sinfactura-types 1.10.552 → 1.10.554

package/dist/auth.d.ts

@@ -491,12 +491,23 @@ declare global {
      *   somebody holds the password and stalled at the second factor.
      * - `wrong_totp` — the step-up code was wrong.
      * - `totp_replay` — an already-used code was presented again and rejected.
-     * - `wrong_passkey` — a passkey (WebAuthn) assertion was presented and failed
-     *   verification: a bad signature, an unknown or revoked credential, an
-     *   expired challenge, or a signature counter that went backwards. Kept apart
-     *   from `wrong_totp` so the trail can tell a mistyped code from a failing
-     *   authenticator; the CLIENT still sees the same `INVALID_2FA_CODE` for both.
-     *   A replayed assertion challenge is `totp_replay`, like a replayed code.
+     * - `wrong_passkey` — a passkey (WebAuthn) assertion was presented and failed.
+     *   ⚠️ It means a DIFFERENT step on each kind of row:
+     *   - **Operator rows (`kind: 'USER'`)** — the passkey is a SECOND factor, so
+     *     this is a failed 2FA leg: a bad signature, an unknown or revoked
+     *     credential, an expired challenge, or a signature counter that went
+     *     backwards. Kept apart from `wrong_totp` so the trail can tell a
+     *     mistyped code from a failing authenticator; the CLIENT still sees the
+     *     same `INVALID_2FA_CODE` for both. A replayed assertion challenge is
+     *     `totp_replay`, like a replayed code.
+     *   - **Customer rows (`kind: 'CUSTOMER'`)** — the passkey is the FIRST
+     *     factor (storefront `passkey-sign-in-verify`, provider `'passkey'`), so
+     *     there is no second factor involved: the assertion against a credential
+     *     that RESOLVED to this customer did not verify (a bad signature, a
+     *     counter regression, a lost counter race). The client sees `401
+     *     PASSKEY_NOT_RECOGNISED`, never `INVALID_2FA_CODE`. An unknown, revoked
+     *     or other-host credential, a forged handle and an expired or replayed
+     *     challenge are refused BEFORE a customer is known and write no row.
      * - `totp_locked` — brute-force lockout active on the TOTP leg.
      * - `enrollment_required` — the credentials were correct and the store's
      *   mandatory-2FA grace window has closed on a user who never enrolled. Like
@@ -662,8 +673,17 @@ declare global {
      * assignable to the other's slot. Both spellings ship; this is documented
      * rather than reconciled, because `method` is an established analytics
      * contract.
+     *
+     * ⚠️ `'passkey'` is NOT a Firebase provider and is NEVER STORED as a
+     * `CustomerSignInMethod` entry. Like `hasPassword`, it is DERIVED: the api
+     * reports it from the customer's live passkeys (see
+     * {@link CustomerPasskeySummary}), and only while the platform's customer
+     * passkey switch is on. It cannot be unlinked through
+     * `unlink-sign-in-method` — a passkey is removed one credential at a time
+     * through `passkey-remove`. It is also the provider recorded on a
+     * {@link CustomerLoginAttempt} for a passkey sign-in.
      */
-    type CustomerSignInProvider = 'google' | 'facebook' | 'apple' | 'password';
+    type CustomerSignInProvider = 'google' | 'facebook' | 'apple' | 'password' | 'passkey';
     /**
      * Whether a stored sign-in method may be used, or has been explicitly turned
      * off by the customer.
@@ -775,6 +795,13 @@ declare global {
      * explicitly-refused. Do not render "never connected" off absence, and do not
      * infer that a link attempt will succeed from it.
      *
+     * ⚠️ One entry is DERIVED, not stored: `{ provider: 'passkey', status:
+     * 'linked' }` is appended while the customer-passkeys switch is on and the
+     * customer holds at least one live passkey. It stands for the whole set of
+     * passkeys (each is removed on its own through `passkey-remove`, never
+     * through unlink) and carries no `firebaseUid` or dates. Whether the switch
+     * is on is `passkeysAvailable`, not this entry.
+     *
      * ⚠️ Note the nesting: `methods` sits under `data`, not at the root beside
      * it, unlike `CustomerSessionsResponse.data` / `CustomerLoginHistoryResponse.data`
      * which put their array directly at `data`. The reason is that `hasPassword`
@@ -792,7 +819,10 @@ declare global {
      */
     interface CustomerSignInMethodsResponse {
         data: {
-            /** LINKED entries only. A refused provider is invisible here. */
+            /**
+             * LINKED entries only, plus the derived `passkey` entry described above.
+             * A refused provider is invisible here.
+             */
             methods: CustomerSignInMethod[];
             /**
              * DERIVED, never stored: "does a usable password credential exist for
@@ -810,6 +840,22 @@ declare global {
              * api sees both halves.
              */
             hasPassword: boolean;
+            /**
+             * `true` iff the platform's customer-passkeys switch
+             * (`customerPasskeysEnabled`) is on — the storefront offers "Add a
+             * passkey" on it.
+             *
+             * ⚠️ Read the switch HERE, never off `methods`. The derived `passkey`
+             * entry in `methods` appears only when the switch is on AND the customer
+             * already holds a live passkey, so "no passkey entry" is the same body for
+             * "switch off" and for "switch on, nothing registered yet" — every
+             * customer at launch. Hiding registration off that absence means nobody
+             * can ever register a first passkey.
+             *
+             * Additive: an older api omits it, which a consumer should read as
+             * `false`.
+             */
+            passkeysAvailable: boolean;
         };
     }
     /**
@@ -838,6 +884,69 @@ declare global {
         unlinked: true;
         provider: CustomerSignInProvider;
     }
+    /**
+     * One live customer passkey, as every customer-passkey read returns it.
+     *
+     * ⚠️ An ALLOW-LIST projection of the stored row: these five keys and nothing
+     * else. The row carries the public key and signature counter, which
+     * `response()` does not strip.
+     */
+    interface CustomerPasskeySummary {
+        /** base64url credential id — what `passkey-remove` takes. */
+        credentialId: string;
+        /** The customer's own name for the device. Personal data. */
+        label: string;
+        /** unix ms */
+        createdAt: number;
+        /** unix ms — the last successful sign-in with it. Absent until first use. */
+        lastUsedAt?: number;
+        /**
+         * The host the passkey was registered on (`cesta.ar` or a verified custom
+         * domain). It signs in on that host only — render it so the customer can
+         * tell two same-named devices apart and knows where each one works.
+         */
+        rpHost: string;
+    }
+    /**
+     * `passkey-register-options` (cookie-authenticated) and
+     * `passkey-sign-in-options` (public) `data` — a single-use, five-minute
+     * challenge. Same shape as the operator {@link PasskeyChallenge}.
+     */
+    type CustomerPasskeyOptionsResponse = PasskeyChallenge;
+    /** `POST /auth` body for `passkey-register-verify`. Cookie-authenticated. */
+    interface CustomerPasskeyRegisterVerifyRequest {
+        mode: 'passkey-register-verify';
+        challengeId: string;
+        response: WebAuthnCredentialResponse;
+        /** The customer's own name for the device. */
+        label?: string;
+    }
+    /** `passkey-register-verify` `data` — the new credential. */
+    type CustomerPasskeyRegisterVerifyResponse = CustomerPasskeySummary;
+    /**
+     * `POST /auth` body for `passkey-sign-in-verify`. Public. The 200 is the
+     * SAME body, cookie and session a password sign-in answers with.
+     */
+    interface CustomerPasskeySignInVerifyRequest {
+        mode: 'passkey-sign-in-verify';
+        challengeId: string;
+        response: WebAuthnCredentialResponse;
+    }
+    /** `GET /auth?mode=passkeys` `data` — the caller's own live passkeys. */
+    interface CustomerPasskeyListResponse {
+        credentials: CustomerPasskeySummary[];
+    }
+    /** `POST /auth` body for `passkey-remove`. Cookie-authenticated. */
+    interface CustomerPasskeyRemoveRequest {
+        mode: 'passkey-remove';
+        credentialId: string;
+    }
+    /** `passkey-remove` `data`. */
+    interface CustomerPasskeyRemoveResponse {
+        credentialId: string;
+        /** unix ms */
+        revokedAt: number;
+    }
     /**
      * One operator refresh-token row: active by default, retained history in the forensic view —
      * `stacks/lambdas/auth/_sessions.ts`, rows from `listSessions`.
@@ -1102,11 +1211,14 @@ declare global {
  * `SIGN_IN_METHODS_CONFLICT` since the sign-in-methods race fix shipped. A
  * contract that lags its own emitter is the failure this tuple closes.
  *
- * - `SIGN_IN_METHOD_LAST_CREDENTIAL` (unlink) — the guardrail. Removing this
- *   provider would leave the account with no way in at all: no other linked
- *   provider and no password. Correct ONLY because the api sees both the social
- *   providers and the password credential. Offer "set a password first", not a
- *   retry.
+ * - `SIGN_IN_METHOD_LAST_CREDENTIAL` (unlink, `passkey-remove`) — the
+ *   guardrail. Removing this provider, or this passkey, would leave the account
+ *   with no way in at all: no other linked provider, no password and — while
+ *   the customer-passkeys switch is on — no other live passkey (with the switch
+ *   off a passkey cannot sign in, so it does not count). Correct ONLY because
+ *   the api sees the social providers, the password credential and the
+ *   passkeys together. Offer "set a password first", not a retry — the
+ *   remedy is the same whichever mode answered it.
  * - `SIGN_IN_METHOD_NOT_LINKED` (unlink) — nothing to unlink. ⚠️ Reachable for a
  *   provider the customer signs in with RIGHT NOW: a working Google sign-in is
  *   still not a linked one.
@@ -1133,6 +1245,9 @@ declare global {
  * - `SIGN_IN_METHODS_CONFLICT` — a concurrent writer won the row. The retry
  *   budget is already spent by the time this reaches the wire, so it is
  *   terminal for this request: surface "please retry", never auto-retry again.
+ *   Also answered by `passkey-register-verify` and `passkey-remove` when
+ *   another change to the customer's ways in (a passkey added or removed, a
+ *   provider unlinked) kept landing between their count and their write.
  *   ⚠️ It collapses TWO distinct DynamoDB failures — a transaction cancellation
  *   from the shared write helper and a bare conditional-check failure from the
  *   social path. That split never reaches the wire, and must not: a caller

package/dist/auth.js

@@ -19,11 +19,14 @@
  * `SIGN_IN_METHODS_CONFLICT` since the sign-in-methods race fix shipped. A
  * contract that lags its own emitter is the failure this tuple closes.
  *
- * - `SIGN_IN_METHOD_LAST_CREDENTIAL` (unlink) — the guardrail. Removing this
- *   provider would leave the account with no way in at all: no other linked
- *   provider and no password. Correct ONLY because the api sees both the social
- *   providers and the password credential. Offer "set a password first", not a
- *   retry.
+ * - `SIGN_IN_METHOD_LAST_CREDENTIAL` (unlink, `passkey-remove`) — the
+ *   guardrail. Removing this provider, or this passkey, would leave the account
+ *   with no way in at all: no other linked provider, no password and — while
+ *   the customer-passkeys switch is on — no other live passkey (with the switch
+ *   off a passkey cannot sign in, so it does not count). Correct ONLY because
+ *   the api sees the social providers, the password credential and the
+ *   passkeys together. Offer "set a password first", not a retry — the
+ *   remedy is the same whichever mode answered it.
  * - `SIGN_IN_METHOD_NOT_LINKED` (unlink) — nothing to unlink. ⚠️ Reachable for a
  *   provider the customer signs in with RIGHT NOW: a working Google sign-in is
  *   still not a linked one.
@@ -50,6 +53,9 @@
  * - `SIGN_IN_METHODS_CONFLICT` — a concurrent writer won the row. The retry
  *   budget is already spent by the time this reaches the wire, so it is
  *   terminal for this request: surface "please retry", never auto-retry again.
+ *   Also answered by `passkey-register-verify` and `passkey-remove` when
+ *   another change to the customer's ways in (a passkey added or removed, a
+ *   provider unlinked) kept landing between their count and their write.
  *   ⚠️ It collapses TWO distinct DynamoDB failures — a transaction cancellation
  *   from the shared write helper and a bare conditional-check failure from the
  *   social path. That split never reaches the wire, and must not: a caller

package/dist/cjs/auth.js

@@ -22,11 +22,14 @@ exports.SESSION_ACTION_ERROR_CODES = exports.PASSKEY_ERROR_CODES = exports.TWO_F
  * `SIGN_IN_METHODS_CONFLICT` since the sign-in-methods race fix shipped. A
  * contract that lags its own emitter is the failure this tuple closes.
  *
- * - `SIGN_IN_METHOD_LAST_CREDENTIAL` (unlink) — the guardrail. Removing this
- *   provider would leave the account with no way in at all: no other linked
- *   provider and no password. Correct ONLY because the api sees both the social
- *   providers and the password credential. Offer "set a password first", not a
- *   retry.
+ * - `SIGN_IN_METHOD_LAST_CREDENTIAL` (unlink, `passkey-remove`) — the
+ *   guardrail. Removing this provider, or this passkey, would leave the account
+ *   with no way in at all: no other linked provider, no password and — while
+ *   the customer-passkeys switch is on — no other live passkey (with the switch
+ *   off a passkey cannot sign in, so it does not count). Correct ONLY because
+ *   the api sees the social providers, the password credential and the
+ *   passkeys together. Offer "set a password first", not a retry — the
+ *   remedy is the same whichever mode answered it.
  * - `SIGN_IN_METHOD_NOT_LINKED` (unlink) — nothing to unlink. ⚠️ Reachable for a
  *   provider the customer signs in with RIGHT NOW: a working Google sign-in is
  *   still not a linked one.
@@ -53,6 +56,9 @@ exports.SESSION_ACTION_ERROR_CODES = exports.PASSKEY_ERROR_CODES = exports.TWO_F
  * - `SIGN_IN_METHODS_CONFLICT` — a concurrent writer won the row. The retry
  *   budget is already spent by the time this reaches the wire, so it is
  *   terminal for this request: surface "please retry", never auto-retry again.
+ *   Also answered by `passkey-register-verify` and `passkey-remove` when
+ *   another change to the customer's ways in (a passkey added or removed, a
+ *   provider unlinked) kept landing between their count and their write.
  *   ⚠️ It collapses TWO distinct DynamoDB failures — a transaction cancellation
  *   from the shared write helper and a bare conditional-check failure from the
  *   social path. That split never reaches the wire, and must not: a caller

package/dist/cjs/mercadopago.js

@@ -2,11 +2,40 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MP_REFUND_RECOVERY_ERROR_CODES = exports.MP_POINT_TIP_ERROR_CODES = exports.MP_DYNAMIC_QR_ERROR_CODES = void 0;
 /**
- * Dynamic QR initiation refusals. Connection/configuration failures use 412;
- * malformed requests use 400; permission/plan/support-session failures use 403.
- * Attempt/allocation conflicts use 409, and an unknown creation outcome uses
- * 504 MP_DYN_QR_UNCONFIRMED. An uncertain attempt remains blocked indefinitely.
- * Legacy order-only requests cannot carry tips.
+ * Dynamic QR initiation refusals, by status:
+ * - 400 malformed request (`VALIDATION_FAILED`, `TIP_EXCEEDS_ORDER`, `TIP_ORDER_REQUIRED`), or an
+ *   order whose paid sum cannot be converted for want of a usable rate (`FX_CONVERSION_UNAVAILABLE`);
+ * - 403 permission, plan or support session (`CAPABILITY_REQUIRED`, `ROLE_FORBIDDEN`,
+ *   `PLAN_UPGRADE_REQUIRED`, `IMPERSONATION_READONLY`);
+ * - 404 missing order or worker (`TIP_ORDER_NOT_FOUND`, `TIP_RECIPIENT_NOT_FOUND`; the POST never
+ *   answers `ORDER_NOT_FOUND`, only the re-sync read below does);
+ * - 409 order state, account, attempt or allocation conflicts (every other order/tip/attempt code);
+ * - 412 connection or configuration (`MP_NOT_CONNECTED`, `MP_TOKEN_EXPIRED`, `MP_USER_ID_MISSING`,
+ *   `MP_NO_STORE_ON_ACCOUNT`);
+ * - 502 a definite POS or QR rejection (`MP_DYN_POS_CREATE_FAILED`, `MP_POS_INVALID`,
+ *   `MP_DYN_QR_CREATE_FAILED`, `MP_DYN_QR_INVALID`);
+ * - 503 `PLATFORM_INTEGRATION_DISABLED`; 504 `MP_DYN_QR_UNCONFIRMED`, an unknown creation outcome.
+ * A thrown error answers `400 UNHANDLED_ERROR`, never a 500. The re-sync read
+ * (`GET /mercadopago/qr/dynamic?orderId=`) uses `VALIDATION_FAILED`, `PLAN_UPGRADE_REQUIRED`,
+ * `CAPABILITY_REQUIRED`, `ORDER_NOT_FOUND` and `ORDER_CANCELLED` from this list.
+ *
+ * Per Idempotency-Key on the tipped path: `MP_DYN_QR_IN_PROGRESS` = in flight
+ * (keep the key, poll); `MP_DYN_QR_REJECTED` = ended with no live charge (a
+ * fresh key is safe); `MP_DYN_QR_EXPIRED` = its QR expired (permanent for that
+ * key). A `contacting` attempt (MercadoPago may have been called) stays blocked
+ * indefinitely; a `reserved` one (provably never contacted) is released once it
+ * outlives the Lambda timeout. A fresh tipped reservation on an order already
+ * fully paid (till tenders plus linked payments cover its total, as its
+ * `financialStatus` derives) answers `PAYMENT_ALREADY_RECEIVED`; a part-paid
+ * order (a split) still mints the remainder. When a till tender or linked payment
+ * is in a currency the store holds no usable rate for, the paid sum is unknown, not
+ * paid: it answers `400 FX_CONVERSION_UNAVAILABLE` (configure the rate in Monedas,
+ * then retry with the same key).
+ * `MP_DYN_QR_INVALID` is untipped-only: on the tipped path a malformed 2xx is
+ * `MP_DYN_QR_UNCONFIRMED`. The retired `{ orderId }`-only body answers
+ * `VALIDATION_FAILED`. `INVALID_ORDER_STATE`, `ORDER_FX_RATE_UNAVAILABLE` and
+ * `ORDER_FX_AMOUNT_TOO_SMALL` were that body's alone and are no longer emitted;
+ * they stay listed so an existing client switch still compiles.
  */
 exports.MP_DYNAMIC_QR_ERROR_CODES = [
     'VALIDATION_FAILED',
@@ -40,6 +69,8 @@ exports.MP_DYNAMIC_QR_ERROR_CODES = [
     'MP_DYN_QR_IN_PROGRESS',
     'MP_DYN_QR_EXPIRED',
     'MP_DYN_QR_UNCONFIRMED',
+    'MP_DYN_QR_REJECTED',
+    'FX_CONVERSION_UNAVAILABLE',
 ];
 exports.MP_POINT_TIP_ERROR_CODES = [
     'TIP_EXCEEDS_ORDER',

package/dist/customer.d.ts

@@ -554,6 +554,13 @@ declare global {
             province: string;
             postalCode: string;
         };
+        /**
+         * Live storefront passkeys this customer holds. NEVER stored on the row:
+         * computed by the operator `GET /customers?customerId=` point read only, and
+         * absent when that count could not be read — absent means unknown, never
+         * zero. A count only; no credential id, key or label is served with it.
+         */
+        passkeyCount?: number;
     }
     /**
      * Every refusal `POST /customers { mode: 'data-export' | 'anonymize' }` and
@@ -1207,6 +1214,19 @@ declare global {
          * operator handler additionally writes an un-deduped `ERROR` row.
          */
         sessionRevocationComplete: boolean;
+        /**
+         * Storefront passkeys (`CUSTOMER_WEBAUTHN_CREDENTIAL#`) this erasure
+         * revoked; every passkey `label` is removed with them. Optional only so the
+         * field is additive — every erasure from this version on sets it.
+         */
+        passkeysRevoked?: number;
+        /**
+         * `false` when the passkey partition could not be read or written to the
+         * end, so a passkey may still sign in. BOTH erasure handlers write an
+         * un-deduped `ERROR` row (`CUSTOMER_ANONYMIZE_PASSKEYS_INCOMPLETE`);
+         * re-issuing the erasure re-runs the revocation. On BOTH wires.
+         */
+        passkeyRevocationComplete?: boolean;
         /**
          * `ACCOUNT#` ledger rows whose denormalised `fullName` was removed by this
          * erasure.

package/dist/mercadopago.d.ts

@@ -136,7 +136,58 @@ declare global {
         expiresAt: number;
         createdAt: number;
         isNew: boolean;
+        /**
+         * Server clock (Unix ms) when this response was built. Present on the tipped
+         * create and replay; never persisted, so a replay carries the replay's instant.
+         * Estimate the client clock offset from this, not from `createdAt` (the
+         * reservation instant, taken before the POS lookup and the provider call).
+         */
+        serverNow?: number;
     }
+    /**
+     * `data` of `409 MP_DYN_QR_IN_PROGRESS`. `scope: 'attempt'` = this
+     * Idempotency-Key's own attempt is in flight; `'order'` = another identity
+     * holds the order's QR fence. `since` = the blocking attempt's reservation
+     * instant (absent only on a fence written before it was stamped). `expiresAt`
+     * only on `state: 'ready'` (an unexpired tipped QR), the instant the fence
+     * frees; `reserved`/`contacting` carry none.
+     */
+    interface MpDynamicQrInProgressDetails {
+        serverNow: number;
+        scope: 'attempt' | 'order';
+        state: 'reserved' | 'contacting' | 'ready';
+        since?: number;
+        expiresAt?: number;
+    }
+    /** `data` of `409 MP_DYN_QR_EXPIRED`: the same key's saved QR expired at `expiresAt`. */
+    interface MpDynamicQrExpiredDetails {
+        serverNow: number;
+        expiresAt: number;
+    }
+    /** `data` of `409 MP_DYN_QR_REJECTED`: the same key's attempt ended with no live charge. */
+    interface MpDynamicQrRejectedDetails {
+        serverNow: number;
+    }
+    /**
+     * `data` of `GET /mercadopago/qr/dynamic?orderId=` — the re-sync read of the order's
+     * dynamic QR. Never carries the Idempotency-Key, owner, fingerprint or tip recipient.
+     * `ready` = an unexpired tipped QR (`qr.isNew` is always false); `pending` = an attempt
+     * holds the order's fence (`since` = its reservation instant; no `qrData`); `none` =
+     * nothing blocks the order.
+     */
+    type MpDynamicQrStateResponse = {
+        state: 'ready';
+        qr: MpDynamicQrResponse;
+        serverNow: number;
+    } | {
+        state: 'pending';
+        phase: 'reserved' | 'contacting';
+        since?: number;
+        serverNow: number;
+    } | {
+        state: 'none';
+        serverNow: number;
+    };
     type MpHookResult = 'config-missing' | 'test-event' | 'orphan' | 'duplicate' | 'not-approved' | 'item-saved' | 'error';
     interface MpHookLogEntry {
         hookId: string;
@@ -202,13 +253,42 @@ declare global {
     }
 }
 /**
- * Dynamic QR initiation refusals. Connection/configuration failures use 412;
- * malformed requests use 400; permission/plan/support-session failures use 403.
- * Attempt/allocation conflicts use 409, and an unknown creation outcome uses
- * 504 MP_DYN_QR_UNCONFIRMED. An uncertain attempt remains blocked indefinitely.
- * Legacy order-only requests cannot carry tips.
+ * Dynamic QR initiation refusals, by status:
+ * - 400 malformed request (`VALIDATION_FAILED`, `TIP_EXCEEDS_ORDER`, `TIP_ORDER_REQUIRED`), or an
+ *   order whose paid sum cannot be converted for want of a usable rate (`FX_CONVERSION_UNAVAILABLE`);
+ * - 403 permission, plan or support session (`CAPABILITY_REQUIRED`, `ROLE_FORBIDDEN`,
+ *   `PLAN_UPGRADE_REQUIRED`, `IMPERSONATION_READONLY`);
+ * - 404 missing order or worker (`TIP_ORDER_NOT_FOUND`, `TIP_RECIPIENT_NOT_FOUND`; the POST never
+ *   answers `ORDER_NOT_FOUND`, only the re-sync read below does);
+ * - 409 order state, account, attempt or allocation conflicts (every other order/tip/attempt code);
+ * - 412 connection or configuration (`MP_NOT_CONNECTED`, `MP_TOKEN_EXPIRED`, `MP_USER_ID_MISSING`,
+ *   `MP_NO_STORE_ON_ACCOUNT`);
+ * - 502 a definite POS or QR rejection (`MP_DYN_POS_CREATE_FAILED`, `MP_POS_INVALID`,
+ *   `MP_DYN_QR_CREATE_FAILED`, `MP_DYN_QR_INVALID`);
+ * - 503 `PLATFORM_INTEGRATION_DISABLED`; 504 `MP_DYN_QR_UNCONFIRMED`, an unknown creation outcome.
+ * A thrown error answers `400 UNHANDLED_ERROR`, never a 500. The re-sync read
+ * (`GET /mercadopago/qr/dynamic?orderId=`) uses `VALIDATION_FAILED`, `PLAN_UPGRADE_REQUIRED`,
+ * `CAPABILITY_REQUIRED`, `ORDER_NOT_FOUND` and `ORDER_CANCELLED` from this list.
+ *
+ * Per Idempotency-Key on the tipped path: `MP_DYN_QR_IN_PROGRESS` = in flight
+ * (keep the key, poll); `MP_DYN_QR_REJECTED` = ended with no live charge (a
+ * fresh key is safe); `MP_DYN_QR_EXPIRED` = its QR expired (permanent for that
+ * key). A `contacting` attempt (MercadoPago may have been called) stays blocked
+ * indefinitely; a `reserved` one (provably never contacted) is released once it
+ * outlives the Lambda timeout. A fresh tipped reservation on an order already
+ * fully paid (till tenders plus linked payments cover its total, as its
+ * `financialStatus` derives) answers `PAYMENT_ALREADY_RECEIVED`; a part-paid
+ * order (a split) still mints the remainder. When a till tender or linked payment
+ * is in a currency the store holds no usable rate for, the paid sum is unknown, not
+ * paid: it answers `400 FX_CONVERSION_UNAVAILABLE` (configure the rate in Monedas,
+ * then retry with the same key).
+ * `MP_DYN_QR_INVALID` is untipped-only: on the tipped path a malformed 2xx is
+ * `MP_DYN_QR_UNCONFIRMED`. The retired `{ orderId }`-only body answers
+ * `VALIDATION_FAILED`. `INVALID_ORDER_STATE`, `ORDER_FX_RATE_UNAVAILABLE` and
+ * `ORDER_FX_AMOUNT_TOO_SMALL` were that body's alone and are no longer emitted;
+ * they stay listed so an existing client switch still compiles.
  */
-export declare const MP_DYNAMIC_QR_ERROR_CODES: readonly ["VALIDATION_FAILED", "MP_NOT_CONNECTED", "MP_TOKEN_EXPIRED", "MP_USER_ID_MISSING", "MP_NO_STORE_ON_ACCOUNT", "MP_DYN_POS_CREATE_FAILED", "MP_POS_INVALID", "MP_DYN_QR_CREATE_FAILED", "MP_DYN_QR_INVALID", "PLATFORM_INTEGRATION_DISABLED", "PLAN_UPGRADE_REQUIRED", "ORDER_CANCELLED", "INVALID_ORDER_STATE", "PAYMENT_ALREADY_RECEIVED", "ORDER_NOT_FOUND", "ORDER_FX_RATE_UNAVAILABLE", "ORDER_FX_AMOUNT_TOO_SMALL", "CAPABILITY_REQUIRED", "ROLE_FORBIDDEN", "IMPERSONATION_READONLY", "TIP_EXCEEDS_ORDER", "TIP_RECIPIENT_NOT_FOUND", "TIP_ACCOUNT_UNVERIFIED", "TIP_SHARED_ACCOUNT_FORBIDDEN", "TIP_ORDER_REQUIRED", "TIP_ORDER_NOT_FOUND", "TIP_OPERATION_CONFLICT", "TIP_PAYMENT_NOT_FOUND", "MP_DYN_QR_IN_PROGRESS", "MP_DYN_QR_EXPIRED", "MP_DYN_QR_UNCONFIRMED"];
+export declare const MP_DYNAMIC_QR_ERROR_CODES: readonly ["VALIDATION_FAILED", "MP_NOT_CONNECTED", "MP_TOKEN_EXPIRED", "MP_USER_ID_MISSING", "MP_NO_STORE_ON_ACCOUNT", "MP_DYN_POS_CREATE_FAILED", "MP_POS_INVALID", "MP_DYN_QR_CREATE_FAILED", "MP_DYN_QR_INVALID", "PLATFORM_INTEGRATION_DISABLED", "PLAN_UPGRADE_REQUIRED", "ORDER_CANCELLED", "INVALID_ORDER_STATE", "PAYMENT_ALREADY_RECEIVED", "ORDER_NOT_FOUND", "ORDER_FX_RATE_UNAVAILABLE", "ORDER_FX_AMOUNT_TOO_SMALL", "CAPABILITY_REQUIRED", "ROLE_FORBIDDEN", "IMPERSONATION_READONLY", "TIP_EXCEEDS_ORDER", "TIP_RECIPIENT_NOT_FOUND", "TIP_ACCOUNT_UNVERIFIED", "TIP_SHARED_ACCOUNT_FORBIDDEN", "TIP_ORDER_REQUIRED", "TIP_ORDER_NOT_FOUND", "TIP_OPERATION_CONFLICT", "TIP_PAYMENT_NOT_FOUND", "MP_DYN_QR_IN_PROGRESS", "MP_DYN_QR_EXPIRED", "MP_DYN_QR_UNCONFIRMED", "MP_DYN_QR_REJECTED", "FX_CONVERSION_UNAVAILABLE"];
 export type MpDynamicQrErrorCode = (typeof MP_DYNAMIC_QR_ERROR_CODES)[number];
 export declare const MP_POINT_TIP_ERROR_CODES: readonly ["TIP_EXCEEDS_ORDER", "VALIDATION_FAILED", "CAPABILITY_REQUIRED", "ROLE_FORBIDDEN", "PLAN_UPGRADE_REQUIRED", "TIP_RECIPIENT_NOT_FOUND", "TIP_ACCOUNT_UNVERIFIED", "TIP_SHARED_ACCOUNT_FORBIDDEN", "TIP_ORDER_REQUIRED", "TIP_ORDER_NOT_FOUND", "TIP_OPERATION_CONFLICT", "TIP_PAYMENT_MISMATCH", "TIP_PAYMENT_NOT_FOUND", "TIP_REFUND_EXCEEDS_ORDER"];
 export type MpPointTipErrorCode = (typeof MP_POINT_TIP_ERROR_CODES)[number];

package/dist/mercadopago.js

@@ -1,9 +1,38 @@
 /**
- * Dynamic QR initiation refusals. Connection/configuration failures use 412;
- * malformed requests use 400; permission/plan/support-session failures use 403.
- * Attempt/allocation conflicts use 409, and an unknown creation outcome uses
- * 504 MP_DYN_QR_UNCONFIRMED. An uncertain attempt remains blocked indefinitely.
- * Legacy order-only requests cannot carry tips.
+ * Dynamic QR initiation refusals, by status:
+ * - 400 malformed request (`VALIDATION_FAILED`, `TIP_EXCEEDS_ORDER`, `TIP_ORDER_REQUIRED`), or an
+ *   order whose paid sum cannot be converted for want of a usable rate (`FX_CONVERSION_UNAVAILABLE`);
+ * - 403 permission, plan or support session (`CAPABILITY_REQUIRED`, `ROLE_FORBIDDEN`,
+ *   `PLAN_UPGRADE_REQUIRED`, `IMPERSONATION_READONLY`);
+ * - 404 missing order or worker (`TIP_ORDER_NOT_FOUND`, `TIP_RECIPIENT_NOT_FOUND`; the POST never
+ *   answers `ORDER_NOT_FOUND`, only the re-sync read below does);
+ * - 409 order state, account, attempt or allocation conflicts (every other order/tip/attempt code);
+ * - 412 connection or configuration (`MP_NOT_CONNECTED`, `MP_TOKEN_EXPIRED`, `MP_USER_ID_MISSING`,
+ *   `MP_NO_STORE_ON_ACCOUNT`);
+ * - 502 a definite POS or QR rejection (`MP_DYN_POS_CREATE_FAILED`, `MP_POS_INVALID`,
+ *   `MP_DYN_QR_CREATE_FAILED`, `MP_DYN_QR_INVALID`);
+ * - 503 `PLATFORM_INTEGRATION_DISABLED`; 504 `MP_DYN_QR_UNCONFIRMED`, an unknown creation outcome.
+ * A thrown error answers `400 UNHANDLED_ERROR`, never a 500. The re-sync read
+ * (`GET /mercadopago/qr/dynamic?orderId=`) uses `VALIDATION_FAILED`, `PLAN_UPGRADE_REQUIRED`,
+ * `CAPABILITY_REQUIRED`, `ORDER_NOT_FOUND` and `ORDER_CANCELLED` from this list.
+ *
+ * Per Idempotency-Key on the tipped path: `MP_DYN_QR_IN_PROGRESS` = in flight
+ * (keep the key, poll); `MP_DYN_QR_REJECTED` = ended with no live charge (a
+ * fresh key is safe); `MP_DYN_QR_EXPIRED` = its QR expired (permanent for that
+ * key). A `contacting` attempt (MercadoPago may have been called) stays blocked
+ * indefinitely; a `reserved` one (provably never contacted) is released once it
+ * outlives the Lambda timeout. A fresh tipped reservation on an order already
+ * fully paid (till tenders plus linked payments cover its total, as its
+ * `financialStatus` derives) answers `PAYMENT_ALREADY_RECEIVED`; a part-paid
+ * order (a split) still mints the remainder. When a till tender or linked payment
+ * is in a currency the store holds no usable rate for, the paid sum is unknown, not
+ * paid: it answers `400 FX_CONVERSION_UNAVAILABLE` (configure the rate in Monedas,
+ * then retry with the same key).
+ * `MP_DYN_QR_INVALID` is untipped-only: on the tipped path a malformed 2xx is
+ * `MP_DYN_QR_UNCONFIRMED`. The retired `{ orderId }`-only body answers
+ * `VALIDATION_FAILED`. `INVALID_ORDER_STATE`, `ORDER_FX_RATE_UNAVAILABLE` and
+ * `ORDER_FX_AMOUNT_TOO_SMALL` were that body's alone and are no longer emitted;
+ * they stay listed so an existing client switch still compiles.
  */
 export const MP_DYNAMIC_QR_ERROR_CODES = [
     'VALIDATION_FAILED',
@@ -37,6 +66,8 @@ export const MP_DYNAMIC_QR_ERROR_CODES = [
     'MP_DYN_QR_IN_PROGRESS',
     'MP_DYN_QR_EXPIRED',
     'MP_DYN_QR_UNCONFIRMED',
+    'MP_DYN_QR_REJECTED',
+    'FX_CONVERSION_UNAVAILABLE',
 ];
 export const MP_POINT_TIP_ERROR_CODES = [
     'TIP_EXCEEDS_ORDER',

package/dist/order.d.ts

@@ -1133,6 +1133,7 @@ declare global {
             postalCode: string;
         };
         mercadopago?: {
+            /** @deprecated Historical, no longer written; see the comment above. */
             dynamicQr?: {
                 qrData: string;
                 inStoreOrderId: string;

package/dist/storefrontEvent.d.ts

@@ -98,15 +98,18 @@ declare global {
          * ⚠️ `'email'` here is what `CustomerSignInProvider` spells
          * `'password'`; the other members share their spelling. Neither value is
          * assignable to the other's slot — map across explicitly.
+         *
+         * `'passkey'` is a storefront passkey sign-in. It is a sign-IN member
+         * only: a passkey is registered from an existing session, so
+         * `Customer Signed Up` never carries it.
          */
-        method: 'email' | 'google' | 'facebook' | 'apple';
+        method: 'email' | 'google' | 'facebook' | 'apple' | 'passkey';
     }
     interface CustomerSignedUpEvent extends StorefrontEventBase {
         event: 'Customer Signed Up';
         /**
-         * Same union as the sign-in twin, and deliberately so: one shared
-         * validator covers both events server-side, so they cannot diverge
-         * without splitting it.
+         * The sign-in twin's union minus `'passkey'` — a passkey is registered
+         * from an existing session, never at sign-up.
          *
          * ⚠️ Only `'email'` is emitted today — registration is api-side and has
          * no social leg. The social members are reachable shape, not observed

package/dist/userActivity.d.ts

@@ -160,6 +160,17 @@ declare global {
         trigger: 'self' | 'two-factor-disabled' | 'two-factor-reset';
         target_user_id?: string;
     }
+    /**
+     * A staff member removed a storefront customer's passkeys — `POST /customers`
+     * mode `revoke-passkeys`. Operator-on-customer: `user_id`/`actor_*` are the
+     * operator, `customer_id` the customer. `revoked_count` is how many live
+     * passkeys this action retracted. Carries no credential id, label or host.
+     */
+    interface CustomerPasskeysRevokedEvent extends UserActivityEventBase {
+        event: 'Customer Passkeys Revoked';
+        customer_id: string;
+        revoked_count: number;
+    }
     interface StoreSettingsUpdatedEvent extends UserActivityEventBase {
         event: 'Store Settings Updated';
         section: string;
@@ -1317,7 +1328,7 @@ declare global {
         carrier?: string;
         tracking_set: boolean;
     }
-    type UserActivityEvent = CustomerConsentImportedEvent | CustomerConsentImportCompletedEvent | UserLoggedInEvent | UserLoggedOutEvent | UserPasswordChangedEvent | UserSuspendedEvent | TwoFactorEnrolledEvent | TwoFactorDisabledEvent | TwoFactorResetEvent | TwoFactorRecoveryCodesGeneratedEvent | PasskeyRegisteredEvent | PasskeyRevokedEvent | StoreSettingsUpdatedEvent | PlanChangedEvent | InvoiceCreatedEvent | OrderCreatedEvent | OrderCancelledEvent | OrderEditedEvent | OrderReturnedEvent | ReturnLineRegradedEvent | ProductPriceChangedEvent | CustomerCreatedEvent | CustomerEditedEvent | CustomerRecordServedEvent | CustomerCreditCheckPerformedEvent | CustomersMergedEvent | CustomerMergeCancelledEvent | CashDrawerOpenedEvent | CashDrawerClosedEvent | TenantImpersonatedEvent | SecretRotatedEvent | UserCreatedEvent | UserUpdatedEvent | ProductCreatedEvent | ProductUpdatedEvent | StockIncomeCreatedEvent | StockAdjustedEvent | CategoryCreatedEvent | CategoryUpdatedEvent | BrandCreatedEvent | BrandUpdatedEvent | SupplierCreatedEvent | SupplierUpdatedEvent | SupplierInvoiceCreatedEvent | SupplierInvoiceMatchOverriddenEvent | SupplierClaimRaisedEvent | SupplierClaimStatusChangedEvent | SupplierAccountCreatedEvent | SupplierAccountUpdatedEvent | AccountCreatedEvent | AccountDeletedEvent | CustomerBalanceReprojectedEvent | BasketUpdatedEvent | BasketDiscountGrantedEvent | BasketDeletedEvent | CashDrawerMovementEvent | CashDrawerReconciledEvent | PaymentCreatedEvent | PaymentLinkedEvent | PaymentUnlinkedEvent | PaymentLinkageUpdatedEvent | CreditLimitOverriddenEvent | AppointmentSelfBookingBlockOverriddenEvent | AppointmentSelfBookingBlockLiftedEvent | NotificationReadEvent | LogDeletedEvent | PlanCreatedEvent | StoreMaintenanceToggledEvent | PlatformMaintenanceToggledEvent | MaintenanceBroadcastSentEvent | TenantCreatedEvent | LiteralUpdatedEvent | SupportTicketCreatedEvent | SupportTicketUpdatedEvent | AuditTrailViewedEvent | ReportViewedEvent | CustomerPiiViewedEvent | CashDrawerUiOpenedEvent | CashDrawerUiClosedEvent | ExportInitiatedEvent | ImpersonationUiStartedEvent | ImpersonationUiEndedEvent | PaymentViewedEvent | InvoiceViewedEvent | CustomerDetailViewedEvent | SupplierAccountViewedEvent | SearchPerformedEvent | ActionDeniedEvent | TwoFactorChallengeShownEvent | TwoFactorCodeValidationFailedEvent | TwoFactorEnrollmentStartedEvent | TwoFactorRecoveryCodesRevealedEvent | TwoFactorResetInitiatedEvent | IntegrationTokenRefreshedEvent | WaitlistConvertedEvent | PlatformConfigUpdatedEvent | MlChannelStatusChangedEvent | IntegrationConnectionChangedEvent | PrintRuleCreatedEvent | PrintRuleEditedEvent | PrintRuleDeletedEvent | WebhookCreatedEvent | WebhookUpdatedEvent | WebhookDeletedEvent | PrinterActiveToggledEvent | PrinterRawFormatsUpdatedEvent | PrinterProfileUpdatedEvent | PlanTemplateUpdatedEvent | SupplierAccountDeletedEvent | CustomerPasswordResetInitiatedEvent | UserSessionsRevokedEvent | UserAnonymizedEvent | UserPasswordResetInitiatedByOperatorEvent | AgentCommandDispatchedEvent | PrintJobCancelledEvent | PrintAgentPairingCodeMintedEvent | PrintAgentPairedEvent | PrintAgentRevokedEvent | RmaRequestedEvent | RmaTransitionedEvent | RmaTrackingUpdatedEvent | ClockedInEvent | ClockedOutEvent | AttendanceCorrectedEvent;
+    type UserActivityEvent = CustomerConsentImportedEvent | CustomerConsentImportCompletedEvent | UserLoggedInEvent | UserLoggedOutEvent | UserPasswordChangedEvent | UserSuspendedEvent | TwoFactorEnrolledEvent | TwoFactorDisabledEvent | TwoFactorResetEvent | TwoFactorRecoveryCodesGeneratedEvent | PasskeyRegisteredEvent | PasskeyRevokedEvent | CustomerPasskeysRevokedEvent | StoreSettingsUpdatedEvent | PlanChangedEvent | InvoiceCreatedEvent | OrderCreatedEvent | OrderCancelledEvent | OrderEditedEvent | OrderReturnedEvent | ReturnLineRegradedEvent | ProductPriceChangedEvent | CustomerCreatedEvent | CustomerEditedEvent | CustomerRecordServedEvent | CustomerCreditCheckPerformedEvent | CustomersMergedEvent | CustomerMergeCancelledEvent | CashDrawerOpenedEvent | CashDrawerClosedEvent | TenantImpersonatedEvent | SecretRotatedEvent | UserCreatedEvent | UserUpdatedEvent | ProductCreatedEvent | ProductUpdatedEvent | StockIncomeCreatedEvent | StockAdjustedEvent | CategoryCreatedEvent | CategoryUpdatedEvent | BrandCreatedEvent | BrandUpdatedEvent | SupplierCreatedEvent | SupplierUpdatedEvent | SupplierInvoiceCreatedEvent | SupplierInvoiceMatchOverriddenEvent | SupplierClaimRaisedEvent | SupplierClaimStatusChangedEvent | SupplierAccountCreatedEvent | SupplierAccountUpdatedEvent | AccountCreatedEvent | AccountDeletedEvent | CustomerBalanceReprojectedEvent | BasketUpdatedEvent | BasketDiscountGrantedEvent | BasketDeletedEvent | CashDrawerMovementEvent | CashDrawerReconciledEvent | PaymentCreatedEvent | PaymentLinkedEvent | PaymentUnlinkedEvent | PaymentLinkageUpdatedEvent | CreditLimitOverriddenEvent | AppointmentSelfBookingBlockOverriddenEvent | AppointmentSelfBookingBlockLiftedEvent | NotificationReadEvent | LogDeletedEvent | PlanCreatedEvent | StoreMaintenanceToggledEvent | PlatformMaintenanceToggledEvent | MaintenanceBroadcastSentEvent | TenantCreatedEvent | LiteralUpdatedEvent | SupportTicketCreatedEvent | SupportTicketUpdatedEvent | AuditTrailViewedEvent | ReportViewedEvent | CustomerPiiViewedEvent | CashDrawerUiOpenedEvent | CashDrawerUiClosedEvent | ExportInitiatedEvent | ImpersonationUiStartedEvent | ImpersonationUiEndedEvent | PaymentViewedEvent | InvoiceViewedEvent | CustomerDetailViewedEvent | SupplierAccountViewedEvent | SearchPerformedEvent | ActionDeniedEvent | TwoFactorChallengeShownEvent | TwoFactorCodeValidationFailedEvent | TwoFactorEnrollmentStartedEvent | TwoFactorRecoveryCodesRevealedEvent | TwoFactorResetInitiatedEvent | IntegrationTokenRefreshedEvent | WaitlistConvertedEvent | PlatformConfigUpdatedEvent | MlChannelStatusChangedEvent | IntegrationConnectionChangedEvent | PrintRuleCreatedEvent | PrintRuleEditedEvent | PrintRuleDeletedEvent | WebhookCreatedEvent | WebhookUpdatedEvent | WebhookDeletedEvent | PrinterActiveToggledEvent | PrinterRawFormatsUpdatedEvent | PrinterProfileUpdatedEvent | PlanTemplateUpdatedEvent | SupplierAccountDeletedEvent | CustomerPasswordResetInitiatedEvent | UserSessionsRevokedEvent | UserAnonymizedEvent | UserPasswordResetInitiatedByOperatorEvent | AgentCommandDispatchedEvent | PrintJobCancelledEvent | PrintAgentPairingCodeMintedEvent | PrintAgentPairedEvent | PrintAgentRevokedEvent | RmaRequestedEvent | RmaTransitionedEvent | RmaTrackingUpdatedEvent | ClockedInEvent | ClockedOutEvent | AttendanceCorrectedEvent;
 }
 /**
  * Canonical whitelist of UI-only `UserActivityEvent` variant names. Imported by

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sinfactura-types",
-	"version": "1.10.552",
+	"version": "1.10.554",
 	"description": "Shared wire and entity contracts for the SINFACTURA platform.",
 	"type": "module",
 	"main": "dist/index.js",