@getpeppr/cli 0.8.1 → 0.8.2

package/dist/index.js

@@ -130,6 +130,518 @@ Validating: ${pc.bold(filename)}
   return lines.join("\n");
 }
 
+// ../sdk/dist/core/canonical-schemes.js
+var ALIAS_TO_EAS = /* @__PURE__ */ new Map([
+  ["AD:VAT", "9922"],
+  ["AE:TIN", "0235"],
+  ["AL:VAT", "9923"],
+  ["AT:CID", "9916"],
+  ["AT:GOV", "9915"],
+  ["AT:KUR", "9919"],
+  ["AT:VAT", "9914"],
+  ["AU:ABN", "0151"],
+  ["BA:VAT", "9924"],
+  ["BE:CBE", "9956"],
+  ["BE:EN", "0208"],
+  ["BE:VAT", "9925"],
+  ["BG:VAT", "9926"],
+  ["CH:UIDB", "0183"],
+  ["CH:VAT", "9927"],
+  ["CY:VAT", "9928"],
+  ["CZ:VAT", "9929"],
+  ["DE:GEBA", "0246"],
+  ["DE:LID", "9958"],
+  ["DE:LWID", "0204"],
+  ["DE:VAT", "9930"],
+  ["DK:CPR", "9901"],
+  ["DK:CVR", "9902"],
+  ["DK:DIGST", "0184"],
+  ["DK:ERST", "0198"],
+  ["DK:P", "0096"],
+  ["DK:SE", "9904"],
+  ["DK:VANS", "9905"],
+  ["DUNS", "0060"],
+  ["EE:CC", "0191"],
+  ["EE:VAT", "9931"],
+  ["ES:VAT", "9920"],
+  ["EU:NAL", "0130"],
+  ["EU:REID", "9913"],
+  ["EU:VAT", "9912"],
+  ["FI:NSI", "0215"],
+  ["FI:ORG", "0212"],
+  ["FI:OVT", "0037"],
+  ["FI:OVT2", "0216"],
+  ["FI:VAT", "0213"],
+  ["FR:CTC", "0225"],
+  ["FR:SIRENE", "0002"],
+  ["FR:SIRET", "0009"],
+  ["FR:VAT", "9957"],
+  ["GB:VAT", "9932"],
+  ["GLN", "0088"],
+  ["GR:VAT", "9933"],
+  ["GS1", "0209"],
+  ["HR:VAT", "9934"],
+  ["HU:VAT", "9910"],
+  ["IBAN", "9918"],
+  ["IE:VAT", "9935"],
+  ["IS:KT", "9917"],
+  ["IS:KTNR", "0196"],
+  ["IT:CF", "9907"],
+  ["IT:CFI", "0210"],
+  ["IT:COD", "0205"],
+  ["IT:CUUO", "0201"],
+  ["IT:FTI", "0097"],
+  ["IT:IPA", "9921"],
+  ["IT:IVA", "0211"],
+  ["IT:SECETI", "0142"],
+  ["IT:SIA", "0135"],
+  ["IT:VAT", "9906"],
+  ["JP:IIN", "0221"],
+  ["JP:SST", "0188"],
+  ["LEI", "0199"],
+  ["LI:VAT", "9936"],
+  ["LT:LEC", "0200"],
+  ["LT:VAT", "9937"],
+  ["LU:MAT", "0240"],
+  ["LU:VAT", "9938"],
+  ["LV:URN", "0218"],
+  ["LV:VAT", "9939"],
+  ["MC:VAT", "9940"],
+  ["ME:VAT", "9941"],
+  ["MK:VAT", "9942"],
+  ["MT:VAT", "9943"],
+  ["MY:EIF", "0230"],
+  ["NG:TID", "0244"],
+  ["NL:KVK", "0106"],
+  ["NL:OIN", "9954"],
+  ["NL:OINO", "0190"],
+  ["NL:VAT", "9944"],
+  ["NO:ORG", "0192"],
+  ["NO:ORGNR", "9908"],
+  ["NO:VAT", "9909"],
+  ["OM:VAT", "0248"],
+  ["PL:VAT", "9945"],
+  ["PT:VAT", "9946"],
+  ["RO:VAT", "9947"],
+  ["RS:VAT", "9948"],
+  ["SE:ORGNR", "0007"],
+  ["SE:VAT", "9955"],
+  ["SG:UEN", "0195"],
+  ["SI:VAT", "9949"],
+  ["SK:DIC", "0245"],
+  ["SK:ICO", "0158"],
+  ["SK:VAT", "9950"],
+  ["SM:VAT", "9951"],
+  ["SPIS", "0242"],
+  ["TR:VAT", "9952"],
+  ["UBLBE", "0193"],
+  ["US:EIN", "9959"],
+  ["VA:VAT", "9953"]
+]);
+function asciiUpper(value) {
+  let out = "";
+  for (const char of value) {
+    const code = char.charCodeAt(0);
+    out += code >= 97 && code <= 122 ? String.fromCharCode(code - 32) : char;
+  }
+  return out;
+}
+function canonicalScheme(scheme) {
+  return lookupCanonicalScheme(scheme) ?? scheme.trim();
+}
+function lookupCanonicalScheme(scheme) {
+  return ALIAS_TO_EAS.get(asciiUpper(scheme.trim()));
+}
+var EAS_TO_COUNTRY = /* @__PURE__ */ new Map([
+  ["0002", "FR"],
+  ["0007", "SE"],
+  ["0009", "FR"],
+  ["0037", "FI"],
+  ["0096", "DK"],
+  ["0097", "IT"],
+  ["0106", "NL"],
+  ["0135", "IT"],
+  ["0142", "IT"],
+  ["0151", "AU"],
+  ["0158", "SK"],
+  ["0183", "CH"],
+  ["0184", "DK"],
+  ["0188", "JP"],
+  ["0190", "NL"],
+  ["0191", "EE"],
+  ["0192", "NO"],
+  ["0193", "BE"],
+  ["0195", "SG"],
+  ["0196", "IS"],
+  ["0198", "DK"],
+  ["0200", "LT"],
+  ["0201", "IT"],
+  ["0204", "DE"],
+  ["0205", "IT"],
+  ["0208", "BE"],
+  ["0210", "IT"],
+  ["0211", "IT"],
+  ["0212", "FI"],
+  ["0213", "FI"],
+  ["0215", "FI"],
+  ["0216", "FI"],
+  ["0218", "LV"],
+  ["0221", "JP"],
+  ["0225", "FR"],
+  ["0230", "MY"],
+  ["0235", "AE"],
+  ["0240", "LU"],
+  ["0244", "NG"],
+  ["0245", "SK"],
+  ["0246", "DE"],
+  ["0248", "OM"],
+  ["9901", "DK"],
+  ["9902", "DK"],
+  ["9904", "DK"],
+  ["9905", "DK"],
+  ["9906", "IT"],
+  ["9907", "IT"],
+  ["9908", "NO"],
+  ["9909", "NO"],
+  ["9910", "HU"],
+  ["9914", "AT"],
+  ["9915", "AT"],
+  ["9916", "AT"],
+  ["9917", "IS"],
+  ["9919", "AT"],
+  ["9920", "ES"],
+  ["9921", "IT"],
+  ["9922", "AD"],
+  ["9923", "AL"],
+  ["9924", "BA"],
+  ["9925", "BE"],
+  ["9926", "BG"],
+  ["9927", "CH"],
+  ["9928", "CY"],
+  ["9929", "CZ"],
+  ["9930", "DE"],
+  ["9931", "EE"],
+  ["9932", "GB"],
+  ["9933", "GR"],
+  ["9934", "HR"],
+  ["9935", "IE"],
+  ["9936", "LI"],
+  ["9937", "LT"],
+  ["9938", "LU"],
+  ["9939", "LV"],
+  ["9940", "MC"],
+  ["9941", "ME"],
+  ["9942", "MK"],
+  ["9943", "MT"],
+  ["9944", "NL"],
+  ["9945", "PL"],
+  ["9946", "PT"],
+  ["9947", "RO"],
+  ["9948", "RS"],
+  ["9949", "SI"],
+  ["9950", "SK"],
+  ["9951", "SM"],
+  ["9952", "TR"],
+  ["9953", "VA"],
+  ["9954", "NL"],
+  ["9955", "SE"],
+  ["9956", "BE"],
+  ["9957", "FR"],
+  ["9958", "DE"],
+  ["9959", "US"]
+]);
+function countryForScheme(scheme) {
+  return EAS_TO_COUNTRY.get(canonicalScheme(scheme));
+}
+var CANONICAL_SCHEME_COUNT = ALIAS_TO_EAS.size;
+var SCHEME_COUNTRY_COUNT = EAS_TO_COUNTRY.size;
+
+// ../sdk/dist/core/peppol-id.js
+function isWellFormedPeppolId(peppolId) {
+  if (!peppolId.includes(":"))
+    return false;
+  const { scheme, id } = parsePeppolId(peppolId);
+  return id.trim().length > 0 && (/^\d{4}$/.test(scheme) || EAS_LITERAL_SCHEMES.has(scheme));
+}
+var EAS_LITERAL_SCHEMES = /* @__PURE__ */ new Set(["AN", "AQ", "AS", "AU", "EM", "SEPA"]);
+function parsePeppolId(peppolId) {
+  const first = peppolId.indexOf(":");
+  if (first === -1) {
+    return { scheme: canonicalScheme(peppolId), id: "" };
+  }
+  const second = peppolId.indexOf(":", first + 1);
+  if (second !== -1) {
+    const resolved = lookupCanonicalScheme(peppolId.slice(0, second));
+    if (resolved !== void 0) {
+      return { scheme: resolved, id: peppolId.slice(second + 1) };
+    }
+  }
+  return {
+    scheme: canonicalScheme(peppolId.slice(0, first)),
+    id: peppolId.slice(first + 1)
+  };
+}
+
+// ../sdk/dist/core/iso6523-icd-codes.js
+var ICD_CODES = /* @__PURE__ */ new Set([
+  "0002",
+  "0003",
+  "0004",
+  "0005",
+  "0006",
+  "0007",
+  "0008",
+  "0009",
+  "0010",
+  "0011",
+  "0012",
+  "0013",
+  "0014",
+  "0015",
+  "0016",
+  "0017",
+  "0018",
+  "0019",
+  "0020",
+  "0021",
+  "0022",
+  "0023",
+  "0024",
+  "0025",
+  "0026",
+  "0027",
+  "0028",
+  "0029",
+  "0030",
+  "0031",
+  "0032",
+  "0033",
+  "0034",
+  "0035",
+  "0036",
+  "0037",
+  "0038",
+  "0039",
+  "0040",
+  "0041",
+  "0042",
+  "0043",
+  "0044",
+  "0045",
+  "0046",
+  "0047",
+  "0048",
+  "0049",
+  "0050",
+  "0051",
+  "0052",
+  "0053",
+  "0054",
+  "0055",
+  "0056",
+  "0057",
+  "0058",
+  "0059",
+  "0060",
+  "0061",
+  "0062",
+  "0063",
+  "0064",
+  "0065",
+  "0066",
+  "0067",
+  "0068",
+  "0069",
+  "0070",
+  "0071",
+  "0072",
+  "0073",
+  "0074",
+  "0075",
+  "0076",
+  "0077",
+  "0078",
+  "0079",
+  "0080",
+  "0081",
+  "0082",
+  "0083",
+  "0084",
+  "0085",
+  "0086",
+  "0087",
+  "0088",
+  "0089",
+  "0090",
+  "0091",
+  "0093",
+  "0094",
+  "0095",
+  "0096",
+  "0097",
+  "0098",
+  "0099",
+  "0100",
+  "0101",
+  "0102",
+  "0104",
+  "0105",
+  "0106",
+  "0107",
+  "0108",
+  "0109",
+  "0110",
+  "0111",
+  "0112",
+  "0113",
+  "0114",
+  "0115",
+  "0116",
+  "0117",
+  "0118",
+  "0119",
+  "0120",
+  "0121",
+  "0122",
+  "0123",
+  "0124",
+  "0125",
+  "0126",
+  "0127",
+  "0128",
+  "0129",
+  "0130",
+  "0131",
+  "0132",
+  "0133",
+  "0134",
+  "0135",
+  "0136",
+  "0137",
+  "0138",
+  "0139",
+  "0140",
+  "0141",
+  "0142",
+  "0143",
+  "0144",
+  "0145",
+  "0146",
+  "0147",
+  "0148",
+  "0149",
+  "0150",
+  "0151",
+  "0152",
+  "0153",
+  "0154",
+  "0155",
+  "0156",
+  "0157",
+  "0158",
+  "0159",
+  "0160",
+  "0161",
+  "0162",
+  "0163",
+  "0164",
+  "0165",
+  "0166",
+  "0167",
+  "0168",
+  "0169",
+  "0170",
+  "0171",
+  "0172",
+  "0173",
+  "0174",
+  "0175",
+  "0176",
+  "0177",
+  "0178",
+  "0179",
+  "0180",
+  "0183",
+  "0184",
+  "0185",
+  "0186",
+  "0187",
+  "0188",
+  "0189",
+  "0190",
+  "0191",
+  "0192",
+  "0193",
+  "0194",
+  "0195",
+  "0196",
+  "0197",
+  "0198",
+  "0199",
+  "0200",
+  "0201",
+  "0202",
+  "0203",
+  "0204",
+  "0205",
+  "0206",
+  "0207",
+  "0208",
+  "0209",
+  "0210",
+  "0211",
+  "0212",
+  "0213",
+  "0214",
+  "0215",
+  "0216",
+  "0217",
+  "0218",
+  "0219",
+  "0220",
+  "0221",
+  "0222",
+  "0223",
+  "0224",
+  "0225",
+  "0226",
+  "0227",
+  "0228",
+  "0229",
+  "0230",
+  "0231",
+  "0232",
+  "0233",
+  "0234",
+  "0235",
+  "0236",
+  "0237",
+  "0238",
+  "0239",
+  "0240",
+  "0241",
+  "0242",
+  "0243",
+  "0244",
+  "0245"
+]);
+var ISO6523_ICD_CODES = Object.freeze({
+  has: (v) => ICD_CODES.has(v),
+  get size() {
+    return ICD_CODES.size;
+  },
+  keys: () => ICD_CODES.keys(),
+  values: () => ICD_CODES.values(),
+  entries: () => ICD_CODES.entries(),
+  forEach: (fn, thisArg) => ICD_CODES.forEach((v, v2) => fn.call(thisArg, v, v2, ISO6523_ICD_CODES)),
+  [Symbol.iterator]: () => ICD_CODES[Symbol.iterator]()
+});
+function canCarryPartyIdentification(scheme, context) {
+  if (ICD_CODES.has(scheme))
+    return true;
+  return scheme === "SEPA" && context !== "AccountingCustomerParty";
+}
+
 // ../sdk/dist/core/ubl-builder.js
 var UBL_NS = "urn:oasis:names:specification:ubl:schema:xsd:Invoice-2";
 var CAC_NS = "urn:oasis:names:specification:ubl:schema:xsd:CommonAggregateComponents-2";
@@ -184,20 +696,34 @@ function formatAmount(amount) {
 function round2(n) {
   return Math.round(n * 100) / 100;
 }
-function parsePeppolId(peppolId) {
-  const scheme = peppolId.split(":")[0];
-  const id = peppolId.split(":").slice(1).join(":");
-  return { scheme, id };
-}
 function buildPartyXml(party, role) {
   const { scheme: endpointScheme, id: endpointId } = parsePeppolId(party.peppolId);
   return `
     <cac:${role}>
       <cac:Party>
         <cbc:EndpointID schemeID="${escapeXml(endpointScheme)}">${escapeXml(endpointId)}</cbc:EndpointID>
-        <cac:PartyIdentification>
+        ${// ⛔ DEUX listes, pas une. `BR-CL-25` juge l'EndpointID ci-dessus contre la
+  // liste EAS (101 valeurs, jusqu'à `9959`) ; `BR-CL-10` juge CE champ-ci
+  // contre la liste ISO 6523 ICD (240 valeurs, `0002`–`0245`). `9932` (GB),
+  // `9935` (IE) et `9930` (DE) sont légaux là-haut et FATALS ici.
+  //
+  // Le champ (BT-29) est optionnel : l'omettre est la seule écriture
+  // conforme pour ces schemes, et c'est ce que le tir réseau de GPR-1102
+  // avait déjà mesuré — `9932`/`9935` n'apparaissent ni en BT-29 ni en
+  // BT-30, seulement en BT-31. Émettre quand même rendait `BR-CL-10` fatale
+  // pour tout vendeur britannique, irlandais ou allemand en `9930`,
+  // y compris en écrivant la forme numérique (GPR-1110).
+  //
+  // ⚠️ BR-CO-26 exige alors qu'un autre identifiant porte l'expéditeur —
+  // `vatNumber` (BT-31) ou `companyId` (BT-30) ci-dessous. `validateInvoice`
+  // AVERTIT quand il n'y en a aucun ; il ne refuse pas, et `toXml()` rend
+  // donc bel et bien un document que le réseau rejettera. C'est délibéré :
+  // `from` est déclaré « deprecated and ignored » à l'envoi, où l'expéditeur
+  // vient de la clé API — bloquer ici casserait des appelants dont le
+  // document part très bien.
+  canCarryPartyIdentification(endpointScheme, role) ? `<cac:PartyIdentification>
           <cbc:ID schemeID="${escapeXml(endpointScheme)}">${escapeXml(endpointId)}</cbc:ID>
-        </cac:PartyIdentification>
+        </cac:PartyIdentification>` : ""}
         <cac:PartyName>
           <cbc:Name>${escapeXml(party.name)}</cbc:Name>
         </cac:PartyName>
@@ -231,9 +757,12 @@ function buildPayeePartyXml(party) {
   const { scheme, id } = parsePeppolId(party.peppolId);
   return `
     <cac:PayeeParty>
-      <cac:PartyIdentification>
+      ${// Même règle qu'au-dessus : `BR-CL-10` a pour contexte TOUT
+  // `cac:PartyIdentification/cbc:ID[@schemeID]`, PayeeParty compris. Le
+  // bénéficiaire (BT-60) reste identifié par son nom, toujours émis.
+  canCarryPartyIdentification(scheme, "PayeeParty") ? `<cac:PartyIdentification>
         <cbc:ID schemeID="${escapeXml(scheme)}">${escapeXml(id)}</cbc:ID>
-      </cac:PartyIdentification>
+      </cac:PartyIdentification>` : ""}
       <cac:PartyName>
         <cbc:Name>${escapeXml(party.name)}</cbc:Name>
       </cac:PartyName>
@@ -964,8 +1493,8 @@ function validateParty(party, path) {
   if (party.peppolId === void 0 || party.peppolId === null || party.peppolId === "") {
     errors.push(error(`${path}.peppolId`, "Peppol participant ID is required", void 0, 'Format: "scheme:id", e.g. "0208:0685660237" for Belgian companies'));
   } else if (!assertString(party.peppolId, `${path}.peppolId`, errors)) {
-  } else if (!party.peppolId.includes(":")) {
-    errors.push(error(`${path}.peppolId`, `Invalid Peppol ID format: "${party.peppolId}"`, void 0, 'Must be "scheme:id" format. Common schemes: 0208 (Belgium), 0009 (France SIRET), 0204 (Germany Leitweg)'));
+  } else if (!isWellFormedPeppolId(party.peppolId)) {
+    errors.push(error(`${path}.peppolId`, `Invalid Peppol ID format: "${party.peppolId}"`, void 0, 'Must be "scheme:id" \u2014 e.g. "0208:0685660237" or "GB:VAT:123456789". The scheme alone ("GB:VAT") is not an identifier.'));
   }
   if (party.country === void 0 || party.country === null || party.country === "") {
     errors.push(error(`${path}.country`, "Country code is required", "BR-11"));
@@ -1047,6 +1576,14 @@ function validateInvoice(input) {
   }
   if (input.from) {
     warnings.push(warning("from", "Seller info is determined by your API key. The 'from' field is deprecated and ignored."));
+    const fromId = input.from.peppolId;
+    if (typeof fromId === "string" && fromId.length > 0) {
+      const { scheme } = parsePeppolId(fromId);
+      const bt29Written = canCarryPartyIdentification(scheme, "AccountingSupplierParty");
+      if (!bt29Written && !input.from.vatNumber && !input.from.companyId) {
+        warnings.push(warning("from.peppolId", `Scheme "${scheme}" cannot carry a seller identifier (BT-29), so that field is omitted. Add a vatNumber (BT-31) or companyId (BT-30), or the network will reject the document under BR-CO-26.`, "BR-CO-26"));
+      }
+    }
   }
   if (!input.to) {
     errors.push(error("to", "Buyer (to) is required", "BR-07"));
@@ -1066,8 +1603,8 @@ function validateInvoice(input) {
     if (ppId === void 0 || ppId === null || ppId === "") {
       errors.push(error("payeeParty.peppolId", "Payee party Peppol ID is required", void 0, 'Format: "scheme:id", e.g. "0208:0685660237"'));
     } else if (!assertString(ppId, "payeeParty.peppolId", errors)) {
-    } else if (!ppId.includes(":")) {
-      errors.push(error("payeeParty.peppolId", `Invalid Peppol ID format: "${ppId}"`, void 0, 'Must be "scheme:id" format'));
+    } else if (!isWellFormedPeppolId(ppId)) {
+      errors.push(error("payeeParty.peppolId", `Invalid Peppol ID format: "${ppId}"`, void 0, 'Must be "scheme:id" \u2014 e.g. "0208:0685660237". The scheme alone ("GB:VAT") is not an identifier.'));
     }
   }
   if (!input.lines || input.lines.length === 0) {
@@ -1161,7 +1698,7 @@ function statusFamily(status) {
 var TERMINAL_FAILURE_STATUSES = STATUS_PRECEDENCE.filter((e) => e.family === "terminal-failure").map((e) => e.status);
 
 // ../sdk/dist/version.js
-var SDK_VERSION = "4.3.0";
+var SDK_VERSION = "4.5.0";
 
 // ../sdk/dist/core/client.js
 function findHeaderCaseInsensitive(headers, name) {
@@ -1761,7 +2298,24 @@ var GetpepprAdapter = class {
       // Declared, never derived from the document: routing decides delivery, and
       // parsing a caller's XML for a destination would put a parse error on the
       // "whose invoice goes where" path.
-      to: options.to
+      to: options.to,
+      // ⛔ GPR-1129 — ce corps est une LISTE BLANCHE, exactement comme
+      // `parseSendResult` l'est en sortie : tout champ non recopié ici est
+      // supprimé en SILENCE, et la capacité correspondante devient
+      // inatteignable pour quiconque passe par le SDK.
+      //
+      // Quatrième occurrence de cette classe, la première dans le sens REQUÊTE
+      // (`rulebook` GPR-1069, `transmission` GPR-1089, `duplicateOf` GPR-1105
+      // étaient des champs de RÉPONSE). Le préjudice n'est pas symétrique : un
+      // champ de réponse jeté casse qui le lit, un champ de requête jeté
+      // produit un refus que l'appelant ne peut relier à rien — il envoie
+      // `sender`, la passerelle ne le voit jamais, et le 422 qu'il reçoit parle
+      // d'une identité qu'il ne revendiquait pas.
+      //
+      // ⚠️ Conditionnel, jamais `sender: options.sender` : une clé présente à
+      // `undefined` disparaît du JSON, donc l'écriture nue passerait les tests
+      // tout en salissant le corps des envois standards.
+      ...options.sender ? { sender: options.sender } : {}
     };
     const result = await this.request("POST", "/invoices/import", body);
     return parseSendResult(result);
@@ -1883,6 +2437,9 @@ function parseSendResult(body) {
       sendResult.transmission = { mode, bytePreservation };
     }
   }
+  const duplicateOf = optionalWireId(readOwn(result, "duplicateOf"));
+  if (duplicateOf)
+    sendResult.duplicateOf = duplicateOf;
   const submissionId = optionalWireId(result.submissionId);
   if (submissionId)
     sendResult.submissionId = submissionId;
@@ -2253,9 +2810,11 @@ var Peppol = class {
    * API with `peppol.identity.get()`, which works with any key. This surface is
    * for platforms that onboard their customers as sub-tenants.
    *
-   * **Getting access:** platform mode is enabled by getpeppr on your account —
-   * email hello@getpeppr.dev to have it switched on. Once it is, you create the
-   * master key yourself at https://console.getpeppr.dev/api-keys.
+   * **Getting access:** in the sandbox, an organisation admin starts the
+   * platform sandbox trial from the console overview (or chooses "A platform
+   * for my customers" at signup), then creates the sandbox master key at
+   * https://console.getpeppr.dev/api-keys. Production platform access is set up
+   * with our team — email hello@getpeppr.dev to request it.
    *
    * @see https://getpeppr.dev/docs/platform/legal-entities/
    */
@@ -2702,12 +3261,10 @@ var DirectoryOperations = class {
    * ```
    */
   async lookup(peppolId) {
-    const colonIndex = peppolId.indexOf(":");
-    if (colonIndex === -1) {
+    if (!peppolId.includes(":")) {
       throw new PeppolError('Invalid Peppol ID format. Expected "scheme:id" (e.g., "0208:0685660237")');
     }
-    const scheme = peppolId.slice(0, colonIndex);
-    const id = peppolId.slice(colonIndex + 1);
+    const { scheme, id } = parsePeppolId(peppolId);
     return this.adapter.lookupDirectory(scheme, id);
   }
   /**
@@ -2907,9 +3464,11 @@ var LegalEntityOperations = class {
   /**
    * Create a sub-tenant Legal Entity for one of your customers.
    *
-   * **Platform accounts only — requires a master API key.** Platform mode is
-   * enabled by getpeppr: email hello@getpeppr.dev, then create the key at
-   * https://console.getpeppr.dev/api-keys.
+   * **Platform accounts only — requires a master API key.** In the sandbox,
+   * an organisation admin starts the platform sandbox trial from the console
+   * overview and creates a sandbox master key at
+   * https://console.getpeppr.dev/api-keys; production platform access is set
+   * up with our team (hello@getpeppr.dev).
    *
    * Your own company's legal entity is managed in the console, on the Peppol
    * identity page (and read from the API with `peppol.identity.get()`); this
@@ -2936,9 +3495,11 @@ var LegalEntityOperations = class {
   /**
    * Fetch a single sub-tenant Legal Entity by id.
    *
-   * **Platform accounts only — requires a master API key.** Platform mode is
-   * enabled by getpeppr: email hello@getpeppr.dev, then create the key at
-   * https://console.getpeppr.dev/api-keys.
+   * **Platform accounts only — requires a master API key.** In the sandbox,
+   * an organisation admin starts the platform sandbox trial from the console
+   * overview and creates a sandbox master key at
+   * https://console.getpeppr.dev/api-keys; production platform access is set
+   * up with our team (hello@getpeppr.dev).
    *
    * For production entities the `status` reflects the attestation lifecycle
    * (awaiting_authz → attested → active).
@@ -2949,9 +3510,11 @@ var LegalEntityOperations = class {
   /**
    * List your sub-tenant Legal Entities, newest first.
    *
-   * **Platform accounts only — requires a master API key.** Platform mode is
-   * enabled by getpeppr: email hello@getpeppr.dev, then create the key at
-   * https://console.getpeppr.dev/api-keys.
+   * **Platform accounts only — requires a master API key.** In the sandbox,
+   * an organisation admin starts the platform sandbox trial from the console
+   * overview and creates a sandbox master key at
+   * https://console.getpeppr.dev/api-keys; production platform access is set
+   * up with our team (hello@getpeppr.dev).
    *
    * This lists the customers you have onboarded, never your own legal entity.
    */
@@ -2961,9 +3524,11 @@ var LegalEntityOperations = class {
   /**
    * Async iterator over all sub-tenant Legal Entities, handling pagination.
    *
-   * **Platform accounts only — requires a master API key.** Platform mode is
-   * enabled by getpeppr: email hello@getpeppr.dev, then create the key at
-   * https://console.getpeppr.dev/api-keys.
+   * **Platform accounts only — requires a master API key.** In the sandbox,
+   * an organisation admin starts the platform sandbox trial from the console
+   * overview and creates a sandbox master key at
+   * https://console.getpeppr.dev/api-keys; production platform access is set
+   * up with our team (hello@getpeppr.dev).
    *
    * @example
    * ```ts
@@ -2977,9 +3542,11 @@ var LegalEntityOperations = class {
    * Archive (soft-delete) a sub-tenant Legal Entity. The id stays resolvable
    * for audit.
    *
-   * **Platform accounts only — requires a master API key.** Platform mode is
-   * enabled by getpeppr: email hello@getpeppr.dev, then create the key at
-   * https://console.getpeppr.dev/api-keys.
+   * **Platform accounts only — requires a master API key.** In the sandbox,
+   * an organisation admin starts the platform sandbox trial from the console
+   * overview and creates a sandbox master key at
+   * https://console.getpeppr.dev/api-keys; production platform access is set
+   * up with our team (hello@getpeppr.dev).
    */
   async archive(id) {
     return this.adapter.archiveLegalEntity(id);
@@ -2988,9 +3555,11 @@ var LegalEntityOperations = class {
    * Request a sub-tenant attestation (production only). Emails the co-branded
    * confirmation link to the sub-tenant contact and returns the pending status.
    *
-   * **Platform accounts only — requires a master API key.** Platform mode is
-   * enabled by getpeppr: email hello@getpeppr.dev, then create the key at
-   * https://console.getpeppr.dev/api-keys.
+   * **Platform accounts only — requires a master API key.** In the sandbox,
+   * an organisation admin starts the platform sandbox trial from the console
+   * overview and creates a sandbox master key at
+   * https://console.getpeppr.dev/api-keys; production platform access is set
+   * up with our team (hello@getpeppr.dev).
    *
    * Transient failures are NOT auto-retried unless you pass `options.idempotencyKey`;
    * re-issuing mints a fresh token, so a retried call is safe.
@@ -3927,12 +4496,11 @@ function validatePeppolId(raw) {
       error: `Invalid Peppol ID format: "${raw}". Expected format: scheme:id (e.g. 0208:0685660237)`
     };
   }
-  const scheme = raw.slice(0, colonIndex);
-  const id = raw.slice(colonIndex + 1);
+  const { scheme, id } = parsePeppolId(raw);
   if (!/^\d{4}$/.test(scheme)) {
     return {
       ok: false,
-      error: `Invalid scheme "${scheme}". Must be exactly 4 digits (e.g. 0208).`
+      error: `Invalid scheme "${scheme}". Must be a 4-digit EAS code (e.g. 0208) or a published symbolic scheme (e.g. GB:VAT).`
     };
   }
   if (!/^[A-Za-z0-9:.\-]+$/.test(id)) {
@@ -4179,19 +4747,17 @@ startxref
 190
 %%EOF`;
 var MINIMAL_TEST_PDF_BASE64 = Buffer.from(MINIMAL_PDF).toString("base64");
-var SCHEME_COUNTRY_DEFAULTS = {
-  "0009": "FR",
-  "0204": "DE",
-  "0208": "BE",
-  "9925": "BE"
-};
 function deriveCountryFromPeppolId(peppolId) {
-  const [scheme, identifier = ""] = peppolId.split(":");
-  const alphaPrefix = identifier.slice(0, 2);
+  const { scheme, id } = parsePeppolId(peppolId);
+  const published = countryForScheme(scheme);
+  if (published !== void 0) {
+    return published;
+  }
+  const alphaPrefix = id.slice(0, 2);
   if (/^[A-Za-z]{2}$/.test(alphaPrefix)) {
     return alphaPrefix.toUpperCase();
   }
-  return SCHEME_COUNTRY_DEFAULTS[scheme] ?? "BE";
+  return "BE";
 }
 function buildDefaultSendPayload(overrides = {}) {
   const today = /* @__PURE__ */ new Date();