peppol-validator

XSD + Schematron validation for UBL 2.1 / Peppol BIS documents — invoices, credit notes, orders, despatch advice, catalogues, application responses and more.

• ✅ XSD works out of the box. The OASIS UBL 2.1 schemas are bundled; the root element is auto-detected and the matching schema is selected.
• 🧩 Schematron is bring-your-own. The Peppol / EN 16931 / XRechnung rule sets are not redistributed here (they belong to their respective bodies). Download the official .sch, compile them once with the bundled compiler, and validate.
• 🔒 Safe & hardened. External entities, DTD loading and network access are disabled; input is size-capped.

This is the open validation layer — it checks documents, it doesn't generate them.

Install

npm install peppol-validator

Quick start — XSD (zero setup)

import { validateXsd } from 'peppol-validator';

const res = validateXsd(xml);
// { valid: boolean, errors: string[], root: 'Invoice' | 'Catalogue' | ... }

if (!res.valid) console.error(res.root, res.errors);

Schematron (bring your own SEF)

The business-rule layer needs the official Schematron. You compile it once:

# 1. download the official .sch you are entitled to use, then:
npx peppol-validator-compile PEPPOLBIS-T19.sch ./artefacts/PEPPOLBIS-T19.sef.json

# or compile a whole folder of *.sch at once:
npx peppol-validator-compile ./sch ./artefacts

import { validate, validateSchematron, resolveSef } from 'peppol-validator';

// XSD + Schematron in one call
const report = await validate(xml, { sef: './artefacts/PEPPOLBIS-T19.sef.json' });
// { valid, xsd, schematron }

// …or resolve a SEF by ruleset name from an artefacts directory:
const sch = await validateSchematron(xml, resolveSef('peppol-bis-3', './artefacts'));
// { valid, errors: SvrlEntry[], warnings: SvrlEntry[] }

API

| Export | Description | |--------|-------------| | validateXsd(xml) → XsdResult | XSD validate against the bundled UBL 2.1 schema for the detected root | | validateSchematron(xml, sefPath) → Promise<SchematronResult> | Run a compiled Schematron SEF (returns errors/warnings; never throws on rule violations) | | validate(xml, { sef?, skipXsd? }) → Promise<ValidationReport> | XSD + optional Schematron; valid is the AND of the stages that ran | | resolveSef(ruleset, dir) → string | Locate a SEF by ruleset name inside a directory | | detectRoot(xml) → string \| null | The detected UBL root element | | KNOWN_RULESETS, SEF_FILENAMES | Ruleset → expected SEF filename map |

Supported roots: Invoice, CreditNote, Order, OrderResponse, OrderChange, OrderCancellation, DespatchAdvice, Catalogue, ApplicationResponse.

Known rulesets: en16931, peppol-bis-3, xrechnung-3, and the Peppol transactions T01 T16 T19 T58 T71 T76 T77 T110 T111 T114 T115 T116.

Why aren't the rule sets bundled?

The Peppol BIS, EN 16931 and XRechnung Schematron artefacts are owned by OpenPEPPOL AISBL, the European Commission (CEF eInvoicing) and KoSIT, and are not published here under a redistribution license. The bundled compiler converts the official .sch into a SaxonJS SEF locally, so you stay within the terms you accepted when downloading them.

Get the sources from the channel you're entitled to use, e.g.:

• Peppol BIS / POACC — https://docs.peppol.eu/
• EN 16931 — ConnectingEurope / eInvoicing-EN16931
• XRechnung — itplr-kosit

Requirements

Node.js ≥ 18. Uses libxmljs2 (XSD, ships prebuilt binaries) and saxon-js (Schematron, pure JS — no Java/JVM).

License

• Code: MIT — see LICENSE.
• Bundled artefacts: OASIS UBL 2.1 XSD and the MIT ISO Schematron skeleton — see NOTICE.
• Schematron rule sets you compile yourself remain under their own terms.