kassza 1.0.0 → 1.0.2

package/dist/payments/stripe.d.ts

@@ -1,6 +1,6 @@
-import { i as PaymentEvent, s as PaymentLineItem, u as PaymentWebhookBaseOptions } from "../types-oiDulesz.js";
+import { i as PaymentEvent, s as PaymentLineItem, u as PaymentWebhookBaseOptions } from "../types-DPnHIwQ_.js";
 import { t as JsonRecord } from "../json-D3Bx7NhF.js";
-import { r as WebhookHandler } from "../webhook-C9IBUdeT.js";
+import { r as WebhookHandler } from "../webhook-BY7437wx.js";
 export declare const STRIPE_DEFAULT_TOLERANCE_SECONDS = 300;
 export declare const STRIPE_API_URL = "https://api.stripe.com";
 export declare const STRIPE_DEFAULT_METHOD = "bankkártya";

package/dist/payments/stripe.js

@@ -17,6 +17,11 @@ const ORDER_REF_KEYS = [
 	"order"
 ];
 const INACTIVE_REFUND_STATUSES = /* @__PURE__ */ new Set(["failed", "canceled"]);
+const REFUND_UPDATE_EVENTS = /* @__PURE__ */ new Set([
+	"charge.refund.updated",
+	"refund.updated",
+	"refund.failed"
+]);
 function parseStripeSignatureHeader(header) {
 	let timestamp;
 	const signatures = [];
@@ -39,12 +44,17 @@ function secretsOf(secret) {
 	if (list.length === 0 || list.some((value) => value === "")) throw new TypeError("Add meg a Stripe webhook titkát (whsec_...).");
 	return list;
 }
+function resolveTolerance(value) {
+	if (value === void 0) return 300;
+	if (!Number.isFinite(value) || value < 0) throw new TypeError(`A toleranceSeconds nemnegatív véges szám legyen (a 0 kikapcsolja az időbélyeg-ellenőrzést), kapott: ${String(value)}`);
+	return value;
+}
 async function verifyStripeSignature(payload, header, secret, options = {}) {
 	const secrets = secretsOf(secret);
+	const tolerance = resolveTolerance(options.toleranceSeconds);
 	if (!header) throw new WebhookVerificationError("stripe", "missing_signature", "Hiányzik a Stripe-Signature fejléc.");
 	const parsed = parseStripeSignatureHeader(header);
 	if (!parsed) throw new WebhookVerificationError("stripe", "invalid_signature", "A Stripe-Signature fejléc formátuma hibás.");
-	const tolerance = options.toleranceSeconds ?? 300;
 	const nowSeconds = Math.floor((options.now?.() ?? Date.now()) / 1e3);
 	if (tolerance > 0 && nowSeconds - parsed.timestamp > tolerance) throw new WebhookVerificationError("stripe", "timestamp_out_of_range", `A Stripe esemény időbélyege régebbi ${tolerance} másodpercnél.`);
 	for (const key of secrets) {
@@ -179,6 +189,30 @@ function fromRefundedCharge(event, options) {
 		raw: event
 	};
 }
+function fromFailedRefund(event, options) {
+	const refund = event.object;
+	if (text(refund.object) !== "refund") return void 0;
+	if (!INACTIVE_REFUND_STATUSES.has(text(refund.status) ?? "")) return void 0;
+	const refundId = text(refund.id);
+	const amount = amountOf(refund, "amount");
+	return {
+		provider: "stripe",
+		kind: "refund-failed",
+		id: text(refund.payment_intent) ?? text(path(refund, "payment_intent", "id")) ?? text(refund.charge) ?? text(path(refund, "charge", "id")) ?? event.id,
+		eventId: event.id,
+		eventType: event.type,
+		orderRef: orderRefOf(refund),
+		refundedAmount: amount,
+		refunds: refundId && amount ? [{
+			id: refundId,
+			amount,
+			createdAt: paidAtOf(event)
+		}] : void 0,
+		paidAt: paidAtOf(event),
+		method: options.method ?? "bankkártya",
+		raw: event
+	};
+}
 function stripePaymentEvent(event, options = {}) {
 	switch (event.type) {
 		case "checkout.session.completed": {
@@ -192,7 +226,7 @@ function stripePaymentEvent(event, options = {}) {
 		case "payment_intent.succeeded": return fromPaymentIntent(event, "paid", options);
 		case "payment_intent.payment_failed": return fromPaymentIntent(event, "failed", options);
 		case "charge.refunded": return fromRefundedCharge(event, options);
-		default: return;
+		default: return REFUND_UPDATE_EVENTS.has(event.type) ? fromFailedRefund(event, options) : void 0;
 	}
 }
 async function stripeGet(url, options, what) {
@@ -305,6 +339,7 @@ async function enrich(payment, event, options) {
 }
 function stripeWebhook(options) {
 	secretsOf(options.secret);
+	resolveTolerance(options.toleranceSeconds);
 	return (request) => respondToWebhook(options, async () => {
 		const payload = await readRawBody(request, "stripe", options.maxBodyBytes);
 		await verifyStripeSignature(payload, request.headers.get("stripe-signature"), options.secret, {

package/dist/{server-CifvB-FX.js → server-CZTJ3562.js}

@@ -1,6 +1,6 @@
-import { c as resolveInvoice, l as INVOICE_LANGUAGES } from "./create-once-B6cAXyET.js";
+import { c as resolveInvoice, l as INVOICE_LANGUAGES } from "./create-once-DcEjO8QH.js";
 import { o as isSzamlazzError, r as SzamlazzError } from "./errors-CGGsW0Y5.js";
-import { t as createKassza } from "./client-JZ1M1sZX.js";
+import { t as createKassza } from "./client-8ElbVwSO.js";
 import { i as resolveRecoveryDelay, n as isUncertainOutcome, r as recoverAfterFailure } from "./once-CMhDPrs7.js";
 import { r as toBudapestDate } from "./dates-DWsZOdaO.js";
 import { a as isVatRate } from "./vat-B4J5Q0tu.js";
@@ -207,13 +207,14 @@ function resolveTtl(ttlMs) {
 function createConfirmations(options) {
 	const secret = options.secret ?? randomSecret();
 	const ttlMs = resolveTtl(options.ttlMs);
-	const sign = async (action, expiresAt, payload) => {
-		return (await hmacHex("SHA-256", secret, `${action}\n${expiresAt}\n${canonicalJson(payload)}`)).slice(0, SIGNATURE_LENGTH);
+	const sign = async (action, expiresAt, day, payload) => {
+		return (await hmacHex("SHA-256", secret, `${action}\n${expiresAt}\n${day}\n${canonicalJson(payload)}`)).slice(0, SIGNATURE_LENGTH);
 	};
 	return {
 		async issue(action, payload) {
-			const expiresAt = options.now().getTime() + ttlMs;
-			const signature = await sign(action, expiresAt, payload);
+			const now = options.now();
+			const expiresAt = now.getTime() + ttlMs;
+			const signature = await sign(action, expiresAt, toBudapestDate(now), payload);
 			return {
 				token: `${expiresAt.toString(36)}.${signature}`,
 				expiresAt: new Date(expiresAt).toISOString()
@@ -225,14 +226,20 @@ function createConfirmations(options) {
 			const match = TOKEN_PATTERN.exec(token.trim());
 			const expiresAt = match?.[1] === void 0 ? NaN : Number.parseInt(match[1], 36);
 			if (!match?.[2] || !Number.isSafeInteger(expiresAt)) throw new ToolInputError(`A megerősítő kód formátuma érvénytelen. ${again}`);
-			if (options.now().getTime() > expiresAt) throw new ToolInputError(`A megerősítő kód lejárt. ${again}`);
-			const expected = await sign(action, expiresAt, payload);
-			if (!timingSafeEqual(expected, match[2])) throw new ToolInputError(`A megerősítő kód nem ehhez a kéréshez tartozik (az adatok eltérnek az előnézettől). ${again}`);
+			const now = options.now();
+			if (now.getTime() > expiresAt) throw new ToolInputError(`A megerősítő kód lejárt. ${again}`);
+			const today = toBudapestDate(now);
+			const expected = await sign(action, expiresAt, today, payload);
+			if (!timingSafeEqual(expected, match[2])) {
+				const previewDay = toBudapestDate(new Date(expiresAt - ttlMs));
+				if (previewDay !== today && timingSafeEqual(await sign(action, expiresAt, previewDay, payload), match[2])) throw new ToolInputError(`A megerősítő kód egy előző napi (${previewDay}) előnézethez tartozik, budapesti idő szerint éjfél után nem érvényes. ${again}`);
+				throw new ToolInputError(`A megerősítő kód nem ehhez a kéréshez tartozik (az adatok eltérnek az előnézettől). ${again}`);
+			}
 		}
 	};
 }
 // src/core/version.ts
-const KASSZA_VERSION = "0.20.0";
+const KASSZA_VERSION = "1.0.1";
 // src/mcp/tool-kit.ts
 const LOCAL_READ = {
 	readOnlyHint: true,
@@ -666,6 +673,17 @@ function documentLabel(resolved) {
 function resolve(input, context) {
 	return resolveInvoice(context.defaults.invoice ?? {}, input, context.now());
 }
+function signedInvoice(args, resolved) {
+	const { issueDate, fulfillmentDate, dueDate } = resolved;
+	return {
+		...args,
+		resolved: {
+			issueDate,
+			fulfillmentDate,
+			dueDate
+		}
+	};
+}
 function previewData(input, resolved) {
 	const totals = summarizeItems(resolved.items.map((item) => item.amounts));
 	return {
@@ -706,7 +724,7 @@ async function previewInvoice(args, context) {
 	const resolved = resolve(input, context);
 	const data = previewData(input, resolved);
 	const totals = summarizeItems(resolved.items.map((item) => item.amounts));
-	const confirmation = await context.confirmations.issue(CREATE_INVOICE, args);
+	const confirmation = await context.confirmations.issue(CREATE_INVOICE, signedInvoice(args, resolved));
 	return {
 		summary: lines(`${documentLabel(resolved)} előnézete (még NEM készült el): ${input.buyer.name}, nettó ${money(totals.netAmount, resolved.currency)}, bruttó ${money(totals.grossAmount, resolved.currency)}.`, `Kelt: ${resolved.issueDate}, teljesítés: ${resolved.fulfillmentDate}, fizetési határidő: ${resolved.dueDate}, fizetési mód: ${resolved.paymentMethod}.`, resolved.sendEmail ? "A Számlázz.hu e-mailben elküldi a vevőnek." : "A vevő nem kap e-mailt a Számlázz.hu-tól.", `Mutasd meg az előnézetet a felhasználónak. Ha jóváhagyja, hívd meg a ${CREATE_INVOICE} eszközt pontosan ugyanezekkel az adatokkal, a confirmation mezőben ezzel a kóddal: ${confirmation.token} (lejár: ${confirmation.expiresAt}).`),
 		data: {
@@ -732,9 +750,9 @@ function existingOutput(details, externalId, created) {
 }
 async function createInvoice(args, context) {
 	const { payload, confirmation } = splitConfirmation(args);
-	await context.confirmations.verify(CREATE_INVOICE, payload, confirmation, PREVIEW_INVOICE);
 	const input = invoiceInputOf(payload);
 	const resolved = resolve(input, context);
+	await context.confirmations.verify(CREATE_INVOICE, signedInvoice(payload, resolved), confirmation, PREVIEW_INVOICE);
 	const externalId = input.externalId ?? `MCP-${await idempotencyKey("create_invoice", resolved.issueDate, payload)}`;
 	const kassza = context.client();
 	const lookup = () => kassza.invoices.find({ externalId }, { includePdf: false });
@@ -1025,9 +1043,15 @@ function previewOf(input, context) {
 		}
 	};
 }
+function signedReceipt(args, day) {
+	return {
+		...args,
+		resolved: { day }
+	};
+}
 async function previewReceipt(args, context) {
 	const preview = previewOf(receiptInputOf(args), context);
-	const confirmation = await context.confirmations.issue(CREATE_RECEIPT, args);
+	const confirmation = await context.confirmations.issue(CREATE_RECEIPT, signedReceipt(args, toBudapestDate(context.now())));
 	return {
 		summary: lines(`Nyugta előnézete (még NEM készült el): bruttó ${money(preview.grossAmount, preview.currency)}.`, `Mutasd meg az előnézetet a felhasználónak. Ha jóváhagyja, hívd meg a ${CREATE_RECEIPT} eszközt pontosan ugyanezekkel az adatokkal, a confirmation mezőben ezzel a kóddal: ${confirmation.token} (lejár: ${confirmation.expiresAt}).`),
 		data: {
@@ -1064,10 +1088,10 @@ function duplicateCallIdError(error, callId) {
 }
 async function createReceipt(args, context) {
 	const { payload, confirmation } = splitConfirmation(args);
-	await context.confirmations.verify(CREATE_RECEIPT, payload, confirmation, PREVIEW_RECEIPT);
 	const input = receiptInputOf(payload);
 	previewOf(input, context);
 	const day = toBudapestDate(context.now());
+	await context.confirmations.verify(CREATE_RECEIPT, signedReceipt(payload, day), confirmation, PREVIEW_RECEIPT);
 	const callId = `MCP-${await idempotencyKey(CREATE_RECEIPT, day, payload)}`;
 	const kassza = context.client();
 	if (input.orderNumber !== void 0) {
@@ -1179,10 +1203,28 @@ function reversalOutput(document, reversedNumber, number, created) {
 		}
 	};
 }
+const reversalsInFlight = /* @__PURE__ */ new Map();
+async function oneReversalAtATime(key, run) {
+	for (;;) {
+		const pending = reversalsInFlight.get(key);
+		if (!pending) break;
+		await pending.catch(() => void 0);
+	}
+	const current = run();
+	reversalsInFlight.set(key, current);
+	try {
+		return await current;
+	} finally {
+		if (reversalsInFlight.get(key) === current) reversalsInFlight.delete(key);
+	}
+}
 async function reverseInvoice(args, context) {
 	assertKnownKeys(args, ["invoiceNumber", "confirmation"], "");
 	const invoiceNumber = requiredString(args, "invoiceNumber", "");
 	await context.confirmations.verify(REVERSE_INVOICE, { invoiceNumber }, args.confirmation, PREVIEW_REVERSAL);
+	return oneReversalAtATime(`invoice:${invoiceNumber}`, () => reverseInvoiceOnce(invoiceNumber, context));
+}
+async function reverseInvoiceOnce(invoiceNumber, context) {
 	const kassza = context.client();
 	const externalId = `${invoiceNumber}/SS`;
 	const lookup = () => kassza.invoices.find({ externalId }, { includePdf: false });
@@ -1208,6 +1250,9 @@ async function reverseReceipt(args, context) {
 	assertKnownKeys(args, ["receiptNumber", "confirmation"], "");
 	const receiptNumber = requiredString(args, "receiptNumber", "");
 	await context.confirmations.verify(REVERSE_RECEIPT, { receiptNumber }, args.confirmation, PREVIEW_REVERSAL);
+	return oneReversalAtATime(`receipt:${receiptNumber}`, () => reverseReceiptOnce(receiptNumber, context));
+}
+async function reverseReceiptOnce(receiptNumber, context) {
 	const kassza = context.client();
 	const original = await kassza.receipts.get({
 		receiptNumber,

package/dist/{server-CGIY7U8C.cjs → server-CrmxXPV-.cjs}

@@ -1,6 +1,6 @@
-const require_create_once = require("./create-once-zeF7GVVP.cjs");
+const require_create_once = require("./create-once-BKUhF1Ov.cjs");
 const require_errors = require("./errors-Bn6pe6yw.cjs");
-const require_client = require("./client-I_29IPMh.cjs");
+const require_client = require("./client-CYS1_Xaz.cjs");
 const require_once = require("./once-BmXfrNbQ.cjs");
 const require_dates = require("./dates-oOp3ypPP.cjs");
 const require_vat = require("./vat-BkoiiKm4.cjs");
@@ -207,13 +207,14 @@ function resolveTtl(ttlMs) {
 function createConfirmations(options) {
 	const secret = options.secret ?? randomSecret();
 	const ttlMs = resolveTtl(options.ttlMs);
-	const sign = async (action, expiresAt, payload) => {
-		return (await require_crypto.hmacHex("SHA-256", secret, `${action}\n${expiresAt}\n${canonicalJson(payload)}`)).slice(0, SIGNATURE_LENGTH);
+	const sign = async (action, expiresAt, day, payload) => {
+		return (await require_crypto.hmacHex("SHA-256", secret, `${action}\n${expiresAt}\n${day}\n${canonicalJson(payload)}`)).slice(0, SIGNATURE_LENGTH);
 	};
 	return {
 		async issue(action, payload) {
-			const expiresAt = options.now().getTime() + ttlMs;
-			const signature = await sign(action, expiresAt, payload);
+			const now = options.now();
+			const expiresAt = now.getTime() + ttlMs;
+			const signature = await sign(action, expiresAt, require_dates.toBudapestDate(now), payload);
 			return {
 				token: `${expiresAt.toString(36)}.${signature}`,
 				expiresAt: new Date(expiresAt).toISOString()
@@ -225,14 +226,20 @@ function createConfirmations(options) {
 			const match = TOKEN_PATTERN.exec(token.trim());
 			const expiresAt = match?.[1] === void 0 ? NaN : Number.parseInt(match[1], 36);
 			if (!match?.[2] || !Number.isSafeInteger(expiresAt)) throw new ToolInputError(`A megerősítő kód formátuma érvénytelen. ${again}`);
-			if (options.now().getTime() > expiresAt) throw new ToolInputError(`A megerősítő kód lejárt. ${again}`);
-			const expected = await sign(action, expiresAt, payload);
-			if (!require_crypto.timingSafeEqual(expected, match[2])) throw new ToolInputError(`A megerősítő kód nem ehhez a kéréshez tartozik (az adatok eltérnek az előnézettől). ${again}`);
+			const now = options.now();
+			if (now.getTime() > expiresAt) throw new ToolInputError(`A megerősítő kód lejárt. ${again}`);
+			const today = require_dates.toBudapestDate(now);
+			const expected = await sign(action, expiresAt, today, payload);
+			if (!require_crypto.timingSafeEqual(expected, match[2])) {
+				const previewDay = require_dates.toBudapestDate(new Date(expiresAt - ttlMs));
+				if (previewDay !== today && require_crypto.timingSafeEqual(await sign(action, expiresAt, previewDay, payload), match[2])) throw new ToolInputError(`A megerősítő kód egy előző napi (${previewDay}) előnézethez tartozik, budapesti idő szerint éjfél után nem érvényes. ${again}`);
+				throw new ToolInputError(`A megerősítő kód nem ehhez a kéréshez tartozik (az adatok eltérnek az előnézettől). ${again}`);
+			}
 		}
 	};
 }
 // src/core/version.ts
-const KASSZA_VERSION = "0.20.0";
+const KASSZA_VERSION = "1.0.1";
 // src/mcp/tool-kit.ts
 const LOCAL_READ = {
 	readOnlyHint: true,
@@ -666,6 +673,17 @@ function documentLabel(resolved) {
 function resolve(input, context) {
 	return require_create_once.resolveInvoice(context.defaults.invoice ?? {}, input, context.now());
 }
+function signedInvoice(args, resolved) {
+	const { issueDate, fulfillmentDate, dueDate } = resolved;
+	return {
+		...args,
+		resolved: {
+			issueDate,
+			fulfillmentDate,
+			dueDate
+		}
+	};
+}
 function previewData(input, resolved) {
 	const totals = require_money.summarizeItems(resolved.items.map((item) => item.amounts));
 	return {
@@ -706,7 +724,7 @@ async function previewInvoice(args, context) {
 	const resolved = resolve(input, context);
 	const data = previewData(input, resolved);
 	const totals = require_money.summarizeItems(resolved.items.map((item) => item.amounts));
-	const confirmation = await context.confirmations.issue(CREATE_INVOICE, args);
+	const confirmation = await context.confirmations.issue(CREATE_INVOICE, signedInvoice(args, resolved));
 	return {
 		summary: lines(`${documentLabel(resolved)} előnézete (még NEM készült el): ${input.buyer.name}, nettó ${money(totals.netAmount, resolved.currency)}, bruttó ${money(totals.grossAmount, resolved.currency)}.`, `Kelt: ${resolved.issueDate}, teljesítés: ${resolved.fulfillmentDate}, fizetési határidő: ${resolved.dueDate}, fizetési mód: ${resolved.paymentMethod}.`, resolved.sendEmail ? "A Számlázz.hu e-mailben elküldi a vevőnek." : "A vevő nem kap e-mailt a Számlázz.hu-tól.", `Mutasd meg az előnézetet a felhasználónak. Ha jóváhagyja, hívd meg a ${CREATE_INVOICE} eszközt pontosan ugyanezekkel az adatokkal, a confirmation mezőben ezzel a kóddal: ${confirmation.token} (lejár: ${confirmation.expiresAt}).`),
 		data: {
@@ -732,9 +750,9 @@ function existingOutput(details, externalId, created) {
 }
 async function createInvoice(args, context) {
 	const { payload, confirmation } = splitConfirmation(args);
-	await context.confirmations.verify(CREATE_INVOICE, payload, confirmation, PREVIEW_INVOICE);
 	const input = invoiceInputOf(payload);
 	const resolved = resolve(input, context);
+	await context.confirmations.verify(CREATE_INVOICE, signedInvoice(payload, resolved), confirmation, PREVIEW_INVOICE);
 	const externalId = input.externalId ?? `MCP-${await idempotencyKey("create_invoice", resolved.issueDate, payload)}`;
 	const kassza = context.client();
 	const lookup = () => kassza.invoices.find({ externalId }, { includePdf: false });
@@ -1025,9 +1043,15 @@ function previewOf(input, context) {
 		}
 	};
 }
+function signedReceipt(args, day) {
+	return {
+		...args,
+		resolved: { day }
+	};
+}
 async function previewReceipt(args, context) {
 	const preview = previewOf(receiptInputOf(args), context);
-	const confirmation = await context.confirmations.issue(CREATE_RECEIPT, args);
+	const confirmation = await context.confirmations.issue(CREATE_RECEIPT, signedReceipt(args, require_dates.toBudapestDate(context.now())));
 	return {
 		summary: lines(`Nyugta előnézete (még NEM készült el): bruttó ${money(preview.grossAmount, preview.currency)}.`, `Mutasd meg az előnézetet a felhasználónak. Ha jóváhagyja, hívd meg a ${CREATE_RECEIPT} eszközt pontosan ugyanezekkel az adatokkal, a confirmation mezőben ezzel a kóddal: ${confirmation.token} (lejár: ${confirmation.expiresAt}).`),
 		data: {
@@ -1064,10 +1088,10 @@ function duplicateCallIdError(error, callId) {
 }
 async function createReceipt(args, context) {
 	const { payload, confirmation } = splitConfirmation(args);
-	await context.confirmations.verify(CREATE_RECEIPT, payload, confirmation, PREVIEW_RECEIPT);
 	const input = receiptInputOf(payload);
 	previewOf(input, context);
 	const day = require_dates.toBudapestDate(context.now());
+	await context.confirmations.verify(CREATE_RECEIPT, signedReceipt(payload, day), confirmation, PREVIEW_RECEIPT);
 	const callId = `MCP-${await idempotencyKey(CREATE_RECEIPT, day, payload)}`;
 	const kassza = context.client();
 	if (input.orderNumber !== void 0) {
@@ -1179,10 +1203,28 @@ function reversalOutput(document, reversedNumber, number, created) {
 		}
 	};
 }
+const reversalsInFlight = /* @__PURE__ */ new Map();
+async function oneReversalAtATime(key, run) {
+	for (;;) {
+		const pending = reversalsInFlight.get(key);
+		if (!pending) break;
+		await pending.catch(() => void 0);
+	}
+	const current = run();
+	reversalsInFlight.set(key, current);
+	try {
+		return await current;
+	} finally {
+		if (reversalsInFlight.get(key) === current) reversalsInFlight.delete(key);
+	}
+}
 async function reverseInvoice(args, context) {
 	assertKnownKeys(args, ["invoiceNumber", "confirmation"], "");
 	const invoiceNumber = requiredString(args, "invoiceNumber", "");
 	await context.confirmations.verify(REVERSE_INVOICE, { invoiceNumber }, args.confirmation, PREVIEW_REVERSAL);
+	return oneReversalAtATime(`invoice:${invoiceNumber}`, () => reverseInvoiceOnce(invoiceNumber, context));
+}
+async function reverseInvoiceOnce(invoiceNumber, context) {
 	const kassza = context.client();
 	const externalId = `${invoiceNumber}/SS`;
 	const lookup = () => kassza.invoices.find({ externalId }, { includePdf: false });
@@ -1208,6 +1250,9 @@ async function reverseReceipt(args, context) {
 	assertKnownKeys(args, ["receiptNumber", "confirmation"], "");
 	const receiptNumber = requiredString(args, "receiptNumber", "");
 	await context.confirmations.verify(REVERSE_RECEIPT, { receiptNumber }, args.confirmation, PREVIEW_REVERSAL);
+	return oneReversalAtATime(`receipt:${receiptNumber}`, () => reverseReceiptOnce(receiptNumber, context));
+}
+async function reverseReceiptOnce(receiptNumber, context) {
 	const kassza = context.client();
 	const original = await kassza.receipts.get({
 		receiptNumber,

package/dist/{shared-BOBTXDTo.cjs → shared-1HiN8LBf.cjs}

@@ -37,6 +37,10 @@ const DEFAULT_URL_EXPIRES_SECONDS = 3600;
 const S3_MAX_PRESIGN_SECONDS = 604800;
 const MAX_KEY_LENGTH = 1024;
 const CONTROL_CHARACTERS = /[\p{Cc}]/u;
+function isDotSegment(segment) {
+	const decoded = segment.replace(/%2e/gi, ".");
+	return decoded === "." || decoded === "..";
+}
 function assertStorageKey(key) {
 	const invalid = (reason) => new StorageError(`Érvénytelen tárhelykulcs (${reason}): ${JSON.stringify(key)}`, {
 		operation: "key",
@@ -47,7 +51,7 @@ function assertStorageKey(key) {
 	if (key.startsWith("/")) throw invalid("nem kezdődhet perjellel");
 	if (key.includes("\\")) throw invalid("visszaperjel nem lehet benne");
 	if (CONTROL_CHARACTERS.test(key)) throw invalid("vezérlőkaraktert tartalmaz");
-	for (const segment of key.split("/")) if (segment === "" || segment === "." || segment === "..") throw invalid("üres, \".\" vagy \"..\" útvonalszakaszt tartalmaz");
+	for (const segment of key.split("/")) if (segment === "" || isDotSegment(segment)) throw invalid("üres, \".\" vagy \"..\" útvonalszakaszt tartalmaz, akár %2e kódolással");
 	return key;
 }
 function normalizePrefix(prefix) {

package/dist/{shared-Dbcfwr8x.js → shared-DF7m3lM7.js}

@@ -37,6 +37,10 @@ const DEFAULT_URL_EXPIRES_SECONDS = 3600;
 const S3_MAX_PRESIGN_SECONDS = 604800;
 const MAX_KEY_LENGTH = 1024;
 const CONTROL_CHARACTERS = /[\p{Cc}]/u;
+function isDotSegment(segment) {
+	const decoded = segment.replace(/%2e/gi, ".");
+	return decoded === "." || decoded === "..";
+}
 function assertStorageKey(key) {
 	const invalid = (reason) => new StorageError(`Érvénytelen tárhelykulcs (${reason}): ${JSON.stringify(key)}`, {
 		operation: "key",
@@ -47,7 +51,7 @@ function assertStorageKey(key) {
 	if (key.startsWith("/")) throw invalid("nem kezdődhet perjellel");
 	if (key.includes("\\")) throw invalid("visszaperjel nem lehet benne");
 	if (CONTROL_CHARACTERS.test(key)) throw invalid("vezérlőkaraktert tartalmaz");
-	for (const segment of key.split("/")) if (segment === "" || segment === "." || segment === "..") throw invalid("üres, \".\" vagy \"..\" útvonalszakaszt tartalmaz");
+	for (const segment of key.split("/")) if (segment === "" || isDotSegment(segment)) throw invalid("üres, \".\" vagy \"..\" útvonalszakaszt tartalmaz, akár %2e kódolással");
 	return key;
 }
 function normalizePrefix(prefix) {

package/dist/storage/fs.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_errors = require("../errors-Bn6pe6yw.cjs");
-const require_shared = require("../shared-BOBTXDTo.cjs");
+const require_shared = require("../shared-1HiN8LBf.cjs");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 // src/storage/fs.ts
@@ -30,14 +30,25 @@ function fsStorage(options) {
 		const [realRoot, realTarget] = await Promise.all([(0, node_fs_promises.realpath)(root), (0, node_fs_promises.realpath)(path)]);
 		if (realTarget !== realRoot && !isInside(realRoot, realTarget)) throw traversal(operation, key);
 	}
+	async function createDirectory(directory, key) {
+		await require_shared.guardStorageCall("Fájlrendszer", "put", key, () => (0, node_fs_promises.mkdir)(root, { recursive: true }));
+		let current = root;
+		for (const segment of (0, node_path.relative)(root, directory).split(node_path.sep)) {
+			if (segment === "") continue;
+			const next = (0, node_path.join)(current, segment);
+			await require_shared.guardStorageCall("Fájlrendszer", "put", key, () => (0, node_fs_promises.mkdir)(next).catch((error) => {
+				if (!hasCode(error, "EEXIST")) throw error;
+			}));
+			await assertRealPathInside(next, "put", key);
+			current = next;
+		}
+	}
 	return {
 		directory: root,
 		pathFor: (key) => pathFor(key),
 		async put(key, body, putOptions) {
 			const target = pathFor(key, "put");
-			const directory = (0, node_path.dirname)(target);
-			await require_shared.guardStorageCall("Fájlrendszer", "put", key, () => (0, node_fs_promises.mkdir)(directory, { recursive: true }));
-			await assertRealPathInside(directory, "put", key);
+			await createDirectory((0, node_path.dirname)(target), key);
 			const temporary = `${target}.${crypto.randomUUID()}.tmp`;
 			try {
 				await (0, node_fs_promises.writeFile)(temporary, body);
@@ -74,6 +85,12 @@ function fsStorage(options) {
 		},
 		async delete(key) {
 			const target = pathFor(key, "delete");
+			try {
+				await assertRealPathInside((0, node_path.dirname)(target), "delete", key);
+			} catch (error) {
+				if (hasCode(error, "ENOENT")) return;
+				throw error;
+			}
 			await require_shared.guardStorageCall("Fájlrendszer", "delete", key, () => (0, node_fs_promises.rm)(target, { force: true }));
 		},
 		async getUrl(key, urlOptions = {}) {

package/dist/storage/fs.js

@@ -1,7 +1,7 @@
 import { r as SzamlazzError } from "../errors-CGGsW0Y5.js";
-import { _ as guardStorageCall, d as normalizePrefix, f as resolveKey, h as StorageError, l as joinPublicUrl, m as unsupportedSignedUrl, u as missingPublicBaseUrl } from "../shared-Dbcfwr8x.js";
+import { _ as guardStorageCall, d as normalizePrefix, f as resolveKey, h as StorageError, l as joinPublicUrl, m as unsupportedSignedUrl, u as missingPublicBaseUrl } from "../shared-DF7m3lM7.js";
 import { mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 // src/storage/fs.ts
 function isInside(root, target) {
 	const path = relative(root, target);
@@ -29,14 +29,25 @@ function fsStorage(options) {
 		const [realRoot, realTarget] = await Promise.all([realpath(root), realpath(path)]);
 		if (realTarget !== realRoot && !isInside(realRoot, realTarget)) throw traversal(operation, key);
 	}
+	async function createDirectory(directory, key) {
+		await guardStorageCall("Fájlrendszer", "put", key, () => mkdir(root, { recursive: true }));
+		let current = root;
+		for (const segment of relative(root, directory).split(sep)) {
+			if (segment === "") continue;
+			const next = join(current, segment);
+			await guardStorageCall("Fájlrendszer", "put", key, () => mkdir(next).catch((error) => {
+				if (!hasCode(error, "EEXIST")) throw error;
+			}));
+			await assertRealPathInside(next, "put", key);
+			current = next;
+		}
+	}
 	return {
 		directory: root,
 		pathFor: (key) => pathFor(key),
 		async put(key, body, putOptions) {
 			const target = pathFor(key, "put");
-			const directory = dirname(target);
-			await guardStorageCall("Fájlrendszer", "put", key, () => mkdir(directory, { recursive: true }));
-			await assertRealPathInside(directory, "put", key);
+			await createDirectory(dirname(target), key);
 			const temporary = `${target}.${crypto.randomUUID()}.tmp`;
 			try {
 				await writeFile(temporary, body);
@@ -73,6 +84,12 @@ function fsStorage(options) {
 		},
 		async delete(key) {
 			const target = pathFor(key, "delete");
+			try {
+				await assertRealPathInside(dirname(target), "delete", key);
+			} catch (error) {
+				if (hasCode(error, "ENOENT")) return;
+				throw error;
+			}
 			await guardStorageCall("Fájlrendszer", "delete", key, () => rm(target, { force: true }));
 		},
 		async getUrl(key, urlOptions = {}) {

package/dist/storage/index.cjs

@@ -2,7 +2,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_errors = require("../errors-Bn6pe6yw.cjs");
 const require_binary = require("../binary-CdpKlNNI.cjs");
 const require_dates = require("../dates-oOp3ypPP.cjs");
-const require_shared = require("../shared-BOBTXDTo.cjs");
+const require_shared = require("../shared-1HiN8LBf.cjs");
 const require_url = require("../url-CRIlLxPE.cjs");
 // src/storage/keys.ts
 const DEFAULT_INVOICE_KEY_PREFIX = "szamlak";

package/dist/storage/index.js

@@ -1,7 +1,7 @@
 import { r as SzamlazzError } from "../errors-CGGsW0Y5.js";
 import { a as isPdf } from "../binary-DuKBSfH-.js";
 import { a as todayInBudapest, n as toAgentDate } from "../dates-DWsZOdaO.js";
-import { _ as guardStorageCall, a as assertStorageKey, c as encodeRfc3986, d as normalizePrefix, f as resolveKey, g as describeError, h as StorageError, i as assertExpires, l as joinPublicUrl, m as unsupportedSignedUrl, n as PDF_CONTENT_TYPE, o as basename, p as toArrayBuffer, r as S3_MAX_PRESIGN_SECONDS, s as encodeKeyPath, u as missingPublicBaseUrl, v as isStorageError } from "../shared-Dbcfwr8x.js";
+import { _ as guardStorageCall, a as assertStorageKey, c as encodeRfc3986, d as normalizePrefix, f as resolveKey, g as describeError, h as StorageError, i as assertExpires, l as joinPublicUrl, m as unsupportedSignedUrl, n as PDF_CONTENT_TYPE, o as basename, p as toArrayBuffer, r as S3_MAX_PRESIGN_SECONDS, s as encodeKeyPath, u as missingPublicBaseUrl, v as isStorageError } from "../shared-DF7m3lM7.js";
 import { n as trimTrailingSlashes } from "../url-DeCMiKVm.js";
 // src/storage/keys.ts
 const DEFAULT_INVOICE_KEY_PREFIX = "szamlak";

package/dist/stores/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_session = require("../session-BYotpR_s.cjs");
-const require_stores = require("../stores-CH4rYKs_.cjs");
+const require_stores = require("../stores-GFAEgthh.cjs");
 exports.CLOUDFLARE_KV_MIN_TTL_SECONDS = require_stores.CLOUDFLARE_KV_MIN_TTL_SECONDS;
 exports.DURABLE_OBJECT_STORE_URL = require_stores.DURABLE_OBJECT_STORE_URL;
 exports.SESSION_TTL_SECONDS = require_session.SESSION_TTL_SECONDS;

package/dist/stores/index.js

@@ -1,3 +1,3 @@
 import { a as memoryStore, n as memoryCookieStore, o as storeCapabilities, t as SESSION_TTL_SECONDS } from "../session-DZeE1ryt.js";
-import { a as upstashRedisCookieStore, c as customCookieStore, d as resilientCookieStore, i as diagnoseStore, l as CLOUDFLARE_KV_MIN_TTL_SECONDS, n as durableObjectStore, o as nodeRedisCookieStore, r as handleDurableObjectStoreRequest, s as ioredisCookieStore, t as DURABLE_OBJECT_STORE_URL, u as cloudflareKvCookieStore } from "../stores-BUnPNJQl.js";
+import { a as upstashRedisCookieStore, c as customCookieStore, d as resilientCookieStore, i as diagnoseStore, l as CLOUDFLARE_KV_MIN_TTL_SECONDS, n as durableObjectStore, o as nodeRedisCookieStore, r as handleDurableObjectStoreRequest, s as ioredisCookieStore, t as DURABLE_OBJECT_STORE_URL, u as cloudflareKvCookieStore } from "../stores-BHBPYrWE.js";
 export { CLOUDFLARE_KV_MIN_TTL_SECONDS, DURABLE_OBJECT_STORE_URL, SESSION_TTL_SECONDS, cloudflareKvCookieStore, cloudflareKvCookieStore as cloudflareKvStore, customCookieStore, customCookieStore as customStore, diagnoseStore, durableObjectStore, handleDurableObjectStoreRequest, ioredisCookieStore, ioredisCookieStore as ioredisStore, memoryCookieStore, memoryStore, nodeRedisCookieStore, nodeRedisCookieStore as nodeRedisStore, resilientCookieStore, resilientCookieStore as resilientStore, storeCapabilities, upstashRedisCookieStore, upstashRedisCookieStore as upstashRedisStore };

package/dist/{stores-BUnPNJQl.js → stores-BHBPYrWE.js}

@@ -254,7 +254,7 @@ async function diagnoseStore(store, options = {}) {
 		if (first !== 1 || second !== 2) throw new Error(`a számláló értékei: ${first}, ${second}`);
 		await store.delete(key);
 	});
-	await Promise.resolve(store.delete(key)).catch(() => void 0);
+	await Promise.resolve().then(() => store.delete(key)).catch(() => void 0);
 	if (!capabilities.setIfAbsent) problems.push("Nincs setIfAbsent: createOnce zárnak nem alkalmas (például Cloudflare KV).");
 	if (!capabilities.increment) problems.push("Nincs increment: naplónak nem alkalmas, a próbálkozás-napló nem atomikus.");
 	return {

package/dist/{stores-CH4rYKs_.cjs → stores-GFAEgthh.cjs}

@@ -254,7 +254,7 @@ async function diagnoseStore(store, options = {}) {
 		if (first !== 1 || second !== 2) throw new Error(`a számláló értékei: ${first}, ${second}`);
 		await store.delete(key);
 	});
-	await Promise.resolve(store.delete(key)).catch(() => void 0);
+	await Promise.resolve().then(() => store.delete(key)).catch(() => void 0);
 	if (!capabilities.setIfAbsent) problems.push("Nincs setIfAbsent: createOnce zárnak nem alkalmas (például Cloudflare KV).");
 	if (!capabilities.increment) problems.push("Nincs increment: naplónak nem alkalmas, a próbálkozás-napló nem atomikus.");
 	return {

package/dist/testing/index.cjs

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_create_once = require("../create-once-zeF7GVVP.cjs");
+const require_create_once = require("../create-once-BKUhF1Ov.cjs");
 const require_errors = require("../errors-Bn6pe6yw.cjs");
 const require_binary = require("../binary-CdpKlNNI.cjs");
 const require_serialize = require("../serialize-DEU7r6Bk.cjs");
-const require_issue = require("../issue-DReARZnF.cjs");
+const require_issue = require("../issue-bLLBTt9j.cjs");
 const require_dates = require("../dates-oOp3ypPP.cjs");
 const require_rounding = require("../rounding-CHmSK5Z2.cjs");
 const require_vat = require("../vat-BkoiiKm4.cjs");

package/dist/testing/index.d.cts

@@ -1,7 +1,7 @@
 import { a as AgentAction, t as KasszaWarning } from "../warnings-DpuYhn39.cjs";
 import { G as InvoiceType, M as CreateInvoiceInput, d as DocumentErrorMode, p as DocumentHook, st as SzamlazzError } from "../context-zGthvNo2.cjs";
 import { r as Receipt } from "../types-_HKTOCuQ.cjs";
-import { f as TaxpayerInfo, n as Kassza, r as KasszaDefaults } from "../client-B00WZ3FK.cjs";
+import { f as TaxpayerInfo, n as Kassza, r as KasszaDefaults } from "../client-CXjvVevB.cjs";
 import { n as InvoiceDetails, o as InvoiceDetailsPayment } from "../get-BL4Fr8-P.cjs";
 type FakeInvoiceTypeCode = "SZ" | "D" | "ES" | "VS" | "HS" | "SS" | "SL";
 interface FakeAgentSeller {

package/dist/testing/index.d.ts

@@ -1,7 +1,7 @@
 import { a as AgentAction, t as KasszaWarning } from "../warnings-DpuYhn39.js";
 import { G as InvoiceType, M as CreateInvoiceInput, d as DocumentErrorMode, p as DocumentHook, st as SzamlazzError } from "../context-BROX7Krw.js";
 import { r as Receipt } from "../types-Z6rQoqHn.js";
-import { f as TaxpayerInfo, n as Kassza, r as KasszaDefaults } from "../client-BJfeFjCM.js";
+import { f as TaxpayerInfo, n as Kassza, r as KasszaDefaults } from "../client-CvojBxd9.js";
 import { n as InvoiceDetails, o as InvoiceDetailsPayment } from "../get-BL4Fr8-P.js";
 type FakeInvoiceTypeCode = "SZ" | "D" | "ES" | "VS" | "HS" | "SS" | "SL";
 interface FakeAgentSeller {