platform-types 1.10.749 → 1.10.751

package/dist/auth.d.ts

@@ -1464,7 +1464,9 @@ declare global {
  *   not supply. Naming it on sign-in would enumerate the customer table.
  * - `SIGN_IN_IDENTITY_UNVERIFIED` (link, `social`, `social-bridge-mint`,
  *   `register-social`) — the provider asserts an identity it has not itself
- *   verified. Never the disabled-account answer: that stays `USER_NOT_ENABLED`.
+ *   verified. Never the disabled-account answer: that is `USER_NOT_ENABLED` —
+ *   `400` at these sign-in doors, and `401` at the storefront `refresh`, which
+ *   answers it for a disabled OR missing customer row so the session ends.
  * - `INVALID_ID_TOKEN` — the token failed verification outright: malformed,
  *   expired, or signed by the wrong issuer. Retryable by re-authenticating.
  * - `SIGN_IN_PROVIDER_UNSUPPORTED` — the provider is not one this store accepts.
@@ -1622,8 +1624,13 @@ export type CustomerSocialRegisterErrorCode = (typeof CUSTOMER_SOCIAL_REGISTER_E
  *   than deactivated.
  * - `ROLE_NOT_ALLOWED` · 401 — the role no longer permits this surface. The
  *   session was legitimate when minted and is not any more.
+ * - `USER_NOT_ENABLED` · 401 — storefront only: the customer row is disabled or
+ *   gone (one code for both there). Fatal like the members above.
+ * - `CUSTOMER_ACCESS_PENDING` / `CUSTOMER_ACCESS_REJECTED` · 401 — storefront
+ *   only: the customer's access is awaiting approval or was rejected
+ *   (`Customer.accessState`). Fatal like the members above: end the session.
  *
- * ⚠️ These three are FATAL and must not be retried. A consumer that classifies
+ * ⚠️ These are FATAL and must not be retried. A consumer that classifies
  * fatality by matching a code list, WITHOUT also reading the status, silently
  * omits them the moment they are added here — and a disabled client then
  * refreshes forever against an account that will never be re-enabled by
@@ -1633,7 +1640,7 @@ export type CustomerSocialRegisterErrorCode = (typeof CUSTOMER_SOCIAL_REGISTER_E
  * retryable produces an infinite refresh loop against a token that will never
  * verify again.
  */
-export declare const REFRESH_ERROR_CODES: readonly ["MISSING_REFRESH_TOKEN", "INVALID_REFRESH_TOKEN", "NOT_A_REFRESH_TOKEN", "LEGACY_STATELESS_TOKEN", "CSRF_ORIGIN_REJECTED", "REFRESH_TOKEN_UNKNOWN", "FAMILY_REVOKED", "SESSION_EXPIRED_ABSOLUTE", "CONCURRENT_ROTATION", "ACCOUNT_DISABLED", "USER_NOT_FOUND", "ROLE_NOT_ALLOWED"];
+export declare const REFRESH_ERROR_CODES: readonly ["MISSING_REFRESH_TOKEN", "INVALID_REFRESH_TOKEN", "NOT_A_REFRESH_TOKEN", "LEGACY_STATELESS_TOKEN", "CSRF_ORIGIN_REJECTED", "REFRESH_TOKEN_UNKNOWN", "FAMILY_REVOKED", "SESSION_EXPIRED_ABSOLUTE", "CONCURRENT_ROTATION", "ACCOUNT_DISABLED", "USER_NOT_FOUND", "ROLE_NOT_ALLOWED", "USER_NOT_ENABLED", "CUSTOMER_ACCESS_PENDING", "CUSTOMER_ACCESS_REJECTED"];
 export type RefreshErrorCode = (typeof REFRESH_ERROR_CODES)[number];
 /**
  * Login-leg discriminators that are a CHALLENGE rather than a refusal — the
@@ -1688,6 +1695,10 @@ export type StepUpErrorCode = (typeof STEP_UP_ERROR_CODES)[number];
  * - `ACCOUNT_LOCKED` · 403 — brute-force lockout; the response carries
  *   `retryAfterSeconds` (see `AccountLockedResponse`).
  * - `ACCOUNT_DISABLED` · 400 — the user row is disabled.
+ * - `CUSTOMER_ACCESS_PENDING` / `CUSTOMER_ACCESS_REJECTED` · 403 — storefront
+ *   only: the customer's credentials are right but the store has not approved
+ *   the account (`Customer.accessState`), or rejected it. Terminal for the
+ *   attempt; retrying or resetting the password cannot change it.
  * - `CAPTCHA_REQUIRED` / `CAPTCHA_INVALID` — the browser captcha tier.
  * - `ATTESTATION_REQUIRED` / `ATTESTATION_INVALID` — the mobile
  *   (body-transport) equivalents of the two above.
@@ -1702,7 +1713,7 @@ export type StepUpErrorCode = (typeof STEP_UP_ERROR_CODES)[number];
  * the wire from four emitters all along and every client was silently falling
  * through to a generic "login failed".
  */
-export declare const LOGIN_ERROR_CODES: readonly ["ACCOUNT_VERIFICATION_FAILED", "WRONG_CREDENTIALS", "ACCOUNT_LOCKED", "ACCOUNT_DISABLED", "CAPTCHA_REQUIRED", "CAPTCHA_INVALID", "ATTESTATION_REQUIRED", "ATTESTATION_INVALID", "ROLE_NOT_ALLOWED"];
+export declare const LOGIN_ERROR_CODES: readonly ["ACCOUNT_VERIFICATION_FAILED", "WRONG_CREDENTIALS", "ACCOUNT_LOCKED", "ACCOUNT_DISABLED", "CUSTOMER_ACCESS_PENDING", "CUSTOMER_ACCESS_REJECTED", "CAPTCHA_REQUIRED", "CAPTCHA_INVALID", "ATTESTATION_REQUIRED", "ATTESTATION_INVALID", "ROLE_NOT_ALLOWED"];
 /**
  * Second-factor FAILURES on the login step-up — the siblings of
  * `STEP_UP_ERROR_CODES`' single success-path discriminator.

package/dist/auth.js

@@ -48,7 +48,9 @@
  *   not supply. Naming it on sign-in would enumerate the customer table.
  * - `SIGN_IN_IDENTITY_UNVERIFIED` (link, `social`, `social-bridge-mint`,
  *   `register-social`) — the provider asserts an identity it has not itself
- *   verified. Never the disabled-account answer: that stays `USER_NOT_ENABLED`.
+ *   verified. Never the disabled-account answer: that is `USER_NOT_ENABLED` —
+ *   `400` at these sign-in doors, and `401` at the storefront `refresh`, which
+ *   answers it for a disabled OR missing customer row so the session ends.
  * - `INVALID_ID_TOKEN` — the token failed verification outright: malformed,
  *   expired, or signed by the wrong issuer. Retryable by re-authenticating.
  * - `SIGN_IN_PROVIDER_UNSUPPORTED` — the provider is not one this store accepts.
@@ -221,8 +223,13 @@ export const CUSTOMER_SOCIAL_REGISTER_ERROR_CODES = [
  *   than deactivated.
  * - `ROLE_NOT_ALLOWED` · 401 — the role no longer permits this surface. The
  *   session was legitimate when minted and is not any more.
+ * - `USER_NOT_ENABLED` · 401 — storefront only: the customer row is disabled or
+ *   gone (one code for both there). Fatal like the members above.
+ * - `CUSTOMER_ACCESS_PENDING` / `CUSTOMER_ACCESS_REJECTED` · 401 — storefront
+ *   only: the customer's access is awaiting approval or was rejected
+ *   (`Customer.accessState`). Fatal like the members above: end the session.
  *
- * ⚠️ These three are FATAL and must not be retried. A consumer that classifies
+ * ⚠️ These are FATAL and must not be retried. A consumer that classifies
  * fatality by matching a code list, WITHOUT also reading the status, silently
  * omits them the moment they are added here — and a disabled client then
  * refreshes forever against an account that will never be re-enabled by
@@ -245,6 +252,9 @@ export const REFRESH_ERROR_CODES = [
     'ACCOUNT_DISABLED',
     'USER_NOT_FOUND',
     'ROLE_NOT_ALLOWED',
+    'USER_NOT_ENABLED',
+    'CUSTOMER_ACCESS_PENDING',
+    'CUSTOMER_ACCESS_REJECTED',
 ];
 /**
  * Login-leg discriminators that are a CHALLENGE rather than a refusal — the
@@ -298,6 +308,10 @@ export const STEP_UP_ERROR_CODES = ['REQUIRES_2FA', 'ENROLLMENT_REQUIRED'];
  * - `ACCOUNT_LOCKED` · 403 — brute-force lockout; the response carries
  *   `retryAfterSeconds` (see `AccountLockedResponse`).
  * - `ACCOUNT_DISABLED` · 400 — the user row is disabled.
+ * - `CUSTOMER_ACCESS_PENDING` / `CUSTOMER_ACCESS_REJECTED` · 403 — storefront
+ *   only: the customer's credentials are right but the store has not approved
+ *   the account (`Customer.accessState`), or rejected it. Terminal for the
+ *   attempt; retrying or resetting the password cannot change it.
  * - `CAPTCHA_REQUIRED` / `CAPTCHA_INVALID` — the browser captcha tier.
  * - `ATTESTATION_REQUIRED` / `ATTESTATION_INVALID` — the mobile
  *   (body-transport) equivalents of the two above.
@@ -317,6 +331,8 @@ export const LOGIN_ERROR_CODES = [
     'WRONG_CREDENTIALS',
     'ACCOUNT_LOCKED',
     'ACCOUNT_DISABLED',
+    'CUSTOMER_ACCESS_PENDING',
+    'CUSTOMER_ACCESS_REJECTED',
     'CAPTCHA_REQUIRED',
     'CAPTCHA_INVALID',
     'ATTESTATION_REQUIRED',

package/dist/cjs/auth.js

@@ -51,7 +51,9 @@ exports.SESSION_ACTION_ERROR_CODES = exports.PASSKEY_ERROR_CODES = exports.TWO_F
  *   not supply. Naming it on sign-in would enumerate the customer table.
  * - `SIGN_IN_IDENTITY_UNVERIFIED` (link, `social`, `social-bridge-mint`,
  *   `register-social`) — the provider asserts an identity it has not itself
- *   verified. Never the disabled-account answer: that stays `USER_NOT_ENABLED`.
+ *   verified. Never the disabled-account answer: that is `USER_NOT_ENABLED` —
+ *   `400` at these sign-in doors, and `401` at the storefront `refresh`, which
+ *   answers it for a disabled OR missing customer row so the session ends.
  * - `INVALID_ID_TOKEN` — the token failed verification outright: malformed,
  *   expired, or signed by the wrong issuer. Retryable by re-authenticating.
  * - `SIGN_IN_PROVIDER_UNSUPPORTED` — the provider is not one this store accepts.
@@ -224,8 +226,13 @@ exports.CUSTOMER_SOCIAL_REGISTER_ERROR_CODES = [
  *   than deactivated.
  * - `ROLE_NOT_ALLOWED` · 401 — the role no longer permits this surface. The
  *   session was legitimate when minted and is not any more.
+ * - `USER_NOT_ENABLED` · 401 — storefront only: the customer row is disabled or
+ *   gone (one code for both there). Fatal like the members above.
+ * - `CUSTOMER_ACCESS_PENDING` / `CUSTOMER_ACCESS_REJECTED` · 401 — storefront
+ *   only: the customer's access is awaiting approval or was rejected
+ *   (`Customer.accessState`). Fatal like the members above: end the session.
  *
- * ⚠️ These three are FATAL and must not be retried. A consumer that classifies
+ * ⚠️ These are FATAL and must not be retried. A consumer that classifies
  * fatality by matching a code list, WITHOUT also reading the status, silently
  * omits them the moment they are added here — and a disabled client then
  * refreshes forever against an account that will never be re-enabled by
@@ -248,6 +255,9 @@ exports.REFRESH_ERROR_CODES = [
     'ACCOUNT_DISABLED',
     'USER_NOT_FOUND',
     'ROLE_NOT_ALLOWED',
+    'USER_NOT_ENABLED',
+    'CUSTOMER_ACCESS_PENDING',
+    'CUSTOMER_ACCESS_REJECTED',
 ];
 /**
  * Login-leg discriminators that are a CHALLENGE rather than a refusal — the
@@ -301,6 +311,10 @@ exports.STEP_UP_ERROR_CODES = ['REQUIRES_2FA', 'ENROLLMENT_REQUIRED'];
  * - `ACCOUNT_LOCKED` · 403 — brute-force lockout; the response carries
  *   `retryAfterSeconds` (see `AccountLockedResponse`).
  * - `ACCOUNT_DISABLED` · 400 — the user row is disabled.
+ * - `CUSTOMER_ACCESS_PENDING` / `CUSTOMER_ACCESS_REJECTED` · 403 — storefront
+ *   only: the customer's credentials are right but the store has not approved
+ *   the account (`Customer.accessState`), or rejected it. Terminal for the
+ *   attempt; retrying or resetting the password cannot change it.
  * - `CAPTCHA_REQUIRED` / `CAPTCHA_INVALID` — the browser captcha tier.
  * - `ATTESTATION_REQUIRED` / `ATTESTATION_INVALID` — the mobile
  *   (body-transport) equivalents of the two above.
@@ -320,6 +334,8 @@ exports.LOGIN_ERROR_CODES = [
     'WRONG_CREDENTIALS',
     'ACCOUNT_LOCKED',
     'ACCOUNT_DISABLED',
+    'CUSTOMER_ACCESS_PENDING',
+    'CUSTOMER_ACCESS_REJECTED',
     'CAPTCHA_REQUIRED',
     'CAPTCHA_INVALID',
     'ATTESTATION_REQUIRED',

package/dist/cjs/order.js

@@ -386,6 +386,9 @@ exports.orderFulfilmentProgress = orderFulfilmentProgress;
  *   and the live customer has not verified. No data payload; before cart read.
  * - `ACCOUNT_DISABLED` · 403 — the live customer is disabled. No data payload;
  *   before cart read. This is distinct from the staff `CUSTOMER_DISABLED` code.
+ * - `CUSTOMER_ACCESS_PENDING` / `CUSTOMER_ACCESS_REJECTED` · 403 — the live
+ *   customer's storefront access awaits approval or was rejected
+ *   (`Customer.accessState`). No data payload; checked beside `ACCOUNT_DISABLED`.
  *
  * Commit-time drawer refusals, on a create whose cash tender books into a
  * drawer shift. No order committed, but a coupon redeemed before the commit
@@ -630,6 +633,8 @@ exports.ORDER_ERROR_CODES = [
     'ORDER_INVALID_CART',
     'EMAIL_VERIFICATION_REQUIRED',
     'ACCOUNT_DISABLED',
+    'CUSTOMER_ACCESS_PENDING',
+    'CUSTOMER_ACCESS_REJECTED',
     // Commit-time drawer refusals; `CURRENCY_MISMATCH` carries its fields at the body's top level.
     'CURRENCY_MISMATCH',
     'SHIFT_NOT_OPEN',

package/dist/cjs/store.js

@@ -20,7 +20,8 @@ exports.CUSTOM_DOMAIN_SLOT_LIMIT = 2;
 exports.CUSTOM_DOMAIN_ROW_LIMIT = 10;
 /**
  * Every `StoreOnboardingReviewArea` — the ONE list. `PATCH /store` validates
- * `config.onboarding.reviewed` against it, so an area is added in one place.
+ * both `config.onboarding.reviewed` and `onboardingReviewAdd` against it, so an
+ * area is added in one place.
  */
 exports.STORE_ONBOARDING_REVIEW_AREAS = ['payments', 'delivery', 'pricing'];
 /**

package/dist/customer.d.ts

@@ -130,6 +130,12 @@ declare global {
          * `'all'`: both.
          */
         disabled?: 'true' | 'false' | 'all';
+        /**
+         * `'pending'`: only customers waiting for storefront access approval
+         * (`Customer.accessState === 'pending'`). Absent: no access filter. ANDs with
+         * every other parameter, `disabled` included.
+         */
+        accessState?: 'pending';
         /** `'true'`: customers who have bought at least once. `'false'`: never bought. */
         withBuy?: 'true' | 'false';
         /**
@@ -258,6 +264,27 @@ declare global {
          */
         zoneIds?: string[];
         disabled: boolean;
+        /**
+         * Storefront ACCESS approval. ABSENT MEANS APPROVED — every row that
+         * predates approval mode, and every row created in `open` mode, carries no
+         * attribute and signs in as before.
+         *
+         * - `'pending'` — written by the storefront `register` / `register-social`
+         *   when the store's `ecommerce.config.registrationMode` is `'approval'`.
+         *   The account exists, but sign-in and refresh are refused
+         *   (`CUSTOMER_ACCESS_PENDING`), checkout refuses, and the catalogue prices
+         *   the shopper as a guest.
+         * - `'rejected'` — written by an admin-tier operator edit
+         *   (`POST /customers { accessState: 'rejected' }`), which also revokes every
+         *   session of the customer. Refused the same way with
+         *   `CUSTOMER_ACCESS_REJECTED`.
+         *
+         * The operator approves with `POST /customers { accessState: 'approved' }`,
+         * which REMOVES the attribute — `'approved'` is a request value only and is
+         * never stored. Independent of `disabled`: a disabled row is refused for
+         * that reason whatever this says.
+         */
+        accessState?: 'pending' | 'rejected';
         discount: number;
         /** Absent after erasure or the final merge flip; registration still requires an address. */
         email?: string;

package/dist/order.d.ts

@@ -2694,6 +2694,9 @@ export declare const orderFulfilmentProgress: (order: OrderFulfilmentProgressInp
  *   and the live customer has not verified. No data payload; before cart read.
  * - `ACCOUNT_DISABLED` · 403 — the live customer is disabled. No data payload;
  *   before cart read. This is distinct from the staff `CUSTOMER_DISABLED` code.
+ * - `CUSTOMER_ACCESS_PENDING` / `CUSTOMER_ACCESS_REJECTED` · 403 — the live
+ *   customer's storefront access awaits approval or was rejected
+ *   (`Customer.accessState`). No data payload; checked beside `ACCOUNT_DISABLED`.
  *
  * Commit-time drawer refusals, on a create whose cash tender books into a
  * drawer shift. No order committed, but a coupon redeemed before the commit
@@ -2820,6 +2823,6 @@ export declare const orderFulfilmentProgress: (order: OrderFulfilmentProgressInp
  * `SUBSCRIPTION_READONLY`) sit on the order CREATE leg only: an edit is not a new
  * order, so `bareOrderPostHandler` routes past `requireMetered` entirely.
  */
-export declare const ORDER_ERROR_CODES: readonly ["ORDER_COST_DENOMINATION_UNKNOWN", "SERVICE_ORDER_DELIVERY_MANAGED", "ORDER_NOT_FOUND", "ORDER_LOCKED", "ORDER_NOT_READY", "ORDER_DELIVERED_ANOTHER_DAY", "ORDER_DELIVERY_STATE_UNCHANGED", "ORDER_ILLEGAL_TRANSITION", "ORDER_VERSION_CONFLICT", "CUSTOMER_NOT_FOUND", "CUSTOMER_MERGED", "ORDER_HAS_NO_CUSTOMER", "CUSTOMER_ANONYMIZED", "FX_CONVERSION_UNAVAILABLE", "ROLE_FORBIDDEN", "ORDER_CANCELLED", "PAYMENT_SETTLED_ON_ANOTHER_ORDER", "ORDER_HAS_SHIPMENTS", "ORDER_HAS_RETURNS", "SHIPMENT_QUANTITY_EXCEEDED", "SHIPMENT_LINE_MISMATCH", "SHIPMENT_NOT_FOUND", "SHIPMENT_LIMIT_REACHED", "SHIPMENT_TOO_LARGE", "ORDER_FULFILMENT_EXTERNAL", "SHIPMENT_FAILED", "ADMIN_REQUIRED", "IDEMPOTENCY_KEY_REQUIRED", "INVALID_IDEMPOTENCY_KEY", "IDEMPOTENCY_KEY_REUSE", "IDEMPOTENCY_IN_PROGRESS", "IDEMPOTENCY_LOCK_CONTENTION", "IDEMPOTENCY_KEY_FAILED", "IDEMPOTENT_RESPONSE_NOT_CACHED", "ORDER_CANCELLATION_NOT_PROTECTED", "ORDER_CANCELLATION_COMMITTED", "ORDER_CANCELLATION_LOCKED", "ORDER_CANCELLATION_TOO_LARGE", "ORDER_CANCELLATION_FAILED", "SALE_LEDGER_RETRACTION_REFUSED", "SALE_LEDGER_ROW_NOT_OWNED", "PRODUCT_NOT_FOUND", "PRODUCT_SALE_LIMIT_EXCEEDED", "PRODUCT_SALE_LIMIT_INVALID", "DEPOSIT_SOURCE_NOT_ALLOWED", "DEPOSIT_CURRENCY_MISMATCH", "DEPOSIT_EXCEEDS_TOTAL", "DEPOSIT_FREEZE_REQUIRES_INVOICE", "DEPOSIT_FREEZE_INVOICE_PENDING", "DEPOSIT_CHARACTERIZATION_CONFLICT", "DEPOSIT_FREEZE_INVOICE_NOT_QUALIFYING", "DEPOSIT_INVOICED_ORDER_MUST_FREEZE", "DEPOSIT_FROZEN_ORDER_MUST_FREEZE", "DEPOSIT_REFERENCE_IS_LINKED_PAYMENT", "DEPOSIT_DUPLICATE_REFERENCE", "TILL_TENDER_REQUIRES_DEPOSIT", "PAYMENT_REFERENCED_BY_DEPOSIT", "ORDER_HAS_UNREFUNDED_DEPOSIT", "ORDER_PRICE_FROZEN", "DEPOSIT_NOT_FOUND", "DEPOSIT_ALREADY_REFUNDED", "UNIT_QUANTITY_NOT_WHOLE", "UNIT_REVISION_STALE", "UNIT_QUANTITY_UNREPRESENTABLE", "KIT_RECIPE_CHANGED", "CART_PROMOTION_UNAVAILABLE", "ORDER_HAS_KIT_LINES", "ORDER_TARGET_REQUIRED", "ORDER_SOURCE_CONFLICT", "ORDER_CUSTOMER_REQUIRED", "BASKET_EMPTY", "BASKET_CHANGED_DURING_CHECKOUT", "CART_VERSION_CREATE_ONLY", "CART_VERSION_REQUIRES_CART_ID", "CART_REVISION_STALE", "CART_CUSTOMER_MISMATCH", "COUNTER_SALE_CREATE_ONLY", "SOLD_AT_CREATE_ONLY", "SOLD_AT_IN_FUTURE", "ORDER_TENDER_CREATE_ONLY", "CREDIT_OVERRIDE_CREATE_ONLY", "ON_ACCOUNT_CREATE_ONLY", "ON_ACCOUNT_WITH_TENDERS", "TENDERS_REQUIRE_COUNTER_SALE", "LINES_REQUIRE_COUNTER_SALE", "PRODUCT_COST_UNKNOWN", "PRICE_CHANGE_DISABLED", "LINE_DISCOUNT_EXCEEDS_MAX", "CUSTOMER_DISABLED", "SHIFT_NOT_AVAILABLE", "SOLD_AT_OUTSIDE_SHIFT", "ORDER_CURRENCY_NOT_SUBSCRIBED", "PAYMENT_METHODS_NOT_CONFIGURED", "PAYMENT_METHOD_NOT_FOUND", "DELIVERY_METHOD_NOT_FOUND", "ORDER_BELOW_MINIMUM_PURCHASE", "ORDER_INVALID_CART", "EMAIL_VERIFICATION_REQUIRED", "ACCOUNT_DISABLED", "CURRENCY_MISMATCH", "SHIFT_NOT_OPEN", "ORDER_DISCOUNT_AFTER_INVOICE", "ORDER_DISCOUNT_ON_SERVICE_ORDER", "ORDER_DISCOUNT_ON_MARKETPLACE_ORDER", "ORDER_INVOICE_METHOD_OUTSTANDING_FACTURA", "ORDER_SERVICE_PERIOD_AFTER_INVOICE", "ORDER_ATTEMPT_COMMITTED", "ORDER_ATTEMPT_ABANDONED", "ORDER_ATTEMPT_KEY_EXPIRED", "ORDER_ATTEMPT_KEY_SCOPE_MISMATCH", "ORDER_COMPLETION_ATTEMPT_COMMITTED", "ORDER_COMPLETION_ATTEMPT_ABANDONED"];
+export declare const ORDER_ERROR_CODES: readonly ["ORDER_COST_DENOMINATION_UNKNOWN", "SERVICE_ORDER_DELIVERY_MANAGED", "ORDER_NOT_FOUND", "ORDER_LOCKED", "ORDER_NOT_READY", "ORDER_DELIVERED_ANOTHER_DAY", "ORDER_DELIVERY_STATE_UNCHANGED", "ORDER_ILLEGAL_TRANSITION", "ORDER_VERSION_CONFLICT", "CUSTOMER_NOT_FOUND", "CUSTOMER_MERGED", "ORDER_HAS_NO_CUSTOMER", "CUSTOMER_ANONYMIZED", "FX_CONVERSION_UNAVAILABLE", "ROLE_FORBIDDEN", "ORDER_CANCELLED", "PAYMENT_SETTLED_ON_ANOTHER_ORDER", "ORDER_HAS_SHIPMENTS", "ORDER_HAS_RETURNS", "SHIPMENT_QUANTITY_EXCEEDED", "SHIPMENT_LINE_MISMATCH", "SHIPMENT_NOT_FOUND", "SHIPMENT_LIMIT_REACHED", "SHIPMENT_TOO_LARGE", "ORDER_FULFILMENT_EXTERNAL", "SHIPMENT_FAILED", "ADMIN_REQUIRED", "IDEMPOTENCY_KEY_REQUIRED", "INVALID_IDEMPOTENCY_KEY", "IDEMPOTENCY_KEY_REUSE", "IDEMPOTENCY_IN_PROGRESS", "IDEMPOTENCY_LOCK_CONTENTION", "IDEMPOTENCY_KEY_FAILED", "IDEMPOTENT_RESPONSE_NOT_CACHED", "ORDER_CANCELLATION_NOT_PROTECTED", "ORDER_CANCELLATION_COMMITTED", "ORDER_CANCELLATION_LOCKED", "ORDER_CANCELLATION_TOO_LARGE", "ORDER_CANCELLATION_FAILED", "SALE_LEDGER_RETRACTION_REFUSED", "SALE_LEDGER_ROW_NOT_OWNED", "PRODUCT_NOT_FOUND", "PRODUCT_SALE_LIMIT_EXCEEDED", "PRODUCT_SALE_LIMIT_INVALID", "DEPOSIT_SOURCE_NOT_ALLOWED", "DEPOSIT_CURRENCY_MISMATCH", "DEPOSIT_EXCEEDS_TOTAL", "DEPOSIT_FREEZE_REQUIRES_INVOICE", "DEPOSIT_FREEZE_INVOICE_PENDING", "DEPOSIT_CHARACTERIZATION_CONFLICT", "DEPOSIT_FREEZE_INVOICE_NOT_QUALIFYING", "DEPOSIT_INVOICED_ORDER_MUST_FREEZE", "DEPOSIT_FROZEN_ORDER_MUST_FREEZE", "DEPOSIT_REFERENCE_IS_LINKED_PAYMENT", "DEPOSIT_DUPLICATE_REFERENCE", "TILL_TENDER_REQUIRES_DEPOSIT", "PAYMENT_REFERENCED_BY_DEPOSIT", "ORDER_HAS_UNREFUNDED_DEPOSIT", "ORDER_PRICE_FROZEN", "DEPOSIT_NOT_FOUND", "DEPOSIT_ALREADY_REFUNDED", "UNIT_QUANTITY_NOT_WHOLE", "UNIT_REVISION_STALE", "UNIT_QUANTITY_UNREPRESENTABLE", "KIT_RECIPE_CHANGED", "CART_PROMOTION_UNAVAILABLE", "ORDER_HAS_KIT_LINES", "ORDER_TARGET_REQUIRED", "ORDER_SOURCE_CONFLICT", "ORDER_CUSTOMER_REQUIRED", "BASKET_EMPTY", "BASKET_CHANGED_DURING_CHECKOUT", "CART_VERSION_CREATE_ONLY", "CART_VERSION_REQUIRES_CART_ID", "CART_REVISION_STALE", "CART_CUSTOMER_MISMATCH", "COUNTER_SALE_CREATE_ONLY", "SOLD_AT_CREATE_ONLY", "SOLD_AT_IN_FUTURE", "ORDER_TENDER_CREATE_ONLY", "CREDIT_OVERRIDE_CREATE_ONLY", "ON_ACCOUNT_CREATE_ONLY", "ON_ACCOUNT_WITH_TENDERS", "TENDERS_REQUIRE_COUNTER_SALE", "LINES_REQUIRE_COUNTER_SALE", "PRODUCT_COST_UNKNOWN", "PRICE_CHANGE_DISABLED", "LINE_DISCOUNT_EXCEEDS_MAX", "CUSTOMER_DISABLED", "SHIFT_NOT_AVAILABLE", "SOLD_AT_OUTSIDE_SHIFT", "ORDER_CURRENCY_NOT_SUBSCRIBED", "PAYMENT_METHODS_NOT_CONFIGURED", "PAYMENT_METHOD_NOT_FOUND", "DELIVERY_METHOD_NOT_FOUND", "ORDER_BELOW_MINIMUM_PURCHASE", "ORDER_INVALID_CART", "EMAIL_VERIFICATION_REQUIRED", "ACCOUNT_DISABLED", "CUSTOMER_ACCESS_PENDING", "CUSTOMER_ACCESS_REJECTED", "CURRENCY_MISMATCH", "SHIFT_NOT_OPEN", "ORDER_DISCOUNT_AFTER_INVOICE", "ORDER_DISCOUNT_ON_SERVICE_ORDER", "ORDER_DISCOUNT_ON_MARKETPLACE_ORDER", "ORDER_INVOICE_METHOD_OUTSTANDING_FACTURA", "ORDER_SERVICE_PERIOD_AFTER_INVOICE", "ORDER_ATTEMPT_COMMITTED", "ORDER_ATTEMPT_ABANDONED", "ORDER_ATTEMPT_KEY_EXPIRED", "ORDER_ATTEMPT_KEY_SCOPE_MISMATCH", "ORDER_COMPLETION_ATTEMPT_COMMITTED", "ORDER_COMPLETION_ATTEMPT_ABANDONED"];
 export type OrderErrorCode = (typeof ORDER_ERROR_CODES)[number];
 export {};

package/dist/order.js

@@ -379,6 +379,9 @@ export const orderFulfilmentProgress = (order) => {
  *   and the live customer has not verified. No data payload; before cart read.
  * - `ACCOUNT_DISABLED` · 403 — the live customer is disabled. No data payload;
  *   before cart read. This is distinct from the staff `CUSTOMER_DISABLED` code.
+ * - `CUSTOMER_ACCESS_PENDING` / `CUSTOMER_ACCESS_REJECTED` · 403 — the live
+ *   customer's storefront access awaits approval or was rejected
+ *   (`Customer.accessState`). No data payload; checked beside `ACCOUNT_DISABLED`.
  *
  * Commit-time drawer refusals, on a create whose cash tender books into a
  * drawer shift. No order committed, but a coupon redeemed before the commit
@@ -623,6 +626,8 @@ export const ORDER_ERROR_CODES = [
     'ORDER_INVALID_CART',
     'EMAIL_VERIFICATION_REQUIRED',
     'ACCOUNT_DISABLED',
+    'CUSTOMER_ACCESS_PENDING',
+    'CUSTOMER_ACCESS_REJECTED',
     // Commit-time drawer refusals; `CURRENCY_MISMATCH` carries its fields at the body's top level.
     'CURRENCY_MISMATCH',
     'SHIFT_NOT_OPEN',

package/dist/pricing.d.ts

@@ -27,6 +27,15 @@ declare global {
         order?: number;
         defaultCurrency?: string;
         tierGated?: boolean;
+        /**
+         * Which shopper audience this list is MEANT for. Absent means `'retail'`.
+         *
+         * ⚠️ Content targeting only — it lets the storefront and the operator tell
+         * a wholesale tier from a retail one. It is NEVER a statement about
+         * consumer-law applicability: nothing may drop a price disclosure, a tax
+         * line or a consumer right because a customer's list says `'wholesale'`.
+         */
+        audienceClass?: 'retail' | 'wholesale';
     }
     /**
      * Quantity break within a slot. Resolution: highest `minQty <= qty` wins.

package/dist/store.d.ts

@@ -135,6 +135,17 @@ declare global {
              * Never sent to shoppers.
              */
             newCustomerPriceList?: number;
+            /**
+             * How storefront self-registration admits a shopper. Absent means
+             * `'open'`: the account is usable at once, as it always was.
+             * `'approval'`: `register` / `register-social` create the customer with
+             * `accessState: 'pending'` and issue no session until an admin-tier
+             * operator approves it (`POST /customers { accessState: 'approved' }`).
+             * Written by `PATCH /store` (ADMIN) and `PUT /platform/stores/{storeId}`
+             * (MANAGER). SENT TO SHOPPERS (web `GET /store` and the customer `stores`
+             * frame), so the storefront can say the account needs approval.
+             */
+            registrationMode?: 'open' | 'approval';
             showStocks?: boolean;
         };
         sidebar?: {
@@ -177,7 +188,7 @@ declare global {
      * data: { field: 'ecommerce.config.newCustomerPriceList', value: number }; nothing written.
      */
     interface EcommercePatchInput {
-        config?: Pick<NonNullable<Ecommerce['config']>, 'showDefaultPriceList' | 'newCustomerPriceList'> & StorefrontLiveSettingsPatch;
+        config?: Pick<NonNullable<Ecommerce['config']>, 'showDefaultPriceList' | 'newCustomerPriceList' | 'registrationMode'> & StorefrontLiveSettingsPatch;
         sidebar?: Ecommerce['sidebar'];
         home?: Omit<NonNullable<Ecommerce['home']>, 'displayOrders' | 'displayProfile'>;
         themeColors?: Ecommerce['themeColors'];
@@ -875,8 +886,14 @@ declare global {
              * Guided-setup onboarding progress (ADR-0020). First-login is derived
              * FE-side (absent, or neither `completed` nor `skipped` ⇒ show wizard).
              * `reviewed` lists the seeded setup areas the admin confirmed with «Ya
-             * lo revisé»; absent ⇒ none reviewed. The block is replaced wholesale on
-             * `PATCH /store`, so a writer must carry `reviewed` forward.
+             * lo revisé»; absent ⇒ none reviewed. No `PATCH /store` removes a mark: a
+             * body carrying this block writes `step` / `completed` / `skipped` as sent
+             * (member by member onto a stored block) and never SETs `reviewed` — each
+             * incoming area is appended conditionally after that write, so the result
+             * is the stored list followed by every new area, a block sent without
+             * `reviewed` keeps the stored list, and a mark another browser lands while
+             * the request is in flight survives. To ADD a mark without sending the
+             * block, use `StoreUpdateInput.onboardingReviewAdd`.
              */
             onboarding?: {
                 step: number;
@@ -1686,6 +1703,23 @@ declare global {
         newPhotoURL?: string;
         /** Leaves to REMOVE from the row — see `StoreRemovableField`. */
         removeFields?: StoreRemovableField[];
+        /**
+         * `PATCH /store` only (the closed `POST /store` body refuses it 400). Adds
+         * each area to `config.onboarding.reviewed` with its own conditional
+         * append on the store row — no read-modify-write — so two browsers marking
+         * different areas at once both persist, and an area already present is a
+         * no-op. At least one area; repeats collapse; any value outside
+         * `STORE_ONBOARDING_REVIEW_AREAS` is a 400 with nothing written. A store
+         * with no `config.onboarding` gets `{ step: 0, completed: false, skipped:
+         * false }` plus the added areas, which the wizard reads as absence did.
+         * Writable by every role that may write `config.onboarding` (USER
+         * included). Applied AFTER the rest of the same body, together with any
+         * areas in a `config.onboarding.reviewed` sent alongside it (that list's
+         * first); the block itself never SETs the list, so it cannot drop an area.
+         * The main write committing and an append then failing answers an error but
+         * still broadcasts the row as it stands.
+         */
+        onboardingReviewAdd?: StoreOnboardingReviewArea[];
     }
     interface Method {
         id: number;
@@ -2117,7 +2151,8 @@ export declare const CUSTOM_DOMAIN_SLOT_LIMIT = 2;
 export declare const CUSTOM_DOMAIN_ROW_LIMIT = 10;
 /**
  * Every `StoreOnboardingReviewArea` — the ONE list. `PATCH /store` validates
- * `config.onboarding.reviewed` against it, so an area is added in one place.
+ * both `config.onboarding.reviewed` and `onboardingReviewAdd` against it, so an
+ * area is added in one place.
  */
 export declare const STORE_ONBOARDING_REVIEW_AREAS: readonly ["payments", "delivery", "pricing"];
 /**

package/dist/store.js

@@ -17,7 +17,8 @@ export const CUSTOM_DOMAIN_SLOT_LIMIT = 2;
 export const CUSTOM_DOMAIN_ROW_LIMIT = 10;
 /**
  * Every `StoreOnboardingReviewArea` — the ONE list. `PATCH /store` validates
- * `config.onboarding.reviewed` against it, so an area is added in one place.
+ * both `config.onboarding.reviewed` and `onboardingReviewAdd` against it, so an
+ * area is added in one place.
  */
 export const STORE_ONBOARDING_REVIEW_AREAS = ['payments', 'delivery', 'pricing'];
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.749",
+	"version": "1.10.751",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",