platform-types 1.10.743 → 1.10.745

package/dist/audit.d.ts

@@ -153,7 +153,7 @@ declare global {
      | 'order_shipment_created'
     /** A shipment was voided; when the order was delivered, this un-delivered it. */
      | 'order_shipment_voided' | 'payment_linked' | 'payment_unlinked'
-    /** A MercadoPago refund shrank or dropped the payment's `linkedPayments` entry. */
+    /** HISTORICAL: written only by the removed outbound MercadoPago refund; kept so old timeline rows still parse. */
      | 'payment_refunded'
     /** At least one till tender leg was appended (an absorbed replay writes none). */
      | 'tender_added'

package/dist/auth.d.ts

@@ -613,10 +613,9 @@ declare global {
      * no single principal to attribute the row to. Never render "no login
      * attempts" as "nobody tried".
      *
-     * `jti` is the same identifier as `CustomerSession.jti`, so a `success` row
-     * can be joined to the session it created — that is how a customer tells
-     * "this unfamiliar sign-in is the device still listed as live" from "it has
-     * since expired".
+     * No login-history row carries the refresh token id (`jti`) on any surface:
+     * a session handle is published only on the session lists
+     * (`CustomerSession.jti` / `OperatorSession.jti`), whose revoke flows use it.
      */
     interface CustomerLoginAttempt {
         outcome: LoginOutcome;
@@ -629,8 +628,10 @@ declare global {
         /** Client build string, when the caller sent one. */
         clientVersion?: string;
         /**
-         * The refresh token id this attempt minted. Present on `success` rows
-         * only, and joins to `CustomerSession.jti`.
+         * @deprecated Never sent. The row stores the refresh token id a success
+         * minted, but no login-history read publishes it; the session lists carry
+         * the handle a revoke needs. Kept so a consumer that still reads it (as a
+         * React key fallback, say) compiles — it is simply always absent.
          */
         jti?: string;
         /**

package/dist/cjs/terminal.js

@@ -181,7 +181,6 @@ exports.TERMINAL_PAIRING_CODE_TTL_SECONDS = 10 * 60;
 /** Money-out actions whose operator sessions require a different ADMIN-or-higher approver. */
 exports.TERMINAL_ELEVATION_ACTIONS = [
     'order.deposit-refund',
-    'mercadopago.refund',
     'shift.refund',
     'shift.cash-out',
     'cash.withdrawal',

package/dist/log.d.ts

@@ -51,8 +51,16 @@ declare global {
         entry: FiscalAuditLogRow;
     }) | (AuditHistoryRowBase & {
         surface: 'loginHistory';
-        entry: Omit<CustomerLoginAttempt, 'ttl'>;
+        entry: AuditHistoryLoginEntry;
     });
+    /**
+     * A `loginHistory` history row's `entry`: the attempt WITHOUT its address, agent or token id.
+     * `GET /logs?mode=history` is IP-free for every role and lens; only the staff-only audit export
+     * file ({@link AuditExportLoginEntry}) carries `ip` and `userAgent`, and no surface carries `jti`.
+     */
+    type AuditHistoryLoginEntry = Omit<CustomerLoginAttempt, 'ttl' | 'ip' | 'userAgent' | 'jti'>;
+    /** A `loginHistory` audit export row's `entry`: the history entry plus the stored `ip` and `userAgent`. */
+    type AuditExportLoginEntry = AuditHistoryLoginEntry & Pick<CustomerLoginAttempt, 'ip' | 'userAgent'>;
     /**
      * How much of one surface this page covers. `complete` means the surface has
      * nothing older in the range; `paging` means it has more; `incomplete` means a
@@ -96,7 +104,13 @@ declare global {
         coverage: AuditHistorySourceCoverage[];
     }
     type AuditExportTier = 'hot' | 'cold' | 'cold-error-output';
-    type AuditExportRow = AuditHistoryRow & {
+    /** A history row as the export captures it; a `loginHistory` row's `entry` keeps `ip`/`userAgent`. */
+    type AuditExportRow = (Exclude<AuditHistoryRow, {
+        surface: 'loginHistory';
+    }> | (AuditHistoryRowBase & {
+        surface: 'loginHistory';
+        entry: AuditExportLoginEntry;
+    })) & {
         tier: AuditExportTier;
     };
     interface AuditExportColdCoverage {

package/dist/mercadopago.d.ts

@@ -1,8 +1,4 @@
 declare global {
-    type MpRefundRequest = {
-        amount?: number;
-        reason?: string;
-    } & TerminalElevationAuthorization;
     /**
      * Device fetched from `GET /point/integration-api/devices` (BE → FE so the
      * admin can pick which physical device receives a payment intent).

package/dist/order.d.ts

@@ -184,7 +184,7 @@ declare global {
          * (the explicit `shiftId`, or the caller's own open drawer). A shift's
          * tender report counts the leg by THIS, so an order tendered across days
          * reports each leg under the shift that took it. A provider-refund reversal
-         * mirrors the shift of the leg it reverses. A seña REFUND leg
+         * (no writer yet) mirrors the shift of the leg it reverses. A seña REFUND leg
          * (`deposit.kind: 'refund'`) is the exception to "the shift that took it":
          * a CASH one names the drawer the cash LEFT — the refunding operator's own,
          * else the one that took the seña (another cashier's), else the store

package/dist/terminal.d.ts

@@ -456,7 +456,6 @@ declare global {
          * `403 ELEVATION_INVALID`. Per {@link TERMINAL_ELEVATION_ACTIONS}:
          *
          * - `'order.deposit-refund'` — the `orderId` of the {@link OrderDepositRefundRequest}. Required.
-         * - `'mercadopago.refund'` — the MercadoPago `paymentId` being refunded. Required.
          * - `'shift.refund'` / `'shift.cash-out'` — the path `{id}` (the `shiftId`) of
          *   `POST /shifts/{id}/movements` ({@link ShiftMovementRequest}). Required.
          * - `'cash.withdrawal'` ({@link CashPostRequest}) and `'account.cash-debit'`
@@ -469,7 +468,7 @@ declare global {
          *   in the body) binds the compensation drawer of the stored row instead.
          *   A client never computes a drawer id.
          *
-         * The four required subjects are refused by the mint's validation when
+         * The three required subjects are refused by the mint's validation when
          * missing (`400`). For the two drawer-bound actions the mint checks, before
          * any PIN work, only the body fields it reads (`400 VALIDATION_FAILED`, paths
          * under `body`): `currency`, a cash edit's `cashId`, an account debit's
@@ -501,13 +500,7 @@ declare global {
      * fingerprint of the cash, account, shift-movement and deposit-refund
      * writes, so a retry carrying a FRESH token with the same key replays the
      * committed response instead of answering `422 IDEMPOTENCY_KEY_REUSE`. A
-     * body without a token fingerprints exactly as before. A MercadoPago refund
-     * has no stored-response replay: its elevation is consumed before the refund
-     * claim, so a retry with the same token answers `403 ELEVATION_INVALID`, and
-     * a retry with a fresh one spends that approval and then meets the refund's
-     * own state (`409
-     * MP_ALREADY_REFUNDED` once the payment is exhausted, `409
-     * MP_REFUND_IN_PROGRESS` while another attempt holds the claim).
+     * body without a token fingerprints exactly as before.
      */
     interface TerminalElevationAuthorization {
         elevationToken?: string;
@@ -654,7 +647,7 @@ export declare const PRINT_AGENT_SESSION_TTL_SECONDS: number;
 export declare const TERMINAL_ENROLMENT_TTL_SECONDS: number;
 export declare const TERMINAL_PAIRING_CODE_TTL_SECONDS: number;
 /** Money-out actions whose operator sessions require a different ADMIN-or-higher approver. */
-export declare const TERMINAL_ELEVATION_ACTIONS: readonly ["order.deposit-refund", "mercadopago.refund", "shift.refund", "shift.cash-out", "cash.withdrawal", "account.cash-debit"];
+export declare const TERMINAL_ELEVATION_ACTIONS: readonly ["order.deposit-refund", "shift.refund", "shift.cash-out", "cash.withdrawal", "account.cash-debit"];
 export type TerminalElevationAction = (typeof TERMINAL_ELEVATION_ACTIONS)[number];
 /**
  * Existing PIN, validation and idempotency refusals retain their current

package/dist/terminal.js

@@ -178,7 +178,6 @@ export const TERMINAL_PAIRING_CODE_TTL_SECONDS = 10 * 60;
 /** Money-out actions whose operator sessions require a different ADMIN-or-higher approver. */
 export const TERMINAL_ELEVATION_ACTIONS = [
     'order.deposit-refund',
-    'mercadopago.refund',
     'shift.refund',
     'shift.cash-out',
     'cash.withdrawal',

package/dist/webhook.d.ts

@@ -547,8 +547,8 @@ export interface OrderStatusChangedPayload {
  * REAL moves only (`from !== to`), announced after the write commits, from
  * every writer that moves the axis on an existing order: the counter tender,
  * both provider settlement webhooks (Stripe, MercadoPago), the payment link
- * (operator, MercadoLibre collection and MercadoPago movements auto-link), the
- * payment unlink and the MercadoPago refund. A redelivered settlement, a top-up
+ * (operator, MercadoLibre collection and MercadoPago movements auto-link), and the
+ * payment unlink. A redelivered settlement, a top-up
  * that leaves a `partial` order `partial`, and a link that is refused all
  * announce nothing.
  *
@@ -556,7 +556,7 @@ export interface OrderStatusChangedPayload {
  * its first `financialStatus`, which is not a transition; `order.created`
  * already announces the row.
  *
- * ⚠️ **Downgrades are events too.** An unlink or a refund can move `paid` back
+ * ⚠️ **Downgrades are events too.** An unlink can move `paid` back
  * to `partial` or `pending`; a subscriber that only handles `to: 'paid'` misses
  * money given back.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.743",
+	"version": "1.10.745",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",