platform-types 1.10.811 → 1.10.813

package/dist/auth.d.ts

@@ -1905,6 +1905,37 @@ export type PasskeyErrorCode = (typeof PASSKEY_ERROR_CODES)[number];
  */
 export declare const SESSION_ACTION_ERROR_CODES: readonly ["SESSION_LOOKUP_INCOMPLETE", "SESSION_UNKNOWN", "REVOKE_INCOMPLETE"];
 export type SessionActionErrorCode = (typeof SESSION_ACTION_ERROR_CODES)[number];
+/**
+ * `body.error` codes `POST /auth/account-deletion` (staff self-deletion,
+ * {@link StaffAccountDeletionInput}) refuses with. Complete for that route.
+ * Nothing is anonymised on any of them.
+ *
+ * - `VALIDATION_FAILED` · 400 — the body failed the schema.
+ * - `USER001_PROTECTED` · 403 — the founding user cannot delete the account.
+ * - `USER_PLATFORM_ROLE_PROTECTED` · 403 — a SUPERVISOR or MANAGER, on any store.
+ * - `USER_NOT_FOUND` · 404 — the token has no USER row (a paired PRINTER).
+ * - `ACCOUNT_DISABLED` · 400 — the account is suspended.
+ * - `OPEN_DRAWER_BLOCKS_DELETION` · 409 — the user holds an open cash drawer;
+ *   close it first.
+ * - `PASSWORD_REQUIRED_FOR_DELETION` · 409 — the account has no password to
+ *   re-authenticate with; set one first. Counts no login failure.
+ * - `ACCOUNT_LOCKED` · 403 — the shared brute-force lockout; carries
+ *   `retryAfterSeconds` (`AccountLockedResponse`).
+ * - `WRONG_CREDENTIALS` · ⚠️ **401** here (400 on login) — wrong current
+ *   password; counted on the shared login counter.
+ * - `REQUIRES_2FA` · 401 — 2FA is enrolled and no `code` was sent.
+ * - `INVALID_2FA_CODE` · 401 — wrong or used `code`.
+ * - `2FA_LOCKED` · 429 — the factor is locked; back off.
+ * - `LAST_ADMIN_MUST_TRANSFER` · 409 — the caller is the store's only live
+ *   ADMIN; make another user ADMIN first. Also the answer when another ADMIN
+ *   deleted their account concurrently and left the caller the last one.
+ * - `USER_CHANGED_DURING_REMOVAL` · 409 — the row (or, for an ADMIN, the store's
+ *   ADMIN set, twice) changed while the request ran. Retry.
+ * - `USER_EMAIL_CLAIM_NOT_OWNED` · 409 — the address claim could not be
+ *   released; contact support before retrying.
+ */
+export declare const STAFF_ACCOUNT_DELETION_ERROR_CODES: readonly ["VALIDATION_FAILED", "USER001_PROTECTED", "USER_PLATFORM_ROLE_PROTECTED", "USER_NOT_FOUND", "ACCOUNT_DISABLED", "OPEN_DRAWER_BLOCKS_DELETION", "PASSWORD_REQUIRED_FOR_DELETION", "ACCOUNT_LOCKED", "WRONG_CREDENTIALS", "REQUIRES_2FA", "INVALID_2FA_CODE", "2FA_LOCKED", "LAST_ADMIN_MUST_TRANSFER", "USER_CHANGED_DURING_REMOVAL", "USER_EMAIL_CLAIM_NOT_OWNED"];
+export type StaffAccountDeletionErrorCode = (typeof STAFF_ACCOUNT_DELETION_ERROR_CODES)[number];
 /**
  * `body.error` codes the two customer email-OTP modes (Web API `POST /auth`
  * `send-otp` / `verify-otp`) refuse with. Match on `body.error`.

package/dist/auth.js

@@ -502,6 +502,52 @@ export const SESSION_ACTION_ERROR_CODES = [
     'SESSION_UNKNOWN',
     'REVOKE_INCOMPLETE',
 ];
+/**
+ * `body.error` codes `POST /auth/account-deletion` (staff self-deletion,
+ * {@link StaffAccountDeletionInput}) refuses with. Complete for that route.
+ * Nothing is anonymised on any of them.
+ *
+ * - `VALIDATION_FAILED` · 400 — the body failed the schema.
+ * - `USER001_PROTECTED` · 403 — the founding user cannot delete the account.
+ * - `USER_PLATFORM_ROLE_PROTECTED` · 403 — a SUPERVISOR or MANAGER, on any store.
+ * - `USER_NOT_FOUND` · 404 — the token has no USER row (a paired PRINTER).
+ * - `ACCOUNT_DISABLED` · 400 — the account is suspended.
+ * - `OPEN_DRAWER_BLOCKS_DELETION` · 409 — the user holds an open cash drawer;
+ *   close it first.
+ * - `PASSWORD_REQUIRED_FOR_DELETION` · 409 — the account has no password to
+ *   re-authenticate with; set one first. Counts no login failure.
+ * - `ACCOUNT_LOCKED` · 403 — the shared brute-force lockout; carries
+ *   `retryAfterSeconds` (`AccountLockedResponse`).
+ * - `WRONG_CREDENTIALS` · ⚠️ **401** here (400 on login) — wrong current
+ *   password; counted on the shared login counter.
+ * - `REQUIRES_2FA` · 401 — 2FA is enrolled and no `code` was sent.
+ * - `INVALID_2FA_CODE` · 401 — wrong or used `code`.
+ * - `2FA_LOCKED` · 429 — the factor is locked; back off.
+ * - `LAST_ADMIN_MUST_TRANSFER` · 409 — the caller is the store's only live
+ *   ADMIN; make another user ADMIN first. Also the answer when another ADMIN
+ *   deleted their account concurrently and left the caller the last one.
+ * - `USER_CHANGED_DURING_REMOVAL` · 409 — the row (or, for an ADMIN, the store's
+ *   ADMIN set, twice) changed while the request ran. Retry.
+ * - `USER_EMAIL_CLAIM_NOT_OWNED` · 409 — the address claim could not be
+ *   released; contact support before retrying.
+ */
+export const STAFF_ACCOUNT_DELETION_ERROR_CODES = [
+    'VALIDATION_FAILED',
+    'USER001_PROTECTED',
+    'USER_PLATFORM_ROLE_PROTECTED',
+    'USER_NOT_FOUND',
+    'ACCOUNT_DISABLED',
+    'OPEN_DRAWER_BLOCKS_DELETION',
+    'PASSWORD_REQUIRED_FOR_DELETION',
+    'ACCOUNT_LOCKED',
+    'WRONG_CREDENTIALS',
+    'REQUIRES_2FA',
+    'INVALID_2FA_CODE',
+    '2FA_LOCKED',
+    'LAST_ADMIN_MUST_TRANSFER',
+    'USER_CHANGED_DURING_REMOVAL',
+    'USER_EMAIL_CLAIM_NOT_OWNED',
+];
 /**
  * `body.error` codes the two customer email-OTP modes (Web API `POST /auth`
  * `send-otp` / `verify-otp`) refuse with. Match on `body.error`.

package/dist/cjs/auth.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CUSTOMER_OTP_LIMITS = exports.CUSTOMER_OTP_ERROR_CODES = exports.SESSION_ACTION_ERROR_CODES = exports.PASSKEY_ERROR_CODES = exports.TWO_FACTOR_MANAGEMENT_ERROR_CODES = exports.LOGIN_2FA_ERROR_CODES = exports.LOGIN_ERROR_CODES = exports.STEP_UP_ERROR_CODES = exports.REFRESH_ERROR_CODES = exports.CUSTOMER_SOCIAL_REGISTER_ERROR_CODES = exports.SOCIAL_BRIDGE_ERROR_CODES = exports.SIGN_IN_METHOD_ERROR_CODES = void 0;
+exports.CUSTOMER_OTP_LIMITS = exports.CUSTOMER_OTP_ERROR_CODES = exports.STAFF_ACCOUNT_DELETION_ERROR_CODES = exports.SESSION_ACTION_ERROR_CODES = exports.PASSKEY_ERROR_CODES = exports.TWO_FACTOR_MANAGEMENT_ERROR_CODES = exports.LOGIN_2FA_ERROR_CODES = exports.LOGIN_ERROR_CODES = exports.STEP_UP_ERROR_CODES = exports.REFRESH_ERROR_CODES = exports.CUSTOMER_SOCIAL_REGISTER_ERROR_CODES = exports.SOCIAL_BRIDGE_ERROR_CODES = exports.SIGN_IN_METHOD_ERROR_CODES = void 0;
 /**
  * `body.error` codes the sign-in-method paths can refuse with.
  *
@@ -505,6 +505,52 @@ exports.SESSION_ACTION_ERROR_CODES = [
     'SESSION_UNKNOWN',
     'REVOKE_INCOMPLETE',
 ];
+/**
+ * `body.error` codes `POST /auth/account-deletion` (staff self-deletion,
+ * {@link StaffAccountDeletionInput}) refuses with. Complete for that route.
+ * Nothing is anonymised on any of them.
+ *
+ * - `VALIDATION_FAILED` · 400 — the body failed the schema.
+ * - `USER001_PROTECTED` · 403 — the founding user cannot delete the account.
+ * - `USER_PLATFORM_ROLE_PROTECTED` · 403 — a SUPERVISOR or MANAGER, on any store.
+ * - `USER_NOT_FOUND` · 404 — the token has no USER row (a paired PRINTER).
+ * - `ACCOUNT_DISABLED` · 400 — the account is suspended.
+ * - `OPEN_DRAWER_BLOCKS_DELETION` · 409 — the user holds an open cash drawer;
+ *   close it first.
+ * - `PASSWORD_REQUIRED_FOR_DELETION` · 409 — the account has no password to
+ *   re-authenticate with; set one first. Counts no login failure.
+ * - `ACCOUNT_LOCKED` · 403 — the shared brute-force lockout; carries
+ *   `retryAfterSeconds` (`AccountLockedResponse`).
+ * - `WRONG_CREDENTIALS` · ⚠️ **401** here (400 on login) — wrong current
+ *   password; counted on the shared login counter.
+ * - `REQUIRES_2FA` · 401 — 2FA is enrolled and no `code` was sent.
+ * - `INVALID_2FA_CODE` · 401 — wrong or used `code`.
+ * - `2FA_LOCKED` · 429 — the factor is locked; back off.
+ * - `LAST_ADMIN_MUST_TRANSFER` · 409 — the caller is the store's only live
+ *   ADMIN; make another user ADMIN first. Also the answer when another ADMIN
+ *   deleted their account concurrently and left the caller the last one.
+ * - `USER_CHANGED_DURING_REMOVAL` · 409 — the row (or, for an ADMIN, the store's
+ *   ADMIN set, twice) changed while the request ran. Retry.
+ * - `USER_EMAIL_CLAIM_NOT_OWNED` · 409 — the address claim could not be
+ *   released; contact support before retrying.
+ */
+exports.STAFF_ACCOUNT_DELETION_ERROR_CODES = [
+    'VALIDATION_FAILED',
+    'USER001_PROTECTED',
+    'USER_PLATFORM_ROLE_PROTECTED',
+    'USER_NOT_FOUND',
+    'ACCOUNT_DISABLED',
+    'OPEN_DRAWER_BLOCKS_DELETION',
+    'PASSWORD_REQUIRED_FOR_DELETION',
+    'ACCOUNT_LOCKED',
+    'WRONG_CREDENTIALS',
+    'REQUIRES_2FA',
+    'INVALID_2FA_CODE',
+    '2FA_LOCKED',
+    'LAST_ADMIN_MUST_TRANSFER',
+    'USER_CHANGED_DURING_REMOVAL',
+    'USER_EMAIL_CLAIM_NOT_OWNED',
+];
 /**
  * `body.error` codes the two customer email-OTP modes (Web API `POST /auth`
  * `send-otp` / `verify-otp`) refuse with. Match on `body.error`.

package/dist/cjs/product.js

@@ -7,10 +7,11 @@ exports.BASE_QUANTITY_DECIMAL_PLACES = 6;
 exports.MAX_BASE_QUANTITY = 1_000_000;
 /**
  * The `sort` values Web `GET /products?mode=discover` serves. `newest` is
- * descending product id; `price_asc` / `price_desc` are the caller's own price
- * (see `PublicProductDiscoverInput.sort`). Name sorts are not served.
+ * descending product id; `price_asc` / `price_desc` are the caller's own price;
+ * `name_asc` / `name_desc` are the product name under a Spanish collation (see
+ * `PublicProductDiscoverInput.sort`).
  */
-exports.DISCOVERY_SORTS = ['newest', 'price_asc', 'price_desc'];
+exports.DISCOVERY_SORTS = ['newest', 'price_asc', 'price_desc', 'name_asc', 'name_desc'];
 /**
  * The facets Web `GET /products?mode=discover` can count (`facets=brand,tag,category`).
  * `brand` tallies `brandId`, `tag` each of `tagIds`, `category` the EXACT `categoryId`

package/dist/product.d.ts

@@ -4,10 +4,11 @@ export declare const BASE_QUANTITY_DECIMAL_PLACES = 6;
 export declare const MAX_BASE_QUANTITY = 1000000;
 /**
  * The `sort` values Web `GET /products?mode=discover` serves. `newest` is
- * descending product id; `price_asc` / `price_desc` are the caller's own price
- * (see `PublicProductDiscoverInput.sort`). Name sorts are not served.
+ * descending product id; `price_asc` / `price_desc` are the caller's own price;
+ * `name_asc` / `name_desc` are the product name under a Spanish collation (see
+ * `PublicProductDiscoverInput.sort`).
  */
-export declare const DISCOVERY_SORTS: readonly ["newest", "price_asc", "price_desc"];
+export declare const DISCOVERY_SORTS: readonly ["newest", "price_asc", "price_desc", "name_asc", "name_desc"];
 export type DiscoverySort = (typeof DISCOVERY_SORTS)[number];
 /**
  * The facets Web `GET /products?mode=discover` can count (`facets=brand,tag,category`).
@@ -298,8 +299,12 @@ declare global {
          * currency, an open offer counting as the price, no quantity break. Rows the
          * caller is shown no price for (a hidden slot, every row for a guest of a
          * store that hides prices) come LAST in both directions; equal prices and
-         * that unpriced tail are newest first. A price sort reads the whole filtered
-         * set on every page, so a set too large for one read is 400
+         * that unpriced tail are newest first. `name_asc` / `name_desc` = the
+         * shown product name, Spanish collation, case- and accent-insensitive,
+         * digits compared as numbers («HP 96» before «HP 904»); names that compare
+         * equal are newest first, and a row with no name comes LAST in both
+         * directions. A price or name sort reads the whole filtered set on every
+         * page, so a set too large for one read is 400
          * `DISCOVERY_SORT_UNSUPPORTED` after the reads, with `supportedSorts`
          * naming what that query can be served in, and a read the time budget cut
          * short is 503 `PRODUCT_LOOKUP_INCOMPLETE` (retryable). A price cursor is
@@ -406,12 +411,12 @@ declare global {
     }
     /** Refusals of Web `GET /products?mode=discover`. */
     type DiscoveryErrorCode = 'INVALID_DISCOVERY_QUERY' | 'INVALID_CURSOR' | 'DISCOVERY_SORT_UNSUPPORTED'
-    /** 503: a price-sorted walk the time budget cut short; retry. */
+    /** 503: a price- or name-sorted walk the time budget cut short; retry. */
      | 'PRODUCT_LOOKUP_INCOMPLETE';
     /**
      * 400 body for a `sort` the api does not serve for this request; `supportedSorts` lists what
-     * it does — every member for an unknown value, the non-price sorts when a price sort's
-     * filtered set was too large to read whole.
+     * it does — every member for an unknown value, the sorts that need no whole-set read when a
+     * price or name sort's filtered set was too large to read whole.
      */
     interface DiscoverySortRefusal {
         message: string;

package/dist/product.js

@@ -4,10 +4,11 @@ export const BASE_QUANTITY_DECIMAL_PLACES = 6;
 export const MAX_BASE_QUANTITY = 1_000_000;
 /**
  * The `sort` values Web `GET /products?mode=discover` serves. `newest` is
- * descending product id; `price_asc` / `price_desc` are the caller's own price
- * (see `PublicProductDiscoverInput.sort`). Name sorts are not served.
+ * descending product id; `price_asc` / `price_desc` are the caller's own price;
+ * `name_asc` / `name_desc` are the product name under a Spanish collation (see
+ * `PublicProductDiscoverInput.sort`).
  */
-export const DISCOVERY_SORTS = ['newest', 'price_asc', 'price_desc'];
+export const DISCOVERY_SORTS = ['newest', 'price_asc', 'price_desc', 'name_asc', 'name_desc'];
 /**
  * The facets Web `GET /products?mode=discover` can count (`facets=brand,tag,category`).
  * `brand` tallies `brandId`, `tag` each of `tagIds`, `category` the EXACT `categoryId`

package/dist/store.d.ts

@@ -595,6 +595,16 @@ declare global {
          * `FIELD_NOT_WRITABLE_HERE`; it moves through its own PATCH route.
          */
         palette?: StorePalette;
+        /**
+         * SERVER-ONLY — never on any app or web projection; declared so the
+         * ownership table covers it. A counter bumped by every staff
+         * self-deletion of an ADMIN (`POST /auth/account-deletion`), in the same
+         * transaction as the anonymise and conditioned on the value read before
+         * the store's live ADMINs were counted, so two ADMINs leaving at once
+         * cannot both commit and leave the store with none. Absent until the
+         * first such removal. No request body may set it.
+         */
+        adminRemovalGeneration?: number;
         storeId: string;
         createdAt: number;
         /** Unix ms — BE-stamped on every `POST`/`PATCH /store` write. Always present on written rows. */

package/dist/user.d.ts

@@ -401,6 +401,35 @@ declare global {
      * Distinct from `LoginErrorCode`, which covers the sign-in lockout flow.
      */
     type UserWriteErrorCode = 'EMAIL_IN_USE' | 'USER_ID_COLLISION';
+    /**
+     * `POST /auth/account-deletion` — the signed-in staff user deletes their OWN
+     * account. The row is anonymised in place exactly as `DELETE /users/{userId}`
+     * would; the store, its data and its invoices are untouched.
+     *
+     * `password` is the CURRENT password; `code` is a TOTP or recovery code,
+     * required when the account has 2FA enrolled (without it the answer is
+     * `401 REQUIRES_2FA`). Refusals: {@link STAFF_ACCOUNT_DELETION_ERROR_CODES}.
+     */
+    interface StaffAccountDeletionInput {
+        password: string;
+        code?: string;
+    }
+    /**
+     * The `200` of `POST /auth/account-deletion`, on the first deletion and on
+     * every repeat (idempotent: a repeat answers the ORIGINAL `anonymizedAt`).
+     * `revocationComplete: false` means the row IS anonymised but some session,
+     * trusted device, passkey or push device may still be live; repeating the
+     * call re-runs those sweeps. Every session of the account is revoked, the
+     * caller's own included — treat the 200 as a sign-out.
+     */
+    interface StaffAccountDeletionResponse {
+        message: string;
+        data: {
+            /** Unix ms of the anonymisation. */
+            anonymizedAt: number;
+            revocationComplete: boolean;
+        };
+    }
     /**
      * A stored `User` plus the refresh token, where one is delivered in the body
      * at all.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.811",
+	"version": "1.10.813",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",