Sync an ERP or accounting system

 ERP or accounting system          Your sync service                    Kentro
                                   (scheduled worker)

 customers, products, costs ---->  POST /v1/customers, /v1/products -->  master data
 vendors                    ---->  POST /v1/vendors  --------------->  vendors
 cash receipts              ---->  POST /v1/payments --------------->  applied to invoices
 sales, invoices, payments  <----  GET /v1/orders, /v1/invoices,  <--  commerce documents
                                   /v1/payments ?updatedSince=...

You are building a sync between Kentro and the user's ERP or accounting system, using the Kentro Channel API. It moves customers, invoices and payments in the directions the user chooses, and keeps both systems consistent without duplicates.

Read first. Fetch https://docs.kentro.io/llms.txt and these pages, and look up every endpoint and schema in them before you use it:
- https://docs.kentro.io/docs/ai-agent-instructions.md (rules you must follow)
- https://docs.kentro.io/reference/channel-api-authentication.md
- https://docs.kentro.io/reference/channel-api-conventions.md
- https://docs.kentro.io/reference/channel-api-flows.md (sections "Invoice and pay separately" and "Keep in sync")
- https://docs.kentro.io/docs/guide-erp-accounting.md

Ask the user for these before writing code:
1. The ERP or accounting system, its API documentation and where its credentials are stored.
2. For each document type (customers, orders, invoices, payments), which system creates it and which system receives it.
3. A Kentro sandbox API key pair from Kentro OS at https://kentro.cc (`Users` > `API keys`) with only the scopes the sync needs: `channel:read` to read from Kentro, and `customers:write`, `invoices:write` and `payments:write` to write into Kentro. Ask the user to store it as KENTRO_KEY and KENTRO_SECRET in the environment, never in the chat.
4. The Kentro sales channel id the documents belong to (GET https://apis.kentro.dev/channel/v1/channels lists them) and the currency.
5. How the ERP's customer, invoice and payment ids map to Kentro externalId values.

Rules:
- Build against https://apis.kentro.dev/channel/v1 and call only the endpoints the Channel API reference documents. There is no Kentro SDK or CLI.
- Send an Idempotency-Key on every write, derived from the ERP document id and version, and reuse it on retries. Send externalId on every create and keep onDuplicate at update.
- Money is decimal strings in currency units with currency. Invoice and payment totals must add up (422 totals_mismatch otherwise). Use decimal arithmetic, never floats.
- Date-only fields such as dueDate take YYYY-MM-DD.
- When several ERP customers share an email address, send X-Customer-Match: externalId so they stay separate Kentro customers.
- A refund is an invoice of type refund plus a payment of type refund, both with positive amounts. A payment Kentro charged itself is refunded in the Kentro portal, not through the API (409 state_conflict with provider_refund_required): report those to the user instead of retrying.
- Retry only 429, 503, 500 and network errors, with backoff that honors Retry-After. Log requestId on every failure.

Steps:
1. Customers: POST /v1/customers as an upsert, or read Kentro's customers with GET /v1/customers?updatedSince=... when Kentro is the source.
2. Invoices: POST /v1/invoices with the order reference, lines, totals and dueDate, or export Kentro's invoices with GET /v1/invoices?updatedSince=....
3. Payments: POST /v1/payments with application.mode auto (oldest open invoices first) or manual with exact invoice amounts; POST /v1/payments/:id/apply applies one later.
4. Incremental export: one watermark per resource; follow nextCursor to null before advancing it.
5. A run report: documents created, updated, unchanged and failed, with the requestId of each failure.

Acceptance checks. Run each one against the sandbox and show the user the requests and responses, with secrets redacted:
- The same customer sent twice answers 201 created, then 200 updated or unchanged.
- An invoice whose totals add up answers 201; a copy with a wrong total answers 422 totals_mismatch, and the sync reports it without retrying.
- A payment with application.mode auto is applied to the open invoice; read it back with GET /v1/payments/:id.
- A write repeated with the same Idempotency-Key answers with Idempotent-Replayed: true.
- An export run picks up a document changed in Kentro since the last watermark, and a second run with no changes writes nothing.
- No secret appears in code, logs or the repository.