sinfactura-types 1.10.577 → 1.10.579

package/dist/auth.d.ts

@@ -12,8 +12,7 @@ declare global {
          * ignored. Treated as ABSENT while the server's `PASSKEY_STEP_UP` flag is
          * off, so a client ahead of the flag gets `REQUIRES_2FA` again, never a
          * wrong-code refusal. Operator `mode: 'login'` only — the storefront
-         * customer login and the Cloud Print `mode: 'printer'` login read the
-         * same body type but do not accept it.
+         * customer login reads the same body type but does not accept it.
          */
         passkeyAssertion?: PasskeyAssertion;
         /** reCAPTCHA v3 token — required only after a `CAPTCHA_REQUIRED` login rejection; otherwise omit. */
@@ -522,8 +521,8 @@ declare global {
      *   on. ⚠️ A property of the DOOR, not of the account, which is what makes it
      *   different from `disabled`: the same row may be refused here and sign in
      *   successfully at another mode, so it must never be rendered as "this
-     *   account is blocked". Emitted by `login`, `social`, `magic-link-verify`
-     *   and `printer`.
+     *   account is blocked". Emitted by `login`, `social` and
+     *   `magic-link-verify`.
      */
     type LoginOutcome = 'success' | 'wrong_password' | 'disabled' | 'blocked' | 'requires_2fa' | 'wrong_totp' | 'totp_replay' | 'wrong_passkey' | 'totp_locked' | 'enrollment_required'
     /**
@@ -970,10 +969,10 @@ declare global {
         /** The session making this very request. Exactly one row carries `true`. */
         current: boolean;
         /**
-         * Device class, present only for non-browser sessions — today the Cloud
-         * Print agent. Descriptive only; it exempts nothing from revocation, but it
-         * lets a client warn that ending this session (or a blanket revoke-others)
-         * also stops printing.
+         * @deprecated Never written. It once marked a Cloud Print agent's
+         * password-login session; print agents now pair instead of logging in as a
+         * user, so the api no longer sets it. Kept so a consumer that
+         * still reads `client === 'printer'` compiles — the test is simply never true.
          */
         client?: 'printer';
     }
@@ -1362,25 +1361,12 @@ export type RefreshErrorCode = (typeof REFRESH_ERROR_CODES)[number];
  *   there is nothing to re-submit: no code the user can type will satisfy it, so
  *   a client that renders the six-digit prompt for this member builds a dead
  *   end. The only move that succeeds is enrolment. Emitted by
- *   `auth/helpers/mandatory2fa.ts` from its three opt-in callers — `_login.ts`,
- *   `_social.ts` and `_printer.ts`. ⚠️ On the `_printer.ts` leg the remedy is
- *   NOT enrolment: that mode reaches the code only for an account holding a
- *   PRINTER role *and* an operator role, and enrolling then earns
- *   `TWO_FA_NOT_SUPPORTED` instead. Show `body.message`, which names the real
- *   fix (a PRINTER-only service user), rather than a generic enrol prompt.
+ *   `auth/helpers/mandatory2fa.ts` from its opt-in callers — `_login.ts`,
+ *   `_social.ts`, `_refresh.ts` and `terminal/_activation.ts`.
  *   ⚠️ NOT emitted from `_magicLinkVerify.ts`, `_verifyPassword.ts` or
  *   `impersonation/_post.ts` — those three deliberately do not opt in, so the
  *   mandate cannot brick account recovery or incident response.
  *
- * ⚠️ `ENROLLMENT_REQUIRED` is spelled exactly that, with no `PRINTER` substring —
- * however natural a surface-prefixed sibling looks, and this constrains any future
- * rename too. A released Cloud Print agent substring-matches on `PRINTER` in the
- * error code for an unrelated client-side condition; api `_printer.ts:196-198`
- * documents this, and it is why the code emitted there is `TWO_FA_NOT_SUPPORTED`
- * rather than anything clearer. A `PRINTER_ENROLLMENT_REQUIRED` would silently trip
- * that branch in every deployed agent, and the failure would surface in the agent,
- * never in our logs.
- *
  * The GRACE-window half of the same obligation is not an error at all — the login
  * succeeds and the body carries `AuthUser.mustEnroll2fa` / `enrollBy`.
  */
@@ -1440,8 +1426,7 @@ export declare const LOGIN_ERROR_CODES: readonly ["WRONG_CREDENTIALS", "ACCOUNT_
  *
  * ⚠️ `ENROLLMENT_REQUIRED` is not here: it belongs to `STEP_UP_ERROR_CODES`,
  * because the second factor did not FAIL — there is no factor to fail yet. See
- * that tuple for it, and for the `PRINTER`-substring hazard that constrains how
- * it may be spelled.
+ * that tuple for it.
  */
 export declare const LOGIN_2FA_ERROR_CODES: readonly ["INVALID_2FA_CODE", "2FA_LOCKED"];
 export type Login2faErrorCode = (typeof LOGIN_2FA_ERROR_CODES)[number];

package/dist/auth.js

@@ -193,25 +193,12 @@ export const REFRESH_ERROR_CODES = [
  *   there is nothing to re-submit: no code the user can type will satisfy it, so
  *   a client that renders the six-digit prompt for this member builds a dead
  *   end. The only move that succeeds is enrolment. Emitted by
- *   `auth/helpers/mandatory2fa.ts` from its three opt-in callers — `_login.ts`,
- *   `_social.ts` and `_printer.ts`. ⚠️ On the `_printer.ts` leg the remedy is
- *   NOT enrolment: that mode reaches the code only for an account holding a
- *   PRINTER role *and* an operator role, and enrolling then earns
- *   `TWO_FA_NOT_SUPPORTED` instead. Show `body.message`, which names the real
- *   fix (a PRINTER-only service user), rather than a generic enrol prompt.
+ *   `auth/helpers/mandatory2fa.ts` from its opt-in callers — `_login.ts`,
+ *   `_social.ts`, `_refresh.ts` and `terminal/_activation.ts`.
  *   ⚠️ NOT emitted from `_magicLinkVerify.ts`, `_verifyPassword.ts` or
  *   `impersonation/_post.ts` — those three deliberately do not opt in, so the
  *   mandate cannot brick account recovery or incident response.
  *
- * ⚠️ `ENROLLMENT_REQUIRED` is spelled exactly that, with no `PRINTER` substring —
- * however natural a surface-prefixed sibling looks, and this constrains any future
- * rename too. A released Cloud Print agent substring-matches on `PRINTER` in the
- * error code for an unrelated client-side condition; api `_printer.ts:196-198`
- * documents this, and it is why the code emitted there is `TWO_FA_NOT_SUPPORTED`
- * rather than anything clearer. A `PRINTER_ENROLLMENT_REQUIRED` would silently trip
- * that branch in every deployed agent, and the failure would surface in the agent,
- * never in our logs.
- *
  * The GRACE-window half of the same obligation is not an error at all — the login
  * succeeds and the body carries `AuthUser.mustEnroll2fa` / `enrollBy`.
  */
@@ -279,8 +266,7 @@ export const LOGIN_ERROR_CODES = [
  *
  * ⚠️ `ENROLLMENT_REQUIRED` is not here: it belongs to `STEP_UP_ERROR_CODES`,
  * because the second factor did not FAIL — there is no factor to fail yet. See
- * that tuple for it, and for the `PRINTER`-substring hazard that constrains how
- * it may be spelled.
+ * that tuple for it.
  */
 export const LOGIN_2FA_ERROR_CODES = ['INVALID_2FA_CODE', '2FA_LOCKED'];
 /**

package/dist/cjs/auth.js

@@ -196,25 +196,12 @@ exports.REFRESH_ERROR_CODES = [
  *   there is nothing to re-submit: no code the user can type will satisfy it, so
  *   a client that renders the six-digit prompt for this member builds a dead
  *   end. The only move that succeeds is enrolment. Emitted by
- *   `auth/helpers/mandatory2fa.ts` from its three opt-in callers — `_login.ts`,
- *   `_social.ts` and `_printer.ts`. ⚠️ On the `_printer.ts` leg the remedy is
- *   NOT enrolment: that mode reaches the code only for an account holding a
- *   PRINTER role *and* an operator role, and enrolling then earns
- *   `TWO_FA_NOT_SUPPORTED` instead. Show `body.message`, which names the real
- *   fix (a PRINTER-only service user), rather than a generic enrol prompt.
+ *   `auth/helpers/mandatory2fa.ts` from its opt-in callers — `_login.ts`,
+ *   `_social.ts`, `_refresh.ts` and `terminal/_activation.ts`.
  *   ⚠️ NOT emitted from `_magicLinkVerify.ts`, `_verifyPassword.ts` or
  *   `impersonation/_post.ts` — those three deliberately do not opt in, so the
  *   mandate cannot brick account recovery or incident response.
  *
- * ⚠️ `ENROLLMENT_REQUIRED` is spelled exactly that, with no `PRINTER` substring —
- * however natural a surface-prefixed sibling looks, and this constrains any future
- * rename too. A released Cloud Print agent substring-matches on `PRINTER` in the
- * error code for an unrelated client-side condition; api `_printer.ts:196-198`
- * documents this, and it is why the code emitted there is `TWO_FA_NOT_SUPPORTED`
- * rather than anything clearer. A `PRINTER_ENROLLMENT_REQUIRED` would silently trip
- * that branch in every deployed agent, and the failure would surface in the agent,
- * never in our logs.
- *
  * The GRACE-window half of the same obligation is not an error at all — the login
  * succeeds and the body carries `AuthUser.mustEnroll2fa` / `enrollBy`.
  */
@@ -282,8 +269,7 @@ exports.LOGIN_ERROR_CODES = [
  *
  * ⚠️ `ENROLLMENT_REQUIRED` is not here: it belongs to `STEP_UP_ERROR_CODES`,
  * because the second factor did not FAIL — there is no factor to fail yet. See
- * that tuple for it, and for the `PRINTER`-substring hazard that constrains how
- * it may be spelled.
+ * that tuple for it.
  */
 exports.LOGIN_2FA_ERROR_CODES = ['INVALID_2FA_CODE', '2FA_LOCKED'];
 /**

package/dist/cjs/kitRecipe.js

@@ -12,19 +12,25 @@
  * the sale consumes the recipe's components from stock, and the line freezes the
  * recipe it consumed (`OrderLine.kit`). Cancelling or returning that line gives
  * back exactly the frozen components, whatever the recipe says later. Every
- * other channel (storefront, service, marketplace, quote conversion) refuses an
- * active kit with the shared `409 PRODUCT_NOT_AVAILABLE`, with stock control on
- * or off, and it cannot be linked to or reactivated on MercadoLibre. Retiring
- * the recipe makes it an ordinary product again.
+ * other channel (service, marketplace, quote conversion) refuses an active kit
+ * with the shared `409 PRODUCT_NOT_AVAILABLE`, with stock control on or off,
+ * and it cannot be linked to or reactivated on MercadoLibre. Retiring the
+ * recipe makes it an ordinary product again.
+ *
+ * A shopper never sees the recipe: the storefront reads `Product.isKit` and the
+ * kit's `stock`, which the shopper projection derives from its components.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KIT_COMPONENT_MAX_QUANTITY = exports.KIT_RECIPE_MAX_COMPONENTS = exports.KIT_SALE_CHANNELS = void 0;
 /**
- * The channels that sell a kit by consuming its components. Only the counter
- * (the operator basket and `POST /orders`, which the app's POS and the mobile
- * app share) does today.
+ * The channels that sell a kit by consuming its components:
+ *
+ * - `counter` — the operator basket and `POST /orders`, which the app's POS and
+ *   the mobile app share;
+ * - `storefront` — the shopper cart and the web checkout. Its WhatsApp catalogue
+ *   and order drafts still leave kits out.
  */
-exports.KIT_SALE_CHANNELS = ['counter'];
+exports.KIT_SALE_CHANNELS = ['counter', 'storefront'];
 /**
  * Most components one recipe names. A save commits the kit, its new revision and
  * every component's usage row in ONE transaction, so this is bounded by

package/dist/cjs/order.js

@@ -251,9 +251,12 @@ exports.orderFulfilmentProgress = orderFulfilmentProgress;
  *   `mode: 'deposit-refund'`, see `OrderDepositRefundRequest`. Nothing was
  *   written. `DEPOSIT_ALREADY_REFUNDED`'s `data` carries
  *   `OrderDepositRefundManualData` when the refund on the ledger was non-cash.
- * - `KIT_RECIPE_CHANGED` · 409 — a counter sale of a kit whose recipe was
- *   saved again or retired after the sale read it; `productIds` names the kits.
- *   Nothing was written; re-read the basket and retry.
+ * - `KIT_RECIPE_CHANGED` · 409 — a sale of a kit (counter or storefront
+ *   checkout) whose recipe was saved again or retired after the sale read it;
+ *   `data.productIds` names the kits. Nothing was written; re-read the cart and
+ *   retry. On the storefront a recipe that moved before the sale read it is
+ *   refused before the coupon is redeemed, while one saved as the order commits
+ *   is refused after it, like every other refusal at commit.
  * - `ORDER_HAS_KIT_LINES` · 409 — `mode: 'edit'` on an order holding a kit line
  *   (`CartLine.kit`). Cancel or return the order instead. Nothing was written.
  *

package/dist/cjs/roles.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.USER_ROLES = void 0;
+exports.PRINT_AGENT_ROLE = exports.USER_ROLES = void 0;
 /**
  * The staff role vocabulary — the single published source of truth for what
  * may appear in `User.roles`.
@@ -15,9 +15,8 @@ exports.USER_ROLES = void 0;
  *
  * ⚠️ **`User.roles` is a delimited STRING, not one of these.** The wire shape
  * is a space- or comma-separated list, so a claim can legitimately carry more
- * than one token (`'USER PRINTER'` is real and load-bearing — a Cloud Print
- * agent whose backing user also operates the till). This tuple types the
- * TOKENS, never the whole attribute. Split before comparing, and compare
+ * than one token (`'USER ADMIN'`). This tuple types the TOKENS, never the
+ * whole attribute. Split before comparing, and compare
  * exact tokens: a bare `String#includes` is a SUBSTRING test, so a future
  * `MANAGER_READONLY` would silently satisfy a `MANAGER` gate.
  *
@@ -28,14 +27,18 @@ exports.USER_ROLES = void 0;
  * to this vocabulary would let a customer role be *assigned to staff*, which
  * no gate anywhere expects.
  *
+ * ⚠️ **`PRINTER` is not here either — it is not a person's role.** It is the
+ * machine marker a PAIRED Cloud Print agent's token carries
+ * (`PRINT_AGENT_ROLE` below), and no `User` row may hold it: every login door
+ * refuses a row that does, and every gate refuses a `PRINTER` token that does
+ * not also carry the agent's `printAgentId` claim.
+ *
  * ⚠️ **Order is not precedence.** This is the assignable set, listed
  * least-privileged first for readability. Audit attribution uses its own
- * priority order in which `PRINTER` outranks every operator role — the
- * machine identity has to win attribution because it already wins the
- * authorization decision. Do not derive one from the other.
+ * priority order. Do not derive one from the other.
  */
 /*
- * ⚠️ **`ACCOUNTANT` is a RESTRICTED role, like `PRINTER` — not a rung on a ladder.**
+ * ⚠️ **`ACCOUNTANT` is a RESTRICTED role — not a rung on a ladder.**
  * It is the tenant's accountant: a read-only fiscal login that reaches the
  * fiscal-book report modes (`invoices`, `supplier-invoices`, `libro-iva-digital`,
  * `iva-simple-apertura`) and the `GET /invoices` reads, and is refused
@@ -44,4 +47,10 @@ exports.USER_ROLES = void 0;
  * separately. Unrelated to the reserved `UserPermissions.accountant` capability
  * key, which nothing reads.
  */
-exports.USER_ROLES = ['USER', 'ADMIN', 'SUPERVISOR', 'MANAGER', 'PRINTER', 'ACCOUNTANT'];
+exports.USER_ROLES = ['USER', 'ADMIN', 'SUPERVISOR', 'MANAGER', 'ACCOUNTANT'];
+/**
+ * The role a paired Cloud Print agent's session token carries — a machine
+ * marker, never a person's role. Minted only by `POST
+ * /terminal/print-agents/session`, always beside a `printAgentId` claim.
+ */
+exports.PRINT_AGENT_ROLE = 'PRINTER';

package/dist/cjs/terminal.js

@@ -137,8 +137,9 @@ exports.TERMINAL_PAIRING_KINDS = ['terminal', 'print-agent'];
  * - `PRINT_AGENT_NOT_FOUND` · 404 — revoke: no such agent in the caller's
  *   store (another store's agent answers the same).
  * - `AGENT_ID_BOUND` · 409 — pair: the install `agentId` is bound to a live
- *   paired agent or a PRINTER user and the code was not minted to replace it
- *   (`replacesAgentId`), or it is bound and the code was minted to replace a
+ *   paired agent and the code was not minted to replace it (`replacesAgentId`);
+ *   a binding left by a pre-pairing PRINTER user holds the id for nobody, so a
+ *   normal code rebinds it. Or it is bound and the code was minted to replace a
  *   DIFFERENT id, or its binding changed during the pairing. Nothing is
  *   consumed.
  */

package/dist/cjs/user.js

@@ -6,9 +6,10 @@ exports.USER_DIRECTORY_KEYS = void 0;
  * below-admin reader of the store's staff list receives instead of the row.
  *
  * ⚠️ An ALLOW-LIST, and the whole point. Name a colleague, tell a disabled or
- * print-agent account apart — that is what a picker, a "finalised by" label or
- * a technician filter needs. Contact data (`email`, `phone`), `permissions`,
- * `notifications`, `totp` and every key added to `User` later are OUT until
+ * legacy PRINTER row (a pre-pairing print-agent user, a non-person) apart —
+ * that is what a picker, a "finalised by" label or a technician filter needs.
+ * Contact data (`email`, `phone`), `permissions`, `notifications`, `totp` and
+ * every key added to `User` later are OUT until
  * someone adds them here, deliberately. Data minimisation (Ley 25.326): a
  * cashier has no need for a colleague's address.
  *

package/dist/kitRecipe.d.ts

@@ -11,17 +11,23 @@
  * the sale consumes the recipe's components from stock, and the line freezes the
  * recipe it consumed (`OrderLine.kit`). Cancelling or returning that line gives
  * back exactly the frozen components, whatever the recipe says later. Every
- * other channel (storefront, service, marketplace, quote conversion) refuses an
- * active kit with the shared `409 PRODUCT_NOT_AVAILABLE`, with stock control on
- * or off, and it cannot be linked to or reactivated on MercadoLibre. Retiring
- * the recipe makes it an ordinary product again.
+ * other channel (service, marketplace, quote conversion) refuses an active kit
+ * with the shared `409 PRODUCT_NOT_AVAILABLE`, with stock control on or off,
+ * and it cannot be linked to or reactivated on MercadoLibre. Retiring the
+ * recipe makes it an ordinary product again.
+ *
+ * A shopper never sees the recipe: the storefront reads `Product.isKit` and the
+ * kit's `stock`, which the shopper projection derives from its components.
  */
 /**
- * The channels that sell a kit by consuming its components. Only the counter
- * (the operator basket and `POST /orders`, which the app's POS and the mobile
- * app share) does today.
+ * The channels that sell a kit by consuming its components:
+ *
+ * - `counter` — the operator basket and `POST /orders`, which the app's POS and
+ *   the mobile app share;
+ * - `storefront` — the shopper cart and the web checkout. Its WhatsApp catalogue
+ *   and order drafts still leave kits out.
  */
-export declare const KIT_SALE_CHANNELS: readonly ["counter"];
+export declare const KIT_SALE_CHANNELS: readonly ["counter", "storefront"];
 /**
  * Most components one recipe names. A save commits the kit, its new revision and
  * every component's usage row in ONE transaction, so this is bounded by

package/dist/kitRecipe.js

@@ -11,17 +11,23 @@
  * the sale consumes the recipe's components from stock, and the line freezes the
  * recipe it consumed (`OrderLine.kit`). Cancelling or returning that line gives
  * back exactly the frozen components, whatever the recipe says later. Every
- * other channel (storefront, service, marketplace, quote conversion) refuses an
- * active kit with the shared `409 PRODUCT_NOT_AVAILABLE`, with stock control on
- * or off, and it cannot be linked to or reactivated on MercadoLibre. Retiring
- * the recipe makes it an ordinary product again.
+ * other channel (service, marketplace, quote conversion) refuses an active kit
+ * with the shared `409 PRODUCT_NOT_AVAILABLE`, with stock control on or off,
+ * and it cannot be linked to or reactivated on MercadoLibre. Retiring the
+ * recipe makes it an ordinary product again.
+ *
+ * A shopper never sees the recipe: the storefront reads `Product.isKit` and the
+ * kit's `stock`, which the shopper projection derives from its components.
  */
 /**
- * The channels that sell a kit by consuming its components. Only the counter
- * (the operator basket and `POST /orders`, which the app's POS and the mobile
- * app share) does today.
+ * The channels that sell a kit by consuming its components:
+ *
+ * - `counter` — the operator basket and `POST /orders`, which the app's POS and
+ *   the mobile app share;
+ * - `storefront` — the shopper cart and the web checkout. Its WhatsApp catalogue
+ *   and order drafts still leave kits out.
  */
-export const KIT_SALE_CHANNELS = ['counter'];
+export const KIT_SALE_CHANNELS = ['counter', 'storefront'];
 /**
  * Most components one recipe names. A save commits the kit, its new revision and
  * every component's usage row in ONE transaction, so this is bounded by

package/dist/order.d.ts

@@ -2082,7 +2082,14 @@ declare global {
             province: string;
         };
     }
-    /** One product a sale asked for more of than is on hand. */
+    /**
+     * One product a sale asked for more of than is on hand.
+     *
+     * On the operator surfaces a kit's short component is named itself. The
+     * storefront checkout never names a component: it reports the KIT, with
+     * `requested` the kit units ordered and `available` the kit units the short
+     * components still make.
+     */
     interface StockShortfall {
         productId: string;
         requested: number;
@@ -2305,9 +2312,12 @@ export declare const orderFulfilmentProgress: (order: OrderFulfilmentProgressInp
  *   `mode: 'deposit-refund'`, see `OrderDepositRefundRequest`. Nothing was
  *   written. `DEPOSIT_ALREADY_REFUNDED`'s `data` carries
  *   `OrderDepositRefundManualData` when the refund on the ledger was non-cash.
- * - `KIT_RECIPE_CHANGED` · 409 — a counter sale of a kit whose recipe was
- *   saved again or retired after the sale read it; `productIds` names the kits.
- *   Nothing was written; re-read the basket and retry.
+ * - `KIT_RECIPE_CHANGED` · 409 — a sale of a kit (counter or storefront
+ *   checkout) whose recipe was saved again or retired after the sale read it;
+ *   `data.productIds` names the kits. Nothing was written; re-read the cart and
+ *   retry. On the storefront a recipe that moved before the sale read it is
+ *   refused before the coupon is redeemed, while one saved as the order commits
+ *   is refused after it, like every other refusal at commit.
  * - `ORDER_HAS_KIT_LINES` · 409 — `mode: 'edit'` on an order holding a kit line
  *   (`CartLine.kit`). Cancel or return the order instead. Nothing was written.
  *

package/dist/order.js

@@ -244,9 +244,12 @@ export const orderFulfilmentProgress = (order) => {
  *   `mode: 'deposit-refund'`, see `OrderDepositRefundRequest`. Nothing was
  *   written. `DEPOSIT_ALREADY_REFUNDED`'s `data` carries
  *   `OrderDepositRefundManualData` when the refund on the ledger was non-cash.
- * - `KIT_RECIPE_CHANGED` · 409 — a counter sale of a kit whose recipe was
- *   saved again or retired after the sale read it; `productIds` names the kits.
- *   Nothing was written; re-read the basket and retry.
+ * - `KIT_RECIPE_CHANGED` · 409 — a sale of a kit (counter or storefront
+ *   checkout) whose recipe was saved again or retired after the sale read it;
+ *   `data.productIds` names the kits. Nothing was written; re-read the cart and
+ *   retry. On the storefront a recipe that moved before the sale read it is
+ *   refused before the coupon is redeemed, while one saved as the order commits
+ *   is refused after it, like every other refusal at commit.
  * - `ORDER_HAS_KIT_LINES` · 409 — `mode: 'edit'` on an order holding a kit line
  *   (`CartLine.kit`). Cancel or return the order instead. Nothing was written.
  *

package/dist/product.d.ts

@@ -680,6 +680,22 @@ declare global {
          * never in a shopper projection.
          */
         kitRecipe?: ProductKitRecipePointer;
+        /**
+         * SHOPPER PROJECTION ONLY, derived and never stored: `true` while
+         * `kitRecipe` is active. The recipe itself never reaches a shopper.
+         *
+         * On a kit, the shopper projection's `stock` is the kit units its
+         * components make right now — the smallest `floor(component stock ÷ units
+         * per kit)`, a missing component reading `0`, from the online depósito on
+         * a store booking stock per depósito — never the kit row's own figure,
+         * which no sale moves. A frame announcing a component's stock does not
+         * re-announce the kits using it, so the figure can lag until the next read;
+         * the checkout judges the components themselves.
+         *
+         * Present only on a payload that carries the kit pointer: a partial frame
+         * without it says nothing about whether the product is a kit.
+         */
+        isKit?: boolean;
         model?: string;
         seoTitle?: string;
         seoDescription?: string;

package/dist/roles.d.ts

@@ -12,9 +12,8 @@
  *
  * ⚠️ **`User.roles` is a delimited STRING, not one of these.** The wire shape
  * is a space- or comma-separated list, so a claim can legitimately carry more
- * than one token (`'USER PRINTER'` is real and load-bearing — a Cloud Print
- * agent whose backing user also operates the till). This tuple types the
- * TOKENS, never the whole attribute. Split before comparing, and compare
+ * than one token (`'USER ADMIN'`). This tuple types the TOKENS, never the
+ * whole attribute. Split before comparing, and compare
  * exact tokens: a bare `String#includes` is a SUBSTRING test, so a future
  * `MANAGER_READONLY` would silently satisfy a `MANAGER` gate.
  *
@@ -25,20 +24,31 @@
  * to this vocabulary would let a customer role be *assigned to staff*, which
  * no gate anywhere expects.
  *
+ * ⚠️ **`PRINTER` is not here either — it is not a person's role.** It is the
+ * machine marker a PAIRED Cloud Print agent's token carries
+ * (`PRINT_AGENT_ROLE` below), and no `User` row may hold it: every login door
+ * refuses a row that does, and every gate refuses a `PRINTER` token that does
+ * not also carry the agent's `printAgentId` claim.
+ *
  * ⚠️ **Order is not precedence.** This is the assignable set, listed
  * least-privileged first for readability. Audit attribution uses its own
- * priority order in which `PRINTER` outranks every operator role — the
- * machine identity has to win attribution because it already wins the
- * authorization decision. Do not derive one from the other.
+ * priority order. Do not derive one from the other.
  */
-export declare const USER_ROLES: readonly ["USER", "ADMIN", "SUPERVISOR", "MANAGER", "PRINTER", "ACCOUNTANT"];
+export declare const USER_ROLES: readonly ["USER", "ADMIN", "SUPERVISOR", "MANAGER", "ACCOUNTANT"];
 /** One assignable staff role token. See `USER_ROLES` for why this is not the shape of `User.roles`. */
 export type UserRole = (typeof USER_ROLES)[number];
 /**
- * Every role string an authenticated principal can present, staff or shopper.
+ * The role a paired Cloud Print agent's session token carries — a machine
+ * marker, never a person's role. Minted only by `POST
+ * /terminal/print-agents/session`, always beside a `printAgentId` claim.
+ */
+export declare const PRINT_AGENT_ROLE: "PRINTER";
+/**
+ * Every role string an authenticated principal can present: staff, the paired
+ * print agent or a shopper.
  *
- * `CUSTOMER` is included here and excluded from `USER_ROLES` on purpose: a
- * reader that classifies an incoming token needs it, and a writer that
- * assigns a staff role must not.
+ * `PRINTER` and `CUSTOMER` are included here and excluded from `USER_ROLES` on
+ * purpose: a reader that classifies an incoming token needs them, and a writer
+ * that assigns a staff role must not.
  */
-export type PrincipalRole = UserRole | 'CUSTOMER';
+export type PrincipalRole = UserRole | typeof PRINT_AGENT_ROLE | 'CUSTOMER';

package/dist/roles.js

@@ -12,9 +12,8 @@
  *
  * ⚠️ **`User.roles` is a delimited STRING, not one of these.** The wire shape
  * is a space- or comma-separated list, so a claim can legitimately carry more
- * than one token (`'USER PRINTER'` is real and load-bearing — a Cloud Print
- * agent whose backing user also operates the till). This tuple types the
- * TOKENS, never the whole attribute. Split before comparing, and compare
+ * than one token (`'USER ADMIN'`). This tuple types the TOKENS, never the
+ * whole attribute. Split before comparing, and compare
  * exact tokens: a bare `String#includes` is a SUBSTRING test, so a future
  * `MANAGER_READONLY` would silently satisfy a `MANAGER` gate.
  *
@@ -25,14 +24,18 @@
  * to this vocabulary would let a customer role be *assigned to staff*, which
  * no gate anywhere expects.
  *
+ * ⚠️ **`PRINTER` is not here either — it is not a person's role.** It is the
+ * machine marker a PAIRED Cloud Print agent's token carries
+ * (`PRINT_AGENT_ROLE` below), and no `User` row may hold it: every login door
+ * refuses a row that does, and every gate refuses a `PRINTER` token that does
+ * not also carry the agent's `printAgentId` claim.
+ *
  * ⚠️ **Order is not precedence.** This is the assignable set, listed
  * least-privileged first for readability. Audit attribution uses its own
- * priority order in which `PRINTER` outranks every operator role — the
- * machine identity has to win attribution because it already wins the
- * authorization decision. Do not derive one from the other.
+ * priority order. Do not derive one from the other.
  */
 /*
- * ⚠️ **`ACCOUNTANT` is a RESTRICTED role, like `PRINTER` — not a rung on a ladder.**
+ * ⚠️ **`ACCOUNTANT` is a RESTRICTED role — not a rung on a ladder.**
  * It is the tenant's accountant: a read-only fiscal login that reaches the
  * fiscal-book report modes (`invoices`, `supplier-invoices`, `libro-iva-digital`,
  * `iva-simple-apertura`) and the `GET /invoices` reads, and is refused
@@ -41,4 +44,10 @@
  * separately. Unrelated to the reserved `UserPermissions.accountant` capability
  * key, which nothing reads.
  */
-export const USER_ROLES = ['USER', 'ADMIN', 'SUPERVISOR', 'MANAGER', 'PRINTER', 'ACCOUNTANT'];
+export const USER_ROLES = ['USER', 'ADMIN', 'SUPERVISOR', 'MANAGER', 'ACCOUNTANT'];
+/**
+ * The role a paired Cloud Print agent's session token carries — a machine
+ * marker, never a person's role. Minted only by `POST
+ * /terminal/print-agents/session`, always beside a `printAgentId` claim.
+ */
+export const PRINT_AGENT_ROLE = 'PRINTER';

package/dist/terminal.d.ts

@@ -46,8 +46,9 @@ declare global {
          * Must exist, else `404 AGENT_ID_NOT_FOUND` and no code is minted. The
          * agent that redeems the code with this exact `agentId` gets the id; a
          * paired agent that held it is revoked by that pairing. Without it, a
-         * redeem naming an id bound to a LIVE agent or a PRINTER user is refused
-         * `409 AGENT_ID_BOUND`; an id whose binding names a revoked paired agent
+         * redeem naming an id bound to a LIVE paired agent is refused
+         * `409 AGENT_ID_BOUND`; an id whose binding names a revoked paired agent,
+         * or a pre-pairing PRINTER user (no door admits one any more), is free and
          * needs none. Same charset as `PrintAgentPairRequest.agentId`.
          */
         replacesAgentId?: string;
@@ -121,12 +122,12 @@ declare global {
         /**
          * The agent's INSTALL id. Its printers and routing rules are keyed by it.
          * An id nothing holds yet — or one whose binding names a revoked paired
-         * agent, when the code was minted for no install id — is bound to the new
-         * print agent. A code minted with `replacesAgentId` pairs only that id. An
-         * id bound to a LIVE agent or
-         * a PRINTER user moves to it only when the code was minted with that id
-         * as `replacesAgentId` (the admin's decision); otherwise the pair is
-         * refused `409 AGENT_ID_BOUND` and the code stays unconsumed. Omit on a fresh
+         * agent or a pre-pairing PRINTER user, when the code was minted for no
+         * install id — is bound to the new print agent. A code minted with
+         * `replacesAgentId` pairs only that id. An id bound to a LIVE paired agent
+         * moves to it only when the code was minted with that id as
+         * `replacesAgentId` (the admin's decision); otherwise the pair is refused
+         * `409 AGENT_ID_BOUND` and the code stays unconsumed. Omit on a fresh
          * install to bind on first use.
          */
         agentId?: string;
@@ -513,8 +514,9 @@ export type TerminalPairingKind = (typeof TERMINAL_PAIRING_KINDS)[number];
  * - `PRINT_AGENT_NOT_FOUND` · 404 — revoke: no such agent in the caller's
  *   store (another store's agent answers the same).
  * - `AGENT_ID_BOUND` · 409 — pair: the install `agentId` is bound to a live
- *   paired agent or a PRINTER user and the code was not minted to replace it
- *   (`replacesAgentId`), or it is bound and the code was minted to replace a
+ *   paired agent and the code was not minted to replace it (`replacesAgentId`);
+ *   a binding left by a pre-pairing PRINTER user holds the id for nobody, so a
+ *   normal code rebinds it. Or it is bound and the code was minted to replace a
  *   DIFFERENT id, or its binding changed during the pairing. Nothing is
  *   consumed.
  */

package/dist/terminal.js

@@ -134,8 +134,9 @@ export const TERMINAL_PAIRING_KINDS = ['terminal', 'print-agent'];
  * - `PRINT_AGENT_NOT_FOUND` · 404 — revoke: no such agent in the caller's
  *   store (another store's agent answers the same).
  * - `AGENT_ID_BOUND` · 409 — pair: the install `agentId` is bound to a live
- *   paired agent or a PRINTER user and the code was not minted to replace it
- *   (`replacesAgentId`), or it is bound and the code was minted to replace a
+ *   paired agent and the code was not minted to replace it (`replacesAgentId`);
+ *   a binding left by a pre-pairing PRINTER user holds the id for nobody, so a
+ *   normal code rebinds it. Or it is bound and the code was minted to replace a
  *   DIFFERENT id, or its binding changed during the pairing. Nothing is
  *   consumed.
  */

package/dist/user.d.ts

@@ -4,9 +4,10 @@ import type { NotificationTypeEnum } from './notification.ts';
  * below-admin reader of the store's staff list receives instead of the row.
  *
  * ⚠️ An ALLOW-LIST, and the whole point. Name a colleague, tell a disabled or
- * print-agent account apart — that is what a picker, a "finalised by" label or
- * a technician filter needs. Contact data (`email`, `phone`), `permissions`,
- * `notifications`, `totp` and every key added to `User` later are OUT until
+ * legacy PRINTER row (a pre-pairing print-agent user, a non-person) apart —
+ * that is what a picker, a "finalised by" label or a technician filter needs.
+ * Contact data (`email`, `phone`), `permissions`, `notifications`, `totp` and
+ * every key added to `User` later are OUT until
  * someone adds them here, deliberately. Data minimisation (Ley 25.326): a
  * cashier has no need for a colleague's address.
  *
@@ -41,7 +42,8 @@ declare global {
      * fallback; never assume a name.
      *
      * Read `roles` with exact-token matching, as on `User.roles` — it is how a
-     * picker leaves out a print-agent account.
+     * picker leaves out a legacy PRINTER row (a pre-pairing print-agent user
+     * that can no longer log in).
      */
     type UserDirectoryEntry = Pick<User, Exclude<UserDirectoryKey, 'fullName'>> & Partial<Pick<User, 'fullName'>>;
     /**
@@ -101,9 +103,12 @@ declare global {
          * Always read `roles`; never the alias.
          *
          * ⚠️ A space- or comma-DELIMITED list, not a single role — a claim can
-         * legitimately carry more than one token (`'USER PRINTER'` is real: a
-         * Cloud Print agent whose backing user also operates the till). Every
-         * token must be a member of the published `USER_ROLES` tuple; split and
+         * legitimately carry more than one token (`'USER ADMIN'`). Every token a
+         * write can GRANT today is a member of the published `USER_ROLES` tuple. A
+         * LEGACY row may still carry `PRINTER` — a pre-pairing print-agent user that
+         * every login door now refuses, which an edit preserves but never grants.
+         * Treat it as a non-person, never as a print agent (those are paired, not
+         * users). Split and
          * compare EXACT tokens, never `String#includes`, which is a substring
          * test that would let a future `MANAGER_READONLY` satisfy a `MANAGER`
          * gate. It stays typed `string` rather than ```${UserRole}``` because

package/dist/user.js

@@ -3,9 +3,10 @@
  * below-admin reader of the store's staff list receives instead of the row.
  *
  * ⚠️ An ALLOW-LIST, and the whole point. Name a colleague, tell a disabled or
- * print-agent account apart — that is what a picker, a "finalised by" label or
- * a technician filter needs. Contact data (`email`, `phone`), `permissions`,
- * `notifications`, `totp` and every key added to `User` later are OUT until
+ * legacy PRINTER row (a pre-pairing print-agent user, a non-person) apart —
+ * that is what a picker, a "finalised by" label or a technician filter needs.
+ * Contact data (`email`, `phone`), `permissions`, `notifications`, `totp` and
+ * every key added to `User` later are OUT until
  * someone adds them here, deliberately. Data minimisation (Ley 25.326): a
  * cashier has no need for a colleague's address.
  *

package/dist/userActivity.d.ts

@@ -1303,7 +1303,7 @@ declare global {
         agent_id?: string;
         /**
          * The binding this pairing replaced, as stored — the raw `boundUserId`,
-         * NOT a bare user id: `{storeId}#USR…` for a PRINTER user, or
+         * NOT a bare user id: `{storeId}#USR…` for a pre-pairing PRINTER user (legacy rows only), or
          * `{storeId}#PAG…` for a paired agent — one this pairing revoked (a
          * sibling `Print Agent Revoked` row), or, with `rebind_via: 'dead-agent'`,
          * one already revoked or aged out (no sibling row). Absent on a fresh
@@ -1313,8 +1313,9 @@ declare global {
         /**
          * Why a bound install id moved, beside `previous_bound_user_id`:
          * `'replaces-agent-id'` — the code's minting admin named it;
-         * `'dead-agent'` — the binding named a revoked (or aged-out) paired
-         * agent, which holds the id for nobody, so no admin named it.
+         * `'dead-agent'` — the binding held the id for nobody, so no admin named
+         * it: it named a revoked (or aged-out) paired agent, or no paired agent at
+         * all (a pre-pairing PRINTER user's `{storeId}#USR…`).
          */
         rebind_via?: 'replaces-agent-id' | 'dead-agent';
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sinfactura-types",
-	"version": "1.10.577",
+	"version": "1.10.579",
 	"description": "Shared wire and entity contracts for the SINFACTURA platform.",
 	"type": "module",
 	"main": "dist/index.js",