platform-types 1.10.812 → 1.10.813

package/dist/auth.d.ts

@@ -1905,6 +1905,37 @@ export type PasskeyErrorCode = (typeof PASSKEY_ERROR_CODES)[number];
  */
 export declare const SESSION_ACTION_ERROR_CODES: readonly ["SESSION_LOOKUP_INCOMPLETE", "SESSION_UNKNOWN", "REVOKE_INCOMPLETE"];
 export type SessionActionErrorCode = (typeof SESSION_ACTION_ERROR_CODES)[number];
+/**
+ * `body.error` codes `POST /auth/account-deletion` (staff self-deletion,
+ * {@link StaffAccountDeletionInput}) refuses with. Complete for that route.
+ * Nothing is anonymised on any of them.
+ *
+ * - `VALIDATION_FAILED` · 400 — the body failed the schema.
+ * - `USER001_PROTECTED` · 403 — the founding user cannot delete the account.
+ * - `USER_PLATFORM_ROLE_PROTECTED` · 403 — a SUPERVISOR or MANAGER, on any store.
+ * - `USER_NOT_FOUND` · 404 — the token has no USER row (a paired PRINTER).
+ * - `ACCOUNT_DISABLED` · 400 — the account is suspended.
+ * - `OPEN_DRAWER_BLOCKS_DELETION` · 409 — the user holds an open cash drawer;
+ *   close it first.
+ * - `PASSWORD_REQUIRED_FOR_DELETION` · 409 — the account has no password to
+ *   re-authenticate with; set one first. Counts no login failure.
+ * - `ACCOUNT_LOCKED` · 403 — the shared brute-force lockout; carries
+ *   `retryAfterSeconds` (`AccountLockedResponse`).
+ * - `WRONG_CREDENTIALS` · ⚠️ **401** here (400 on login) — wrong current
+ *   password; counted on the shared login counter.
+ * - `REQUIRES_2FA` · 401 — 2FA is enrolled and no `code` was sent.
+ * - `INVALID_2FA_CODE` · 401 — wrong or used `code`.
+ * - `2FA_LOCKED` · 429 — the factor is locked; back off.
+ * - `LAST_ADMIN_MUST_TRANSFER` · 409 — the caller is the store's only live
+ *   ADMIN; make another user ADMIN first. Also the answer when another ADMIN
+ *   deleted their account concurrently and left the caller the last one.
+ * - `USER_CHANGED_DURING_REMOVAL` · 409 — the row (or, for an ADMIN, the store's
+ *   ADMIN set, twice) changed while the request ran. Retry.
+ * - `USER_EMAIL_CLAIM_NOT_OWNED` · 409 — the address claim could not be
+ *   released; contact support before retrying.
+ */
+export declare const STAFF_ACCOUNT_DELETION_ERROR_CODES: readonly ["VALIDATION_FAILED", "USER001_PROTECTED", "USER_PLATFORM_ROLE_PROTECTED", "USER_NOT_FOUND", "ACCOUNT_DISABLED", "OPEN_DRAWER_BLOCKS_DELETION", "PASSWORD_REQUIRED_FOR_DELETION", "ACCOUNT_LOCKED", "WRONG_CREDENTIALS", "REQUIRES_2FA", "INVALID_2FA_CODE", "2FA_LOCKED", "LAST_ADMIN_MUST_TRANSFER", "USER_CHANGED_DURING_REMOVAL", "USER_EMAIL_CLAIM_NOT_OWNED"];
+export type StaffAccountDeletionErrorCode = (typeof STAFF_ACCOUNT_DELETION_ERROR_CODES)[number];
 /**
  * `body.error` codes the two customer email-OTP modes (Web API `POST /auth`
  * `send-otp` / `verify-otp`) refuse with. Match on `body.error`.

package/dist/auth.js

@@ -502,6 +502,52 @@ export const SESSION_ACTION_ERROR_CODES = [
     'SESSION_UNKNOWN',
     'REVOKE_INCOMPLETE',
 ];
+/**
+ * `body.error` codes `POST /auth/account-deletion` (staff self-deletion,
+ * {@link StaffAccountDeletionInput}) refuses with. Complete for that route.
+ * Nothing is anonymised on any of them.
+ *
+ * - `VALIDATION_FAILED` · 400 — the body failed the schema.
+ * - `USER001_PROTECTED` · 403 — the founding user cannot delete the account.
+ * - `USER_PLATFORM_ROLE_PROTECTED` · 403 — a SUPERVISOR or MANAGER, on any store.
+ * - `USER_NOT_FOUND` · 404 — the token has no USER row (a paired PRINTER).
+ * - `ACCOUNT_DISABLED` · 400 — the account is suspended.
+ * - `OPEN_DRAWER_BLOCKS_DELETION` · 409 — the user holds an open cash drawer;
+ *   close it first.
+ * - `PASSWORD_REQUIRED_FOR_DELETION` · 409 — the account has no password to
+ *   re-authenticate with; set one first. Counts no login failure.
+ * - `ACCOUNT_LOCKED` · 403 — the shared brute-force lockout; carries
+ *   `retryAfterSeconds` (`AccountLockedResponse`).
+ * - `WRONG_CREDENTIALS` · ⚠️ **401** here (400 on login) — wrong current
+ *   password; counted on the shared login counter.
+ * - `REQUIRES_2FA` · 401 — 2FA is enrolled and no `code` was sent.
+ * - `INVALID_2FA_CODE` · 401 — wrong or used `code`.
+ * - `2FA_LOCKED` · 429 — the factor is locked; back off.
+ * - `LAST_ADMIN_MUST_TRANSFER` · 409 — the caller is the store's only live
+ *   ADMIN; make another user ADMIN first. Also the answer when another ADMIN
+ *   deleted their account concurrently and left the caller the last one.
+ * - `USER_CHANGED_DURING_REMOVAL` · 409 — the row (or, for an ADMIN, the store's
+ *   ADMIN set, twice) changed while the request ran. Retry.
+ * - `USER_EMAIL_CLAIM_NOT_OWNED` · 409 — the address claim could not be
+ *   released; contact support before retrying.
+ */
+export const STAFF_ACCOUNT_DELETION_ERROR_CODES = [
+    'VALIDATION_FAILED',
+    'USER001_PROTECTED',
+    'USER_PLATFORM_ROLE_PROTECTED',
+    'USER_NOT_FOUND',
+    'ACCOUNT_DISABLED',
+    'OPEN_DRAWER_BLOCKS_DELETION',
+    'PASSWORD_REQUIRED_FOR_DELETION',
+    'ACCOUNT_LOCKED',
+    'WRONG_CREDENTIALS',
+    'REQUIRES_2FA',
+    'INVALID_2FA_CODE',
+    '2FA_LOCKED',
+    'LAST_ADMIN_MUST_TRANSFER',
+    'USER_CHANGED_DURING_REMOVAL',
+    'USER_EMAIL_CLAIM_NOT_OWNED',
+];
 /**
  * `body.error` codes the two customer email-OTP modes (Web API `POST /auth`
  * `send-otp` / `verify-otp`) refuse with. Match on `body.error`.

package/dist/cjs/auth.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CUSTOMER_OTP_LIMITS = exports.CUSTOMER_OTP_ERROR_CODES = exports.SESSION_ACTION_ERROR_CODES = exports.PASSKEY_ERROR_CODES = exports.TWO_FACTOR_MANAGEMENT_ERROR_CODES = exports.LOGIN_2FA_ERROR_CODES = exports.LOGIN_ERROR_CODES = exports.STEP_UP_ERROR_CODES = exports.REFRESH_ERROR_CODES = exports.CUSTOMER_SOCIAL_REGISTER_ERROR_CODES = exports.SOCIAL_BRIDGE_ERROR_CODES = exports.SIGN_IN_METHOD_ERROR_CODES = void 0;
+exports.CUSTOMER_OTP_LIMITS = exports.CUSTOMER_OTP_ERROR_CODES = exports.STAFF_ACCOUNT_DELETION_ERROR_CODES = exports.SESSION_ACTION_ERROR_CODES = exports.PASSKEY_ERROR_CODES = exports.TWO_FACTOR_MANAGEMENT_ERROR_CODES = exports.LOGIN_2FA_ERROR_CODES = exports.LOGIN_ERROR_CODES = exports.STEP_UP_ERROR_CODES = exports.REFRESH_ERROR_CODES = exports.CUSTOMER_SOCIAL_REGISTER_ERROR_CODES = exports.SOCIAL_BRIDGE_ERROR_CODES = exports.SIGN_IN_METHOD_ERROR_CODES = void 0;
 /**
  * `body.error` codes the sign-in-method paths can refuse with.
  *
@@ -505,6 +505,52 @@ exports.SESSION_ACTION_ERROR_CODES = [
     'SESSION_UNKNOWN',
     'REVOKE_INCOMPLETE',
 ];
+/**
+ * `body.error` codes `POST /auth/account-deletion` (staff self-deletion,
+ * {@link StaffAccountDeletionInput}) refuses with. Complete for that route.
+ * Nothing is anonymised on any of them.
+ *
+ * - `VALIDATION_FAILED` · 400 — the body failed the schema.
+ * - `USER001_PROTECTED` · 403 — the founding user cannot delete the account.
+ * - `USER_PLATFORM_ROLE_PROTECTED` · 403 — a SUPERVISOR or MANAGER, on any store.
+ * - `USER_NOT_FOUND` · 404 — the token has no USER row (a paired PRINTER).
+ * - `ACCOUNT_DISABLED` · 400 — the account is suspended.
+ * - `OPEN_DRAWER_BLOCKS_DELETION` · 409 — the user holds an open cash drawer;
+ *   close it first.
+ * - `PASSWORD_REQUIRED_FOR_DELETION` · 409 — the account has no password to
+ *   re-authenticate with; set one first. Counts no login failure.
+ * - `ACCOUNT_LOCKED` · 403 — the shared brute-force lockout; carries
+ *   `retryAfterSeconds` (`AccountLockedResponse`).
+ * - `WRONG_CREDENTIALS` · ⚠️ **401** here (400 on login) — wrong current
+ *   password; counted on the shared login counter.
+ * - `REQUIRES_2FA` · 401 — 2FA is enrolled and no `code` was sent.
+ * - `INVALID_2FA_CODE` · 401 — wrong or used `code`.
+ * - `2FA_LOCKED` · 429 — the factor is locked; back off.
+ * - `LAST_ADMIN_MUST_TRANSFER` · 409 — the caller is the store's only live
+ *   ADMIN; make another user ADMIN first. Also the answer when another ADMIN
+ *   deleted their account concurrently and left the caller the last one.
+ * - `USER_CHANGED_DURING_REMOVAL` · 409 — the row (or, for an ADMIN, the store's
+ *   ADMIN set, twice) changed while the request ran. Retry.
+ * - `USER_EMAIL_CLAIM_NOT_OWNED` · 409 — the address claim could not be
+ *   released; contact support before retrying.
+ */
+exports.STAFF_ACCOUNT_DELETION_ERROR_CODES = [
+    'VALIDATION_FAILED',
+    'USER001_PROTECTED',
+    'USER_PLATFORM_ROLE_PROTECTED',
+    'USER_NOT_FOUND',
+    'ACCOUNT_DISABLED',
+    'OPEN_DRAWER_BLOCKS_DELETION',
+    'PASSWORD_REQUIRED_FOR_DELETION',
+    'ACCOUNT_LOCKED',
+    'WRONG_CREDENTIALS',
+    'REQUIRES_2FA',
+    'INVALID_2FA_CODE',
+    '2FA_LOCKED',
+    'LAST_ADMIN_MUST_TRANSFER',
+    'USER_CHANGED_DURING_REMOVAL',
+    'USER_EMAIL_CLAIM_NOT_OWNED',
+];
 /**
  * `body.error` codes the two customer email-OTP modes (Web API `POST /auth`
  * `send-otp` / `verify-otp`) refuse with. Match on `body.error`.

package/dist/store.d.ts

@@ -595,6 +595,16 @@ declare global {
          * `FIELD_NOT_WRITABLE_HERE`; it moves through its own PATCH route.
          */
         palette?: StorePalette;
+        /**
+         * SERVER-ONLY — never on any app or web projection; declared so the
+         * ownership table covers it. A counter bumped by every staff
+         * self-deletion of an ADMIN (`POST /auth/account-deletion`), in the same
+         * transaction as the anonymise and conditioned on the value read before
+         * the store's live ADMINs were counted, so two ADMINs leaving at once
+         * cannot both commit and leave the store with none. Absent until the
+         * first such removal. No request body may set it.
+         */
+        adminRemovalGeneration?: number;
         storeId: string;
         createdAt: number;
         /** Unix ms — BE-stamped on every `POST`/`PATCH /store` write. Always present on written rows. */

package/dist/user.d.ts

@@ -401,6 +401,35 @@ declare global {
      * Distinct from `LoginErrorCode`, which covers the sign-in lockout flow.
      */
     type UserWriteErrorCode = 'EMAIL_IN_USE' | 'USER_ID_COLLISION';
+    /**
+     * `POST /auth/account-deletion` — the signed-in staff user deletes their OWN
+     * account. The row is anonymised in place exactly as `DELETE /users/{userId}`
+     * would; the store, its data and its invoices are untouched.
+     *
+     * `password` is the CURRENT password; `code` is a TOTP or recovery code,
+     * required when the account has 2FA enrolled (without it the answer is
+     * `401 REQUIRES_2FA`). Refusals: {@link STAFF_ACCOUNT_DELETION_ERROR_CODES}.
+     */
+    interface StaffAccountDeletionInput {
+        password: string;
+        code?: string;
+    }
+    /**
+     * The `200` of `POST /auth/account-deletion`, on the first deletion and on
+     * every repeat (idempotent: a repeat answers the ORIGINAL `anonymizedAt`).
+     * `revocationComplete: false` means the row IS anonymised but some session,
+     * trusted device, passkey or push device may still be live; repeating the
+     * call re-runs those sweeps. Every session of the account is revoked, the
+     * caller's own included — treat the 200 as a sign-out.
+     */
+    interface StaffAccountDeletionResponse {
+        message: string;
+        data: {
+            /** Unix ms of the anonymisation. */
+            anonymizedAt: number;
+            revocationComplete: boolean;
+        };
+    }
     /**
      * A stored `User` plus the refresh token, where one is delivered in the body
      * at all.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.812",
+	"version": "1.10.813",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",