@getpeppr/cli 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -4,6 +4,33 @@ All notable changes to `@getpeppr/cli` are documented here.
 
 The CLI bundles `@getpeppr/sdk` into its published artifact (tsup `noExternal`), so `validate`, `convert` and `init` run the SDK's validators, country rules and UBL builder locally — an SDK release only reaches CLI users once the CLI is rebundled. Rebundle-only releases are listed with the SDK version they ship.
 
+## [0.7.1] — 2026-08-18
+
+Rebundle SDK 4.1.1. This release matters for `getpeppr validate`, which runs the
+schematron validator locally from the bundled SDK.
+
+**Four rule identifiers were wrong, and 0.7.0 still reports them.** They named
+real rules from the Peppol rulebook — just not the ones being checked — which is
+worse than a typo: you could look one up, read a genuine rule, and find it had
+nothing to do with your document.
+
+| `validate` reported | It now reports | What the check actually verifies |
+| --- | --- | --- |
+| `BR-S-01` | `BR-S-05` | standard-rated line must carry a VAT rate above zero |
+| `BR-S-05` | `BR-Z-05` | zero-rated line must carry a rate of exactly zero |
+| `BR-S-06` | `BR-E-05` | VAT-exempt line must carry a rate of exactly zero |
+| `BR-S-08` | `BR-AE-05` | reverse-charge line must carry a rate of exactly zero |
+
+The checks themselves were always right — a zero-rated line carrying a non-zero
+rate was always caught. Only the label was wrong. **If you branch on any of these
+identifiers in a pipeline, they change with this version.**
+
+Fixed in SDK 4.1.0 on 2026-08-18; CLI users only receive it now, because the CLI
+bundles the SDK rather than depending on it at runtime.
+
+Also carries SDK 4.1.1, which corrects the JSDoc on `importFile()` — raw import
+does not preserve your document byte for byte, and the SDK said it did.
+
 ## [0.7.0] — 2026-08-16
 
 Rebundle SDK 4.0.0 (GPR-1061). `getpeppr send --watch` could not confirm a

package/README.md

@@ -175,6 +175,23 @@ Removes `~/.config/getpeppr/credentials.json`. No-op if the file doesn't exist.
 | `1` | Failure (invalid invoice, participant not found) |
 | `2` | Input error (file not found, invalid JSON, bad arguments) |
 
+### `send --watch` is two outcomes, not one
+
+Since 0.7.0, a watch that fails because the API answered something the CLI
+cannot honestly read exits **1**. Before 0.7.0 it printed a warning and exited
+`0`, which meant an automation could read a broken API as a confirmed delivery.
+
+A watch that runs out of time still exits **0**, and that is a different fact:
+the document was accepted, and the watch stopped without having *seen* a
+terminal status. It does not follow that the document is still in flight. The
+deadline is checked between polls, so a status can turn terminal during the
+final wait and never be read — the status printed on a timeout may already be
+stale. Poll again or use a webhook rather than treating a timeout as a failure.
+
+⚠️ The 60 seconds bound when the **last poll starts**, not when the command
+ends. The deadline is checked before each request, so a slow or retried call
+carries the run past it. If a pipeline needs a hard ceiling, impose your own.
+
 ## CI/CD integration
 
 ```bash

package/dist/index.js

@@ -1161,7 +1161,7 @@ function statusFamily(status) {
 var TERMINAL_FAILURE_STATUSES = STATUS_PRECEDENCE.filter((e) => e.family === "terminal-failure").map((e) => e.status);
 
 // ../sdk/dist/version.js
-var SDK_VERSION = "4.0.0";
+var SDK_VERSION = "4.1.1";
 
 // ../sdk/dist/core/client.js
 function findHeaderCaseInsensitive(headers, name) {
@@ -1753,7 +1753,11 @@ var GetpepprAdapter = class {
     const body = {
       file: arrayBufferToBase64(options.file),
       filename: options.filename,
-      mimeType: options.mimeType ?? detectMimeType(options.filename)
+      mimeType: options.mimeType ?? detectMimeType(options.filename),
+      // Declared, never derived from the document: routing decides delivery, and
+      // parsing a caller's XML for a destination would put a parse error on the
+      // "whose invoice goes where" path.
+      to: options.to
     };
     const result = await this.request("POST", "/invoices/import", body);
     return parseSendResult(result);
@@ -1863,6 +1867,10 @@ function parseSendResult(body) {
   const detail = parseStatusDetail(result.detail);
   if (detail)
     sendResult.detail = detail;
+  const rulebook = result.rulebook;
+  if (typeof rulebook === "object" && rulebook !== null && typeof rulebook.peppol === "string" && typeof rulebook.verifiedAt === "string") {
+    sendResult.rulebook = rulebook;
+  }
   const submissionId = optionalWireId(result.submissionId);
   if (submissionId)
     sendResult.submissionId = submissionId;
@@ -2354,9 +2362,30 @@ ${validation.errors.map((e) => `  - ${e.field}: ${e.message}${e.suggestion ? ` (
     return this.adapter.validateDocumentServer(input);
   }
   /**
-   * Import an invoice from a file (XML, PDF, JSON).
-   * The file is base64-encoded and sent to the gateway, which forwards it
-   * as multipart/form-data to the provider's import endpoint.
+   * Send a UBL Invoice or CreditNote you built yourself.
+   *
+   * getpeppr does not regenerate, normalise, or repair the document — we
+   * forward the bytes you supplied, unchanged, to the network. Only UBL Invoice
+   * and CreditNote are accepted — a PDF, a CII document, or an XML that is
+   * neither is refused. The file is base64-encoded into a JSON body; there is
+   * no multipart upload.
+   *
+   * ⚠️ Byte-for-byte equality is NOT guaranteed, because the network
+   * re-serialises the document in transit. Measured 2026-08-18 on a test
+   * document: namespace declarations come back reordered, numeric character
+   * references are resolved (`A` → `A`), whitespace inside tags is dropped,
+   * and no element was added, removed or altered. That is one document and four
+   * kinds of difference — indicative, not a warranty of what is preserved.
+   * **If you seal your documents, hash a canonical form (C14N) rather than the
+   * raw bytes.**
+   *
+   * `to` is required and is never read from the document. Routing decides
+   * delivery, the document travels as payload, and getpeppr will not guess a
+   * destination by parsing your XML.
+   *
+   * Before transmission the document is validated against the complete official
+   * OpenPeppol rulebooks. A document violating a `fatal` rule is refused and is
+   * NOT sent; the error names the rule.
    *
    * @example
    * ```ts
@@ -2364,10 +2393,29 @@ ${validation.errors.map((e) => `  - ${e.field}: ${e.message}${e.suggestion ? ` (
    * const result = await peppol.invoices.importFile({
    *   file: xmlBytes,
    *   filename: "invoice.xml",
+   *   to: { peppolId: "0208:0685660237" },
    * });
    * console.log(result.id, result.status);
    * ```
-   * @throws {PeppolApiError} 501 if the gateway provider does not support file import
+   *
+   * @throws {PeppolApiError} 400 — `invalid_base64`, or a missing `file` /
+   *   `filename`. `missing_recipient` when `to.peppolId` is absent.
+   * @throws {PeppolApiError} 422 — the document was refused and NOT sent. Two
+   *   families, and they do NOT retry the same way:
+   *
+   *   - **The document was rejected** (`validation_failed`, `not_ubl_document`,
+   *     `document_too_complex`, `undecodable_document`, `unsupported_encoding`).
+   *     Terminal: the same bytes fail identically forever. Fix the document —
+   *     retrying is pure waste, and `validation_failed` names the rule.
+   *   - **The account may not send right now** (`peppol_identity_incomplete`,
+   *     `peppol_identity_not_verified`, `platform_billing_not_active`,
+   *     `production_access_expired`). ⛔ NOT terminal: these describe account
+   *     state, and account state changes — a verification completes, a contract
+   *     is activated. The identical document will go through once it does.
+   *
+   *   Treating the second family as terminal costs a customer a real invoice;
+   *   treating the first as retryable costs an infinite loop. See the API
+   *   reference for the full list.
    */
   async importFile(options) {
     return this.adapter.importInvoice(options);
@@ -3174,7 +3222,7 @@ var brCo16 = (input) => {
   }
   return [];
 };
-var brS01 = (input) => {
+var brS05 = (input) => {
   const violations = [];
   if (!input.lines)
     return violations;
@@ -3182,43 +3230,43 @@ var brS01 = (input) => {
     const line = input.lines[i];
     const category = line.vatCategory ?? "S";
     if (category === "S" && (line.vatRate === void 0 || line.vatRate <= 0)) {
-      violations.push(violation("BR-S-01", "error", `Line ${i}: standard rate (S) requires vatRate > 0, got ${line.vatRate ?? "undefined"}.`, `lines[${i}].vatRate`));
+      violations.push(violation("BR-S-05", "error", `Line ${i}: standard rate (S) requires vatRate > 0, got ${line.vatRate ?? "undefined"}.`, `lines[${i}].vatRate`));
     }
   }
   return violations;
 };
-var brS05 = (input) => {
+var brZ05 = (input) => {
   const violations = [];
   if (!input.lines)
     return violations;
   for (let i = 0; i < input.lines.length; i++) {
     const line = input.lines[i];
     if (line.vatCategory === "Z" && line.vatRate !== 0) {
-      violations.push(violation("BR-S-05", "error", `Line ${i}: zero-rated (Z) requires vatRate = 0, got ${line.vatRate}.`, `lines[${i}].vatRate`));
+      violations.push(violation("BR-Z-05", "error", `Line ${i}: zero-rated (Z) requires vatRate = 0, got ${line.vatRate}.`, `lines[${i}].vatRate`));
     }
   }
   return violations;
 };
-var brS06 = (input) => {
+var brE05 = (input) => {
   const violations = [];
   if (!input.lines)
     return violations;
   for (let i = 0; i < input.lines.length; i++) {
     const line = input.lines[i];
     if (line.vatCategory === "E" && line.vatRate !== 0) {
-      violations.push(violation("BR-S-06", "error", `Line ${i}: exempt (E) requires vatRate = 0, got ${line.vatRate}.`, `lines[${i}].vatRate`));
+      violations.push(violation("BR-E-05", "error", `Line ${i}: exempt (E) requires vatRate = 0, got ${line.vatRate}.`, `lines[${i}].vatRate`));
     }
   }
   return violations;
 };
-var brS08 = (input) => {
+var brAe05 = (input) => {
   const violations = [];
   if (!input.lines)
     return violations;
   for (let i = 0; i < input.lines.length; i++) {
     const line = input.lines[i];
     if (line.vatCategory === "AE" && line.vatRate !== 0) {
-      violations.push(violation("BR-S-08", "error", `Line ${i}: reverse charge (AE) requires vatRate = 0, got ${line.vatRate}.`, `lines[${i}].vatRate`));
+      violations.push(violation("BR-AE-05", "error", `Line ${i}: reverse charge (AE) requires vatRate = 0, got ${line.vatRate}.`, `lines[${i}].vatRate`));
     }
   }
   return violations;
@@ -3281,11 +3329,11 @@ var ALL_RULES = [
   brCo13,
   brCo15,
   brCo16,
-  // Tax categories (BR-S)
-  brS01,
+  // Tax categories (one family per category)
   brS05,
-  brS06,
-  brS08,
+  brZ05,
+  brE05,
+  brAe05,
   // Peppol-specific
   peppolR004,
   vatCategoryCodes,
@@ -3306,10 +3354,31 @@ function validateSchematron(input) {
   }
   return {
     valid: errors.length === 0,
+    coverage: { rulesChecked: SDK_SCHEMATRON_RULE_IDS.length, ofNetworkFatalRules: "partial" },
     errors,
     warnings
   };
 }
+var SDK_SCHEMATRON_RULE_IDS = [
+  "BR-02",
+  "BR-03",
+  "BR-06",
+  "BR-07",
+  "BR-08",
+  "BR-09",
+  "BR-10",
+  "BR-CL-17",
+  "BR-CO-10",
+  "BR-CO-13",
+  "BR-CO-15",
+  "BR-CO-16",
+  "BR-S-05",
+  "BR-Z-05",
+  "BR-E-05",
+  "BR-AE-05",
+  "PEPPOL-EN16931-R004",
+  "PEPPOL-EN16931-R080"
+];
 
 // src/commands/validate.ts
 function runValidation(input) {