a sandbox `send`, the CLI reads `GET /v1/identity`: its own generated fixture is adapted to the returned O/0 or AE/0 profile, while a user-edited file is never rewritten silently and is refused locally if its tax mode conflicts with the sender.
@@ -294,7 +303,7 @@ This is the exact template generated by `getpeppr init`. See the [full type refe
 
 ## Ready to send?
 
-Once your invoice validates, send it to the Peppol network — straight from the CLI:
+When your invoice JSON is ready, send it to the Peppol network — straight from the CLI:
 
 ```bash
 getpeppr login                       # store your sandbox key once

package/dist/index.js

@@ -1698,16 +1698,19 @@ function assertString(value, fieldPath, errors) {
 var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 var ALLOWANCE_CHARGE_CONTRACT_RULE = "GETPEPPR-ALLOWANCE-CHARGE-AMOUNT";
 var DERIVED_AMOUNT_CONTRACT_RULE2 = "GETPEPPR-DERIVED-AMOUNT";
+var BUYER_ADDRESS_DELIVERY_RULE = "GETPEPPR-BUYER-ADDRESS";
+var LINE_VAT_RATE_RULE = "GETPEPPR-LINE-VAT-RATE";
+var TAX_CURRENCY_RATE_RULE = "GETPEPPR-TAX-CURRENCY-RATE";
 function survivesCents2(value) {
   return Number.isFinite(value) && Number.isFinite(value * 100);
 }
 function validateParty(party, path) {
   const errors = [];
   if (party.name === void 0 || party.name === null || party.name === "") {
-    errors.push(error(`${path}.name`, "Business name is required", "BR-06"));
+    errors.push(error(`${path}.name`, "Business name is required", "BR-07"));
   } else if (!assertString(party.name, `${path}.name`, errors)) {
   } else if (!party.name.trim()) {
-    errors.push(error(`${path}.name`, "Business name is required", "BR-06"));
+    errors.push(error(`${path}.name`, "Business name is required", "BR-07"));
   }
   if (party.peppolId === void 0 || party.peppolId === null || party.peppolId === "") {
     errors.push(error(`${path}.peppolId`, "Peppol participant ID is required", void 0, 'Format: "scheme:id", e.g. "0208:0685660237" for Belgian companies'));
@@ -1726,22 +1729,22 @@ function validateParty(party, path) {
 function validateBuyerAddress(party, path) {
   const errors = [];
   if (party.street === void 0 || party.street === null || party.street === "") {
-    errors.push(error(`${path}.street`, "Street address is required for the buyer", "BR-50", 'e.g. "123 Business Street"'));
+    errors.push(error(`${path}.street`, "Street address is required for the buyer", BUYER_ADDRESS_DELIVERY_RULE, 'e.g. "123 Business Street"'));
   } else if (!assertString(party.street, `${path}.street`, errors)) {
   } else if (!party.street.trim()) {
-    errors.push(error(`${path}.street`, "Street address is required for the buyer", "BR-50", 'e.g. "123 Business Street"'));
+    errors.push(error(`${path}.street`, "Street address is required for the buyer", BUYER_ADDRESS_DELIVERY_RULE, 'e.g. "123 Business Street"'));
   }
   if (party.city === void 0 || party.city === null || party.city === "") {
-    errors.push(error(`${path}.city`, "City is required for the buyer", "BR-51", 'e.g. "Brussels"'));
+    errors.push(error(`${path}.city`, "City is required for the buyer", BUYER_ADDRESS_DELIVERY_RULE, 'e.g. "Brussels"'));
   } else if (!assertString(party.city, `${path}.city`, errors)) {
   } else if (!party.city.trim()) {
-    errors.push(error(`${path}.city`, "City is required for the buyer", "BR-51", 'e.g. "Brussels"'));
+    errors.push(error(`${path}.city`, "City is required for the buyer", BUYER_ADDRESS_DELIVERY_RULE, 'e.g. "Brussels"'));
   }
   if (party.postalCode === void 0 || party.postalCode === null || party.postalCode === "") {
-    errors.push(error(`${path}.postalCode`, "Postal code is required for the buyer", "BR-53", 'e.g. "1000"'));
+    errors.push(error(`${path}.postalCode`, "Postal code is required for the buyer", BUYER_ADDRESS_DELIVERY_RULE, 'e.g. "1000"'));
   } else if (!assertString(party.postalCode, `${path}.postalCode`, errors)) {
   } else if (!party.postalCode.trim()) {
-    errors.push(error(`${path}.postalCode`, "Postal code is required for the buyer", "BR-53", 'e.g. "1000"'));
+    errors.push(error(`${path}.postalCode`, "Postal code is required for the buyer", BUYER_ADDRESS_DELIVERY_RULE, 'e.g. "1000"'));
   }
   return errors;
 }
@@ -1770,7 +1773,7 @@ function validateLine(line, index, isCreditNote = false) {
     }
   }
   if (line.vatRate === void 0 || line.vatRate === null) {
-    errors.push(error(`${path}.vatRate`, "VAT rate is required", "BR-CO-17"));
+    errors.push(error(`${path}.vatRate`, "VAT rate is required", LINE_VAT_RATE_RULE));
   } else if (line.vatRate < 0 || line.vatRate > 100) {
     errors.push(error(`${path}.vatRate`, `VAT rate must be between 0 and 100, got ${line.vatRate}`, void 0, "Use 0 for zero-rated, 21 for standard Belgian VAT, etc."));
   }
@@ -1945,10 +1948,25 @@ function validateInvoice(input) {
     }
   }
   if (!input.buyerReference && !input.orderReference) {
-    warnings.push(warning("buyerReference", "Either buyerReference or orderReference is required by Peppol BIS 3.0 (BT-10).", "BR-10"));
+    warnings.push(warning(
+      "buyerReference",
+      "Either buyerReference or orderReference is required by Peppol BIS 3.0 (BT-10).",
+      // GPR-1267 — PEPPOL-EN16931-R003 IS this rule: "A buyer reference or
+      // purchase order reference MUST be provided." BR-10 is the buyer
+      // postal address.
+      "PEPPOL-EN16931-R003"
+    ));
   }
   if (input.taxCurrency && input.taxCurrency !== (input.currency ?? "EUR") && !input.taxCurrencyRate) {
-    errors.push(error("taxCurrencyRate", "Tax currency rate is required when taxCurrency differs from document currency", "BR-53", "Set taxCurrencyRate to the exchange rate from document currency to tax currency"));
+    errors.push(error(
+      "taxCurrencyRate",
+      "Tax currency rate is required when taxCurrency differs from document currency",
+      // GPR-1267 — BR-53 mandates the BT-111 total in accounting currency,
+      // which the builder derives itself; the client-supplied rate is an
+      // input-contract requirement, not that rule.
+      TAX_CURRENCY_RATE_RULE,
+      "Set taxCurrencyRate to the exchange rate from document currency to tax currency"
+    ));
   }
   if (input.taxCurrency && input.taxCurrency === (input.currency ?? "EUR")) {
     warnings.push(warning("taxCurrency", "Tax currency is the same as document currency \u2014 TaxCurrencyCode will be omitted"));
@@ -1963,7 +1981,7 @@ function validateInvoice(input) {
     errors.push(error("taxCurrency", `Invalid tax currency code: "${input.taxCurrency}"`, void 0, 'Use ISO 4217 (e.g., "EUR", "USD")'));
   }
   if (!input.dueDate) {
-    warnings.push(warning("dueDate", "No due date specified. Recommended for payment terms.", "BR-09"));
+    warnings.push(warning("dueDate", "No due date specified. Recommended for payment terms."));
   }
   if (!input.to?.vatNumber) {
     warnings.push(warning("to.vatNumber", "Buyer VAT number not provided. May be required for B2B."));
@@ -2380,6 +2398,90 @@ var buyerPeppolIdRequired = (input) => {
   }
   return [];
 };
+var PROFILE_INVOICE_TYPE_CODES = /* @__PURE__ */ new Set([
+  "71",
+  "80",
+  "82",
+  "84",
+  "102",
+  "218",
+  "219",
+  "326",
+  "331",
+  "380",
+  "382",
+  "383",
+  "384",
+  "386",
+  "388",
+  "393",
+  "395",
+  "553",
+  "575",
+  "623",
+  "780",
+  "817",
+  "870",
+  "875",
+  "876",
+  "877"
+]);
+var PROFILE_CREDIT_NOTE_TYPE_CODES = /* @__PURE__ */ new Set([
+  "381",
+  "396",
+  "81",
+  "83",
+  "532"
+]);
+function normalizeXmlSpace(value) {
+  return value.replace(/[\u0009\u000A\u000D\u0020]+/g, " ").replace(/^ /, "").replace(/ $/, "");
+}
+function normalizedTypeCode(value, fallback) {
+  if (value === void 0 || value === null)
+    return String(fallback);
+  if (typeof value === "number" && Number.isFinite(value))
+    return String(value);
+  if (typeof value === "string" && value.length <= 16)
+    return normalizeXmlSpace(value);
+  return void 0;
+}
+function normalizedCountry(value) {
+  return typeof value === "string" ? normalizeXmlSpace(value).toUpperCase() : void 0;
+}
+var invoiceTypeCodeForProfile = (input) => {
+  if (input.isCreditNote)
+    return [];
+  const invoiceTypeCode = normalizedTypeCode(input.invoiceTypeCode, 380);
+  if (invoiceTypeCode !== void 0 && PROFILE_INVOICE_TYPE_CODES.has(invoiceTypeCode))
+    return [];
+  return [
+    violation("PEPPOL-EN16931-P0100", "error", "Invoice type code is not allowed by the Peppol billing profile used by the local UBL builder.", "invoiceTypeCode")
+  ];
+};
+var creditNoteTypeCodeForProfile = (input) => {
+  if (!input.isCreditNote)
+    return [];
+  const invoiceTypeCode = normalizedTypeCode(input.invoiceTypeCode, 381);
+  if (invoiceTypeCode !== void 0 && PROFILE_CREDIT_NOTE_TYPE_CODES.has(invoiceTypeCode))
+    return [];
+  return [
+    violation("PEPPOL-EN16931-P0101", "error", "Credit note type code is not allowed by the Peppol billing profile used by the local UBL builder.", "invoiceTypeCode")
+  ];
+};
+var germanInvoiceTypeCode = (input) => {
+  if (input.isCreditNote)
+    return [];
+  const invoiceTypeCode = normalizedTypeCode(input.invoiceTypeCode, 380);
+  if (invoiceTypeCode !== "326" && invoiceTypeCode !== "384")
+    return [];
+  const sellerCountry = normalizedCountry(input.from?.country);
+  const buyerCountry = normalizedCountry(input.to?.country);
+  if (sellerCountry === "DE" && buyerCountry === "DE")
+    return [];
+  return [
+    violation("PEPPOL-EN16931-P0112", "error", "Invoice type code 326 or 384 is only allowed when both buyer and seller are German organizations.", "invoiceTypeCode")
+  ];
+};
 var vatCategoryCodes = (input) => {
   const violations = [];
   const sendable = SENDABLE_VAT_CATEGORIES.join(", ");
@@ -2445,6 +2547,9 @@ var ALL_RULES = [
   brIc10,
   // Peppol-specific
   buyerPeppolIdRequired,
+  invoiceTypeCodeForProfile,
+  creditNoteTypeCodeForProfile,
+  germanInvoiceTypeCode,
   vatCategoryCodes,
   unitCodeRecognised
 ];
@@ -2505,6 +2610,9 @@ var SDK_SCHEMATRON_RULE_IDS = [
   "BR-O-10",
   "BR-IC-10",
   "GETPEPPR-BUYER-PEPPOL-ID-REQUIRED",
+  "PEPPOL-EN16931-P0100",
+  "PEPPOL-EN16931-P0101",
+  "PEPPOL-EN16931-P0112",
   "GETPEPPR-UNIT-CODE-RECOGNISED"
 ];
 
@@ -2533,7 +2641,7 @@ function statusFamily(status) {
 var TERMINAL_FAILURE_STATUSES = STATUS_PRECEDENCE.filter((e) => e.family === "terminal-failure").map((e) => e.status);
 
 // ../sdk/dist/version.js
-var SDK_VERSION = "5.2.0";
+var SDK_VERSION = "5.3.0";
 
 // ../sdk/dist/core/api-result.js
 var API_RESULT_HEADER_NAMES = {
@@ -4424,6 +4532,8 @@ var DirectoryOperations = class {
   }
   /**
    * Search the Peppol Directory for participants.
+   * Pagination is exact and participant-based. Queries wider than the public
+   * Directory's accessible result window are rejected; add narrower criteria.
    *
    * @example
    * ```ts
@@ -4889,14 +4999,32 @@ var TransportOperations = class {
 };
 
 // src/commands/validate.ts
-function runValidation(input) {
+var SEND_INERT_INVOICE_TYPE_PROFILE_RULES = /* @__PURE__ */ new Set([
+  "PEPPOL-EN16931-P0100",
+  "PEPPOL-EN16931-P0101",
+  "PEPPOL-EN16931-P0112"
+]);
+function isSendRelevantSchematronViolation(violation2) {
+  return !(violation2.field === "invoiceTypeCode" && SEND_INERT_INVOICE_TYPE_PROFILE_RULES.has(violation2.ruleId));
+}
+function runMergedValidation(input, schematronFilter) {
   const structure = validateInvoice(input);
-  const schematron = validateSchematron(input);
+  const completeSchematron = validateSchematron(input);
+  const schematron = {
+    errors: completeSchematron.errors.filter(schematronFilter),
+    warnings: completeSchematron.warnings
+  };
   const countryRules = validateCountryRules(input);
+  const countryKeys = new Set(
+    countryRules.warnings.map((w) => JSON.stringify([w.field, w.message, w.ruleId]))
+  );
+  const structureWarnings = structure.warnings.filter(
+    (w) => !countryKeys.has(JSON.stringify([w.field, w.message, w.ruleId]))
+  );
   const totalErrors = structure.errors.length + schematron.errors.length + countryRules.errors.length;
-  const totalWarnings = structure.warnings.length + schematron.warnings.length + countryRules.warnings.length;
+  const totalWarnings = structureWarnings.length + schematron.warnings.length + countryRules.warnings.length;
   return {
-    structure: { errors: structure.errors, warnings: structure.warnings },
+    structure: { errors: structure.errors, warnings: structureWarnings },
     schematron: { errors: schematron.errors, warnings: schematron.warnings },
     countryRules: {
       errors: countryRules.errors,
@@ -4907,6 +5035,12 @@ function runValidation(input) {
     valid: totalErrors === 0
   };
 }
+function runValidation(input) {
+  return runMergedValidation(input, () => true);
+}
+function runSendPreflight(input) {
+  return runMergedValidation(input, isSendRelevantSchematronViolation);
+}
 function registerValidateCommand(program2) {
   program2.command("validate").description("Validate a Peppol invoice JSON file").argument("<file>", "path to invoice JSON file").option("--json", "output results as JSON").option("--quiet", "exit code only, no output").action(async (file, options) => {
     const input = readAndValidateInvoiceJson(file);
@@ -5754,7 +5888,7 @@ function formatSendResult(result, mode) {
 var API_BASE = "https://api.getpeppr.dev/v1";
 var LOCAL_BASE = "http://localhost:3001/api/v1";
 function registerSendCommand(program2) {
-  program2.command("send").description("Send an invoice to the Peppol network via getpeppr API").argument("[file]", "optional path to invoice JSON (mutex with --to/--amount/...)").option("--prod", "target production (live keys + confirmation)").option("--local", "target localhost:3001 dev server").option("--key <key>", "override API key \u2014 for CI/scripted use only; visible in `ps` and shell history. Prefer GETPEPPR_API_KEY env var.").option("--to <peppol-id>", "recipient peppol id (e.g., 9925:BE0314595348)").option("--country <iso>", "recipient ISO 3166-1 alpha-2 country override (e.g., BE)").option("--amount <number>", "line amount in major currency units (decimal allowed)").option("--currency <iso>", "ISO 4217 currency (default EUR)").option("--desc <text>", "line description").option("--attachment", "attach the test PDF").option("--watch", "poll status until a terminal state (60s timeout)").option("-y, --yes", "skip --prod confirmation prompt").option("--no-validate", "skip pre-validation locally").option("--json", "output JSON").option("--quiet", "exit code only, no output").action(async (file, flags) => {
+  program2.command("send").description("Send an invoice to the Peppol network via getpeppr API").argument("[file]", "optional path to invoice JSON (mutex with --to/--amount/...)").option("--prod", "target production (live keys + confirmation)").option("--local", "target localhost:3001 dev server").option("--key <key>", "override API key \u2014 for CI/scripted use only; visible in `ps` and shell history. Prefer GETPEPPR_API_KEY env var.").option("--to <peppol-id>", "recipient peppol id (e.g., 9925:BE0314595348)").option("--country <iso>", "recipient ISO 3166-1 alpha-2 country override (e.g., BE)").option("--amount <number>", "line amount in major currency units (decimal allowed)").option("--currency <iso>", "ISO 4217 currency (default EUR)").option("--desc <text>", "line description").option("--attachment", "attach the test PDF").option("--watch", "poll status until a terminal state (60s timeout)").option("-y, --yes", "skip --prod confirmation prompt").option("--no-validate", "skip the JSON send preflight").option("--json", "output JSON").option("--quiet", "exit code only, no output").action(async (file, flags) => {
     let auth;
     try {
       auth = resolveApiKey({
@@ -5828,7 +5962,7 @@ function registerSendCommand(program2) {
       }
     }
     if (flags.validate !== false) {
-      const result2 = runValidation(payload);
+      const result2 = runSendPreflight(payload);
       if (!result2.valid) {
         process.stderr.write(
           `${pc6.red("\u2717")} Pre-validation failed (${result2.totalErrors} errors). Use --no-validate to skip.