@thinkai/tai-api-contract 2.46.0-pr.858.7e24f603 → 2.47.0

package/openapi/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: ThinkAI API
-  version: 2.46.0
+  version: 2.47.0
   description: >
     Contract surface for the AI Driven SDLC backend used by ThinkAI.
     Workspace-scoped routes use `/workspaces/{workspaceId}/...`.
@@ -327,6 +327,56 @@ paths:
           description: Updated
         "401":
           $ref: "#/components/responses/Unauthorized"
+    delete:
+      tags: [Me]
+      summary: Delete current user account and all owned data
+      operationId: deleteMe
+      description: >
+        Self-service account deletion. Hard-deletes the authenticated user in a single
+        atomic transaction with the same semantics as admin `deleteUserAndData` (#428):
+        owned workspaces (and all workspace-level child tables via CASCADE), membership
+        rows in other workspaces, invitations where the user is `invited_by`, and the
+        user row itself. After the DB commit, removes the corresponding Supabase Auth
+        user via the service-role key; Auth deletion failure is logged but does not
+        roll back the DB changes.
+
+        **Irreversible.** Owned workspaces in the #440 soft-delete grace period are
+        also hard-deleted immediately; there is no restore window after account delete.
+
+        **Authorization:** Bearer JWT required. Body must include the caller's email
+        exactly (case-insensitive) as a type-to-confirm guard.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeleteMeBodyDto"
+      responses:
+        "204":
+          description: Account and all owned data deleted.
+        "400":
+          description: Missing or mismatched confirmation email.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorMessageDto"
+              example:
+                error: Confirmation email does not match account email
+                code: email_mismatch
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "409":
+          description: Identity conflict resolving the current user.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorMessageDto"
+        "503":
+          description: Account deletion not supported by the configured store.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorMessageDto"
 
   /me/workspaces:
     get:
@@ -7784,6 +7834,17 @@ components:
           type: string
           nullable: true
 
+    DeleteMeBodyDto:
+      type: object
+      required: [email]
+      properties:
+        email:
+          type: string
+          format: email
+          description: >
+            Must match the authenticated user's email (case-insensitive). Acts as
+            a type-to-confirm guard against accidental deletion.
+
     WorkspaceSummaryDto:
       type: object
       required: [id, slug, name, status, role]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thinkai/tai-api-contract",
-  "version": "2.46.0-pr.858.7e24f603",
+  "version": "2.47.0",
   "private": false,
   "type": "module",
   "main": "dist/index.js",

package/src/generated/openapi.ts

@@ -82,7 +82,13 @@ export interface paths {
         /** Update current user profile */
         put: operations["updateMe"];
         post?: never;
-        delete?: never;
+        /**
+         * Delete current user account and all owned data
+         * @description Self-service account deletion. Hard-deletes the authenticated user in a single atomic transaction with the same semantics as admin `deleteUserAndData` (#428): owned workspaces (and all workspace-level child tables via CASCADE), membership rows in other workspaces, invitations where the user is `invited_by`, and the user row itself. After the DB commit, removes the corresponding Supabase Auth user via the service-role key; Auth deletion failure is logged but does not roll back the DB changes.
+         *     **Irreversible.** Owned workspaces in the #440 soft-delete grace period are also hard-deleted immediately; there is no restore window after account delete.
+         *     **Authorization:** Bearer JWT required. Body must include the caller's email exactly (case-insensitive) as a type-to-confirm guard.
+         */
+        delete: operations["deleteMe"];
         options?: never;
         head?: never;
         patch?: never;
@@ -3104,6 +3110,13 @@ export interface components {
             email?: string;
             defaultWorkspaceId?: string | null;
         };
+        DeleteMeBodyDto: {
+            /**
+             * Format: email
+             * @description Must match the authenticated user's email (case-insensitive). Acts as a type-to-confirm guard against accidental deletion.
+             */
+            email: string;
+        };
         WorkspaceSummaryDto: {
             id: string;
             slug: string;
@@ -4716,6 +4729,7 @@ export type AiToolMemberHeatmapDayDto = components['schemas']['AiToolMemberHeatm
 export type AiToolMemberDetailDto = components['schemas']['AiToolMemberDetailDto'];
 export type MeProfileDto = components['schemas']['MeProfileDto'];
 export type UpdateMeBodyDto = components['schemas']['UpdateMeBodyDto'];
+export type DeleteMeBodyDto = components['schemas']['DeleteMeBodyDto'];
 export type WorkspaceSummaryDto = components['schemas']['WorkspaceSummaryDto'];
 export type WorkspacesForUserDto = components['schemas']['WorkspacesForUserDto'];
 export type CreateWorkspaceBodyDto = components['schemas']['CreateWorkspaceBodyDto'];
@@ -5113,6 +5127,62 @@ export interface operations {
             401: components["responses"]["Unauthorized"];
         };
     };
+    deleteMe: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DeleteMeBodyDto"];
+            };
+        };
+        responses: {
+            /** @description Account and all owned data deleted. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Missing or mismatched confirmation email. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Confirmation email does not match account email",
+                     *       "code": "email_mismatch"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            /** @description Identity conflict resolving the current user. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Account deletion not supported by the configured store. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
     listMyWorkspaces: {
         parameters: {
             query?: never;