@aglyn/aglyn 1.0.0-beta.143

package/src/lib/plugin-manager/plugin-subprocessors.d.ts

@@ -0,0 +1,135 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A plugin's subprocessors, and the other hosts its code names (AGL-2984,
+ * AGL-2978).
+ *
+ * The published subprocessor list is derived from a host-keyed registry of
+ * every third-party host the platform's code reaches. A plugin whose code
+ * sends data to a third party declares that recipient here, in the fields
+ * the published list carries, and the registry folds the declaration in
+ * beside the hosts it declares for itself. The plugin that reaches a vendor
+ * is the one place that vendor's row is written, and the registry names no
+ * plugin's vendor.
+ *
+ * The registry keys on every host the code NAMES, not only on recipients, so
+ * a plugin declares its other hosts the same way:
+ *
+ * - `hosts` — a host that is not a published recipient, on the registry's
+ *   own two terms: `not-a-subprocessor` (a request really is made, and no
+ *   personal data reaches the host, or the customer rather than Aglyn chose
+ *   it) or `no-request` (nothing of ours ever requests it). The entry carries
+ *   the evidence for the claim, exactly as the registry's own do.
+ * - `uses` — a host already declared, by the registry or by another plugin,
+ *   that this plugin's code reaches as well. The host keeps its one
+ *   declaration and its disposition; the use adds why this plugin reaches it
+ *   and what it receives from this plugin, so the entry a reader lands on
+ *   names every use of the host.
+ *
+ * Declarations reach an app as DATA. A plugin names the function that
+ * returns them under `subprocessors` in `plugins.config.json`; the manifest
+ * generator calls it and writes what it returns into a generated module, so
+ * an app reads a plugin's declarations synchronously and without importing
+ * the plugin.
+ *
+ * A host carries one declaration. The fold refuses a host the registry
+ * already declares, or that another plugin declared first, and names both
+ * claimants: a record keyed by host would otherwise keep whichever
+ * declaration was folded last, and publish it. A use is the one way to add
+ * to a declared host, and the fold refuses a use of a host nothing declares.
+ */
+/** One third-party recipient of a plugin's data, as the published list carries it. */
+export interface PluginSubprocessorDeclaration {
+    /** The host the plugin's code reaches, as a bare hostname: the registry's key. */
+    readonly host: string;
+    /** The legal entity that receives the data. */
+    readonly entity: string;
+    /** Where it processes, as the published table states it. */
+    readonly region: string;
+    /** The published purpose cell. */
+    readonly purpose: string;
+    /** The published list's change-log date for the entity, `YYYY-MM-DD`. */
+    readonly publishedOn: string;
+    /** Why the plugin reaches the host, in the words the next reader needs. */
+    readonly reason: string;
+    /** What the recipient receives, written from the code. */
+    readonly dataReceived: string;
+}
+/** The dispositions a host that is not a published recipient may carry. */
+export declare const PLUGIN_EGRESS_HOST_DISPOSITIONS: readonly ["not-a-subprocessor", "no-request"];
+export type PluginEgressHostDisposition = (typeof PLUGIN_EGRESS_HOST_DISPOSITIONS)[number];
+/** A host a plugin's code names that is not a published recipient. */
+export interface PluginEgressHostDeclaration {
+    /** The host, as a bare hostname: the registry's key. */
+    readonly host: string;
+    readonly disposition: PluginEgressHostDisposition;
+    /** Why the host is in the plugin's code: the evidence for the disposition. */
+    readonly reason: string;
+    /** What the host receives, and for these dispositions what does NOT go. */
+    readonly dataReceived: string;
+}
+/** A host declared elsewhere that a plugin's code reaches as well. */
+export interface PluginEgressUseDeclaration {
+    /** The declared host, as a bare hostname. */
+    readonly host: string;
+    /** Why this plugin reaches it, written to follow the declaration's own reason. */
+    readonly reason: string;
+    /** What the host receives from this plugin, written to follow the declaration's own. */
+    readonly dataReceived: string;
+}
+/**
+ * What a plugin's `subprocessors` entry answers: its published recipients,
+ * or those with its other hosts and its uses of hosts declared elsewhere.
+ */
+export type PluginSubprocessorsAnswer = readonly PluginSubprocessorDeclaration[] | {
+    readonly subprocessors?: readonly PluginSubprocessorDeclaration[];
+    readonly hosts?: readonly PluginEgressHostDeclaration[];
+    readonly uses?: readonly PluginEgressUseDeclaration[];
+};
+/** One plugin's declarations, as the generated manifest lists them. */
+export interface PluginSubprocessorManifestEntry {
+    readonly pluginId: string;
+    readonly subprocessors: readonly PluginSubprocessorDeclaration[];
+    /** Hosts the plugin's code names that are not published recipients. */
+    readonly hosts?: readonly PluginEgressHostDeclaration[];
+    /** Hosts declared elsewhere that the plugin's code reaches as well. */
+    readonly uses?: readonly PluginEgressUseDeclaration[];
+}
+/** How a consumer builds the entries the fold cannot build from `toEntry`. */
+export interface FoldPluginEgressOptions<Entry> {
+    /** The entry for a host a plugin declares that is not a published recipient. */
+    toHostEntry?: (declaration: PluginEgressHostDeclaration) => Entry;
+    /**
+     * The entry with one more use added, as a new value: the entry given is the
+     * registry's or another plugin's, and is left as it is.
+     */
+    withUse?: (entry: Entry, use: PluginEgressUseDeclaration, pluginId: string) => Entry;
+}
+/**
+ * The registry with every plugin's declarations folded in: a new record
+ * holding `base`, one entry per declared recipient built by `toEntry`, one
+ * per declared host built by `options.toHostEntry`, and every use added to
+ * its host's entry by `options.withUse`. `base` is left as it is.
+ *
+ * Throws on a declaration with no host; on a host already declared by `base`
+ * or by an earlier plugin in `manifest`, naming both claimants; on a host
+ * with a disposition the registry does not know; on a use of a host nothing
+ * declares, or of a host its own plugin declares; and on hosts or uses the
+ * consumer gave no way to fold. Uses are folded after every declaration, so
+ * a use may name a host a later plugin declares.
+ */
+export declare function foldPluginSubprocessors<Entry>(base: Readonly<Record<string, Entry>>, manifest: readonly PluginSubprocessorManifestEntry[], toEntry: (declaration: PluginSubprocessorDeclaration) => Entry, options?: FoldPluginEgressOptions<Entry>): Record<string, Entry>;

package/src/lib/plugin-manager/plugin-subprocessors.js

@@ -0,0 +1,129 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * A plugin's subprocessors, and the other hosts its code names (AGL-2984,
+ * AGL-2978).
+ *
+ * The published subprocessor list is derived from a host-keyed registry of
+ * every third-party host the platform's code reaches. A plugin whose code
+ * sends data to a third party declares that recipient here, in the fields
+ * the published list carries, and the registry folds the declaration in
+ * beside the hosts it declares for itself. The plugin that reaches a vendor
+ * is the one place that vendor's row is written, and the registry names no
+ * plugin's vendor.
+ *
+ * The registry keys on every host the code NAMES, not only on recipients, so
+ * a plugin declares its other hosts the same way:
+ *
+ * - `hosts` — a host that is not a published recipient, on the registry's
+ *   own two terms: `not-a-subprocessor` (a request really is made, and no
+ *   personal data reaches the host, or the customer rather than Aglyn chose
+ *   it) or `no-request` (nothing of ours ever requests it). The entry carries
+ *   the evidence for the claim, exactly as the registry's own do.
+ * - `uses` — a host already declared, by the registry or by another plugin,
+ *   that this plugin's code reaches as well. The host keeps its one
+ *   declaration and its disposition; the use adds why this plugin reaches it
+ *   and what it receives from this plugin, so the entry a reader lands on
+ *   names every use of the host.
+ *
+ * Declarations reach an app as DATA. A plugin names the function that
+ * returns them under `subprocessors` in `plugins.config.json`; the manifest
+ * generator calls it and writes what it returns into a generated module, so
+ * an app reads a plugin's declarations synchronously and without importing
+ * the plugin.
+ *
+ * A host carries one declaration. The fold refuses a host the registry
+ * already declares, or that another plugin declared first, and names both
+ * claimants: a record keyed by host would otherwise keep whichever
+ * declaration was folded last, and publish it. A use is the one way to add
+ * to a declared host, and the fold refuses a use of a host nothing declares.
+ */ /** One third-party recipient of a plugin's data, as the published list carries it. */ import { _ as _extends } from "@swc/helpers/_/_extends";
+/** The dispositions a host that is not a published recipient may carry. */ export const PLUGIN_EGRESS_HOST_DISPOSITIONS = [
+    'not-a-subprocessor',
+    'no-request'
+];
+/**
+ * The registry with every plugin's declarations folded in: a new record
+ * holding `base`, one entry per declared recipient built by `toEntry`, one
+ * per declared host built by `options.toHostEntry`, and every use added to
+ * its host's entry by `options.withUse`. `base` is left as it is.
+ *
+ * Throws on a declaration with no host; on a host already declared by `base`
+ * or by an earlier plugin in `manifest`, naming both claimants; on a host
+ * with a disposition the registry does not know; on a use of a host nothing
+ * declares, or of a host its own plugin declares; and on hosts or uses the
+ * consumer gave no way to fold. Uses are folded after every declaration, so
+ * a use may name a host a later plugin declares.
+ */ export function foldPluginSubprocessors(base, manifest, toEntry, options = {}) {
+    const registry = _extends({}, base);
+    const declaredBy = new Map(Object.keys(base).map((host)=>[
+            host,
+            'the base registry'
+        ]));
+    const claim = (host, claimant)=>{
+        const earlier = declaredBy.get(host);
+        if (earlier) {
+            throw new Error(`${host} is declared by ${earlier} and by ${claimant}: a host carries one declaration`);
+        }
+        declaredBy.set(host, claimant);
+    };
+    for (const { pluginId, subprocessors, hosts = [] } of manifest){
+        const claimant = `plugin '${pluginId}'`;
+        for (const declaration of subprocessors){
+            const { host } = declaration;
+            if (!host) {
+                throw new Error(`${claimant} declares a subprocessor (${declaration.entity}) with no host`);
+            }
+            claim(host, claimant);
+            registry[host] = toEntry(declaration);
+        }
+        for (const declaration of hosts){
+            const { host } = declaration;
+            if (!host) {
+                throw new Error(`${claimant} declares a ${declaration.disposition} host with no host`);
+            }
+            if (!PLUGIN_EGRESS_HOST_DISPOSITIONS.includes(declaration.disposition)) {
+                throw new Error(`${claimant} declares ${host} as '${String(declaration.disposition)}', which is not a disposition a host may carry`);
+            }
+            if (!options.toHostEntry) {
+                throw new Error(`${claimant} declares ${host}, and this registry folds no hosts`);
+            }
+            claim(host, claimant);
+            registry[host] = options.toHostEntry(declaration);
+        }
+    }
+    for (const { pluginId, uses = [] } of manifest){
+        const claimant = `plugin '${pluginId}'`;
+        for (const use of uses){
+            const { host } = use;
+            if (!host) throw new Error(`${claimant} declares a use with no host`);
+            const owner = declaredBy.get(host);
+            if (!owner) {
+                throw new Error(`${claimant} declares a use of ${host}, which nothing declares: declare the host instead`);
+            }
+            if (owner === claimant) {
+                throw new Error(`${claimant} declares both ${host} and a use of it: write the use into the declaration`);
+            }
+            if (!options.withUse) {
+                throw new Error(`${claimant} declares a use of ${host}, and this registry folds no uses`);
+            }
+            registry[host] = options.withUse(registry[host], use, pluginId);
+        }
+    }
+    return registry;
+}
+
+//# sourceMappingURL=plugin-subprocessors.js.map

package/src/lib/plugin-manager/plugin-subprocessors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-subprocessors.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A plugin's subprocessors, and the other hosts its code names (AGL-2984,\n * AGL-2978).\n *\n * The published subprocessor list is derived from a host-keyed registry of\n * every third-party host the platform's code reaches. A plugin whose code\n * sends data to a third party declares that recipient here, in the fields\n * the published list carries, and the registry folds the declaration in\n * beside the hosts it declares for itself. The plugin that reaches a vendor\n * is the one place that vendor's row is written, and the registry names no\n * plugin's vendor.\n *\n * The registry keys on every host the code NAMES, not only on recipients, so\n * a plugin declares its other hosts the same way:\n *\n * - `hosts` — a host that is not a published recipient, on the registry's\n *   own two terms: `not-a-subprocessor` (a request really is made, and no\n *   personal data reaches the host, or the customer rather than Aglyn chose\n *   it) or `no-request` (nothing of ours ever requests it). The entry carries\n *   the evidence for the claim, exactly as the registry's own do.\n * - `uses` — a host already declared, by the registry or by another plugin,\n *   that this plugin's code reaches as well. The host keeps its one\n *   declaration and its disposition; the use adds why this plugin reaches it\n *   and what it receives from this plugin, so the entry a reader lands on\n *   names every use of the host.\n *\n * Declarations reach an app as DATA. A plugin names the function that\n * returns them under `subprocessors` in `plugins.config.json`; the manifest\n * generator calls it and writes what it returns into a generated module, so\n * an app reads a plugin's declarations synchronously and without importing\n * the plugin.\n *\n * A host carries one declaration. The fold refuses a host the registry\n * already declares, or that another plugin declared first, and names both\n * claimants: a record keyed by host would otherwise keep whichever\n * declaration was folded last, and publish it. A use is the one way to add\n * to a declared host, and the fold refuses a use of a host nothing declares.\n */\n\n/** One third-party recipient of a plugin's data, as the published list carries it. */\nexport interface PluginSubprocessorDeclaration {\n  /** The host the plugin's code reaches, as a bare hostname: the registry's key. */\n  readonly host: string\n  /** The legal entity that receives the data. */\n  readonly entity: string\n  /** Where it processes, as the published table states it. */\n  readonly region: string\n  /** The published purpose cell. */\n  readonly purpose: string\n  /** The published list's change-log date for the entity, `YYYY-MM-DD`. */\n  readonly publishedOn: string\n  /** Why the plugin reaches the host, in the words the next reader needs. */\n  readonly reason: string\n  /** What the recipient receives, written from the code. */\n  readonly dataReceived: string\n}\n\n/** The dispositions a host that is not a published recipient may carry. */\nexport const PLUGIN_EGRESS_HOST_DISPOSITIONS = ['not-a-subprocessor', 'no-request'] as const\nexport type PluginEgressHostDisposition = (typeof PLUGIN_EGRESS_HOST_DISPOSITIONS)[number]\n\n/** A host a plugin's code names that is not a published recipient. */\nexport interface PluginEgressHostDeclaration {\n  /** The host, as a bare hostname: the registry's key. */\n  readonly host: string\n  readonly disposition: PluginEgressHostDisposition\n  /** Why the host is in the plugin's code: the evidence for the disposition. */\n  readonly reason: string\n  /** What the host receives, and for these dispositions what does NOT go. */\n  readonly dataReceived: string\n}\n\n/** A host declared elsewhere that a plugin's code reaches as well. */\nexport interface PluginEgressUseDeclaration {\n  /** The declared host, as a bare hostname. */\n  readonly host: string\n  /** Why this plugin reaches it, written to follow the declaration's own reason. */\n  readonly reason: string\n  /** What the host receives from this plugin, written to follow the declaration's own. */\n  readonly dataReceived: string\n}\n\n/**\n * What a plugin's `subprocessors` entry answers: its published recipients,\n * or those with its other hosts and its uses of hosts declared elsewhere.\n */\nexport type PluginSubprocessorsAnswer =\n  | readonly PluginSubprocessorDeclaration[]\n  | {\n      readonly subprocessors?: readonly PluginSubprocessorDeclaration[]\n      readonly hosts?: readonly PluginEgressHostDeclaration[]\n      readonly uses?: readonly PluginEgressUseDeclaration[]\n    }\n\n/** One plugin's declarations, as the generated manifest lists them. */\nexport interface PluginSubprocessorManifestEntry {\n  readonly pluginId: string\n  readonly subprocessors: readonly PluginSubprocessorDeclaration[]\n  /** Hosts the plugin's code names that are not published recipients. */\n  readonly hosts?: readonly PluginEgressHostDeclaration[]\n  /** Hosts declared elsewhere that the plugin's code reaches as well. */\n  readonly uses?: readonly PluginEgressUseDeclaration[]\n}\n\n/** How a consumer builds the entries the fold cannot build from `toEntry`. */\nexport interface FoldPluginEgressOptions<Entry> {\n  /** The entry for a host a plugin declares that is not a published recipient. */\n  toHostEntry?: (declaration: PluginEgressHostDeclaration) => Entry\n  /**\n   * The entry with one more use added, as a new value: the entry given is the\n   * registry's or another plugin's, and is left as it is.\n   */\n  withUse?: (entry: Entry, use: PluginEgressUseDeclaration, pluginId: string) => Entry\n}\n\n/**\n * The registry with every plugin's declarations folded in: a new record\n * holding `base`, one entry per declared recipient built by `toEntry`, one\n * per declared host built by `options.toHostEntry`, and every use added to\n * its host's entry by `options.withUse`. `base` is left as it is.\n *\n * Throws on a declaration with no host; on a host already declared by `base`\n * or by an earlier plugin in `manifest`, naming both claimants; on a host\n * with a disposition the registry does not know; on a use of a host nothing\n * declares, or of a host its own plugin declares; and on hosts or uses the\n * consumer gave no way to fold. Uses are folded after every declaration, so\n * a use may name a host a later plugin declares.\n */\nexport function foldPluginSubprocessors<Entry>(\n  base: Readonly<Record<string, Entry>>,\n  manifest: readonly PluginSubprocessorManifestEntry[],\n  toEntry: (declaration: PluginSubprocessorDeclaration) => Entry,\n  options: FoldPluginEgressOptions<Entry> = {},\n): Record<string, Entry> {\n  const registry: Record<string, Entry> = { ...base }\n  const declaredBy = new Map<string, string>(\n    Object.keys(base).map((host) => [host, 'the base registry']),\n  )\n  const claim = (host: string, claimant: string) => {\n    const earlier = declaredBy.get(host)\n    if (earlier) {\n      throw new Error(\n        `${host} is declared by ${earlier} and by ${claimant}: a host carries one declaration`,\n      )\n    }\n    declaredBy.set(host, claimant)\n  }\n\n  for (const { pluginId, subprocessors, hosts = [] } of manifest) {\n    const claimant = `plugin '${pluginId}'`\n    for (const declaration of subprocessors) {\n      const { host } = declaration\n      if (!host) {\n        throw new Error(\n          `${claimant} declares a subprocessor (${declaration.entity}) with no host`,\n        )\n      }\n      claim(host, claimant)\n      registry[host] = toEntry(declaration)\n    }\n    for (const declaration of hosts) {\n      const { host } = declaration\n      if (!host) {\n        throw new Error(`${claimant} declares a ${declaration.disposition} host with no host`)\n      }\n      if (!PLUGIN_EGRESS_HOST_DISPOSITIONS.includes(declaration.disposition)) {\n        throw new Error(\n          `${claimant} declares ${host} as '${String(declaration.disposition)}', which is not a disposition a host may carry`,\n        )\n      }\n      if (!options.toHostEntry) {\n        throw new Error(`${claimant} declares ${host}, and this registry folds no hosts`)\n      }\n      claim(host, claimant)\n      registry[host] = options.toHostEntry(declaration)\n    }\n  }\n\n  for (const { pluginId, uses = [] } of manifest) {\n    const claimant = `plugin '${pluginId}'`\n    for (const use of uses) {\n      const { host } = use\n      if (!host) throw new Error(`${claimant} declares a use with no host`)\n      const owner = declaredBy.get(host)\n      if (!owner) {\n        throw new Error(\n          `${claimant} declares a use of ${host}, which nothing declares: declare the host instead`,\n        )\n      }\n      if (owner === claimant) {\n        throw new Error(\n          `${claimant} declares both ${host} and a use of it: write the use into the declaration`,\n        )\n      }\n      if (!options.withUse) {\n        throw new Error(`${claimant} declares a use of ${host}, and this registry folds no uses`)\n      }\n      registry[host] = options.withUse(registry[host], use, pluginId)\n    }\n  }\n  return registry\n}\n"],"names":["PLUGIN_EGRESS_HOST_DISPOSITIONS","foldPluginSubprocessors","base","manifest","toEntry","options","registry","declaredBy","Map","Object","keys","map","host","claim","claimant","earlier","get","Error","set","pluginId","subprocessors","hosts","declaration","entity","disposition","includes","String","toHostEntry","uses","use","owner","withUse"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCC,GAED,oFAAoF;AAkBpF,yEAAyE,GACzE,OAAO,MAAMA,kCAAkC;IAAC;IAAsB;CAAa,CAAS;AAyD5F;;;;;;;;;;;;CAYC,GACD,OAAO,SAASC,wBACdC,IAAqC,EACrCC,QAAoD,EACpDC,OAA8D,EAC9DC,UAA0C,CAAC,CAAC;IAE5C,MAAMC,WAAkC,aAAKJ;IAC7C,MAAMK,aAAa,IAAIC,IACrBC,OAAOC,IAAI,CAACR,MAAMS,GAAG,CAAC,CAACC,OAAS;YAACA;YAAM;SAAoB;IAE7D,MAAMC,QAAQ,CAACD,MAAcE;QAC3B,MAAMC,UAAUR,WAAWS,GAAG,CAACJ;QAC/B,IAAIG,SAAS;YACX,MAAM,IAAIE,MACR,GAAGL,KAAK,gBAAgB,EAAEG,QAAQ,QAAQ,EAAED,SAAS,gCAAgC,CAAC;QAE1F;QACAP,WAAWW,GAAG,CAACN,MAAME;IACvB;IAEA,KAAK,MAAM,EAAEK,QAAQ,EAAEC,aAAa,EAAEC,QAAQ,EAAE,EAAE,IAAIlB,SAAU;QAC9D,MAAMW,WAAW,CAAC,QAAQ,EAAEK,SAAS,CAAC,CAAC;QACvC,KAAK,MAAMG,eAAeF,cAAe;YACvC,MAAM,EAAER,IAAI,EAAE,GAAGU;YACjB,IAAI,CAACV,MAAM;gBACT,MAAM,IAAIK,MACR,GAAGH,SAAS,0BAA0B,EAAEQ,YAAYC,MAAM,CAAC,cAAc,CAAC;YAE9E;YACAV,MAAMD,MAAME;YACZR,QAAQ,CAACM,KAAK,GAAGR,QAAQkB;QAC3B;QACA,KAAK,MAAMA,eAAeD,MAAO;YAC/B,MAAM,EAAET,IAAI,EAAE,GAAGU;YACjB,IAAI,CAACV,MAAM;gBACT,MAAM,IAAIK,MAAM,GAAGH,SAAS,YAAY,EAAEQ,YAAYE,WAAW,CAAC,kBAAkB,CAAC;YACvF;YACA,IAAI,CAACxB,gCAAgCyB,QAAQ,CAACH,YAAYE,WAAW,GAAG;gBACtE,MAAM,IAAIP,MACR,GAAGH,SAAS,UAAU,EAAEF,KAAK,KAAK,EAAEc,OAAOJ,YAAYE,WAAW,EAAE,8CAA8C,CAAC;YAEvH;YACA,IAAI,CAACnB,QAAQsB,WAAW,EAAE;gBACxB,MAAM,IAAIV,MAAM,GAAGH,SAAS,UAAU,EAAEF,KAAK,kCAAkC,CAAC;YAClF;YACAC,MAAMD,MAAME;YACZR,QAAQ,CAACM,KAAK,GAAGP,QAAQsB,WAAW,CAACL;QACvC;IACF;IAEA,KAAK,MAAM,EAAEH,QAAQ,EAAES,OAAO,EAAE,EAAE,IAAIzB,SAAU;QAC9C,MAAMW,WAAW,CAAC,QAAQ,EAAEK,SAAS,CAAC,CAAC;QACvC,KAAK,MAAMU,OAAOD,KAAM;YACtB,MAAM,EAAEhB,IAAI,EAAE,GAAGiB;YACjB,IAAI,CAACjB,MAAM,MAAM,IAAIK,MAAM,GAAGH,SAAS,4BAA4B,CAAC;YACpE,MAAMgB,QAAQvB,WAAWS,GAAG,CAACJ;YAC7B,IAAI,CAACkB,OAAO;gBACV,MAAM,IAAIb,MACR,GAAGH,SAAS,mBAAmB,EAAEF,KAAK,kDAAkD,CAAC;YAE7F;YACA,IAAIkB,UAAUhB,UAAU;gBACtB,MAAM,IAAIG,MACR,GAAGH,SAAS,eAAe,EAAEF,KAAK,oDAAoD,CAAC;YAE3F;YACA,IAAI,CAACP,QAAQ0B,OAAO,EAAE;gBACpB,MAAM,IAAId,MAAM,GAAGH,SAAS,mBAAmB,EAAEF,KAAK,iCAAiC,CAAC;YAC1F;YACAN,QAAQ,CAACM,KAAK,GAAGP,QAAQ0B,OAAO,CAACzB,QAAQ,CAACM,KAAK,EAAEiB,KAAKV;QACxD;IACF;IACA,OAAOb;AACT"}

package/src/lib/plugin-manager/plugin-tax-profile.d.ts

@@ -0,0 +1,84 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The tenant's tax rule, answered by the one plugin that owns it (AGL-3080).
+ *
+ * More than one plugin takes money — a storefront sells goods, a calendar
+ * sells appointments — and a merchant has ONE tax profile. The plugin that
+ * keeps it works out what a flat rate adds to a charge and which regime a
+ * settled payment was taxed under; any other plugin that charges asks here.
+ * Importing the owner's model instead is how two money paths end up with two
+ * rounding rules, and the second is found by an accountant.
+ *
+ * ## Pure, synchronous, and unauthenticated
+ *
+ * Both questions are arithmetic over values the caller already holds: a rate
+ * off the settings it read, a charge in cents, a settled payment object.
+ * Nothing is read and nobody is asked who they are.
+ *
+ * ## No profile is a refusal, never a zero
+ *
+ * {@link pluginTaxProfile} THROWS when no plugin registered one. Every other
+ * seam here answers `null` for "nobody home", and this one must not: a caller
+ * that read `null` as "no tax" would charge a customer an untaxed total and
+ * record it as untaxed, silently, and the merchant would owe the difference.
+ * A refused sale is seen the same day.
+ *
+ * It cannot happen in a working build. Both apps load every plugin's server
+ * entry before a plugin handler, a cron or the billing webhook runs
+ * (`ensureAll`), so the owner's registration is in place wherever a charge is
+ * priced; `tax-profile-is-registered.spec.ts` in each app holds that.
+ *
+ * ## One owner
+ *
+ * A workspace has one tax profile, so the contract is a slot: a second
+ * plugin's profile is refused naming both and the incumbent keeps serving.
+ *
+ * Import this module by its own subpath
+ * (`@aglyn/aglyn/plugin-manager/plugin-tax-profile`); it is not in the barrel.
+ */
+/** What a flat rate adds to one charge. All zero and empty when it adds nothing. */
+export interface PluginResolvedFlatTax {
+    taxCents: number;
+    /** What the line is called on the receipt. */
+    label: string;
+    pct: number;
+}
+export interface PluginTaxProfile {
+    /**
+     * Tax, EXCLUSIVE, for a flat merchant rate on one charged amount. `rate` is
+     * the merchant's stored setting, passed as read: the owner decides what a
+     * usable rate is, and an absent, zero, negative or out-of-range one answers
+     * zero rather than throwing.
+     */
+    flatTax(rate: unknown, chargeCents: number, fallbackLabel: string): PluginResolvedFlatTax;
+    /**
+     * Which regime a settled payment was taxed under, as the owner records it.
+     * `manualTaxCents` is the tax this caller added as a line of its own, which
+     * the payment processor reports as no tax at all.
+     */
+    taxModeOf(settledPayment: unknown, manualTaxCents?: number): string;
+}
+export declare const PLUGIN_TAX_PROFILE: import("./plugin-services").PluginServiceContract<PluginTaxProfile>;
+/** Registers the plugin that owns the tenant's tax rule. */
+export declare function registerPluginTaxProfile(profile: PluginTaxProfile, options?: {
+    pluginId?: string;
+}): void;
+/** The owner, or `null` — for a caller that only wants to know who it is. */
+export declare function pluginTaxProfileOwner(): string | null;
+/** The tax rule. THROWS when no plugin registered one; see the module note. */
+export declare function pluginTaxProfile(): PluginTaxProfile;

package/src/lib/plugin-manager/plugin-tax-profile.js

@@ -0,0 +1,39 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { definePluginServiceContract, registerPluginService, resolvePluginServices } from "./plugin-services.js";
+export const PLUGIN_TAX_PROFILE = definePluginServiceContract('core.tax-profile', {
+    multiple: false
+});
+/** Registers the plugin that owns the tenant's tax rule. */ export function registerPluginTaxProfile(profile, options) {
+    registerPluginService(PLUGIN_TAX_PROFILE, profile, _extends({}, (options == null ? void 0 : options.pluginId) ? {
+        pluginId: options.pluginId
+    } : {}));
+}
+/** The owner, or `null` — for a caller that only wants to know who it is. */ export function pluginTaxProfileOwner() {
+    var _ref;
+    var _resolvePluginServices_;
+    return (_ref = (_resolvePluginServices_ = resolvePluginServices(PLUGIN_TAX_PROFILE)[0]) == null ? void 0 : _resolvePluginServices_.pluginId) != null ? _ref : null;
+}
+/** The tax rule. THROWS when no plugin registered one; see the module note. */ export function pluginTaxProfile() {
+    const entry = resolvePluginServices(PLUGIN_TAX_PROFILE)[0];
+    if (!entry) {
+        throw new Error('no plugin registered a tax profile, so this charge cannot be priced: ' + 'refusing rather than charging it untaxed');
+    }
+    return entry.impl;
+}
+
+//# sourceMappingURL=plugin-tax-profile.js.map

package/src/lib/plugin-manager/plugin-tax-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-tax-profile.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  definePluginServiceContract,\n  registerPluginService,\n  resolvePluginServices,\n} from './plugin-services'\n\n/**\n * The tenant's tax rule, answered by the one plugin that owns it (AGL-3080).\n *\n * More than one plugin takes money — a storefront sells goods, a calendar\n * sells appointments — and a merchant has ONE tax profile. The plugin that\n * keeps it works out what a flat rate adds to a charge and which regime a\n * settled payment was taxed under; any other plugin that charges asks here.\n * Importing the owner's model instead is how two money paths end up with two\n * rounding rules, and the second is found by an accountant.\n *\n * ## Pure, synchronous, and unauthenticated\n *\n * Both questions are arithmetic over values the caller already holds: a rate\n * off the settings it read, a charge in cents, a settled payment object.\n * Nothing is read and nobody is asked who they are.\n *\n * ## No profile is a refusal, never a zero\n *\n * {@link pluginTaxProfile} THROWS when no plugin registered one. Every other\n * seam here answers `null` for \"nobody home\", and this one must not: a caller\n * that read `null` as \"no tax\" would charge a customer an untaxed total and\n * record it as untaxed, silently, and the merchant would owe the difference.\n * A refused sale is seen the same day.\n *\n * It cannot happen in a working build. Both apps load every plugin's server\n * entry before a plugin handler, a cron or the billing webhook runs\n * (`ensureAll`), so the owner's registration is in place wherever a charge is\n * priced; `tax-profile-is-registered.spec.ts` in each app holds that.\n *\n * ## One owner\n *\n * A workspace has one tax profile, so the contract is a slot: a second\n * plugin's profile is refused naming both and the incumbent keeps serving.\n *\n * Import this module by its own subpath\n * (`@aglyn/aglyn/plugin-manager/plugin-tax-profile`); it is not in the barrel.\n */\n\n/** What a flat rate adds to one charge. All zero and empty when it adds nothing. */\nexport interface PluginResolvedFlatTax {\n  taxCents: number\n  /** What the line is called on the receipt. */\n  label: string\n  pct: number\n}\n\nexport interface PluginTaxProfile {\n  /**\n   * Tax, EXCLUSIVE, for a flat merchant rate on one charged amount. `rate` is\n   * the merchant's stored setting, passed as read: the owner decides what a\n   * usable rate is, and an absent, zero, negative or out-of-range one answers\n   * zero rather than throwing.\n   */\n  flatTax(\n    rate: unknown,\n    chargeCents: number,\n    fallbackLabel: string,\n  ): PluginResolvedFlatTax\n  /**\n   * Which regime a settled payment was taxed under, as the owner records it.\n   * `manualTaxCents` is the tax this caller added as a line of its own, which\n   * the payment processor reports as no tax at all.\n   */\n  taxModeOf(settledPayment: unknown, manualTaxCents?: number): string\n}\n\nexport const PLUGIN_TAX_PROFILE = definePluginServiceContract<PluginTaxProfile>(\n  'core.tax-profile',\n  { multiple: false },\n)\n\n/** Registers the plugin that owns the tenant's tax rule. */\nexport function registerPluginTaxProfile(\n  profile: PluginTaxProfile,\n  options?: { pluginId?: string },\n): void {\n  registerPluginService(PLUGIN_TAX_PROFILE, profile, {\n    ...(options?.pluginId ? { pluginId: options.pluginId } : {}),\n  })\n}\n\n/** The owner, or `null` — for a caller that only wants to know who it is. */\nexport function pluginTaxProfileOwner(): string | null {\n  return resolvePluginServices(PLUGIN_TAX_PROFILE)[0]?.pluginId ?? null\n}\n\n/** The tax rule. THROWS when no plugin registered one; see the module note. */\nexport function pluginTaxProfile(): PluginTaxProfile {\n  const entry = resolvePluginServices(PLUGIN_TAX_PROFILE)[0]\n  if (!entry) {\n    throw new Error(\n      'no plugin registered a tax profile, so this charge cannot be priced: ' +\n        'refusing rather than charging it untaxed',\n    )\n  }\n  return entry.impl\n}\n"],"names":["definePluginServiceContract","registerPluginService","resolvePluginServices","PLUGIN_TAX_PROFILE","multiple","registerPluginTaxProfile","profile","options","pluginId","pluginTaxProfileOwner","pluginTaxProfile","entry","Error","impl"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,2BAA2B,EAC3BC,qBAAqB,EACrBC,qBAAqB,QAChB,uBAAmB;AAoE1B,OAAO,MAAMC,qBAAqBH,4BAChC,oBACA;IAAEI,UAAU;AAAM,GACnB;AAED,0DAA0D,GAC1D,OAAO,SAASC,yBACdC,OAAyB,EACzBC,OAA+B;IAE/BN,sBAAsBE,oBAAoBG,SAAS,aAC7CC,CAAAA,2BAAAA,QAASC,QAAQ,IAAG;QAAEA,UAAUD,QAAQC,QAAQ;IAAC,IAAI,CAAC;AAE9D;AAEA,2EAA2E,GAC3E,OAAO,SAASC;;QACPP;IAAP,gBAAOA,0BAAAA,sBAAsBC,mBAAmB,CAAC,EAAE,qBAA5CD,wBAA8CM,QAAQ,mBAAI;AACnE;AAEA,6EAA6E,GAC7E,OAAO,SAASE;IACd,MAAMC,QAAQT,sBAAsBC,mBAAmB,CAAC,EAAE;IAC1D,IAAI,CAACQ,OAAO;QACV,MAAM,IAAIC,MACR,0EACE;IAEN;IACA,OAAOD,MAAME,IAAI;AACnB"}

package/src/lib/plugin-manager/plugin-user-erasure.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** What an eraser is asked to erase. */
+export interface PluginUserErasureRequest {
+    /** The account being erased. */
+    uid: string;
+    /**
+     * Every workspace the person belonged to when the erasure began. Their
+     * memberships are removed before the erasers run, so this is the only
+     * record of them an eraser gets.
+     */
+    orgIds: readonly string[];
+}
+/**
+ * What an eraser reports for the erasure's audit record: counts and flags,
+ * never the erased content, because the record outlives the data by design.
+ * A `null` field is a figure the eraser could not measure, which is not zero.
+ */
+export type PluginUserErasureReport = Readonly<Record<string, number | boolean | null>>;
+export type PluginUserEraser = (request: PluginUserErasureRequest) => Promise<PluginUserErasureReport>;
+/**
+ * Registers a plugin's eraser. Owner = the loader's marker inside a register
+ * fn, else `options.pluginId`; an eraser with neither throws. One eraser per
+ * plugin: registering again replaces the plugin's earlier eraser in place,
+ * so a module evaluated twice does not erase twice.
+ */
+export declare function registerPluginUserEraser(eraser: PluginUserEraser, options?: {
+    pluginId?: string;
+}): void;
+/**
+ * Runs every eraser, in registration order, and answers each plugin's
+ * report by plugin id: the eraser's own report, or `null` for one that
+ * threw.
+ */
+export declare function runPluginUserErasers(request: PluginUserErasureRequest): Promise<Record<string, PluginUserErasureReport | null>>;
+/** The plugins with an eraser, in the order they run. */
+export declare function listPluginUserErasers(): string[];
+/** Test seam: forget every eraser. */
+export declare function resetPluginUserErasersForTests(): void;

package/src/lib/plugin-manager/plugin-user-erasure.js

@@ -0,0 +1,84 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * A plugin's share of an account erasure (AGL-2939).
+ *
+ * The account erasure deletes what core stores about a person: the user
+ * document and its subcollections, the memberships, the public profile, the
+ * delivery log and the auth record. A plugin that keeps data ABOUT a person
+ * where none of that reaches — documents under an org keyed by the uid, a
+ * collection carrying the uid as a field — registers an eraser here, and
+ * the erasure runs every eraser with the person's uid and the workspaces
+ * they belonged to.
+ *
+ * Erasers run in registration order and are ISOLATED: a throw is logged
+ * against its plugin, recorded as `null`, and does not stop the next one.
+ * An erasure runs against a legal clock, and one plugin's outage must not
+ * keep every other plugin's data past it. The `null` is how the erasure's
+ * audit record says that plugin's data may remain, which a report of zero
+ * would hide.
+ *
+ * Registered from a plugin's `serverDeclarations` entry, so the eraser is in
+ * place in a server process that never loaded the plugin's API surface.
+ */ import { getRegisteringPluginId } from "../app-utils/registering-plugin.js";
+const registrations = [];
+/**
+ * Registers a plugin's eraser. Owner = the loader's marker inside a register
+ * fn, else `options.pluginId`; an eraser with neither throws. One eraser per
+ * plugin: registering again replaces the plugin's earlier eraser in place,
+ * so a module evaluated twice does not erase twice.
+ */ export function registerPluginUserEraser(eraser, options) {
+    var _ref, _getRegisteringPluginId;
+    const pluginId = ((_ref = (_getRegisteringPluginId = getRegisteringPluginId()) != null ? _getRegisteringPluginId : options == null ? void 0 : options.pluginId) != null ? _ref : '').trim();
+    if (!pluginId) {
+        throw new Error('a plugin user eraser was registered with no owner: pass { pluginId } ' + 'when registering outside a plugin register fn');
+    }
+    const index = registrations.findIndex((entry)=>entry.pluginId === pluginId);
+    if (index >= 0) registrations[index] = {
+        pluginId,
+        eraser
+    };
+    else registrations.push({
+        pluginId,
+        eraser
+    });
+}
+/**
+ * Runs every eraser, in registration order, and answers each plugin's
+ * report by plugin id: the eraser's own report, or `null` for one that
+ * threw.
+ */ export async function runPluginUserErasers(request) {
+    const reports = {};
+    for (const { pluginId, eraser } of [
+        ...registrations
+    ]){
+        try {
+            reports[pluginId] = await eraser(request);
+        } catch (error) {
+            reports[pluginId] = null;
+            console.error(`[plugins] ${pluginId} failed to erase user ${request.uid}`, error);
+        }
+    }
+    return reports;
+}
+/** The plugins with an eraser, in the order they run. */ export function listPluginUserErasers() {
+    return registrations.map((entry)=>entry.pluginId);
+}
+/** Test seam: forget every eraser. */ export function resetPluginUserErasersForTests() {
+    registrations.length = 0;
+}
+
+//# sourceMappingURL=plugin-user-erasure.js.map

package/src/lib/plugin-manager/plugin-user-erasure.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-user-erasure.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A plugin's share of an account erasure (AGL-2939).\n *\n * The account erasure deletes what core stores about a person: the user\n * document and its subcollections, the memberships, the public profile, the\n * delivery log and the auth record. A plugin that keeps data ABOUT a person\n * where none of that reaches — documents under an org keyed by the uid, a\n * collection carrying the uid as a field — registers an eraser here, and\n * the erasure runs every eraser with the person's uid and the workspaces\n * they belonged to.\n *\n * Erasers run in registration order and are ISOLATED: a throw is logged\n * against its plugin, recorded as `null`, and does not stop the next one.\n * An erasure runs against a legal clock, and one plugin's outage must not\n * keep every other plugin's data past it. The `null` is how the erasure's\n * audit record says that plugin's data may remain, which a report of zero\n * would hide.\n *\n * Registered from a plugin's `serverDeclarations` entry, so the eraser is in\n * place in a server process that never loaded the plugin's API surface.\n */\n\nimport { getRegisteringPluginId } from '../app-utils/registering-plugin'\n\n/** What an eraser is asked to erase. */\nexport interface PluginUserErasureRequest {\n  /** The account being erased. */\n  uid: string\n  /**\n   * Every workspace the person belonged to when the erasure began. Their\n   * memberships are removed before the erasers run, so this is the only\n   * record of them an eraser gets.\n   */\n  orgIds: readonly string[]\n}\n\n/**\n * What an eraser reports for the erasure's audit record: counts and flags,\n * never the erased content, because the record outlives the data by design.\n * A `null` field is a figure the eraser could not measure, which is not zero.\n */\nexport type PluginUserErasureReport = Readonly<Record<string, number | boolean | null>>\n\nexport type PluginUserEraser = (\n  request: PluginUserErasureRequest,\n) => Promise<PluginUserErasureReport>\n\ninterface Registration {\n  pluginId: string\n  eraser: PluginUserEraser\n}\n\nconst registrations: Registration[] = []\n\n/**\n * Registers a plugin's eraser. Owner = the loader's marker inside a register\n * fn, else `options.pluginId`; an eraser with neither throws. One eraser per\n * plugin: registering again replaces the plugin's earlier eraser in place,\n * so a module evaluated twice does not erase twice.\n */\nexport function registerPluginUserEraser(\n  eraser: PluginUserEraser,\n  options?: { pluginId?: string },\n): void {\n  const pluginId = (getRegisteringPluginId() ?? options?.pluginId ?? '').trim()\n  if (!pluginId) {\n    throw new Error(\n      'a plugin user eraser was registered with no owner: pass { pluginId } ' +\n        'when registering outside a plugin register fn',\n    )\n  }\n  const index = registrations.findIndex((entry) => entry.pluginId === pluginId)\n  if (index >= 0) registrations[index] = { pluginId, eraser }\n  else registrations.push({ pluginId, eraser })\n}\n\n/**\n * Runs every eraser, in registration order, and answers each plugin's\n * report by plugin id: the eraser's own report, or `null` for one that\n * threw.\n */\nexport async function runPluginUserErasers(\n  request: PluginUserErasureRequest,\n): Promise<Record<string, PluginUserErasureReport | null>> {\n  const reports: Record<string, PluginUserErasureReport | null> = {}\n  for (const { pluginId, eraser } of [...registrations]) {\n    try {\n      reports[pluginId] = await eraser(request)\n    } catch (error) {\n      reports[pluginId] = null\n      console.error(`[plugins] ${pluginId} failed to erase user ${request.uid}`, error)\n    }\n  }\n  return reports\n}\n\n/** The plugins with an eraser, in the order they run. */\nexport function listPluginUserErasers(): string[] {\n  return registrations.map((entry) => entry.pluginId)\n}\n\n/** Test seam: forget every eraser. */\nexport function resetPluginUserErasersForTests(): void {\n  registrations.length = 0\n}\n"],"names":["getRegisteringPluginId","registrations","registerPluginUserEraser","eraser","options","pluginId","trim","Error","index","findIndex","entry","push","runPluginUserErasers","request","reports","error","console","uid","listPluginUserErasers","map","resetPluginUserErasersForTests","length"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,SAASA,sBAAsB,QAAQ,qCAAiC;AA8BxE,MAAMC,gBAAgC,EAAE;AAExC;;;;;CAKC,GACD,OAAO,SAASC,yBACdC,MAAwB,EACxBC,OAA+B;QAEbJ,MAAAA;IAAlB,MAAMK,WAAW,EAACL,QAAAA,0BAAAA,oCAAAA,0BAA4BI,2BAAAA,QAASC,QAAQ,YAA7CL,OAAiD,IAAIM,IAAI;IAC3E,IAAI,CAACD,UAAU;QACb,MAAM,IAAIE,MACR,0EACE;IAEN;IACA,MAAMC,QAAQP,cAAcQ,SAAS,CAAC,CAACC,QAAUA,MAAML,QAAQ,KAAKA;IACpE,IAAIG,SAAS,GAAGP,aAAa,CAACO,MAAM,GAAG;QAAEH;QAAUF;IAAO;SACrDF,cAAcU,IAAI,CAAC;QAAEN;QAAUF;IAAO;AAC7C;AAEA;;;;CAIC,GACD,OAAO,eAAeS,qBACpBC,OAAiC;IAEjC,MAAMC,UAA0D,CAAC;IACjE,KAAK,MAAM,EAAET,QAAQ,EAAEF,MAAM,EAAE,IAAI;WAAIF;KAAc,CAAE;QACrD,IAAI;YACFa,OAAO,CAACT,SAAS,GAAG,MAAMF,OAAOU;QACnC,EAAE,OAAOE,OAAO;YACdD,OAAO,CAACT,SAAS,GAAG;YACpBW,QAAQD,KAAK,CAAC,CAAC,UAAU,EAAEV,SAAS,sBAAsB,EAAEQ,QAAQI,GAAG,EAAE,EAAEF;QAC7E;IACF;IACA,OAAOD;AACT;AAEA,uDAAuD,GACvD,OAAO,SAASI;IACd,OAAOjB,cAAckB,GAAG,CAAC,CAACT,QAAUA,MAAML,QAAQ;AACpD;AAEA,oCAAoC,GACpC,OAAO,SAASe;IACdnB,cAAcoB,MAAM,GAAG;AACzB"}