kassza 0.5.1 → 0.7.0

package/README.md

@@ -645,9 +645,11 @@ Csak a Számlázz.hu IP-címeiről jövő kérést érdemes elfogadni:
 ```ts
 import { isSzamlazzIp } from 'kassza/ipn'
 
-isSzamlazzIp(request.headers.get('x-forwarded-for') ?? '')
+isSzamlazzIp(request.headers.get('x-forwarded-for'))
 ```
 
+Az `x-forwarded-for` fejlécből a **jobb szélső** címet vizsgálja, vagyis azt, amit a hozzád legközelebbi proxy látott, mert a fejléc bal oldalát a kliens is írhatja. Ha több megbízható proxy van előtted, add meg a számukat: `isSzamlazzIp(fejlec, { trustedProxies: 1 })`.
+
 📖 **Dokumentáció:** [IPN fizetési értesítés](https://kassza-amber.vercel.app/docs/befizetes-rogzitese/ipn)
 
 </details>

package/agents/api.md

@@ -190,7 +190,8 @@ createMockKassza({ defaults?, taxpayers?: Record<taxpayerId, TaxpayerInfo>, cred
 - `parseIpnNotification(body: string | URLSearchParams | FormData | Record<string, string>): IpnNotification`
 - `IpnNotification` is `{ invoiceNumber, proformaNumber?, orderNumber?, grossTotal, paidAmount, paymentMethod?, paymentDate?, isFullyPaid, raw }`.
 - `ipnOkResponse(): Response`
-- `isSzamlazzIp(ip)` and `SZAMLAZZ_OUTBOUND_IPS`.
+- `isSzamlazzIp(ip, { trustedProxies?, allowedIps? })` and `SZAMLAZZ_OUTBOUND_IPS`. `ip` may be an `x-forwarded-for` list: the rightmost entry is checked, after skipping `trustedProxies` entries.
+- `readIpnNotification` rejects bodies above `MAX_IPN_BODY_BYTES` (64 KiB) with a `validation` error.
 
 ### `kassza/validators`
 

package/agents/pitfalls.md

@@ -30,7 +30,7 @@ Read this before writing any code that issues invoices or receipts. These rules
 | `registerPayment` | `additive` defaults to `true` and appends to earlier payments | Use `clearPayments` to wipe them |
 | Session cookie | Expires after 90 minutes of inactivity; the in-memory store is per process | In serverless, pass a shared `cookieStore` from `kassza/cookie-stores` |
 | IPN webhook | Retried every 3 minutes, at most 10 times; only the latest one per invoice is sent | Respond with HTTP 200 quickly and process idempotently |
-| IPN source check | `isSzamlazzIp` trusts the first `x-forwarded-for` entry | Use it only behind a proxy you control |
+| IPN source check | `isSzamlazzIp` checks the rightmost `x-forwarded-for` entry, the address your nearest proxy saw; the left side is client-controlled | Behind several proxies pass `{ trustedProxies: n }`; never feed it a header that no proxy of yours writes |
 | `buyer.groupTaxNumber`, item `dataDeletionCode` | Documented on docs.szamlazz.hu, but missing from the downloadable `xmlszamla.xsd` (and `torloKod` from `xmlnyugtacreate.xsd`) | Use them only when needed; if you get error 57, remove them |
 | NAV receipt data reporting | Mandatory since 2026-09-01, with a grace period until 2026-12-31 | No code change needed yet; watch the kassza changelog |
 

package/dist/cookie-stores/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_binary = require("../binary-B89HM03_.cjs");
-const require_session = require("../session-CRGOuz-R.cjs");
+const require_session = require("../session-CKOuE6Jc.cjs");
 //#region src/cookie-stores/resilient.ts
 function warnCookieStoreError(event) {
 	console.warn(`[szamlazz] A session cookie store "${event.operation}" művelete sikertelen, a kérés session nélkül folytatódik.`, event.error);

package/dist/cookie-stores/index.js

@@ -1,5 +1,5 @@
 import { r as decodeUtf8 } from "../binary-D0M9U2MD.js";
-import { n as memoryCookieStore, t as SESSION_TTL_SECONDS } from "../session-OJMLGufT.js";
+import { n as memoryCookieStore, t as SESSION_TTL_SECONDS } from "../session-rMKaJcmq.js";
 //#region src/cookie-stores/resilient.ts
 function warnCookieStoreError(event) {
 	console.warn(`[szamlazz] A session cookie store "${event.operation}" művelete sikertelen, a kérés session nélkül folytatódik.`, event.error);

package/dist/{create-DDZaNlOz.js → create-5YkUcJSe.js}

@@ -30,10 +30,16 @@ const NAMED_ENTITIES = {
 	quot: "\"",
 	apos: "'"
 };
+const MAX_CODE_POINT = 1114111;
+const MIN_SURROGATE = 55296;
+const MAX_SURROGATE = 57343;
+function codePointToString(codePoint, fallback) {
+	return Number.isInteger(codePoint) && codePoint >= 0 && codePoint <= MAX_CODE_POINT && (codePoint < MIN_SURROGATE || codePoint > MAX_SURROGATE) ? String.fromCodePoint(codePoint) : fallback;
+}
 function decodeEntities(value) {
 	return value.replace(/&(#x[0-9a-fA-F]+|#\d+|[a-zA-Z]+);/g, (match, entity) => {
-		if (entity.startsWith("#x")) return String.fromCodePoint(Number.parseInt(entity.slice(2), 16));
-		if (entity.startsWith("#")) return String.fromCodePoint(Number.parseInt(entity.slice(1), 10));
+		if (entity.startsWith("#x")) return codePointToString(Number.parseInt(entity.slice(2), 16), match);
+		if (entity.startsWith("#")) return codePointToString(Number.parseInt(entity.slice(1), 10), match);
 		return NAMED_ENTITIES[entity] ?? match;
 	});
 }
@@ -51,6 +57,17 @@ function parseAttributes(source) {
 	}
 	return attributes;
 }
+function findTagEnd(xml, from) {
+	let quote;
+	for (let index = from; index < xml.length; index++) {
+		const char = xml[index];
+		if (quote !== void 0) {
+			if (char === quote) quote = void 0;
+		} else if (char === "\"" || char === "'") quote = char;
+		else if (char === ">") return index;
+	}
+	return -1;
+}
 function skipUntil(xml, from, terminator) {
 	const end = xml.indexOf(terminator, from);
 	if (end === -1) throw new XmlParseError(`Lezáratlan szerkezet, hiányzik: ${terminator}`);
@@ -90,7 +107,7 @@ function parseXml(xml) {
 			position = skipUntil(xml, tagStart + 2, ">");
 			continue;
 		}
-		const tagEnd = xml.indexOf(">", tagStart);
+		const tagEnd = findTagEnd(xml, tagStart + 1);
 		if (tagEnd === -1) throw new XmlParseError("Lezáratlan XML tag");
 		const rawTag = xml.slice(tagStart + 1, tagEnd);
 		position = tagEnd + 1;
@@ -329,6 +346,7 @@ function escapeXml(value) {
 }
 function formatXmlNumber(value) {
 	if (!Number.isFinite(value)) throw new RangeError(`Az XML-be csak véges szám írható, kapott: ${value}`);
+	if (Math.abs(value) > Number.MAX_SAFE_INTEGER) throw new RangeError(`Az XML-be írható szám abszolút értéke legfeljebb 2^53 - 1 lehet, kapott: ${value}`);
 	if (Number.isInteger(value)) return value.toString();
 	const fixed = value.toFixed(10).replace(/0+$/, "").replace(/\.$/, "");
 	return fixed === "-0" ? "0" : fixed;

package/dist/{create-BZd6CUO7.cjs → create-DZsl3Z4m.cjs}

@@ -30,10 +30,16 @@ const NAMED_ENTITIES = {
 	quot: "\"",
 	apos: "'"
 };
+const MAX_CODE_POINT = 1114111;
+const MIN_SURROGATE = 55296;
+const MAX_SURROGATE = 57343;
+function codePointToString(codePoint, fallback) {
+	return Number.isInteger(codePoint) && codePoint >= 0 && codePoint <= MAX_CODE_POINT && (codePoint < MIN_SURROGATE || codePoint > MAX_SURROGATE) ? String.fromCodePoint(codePoint) : fallback;
+}
 function decodeEntities(value) {
 	return value.replace(/&(#x[0-9a-fA-F]+|#\d+|[a-zA-Z]+);/g, (match, entity) => {
-		if (entity.startsWith("#x")) return String.fromCodePoint(Number.parseInt(entity.slice(2), 16));
-		if (entity.startsWith("#")) return String.fromCodePoint(Number.parseInt(entity.slice(1), 10));
+		if (entity.startsWith("#x")) return codePointToString(Number.parseInt(entity.slice(2), 16), match);
+		if (entity.startsWith("#")) return codePointToString(Number.parseInt(entity.slice(1), 10), match);
 		return NAMED_ENTITIES[entity] ?? match;
 	});
 }
@@ -51,6 +57,17 @@ function parseAttributes(source) {
 	}
 	return attributes;
 }
+function findTagEnd(xml, from) {
+	let quote;
+	for (let index = from; index < xml.length; index++) {
+		const char = xml[index];
+		if (quote !== void 0) {
+			if (char === quote) quote = void 0;
+		} else if (char === "\"" || char === "'") quote = char;
+		else if (char === ">") return index;
+	}
+	return -1;
+}
 function skipUntil(xml, from, terminator) {
 	const end = xml.indexOf(terminator, from);
 	if (end === -1) throw new XmlParseError(`Lezáratlan szerkezet, hiányzik: ${terminator}`);
@@ -90,7 +107,7 @@ function parseXml(xml) {
 			position = skipUntil(xml, tagStart + 2, ">");
 			continue;
 		}
-		const tagEnd = xml.indexOf(">", tagStart);
+		const tagEnd = findTagEnd(xml, tagStart + 1);
 		if (tagEnd === -1) throw new XmlParseError("Lezáratlan XML tag");
 		const rawTag = xml.slice(tagStart + 1, tagEnd);
 		position = tagEnd + 1;
@@ -329,6 +346,7 @@ function escapeXml(value) {
 }
 function formatXmlNumber(value) {
 	if (!Number.isFinite(value)) throw new RangeError(`Az XML-be csak véges szám írható, kapott: ${value}`);
+	if (Math.abs(value) > Number.MAX_SAFE_INTEGER) throw new RangeError(`Az XML-be írható szám abszolút értéke legfeljebb 2^53 - 1 lehet, kapott: ${value}`);
 	if (Number.isInteger(value)) return value.toString();
 	const fixed = value.toFixed(10).replace(/0+$/, "").replace(/\.$/, "");
 	return fixed === "-0" ? "0" : fixed;

package/dist/index.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_create = require("./create-BZd6CUO7.cjs");
+const require_create = require("./create-DZsl3Z4m.cjs");
 const require_errors = require("./errors-B0QJhUW1.cjs");
 const require_binary = require("./binary-B89HM03_.cjs");
-const require_session = require("./session-CRGOuz-R.cjs");
+const require_session = require("./session-CKOuE6Jc.cjs");
 const require_dates = require("./dates-PPxH0n5H.cjs");
 const require_money = require("./money-DkiGukAw.cjs");
 const DEFAULT_SAFE_ATTEMPTS = 3;
@@ -63,6 +63,15 @@ async function ignoreStoreFailure(operation) {
 		return;
 	}
 }
+function callHook(hook, event) {
+	if (!hook) return;
+	try {
+		const result = hook(event);
+		if (result instanceof Promise) result.catch(() => void 0);
+	} catch {
+		return;
+	}
+}
 function clampAttempts(value) {
 	if (value === void 0) return DEFAULT_SAFE_ATTEMPTS;
 	if (!Number.isInteger(value) || value < 1) throw configurationError(`A maxAttempts értéke legalább 1 egész szám legyen, kapott: ${value}`);
@@ -77,16 +86,22 @@ function createAgentContext(options = {}) {
 	const safeAttempts = clampAttempts(options.maxAttempts);
 	const retryDelayMs = options.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS;
 	const cookieStore = options.cookieStore === false ? void 0 : options.cookieStore ?? require_session.memoryCookieStore();
-	const sessionKey = require_session.sessionKeyFor(credentials.map((node) => String(node.content)).join("|"));
+	const sessionSecret = credentials.map((node) => String(node.content)).join("|");
+	let sessionKeyPromise;
+	const resolveSessionKey = () => {
+		sessionKeyPromise ??= require_session.sessionKeyFor(sessionSecret);
+		return sessionKeyPromise;
+	};
 	const hooks = options.hooks ?? {};
 	async function send(request) {
-		const cookie = cookieStore ? await ignoreStoreFailure(() => cookieStore.get(sessionKey)) : void 0;
+		const cookie = cookieStore ? await ignoreStoreFailure(async () => cookieStore.get(await resolveSessionKey())) : void 0;
 		request.signal?.throwIfAborted();
 		const headers = new Headers({ Accept: "application/xml, application/pdf, text/plain, */*" });
 		if (cookie) headers.set("Cookie", cookie);
 		const timeoutSignal = AbortSignal.timeout(timeoutMs);
 		const signal = request.signal ? AbortSignal.any([request.signal, timeoutSignal]) : timeoutSignal;
 		let response;
+		let body;
 		try {
 			response = await fetchImpl(endpoint, {
 				method: "POST",
@@ -94,6 +109,7 @@ function createAgentContext(options = {}) {
 				body: buildFormData(request),
 				signal
 			});
+			body = new Uint8Array(await response.arrayBuffer());
 		} catch (error) {
 			if (request.signal?.aborted) throw request.signal.reason;
 			if (timeoutSignal.aborted || isAbortError(error)) throw new require_errors.SzamlazzError(`A Számlázz.hu nem válaszolt ${timeoutMs} ms alatt.`, {
@@ -107,27 +123,26 @@ function createAgentContext(options = {}) {
 				cause: error
 			});
 		}
-		const body = new Uint8Array(await response.arrayBuffer());
 		if (cookieStore) {
 			const merged = require_session.mergeSetCookies(cookie, response.headers);
-			if (merged) await ignoreStoreFailure(() => cookieStore.set(sessionKey, merged, require_session.SESSION_TTL_SECONDS));
+			if (merged) await ignoreStoreFailure(async () => cookieStore.set(await resolveSessionKey(), merged, require_session.SESSION_TTL_SECONDS));
 		}
 		return require_create.createAgentResponse(request.action, response.status, response.headers, body);
 	}
 	async function resetSession() {
-		if (cookieStore) await ignoreStoreFailure(() => cookieStore.delete(sessionKey));
+		if (cookieStore) await ignoreStoreFailure(async () => cookieStore.delete(await resolveSessionKey()));
 	}
 	async function execute(request, parse) {
 		const maxAttempts = request.safeToRetry ? safeAttempts : 1;
 		for (let attempt = 1;; attempt++) {
 			const startedAt = Date.now();
-			hooks.onRequest?.({
+			callHook(hooks.onRequest, {
 				action: request.action,
 				attempt
 			});
 			try {
 				const response = await send(request);
-				hooks.onResponse?.({
+				callHook(hooks.onResponse, {
 					action: request.action,
 					attempt,
 					status: response.status,
@@ -137,7 +152,7 @@ function createAgentContext(options = {}) {
 			} catch (error) {
 				if (!(error instanceof require_errors.SzamlazzError)) throw error;
 				const willRetry = error.retryable && attempt < maxAttempts;
-				hooks.onError?.({
+				callHook(hooks.onError, {
 					action: request.action,
 					attempt,
 					error,

package/dist/index.js

@@ -1,7 +1,7 @@
-import { A as childBoolean, C as readHeader$1, D as throwIfTextError, E as throwIfHttpError, F as AGENT_ACTIONS, I as MAX_INVOICE_ATTACHMENTS, L as SZAMLAZZ_AGENT_URL, M as childText, N as findChild, O as throwIfXmlFailure, P as findChildren, S as readDocumentHeaders, T as throwIfHeaderError, _ as optionalEl, a as RECEIPT_XSD_BASE_URL, b as parseDoneText, c as requireReceiptNumber, d as presentText, f as resolveInvoice, g as el, h as buildXmlDocument, i as parseReceiptResponse, j as childNumber, k as unexpectedResponse, l as validateTemplate$1, m as TAXPAYER_TYPE_CODES, o as optionalText$1, p as INVOICE_TEMPLATES, r as createReceipt, s as receiptValidationError, u as optionalAgentDate$1, v as createAgentResponse, w as throwIfAnyError, x as parseResponseXml, y as looksLikeXml } from "./create-DDZaNlOz.js";
+import { A as childBoolean, C as readHeader$1, D as throwIfTextError, E as throwIfHttpError, F as AGENT_ACTIONS, I as MAX_INVOICE_ATTACHMENTS, L as SZAMLAZZ_AGENT_URL, M as childText, N as findChild, O as throwIfXmlFailure, P as findChildren, S as readDocumentHeaders, T as throwIfHeaderError, _ as optionalEl, a as RECEIPT_XSD_BASE_URL, b as parseDoneText, c as requireReceiptNumber, d as presentText, f as resolveInvoice, g as el, h as buildXmlDocument, i as parseReceiptResponse, j as childNumber, k as unexpectedResponse, l as validateTemplate$1, m as TAXPAYER_TYPE_CODES, o as optionalText$1, p as INVOICE_TEMPLATES, r as createReceipt, s as receiptValidationError, u as optionalAgentDate$1, v as createAgentResponse, w as throwIfAnyError, x as parseResponseXml, y as looksLikeXml } from "./create-5YkUcJSe.js";
 import { a as parseErrorCode, i as isSzamlazzError, n as SzamlazzError, r as createAgentError, t as AGENT_ERROR_CODES } from "./errors-DapdV5DK.js";
 import { n as bytesToBase64, t as base64ToBytes } from "./binary-D0M9U2MD.js";
-import { i as sessionKeyFor, n as memoryCookieStore, r as mergeSetCookies, t as SESSION_TTL_SECONDS } from "./session-OJMLGufT.js";
+import { i as sessionKeyFor, n as memoryCookieStore, r as mergeSetCookies, t as SESSION_TTL_SECONDS } from "./session-rMKaJcmq.js";
 import { i as todayInBudapest, n as toAgentDate, r as toBudapestDate, t as addBudapestDays } from "./dates-D2XebOIg.js";
 import { i as summarizeItems, s as formatVatRate } from "./money-C9j7nBNP.js";
 const DEFAULT_SAFE_ATTEMPTS = 3;
@@ -62,6 +62,15 @@ async function ignoreStoreFailure(operation) {
 		return;
 	}
 }
+function callHook(hook, event) {
+	if (!hook) return;
+	try {
+		const result = hook(event);
+		if (result instanceof Promise) result.catch(() => void 0);
+	} catch {
+		return;
+	}
+}
 function clampAttempts(value) {
 	if (value === void 0) return DEFAULT_SAFE_ATTEMPTS;
 	if (!Number.isInteger(value) || value < 1) throw configurationError(`A maxAttempts értéke legalább 1 egész szám legyen, kapott: ${value}`);
@@ -76,16 +85,22 @@ function createAgentContext(options = {}) {
 	const safeAttempts = clampAttempts(options.maxAttempts);
 	const retryDelayMs = options.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS;
 	const cookieStore = options.cookieStore === false ? void 0 : options.cookieStore ?? memoryCookieStore();
-	const sessionKey = sessionKeyFor(credentials.map((node) => String(node.content)).join("|"));
+	const sessionSecret = credentials.map((node) => String(node.content)).join("|");
+	let sessionKeyPromise;
+	const resolveSessionKey = () => {
+		sessionKeyPromise ??= sessionKeyFor(sessionSecret);
+		return sessionKeyPromise;
+	};
 	const hooks = options.hooks ?? {};
 	async function send(request) {
-		const cookie = cookieStore ? await ignoreStoreFailure(() => cookieStore.get(sessionKey)) : void 0;
+		const cookie = cookieStore ? await ignoreStoreFailure(async () => cookieStore.get(await resolveSessionKey())) : void 0;
 		request.signal?.throwIfAborted();
 		const headers = new Headers({ Accept: "application/xml, application/pdf, text/plain, */*" });
 		if (cookie) headers.set("Cookie", cookie);
 		const timeoutSignal = AbortSignal.timeout(timeoutMs);
 		const signal = request.signal ? AbortSignal.any([request.signal, timeoutSignal]) : timeoutSignal;
 		let response;
+		let body;
 		try {
 			response = await fetchImpl(endpoint, {
 				method: "POST",
@@ -93,6 +108,7 @@ function createAgentContext(options = {}) {
 				body: buildFormData(request),
 				signal
 			});
+			body = new Uint8Array(await response.arrayBuffer());
 		} catch (error) {
 			if (request.signal?.aborted) throw request.signal.reason;
 			if (timeoutSignal.aborted || isAbortError(error)) throw new SzamlazzError(`A Számlázz.hu nem válaszolt ${timeoutMs} ms alatt.`, {
@@ -106,27 +122,26 @@ function createAgentContext(options = {}) {
 				cause: error
 			});
 		}
-		const body = new Uint8Array(await response.arrayBuffer());
 		if (cookieStore) {
 			const merged = mergeSetCookies(cookie, response.headers);
-			if (merged) await ignoreStoreFailure(() => cookieStore.set(sessionKey, merged, SESSION_TTL_SECONDS));
+			if (merged) await ignoreStoreFailure(async () => cookieStore.set(await resolveSessionKey(), merged, SESSION_TTL_SECONDS));
 		}
 		return createAgentResponse(request.action, response.status, response.headers, body);
 	}
 	async function resetSession() {
-		if (cookieStore) await ignoreStoreFailure(() => cookieStore.delete(sessionKey));
+		if (cookieStore) await ignoreStoreFailure(async () => cookieStore.delete(await resolveSessionKey()));
 	}
 	async function execute(request, parse) {
 		const maxAttempts = request.safeToRetry ? safeAttempts : 1;
 		for (let attempt = 1;; attempt++) {
 			const startedAt = Date.now();
-			hooks.onRequest?.({
+			callHook(hooks.onRequest, {
 				action: request.action,
 				attempt
 			});
 			try {
 				const response = await send(request);
-				hooks.onResponse?.({
+				callHook(hooks.onResponse, {
 					action: request.action,
 					attempt,
 					status: response.status,
@@ -136,7 +151,7 @@ function createAgentContext(options = {}) {
 			} catch (error) {
 				if (!(error instanceof SzamlazzError)) throw error;
 				const willRetry = error.retryable && attempt < maxAttempts;
-				hooks.onError?.({
+				callHook(hooks.onError, {
 					action: request.action,
 					attempt,
 					error,

package/dist/ipn/index.cjs

@@ -1,24 +1,35 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_errors = require("../errors-B0QJhUW1.cjs");
+const require_binary = require("../binary-B89HM03_.cjs");
 //#region src/ipn/ip.ts
 const SZAMLAZZ_OUTBOUND_IPS = [
 	"3.73.214.98",
 	"3.76.149.232",
 	"18.153.156.51"
 ];
-const OUTBOUND_IP_SET = new Set(SZAMLAZZ_OUTBOUND_IPS);
 function normalizeIp(value) {
-	const comma = value.indexOf(",");
-	let ip = (comma === -1 ? value : value.slice(0, comma)).trim();
+	let ip = value.trim();
 	const bracketed = /^\[([^\]]+)\](?::\d+)?$/.exec(ip);
 	if (bracketed?.[1]) ip = bracketed[1];
 	const ipv4WithPort = /^(\d{1,3}(?:\.\d{1,3}){3}):\d+$/.exec(ip);
 	if (ipv4WithPort?.[1]) ip = ipv4WithPort[1];
 	return ip.replace(/^::ffff:/i, "");
 }
-function isSzamlazzIp(ip) {
+function resolveTrustedProxies(value) {
+	if (value === void 0) return 0;
+	if (!Number.isInteger(value) || value < 0) throw new require_errors.SzamlazzError(`A trustedProxies értéke nemnegatív egész szám legyen, kapott: ${value}`, { category: "configuration" });
+	return value;
+}
+function clientAddress(header, trustedProxies) {
+	const entries = header.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
+	return entries[entries.length - 1 - trustedProxies];
+}
+function isSzamlazzIp(ip, options = {}) {
+	const trustedProxies = resolveTrustedProxies(options.trustedProxies);
 	if (typeof ip !== "string") return false;
-	return OUTBOUND_IP_SET.has(normalizeIp(ip));
+	const client = clientAddress(ip, trustedProxies);
+	if (client === void 0) return false;
+	return new Set((options.allowedIps ?? SZAMLAZZ_OUTBOUND_IPS).map(normalizeIp)).has(normalizeIp(client));
 }
 //#endregion
 //#region src/ipn/notification.ts
@@ -32,6 +43,7 @@ const IPN_FIELDS = {
 	paymentDate: "szlahu_kifizdat"
 };
 const AMOUNT_TOLERANCE = .005;
+const MAX_IPN_BODY_BYTES = 65536;
 function ipnError(message) {
 	return new require_errors.SzamlazzError(message, { category: "validation" });
 }
@@ -86,9 +98,43 @@ function parseIpnNotification(input) {
 		raw
 	};
 }
+function bodyTooLarge() {
+	return ipnError(`Az IPN kérés törzse túl nagy, legfeljebb ${MAX_IPN_BODY_BYTES} bájt fogadható el.`);
+}
+function assertDeclaredSize(request) {
+	const declared = Number(request.headers.get("content-length"));
+	if (Number.isFinite(declared) && declared > 65536) throw bodyTooLarge();
+}
+async function readLimitedText(request) {
+	assertDeclaredSize(request);
+	if (!request.body) return "";
+	const reader = request.body.getReader();
+	const chunks = [];
+	let total = 0;
+	let chunk = await reader.read();
+	while (!chunk.done) {
+		total += chunk.value.byteLength;
+		if (total > 65536) {
+			await reader.cancel().catch(() => void 0);
+			throw bodyTooLarge();
+		}
+		chunks.push(chunk.value);
+		chunk = await reader.read();
+	}
+	const bytes = new Uint8Array(total);
+	let offset = 0;
+	for (const part of chunks) {
+		bytes.set(part, offset);
+		offset += part.byteLength;
+	}
+	return require_binary.decodeUtf8(bytes);
+}
 async function readIpnNotification(request) {
-	if ((request.headers.get("content-type")?.toLowerCase() ?? "").includes("multipart/form-data")) return parseIpnNotification(await request.formData());
-	const body = await request.text();
+	if ((request.headers.get("content-type")?.toLowerCase() ?? "").includes("multipart/form-data")) {
+		assertDeclaredSize(request);
+		return parseIpnNotification(await request.formData());
+	}
+	const body = await readLimitedText(request);
 	if (body.trim() === "") return parseIpnNotification(new URL(request.url).searchParams);
 	return parseIpnNotification(body);
 }
@@ -100,6 +146,7 @@ function ipnOkResponse() {
 }
 //#endregion
 exports.IPN_FIELDS = IPN_FIELDS;
+exports.MAX_IPN_BODY_BYTES = MAX_IPN_BODY_BYTES;
 exports.SZAMLAZZ_OUTBOUND_IPS = SZAMLAZZ_OUTBOUND_IPS;
 exports.ipnOkResponse = ipnOkResponse;
 exports.isSzamlazzIp = isSzamlazzIp;

package/dist/ipn/index.d.cts

@@ -1,6 +1,10 @@
 //#region src/ipn/ip.d.ts
 export declare const SZAMLAZZ_OUTBOUND_IPS: readonly string[];
-export declare function isSzamlazzIp(ip: string): boolean;
+interface SzamlazzIpOptions {
+  readonly trustedProxies?: number | undefined;
+  readonly allowedIps?: readonly string[] | undefined;
+}
+export declare function isSzamlazzIp(ip: string | null | undefined, options?: SzamlazzIpOptions): boolean;
 //#endregion
 //#region src/ipn/notification.d.ts
 type IpnInput = string | URLSearchParams | FormData | Readonly<Record<string, string>>;
@@ -24,9 +28,10 @@ export declare const IPN_FIELDS: {
   readonly paymentMethod: "szlahu_fizetesmod";
   readonly paymentDate: "szlahu_kifizdat";
 };
+export declare const MAX_IPN_BODY_BYTES = 65536;
 export declare function parseIpnAmount(value: string): number | undefined;
 export declare function parseIpnNotification(input: IpnInput): IpnNotification;
 export declare function readIpnNotification(request: Request): Promise<IpnNotification>;
 export declare function ipnOkResponse(): Response;
 //#endregion
-export type { IpnInput, IpnNotification };
+export type { IpnInput, IpnNotification, SzamlazzIpOptions };

package/dist/ipn/index.d.ts

@@ -1,6 +1,10 @@
 //#region src/ipn/ip.d.ts
 export declare const SZAMLAZZ_OUTBOUND_IPS: readonly string[];
-export declare function isSzamlazzIp(ip: string): boolean;
+interface SzamlazzIpOptions {
+  readonly trustedProxies?: number | undefined;
+  readonly allowedIps?: readonly string[] | undefined;
+}
+export declare function isSzamlazzIp(ip: string | null | undefined, options?: SzamlazzIpOptions): boolean;
 //#endregion
 //#region src/ipn/notification.d.ts
 type IpnInput = string | URLSearchParams | FormData | Readonly<Record<string, string>>;
@@ -24,9 +28,10 @@ export declare const IPN_FIELDS: {
   readonly paymentMethod: "szlahu_fizetesmod";
   readonly paymentDate: "szlahu_kifizdat";
 };
+export declare const MAX_IPN_BODY_BYTES = 65536;
 export declare function parseIpnAmount(value: string): number | undefined;
 export declare function parseIpnNotification(input: IpnInput): IpnNotification;
 export declare function readIpnNotification(request: Request): Promise<IpnNotification>;
 export declare function ipnOkResponse(): Response;
 //#endregion
-export type { IpnInput, IpnNotification };
+export type { IpnInput, IpnNotification, SzamlazzIpOptions };

package/dist/ipn/index.js

@@ -1,23 +1,34 @@
 import { n as SzamlazzError } from "../errors-DapdV5DK.js";
+import { r as decodeUtf8 } from "../binary-D0M9U2MD.js";
 //#region src/ipn/ip.ts
 const SZAMLAZZ_OUTBOUND_IPS = [
 	"3.73.214.98",
 	"3.76.149.232",
 	"18.153.156.51"
 ];
-const OUTBOUND_IP_SET = new Set(SZAMLAZZ_OUTBOUND_IPS);
 function normalizeIp(value) {
-	const comma = value.indexOf(",");
-	let ip = (comma === -1 ? value : value.slice(0, comma)).trim();
+	let ip = value.trim();
 	const bracketed = /^\[([^\]]+)\](?::\d+)?$/.exec(ip);
 	if (bracketed?.[1]) ip = bracketed[1];
 	const ipv4WithPort = /^(\d{1,3}(?:\.\d{1,3}){3}):\d+$/.exec(ip);
 	if (ipv4WithPort?.[1]) ip = ipv4WithPort[1];
 	return ip.replace(/^::ffff:/i, "");
 }
-function isSzamlazzIp(ip) {
+function resolveTrustedProxies(value) {
+	if (value === void 0) return 0;
+	if (!Number.isInteger(value) || value < 0) throw new SzamlazzError(`A trustedProxies értéke nemnegatív egész szám legyen, kapott: ${value}`, { category: "configuration" });
+	return value;
+}
+function clientAddress(header, trustedProxies) {
+	const entries = header.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
+	return entries[entries.length - 1 - trustedProxies];
+}
+function isSzamlazzIp(ip, options = {}) {
+	const trustedProxies = resolveTrustedProxies(options.trustedProxies);
 	if (typeof ip !== "string") return false;
-	return OUTBOUND_IP_SET.has(normalizeIp(ip));
+	const client = clientAddress(ip, trustedProxies);
+	if (client === void 0) return false;
+	return new Set((options.allowedIps ?? SZAMLAZZ_OUTBOUND_IPS).map(normalizeIp)).has(normalizeIp(client));
 }
 //#endregion
 //#region src/ipn/notification.ts
@@ -31,6 +42,7 @@ const IPN_FIELDS = {
 	paymentDate: "szlahu_kifizdat"
 };
 const AMOUNT_TOLERANCE = .005;
+const MAX_IPN_BODY_BYTES = 65536;
 function ipnError(message) {
 	return new SzamlazzError(message, { category: "validation" });
 }
@@ -85,9 +97,43 @@ function parseIpnNotification(input) {
 		raw
 	};
 }
+function bodyTooLarge() {
+	return ipnError(`Az IPN kérés törzse túl nagy, legfeljebb ${MAX_IPN_BODY_BYTES} bájt fogadható el.`);
+}
+function assertDeclaredSize(request) {
+	const declared = Number(request.headers.get("content-length"));
+	if (Number.isFinite(declared) && declared > 65536) throw bodyTooLarge();
+}
+async function readLimitedText(request) {
+	assertDeclaredSize(request);
+	if (!request.body) return "";
+	const reader = request.body.getReader();
+	const chunks = [];
+	let total = 0;
+	let chunk = await reader.read();
+	while (!chunk.done) {
+		total += chunk.value.byteLength;
+		if (total > 65536) {
+			await reader.cancel().catch(() => void 0);
+			throw bodyTooLarge();
+		}
+		chunks.push(chunk.value);
+		chunk = await reader.read();
+	}
+	const bytes = new Uint8Array(total);
+	let offset = 0;
+	for (const part of chunks) {
+		bytes.set(part, offset);
+		offset += part.byteLength;
+	}
+	return decodeUtf8(bytes);
+}
 async function readIpnNotification(request) {
-	if ((request.headers.get("content-type")?.toLowerCase() ?? "").includes("multipart/form-data")) return parseIpnNotification(await request.formData());
-	const body = await request.text();
+	if ((request.headers.get("content-type")?.toLowerCase() ?? "").includes("multipart/form-data")) {
+		assertDeclaredSize(request);
+		return parseIpnNotification(await request.formData());
+	}
+	const body = await readLimitedText(request);
 	if (body.trim() === "") return parseIpnNotification(new URL(request.url).searchParams);
 	return parseIpnNotification(body);
 }
@@ -98,4 +144,4 @@ function ipnOkResponse() {
 	});
 }
 //#endregion
-export { IPN_FIELDS, SZAMLAZZ_OUTBOUND_IPS, ipnOkResponse, isSzamlazzIp, parseIpnAmount, parseIpnNotification, readIpnNotification };
+export { IPN_FIELDS, MAX_IPN_BODY_BYTES, SZAMLAZZ_OUTBOUND_IPS, ipnOkResponse, isSzamlazzIp, parseIpnAmount, parseIpnNotification, readIpnNotification };

package/dist/{session-CRGOuz-R.cjs → session-CKOuE6Jc.cjs}

@@ -23,20 +23,12 @@ function memoryCookieStore() {
 		}
 	};
 }
-function cyrb53(value, seed) {
-	let h1 = 3735928559 ^ seed;
-	let h2 = 1103547991 ^ seed;
-	for (let index = 0; index < value.length; index++) {
-		const code = value.charCodeAt(index);
-		h1 = Math.imul(h1 ^ code, 2654435761);
-		h2 = Math.imul(h2 ^ code, 1597334677);
-	}
-	h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507) ^ Math.imul(h2 ^ h2 >>> 13, 3266489909);
-	h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507) ^ Math.imul(h1 ^ h1 >>> 13, 3266489909);
-	return (4294967296 * (2097151 & h2) + (h1 >>> 0)).toString(16).padStart(14, "0");
-}
-function sessionKeyFor(secret) {
-	return `szamlazz:session:${cyrb53(secret, 1)}${cyrb53(secret, 2)}`;
+const SESSION_KEY_PREFIX = "szamlazz:session:";
+const sessionKeyEncoder = new TextEncoder();
+async function sessionKeyFor(secret) {
+	const digest = await crypto.subtle.digest("SHA-256", sessionKeyEncoder.encode(`${SESSION_KEY_PREFIX}${secret}`));
+	const hex = Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0"));
+	return `${SESSION_KEY_PREFIX}${hex.join("")}`;
 }
 function readSetCookieHeaders(headers) {
 	const withGetter = headers;

package/dist/{session-OJMLGufT.js → session-rMKaJcmq.js}

@@ -23,20 +23,12 @@ function memoryCookieStore() {
 		}
 	};
 }
-function cyrb53(value, seed) {
-	let h1 = 3735928559 ^ seed;
-	let h2 = 1103547991 ^ seed;
-	for (let index = 0; index < value.length; index++) {
-		const code = value.charCodeAt(index);
-		h1 = Math.imul(h1 ^ code, 2654435761);
-		h2 = Math.imul(h2 ^ code, 1597334677);
-	}
-	h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507) ^ Math.imul(h2 ^ h2 >>> 13, 3266489909);
-	h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507) ^ Math.imul(h1 ^ h1 >>> 13, 3266489909);
-	return (4294967296 * (2097151 & h2) + (h1 >>> 0)).toString(16).padStart(14, "0");
-}
-function sessionKeyFor(secret) {
-	return `szamlazz:session:${cyrb53(secret, 1)}${cyrb53(secret, 2)}`;
+const SESSION_KEY_PREFIX = "szamlazz:session:";
+const sessionKeyEncoder = new TextEncoder();
+async function sessionKeyFor(secret) {
+	const digest = await crypto.subtle.digest("SHA-256", sessionKeyEncoder.encode(`${SESSION_KEY_PREFIX}${secret}`));
+	const hex = Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0"));
+	return `${SESSION_KEY_PREFIX}${hex.join("")}`;
 }
 function readSetCookieHeaders(headers) {
 	const withGetter = headers;

package/dist/testing/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_create = require("../create-BZd6CUO7.cjs");
+const require_create = require("../create-DZsl3Z4m.cjs");
 const require_errors = require("../errors-B0QJhUW1.cjs");
 const require_dates = require("../dates-PPxH0n5H.cjs");
 const require_money = require("../money-DkiGukAw.cjs");

package/dist/testing/index.js

@@ -1,4 +1,4 @@
-import { f as resolveInvoice, n as calculateReceiptItems, t as buildCreateReceiptXml } from "../create-DDZaNlOz.js";
+import { f as resolveInvoice, n as calculateReceiptItems, t as buildCreateReceiptXml } from "../create-5YkUcJSe.js";
 import { n as SzamlazzError } from "../errors-DapdV5DK.js";
 import { n as toAgentDate } from "../dates-D2XebOIg.js";
 import { i as summarizeItems } from "../money-C9j7nBNP.js";

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "kassza",
-  "version": "0.5.1",
-  "author": "futozs",
+  "version": "0.7.0",
+  "author": {
+    "name": "futozs",
+    "url": "https://github.com/futozs",
+    "email": "zsombi.futo@gmail.com"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/futozs/kassza.git"
@@ -11,7 +15,7 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.18.5",
     "@biomejs/biome": "^2.5.13",
-    "@types/node": "^26.6.0",
+    "@types/node": "^22.19.0",
     "@vitest/coverage-v8": "^5.0.1",
     "opentype.js": "^2.0.0",
     "publint": "^0.3.24",
@@ -112,7 +116,6 @@
   "files": [
     "dist",
     "agents",
-    "assets",
     "llms.txt"
   ],
   "homepage": "https://kassza-amber.vercel.app",
@@ -157,5 +160,30 @@
   },
   "sideEffects": false,
   "type": "module",
-  "types": "./dist/index.d.ts"
+  "types": "./dist/index.d.ts",
+  "typesVersions": {
+    "*": {
+      "money": [
+        "./dist/money/index.d.ts"
+      ],
+      "validators": [
+        "./dist/validators/index.d.ts"
+      ],
+      "ipn": [
+        "./dist/ipn/index.d.ts"
+      ],
+      "storage": [
+        "./dist/storage/index.d.ts"
+      ],
+      "storage/fs": [
+        "./dist/storage/fs.d.ts"
+      ],
+      "cookie-stores": [
+        "./dist/cookie-stores/index.d.ts"
+      ],
+      "testing": [
+        "./dist/testing/index.d.ts"
+      ]
+    }
+  }
 }

package/assets/comparison.svg

@@ -1,39 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="760" height="344" viewBox="0 0 760 344" role="img" aria-labelledby="t d">
-  <title id="t">Számla Agent műveletek, 11-ből</title>
-  <desc id="d">kassza 11, szamlazz.js 3, @ribbery009/szamlazz-ts 3, @halftome/szamlazz-client 3, szamlazz.ts 3, szamlazzhu-client 2</desc>
-  <style>
-    text{font-family:system-ui,-apple-system,"Segoe UI",Roboto,sans-serif}
-    .title{fill:#111827;font-size:22px;font-weight:700}.sub{fill:#6B7280;font-size:14px}
-    .label{fill:#374151;font-size:15px}.label.hi{fill:#111827;font-weight:700}
-    .value{fill:#374151;font-size:15px;font-variant-numeric:tabular-nums}.value.hi{fill:#111827;font-weight:700}
-    .bar{fill:#9CA3AF}.bar.hi{fill:#14532D}.track{fill:#E5E7EB}.card{fill:#FFFFFF;stroke:#E5E7EB}
-    @media (prefers-color-scheme:dark){.title,.label.hi,.value.hi{fill:#F9FAFB}.sub{fill:#9CA3AF}.label,.value{fill:#D1D5DB}.bar{fill:#6B7280}.bar.hi{fill:#22C55E}.track{fill:#1F2937}.card{fill:#0D1117;stroke:#30363D}}
-  </style>
-  <rect class="card" x="0.5" y="0.5" width="759" height="343" rx="12"/>
-  <text class="title" x="16" y="34">Számla Agent műveletek, 11-ből</text>
-  <text class="sub" x="16" y="58">A csomagok publikált kódjában ellenőrizve, 2026. szeptember</text>
-  <text class="label hi" x="256" y="106" text-anchor="end">kassza</text>
-  <rect class="track" x="272" y="92" width="374" height="18" rx="4"/>
-  <rect class="bar hi" x="272" y="92" width="374" height="18" rx="4"/>
-  <text class="value hi" x="658" y="106">11/11</text>
-  <text class="label" x="256" y="144" text-anchor="end">szamlazz.js</text>
-  <rect class="track" x="272" y="130" width="374" height="18" rx="4"/>
-  <rect class="bar" x="272" y="130" width="102" height="18" rx="4"/>
-  <text class="value" x="658" y="144">3/11</text>
-  <text class="label" x="256" y="182" text-anchor="end">@ribbery009/szamlazz-ts</text>
-  <rect class="track" x="272" y="168" width="374" height="18" rx="4"/>
-  <rect class="bar" x="272" y="168" width="102" height="18" rx="4"/>
-  <text class="value" x="658" y="182">3/11</text>
-  <text class="label" x="256" y="220" text-anchor="end">@halftome/szamlazz-client</text>
-  <rect class="track" x="272" y="206" width="374" height="18" rx="4"/>
-  <rect class="bar" x="272" y="206" width="102" height="18" rx="4"/>
-  <text class="value" x="658" y="220">3/11</text>
-  <text class="label" x="256" y="258" text-anchor="end">szamlazz.ts</text>
-  <rect class="track" x="272" y="244" width="374" height="18" rx="4"/>
-  <rect class="bar" x="272" y="244" width="102" height="18" rx="4"/>
-  <text class="value" x="658" y="258">3/11</text>
-  <text class="label" x="256" y="296" text-anchor="end">szamlazzhu-client</text>
-  <rect class="track" x="272" y="282" width="374" height="18" rx="4"/>
-  <rect class="bar" x="272" y="282" width="68" height="18" rx="4"/>
-  <text class="value" x="658" y="296">2/11</text>
-</svg>

package/assets/logo-wordmark.svg

@@ -1,6 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="994" height="312" viewBox="0 0 994 312" role="img" aria-labelledby="title desc">
-<title id="title">kassza</title>
-<desc id="desc">kassza logó: Számlázz.hu, TypeScriptben</desc>
-<defs><linearGradient id="logo-tile" x1="0" y1="0" x2="1" y2="1"><stop offset="0" stop-color="#14532D"/><stop offset="1" stop-color="#052E16"/></linearGradient><linearGradient id="logo-paper" x1="0" y1="0" x2="0" y2="1"><stop offset="0" stop-color="#FFFDF5"/><stop offset="1" stop-color="#F3EBD3"/></linearGradient><path id="t0" d="M194 0L36 0L36-700L194-700L194-329Q228-347 253-370Q277-393 294-419Q311-446 322-473Q332-501 339-528L525-528Q514-488 494-450Q473-413 443-380Q413-348 374-322Q334-296 286-279L286-271Q348-281 388-273Q427-266 450-245Q473-225 486-194Q498-163 505-125L528 0L353 0L342-88Q338-120 331-148Q324-176 304-193Q284-211 241-211L194-211"/><path id="t1" d="M175 14Q135 14 99 0Q63-14 40-45Q17-77 17-130Q17-179 36-209Q55-240 87-258Q119-277 157-286Q195-296 232-303Q284-313 310-319Q336-325 346-333Q355-341 355-355Q355-384 334-399Q312-414 277-414Q255-414 233-406Q211-398 197-377Q183-357 184-319L40-329Q38-392 59-433Q80-475 117-498Q153-522 197-532Q240-542 283-542Q362-542 413-512Q464-483 489-427Q513-372 513-293L513-199Q513-166 513-132Q513-99 513-66Q513-33 513 0L373 0Q373-36 373-73Q373-110 373-151L367-151Q363-106 338-68Q312-31 271-8Q229 14 175 14M242-104Q259-104 279-110Q298-117 316-132Q333-147 344-173Q355-200 355-239L355-263L382-266Q374-253 356-245Q337-237 314-232Q291-228 268-223Q244-219 224-211Q204-204 192-191Q179-179 179-157Q179-131 198-117Q216-104 242-104"/><path id="t2" d="M267 14Q214 14 169 4Q123-7 90-30Q56-53 39-91Q21-130 24-185L165-197Q167-164 180-142Q193-121 216-111Q239-101 272-101Q303-101 326-111Q348-122 348-147Q348-160 340-168Q332-177 311-184Q289-192 248-202Q197-215 156-228Q115-241 86-259Q57-277 42-303Q27-330 27-369Q27-424 57-462Q86-501 138-521Q190-542 258-542Q319-542 372-523Q425-504 456-461Q486-418 478-347L340-334Q343-363 332-383Q321-404 300-414Q279-425 249-425Q215-425 197-412Q178-400 178-381Q178-366 190-355Q201-345 226-337Q250-330 289-321Q323-314 360-303Q397-292 429-273Q461-255 481-225Q501-195 501-149Q501-100 474-63Q447-26 395-6Q343 14 267 14"/><path id="t3" d="M463 0L20 0L20-136L271-392L271-398L25-398L25-528L460-528L460-391L209-134L209-130L463-130"/><path id="t4" d="M309 16Q232 16 175-15Q117-46 83-101Q49-157 43-231L151-238Q158-187 179-152Q200-117 234-99Q268-82 313-82Q357-82 387-93Q417-105 433-127Q449-149 449-181Q449-213 434-236Q419-259 380-278Q341-298 266-319Q193-339 147-364Q101-390 80-427Q59-465 59-520Q59-581 88-627Q116-674 170-700Q223-726 298-726Q372-726 425-697Q477-668 508-616Q538-565 545-496L437-490Q432-531 415-562Q397-593 367-610Q337-628 295-628Q236-628 202-600Q167-572 167-525Q167-495 181-474Q195-454 230-438Q265-423 328-405Q413-382 463-351Q513-321 535-280Q557-239 557-181Q557-123 526-78Q495-33 440-8Q384 16 309 16"/><path id="t5" d="M522 0L78 0L78-95L400-447L88-447L88-532L514-532L514-437L191-85L522-85"/><path id="t6" d="M228 12Q178 12 138-6Q98-24 75-57Q51-90 51-134Q51-202 93-240Q134-278 218-294L390-330Q390-392 363-423Q336-454 282-454Q232-454 204-431Q176-408 166-367L60-374Q75-450 133-497Q191-544 282-544Q384-544 438-486Q491-428 491-326L491-116Q491-98 499-90Q507-83 522-83L552-83L552 0Q546 1 533 2Q519 3 506 3Q470 3 445-9Q420-21 408-46Q395-72 393-111L409-111Q403-76 378-48Q353-20 314-4Q275 12 228 12M243-71Q291-71 324-88Q357-105 374-136Q390-167 390-209L390-250L242-220Q194-211 175-192Q156-173 156-142Q156-109 179-90Q202-71 243-71M325-596L239-596L304-730L415-730"/><path id="t7" d="M134 0L36 0L36-532L124-532L128-412L117-415Q127-476 157-510Q186-544 231-544Q279-544 304-510Q328-476 334-409L323-409Q332-473 364-508Q396-544 444-544Q507-544 536-500Q564-457 564-359L564 0L466 0L466-342Q466-406 453-431Q439-456 411-456Q393-456 379-444Q364-432 356-406Q348-381 348-340L348 0L252 0L252-342Q252-404 240-430Q227-456 198-456Q179-456 165-444Q151-432 143-406Q134-381 134-340"/><path id="t8" d="M365-32L264-32L264-559Q264-590 247-607Q229-625 198-625L76-625L76-710L209-710Q286-710 326-670Q365-631 365-554L365-32M544 0L56 0L56-85L544-85"/><path id="t9" d="M368 0L232 0L232-132L368-132"/><path id="ta" d="M194 0L93 0L93-710L194-710L194-416L184-420Q194-463 218-490Q242-518 276-531Q310-544 351-544Q407-544 446-518Q484-493 504-447Q523-402 523-343L523 0L422 0L422-317Q422-389 397-422Q371-456 321-456Q264-456 229-420Q194-384 194-314"/><path id="tb" d="M254 12Q177 12 131-40Q85-93 85-188L85-532L186-532L186-214Q186-142 211-109Q236-76 287-76Q342-76 376-113Q409-150 409-218L409-532L510-532L510 0L415 0L414-139L428-133Q414-64 369-26Q324 12 254 12"/><path id="tc" d="M304 162L236 162L292 0L234 0L234-132L366-132L366-11"/><path id="te" d="M352 0L248 0L248-611L40-611L40-710L560-710L560-611L352-611"/><path id="tf" d="M204 150L129 150L129 65L194 65Q221 65 235 57Q249 48 256 29L273-18L240-18L46-532L154-532L305-113L446-532L554-532L342 60Q326 108 293 129Q260 150 204 150"/><path id="tg" d="M173 150L72 150L72-532L168-532L170-411L158-417Q178-479 224-511Q269-544 331-544Q408-544 457-505Q506-467 530-404Q554-341 554-266Q554-191 530-128Q506-65 457-26Q408 12 331 12Q290 12 255-1Q220-15 196-40Q171-66 160-102L173-116L173 150M312-81Q376-81 412-129Q448-177 448-266Q448-355 412-403Q376-451 312-451Q270-451 239-430Q208-410 191-369Q173-328 173-266Q173-204 190-163Q207-122 239-101Q270-81 312-81"/><path id="th" d="M305 12Q230 12 175-22Q119-56 89-119Q58-182 58-266Q58-350 89-412Q119-474 174-509Q228-544 302-544Q372-544 427-510Q481-477 512-414Q542-352 542-264L542-236L163-236Q168-160 206-120Q243-81 306-81Q353-81 384-103Q415-126 427-162L532-155Q509-79 450-33Q391 12 305 12M164-317L432-317Q427-385 391-418Q355-451 301-451Q245-451 210-417Q174-383 164-317"/><path id="ti" d="M312 12Q238 12 182-22Q125-57 95-119Q64-182 64-266Q64-350 95-412Q125-474 182-509Q238-544 312-544Q373-544 421-521Q469-499 500-456Q531-413 541-353L438-346Q426-397 393-424Q360-451 313-451Q246-451 208-401Q169-352 169-266Q169-180 208-130Q246-81 313-81Q361-81 396-109Q430-138 441-194L544-188Q534-127 502-82Q470-38 422-13Q373 12 312 12"/><path id="tj" d="M486 0L84 0L84-85L265-85L219-39L219-493L265-447L84-447L84-532L299-532L308-384L299-391Q306-462 340-497Q373-532 433-532L546-532L546-444L437-444Q399-444 373-429Q347-415 334-386Q320-358 320-316L320-39L274-85L486-85"/><path id="tk" d="M284 0L76 0L76-85L284-85L284-493L331-447L86-447L86-532L386-532L386-85L564-85L564 0L386 0L284 0M382-609L278-609L278-714L382-714"/><path id="tl" d="M524 0L376 0Q295 0 256-37Q216-75 216-153L216-657L317-657L317-158Q317-121 335-103Q352-85 387-85L524-85L524 0M524-447L48-447L48-532L524-532"/><path id="tm" d="M342 12Q298 12 263-3Q228-18 204-46Q180-74 168-110L181-127L176 0L82 0L82-710L183-710L183-412L173-433Q182-462 205-487Q228-512 264-528Q299-544 342-544Q410-544 460-510Q510-477 537-414Q564-352 564-266Q564-180 537-117Q510-55 460-21Q410 12 342 12M325-81Q388-81 423-130Q458-180 458-266Q458-353 423-402Q388-451 327-451Q282-451 250-429Q218-407 201-366Q183-325 183-266Q183-209 201-167Q218-126 250-103Q281-81 325-81"/><path id="tn" d="M181 0L80 0L80-532L173-532L176-393L165-401Q175-450 201-481Q226-513 263-528Q300-544 342-544Q402-544 441-517Q480-491 500-445Q520-400 520-343L520 0L419 0L419-317Q419-386 393-421Q366-456 313-456Q276-456 247-440Q217-424 199-392Q181-361 181-315"/></defs>
-<g transform="translate(28 28) scale(0.5)"><rect width="512" height="512" rx="112" fill="url(#logo-tile)"/><path d="M146 84H366A20 20 0 0 1 386 104V428l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18V104A20 20 0 0 1 146 84Z" fill="#000" opacity="0.22" transform="translate(0 10)"/><path d="M146 84H366A20 20 0 0 1 386 104V428l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18V104A20 20 0 0 1 146 84Z" fill="url(#logo-paper)"/><path d="M170 136h40v88l76-88h50l-80 90 86 116h-50l-62-86-20 22v64h-40z" fill="#14532D"/><rect x="160" y="368" width="120" height="12" rx="6" fill="#14532D" opacity="0.28"/><rect x="304" y="368" width="48" height="12" rx="6" fill="#F59E0B"/></g><g transform="translate(327.57 188.27) scale(0.212)" fill="#2d8949"><use href="#t0" x="0"/><use href="#t1" x="516"/><use href="#t2" x="1039"/><use href="#t2" x="1536"/><use href="#t3" x="2033"/><use href="#t1" x="2494"/></g><rect x="335.2" y="250.16" width="84.8" height="15.26" rx="7.63" fill="#F59E0B"/><g transform="translate(438.02 266.71) scale(0.0335)" fill="#787f79"><use href="#t4" x="0"/><use href="#t5" x="609"/><use href="#t6" x="1217"/><use href="#t7" x="1826"/><use href="#t8" x="2434"/><use href="#t6" x="3043"/><use href="#t5" x="3651"/><use href="#t5" x="4260"/><use href="#t9" x="4869"/><use href="#ta" x="5477"/><use href="#tb" x="6086"/><use href="#tc" x="6694"/><use href="#te" x="7911"/><use href="#tf" x="8520"/><use href="#tg" x="9129"/><use href="#th" x="9737"/><use href="#t4" x="10346"/><use href="#ti" x="10954"/><use href="#tj" x="11563"/><use href="#tk" x="12171"/><use href="#tg" x="12780"/><use href="#tl" x="13388"/><use href="#tm" x="13997"/><use href="#th" x="14606"/><use href="#tn" x="15214"/></g>
-</svg>

package/assets/logo.svg

@@ -1,19 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 512 512" role="img" aria-labelledby="title">
-  <title id="title">kassza</title>
-  <defs>
-    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
-      <stop offset="0" stop-color="#14532D"/>
-      <stop offset="1" stop-color="#052E16"/>
-    </linearGradient>
-    <linearGradient id="paper" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0" stop-color="#FFFDF5"/>
-      <stop offset="1" stop-color="#F3EBD3"/>
-    </linearGradient>
-  </defs>
-  <rect width="512" height="512" rx="112" fill="url(#bg)"/>
-  <path d="M146 84H366A20 20 0 0 1 386 104V428l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18V104A20 20 0 0 1 146 84Z" fill="#000" opacity=".22" transform="translate(0 10)"/>
-  <path d="M146 84H366A20 20 0 0 1 386 104V428l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18 l-13 -18 l-13 18V104A20 20 0 0 1 146 84Z" fill="url(#paper)"/>
-  <path d="M170 136h40v88l76-88h50l-80 90 86 116h-50l-62-86-20 22v64h-40z" fill="#14532D"/>
-  <rect x="160" y="368" width="120" height="12" rx="6" fill="#14532D" opacity=".28"/>
-  <rect x="304" y="368" width="48" height="12" rx="6" fill="#F59E0B"/>
-</svg>