@sixtyninecommerce/admin 0.8.0 → 0.9.0

package/dist/client.d.ts

@@ -2,14 +2,23 @@ import { type DeprecationNotice, type RateLimitInfo, type RetryPolicy, type Tena
 import { type ApiTokensModule } from './api-tokens/index.js';
 import { type AppInstallationConfigModule } from './apps/config.js';
 import { type AppCredentialConfig } from './apps/credential.js';
+import { type AppEventSubscriptionModule } from './apps/event-subscription.js';
+import { type AppHookSecretModule } from './apps/hook-secret.js';
 import { type AppsModule } from './apps/index.js';
 import { type AuditModule } from './audit/index.js';
 import { type AuthModule } from './auth/index.js';
+import { type BulkModule } from './bulk/index.js';
+import { type CatalogModule } from './catalog/index.js';
+import { type ComplianceModule } from './compliance/index.js';
 import { type FormsModule } from './content/forms.js';
 import { type CustomObjectsModule } from './custom-objects/index.js';
 import { type CustomersModule } from './customers/index.js';
 import { type DocumentsModule } from './documents/index.js';
+import { type EventsModule } from './events/index.js';
+import { type FeedsModule } from './feeds/index.js';
+import { type FulfillmentsModule } from './fulfillments/index.js';
 import { type HeadsModule } from './heads/index.js';
+import { type HooksModule } from './hooks/index.js';
 import { type JobsModule } from './jobs/index.js';
 import { type LocationsModule } from './locations/index.js';
 import { type MetaModule } from './meta/index.js';
@@ -17,13 +26,33 @@ import { type MetafieldsModule } from './metafields/index.js';
 import { type OrdersModule } from './orders/index.js';
 import { type PaymentsModule } from './payments/index.js';
 import { type PlatformAppsModule } from './platform/apps.js';
+import { type PlatformCatalogModule } from './platform/catalog.js';
+import { type PlatformEntitlementsModule } from './platform/entitlements.js';
+import { type PlatformLegalEntitiesModule } from './platform/legal-entities.js';
+import { type PlatformOrganizationsModule } from './platform/organizations.js';
 import { type PlatformModule } from './platform/provision-store.js';
+import { type PlatformReportsModule } from './platform/reports.js';
+import { type PlatformServerMetricsModule } from './platform/server-metrics.js';
+import { type PosModule } from './pos/index.js';
+import { type PricingModule } from './pricing/index.js';
+import { type ProvenanceModule } from './provenance/index.js';
+import { type ReportsModule } from './reports/index.js';
 import { type RedirectsModule } from './seo/redirects.js';
+import { type ParcelCountSuggestionMethod } from './shipping/parcel-count-suggestion.js';
+import { type ShippingModule } from './shipping/parcel-rule.js';
+import { type StockModule } from './stock/index.js';
+import { type StoredValueModule } from './stored-value/index.js';
 import { type TaxModule } from './tax/index.js';
 import { type CapabilitiesModule } from './tenant/capabilities.js';
 import { type ChannelsModule } from './tenant/channels.js';
+import { type TenantEntitlementsReader } from './tenant/entitlements.js';
+import { type FieldGroupOwnersReader, type FieldGroupSyncSourcesReader } from './tenant/field-groups.js';
+import { type LegalEntityModule } from './tenant/legal-entity.js';
+import { type NotificationsModule } from './tenant/notifications.js';
 import { type RetentionModule } from './tenant/retention.js';
+import { type SettingsSourcesModule } from './tenant/settings-sources.js';
 import { type UploadsModule } from './uploads/index.js';
+import { type UsersModule } from './users/index.js';
 export interface AdminClientConfig {
     urls: {
         vendureUrl: string;
@@ -71,21 +100,54 @@ export interface AdminClient {
     apiTokens: ApiTokensModule;
     /** Installing and managing apps on the ACTIVE store. Needs `InstallApps`. */
     apps: AppsModule & {
-        /** One installation's own surfaces. `config` is its settings form (spec §8.13). */
+        /**
+         * One installation's own surfaces. `config` is its settings form (spec §8.13);
+         * `eventSubscription` is the calling installation's event subscription and
+         * its signing secret (spec §6.9), read with the installation's own credential.
+         */
         installation: {
             config: AppInstallationConfigModule;
+            eventSubscription: AppEventSubscriptionModule;
+            /**
+             * The calling installation's hook signing secret, ONCE (spec §8.14): read it
+             * with the installation's own credential and hand it to `createHookHandler`.
+             */
+            hookSecret: AppHookSecretModule;
         };
     };
     audit: AuditModule;
+    /**
+     * Products, variants, options, facets, collections, assets, visibility and
+     * properties (spec §9.2 `catalog`). Needs the catalog permissions.
+     */
+    catalog: CatalogModule;
     channels: ChannelsModule;
     content: {
         forms: FormsModule;
     };
+    /**
+     * Compliance requests to installed apps: data requests, customer and
+     * post-uninstall redactions, their acknowledgements and who is overdue (spec §6.9).
+     */
+    compliance: ComplianceModule;
     /**
      * Invoices, credit notes and packing slips: issuing them, the numbered facts
      * they were built from, and the store's own extension blocks (spec §8.5).
      */
     documents: DocumentsModule;
+    /**
+     * App hooks (spec §8.14): calls the PLATFORM makes to an installed app, signed,
+     * budgeted, never redirected and audited. `assignments` makes an installed app
+     * the store's tax, payment or fulfillment provider; `ping` tests one hook.
+     */
+    hooks: HooksModule;
+    /**
+     * Platform events (spec §6.9): `poll`/`pollAll`/`replay`/`head` over the event log (a
+     * machine credential with `ReadPlatformEvents`), `subscribe` to build a typed webhook
+     * endpoint, and `subscriptions.*` for where events are pushed (`ManageEventSubscriptions`,
+     * the `events` token template).
+     */
+    events: EventsModule;
     /**
      * Customers — the commerce master record, plus their groups and addresses.
      * `list`/`get` need `ReadCustomer`, the writes `UpdateCustomer`, and `erase`
@@ -93,9 +155,25 @@ export interface AdminClient {
      * a customer across channels by email and is not reachable through this SDK.
      */
     customers: CustomersModule;
+    /**
+     * A fulfillment's parcels, per-parcel barcodes, merged carrier label, and
+     * the request that labels every parcel still missing one.
+     */
+    fulfillments: FulfillmentsModule;
+    /**
+     * Product feeds (spec §8.14): the configurations, their rule ASTs, the runs
+     * and item issues the generator produces, the Google-taxonomy mapping and the
+     * AI helpers. Channel-scoped throughout — no method takes a channel.
+     */
+    feeds: FeedsModule;
     /** The store's head registry: every client surface it serves (spec §6.7). */
     heads: HeadsModule;
     /** Every long-running operation the platform runs, under one resource (spec §6.11). */
+    /**
+     * JSONL bulk import and export (spec §6.11, §15.22): a million rows as one
+     * job, per-row outcomes, and none of your rate limit spent on the rows.
+     */
+    bulk: BulkModule;
     jobs: JobsModule;
     /** Stock-location profiles (spec §8.7); `TenantContext.location` names one by id. */
     locations: LocationsModule;
@@ -109,8 +187,9 @@ export interface AdminClient {
     /** App and platform custom data on core entities (spec §8.13, §8.4). */
     metafields: MetafieldsModule;
     /**
-     * Surcharges on a placed order (spec §8.6 for `taxClass`), and the deposit
-     * flow: park, read the payment position, settle (spec §8.2, §15.5).
+     * Surcharges on a placed order (spec §8.6 for `taxClass`), the deposit
+     * flow: park, read the payment position, settle (spec §8.2, §15.5), and the
+     * parcel count its shipping was charged for (`parcelCharge`).
      */
     orders: OrdersModule;
     /**
@@ -118,9 +197,47 @@ export interface AdminClient {
      * recorded against an order with what it stands at (spec §8.2).
      */
     payments: PaymentsModule;
+    /**
+     * Point of sale on a machine principal (spec §8.8): register sessions, cash,
+     * tenders, the sale, refunds, X and Z — with no paired tablet. Needs a `pos`
+     * token restricted to the location it sells from, and `tenant.location`.
+     */
+    pos: PosModule;
+    /**
+     * Promotions at the register (spec §9.2 `pricing`): the promotions a register
+     * can offer now, coupons — plain and unique codes — on a Draft order, and what
+     * each discount did to each line.
+     */
+    pricing: PricingModule;
+    /**
+     * Who last changed each field group (price, stock, product details, customer details) of a
+     * product, variant or customer, and whether an app or key manages it (spec §8.10). Last
+     * writer only; the history is the platform event log.
+     */
+    provenance: ProvenanceModule;
+    /** Tenant reporting in minor units and ISO-8601 UTC (spec §9.2 `reports`, §9.3). */
+    reports: ReportsModule;
     seo: {
         redirects: RedirectsModule;
     };
+    /**
+     * Shipping of the ACTIVE channel (spec §9.2 `shipping`): the channel's
+     * `parcelRule`, and `parcelCountSuggestion` for a set of variant items.
+     */
+    shipping: ShippingModule & {
+        parcelCountSuggestion: ParcelCountSuggestionMethod;
+    };
+    /**
+     * Stock per location by state, the ledger with reasons, reason-carrying
+     * adjustments, transfers and allocation release (spec §9.2 `stock`, §8.7).
+     */
+    stock: StockModule;
+    /**
+     * Stored value (incentives program): gift cards, store credit and points on one ledger —
+     * accounts, statements, liability, staff issue/adjust/block, and spending a balance as a
+     * payment on an order.
+     */
+    storedValue: StoredValueModule;
     /** The store's own tax classes and their per-country mappings (spec §8.6). */
     tax: TaxModule;
     /**
@@ -128,10 +245,40 @@ export interface AdminClient {
      * bytes straight to the object store, then hand the id to a consuming call.
      */
     uploads: UploadsModule;
+    /**
+     * The active store's staff (spec §7 `users.ensure`): `ensure` brings a person to exactly these
+     * roles in one repeatable call (created, attached, restored or unchanged), `update` changes their
+     * names or login email.
+     */
+    users: UsersModule;
     /** The calling tenant's own settings. Always the ACTIVE channel — no channel argument. */
     tenant: {
         capabilities: CapabilitiesModule;
+        /**
+         * The plugins the active store may use: its own grants and its organization's, as the
+         * engine's operation gate reads them, uncached. Needs `ReadCatalog` or `ReadSettings`.
+         */
+        entitlements: TenantEntitlementsReader;
+        /**
+         * Who owns each field group on the active store (an app installation or an API token), as
+         * the grant rules read it. Release one with `apps.releaseFieldGroup`.
+         */
+        fieldGroupOwners: FieldGroupOwnersReader;
+        /** The field groups Exact Online or the store's organization already writes here. */
+        fieldGroupSyncSources: FieldGroupSyncSourcesReader;
         retention: RetentionModule;
+        /** Per notification event: on or off, who sends it (spec §8.15), and to whom. */
+        notifications: NotificationsModule;
+        /**
+         * Where each settings group comes from — the store or its organization — and the store's
+         * choice to keep its own values (multi-region spec §5.3).
+         */
+        settingsSources: SettingsSourcesModule;
+        /**
+         * The active store's legal entity: the company its invoices name (multi-region spec §7.1).
+         * Changing it needs `UpdateSeller` on every store of the entity.
+         */
+        legalEntity: LegalEntityModule;
     };
     /**
      * Human SuperAdmin surface. Every method refuses an API token or an app
@@ -140,6 +287,27 @@ export interface AdminClient {
      */
     platform: PlatformModule & {
         apps: PlatformAppsModule;
+        /** Catalogue maintenance on a named store (the translation-language repair). */
+        catalog: PlatformCatalogModule;
+        /**
+         * Which external plugins each store may use: read one store's grants or every store's, and
+         * connect or disconnect a plugin for a store — see {@link PlatformEntitlementsModule}.
+         */
+        entitlements: PlatformEntitlementsModule;
+        /**
+         * The platform's legal entities (multi-region spec §7.1): SuperAdmin list and create; read and
+         * update through every store of an entity — see {@link PlatformLegalEntitiesModule}.
+         */
+        legalEntities: PlatformLegalEntitiesModule;
+        /**
+         * Organizations and their plugin entitlements (multi-region spec §5.1).
+         * An organization admin reads and edits its own with the organization's
+         * workspace channel as the tenant — see {@link PlatformOrganizationsModule}.
+         */
+        organizations: PlatformOrganizationsModule;
+        reports: PlatformReportsModule;
+        /** Basic health of the platform's own servers (CPU, memory, disk, network). */
+        serverMetrics: PlatformServerMetricsModule;
     };
     /** A derived client on another tenant, sharing this one's principal. */
     withTenant(tenant: Partial<TenantContext> & {

package/dist/client.js

@@ -1,15 +1,24 @@
-import { createChannelResolver, createTransport, mergeTenant, UNSCOPED_TENANT, ValidationError, } from '@sixtyninecommerce/core';
+import { createChannelResolver, createTransport, isBrowserRuntime, mergeTenant, UNSCOPED_TENANT, ValidationError, } from '@sixtyninecommerce/core';
 import { createApiTokensModule } from './api-tokens/index.js';
 import { createAppConfigModule } from './apps/config.js';
 import { createAppCredential, } from './apps/credential.js';
+import { createAppEventSubscriptionModule, } from './apps/event-subscription.js';
+import { createAppHookSecretModule } from './apps/hook-secret.js';
 import { createAppsModule } from './apps/index.js';
 import { createAuditModule } from './audit/index.js';
 import { createAuthModule } from './auth/index.js';
+import { createBulkModule } from './bulk/index.js';
+import { createCatalogModule } from './catalog/index.js';
+import { createComplianceModule } from './compliance/index.js';
 import { createFormsModule } from './content/forms.js';
 import { createCustomObjectsModule } from './custom-objects/index.js';
 import { createCustomersModule } from './customers/index.js';
 import { createDocumentsModule } from './documents/index.js';
+import { createEventsModule } from './events/index.js';
+import { createFeedsModule } from './feeds/index.js';
+import { createFulfillmentsModule } from './fulfillments/index.js';
 import { createHeadsModule } from './heads/index.js';
+import { createHooksModule } from './hooks/index.js';
 import { createJobsModule } from './jobs/index.js';
 import { createLocationsModule } from './locations/index.js';
 import { createMetaModule } from './meta/index.js';
@@ -17,13 +26,33 @@ import { createMetafieldsModule } from './metafields/index.js';
 import { createOrdersModule } from './orders/index.js';
 import { createPaymentsModule } from './payments/index.js';
 import { createPlatformAppsModule } from './platform/apps.js';
+import { createPlatformCatalogModule } from './platform/catalog.js';
+import { createPlatformEntitlementsModule, } from './platform/entitlements.js';
+import { createPlatformLegalEntitiesModule, } from './platform/legal-entities.js';
+import { createPlatformOrganizationsModule, } from './platform/organizations.js';
 import { createPlatformModule } from './platform/provision-store.js';
+import { createPlatformReportsModule } from './platform/reports.js';
+import { createPlatformServerMetricsModule, } from './platform/server-metrics.js';
+import { createPosModule } from './pos/index.js';
+import { createPricingModule } from './pricing/index.js';
+import { createProvenanceModule } from './provenance/index.js';
+import { createReportsModule } from './reports/index.js';
 import { createRedirectsModule } from './seo/redirects.js';
+import { createParcelCountSuggestion, } from './shipping/parcel-count-suggestion.js';
+import { createShippingModule } from './shipping/parcel-rule.js';
+import { createStockModule } from './stock/index.js';
+import { createStoredValueModule } from './stored-value/index.js';
 import { createTaxModule } from './tax/index.js';
 import { createCapabilitiesModule } from './tenant/capabilities.js';
 import { createChannelsModule } from './tenant/channels.js';
+import { createTenantEntitlementsReader, } from './tenant/entitlements.js';
+import { createFieldGroupOwnersReader, createFieldGroupSyncSourcesReader, } from './tenant/field-groups.js';
+import { createLegalEntityModule } from './tenant/legal-entity.js';
+import { createNotificationsModule } from './tenant/notifications.js';
 import { createRetentionModule } from './tenant/retention.js';
+import { createSettingsSourcesModule, } from './tenant/settings-sources.js';
 import { createUploadsModule } from './uploads/index.js';
+import { createUsersModule } from './users/index.js';
 /**
  * An admin credential in a browser is a credential the whole internet can read
  * (spec §18 amendment 3, §15.21). A SESSION bearer is fine there — that is what
@@ -35,11 +64,9 @@ function assertNotInBrowser(auth) {
     // long-lived token is, and for the same reason.
     if (!('token' in auth) && !('app' in auth))
         return;
-    // Indexed off a typed view of globalThis: this package compiles without the
-    // DOM lib on purpose, so that a stray `document.` reference cannot slip in.
-    const runtime = globalThis;
-    const inBrowser = runtime.window !== undefined && runtime.document !== undefined;
-    if (!inBrowser)
+    // `core`'s one definition of "a browser", which the storefront SDK's
+    // private-token refusal uses too, so the two SDKs cannot disagree about it.
+    if (!isBrowserRuntime())
         return;
     const credential = 'app' in auth ? "An app's private key" : 'An API token';
     throw new ValidationError({
@@ -157,7 +184,11 @@ function assertSessionIsWritable(session) {
  */
 function buildAppsModule(transport) {
     const apps = createAppsModule(transport);
-    const installation = Object.assign((id, options) => apps.installation(id, options), { config: createAppConfigModule(transport) });
+    const installation = Object.assign((id, options) => apps.installation(id, options), {
+        config: createAppConfigModule(transport),
+        eventSubscription: createAppEventSubscriptionModule(transport),
+        hookSecret: createAppHookSecretModule(transport),
+    });
     return { ...apps, installation };
 }
 export function createAdminClient(config) {
@@ -325,6 +356,17 @@ function buildClient(config, overrides, resolver, shared, credential) {
     // No guard here: the transport refuses an unscoped call itself with
     // TENANT_REQUIRED unless it opts in, and only `auth` does. One rule, in the
     // one place that knows what left the process.
+    const jobsModule = createJobsModule(transport);
+    // The PUT goes to the object store, not to this platform, so it needs the
+    // caller's own fetch rather than the transport — which would attach the
+    // tenant headers and the bearer to a request that must carry neither.
+    const uploadsModule = createUploadsModule(transport, config.fetch ?? globalThis.fetch);
+    // Composed from the two modules it is built on rather than re-implementing
+    // either: `import` stages the file through `uploads` — the exact
+    // `Content-Length` + `Content-Type` + `client_token` protocol, in one place
+    // — and waits on the run through `jobs`, which owns the polling loop.
+    // `reports.export` rides the same export machinery, so it shares both.
+    const bulkModule = createBulkModule(transport, uploadsModule, jobsModule);
     return {
         auth: createAuthModule(transport, store && {
             present: () => store.read() !== '',
@@ -346,32 +388,59 @@ function buildClient(config, overrides, resolver, shared, credential) {
         }),
         apiTokens: createApiTokensModule(transport),
         apps: buildAppsModule(transport),
+        bulk: bulkModule,
         audit: createAuditModule(transport),
+        catalog: createCatalogModule(transport),
         channels: createChannelsModule(resolver),
         content: { forms: createFormsModule(transport) },
+        fulfillments: createFulfillmentsModule(transport),
         heads: createHeadsModule(transport),
-        jobs: createJobsModule(transport),
+        jobs: jobsModule,
         locations: createLocationsModule(transport),
         meta: createMetaModule(transport),
         customObjects: createCustomObjectsModule(transport),
         metafields: createMetafieldsModule(transport),
         orders: createOrdersModule(transport),
         payments: createPaymentsModule(transport),
+        pos: createPosModule(transport),
+        pricing: createPricingModule(transport),
+        provenance: createProvenanceModule(transport),
+        reports: createReportsModule(transport, bulkModule, jobsModule, () => tenant.location),
         documents: createDocumentsModule(transport),
+        hooks: createHooksModule(transport),
+        events: createEventsModule(transport),
         customers: createCustomersModule(transport),
+        compliance: createComplianceModule(transport),
+        feeds: createFeedsModule(transport),
         seo: { redirects: createRedirectsModule(transport) },
+        shipping: {
+            ...createShippingModule(transport),
+            parcelCountSuggestion: createParcelCountSuggestion(transport),
+        },
+        stock: createStockModule(transport),
+        storedValue: createStoredValueModule(transport),
         tax: createTaxModule(transport),
-        // The PUT goes to the object store, not to this platform, so it needs the
-        // caller's own fetch rather than the transport — which would attach the
-        // tenant headers and the bearer to a request that must carry neither.
-        uploads: createUploadsModule(transport, config.fetch ?? globalThis.fetch),
+        uploads: uploadsModule,
+        users: createUsersModule(transport),
         tenant: {
             capabilities: createCapabilitiesModule(transport),
+            entitlements: createTenantEntitlementsReader(transport),
+            fieldGroupOwners: createFieldGroupOwnersReader(transport),
+            fieldGroupSyncSources: createFieldGroupSyncSourcesReader(transport),
             retention: createRetentionModule(transport),
+            notifications: createNotificationsModule(transport),
+            settingsSources: createSettingsSourcesModule(transport),
+            legalEntity: createLegalEntityModule(transport),
         },
         platform: {
             ...createPlatformModule(transport, config),
             apps: createPlatformAppsModule(transport, config),
+            catalog: createPlatformCatalogModule(transport, config),
+            entitlements: createPlatformEntitlementsModule(transport, config),
+            legalEntities: createPlatformLegalEntitiesModule(transport, config),
+            organizations: createPlatformOrganizationsModule(transport, config),
+            reports: createPlatformReportsModule(transport, config),
+            serverMetrics: createPlatformServerMetricsModule(transport, config),
         },
         withTenant(next) {
             // `mergeTenant`, not a spread: it merges `actor` FIELD BY FIELD, so a

package/dist/compliance/index.d.ts

@@ -0,0 +1,88 @@
+import { type Page, type Transport } from '@sixtyninecommerce/core';
+import type { Call, ListOptions } from '../types.js';
+/**
+ * Compliance requests — what the platform asks of the apps installed on a
+ * store (headless spec §6.9 "Compliance events").
+ *
+ * Three kinds, each delivered to every app installation as an event whatever
+ * its event filters say:
+ *
+ * - `data` — `customer.data_requested`, raised with
+ *   `admin.customers.requestData`: tell the merchant what you hold about this
+ *   person;
+ * - `customer_redact` — `customer.redact_requested`, raised by
+ *   `admin.customers.erase`: erase your copy of this person;
+ * - `installation_redact` — `installation.redact_requested`, 48 hours after
+ *   your app was uninstalled: erase what you hold about this store. It cannot
+ *   be acknowledged (the installation has no credential any more).
+ *
+ * An app acknowledges a request within 30 days (`dueAt`) with
+ * {@link ComplianceModule.acknowledge}, using its own installation token. The
+ * merchant reads the state with {@link ComplianceModule.list}: an addressed
+ * installation that has not acknowledged by `dueAt` is listed in
+ * `overdueInstallationIds`. Overdue is reported, never enforced: nothing is
+ * suspended.
+ */
+export declare const COMPLIANCE_REQUEST_FIELDS = "\n  id\n  kind\n  subjectId\n  requestedBy\n  reason\n  requestedAt\n  dueAt\n  addressedInstallationIds\n  acknowledgements { id requestId installationId acknowledgedAt note }\n  overdueInstallationIds\n  overdue\n";
+export declare const LIST_QUERY = "\n  query ComplianceRequests($options: ComplianceRequestListOptions) {\n    complianceRequests(options: $options) {\n      items { \n  id\n  kind\n  subjectId\n  requestedBy\n  reason\n  requestedAt\n  dueAt\n  addressedInstallationIds\n  acknowledgements { id requestId installationId acknowledgedAt note }\n  overdueInstallationIds\n  overdue\n }\n      totalItems\n    }\n  }\n";
+export declare const ACKNOWLEDGE_MUTATION = "\n  mutation AcknowledgeComplianceRequest($requestId: ID!, $note: String, $idempotencyKey: String) {\n    acknowledgeComplianceRequest(requestId: $requestId, note: $note, idempotencyKey: $idempotencyKey) {\n      id\n      requestId\n      installationId\n      acknowledgedAt\n      note\n    }\n  }\n";
+export type ComplianceRequestKind = 'data' | 'customer_redact' | 'installation_redact';
+export interface ComplianceAcknowledgement {
+    id: string;
+    requestId: string;
+    installationId: string;
+    /** ISO-8601. */
+    acknowledgedAt: string;
+    /** The app's note. Blanked when the customer the request is about is erased. */
+    note: string | null;
+}
+export interface ComplianceRequest {
+    id: string;
+    kind: ComplianceRequestKind;
+    /** The customer id, or the installation id for `installation_redact`. */
+    subjectId: string;
+    /** `<kind>:<id>` of who asked (`user:`, `api_token:`, `app_installation:`, `system:`). */
+    requestedBy: string | null;
+    /** The merchant's reason on a data request. Never sent to apps. */
+    reason: string | null;
+    /** ISO-8601. */
+    requestedAt: string;
+    /** ISO-8601; `requestedAt` + 30 days. */
+    dueAt: string;
+    /** The installations it was delivered to, as they stood when it was raised. */
+    addressedInstallationIds: string[];
+    acknowledgements: ComplianceAcknowledgement[];
+    /** Addressed installations with no acknowledgement once `dueAt` has passed. */
+    overdueInstallationIds: string[];
+    overdue: boolean;
+    [extra: string]: unknown;
+}
+export interface ComplianceListOptions extends ListOptions {
+    kind?: ComplianceRequestKind;
+    /** A customer id, or an installation id for `installation_redact`. */
+    subjectId?: string;
+    /** Only requests addressed to this installation. */
+    installationId?: string;
+    /** Only requests past `dueAt` with an unacknowledged addressed installation. */
+    overdueOnly?: boolean;
+}
+export interface AcknowledgeComplianceOptions extends Call {
+    /**
+     * Up to 1000 characters. Refused (`COMPLIANCE_NOTE_NOT_ALLOWED`) on a request
+     * about a customer who has been erased: nothing about them may outlive it.
+     */
+    note?: string;
+}
+export interface ComplianceModule {
+    /** This store's compliance requests, newest first. Needs ReadCustomer, ReadSettings or InstallApps. */
+    list(options?: ComplianceListOptions): Promise<Page<ComplianceRequest>>;
+    /**
+     * Acknowledge a request delivered to your app. Call it with the app's OWN
+     * installation token (`PermissionDeniedError` `COMPLIANCE_ACKNOWLEDGE_NOT_ALLOWED`
+     * otherwise); a request that was not delivered to your installation is
+     * `NotFoundError` `COMPLIANCE_REQUEST_NOT_FOUND`. Acknowledging twice answers
+     * the first acknowledgement.
+     */
+    acknowledge(requestId: string, options?: AcknowledgeComplianceOptions): Promise<ComplianceAcknowledgement>;
+}
+export declare function createComplianceModule(transport: Transport): ComplianceModule;

package/dist/compliance/index.js

@@ -0,0 +1,88 @@
+import { pageFromVendureList, readOffsetCursor, } from '@sixtyninecommerce/core';
+/**
+ * Compliance requests — what the platform asks of the apps installed on a
+ * store (headless spec §6.9 "Compliance events").
+ *
+ * Three kinds, each delivered to every app installation as an event whatever
+ * its event filters say:
+ *
+ * - `data` — `customer.data_requested`, raised with
+ *   `admin.customers.requestData`: tell the merchant what you hold about this
+ *   person;
+ * - `customer_redact` — `customer.redact_requested`, raised by
+ *   `admin.customers.erase`: erase your copy of this person;
+ * - `installation_redact` — `installation.redact_requested`, 48 hours after
+ *   your app was uninstalled: erase what you hold about this store. It cannot
+ *   be acknowledged (the installation has no credential any more).
+ *
+ * An app acknowledges a request within 30 days (`dueAt`) with
+ * {@link ComplianceModule.acknowledge}, using its own installation token. The
+ * merchant reads the state with {@link ComplianceModule.list}: an addressed
+ * installation that has not acknowledged by `dueAt` is listed in
+ * `overdueInstallationIds`. Overdue is reported, never enforced: nothing is
+ * suspended.
+ */
+export const COMPLIANCE_REQUEST_FIELDS = /* GraphQL */ `
+  id
+  kind
+  subjectId
+  requestedBy
+  reason
+  requestedAt
+  dueAt
+  addressedInstallationIds
+  acknowledgements { id requestId installationId acknowledgedAt note }
+  overdueInstallationIds
+  overdue
+`;
+export const LIST_QUERY = /* GraphQL */ `
+  query ComplianceRequests($options: ComplianceRequestListOptions) {
+    complianceRequests(options: $options) {
+      items { ${COMPLIANCE_REQUEST_FIELDS} }
+      totalItems
+    }
+  }
+`;
+export const ACKNOWLEDGE_MUTATION = /* GraphQL */ `
+  mutation AcknowledgeComplianceRequest($requestId: ID!, $note: String, $idempotencyKey: String) {
+    acknowledgeComplianceRequest(requestId: $requestId, note: $note, idempotencyKey: $idempotencyKey) {
+      id
+      requestId
+      installationId
+      acknowledgedAt
+      note
+    }
+  }
+`;
+const DEFAULT_PAGE_SIZE = 25;
+export function createComplianceModule(transport) {
+    const listPage = async (skip, take, options) => {
+        const filter = {
+            kind: options?.kind ?? null,
+            subjectId: options?.subjectId ?? null,
+            installationId: options?.installationId ?? null,
+            overdueOnly: options?.overdueOnly ?? null,
+        };
+        const data = await transport.graphql({ api: 'admin', query: LIST_QUERY, variables: { options: { skip, take, filter } } }, options);
+        return pageFromVendureList(data.complianceRequests, skip, take, (cursor) => listPage(readOffsetCursor(cursor), take, options));
+    };
+    return {
+        list(options) {
+            const take = options?.limit ?? DEFAULT_PAGE_SIZE;
+            const skip = options?.after === undefined ? 0 : readOffsetCursor(options.after);
+            return listPage(skip, take, options);
+        },
+        async acknowledge(requestId, options) {
+            const data = await transport.graphql({
+                api: 'admin',
+                query: ACKNOWLEDGE_MUTATION,
+                variables: {
+                    requestId,
+                    note: options?.note ?? null,
+                    idempotencyKey: options?.idempotencyKey ?? null,
+                },
+            }, options);
+            return data.acknowledgeComplianceRequest;
+        },
+    };
+}

package/dist/customer-data-redaction.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Reads the Admin API's `customerDataRedaction` response extension (W7-12): it
+ * says how many field positions the caller's customer-data level blanked.
+ *
+ * One watcher per call: `onExtensions` goes on the transport call, and `mark`
+ * stamps `redacted: true` on each record of the answer when anything was
+ * withheld. Without the stamp a blanked field reads as "none on record".
+ */
+export declare function redactionWatcher(): {
+    onExtensions: (extensions: Readonly<Record<string, unknown>>) => void;
+    mark: <T extends {
+        redacted?: true;
+    } | null>(record: T) => T;
+};

package/dist/customer-data-redaction.js

@@ -0,0 +1,22 @@
+/**
+ * Reads the Admin API's `customerDataRedaction` response extension (W7-12): it
+ * says how many field positions the caller's customer-data level blanked.
+ *
+ * One watcher per call: `onExtensions` goes on the transport call, and `mark`
+ * stamps `redacted: true` on each record of the answer when anything was
+ * withheld. Without the stamp a blanked field reads as "none on record".
+ */
+export function redactionWatcher() {
+    let withheld = false;
+    return {
+        onExtensions(extensions) {
+            const redaction = extensions.customerDataRedaction;
+            withheld = typeof redaction?.fields === 'number' && redaction.fields > 0;
+        },
+        mark(record) {
+            if (record && withheld)
+                record.redacted = true;
+            return record;
+        },
+    };
+}