@getpeppr/cli 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -4,6 +4,53 @@ All notable changes to `@getpeppr/cli` are documented here.
 
 The CLI bundles `@getpeppr/sdk` into its published artifact (tsup `noExternal`), so `validate`, `convert` and `init` run the SDK's validators, country rules and UBL builder locally — an SDK release only reaches CLI users once the CLI is rebundled. Rebundle-only releases are listed with the SDK version they ship.
 
+## [0.11.0] — 2026-09-04
+
+Rebundles `@getpeppr/sdk` 5.1.0.
+
+- **`getpeppr validate` follows BR-CL-01's two vocabularies** instead of a hand-written list of seven codes. Measured against the published 0.10.0 (which bundles SDK 5.0.0):
+  - **44 legal invoice codes stop being falsely refused** — `326` (partial invoice, named by `DE-R-017`), `382` and 42 others now pass. On 0.10.0 each exits 1.
+  - **Credit notes carrying `383`, `384`, `386`, `389` or `751` are now refused locally** with a `BR-CL-01` error suggesting legal credit-note codes. On 0.10.0 each passed local validation — every one is fatal on the network, so the document failed later and less clearly.
+  - The default is unchanged: omit `invoiceTypeCode` and the document kind decides (`380` invoice, `381` credit note).
+- **The tarball now ships its `LICENSE` file** (the published 0.10.0 does not contain one) and the corrected README.
+
+## [0.10.0] — 2026-08-28
+
+Bundles SDK **5.0.0**. Minor rather than patch because inputs that used to pass
+now change the exit code — if you gate a pipeline on `getpeppr validate`, read
+this before upgrading.
+
+**What `validate` now refuses:**
+
+| Input | 0.9.0 | 0.10.0 |
+| --- | --- | --- |
+| `"currency": "BGN"` or `"HRK"` | accepted, exit 0 | `Invalid currency code`, exit 1 |
+| a negative allowance or charge `amount` | accepted, exit 0 | refused, exit 1 |
+
+Bulgaria and Croatia joined the euro, and Peppol BIS Billing 3.0.21 — mandatory
+on the network since 2026-08-17 — dropped both codes from `BR-CL-04`/`BR-CL-05`.
+Use `EUR`. Separately, `XCG` (Caribbean guilder) is now accepted; it is the
+successor to `ANG`, not a replacement for either of the two dropped codes.
+
+⚠️ **`vatCategory: "L"` and `"M"` are NOT part of this change.** Measured on the
+published 0.9.0: `validate` already exits 1 on both, because it bundles an SDK
+newer than 3.2.0. And `convert` without `--validate` still renders them, as it
+should — an IGIC document is valid EN 16931, it simply cannot travel our JSON
+send path.
+
+**And a fix this CLI never carried.** 0.9.0 bundled SDK 4.8.0, one release
+behind, so it missed the `baseQuantity` correction from 4.8.1. Measured on the
+published 0.9.0 against this build, same input — a 24-unit order priced "€30 per
+box of 12":
+
+```
+0.9.0   <cbc:LineExtensionAmount currencyID="EUR">720.00</cbc:LineExtensionAmount>
+0.10.0  <cbc:LineExtensionAmount currencyID="EUR">60.00</cbc:LineExtensionAmount>
+```
+
+720 instead of 60 is a fatal `PEPPOL-EN16931-R120` violation. `getpeppr convert`
+gets it right now (GPR-1212).
+
 ## [0.9.0] — 2026-08-23
 
 Before every sandbox send, the CLI now reads the exact sender profile from

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Zero Loop Labs Ltd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -103,7 +103,7 @@ getpeppr lookup 0208:0685660237 --json
 
 ### `getpeppr login` — Save your API key
 
-Store a getpeppr API key in `~/.config/getpeppr/credentials.json` (mode `0600`). Sandbox and live keys can coexist.
+Store a getpeppr API key in `$XDG_CONFIG_HOME/getpeppr/credentials.json` — `~/.config/getpeppr/credentials.json` by default, `%APPDATA%\getpeppr\credentials.json` on Windows. On Unix-like systems the file is created and checked with mode `0600`; Windows has no POSIX mode. Sandbox and live keys can coexist.
 
 ```bash
 # Interactive (recommended) — prompts for the key with masked input
@@ -149,6 +149,7 @@ getpeppr send invoice.json --prod
 | `--to <peppol-id>` | Recipient Peppol ID (when no file) |
 | `--amount <number>` | Line amount in major currency units |
 | `--currency <iso>` | ISO 4217 code (default `EUR`) |
+| `--country <iso>` | Recipient country (ISO 3166-1 alpha-2) when no file |
 | `--desc <text>` | Line description |
 | `--attachment` | Attach the bundled test PDF |
 | `--watch` | Poll status until terminal (60s timeout) |
@@ -189,7 +190,7 @@ If no legal entity exists in the environment yet, `whoami` says so and points to
 getpeppr logout
 ```
 
-Removes `~/.config/getpeppr/credentials.json`. No-op if the file doesn't exist.
+Removes the credentials file. No-op if the file doesn't exist.
 
 ## Exit codes