sinfactura-types 1.10.509 → 1.10.511

package/dist/auth.d.ts

@@ -408,21 +408,32 @@ declare global {
      * on `message`. `revoked` echoes the `jti` that was ended.
      *
      * `logged_out_self` means the caller revoked the session it is currently
-     * using: the response also clears the refresh cookie, so the client is now
-     * signed out and must route to login instead of re-rendering the device
-     * list. `session_revoked` means some OTHER device was ended and this
-     * session continues.
+     * using — any row of the caller's own session family: the response also
+     * clears the refresh cookie, so the client is now signed out and must route
+     * to login instead of re-rendering the device list. `session_revoked` means
+     * some OTHER device was ended and this session continues.
+     *
+     * ⚠️ `logged_out_self` can carry `complete: false`: the cookie was cleared,
+     * but the sweep of the caller's own session did not finish, so a copy of it
+     * may still be live elsewhere. Say so, and suggest signing in again and
+     * ending the other sessions — do not report a clean sign-out. The field is
+     * absent when the sweep finished.
+     *
+     * ⚠️ An unfinished sweep of ANOTHER session is NOT a 200. It answers **502**
+     * with `error: 'REVOKE_INCOMPLETE'` and a `revokedCount`: that device may
+     * still be signed in. Read the outcome from the STATUS and surface a retry —
+     * safe, but not guaranteed to finish, so do not retry in a loop.
      *
      * ⚠️ A miss does NOT always answer 404. When the session lookup was capped
      * — the same shortfall `CustomerSessionsResponse.complete: false` reports —
      * and the target `jti` was not among the rows read, the endpoint answers
-     * **409** with `error: 'session_lookup_incomplete'` INSTEAD of a 404, on
+     * **409** with `error: 'SESSION_LOOKUP_INCOMPLETE'` INSTEAD of a 404, on
      * purpose: a miss on a capped list is not proof of absence.
      *
      * Treating that 409 as "already gone" is the dangerous handling. It tells
      * someone their stolen device was killed while its token is still live. The
      * 409 means "ask again" — retry, or fall back to `revoke-others`, which
-     * needs no lookup. Only a genuine 404 `session_unknown` means the session
+     * needs no lookup. Only a genuine 404 `SESSION_UNKNOWN` means the session
      * does not exist.
      */
     type RevokeSessionResult = {
@@ -431,14 +442,18 @@ declare global {
     } | {
         message: 'logged_out_self';
         revoked: string;
+        /** Present (and `false`) only when the sweep of the caller's own session did not finish. */
+        complete?: false;
     };
     /**
-     * `POST /auth { mode: 'revoke-others' }` — the 200 body. Every session in
-     * the caller's partition except the one making the request is dead.
+     * `POST /auth { mode: 'revoke-others' }` — the 200 body. The sweep ended
+     * every session in the caller's partition but the caller's own, and its last
+     * read found none left. ⚠️ That is the strongest answer the api can give, not
+     * proof: a refresh landing during the sweep can still leave its session live.
      *
      * `complete` is the literal `true` and carries no information on its own,
      * because an INCOMPLETE sweep is deliberately NOT a 200: it answers **502**
-     * with `error: 'revoke_incomplete'` and a `revokedCount` that is a PARTIAL
+     * with `error: 'REVOKE_INCOMPLETE'` and a `revokedCount` that is a PARTIAL
      * count. Some refresh tokens survived that sweep and are STILL USABLE.
      *
      * So read the outcome from the STATUS, never from the count. On 200 the
@@ -1091,6 +1106,13 @@ declare global {
  *   customer to link rather than showing a generic failure; the relay address
  *   itself is deliberately not carried, since it is re-derivable from the token
  *   on the next sign-in.
+ *
+ * ⚠️ `link-sign-in-method` and `unlink-sign-in-method` also require the
+ * presented refresh token's OWN row to be live, so they can answer three
+ * `RefreshErrorCode` members before any of the above: `401
+ * REFRESH_TOKEN_UNKNOWN` (missing, mismatched or already-ended row), `409
+ * CONCURRENT_ROTATION` (a rotation under 30 s ago — retry once with the new
+ * token) and `401 FAMILY_REVOKED` (a replay — the session is revoked as theft).
  */
 export declare const SIGN_IN_METHOD_ERROR_CODES: readonly ["SIGN_IN_METHOD_LAST_CREDENTIAL", "SIGN_IN_METHOD_NOT_LINKED", "SIGN_IN_METHOD_ALREADY_LINKED", "SIGN_IN_PROVIDER_REFUSED", "SIGN_IN_UID_MISMATCH", "SIGN_IN_IDENTITY_MISMATCH", "SIGN_IN_IDENTITY_UNVERIFIED", "INVALID_ID_TOKEN", "SIGN_IN_PROVIDER_UNSUPPORTED", "SIGN_IN_METHODS_CONFLICT", "SIGN_IN_RELAY_IDENTITY_UNRESOLVED"];
 export type SignInMethodErrorCode = (typeof SIGN_IN_METHOD_ERROR_CODES)[number];
@@ -1335,9 +1357,10 @@ export type TwoFactorManagementErrorCode = (typeof TWO_FACTOR_MANAGEMENT_ERROR_C
 export declare const PASSKEY_ERROR_CODES: readonly ["PASSKEY_DISABLED", "IMPERSONATION_PASSKEY_FORBIDDEN", "TOTP_REQUIRED_BEFORE_PASSKEY", "PASSKEY_LIMIT_REACHED", "INVALID_CHALLENGE", "CHALLENGE_ALREADY_USED", "PASSKEY_REGISTRATION_INVALID", "PASSKEY_ALREADY_REGISTERED", "PASSKEY_NOT_FOUND", "USER_NOT_FOUND", "INVALID_2FA_CODE", "2FA_LOCKED"];
 export type PasskeyErrorCode = (typeof PASSKEY_ERROR_CODES)[number];
 /**
- * Refusals from the session-management legs — `stacks/lambdas/auth/_revokeSession.ts`
- * and `_revokeOthers.ts`. Shared by the operator and customer hosts, which run
- * the same handlers.
+ * Refusals from the session-management legs — `revoke-session` and
+ * `revoke-others` on both the operator host (`stacks/lambdas/auth/`) and the
+ * customer host (`stacks/web/lambdas/auth/`), two handler pairs that answer the
+ * same codes.
  *
  * - `SESSION_LOOKUP_INCOMPLETE` · 409 — the session list was capped before the
  *   target `jti` was reached, so the api cannot prove the session does not
@@ -1345,9 +1368,26 @@ export type PasskeyErrorCode = (typeof PASSKEY_ERROR_CODES)[number];
  *   reason: one means "not found", the other means "not looked at". Collapsing
  *   them tells a user a device is gone when it may still be live.
  * - `SESSION_UNKNOWN` · 404 — genuinely absent. Not retryable.
- * - `REVOKE_INCOMPLETE` · 502 — a revoke-others sweep ended partway. Some
- *   sessions WERE revoked; the body carries `revokedCount`. Retry to finish —
- *   the operation is idempotent over the sessions already ended.
+ * - `REVOKE_INCOMPLETE` · 502 — a revoke-others sweep, or a revoke-session sweep
+ *   of ANOTHER session, ended partway. (Revoking the caller's OWN session — any
+ *   row of its family — answers `200 logged_out_self` with `complete: false`
+ *   instead: the delivery is cleared, so there is nothing to retry with.) Some sessions WERE revoked; the body carries `revokedCount`. A
+ *   retry is safe (idempotent over the sessions already ended) and finishes a
+ *   sweep a failed write or a racing rotation cut short — but it reads from
+ *   the top again, so it is not guaranteed to finish; do not retry in a loop.
+ *
+ * ⚠️ Both legs can also answer three `RefreshErrorCode` members: they require
+ * the presented token's OWN row to be live, so a missing, mismatched or
+ * already-ended row is `401 REFRESH_TOKEN_UNKNOWN`, a row a rotation stamped
+ * under 30 s ago is `409 CONCURRENT_ROTATION` (retry once with the new token),
+ * and a row a rotation stamped longer ago is a replay — the session is revoked
+ * as theft and the answer is `401 FAMILY_REVOKED`.
+ *
+ * ⚠️ The READ modes on the same refresh credential — `GET /auth?mode=sessions`,
+ * `?mode=login-history` and the customer host's `?mode=sign-in-methods` — make
+ * the same check and answer the same two 401s (a replay revokes the session
+ * there too). They never answer the 409: a row a rotation stamped under 30 s
+ * ago is served.
  */
 export declare const SESSION_ACTION_ERROR_CODES: readonly ["SESSION_LOOKUP_INCOMPLETE", "SESSION_UNKNOWN", "REVOKE_INCOMPLETE"];
 export type SessionActionErrorCode = (typeof SESSION_ACTION_ERROR_CODES)[number];

package/dist/auth.js

@@ -59,6 +59,13 @@
  *   customer to link rather than showing a generic failure; the relay address
  *   itself is deliberately not carried, since it is re-derivable from the token
  *   on the next sign-in.
+ *
+ * ⚠️ `link-sign-in-method` and `unlink-sign-in-method` also require the
+ * presented refresh token's OWN row to be live, so they can answer three
+ * `RefreshErrorCode` members before any of the above: `401
+ * REFRESH_TOKEN_UNKNOWN` (missing, mismatched or already-ended row), `409
+ * CONCURRENT_ROTATION` (a rotation under 30 s ago — retry once with the new
+ * token) and `401 FAMILY_REVOKED` (a replay — the session is revoked as theft).
  */
 export const SIGN_IN_METHOD_ERROR_CODES = [
     'SIGN_IN_METHOD_LAST_CREDENTIAL',
@@ -354,9 +361,10 @@ export const PASSKEY_ERROR_CODES = [
     '2FA_LOCKED',
 ];
 /**
- * Refusals from the session-management legs — `stacks/lambdas/auth/_revokeSession.ts`
- * and `_revokeOthers.ts`. Shared by the operator and customer hosts, which run
- * the same handlers.
+ * Refusals from the session-management legs — `revoke-session` and
+ * `revoke-others` on both the operator host (`stacks/lambdas/auth/`) and the
+ * customer host (`stacks/web/lambdas/auth/`), two handler pairs that answer the
+ * same codes.
  *
  * - `SESSION_LOOKUP_INCOMPLETE` · 409 — the session list was capped before the
  *   target `jti` was reached, so the api cannot prove the session does not
@@ -364,9 +372,26 @@ export const PASSKEY_ERROR_CODES = [
  *   reason: one means "not found", the other means "not looked at". Collapsing
  *   them tells a user a device is gone when it may still be live.
  * - `SESSION_UNKNOWN` · 404 — genuinely absent. Not retryable.
- * - `REVOKE_INCOMPLETE` · 502 — a revoke-others sweep ended partway. Some
- *   sessions WERE revoked; the body carries `revokedCount`. Retry to finish —
- *   the operation is idempotent over the sessions already ended.
+ * - `REVOKE_INCOMPLETE` · 502 — a revoke-others sweep, or a revoke-session sweep
+ *   of ANOTHER session, ended partway. (Revoking the caller's OWN session — any
+ *   row of its family — answers `200 logged_out_self` with `complete: false`
+ *   instead: the delivery is cleared, so there is nothing to retry with.) Some sessions WERE revoked; the body carries `revokedCount`. A
+ *   retry is safe (idempotent over the sessions already ended) and finishes a
+ *   sweep a failed write or a racing rotation cut short — but it reads from
+ *   the top again, so it is not guaranteed to finish; do not retry in a loop.
+ *
+ * ⚠️ Both legs can also answer three `RefreshErrorCode` members: they require
+ * the presented token's OWN row to be live, so a missing, mismatched or
+ * already-ended row is `401 REFRESH_TOKEN_UNKNOWN`, a row a rotation stamped
+ * under 30 s ago is `409 CONCURRENT_ROTATION` (retry once with the new token),
+ * and a row a rotation stamped longer ago is a replay — the session is revoked
+ * as theft and the answer is `401 FAMILY_REVOKED`.
+ *
+ * ⚠️ The READ modes on the same refresh credential — `GET /auth?mode=sessions`,
+ * `?mode=login-history` and the customer host's `?mode=sign-in-methods` — make
+ * the same check and answer the same two 401s (a replay revokes the session
+ * there too). They never answer the 409: a row a rotation stamped under 30 s
+ * ago is served.
  */
 export const SESSION_ACTION_ERROR_CODES = [
     'SESSION_LOOKUP_INCOMPLETE',

package/dist/cjs/auth.js

@@ -62,6 +62,13 @@ exports.SESSION_ACTION_ERROR_CODES = exports.PASSKEY_ERROR_CODES = exports.TWO_F
  *   customer to link rather than showing a generic failure; the relay address
  *   itself is deliberately not carried, since it is re-derivable from the token
  *   on the next sign-in.
+ *
+ * ⚠️ `link-sign-in-method` and `unlink-sign-in-method` also require the
+ * presented refresh token's OWN row to be live, so they can answer three
+ * `RefreshErrorCode` members before any of the above: `401
+ * REFRESH_TOKEN_UNKNOWN` (missing, mismatched or already-ended row), `409
+ * CONCURRENT_ROTATION` (a rotation under 30 s ago — retry once with the new
+ * token) and `401 FAMILY_REVOKED` (a replay — the session is revoked as theft).
  */
 exports.SIGN_IN_METHOD_ERROR_CODES = [
     'SIGN_IN_METHOD_LAST_CREDENTIAL',
@@ -357,9 +364,10 @@ exports.PASSKEY_ERROR_CODES = [
     '2FA_LOCKED',
 ];
 /**
- * Refusals from the session-management legs — `stacks/lambdas/auth/_revokeSession.ts`
- * and `_revokeOthers.ts`. Shared by the operator and customer hosts, which run
- * the same handlers.
+ * Refusals from the session-management legs — `revoke-session` and
+ * `revoke-others` on both the operator host (`stacks/lambdas/auth/`) and the
+ * customer host (`stacks/web/lambdas/auth/`), two handler pairs that answer the
+ * same codes.
  *
  * - `SESSION_LOOKUP_INCOMPLETE` · 409 — the session list was capped before the
  *   target `jti` was reached, so the api cannot prove the session does not
@@ -367,9 +375,26 @@ exports.PASSKEY_ERROR_CODES = [
  *   reason: one means "not found", the other means "not looked at". Collapsing
  *   them tells a user a device is gone when it may still be live.
  * - `SESSION_UNKNOWN` · 404 — genuinely absent. Not retryable.
- * - `REVOKE_INCOMPLETE` · 502 — a revoke-others sweep ended partway. Some
- *   sessions WERE revoked; the body carries `revokedCount`. Retry to finish —
- *   the operation is idempotent over the sessions already ended.
+ * - `REVOKE_INCOMPLETE` · 502 — a revoke-others sweep, or a revoke-session sweep
+ *   of ANOTHER session, ended partway. (Revoking the caller's OWN session — any
+ *   row of its family — answers `200 logged_out_self` with `complete: false`
+ *   instead: the delivery is cleared, so there is nothing to retry with.) Some sessions WERE revoked; the body carries `revokedCount`. A
+ *   retry is safe (idempotent over the sessions already ended) and finishes a
+ *   sweep a failed write or a racing rotation cut short — but it reads from
+ *   the top again, so it is not guaranteed to finish; do not retry in a loop.
+ *
+ * ⚠️ Both legs can also answer three `RefreshErrorCode` members: they require
+ * the presented token's OWN row to be live, so a missing, mismatched or
+ * already-ended row is `401 REFRESH_TOKEN_UNKNOWN`, a row a rotation stamped
+ * under 30 s ago is `409 CONCURRENT_ROTATION` (retry once with the new token),
+ * and a row a rotation stamped longer ago is a replay — the session is revoked
+ * as theft and the answer is `401 FAMILY_REVOKED`.
+ *
+ * ⚠️ The READ modes on the same refresh credential — `GET /auth?mode=sessions`,
+ * `?mode=login-history` and the customer host's `?mode=sign-in-methods` — make
+ * the same check and answer the same two 401s (a replay revokes the session
+ * there too). They never answer the 409: a row a rotation stamped under 30 s
+ * ago is served.
  */
 exports.SESSION_ACTION_ERROR_CODES = [
     'SESSION_LOOKUP_INCOMPLETE',

package/dist/customer.d.ts

@@ -1014,9 +1014,10 @@ declare global {
     /**
      * `data` of the STOREFRONT erasure (`POST /user` mode `anonymize`): the
      * operator result minus the notes counts, which would tell the subject how
-     * many operator notes existed about them.
+     * many operator notes existed about them, and minus the RMA reason counts,
+     * for the same reason (the rejection reasons are operator-written).
      */
-    type WebAnonymizeCustomerResult = Omit<AnonymizeCustomerResult, 'notesErased' | 'notesEraseComplete'>;
+    type WebAnonymizeCustomerResult = Omit<AnonymizeCustomerResult, 'notesErased' | 'notesEraseComplete' | 'rmaReasonsErased' | 'rmaEraseComplete'>;
     /**
      * The outcome of a Ley 25.326 art. 16 erasure (`anonymizeCustomer`). The
      * row is anonymised in place and KEPT — see `Customer.anonymizedAt`.
@@ -1093,6 +1094,20 @@ declare global {
          * On BOTH wires — counts only.
          */
         contactsEraseComplete: boolean;
+        /**
+         * `RMA#` rows of this customer whose free text (`requestReason`,
+         * `rejectionReason`) this erasure REMOVEd. The RMA row itself is kept —
+         * it is the store's record of a return. Operator wire only.
+         */
+        rmaReasonsErased: number;
+        /**
+         * `false` when the RMA rows could not be read or written to the end, so a
+         * reason may remain. Re-issuing the erasure re-runs the step; BOTH erasure
+         * handlers write a deduped `ERROR` row (`CUSTOMER_ANONYMIZE_RMA_INCOMPLETE`).
+         * Operator wire only — the storefront response omits both
+         * (`WebAnonymizeCustomerResult`).
+         */
+        rmaEraseComplete: boolean;
         /**
          * The subject's `ORDER#` rows whose frozen recipient this erasure scrubbed —
          * `customer` reduced to `{ customerId }`, `deliveryAddress` removed, the

package/dist/platform.d.ts

@@ -631,7 +631,16 @@ export interface TenantActiveSessionsResponse {
     sessions: TenantActiveSessionSummary[];
     complete: boolean;
 }
-/** Revoke-all result. Idempotent: revoking with no sessions is `revoked: 0`, not an error. */
+/**
+ * Revoke-all result. Idempotent: revoking with no sessions is `revoked: 0`, not an error.
+ *
+ * ⚠️ A 200 always carries `complete: true`. A sweep that did not finish answers
+ * `502 REVOKE_INCOMPLETE` with this same `{ revoked, failed, complete: false }`
+ * beside `error` — some of the user's sessions may still be live, so branch on
+ * the STATUS. A retry is safe and finishes a sweep a failed write or a racing
+ * rotation cut short, but it reads from the top again and is not guaranteed to
+ * finish.
+ */
 export interface TenantUserSessionsRevokeResponse {
     revoked: number;
     failed: number;

package/dist/rma.d.ts

@@ -70,23 +70,36 @@ declare global {
         /**
          * The order's customer. Present so an operator can find the RMA by
          * customer; a walk-in order's synthetic system customer is a legal value.
+         * ABSENT when the order carries no `customerId` (a legacy order) — never
+         * `''`, which DynamoDB refuses as a `PK-customerId` index key.
+         *
+         * Optional, and it has to be: `Order.customerId` is itself optional, the
+         * row cannot store an empty string, and a `''` synthesised at read time
+         * would be a customer id that names nobody in a `string` slot — the
+         * failure `Order.customerId` documents. Refusing the return instead would
+         * leave every legacy order un-returnable.
          */
-        customerId: string;
+        customerId?: string;
         status: RmaStatus;
         items: RmaItem[];
         /** Operator who entered the request — typically off a phone call. */
         requestedBy: string;
         requestedAt: number;
-        /** Free text from the customer, relayed by the operator. Bounded. */
+        /**
+         * Free text from the customer, relayed by the operator. Bounded. Not
+         * written for a customer whose data was erased, and REMOVEd from the row
+         * by an erasure (Ley 25.326 art. 16).
+         */
         requestReason?: string;
         authorizedBy?: string;
         authorizedAt?: number;
         rejectedBy?: string;
         rejectedAt?: number;
         /**
-         * Required on `rejected` — enforced by the handler, not by this type.
-         * Optional here because it is absent on every other status, and a
-         * required field would make the union unrepresentable.
+         * Required in the reject REQUEST (`RmaRejectInput`), not on the row: a
+         * `rejected` RMA carries it unless its customer's data was erased — it is
+         * not written for an already-erased customer, and an erasure REMOVEs it
+         * (Ley 25.326 art. 16). Absent on every other status.
          */
         rejectionReason?: string;
         receivedAt?: number;

package/dist/userActivity.d.ts

@@ -1207,6 +1207,13 @@ declare global {
         event: 'User Sessions Revoked';
         target_user_id: string;
         revoked_count: number;
+        /**
+         * Whether the sweep FINISHED: its last read of the target's sessions found
+         * none left to end. `false` means some may still be live — the operator was
+         * answered `502 REVOKE_INCOMPLETE`. Absent on rows written before it was
+         * recorded.
+         */
+        complete?: boolean;
     }
     /**
      * A staff user was REMOVED by anonymising their row in place

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sinfactura-types",
-	"version": "1.10.509",
+	"version": "1.10.511",
 	"description": "Shared wire and entity contracts for the SINFACTURA platform.",
 	"type": "module",
 	"main": "dist/index.js",