@aglyn/aglyn 1.0.0-beta.221 → 1.0.0-beta.222

package/src/lib/plugin-manager/plugin-org-erasure.js

@@ -1,3 +1,4 @@
+var _globalScope_ERASERS_KEY;
 /**
  * @license
  * Copyright 2026 Aglyn LLC
@@ -71,9 +72,17 @@
  * the plugin loaded — a deletion that must not depend on which bundles an
  * erasing process happened to load, so it is data rather than an eraser.
  */ import { getRegisteringPluginId } from "../app-utils/registering-plugin.js";
+import { runPluginDeclarationsRepair } from "./plugin-declarations-repair.js";
 import { PLUGIN_ORG_KEYED_COLLECTIONS, PLUGIN_REQUIRED_ORG_ERASERS } from "./first-party-plugins.generated.js";
 export { PLUGIN_ORG_KEYED_COLLECTIONS, PLUGIN_REQUIRED_ORG_ERASERS };
-const registrations = [];
+/**
+ * One list per process, on `globalThis` (AGL-3464): the app registers its
+ * plugins' erasers from `instrumentation.ts`, which Next compiles apart from
+ * the route that runs the erasure, and a module-scoped list is filled in one
+ * copy and read empty in the other — the AGL-3412 shape.
+ */ const ERASERS_KEY = Symbol.for('@aglyn/aglyn:plugin-org-erasers');
+const globalScope = globalThis;
+const registrations = (_globalScope_ERASERS_KEY = globalScope[ERASERS_KEY]) != null ? _globalScope_ERASERS_KEY : globalScope[ERASERS_KEY] = [];
 /**
  * Registers a plugin's workspace eraser. Owner = the loader's marker inside a
  * register fn, else `options.pluginId`; an eraser with neither throws. One
@@ -102,11 +111,11 @@ const registrations = [];
  *
  * Throws in exactly two cases, both about a REQUIRED eraser (`required`,
  * the compiled {@link PLUGIN_REQUIRED_ORG_ERASERS} unless a spec passes its
- * own): before running anything, when one is not registered; and after
- * running every eraser, when one threw.
+ * own): before running anything, when one is not registered even after the
+ * app's boot step has run once more; and after running every eraser, when
+ * one threw.
  */ export async function runPluginOrgErasers(request, required = PLUGIN_REQUIRED_ORG_ERASERS) {
-    const registered = new Set(registrations.map((entry)=>entry.pluginId));
-    const missing = required.filter((pluginId)=>!registered.has(pluginId));
+    const missing = await missingAfterRepair(required);
     if (missing.length) {
         throw new Error(`[plugins] erasing org ${request.orgId} refused: ${missing.join(', ')} ` + 'declared a required org eraser and none is registered in this process');
     }
@@ -131,6 +140,22 @@ const registrations = [];
     }
     return reports;
 }
+/**
+ * The required erasers not registered in this process, after running the
+ * app's boot step once when any is missing (AGL-3464): a boot whose
+ * declarations failed looks the same from here as one that never declared
+ * the eraser, and only the second is a reason to refuse.
+ */ async function missingAfterRepair(required) {
+    const missing = ()=>{
+        const registered = new Set(registrations.map((entry)=>entry.pluginId));
+        return required.filter((pluginId)=>!registered.has(pluginId));
+    };
+    if (!missing().length) return [];
+    await runPluginDeclarationsRepair().catch((error)=>{
+        console.error('[plugins] the declarations repair failed before an org erasure', error);
+    });
+    return missing();
+}
 /** The plugins with a workspace eraser, in the order they run. */ export function listPluginOrgErasers() {
     return registrations.map((entry)=>entry.pluginId);
 }

package/src/lib/plugin-manager/plugin-org-erasure.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-org-erasure.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A plugin's share of a workspace erasure (AGL-2978).\n *\n * The workspace erasure destroys what the platform holds for an\n * organization: its document tree, its sites, and the top-level records\n * keyed to it by a field. A plugin that holds something those deletes cannot\n * finish on their own registers an eraser here — a grant at a provider that\n * only the plugin can revoke, or a record outside every path and field the\n * erasure sweeps — and the erasure runs every eraser with the organization's\n * id.\n *\n * Erasers run BEFORE the erasure deletes anything of its own. The\n * organization, its roster and every record the erasure is about to sweep\n * still exist when an eraser runs, so an eraser that has to act through a\n * record — open a stored grant to revoke it — finds the record there. What\n * the erasure deletes on its own stays its to delete: an eraser adds to the\n * erasure, and the erasure does not wait on one to finish its own sweeps.\n *\n * Erasers run in registration order and are ISOLATED: a throw is logged\n * against its plugin, recorded as `null`, and does not stop the next one or\n * the erasure. An erasure runs against a legal clock, and one plugin's\n * outage must not keep every other plugin's data, or the workspace, past it.\n * The `null` is how the erasure's audit record says that plugin's share may\n * not be done, which a report of zero would hide.\n *\n * A DRY RUN is handed to every eraser, which must then touch no provider and\n * write nothing: it counts what it would do. A plan that reached a vendor\n * would be an erasure that happened without anybody deciding it should.\n *\n * Registered from a plugin's declarations — `serverDeclarations`, or\n * `consoleServerDeclarations` for an eraser that opens a credential only the\n * console holds — so the eraser is in place in a server process that never\n * loaded the plugin's API surface.\n *\n * ## A REQUIRED eraser (AGL-3080)\n *\n * Isolation is right for a share whose failure leaves the workspace's data\n * gone and only a provider-side courtesy undone. It is wrong for a share the\n * erasure PROMISES: a public record naming the erased organization, a payout\n * identifier on a world-readable document. A plugin holding such a record\n * declares `\"requiredOrgEraser\": true` in `plugins.config.json`, compiled into\n * {@link PLUGIN_REQUIRED_ORG_ERASERS} so no registration can opt out of it, and:\n *\n * - an erasure REFUSES to start while a required eraser is not registered —\n *   a boot that failed to declare it must not produce a \"complete\" erasure\n *   with the record still standing;\n * - a required eraser that throws still lets every other eraser run, and then\n *   fails the erasure's `plugins` step, which the cron retries.\n *\n * ## Plugin collections keyed by the organization (AGL-3080)\n *\n * A plugin's TOP-LEVEL collection whose documents carry the organization's id\n * in a field is invisible to the erasure's path deletes. The plugin declares\n * it (`orgKeyedCollections`, compiled into {@link PLUGIN_ORG_KEYED_COLLECTIONS})\n * and the erasure sweeps it by that field in every process, with or without\n * the plugin loaded — a deletion that must not depend on which bundles an\n * erasing process happened to load, so it is data rather than an eraser.\n */\n\nimport { getRegisteringPluginId } from '../app-utils/registering-plugin'\nimport {\n  PLUGIN_ORG_KEYED_COLLECTIONS,\n  PLUGIN_REQUIRED_ORG_ERASERS,\n} from './first-party-plugins.generated'\n\nexport { PLUGIN_ORG_KEYED_COLLECTIONS, PLUGIN_REQUIRED_ORG_ERASERS }\n\n/**\n * A plugin's top-level collection whose documents name an organization in a\n * field, declared by that plugin. See the module note.\n */\nexport interface PluginOrgKeyedCollection {\n  /** The plugin that declared it. */\n  pluginId: string\n  /** The top-level collection. */\n  name: string\n  /** The field naming the organization a document belongs to. */\n  orgField: string\n}\n\n/** What an eraser is asked to erase. */\nexport interface PluginOrgErasureRequest {\n  /** The workspace being erased. */\n  orgId: string\n  /**\n   * A plan, not an erasure: count, touch no provider, write nothing. The\n   * erasure's own sweeps honor the same flag.\n   */\n  dryRun: boolean\n}\n\n/**\n * What an eraser reports for the erasure's audit record: counts and flags,\n * never the erased content, because the record outlives the data by design.\n * A `null` field is a figure the eraser could not measure, which is not zero.\n */\nexport type PluginOrgErasureReport = Readonly<Record<string, number | boolean | null>>\n\nexport type PluginOrgEraser = (\n  request: PluginOrgErasureRequest,\n) => Promise<PluginOrgErasureReport>\n\ninterface Registration {\n  pluginId: string\n  eraser: PluginOrgEraser\n}\n\nconst registrations: Registration[] = []\n\n/**\n * Registers a plugin's workspace eraser. Owner = the loader's marker inside a\n * register fn, else `options.pluginId`; an eraser with neither throws. One\n * eraser per plugin: registering again replaces the plugin's earlier eraser\n * in place, so a module evaluated twice does not erase twice.\n */\nexport function registerPluginOrgEraser(\n  eraser: PluginOrgEraser,\n  options?: { pluginId?: string },\n): void {\n  const pluginId = (getRegisteringPluginId() ?? options?.pluginId ?? '').trim()\n  if (!pluginId) {\n    throw new Error(\n      'a plugin org eraser was registered with no owner: pass { pluginId } ' +\n        'when registering outside a plugin register fn',\n    )\n  }\n  const index = registrations.findIndex((entry) => entry.pluginId === pluginId)\n  if (index >= 0) registrations[index] = { pluginId, eraser }\n  else registrations.push({ pluginId, eraser })\n}\n\n/**\n * Runs every eraser, in registration order, and answers each plugin's\n * report by plugin id: the eraser's own report, or `null` for one that\n * threw.\n *\n * Throws in exactly two cases, both about a REQUIRED eraser (`required`,\n * the compiled {@link PLUGIN_REQUIRED_ORG_ERASERS} unless a spec passes its\n * own): before running anything, when one is not registered; and after\n * running every eraser, when one threw.\n */\nexport async function runPluginOrgErasers(\n  request: PluginOrgErasureRequest,\n  required: readonly string[] = PLUGIN_REQUIRED_ORG_ERASERS,\n): Promise<Record<string, PluginOrgErasureReport | null>> {\n  const registered = new Set(registrations.map((entry) => entry.pluginId))\n  const missing = required.filter((pluginId) => !registered.has(pluginId))\n  if (missing.length) {\n    throw new Error(\n      `[plugins] erasing org ${request.orgId} refused: ${missing.join(', ')} ` +\n        'declared a required org eraser and none is registered in this process',\n    )\n  }\n  const reports: Record<string, PluginOrgErasureReport | null> = {}\n  const failedRequired: string[] = []\n  for (const { pluginId, eraser } of [...registrations]) {\n    try {\n      reports[pluginId] = await eraser({ orgId: request.orgId, dryRun: request.dryRun })\n    } catch (error) {\n      reports[pluginId] = null\n      console.error(`[plugins] ${pluginId} failed to erase org ${request.orgId}`, error)\n      if (required.includes(pluginId)) failedRequired.push(pluginId)\n    }\n  }\n  if (failedRequired.length) {\n    throw new Error(\n      `[plugins] erasing org ${request.orgId} incomplete: the required eraser of ` +\n        `${failedRequired.join(', ')} failed`,\n    )\n  }\n  return reports\n}\n\n/** The plugins with a workspace eraser, in the order they run. */\nexport function listPluginOrgErasers(): string[] {\n  return registrations.map((entry) => entry.pluginId)\n}\n\n/** Test seam: forget every eraser. */\nexport function resetPluginOrgErasersForTests(): void {\n  registrations.length = 0\n}\n\n/**\n * Test seam: a no-op eraser for every REQUIRED plugin that has none, so a\n * spec about the erasure's own sweeps can run it without loading a plugin\n * (core and the data layer may not import one). A spec about a required\n * plugin's share registers the real one through the app's manifest instead.\n */\nexport function standInRequiredOrgErasersForTests(): void {\n  const registered = new Set(registrations.map((entry) => entry.pluginId))\n  for (const pluginId of PLUGIN_REQUIRED_ORG_ERASERS) {\n    if (!registered.has(pluginId)) {\n      registrations.push({ pluginId, eraser: async () => ({ standIn: true }) })\n    }\n  }\n}\n"],"names":["getRegisteringPluginId","PLUGIN_ORG_KEYED_COLLECTIONS","PLUGIN_REQUIRED_ORG_ERASERS","registrations","registerPluginOrgEraser","eraser","options","pluginId","trim","Error","index","findIndex","entry","push","runPluginOrgErasers","request","required","registered","Set","map","missing","filter","has","length","orgId","join","reports","failedRequired","dryRun","error","console","includes","listPluginOrgErasers","resetPluginOrgErasersForTests","standInRequiredOrgErasersForTests","standIn"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyDC,GAED,SAASA,sBAAsB,QAAQ,qCAAiC;AACxE,SACEC,4BAA4B,EAC5BC,2BAA2B,QACtB,qCAAiC;AAExC,SAASD,4BAA4B,EAAEC,2BAA2B,GAAE;AA0CpE,MAAMC,gBAAgC,EAAE;AAExC;;;;;CAKC,GACD,OAAO,SAASC,wBACdC,MAAuB,EACvBC,OAA+B;QAEbN,MAAAA;IAAlB,MAAMO,WAAW,EAACP,QAAAA,0BAAAA,oCAAAA,0BAA4BM,2BAAAA,QAASC,QAAQ,YAA7CP,OAAiD,IAAIQ,IAAI;IAC3E,IAAI,CAACD,UAAU;QACb,MAAM,IAAIE,MACR,yEACE;IAEN;IACA,MAAMC,QAAQP,cAAcQ,SAAS,CAAC,CAACC,QAAUA,MAAML,QAAQ,KAAKA;IACpE,IAAIG,SAAS,GAAGP,aAAa,CAACO,MAAM,GAAG;QAAEH;QAAUF;IAAO;SACrDF,cAAcU,IAAI,CAAC;QAAEN;QAAUF;IAAO;AAC7C;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeS,oBACpBC,OAAgC,EAChCC,WAA8Bd,2BAA2B;IAEzD,MAAMe,aAAa,IAAIC,IAAIf,cAAcgB,GAAG,CAAC,CAACP,QAAUA,MAAML,QAAQ;IACtE,MAAMa,UAAUJ,SAASK,MAAM,CAAC,CAACd,WAAa,CAACU,WAAWK,GAAG,CAACf;IAC9D,IAAIa,QAAQG,MAAM,EAAE;QAClB,MAAM,IAAId,MACR,CAAC,sBAAsB,EAAEM,QAAQS,KAAK,CAAC,UAAU,EAAEJ,QAAQK,IAAI,CAAC,MAAM,CAAC,CAAC,GACtE;IAEN;IACA,MAAMC,UAAyD,CAAC;IAChE,MAAMC,iBAA2B,EAAE;IACnC,KAAK,MAAM,EAAEpB,QAAQ,EAAEF,MAAM,EAAE,IAAI;WAAIF;KAAc,CAAE;QACrD,IAAI;YACFuB,OAAO,CAACnB,SAAS,GAAG,MAAMF,OAAO;gBAAEmB,OAAOT,QAAQS,KAAK;gBAAEI,QAAQb,QAAQa,MAAM;YAAC;QAClF,EAAE,OAAOC,OAAO;YACdH,OAAO,CAACnB,SAAS,GAAG;YACpBuB,QAAQD,KAAK,CAAC,CAAC,UAAU,EAAEtB,SAAS,qBAAqB,EAAEQ,QAAQS,KAAK,EAAE,EAAEK;YAC5E,IAAIb,SAASe,QAAQ,CAACxB,WAAWoB,eAAed,IAAI,CAACN;QACvD;IACF;IACA,IAAIoB,eAAeJ,MAAM,EAAE;QACzB,MAAM,IAAId,MACR,CAAC,sBAAsB,EAAEM,QAAQS,KAAK,CAAC,oCAAoC,CAAC,GAC1E,GAAGG,eAAeF,IAAI,CAAC,MAAM,OAAO,CAAC;IAE3C;IACA,OAAOC;AACT;AAEA,gEAAgE,GAChE,OAAO,SAASM;IACd,OAAO7B,cAAcgB,GAAG,CAAC,CAACP,QAAUA,MAAML,QAAQ;AACpD;AAEA,oCAAoC,GACpC,OAAO,SAAS0B;IACd9B,cAAcoB,MAAM,GAAG;AACzB;AAEA;;;;;CAKC,GACD,OAAO,SAASW;IACd,MAAMjB,aAAa,IAAIC,IAAIf,cAAcgB,GAAG,CAAC,CAACP,QAAUA,MAAML,QAAQ;IACtE,KAAK,MAAMA,YAAYL,4BAA6B;QAClD,IAAI,CAACe,WAAWK,GAAG,CAACf,WAAW;YAC7BJ,cAAcU,IAAI,CAAC;gBAAEN;gBAAUF,QAAQ,UAAa,CAAA;wBAAE8B,SAAS;oBAAK,CAAA;YAAG;QACzE;IACF;AACF"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-org-erasure.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A plugin's share of a workspace erasure (AGL-2978).\n *\n * The workspace erasure destroys what the platform holds for an\n * organization: its document tree, its sites, and the top-level records\n * keyed to it by a field. A plugin that holds something those deletes cannot\n * finish on their own registers an eraser here — a grant at a provider that\n * only the plugin can revoke, or a record outside every path and field the\n * erasure sweeps — and the erasure runs every eraser with the organization's\n * id.\n *\n * Erasers run BEFORE the erasure deletes anything of its own. The\n * organization, its roster and every record the erasure is about to sweep\n * still exist when an eraser runs, so an eraser that has to act through a\n * record — open a stored grant to revoke it — finds the record there. What\n * the erasure deletes on its own stays its to delete: an eraser adds to the\n * erasure, and the erasure does not wait on one to finish its own sweeps.\n *\n * Erasers run in registration order and are ISOLATED: a throw is logged\n * against its plugin, recorded as `null`, and does not stop the next one or\n * the erasure. An erasure runs against a legal clock, and one plugin's\n * outage must not keep every other plugin's data, or the workspace, past it.\n * The `null` is how the erasure's audit record says that plugin's share may\n * not be done, which a report of zero would hide.\n *\n * A DRY RUN is handed to every eraser, which must then touch no provider and\n * write nothing: it counts what it would do. A plan that reached a vendor\n * would be an erasure that happened without anybody deciding it should.\n *\n * Registered from a plugin's declarations — `serverDeclarations`, or\n * `consoleServerDeclarations` for an eraser that opens a credential only the\n * console holds — so the eraser is in place in a server process that never\n * loaded the plugin's API surface.\n *\n * ## A REQUIRED eraser (AGL-3080)\n *\n * Isolation is right for a share whose failure leaves the workspace's data\n * gone and only a provider-side courtesy undone. It is wrong for a share the\n * erasure PROMISES: a public record naming the erased organization, a payout\n * identifier on a world-readable document. A plugin holding such a record\n * declares `\"requiredOrgEraser\": true` in `plugins.config.json`, compiled into\n * {@link PLUGIN_REQUIRED_ORG_ERASERS} so no registration can opt out of it, and:\n *\n * - an erasure REFUSES to start while a required eraser is not registered —\n *   a boot that failed to declare it must not produce a \"complete\" erasure\n *   with the record still standing;\n * - a required eraser that throws still lets every other eraser run, and then\n *   fails the erasure's `plugins` step, which the cron retries.\n *\n * ## Plugin collections keyed by the organization (AGL-3080)\n *\n * A plugin's TOP-LEVEL collection whose documents carry the organization's id\n * in a field is invisible to the erasure's path deletes. The plugin declares\n * it (`orgKeyedCollections`, compiled into {@link PLUGIN_ORG_KEYED_COLLECTIONS})\n * and the erasure sweeps it by that field in every process, with or without\n * the plugin loaded — a deletion that must not depend on which bundles an\n * erasing process happened to load, so it is data rather than an eraser.\n */\n\nimport { getRegisteringPluginId } from '../app-utils/registering-plugin'\nimport { runPluginDeclarationsRepair } from './plugin-declarations-repair'\nimport {\n  PLUGIN_ORG_KEYED_COLLECTIONS,\n  PLUGIN_REQUIRED_ORG_ERASERS,\n} from './first-party-plugins.generated'\n\nexport { PLUGIN_ORG_KEYED_COLLECTIONS, PLUGIN_REQUIRED_ORG_ERASERS }\n\n/**\n * A plugin's top-level collection whose documents name an organization in a\n * field, declared by that plugin. See the module note.\n */\nexport interface PluginOrgKeyedCollection {\n  /** The plugin that declared it. */\n  pluginId: string\n  /** The top-level collection. */\n  name: string\n  /** The field naming the organization a document belongs to. */\n  orgField: string\n}\n\n/** What an eraser is asked to erase. */\nexport interface PluginOrgErasureRequest {\n  /** The workspace being erased. */\n  orgId: string\n  /**\n   * A plan, not an erasure: count, touch no provider, write nothing. The\n   * erasure's own sweeps honor the same flag.\n   */\n  dryRun: boolean\n}\n\n/**\n * What an eraser reports for the erasure's audit record: counts and flags,\n * never the erased content, because the record outlives the data by design.\n * A `null` field is a figure the eraser could not measure, which is not zero.\n */\nexport type PluginOrgErasureReport = Readonly<Record<string, number | boolean | null>>\n\nexport type PluginOrgEraser = (\n  request: PluginOrgErasureRequest,\n) => Promise<PluginOrgErasureReport>\n\ninterface Registration {\n  pluginId: string\n  eraser: PluginOrgEraser\n}\n\n/**\n * One list per process, on `globalThis` (AGL-3464): the app registers its\n * plugins' erasers from `instrumentation.ts`, which Next compiles apart from\n * the route that runs the erasure, and a module-scoped list is filled in one\n * copy and read empty in the other — the AGL-3412 shape.\n */\nconst ERASERS_KEY = Symbol.for('@aglyn/aglyn:plugin-org-erasers')\n\nconst globalScope = globalThis as typeof globalThis & {\n  [ERASERS_KEY]?: Registration[]\n}\n\nconst registrations: Registration[] =\n  globalScope[ERASERS_KEY] ?? (globalScope[ERASERS_KEY] = [])\n\n/**\n * Registers a plugin's workspace eraser. Owner = the loader's marker inside a\n * register fn, else `options.pluginId`; an eraser with neither throws. One\n * eraser per plugin: registering again replaces the plugin's earlier eraser\n * in place, so a module evaluated twice does not erase twice.\n */\nexport function registerPluginOrgEraser(\n  eraser: PluginOrgEraser,\n  options?: { pluginId?: string },\n): void {\n  const pluginId = (getRegisteringPluginId() ?? options?.pluginId ?? '').trim()\n  if (!pluginId) {\n    throw new Error(\n      'a plugin org eraser was registered with no owner: pass { pluginId } ' +\n        'when registering outside a plugin register fn',\n    )\n  }\n  const index = registrations.findIndex((entry) => entry.pluginId === pluginId)\n  if (index >= 0) registrations[index] = { pluginId, eraser }\n  else registrations.push({ pluginId, eraser })\n}\n\n/**\n * Runs every eraser, in registration order, and answers each plugin's\n * report by plugin id: the eraser's own report, or `null` for one that\n * threw.\n *\n * Throws in exactly two cases, both about a REQUIRED eraser (`required`,\n * the compiled {@link PLUGIN_REQUIRED_ORG_ERASERS} unless a spec passes its\n * own): before running anything, when one is not registered even after the\n * app's boot step has run once more; and after running every eraser, when\n * one threw.\n */\nexport async function runPluginOrgErasers(\n  request: PluginOrgErasureRequest,\n  required: readonly string[] = PLUGIN_REQUIRED_ORG_ERASERS,\n): Promise<Record<string, PluginOrgErasureReport | null>> {\n  const missing = await missingAfterRepair(required)\n  if (missing.length) {\n    throw new Error(\n      `[plugins] erasing org ${request.orgId} refused: ${missing.join(', ')} ` +\n        'declared a required org eraser and none is registered in this process',\n    )\n  }\n  const reports: Record<string, PluginOrgErasureReport | null> = {}\n  const failedRequired: string[] = []\n  for (const { pluginId, eraser } of [...registrations]) {\n    try {\n      reports[pluginId] = await eraser({ orgId: request.orgId, dryRun: request.dryRun })\n    } catch (error) {\n      reports[pluginId] = null\n      console.error(`[plugins] ${pluginId} failed to erase org ${request.orgId}`, error)\n      if (required.includes(pluginId)) failedRequired.push(pluginId)\n    }\n  }\n  if (failedRequired.length) {\n    throw new Error(\n      `[plugins] erasing org ${request.orgId} incomplete: the required eraser of ` +\n        `${failedRequired.join(', ')} failed`,\n    )\n  }\n  return reports\n}\n\n/**\n * The required erasers not registered in this process, after running the\n * app's boot step once when any is missing (AGL-3464): a boot whose\n * declarations failed looks the same from here as one that never declared\n * the eraser, and only the second is a reason to refuse.\n */\nasync function missingAfterRepair(required: readonly string[]): Promise<string[]> {\n  const missing = () => {\n    const registered = new Set(registrations.map((entry) => entry.pluginId))\n    return required.filter((pluginId) => !registered.has(pluginId))\n  }\n  if (!missing().length) return []\n  await runPluginDeclarationsRepair().catch((error: unknown) => {\n    console.error('[plugins] the declarations repair failed before an org erasure', error)\n  })\n  return missing()\n}\n\n/** The plugins with a workspace eraser, in the order they run. */\nexport function listPluginOrgErasers(): string[] {\n  return registrations.map((entry) => entry.pluginId)\n}\n\n/** Test seam: forget every eraser. */\nexport function resetPluginOrgErasersForTests(): void {\n  registrations.length = 0\n}\n\n/**\n * Test seam: a no-op eraser for every REQUIRED plugin that has none, so a\n * spec about the erasure's own sweeps can run it without loading a plugin\n * (core and the data layer may not import one). A spec about a required\n * plugin's share registers the real one through the app's manifest instead.\n */\nexport function standInRequiredOrgErasersForTests(): void {\n  const registered = new Set(registrations.map((entry) => entry.pluginId))\n  for (const pluginId of PLUGIN_REQUIRED_ORG_ERASERS) {\n    if (!registered.has(pluginId)) {\n      registrations.push({ pluginId, eraser: async () => ({ standIn: true }) })\n    }\n  }\n}\n"],"names":["globalScope","getRegisteringPluginId","runPluginDeclarationsRepair","PLUGIN_ORG_KEYED_COLLECTIONS","PLUGIN_REQUIRED_ORG_ERASERS","ERASERS_KEY","Symbol","for","globalThis","registrations","registerPluginOrgEraser","eraser","options","pluginId","trim","Error","index","findIndex","entry","push","runPluginOrgErasers","request","required","missing","missingAfterRepair","length","orgId","join","reports","failedRequired","dryRun","error","console","includes","registered","Set","map","filter","has","catch","listPluginOrgErasers","resetPluginOrgErasersForTests","standInRequiredOrgErasersForTests","standIn"],"mappings":"IA0IEA;AA1IF;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyDC,GAED,SAASC,sBAAsB,QAAQ,qCAAiC;AACxE,SAASC,2BAA2B,QAAQ,kCAA8B;AAC1E,SACEC,4BAA4B,EAC5BC,2BAA2B,QACtB,qCAAiC;AAExC,SAASD,4BAA4B,EAAEC,2BAA2B,GAAE;AA0CpE;;;;;CAKC,GACD,MAAMC,cAAcC,OAAOC,GAAG,CAAC;AAE/B,MAAMP,cAAcQ;AAIpB,MAAMC,iBACJT,2BAAAA,WAAW,CAACK,YAAY,YAAxBL,2BAA6BA,WAAW,CAACK,YAAY,GAAG,EAAE;AAE5D;;;;;CAKC,GACD,OAAO,SAASK,wBACdC,MAAuB,EACvBC,OAA+B;QAEbX,MAAAA;IAAlB,MAAMY,WAAW,EAACZ,QAAAA,0BAAAA,oCAAAA,0BAA4BW,2BAAAA,QAASC,QAAQ,YAA7CZ,OAAiD,IAAIa,IAAI;IAC3E,IAAI,CAACD,UAAU;QACb,MAAM,IAAIE,MACR,yEACE;IAEN;IACA,MAAMC,QAAQP,cAAcQ,SAAS,CAAC,CAACC,QAAUA,MAAML,QAAQ,KAAKA;IACpE,IAAIG,SAAS,GAAGP,aAAa,CAACO,MAAM,GAAG;QAAEH;QAAUF;IAAO;SACrDF,cAAcU,IAAI,CAAC;QAAEN;QAAUF;IAAO;AAC7C;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAeS,oBACpBC,OAAgC,EAChCC,WAA8BlB,2BAA2B;IAEzD,MAAMmB,UAAU,MAAMC,mBAAmBF;IACzC,IAAIC,QAAQE,MAAM,EAAE;QAClB,MAAM,IAAIV,MACR,CAAC,sBAAsB,EAAEM,QAAQK,KAAK,CAAC,UAAU,EAAEH,QAAQI,IAAI,CAAC,MAAM,CAAC,CAAC,GACtE;IAEN;IACA,MAAMC,UAAyD,CAAC;IAChE,MAAMC,iBAA2B,EAAE;IACnC,KAAK,MAAM,EAAEhB,QAAQ,EAAEF,MAAM,EAAE,IAAI;WAAIF;KAAc,CAAE;QACrD,IAAI;YACFmB,OAAO,CAACf,SAAS,GAAG,MAAMF,OAAO;gBAAEe,OAAOL,QAAQK,KAAK;gBAAEI,QAAQT,QAAQS,MAAM;YAAC;QAClF,EAAE,OAAOC,OAAO;YACdH,OAAO,CAACf,SAAS,GAAG;YACpBmB,QAAQD,KAAK,CAAC,CAAC,UAAU,EAAElB,SAAS,qBAAqB,EAAEQ,QAAQK,KAAK,EAAE,EAAEK;YAC5E,IAAIT,SAASW,QAAQ,CAACpB,WAAWgB,eAAeV,IAAI,CAACN;QACvD;IACF;IACA,IAAIgB,eAAeJ,MAAM,EAAE;QACzB,MAAM,IAAIV,MACR,CAAC,sBAAsB,EAAEM,QAAQK,KAAK,CAAC,oCAAoC,CAAC,GAC1E,GAAGG,eAAeF,IAAI,CAAC,MAAM,OAAO,CAAC;IAE3C;IACA,OAAOC;AACT;AAEA;;;;;CAKC,GACD,eAAeJ,mBAAmBF,QAA2B;IAC3D,MAAMC,UAAU;QACd,MAAMW,aAAa,IAAIC,IAAI1B,cAAc2B,GAAG,CAAC,CAAClB,QAAUA,MAAML,QAAQ;QACtE,OAAOS,SAASe,MAAM,CAAC,CAACxB,WAAa,CAACqB,WAAWI,GAAG,CAACzB;IACvD;IACA,IAAI,CAACU,UAAUE,MAAM,EAAE,OAAO,EAAE;IAChC,MAAMvB,8BAA8BqC,KAAK,CAAC,CAACR;QACzCC,QAAQD,KAAK,CAAC,kEAAkEA;IAClF;IACA,OAAOR;AACT;AAEA,gEAAgE,GAChE,OAAO,SAASiB;IACd,OAAO/B,cAAc2B,GAAG,CAAC,CAAClB,QAAUA,MAAML,QAAQ;AACpD;AAEA,oCAAoC,GACpC,OAAO,SAAS4B;IACdhC,cAAcgB,MAAM,GAAG;AACzB;AAEA;;;;;CAKC,GACD,OAAO,SAASiB;IACd,MAAMR,aAAa,IAAIC,IAAI1B,cAAc2B,GAAG,CAAC,CAAClB,QAAUA,MAAML,QAAQ;IACtE,KAAK,MAAMA,YAAYT,4BAA6B;QAClD,IAAI,CAAC8B,WAAWI,GAAG,CAACzB,WAAW;YAC7BJ,cAAcU,IAAI,CAAC;gBAAEN;gBAAUF,QAAQ,UAAa,CAAA;wBAAEgC,SAAS;oBAAK,CAAA;YAAG;QACzE;IACF;AACF"}

package/src/lib/plugin-manager/plugin-person-erasure.d.ts

@@ -14,8 +14,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-/** Who is being erased, and from which workspace. */
-export interface PluginPersonErasureRequest {
+import { PLUGIN_REQUIRED_PERSON_ERASERS } from './first-party-plugins.generated';
+export { PLUGIN_REQUIRED_PERSON_ERASERS };
+/** Who is being erased, and from which workspace: what is known before anyone erases. */
+export interface PluginPersonErasureTarget {
     /** The workspace the person is erased from. */
     orgId: string;
     /** The person's address, normalized. */
@@ -25,10 +27,18 @@ export interface PluginPersonErasureRequest {
      * keeps in the same way, names the person without their address.
      */
     key: string;
-    /** The contact documents the erasure is about to delete, by id. */
-    contactIds: readonly string[];
     /** A plan, not an erasure: count, write nothing. */
     dryRun: boolean;
+    /** When the erasure runs, epoch ms: the one time every stamp it leaves carries. */
+    atMs: number;
+}
+/** What every eraser is handed. */
+export interface PluginPersonErasureRequest extends PluginPersonErasureTarget {
+    /**
+     * The person's records, by the record system's ids, as its `locate`
+     * answered before anything was erased — empty when no plugin keeps people.
+     */
+    contactIds: readonly string[];
 }
 /**
  * What an eraser reports for the erasure's audit record: counts and flags,
@@ -37,6 +47,13 @@ export interface PluginPersonErasureRequest {
  */
 export type PluginPersonErasureReport = Readonly<Record<string, number | boolean | null>>;
 export type PluginPersonEraser = (request: PluginPersonErasureRequest) => Promise<PluginPersonErasureReport>;
+/** The plugin that keeps the people: names the person's records first, erases them last. */
+export interface PluginPersonRecordsEraser {
+    /** The ids of the person's records in this workspace. Writes nothing. */
+    locate(target: PluginPersonErasureTarget): Promise<readonly string[]>;
+    /** Its own share, run after every other eraser. */
+    erase: PluginPersonEraser;
+}
 /**
  * Registers a plugin's person eraser. Owner = the loader's marker inside a
  * register fn, else `options.pluginId`; an eraser with neither throws. One
@@ -47,12 +64,54 @@ export declare function registerPluginPersonEraser(eraser: PluginPersonEraser, o
     pluginId?: string;
 }): void;
 /**
- * Runs every eraser, in registration order, and answers each plugin's
- * report by plugin id: the eraser's own report, or `null` for one that
- * threw. Never throws.
+ * Registers the records eraser of the plugin that keeps people. One per
+ * process: the same plugin registering again replaces its own, and a second
+ * plugin is refused naming both — a workspace keeps one set of people.
+ */
+export declare function registerPluginPersonRecordsEraser(eraser: PluginPersonRecordsEraser, options?: {
+    pluginId?: string;
+}): void;
+/**
+ * The required erasers not registered in this process, in `required` order —
+ * empty when the erasure may run. The erasure asks before it writes anything.
+ */
+export declare function missingRequiredPersonErasers(required?: readonly string[]): string[];
+/**
+ * {@link missingRequiredPersonErasers}, after running the app's boot step
+ * once when any is missing (AGL-3464): a boot whose declarations failed looks
+ * the same from here as one that never declared the eraser, and only the
+ * second is a reason to refuse. What the erasure asks before it writes
+ * anything.
  */
-export declare function runPluginPersonErasers(request: PluginPersonErasureRequest): Promise<Record<string, PluginPersonErasureReport | null>>;
-/** The plugins with a person eraser, in the order they run. */
+export declare function missingRequiredPersonErasersAfterRepair(required?: readonly string[]): Promise<string[]>;
+/** What one erasure's plugins did. */
+export interface PluginPersonErasureOutcome {
+    /** The records `locate` named, handed to every eraser. */
+    contactIds: string[];
+    /** Each plugin's report by plugin id, or `null` for an eraser that threw. */
+    reports: Record<string, PluginPersonErasureReport | null>;
+}
+/**
+ * Runs the plugins' shares of one person erasure: the records eraser's
+ * `locate`, every other eraser in registration order, then the records
+ * eraser's `erase`. See the module note.
+ *
+ * Throws in three cases, each about a share the erasure promises (`required`,
+ * the compiled {@link PLUGIN_REQUIRED_PERSON_ERASERS} unless a spec passes its
+ * own): before running anything, when a required eraser is not registered
+ * even after the app's boot step has run once more, or the records eraser
+ * cannot `locate`; and after running every eraser, when a required one
+ * threw. Otherwise never.
+ */
+export declare function runPluginPersonErasure(target: PluginPersonErasureTarget, required?: readonly string[]): Promise<PluginPersonErasureOutcome>;
+/** The plugins with a person eraser, in the order they run: the records eraser last. */
 export declare function listPluginPersonErasers(): string[];
 /** Test seam: forget every eraser. */
 export declare function resetPluginPersonErasersForTests(): void;
+/**
+ * Test seam: a no-op eraser for every REQUIRED plugin that has none, so a spec
+ * about the erasure's own sweeps can run it without loading a plugin (core
+ * and the data layer may not import one). A spec about a plugin's share
+ * registers the real one through the app's manifest instead.
+ */
+export declare function standInRequiredPersonErasersForTests(): void;

package/src/lib/plugin-manager/plugin-person-erasure.js

@@ -1,3 +1,5 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+var _globalScope_ERASERS_KEY;
 /**
  * @license
  * Copyright 2026 Aglyn LLC
@@ -14,54 +16,103 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */ /**
- * A plugin's share of a PERSON erasure (AGL-2981).
- *
- * The person erasure removes one person from one workspace — a contact the
- * workspace kept, not an account: the contact document, what the CRM files
- * beside it, the leads, list memberships and delivery log under the
- * address, and the person's identity on orders and bookings. A plugin that
- * keeps records about such a person where none of those sweeps reach — a
- * collection under the organization keyed by the contact or by the address
- * — registers an eraser here, and the erasure runs every eraser with the
- * person's address, its key and the contacts it is about to delete.
- *
- * Erasers run AFTER the erasure has closed the door and BEFORE it deletes
- * the contacts: every site's suppression row is already written, so nothing
- * a plugin sends can reach the person while its eraser runs, and the contact
- * documents still exist for an eraser that has to read one.
+ * The plugins' shares of a PERSON erasure (AGL-2981, AGL-3080).
+ *
+ * The person erasure removes one person from one workspace — a person the
+ * workspace kept, not an account. The platform closes every site's door to
+ * the address (a suppression row per site), sweeps the delivery log filed
+ * under it, and keeps the audit; everything else the workspace keeps about the
+ * person is a plugin's, and each plugin that keeps some registers an eraser
+ * here: the record system's people and what it files beside them, a shop's
+ * orders, a calendar's bookings, an audience's members, a sequence's
+ * enrollments.
+ *
+ * ## The plugin that keeps the people goes first, and last
+ *
+ * Other plugins key what they keep about a person on the record system's ids
+ * — an enrollment names the contact it enrolled — so the erasure has to know
+ * those ids before anybody erases, and the records themselves have to outlive
+ * every other eraser. The plugin that keeps people registers a RECORDS eraser
+ * (`registerPluginPersonRecordsEraser`, one per workspace) with two halves:
+ *
+ *  1. `locate` names the person's records, read before anything is erased; the
+ *     ids are handed to every eraser as `contactIds`;
+ *  2. every other eraser runs, in registration order;
+ *  3. the records eraser's own `erase` runs LAST, while nothing else is left
+ *     that needs the records to find what it keeps.
+ *
+ * Every eraser runs AFTER the erasure has closed the door — every site's
+ * suppression row is already written, so nothing a plugin sends can reach the
+ * person while it runs.
  *
  * The two halves of the rule that holds everywhere else in the erasure hold
  * here too. A record ABOUT the person goes. A record that the person asked
- * not to be contacted — keyed by `personKey`, the hash every suppression
- * list is keyed by, and holding no address — is KEPT, because the promise
- * it records has to outlive the person's data; an eraser strips from it
- * anything that could identify the person again.
+ * not to be contacted — keyed by `personKey`, the hash every suppression list
+ * is keyed by, and holding no address — is KEPT, because the promise it
+ * records has to outlive the person's data; an eraser strips from it anything
+ * that could identify the person again.
+ *
+ * ## Isolated, unless REQUIRED
  *
- * Erasers run in registration order and are ISOLATED: a throw is logged
- * against its plugin, recorded as `null`, and does not stop the next one or
- * the erasure. The `null` is how the erasure's audit record says that
- * plugin's share may remain, which a report of zero would hide.
+ * Erasers are ISOLATED: a throw is logged against its plugin, recorded as
+ * `null`, and does not stop the next one. The `null` is how the erasure's
+ * audit record says that plugin's share may remain, which a report of zero
+ * would hide.
+ *
+ * Isolation is right for a courtesy and wrong for a share the erasure
+ * PROMISES the person — their contact record, their leads, their name on an
+ * order. A plugin keeping such a share declares `"requiredPersonEraser": true`
+ * in `plugins.config.json`, compiled into {@link PLUGIN_REQUIRED_PERSON_ERASERS}
+ * so no registration can opt out of it, and:
+ *
+ * - the erasure REFUSES to start while a required eraser is not registered —
+ *   a boot that failed to declare one must not produce an "erased" request
+ *   with the person still on file;
+ * - a records eraser whose `locate` throws stops the erasure before anything
+ *   is erased: nobody can be handed the ids;
+ * - a required eraser that throws still lets every other eraser run, and then
+ *   fails the erasure, which the job retries.
  *
  * A DRY RUN is handed to every eraser, which must then write nothing: it
  * counts what it would do.
  *
  * Registered from a plugin's declarations — `serverDeclarations`, or
- * `consoleServerDeclarations` for a plugin whose server code runs only in
- * the console — so the eraser is in place in a process that never loaded
- * the plugin's API surface.
+ * `consoleServerDeclarations` for a plugin whose server code runs only in the
+ * console — so the eraser is in place in a process that never loaded the
+ * plugin's API surface.
  */ import { getRegisteringPluginId } from "../app-utils/registering-plugin.js";
-const registrations = [];
+import { PLUGIN_REQUIRED_PERSON_ERASERS } from "./first-party-plugins.generated.js";
+import { runPluginDeclarationsRepair } from "./plugin-declarations-repair.js";
+export { PLUGIN_REQUIRED_PERSON_ERASERS };
+/**
+ * One set of erasers per process, on `globalThis` (AGL-3464): the app registers its
+ * plugins' erasers from `instrumentation.ts`, which Next compiles apart from
+ * the route that runs the erasure, and a module-scoped list is filled in one
+ * copy and read empty in the other — the AGL-3412 shape.
+ * Here a required share registered in the other copy reads as missing, and
+ * every erasure refuses.
+ */ const ERASERS_KEY = Symbol.for('@aglyn/aglyn:plugin-person-erasers');
+const globalScope = globalThis;
+const erasers = (_globalScope_ERASERS_KEY = globalScope[ERASERS_KEY]) != null ? _globalScope_ERASERS_KEY : globalScope[ERASERS_KEY] = {
+    registrations: [],
+    records: null
+};
+const registrations = erasers.registrations;
+function ownerOf(options, what) {
+    var _ref, _getRegisteringPluginId;
+    const pluginId = ((_ref = (_getRegisteringPluginId = getRegisteringPluginId()) != null ? _getRegisteringPluginId : options == null ? void 0 : options.pluginId) != null ? _ref : '').trim();
+    if (!pluginId) {
+        throw new Error(`a plugin ${what} was registered with no owner: pass { pluginId } ` + 'when registering outside a plugin register fn');
+    }
+    return pluginId;
+}
 /**
  * Registers a plugin's person eraser. Owner = the loader's marker inside a
  * register fn, else `options.pluginId`; an eraser with neither throws. One
  * eraser per plugin: registering again replaces the plugin's earlier eraser
  * in place, so a module evaluated twice does not erase twice.
  */ export function registerPluginPersonEraser(eraser, options) {
-    var _ref, _getRegisteringPluginId;
-    const pluginId = ((_ref = (_getRegisteringPluginId = getRegisteringPluginId()) != null ? _getRegisteringPluginId : options == null ? void 0 : options.pluginId) != null ? _ref : '').trim();
-    if (!pluginId) {
-        throw new Error('a plugin person eraser was registered with no owner: pass { pluginId } ' + 'when registering outside a plugin register fn');
-    }
+    const pluginId = ownerOf(options, 'person eraser');
     const index = registrations.findIndex((entry)=>entry.pluginId === pluginId);
     if (index >= 0) registrations[index] = {
         pluginId,
@@ -73,37 +124,131 @@ const registrations = [];
     });
 }
 /**
- * Runs every eraser, in registration order, and answers each plugin's
- * report by plugin id: the eraser's own report, or `null` for one that
- * threw. Never throws.
- */ export async function runPluginPersonErasers(request) {
+ * Registers the records eraser of the plugin that keeps people. One per
+ * process: the same plugin registering again replaces its own, and a second
+ * plugin is refused naming both — a workspace keeps one set of people.
+ */ export function registerPluginPersonRecordsEraser(eraser, options) {
+    const pluginId = ownerOf(options, 'person records eraser');
+    if (erasers.records && erasers.records.pluginId !== pluginId) {
+        throw new Error(`the person records eraser is "${erasers.records.pluginId}"'s; refused one from "${pluginId}"`);
+    }
+    erasers.records = {
+        pluginId,
+        eraser
+    };
+}
+/**
+ * The required erasers not registered in this process, in `required` order —
+ * empty when the erasure may run. The erasure asks before it writes anything.
+ */ export function missingRequiredPersonErasers(required = PLUGIN_REQUIRED_PERSON_ERASERS) {
+    const registered = new Set(registrations.map((entry)=>entry.pluginId));
+    if (erasers.records) registered.add(erasers.records.pluginId);
+    return required.filter((pluginId)=>!registered.has(pluginId));
+}
+/**
+ * {@link missingRequiredPersonErasers}, after running the app's boot step
+ * once when any is missing (AGL-3464): a boot whose declarations failed looks
+ * the same from here as one that never declared the eraser, and only the
+ * second is a reason to refuse. What the erasure asks before it writes
+ * anything.
+ */ export async function missingRequiredPersonErasersAfterRepair(required = PLUGIN_REQUIRED_PERSON_ERASERS) {
+    if (!missingRequiredPersonErasers(required).length) return [];
+    await runPluginDeclarationsRepair().catch((error)=>{
+        console.error('[plugins] the declarations repair failed before a person erasure', error);
+    });
+    return missingRequiredPersonErasers(required);
+}
+/**
+ * Runs the plugins' shares of one person erasure: the records eraser's
+ * `locate`, every other eraser in registration order, then the records
+ * eraser's `erase`. See the module note.
+ *
+ * Throws in three cases, each about a share the erasure promises (`required`,
+ * the compiled {@link PLUGIN_REQUIRED_PERSON_ERASERS} unless a spec passes its
+ * own): before running anything, when a required eraser is not registered
+ * even after the app's boot step has run once more, or the records eraser
+ * cannot `locate`; and after running every eraser, when a required one
+ * threw. Otherwise never.
+ */ export async function runPluginPersonErasure(target, required = PLUGIN_REQUIRED_PERSON_ERASERS) {
+    const missing = await missingRequiredPersonErasersAfterRepair(required);
+    if (missing.length) {
+        throw new Error(`[plugins] erasing a person in org ${target.orgId} refused: ${missing.join(', ')} ` + 'declared a required person eraser and none is registered in this process');
+    }
+    const base = {
+        orgId: target.orgId,
+        email: target.email,
+        key: target.key,
+        dryRun: target.dryRun,
+        atMs: target.atMs
+    };
+    const records = erasers.records;
+    const contactIds = records ? [
+        ...await records.eraser.locate(_extends({}, base))
+    ] : [];
     const reports = {};
-    for (const { pluginId, eraser } of [
-        ...registrations
-    ]){
+    const failedRequired = [];
+    const run = async (pluginId, eraser)=>{
         try {
-            reports[pluginId] = await eraser({
-                orgId: request.orgId,
-                email: request.email,
-                key: request.key,
+            reports[pluginId] = await eraser(_extends({}, base, {
                 contactIds: [
-                    ...request.contactIds
-                ],
-                dryRun: request.dryRun
-            });
+                    ...contactIds
+                ]
+            }));
         } catch (error) {
             reports[pluginId] = null;
             // The org, never the address: this line outlives the erasure.
-            console.error(`[plugins] ${pluginId} failed to erase a person in org ${request.orgId}`, error);
+            console.error(`[plugins] ${pluginId} failed to erase a person in org ${target.orgId}`, error);
+            if (required.includes(pluginId)) failedRequired.push(pluginId);
         }
+    };
+    const owner = records;
+    for (const { pluginId, eraser } of [
+        ...registrations
+    ]){
+        if (pluginId === (owner == null ? void 0 : owner.pluginId)) continue;
+        await run(pluginId, eraser);
+    }
+    if (owner) await run(owner.pluginId, owner.eraser.erase);
+    if (failedRequired.length) {
+        throw new Error(`[plugins] erasing a person in org ${target.orgId} incomplete: the required eraser of ` + `${failedRequired.join(', ')} failed`);
     }
-    return reports;
+    return {
+        contactIds,
+        reports
+    };
 }
-/** The plugins with a person eraser, in the order they run. */ export function listPluginPersonErasers() {
-    return registrations.map((entry)=>entry.pluginId);
+/** The plugins with a person eraser, in the order they run: the records eraser last. */ export function listPluginPersonErasers() {
+    var _erasers_records;
+    const owner = (_erasers_records = erasers.records) == null ? void 0 : _erasers_records.pluginId;
+    return [
+        ...registrations.map((entry)=>entry.pluginId).filter((pluginId)=>pluginId !== owner),
+        ...owner ? [
+            owner
+        ] : []
+    ];
 }
 /** Test seam: forget every eraser. */ export function resetPluginPersonErasersForTests() {
     registrations.length = 0;
+    erasers.records = null;
+}
+/**
+ * Test seam: a no-op eraser for every REQUIRED plugin that has none, so a spec
+ * about the erasure's own sweeps can run it without loading a plugin (core
+ * and the data layer may not import one). A spec about a plugin's share
+ * registers the real one through the app's manifest instead.
+ */ export function standInRequiredPersonErasersForTests() {
+    const registered = new Set(registrations.map((entry)=>entry.pluginId));
+    if (erasers.records) registered.add(erasers.records.pluginId);
+    for (const pluginId of PLUGIN_REQUIRED_PERSON_ERASERS){
+        if (!registered.has(pluginId)) {
+            registrations.push({
+                pluginId,
+                eraser: async ()=>({
+                        standIn: true
+                    })
+            });
+        }
+    }
 }
 
 //# sourceMappingURL=plugin-person-erasure.js.map

package/src/lib/plugin-manager/plugin-person-erasure.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-person-erasure.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A plugin's share of a PERSON erasure (AGL-2981).\n *\n * The person erasure removes one person from one workspace — a contact the\n * workspace kept, not an account: the contact document, what the CRM files\n * beside it, the leads, list memberships and delivery log under the\n * address, and the person's identity on orders and bookings. A plugin that\n * keeps records about such a person where none of those sweeps reach — a\n * collection under the organization keyed by the contact or by the address\n * — registers an eraser here, and the erasure runs every eraser with the\n * person's address, its key and the contacts it is about to delete.\n *\n * Erasers run AFTER the erasure has closed the door and BEFORE it deletes\n * the contacts: every site's suppression row is already written, so nothing\n * a plugin sends can reach the person while its eraser runs, and the contact\n * documents still exist for an eraser that has to read one.\n *\n * The two halves of the rule that holds everywhere else in the erasure hold\n * here too. A record ABOUT the person goes. A record that the person asked\n * not to be contacted — keyed by `personKey`, the hash every suppression\n * list is keyed by, and holding no address — is KEPT, because the promise\n * it records has to outlive the person's data; an eraser strips from it\n * anything that could identify the person again.\n *\n * Erasers run in registration order and are ISOLATED: a throw is logged\n * against its plugin, recorded as `null`, and does not stop the next one or\n * the erasure. The `null` is how the erasure's audit record says that\n * plugin's share may remain, which a report of zero would hide.\n *\n * A DRY RUN is handed to every eraser, which must then write nothing: it\n * counts what it would do.\n *\n * Registered from a plugin's declarations — `serverDeclarations`, or\n * `consoleServerDeclarations` for a plugin whose server code runs only in\n * the console — so the eraser is in place in a process that never loaded\n * the plugin's API surface.\n */\n\nimport { getRegisteringPluginId } from '../app-utils/registering-plugin'\n\n/** Who is being erased, and from which workspace. */\nexport interface PluginPersonErasureRequest {\n  /** The workspace the person is erased from. */\n  orgId: string\n  /** The person's address, normalized. */\n  email: string\n  /**\n   * `personKey(email)`: how every suppression list, and any list a plugin\n   * keeps in the same way, names the person without their address.\n   */\n  key: string\n  /** The contact documents the erasure is about to delete, by id. */\n  contactIds: readonly string[]\n  /** A plan, not an erasure: count, write nothing. */\n  dryRun: boolean\n}\n\n/**\n * What an eraser reports for the erasure's audit record: counts and flags,\n * never the erased content. A `null` field is a figure the eraser could not\n * measure, which is not zero.\n */\nexport type PluginPersonErasureReport = Readonly<Record<string, number | boolean | null>>\n\nexport type PluginPersonEraser = (\n  request: PluginPersonErasureRequest,\n) => Promise<PluginPersonErasureReport>\n\ninterface Registration {\n  pluginId: string\n  eraser: PluginPersonEraser\n}\n\nconst registrations: Registration[] = []\n\n/**\n * Registers a plugin's person eraser. Owner = the loader's marker inside a\n * register fn, else `options.pluginId`; an eraser with neither throws. One\n * eraser per plugin: registering again replaces the plugin's earlier eraser\n * in place, so a module evaluated twice does not erase twice.\n */\nexport function registerPluginPersonEraser(\n  eraser: PluginPersonEraser,\n  options?: { pluginId?: string },\n): void {\n  const pluginId = (getRegisteringPluginId() ?? options?.pluginId ?? '').trim()\n  if (!pluginId) {\n    throw new Error(\n      'a plugin person eraser was registered with no owner: pass { pluginId } ' +\n        'when registering outside a plugin register fn',\n    )\n  }\n  const index = registrations.findIndex((entry) => entry.pluginId === pluginId)\n  if (index >= 0) registrations[index] = { pluginId, eraser }\n  else registrations.push({ pluginId, eraser })\n}\n\n/**\n * Runs every eraser, in registration order, and answers each plugin's\n * report by plugin id: the eraser's own report, or `null` for one that\n * threw. Never throws.\n */\nexport async function runPluginPersonErasers(\n  request: PluginPersonErasureRequest,\n): Promise<Record<string, PluginPersonErasureReport | null>> {\n  const reports: Record<string, PluginPersonErasureReport | null> = {}\n  for (const { pluginId, eraser } of [...registrations]) {\n    try {\n      reports[pluginId] = await eraser({\n        orgId: request.orgId,\n        email: request.email,\n        key: request.key,\n        contactIds: [...request.contactIds],\n        dryRun: request.dryRun,\n      })\n    } catch (error) {\n      reports[pluginId] = null\n      // The org, never the address: this line outlives the erasure.\n      console.error(`[plugins] ${pluginId} failed to erase a person in org ${request.orgId}`, error)\n    }\n  }\n  return reports\n}\n\n/** The plugins with a person eraser, in the order they run. */\nexport function listPluginPersonErasers(): string[] {\n  return registrations.map((entry) => entry.pluginId)\n}\n\n/** Test seam: forget every eraser. */\nexport function resetPluginPersonErasersForTests(): void {\n  registrations.length = 0\n}\n"],"names":["getRegisteringPluginId","registrations","registerPluginPersonEraser","eraser","options","pluginId","trim","Error","index","findIndex","entry","push","runPluginPersonErasers","request","reports","orgId","email","key","contactIds","dryRun","error","console","listPluginPersonErasers","map","resetPluginPersonErasersForTests","length"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCC,GAED,SAASA,sBAAsB,QAAQ,qCAAiC;AAmCxE,MAAMC,gBAAgC,EAAE;AAExC;;;;;CAKC,GACD,OAAO,SAASC,2BACdC,MAA0B,EAC1BC,OAA+B;QAEbJ,MAAAA;IAAlB,MAAMK,WAAW,EAACL,QAAAA,0BAAAA,oCAAAA,0BAA4BI,2BAAAA,QAASC,QAAQ,YAA7CL,OAAiD,IAAIM,IAAI;IAC3E,IAAI,CAACD,UAAU;QACb,MAAM,IAAIE,MACR,4EACE;IAEN;IACA,MAAMC,QAAQP,cAAcQ,SAAS,CAAC,CAACC,QAAUA,MAAML,QAAQ,KAAKA;IACpE,IAAIG,SAAS,GAAGP,aAAa,CAACO,MAAM,GAAG;QAAEH;QAAUF;IAAO;SACrDF,cAAcU,IAAI,CAAC;QAAEN;QAAUF;IAAO;AAC7C;AAEA;;;;CAIC,GACD,OAAO,eAAeS,uBACpBC,OAAmC;IAEnC,MAAMC,UAA4D,CAAC;IACnE,KAAK,MAAM,EAAET,QAAQ,EAAEF,MAAM,EAAE,IAAI;WAAIF;KAAc,CAAE;QACrD,IAAI;YACFa,OAAO,CAACT,SAAS,GAAG,MAAMF,OAAO;gBAC/BY,OAAOF,QAAQE,KAAK;gBACpBC,OAAOH,QAAQG,KAAK;gBACpBC,KAAKJ,QAAQI,GAAG;gBAChBC,YAAY;uBAAIL,QAAQK,UAAU;iBAAC;gBACnCC,QAAQN,QAAQM,MAAM;YACxB;QACF,EAAE,OAAOC,OAAO;YACdN,OAAO,CAACT,SAAS,GAAG;YACpB,8DAA8D;YAC9DgB,QAAQD,KAAK,CAAC,CAAC,UAAU,EAAEf,SAAS,iCAAiC,EAAEQ,QAAQE,KAAK,EAAE,EAAEK;QAC1F;IACF;IACA,OAAON;AACT;AAEA,6DAA6D,GAC7D,OAAO,SAASQ;IACd,OAAOrB,cAAcsB,GAAG,CAAC,CAACb,QAAUA,MAAML,QAAQ;AACpD;AAEA,oCAAoC,GACpC,OAAO,SAASmB;IACdvB,cAAcwB,MAAM,GAAG;AACzB"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-person-erasure.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The plugins' shares of a PERSON erasure (AGL-2981, AGL-3080).\n *\n * The person erasure removes one person from one workspace — a person the\n * workspace kept, not an account. The platform closes every site's door to\n * the address (a suppression row per site), sweeps the delivery log filed\n * under it, and keeps the audit; everything else the workspace keeps about the\n * person is a plugin's, and each plugin that keeps some registers an eraser\n * here: the record system's people and what it files beside them, a shop's\n * orders, a calendar's bookings, an audience's members, a sequence's\n * enrollments.\n *\n * ## The plugin that keeps the people goes first, and last\n *\n * Other plugins key what they keep about a person on the record system's ids\n * — an enrollment names the contact it enrolled — so the erasure has to know\n * those ids before anybody erases, and the records themselves have to outlive\n * every other eraser. The plugin that keeps people registers a RECORDS eraser\n * (`registerPluginPersonRecordsEraser`, one per workspace) with two halves:\n *\n *  1. `locate` names the person's records, read before anything is erased; the\n *     ids are handed to every eraser as `contactIds`;\n *  2. every other eraser runs, in registration order;\n *  3. the records eraser's own `erase` runs LAST, while nothing else is left\n *     that needs the records to find what it keeps.\n *\n * Every eraser runs AFTER the erasure has closed the door — every site's\n * suppression row is already written, so nothing a plugin sends can reach the\n * person while it runs.\n *\n * The two halves of the rule that holds everywhere else in the erasure hold\n * here too. A record ABOUT the person goes. A record that the person asked\n * not to be contacted — keyed by `personKey`, the hash every suppression list\n * is keyed by, and holding no address — is KEPT, because the promise it\n * records has to outlive the person's data; an eraser strips from it anything\n * that could identify the person again.\n *\n * ## Isolated, unless REQUIRED\n *\n * Erasers are ISOLATED: a throw is logged against its plugin, recorded as\n * `null`, and does not stop the next one. The `null` is how the erasure's\n * audit record says that plugin's share may remain, which a report of zero\n * would hide.\n *\n * Isolation is right for a courtesy and wrong for a share the erasure\n * PROMISES the person — their contact record, their leads, their name on an\n * order. A plugin keeping such a share declares `\"requiredPersonEraser\": true`\n * in `plugins.config.json`, compiled into {@link PLUGIN_REQUIRED_PERSON_ERASERS}\n * so no registration can opt out of it, and:\n *\n * - the erasure REFUSES to start while a required eraser is not registered —\n *   a boot that failed to declare one must not produce an \"erased\" request\n *   with the person still on file;\n * - a records eraser whose `locate` throws stops the erasure before anything\n *   is erased: nobody can be handed the ids;\n * - a required eraser that throws still lets every other eraser run, and then\n *   fails the erasure, which the job retries.\n *\n * A DRY RUN is handed to every eraser, which must then write nothing: it\n * counts what it would do.\n *\n * Registered from a plugin's declarations — `serverDeclarations`, or\n * `consoleServerDeclarations` for a plugin whose server code runs only in the\n * console — so the eraser is in place in a process that never loaded the\n * plugin's API surface.\n */\n\nimport { getRegisteringPluginId } from '../app-utils/registering-plugin'\nimport { PLUGIN_REQUIRED_PERSON_ERASERS } from './first-party-plugins.generated'\nimport { runPluginDeclarationsRepair } from './plugin-declarations-repair'\n\nexport { PLUGIN_REQUIRED_PERSON_ERASERS }\n\n/** Who is being erased, and from which workspace: what is known before anyone erases. */\nexport interface PluginPersonErasureTarget {\n  /** The workspace the person is erased from. */\n  orgId: string\n  /** The person's address, normalized. */\n  email: string\n  /**\n   * `personKey(email)`: how every suppression list, and any list a plugin\n   * keeps in the same way, names the person without their address.\n   */\n  key: string\n  /** A plan, not an erasure: count, write nothing. */\n  dryRun: boolean\n  /** When the erasure runs, epoch ms: the one time every stamp it leaves carries. */\n  atMs: number\n}\n\n/** What every eraser is handed. */\nexport interface PluginPersonErasureRequest extends PluginPersonErasureTarget {\n  /**\n   * The person's records, by the record system's ids, as its `locate`\n   * answered before anything was erased — empty when no plugin keeps people.\n   */\n  contactIds: readonly string[]\n}\n\n/**\n * What an eraser reports for the erasure's audit record: counts and flags,\n * never the erased content. A `null` field is a figure the eraser could not\n * measure, which is not zero.\n */\nexport type PluginPersonErasureReport = Readonly<Record<string, number | boolean | null>>\n\nexport type PluginPersonEraser = (\n  request: PluginPersonErasureRequest,\n) => Promise<PluginPersonErasureReport>\n\n/** The plugin that keeps the people: names the person's records first, erases them last. */\nexport interface PluginPersonRecordsEraser {\n  /** The ids of the person's records in this workspace. Writes nothing. */\n  locate(target: PluginPersonErasureTarget): Promise<readonly string[]>\n  /** Its own share, run after every other eraser. */\n  erase: PluginPersonEraser\n}\n\ninterface Registration {\n  pluginId: string\n  eraser: PluginPersonEraser\n}\n\ninterface PersonErasers {\n  registrations: Registration[]\n  records: { pluginId: string; eraser: PluginPersonRecordsEraser } | null\n}\n\n/**\n * One set of erasers per process, on `globalThis` (AGL-3464): the app registers its\n * plugins' erasers from `instrumentation.ts`, which Next compiles apart from\n * the route that runs the erasure, and a module-scoped list is filled in one\n * copy and read empty in the other — the AGL-3412 shape.\n * Here a required share registered in the other copy reads as missing, and\n * every erasure refuses.\n */\nconst ERASERS_KEY = Symbol.for('@aglyn/aglyn:plugin-person-erasers')\n\nconst globalScope = globalThis as typeof globalThis & {\n  [ERASERS_KEY]?: PersonErasers\n}\n\nconst erasers: PersonErasers =\n  globalScope[ERASERS_KEY] ?? (globalScope[ERASERS_KEY] = { registrations: [], records: null })\nconst registrations = erasers.registrations\n\nfunction ownerOf(options: { pluginId?: string } | undefined, what: string): string {\n  const pluginId = (getRegisteringPluginId() ?? options?.pluginId ?? '').trim()\n  if (!pluginId) {\n    throw new Error(\n      `a plugin ${what} was registered with no owner: pass { pluginId } ` +\n        'when registering outside a plugin register fn',\n    )\n  }\n  return pluginId\n}\n\n/**\n * Registers a plugin's person eraser. Owner = the loader's marker inside a\n * register fn, else `options.pluginId`; an eraser with neither throws. One\n * eraser per plugin: registering again replaces the plugin's earlier eraser\n * in place, so a module evaluated twice does not erase twice.\n */\nexport function registerPluginPersonEraser(\n  eraser: PluginPersonEraser,\n  options?: { pluginId?: string },\n): void {\n  const pluginId = ownerOf(options, 'person eraser')\n  const index = registrations.findIndex((entry) => entry.pluginId === pluginId)\n  if (index >= 0) registrations[index] = { pluginId, eraser }\n  else registrations.push({ pluginId, eraser })\n}\n\n/**\n * Registers the records eraser of the plugin that keeps people. One per\n * process: the same plugin registering again replaces its own, and a second\n * plugin is refused naming both — a workspace keeps one set of people.\n */\nexport function registerPluginPersonRecordsEraser(\n  eraser: PluginPersonRecordsEraser,\n  options?: { pluginId?: string },\n): void {\n  const pluginId = ownerOf(options, 'person records eraser')\n  if (erasers.records && erasers.records.pluginId !== pluginId) {\n    throw new Error(\n      `the person records eraser is \"${erasers.records.pluginId}\"'s; refused one from \"${pluginId}\"`,\n    )\n  }\n  erasers.records = { pluginId, eraser }\n}\n\n/**\n * The required erasers not registered in this process, in `required` order —\n * empty when the erasure may run. The erasure asks before it writes anything.\n */\nexport function missingRequiredPersonErasers(\n  required: readonly string[] = PLUGIN_REQUIRED_PERSON_ERASERS,\n): string[] {\n  const registered = new Set(registrations.map((entry) => entry.pluginId))\n  if (erasers.records) registered.add(erasers.records.pluginId)\n  return required.filter((pluginId) => !registered.has(pluginId))\n}\n\n/**\n * {@link missingRequiredPersonErasers}, after running the app's boot step\n * once when any is missing (AGL-3464): a boot whose declarations failed looks\n * the same from here as one that never declared the eraser, and only the\n * second is a reason to refuse. What the erasure asks before it writes\n * anything.\n */\nexport async function missingRequiredPersonErasersAfterRepair(\n  required: readonly string[] = PLUGIN_REQUIRED_PERSON_ERASERS,\n): Promise<string[]> {\n  if (!missingRequiredPersonErasers(required).length) return []\n  await runPluginDeclarationsRepair().catch((error: unknown) => {\n    console.error('[plugins] the declarations repair failed before a person erasure', error)\n  })\n  return missingRequiredPersonErasers(required)\n}\n\n/** What one erasure's plugins did. */\nexport interface PluginPersonErasureOutcome {\n  /** The records `locate` named, handed to every eraser. */\n  contactIds: string[]\n  /** Each plugin's report by plugin id, or `null` for an eraser that threw. */\n  reports: Record<string, PluginPersonErasureReport | null>\n}\n\n/**\n * Runs the plugins' shares of one person erasure: the records eraser's\n * `locate`, every other eraser in registration order, then the records\n * eraser's `erase`. See the module note.\n *\n * Throws in three cases, each about a share the erasure promises (`required`,\n * the compiled {@link PLUGIN_REQUIRED_PERSON_ERASERS} unless a spec passes its\n * own): before running anything, when a required eraser is not registered\n * even after the app's boot step has run once more, or the records eraser\n * cannot `locate`; and after running every eraser, when a required one\n * threw. Otherwise never.\n */\nexport async function runPluginPersonErasure(\n  target: PluginPersonErasureTarget,\n  required: readonly string[] = PLUGIN_REQUIRED_PERSON_ERASERS,\n): Promise<PluginPersonErasureOutcome> {\n  const missing = await missingRequiredPersonErasersAfterRepair(required)\n  if (missing.length) {\n    throw new Error(\n      `[plugins] erasing a person in org ${target.orgId} refused: ${missing.join(', ')} ` +\n        'declared a required person eraser and none is registered in this process',\n    )\n  }\n  const base: PluginPersonErasureTarget = {\n    orgId: target.orgId,\n    email: target.email,\n    key: target.key,\n    dryRun: target.dryRun,\n    atMs: target.atMs,\n  }\n  const records = erasers.records\n  const contactIds = records ? [...(await records.eraser.locate({ ...base }))] : []\n  const reports: Record<string, PluginPersonErasureReport | null> = {}\n  const failedRequired: string[] = []\n  const run = async (pluginId: string, eraser: PluginPersonEraser) => {\n    try {\n      reports[pluginId] = await eraser({ ...base, contactIds: [...contactIds] })\n    } catch (error) {\n      reports[pluginId] = null\n      // The org, never the address: this line outlives the erasure.\n      console.error(`[plugins] ${pluginId} failed to erase a person in org ${target.orgId}`, error)\n      if (required.includes(pluginId)) failedRequired.push(pluginId)\n    }\n  }\n  const owner = records\n  for (const { pluginId, eraser } of [...registrations]) {\n    if (pluginId === owner?.pluginId) continue\n    await run(pluginId, eraser)\n  }\n  if (owner) await run(owner.pluginId, owner.eraser.erase)\n  if (failedRequired.length) {\n    throw new Error(\n      `[plugins] erasing a person in org ${target.orgId} incomplete: the required eraser of ` +\n        `${failedRequired.join(', ')} failed`,\n    )\n  }\n  return { contactIds, reports }\n}\n\n/** The plugins with a person eraser, in the order they run: the records eraser last. */\nexport function listPluginPersonErasers(): string[] {\n  const owner = erasers.records?.pluginId\n  return [\n    ...registrations.map((entry) => entry.pluginId).filter((pluginId) => pluginId !== owner),\n    ...(owner ? [owner] : []),\n  ]\n}\n\n/** Test seam: forget every eraser. */\nexport function resetPluginPersonErasersForTests(): void {\n  registrations.length = 0\n  erasers.records = null\n}\n\n/**\n * Test seam: a no-op eraser for every REQUIRED plugin that has none, so a spec\n * about the erasure's own sweeps can run it without loading a plugin (core\n * and the data layer may not import one). A spec about a plugin's share\n * registers the real one through the app's manifest instead.\n */\nexport function standInRequiredPersonErasersForTests(): void {\n  const registered = new Set(registrations.map((entry) => entry.pluginId))\n  if (erasers.records) registered.add(erasers.records.pluginId)\n  for (const pluginId of PLUGIN_REQUIRED_PERSON_ERASERS) {\n    if (!registered.has(pluginId)) {\n      registrations.push({ pluginId, eraser: async () => ({ standIn: true }) })\n    }\n  }\n}\n"],"names":["globalScope","getRegisteringPluginId","PLUGIN_REQUIRED_PERSON_ERASERS","runPluginDeclarationsRepair","ERASERS_KEY","Symbol","for","globalThis","erasers","registrations","records","ownerOf","options","what","pluginId","trim","Error","registerPluginPersonEraser","eraser","index","findIndex","entry","push","registerPluginPersonRecordsEraser","missingRequiredPersonErasers","required","registered","Set","map","add","filter","has","missingRequiredPersonErasersAfterRepair","length","catch","error","console","runPluginPersonErasure","target","missing","orgId","join","base","email","key","dryRun","atMs","contactIds","locate","reports","failedRequired","run","includes","owner","erase","listPluginPersonErasers","resetPluginPersonErasersForTests","standInRequiredPersonErasersForTests","standIn"],"mappings":";IAgKEA;AAhKF;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiEC,GAED,SAASC,sBAAsB,QAAQ,qCAAiC;AACxE,SAASC,8BAA8B,QAAQ,qCAAiC;AAChF,SAASC,2BAA2B,QAAQ,kCAA8B;AAE1E,SAASD,8BAA8B,GAAE;AAyDzC;;;;;;;CAOC,GACD,MAAME,cAAcC,OAAOC,GAAG,CAAC;AAE/B,MAAMN,cAAcO;AAIpB,MAAMC,WACJR,2BAAAA,WAAW,CAACI,YAAY,YAAxBJ,2BAA6BA,WAAW,CAACI,YAAY,GAAG;IAAEK,eAAe,EAAE;IAAEC,SAAS;AAAK;AAC7F,MAAMD,gBAAgBD,QAAQC,aAAa;AAE3C,SAASE,QAAQC,OAA0C,EAAEC,IAAY;QACrDZ,MAAAA;IAAlB,MAAMa,WAAW,EAACb,QAAAA,0BAAAA,oCAAAA,0BAA4BW,2BAAAA,QAASE,QAAQ,YAA7Cb,OAAiD,IAAIc,IAAI;IAC3E,IAAI,CAACD,UAAU;QACb,MAAM,IAAIE,MACR,CAAC,SAAS,EAAEH,KAAK,iDAAiD,CAAC,GACjE;IAEN;IACA,OAAOC;AACT;AAEA;;;;;CAKC,GACD,OAAO,SAASG,2BACdC,MAA0B,EAC1BN,OAA+B;IAE/B,MAAME,WAAWH,QAAQC,SAAS;IAClC,MAAMO,QAAQV,cAAcW,SAAS,CAAC,CAACC,QAAUA,MAAMP,QAAQ,KAAKA;IACpE,IAAIK,SAAS,GAAGV,aAAa,CAACU,MAAM,GAAG;QAAEL;QAAUI;IAAO;SACrDT,cAAca,IAAI,CAAC;QAAER;QAAUI;IAAO;AAC7C;AAEA;;;;CAIC,GACD,OAAO,SAASK,kCACdL,MAAiC,EACjCN,OAA+B;IAE/B,MAAME,WAAWH,QAAQC,SAAS;IAClC,IAAIJ,QAAQE,OAAO,IAAIF,QAAQE,OAAO,CAACI,QAAQ,KAAKA,UAAU;QAC5D,MAAM,IAAIE,MACR,CAAC,8BAA8B,EAAER,QAAQE,OAAO,CAACI,QAAQ,CAAC,uBAAuB,EAAEA,SAAS,CAAC,CAAC;IAElG;IACAN,QAAQE,OAAO,GAAG;QAAEI;QAAUI;IAAO;AACvC;AAEA;;;CAGC,GACD,OAAO,SAASM,6BACdC,WAA8BvB,8BAA8B;IAE5D,MAAMwB,aAAa,IAAIC,IAAIlB,cAAcmB,GAAG,CAAC,CAACP,QAAUA,MAAMP,QAAQ;IACtE,IAAIN,QAAQE,OAAO,EAAEgB,WAAWG,GAAG,CAACrB,QAAQE,OAAO,CAACI,QAAQ;IAC5D,OAAOW,SAASK,MAAM,CAAC,CAAChB,WAAa,CAACY,WAAWK,GAAG,CAACjB;AACvD;AAEA;;;;;;CAMC,GACD,OAAO,eAAekB,wCACpBP,WAA8BvB,8BAA8B;IAE5D,IAAI,CAACsB,6BAA6BC,UAAUQ,MAAM,EAAE,OAAO,EAAE;IAC7D,MAAM9B,8BAA8B+B,KAAK,CAAC,CAACC;QACzCC,QAAQD,KAAK,CAAC,oEAAoEA;IACpF;IACA,OAAOX,6BAA6BC;AACtC;AAUA;;;;;;;;;;;CAWC,GACD,OAAO,eAAeY,uBACpBC,MAAiC,EACjCb,WAA8BvB,8BAA8B;IAE5D,MAAMqC,UAAU,MAAMP,wCAAwCP;IAC9D,IAAIc,QAAQN,MAAM,EAAE;QAClB,MAAM,IAAIjB,MACR,CAAC,kCAAkC,EAAEsB,OAAOE,KAAK,CAAC,UAAU,EAAED,QAAQE,IAAI,CAAC,MAAM,CAAC,CAAC,GACjF;IAEN;IACA,MAAMC,OAAkC;QACtCF,OAAOF,OAAOE,KAAK;QACnBG,OAAOL,OAAOK,KAAK;QACnBC,KAAKN,OAAOM,GAAG;QACfC,QAAQP,OAAOO,MAAM;QACrBC,MAAMR,OAAOQ,IAAI;IACnB;IACA,MAAMpC,UAAUF,QAAQE,OAAO;IAC/B,MAAMqC,aAAarC,UAAU;WAAK,MAAMA,QAAQQ,MAAM,CAAC8B,MAAM,CAAC,aAAKN;KAAS,GAAG,EAAE;IACjF,MAAMO,UAA4D,CAAC;IACnE,MAAMC,iBAA2B,EAAE;IACnC,MAAMC,MAAM,OAAOrC,UAAkBI;QACnC,IAAI;YACF+B,OAAO,CAACnC,SAAS,GAAG,MAAMI,OAAO,aAAKwB;gBAAMK,YAAY;uBAAIA;iBAAW;;QACzE,EAAE,OAAOZ,OAAO;YACdc,OAAO,CAACnC,SAAS,GAAG;YACpB,8DAA8D;YAC9DsB,QAAQD,KAAK,CAAC,CAAC,UAAU,EAAErB,SAAS,iCAAiC,EAAEwB,OAAOE,KAAK,EAAE,EAAEL;YACvF,IAAIV,SAAS2B,QAAQ,CAACtC,WAAWoC,eAAe5B,IAAI,CAACR;QACvD;IACF;IACA,MAAMuC,QAAQ3C;IACd,KAAK,MAAM,EAAEI,QAAQ,EAAEI,MAAM,EAAE,IAAI;WAAIT;KAAc,CAAE;QACrD,IAAIK,cAAauC,yBAAAA,MAAOvC,QAAQ,GAAE;QAClC,MAAMqC,IAAIrC,UAAUI;IACtB;IACA,IAAImC,OAAO,MAAMF,IAAIE,MAAMvC,QAAQ,EAAEuC,MAAMnC,MAAM,CAACoC,KAAK;IACvD,IAAIJ,eAAejB,MAAM,EAAE;QACzB,MAAM,IAAIjB,MACR,CAAC,kCAAkC,EAAEsB,OAAOE,KAAK,CAAC,oCAAoC,CAAC,GACrF,GAAGU,eAAeT,IAAI,CAAC,MAAM,OAAO,CAAC;IAE3C;IACA,OAAO;QAAEM;QAAYE;IAAQ;AAC/B;AAEA,sFAAsF,GACtF,OAAO,SAASM;QACA/C;IAAd,MAAM6C,SAAQ7C,mBAAAA,QAAQE,OAAO,qBAAfF,iBAAiBM,QAAQ;IACvC,OAAO;WACFL,cAAcmB,GAAG,CAAC,CAACP,QAAUA,MAAMP,QAAQ,EAAEgB,MAAM,CAAC,CAAChB,WAAaA,aAAauC;WAC9EA,QAAQ;YAACA;SAAM,GAAG,EAAE;KACzB;AACH;AAEA,oCAAoC,GACpC,OAAO,SAASG;IACd/C,cAAcwB,MAAM,GAAG;IACvBzB,QAAQE,OAAO,GAAG;AACpB;AAEA;;;;;CAKC,GACD,OAAO,SAAS+C;IACd,MAAM/B,aAAa,IAAIC,IAAIlB,cAAcmB,GAAG,CAAC,CAACP,QAAUA,MAAMP,QAAQ;IACtE,IAAIN,QAAQE,OAAO,EAAEgB,WAAWG,GAAG,CAACrB,QAAQE,OAAO,CAACI,QAAQ;IAC5D,KAAK,MAAMA,YAAYZ,+BAAgC;QACrD,IAAI,CAACwB,WAAWK,GAAG,CAACjB,WAAW;YAC7BL,cAAca,IAAI,CAAC;gBAAER;gBAAUI,QAAQ,UAAa,CAAA;wBAAEwC,SAAS;oBAAK,CAAA;YAAG;QACzE;IACF;AACF"}