sinfactura-types 1.10.520 → 1.10.522

package/dist/customer.d.ts

@@ -593,7 +593,8 @@ declare global {
      | 'CUSTOMER_LEDGER_TRUNCATED'
     /**
      * A concurrent LEDGER write moved `balance` or `eventSeq` between the
-     * erasure's pre-read and its conditional write, so the write cancelled.
+     * erasure's pre-read and its conditional write, so the write cancelled —
+     * or, far rarer, the row's email claim changed owner in that window.
      *
      * ⚠️ **NOTHING was erased, and this is the one refusal that is safe to
      * retry immediately.** It is distinct from `CUSTOMER_ALREADY_ANONYMIZED`
@@ -620,7 +621,80 @@ declare global {
      * The storefront twin answers this code with a generic message that never
      * mentions a merge; the operator surface names it.
      */
-     | 'CUSTOMER_ERASURE_MERGE_IN_PROGRESS';
+     | 'CUSTOMER_ERASURE_MERGE_IN_PROGRESS'
+    /**
+     * The customer was merged into another one, so the erasure must go through
+     * that survivor (see `AnonymizeCustomerResult.erasedCustomerId`), and the
+     * survivor cannot be erased WHOLE. NOTHING was written, on either row.
+     * `data` is `CustomerErasureIncompleteData`; its `erasureIncompleteReason`
+     * says why. A deduped ERROR row (`CUSTOMER_ERASURE_INCOMPLETE`) tells staff,
+     * on both surfaces.
+     */
+     | 'CUSTOMER_ERASURE_INCOMPLETE'
+    /**
+     * 409, STOREFRONT ONLY (`POST /user` mode `anonymize`). The calling
+     * customer's own account was merged away into another one, and the
+     * storefront never erases through a survivor: only staff do, on
+     * `POST /customers` mode `anonymize`. NOTHING was written. `data` is
+     * `CustomerErasureRequiresStaffData` — the caller's own id and nothing else.
+     * One ERROR row (`CUSTOMER_ERASURE_REQUIRES_STAFF`), deduped per customer per
+     * day, tells staff that the customer asked. The client tells the shopper to
+     * contact the shop; retrying cannot succeed.
+     */
+     | 'CUSTOMER_ERASURE_REQUIRES_STAFF';
+    /**
+     * Why an erasure of a merged-away customer was refused as incomplete.
+     *
+     * - `MERGE_CHAIN` — the survivor was itself merged into a third customer (A
+     *   into B, then B into C). Chains are never walked: erase the end of the
+     *   chain by hand.
+     * - `MERGE_SURVIVOR_UNRESOLVED` — the survivor the customer names is gone.
+     * - `MERGE_LOOKUP_TRUNCATED` — NOT a refusal: only on a 200's
+     *   `AnonymizeCustomerResult.erasureIncompleteReason`. The store's customers
+     *   could not be read to the end to rule out a survivor, or a chain past one
+     *   (an erased customer naming no survivor, or a survivor erased before its own
+     *   survivor id was kept). The rows known were erased — the survivor the
+     *   customer's own row names included, when that survivor was already erased.
+     *   Re-issue. ⚠️ The re-issue can erase ANOTHER account whole: when the lookup
+     *   then completes and finds the customer was merged, it goes through that
+     *   survivor. Wins over `MERGED_ROW_NOT_ERASED` when both hold.
+     * - `MERGED_ROW_NOT_ERASED` — NOT a refusal either: the target was erased but
+     *   the erasure of a merged-away row folded into it is unfinished — its write
+     *   failed, the erasure ran out of time before reaching it, or one of its
+     *   completion steps reported incomplete. `incompleteCustomerIds` names the
+     *   rows. Re-issue.
+     */
+    type CustomerErasureIncompleteReason = 'MERGE_CHAIN' | 'MERGE_SURVIVOR_UNRESOLVED' | 'MERGE_LOOKUP_TRUNCATED' | 'MERGED_ROW_NOT_ERASED';
+    /** The reasons a 200 erasure can carry (`AnonymizeCustomerResult.erasureIncompleteReason`). */
+    type CustomerErasureResultIncompleteReason = Extract<CustomerErasureIncompleteReason, 'MERGE_LOOKUP_TRUNCATED' | 'MERGED_ROW_NOT_ERASED'>;
+    /** `data` of a `409 CUSTOMER_ERASURE_INCOMPLETE` refusal, on both erasure surfaces. Ids only. */
+    interface CustomerErasureIncompleteData {
+        /** The id the request named. */
+        customerId: string;
+        erasureIncompleteReason: Exclude<CustomerErasureIncompleteReason, CustomerErasureResultIncompleteReason>;
+    }
+    /** `data` of the storefront's `409 CUSTOMER_ERASURE_REQUIRES_STAFF`: the caller's OWN id, nothing else. */
+    interface CustomerErasureRequiresStaffData {
+        customerId: string;
+    }
+    /**
+     * Extra `data` keys of an OPERATOR erasure refusal (`POST /customers` mode
+     * `anonymize`) that is about ANOTHER row than the one the request named. The
+     * refusal's own keys are unchanged: `customerId` is still the row the refusal
+     * belongs to (whose balance, whose open orders), which on these refusals is
+     * not the customer the operator named. Never on the storefront wire.
+     */
+    interface CustomerErasureRefusalContext {
+        /** The id the request named. Present whenever either key below applies. */
+        requestedCustomerId?: string;
+        /**
+         * The merge survivor the erasure goes through — the account that would be
+         * erased whole. Present only on a redirect (the named customer was merged
+         * away). Absent when the refusal is a merged-away row's, folded into the
+         * customer that was named.
+         */
+        survivorCustomerId?: string;
+    }
     /**
      * Every refusal `POST /customers { mode: 'merge' }` can answer, as the bare
      * SCREAMING_SNAKE `error` code on the wire. Thrown by
@@ -726,10 +800,15 @@ declare global {
      */
     type CustomerBalanceWriteErrorCode = 'CUSTOMER_MERGED'
     /**
-     * `DELETE /payments/{source}/{paymentId}/link` only: the credit row is a
-     * LEGACY row naming no customer, and the payment's customer was erased —
-     * so whether it had been merged first (and where its money went) is no
-     * longer provable. `409`, nothing written; `data` is absent.
+     * `409`, nothing written; `data` is absent. Answered by:
+     * - `DELETE /payments/{source}/{paymentId}/link`: the credit row is a
+     *   LEGACY row naming no customer, and the payment's customer was erased —
+     *   so whether it had been merged first (and where its money went) is no
+     *   longer provable;
+     * - `POST /account`, for a movement that carries the customer's name: the
+     *   customer was erased between the handler's read of the name and its
+     *   write. Re-issue it: the retry reads the erasure and books the movement
+     *   with no name.
      */
      | 'CUSTOMER_ANONYMIZED';
     /**
@@ -1012,9 +1091,55 @@ declare global {
      * row is anonymised in place and KEPT — see `Customer.anonymizedAt`.
      */
     interface AnonymizeCustomerResult {
+        /** The id the request named. */
         customerId: string;
-        /** ms epoch stamped on the row. */
+        /**
+         * The id whose personal data this erasure removed. Equal to `customerId`,
+         * except — on the OPERATOR route only — for a customer that a FINISHED merge
+         * folded into another one: the person's orders, ledger, notes, addresses and
+         * contacts then live on that survivor, so the WHOLE survivor is erased (its
+         * own refusals apply), and `customerId`'s own row with it
+         * (`alsoErasedCustomerIds`). A client must say so FIRST whenever the two
+         * differ, naming this id: another account than the one named was erased. The
+         * storefront never redirects (`CUSTOMER_ERASURE_REQUIRES_STAFF`), so there the
+         * two are always equal. The counts below are summed over every row this
+         * erasure ran, and each `*Complete` flag holds only when it holds for every
+         * one.
+         */
+        erasedCustomerId: string;
+        /**
+         * The merged-away customers a finished merge folded into `erasedCustomerId`
+         * (its `mergedFrom`, followed row by row) whose erasure this call ran: each
+         * is a record of the same person. A row not yet anonymised is anonymised; one
+         * an earlier erasure anonymised has its completion steps re-run, on every
+         * call. On a redirect it includes `customerId` — unless that row's own write
+         * failed (then `incompleteCustomerIds` names it) or a concurrent erasure
+         * took it. Likewise any folded row that failed, was taken by a concurrent
+         * erasure, or was not reached before the erasure ran out of time is NOT
+         * listed. Absent when this erasure ran only `erasedCustomerId`. A client must
+         * name them.
+         */
+        alsoErasedCustomerIds?: string[];
+        /**
+         * The rows whose erasure this call left UNFINISHED: `erasedCustomerId` when
+         * one of its completion steps reported incomplete, and every merged-away row
+         * that failed, was not reached before the erasure ran out of time, or has a
+         * completion step incomplete. Set only on an erasure of more than one row (a
+         * redirect, or a target with merged-away rows) — for a single row the
+         * `*Complete` flags already say whose they are. Absent when every row
+         * finished. Re-issuing the erasure takes them up; the
+         * `CUSTOMER_ERASURE_INCOMPLETE` ERROR row carries the same ids.
+         */
+        incompleteCustomerIds?: string[];
+        /** ms epoch stamped on the row — the erased (survivor's) row when redirected. */
         anonymizedAt: number;
+        /**
+         * Set when this erasure is, or may be, INCOMPLETE as a whole — see
+         * `CustomerErasureIncompleteReason`. A client must say the erasure is not
+         * complete; both handlers write the deduped `CUSTOMER_ERASURE_INCOMPLETE`
+         * ERROR row.
+         */
+        erasureIncompleteReason?: CustomerErasureResultIncompleteReason;
         /**
          * The attribute NAMES removed — names only, never values, so this is
          * safe to return, log and audit. Evidence that the sweep covered a field
@@ -1066,9 +1191,7 @@ declare global {
          * per customer per day, naming the unproven drawer rows by `cashId`;
          * re-issuing the erasure resumes the scrub where it stopped. An unproven
          * row stays reported until it is gone or its `description` is empty or the
-         * movement's motivo alone (an operator's `POST /cash` edit). For a
-         * merged-away customer it also covers the mirrors of the movements the
-         * merge moved to the survivor.
+         * movement's motivo alone (an operator's `POST /cash` edit).
          * Optional only so the field is additive — every erasure from this version
          * on sets it.
          */
@@ -1144,10 +1267,7 @@ declare global {
          * `comment` the same step blanks — could not be read or written to the end,
          * so a row carrying the name or the subject's free text may remain. BOTH
          * erasure handlers write an un-deduped `ERROR` row
-         * (`CUSTOMER_ANONYMIZE_ORDERS_INCOMPLETE`). ALWAYS `false` for a merged-away
-         * customer (`mergedInto`): the merge re-pointed their orders to the survivor
-         * with no provenance to find them by, so only erasing the survivor reaches
-         * those orders' frozen recipient.
+         * (`CUSTOMER_ANONYMIZE_ORDERS_INCOMPLETE`).
          */
         orderScrubComplete: boolean;
     }

package/dist/invoice.d.ts

@@ -157,8 +157,8 @@ declare global {
          * frozen exactly as declared to ARCA rather than re-derived at read time.
          *
          * Stored alongside the array on purpose: `buildTributos` rounds each entry
-         * and then rounds the sum, so a reader summing the array reproduces it, but
-         * only while it uses the same rounding. This is the value ARCA reconciled
+         * and sums the rounded entries, so a reader summing the array reproduces it,
+         * but only while it uses the same rounding. This is the value ARCA reconciled
          * `ImpTotal == ImpTotConc + ImpNeto + ImpOpEx + ImpTrib + ImpIVA` against,
          * and that identity is what makes `total` decomposable.
          *
@@ -179,6 +179,27 @@ declare global {
          * (`stacks/lambdas/reports/_format.ts`'s `ventasPesoFactor`).
          */
         total: number;
+        /**
+         * The rounding rule this voucher's amounts were built under.
+         *
+         * `'decimal'` — every per-unit figure, alícuota bucket and voucher total
+         * rounded to centavos half away from zero on the DECIMAL value (unit 0.35
+         * at 50 % off is 0.18). Written on every Invoice row built under it since
+         * the field shipped — factura, CAEA, `pending_cae`, `rejected`, export, and
+         * a credit note whose factura carries it.
+         *
+         * ABSENT ⇒ the row was built under the LEGACY rule, `Number(x.toFixed(2))`
+         * on the binary double (the same 0.35 at 50 % off is 0.17). Forward-only,
+         * never backfilled: every row written before the field exists is legacy,
+         * and so is a NEW credit note crediting such a factura, which is built
+         * under its factura's rule so it can credit it exactly.
+         *
+         * Read where a voucher is rebuilt or re-rendered rather than read back: a
+         * credit note's economics follow its factura's rule, the pending-CAE drain
+         * rebuilds a row under its own, and the PDF / ESC/POS receipt replay a
+         * line under it.
+         */
+        amountRounding?: 'decimal';
         cae: string;
         caeExpiration: string;
         observations?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sinfactura-types",
-	"version": "1.10.520",
+	"version": "1.10.522",
 	"description": "Shared wire and entity contracts for the SINFACTURA platform.",
 	"type": "module",
 	"main": "dist/index.js",