@getpeppr/sdk 3.0.0 is a major release because it removes a scheme the SDK
should never have recommended, and because a validation path that used to let
input through now checks it.
GB:CRN is gone. The Companies House number was the recommended UK default
in SCHEMES_BY_COUNTRY.GB. It is not a Peppol scheme: no EAS code, absent from
the OpenPeppol code list entirely. A Legal Entity registered under it is
reachable by nobody. Companies House remains an excellent registry to prove
who a company is — it is not an address. UK users should be offered GB:VAT.
The UK VAT rule was rebuilt from measurement. The previous /^GB\d{9}$/
accepted zero of the 390 live 9932: participants sampled from the Peppol
Directory on 2026-08-03: 351 of them write the prefix in lowercase, and 39 carry
no prefix at all. The new rule is case-insensitive and accepts 385 of the 390.
The five refused are 7-, 8- and 10-character values — almost certainly Companies
House numbers typed into a VAT field, the exact mistake this release exists to
stop.
Several forms that 2.6.0 rejected now validate, all additively: 12-digit numbers
(VAT groups and branch traders), the legacy GD and HA prefixes still in
circulation for government departments and health bodies, and Northern Ireland
XI prefixes. GB:VAT also becomes the recommended UK default, in place of the
removed GB:CRN.
The German Leitweg-ID rule rejected 17 of the 19 real identifiers we sampled,
including Stadt Augsburg, Deutsche Rentenversicherung Bund and BMW Germany. The
old pattern assumed a numeric 4–5 digit middle block; the middle block is in
fact optional, alphanumeric and 1–30 characters. German B2G onboarding was
walled off at the SDK before a request ever reached the API. 0204 is also no
longer described as public-sector-only — it is the scheme that routes to German
private companies too.
Scheme lookup is now case-insensitive, which is the change most likely to
show up in your code. In 2.6.0, validatePeppolIdentifier("gb:vat", "not-a-vat")
returned valid: true: the lowercase spelling matched no known scheme and fell
through to a permissive path. It now returns valid: false. The same applies to
de:lwid and to the numeric spelling 9932. Nothing that was correct becomes
incorrect — but input that silently passed may now be rejected.
These rules apply when you register a Peppol identity — POST /v1/legal-entities
and the onboarding endpoint — and the gateway has been running the corrected
versions since they merged in early August. What was behind is the SDK's local,
in-editor validation, and that is what this release brings in line. Invoice
validation and sending are unaffected either way: neither POST /v1/validate/server
nor POST /v1/invoices checks scheme rules.
Upgrading
npm install @getpeppr/sdk@3.0.0
If you read SCHEMES_BY_COUNTRY.GB to build a scheme picker, the GB:CRN entry
is now absent — offer GB:VAT instead. Calling
validatePeppolIdentifier("GB:CRN", …) directly now fails open: since the
scheme is no longer listed, it takes the permissive path any unrecognised scheme
takes, so ("GB:CRN", "abc") returns valid: true where 2.6.0 returned
valid: false.
Scheme options also carry a new optional aliases array, so 9932 resolves to
the same rule as GB:VAT, and DE:LWID to the same rule as 0204.
The CLI is unchanged — it does not use these exports.