ksef-client-ts 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,2009 @@
+import * as crypto from 'node:crypto';
+
+interface EnvironmentConfig {
+    apiUrl: string;
+    qrUrl: string;
+    lighthouseUrl: string;
+}
+declare const Environment: {
+    readonly TEST: {
+        readonly apiUrl: "https://api-test.ksef.mf.gov.pl";
+        readonly qrUrl: "https://qr-test.ksef.mf.gov.pl";
+        readonly lighthouseUrl: "https://api-latarnia-test.ksef.mf.gov.pl";
+    };
+    readonly DEMO: {
+        readonly apiUrl: "https://api-demo.ksef.mf.gov.pl";
+        readonly qrUrl: "https://qr-demo.ksef.mf.gov.pl";
+        readonly lighthouseUrl: "";
+    };
+    readonly PRD: {
+        readonly apiUrl: "https://api.ksef.mf.gov.pl";
+        readonly qrUrl: "https://qr.ksef.mf.gov.pl";
+        readonly lighthouseUrl: "https://api-latarnia.ksef.mf.gov.pl";
+    };
+};
+type EnvironmentName = keyof typeof Environment;
+
+type TransportFn = (url: string, init: RequestInit) => Promise<Response>;
+declare const defaultTransport: TransportFn;
+
+interface RetryPolicy {
+    maxRetries: number;
+    baseDelayMs: number;
+    maxDelayMs: number;
+    retryableStatusCodes: number[];
+    retryNetworkErrors: boolean;
+}
+declare function defaultRetryPolicy(): RetryPolicy;
+declare function calculateBackoff(attempt: number, policy: RetryPolicy): number;
+declare function parseRetryAfter(header: string | null): number | null;
+declare function isRetryableError(error: unknown, policy: RetryPolicy): boolean;
+declare function isRetryableStatus(status: number, policy: RetryPolicy): boolean;
+declare function sleep(ms: number): Promise<void>;
+
+interface RateLimitConfig {
+    globalRps: number;
+    endpointLimits?: Record<string, number>;
+}
+declare class RateLimitPolicy {
+    private readonly globalBucket;
+    private readonly endpointBuckets;
+    private readonly endpointLimits;
+    private chain;
+    constructor(config: RateLimitConfig);
+    acquire(endpoint: string): Promise<void>;
+    private doAcquire;
+}
+declare function defaultRateLimitPolicy(): RateLimitPolicy;
+
+interface AuthManager {
+    getAccessToken(): string | undefined;
+    setAccessToken(token: string | undefined): void;
+    getRefreshToken(): string | undefined;
+    setRefreshToken(token: string | undefined): void;
+    onUnauthorized(): Promise<string | null>;
+}
+declare class DefaultAuthManager implements AuthManager {
+    private token;
+    private refreshToken;
+    private readonly refreshFn;
+    private refreshPromise;
+    constructor(refreshFn: () => Promise<string | null>, initialToken?: string);
+    getAccessToken(): string | undefined;
+    setAccessToken(token: string | undefined): void;
+    getRefreshToken(): string | undefined;
+    setRefreshToken(token: string | undefined): void;
+    onUnauthorized(): Promise<string | null>;
+}
+
+interface KSeFClientOptions {
+    environment?: EnvironmentName;
+    baseUrl?: string;
+    baseQrUrl?: string;
+    lighthouseUrl?: string;
+    apiVersion?: string;
+    timeout?: number;
+    customHeaders?: Record<string, string>;
+    transport?: TransportFn;
+    retry?: Partial<RetryPolicy>;
+    rateLimit?: Partial<RateLimitConfig> | null;
+    presignedUrlHosts?: string[];
+    authManager?: AuthManager;
+}
+interface ResolvedOptions {
+    baseUrl: string;
+    baseQrUrl: string;
+    lighthouseUrl: string;
+    apiVersion: string;
+    timeout: number;
+    customHeaders: Record<string, string>;
+}
+declare function resolveOptions(options?: KSeFClientOptions): ResolvedOptions;
+
+interface ExceptionDetails {
+    exceptionCode?: number;
+    exceptionDescription?: string | null;
+    details?: string[] | null;
+}
+interface ApiErrorResponse {
+    exception?: {
+        serviceCtx?: string;
+        serviceCode?: string;
+        serviceName?: string;
+        timestamp?: string;
+        referenceNumber?: string;
+        exceptionDetailList?: ExceptionDetails[];
+    };
+}
+interface UnauthorizedProblemDetails {
+    title: string;
+    status: number;
+    detail: string;
+    instance?: string;
+    traceId?: string;
+}
+type ForbiddenReasonCode = 'missing-permissions' | 'ip-not-allowed' | 'insufficient-resource-access' | 'auth-method-not-allowed' | 'security-service-blocked' | (string & {});
+interface ForbiddenProblemDetails {
+    title: string;
+    status: number;
+    detail: string;
+    instance?: string;
+    reasonCode: ForbiddenReasonCode;
+    security?: Record<string, unknown>;
+    traceId?: string;
+}
+
+declare class KSeFError extends Error {
+    constructor(message: string);
+}
+
+interface ValidationDetail {
+    field?: string;
+    message: string;
+}
+declare class KSeFValidationError extends KSeFError {
+    readonly details: ValidationDetail[];
+    constructor(message: string, details?: ValidationDetail[]);
+    static fromField(field: string, message: string): KSeFValidationError;
+    static fromMessages(messages: string[]): KSeFValidationError;
+}
+
+declare class KSeFApiError extends KSeFError {
+    readonly statusCode: number;
+    readonly errorResponse?: ApiErrorResponse;
+    constructor(message: string, statusCode: number, errorResponse?: ApiErrorResponse);
+    static fromResponse(statusCode: number, body?: ApiErrorResponse): KSeFApiError;
+}
+
+declare class KSeFRateLimitError extends KSeFApiError {
+    readonly retryAfterSeconds?: number;
+    readonly retryAfterDate?: Date;
+    readonly recommendedDelay: number;
+    constructor(message: string, statusCode: number, errorResponse?: ApiErrorResponse, retryAfterSeconds?: number, retryAfterDate?: Date);
+    static fromRetryAfterHeader(statusCode: number, retryAfterHeader?: string | null, body?: ApiErrorResponse): KSeFRateLimitError;
+}
+
+declare class KSeFUnauthorizedError extends KSeFError {
+    readonly statusCode = 401;
+    readonly detail: string;
+    readonly traceId?: string;
+    readonly instance?: string;
+    constructor(problemDetails: UnauthorizedProblemDetails);
+}
+
+declare class KSeFForbiddenError extends KSeFError {
+    readonly statusCode = 403;
+    readonly detail: string;
+    readonly reasonCode: ForbiddenReasonCode;
+    readonly instance?: string;
+    readonly security?: Record<string, unknown>;
+    readonly traceId?: string;
+    constructor(problemDetails: ForbiddenProblemDetails);
+}
+
+declare class KSeFAuthStatusError extends KSeFError {
+    readonly referenceNumber?: string;
+    readonly statusDescription?: string;
+    constructor(message: string, referenceNumber?: string, statusDescription?: string);
+}
+
+declare class KSeFSessionExpiredError extends KSeFError {
+    constructor(message?: string);
+}
+
+declare class RouteBuilder {
+    private readonly apiVersion;
+    constructor(apiVersion: string);
+    build(endpoint: string, apiVersion?: string): string;
+}
+
+type HttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';
+declare class RestRequest {
+    readonly method: HttpMethod;
+    readonly path: string;
+    private _body?;
+    private _headers;
+    private _query;
+    private _presigned;
+    private _skipAuthRetry;
+    private constructor();
+    static get(path: string): RestRequest;
+    static post(path: string): RestRequest;
+    static put(path: string): RestRequest;
+    static delete(path: string): RestRequest;
+    body(data: unknown): this;
+    header(name: string, value: string): this;
+    headers(headers: Record<string, string>): this;
+    accessToken(token: string): this;
+    query(key: string, value: string): this;
+    presigned(flag?: boolean): this;
+    isPresigned(): boolean;
+    skipAuthRetry(flag?: boolean): this;
+    isSkipAuthRetry(): boolean;
+    getBody(): unknown | undefined;
+    getHeaders(): Record<string, string>;
+    getQuery(): [string, string][];
+}
+
+interface RestResponse<T> {
+    body: T;
+    headers: Headers;
+    statusCode: number;
+}
+
+interface PresignedUrlPolicy {
+    allowedHosts: string[];
+    requireHttps: boolean;
+    blockRedirectParams: boolean;
+    rejectPrivateIps: boolean;
+}
+declare function defaultPresignedUrlPolicy(): PresignedUrlPolicy;
+declare function validatePresignedUrl(url: string, policy: PresignedUrlPolicy): void;
+
+interface RestClientConfig {
+    transport?: TransportFn;
+    retryPolicy?: RetryPolicy;
+    rateLimitPolicy?: RateLimitPolicy | null;
+    authManager?: AuthManager;
+    presignedUrlPolicy?: PresignedUrlPolicy;
+}
+declare class RestClient {
+    private readonly options;
+    private readonly routeBuilder;
+    private readonly transport;
+    private readonly retryPolicy;
+    private readonly rateLimitPolicy;
+    private readonly authManager?;
+    private readonly presignedUrlPolicy?;
+    constructor(options: ResolvedOptions, config?: RestClientConfig);
+    execute<T>(request: RestRequest): Promise<RestResponse<T>>;
+    executeRaw(request: RestRequest): Promise<RestResponse<ArrayBuffer>>;
+    private sendRequest;
+    private doRequest;
+    private buildUrl;
+    private ensureSuccess;
+}
+
+/**
+ * All KSeF API v2 route definitions.
+ *
+ * Static routes are plain string literals.
+ * Parameterized routes are arrow functions returning template-literal `as const`.
+ */
+declare const Routes: {
+    readonly TestData: {
+        readonly createSubject: "testdata/subject";
+        readonly removeSubject: "testdata/subject/remove";
+        readonly createPerson: "testdata/person";
+        readonly removePerson: "testdata/person/remove";
+        readonly grantPerms: "testdata/permissions";
+        readonly revokePerms: "testdata/permissions/revoke";
+        readonly enableAttach: "testdata/attachment";
+        readonly disableAttach: "testdata/attachment/revoke";
+        readonly changeSessionLimitsInCurrentContext: "testdata/limits/context/session";
+        readonly restoreDefaultSessionLimitsInCurrentContext: "testdata/limits/context/session";
+        readonly changeCertificatesLimitInCurrentSubject: "testdata/limits/subject/certificate";
+        readonly restoreDefaultCertificatesLimitInCurrentSubject: "testdata/limits/subject/certificate";
+        readonly rateLimits: "testdata/rate-limits";
+        readonly productionRateLimits: "testdata/rate-limits/production";
+        readonly blockContext: "testdata/context/block";
+        readonly unblockContext: "testdata/context/unblock";
+    };
+    readonly Limits: {
+        readonly currentContext: "limits/context";
+        readonly currentSubject: "limits/subject";
+        readonly rateLimits: "rate-limits";
+    };
+    readonly ActiveSessions: {
+        readonly session: "auth/sessions";
+        readonly delete: (ref: string) => `auth/sessions/${string}`;
+        readonly currentSession: "auth/sessions/current";
+    };
+    readonly Authorization: {
+        readonly challenge: "auth/challenge";
+        readonly xadesSignature: "auth/xades-signature";
+        readonly ksefToken: "auth/ksef-token";
+        readonly status: (ref: string) => `auth/${string}`;
+        readonly Token: {
+            readonly redeem: "auth/token/redeem";
+            readonly refresh: "auth/token/refresh";
+        };
+    };
+    readonly Sessions: {
+        readonly root: "sessions";
+        readonly byReference: (ref: string) => `sessions/${string}`;
+        readonly invoices: (ref: string) => `sessions/${string}/invoices`;
+        readonly invoice: (ref: string, invoiceRef: string) => `sessions/${string}/invoices/${string}`;
+        readonly failedInvoices: (ref: string) => `sessions/${string}/invoices/failed`;
+        readonly upoByKsefNumber: (ref: string, ksefNumber: string) => `sessions/${string}/invoices/ksef/${string}/upo`;
+        readonly upoByInvoiceReference: (ref: string, invoiceRef: string) => `sessions/${string}/invoices/${string}/upo`;
+        readonly upo: (ref: string, upoRef: string) => `sessions/${string}/upo/${string}`;
+        readonly Online: {
+            readonly open: "sessions/online";
+            readonly invoices: (sessionRef: string) => `sessions/online/${string}/invoices`;
+            readonly close: (sessionRef: string) => `sessions/online/${string}/close`;
+        };
+        readonly Batch: {
+            readonly open: "sessions/batch";
+            readonly close: (batchRef: string) => `sessions/batch/${string}/close`;
+        };
+    };
+    readonly Invoices: {
+        readonly byKsefNumber: (ksefNumber: string) => `invoices/ksef/${string}`;
+        readonly queryMetadata: "invoices/query/metadata";
+        readonly exports: "invoices/exports";
+        readonly exportByReference: (ref: string) => `invoices/exports/${string}`;
+    };
+    readonly Permissions: {
+        readonly Grants: {
+            readonly persons: "permissions/persons/grants";
+            readonly entities: "permissions/entities/grants";
+            readonly authorizations: "permissions/authorizations/grants";
+            readonly indirect: "permissions/indirect/grants";
+            readonly subunits: "permissions/subunits/grants";
+            readonly euEntities: "permissions/eu-entities/administration/grants";
+            readonly euEntitiesRepresentatives: "permissions/eu-entities/grants";
+        };
+        readonly Common: {
+            readonly grantById: (id: string) => `permissions/common/grants/${string}`;
+        };
+        readonly Authorizations: {
+            readonly grantById: (id: string) => `permissions/authorizations/grants/${string}`;
+        };
+        readonly Query: {
+            readonly personalGrants: "permissions/query/personal/grants";
+            readonly personsGrants: "permissions/query/persons/grants";
+            readonly subunitsGrants: "permissions/query/subunits/grants";
+            readonly entitiesRoles: "permissions/query/entities/roles";
+            readonly entitiesGrants: "permissions/query/entities/grants";
+            readonly subordinateEntitiesRoles: "permissions/query/subordinate-entities/roles";
+            readonly authorizationsGrants: "permissions/query/authorizations/grants";
+            readonly euEntitiesGrants: "permissions/query/eu-entities/grants";
+        };
+        readonly Operations: {
+            readonly byReference: (ref: string) => `permissions/operations/${string}`;
+        };
+        readonly Attachments: {
+            readonly status: "permissions/attachments/status";
+        };
+    };
+    readonly Certificates: {
+        readonly limits: "certificates/limits";
+        readonly enrollmentData: "certificates/enrollments/data";
+        readonly enrollments: "certificates/enrollments";
+        readonly enrollmentStatus: (ref: string) => `certificates/enrollments/${string}`;
+        readonly retrieve: "certificates/retrieve";
+        readonly revoke: (serialNumber: string) => `certificates/${string}/revoke`;
+        readonly query: "certificates/query";
+    };
+    readonly Tokens: {
+        readonly root: "tokens";
+        readonly byReference: (ref: string) => `tokens/${string}`;
+    };
+    readonly Peppol: {
+        readonly query: "peppol/query";
+    };
+    readonly Security: {
+        readonly publicKeyCertificates: "security/public-key-certificates";
+    };
+    readonly Lighthouse: {
+        readonly status: "status";
+        readonly messages: "messages";
+    };
+};
+
+declare const Nip: RegExp;
+declare const VatUe: RegExp;
+declare const NipVatUe: RegExp;
+declare const InternalId: RegExp;
+declare const PeppolId: RegExp;
+declare const ReferenceNumber: RegExp;
+declare const KsefNumber: RegExp;
+declare const KsefNumberV35: RegExp;
+declare const KsefNumberV36: RegExp;
+declare const CertificateName: RegExp;
+declare const Pesel: RegExp;
+declare const CertificateFingerprint: RegExp;
+declare const Base64String: RegExp;
+declare const Ip4Address: RegExp;
+declare const Ip4Range: RegExp;
+declare const Ip4Mask: RegExp;
+declare const Sha256Base64: RegExp;
+declare function isValidNip(value: string): boolean;
+declare function isValidVatUe(value: string): boolean;
+declare function isValidNipVatUe(value: string): boolean;
+declare function isValidInternalId(value: string): boolean;
+declare function isValidPeppolId(value: string): boolean;
+declare function isValidReferenceNumber(value: string): boolean;
+declare function isValidKsefNumber(value: string): boolean;
+declare function isValidPesel(value: string): boolean;
+declare function isValidCertificateName(value: string): boolean;
+declare function isValidCertificateFingerprint(value: string): boolean;
+declare function isValidBase64(value: string): boolean;
+declare function isValidIp4Address(value: string): boolean;
+declare function isValidSha256Base64(value: string): boolean;
+
+declare const REQUIRED_CHALLENGE_LENGTH = 36;
+declare const CERTIFICATE_NAME_MIN_LENGTH = 5;
+declare const CERTIFICATE_NAME_MAX_LENGTH = 100;
+declare const SUBUNIT_NAME_MIN_LENGTH = 5;
+declare const SUBUNIT_NAME_MAX_LENGTH = 256;
+declare const PERMISSION_DESCRIPTION_MIN_LENGTH = 5;
+declare const PERMISSION_DESCRIPTION_MAX_LENGTH = 256;
+
+interface OperationResponse {
+    referenceNumber: string;
+}
+interface OperationStatusInfo {
+    code: number;
+    description: string;
+    details?: string[];
+}
+interface TokenInfo {
+    token: string;
+    validUntil: string;
+}
+interface FormCode {
+    systemCode: string;
+    schemaVersion: string;
+    value: string;
+}
+interface EncryptionInfo {
+    encryptedSymmetricKey: string;
+    initializationVector: string;
+}
+interface FileMetadata {
+    hashSHA: string;
+    fileSize: number;
+}
+type ContextIdentifierType = 'Nip' | 'InternalId' | 'NipVatUe' | 'PeppolId';
+interface ContextIdentifier {
+    type: ContextIdentifierType;
+    value: string;
+}
+type SessionType = 'Online' | 'Batch';
+type SessionStatus = 'Succeeded' | 'InProgress' | 'Failed' | 'Cancelled';
+type SortOrder = 'Asc' | 'Desc';
+type InvoicingMode = 'Online' | 'Offline';
+type PermissionSubjectIdentifierType = 'Nip' | 'Pesel' | 'Fingerprint';
+
+interface AuthChallengeResponse {
+    challenge: string;
+    timestamp: string;
+    timestampMs: number;
+    clientIp: string;
+}
+interface AuthenticationInitResponse {
+    referenceNumber: string;
+    authenticationToken: TokenInfo;
+}
+interface AuthenticationTokensResponse {
+    accessToken: TokenInfo;
+    refreshToken: TokenInfo;
+}
+interface AuthenticationTokenRefreshResponse {
+    accessToken: TokenInfo;
+}
+type AuthenticationMethodInfoCategory = 'XadesSignature' | 'NationalNode' | 'Token' | 'Other';
+interface AuthenticationMethodInfo {
+    category: AuthenticationMethodInfoCategory;
+    code: string;
+    displayName: string;
+}
+interface AuthenticationOperationStatusResponse {
+    startDate: string;
+    authenticationMethodInfo: AuthenticationMethodInfo;
+    /** @deprecated Required by spec but deprecated. */
+    authenticationMethod?: AuthenticationMethod;
+    status: OperationStatusInfo;
+    isTokenRedeemed?: boolean;
+    lastTokenRefreshDate?: string;
+    refreshTokenValidUntil?: string;
+}
+/**
+ * Subject identifier type for the XAdES auth XML request.
+ * This is XML-specific (not in the REST OpenAPI spec).
+ * Known value: 'certificateSubject' (used with qualified signatures/seals).
+ */
+type XadesSubjectIdentifierType = 'certificateSubject' | (string & {});
+interface AllowedIps {
+    ip4Addresses?: string[];
+    ip4Ranges?: string[];
+    ip4Masks?: string[];
+}
+interface AuthorizationPolicy {
+    allowedIps?: AllowedIps;
+}
+interface AuthTokenRequest {
+    challenge: string;
+    contextIdentifier: ContextIdentifier;
+    subjectIdentifierType: XadesSubjectIdentifierType;
+    authorizationPolicy?: AuthorizationPolicy;
+}
+interface AuthKsefTokenRequest {
+    challenge: string;
+    contextIdentifier: ContextIdentifier;
+    encryptedToken: string;
+    authorizationPolicy?: AuthorizationPolicy;
+}
+type AuthenticationMethod = 'Token' | 'TrustedProfile' | 'InternalCertificate' | 'QualifiedSignature' | 'QualifiedSeal' | 'PersonalSignature' | 'PeppolSignature';
+
+interface AuthSessionInfo {
+    startDate: string;
+    authenticationMethodInfo: AuthenticationMethodInfo;
+    /** @deprecated Required by spec but deprecated. */
+    authenticationMethod?: AuthenticationMethod;
+    status: OperationStatusInfo;
+    isTokenRedeemed?: boolean;
+    lastTokenRefreshDate?: string;
+    refreshTokenValidUntil?: string;
+    referenceNumber: string;
+    isCurrent: boolean;
+}
+interface AuthenticationListResponse {
+    continuationToken?: string;
+    items: AuthSessionInfo[];
+}
+
+interface OpenOnlineSessionRequest {
+    formCode: FormCode;
+    encryption: EncryptionInfo;
+}
+interface OpenOnlineSessionResponse {
+    referenceNumber: string;
+    validUntil: string;
+}
+interface SendInvoiceRequest {
+    invoiceHash: string;
+    invoiceSize: number;
+    encryptedInvoiceHash: string;
+    encryptedInvoiceSize: number;
+    encryptedInvoiceContent: string;
+    offlineMode?: boolean;
+    hashOfCorrectedInvoice?: string;
+}
+interface SendInvoiceResponse {
+    referenceNumber: string;
+}
+
+interface BatchFilePartInfo {
+    ordinalNumber: number;
+    fileSize: number;
+    fileHash: string;
+}
+interface BatchFileInfo {
+    fileSize: number;
+    fileHash: string;
+    fileParts: BatchFilePartInfo[];
+}
+interface OpenBatchSessionRequest {
+    formCode: FormCode;
+    batchFile: BatchFileInfo;
+    encryption: EncryptionInfo;
+    offlineMode?: boolean;
+}
+interface PartUploadRequest {
+    method: string;
+    ordinalNumber: number;
+    url: string;
+    headers: Record<string, string | null>;
+}
+interface OpenBatchSessionResponse {
+    referenceNumber: string;
+    partUploadRequests: PartUploadRequest[];
+}
+interface BatchPartSendingInfo {
+    data: ArrayBuffer;
+    metadata: FileMetadata;
+    ordinalNumber: number;
+}
+
+interface SessionsFilter {
+    referenceNumber?: string;
+    dateCreatedFrom?: string;
+    dateCreatedTo?: string;
+    dateClosedFrom?: string;
+    dateClosedTo?: string;
+    dateModifiedFrom?: string;
+    dateModifiedTo?: string;
+    statuses?: SessionStatus[];
+}
+interface SessionsQueryResponseItem {
+    referenceNumber: string;
+    status: OperationStatusInfo;
+    dateCreated: string;
+    dateUpdated: string;
+    validUntil?: string | null;
+    totalInvoiceCount: number;
+    successfulInvoiceCount: number;
+    failedInvoiceCount: number;
+}
+interface SessionsQueryResponse {
+    continuationToken?: string;
+    sessions: SessionsQueryResponseItem[];
+}
+interface UpoPage {
+    referenceNumber: string;
+    downloadUrl: string;
+    downloadUrlExpirationDate: string;
+}
+interface UpoResponse {
+    pages: UpoPage[];
+}
+interface SessionStatusResponse {
+    status: OperationStatusInfo;
+    upo?: UpoResponse;
+    invoiceCount?: number;
+    successfulInvoiceCount?: number;
+    failedInvoiceCount?: number;
+    validUntil?: string | null;
+    dateCreated: string;
+    dateUpdated: string;
+}
+
+interface InvoiceStatusInfo {
+    code: number;
+    description: string;
+    details?: string[];
+    extensions?: Record<string, string>;
+}
+interface SessionInvoiceStatusResponse {
+    ordinalNumber: number;
+    invoiceNumber?: string;
+    ksefNumber?: string;
+    referenceNumber: string;
+    invoiceHash: string;
+    invoiceFileName?: string;
+    acquisitionDate?: string;
+    invoicingDate: string;
+    permanentStorageDate?: string;
+    upoDownloadUrl?: string;
+    status: InvoiceStatusInfo;
+    invoicingMode?: InvoicingMode | null;
+    upoDownloadUrlExpirationDate?: string;
+}
+interface SessionInvoicesResponse {
+    continuationToken?: string;
+    invoices: SessionInvoiceStatusResponse[];
+}
+interface UpoResult {
+    upo: string;
+    hash?: string;
+}
+
+/**
+ * Invoice subject type — defines the taxpayer's role in the invoice.
+ * - `Subject1` — seller (invoices issued by us)
+ * - `Subject2` — buyer (invoices received by us)
+ * - `Subject3` — third party (e.g. intermediary)
+ * - `SubjectAuthorized` — authorized subject acting on behalf of seller/buyer
+ */
+type InvoiceSubjectType = 'Subject1' | 'Subject2' | 'Subject3' | 'SubjectAuthorized';
+type InvoiceQueryDateType = 'Issue' | 'Invoicing' | 'PermanentStorage';
+type AmountType = 'Brutto' | 'Netto' | 'Vat';
+type BuyerIdentifierType = 'Nip' | 'VatUe' | 'Other' | 'None';
+type ThirdSubjectIdentifierType = 'Nip' | 'InternalId' | 'VatUe' | 'Other' | 'None';
+type FormType = 'FA' | 'PEF' | 'RR';
+type InvoiceType = 'Vat' | 'Zal' | 'Kor' | 'Roz' | 'Upr' | 'KorZal' | 'KorRoz' | 'VatPef' | 'VatPefSp' | 'KorPef' | 'VatRr' | 'KorVatRr';
+interface InvoiceQueryDateRange {
+    dateType: InvoiceQueryDateType;
+    from: string;
+    to?: string;
+    restrictToPermanentStorageHwmDate?: boolean;
+}
+interface InvoiceQueryAmount {
+    type: AmountType;
+    from?: number;
+    to?: number;
+}
+interface InvoiceQueryBuyerIdentifier {
+    type: BuyerIdentifierType;
+    value?: string;
+}
+interface InvoiceQueryFilters {
+    subjectType: InvoiceSubjectType;
+    dateRange: InvoiceQueryDateRange;
+    ksefNumber?: string;
+    invoiceNumber?: string;
+    amount?: InvoiceQueryAmount;
+    sellerNip?: string;
+    buyerIdentifier?: InvoiceQueryBuyerIdentifier;
+    currencyCodes?: string[];
+    invoicingMode?: InvoicingMode;
+    isSelfInvoicing?: boolean;
+    formType?: FormType;
+    invoiceTypes?: InvoiceType[];
+    hasAttachment?: boolean;
+}
+interface InvoiceMetadataSeller {
+    nip: string;
+    name?: string;
+}
+interface InvoiceMetadataBuyerIdentifier {
+    type: BuyerIdentifierType;
+    value?: string;
+}
+interface InvoiceMetadataBuyer {
+    identifier: InvoiceMetadataBuyerIdentifier;
+    name?: string;
+}
+interface InvoiceMetadataThirdSubjectIdentifier {
+    type: ThirdSubjectIdentifierType;
+    value?: string | null;
+}
+interface InvoiceMetadataThirdSubject {
+    identifier: InvoiceMetadataThirdSubjectIdentifier;
+    name?: string | null;
+    role: number;
+}
+interface InvoiceMetadataAuthorizedSubject {
+    nip: string;
+    name?: string;
+    role: number;
+}
+interface InvoiceMetadata {
+    ksefNumber: string;
+    invoiceNumber: string;
+    issueDate: string;
+    invoicingDate: string;
+    acquisitionDate: string;
+    permanentStorageDate: string;
+    seller: InvoiceMetadataSeller;
+    buyer: InvoiceMetadataBuyer;
+    netAmount: number;
+    grossAmount: number;
+    vatAmount: number;
+    currency: string;
+    invoicingMode: InvoicingMode;
+    invoiceType: InvoiceType;
+    formCode: FormCode;
+    isSelfInvoicing: boolean;
+    hasAttachment: boolean;
+    invoiceHash: string;
+    hashOfCorrectedInvoice?: string;
+    thirdSubjects?: InvoiceMetadataThirdSubject[];
+    authorizedSubject?: InvoiceMetadataAuthorizedSubject;
+}
+interface QueryInvoicesMetadataResponse {
+    hasMore: boolean;
+    isTruncated: boolean;
+    invoices: InvoiceMetadata[];
+    permanentStorageHwmDate?: string;
+}
+interface InvoiceExportRequest {
+    encryption: EncryptionInfo;
+    filters: InvoiceQueryFilters;
+}
+interface InvoiceExportPackagePart {
+    ordinalNumber: number;
+    partName: string;
+    method: string;
+    url: string;
+    partSize: number;
+    partHash: string;
+    encryptedPartSize: number;
+    encryptedPartHash: string;
+    expirationDate: string;
+}
+interface InvoiceExportPackage {
+    invoiceCount: number;
+    size: number;
+    parts: InvoiceExportPackagePart[];
+    isTruncated: boolean;
+    lastIssueDate?: string;
+    lastInvoicingDate?: string;
+    lastPermanentStorageDate?: string;
+    permanentStorageHwmDate?: string;
+}
+interface InvoiceExportStatusResponse {
+    status: OperationStatusInfo;
+    completedDate?: string;
+    packageExpirationDate?: string;
+    package?: InvoiceExportPackage;
+}
+
+type PersonPermissionType = 'InvoiceRead' | 'InvoiceWrite' | 'CredentialsRead' | 'CredentialsManage' | 'EnforcementOperations' | 'SubunitManage' | 'Introspection';
+type SubunitPermissionScope = 'CredentialsManage';
+type EuEntityPermissionType = 'InvoiceRead' | 'InvoiceWrite';
+type EntityPermissionItemType = 'InvoiceRead' | 'InvoiceWrite';
+type IndirectPermissionType = 'InvoiceRead' | 'InvoiceWrite';
+type PersonalPermissionScopeType = 'CredentialsManage' | 'CredentialsRead' | 'InvoiceWrite' | 'InvoiceRead' | 'Introspection' | 'SubunitManage' | 'EnforcementOperations' | 'VatUeManage';
+type EuEntityPermissionsQueryPermissionType = 'VatUeManage' | 'InvoiceWrite' | 'InvoiceRead' | 'Introspection';
+type InvoicePermissionType = 'SelfInvoicing' | 'TaxRepresentative' | 'RRInvoicing' | 'PefInvoicing';
+type EntityAuthorizationPermissionType = 'SelfInvoicing' | 'TaxRepresentative' | 'RRInvoicing' | 'PefInvoicing';
+type EntityRoleType = 'CourtBailiff' | 'EnforcementAuthority' | 'LocalGovernmentUnit' | 'LocalGovernmentSubUnit' | 'VatGroupUnit' | 'VatGroupSubUnit';
+type SubordinateEntityRoleType = 'LocalGovernmentSubUnit' | 'VatGroupSubUnit';
+type PermissionState = 'Active' | 'Inactive';
+type PersonPermissionsQueryType = 'PermissionsInCurrentContext' | 'PermissionsGrantedInCurrentContext';
+type EntityAuthorizationsQueryType = 'Granted' | 'Received';
+type EntityAuthorizationPermissionsSubjectIdentifierType = 'Nip' | 'PeppolId';
+type EuEntityAdministrationPermissionsSubjectIdentifierType = 'Fingerprint';
+type EuEntityPermissionsSubjectIdentifierType = 'Fingerprint';
+type SubunitPermissionsSubjectIdentifierType = 'Nip' | 'Pesel' | 'Fingerprint';
+type SubunitPermissionsContextIdentifierType = 'Nip' | 'InternalId';
+type SubunitPermissionsSubunitIdentifierType = 'InternalId' | 'Nip';
+type EuEntityAdministrationPermissionsContextIdentifierType = 'NipVatUe';
+type IndirectPermissionsSubjectIdentifierType = 'Nip' | 'Pesel' | 'Fingerprint';
+type IndirectPermissionsTargetIdentifierType = 'Nip' | 'AllPartners' | 'InternalId';
+type EntityPermissionsContextIdentifierType = 'Nip' | 'InternalId';
+type PersonSubjectDetailsType = 'PersonByIdentifier' | 'PersonByFingerprintWithIdentifier' | 'PersonByFingerprintWithoutIdentifier';
+type EuEntityPermissionSubjectDetailsType = 'PersonByFingerprintWithIdentifier' | 'PersonByFingerprintWithoutIdentifier' | 'EntityByFingerprint';
+type PersonalPermissionsContextIdentifierType = 'Nip' | 'InternalId';
+type PersonalPermissionsAuthorizedIdentifierType = 'Nip' | 'Pesel' | 'Fingerprint';
+type PersonalPermissionsTargetIdentifierType = 'Nip' | 'AllPartners' | 'InternalId';
+type PersonPermissionsAuthorizedIdentifierType = 'Nip' | 'Pesel' | 'Fingerprint';
+type PersonPermissionsContextIdentifierType = 'Nip' | 'InternalId';
+type PersonPermissionsTargetIdentifierType = 'Nip' | 'AllPartners' | 'InternalId';
+type PersonPermissionsAuthorIdentifierType = 'Nip' | 'Pesel' | 'Fingerprint' | 'System';
+type SubunitPermissionsAuthorIdentifierType = 'Nip' | 'Pesel' | 'Fingerprint';
+type EntityRolesParentEntityIdentifierType = 'Nip';
+type SubordinateRoleSubordinateEntityIdentifierType = 'Nip';
+type EntityAuthorizationsAuthorIdentifierType = 'Nip' | 'Pesel' | 'Fingerprint';
+type EntityAuthorizationsAuthorizedEntityIdentifierType = 'Nip' | 'PeppolId';
+type EntityAuthorizationsAuthorizingEntityIdentifierType = 'Nip';
+type EuEntityPermissionsAuthorIdentifierType = 'Nip' | 'Pesel' | 'Fingerprint';
+type PersonIdentifierType = 'Pesel' | 'Nip';
+type PersonSubjectByFingerprintDetailsType = 'PersonByFingerprintWithIdentifier' | 'PersonByFingerprintWithoutIdentifier';
+type EntitySubjectByFingerprintDetailsType = 'EntityByFingerprint';
+type EntitySubjectByIdentifierDetailsType = 'EntityByIdentifier';
+type EntitySubjectDetailsType = 'EntityByIdentifier' | 'EntityByFingerprint';
+interface PersonSubjectIdentifier {
+    type: PermissionSubjectIdentifierType;
+    value: string;
+}
+interface EntitySubjectIdentifier {
+    type: 'Nip';
+    value: string;
+}
+interface EntityAuthorizationSubjectIdentifier {
+    type: EntityAuthorizationPermissionsSubjectIdentifierType;
+    value: string;
+}
+interface IndirectPermissionsSubjectIdentifier {
+    type: IndirectPermissionsSubjectIdentifierType;
+    value: string;
+}
+interface IndirectPermissionsTargetIdentifier {
+    type: IndirectPermissionsTargetIdentifierType;
+    value?: string;
+}
+interface SubunitPermissionsSubjectIdentifier {
+    type: SubunitPermissionsSubjectIdentifierType;
+    value: string;
+}
+interface SubunitPermissionsContextIdentifier {
+    type: SubunitPermissionsContextIdentifierType;
+    value: string;
+}
+interface EuEntityAdministrationSubjectIdentifier {
+    type: EuEntityAdministrationPermissionsSubjectIdentifierType;
+    value: string;
+}
+interface EuEntityAdministrationContextIdentifier {
+    type: EuEntityAdministrationPermissionsContextIdentifierType;
+    value: string;
+}
+interface EuEntityPermissionsSubjectIdentifier {
+    type: EuEntityPermissionsSubjectIdentifierType;
+    value: string;
+}
+interface SubunitPermissionsSubunitIdentifier {
+    type: SubunitPermissionsSubunitIdentifierType;
+    value: string;
+}
+interface EntityPermissionsContextIdentifier {
+    type: EntityPermissionsContextIdentifierType;
+    value: string;
+}
+interface PersonalPermissionsContextIdentifier {
+    type: PersonalPermissionsContextIdentifierType;
+    value: string;
+}
+interface PersonalPermissionsAuthorizedIdentifier {
+    type: PersonalPermissionsAuthorizedIdentifierType;
+    value: string;
+}
+interface PersonalPermissionsTargetIdentifier {
+    type: PersonalPermissionsTargetIdentifierType;
+    value?: string | null;
+}
+interface PersonPermissionsAuthorizedIdentifier {
+    type: PersonPermissionsAuthorizedIdentifierType;
+    value: string;
+}
+interface PersonPermissionsContextIdentifier {
+    type: PersonPermissionsContextIdentifierType;
+    value: string;
+}
+interface PersonPermissionsTargetIdentifier {
+    type: PersonPermissionsTargetIdentifierType;
+    value?: string | null;
+}
+interface PersonPermissionsAuthorIdentifier {
+    type: PersonPermissionsAuthorIdentifierType;
+    value?: string | null;
+}
+interface SubunitPermissionsAuthorizedIdentifier {
+    type: SubunitPermissionsSubjectIdentifierType;
+    value: string;
+}
+interface SubunitPermissionsAuthorIdentifier {
+    type: SubunitPermissionsAuthorIdentifierType;
+    value: string;
+}
+interface EntityRolesParentEntityIdentifier {
+    type: EntityRolesParentEntityIdentifierType;
+    value: string;
+}
+interface SubordinateRoleSubordinateEntityIdentifier {
+    type: SubordinateRoleSubordinateEntityIdentifierType;
+    value: string;
+}
+interface EntityAuthorizationsAuthorIdentifier {
+    type: EntityAuthorizationsAuthorIdentifierType;
+    value: string;
+}
+interface EntityAuthorizationsAuthorizedEntityIdentifier {
+    type: EntityAuthorizationsAuthorizedEntityIdentifierType;
+    value: string;
+}
+interface EntityAuthorizationsAuthorizingEntityIdentifier {
+    type: EntityAuthorizationsAuthorizingEntityIdentifierType;
+    value: string;
+}
+interface EuEntityPermissionsAuthorIdentifier {
+    type: EuEntityPermissionsAuthorIdentifierType;
+    value: string;
+}
+interface PersonIdentifier {
+    type: PersonIdentifierType;
+    value: string;
+}
+interface PersonByIdentifierDetails {
+    firstName: string;
+    lastName: string;
+}
+interface PersonByFingerprintWithIdentifierDetails {
+    firstName: string;
+    lastName: string;
+    identifier: PersonIdentifier;
+}
+interface PersonByFingerprintWithoutIdentifierDetails {
+    firstName: string;
+    lastName: string;
+    birthDate: string;
+    idDocument: IdDocument;
+}
+interface IdDocument {
+    type: string;
+    number: string;
+    country: string;
+}
+interface PersonPermissionSubjectDetails {
+    subjectDetailsType: PersonSubjectDetailsType;
+    personById?: PersonByIdentifierDetails;
+    personByFpWithId?: PersonByFingerprintWithIdentifierDetails;
+    personByFpNoId?: PersonByFingerprintWithoutIdentifierDetails;
+}
+interface EntityDetails {
+    fullName: string;
+}
+interface EntityByFingerprintDetails {
+    fullName: string;
+    address: string;
+}
+interface EuEntityDetails {
+    fullName: string;
+    address: string;
+}
+interface EuEntityPermissionSubjectDetails {
+    subjectDetailsType: EuEntityPermissionSubjectDetailsType;
+    personByFpWithId?: PersonByFingerprintWithIdentifierDetails;
+    personByFpNoId?: PersonByFingerprintWithoutIdentifierDetails;
+    entityByFp?: EntityByFingerprintDetails;
+}
+interface PermissionsSubjectPersonDetails {
+    subjectDetailsType: PersonSubjectDetailsType;
+    firstName: string;
+    lastName: string;
+    personIdentifier?: PersonIdentifier | null;
+    birthDate?: string | null;
+    idDocument?: IdDocument | null;
+}
+interface PermissionsSubjectPersonByFingerprintDetails {
+    subjectDetailsType: PersonSubjectByFingerprintDetailsType;
+    firstName: string;
+    lastName: string;
+    personIdentifier?: PersonIdentifier | null;
+    birthDate?: string | null;
+    idDocument?: IdDocument | null;
+}
+interface PermissionsSubjectEntityDetails {
+    subjectDetailsType: EntitySubjectDetailsType;
+    fullName: string;
+    address?: string | null;
+}
+interface PermissionsSubjectEntityByFingerprintDetails {
+    subjectDetailsType: EntitySubjectByFingerprintDetailsType;
+    fullName: string;
+    address?: string | null;
+}
+interface PermissionsSubjectEntityByIdentifierDetails {
+    subjectDetailsType: EntitySubjectByIdentifierDetailsType;
+    fullName: string;
+}
+interface PermissionsEuEntityDetails {
+    fullName: string;
+    address: string;
+}
+interface PermissionWithDelegate<T extends string> {
+    permission: T;
+    canDelegate: boolean;
+}
+interface EntityPermission {
+    type: EntityPermissionItemType;
+    canDelegate?: boolean;
+}
+interface GrantPermissionsPersonRequest {
+    subjectIdentifier: PersonSubjectIdentifier;
+    permissions: PersonPermissionType[];
+    description: string;
+    subjectDetails: PersonPermissionSubjectDetails;
+}
+interface GrantPermissionsEntityRequest {
+    subjectIdentifier: EntitySubjectIdentifier;
+    permissions: EntityPermission[];
+    description: string;
+    subjectDetails: EntityDetails;
+}
+interface GrantPermissionsAuthorizationRequest {
+    subjectIdentifier: EntityAuthorizationSubjectIdentifier;
+    permission: EntityAuthorizationPermissionType;
+    description: string;
+    subjectDetails: EntityDetails;
+}
+interface GrantPermissionsIndirectRequest {
+    subjectIdentifier: IndirectPermissionsSubjectIdentifier;
+    targetIdentifier?: IndirectPermissionsTargetIdentifier;
+    permissions: IndirectPermissionType[];
+    description: string;
+    subjectDetails: PersonPermissionSubjectDetails;
+}
+interface GrantPermissionsSubunitRequest {
+    subjectIdentifier: SubunitPermissionsSubjectIdentifier;
+    contextIdentifier: SubunitPermissionsContextIdentifier;
+    description: string;
+    subunitName?: string;
+    subjectDetails: PersonPermissionSubjectDetails;
+}
+interface GrantPermissionsEuEntityAdminRequest {
+    subjectIdentifier: EuEntityAdministrationSubjectIdentifier;
+    contextIdentifier: EuEntityAdministrationContextIdentifier;
+    description: string;
+    euEntityName: string;
+    subjectDetails: EuEntityPermissionSubjectDetails;
+    euEntityDetails: EuEntityDetails;
+}
+interface GrantPermissionsEuEntityRepresentativeRequest {
+    subjectIdentifier: EuEntityPermissionsSubjectIdentifier;
+    permissions: EuEntityPermissionType[];
+    description: string;
+    subjectDetails: EuEntityPermissionSubjectDetails;
+}
+/** @deprecated Use GrantPermissionsEuEntityAdminRequest instead */
+type GrantPermissionsEuEntityRequest = GrantPermissionsEuEntityAdminRequest;
+interface QueryPersonalGrantsRequest {
+    contextIdentifier?: EntityPermissionsContextIdentifier;
+    targetIdentifier?: IndirectPermissionsTargetIdentifier;
+    permissionTypes?: PersonalPermissionScopeType[];
+    permissionState?: PermissionState;
+}
+interface QueryPersonsGrantsRequest {
+    queryType: PersonPermissionsQueryType;
+    authorIdentifier?: PersonPermissionsAuthorIdentifier;
+    authorizedIdentifier?: PersonSubjectIdentifier;
+    contextIdentifier?: EntityPermissionsContextIdentifier;
+    targetIdentifier?: IndirectPermissionsTargetIdentifier;
+    permissionTypes?: PersonPermissionType[];
+    permissionState?: PermissionState;
+}
+interface QuerySubunitsGrantsRequest {
+    subunitIdentifier?: SubunitPermissionsSubunitIdentifier;
+}
+interface QueryEntitiesRolesRequest {
+    pageOffset?: number;
+    pageSize?: number;
+}
+interface QueryEntitiesGrantsRequest {
+    contextIdentifier?: EntityPermissionsContextIdentifier;
+}
+interface QuerySubordinateEntitiesRolesRequest {
+    subordinateEntityIdentifier?: {
+        type: 'Nip';
+        value: string;
+    };
+}
+interface QueryAuthorizationsGrantsRequest {
+    queryType: EntityAuthorizationsQueryType;
+    authorizingIdentifier?: EntityAuthorizationsAuthorizingEntityIdentifier;
+    authorizedIdentifier?: EntityAuthorizationSubjectIdentifier;
+    permissionTypes?: InvoicePermissionType[];
+}
+interface QueryEuEntitiesGrantsRequest {
+    vatUeIdentifier?: string;
+    authorizedFingerprintIdentifier?: string;
+    permissionTypes?: EuEntityPermissionsQueryPermissionType[];
+}
+interface PersonalPermission {
+    id: string;
+    contextIdentifier?: PersonalPermissionsContextIdentifier | null;
+    authorizedIdentifier?: PersonalPermissionsAuthorizedIdentifier | null;
+    targetIdentifier?: PersonalPermissionsTargetIdentifier | null;
+    permissionScope: PersonalPermissionScopeType;
+    subjectPersonDetails?: PermissionsSubjectPersonDetails | null;
+    subjectEntityDetails?: PermissionsSubjectEntityDetails | null;
+    permissionState: PermissionState;
+    startDate: string;
+    canDelegate: boolean;
+    description: string;
+}
+interface PersonPermission {
+    id: string;
+    authorizedIdentifier: PersonPermissionsAuthorizedIdentifier;
+    contextIdentifier?: PersonPermissionsContextIdentifier | null;
+    targetIdentifier?: PersonPermissionsTargetIdentifier | null;
+    authorIdentifier: PersonPermissionsAuthorIdentifier;
+    permissionScope: PersonPermissionType;
+    subjectPersonDetails?: PermissionsSubjectPersonDetails | null;
+    subjectEntityDetails?: PermissionsSubjectEntityDetails | null;
+    permissionState: PermissionState;
+    startDate: string;
+    canDelegate: boolean;
+    description: string;
+}
+interface SubunitPermission {
+    id: string;
+    authorizedIdentifier: SubunitPermissionsAuthorizedIdentifier;
+    subunitIdentifier: SubunitPermissionsSubunitIdentifier;
+    authorIdentifier: SubunitPermissionsAuthorIdentifier;
+    permissionScope: SubunitPermissionScope;
+    subjectPersonDetails?: PermissionsSubjectPersonDetails | null;
+    subunitName?: string | null;
+    startDate: string;
+    description: string;
+}
+interface EntityRole {
+    parentEntityIdentifier?: EntityRolesParentEntityIdentifier | null;
+    role: EntityRoleType;
+    startDate: string;
+    description: string;
+}
+interface SubordinateEntityRole {
+    subordinateEntityIdentifier: SubordinateRoleSubordinateEntityIdentifier;
+    role: SubordinateEntityRoleType;
+    startDate: string;
+    description: string;
+}
+interface EntityAuthorizationGrant {
+    id: string;
+    authorIdentifier?: EntityAuthorizationsAuthorIdentifier | null;
+    authorizedEntityIdentifier: EntityAuthorizationsAuthorizedEntityIdentifier;
+    authorizingEntityIdentifier: EntityAuthorizationsAuthorizingEntityIdentifier;
+    authorizationScope: InvoicePermissionType;
+    subjectEntityDetails?: PermissionsSubjectEntityByIdentifierDetails | null;
+    startDate: string;
+    description: string;
+}
+/** @deprecated Use EntityAuthorizationGrant instead */
+type AuthorizationGrant = EntityAuthorizationGrant;
+interface EuEntityPermission {
+    id: string;
+    authorIdentifier: EuEntityPermissionsAuthorIdentifier;
+    vatUeIdentifier: string;
+    euEntityName: string;
+    authorizedFingerprintIdentifier: string;
+    permissionScope: EuEntityPermissionsQueryPermissionType;
+    subjectPersonDetails?: PermissionsSubjectPersonByFingerprintDetails | null;
+    subjectEntityDetails?: PermissionsSubjectEntityByFingerprintDetails | null;
+    euEntityDetails?: PermissionsEuEntityDetails | null;
+    startDate: string;
+    description: string;
+}
+interface EntityPermissionItem {
+    id: string;
+    contextIdentifier: EntityPermissionsContextIdentifier;
+    permissionScope: EntityPermissionItemType;
+    startDate: string;
+    canDelegate: boolean;
+    description: string;
+}
+interface PagedPermissionsResponse<T> {
+    hasMore: boolean;
+    permissions: T[];
+}
+interface PagedRolesResponse<T> {
+    hasMore: boolean;
+    roles: T[];
+}
+interface PagedAuthorizationsResponse<T> {
+    hasMore: boolean;
+    authorizationGrants: T[];
+}
+interface PermissionsOperationStatusResponse {
+    status: OperationStatusInfo;
+}
+interface PermissionsAttachmentAllowedResponse {
+    isAttachmentAllowed?: boolean;
+    revokedDate?: string | null;
+}
+
+type KsefTokenPermissionType = 'InvoiceRead' | 'InvoiceWrite' | 'CredentialsRead' | 'CredentialsManage' | 'EnforcementOperations' | 'SubunitManage' | 'Introspection';
+type KsefTokenStatus = 'Pending' | 'Active' | 'Revoking' | 'Revoked' | 'Failed';
+interface KsefTokenRequest {
+    description: string;
+    permissions: KsefTokenPermissionType[];
+}
+interface KsefTokenResponse {
+    referenceNumber: string;
+    token: string;
+}
+interface AuthenticationKsefToken {
+    referenceNumber: string;
+    authorIdentifier: TokenAuthorIdentifier;
+    contextIdentifier: TokenContextIdentifier;
+    description: string;
+    requestedPermissions: KsefTokenPermissionType[];
+    dateCreated: string;
+    lastUseDate?: string | null;
+    status: KsefTokenStatus;
+    statusDetails?: string[] | null;
+}
+type QueryTokensResponseItem = AuthenticationKsefToken;
+type TokenStatusResponse = AuthenticationKsefToken;
+type TokenAuthorIdentifierType = 'Nip' | 'Pesel' | 'Fingerprint';
+type TokenContextIdentifierType = 'Nip' | 'InternalId' | 'NipVatUe' | 'PeppolId';
+interface TokenAuthorIdentifier {
+    type: TokenAuthorIdentifierType;
+    value: string;
+}
+interface TokenContextIdentifier {
+    type: TokenContextIdentifierType;
+    value: string;
+}
+interface QueryKsefTokensOptions {
+    continuationToken?: string;
+    pageSize?: number;
+    status?: KsefTokenStatus[];
+    description?: string;
+    authorIdentifier?: string;
+    authorIdentifierType?: TokenAuthorIdentifierType;
+}
+interface QueryKsefTokensResponse {
+    continuationToken?: string | null;
+    tokens: QueryTokensResponseItem[];
+}
+
+type CertificateType = 'Authentication' | 'Offline';
+type CertificateStatus = 'Active' | 'Blocked' | 'Revoked' | 'Expired';
+type CertificateSubjectIdentifierType = 'Nip' | 'Pesel' | 'Fingerprint';
+interface CertificateLimit {
+    limit: number;
+    remaining: number;
+}
+interface CertificateLimitsResponse {
+    canRequest: boolean;
+    enrollment: CertificateLimit;
+    certificate: CertificateLimit;
+}
+interface CertificateEnrollmentDataResponse {
+    commonName: string;
+    countryName: string;
+    givenName?: string;
+    surname?: string;
+    serialNumber?: string;
+    uniqueIdentifier?: string;
+    organizationName?: string;
+    organizationIdentifier?: string;
+}
+interface EnrollCertificateRequest {
+    certificateName: string;
+    certificateType: CertificateType;
+    csr: string;
+    validFrom?: string;
+}
+interface EnrollCertificateResponse {
+    referenceNumber: string;
+    timestamp: string;
+}
+interface StatusInfo {
+    code: number;
+    description: string;
+    details?: string[];
+}
+interface CertificateEnrollmentStatusResponse {
+    requestDate: string;
+    status: StatusInfo;
+    certificateSerialNumber?: string;
+}
+interface RetrieveCertificatesRequest {
+    certificateSerialNumbers: string[];
+}
+interface RetrieveCertificatesListItem {
+    certificate: string;
+    certificateName: string;
+    certificateSerialNumber: string;
+    certificateType: CertificateType;
+}
+interface RetrieveCertificatesResponse {
+    certificates: RetrieveCertificatesListItem[];
+}
+interface QueryCertificatesRequest {
+    certificateSerialNumber?: string;
+    name?: string;
+    type?: CertificateType;
+    status?: CertificateStatus;
+    expiresAfter?: string;
+}
+interface CertificateSubjectIdentifier {
+    type: CertificateSubjectIdentifierType;
+    value: string;
+}
+interface CertificateListItem {
+    certificateSerialNumber: string;
+    name: string;
+    type: CertificateType;
+    commonName: string;
+    status: CertificateStatus;
+    subjectIdentifier: CertificateSubjectIdentifier;
+    validFrom: string;
+    validTo: string;
+    lastUseDate?: string;
+    requestDate: string;
+}
+interface QueryCertificatesResponse {
+    certificates: CertificateListItem[];
+    hasMore: boolean;
+}
+interface RevokeCertificateRequest {
+    revocationReason?: CertificateRevocationReason | null;
+}
+type CertificateRevocationReason = 'Unspecified' | 'Superseded' | 'KeyCompromise';
+
+type KsefSystemStatus = 'AVAILABLE' | 'MAINTENANCE' | 'FAILURE' | 'TOTAL_FAILURE';
+interface LighthouseMessage {
+    id: string;
+    eventId: string;
+    category: string;
+    type: string;
+    title: string;
+    text: string;
+    start: string;
+    end?: string;
+    version: number;
+    published: string;
+}
+interface KsefStatusResponse {
+    status: KsefSystemStatus;
+    timestamp: string;
+}
+interface KsefMessagesResponse {
+    messages: LighthouseMessage[];
+}
+
+interface EffectiveApiRateLimitValues {
+    perSecond: number;
+    perMinute: number;
+    perHour: number;
+}
+interface EffectiveApiRateLimits {
+    onlineSession: EffectiveApiRateLimitValues;
+    batchSession: EffectiveApiRateLimitValues;
+    invoiceSend: EffectiveApiRateLimitValues;
+    invoiceStatus: EffectiveApiRateLimitValues;
+    sessionList: EffectiveApiRateLimitValues;
+    sessionInvoiceList: EffectiveApiRateLimitValues;
+    sessionMisc: EffectiveApiRateLimitValues;
+    invoiceMetadata: EffectiveApiRateLimitValues;
+    invoiceExport: EffectiveApiRateLimitValues;
+    invoiceExportStatus: EffectiveApiRateLimitValues;
+    invoiceDownload: EffectiveApiRateLimitValues;
+    other: EffectiveApiRateLimitValues;
+}
+interface OnlineSessionEffectiveContextLimits {
+    maxInvoiceSizeInMB: number;
+    maxInvoiceWithAttachmentSizeInMB: number;
+    maxInvoices: number;
+}
+interface BatchSessionEffectiveContextLimits {
+    maxInvoiceSizeInMB: number;
+    maxInvoiceWithAttachmentSizeInMB: number;
+    maxInvoices: number;
+}
+interface EffectiveContextLimits {
+    onlineSession: OnlineSessionEffectiveContextLimits;
+    batchSession: BatchSessionEffectiveContextLimits;
+}
+interface EnrollmentEffectiveSubjectLimits {
+    maxEnrollments?: number;
+}
+interface CertificateEffectiveSubjectLimits {
+    maxCertificates?: number;
+}
+interface EffectiveSubjectLimits {
+    enrollment?: EnrollmentEffectiveSubjectLimits | null;
+    certificate?: CertificateEffectiveSubjectLimits | null;
+}
+
+interface ApiRateLimitValuesOverride {
+    perSecond: number;
+    perMinute: number;
+    perHour: number;
+}
+interface ApiRateLimitsOverride {
+    onlineSession: ApiRateLimitValuesOverride;
+    batchSession: ApiRateLimitValuesOverride;
+    invoiceSend: ApiRateLimitValuesOverride;
+    invoiceStatus: ApiRateLimitValuesOverride;
+    sessionList: ApiRateLimitValuesOverride;
+    sessionInvoiceList: ApiRateLimitValuesOverride;
+    sessionMisc: ApiRateLimitValuesOverride;
+    invoiceMetadata: ApiRateLimitValuesOverride;
+    invoiceExport: ApiRateLimitValuesOverride;
+    invoiceExportStatus: ApiRateLimitValuesOverride;
+    invoiceDownload: ApiRateLimitValuesOverride;
+    other: ApiRateLimitValuesOverride;
+}
+interface OnlineSessionContextLimitsOverride {
+    maxInvoiceSizeInMB: number;
+    maxInvoiceWithAttachmentSizeInMB: number;
+    maxInvoices: number;
+}
+interface BatchSessionContextLimitsOverride {
+    maxInvoiceSizeInMB: number;
+    maxInvoiceWithAttachmentSizeInMB: number;
+    maxInvoices: number;
+}
+interface SetSessionLimitsRequest {
+    onlineSession: OnlineSessionContextLimitsOverride;
+    batchSession: BatchSessionContextLimitsOverride;
+}
+interface EnrollmentSubjectLimitsOverride {
+    maxEnrollments?: number | null;
+}
+interface CertificateSubjectLimitsOverride {
+    maxCertificates?: number | null;
+}
+interface SetSubjectLimitsRequest {
+    subjectIdentifierType?: PermissionSubjectIdentifierType;
+    enrollment?: EnrollmentSubjectLimitsOverride | null;
+    certificate?: CertificateSubjectLimitsOverride | null;
+}
+interface SetRateLimitsRequest {
+    rateLimits: ApiRateLimitsOverride;
+}
+
+interface PeppolProvider {
+    id: string;
+    name: string;
+    dateCreated: string;
+}
+interface QueryPeppolProvidersResponse {
+    peppolProviders: PeppolProvider[];
+    hasMore: boolean;
+}
+
+type SubjectType = 'EnforcementAuthority' | 'VatGroup' | 'JST';
+type TestDataContextIdentifierType = 'Nip';
+interface TestDataContextIdentifier {
+    type: TestDataContextIdentifierType;
+    value: string;
+}
+type TestDataAuthorizedIdentifierType = 'Nip' | 'Pesel' | 'Fingerprint';
+interface TestDataAuthorizedIdentifier {
+    type: TestDataAuthorizedIdentifierType;
+    value: string;
+}
+type TestDataPermissionType = 'InvoiceRead' | 'InvoiceWrite' | 'CredentialsRead' | 'CredentialsManage' | 'EnforcementOperations' | 'SubunitManage' | 'Introspection';
+interface TestDataPermission {
+    permissionType: TestDataPermissionType;
+    description: string;
+}
+type TestDataAuthenticationContextIdentifierType = 'Nip' | 'InternalId' | 'NipVatUe' | 'PeppolId';
+interface TestDataAuthenticationContextIdentifier {
+    type: TestDataAuthenticationContextIdentifierType;
+    value: string;
+}
+interface Subunit {
+    subjectNip: string;
+    description: string;
+}
+interface SubjectCreateRequest {
+    subjectNip: string;
+    subjectType: SubjectType;
+    description: string;
+    subunits?: Subunit[] | null;
+    createdDate?: string | null;
+}
+interface SubjectRemoveRequest {
+    subjectNip: string;
+}
+interface PersonCreateRequest {
+    nip: string;
+    pesel: string;
+    isBailiff: boolean;
+    description: string;
+    isDeceased?: boolean;
+    createdDate?: string | null;
+}
+interface PersonRemoveRequest {
+    nip: string;
+}
+interface TestDataPermissionsGrantRequest {
+    contextIdentifier: TestDataContextIdentifier;
+    authorizedIdentifier: TestDataAuthorizedIdentifier;
+    permissions: TestDataPermission[];
+}
+interface TestDataPermissionsRevokeRequest {
+    contextIdentifier: TestDataContextIdentifier;
+    authorizedIdentifier: TestDataAuthorizedIdentifier;
+}
+interface AttachmentPermissionGrantRequest {
+    nip: string;
+}
+interface AttachmentPermissionRevokeRequest {
+    nip: string;
+    expectedEndDate?: string | null;
+}
+interface BlockContextAuthenticationRequest {
+    contextIdentifier?: TestDataAuthenticationContextIdentifier | null;
+}
+interface UnblockContextAuthenticationRequest {
+    contextIdentifier?: TestDataAuthenticationContextIdentifier | null;
+}
+interface TestDataStatusResponse {
+    code: number;
+    description: string;
+}
+
+type PublicKeyCertificateUsage = 'KsefTokenEncryption' | 'SymmetricKeyEncryption';
+interface PublicKeyCertificate {
+    certificate: string;
+    validFrom: string;
+    validTo: string;
+    usage: PublicKeyCertificateUsage[];
+}
+interface EncryptionData {
+    cipherKey: Uint8Array;
+    cipherIv: Uint8Array;
+    encryptionInfo: EncryptionInfo;
+}
+interface CsrResult {
+    csrDer: Uint8Array;
+    privateKeyPem: string;
+}
+interface SelfSignedCertificateResult {
+    certificatePem: string;
+    privateKeyPem: string;
+    fingerprint: string;
+}
+interface X500NameFields {
+    commonName?: string;
+    givenName?: string;
+    surname?: string;
+    serialNumber?: string;
+    organizationName?: string;
+    organizationIdentifier?: string;
+    uniqueIdentifier?: string;
+    countryCode?: string;
+}
+type CryptoEncryptionMethod = 'RSA' | 'ECDSA';
+
+type QRCodeContextIdentifierType = 'Nip' | 'InternalId' | 'NipVatUe' | 'PeppolId';
+interface QrCodeResult {
+    url: string;
+    qrCode: string;
+}
+interface QrCodeOptions {
+    width?: number;
+    margin?: number;
+    errorCorrectionLevel?: 'L' | 'M' | 'Q' | 'H';
+}
+
+declare class AuthService {
+    private readonly restClient;
+    constructor(restClient: RestClient);
+    getChallenge(): Promise<AuthChallengeResponse>;
+    submitXadesAuthRequest(signedXml: string, verifyCertificateChain?: boolean): Promise<AuthenticationInitResponse>;
+    submitKsefTokenAuthRequest(payload: AuthKsefTokenRequest): Promise<AuthenticationInitResponse>;
+    getAuthStatus(referenceNumber: string, authToken: string): Promise<AuthenticationOperationStatusResponse>;
+    getAccessToken(authToken: string): Promise<AuthenticationTokensResponse>;
+    refreshAccessToken(refreshToken: string): Promise<AuthenticationTokenRefreshResponse>;
+}
+
+declare class ActiveSessionsService {
+    private readonly restClient;
+    constructor(restClient: RestClient);
+    getActiveSessions(pageSize?: number, continuationToken?: string): Promise<AuthenticationListResponse>;
+    revokeCurrentSession(): Promise<void>;
+    revokeSession(sessionRef: string): Promise<void>;
+}
+
+declare class OnlineSessionService {
+    private readonly restClient;
+    constructor(restClient: RestClient);
+    openSession(request: OpenOnlineSessionRequest, upoVersion?: string): Promise<OpenOnlineSessionResponse>;
+    sendInvoice(sessionRef: string, request: SendInvoiceRequest): Promise<SendInvoiceResponse>;
+    closeSession(sessionRef: string): Promise<void>;
+}
+
+declare class BatchSessionService {
+    private readonly restClient;
+    constructor(restClient: RestClient);
+    openSession(request: OpenBatchSessionRequest, upoVersion?: string): Promise<OpenBatchSessionResponse>;
+    sendParts(openResponse: OpenBatchSessionResponse, parts: BatchPartSendingInfo[]): Promise<void>;
+    closeSession(batchRef: string): Promise<void>;
+}
+
+declare class SessionStatusService {
+    private readonly restClient;
+    constructor(restClient: RestClient);
+    getSessions(type: SessionType, pageSize?: number, continuationToken?: string, filter?: SessionsFilter): Promise<SessionsQueryResponse>;
+    getSessionStatus(sessionRef: string): Promise<SessionStatusResponse>;
+    getSessionInvoices(sessionRef: string, pageSize?: number, continuationToken?: string): Promise<SessionInvoicesResponse>;
+    getSessionInvoice(sessionRef: string, invoiceRef: string): Promise<SessionInvoiceStatusResponse>;
+    getSessionFailedInvoices(sessionRef: string, pageSize?: number, continuationToken?: string): Promise<SessionInvoicesResponse>;
+    getInvoiceUpoByKsefNumber(sessionRef: string, ksefNumber: string): Promise<UpoResult>;
+    getInvoiceUpoByReference(sessionRef: string, invoiceRef: string): Promise<UpoResult>;
+    getSessionUpo(sessionRef: string, upoRef: string): Promise<UpoResult>;
+}
+
+declare class InvoiceDownloadService {
+    private readonly restClient;
+    constructor(restClient: RestClient);
+    getInvoice(ksefNumber: string): Promise<string>;
+    queryInvoiceMetadata(filters: InvoiceQueryFilters, pageOffset?: number, pageSize?: number, sortOrder?: SortOrder): Promise<QueryInvoicesMetadataResponse>;
+    exportInvoices(request: InvoiceExportRequest): Promise<OperationResponse>;
+    getInvoiceExportStatus(ref: string): Promise<InvoiceExportStatusResponse>;
+}
+
+declare class PermissionsService {
+    private readonly restClient;
+    constructor(restClient: RestClient);
+    grantPersonPermissions(request: GrantPermissionsPersonRequest): Promise<OperationResponse>;
+    grantEntityPermissions(request: GrantPermissionsEntityRequest): Promise<OperationResponse>;
+    grantAuthorizationPermissions(request: GrantPermissionsAuthorizationRequest): Promise<OperationResponse>;
+    grantIndirectPermissions(request: GrantPermissionsIndirectRequest): Promise<OperationResponse>;
+    grantSubunitPermissions(request: GrantPermissionsSubunitRequest): Promise<OperationResponse>;
+    grantEuEntityAdminPermissions(request: GrantPermissionsEuEntityAdminRequest): Promise<OperationResponse>;
+    /** @deprecated Use grantEuEntityAdminPermissions instead */
+    grantEuEntityPermissions(request: GrantPermissionsEuEntityAdminRequest): Promise<OperationResponse>;
+    grantEuEntityRepresentativePermissions(request: GrantPermissionsEuEntityRepresentativeRequest): Promise<OperationResponse>;
+    revokeCommonGrant(grantId: string): Promise<OperationResponse>;
+    revokeAuthorizationGrant(grantId: string): Promise<OperationResponse>;
+    queryPersonalGrants(options?: QueryPersonalGrantsRequest, pageOffset?: number, pageSize?: number): Promise<PagedPermissionsResponse<PersonalPermission>>;
+    queryPersonsGrants(options: QueryPersonsGrantsRequest, pageOffset?: number, pageSize?: number): Promise<PagedPermissionsResponse<PersonPermission>>;
+    querySubunitsGrants(options?: QuerySubunitsGrantsRequest, pageOffset?: number, pageSize?: number): Promise<PagedPermissionsResponse<SubunitPermission>>;
+    queryEntitiesRoles(options?: QueryEntitiesRolesRequest): Promise<PagedRolesResponse<EntityRole>>;
+    queryEntitiesGrants(options?: QueryEntitiesGrantsRequest, pageOffset?: number, pageSize?: number): Promise<PagedPermissionsResponse<EntityPermissionItem>>;
+    querySubordinateEntitiesRoles(options?: QuerySubordinateEntitiesRolesRequest, pageOffset?: number, pageSize?: number): Promise<PagedRolesResponse<SubordinateEntityRole>>;
+    queryAuthorizationsGrants(options: QueryAuthorizationsGrantsRequest, pageOffset?: number, pageSize?: number): Promise<PagedAuthorizationsResponse<EntityAuthorizationGrant>>;
+    queryEuEntitiesGrants(options?: QueryEuEntitiesGrantsRequest, pageOffset?: number, pageSize?: number): Promise<PagedPermissionsResponse<EuEntityPermission>>;
+    getOperationStatus(ref: string): Promise<PermissionsOperationStatusResponse>;
+    getAttachmentStatus(): Promise<PermissionsAttachmentAllowedResponse>;
+}
+
+declare class TokenService {
+    private readonly restClient;
+    constructor(restClient: RestClient);
+    generateToken(request: KsefTokenRequest): Promise<KsefTokenResponse>;
+    queryTokens(options?: QueryKsefTokensOptions): Promise<QueryKsefTokensResponse>;
+    getToken(ref: string): Promise<TokenStatusResponse>;
+    revokeToken(ref: string): Promise<void>;
+}
+
+declare class CertificateApiService {
+    private readonly restClient;
+    constructor(restClient: RestClient);
+    getLimits(): Promise<CertificateLimitsResponse>;
+    getEnrollmentData(): Promise<CertificateEnrollmentDataResponse>;
+    enroll(request: EnrollCertificateRequest): Promise<EnrollCertificateResponse>;
+    getEnrollmentStatus(ref: string): Promise<CertificateEnrollmentStatusResponse>;
+    retrieve(request: RetrieveCertificatesRequest): Promise<RetrieveCertificatesResponse>;
+    revoke(serialNumber: string, request: RevokeCertificateRequest): Promise<void>;
+    query(request: QueryCertificatesRequest, pageSize?: number, pageOffset?: number): Promise<QueryCertificatesResponse>;
+}
+
+declare class LighthouseService {
+    private readonly lighthouseUrl;
+    private readonly timeout;
+    constructor(options: ResolvedOptions);
+    private fetchJson;
+    getStatus(): Promise<KsefStatusResponse>;
+    getMessages(): Promise<LighthouseMessage[]>;
+}
+
+declare class LimitsService {
+    private readonly restClient;
+    constructor(restClient: RestClient);
+    getContextLimits(): Promise<EffectiveContextLimits>;
+    getSubjectLimits(): Promise<EffectiveSubjectLimits>;
+    getRateLimits(): Promise<EffectiveApiRateLimits>;
+}
+
+declare class PeppolService {
+    private readonly restClient;
+    constructor(restClient: RestClient);
+    queryProviders(pageOffset?: number, pageSize?: number): Promise<QueryPeppolProvidersResponse>;
+}
+
+declare class TestDataService {
+    private readonly restClient;
+    constructor(restClient: RestClient);
+    createSubject(request: SubjectCreateRequest): Promise<TestDataStatusResponse>;
+    removeSubject(request: SubjectRemoveRequest): Promise<TestDataStatusResponse>;
+    createPerson(request: PersonCreateRequest): Promise<TestDataStatusResponse>;
+    removePerson(request: PersonRemoveRequest): Promise<TestDataStatusResponse>;
+    grantPermissions(request: TestDataPermissionsGrantRequest): Promise<TestDataStatusResponse>;
+    revokePermissions(request: TestDataPermissionsRevokeRequest): Promise<TestDataStatusResponse>;
+    enableAttachment(request: AttachmentPermissionGrantRequest): Promise<TestDataStatusResponse>;
+    disableAttachment(request: AttachmentPermissionRevokeRequest): Promise<TestDataStatusResponse>;
+    changeSessionLimits(request: SetSessionLimitsRequest): Promise<TestDataStatusResponse>;
+    restoreDefaultSessionLimits(): Promise<TestDataStatusResponse>;
+    changeCertificatesLimit(request: SetSubjectLimitsRequest): Promise<TestDataStatusResponse>;
+    restoreDefaultCertificatesLimit(): Promise<TestDataStatusResponse>;
+    setRateLimits(request: SetRateLimitsRequest): Promise<TestDataStatusResponse>;
+    restoreDefaultRateLimits(): Promise<TestDataStatusResponse>;
+    setProductionRateLimits(): Promise<TestDataStatusResponse>;
+    blockContext(request: BlockContextAuthenticationRequest): Promise<TestDataStatusResponse>;
+    unblockContext(request: UnblockContextAuthenticationRequest): Promise<TestDataStatusResponse>;
+}
+
+declare class AuthTokenRequestBuilder {
+    private challenge?;
+    private contextIdentifier?;
+    private subjectIdentifierType?;
+    private authorizationPolicy?;
+    withChallenge(challenge: string): this;
+    withContextNip(nip: string): this;
+    withContextInternalId(id: string): this;
+    withContextNipVatUe(value: string): this;
+    withContextPeppolId(id: string): this;
+    withSubjectType(type: XadesSubjectIdentifierType): this;
+    withAuthorizationPolicy(policy: AuthorizationPolicy): this;
+    build(): AuthTokenRequest;
+    private withContext;
+}
+
+declare class AuthKsefTokenRequestBuilder {
+    private challenge?;
+    private contextIdentifier?;
+    private encryptedToken?;
+    private authorizationPolicy?;
+    withChallenge(challenge: string): this;
+    withContextNip(nip: string): this;
+    withContextInternalId(id: string): this;
+    withContextNipVatUe(value: string): this;
+    withContextPeppolId(id: string): this;
+    withEncryptedToken(token: string): this;
+    withAuthorizationPolicy(policy: AuthorizationPolicy): this;
+    build(): AuthKsefTokenRequest;
+    private withContext;
+}
+
+declare class InvoiceQueryFilterBuilder {
+    private subjectType?;
+    private dateRange?;
+    private ksefNumber?;
+    private invoiceNumber?;
+    private amount?;
+    private sellerNip?;
+    private buyerIdentifier?;
+    private currencyCodes?;
+    private invoicingMode?;
+    private isSelfInvoicing?;
+    private formType?;
+    private invoiceTypes?;
+    private hasAttachment?;
+    withSubjectType(type: InvoiceSubjectType): this;
+    withDateRange(dateType: InvoiceQueryDateType, from: string, to?: string): this;
+    withDateRangeRestricted(dateType: InvoiceQueryDateType, from: string, to?: string): this;
+    withKsefNumber(ksefNumber: string): this;
+    withInvoiceNumber(invoiceNumber: string): this;
+    withAmount(type: AmountType, from?: number, to?: number): this;
+    withSellerNip(nip: string): this;
+    withBuyerIdentifier(type: BuyerIdentifierType, value?: string): this;
+    withCurrencyCodes(codes: string[]): this;
+    withInvoicingMode(mode: InvoicingMode): this;
+    withSelfInvoicing(value: boolean): this;
+    withFormType(type: FormType): this;
+    withInvoiceTypes(types: InvoiceType[]): this;
+    withHasAttachment(value: boolean): this;
+    build(): InvoiceQueryFilters;
+}
+
+declare class PersonPermissionGrantBuilder {
+    private subjectIdentifier?;
+    private permissions;
+    private _description?;
+    private _subjectDetails?;
+    withSubjectIdentifier(type: PermissionSubjectIdentifierType, value: string): this;
+    addPermission(permission: PersonPermissionType): this;
+    withPermissions(permissions: PersonPermissionType[]): this;
+    withDescription(description: string): this;
+    withSubjectDetails(subjectDetails: PersonPermissionSubjectDetails): this;
+    build(): GrantPermissionsPersonRequest;
+}
+
+declare class EntityPermissionGrantBuilder {
+    private nip?;
+    private permissions;
+    private _description?;
+    private _subjectDetails?;
+    withNip(nip: string): this;
+    addPermission(type: EntityPermissionItemType, canDelegate?: boolean): this;
+    withPermissions(permissions: EntityPermission[]): this;
+    withDescription(description: string): this;
+    withSubjectDetails(subjectDetails: EntityDetails): this;
+    build(): GrantPermissionsEntityRequest;
+}
+
+declare class AuthorizationPermissionGrantBuilder {
+    private _subjectIdentifier?;
+    private _permission?;
+    private _description?;
+    private _subjectDetails?;
+    withSubjectIdentifier(type: EntityAuthorizationPermissionsSubjectIdentifierType, value: string): this;
+    withPermission(permission: EntityAuthorizationPermissionType): this;
+    withDescription(description: string): this;
+    withSubjectDetails(subjectDetails: EntityDetails): this;
+    build(): GrantPermissionsAuthorizationRequest;
+}
+
+declare class CertificateFetcher {
+    private readonly restClient;
+    private symmetricKeyPem;
+    private ksefTokenPem;
+    private initialized;
+    constructor(restClient: RestClient);
+    init(): Promise<void>;
+    refresh(): Promise<void>;
+    getSymmetricKeyEncryptionPem(): string;
+    getKsefTokenEncryptionPem(): string;
+    private fetchCertificates;
+    private derBase64ToPem;
+}
+
+/**
+ * Cryptographic operations for the KSeF system.
+ *
+ * Provides AES-256-CBC encryption/decryption, RSA-OAEP key wrapping,
+ * KSeF token encryption (RSA or ECDH+AES-GCM), SHA-256 hashing,
+ * and CSR generation (RSA-2048 / ECDSA P-256).
+ */
+declare class CryptographyService {
+    private readonly fetcher;
+    constructor(fetcher: CertificateFetcher);
+    /** Initialise the underlying certificate fetcher. */
+    init(): Promise<void>;
+    /** Encrypt with AES-256-CBC (PKCS7 padding is automatic in Node). */
+    encryptAES256(content: Uint8Array, key: Uint8Array, iv: Uint8Array): Uint8Array;
+    /** Decrypt with AES-256-CBC. */
+    decryptAES256(content: Uint8Array, key: Uint8Array, iv: Uint8Array): Uint8Array;
+    /**
+     * Generate a random AES-256 key and IV, then wrap the key with the
+     * SymmetricKeyEncryption certificate's RSA public key (RSA-OAEP SHA-256).
+     */
+    getEncryptionData(): EncryptionData;
+    /**
+     * Encrypt a KSeF token for session authorisation.
+     *
+     * Token payload: `"<token>|<challengeTimestampMs>"`.
+     *
+     * The algorithm is chosen automatically based on the KsefTokenEncryption
+     * certificate's public key type:
+     *  - **RSA** — RSA-OAEP with SHA-256
+     *  - **EC**  — ECDH key-agreement (P-256) + AES-256-GCM
+     *
+     * The EC variant outputs bytes in the Java-compatible format:
+     * `[ephemeralSPKI | nonce(12) | ciphertext+tag]`.
+     */
+    encryptKsefToken(token: string, challengeTimestamp: string): Uint8Array;
+    /** Compute SHA-256 hash (base64) and byte length. */
+    getFileMetadata(file: Uint8Array): FileMetadata;
+    /** Generate an RSA-2048 CSR (PKCS#10, DER) and return it together with the private key PEM. */
+    generateCsrRsa(fields: X500NameFields): Promise<CsrResult>;
+    /** Generate an ECDSA P-256 CSR (PKCS#10, DER) and return it together with the private key PEM. */
+    generateCsrEcdsa(fields: X500NameFields): Promise<CsrResult>;
+    /** Parse a PEM-encoded private key into a Node.js KeyObject. */
+    parsePrivateKey(pem: string): crypto.KeyObject;
+    /** RSA-OAEP SHA-256 encryption. */
+    private encryptRsaOaep;
+    /**
+     * ECDH (P-256) + AES-256-GCM encryption.
+     *
+     * 1. Generate an ephemeral EC key pair on the same curve (P-256).
+     * 2. Derive a shared secret via ECDH with the receiver's public key.
+     * 3. Use the shared secret (32 bytes) as the AES-256-GCM key.
+     * 4. Encrypt with a random 12-byte nonce.
+     * 5. Output: `[ephemeralSPKI | nonce(12) | ciphertext+tag]`
+     *    (Java-compatible — GCM appends the 16-byte tag to the ciphertext).
+     */
+    private encryptEcdhAesGcm;
+}
+
+/**
+ * XAdES-B enveloped XML signature service.
+ *
+ * Produces signatures compatible with the Polish KSeF API.
+ *
+ * The implementation builds the entire `ds:Signature` element manually,
+ * using `xml-crypto`'s {@link ExclusiveCanonicalization} for XML C14N
+ * and `node:crypto` for the actual cryptographic signing.
+ */
+declare class SignatureService {
+    /**
+     * Sign an XML document with an XAdES-B enveloped signature.
+     *
+     * @param xml          - The XML document to sign (string).
+     * @param certPem      - The signing certificate in PEM format.
+     * @param privateKeyPem - The private key in PEM format.
+     * @returns The signed XML document as a string.
+     */
+    static sign(xml: string, certPem: string, privateKeyPem: string): string;
+}
+
+declare class CertificateService {
+    static getSha256Fingerprint(certPem: string): string;
+    static generatePersonalCertificate(givenName: string, surname: string, serialNumber: string, commonName: string, method?: CryptoEncryptionMethod): Promise<SelfSignedCertificateResult>;
+    static generateCompanySeal(orgName: string, orgIdentifier: string, commonName: string, method?: CryptoEncryptionMethod): Promise<SelfSignedCertificateResult>;
+}
+
+declare class VerificationLinkService {
+    private readonly baseQrUrl;
+    constructor(baseQrUrl: string);
+    /**
+     * Build invoice verification URL (Code I).
+     * Format: {baseQrUrl}/invoice/{NIP}/{DD-MM-YYYY}/{hash_base64url}
+     */
+    buildInvoiceVerificationUrl(nip: string, issueDate: Date | string, invoiceHashBase64: string): string;
+    /**
+     * Build certificate verification URL (Code II).
+     * Format: {baseQrUrl}/certificate/{contextType}/{contextId}/{sellerNip}/{certSerial}/{hash_base64url}/{signature_base64url}
+     */
+    buildCertificateVerificationUrl(contextType: string, contextId: string, sellerNip: string, certSerial: string, invoiceHashBase64: string, privateKeyPem: string): string;
+    private base64ToBase64Url;
+}
+
+declare class QrCodeService {
+    static generateQrCode(url: string, options?: QrCodeOptions): Promise<Buffer>;
+    static generateQrCodeBase64(url: string, options?: QrCodeOptions): Promise<string>;
+    static generateQrCodeSvg(url: string, options?: QrCodeOptions): Promise<string>;
+    static generateQrCodeSvgWithLabel(url: string, label: string, options?: QrCodeOptions): Promise<string>;
+    static generateResult(url: string, options?: QrCodeOptions): Promise<QrCodeResult>;
+}
+
+declare class KSeFClient {
+    readonly auth: AuthService;
+    readonly activeSessions: ActiveSessionsService;
+    readonly onlineSession: OnlineSessionService;
+    readonly batchSession: BatchSessionService;
+    readonly sessionStatus: SessionStatusService;
+    readonly invoices: InvoiceDownloadService;
+    readonly permissions: PermissionsService;
+    readonly tokens: TokenService;
+    readonly certificates: CertificateApiService;
+    readonly lighthouse: LighthouseService;
+    readonly limits: LimitsService;
+    readonly peppol: PeppolService;
+    readonly testData: TestDataService;
+    readonly crypto: CryptographyService;
+    readonly qr: VerificationLinkService;
+    readonly options: ResolvedOptions;
+    readonly authManager: AuthManager;
+    constructor(options?: KSeFClientOptions);
+    loginWithToken(token: string, nip: string): Promise<void>;
+    loginWithCertificate(certPem: string, keyPem: string, nip: string): Promise<void>;
+    logout(): Promise<void>;
+}
+
+export { ActiveSessionsService, type AllowedIps, type AmountType, type ApiErrorResponse, type ApiRateLimitValuesOverride, type ApiRateLimitsOverride, type AttachmentPermissionGrantRequest, type AttachmentPermissionRevokeRequest, type AuthChallengeResponse, type AuthKsefTokenRequest, AuthKsefTokenRequestBuilder, type AuthManager, AuthService, type AuthSessionInfo, type AuthTokenRequest, AuthTokenRequestBuilder, type AuthenticationInitResponse, type AuthenticationKsefToken, type AuthenticationListResponse, type AuthenticationMethod, type AuthenticationMethodInfo, type AuthenticationMethodInfoCategory, type AuthenticationOperationStatusResponse, type AuthenticationTokenRefreshResponse, type AuthenticationTokensResponse, type AuthorizationGrant, AuthorizationPermissionGrantBuilder, type AuthorizationPolicy, Base64String, type BatchFileInfo, type BatchFilePartInfo, type BatchPartSendingInfo, type BatchSessionContextLimitsOverride, type BatchSessionEffectiveContextLimits, BatchSessionService, type BlockContextAuthenticationRequest, type BuyerIdentifierType, CERTIFICATE_NAME_MAX_LENGTH, CERTIFICATE_NAME_MIN_LENGTH, CertificateApiService, type CertificateEffectiveSubjectLimits, type CertificateEnrollmentDataResponse, type CertificateEnrollmentStatusResponse, CertificateFetcher, CertificateFingerprint, type CertificateLimit, type CertificateLimitsResponse, type CertificateListItem, CertificateName, type CertificateRevocationReason, CertificateService, type CertificateStatus, type CertificateSubjectIdentifier, type CertificateSubjectIdentifierType, type CertificateSubjectLimitsOverride, type CertificateType, type ContextIdentifier, type ContextIdentifierType, type CryptoEncryptionMethod, CryptographyService, type CsrResult, DefaultAuthManager, type EffectiveApiRateLimitValues, type EffectiveApiRateLimits, type EffectiveContextLimits, type EffectiveSubjectLimits, type EncryptionData, type EncryptionInfo, type EnrollCertificateRequest, type EnrollCertificateResponse, type EnrollmentEffectiveSubjectLimits, type EnrollmentSubjectLimitsOverride, type EntityAuthorizationGrant, type EntityAuthorizationPermissionType, type EntityAuthorizationPermissionsSubjectIdentifierType, type EntityAuthorizationSubjectIdentifier, type EntityAuthorizationsAuthorIdentifier, type EntityAuthorizationsAuthorIdentifierType, type EntityAuthorizationsAuthorizedEntityIdentifier, type EntityAuthorizationsAuthorizedEntityIdentifierType, type EntityAuthorizationsAuthorizingEntityIdentifier, type EntityAuthorizationsAuthorizingEntityIdentifierType, type EntityAuthorizationsQueryType, type EntityByFingerprintDetails, type EntityDetails, type EntityPermission, EntityPermissionGrantBuilder, type EntityPermissionItem, type EntityPermissionItemType, type EntityPermissionsContextIdentifier, type EntityPermissionsContextIdentifierType, type EntityRole, type EntityRoleType, type EntityRolesParentEntityIdentifier, type EntityRolesParentEntityIdentifierType, type EntitySubjectByFingerprintDetailsType, type EntitySubjectByIdentifierDetailsType, type EntitySubjectDetailsType, type EntitySubjectIdentifier, Environment, type EnvironmentConfig, type EnvironmentName, type EuEntityAdministrationContextIdentifier, type EuEntityAdministrationPermissionsContextIdentifierType, type EuEntityAdministrationPermissionsSubjectIdentifierType, type EuEntityAdministrationSubjectIdentifier, type EuEntityDetails, type EuEntityPermission, type EuEntityPermissionSubjectDetails, type EuEntityPermissionSubjectDetailsType, type EuEntityPermissionType, type EuEntityPermissionsAuthorIdentifier, type EuEntityPermissionsAuthorIdentifierType, type EuEntityPermissionsQueryPermissionType, type EuEntityPermissionsSubjectIdentifier, type EuEntityPermissionsSubjectIdentifierType, type ExceptionDetails, type FileMetadata, type ForbiddenProblemDetails, type ForbiddenReasonCode, type FormCode, type FormType, type GrantPermissionsAuthorizationRequest, type GrantPermissionsEntityRequest, type GrantPermissionsEuEntityAdminRequest, type GrantPermissionsEuEntityRepresentativeRequest, type GrantPermissionsEuEntityRequest, type GrantPermissionsIndirectRequest, type GrantPermissionsPersonRequest, type GrantPermissionsSubunitRequest, type HttpMethod, type IdDocument, type IndirectPermissionType, type IndirectPermissionsSubjectIdentifier, type IndirectPermissionsSubjectIdentifierType, type IndirectPermissionsTargetIdentifier, type IndirectPermissionsTargetIdentifierType, InternalId, InvoiceDownloadService, type InvoiceExportPackage, type InvoiceExportPackagePart, type InvoiceExportRequest, type InvoiceExportStatusResponse, type InvoiceMetadata, type InvoiceMetadataAuthorizedSubject, type InvoiceMetadataBuyer, type InvoiceMetadataBuyerIdentifier, type InvoiceMetadataSeller, type InvoiceMetadataThirdSubject, type InvoiceMetadataThirdSubjectIdentifier, type InvoicePermissionType, type InvoiceQueryAmount, type InvoiceQueryBuyerIdentifier, type InvoiceQueryDateRange, type InvoiceQueryDateType, InvoiceQueryFilterBuilder, type InvoiceQueryFilters, type InvoiceStatusInfo, type InvoiceSubjectType, type InvoiceType, type InvoicingMode, Ip4Address, Ip4Mask, Ip4Range, KSeFApiError, KSeFAuthStatusError, KSeFClient, type KSeFClientOptions, KSeFError, KSeFForbiddenError, KSeFRateLimitError, KSeFSessionExpiredError, KSeFUnauthorizedError, KSeFValidationError, type KsefMessagesResponse, KsefNumber, KsefNumberV35, KsefNumberV36, type KsefStatusResponse, type KsefSystemStatus, type KsefTokenPermissionType, type KsefTokenRequest, type KsefTokenResponse, type KsefTokenStatus, type LighthouseMessage, LighthouseService, LimitsService, Nip, NipVatUe, type OnlineSessionContextLimitsOverride, type OnlineSessionEffectiveContextLimits, OnlineSessionService, type OpenBatchSessionRequest, type OpenBatchSessionResponse, type OpenOnlineSessionRequest, type OpenOnlineSessionResponse, type OperationResponse, type OperationStatusInfo, PERMISSION_DESCRIPTION_MAX_LENGTH, PERMISSION_DESCRIPTION_MIN_LENGTH, type PagedAuthorizationsResponse, type PagedPermissionsResponse, type PagedRolesResponse, type PartUploadRequest, PeppolId, type PeppolProvider, PeppolService, type PermissionState, type PermissionSubjectIdentifierType, type PermissionWithDelegate, type PermissionsAttachmentAllowedResponse, type PermissionsEuEntityDetails, type PermissionsOperationStatusResponse, PermissionsService, type PermissionsSubjectEntityByFingerprintDetails, type PermissionsSubjectEntityByIdentifierDetails, type PermissionsSubjectEntityDetails, type PermissionsSubjectPersonByFingerprintDetails, type PermissionsSubjectPersonDetails, type PersonByFingerprintWithIdentifierDetails, type PersonByFingerprintWithoutIdentifierDetails, type PersonByIdentifierDetails, type PersonCreateRequest, type PersonIdentifier, type PersonIdentifierType, type PersonPermission, PersonPermissionGrantBuilder, type PersonPermissionSubjectDetails, type PersonPermissionType, type PersonPermissionsAuthorIdentifier, type PersonPermissionsAuthorIdentifierType, type PersonPermissionsAuthorizedIdentifier, type PersonPermissionsAuthorizedIdentifierType, type PersonPermissionsContextIdentifier, type PersonPermissionsContextIdentifierType, type PersonPermissionsQueryType, type PersonPermissionsTargetIdentifier, type PersonPermissionsTargetIdentifierType, type PersonRemoveRequest, type PersonSubjectByFingerprintDetailsType, type PersonSubjectDetailsType, type PersonSubjectIdentifier, type PersonalPermission, type PersonalPermissionScopeType, type PersonalPermissionsAuthorizedIdentifier, type PersonalPermissionsAuthorizedIdentifierType, type PersonalPermissionsContextIdentifier, type PersonalPermissionsContextIdentifierType, type PersonalPermissionsTargetIdentifier, type PersonalPermissionsTargetIdentifierType, Pesel, type PresignedUrlPolicy, type PublicKeyCertificate, type PublicKeyCertificateUsage, type QRCodeContextIdentifierType, type QrCodeOptions, type QrCodeResult, QrCodeService, type QueryAuthorizationsGrantsRequest, type QueryCertificatesRequest, type QueryCertificatesResponse, type QueryEntitiesGrantsRequest, type QueryEntitiesRolesRequest, type QueryEuEntitiesGrantsRequest, type QueryInvoicesMetadataResponse, type QueryKsefTokensOptions, type QueryKsefTokensResponse, type QueryPeppolProvidersResponse, type QueryPersonalGrantsRequest, type QueryPersonsGrantsRequest, type QuerySubordinateEntitiesRolesRequest, type QuerySubunitsGrantsRequest, type QueryTokensResponseItem, REQUIRED_CHALLENGE_LENGTH, type RateLimitConfig, RateLimitPolicy, ReferenceNumber, type ResolvedOptions, RestClient, RestRequest, type RestResponse, type RetrieveCertificatesListItem, type RetrieveCertificatesRequest, type RetrieveCertificatesResponse, type RetryPolicy, type RevokeCertificateRequest, RouteBuilder, Routes, SUBUNIT_NAME_MAX_LENGTH, SUBUNIT_NAME_MIN_LENGTH, type SelfSignedCertificateResult, type SendInvoiceRequest, type SendInvoiceResponse, type SessionInvoiceStatusResponse, type SessionInvoicesResponse, type SessionStatus, type SessionStatusResponse, SessionStatusService, type SessionType, type SessionsFilter, type SessionsQueryResponse, type SessionsQueryResponseItem, type SetRateLimitsRequest, type SetSessionLimitsRequest, type SetSubjectLimitsRequest, Sha256Base64, SignatureService, type SortOrder, type StatusInfo, type SubjectCreateRequest, type SubjectRemoveRequest, type SubjectType, type SubordinateEntityRole, type SubordinateEntityRoleType, type SubordinateRoleSubordinateEntityIdentifier, type SubordinateRoleSubordinateEntityIdentifierType, type Subunit, type SubunitPermission, type SubunitPermissionScope, type SubunitPermissionsAuthorIdentifier, type SubunitPermissionsAuthorIdentifierType, type SubunitPermissionsAuthorizedIdentifier, type SubunitPermissionsContextIdentifier, type SubunitPermissionsContextIdentifierType, type SubunitPermissionsSubjectIdentifier, type SubunitPermissionsSubjectIdentifierType, type SubunitPermissionsSubunitIdentifier, type SubunitPermissionsSubunitIdentifierType, type TestDataAuthenticationContextIdentifier, type TestDataAuthenticationContextIdentifierType, type TestDataAuthorizedIdentifier, type TestDataAuthorizedIdentifierType, type TestDataContextIdentifier, type TestDataContextIdentifierType, type TestDataPermission, type TestDataPermissionType, type TestDataPermissionsGrantRequest, type TestDataPermissionsRevokeRequest, TestDataService, type TestDataStatusResponse, type ThirdSubjectIdentifierType, type TokenAuthorIdentifier, type TokenAuthorIdentifierType, type TokenContextIdentifier, type TokenContextIdentifierType, type TokenInfo, TokenService, type TokenStatusResponse, type TransportFn, type UnauthorizedProblemDetails, type UnblockContextAuthenticationRequest, type UpoPage, type UpoResponse, type UpoResult, type ValidationDetail, VatUe, VerificationLinkService, type X500NameFields, type XadesSubjectIdentifierType, calculateBackoff, defaultPresignedUrlPolicy, defaultRateLimitPolicy, defaultRetryPolicy, defaultTransport, isRetryableError, isRetryableStatus, isValidBase64, isValidCertificateFingerprint, isValidCertificateName, isValidInternalId, isValidIp4Address, isValidKsefNumber, isValidNip, isValidNipVatUe, isValidPeppolId, isValidPesel, isValidReferenceNumber, isValidSha256Base64, isValidVatUe, parseRetryAfter, resolveOptions, sleep, validatePresignedUrl };