kassza 1.0.1 → 1.0.2

package/dist/{server-aSw0DUua.js → server-CZTJ3562.js}

@@ -1,6 +1,6 @@
-import { c as resolveInvoice, l as INVOICE_LANGUAGES } from "./create-once-B6cAXyET.js";
+import { c as resolveInvoice, l as INVOICE_LANGUAGES } from "./create-once-DcEjO8QH.js";
 import { o as isSzamlazzError, r as SzamlazzError } from "./errors-CGGsW0Y5.js";
-import { t as createKassza } from "./client-JZ1M1sZX.js";
+import { t as createKassza } from "./client-8ElbVwSO.js";
 import { i as resolveRecoveryDelay, n as isUncertainOutcome, r as recoverAfterFailure } from "./once-CMhDPrs7.js";
 import { r as toBudapestDate } from "./dates-DWsZOdaO.js";
 import { a as isVatRate } from "./vat-B4J5Q0tu.js";
@@ -207,13 +207,14 @@ function resolveTtl(ttlMs) {
 function createConfirmations(options) {
 	const secret = options.secret ?? randomSecret();
 	const ttlMs = resolveTtl(options.ttlMs);
-	const sign = async (action, expiresAt, payload) => {
-		return (await hmacHex("SHA-256", secret, `${action}\n${expiresAt}\n${canonicalJson(payload)}`)).slice(0, SIGNATURE_LENGTH);
+	const sign = async (action, expiresAt, day, payload) => {
+		return (await hmacHex("SHA-256", secret, `${action}\n${expiresAt}\n${day}\n${canonicalJson(payload)}`)).slice(0, SIGNATURE_LENGTH);
 	};
 	return {
 		async issue(action, payload) {
-			const expiresAt = options.now().getTime() + ttlMs;
-			const signature = await sign(action, expiresAt, payload);
+			const now = options.now();
+			const expiresAt = now.getTime() + ttlMs;
+			const signature = await sign(action, expiresAt, toBudapestDate(now), payload);
 			return {
 				token: `${expiresAt.toString(36)}.${signature}`,
 				expiresAt: new Date(expiresAt).toISOString()
@@ -225,14 +226,20 @@ function createConfirmations(options) {
 			const match = TOKEN_PATTERN.exec(token.trim());
 			const expiresAt = match?.[1] === void 0 ? NaN : Number.parseInt(match[1], 36);
 			if (!match?.[2] || !Number.isSafeInteger(expiresAt)) throw new ToolInputError(`A megerősítő kód formátuma érvénytelen. ${again}`);
-			if (options.now().getTime() > expiresAt) throw new ToolInputError(`A megerősítő kód lejárt. ${again}`);
-			const expected = await sign(action, expiresAt, payload);
-			if (!timingSafeEqual(expected, match[2])) throw new ToolInputError(`A megerősítő kód nem ehhez a kéréshez tartozik (az adatok eltérnek az előnézettől). ${again}`);
+			const now = options.now();
+			if (now.getTime() > expiresAt) throw new ToolInputError(`A megerősítő kód lejárt. ${again}`);
+			const today = toBudapestDate(now);
+			const expected = await sign(action, expiresAt, today, payload);
+			if (!timingSafeEqual(expected, match[2])) {
+				const previewDay = toBudapestDate(new Date(expiresAt - ttlMs));
+				if (previewDay !== today && timingSafeEqual(await sign(action, expiresAt, previewDay, payload), match[2])) throw new ToolInputError(`A megerősítő kód egy előző napi (${previewDay}) előnézethez tartozik, budapesti idő szerint éjfél után nem érvényes. ${again}`);
+				throw new ToolInputError(`A megerősítő kód nem ehhez a kéréshez tartozik (az adatok eltérnek az előnézettől). ${again}`);
+			}
 		}
 	};
 }
 // src/core/version.ts
-const KASSZA_VERSION = "1.0.0";
+const KASSZA_VERSION = "1.0.1";
 // src/mcp/tool-kit.ts
 const LOCAL_READ = {
 	readOnlyHint: true,
@@ -1196,10 +1203,28 @@ function reversalOutput(document, reversedNumber, number, created) {
 		}
 	};
 }
+const reversalsInFlight = /* @__PURE__ */ new Map();
+async function oneReversalAtATime(key, run) {
+	for (;;) {
+		const pending = reversalsInFlight.get(key);
+		if (!pending) break;
+		await pending.catch(() => void 0);
+	}
+	const current = run();
+	reversalsInFlight.set(key, current);
+	try {
+		return await current;
+	} finally {
+		if (reversalsInFlight.get(key) === current) reversalsInFlight.delete(key);
+	}
+}
 async function reverseInvoice(args, context) {
 	assertKnownKeys(args, ["invoiceNumber", "confirmation"], "");
 	const invoiceNumber = requiredString(args, "invoiceNumber", "");
 	await context.confirmations.verify(REVERSE_INVOICE, { invoiceNumber }, args.confirmation, PREVIEW_REVERSAL);
+	return oneReversalAtATime(`invoice:${invoiceNumber}`, () => reverseInvoiceOnce(invoiceNumber, context));
+}
+async function reverseInvoiceOnce(invoiceNumber, context) {
 	const kassza = context.client();
 	const externalId = `${invoiceNumber}/SS`;
 	const lookup = () => kassza.invoices.find({ externalId }, { includePdf: false });
@@ -1225,6 +1250,9 @@ async function reverseReceipt(args, context) {
 	assertKnownKeys(args, ["receiptNumber", "confirmation"], "");
 	const receiptNumber = requiredString(args, "receiptNumber", "");
 	await context.confirmations.verify(REVERSE_RECEIPT, { receiptNumber }, args.confirmation, PREVIEW_REVERSAL);
+	return oneReversalAtATime(`receipt:${receiptNumber}`, () => reverseReceiptOnce(receiptNumber, context));
+}
+async function reverseReceiptOnce(receiptNumber, context) {
 	const kassza = context.client();
 	const original = await kassza.receipts.get({
 		receiptNumber,

package/dist/{server-BbR19Oj6.cjs → server-CrmxXPV-.cjs}

@@ -1,6 +1,6 @@
-const require_create_once = require("./create-once-zeF7GVVP.cjs");
+const require_create_once = require("./create-once-BKUhF1Ov.cjs");
 const require_errors = require("./errors-Bn6pe6yw.cjs");
-const require_client = require("./client-I_29IPMh.cjs");
+const require_client = require("./client-CYS1_Xaz.cjs");
 const require_once = require("./once-BmXfrNbQ.cjs");
 const require_dates = require("./dates-oOp3ypPP.cjs");
 const require_vat = require("./vat-BkoiiKm4.cjs");
@@ -207,13 +207,14 @@ function resolveTtl(ttlMs) {
 function createConfirmations(options) {
 	const secret = options.secret ?? randomSecret();
 	const ttlMs = resolveTtl(options.ttlMs);
-	const sign = async (action, expiresAt, payload) => {
-		return (await require_crypto.hmacHex("SHA-256", secret, `${action}\n${expiresAt}\n${canonicalJson(payload)}`)).slice(0, SIGNATURE_LENGTH);
+	const sign = async (action, expiresAt, day, payload) => {
+		return (await require_crypto.hmacHex("SHA-256", secret, `${action}\n${expiresAt}\n${day}\n${canonicalJson(payload)}`)).slice(0, SIGNATURE_LENGTH);
 	};
 	return {
 		async issue(action, payload) {
-			const expiresAt = options.now().getTime() + ttlMs;
-			const signature = await sign(action, expiresAt, payload);
+			const now = options.now();
+			const expiresAt = now.getTime() + ttlMs;
+			const signature = await sign(action, expiresAt, require_dates.toBudapestDate(now), payload);
 			return {
 				token: `${expiresAt.toString(36)}.${signature}`,
 				expiresAt: new Date(expiresAt).toISOString()
@@ -225,14 +226,20 @@ function createConfirmations(options) {
 			const match = TOKEN_PATTERN.exec(token.trim());
 			const expiresAt = match?.[1] === void 0 ? NaN : Number.parseInt(match[1], 36);
 			if (!match?.[2] || !Number.isSafeInteger(expiresAt)) throw new ToolInputError(`A megerősítő kód formátuma érvénytelen. ${again}`);
-			if (options.now().getTime() > expiresAt) throw new ToolInputError(`A megerősítő kód lejárt. ${again}`);
-			const expected = await sign(action, expiresAt, payload);
-			if (!require_crypto.timingSafeEqual(expected, match[2])) throw new ToolInputError(`A megerősítő kód nem ehhez a kéréshez tartozik (az adatok eltérnek az előnézettől). ${again}`);
+			const now = options.now();
+			if (now.getTime() > expiresAt) throw new ToolInputError(`A megerősítő kód lejárt. ${again}`);
+			const today = require_dates.toBudapestDate(now);
+			const expected = await sign(action, expiresAt, today, payload);
+			if (!require_crypto.timingSafeEqual(expected, match[2])) {
+				const previewDay = require_dates.toBudapestDate(new Date(expiresAt - ttlMs));
+				if (previewDay !== today && require_crypto.timingSafeEqual(await sign(action, expiresAt, previewDay, payload), match[2])) throw new ToolInputError(`A megerősítő kód egy előző napi (${previewDay}) előnézethez tartozik, budapesti idő szerint éjfél után nem érvényes. ${again}`);
+				throw new ToolInputError(`A megerősítő kód nem ehhez a kéréshez tartozik (az adatok eltérnek az előnézettől). ${again}`);
+			}
 		}
 	};
 }
 // src/core/version.ts
-const KASSZA_VERSION = "1.0.0";
+const KASSZA_VERSION = "1.0.1";
 // src/mcp/tool-kit.ts
 const LOCAL_READ = {
 	readOnlyHint: true,
@@ -1196,10 +1203,28 @@ function reversalOutput(document, reversedNumber, number, created) {
 		}
 	};
 }
+const reversalsInFlight = /* @__PURE__ */ new Map();
+async function oneReversalAtATime(key, run) {
+	for (;;) {
+		const pending = reversalsInFlight.get(key);
+		if (!pending) break;
+		await pending.catch(() => void 0);
+	}
+	const current = run();
+	reversalsInFlight.set(key, current);
+	try {
+		return await current;
+	} finally {
+		if (reversalsInFlight.get(key) === current) reversalsInFlight.delete(key);
+	}
+}
 async function reverseInvoice(args, context) {
 	assertKnownKeys(args, ["invoiceNumber", "confirmation"], "");
 	const invoiceNumber = requiredString(args, "invoiceNumber", "");
 	await context.confirmations.verify(REVERSE_INVOICE, { invoiceNumber }, args.confirmation, PREVIEW_REVERSAL);
+	return oneReversalAtATime(`invoice:${invoiceNumber}`, () => reverseInvoiceOnce(invoiceNumber, context));
+}
+async function reverseInvoiceOnce(invoiceNumber, context) {
 	const kassza = context.client();
 	const externalId = `${invoiceNumber}/SS`;
 	const lookup = () => kassza.invoices.find({ externalId }, { includePdf: false });
@@ -1225,6 +1250,9 @@ async function reverseReceipt(args, context) {
 	assertKnownKeys(args, ["receiptNumber", "confirmation"], "");
 	const receiptNumber = requiredString(args, "receiptNumber", "");
 	await context.confirmations.verify(REVERSE_RECEIPT, { receiptNumber }, args.confirmation, PREVIEW_REVERSAL);
+	return oneReversalAtATime(`receipt:${receiptNumber}`, () => reverseReceiptOnce(receiptNumber, context));
+}
+async function reverseReceiptOnce(receiptNumber, context) {
 	const kassza = context.client();
 	const original = await kassza.receipts.get({
 		receiptNumber,

package/dist/testing/index.cjs

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_create_once = require("../create-once-zeF7GVVP.cjs");
+const require_create_once = require("../create-once-BKUhF1Ov.cjs");
 const require_errors = require("../errors-Bn6pe6yw.cjs");
 const require_binary = require("../binary-CdpKlNNI.cjs");
 const require_serialize = require("../serialize-DEU7r6Bk.cjs");
-const require_issue = require("../issue-DReARZnF.cjs");
+const require_issue = require("../issue-bLLBTt9j.cjs");
 const require_dates = require("../dates-oOp3ypPP.cjs");
 const require_rounding = require("../rounding-CHmSK5Z2.cjs");
 const require_vat = require("../vat-BkoiiKm4.cjs");

package/dist/testing/index.d.cts

@@ -1,7 +1,7 @@
 import { a as AgentAction, t as KasszaWarning } from "../warnings-DpuYhn39.cjs";
 import { G as InvoiceType, M as CreateInvoiceInput, d as DocumentErrorMode, p as DocumentHook, st as SzamlazzError } from "../context-zGthvNo2.cjs";
 import { r as Receipt } from "../types-_HKTOCuQ.cjs";
-import { f as TaxpayerInfo, n as Kassza, r as KasszaDefaults } from "../client-B00WZ3FK.cjs";
+import { f as TaxpayerInfo, n as Kassza, r as KasszaDefaults } from "../client-CXjvVevB.cjs";
 import { n as InvoiceDetails, o as InvoiceDetailsPayment } from "../get-BL4Fr8-P.cjs";
 type FakeInvoiceTypeCode = "SZ" | "D" | "ES" | "VS" | "HS" | "SS" | "SL";
 interface FakeAgentSeller {

package/dist/testing/index.d.ts

@@ -1,7 +1,7 @@
 import { a as AgentAction, t as KasszaWarning } from "../warnings-DpuYhn39.js";
 import { G as InvoiceType, M as CreateInvoiceInput, d as DocumentErrorMode, p as DocumentHook, st as SzamlazzError } from "../context-BROX7Krw.js";
 import { r as Receipt } from "../types-Z6rQoqHn.js";
-import { f as TaxpayerInfo, n as Kassza, r as KasszaDefaults } from "../client-BJfeFjCM.js";
+import { f as TaxpayerInfo, n as Kassza, r as KasszaDefaults } from "../client-CvojBxd9.js";
 import { n as InvoiceDetails, o as InvoiceDetailsPayment } from "../get-BL4Fr8-P.js";
 type FakeInvoiceTypeCode = "SZ" | "D" | "ES" | "VS" | "HS" | "SS" | "SL";
 interface FakeAgentSeller {

package/dist/testing/index.js

@@ -1,8 +1,8 @@
-import { c as resolveInvoice, g as AGENT_ACTIONS, m as emitDocumentEvent, r as registerPaymentOnce, t as createReceiptOnce } from "../create-once-B6cAXyET.js";
+import { c as resolveInvoice, g as AGENT_ACTIONS, m as emitDocumentEvent, r as registerPaymentOnce, t as createReceiptOnce } from "../create-once-DcEjO8QH.js";
 import { r as SzamlazzError, t as AGENT_ERROR_CODES } from "../errors-CGGsW0Y5.js";
 import { i as encodeUtf8, n as bytesToBase64 } from "../binary-DuKBSfH-.js";
 import { a as optionalEl, c as childNumber, d as findChildren, f as parseXml, i as formatXmlNumber, l as childText, n as buildXmlDocument, r as el, s as childBoolean, u as findChild } from "../serialize-CjymGkJj.js";
-import { l as createInvoiceOnce, n as issueForPayment, o as convertReceiptToInvoice } from "../issue-Dy9zvRK1.js";
+import { l as createInvoiceOnce, n as issueForPayment, o as convertReceiptToInvoice } from "../issue-CUiDvJhQ.js";
 import { n as toAgentDate, r as toBudapestDate } from "../dates-DWsZOdaO.js";
 import { n as decimalPlaces, r as roundMoney } from "../rounding-CZLj4DbV.js";
 import { i as isHuf, t as NUMERIC_VAT_RATES } from "../vat-B4J5Q0tu.js";

package/dist/{types-DeuUqIvU.d.cts → types-DGJiVNxr.d.cts}

@@ -1,7 +1,7 @@
 import { t as KasszaWarning } from "./warnings-DpuYhn39.cjs";
 import { n as KeyValueStore } from "./store-BkaZ8qkU.cjs";
 type PaymentProvider = "stripe" | "simplepay" | "barion" | "revolut" | "paypal" | (string & {});
-type PaymentEventKind = "paid" | "refunded" | "partially-refunded" | "failed" | "other";
+type PaymentEventKind = "paid" | "refunded" | "partially-refunded" | "refund-failed" | "failed" | "other";
 interface PaymentAmount {
   readonly value: number;
   readonly currency: string;

package/dist/{types-oiDulesz.d.ts → types-DPnHIwQ_.d.ts}

@@ -1,7 +1,7 @@
 import { t as KasszaWarning } from "./warnings-DpuYhn39.js";
 import { n as KeyValueStore } from "./store-BkaZ8qkU.js";
 type PaymentProvider = "stripe" | "simplepay" | "barion" | "revolut" | "paypal" | (string & {});
-type PaymentEventKind = "paid" | "refunded" | "partially-refunded" | "failed" | "other";
+type PaymentEventKind = "paid" | "refunded" | "partially-refunded" | "refund-failed" | "failed" | "other";
 interface PaymentAmount {
   readonly value: number;
   readonly currency: string;

package/dist/{webhook-C9IBUdeT.d.ts → webhook-BY7437wx.d.ts}

@@ -1,4 +1,4 @@
-import { i as PaymentEvent, u as PaymentWebhookBaseOptions } from "./types-oiDulesz.js";
+import { i as PaymentEvent, u as PaymentWebhookBaseOptions } from "./types-DPnHIwQ_.js";
 declare const WEBHOOK_DEDUPE_KEY_PREFIX = "szamlazz:evt:";
 declare const DEFAULT_DEDUPE_TTL_SECONDS: number;
 type WebhookHandler = (request: Request) => Promise<Response>;

package/dist/{webhook-DF2p_m2Q.d.cts → webhook-CwDbGvSn.d.cts}

@@ -1,4 +1,4 @@
-import { i as PaymentEvent, u as PaymentWebhookBaseOptions } from "./types-DeuUqIvU.cjs";
+import { i as PaymentEvent, u as PaymentWebhookBaseOptions } from "./types-DGJiVNxr.cjs";
 declare const WEBHOOK_DEDUPE_KEY_PREFIX = "szamlazz:evt:";
 declare const DEFAULT_DEDUPE_TTL_SECONDS: number;
 type WebhookHandler = (request: Request) => Promise<Response>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kassza",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "author": {
     "name": "futozs",
     "url": "https://github.com/futozs",