beliq-sevdesk 0.2.0 → 0.2.2

package/README.md

@@ -162,7 +162,7 @@ variable.
 | `SEVDESK_MAX_RETRIES` | | `4` | Retries on a sevDesk 429 / 5xx / network error. |
 | `SEVDESK_NOTIFY_WEBHOOK` | `--notify-webhook` | (none) | POST a JSON poll report here. Empty = no notifications. |
 | `SEVDESK_NOTIFY_ON` | | `failure` | `failure` (only on a failed invoice) or `always` (every poll). |
-| `SEVDESK_BASE_URL` | | `https://api.sevdesk.de/api/v1` | Override for a mock or a future version. |
+| `SEVDESK_BASE_URL` | | `https://my.sevdesk.de/api/v1` | Override for a mock or a future version. |
 | `BELIQ_BASE_URL` | | `https://api.beliq.eu` | Override for a self-hosted beliq. |
 | `BELIQ_AUTH` | | `header` | How the beliq key is sent: `header` (X-API-Key) or `bearer`. |
 

package/dist/config.js

@@ -1,8 +1,11 @@
 import { DEFAULT_BASE_URL, LIVE_CONVERT_TARGET_FORMATS, LIVE_PROFILES, } from '@beliq/sdk';
 import { flagBool, flagStr } from './args.js';
 import { ConfigError } from './errors.js';
-/** sevDesk default REST base. Endpoints hang off /Invoice, /Invoice/{id}/getXml. */
-export const DEFAULT_SEVDESK_BASE_URL = 'https://api.sevdesk.de/api/v1';
+/**
+ * sevDesk default REST base. Endpoints hang off /Invoice, /Invoice/{id}/getXml.
+ * `api.sevdesk.de` serves the API documentation site and 404s every REST path.
+ */
+export const DEFAULT_SEVDESK_BASE_URL = 'https://my.sevdesk.de/api/v1';
 /** sevDesk invoice status codes (Settings dropdown values), keyed by friendly name. */
 const STATUS_CODES = { draft: '100', open: '200', paid: '1000' };
 /** Read a non-empty trimmed value; flag wins over env. */

package/dist/sevdesk.js

@@ -1,6 +1,8 @@
 import { SevDeskApiError } from './errors.js';
 /** A hard ceiling on pages walked per poll, so a misconfigured window can't loop forever. */
 const MAX_PAGES = 100;
+/** Per-attempt deadline so a stalled sevDesk connection aborts instead of hanging the poll. */
+const REQUEST_TIMEOUT_MS = 30_000;
 const encoder = new TextEncoder();
 const decoder = new TextDecoder('utf-8');
 function looksLikeXml(s) {
@@ -64,6 +66,7 @@ export class SevDeskClient {
     #sleep;
     #maxRetries;
     #baseRetryDelayMs;
+    #requestTimeoutMs;
     constructor(options) {
         if (!options.token)
             throw new Error('sevdesk: token is required');
@@ -77,6 +80,7 @@ export class SevDeskClient {
         this.#sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
         this.#maxRetries = options.maxRetries ?? 4;
         this.#baseRetryDelayMs = options.baseRetryDelayMs ?? 500;
+        this.#requestTimeoutMs = options.requestTimeoutMs ?? REQUEST_TIMEOUT_MS;
     }
     async listInvoices(params) {
         const limit = params.pageSize && params.pageSize > 0 ? params.pageSize : 100;
@@ -122,25 +126,37 @@ export class SevDeskClient {
         }
         let lastError;
         for (let attempt = 0; attempt <= this.#maxRetries; attempt++) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), this.#requestTimeoutMs);
             let res;
+            let text = '';
             try {
                 res = await this.#fetch(url.toString(), {
                     method,
                     headers: { Authorization: this.#token, Accept: 'application/json' },
+                    signal: controller.signal,
                 });
+                // Read the body under the same deadline so a stalled stream also aborts.
+                if (res.ok)
+                    text = await res.text();
             }
             catch (err) {
-                lastError = err;
+                lastError = controller.signal.aborted
+                    ? new Error(`timed out after ${this.#requestTimeoutMs}ms`)
+                    : err;
                 if (attempt < this.#maxRetries) {
                     await this.#backoff(attempt);
                     continue;
                 }
                 throw new SevDeskApiError(`sevDesk ${method} ${path} network error: ${lastError.message}`, 0);
             }
+            finally {
+                clearTimeout(timer);
+            }
             if (res.ok) {
                 return {
                     status: res.status,
-                    text: await res.text(),
+                    text,
                     contentType: res.headers.get('content-type') ?? '',
                 };
             }
@@ -148,6 +164,12 @@ export class SevDeskClient {
                 await this.#backoff(attempt);
                 continue;
             }
+            // An HTML 404 means the base URL is not the REST API. api.sevdesk.de serves the
+            // documentation site and answers every REST path this way.
+            if (res.status === 404 && (res.headers.get('content-type') ?? '').includes('text/html')) {
+                throw new SevDeskApiError(`sevDesk ${method} ${path} returned an HTML 404: ${this.#baseUrl} is not the REST API. ` +
+                    'The REST base is https://my.sevdesk.de/api/v1; check SEVDESK_BASE_URL.', res.status);
+            }
             throw new SevDeskApiError(`sevDesk ${method} ${path} failed with status ${res.status}`, res.status);
         }
         // Unreachable: the loop either returns or throws. Satisfies noImplicitReturns.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beliq-sevdesk",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Self-hostable worker that polls sevDesk for e-invoices, converts each to the formats a counterparty needs, and validates them against beliq's authority-pinned, drift-checked rules. The sevDesk token never leaves your environment.",
   "license": "MIT",
   "type": "module",
@@ -57,7 +57,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@beliq/sdk": "^0.1.1"
+    "@beliq/sdk": "^0.3.0"
   },
   "devDependencies": {
     "@types/node": "^20.14.0",
@@ -65,6 +65,6 @@
     "@typescript-eslint/parser": "^7.18.0",
     "eslint": "^8.57.0",
     "typescript": "^5.5.4",
-    "vitest": "^2.1.8"
+    "vitest": "^4.0.0"
   }
 }