ksef-client-ts 0.6.0 → 0.6.2

package/dist/cli.js

@@ -97,12 +97,14 @@ var init_ksef_unauthorized_error = __esm({
       detail;
       traceId;
       instance;
+      timestamp;
       constructor(problemDetails) {
         super(problemDetails.detail || "Unauthorized");
         this.name = "KSeFUnauthorizedError";
         this.detail = problemDetails.detail;
         this.traceId = problemDetails.traceId;
         this.instance = problemDetails.instance;
+        this.timestamp = problemDetails.timestamp;
       }
     };
   }
@@ -121,6 +123,7 @@ var init_ksef_forbidden_error = __esm({
       instance;
       security;
       traceId;
+      timestamp;
       constructor(problemDetails) {
         super(problemDetails.detail || "Forbidden");
         this.name = "KSeFForbiddenError";
@@ -129,6 +132,7 @@ var init_ksef_forbidden_error = __esm({
         this.instance = problemDetails.instance;
         this.security = problemDetails.security;
         this.traceId = problemDetails.traceId;
+        this.timestamp = problemDetails.timestamp;
       }
     };
   }
@@ -219,6 +223,69 @@ var init_config = __esm({
   }
 });
 
+// src/errors/ksef-gone-error.ts
+var KSeFGoneError;
+var init_ksef_gone_error = __esm({
+  "src/errors/ksef-gone-error.ts"() {
+    "use strict";
+    init_ksef_error();
+    KSeFGoneError = class extends KSeFError {
+      statusCode = 410;
+      detail;
+      instance;
+      traceId;
+      timestamp;
+      constructor(problemDetails) {
+        super(problemDetails.detail || "Operation status no longer available (retention expired)");
+        this.name = "KSeFGoneError";
+        this.detail = problemDetails.detail;
+        this.instance = problemDetails.instance;
+        this.traceId = problemDetails.traceId;
+        this.timestamp = problemDetails.timestamp;
+      }
+    };
+  }
+});
+
+// src/errors/error-codes.ts
+function hasErrorCode(body, code) {
+  return !!body?.exception?.exceptionDetailList?.some((d) => d.exceptionCode === code);
+}
+var KSeFErrorCode;
+var init_error_codes = __esm({
+  "src/errors/error-codes.ts"() {
+    "use strict";
+    KSeFErrorCode = {
+      BatchTimeout: 21208,
+      DuplicateInvoice: 440
+    };
+  }
+});
+
+// src/errors/ksef-batch-timeout-error.ts
+var KSeFBatchTimeoutError;
+var init_ksef_batch_timeout_error = __esm({
+  "src/errors/ksef-batch-timeout-error.ts"() {
+    "use strict";
+    init_ksef_api_error();
+    init_error_codes();
+    KSeFBatchTimeoutError = class _KSeFBatchTimeoutError extends KSeFApiError {
+      errorCode = KSeFErrorCode.BatchTimeout;
+      constructor(message, statusCode, errorResponse) {
+        super(message, statusCode, errorResponse);
+        this.name = "KSeFBatchTimeoutError";
+      }
+      static fromResponse(statusCode, body) {
+        const detail = body?.exception?.exceptionDetailList?.find(
+          (d) => d.exceptionCode === KSeFErrorCode.BatchTimeout
+        );
+        const message = detail?.exceptionDescription?.trim() || "Batch session timed out before the server completed processing (KSeF 21208).";
+        return new _KSeFBatchTimeoutError(message, statusCode, body);
+      }
+    };
+  }
+});
+
 // src/http/route-builder.ts
 var RouteBuilder;
 var init_route_builder = __esm({
@@ -396,6 +463,9 @@ var init_rest_client = __esm({
     init_ksef_rate_limit_error();
     init_ksef_unauthorized_error();
     init_ksef_forbidden_error();
+    init_ksef_gone_error();
+    init_ksef_batch_timeout_error();
+    init_error_codes();
     init_route_builder();
     init_transport();
     init_retry_policy();
@@ -536,18 +606,33 @@ var init_rest_client = __esm({
           );
         }
         if (response.status === 401) {
-          const body = parseJson();
-          if (body?.detail) {
-            throw new KSeFUnauthorizedError(body);
+          const body2 = parseJson();
+          if (body2?.detail) {
+            throw new KSeFUnauthorizedError(body2);
           }
         }
         if (response.status === 403) {
-          const body = parseJson();
-          if (body?.reasonCode) {
-            throw new KSeFForbiddenError(body);
+          const body2 = parseJson();
+          if (body2?.reasonCode) {
+            throw new KSeFForbiddenError(body2);
           }
         }
-        throw KSeFApiError.fromResponse(response.status, parseJson());
+        if (response.status === 410) {
+          const body2 = parseJson();
+          throw new KSeFGoneError({
+            title: body2?.title || "Gone",
+            status: body2?.status || 410,
+            detail: body2?.detail || "Operation status no longer available (retention expired)",
+            instance: body2?.instance,
+            traceId: body2?.traceId,
+            timestamp: body2?.timestamp
+          });
+        }
+        const body = parseJson();
+        if (hasErrorCode(body, KSeFErrorCode.BatchTimeout)) {
+          throw KSeFBatchTimeoutError.fromResponse(response.status, body);
+        }
+        throw KSeFApiError.fromResponse(response.status, body);
       }
     };
   }
@@ -988,6 +1073,32 @@ var init_online_session = __esm({
   }
 });
 
+// src/utils/concurrency.ts
+async function runWithConcurrency(tasks, parallelism) {
+  if (tasks.length === 0) return;
+  const limit = Math.max(1, Math.min(parallelism, tasks.length));
+  const controller = new AbortController();
+  let index = 0;
+  const workers = Array.from({ length: limit }, async () => {
+    while (index < tasks.length && !controller.signal.aborted) {
+      const current = index;
+      index += 1;
+      try {
+        await tasks[current](controller.signal);
+      } catch (err) {
+        controller.abort();
+        throw err;
+      }
+    }
+  });
+  await Promise.all(workers);
+}
+var init_concurrency = __esm({
+  "src/utils/concurrency.ts"() {
+    "use strict";
+  }
+});
+
 // src/services/batch-session.ts
 var BatchSessionService;
 var init_batch_session = __esm({
@@ -996,6 +1107,7 @@ var init_batch_session = __esm({
     init_ksef_feature();
     init_rest_request();
     init_routes();
+    init_concurrency();
     BatchSessionService = class {
       restClient;
       constructor(restClient) {
@@ -1009,12 +1121,10 @@ var init_batch_session = __esm({
         const response = await this.restClient.execute(req);
         return response.body;
       }
-      async sendParts(openResponse, parts) {
-        const uploadRequests = openResponse.partUploadRequests;
-        const tasks = parts.map(async (part) => {
-          const uploadReq = uploadRequests.find(
-            (r) => r.ordinalNumber === part.ordinalNumber
-          );
+      async sendParts(openResponse, parts, parallelism) {
+        const uploadMap = new Map(openResponse.partUploadRequests.map((r) => [r.ordinalNumber, r]));
+        const tasks = parts.map((part) => async (signal) => {
+          const uploadReq = uploadMap.get(part.ordinalNumber);
           if (!uploadReq) {
             throw new Error(`No upload request found for part ${part.ordinalNumber}`);
           }
@@ -1022,25 +1132,38 @@ var init_batch_session = __esm({
           for (const [k, v] of Object.entries(uploadReq.headers)) {
             if (v != null) headers[k] = v;
           }
-          await fetch(uploadReq.url, {
+          const resp = await fetch(uploadReq.url, {
             method: uploadReq.method,
             headers,
-            body: part.data
+            body: part.data,
+            signal
           });
+          if (!resp.ok) {
+            const body = await resp.text().catch(() => "");
+            throw new Error(
+              `Upload failed for part ${part.ordinalNumber}: HTTP ${resp.status}${body ? ` \u2014 ${body}` : ""}`
+            );
+          }
         });
-        await Promise.all(tasks);
+        if (parallelism !== void 0) {
+          await runWithConcurrency(tasks, parallelism);
+        } else {
+          const ac = new AbortController();
+          await Promise.all(tasks.map((t) => t(ac.signal).catch((err) => {
+            ac.abort();
+            throw err;
+          })));
+        }
       }
       /**
-       * Upload parts sequentially (not in parallel) because each part uses a
-       * streaming body (`duplex: 'half'`). Parallel streaming uploads can cause
-       * backpressure issues and exceed memory limits for large payloads.
+       * Upload parts using streaming bodies (`duplex: 'half'`).
+       * By default uploads sequentially to avoid backpressure issues.
+       * Pass `parallelism` to enable bounded concurrent uploads.
        */
-      async sendPartsWithStream(openResponse, parts) {
-        const uploadRequests = openResponse.partUploadRequests;
-        for (const part of parts) {
-          const uploadReq = uploadRequests.find(
-            (r) => r.ordinalNumber === part.ordinalNumber
-          );
+      async sendPartsWithStream(openResponse, parts, parallelism) {
+        const uploadMap = new Map(openResponse.partUploadRequests.map((r) => [r.ordinalNumber, r]));
+        const uploadPart = async (part, signal) => {
+          const uploadReq = uploadMap.get(part.ordinalNumber);
           if (!uploadReq) {
             throw new Error(`No upload request found for part ${part.ordinalNumber}`);
           }
@@ -1052,11 +1175,23 @@ var init_batch_session = __esm({
             method: uploadReq.method,
             headers,
             body: part.dataStream,
+            signal,
             // @ts-expect-error -- Node 18+ undici supports duplex for streaming body
             duplex: "half"
           });
           if (!resp.ok) {
-            throw new Error(`Upload failed for part ${part.ordinalNumber}: HTTP ${resp.status}`);
+            const body = await resp.text().catch(() => "");
+            throw new Error(
+              `Upload failed for part ${part.ordinalNumber}: HTTP ${resp.status}${body ? ` \u2014 ${body}` : ""}`
+            );
+          }
+        };
+        if (parallelism !== void 0) {
+          await runWithConcurrency(parts.map((p) => (signal) => uploadPart(p, signal)), parallelism);
+        } else {
+          const { signal } = new AbortController();
+          for (const part of parts) {
+            await uploadPart(part, signal);
           }
         }
       }
@@ -1169,7 +1304,10 @@ var init_invoice_download = __esm({
       async getInvoice(ksefNumber) {
         const req = RestRequest.get(Routes.Invoices.byKsefNumber(ksefNumber));
         const response = await this.restClient.executeRaw(req);
-        return new TextDecoder().decode(response.body);
+        return {
+          xml: new TextDecoder().decode(response.body),
+          hash: response.headers.get("x-ms-meta-hash") ?? void 0
+        };
       }
       async queryInvoiceMetadata(filters, pageOffset, pageSize, sortOrder) {
         const req = RestRequest.post(Routes.Invoices.queryMetadata).body(filters);
@@ -1450,9 +1588,12 @@ var init_errors = __esm({
     init_ksef_rate_limit_error();
     init_ksef_unauthorized_error();
     init_ksef_forbidden_error();
+    init_ksef_gone_error();
     init_ksef_auth_status_error();
     init_ksef_session_expired_error();
     init_ksef_validation_error();
+    init_ksef_batch_timeout_error();
+    init_error_codes();
   }
 });
 
@@ -2087,6 +2228,72 @@ var init_auth_xml_builder = __esm({
   }
 });
 
+// src/offline/holidays.ts
+function toDateKey(d) {
+  return d.toISOString().slice(0, 10);
+}
+function dateKey(year, month, day) {
+  return toDateKey(new Date(Date.UTC(year, month - 1, day)));
+}
+function addDays(d, n) {
+  const result = new Date(d);
+  result.setUTCDate(result.getUTCDate() + n);
+  return result;
+}
+function computeEasterSunday(year) {
+  const a = year % 19;
+  const b = Math.floor(year / 100);
+  const c = year % 100;
+  const d = Math.floor(b / 4);
+  const e = b % 4;
+  const f = Math.floor((b + 8) / 25);
+  const g = Math.floor((b - f + 1) / 3);
+  const h = (19 * a + b - d - g + 15) % 30;
+  const i = Math.floor(c / 4);
+  const k = c % 4;
+  const l = (32 + 2 * e + 2 * i - h - k) % 7;
+  const m = Math.floor((a + 11 * h + 22 * l) / 451);
+  const month = Math.floor((h + l - 7 * m + 114) / 31);
+  const day = (h + l - 7 * m + 114) % 31 + 1;
+  return new Date(Date.UTC(year, month - 1, day));
+}
+function getPolishHolidays(year) {
+  const cached = holidayCache.get(year);
+  if (cached) return cached;
+  const easter = computeEasterSunday(year);
+  const holidays = /* @__PURE__ */ new Set([
+    // Fixed
+    dateKey(year, 1, 1),
+    dateKey(year, 1, 6),
+    dateKey(year, 5, 1),
+    dateKey(year, 5, 3),
+    dateKey(year, 8, 15),
+    dateKey(year, 11, 1),
+    dateKey(year, 11, 11),
+    dateKey(year, 12, 25),
+    dateKey(year, 12, 26),
+    // Wigilia — added by Dz.U. 2024 poz. 1965, effective from 2025
+    ...year >= 2025 ? [dateKey(year, 12, 24)] : [],
+    // Moveable
+    toDateKey(easter),
+    toDateKey(addDays(easter, 1)),
+    toDateKey(addDays(easter, 49)),
+    toDateKey(addDays(easter, 60))
+  ]);
+  holidayCache.set(year, holidays);
+  return holidays;
+}
+function isPolishHoliday(date) {
+  return getPolishHolidays(date.getUTCFullYear()).has(toDateKey(date));
+}
+var holidayCache;
+var init_holidays = __esm({
+  "src/offline/holidays.ts"() {
+    "use strict";
+    holidayCache = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/offline/deadline.ts
 function getDefaultReason(mode) {
   switch (mode) {
@@ -2103,7 +2310,7 @@ function getDefaultReason(mode) {
 function nextBusinessDay(from) {
   const d = new Date(from);
   d.setUTCDate(d.getUTCDate() + 1);
-  while (d.getUTCDay() === 0 || d.getUTCDay() === 6) {
+  while (d.getUTCDay() === 0 || d.getUTCDay() === 6 || isPolishHoliday(d)) {
     d.setUTCDate(d.getUTCDate() + 1);
   }
   return d;
@@ -2116,7 +2323,7 @@ function addBusinessDays(from, days) {
   let remaining = days;
   while (remaining > 0) {
     d.setUTCDate(d.getUTCDate() + 1);
-    if (d.getUTCDay() !== 0 && d.getUTCDay() !== 6) {
+    if (d.getUTCDay() !== 0 && d.getUTCDay() !== 6 && !isPolishHoliday(d)) {
       remaining--;
     }
   }
@@ -2162,6 +2369,7 @@ var FAR_FUTURE;
 var init_deadline = __esm({
   "src/offline/deadline.ts"() {
     "use strict";
+    init_holidays();
     FAR_FUTURE = /* @__PURE__ */ new Date("9999-12-31T23:59:59Z");
   }
 });
@@ -2884,6 +3092,7 @@ var init_client = __esm({
       qr;
       options;
       authManager;
+      _baseRestClientConfig;
       _offline;
       constructor(options) {
         this.options = resolveOptions(options);
@@ -2895,6 +3104,8 @@ var init_client = __esm({
         });
         this.authManager = authManager;
         const restClientConfig = buildRestClientConfig(options, authManager);
+        const { authManager: _am, ...baseConfig } = restClientConfig;
+        this._baseRestClientConfig = baseConfig;
         const restClient = new RestClient(this.options, restClientConfig);
         const fetcher = new CertificateFetcher(restClient);
         this.crypto = new CryptographyService(fetcher);
@@ -2919,6 +3130,10 @@ var init_client = __esm({
         }
         return this._offline;
       }
+      /** @internal Create a RestClient with a different AuthManager, preserving transport/retry/rateLimit config. */
+      createScopedRestClient(authManager) {
+        return new RestClient(this.options, { ...this._baseRestClientConfig, authManager });
+      }
       async loginWithToken(token, nip) {
         const challenge2 = await this.auth.getChallenge();
         await this.crypto.init();
@@ -2933,6 +3148,7 @@ var init_client = __esm({
         const tokens = await this.auth.getAccessToken(authToken);
         this.authManager.setAccessToken(tokens.accessToken.token);
         this.authManager.setRefreshToken(tokens.refreshToken.token);
+        return { clientIp: challenge2.clientIp };
       }
       async loginWithCertificate(certPem, keyPem, nip, keyPassword) {
         const challenge2 = await this.auth.getChallenge();
@@ -2945,11 +3161,12 @@ var init_client = __esm({
         const tokens = await this.auth.getAccessToken(authToken);
         this.authManager.setAccessToken(tokens.accessToken.token);
         this.authManager.setRefreshToken(tokens.refreshToken.token);
+        return { clientIp: challenge2.clientIp };
       }
       async loginWithPkcs12(p12, password, nip) {
         const { Pkcs12Loader: Pkcs12Loader2 } = await Promise.resolve().then(() => (init_pkcs12_loader(), pkcs12_loader_exports));
         const { certificatePem, privateKeyPem } = Pkcs12Loader2.load(p12, password);
-        await this.loginWithCertificate(certificatePem, privateKeyPem, nip);
+        return this.loginWithCertificate(certificatePem, privateKeyPem, nip);
       }
       async awaitAuthReady(referenceNumber, authToken) {
         for (let i = 0; i < 30; i++) {
@@ -5034,7 +5251,7 @@ var init_invoice_validator = __esm({
 });
 
 // src/builders/batch-file.ts
-import * as crypto5 from "crypto";
+import * as crypto6 from "crypto";
 function splitBuffer(data, maxPartSize) {
   if (data.length <= maxPartSize) {
     return [data];
@@ -5045,8 +5262,8 @@ function splitBuffer(data, maxPartSize) {
   }
   return parts;
 }
-function sha256Base64(data) {
-  return crypto5.createHash("sha256").update(data).digest("base64");
+function sha256Base642(data) {
+  return crypto6.createHash("sha256").update(data).digest("base64");
 }
 var BATCH_MAX_PART_SIZE, BATCH_MAX_TOTAL_SIZE, BATCH_MAX_PARTS, BatchFileBuilder;
 var init_batch_file = __esm({
@@ -5083,7 +5300,7 @@ var init_batch_file = __esm({
             `Data requires ${rawParts.length} parts, exceeding maximum of ${BATCH_MAX_PARTS}`
           );
         }
-        const zipHash = sha256Base64(zipBytes);
+        const zipHash = sha256Base642(zipBytes);
         const encryptedParts = [];
         const fileParts = rawParts.map((raw, i) => {
           const encrypted = encryptFn(raw);
@@ -5091,7 +5308,7 @@ var init_batch_file = __esm({
           return {
             ordinalNumber: i + 1,
             fileSize: encrypted.length,
-            fileHash: sha256Base64(encrypted)
+            fileHash: sha256Base642(encrypted)
           };
         });
         return {
@@ -5174,7 +5391,7 @@ var init_batch_file = __esm({
             encryptedChunks.push(value);
           }
           const encryptedData = new Uint8Array(Buffer.concat(encryptedChunks));
-          const encryptedMeta = sha256Base64(encryptedData);
+          const encryptedMeta = sha256Base642(encryptedData);
           fileParts.push({
             ordinalNumber: partIndex + 1,
             fileSize: encryptedData.byteLength,
@@ -5218,6 +5435,9 @@ __export(batch_session_workflow_exports, {
   uploadBatchStreamParsed: () => uploadBatchStreamParsed
 });
 async function uploadBatch(client, zipData, options) {
+  if (options?.parallelism !== void 0 && (!Number.isInteger(options.parallelism) || options.parallelism < 1)) {
+    throw new Error("parallelism must be a positive integer");
+  }
   await client.crypto.init();
   if (options?.validate) {
     const { unzip: unzip2 } = await Promise.resolve().then(() => (init_zip(), zip_exports));
@@ -5260,7 +5480,7 @@ async function uploadBatch(client, zipData, options) {
     },
     ordinalNumber: i + 1
   }));
-  await client.batchSession.sendParts(openResp, sendingParts);
+  await client.batchSession.sendParts(openResp, sendingParts, options?.parallelism);
   await client.batchSession.closeSession(openResp.referenceNumber);
   const result = await pollUntil(
     () => client.sessionStatus.getSessionStatus(openResp.referenceNumber),
@@ -5281,6 +5501,9 @@ async function uploadBatch(client, zipData, options) {
   };
 }
 async function uploadBatchStream(client, zipStreamFactory, zipSize, options) {
+  if (options?.parallelism !== void 0 && (!Number.isInteger(options.parallelism) || options.parallelism < 1)) {
+    throw new Error("parallelism must be a positive integer");
+  }
   await client.crypto.init();
   const encData = client.crypto.getEncryptionData();
   const formCode = options?.formCode ?? DEFAULT_FORM_CODE;
@@ -5302,7 +5525,7 @@ async function uploadBatchStream(client, zipStreamFactory, zipSize, options) {
     },
     options?.upoVersion
   );
-  await client.batchSession.sendPartsWithStream(openResp, streamParts);
+  await client.batchSession.sendPartsWithStream(openResp, streamParts, options?.parallelism);
   await client.batchSession.closeSession(openResp.referenceNumber);
   const result = await pollUntil(
     () => client.sessionStatus.getSessionStatus(openResp.referenceNumber),
@@ -5923,17 +6146,18 @@ var login = defineCommand2({
         throw new Error("NIP is required. Provide --nip or set it via `ksef config set --nip <nip>`.");
       }
       const token = args.token ?? loadCredentials()?.token;
+      let loginResult;
       if (token) {
-        await client.loginWithToken(token, nip);
+        loginResult = await client.loginWithToken(token, nip);
       } else if (args.p12) {
         const fs15 = await import("fs");
         const p12Buffer = fs15.readFileSync(args.p12);
-        await client.loginWithPkcs12(p12Buffer, args["p12-password"] ?? "", nip);
+        loginResult = await client.loginWithPkcs12(p12Buffer, args["p12-password"] ?? "", nip);
       } else if (args.cert && args.key) {
         const fs15 = await import("fs");
         const certPem = fs15.readFileSync(args.cert, "utf-8");
         const keyPem = fs15.readFileSync(args.key, "utf-8");
-        await client.loginWithCertificate(certPem, keyPem, nip, args["key-password"]);
+        loginResult = await client.loginWithCertificate(certPem, keyPem, nip, args["key-password"]);
       } else {
         throw new Error("Provide --token, --p12, or both --cert and --key for authentication.");
       }
@@ -5948,7 +6172,12 @@ var login = defineCommand2({
       if (args.env && args.env !== config.environment) {
         saveConfig({ ...config, environment: session.environment });
       }
-      outputSuccess("Logged in successfully.");
+      if (args.json) {
+        console.log(JSON.stringify({ status: "ok", clientIp: loginResult.clientIp }, null, 2));
+      } else {
+        consola6.info(`Seen client IP: ${loginResult.clientIp}`);
+        outputSuccess("Logged in successfully.");
+      }
     });
   }
 });
@@ -6111,6 +6340,8 @@ var loginExternal = defineCommand2({
         process.stderr.write(`Challenge: ${challengeResult.challenge}
 `);
         process.stderr.write(`Timestamp: ${challengeResult.timestamp}
+`);
+        process.stderr.write(`Seen client IP: ${challengeResult.clientIp}
 `);
         process.stderr.write(`Note: Sign this XML and submit with --submit before the challenge expires.
 `);
@@ -6311,6 +6542,7 @@ var list = defineCommand3({
           reference: s.referenceNumber,
           status: `${s.status.code} \u2014 ${s.status.description}`,
           created: s.dateCreated,
+          updated: s.dateUpdated,
           total: s.totalInvoiceCount,
           success: s.successfulInvoiceCount,
           failed: s.failedInvoiceCount
@@ -6319,6 +6551,7 @@ var list = defineCommand3({
           { key: "reference", label: "Reference" },
           { key: "status", label: "Status" },
           { key: "created", label: "Created" },
+          { key: "updated", label: "Updated" },
           { key: "total", label: "Total" },
           { key: "success", label: "Success" },
           { key: "failed", label: "Failed" }
@@ -6646,6 +6879,17 @@ var FileHwmStore = class {
 // src/workflows/invoice-export-workflow.ts
 init_zip();
 init_polling();
+
+// src/utils/hash.ts
+import crypto5 from "crypto";
+function sha256Base64(data) {
+  return crypto5.createHash("sha256").update(data).digest("base64");
+}
+function verifyHash(data, expectedHash) {
+  return sha256Base64(data) === expectedHash;
+}
+
+// src/workflows/invoice-export-workflow.ts
 async function doExport(client, filters, options) {
   await client.crypto.init();
   const encData = client.crypto.getEncryptionData();
@@ -6674,6 +6918,7 @@ async function doExport(client, filters, options) {
         url: p.url,
         method: p.method,
         partSize: p.partSize,
+        partHash: p.partHash,
         encryptedPartSize: p.encryptedPartSize,
         encryptedPartHash: p.encryptedPartHash,
         expirationDate: p.expirationDate
@@ -6735,6 +6980,9 @@ async function incrementalExportAndDownload(client, options) {
         throw new Error(`Download failed for part ${part.ordinalNumber}: HTTP ${resp.status}`);
       }
       const encryptedData = new Uint8Array(await resp.arrayBuffer());
+      if (options.verifyHash !== false && !verifyHash(encryptedData, part.encryptedPartHash)) {
+        throw new Error(`Hash mismatch for export part ${part.ordinalNumber}`);
+      }
       const decrypted = client.crypto.decryptAES256(encryptedData, encData.cipherKey, encData.cipherIv);
       decryptedParts.push(decrypted);
     }
@@ -6930,8 +7178,8 @@ var QUERY_FILTER_ARGS = {
   dateType: { type: "string", description: "Date type: Issue|Invoicing|PermanentStorage (default: Invoicing)" },
   sellerNip: { type: "string", description: "Filter by seller NIP" },
   buyerNip: { type: "string", description: "Filter by buyer NIP" },
-  amountFrom: { type: "string", description: "Minimum amount" },
-  amountTo: { type: "string", description: "Maximum amount" },
+  amountFrom: { type: "string", description: "Minimum amount (negative values allowed)" },
+  amountTo: { type: "string", description: "Maximum amount (negative values allowed)" },
   amountType: { type: "string", description: "Amount type: Brutto|Netto|Vat (default: Brutto)" },
   currency: { type: "string", description: "Currency code (e.g. PLN, EUR)" }
 };
@@ -6943,6 +7191,7 @@ var send = defineCommand5({
     stream: { type: "boolean", description: "Use stream-based batch upload (for ZIP files, reduces memory usage)" },
     formCode: { type: "string", description: "Document type: FA2, FA3, PEF3, PEFKOR3, FARR1 (default: FA3)" },
     validate: { type: "boolean", description: "Validate XML before sending" },
+    parallelism: { type: "string", description: "Number of concurrent part uploads (batch mode)" },
     env: { type: "string", description: "Environment (test/demo/prod)" },
     json: { type: "boolean", description: "Output as JSON" },
     verbose: { type: "boolean", description: "Show HTTP request/response details" },
@@ -6956,6 +7205,10 @@ var send = defineCommand5({
       const config = loadConfig();
       const nip = args.nip ?? config.nip;
       const filePath = args.path;
+      const parallelism = args.parallelism ? Number(args.parallelism) : void 0;
+      if (parallelism !== void 0 && (!Number.isInteger(parallelism) || parallelism < 1)) {
+        throw new Error("--parallelism must be a positive integer");
+      }
       const formCodeKey = args.formCode;
       let formCode = DEFAULT_FORM_CODE;
       if (formCodeKey) {
@@ -6988,7 +7241,8 @@ var send = defineCommand5({
         if (!args.json) consola9.start(`Sending batch via stream (${(zipSize / 1e6).toFixed(1)} MB)...`);
         const result = await uploadBatchStream2(client, zipStreamFactory, zipSize, {
           formCode,
-          pollOptions: { intervalMs: 3e3 }
+          pollOptions: { intervalMs: 3e3 },
+          parallelism
         });
         if (args.json) {
           outputResult(result, { json: true });
@@ -7052,7 +7306,7 @@ var send = defineCommand5({
           { formCode, batchFile: batchFileInfo, encryption: encryptionData.encryptionInfo }
         );
         saveOnlineSessionRef(openResult.referenceNumber);
-        await client.batchSession.sendParts(openResult, parts);
+        await client.batchSession.sendParts(openResult, parts, parallelism);
         await client.batchSession.closeSession(openResult.referenceNumber);
         clearOnlineSessionRef();
         if (args.json) {
@@ -7117,9 +7371,9 @@ var get = defineCommand5({
     return withErrorHandler(async () => {
       const globalOpts = getGlobalOpts4(args);
       const { client } = await requireSession(globalOpts);
-      const xml = await client.invoices.getInvoice(args.ksefNumber);
+      const { xml, hash } = await client.invoices.getInvoice(args.ksefNumber);
       if (args.json) {
-        outputResult({ ksefNumber: args.ksefNumber, xml }, { json: true });
+        outputResult({ ksefNumber: args.ksefNumber, xml, hash }, { json: true });
         return;
       }
       if (args.o) {
@@ -8036,12 +8290,12 @@ import fs10 from "fs";
 import path7 from "path";
 
 // src/crypto/certificate-service.ts
-import * as crypto6 from "crypto";
+import * as crypto7 from "crypto";
 import * as x5092 from "@peculiar/x509";
 var CertificateService = class {
   static getSha256Fingerprint(certPem) {
     const der = extractDerFromPem2(certPem);
-    return crypto6.createHash("sha256").update(der).digest("hex").toUpperCase();
+    return crypto7.createHash("sha256").update(der).digest("hex").toUpperCase();
   }
   static async generatePersonalCertificate(givenName, surname, serialNumber, commonName, method = "RSA") {
     const nameParts = [];
@@ -8064,7 +8318,7 @@ var CertificateService = class {
   }
 };
 async function generateSelfSigned(subject2, method) {
-  x5092.cryptoProvider.set(crypto6.webcrypto);
+  x5092.cryptoProvider.set(crypto7.webcrypto);
   let algorithm;
   let signingAlgorithm;
   if (method === "ECDSA") {
@@ -8079,7 +8333,7 @@ async function generateSelfSigned(subject2, method) {
     };
     signingAlgorithm = algorithm;
   }
-  const keys = await crypto6.webcrypto.subtle.generateKey(
+  const keys = await crypto7.webcrypto.subtle.generateKey(
     algorithm,
     true,
     ["sign", "verify"]
@@ -8096,9 +8350,9 @@ async function generateSelfSigned(subject2, method) {
     serialNumber: Date.now().toString(16)
   });
   const certPem = cert.toString("pem");
-  const pkcs8 = await crypto6.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+  const pkcs8 = await crypto7.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
   const privateKeyPem = pemEncode2(new Uint8Array(pkcs8), "PRIVATE KEY");
-  const fingerprint = crypto6.createHash("sha256").update(Buffer.from(cert.rawData)).digest("hex").toUpperCase();
+  const fingerprint = crypto7.createHash("sha256").update(Buffer.from(cert.rawData)).digest("hex").toUpperCase();
   return { certificatePem: certPem, privateKeyPem, fingerprint };
 }
 function extractDerFromPem2(pem) {