@getpeppr/cli 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -0,0 +1,233 @@
+# Changelog
+
+All notable changes to `@getpeppr/cli` are documented here.
+
+The CLI bundles `@getpeppr/sdk` into its published artifact (tsup `noExternal`), so `validate`, `convert` and `init` run the SDK's validators, country rules and UBL builder locally — an SDK release only reaches CLI users once the CLI is rebundled. Rebundle-only releases are listed with the SDK version they ship.
+
+## [0.7.1] — 2026-08-18
+
+Rebundle SDK 4.1.1. This release matters for `getpeppr validate`, which runs the
+schematron validator locally from the bundled SDK.
+
+**Four rule identifiers were wrong, and 0.7.0 still reports them.** They named
+real rules from the Peppol rulebook — just not the ones being checked — which is
+worse than a typo: you could look one up, read a genuine rule, and find it had
+nothing to do with your document.
+
+| `validate` reported | It now reports | What the check actually verifies |
+| --- | --- | --- |
+| `BR-S-01` | `BR-S-05` | standard-rated line must carry a VAT rate above zero |
+| `BR-S-05` | `BR-Z-05` | zero-rated line must carry a rate of exactly zero |
+| `BR-S-06` | `BR-E-05` | VAT-exempt line must carry a rate of exactly zero |
+| `BR-S-08` | `BR-AE-05` | reverse-charge line must carry a rate of exactly zero |
+
+The checks themselves were always right — a zero-rated line carrying a non-zero
+rate was always caught. Only the label was wrong. **If you branch on any of these
+identifiers in a pipeline, they change with this version.**
+
+Fixed in SDK 4.1.0 on 2026-08-18; CLI users only receive it now, because the CLI
+bundles the SDK rather than depending on it at runtime.
+
+Also carries SDK 4.1.1, which corrects the JSDoc on `importFile()` — raw import
+does not preserve your document byte for byte, and the SDK said it did.
+
+## [0.7.0] — 2026-08-16
+
+Rebundle SDK 4.0.0 (GPR-1061). `getpeppr send --watch` could not confirm a
+delivery: it polled every 2 seconds, was handed an invented `submitted` every
+time, and after 60 seconds printed *"Timeout — invoice was sent but delivery not
+confirmed"* on invoices that had in fact been delivered. The status was never
+measured; the SDK was supplying it.
+
+The SDK now refuses a status the gateway did not send, so `--watch` stops
+reporting a timeout it cannot justify. When the gateway answers without a
+status, the watch ends immediately with `⚠ Watch error:` and the reason, instead
+of waiting a minute to say nothing.
+
+### Changed
+
+- `send --watch` surfaces a gateway protocol fault instead of polling to
+  timeout. Minor rather than patch: a script that read the 60-second timeout as
+  "not delivered yet" will now see an error much sooner — which is the point,
+  since that timeout was never evidence of anything.
+- **`send --watch` exits 1 when the watch itself fails.** It used to print the
+  error and exit 0, leaving the send-time `submitted` on stdout: an automation
+  gating on the exit code read a broken API as a confirmed delivery. A watch you
+  asked for and could not run is not a success.
+
+  A watch that merely **times out** still exits 0, unchanged. The send worked;
+  delivery is simply unconfirmed within the window. That is a different fact
+  from "the API answered something the SDK refused to interpret".
+
+## [0.6.0] — 2026-08-12
+
+Rebundle SDK 3.2.0 (GPR-1012, GPR-1020). Minor rather than patch: `validate` now
+**fails** documents it used to pass, so a pipeline gating on its exit code will
+start rejecting invoices — which is the point, since those invoices were being
+refused at send time anyway.
+
+Measured against the published `0.5.4` on the same file, before and after:
+
+| `vatCategory` | 0.5.4 said | 0.6.0 says |
+| --- | --- | --- |
+| `L` (IGIC) | *nothing* — passed silently | `unsupported_vat_category`, explained |
+| `M` (IPSI) | *nothing* — passed silently | `unsupported_vat_category`, explained |
+| `B` (split payment) | `invalid VAT category` | `unsupported_vat_category` |
+| `ae` | `invalid VAT category` | `BR-CL-17` + a note that codes are case-sensitive |
+
+### Changed
+
+- `validate` reports unroutable VAT categories instead of passing them. `L` and
+  `M` are valid EN 16931 codes our provider has no vocabulary for, so a document
+  carrying one is refused with a 422 at send time. `0.5.4` said nothing about
+  them, which meant the offline validator's verdict and the gateway's disagreed
+  on exactly the case where the developer needed the warning.
+- `validate` no longer emits the rule id `PEPPOL-EN16931-R006`. That id does not
+  exist in Peppol rulebook v3.0.20 — the family stops at R005, R007 and R008 —
+  so the CLI was citing a rule a reader could not look up. Violations now carry
+  `BR-CL-17` (a genuine EN 16931 rule) or `unsupported_vat_category`.
+- `validate` accepts `B` (Italian split payment) as a real VAT category. It was
+  reported invalid, which is the more expensive direction of error: telling a
+  developer the network refuses a code it accepts closes a corridor that is open.
+- A `vatCategory` of `null` is treated as absent rather than reported as the
+  literal string `"null"` — the shape any JSON serialiser emits for an unset
+  field, and the shape the gateway has always accepted.
+
+### Unchanged
+
+- `lookup`, `login`, `logout` and `send` behave identically.
+- The scheme and identifier fixes from SDK 3.0.0 (`GB:CRN` removal, `GB:VAT` and
+  Leitweg-ID patterns) are **not** in this bundle and never were: those symbols
+  live in a module the CLI does not import, and tsup tree-shakes them out.
+  Verified on the built artifact — `SCHEMES_BY_COUNTRY`, `validatePeppolIdentifier`
+  and `LEITWEG` are absent while `buildInvoiceXml` and `validateSchematron` are
+  present, so the absence is real and not a broken grep. SDK 3.1.0 was type-only
+  and had nothing to bundle.
+
+## [0.5.4] — 2026-07-24
+
+### Changed
+
+- Rebundle SDK 2.5.0 (GPR-868): `directory.search()` pagination meta remap, `WebhookEventType` phantom values removed. No CLI command change (`lookup` uses its own directory client).
+
+## [0.5.3] — 2026-07-20
+
+### Changed
+
+- `init` templates now target the getpeppr sandbox test receiver, so a scaffolded invoice can be sent successfully on the first try in sandbox (GPR-828).
+
+## [0.5.2] — 2026-07-16
+
+### Changed
+
+- Rebundle SDK 2.4.0 (GPR-134): `validate`/`convert` now apply the France country rules (FR-01 SIREN/SIRET checksums with the corrected La Poste model, FR-02 VAT key alphabet, FR-03 DGFiP VAT key formula) locally.
+
+## [0.5.1] — 2026-07-16
+
+### Fixed
+
+- Rebundle SDK 2.3.0 (GPR-838): `convert`/`validate` now emit EN 16931 BR-CO-17-compliant UBL — group-level VAT rounding replaced per-line accumulation, which could drift the payable amount by one cent on sub-cent line amounts.
+
+## [0.5.0] — 2026-07-13
+
+### Changed
+
+- `send --watch` stops on the terminal `no_action` status (recipient not deliverable) and `send` exits 1 on it (GPR-830). Rebundles SDK 2.1.0 (`invoice.undeliverable` webhook event, `waitFor` terminal semantics).
+
+## [0.4.7] — 2026-06-21
+
+### Changed
+
+- Rebundle SDK 2.0.0 (bundle hygiene, no command change).
+
+## [0.4.6] — 2026-06-19
+
+### Changed
+
+- Rebundle SDK 1.9.0 (GPR-738: `invoices.list()` blank `number`/`createdAt` fix).
+
+## [0.4.5] — 2026-06-04
+
+### Changed
+
+- Rebundle SDK 1.5.2 (directory response alignment).
+
+## [0.4.4] — 2026-06-04
+
+### Changed
+
+- Rebundle SDK 1.5.1 (patch train).
+
+## [0.4.3] — 2026-05-24
+
+### Changed
+
+- Rebundle SDK 1.5.0 (server validation contract updates).
+
+## [0.4.2] — 2026-05-07
+
+### Fixed
+
+- Repaired published package imports (#289) — same packaging fix as SDK 1.4.2.
+
+## [0.4.1] — 2026-05-07
+
+### Changed
+
+- Version alignment with SDK 1.4.1, package metadata normalization (#287, #290).
+
+## [0.4.0] — 2026-05-01
+
+### Added
+
+- `DirectoryError` class for directory lookup failures (GPR-414 PR-B, #270).
+
+### Fixed
+
+- `lookup`/search requests now carry `AbortSignal.timeout(15s)` and an HTTP ok-check — previously a slow Peppol Directory response could hang the command forever.
+
+## [0.3.1] — 2026-04-27
+
+### Changed
+
+- README documents the `send`, `login` and `logout` commands.
+
+## [0.3.0] — 2026-04-27
+
+### Added
+
+- `send [file]` — send an invoice to the Peppol network via the getpeppr API (`--watch`, `--prod`) (GPR-278).
+- `login` / `logout` — store/remove the API key in `~/.config/getpeppr/credentials.json` (mode 0600).
+- SDK now bundled into the published artifact via tsup `noExternal` (fixes `ERR_UNSUPPORTED_DIR_IMPORT` on user installs). 7 commands total.
+
+## [0.2.2] — 2026-04-09
+
+### Changed
+
+- README documents the `init`, `convert` and `lookup` commands.
+
+## [0.2.1] — 2026-04-09
+
+### Changed
+
+- Belgian seller templates for `init`.
+
+## [0.2.0] — 2026-04-09
+
+### Added
+
+- `init [file]` — scaffold an invoice/credit-note JSON template (GPR-275).
+- `convert <file>` — JSON → Peppol BIS 3.0 UBL XML on stdout (GPR-276).
+- `lookup <peppolId>` — Peppol Directory participant search (GPR-277).
+
+## [0.1.1] — 2026-04-07
+
+### Changed
+
+- npm README and website docs page (GPR-159).
+
+## [0.1.0] — 2026-04-07
+
+### Added
+
+- Initial release: `getpeppr validate <file>` — offline Peppol invoice validation running the SDK's three validators locally, no account required (GPR-265/266/267). Exit codes: 0 = valid, 1 = validation errors, 2 = fatal.

package/README.md

@@ -175,6 +175,23 @@ Removes `~/.config/getpeppr/credentials.json`. No-op if the file doesn't exist.
 | `1` | Failure (invalid invoice, participant not found) |
 | `2` | Input error (file not found, invalid JSON, bad arguments) |
 
+### `send --watch` is two outcomes, not one
+
+Since 0.7.0, a watch that fails because the API answered something the CLI
+cannot honestly read exits **1**. Before 0.7.0 it printed a warning and exited
+`0`, which meant an automation could read a broken API as a confirmed delivery.
+
+A watch that runs out of time still exits **0**, and that is a different fact:
+the document was accepted, and the watch stopped without having *seen* a
+terminal status. It does not follow that the document is still in flight. The
+deadline is checked between polls, so a status can turn terminal during the
+final wait and never be read — the status printed on a timeout may already be
+stale. Poll again or use a webhook rather than treating a timeout as a failure.
+
+⚠️ The 60 seconds bound when the **last poll starts**, not when the command
+ends. The deadline is checked before each request, so a slow or retried call
+carries the run past it. If a pipeline needs a hard ceiling, impose your own.
+
 ## CI/CD integration
 
 ```bash
@@ -271,6 +288,16 @@ const result = await peppol.invoices.send(invoice);
 
 Sign up at [getpeppr.dev](https://getpeppr.dev) to get your API key.
 
+## Release notes
+
+`validate` runs the Peppol rules bundled into the version you installed, so its
+verdict can change between releases — which matters most if you gate a pipeline
+on its exit code. Two places tell you what moved:
+
+- `CHANGELOG.md`, shipped inside the package (`node_modules/@getpeppr/cli/CHANGELOG.md`).
+- [getpeppr.dev/news](https://getpeppr.dev/news) for the same notes on the web,
+  alongside gateway and SDK changes.
+
 ## License
 
 MIT