@getpeppr/cli 0.8.4 → 0.9.0

package/CHANGELOG.md

@@ -4,12 +4,24 @@ All notable changes to `@getpeppr/cli` are documented here.
 
 The CLI bundles `@getpeppr/sdk` into its published artifact (tsup `noExternal`), so `validate`, `convert` and `init` run the SDK's validators, country rules and UBL builder locally — an SDK release only reaches CLI users once the CLI is rebundled. Rebundle-only releases are listed with the SDK version they ship.
 
+## [0.9.0] — 2026-08-23
+
+Before every sandbox send, the CLI now reads the exact sender profile from
+`GET /v1/identity`. Its own generated fixture is adapted to O/0 for a
+routing-only sender or AE/0 for a sender carrying a Tax Identifier. A
+user-authored file is never rewritten silently: an incompatible tax mode is
+refused locally before the invoice API is called.
+
+This replaces the incomplete static O/0 assumption in 0.8.4. It also bundles
+SDK 4.8.0 and fails closed when the provider inventory or scheme role cannot be
+verified (GPR-1149).
+
 ## [0.8.4] — 2026-08-22
 
-`getpeppr init` now scaffolds an invoice that a fresh sandbox account can send:
-the SPF Economie test receiver plus out-of-scope `O/0` lines. The previous
-template targeted the correct receiver but still carried VAT-bearing and
-reverse-charge lines, so a new sender with no VAT identifier received 422.
+`getpeppr init` scaffolded the SPF Economie test receiver plus out-of-scope
+`O/0` lines. That fixed routing-only senders but incorrectly assumed every
+sandbox sender lacked a Tax Identifier; 0.9.0 supersedes the static choice with
+the exact sender profile.
 
 Every generated `O` line includes the builder-only exemption reason required by
 the SDK's local validator. The quick `getpeppr send --to …` payload remains on

package/README.md

@@ -237,11 +237,11 @@ The CLI runs three validation engines from the [@getpeppr/sdk](https://www.npmjs
 2. **Business Rules** — Peppol BIS 3.0 / EN 16931 compliance (BR-xx, BR-CO-xx, PEPPOL-xx rules)
 3. **Country Rules** — Belgium (BE), France (FR), Italy (IT), Netherlands (NL), Germany (DE)
 
-Scaffolding (`init`), validation, and conversion run fully offline — no API key or network connection required. Only `lookup`, `send`, and `whoami` need a network connection.
+Scaffolding (`init`), validation, and conversion run fully offline — no API key or network connection required. Only `lookup`, `send`, and `whoami` need a network connection. Before a sandbox `send`, the CLI reads `GET /v1/identity`: its own generated fixture is adapted to the returned O/0 or AE/0 profile, while a user-edited file is never rewritten silently and is refused locally if its tax mode conflicts with the sender.
 
 ## Invoice format
 
-The input file must be a JSON object matching the getpeppr `InvoiceInput` type. `number`, `to`, and `lines` are required for API sends. The `from` party is included in the scaffold because offline validation and UBL conversion need seller metadata; API sends use the legal entity linked to your key. The generated file is an integration fixture: a fresh sandbox sender has no VAT identifier, so every line uses category `O` at rate `0`.
+The input file must be a JSON object matching the getpeppr `InvoiceInput` type. `number`, `to`, and `lines` are required for API sends. The `from` party is included in the scaffold because offline validation and UBL conversion need seller metadata; API sends use the legal entity linked to your key. The generated file starts as an O/0 integration fixture. At send time the CLI verifies it against the actual sender profile and never forwards an incompatible tax mode.
 
 ```json
 {

package/dist/index.js

@@ -130,7 +130,7 @@ Validating: ${pc.bold(filename)}
   return lines.join("\n");
 }
 
-// ../../../getpeppr/packages/sdk/dist/core/canonical-schemes.js
+// ../sdk/dist/core/canonical-schemes.js
 var ALIAS_TO_EAS = /* @__PURE__ */ new Map([
   ["AD:VAT", "9922"],
   ["AE:TIN", "0235"],
@@ -356,7 +356,7 @@ function countryForScheme(scheme) {
 var CANONICAL_SCHEME_COUNT = ALIAS_TO_EAS.size;
 var SCHEME_COUNTRY_COUNT = EAS_TO_COUNTRY.size;
 
-// ../../../getpeppr/packages/sdk/dist/core/peppol-id.js
+// ../sdk/dist/core/peppol-id.js
 function isWellFormedPeppolId(peppolId) {
   if (!peppolId.includes(":"))
     return false;
@@ -382,7 +382,7 @@ function parsePeppolId(peppolId) {
   };
 }
 
-// ../../../getpeppr/packages/sdk/dist/core/iso6523-icd-codes.js
+// ../sdk/dist/core/iso6523-icd-codes.js
 var ICD_CODES = /* @__PURE__ */ new Set([
   "0002",
   "0003",
@@ -642,7 +642,7 @@ function canCarryPartyIdentification(scheme, context) {
   return scheme === "SEPA" && context !== "AccountingCustomerParty";
 }
 
-// ../../../getpeppr/packages/sdk/dist/core/ubl-builder.js
+// ../sdk/dist/core/ubl-builder.js
 var UBL_NS = "urn:oasis:names:specification:ubl:schema:xsd:Invoice-2";
 var CAC_NS = "urn:oasis:names:specification:ubl:schema:xsd:CommonAggregateComponents-2";
 var CBC_NS = "urn:oasis:names:specification:ubl:schema:xsd:CommonBasicComponents-2";
@@ -1242,7 +1242,7 @@ function buildCreditNoteXml(input) {
 </CreditNote>`;
 }
 
-// ../../../getpeppr/packages/sdk/dist/core/checksums/luhn.js
+// ../sdk/dist/core/checksums/luhn.js
 function isValidLuhn(input) {
   if (typeof input !== "string")
     return false;
@@ -1283,7 +1283,7 @@ function isValidLuhnSiret(input) {
   return false;
 }
 
-// ../../../getpeppr/packages/sdk/dist/core/country-rules.js
+// ../sdk/dist/core/country-rules.js
 function warn(field, message, ruleId) {
   return { field, message, ruleId };
 }
@@ -1424,7 +1424,7 @@ function validateCountryRules(input) {
   return { errors, warnings };
 }
 
-// ../../../getpeppr/packages/sdk/dist/core/code-lists.js
+// ../sdk/dist/core/code-lists.js
 var CURRENCIES = /* @__PURE__ */ new Map([
   ["EUR", { code: "EUR", name: "Euro", minorUnits: 2 }],
   ["USD", { code: "USD", name: "US Dollar", minorUnits: 2 }],
@@ -1549,7 +1549,7 @@ function getAllUnits() {
   return Array.from(UNIT_CODES.entries()).map(([code, name]) => ({ code, name })).sort((a, b) => a.code.localeCompare(b.code));
 }
 
-// ../../../getpeppr/packages/sdk/dist/core/validator.js
+// ../sdk/dist/core/validator.js
 function error(field, message, ruleId, suggestion) {
   return { field, message, ruleId, suggestion };
 }
@@ -1781,7 +1781,7 @@ function validateInvoice(input) {
   };
 }
 
-// ../../../getpeppr/packages/sdk/dist/core/schematron.js
+// ../sdk/dist/core/schematron.js
 function violation(ruleId, severity, message, field) {
   return { ruleId, severity, message, field };
 }
@@ -2306,7 +2306,7 @@ var SDK_SCHEMATRON_RULE_IDS = [
   "PEPPOL-EN16931-R080"
 ];
 
-// ../../../getpeppr/packages/sdk/dist/core/status-precedence.js
+// ../sdk/dist/core/status-precedence.js
 var STATUS_PRECEDENCE = [
   { status: "failed", family: "terminal-failure" },
   { status: "rejected", family: "terminal-failure" },
@@ -2330,10 +2330,10 @@ function statusFamily(status) {
 }
 var TERMINAL_FAILURE_STATUSES = STATUS_PRECEDENCE.filter((e) => e.family === "terminal-failure").map((e) => e.status);
 
-// ../../../getpeppr/packages/sdk/dist/version.js
-var SDK_VERSION = "4.7.0";
+// ../sdk/dist/version.js
+var SDK_VERSION = "4.8.0";
 
-// ../../../getpeppr/packages/sdk/dist/core/client.js
+// ../sdk/dist/core/client.js
 function findHeaderCaseInsensitive(headers, name) {
   if (!headers)
     return void 0;
@@ -2604,6 +2604,8 @@ var GetpepprAdapter = class {
       params.set("limit", String(options.limit));
     if (options?.offset != null)
       params.set("offset", String(options.offset));
+    if (options?.number != null)
+      params.set("number", options.number);
     if (options?.includeLines)
       params.set("include", "lines");
     const query = params.toString() ? `?${params.toString()}` : "";
@@ -2737,7 +2739,9 @@ var GetpepprAdapter = class {
       params.set("limit", String(options.limit));
     if (options?.offset != null)
       params.set("offset", String(options.offset));
-    if (options?.invoiceId)
+    if (options?.documentId != null)
+      params.set("documentId", options.documentId);
+    if (options?.invoiceId != null)
       params.set("invoiceId", options.invoiceId);
     if (options?.dateFrom)
       params.set("dateFrom", options.dateFrom);
@@ -3244,9 +3248,49 @@ function parseAccountIdentity(raw) {
   return {
     environment,
     legalEntity: parseAccountIdentityLegalEntity(readOwn(result, "legalEntity"), result),
-    identifiers
+    identifiers,
+    sandboxFirstSend: parseSandboxFirstSendProfile(readOwn(result, "sandboxFirstSend"), result)
   };
 }
+function parseSandboxFirstSendProfile(raw, body) {
+  if (raw === null)
+    return null;
+  if (!isRecord(raw)) {
+    throw new PeppolProtocolError("The getpeppr API answered the identity request without a valid sandboxFirstSend field. Please report this response to support@getpeppr.dev.", "sandboxFirstSend", boundedBody(body));
+  }
+  const status = readOwn(raw, "status");
+  if (status === "blocked") {
+    const code = readOwn(raw, "code");
+    const message = readOwn(raw, "message");
+    if (typeof code === "string" && code.trim() !== "" && typeof message === "string" && message.trim() !== "") {
+      return { status, code, message };
+    }
+  }
+  if (status === "ready") {
+    const taxMode = readOwn(raw, "taxMode");
+    const line = readOwn(raw, "line");
+    if ((taxMode === "outside_scope" || taxMode === "reverse_charge") && isRecord(line)) {
+      const vatRate = readOwn(line, "vatRate");
+      const vatCategory = readOwn(line, "vatCategory");
+      const taxExemptReason = readOwn(line, "taxExemptReason");
+      if (vatRate === 0 && typeof taxExemptReason === "string" && taxExemptReason.trim() !== "" && taxMode === "outside_scope" && vatCategory === "O") {
+        return {
+          status,
+          taxMode,
+          line: { vatRate, vatCategory, taxExemptReason }
+        };
+      }
+      if (vatRate === 0 && typeof taxExemptReason === "string" && taxExemptReason.trim() !== "" && taxMode === "reverse_charge" && vatCategory === "AE") {
+        return {
+          status,
+          taxMode,
+          line: { vatRate, vatCategory, taxExemptReason }
+        };
+      }
+    }
+  }
+  throw new PeppolProtocolError("The getpeppr API answered the identity request with a malformed sandboxFirstSend profile. Please report this response to support@getpeppr.dev.", "sandboxFirstSend", boundedBody(body));
+}
 function parseAccountIdentityLegalEntity(raw, body) {
   if (raw === null)
     return null;
@@ -3976,8 +4020,8 @@ var EventOperations = class {
    * const result = await peppol.events.list({ limit: 10 });
    * console.log(result.data, result.meta);
    *
-   * // Filter by invoice
-   * const invoiceEvents = await peppol.events.list({ invoiceId: "inv-123" });
+   * // Filter by provider document ID or getpeppr submission ID
+   * const invoiceEvents = await peppol.events.list({ documentId: "inv-123" });
    * ```
    */
   async list(options) {
@@ -3988,7 +4032,7 @@ var EventOperations = class {
    *
    * @example
    * ```ts
-   * for await (const event of peppol.events.listAll({ invoiceId: "inv-123" })) {
+   * for await (const event of peppol.events.listAll({ documentId: "inv-123" })) {
    *   console.log(event.name, event.createdAt);
    * }
    * ```
@@ -4536,9 +4580,9 @@ function registerInitCommand(program2) {
   3. Convert to XML: getpeppr convert ${filename}
   4. Send: getpeppr send ${filename}
 
-  ${pc2.dim("Sandbox note:")} ready for a fresh sandbox account. This template
-  targets the test receiver and uses O/0 tax lines. Replace the fixture tax
-  treatment with the real category after registering the sender's VAT details.
+  ${pc2.dim("Sandbox note:")} this offline template starts with O/0 tax lines.
+  On send, the CLI checks GET /v1/identity and refuses a conflicting sender
+  profile before anything reaches the provider.
 `);
       process.exit(0);
     }
@@ -5102,11 +5146,10 @@ function buildDefaultSendPayload(overrides = {}) {
         unitPrice: amount,
         vatRate: 0,
         // vatCategory "O" = outside the scope of VAT (UBL 2.1 / EN 16931).
-        // A fresh sandbox sender has no VAT identifier, so this integration
-        // fixture deliberately uses O/0. The SDK pre-validator requires the
-        // builder-only reason; the send transport strips it so Storecove can
-        // derive its own provider-specific text.
-        // Do not fall back to VAT-bearing category "S": a fresh sandbox sender has no VAT number.
+        // This offline fixture starts at O/0. Before sending, the CLI reads
+        // GET /identity and replaces these tax fields with the sender-specific
+        // O/0 or AE/0 first-send profile. The SDK transport strips the
+        // builder-only reason so Storecove can derive its own provider text.
         vatCategory: "O",
         taxExemptReason: "Not subject to VAT"
       }
@@ -5282,6 +5325,42 @@ function registerSendCommand(program2) {
       }
       throw e;
     }
+    const baseUrl = flags.local ? LOCAL_BASE : API_BASE;
+    const client = new Peppol({ apiKey: auth.apiKey, baseUrl });
+    if (auth.environment === "sandbox") {
+      let profile;
+      try {
+        profile = (await client.identity.get()).sandboxFirstSend;
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        process.stderr.write(`${pc6.red("\u2722")} Could not verify the sandbox sender profile: ${msg}
+`);
+        process.exit(1);
+        return;
+      }
+      if (!profile || profile.status !== "ready") {
+        const message = profile?.status === "blocked" ? profile.message : "The sandbox first-send profile is unavailable.";
+        process.stderr.write(`${pc6.red("\u2722")} ${message}
+`);
+        process.exit(1);
+        return;
+      }
+      const taxEntries = [payload.lines, payload.allowances, payload.charges].filter(Array.isArray).flat();
+      const payloadOutsideScope = taxEntries.length > 0 && taxEntries.every((entry) => entry.vatCategory === "O");
+      const profileOutsideScope = profile.taxMode === "outside_scope";
+      if (file) {
+        if (payloadOutsideScope !== profileOutsideScope) {
+          process.stderr.write(
+            `${pc6.red("\u2722")} This file's tax mode does not match the sandbox sender. GET /v1/identity recommends ${profile.line.vatCategory}/0. Nothing was sent.
+`
+          );
+          process.exit(1);
+          return;
+        }
+      } else {
+        payload.lines = payload.lines.map((line) => ({ ...line, ...profile.line }));
+      }
+    }
     if (flags.validate !== false) {
       const result2 = runValidation(payload);
       if (!result2.valid) {
@@ -5302,8 +5381,6 @@ function registerSendCommand(program2) {
         process.exit(0);
       }
     }
-    const baseUrl = flags.local ? LOCAL_BASE : API_BASE;
-    const client = new Peppol({ apiKey: auth.apiKey, baseUrl });
     let result;
     try {
       result = await client.invoices.send(payload);