platform-types 1.10.742 → 1.10.744

package/dist/auth.d.ts

@@ -613,10 +613,9 @@ declare global {
      * no single principal to attribute the row to. Never render "no login
      * attempts" as "nobody tried".
      *
-     * `jti` is the same identifier as `CustomerSession.jti`, so a `success` row
-     * can be joined to the session it created — that is how a customer tells
-     * "this unfamiliar sign-in is the device still listed as live" from "it has
-     * since expired".
+     * No login-history row carries the refresh token id (`jti`) on any surface:
+     * a session handle is published only on the session lists
+     * (`CustomerSession.jti` / `OperatorSession.jti`), whose revoke flows use it.
      */
     interface CustomerLoginAttempt {
         outcome: LoginOutcome;
@@ -629,8 +628,10 @@ declare global {
         /** Client build string, when the caller sent one. */
         clientVersion?: string;
         /**
-         * The refresh token id this attempt minted. Present on `success` rows
-         * only, and joins to `CustomerSession.jti`.
+         * @deprecated Never sent. The row stores the refresh token id a success
+         * minted, but no login-history read publishes it; the session lists carry
+         * the handle a revoke needs. Kept so a consumer that still reads it (as a
+         * React key fallback, say) compiles — it is simply always absent.
          */
         jti?: string;
         /**

package/dist/log.d.ts

@@ -51,8 +51,16 @@ declare global {
         entry: FiscalAuditLogRow;
     }) | (AuditHistoryRowBase & {
         surface: 'loginHistory';
-        entry: Omit<CustomerLoginAttempt, 'ttl'>;
+        entry: AuditHistoryLoginEntry;
     });
+    /**
+     * A `loginHistory` history row's `entry`: the attempt WITHOUT its address, agent or token id.
+     * `GET /logs?mode=history` is IP-free for every role and lens; only the staff-only audit export
+     * file ({@link AuditExportLoginEntry}) carries `ip` and `userAgent`, and no surface carries `jti`.
+     */
+    type AuditHistoryLoginEntry = Omit<CustomerLoginAttempt, 'ttl' | 'ip' | 'userAgent' | 'jti'>;
+    /** A `loginHistory` audit export row's `entry`: the history entry plus the stored `ip` and `userAgent`. */
+    type AuditExportLoginEntry = AuditHistoryLoginEntry & Pick<CustomerLoginAttempt, 'ip' | 'userAgent'>;
     /**
      * How much of one surface this page covers. `complete` means the surface has
      * nothing older in the range; `paging` means it has more; `incomplete` means a
@@ -96,10 +104,20 @@ declare global {
         coverage: AuditHistorySourceCoverage[];
     }
     type AuditExportTier = 'hot' | 'cold' | 'cold-error-output';
-    type AuditExportRow = AuditHistoryRow & {
+    /** A history row as the export captures it; a `loginHistory` row's `entry` keeps `ip`/`userAgent`. */
+    type AuditExportRow = (Exclude<AuditHistoryRow, {
+        surface: 'loginHistory';
+    }> | (AuditHistoryRowBase & {
+        surface: 'loginHistory';
+        entry: AuditExportLoginEntry;
+    })) & {
         tier: AuditExportTier;
     };
     interface AuditExportColdCoverage {
+        /**
+         * `pending-delivery` is no longer produced: an export whose end passed `visibleThrough` is
+         * now cut to it (`AuditExportSourceManifest.clamp`). It stays for manifests stored before.
+         */
         state: 'complete' | 'pending-delivery' | 'incomplete' | 'not-read' | 'unsupported';
         reason?: 'COLD_OBJECT_TOO_LARGE' | 'COLD_READ_FAILED' | 'COLD_LENS_UNSUPPORTED' | 'BUDGET_EXHAUSTED' | 'DEDUP_SET_OVERFLOW' | 'FISCAL_REPLAY_IDS_NOT_CAPTURED' | 'COLD_TIER_NOT_ENUMERATED';
         arrivalWindow: {
@@ -119,7 +137,17 @@ declare global {
         rowsOtherTenant: number;
         rowsOutOfRange: number;
         duplicatesOfHot: number;
+        /**
+         * Cold-only rows in the file: read rows less hot duplicates and, once the export worker
+         * nets them, less `erasedRowsOmitted`.
+         */
         coldOnlyEmitted: number;
+        /**
+         * Cold-only rows read but left out of the file for naming an already-erased customer;
+         * written by the export worker. Absent when none was. Summed over every source with
+         * `hot.erasedRowsOmitted`, it equals the manifest's own `erasedRowsOmitted`.
+         */
+        erasedRowsOmitted?: number;
         legacyRows: number;
         excludedAnonymous: number;
         invalidRows: number;
@@ -129,8 +157,11 @@ declare global {
         tierPlan: 'hot-only-no-archive' | 'hot-authoritative' | 'hot-and-cold';
         tierPlanReason: string;
         hot: AuditHistorySourceCoverage & {
+            /** Hot rows in the file, net of `erasedRowsOmitted`. */
             emitted: number;
             nearExpiryRecorded: number;
+            /** Hot rows read but left out for naming an already-erased customer (export worker). Absent when none was. */
+            erasedRowsOmitted?: number;
         };
         cold?: AuditExportColdCoverage;
     }
@@ -148,7 +179,25 @@ declare global {
             fromIso: string;
             toIso: string;
         };
+        /**
+         * The end every read of the capture used: `requested.toIso` bounded by `captureStartedAt`,
+         * and cut further to the cold delivery horizon when {@link clamp} is present.
+         */
         effectiveTo: string;
+        /**
+         * Present when the export's end was cut short of the request; written by the export engine
+         * (`buildAuditExportManifest`). `COLD_DELIVERY_HORIZON`: the selection holds an archived
+         * surface (`userActivity`, `fiscalAudit`, `storefrontEvents`) and the requested end lies past
+         * the instant the capture can prove the cold archive delivered — `captureStartedAt` less
+         * the delivery window (`sources[].cold.visibleThrough`, about 24 h 15 min). The whole file,
+         * every surface in it, ends at `to` (equal to `effectiveTo`); nothing after it is in the
+         * file, and the coverage states describe the cut range. `requested` stays as asked. Absent
+         * when nothing was cut — a selection of `entityAudit`/`loginHistory` alone never is.
+         */
+        clamp?: {
+            to: string;
+            reason: 'COLD_DELIVERY_HORIZON';
+        };
         captureStartedAt: string;
         captureCompletedAt?: string;
         lifetimeMs: number;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.742",
+	"version": "1.10.744",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",