@kreiseck/kasseneck-api 1.19.0 → 1.21.0

package/CHANGELOG.md

@@ -4,6 +4,29 @@ Was vor 0.7.0 geschah, steht in der Commit-Historie (`git log`); ab hier wird
 es hier geführt. Ein Eintrag nennt die Änderung **und ihren Grund** —
 nur der Grund überlebt den nächsten Umbau.
 
+## 1.21.0 - 2026-10-31
+
+DEP export at the cash register (*Kassennachschau*, stage 2): the five DEP calls now also run on the register path, for the manager only, plus the words and the folder name both registers use. Additive.
+
+- **`POS_CALLS` gains `createDepExport`, `getDepExport`, `getDepExportFile`, `createDepHandoverLink` and `revokeDepHandoverLink`** (now 47, eleven of them also public). Signed in with `registerUserAuth` they go to `https://kasse.kasseneck.at/api/v3/<name>` (the web register: `/api/v3`), with `apiKeyAuth` they stay on the public base as before. Reason: the web register and the register app export the DEP during an inspection themselves instead of sending the owner to the customer area.
+- **New error code `manager_only`** in `DEP_EXPORT_ERROR_CODES` (contract `errorCodes.depExport`): on the register path only the manager exports, that is the owner or a register user with the permission `layout` (the one both registers call *Kassen-Chef*). A device with an API key is not affected.
+- **Words of the screen *Prüfung (DEP)*** in `LABELS` (`nav.dep`, `dep.*`: title, period choice, create, save to USB stick, link for the inspector, code, valid until, revoke, checksum) and `MESSAGES` (`dep.*`: manager only, offline with the two working days, creating, running, failed, daily limit, period invalid, USB hint, saved, save failed, ZIP fallback in the browser, code shown once, revoked). `ERROR_CODE_RULES` map `manager_only`, `export_running` and `too_many_exports` to the register's own sentence; deliberately not `export_failed` (also a code of the payment paths, where the outcome can be unknown) and not `too_many_links` (the backend's sentence names the limit). Reason: web register and app say the same.
+- **`depFolderName(cashregisterId, from?, to?)`** (`./pos`): the folder on the USB stick, `DEP_<cash register id>_<from>_<to>`, `DEP_<id>_alles` without a period, `bis_`/`ab_` with one end only; characters FAT32 or exFAT refuse become `_`. Cases in `fixtures/dep-folder-cases.json` (also used by the Dart twin).
+- Contract `v3` re-fetched from the backend (the five calls in `endpoints.register`, `manager_only`, register-path cases).
+
+## 1.20.0 - 2026-10-30
+
+DEP export for the cash register inspection (*Kassennachschau*): `createDepExport`, `getDepExport`, `waitForDepExport`, `getDepExportFile`, `createDepHandoverLink` and `revokeDepHandoverLink` for the five new public endpoints (`/v3` only). Additive.
+
+- **`createDepExport({ from?, to?, requestId? })`** (root and `createKasseneckApi`, `apiKeyAuth` with `cashregister-token` like `listReceipts`) queues an export of the data capture log (§ 19 para. 2 RKSV) and answers at once with `{ exportId, status, from, to }`. `from`/`to` are real calendar days `YYYY-MM-DD`, `to` not before `from`; `requestId` at most 64 characters of `A-Z a-z 0-9 _ -`; all checked before sending (`KasseneckValidationError`, `scope: 'request'`). Classified `repeatable` (not in `UNKNOWN_OUTCOME_CALLS`, outcome `rejected` after a lost answer): with `requestId` the call is idempotent, without it a repeat only starts a second export (limit 20 a day, no booking); resend with the **same** `requestId` and period to get the first, with its current `status` (also `done` or `failed`). The same `requestId` with another period is rejected with `idempotency_conflict`; `export_running` names the running export in `details.exportId`. Reason: an export runs minutes in the background and the hosting redirect cuts requests after 60 s, so creating and fetching are separate calls.
+- **`getDepExport({ exportId })`** returns `DepExport`: `status` `running|done|failed`, `from`/`to`, `createdAt`/`finishedAt` (ISO 8601 UTC), `receiptCount`, `counterFrom`/`counterTo`, `sha256`/`size` of the DEP file, `findings` (`DepExportFindings`: `gaps [{ from, to }]`, `chainBreaks` with at most the first break, `withoutCounter` and `withoutSignature` as receipt ids), `items` (`rowCount`, `sha256`, `size`; `null` for exports from before item lines), `handoverLinks` (`DepHandoverLinkInfo`, never address or code) and, when failed, `error` `export_failed|export_stalled`. A body without `exportId`, with an unknown `status` or without `handoverLinks` throws `KasseneckValidationError` (`scope: 'response'`).
+- **`waitForDepExport({ exportId, timeoutMs = 600000 })`** polls `getDepExport`: the first query at once, then after 2 s, every wait 1.5 times longer, at most 15 s (`DEP_EXPORT_POLL_*`); the last wait is shortened to the deadline, so the last query lies on it. `done` returns the export, `failed` throws `KasseneckApiError` with `code` `export_failed` or `export_stalled` (`details.exportId`; both in the type `DepExportErrorCode`), the deadline throws the new `DepExportTimeoutError` (`exportId`, `timeoutMs`, `lastStatus`; no `KasseneckApiError`, because the export keeps running and must be looked up, not queued again). A failing query (also a network error) ends the wait with its own error; the export keeps running, follow it with `getDepExport` (README). Reason: callers should not each write the same loop with their own back-off.
+- **`getDepExportFile({ exportId, file, sha256?, downloadTimeoutMs? })`**, `file` `dep|protocol|items|zip` (`DEP_EXPORT_FILES`), returns `{ bytes, fileName, contentType, sha256 }`. The server answers up to 9 MiB with the file itself and above with JSON `{ download: { url, expiresAt, size, sha256, fileName, contentType } }`; the package follows the link (`GET`, no sign-in headers, https only, `http` only for localhost) and checks size and SHA-256 against the server's values. `downloadTimeoutMs` (default 600000 = 10 minutes, checked before sending) limits the call itself and the download over the link, each; the client's general `timeoutMs` (30 s) does not apply to this call. Reason: the server reads and checks a direct file of up to 9 MiB before it answers, which can take longer than 30 s. With `sha256` (for example `DepExport.sha256` or `items.sha256`) it checks a direct file as well; the sum is a client-side check and not sent. A mismatch throws `DepExportChecksumError` (a `KasseneckValidationError` with `scope: 'response'`, `expected`, `actual`). Errors while loading the link (`KasseneckHttpError`, `KasseneckNetworkError`) and the messages never contain the signed address. Reason: a download link carries the permission, and a file that does not match its checksum must not be handed on.
+- **New transport entry `createFileOrDataTransport`** (root and `./client`, types `FileOrData`, `FileOrDataCallOptions`, `KasseneckFileOrDataTransport`): takes an optional per-call `{ timeoutMs }` (otherwise the transport's), reads the answer as bytes and decides on `Content-Disposition: attachment` between `{ file: { bytes, fileName, contentType } }` and the `data` of a success envelope (an error envelope gives the usual `KasseneckApiError`). The existing `createPdfOrDataTransport` decides on `%PDF` and cannot tell DEP JSON, CSV or ZIP from an envelope. The file name from the header is reduced to its last path part and stripped of control characters.
+- **`createDepHandoverLink({ exportId })`** returns `{ linkId, url, code, expiresAt }` (valid 14 days; `url` and the 6-digit `code`, a string with leading zeros, only in this answer), **`revokeDepHandoverLink({ linkId })`** returns `{ linkId, revokedAt }`. Both are `repeatable` like `createDepExport`: a repeated `createDepHandoverLink` makes a second link (the first stays in `getDepExport().handoverLinks` and can be revoked; the price is at most `too_many_links`), `revokeDepHandoverLink` is idempotent. `getDepExport` and `getDepExportFile` are reads.
+- **`DEP_EXPORT_ERROR_CODES`** equal to `errorCodes.depExport` of the contract (order included, every code in `errorCodes.all`; pinned by a test): `validation`, `invalid_period`, `idempotency_conflict`, `export_running`, `too_many_exports`, `export_not_found`, `export_not_ready`, `export_failed`, `invalid_file`, `file_not_available`, `too_many_links`, `link_not_found` (unknown or of another cash register; revoking twice is no error), `server_error` (plus the codes of sign-in and edge). **`DEP_EXPORT_FAILURES`** (`export_failed`, `export_stalled`) equal to the values of the contract catalogue `DEP_EXPORT_FEHLER`. Type `DepExportErrorCode` covers both lists.
+- `PUBLIC_CALLS` is now 113 and `ALL_CALLS`, `CALLS_WITHOUT_EFFECT` know the five calls (two reads, three `repeatable`; `UNKNOWN_OUTCOME_CALLS` unchanged). Contract `v3` re-fetched from the backend (the five endpoints in `endpoints.public`, `v3Routed` and the effect lists; their schemas are empty; `errorCodes.depExport` and `catalogs.DEP_EXPORT_FEHLER`).
+
 ## 1.19.0 - 2026-10-30
 
 The full view of `listReceipts` delivers what `getReceipt` delivers (backend 30.10.2026, spec `list-receipts-voll`). Additive for reading.
@@ -12,6 +35,7 @@ The full view of `listReceipts` delivers what `getReceipt` delivers (backend 30.
 - **Receipts of the full view: `ListedFullReceipt`** (`Receipt` plus `testSignature`); `registrationInfo` on zero receipts. No server `layout` in the list: it is the main cost driver of a page (about 2.7 times the size) and only needed for the receipt someone opens or prints, so it stays with `getReceiptWithCompany`. New helper `listedReceiptWithCompany(page, receipt)` returns the `ReceiptWithCompany` of `getReceiptWithCompany` without `outputs` and with `layout: null`; `receiptLayoutFromResult` builds the layout from it. Reason: one way to print and show a receipt, single or from the list.
 - **Provider data follow the caller, not the channel.** The backend now returns `payments[].providerPaymentId`/`providerData` (and `cardPaymentId`/`cardPaymentData` on old card receipts) to the business itself on both channels, in `getReceipt`, `createReceipt`, `cancelReceipt`, `getReportV2` and `listReceipts`; a partner access never. No API change here (the fields were already optional); `cardRefundReference` and the card-refund check now name that rule in their messages. Reason: the restriction to the register channel stopped nobody holding the API key and pushed integrations into the register channel.
 - Contract re-fetched from the backend: provider data now in the `/v3` cases of `belege.json` and `storno.json`, schema of `listReceipts` with the new fields; other files change only `_quelle`.
+
 ## 1.18.0 - 2026-10-30
 
 Recording handwritten receipts (Nacherfassung). After a register outage or a sale outside the premises the business

package/README.md

@@ -553,7 +553,8 @@ The facade from `createKasseneckApi` offers `sellReceipt` and
 `sendReceiptEmail`, the report downloads, the FinanzOnline status queries
 (`getCashboxStatus`, `getSignatureStatus`), `getReportV2({ start, end })` for
 the raw receipts and company data of a period, `listReceipts` and
-`listAllReceipts` for receipt lists page by page (see below), and the Stripe
+`listAllReceipts` for receipt lists page by page (see below), the DEP export
+for the cash register inspection (see below), and the Stripe
 and Hobex cloud payments.
 
 The models are English throughout: the company has `taxNumber` and `vatId`, a
@@ -673,6 +674,74 @@ for await (const receipt of api.listAllReceipts({ from: '2026-10-01', to: '2026-
   cash register or query, or changed window, `order` or `view`),
   `server_error`, plus the codes of sign-in and edge.
 
+### DEP export for the cash register inspection (*Kassennachschau*)
+
+For a period named by the inspector (§ 19 para. 2 RKSV) the register hands out
+its data capture log (*DEP*), a protocol, the item lines and everything as a ZIP,
+and a handover link with a code the inspector opens without signing in. Same
+sign-in as `listReceipts` (API key plus `cashregister-token`, the cash register
+comes from the token), only on `/v3`.
+
+```ts
+const started = await api.createDepExport({ from: '2026-10-01', to: '2026-10-29', requestId: 'inspection-2026-10-30' });
+const dep = await api.waitForDepExport({ exportId: started.exportId });   // polls 2 s, x1.5, at most 15 s
+console.log(dep.receiptCount, dep.findings?.gaps, dep.findings?.chainBreaks);
+
+// DEP JSON, checked against the checksum the export names.
+const file = await api.getDepExportFile({ exportId: dep.exportId, file: 'dep', sha256: dep.sha256! });
+// file.bytes, file.fileName, file.contentType, file.sha256
+
+const link = await api.createDepHandoverLink({ exportId: dep.exportId });  // { linkId, url, code, expiresAt }
+await api.revokeDepHandoverLink({ linkId: link.linkId });
+```
+
+- **`createDepExport({ from?, to?, requestId? })`** queues the export and
+  answers at once with `{ exportId, status: 'running', from, to }`; it runs in
+  the background, at most one per cash register at a time (`export_running`,
+  `details.exportId` names the running one). `from`/`to` are `YYYY-MM-DD`, both
+  inclusive; without them the whole stock is exported. With a `requestId` (at
+  most 64 characters of `A-Z a-z 0-9 _ -`) the call is repeatable: the same
+  value with the same period returns that export with its current `status`
+  (also `done` or `failed`); the same value with another period is rejected
+  with `idempotency_conflict`. After a lost answer resend with the **same**
+  `requestId` and period (without it you only get a second export).
+- **`getDepExport({ exportId })`** returns `DepExport`: `status`
+  (`running|done|failed`), counts, `sha256`/`size` of the DEP file, `findings`
+  (`gaps` as ranges of missing receipt numbers, `chainBreaks`, receipts
+  `withoutCounter` and `withoutSignature`), `items` (the CSV of item lines),
+  `handoverLinks` and, when failed, `error` (`export_failed|export_stalled`).
+- **`waitForDepExport({ exportId, timeoutMs = 600000 })`** polls `getDepExport`
+  (first at once, then after 2 s, each wait 1.5 times longer, at most 15 s) and
+  returns the finished export. A failed export throws `KasseneckApiError` whose
+  `code` is the export's `error` (`export_failed` or `export_stalled`); after
+  `timeoutMs` it throws `DepExportTimeoutError` (the export keeps running on
+  the server: look it up with `getDepExport`, do not queue a new one). A
+  network error while waiting also ends `waitForDepExport` with that error; the
+  export keeps running on the server as well, follow it with `getDepExport`.
+- **`getDepExportFile({ exportId, file, sha256?, downloadTimeoutMs? })`** with
+  `file` `dep`, `protocol` (PDF), `items` (CSV) or `zip`. Up to 9 MiB the server
+  sends the file itself, above it a signed download link (15 minutes); the
+  package follows the link, so the result is the same: `{ bytes, fileName, contentType, sha256 }`.
+  A file is recognised by `Content-Disposition: attachment`, never by its
+  content type (the DEP itself is JSON). `downloadTimeoutMs` (default 600000)
+  limits the call itself and the download over a link, each; the general
+  `timeoutMs` of the client (30 s) does not apply here, because a direct file
+  of up to 9 MiB comes in the answer of the call.
+  The SHA-256 is always checked against the sum the server names with a link;
+  pass `sha256` (for example `dep.sha256`, `dep.items.sha256`) to check a direct
+  file as well. A mismatch throws `DepExportChecksumError`
+  (`KasseneckValidationError`, `scope: 'response'`); do not use the bytes.
+- **`createDepHandoverLink` / `revokeDepHandoverLink`:** the link is valid for
+  14 days, `url` and the 6-digit `code` (a string, keep leading zeros) come only
+  in this answer and are handed over separately.
+- **Errors** (`KasseneckApiError.code`, `DEP_EXPORT_ERROR_CODES`, the list
+  `errorCodes.depExport` of the contract): `validation`, `invalid_period`,
+  `idempotency_conflict`, `export_running`, `too_many_exports`,
+  `export_not_found`, `export_not_ready`, `export_failed`, `invalid_file`,
+  `file_not_available`, `too_many_links`, `link_not_found`, `server_error`, plus
+  the codes of sign-in and edge; `waitForDepExport` also throws `export_stalled`
+  (type `DepExportErrorCode`). Revoking a link twice is no error.
+
 ## Cancellation (Storno)
 
 A cancellation (*Storno*) refers to the original receipt, in full or in part:

package/dist/cjs/client/api.d.ts

@@ -4,6 +4,7 @@ import { type HobexPayOptions, type HobexRefundOptions } from '../payments/hobex
 import { type TransportOptions } from './transport.js';
 import { type CashregisterReportPeriod, type ReportV2, type ReportV2Options } from './reports.js';
 import { type CashboxStatus, type SignatureStatus } from './status.js';
+import { type CreateDepExportOptions, type CreateDepExportResult, type DepExport, type DepExportFile, type DepHandoverLink, type GetDepExportFileOptions, type RevokedDepHandoverLink, type WaitForDepExportOptions } from './dep-export.js';
 import { type ListedReceipt, type ListReceiptsOptions, type ListReceiptsPage, type ListReceiptsView } from './list-receipts.js';
 import { type SendReceiptEmailOptions, type SendReceiptEmailResult, type LogReceiptOutputsOptions, type LogReceiptOutputsResult, type ListMyReceiptsOptions, type ReceiptList, type ReceiptWithCompany, type SellReceiptOptions, type CancelReceiptOptions, type CancelReceiptResult } from './receipts.js';
 /**
@@ -61,6 +62,24 @@ export interface KasseneckApi {
     listReceipts<V extends ListReceiptsView = 'summary'>(options: ListReceiptsOptions<V>): Promise<ListReceiptsPage<V>>;
     /** Alle Belege eines Tages oder Zeitraums, Seite fuer Seite geholt (hoechstens 100 Seiten). */
     listAllReceipts<V extends ListReceiptsView = 'summary'>(options: ListReceiptsOptions<V>): AsyncGenerator<ListedReceipt<V>, void, undefined>;
+    /** DEP-Export fuer die Kassennachschau einstellen (`createDepExport`, nur /v3); antwortet sofort, der Export laeuft im Hintergrund. */
+    createDepExport(options?: CreateDepExportOptions): Promise<CreateDepExportResult>;
+    /** Zustand, Kennzahlen, Befund und Pruefer-Links eines Exports (`getDepExport`). */
+    getDepExport(options: {
+        exportId: string;
+    }): Promise<DepExport>;
+    /** Wartet, bis der Export fertig ist (Abfrage 2 s, x1,5, hoechstens 15 s; Vorgabe 10 Minuten). */
+    waitForDepExport(options: WaitForDepExportOptions): Promise<DepExport>;
+    /** Eine Datei des Exports (dep, protocol, items, zip) laden und gegen die SHA-256-Summe pruefen. */
+    getDepExportFile(options: GetDepExportFileOptions): Promise<DepExportFile>;
+    /** Pruefer-Link (Adresse und 6-stelliger Code, 14 Tage) zu einem fertigen Export. */
+    createDepHandoverLink(options: {
+        exportId: string;
+    }): Promise<DepHandoverLink>;
+    /** Pruefer-Link der eigenen Kasse widerrufen. */
+    revokeDepHandoverLink(options: {
+        linkId: string;
+    }): Promise<RevokedDepHandoverLink>;
     /** Kassenbericht als PDF (v2): abgeschlossener Monat, Tag oder Zeitraum (Endpunkt `getCashregisterReport`). */
     getCashregisterReport(options: CashregisterReportPeriod): Promise<Uint8Array>;
     /** @deprecated Since 1.10.0: use getCashregisterReport. Tagesbericht als PDF (Kalendertag nach Wiener Zeit). */

package/dist/cjs/client/api.js

@@ -6,6 +6,7 @@ const hobex_js_1 = require("../payments/hobex.js");
 const transport_js_1 = require("./transport.js");
 const reports_js_1 = require("./reports.js");
 const status_js_1 = require("./status.js");
+const dep_export_js_1 = require("./dep-export.js");
 const list_receipts_js_1 = require("./list-receipts.js");
 const receipts_js_1 = require("./receipts.js");
 const cashregisters_js_1 = require("./cashregisters.js");
@@ -15,6 +16,17 @@ function createKasseneckApi(options) {
     // Zweiter Einstiegspunkt fuer die PDF-Downloads; dieselben Optionen,
     // dieselbe Anmeldung — nur die Antwort wird als Bytes gelesen.
     const rufenBinaer = (0, transport_js_1.createBinaryTransport)(options);
+    // Fuer Dateien beliebiger Art (DEP-Export): Datei oder Lese-Link.
+    const rufenDatei = (0, transport_js_1.createFileOrDataTransport)(options);
+    // Das globale fetch erst beim Folgen eines Lese-Links holen: ohne Link braucht es niemand.
+    const holen = (url, init) => {
+        if (options.fetch)
+            return options.fetch(url, init);
+        const umgebung = globalThis;
+        if (typeof umgebung.fetch !== 'function')
+            throw new Error('getDepExportFile: kein globales fetch vorhanden');
+        return umgebung.fetch(url, init);
+    };
     return {
         sellReceipt: (o) => (0, receipts_js_1.sellReceipt)(rufen, o),
         sellReceiptWithCompany: (o) => (0, receipts_js_1.sellReceiptWithCompany)(rufen, o),
@@ -31,6 +43,12 @@ function createKasseneckApi(options) {
         getReportV2: (o) => (0, reports_js_1.getReportV2)(rufen, o),
         listReceipts: (o) => (0, list_receipts_js_1.listReceipts)(rufen, o),
         listAllReceipts: (o) => (0, list_receipts_js_1.listAllReceipts)(rufen, o),
+        createDepExport: (o) => (0, dep_export_js_1.createDepExport)(rufen, o),
+        getDepExport: (o) => (0, dep_export_js_1.getDepExport)(rufen, o),
+        waitForDepExport: (o) => (0, dep_export_js_1.waitForDepExport)(rufen, o),
+        getDepExportFile: (o) => (0, dep_export_js_1.getDepExportFile)(rufenDatei, holen, o),
+        createDepHandoverLink: (o) => (0, dep_export_js_1.createDepHandoverLink)(rufen, o),
+        revokeDepHandoverLink: (o) => (0, dep_export_js_1.revokeDepHandoverLink)(rufen, o),
         getCashregisterReport: (options) => (0, reports_js_1.getCashregisterReport)(rufenBinaer, options),
         downloadDailyReport: (date) => (0, reports_js_1.downloadDailyReport)(rufenBinaer, date),
         downloadMonthlyReport: (reportMonth) => (0, reports_js_1.downloadMonthlyReport)(rufenBinaer, reportMonth),

package/dist/cjs/client/aufrufe.d.ts

@@ -12,8 +12,8 @@
  * weiterhin jeden `string`: wer einen Aufruf braucht, den dieses Paket nicht
  * umhuellt, muss ihn weiterhin absetzen koennen.
  */
-import type { PdfOrData, TransportBodyFields, TransportCallOptions } from './transport.js';
-export declare const ALL_CALLS: readonly ["activateCashregister", "cancelInvoice", "cancelReceipt", "createCreditNote", "createCustomer", "createCustomerCashregister", "createPartnerCustomer", "checkPartnerCustomerEmail", "createPartnerWebhook", "createPaymentLinkStripe", "createPrintJob", "createReceipt", "deletePartnerWebhook", "downloadDailyReport", "downloadReport", "endRegisterSession", "financeWebService", "generateFullReceiptId", "getCashregisterReport", "getCustomer", "getCustomerCredentials", "getCustomerSignatureStatus", "getFirstReceiptDate", "getInvoice", "getInvoicePdf", "getInvoiceSetupStatus", "getInvoiceXml", "getKasseSettings", "getPartnerCustomer", "getPartnerInfo", "getPrintJob", "getReceipt", "getReportV2", "hobexPayApi", "hobexRefundApi", "issueInvoice", "listCustomerCashregisters", "listInvoices", "listBrands", "listMyArticleGroups", "listMyArticles", "listMyCashregisters", "listMyPrinters", "listMyReceipts", "listMyStock", "listMyStockLocations", "listMyTipRecipients", "listPartnerCustomers", "listPartnerWebhookDeliveries", "listPartnerWebhooks", "listReceipts", "listRegisterUsersForDevice", "listRegisterSessionsForDevice", "pairRegisterDevice", "recordInvoicePayment", "registerPinLogin", "registerUserLogin", "renewRegisterSession", "reportCustomerContract", "requestCustomerSignature", "searchCustomers", "sendPartnerCustomerFonLink", "sendPartnerWebhookTest", "sendReceiptEmail", "setMyCashregisterStockLocation", "setMyKasseLogo", "setMyKasseSettings", "setMyRegisterDeviceSettings", "stripeCaptureIntent", "unpairRegisterDevice", "rotatePartnerWebhookSecret", "updateCustomer", "updatePartnerWebhook", "getArticle", "listArticles", "lookupArticleByCode", "listLocations", "getStock", "listStock", "listStockMovements", "createWebhook", "updateWebhook", "deleteWebhook", "listWebhooks", "sendWebhookTest", "rotateWebhookSecret", "listWebhookDeliveries", "createArticle", "updateArticle", "deactivateArticle", "receiveGoods", "transferStock", "recordStockLoss", "changeStockCondition", "reverseStockMovement", "createReservation", "extendReservation", "releaseReservation", "getReservation", "listReservations", "createVariantGroup", "updateVariantGroup", "getVariantGroup", "listVariantGroups", "addVariant", "createStocktake", "listStocktakes", "getStocktake", "listStocktakeItems", "recordStocktakeCount", "voidStocktakeCount", "listStocktakeCounts", "reviewStocktake", "recountStocktake", "closeStocktake", "cancelStocktake", "getStocktakePdf", "orderSignatureCard", "getSignatureCardOrder", "listMyStocktakes", "listMyStocktakeItems", "listMyStocktakeCounts", "recordMyStocktakeCount", "voidMyStocktakeCount", "checkVoucher", "reprintVoucherLabel", "getMyDrawerState", "openMyShift", "recordMyCashMovement", "logMyDrawerOpenings", "getMyShiftReport", "closeMyShift", "logReceiptOutputs"];
+import type { FileOrData, FileOrDataCallOptions, PdfOrData, TransportBodyFields, TransportCallOptions } from './transport.js';
+export declare const ALL_CALLS: readonly ["activateCashregister", "cancelInvoice", "cancelReceipt", "createCreditNote", "createCustomer", "createCustomerCashregister", "createDepExport", "createDepHandoverLink", "createPartnerCustomer", "checkPartnerCustomerEmail", "createPartnerWebhook", "createPaymentLinkStripe", "createPrintJob", "createReceipt", "deletePartnerWebhook", "downloadDailyReport", "downloadReport", "endRegisterSession", "financeWebService", "generateFullReceiptId", "getCashregisterReport", "getCustomer", "getCustomerCredentials", "getCustomerSignatureStatus", "getDepExport", "getDepExportFile", "getFirstReceiptDate", "getInvoice", "getInvoicePdf", "getInvoiceSetupStatus", "getInvoiceXml", "getKasseSettings", "getPartnerCustomer", "getPartnerInfo", "getPrintJob", "getReceipt", "getReportV2", "hobexPayApi", "hobexRefundApi", "issueInvoice", "listCustomerCashregisters", "listInvoices", "listBrands", "listMyArticleGroups", "listMyArticles", "listMyCashregisters", "listMyPrinters", "listMyReceipts", "listMyStock", "listMyStockLocations", "listMyTipRecipients", "listPartnerCustomers", "listPartnerWebhookDeliveries", "listPartnerWebhooks", "listReceipts", "listRegisterUsersForDevice", "listRegisterSessionsForDevice", "pairRegisterDevice", "recordInvoicePayment", "registerPinLogin", "registerUserLogin", "renewRegisterSession", "reportCustomerContract", "requestCustomerSignature", "revokeDepHandoverLink", "searchCustomers", "sendPartnerCustomerFonLink", "sendPartnerWebhookTest", "sendReceiptEmail", "setMyCashregisterStockLocation", "setMyKasseLogo", "setMyKasseSettings", "setMyRegisterDeviceSettings", "stripeCaptureIntent", "unpairRegisterDevice", "rotatePartnerWebhookSecret", "updateCustomer", "updatePartnerWebhook", "getArticle", "listArticles", "lookupArticleByCode", "listLocations", "getStock", "listStock", "listStockMovements", "createWebhook", "updateWebhook", "deleteWebhook", "listWebhooks", "sendWebhookTest", "rotateWebhookSecret", "listWebhookDeliveries", "createArticle", "updateArticle", "deactivateArticle", "receiveGoods", "transferStock", "recordStockLoss", "changeStockCondition", "reverseStockMovement", "createReservation", "extendReservation", "releaseReservation", "getReservation", "listReservations", "createVariantGroup", "updateVariantGroup", "getVariantGroup", "listVariantGroups", "addVariant", "createStocktake", "listStocktakes", "getStocktake", "listStocktakeItems", "recordStocktakeCount", "voidStocktakeCount", "listStocktakeCounts", "reviewStocktake", "recountStocktake", "closeStocktake", "cancelStocktake", "getStocktakePdf", "orderSignatureCard", "getSignatureCardOrder", "listMyStocktakes", "listMyStocktakeItems", "listMyStocktakeCounts", "recordMyStocktakeCount", "voidMyStocktakeCount", "checkVoucher", "reprintVoucherLabel", "getMyDrawerState", "openMyShift", "recordMyCashMovement", "logMyDrawerOpenings", "getMyShiftReport", "closeMyShift", "logReceiptOutputs"];
 export type ApiCall = typeof ALL_CALLS[number];
 /**
  * Die oeffentlichen Endpunkte unter `/v3` (`https://api.kasseneck.at/v3/<name>`),
@@ -21,14 +21,15 @@ export type ApiCall = typeof ALL_CALLS[number];
  * (`fixtures/v3/v3-vokabular.json`, `endpoints.public`, umbenannt nach
  * `names`). Ein Test haelt beide Listen deckungsgleich.
  */
-export declare const PUBLIC_CALLS: readonly ["createReceipt", "getReceipt", "cancelReceipt", "sendReceiptEmail", "generateFullReceiptId", "downloadReceipt", "getFirstReceiptDate", "getReportV2", "downloadReport", "downloadDailyReport", "getCashregisterReport", "createPaymentLinkStripe", "stripeCaptureIntent", "hobexPayApi", "hobexRefundApi", "hobexGetStatus", "financeWebService", "listMyTipRecipients", "getPartnerInfo", "createPartnerCustomer", "checkPartnerCustomerEmail", "listPartnerCustomers", "getPartnerCustomer", "sendPartnerCustomerFonLink", "createPartnerWebhook", "updatePartnerWebhook", "deletePartnerWebhook", "listPartnerWebhooks", "sendPartnerWebhookTest", "rotatePartnerWebhookSecret", "listPartnerWebhookDeliveries", "requestCustomerSignature", "getCustomerSignatureStatus", "createCustomerCashregister", "activateCashregister", "listCustomerCashregisters", "getCustomerCredentials", "reportCustomerContract", "getPartnerBilling", "getPartnerBillingMonth", "createCustomer", "getCustomer", "updateCustomer", "searchCustomers", "issueInvoice", "cancelInvoice", "createCreditNote", "getInvoice", "listInvoices", "getInvoicePdf", "getInvoiceXml", "getInvoiceSetupStatus", "listBrands", "recordInvoicePayment", "createInvoiceItem", "updateInvoiceItem", "withdrawInvoiceItem", "getInvoiceItem", "listInvoiceItems", "setCustomerMandate", "revokeCustomerMandate", "getArticle", "listArticles", "lookupArticleByCode", "listLocations", "getStock", "listStock", "listStockMovements", "createWebhook", "updateWebhook", "deleteWebhook", "listWebhooks", "sendWebhookTest", "rotateWebhookSecret", "listWebhookDeliveries", "createArticle", "updateArticle", "deactivateArticle", "receiveGoods", "transferStock", "recordStockLoss", "changeStockCondition", "reverseStockMovement", "createReservation", "extendReservation", "releaseReservation", "getReservation", "listReservations", "createVariantGroup", "updateVariantGroup", "getVariantGroup", "listVariantGroups", "addVariant", "createStocktake", "listStocktakes", "getStocktake", "listStocktakeItems", "recordStocktakeCount", "voidStocktakeCount", "listStocktakeCounts", "reviewStocktake", "recountStocktake", "closeStocktake", "cancelStocktake", "getStocktakePdf", "orderSignatureCard", "getSignatureCardOrder", "listReceipts"];
+export declare const PUBLIC_CALLS: readonly ["createReceipt", "getReceipt", "cancelReceipt", "sendReceiptEmail", "generateFullReceiptId", "downloadReceipt", "getFirstReceiptDate", "getReportV2", "downloadReport", "downloadDailyReport", "getCashregisterReport", "createPaymentLinkStripe", "stripeCaptureIntent", "hobexPayApi", "hobexRefundApi", "hobexGetStatus", "financeWebService", "listMyTipRecipients", "getPartnerInfo", "createPartnerCustomer", "checkPartnerCustomerEmail", "listPartnerCustomers", "getPartnerCustomer", "sendPartnerCustomerFonLink", "createPartnerWebhook", "updatePartnerWebhook", "deletePartnerWebhook", "listPartnerWebhooks", "sendPartnerWebhookTest", "rotatePartnerWebhookSecret", "listPartnerWebhookDeliveries", "requestCustomerSignature", "getCustomerSignatureStatus", "createCustomerCashregister", "activateCashregister", "listCustomerCashregisters", "getCustomerCredentials", "reportCustomerContract", "getPartnerBilling", "getPartnerBillingMonth", "createCustomer", "getCustomer", "updateCustomer", "searchCustomers", "issueInvoice", "cancelInvoice", "createCreditNote", "getInvoice", "listInvoices", "getInvoicePdf", "getInvoiceXml", "getInvoiceSetupStatus", "listBrands", "recordInvoicePayment", "createInvoiceItem", "updateInvoiceItem", "withdrawInvoiceItem", "getInvoiceItem", "listInvoiceItems", "setCustomerMandate", "revokeCustomerMandate", "getArticle", "listArticles", "lookupArticleByCode", "listLocations", "getStock", "listStock", "listStockMovements", "createWebhook", "updateWebhook", "deleteWebhook", "listWebhooks", "sendWebhookTest", "rotateWebhookSecret", "listWebhookDeliveries", "createArticle", "updateArticle", "deactivateArticle", "receiveGoods", "transferStock", "recordStockLoss", "changeStockCondition", "reverseStockMovement", "createReservation", "extendReservation", "releaseReservation", "getReservation", "listReservations", "createVariantGroup", "updateVariantGroup", "getVariantGroup", "listVariantGroups", "addVariant", "createStocktake", "listStocktakes", "getStocktake", "listStocktakeItems", "recordStocktakeCount", "voidStocktakeCount", "listStocktakeCounts", "reviewStocktake", "recountStocktake", "closeStocktake", "cancelStocktake", "getStocktakePdf", "orderSignatureCard", "getSignatureCardOrder", "listReceipts", "createDepExport", "getDepExport", "getDepExportFile", "createDepHandoverLink", "revokeDepHandoverLink"];
 /**
  * Die Endpunkte des Kassenwegs (`https://kasse.kasseneck.at/api/v3/<name>`,
  * Web-Kasse: gleicher Ursprung `/api/v3`), in der Reihenfolge von
- * `endpoints.register`. Sechs davon sind zugleich oeffentlich; die Kasse ruft
- * sie trotzdem ueber diesen Weg (ein Dialekt je Client, Nachtrag §5.2).
+ * `endpoints.register`. Elf davon sind zugleich oeffentlich (sechs Beleg-Aufrufe und
+ * die fuenf DEP-Aufrufe); die Kasse ruft sie trotzdem ueber diesen Weg (ein Dialekt
+ * je Client, Nachtrag §5.2).
  */
-export declare const POS_CALLS: readonly ["pairRegisterDevice", "listRegisterUsersForDevice", "listRegisterSessionsForDevice", "registerUserLogin", "registerPinLogin", "renewRegisterSession", "endRegisterSession", "unpairRegisterDevice", "listMyCashregisters", "listMyReceipts", "getReceipt", "createReceipt", "generateFullReceiptId", "cancelReceipt", "sendReceiptEmail", "listMyArticleGroups", "listMyArticles", "getKasseSettings", "setMyKasseSettings", "setMyKasseLogo", "setMyRegisterDeviceSettings", "listMyPrinters", "createPrintJob", "getPrintJob", "listMyTipRecipients", "listMyStockLocations", "listMyStock", "setMyCashregisterStockLocation", "listMyStocktakes", "listMyStocktakeItems", "listMyStocktakeCounts", "recordMyStocktakeCount", "voidMyStocktakeCount", "checkVoucher", "reprintVoucherLabel", "getMyDrawerState", "openMyShift", "recordMyCashMovement", "logMyDrawerOpenings", "getMyShiftReport", "closeMyShift", "logReceiptOutputs"];
+export declare const POS_CALLS: readonly ["pairRegisterDevice", "listRegisterUsersForDevice", "listRegisterSessionsForDevice", "registerUserLogin", "registerPinLogin", "renewRegisterSession", "endRegisterSession", "unpairRegisterDevice", "listMyCashregisters", "listMyReceipts", "getReceipt", "createReceipt", "generateFullReceiptId", "cancelReceipt", "sendReceiptEmail", "listMyArticleGroups", "listMyArticles", "getKasseSettings", "setMyKasseSettings", "setMyKasseLogo", "setMyRegisterDeviceSettings", "listMyPrinters", "createPrintJob", "getPrintJob", "listMyTipRecipients", "listMyStockLocations", "listMyStock", "setMyCashregisterStockLocation", "listMyStocktakes", "listMyStocktakeItems", "listMyStocktakeCounts", "recordMyStocktakeCount", "voidMyStocktakeCount", "checkVoucher", "reprintVoucherLabel", "getMyDrawerState", "openMyShift", "recordMyCashMovement", "logMyDrawerOpenings", "getMyShiftReport", "closeMyShift", "logReceiptOutputs", "createDepExport", "getDepExport", "getDepExportFile", "createDepHandoverLink", "revokeDepHandoverLink"];
 export type PublicCall = typeof PUBLIC_CALLS[number];
 export type PosCall = typeof POS_CALLS[number];
 /**
@@ -99,3 +100,5 @@ export type InternerTransport = <T = unknown>(functionName: ApiCall, params?: Re
 export type InternerBinaerTransport = (functionName: ApiCall, params?: Record<string, unknown>) => Promise<Uint8Array>;
 /** Wie `createPdfOrDataTransport` (transport.ts), nur mit bekanntem Aufrufnamen. */
 export type InternerPdfOderDatenTransport = (functionName: ApiCall, params?: Record<string, unknown>) => Promise<PdfOrData>;
+/** Wie `createFileOrDataTransport` (transport.ts), nur mit bekanntem Aufrufnamen. */
+export type InternerDateiOderDatenTransport = (functionName: ApiCall, params?: Record<string, unknown>, options?: FileOrDataCallOptions) => Promise<FileOrData>;

package/dist/cjs/client/aufrufe.js

@@ -11,6 +11,8 @@ exports.ALL_CALLS = [
     'createCreditNote',
     'createCustomer',
     'createCustomerCashregister',
+    'createDepExport',
+    'createDepHandoverLink',
     'createPartnerCustomer',
     'checkPartnerCustomerEmail',
     'createPartnerWebhook',
@@ -27,6 +29,8 @@ exports.ALL_CALLS = [
     'getCustomer',
     'getCustomerCredentials',
     'getCustomerSignatureStatus',
+    'getDepExport',
+    'getDepExportFile',
     'getFirstReceiptDate',
     'getInvoice',
     'getInvoicePdf',
@@ -65,6 +69,7 @@ exports.ALL_CALLS = [
     'renewRegisterSession',
     'reportCustomerContract',
     'requestCustomerSignature',
+    'revokeDepHandoverLink',
     'searchCustomers',
     'sendPartnerCustomerFonLink',
     'sendPartnerWebhookTest',
@@ -271,12 +276,19 @@ exports.PUBLIC_CALLS = [
     'getSignatureCardOrder',
     // Belege einer Kasse auflisten, nur unter /v3 (Nachfolger von getReportV2 fuer Listen).
     'listReceipts',
+    // DEP-Export fuer die Kassennachschau (Kassen-Token), nur unter /v3.
+    'createDepExport',
+    'getDepExport',
+    'getDepExportFile',
+    'createDepHandoverLink',
+    'revokeDepHandoverLink',
 ];
 /**
  * Die Endpunkte des Kassenwegs (`https://kasse.kasseneck.at/api/v3/<name>`,
  * Web-Kasse: gleicher Ursprung `/api/v3`), in der Reihenfolge von
- * `endpoints.register`. Sechs davon sind zugleich oeffentlich; die Kasse ruft
- * sie trotzdem ueber diesen Weg (ein Dialekt je Client, Nachtrag §5.2).
+ * `endpoints.register`. Elf davon sind zugleich oeffentlich (sechs Beleg-Aufrufe und
+ * die fuenf DEP-Aufrufe); die Kasse ruft sie trotzdem ueber diesen Weg (ein Dialekt
+ * je Client, Nachtrag §5.2).
  */
 exports.POS_CALLS = [
     'pairRegisterDevice',
@@ -326,6 +338,12 @@ exports.POS_CALLS = [
     'closeMyShift',
     // Ausgaben eines Belegs melden: nur ueber den Kassenweg.
     'logReceiptOutputs',
+    // DEP fuer die Kassennachschau (Stufe 2): zugleich oeffentlich; an der Kasse nur fuer den Chef (manager_only).
+    'createDepExport',
+    'getDepExport',
+    'getDepExportFile',
+    'createDepHandoverLink',
+    'revokeDepHandoverLink',
 ];
 /**
  * Die Aufrufe **mit Wirkung**, alphabetisch: sie legen etwas an, aendern oder
@@ -455,6 +473,15 @@ exports.CALLS_WITHOUT_EFFECT = Object.freeze({
     getCustomer: 'read',
     getCustomerCredentials: 'read',
     getCustomerSignatureStatus: 'read',
+    // DEP-Export: ein verlorener Ausgang ist harmlos wiederholbar. createDepExport ist mit requestId idempotent, ohne nur
+    // doppelt (Grenze 20 je Tag, keine Buchung). createDepHandoverLink erzeugt bei Wiederholung einen zweiten Link (der
+    // alte steht in getDepExport().handoverLinks und ist widerrufbar; Preis hoechstens too_many_links). revokeDepHandoverLink
+    // ist idempotent.
+    createDepExport: 'repeatable',
+    createDepHandoverLink: 'repeatable',
+    revokeDepHandoverLink: 'repeatable',
+    getDepExport: 'read',
+    getDepExportFile: 'read',
     getFirstReceiptDate: 'read',
     getInvoice: 'read',
     getInvoiceItem: 'read',

package/dist/cjs/client/dep-export.d.ts

@@ -0,0 +1,242 @@
+import { KasseneckValidationError } from './errors.js';
+import type { InternerDateiOderDatenTransport, InternerTransport } from './aufrufe.js';
+import type { FetchLike } from './transport.js';
+/**
+ * DEP-Export fuer die Kassennachschau (nur unter `/v3`): ein Export des
+ * Datenerfassungsprotokolls fuer einen vom Pruefungsorgan vorgegebenen
+ * Zeitraum (§ 19 Abs. 2 RKSV), Dateien zum Abholen und ein Pruefer-Link mit
+ * Code, ueber den das Pruefungsorgan die Dateien ohne Anmeldung laedt.
+ *
+ * **Anmeldung wie `listReceipts`:** API-Schluessel plus `cashregister-token`;
+ * die Kasse kommt aus dem Token, nie aus einem Parameter. Ein Export einer
+ * anderen Kasse ist `export_not_found`.
+ *
+ * **Ablauf:** `createDepExport` stellt den Export ein und antwortet sofort
+ * (`status: 'running'`; eine Wiederholung mit derselben `requestId` nennt den
+ * aktuellen Stand); er laeuft im Hintergrund. `waitForDepExport` fragt bis zum
+ * Ende, `getDepExportFile` holt eine Datei, `createDepHandoverLink` erzeugt den
+ * Link fuer das Pruefungsorgan.
+ */
+/** Zustand eines Exports: in Arbeit, fertig oder fehlgeschlagen. */
+export declare const DEP_EXPORT_STATUSES: readonly ["running", "done", "failed"];
+export type DepExportStatus = (typeof DEP_EXPORT_STATUSES)[number];
+/** Die Dateien eines Exports: DEP-JSON, Protokoll (PDF), Positionen (CSV) und alles zusammen als ZIP. */
+export declare const DEP_EXPORT_FILES: readonly ["dep", "protocol", "items", "zip"];
+export type DepExportFileKind = (typeof DEP_EXPORT_FILES)[number];
+/**
+ * Fehlercodes der fuenf Aufrufe (`code` des [KasseneckApiError]) wie im
+ * Vertrag des Backends (`errorCodes.depExport` in `fixtures/v3/v3-vokabular.json`,
+ * Katalog `dep_nachschau`), in dessen Reihenfolge; dazu kommen die gemeinsamen
+ * Codes von Anmeldung und Rand. Ein Code ausserhalb bleibt ueber
+ * `KasseneckApiError.code` lesbar.
+ */
+export declare const DEP_EXPORT_ERROR_CODES: readonly ["validation", "invalid_period", "idempotency_conflict", "export_running", "too_many_exports", "export_not_found", "export_not_ready", "export_failed", "invalid_file", "file_not_available", "too_many_links", "link_not_found", "manager_only", "server_error"];
+/**
+ * Warum ein Export fehlgeschlagen ist (`DepExport.error`): die Werte des
+ * Katalogs `DEP_EXPORT_FEHLER` im Vertrag. `export_stalled` = nach 35 Minuten
+ * nicht fertig.
+ */
+export declare const DEP_EXPORT_FAILURES: readonly ["export_failed", "export_stalled"];
+export type DepExportFailure = (typeof DEP_EXPORT_FAILURES)[number];
+/**
+ * Codes, die die DEP-Aufrufe als `KasseneckApiError.code` werfen:
+ * [DEP_EXPORT_ERROR_CODES] und, aus [waitForDepExport], die Gruende eines
+ * fehlgeschlagenen Exports ([DEP_EXPORT_FAILURES], also auch `export_stalled`).
+ */
+export type DepExportErrorCode = (typeof DEP_EXPORT_ERROR_CODES)[number] | DepExportFailure;
+/** Eingabe von [createDepExport]. Ohne `from`/`to` der ganze Bestand. */
+export interface CreateDepExportOptions {
+    /** Erster Tag (inklusive), `YYYY-MM-DD`, nicht in der Zukunft. */
+    from?: string;
+    /** Letzter Tag (inklusive), `YYYY-MM-DD`, nicht vor `from`. */
+    to?: string;
+    /**
+     * Wiederholungsschutz je Kasse: derselbe Wert mit demselben Zeitraum
+     * liefert denselben Export (mit seinem aktuellen Stand) statt eines zweiten;
+     * mit anderem Zeitraum `idempotency_conflict`. Hoechstens 64 Zeichen aus
+     * `A-Z a-z 0-9 _ -`. Bei unklarem Ausgang (Zeitlimit) mit **demselben** Wert
+     * und demselben Zeitraum wiederholen.
+     */
+    requestId?: string;
+}
+/** Antwort von [createDepExport]: Kennung und Zustand (bei einer wiederholten `requestId` auch `done`). */
+export interface CreateDepExportResult {
+    exportId: string;
+    status: DepExportStatus;
+    from: string | null;
+    to: string | null;
+}
+/** Eine Luecke in der Belegnummerierung: Zaehler von bis (einschliesslich). */
+export interface DepExportGap {
+    from: number;
+    to: number;
+}
+/** Erster Bruch der Signaturkette: am Zaehler `counter` erwartet, aber gefunden. */
+export interface DepExportChainBreak {
+    counter: number | null;
+    expected: unknown;
+    found: unknown;
+}
+/** Befund der Pruefung des Exports (`DepExport.findings`). */
+export interface DepExportFindings {
+    receiptCount: number | null;
+    counterFrom: number | null;
+    counterTo: number | null;
+    /** Fehlende Belegnummern als zusammenhaengende Bereiche. */
+    gaps: DepExportGap[];
+    /** Hoechstens ein Eintrag: der erste Bruch der Kette. */
+    chainBreaks: DepExportChainBreak[];
+    /** `receiptId` der Belege ohne Zaehler. */
+    withoutCounter: string[];
+    /** `receiptId` der Belege ohne Signatur. */
+    withoutSignature: string[];
+}
+/** Die Positionsdatei (CSV) eines Exports; `null` bei Exporten aus der Zeit davor. */
+export interface DepExportItems {
+    rowCount: number;
+    sha256: string;
+    size: number;
+}
+/** Ein Pruefer-Link, wie ihn der Export auffuehrt (ohne Adresse und Code). */
+export interface DepHandoverLinkInfo {
+    linkId: string;
+    createdAt: string | null;
+    expiresAt: string | null;
+    revokedAt: string | null;
+    firstAccessAt: string | null;
+    accessCount: number;
+}
+/** Ein Export mit Zustand, Kennzahlen, Befund und Links (`getDepExport`). Zeiten ISO 8601 (UTC). */
+export interface DepExport {
+    exportId: string;
+    status: DepExportStatus;
+    from: string | null;
+    to: string | null;
+    createdAt: string | null;
+    finishedAt: string | null;
+    receiptCount: number | null;
+    counterFrom: number | null;
+    counterTo: number | null;
+    /** SHA-256 (hex) der DEP-JSON-Datei. */
+    sha256: string | null;
+    /** Groesse der DEP-JSON-Datei in Byte. */
+    size: number | null;
+    findings: DepExportFindings | null;
+    items: DepExportItems | null;
+    handoverLinks: DepHandoverLinkInfo[];
+    /** Nur bei `status: 'failed'`: `export_stalled` (haengend) oder `export_failed`. */
+    error?: DepExportFailure;
+}
+/** Eingabe von [waitForDepExport]. */
+export interface WaitForDepExportOptions {
+    exportId: string;
+    /** Hoechstdauer in Millisekunden (Vorgabe 600.000 = 10 Minuten). */
+    timeoutMs?: number;
+}
+/** Eingabe von [getDepExportFile]. */
+export interface GetDepExportFileOptions {
+    exportId: string;
+    file: DepExportFileKind;
+    /**
+     * Bekannte SHA-256-Pruefsumme (hex) der Datei, etwa `DepExport.sha256` fuer
+     * `dep` oder `DepExport.items.sha256` fuer `items`. Weicht die geladene Datei
+     * ab, wirft der Aufruf. Bei einem Lese-Link prueft der Aufruf ausserdem immer
+     * gegen die Pruefsumme, die der Server mit dem Link nennt.
+     */
+    sha256?: string;
+    /**
+     * Zeitlimit in Millisekunden (Vorgabe 600.000), je fuer den Aufruf selbst und
+     * fuer das Laden ueber einen Lese-Link. Der Aufruf liefert eine Datei bis
+     * 9 MiB direkt und braucht dafuer mehr als das allgemeine Zeitlimit des
+     * Transports (`timeoutMs`, Vorgabe 30 s); es gilt hier nicht.
+     */
+    downloadTimeoutMs?: number;
+}
+/** Eine geladene, gepruefte Datei. */
+export interface DepExportFile {
+    bytes: Uint8Array;
+    fileName: string;
+    contentType: string;
+    /** SHA-256 (hex) der Bytes, vom Paket berechnet. */
+    sha256: string;
+}
+/** Ein erzeugter Pruefer-Link (`createDepHandoverLink`). Adresse und Code nur jetzt, danach nie wieder. */
+export interface DepHandoverLink {
+    linkId: string;
+    /** Adresse fuer das Pruefungsorgan (Token im Fragment). */
+    url: string;
+    /** 6-stelliger Code, getrennt von der Adresse zu uebergeben. */
+    code: string;
+    expiresAt: string;
+}
+/** Antwort von [revokeDepHandoverLink]. */
+export interface RevokedDepHandoverLink {
+    linkId: string;
+    revokedAt: string | null;
+}
+/** Wartezeiten von [waitForDepExport]: 2 s, dann je x1,5, hoechstens 15 s. */
+export declare const DEP_EXPORT_POLL_START_MS = 2000;
+export declare const DEP_EXPORT_POLL_FACTOR = 1.5;
+export declare const DEP_EXPORT_POLL_MAX_MS = 15000;
+/** Vorgabe fuer `waitForDepExport.timeoutMs`. */
+export declare const DEP_EXPORT_WAIT_TIMEOUT_MS = 600000;
+/** Vorgabe fuer `getDepExportFile.downloadTimeoutMs`: der Aufruf selbst und das Laden ueber einen Lese-Link. */
+export declare const DEP_EXPORT_DOWNLOAD_TIMEOUT_MS = 600000;
+/**
+ * [waitForDepExport] gab auf, weil der Export nach `timeoutMs` weder fertig
+ * noch fehlgeschlagen war. Der Export laeuft serverseitig weiter: mit
+ * `getDepExport` (oder erneutem Warten) nachsehen, nicht neu anstossen.
+ */
+export declare class DepExportTimeoutError extends Error {
+    readonly name = "DepExportTimeoutError";
+    readonly exportId: string;
+    readonly timeoutMs: number;
+    /** Zustand bei der letzten Abfrage. */
+    readonly lastStatus: DepExportStatus;
+    constructor(exportId: string, timeoutMs: number, lastStatus: DepExportStatus);
+}
+/** Das Ergebnis stimmt nicht mit der Pruefsumme ueberein: die Datei ist nicht zu verwenden. */
+export declare class DepExportChecksumError extends KasseneckValidationError {
+    readonly expected: string;
+    readonly actual: string;
+    constructor(exportId: string, file: DepExportFileKind, expected: string, actual: string);
+}
+/**
+ * Stellt einen DEP-Export ein (`createDepExport`) und antwortet sofort mit
+ * `status: 'running'`. Hoechstens ein laufender Export je Kasse
+ * (`export_running`, `details.exportId` nennt ihn). Mit `requestId` ist der
+ * Aufruf wiederholbar: dieselbe Kennung mit demselben Zeitraum liefert den
+ * bestehenden Export mit seinem aktuellen Stand (auch `done` oder `failed`),
+ * mit anderem Zeitraum `idempotency_conflict`.
+ */
+export declare function createDepExport(transport: InternerTransport, options?: CreateDepExportOptions): Promise<CreateDepExportResult>;
+/** Zustand, Kennzahlen, Befund und Links eines Exports (`getDepExport`). */
+export declare function getDepExport(transport: InternerTransport, options: {
+    exportId: string;
+}): Promise<DepExport>;
+/**
+ * Wartet, bis der Export fertig ist, und gibt ihn zurueck. Fragt mit
+ * [DEP_EXPORT_POLL_START_MS] Abstand, dann je x[DEP_EXPORT_POLL_FACTOR],
+ * hoechstens [DEP_EXPORT_POLL_MAX_MS]. Bei `failed` wirft er einen
+ * [KasseneckApiError] mit `code` `export_failed` oder `export_stalled`
+ * (haengender Export); nach `timeoutMs` einen [DepExportTimeoutError]. Ein
+ * Fehler beim Abfragen selbst bricht ab.
+ */
+export declare function waitForDepExport(transport: InternerTransport, options: WaitForDepExportOptions): Promise<DepExport>;
+/**
+ * Holt eine Datei eines fertigen Exports (`getDepExportFile`). Der Server
+ * liefert sie bis 9 MiB selbst, darueber als signierten Lese-Link (15 Minuten);
+ * dem Link folgt dieser Aufruf und laedt die Bytes. In beiden Faellen ist das
+ * Ergebnis dasselbe. Geprueft wird die SHA-256-Summe: beim Lese-Link immer
+ * gegen die Summe des Servers, sonst und zusaetzlich gegen `options.sha256`,
+ * wenn sie bekannt ist. Eine Abweichung wirft [DepExportChecksumError].
+ */
+export declare function getDepExportFile(transport: InternerDateiOderDatenTransport, fetchFn: FetchLike, options: GetDepExportFileOptions): Promise<DepExportFile>;
+/** Erzeugt einen Pruefer-Link zu einem fertigen Export (`createDepHandoverLink`). Gueltig 14 Tage. */
+export declare function createDepHandoverLink(transport: InternerTransport, options: {
+    exportId: string;
+}): Promise<DepHandoverLink>;
+/** Widerruft einen Pruefer-Link der eigenen Kasse (`revokeDepHandoverLink`). */
+export declare function revokeDepHandoverLink(transport: InternerTransport, options: {
+    linkId: string;
+}): Promise<RevokedDepHandoverLink>;