@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/erase.js

@@ -0,0 +1,1506 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { FieldValue } from "firebase-admin/firestore";
+import { firebaseAdmin } from "./firebase-admin.js";
+import { eraseMediaDeliveryScope } from "./media-delivery.js";
+import { deleteHostProjectionForAllMembers } from "./host-memberships.js";
+import { detachWorkspaceDomain } from "./workspace-domains.js";
+import { CONSOLE_DOMAINS_COLLECTION, releaseConsoleDomain } from "./console-domains.js";
+import { authForPool, findUserByUidAcrossPools } from "./auth-pools.js";
+import { eraseEmailDeliveriesForAddresses } from "./email-delivery-log.js";
+import { resolveAccountAddresses } from "./account-addresses.js";
+import { EMAIL_IDENTITY_INDEX_COLLECTION } from "./account-emails.js";
+import { removeOrgMember } from "./organizations.js";
+import { runPluginUserErasers } from "@aglyn/aglyn/plugin-manager/plugin-user-erasure";
+import { runPluginOrgErasers } from "@aglyn/aglyn/plugin-manager/plugin-org-erasure";
+import { isBillingSubscription } from "@aglyn/aglyn/server";
+import { readOrgBilling } from "./org-billing.js";
+import { disposeHostSendingDomain, readSendingDomainTeardownByLabel } from "./sending-domain-debt.js";
+/** The reversible hold before a requested erasure is executed (AGL-485). */ export const ERASURE_HOLD_MS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * The admin app is initialized without a default storageBucket, so every
+ * bucket access must name it explicitly (same as the media routes). Falls
+ * through to the admin default if the env is somehow unset.
+ */ function storageBucket() {
+    const name = process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET;
+    return firebaseAdmin.app().storage().bucket(name || undefined);
+}
+/**
+ * `supplierDeliveries` — the dropship outbox, keyed by `hostId` as a FIELD.
+ *
+ * The literal rather than an import: the collection belongs to
+ * `libs/plugins/commerce/src/lib/server/supplier-outbox.ts`
+ * (`SUPPLIER_DELIVERY_COLLECTION`), which is tagged `aglyn:addons`, and this
+ * library is `scope:data` — the nx boundary forbids the edge, and reaching
+ * for a dynamic import to dodge it would poison the lint graph instead. The
+ * emulator spec asserts the two spellings still agree by reading that file,
+ * so a rename fails a test rather than silently un-wiring this sweep.
+ */ const SUPPLIER_DELIVERY_COLLECTION = 'supplierDeliveries';
+/**
+ * `outreachMailboxCredentials` — the OAuth grant behind each mailbox a rep
+ * connects to Outreach, keyed by the mailbox id and carrying `orgId` as a
+ * FIELD.
+ *
+ * The literal rather than an import, for `SUPPLIER_DELIVERY_COLLECTION`'s
+ * reason: the collection belongs to `libs/plugins/outreach`
+ * (`OUTREACH_COLLECTIONS.mailboxCredentials` in
+ * `src/lib/model/outreach.types.ts`), and this `scope:data` library may not
+ * import a plugin. The plugin's own spec asserts the two spellings agree, so
+ * a rename fails a test rather than silently un-wiring the sweep.
+ *
+ * A static sweep here, not a hook the plugin registers, because an erasure
+ * cannot rely on the plugin being present. An org that switched Outreach off
+ * still holds the tokens its reps granted, and the process running the
+ * erasure — the cron, the operator script, a replay — may never have loaded
+ * the plugin's bundle at all. A credential's lifetime cannot depend on which
+ * bundles an erasing process happened to load.
+ */ const OUTREACH_MAILBOX_CREDENTIALS_COLLECTION = 'outreachMailboxCredentials';
+/**
+ * Destroy the site's DEAD-LETTERED supplier deliveries (AGL-1448).
+ *
+ * `supplierDeliveries/{id}` is TOP-LEVEL and carries `hostId` as a field, so
+ * neither `recursiveDelete(hosts/{hostId})` here nor
+ * `recursiveDelete(orgs/{orgId})` in `eraseOrg` can see it. That placement is
+ * deliberate and correct — a subcollection would be editor-writable under the
+ * permissive host catch-all, and the row carries the exact JSON body we sign
+ * and POST to the supplier — so the fix is a sweep, not a move.
+ *
+ * **The gap is the dead letter, and the module that created it named it.**
+ * `supplier-outbox.ts` DELETES a row the moment delivery succeeds, and its
+ * docblock says why in terms: the body holds the buyer's email and name, and
+ * a top-level document is outside the recursive delete an erasure runs. The
+ * happy path was solved by that deletion. The failure path was not: after
+ * `SUPPLIER_DELIVERY_MAX_ATTEMPTS` the row is left standing as `failed`,
+ * because a human is supposed to act on it and the merchant has been told.
+ * Nothing ever collects it afterwards — no TTL policy keys on it, no cron
+ * reaps it, and the erasure could not reach it. So the one class of row that
+ * survives is the one holding a THIRD PARTY's name, email and shipping
+ * address, against a site whose owner has since asked to be erased and whom
+ * nobody can ask to act on the dead letter any more.
+ *
+ * Bounded by the `hostId` field, never a collection sweep: this collection
+ * holds every other merchant's orders. Chunked, because a batch caps at 500
+ * and nothing bounds a dead-letter backlog below that.
+ *
+ * In `eraseHost` rather than `eraseOrg` on purpose — it is host-scoped data,
+ * so the self-serve "delete this site" path gets the same cleanup as a full
+ * org erasure instead of leaving the residue behind for the smaller action.
+ *
+ * Best-effort, like every other trailing cleanup in `eraseHost`: a site
+ * delete must not fail because an outbox query did.
+ */ async function eraseHostSupplierDeliveries(hostId) {
+    if (!hostId) return 0;
+    try {
+        const firestore = firebaseAdmin.app().firestore();
+        const rows = await firestore.collection(SUPPLIER_DELIVERY_COLLECTION).where('hostId', '==', hostId).get();
+        for(let index = 0; index < rows.docs.length; index += 400){
+            const batch = firestore.batch();
+            for (const doc of rows.docs.slice(index, index + 400)){
+                batch.delete(doc.ref);
+            }
+            await batch.commit();
+        }
+        return rows.size;
+    } catch (error) {
+        console.error(`eraseHost: supplier outbox cleanup failed for ${hostId}`, error);
+        return 0;
+    }
+}
+export async function eraseHost(hostId, options = {}) {
+    var _hostSnapshot_get;
+    const firestore = firebaseAdmin.app().firestore();
+    const hostRef = firestore.collection('hosts').doc(hostId);
+    const hostSnapshot = await hostRef.get();
+    const orgId = hostSnapshot.get('orgId');
+    /*==========================================
+   * THE SENDING DOMAIN, READ FIRST AND RELEASED LAST.
+   *
+   * Read here because the pinned label lives on the host document and the
+   * `recursiveDelete` at the bottom of this function destroys it. Read
+   * afterwards there would be nothing left to say WHICH provider domain holds
+   * a plan-capped account slot and WHICH records in our zone carry a signing
+   * key for a name a future site can claim.
+   *
+   * Released after everything else, so a teardown that dies partway leaves the
+   * claim standing and the domain findable rather than orphaning two vendors'
+   * resources with nothing pointing at them.
+   *=========================================*/ const sendingLabel = String((_hostSnapshot_get = hostSnapshot.get('sendingLabel')) != null ? _hostSnapshot_get : '').trim();
+    const sendingTeardown = sendingLabel ? await readSendingDomainTeardownByLabel(sendingLabel).catch(()=>null) : null;
+    // Storage first (best-effort — the object tree is derived, regenerable).
+    try {
+        await storageBucket().deleteFiles({
+            prefix: `hosts/${hostId}/`
+        });
+    } catch (error) {
+        console.error(`eraseHost: storage cleanup failed for ${hostId}`, error);
+    }
+    // And the delivery provider's copies of the site's video (AGL-2824), held
+    // under the same library prefix. Nothing runs when no provider is
+    // configured to store; a failure is logged, like the bucket's.
+    await eraseMediaDeliveryScope({
+        collection: 'hosts',
+        scopeId: hostId
+    });
+    // Dead-lettered supplier deliveries (AGL-1448). See the note on
+    // SUPPLIER_DELIVERY_COLLECTION below for why this is here and not implied
+    // by the recursiveDelete at the end of this function.
+    await eraseHostSupplierDeliveries(hostId);
+    // Routing: the middleware resolves a request to a host via hostIndex and
+    // the owning org's hosts map — drop both so the subdomain/cname 404s.
+    await firestore.collection('hostIndex').doc(hostId).delete().catch(()=>undefined);
+    if (orgId) {
+        // The routing entry and the site's POOLED SEATS go in the SAME write —
+        // POS registers (AGL-1775) and collaborators (AGL-2439), which are the
+        // same mechanism on two keys and must be released together or a deleted
+        // site strands one pool while returning the other.
+        //
+        // `registerAllocations[hostId]` is capacity the org has
+        // paid for and assigned here; a deleted site must return it to the pool
+        // or the org keeps paying $89/mo for a seat pinned to a site that no
+        // longer exists and cannot be reassigned from any surface. Releasing it
+        // by deleting the key rather than by decrementing a counter means the
+        // pool is `purchased - sum(allocations)` by arithmetic and has nothing to
+        // drift out of step with.
+        await firestore.collection('orgs').doc(orgId).set({
+            hosts: {
+                [hostId]: FieldValue.delete()
+            },
+            registerAllocations: {
+                [hostId]: FieldValue.delete()
+            },
+            collaboratorAllocations: {
+                [hostId]: FieldValue.delete()
+            }
+        }, {
+            merge: true
+        }).catch(()=>undefined);
+        // Drop every member's reverse-index row for this host (AGL-844); the
+        // members still exist here (recursiveDelete of the org, if any, is later).
+        await deleteHostProjectionForAllMembers(orgId, hostId).catch(()=>undefined);
+    }
+    // The host document tree (screens/layouts/versions/counters/products/…).
+    await firestore.recursiveDelete(hostRef);
+    // Never throws, and never leaves the slot unaccounted for: whatever the
+    // vendors refuse is recorded on the label claim for the reaper to finish.
+    return {
+        sendingDomain: await disposeHostSendingDomain({
+            teardown: sendingTeardown ? _extends({}, sendingTeardown, {
+                hostId
+            }) : null,
+            tearDown: options == null ? void 0 : options.tearDownSendingDomain
+        })
+    };
+}
+/**
+ * Delete a single resource document *and everything under it* (AGL-945).
+ *
+ * Firestore does not cascade: deleting `orgs/{o}/datasets/{d}` leaves every
+ * `records/{r}` beneath it alive but unreachable from the console — still
+ * billed, still matched by the rules (which match subcollection paths
+ * independently of the parent), and resurrected wholesale if the parent id
+ * is ever reused. Only the Admin SDK has `recursiveDelete`, so the console
+ * cards route their deletes through /api/resources/erase, which lands here.
+ *
+ * Authorization belongs to the caller — this only walks the tree.
+ */ export async function eraseSubtree(path) {
+    const firestore = firebaseAdmin.app().firestore();
+    const [scope, scopeId, kind, id] = path;
+    await firestore.recursiveDelete(firestore.collection(scope).doc(scopeId).collection(kind).doc(id));
+}
+/** Best-effort Stripe customer deletion — PII lives at the processor too. */ async function deleteStripeCustomer(customerId) {
+    const key = process.env.STRIPE_SECRET_KEY;
+    if (!key || !customerId) return;
+    try {
+        await fetch(`https://api.stripe.com/v1/customers/${customerId}`, {
+            method: 'DELETE',
+            headers: {
+                Authorization: `Bearer ${key}`
+            }
+        });
+    } catch (error) {
+        console.error(`eraseOrg: Stripe customer ${customerId} delete failed`, error);
+    }
+}
+/**
+ * Delete every API credential the org owns (AGL-1444).
+ *
+ * `apiKeys` is a TOP-LEVEL collection keyed by the SHA-256 of the token and
+ * carrying `orgId` as a FIELD, so `recursiveDelete(orgRef)` cannot see it —
+ * a path-scoped cascade is structurally blind to anything not under the path.
+ * The credential therefore outlived the workspace: `verifyApiKey` kept
+ * resolving the token to a live principal naming an org that no longer
+ * existed. `authenticateApiV1` happens to refuse it (it reads the org doc and
+ * 401s), but that is a gate one layer above the credential, and a key whose
+ * revocation depends on every future caller repeating a lookup is not
+ * revoked. The document is also a small record of the erased workspace in its
+ * own right — a human-authored label, the creating uid, the granted scopes.
+ *
+ * Bounded by the `orgId` field, never a collection sweep: this collection
+ * holds every other customer's integration credentials too.
+ *
+ * Returns the number destroyed, for the audit row — an erasure trail that
+ * understates what it removed is the one record that has to be right.
+ */ async function eraseOrgApiKeys(orgId, dryRun = false) {
+    return deleteDocsByOrgId('apiKeys', orgId, dryRun);
+}
+/**
+ * Delete every Outreach mailbox credential the org holds (AGL-2974).
+ *
+ * `outreachMailboxCredentials` is a TOP-LEVEL collection keyed by the mailbox
+ * id and carrying `orgId` as a FIELD, so `recursiveDelete(orgRef)` cannot see
+ * it — the blindness `eraseOrgApiKeys` answers, on a more dangerous document.
+ * Left standing, the OAuth grant a rep gave for their own mailbox would
+ * outlive the workspace it was given to: tokens that can still send as that
+ * person, held for an organization that no longer exists and that nobody can
+ * ask to disconnect them.
+ *
+ * This destroys the platform's copy of the grant; it does not call the
+ * provider's revocation endpoint, which needs the plugin's provider adapter.
+ * With the tokens gone the grant has nothing left to act through.
+ *
+ * Bounded by the `orgId` field, never a collection sweep: this collection
+ * holds every other workspace's connected mailboxes too.
+ *
+ * Returns the number destroyed, for the audit row — an erasure trail that
+ * understates what it removed is the one record that has to be right.
+ */ async function eraseOrgOutreachMailboxCredentials(orgId, dryRun = false) {
+    return deleteDocsByOrgId(OUTREACH_MAILBOX_CREDENTIALS_COLLECTION, orgId, dryRun);
+}
+/**
+ * Delete every document in a TOP-LEVEL collection that names this org in its
+ * `orgId` FIELD (AGL-1444/AGL-1448).
+ *
+ * The shared mechanism behind every collection a path-scoped cascade cannot
+ * see. Two properties are the whole point, and neither is optional:
+ *
+ *   - **Bounded by the field, never a collection sweep.** Every one of these
+ *     collections holds other customers' credentials, routing and billing
+ *     correlations. A `collection(name).get()` here would erase the estate.
+ *   - **Chunked**, because a batch caps at 500 writes and nothing bounds an
+ *     org's row count below that.
+ *
+ * Returns the number destroyed, for the audit row — an erasure trail that
+ * understates what it removed is the one record that has to be right.
+ *
+ * `dryRun` runs the query and skips the commit (AGL-1481), so a plan counts
+ * rows through the SAME function that deletes them. A separate counting pass
+ * would be a second enumeration of the sweep list, which is precisely the
+ * divergence AGL-1481 exists to remove.
+ *
+ * **`platformRevenue` must NEVER be added to this sweep (AGL-1811).** It is
+ * org-keyed by field — exactly the shape this mechanism eats — and that is
+ * the trap: those rows are per-transaction TAX FILING RECORDS (gross, tax,
+ * jurisdiction) with a statutory retention obligation, and the quarterly
+ * Texas return is their sum. GDPR Art. 17(3)(b) exempts them: erasure does
+ * not extend to records retained for compliance with a legal obligation. An
+ * erased org's rows deliberately outlive it — the
+ * `erase-org-tax-retention.emulator.spec` pins survival, so an over-eager
+ * future sweep fails a test instead of un-filing a tax period.
+ *
+ * **`storefrontTaxCollected` must NEVER be added either (AGL-1904).** Same
+ * shape, same trap, same reason: it carries `orgId` as a field, and its rows
+ * are the record of sales tax charged to shoppers on that org's storefront —
+ * including the tax a `mode: 'stripe'` store collects under AGLYN's own
+ * Texas registration, which Aglyn must be able to account for long after the
+ * merchant has gone.
+ */ async function deleteDocsByOrgId(collection, orgId, dryRun = false) {
+    if (!orgId) return 0;
+    const firestore = firebaseAdmin.app().firestore();
+    const rows = await firestore.collection(collection).where('orgId', '==', orgId).get();
+    if (dryRun) return rows.size;
+    for(let index = 0; index < rows.docs.length; index += 400){
+        const batch = firestore.batch();
+        for (const doc of rows.docs.slice(index, index + 400))batch.delete(doc.ref);
+        await batch.commit();
+    }
+    return rows.size;
+}
+/**
+ * Drop the org's public SSO routing documents (AGL-1448).
+ *
+ * `ssoDomains/{domain}` is keyed by the DOMAIN and carries `orgId` as a field,
+ * so `recursiveDelete(orgRef)` never reaches it. The org's own claims under
+ * `orgs/{orgId}/ssoDomains/{domain}` do die with the tree; the public routing
+ * doc — the one that decides where a sign-in goes — does not.
+ *
+ * **`unpublishSsoDomains` is not the fix, though it looks like it.** That
+ * function is the reversible half of the console's SSO toggle: it sets
+ * `active: false` and leaves the document standing precisely so re-enabling
+ * restores the same pool and the same uids. Applied to an erasure it would
+ * leave behind a record naming the deleted org, its GCIP tenant and provider
+ * ids, its IdP display name and the customer's email domain — and, worse, a
+ * live reservation: `issueDomainClaim` refuses a domain whose `ssoDomains` doc
+ * belongs to another org REGARDLESS of `active`, so a ghost would hold a real
+ * customer's domain against them with no way to appeal. Absence is the only
+ * state that both stops the routing and releases the name.
+ *
+ * Deleting is safe on the read side: `/api/auth/sso-lookup` already treats a
+ * missing doc and an inactive one identically (`{ ssoEnabled: false }`).
+ */ async function eraseOrgSsoDomains(orgId, dryRun = false) {
+    return deleteDocsByOrgId('ssoDomains', orgId, dryRun);
+}
+/**
+ * Release every custom console domain the org holds (AGL-1448).
+ *
+ * `releaseConsoleDomain` already does exactly the right thing and was called
+ * from nothing but its own spec. It is wired rather than reimplemented, and
+ * the ordering it enforces is the reason: Vercel detach FIRST, documents
+ * second, and the claim KEPT if a detach fails. `resolveConsoleDomain`'s
+ * `unknown` verdict — the one that lets localhost, previews and self-hosted
+ * installs work — is only safe while every name the console project still
+ * answers for has a document (AGL-1430). Deleting the claim here directly
+ * would break that correspondence and hand the name to the next org that
+ * claims it, with Vercel's `already-exists` reading as health.
+ *
+ * It takes one domain, so the org-bounded query is the part that was missing.
+ * Every name in a claim set — the primary and its `www` twin — carries the
+ * same `orgId` and the same `primaryHost`, so releasing once per distinct
+ * primary covers the set exactly, without a second pass over the twins.
+ *
+ * Best-effort, like every other external cleanup here: an erasure must not
+ * fail because Vercel did. A name that could not be detached keeps its claim
+ * and is reported in the audit row as un-released.
+ */ async function releaseOrgConsoleDomains(orgId, dryRun = false) {
+    const firestore = firebaseAdmin.app().firestore();
+    const claims = await firestore.collection(CONSOLE_DOMAINS_COLLECTION).where('orgId', '==', orgId).get();
+    const primaries = new Set(claims.docs.map((doc)=>doc.get('primaryHost') || doc.id));
+    // A plan counts the claim sets it WOULD release. `releaseConsoleDomain`
+    // detaches at Vercel, so it must not run for a dry run (AGL-1481).
+    if (dryRun) return primaries.size;
+    let released = 0;
+    for (const domain of primaries){
+        const result = await releaseConsoleDomain({
+            orgId,
+            domain
+        }).catch((error)=>{
+            console.error(`eraseOrg: console domain ${domain} release failed`, error);
+            return {
+                released: false
+            };
+        });
+        if (result.released) released += 1;
+    }
+    return released;
+}
+/**
+ * Drop the local Stripe reverse index (AGL-1448, AGL-1028).
+ *
+ * `stripeCustomers/{stripeCustomerId} -> { orgId }` exists because AGL-1028
+ * moved `stripeCustomerId` off the org doc into a manager-gated subcollection,
+ * which broke the webhook's `where('stripeCustomerId', '==', …)` lookup. It is
+ * denied to every client for one reason, stated in the rules: readable, it
+ * maps a billing identity back to a workspace.
+ *
+ * The erasure had this exactly inverted. It deleted the customer AT STRIPE and
+ * kept the local index — so the artefact that survived was the correlation the
+ * whole issue existed to prevent, now pointing at an org that no longer exists
+ * to be gated on. This deletes the local rows. The Stripe-side delete is
+ * unchanged and still runs: PII lives at the processor too, and one is not a
+ * substitute for the other.
+ *
+ * Bounded by the `orgId` field rather than by the org's CURRENT customer id,
+ * because nothing cleans up the index when a customer id changes — an org that
+ * was re-created in Stripe has more than one row pointing at it.
+ */ async function eraseOrgStripeIndex(orgId, dryRun = false) {
+    return deleteDocsByOrgId('stripeCustomers', orgId, dryRun);
+}
+/**
+ * Drop the org's REST API replay keys (AGL-1448).
+ *
+ * `apiIdempotency/{sha256(orgId:key)}` dedupes `POST`s by `Idempotency-Key`
+ * (AGL-618). Low severity — a replay key names an org and a record id and
+ * authorises nothing — but it does NOT age out on its own, which is the part
+ * worth writing down because the assumption runs the other way: the only TTL
+ * policy on the database is `rateLimits.expiresAt`
+ * (`docs/FIRESTORE_MANUAL_CONFIG.md`), and these documents carry no expiry
+ * field for a policy to key on. Left alone they accumulate against a dead org
+ * indefinitely.
+ *
+ * Taken with the credentials rather than at the end: the record ids they carry
+ * point into the org tree that step 4 destroys.
+ */ async function eraseOrgIdempotencyKeys(orgId, dryRun = false) {
+    return deleteDocsByOrgId('apiIdempotency', orgId, dryRun);
+}
+/**
+ * Release every slug the org has EVER held (AGL-1448).
+ *
+ * The erasure deleted `orgSlugs/{org.slug}` — the current name only. But
+ * `changeOrgSlug` leaves a tombstone at the previous slug (`{ orgId, movedTo,
+ * renamedAt }`) so old workspace URLs keep redirecting (AGL-585/AGL-236), and
+ * nothing ever collected them. Every historical name an org held therefore
+ * survived its erasure, in the one collection the rules make
+ * `allow read: if true` — public because it doubles as the pre-auth health
+ * probe. An erased workspace's naming history stayed world-readable, each
+ * tombstone still naming the dead org id.
+ *
+ * Bounded by the `orgId` field, which is exactly the right boundary here and
+ * not merely the safe one: claiming a tombstoned slug FULL-REPLACES the
+ * document with the new owner's `{ orgId }`, so a name this org renamed away
+ * from and somebody else has since taken does not match — and must not be
+ * swept, because it is now a live tenant's reservation.
+ *
+ * The current slug is unioned in rather than assumed present: an org whose
+ * reservation was lost to a legacy write would otherwise keep its workspace
+ * subdomain attached to the project. ⛔ ONLY WHEN NOBODY HOLDS IT (AGL-2585).
+ * A workspace address taken by an unverified signup is a reservation that
+ * lapses, and a live workspace may since have claimed the name — at which
+ * point `orgSlugs/{slug}` names THAT org, and the erasure of this one would
+ * otherwise delete a working tenant's reservation and detach their subdomain.
+ * The `orgId` query above already refuses that document; this is the one line
+ * that used to add it back by assumption.
+ *
+ * Each name's `{slug}.aglyn.com` is detached too. `changeOrgSlug` deliberately
+ * KEEPS the old subdomain attached so the tombstone's 308 has a hostname to
+ * run on; once the tombstone goes, the attachment is a name resolving to a
+ * console for an org that does not exist. Best-effort, like every other
+ * external cleanup here: an erasure must not fail because a DNS API did.
+ */ async function eraseOrgSlugs(orgId, currentSlug, dryRun = false) {
+    const firestore = firebaseAdmin.app().firestore();
+    const held = await firestore.collection('orgSlugs').where('orgId', '==', orgId).get();
+    const slugs = new Set(held.docs.map((doc)=>doc.id));
+    if (currentSlug && !slugs.has(currentSlug)) {
+        // Absent means the reservation was lost and only the DNS attachment is
+        // left to clean up. Present but not matched by the query above means it
+        // belongs to another org now, and is not this erasure's to touch.
+        const reservation = await firestore.collection('orgSlugs').doc(currentSlug).get().catch(()=>null);
+        if (reservation && !reservation.exists) slugs.add(currentSlug);
+    }
+    // `detachWorkspaceDomain` calls a live DNS API — never on a plan (AGL-1481).
+    if (dryRun) return slugs.size;
+    for (const slug of slugs){
+        await firestore.collection('orgSlugs').doc(slug).delete().catch(()=>undefined);
+        await detachWorkspaceDomain(slug).catch(()=>undefined);
+    }
+    return slugs.size;
+}
+/**
+ * Sweep up ORPHANED `hostIndex` rows the per-host loop cannot enumerate
+ * (AGL-1448).
+ *
+ * `hostIndex/{hostId}` is `{ orgId, subdomain }` and `allow read: if
+ * isSignedIn()`. It is deleted today inside `eraseHost`, which `eraseOrg`
+ * calls once per document in `hosts where orgId == org` — so the row is
+ * reached DERIVATIVELY, through a second collection, and only for as long as
+ * the two agree.
+ *
+ * **The erasure is itself one of the ways they stop agreeing.** `eraseHost`'s
+ * `hostIndex` delete is `.catch(() => undefined)` — fail-soft on purpose, so
+ * a transient failure never blocks the Firestore delete — and the very next
+ * statement `recursiveDelete`s `hosts/{hostId}`. The instant that lands, the
+ * orphaned index row is unreachable from the org side forever: nothing points
+ * at it, so neither this run nor any retry can ever enumerate it again. A
+ * fail-soft that manufactures a PERMANENT orphan is not fail-soft, and the
+ * residue is a signed-in-readable row naming a dead org and the subdomain its
+ * customer chose.
+ *
+ * Bounded by the `orgId` field — this is the table the middleware resolves
+ * every request on, so an unbounded sweep here does not lose an index, it
+ * takes the estate offline.
+ *
+ * A BACKSTOP, not a replacement: the per-host loop still does the real work
+ * (Storage, the org routing map, the member projections, the host tree). This
+ * only collects what that loop structurally cannot see.
+ */ async function eraseOrgHostIndex(orgId, dryRun = false) {
+    return deleteDocsByOrgId('hostIndex', orgId, dryRun);
+}
+/**
+ * Sweep up `hostMemberships` projections belonging to FORMER members
+ * (AGL-1448).
+ *
+ * `users/{uid}/hostMemberships/{hostId}` carries `{ orgId, subdomain,
+ * displayName, nameLower, role }` — the site switcher's row. It lives under a
+ * USER, so `recursiveDelete(orgs/{orgId})` cannot reach it, and `eraseOrg`'s
+ * members loop only walks `orgs/{orgId}/members`.
+ *
+ * `deleteHostProjectionForAllMembers(orgId, hostId)` clears the row for
+ * everyone in that member list at the moment the erasure runs. **A former
+ * member is not in it.** Their row is written by the projection fan-out and
+ * removed by `removeOrgMember`, which is fail-soft in the same way as
+ * everything else on that path; one missed fan-out leaves a row no later
+ * erasure can find, because the enumeration starts from a membership that no
+ * longer exists. The erased workspace's site NAME and subdomain then live on
+ * in the user document of somebody who left the company.
+ *
+ * ## This is a COLLECTION-GROUP query, and that owes an index
+ *
+ * `hostMemberships` has two composite indexes, both `queryScope: COLLECTION`.
+ * A collection-group equality on `orgId` needs a `COLLECTION_GROUP`
+ * single-field index, which Firestore does NOT create automatically — the
+ * automatic single-field indexes are collection-scoped except for
+ * array-contains. `cloud/firebase-firestore.indexes.json` therefore gains a
+ * `fieldOverrides` entry alongside the existing `members.uid` and
+ * `messages.authorId` ones, and **it must be deployed by hand.**
+ *
+ * Until it is, the query throws `FAILED_PRECONDITION`. AGL-1793 is this
+ * codebase's record of exactly that failure mode — both commerce crons
+ * silently dead in production for want of a `COLLECTION_GROUP_ASC` override —
+ * so this refuses to be the thing that kills an erasure. It is caught and
+ * reported as `null`, which is deliberately NOT `0`: a zero would say "there
+ * was nothing to sweep" and a missing index would wear that as a clean bill
+ * of health. `null` in the audit row says "attempted, could not run", and the
+ * spec asserts a NUMBER so the wired-and-indexed path is what is pinned.
+ */ async function eraseOrgHostMemberships(orgId, dryRun = false) {
+    if (!orgId) return 0;
+    try {
+        const firestore = firebaseAdmin.app().firestore();
+        const rows = await firestore.collectionGroup('hostMemberships').where('orgId', '==', orgId).get();
+        if (dryRun) return rows.size;
+        for(let index = 0; index < rows.docs.length; index += 400){
+            const batch = firestore.batch();
+            for (const doc of rows.docs.slice(index, index + 400)){
+                batch.delete(doc.ref);
+            }
+            await batch.commit();
+        }
+        return rows.size;
+    } catch (error) {
+        console.error(`eraseOrg: hostMemberships projection sweep failed for ${orgId} — a missing COLLECTION_GROUP index on hostMemberships.orgId is the likeliest cause`, error);
+        return null;
+    }
+}
+/**
+ * Drop the org's PUBLIC marketplace identity — the profile and every handle
+ * it reserved (AGL-1970).
+ *
+ * Both survived every erasure until now, and both are `allow read: if true`
+ * (`cloud/firebase-firestore.rules`, `match /publisherProfiles/{orgId}`). This
+ * is the AGL-1448 shape with one twist that is the whole reason it was missed:
+ * `publisherProfiles` is keyed by the org id **as the document id**, so it is
+ * invisible to `deleteDocsByOrgId` *and* to a reader scanning this file for
+ * the field-keyed sweep list. Nothing prompts you to notice it.
+ *
+ * What survived is not cosmetic. `stripeAccountId` is a **payout
+ * destination** — written server-side only after Connect onboarding/KYC and
+ * trusted by every checkout path — so an erased org stayed world-readable with
+ * a live payment-account identifier attached to a dead identity. That is the
+ * `stripeCustomers` correlation AGL-1448 removed, pointing the other way.
+ *
+ * `publisherHandles` is the easy half and goes unconditionally: it carries
+ * `orgId` as a FIELD, so `deleteDocsByOrgId` fits exactly, and it is a **live
+ * reservation** — `claimPublisherHandle` refuses a handle another org's row
+ * names, so a ghost holds a marketplace name against a real customer with no
+ * way to appeal. That is the `ssoDomains` argument verbatim, and absence is
+ * again the only state that both stops the read and releases the name. Rename
+ * tombstones (`{ orgId, movedTo }`) carry the same `orgId` and go with it, and
+ * the field bound is what makes that safe: re-claiming a tombstone FULL-
+ * REPLACES it with the new owner's `{ orgId }`, so a handle this org renamed
+ * away from and somebody else has since taken does not match the query.
+ *
+ * **The profile is the half with a genuine tension, and it is resolved here
+ * rather than deferred.** `marketplaceListings` outlives an erasure — that is
+ * AGL-1448's parked Tier 3 product decision, an erased org's listing being
+ * something buyers paid for — so deleting the publisher document outright can
+ * leave a listing attributed to nothing. So:
+ *
+ *   - **No surviving listing** → `recursiveDelete` the profile. `deleted`.
+ *     `recursiveDelete` and not `delete`: `publish-plugin` keeps its daily
+ *     publish-rate window at `publisherProfiles/{orgId}/meta/publishWindow`,
+ *     and a document delete would orphan it under a path with no owner.
+ *   - **A listing survives** → the same `recursiveDelete`, then a minimal
+ *     `{ erased: true, erasedAt }` in its place. `tombstoned`. The tombstone
+ *     carries no `handle`, no `displayName`, no `bio`/`avatarUrl`/`website`,
+ *     no `publisherAgreement` and — the point — no `stripeAccountId`. It is
+ *     "an internal record that the erasure happened", which is exactly what
+ *     the Privacy Policy §5 sentence reserves; every byte the sentence calls
+ *     content is gone either way. Readers already handle it: with no `handle`,
+ *     `resolvePublisherProfile` returns `null`, which is the pre-existing
+ *     "this org has no profile" path.
+ *
+ * The count of surviving listings is returned either way, so an erasure that
+ * left something standing SAYS SO in its audit row instead of reporting a
+ * clean success — the Tier 3 decision is still open, and an erasure is the
+ * one place its cost is measurable.
+ */ async function eraseOrgPublisherIdentity(orgId, dryRun = false) {
+    const firestore = firebaseAdmin.app().firestore();
+    const handles = await deleteDocsByOrgId('publisherHandles', orgId, dryRun);
+    const profileRef = firestore.collection('publisherProfiles').doc(orgId);
+    const [profileSnapshot, listings] = await Promise.all([
+        profileRef.get(),
+        // `profileId` is the listing's publishing-org id (AGL-652) — the same
+        // value as this profile's document id, under the older field name.
+        firestore.collection('marketplaceListings').where('profileId', '==', orgId).get()
+    ]);
+    const listingsRetained = listings.size;
+    if (!profileSnapshot.exists) {
+        return {
+            handles,
+            profile: 'absent',
+            listingsRetained
+        };
+    }
+    if (dryRun) {
+        return {
+            handles,
+            profile: listingsRetained ? 'tombstoned' : 'deleted',
+            listingsRetained
+        };
+    }
+    await firestore.recursiveDelete(profileRef);
+    if (!listingsRetained) return {
+        handles,
+        profile: 'deleted',
+        listingsRetained
+    };
+    await profileRef.set({
+        erased: true,
+        erasedAt: FieldValue.serverTimestamp()
+    });
+    return {
+        handles,
+        profile: 'tombstoned',
+        listingsRetained
+    };
+}
+/**
+ * Destroy every support ticket the org opened, and the messages under each
+ * (AGL-1971).
+ *
+ * `supportTickets/{id}` is top-level with `orgId` as a field — the exact shape
+ * `deleteDocsByOrgId` exists for — and it was in neither sweep list. It is
+ * also the highest-PII-density collection outside the org tree: `messages`
+ * rows carry `authorId`, `authorEmail` and up to 5000 characters of prose a
+ * customer wrote to us, which is where somebody pastes the invoice, the member
+ * list, or the very data they are asking us to delete.
+ *
+ * **`deleteDocsByOrgId` is deliberately NOT used here**, though the query is
+ * identical. It deletes documents, not subtrees, and a batch delete of the
+ * ticket documents would leave every `messages` row alive under a parent that
+ * no longer exists — the prose and the email surviving the delete that was
+ * supposed to remove them, now unreachable by any query that starts from
+ * `orgId`. `recursiveDelete` per ticket is the only correct shape.
+ *
+ * **No retention exception, and the alternative was considered.** A closed
+ * support thread is arguable dispute evidence, which is the class of argument
+ * that keeps `platformRevenue` alive (AGL-1811). It does not reach here: that
+ * exemption is GDPR Art. 17(3)(b), *records retained to comply with a legal
+ * obligation*, and no law requires us to keep a support thread — a Texas tax
+ * return is filed from `platformRevenue`; nothing is filed from a ticket.
+ * Live DPA §11 commits the other way in terms ("delete or return Customer
+ * Personal Data, except to the extent retention is required by law"). What
+ * remains as evidence is the `adminAudit` row: the erasure happened, when, at
+ * whose instruction, and how many tickets it destroyed — ids and counts,
+ * never content (AGL-1443).
+ *
+ * Sequential rather than parallel: `recursiveDelete` is itself a bulk writer,
+ * and fanning N of them out at once is how a 60-second cron loses an erasure.
+ */ async function eraseOrgSupportTickets(orgId, dryRun = false) {
+    if (!orgId) return 0;
+    const firestore = firebaseAdmin.app().firestore();
+    const tickets = await firestore.collection('supportTickets').where('orgId', '==', orgId).get();
+    if (dryRun) return tickets.size;
+    for (const ticket of tickets.docs){
+        await firestore.recursiveDelete(ticket.ref);
+    }
+    return tickets.size;
+}
+/**
+ * A stable label for an error, carrying no free text (AGL-1455).
+ *
+ * The class name and the SDK's error code are enough to tell a Firestore
+ * permission denial from a deadline exceeded from an out-of-memory kill. The
+ * MESSAGE is deliberately not stored: a Firestore or Storage error quotes the
+ * path — and sometimes the payload — it choked on, and this row lands in a
+ * collection that must not become a second copy of what the erasure failed to
+ * delete (AGL-1443). The full error still goes to `console.error`, which is
+ * the log, not the record.
+ */ function errorLabel(error) {
+    const source = error != null ? error : {};
+    const parts = [
+        source.name,
+        source.code
+    ].filter((part)=>typeof part === 'string' || typeof part === 'number');
+    return parts.length ? parts.join(':') : 'unknown';
+}
+/**
+ * Record a failed erasure attempt where somebody will actually find it
+ * (AGL-1455).
+ *
+ * Aborting when the export cannot be written is correct and stays — the bug
+ * was that the abort was invisible. `skippedReason` reached exactly one
+ * place, the cron endpoint's HTTP response body, and nobody reads a
+ * scheduler's 200. Meanwhile `erasureRequestedAt` stays set, so the same org
+ * is retried on the next run and fails the same way indefinitely, and the
+ * customer who requested the erasure is told nothing.
+ *
+ * An `adminAudit` row is the cheapest durable form and the one the success
+ * path already uses, so the two read as a pair: same `actorUid`, same
+ * `target`, same `before` inventory, and `after` carrying what actually
+ * happened. Staff can find every stuck erasure by filtering the audit log on
+ * the action, which is exactly the search that was impossible before.
+ *
+ * `after.exportWritten`/`after.exportPath` used to be the fields that
+ * mattered here: they named the complete dump of a still-existing workspace
+ * that a post-export failure left in the bucket. AGL-1443 removed the write,
+ * so that state is no longer reachable and the fields no longer exist. What
+ * replaces them is `after.requestedAt` — WHICH erasure request is stuck,
+ * which the object's name used to be the only record of.
+ *
+ * Ids, counts, a step name and a timestamp. Never customer data.
+ *
+ * Best-effort and never throws: this runs while an erasure is already
+ * failing, and losing the original error to a bookkeeping write would be
+ * worse than losing the row.
+ */ async function recordErasureFailure(entry) {
+    await firebaseAdmin.app().firestore().collection('adminAudit').add({
+        actorUid: entry.actorUid,
+        action: 'org.erase-failed',
+        target: `orgs/${entry.orgId}`,
+        before: entry.before,
+        after: _extends({
+            failedStep: entry.step,
+            error: errorLabel(entry.error),
+            requestedAt: entry.requestedAt
+        }, entry.after),
+        at: FieldValue.serverTimestamp()
+    }).catch((auditError)=>{
+        console.error(`eraseOrg: could not record the failed attempt for ${entry.orgId}`, auditError);
+    });
+}
+/**
+ * Permanently erase an organization once its 7-day hold has elapsed
+ * (AGL-485/487). Runs from the automated cron and the manual staff path.
+ *
+ * **Both of those are literally this function (AGL-1481).** The manual path,
+ * `tools/scripts/erase-tenant.mjs`, used to be a second implementation, and a
+ * second implementation of a cascade delete is a divergence with a schedule:
+ * within a week of `eraseOrgApiKeys`, the SSO/console-domain release and the
+ * org-keyed index sweeps landing here, the script was missing all four and
+ * reporting success without them — leaving a live API credential, live domain
+ * reservations, `orgSlugs` tombstones and the `stripeCustomers` reverse index
+ * behind an erasure a human had been told was complete. The script now calls
+ * this, and `EraseOrgOptions` is where the two capabilities it had and this
+ * did not (a plan, and a named actor) live instead.
+ *
+ * Order matters and every step is defensive:
+ *   1. Re-read the org and re-verify erasureRequestedAt + hold — never
+ *      delete on a stale/cancelled request.
+ *   2. Nothing is written. This step used to persist a final JSON export of
+ *      the org and host trees to `erasures/{orgId}/…` and abort if it could
+ *      not — see the note below for why it is gone (AGL-1443).
+ *   3. Revoke the org's API credentials (AGL-1444), its public routing — SSO
+ *      domains and custom console domains (AGL-1448) — and its public
+ *      marketplace identity: the publisher profile and every handle it
+ *      reserved (AGL-1970); and destroy the OAuth grants behind its reps'
+ *      Outreach mailboxes (AGL-2974). All of them are top-level collections
+ *      keyed by something other than a path under the org, so the org-tree
+ *      delete cannot reach them; doing them before the content delete also
+ *      closes the mid-erasure window, in which a credential, a domain or a
+ *      public publisher page still resolves to a half-deleted workspace.
+ *   4. Delete each host (eraseHost), org-level Storage, the Stripe customer
+ *      AND its local reverse index, member back-references, then the org tree
+ *      and every slug the org ever held — tombstones included (AGL-1448).
+ *   5. Audit.
+ *
+ * Every ending is audited, not just the successful one (AGL-1455). A throw
+ * from any step writes an `org.erase-failed` row before re-throwing, because
+ * `erasureRequestedAt` stays set on a failure: without a record the org is
+ * retried and fails identically on every subsequent run, forever, and nothing
+ * anywhere says so.
+ *
+ * **The erasure writes no copy of the workspace (AGL-1443).** It used to
+ * persist `erasures/{orgId}/{requestedMs}.json` — and "export" understated
+ * it: `exportDocTree` recursed `listCollections()` with no bound and copied
+ * `snapshot.data()` wholesale, so the object was a complete verbatim copy of
+ * the org tree and every host tree, carrying `webhooks.secret` (a plaintext
+ * HMAC key), `orders.paymentLinkUrl` (a live bearer URL that lets its holder
+ * pay), `screens.protection.passwordHash` and `ssoDomains.token`. It landed
+ * on a prefix this function's own storage sweep does not cover, in a bucket
+ * with no lifecycle rule, so the most sensitive object the platform can
+ * produce outlived the request that deleted everything else — indefinitely,
+ * unread, and belonging to a customer who had been told their workspace was
+ * gone. Four facts decided it, and none of them is about tidiness:
+ *
+ *   - **Nothing read it.** One producer, zero consumers in the repo; the
+ *     owner's confirmation email never mentioned it.
+ *   - **A governed full copy already exists.** Firestore backups run weekly
+ *     with 14-week retention (AGL-871), so the dump added no recoverability —
+ *     only a second, ungoverned place the data lived.
+ *   - **The minimum that proves an erasure was already being written.** The
+ *     `adminAudit` row below is ids and counts, in a collection with a
+ *     retention policy. The one thing the object's NAME carried that the row
+ *     did not — which request this run fulfilled — is now `after.requestedAt`.
+ *   - **The DPA commits to "a limited period, after which deleted or
+ *     de-identified"**, which indefinite retention of a full dump sits
+ *     outside of.
+ *
+ * Two consequences are deliberate, not side effects. The export-write abort
+ * is gone with the write: there is nothing left to fail before the first
+ * delete, so an erasure can no longer be blocked by Storage. And the export
+ * was the only unbounded work in this function — it built the whole workspace
+ * in memory inside a 60-second cron, so the larger the workspace the likelier
+ * its erasure silently never happened (AGL-1455 half 1). That defect is
+ * removed by deletion rather than by a streaming exporter.
+ */ export async function eraseOrg(orgId, options = {}) {
+    var _ref;
+    var _orgSnapshot_get_toMillis, _orgSnapshot_get;
+    const { dryRun = false, actorUid = 'cron:run-erasures', tearDownSendingDomain = null, withoutRequest = null } = options;
+    const firestore = firebaseAdmin.app().firestore();
+    const orgRef = firestore.collection('orgs').doc(orgId);
+    const orgSnapshot = await orgRef.get();
+    if (!orgSnapshot.exists) return {
+        ok: false,
+        skippedReason: 'not-found'
+    };
+    const requestedMs = (_ref = (_orgSnapshot_get = orgSnapshot.get('erasureRequestedAt')) == null ? void 0 : (_orgSnapshot_get_toMillis = _orgSnapshot_get.toMillis) == null ? void 0 : _orgSnapshot_get_toMillis.call(_orgSnapshot_get)) != null ? _ref : null;
+    // The request and its hold, unless the caller carries its own proof
+    // (AGL-2585). Both refusals are skipped together: a workspace with no
+    // request has no stamp for a hold to run from, so keeping the second while
+    // dropping the first would be a hold measured against `null`.
+    if (!withoutRequest) {
+        if (!requestedMs) return {
+            ok: false,
+            skippedReason: 'no-request'
+        };
+        if (Date.now() - requestedMs < ERASURE_HOLD_MS) {
+            return {
+                ok: false,
+                skippedReason: 'hold-active'
+            };
+        }
+    }
+    const hosts = await firestore.collection('hosts').where('orgId', '==', orgId).get();
+    const members = await orgRef.collection('members').get();
+    const slug = orgSnapshot.get('slug');
+    // AGL-1028: moved to `orgs/{orgId}/billing/stripe`; the helper falls back
+    // to the org doc for orgs the backfill has not reached.
+    const stripeCustomerId = (await readOrgBilling(orgId)).stripeCustomerId;
+    // The inventory both audit rows report, taken before anything is touched.
+    const before = {
+        hosts: hosts.size,
+        members: members.size
+    };
+    // No export. The write that used to stand here is gone (AGL-1443) — see
+    // the note above this function. Nothing is persisted anywhere before the
+    // deleting starts, and `requestedMs` now travels in the audit row rather
+    // than in an object's name.
+    // None of what follows was guarded (AGL-1455) — `eraseOrgApiKeys`,
+    // `eraseOrgSsoDomains`, `eraseOrgIdempotencyKeys` and `recursiveDelete` all
+    // throw. A throw here leaves a workspace half destroyed and still standing,
+    // recorded nowhere. Each step now names itself, and the error is re-thrown
+    // unchanged — this adds a record, it does not swallow the failure. What it
+    // can no longer leave behind is the state that used to be the worst one: a
+    // surviving workspace with its own complete dump already in the bucket.
+    const progress = {};
+    let step = 'plugins';
+    try {
+        // The plugins' share first (AGL-2978), while the org, its roster and
+        // every record swept below still exist: an eraser that revokes a grant at
+        // its provider opens the stored grant to do it. Each eraser is isolated,
+        // so a failing one is recorded as `null` and stops nothing; on a plan
+        // each one counts and touches no provider.
+        progress.plugins = await runPluginOrgErasers({
+            orgId,
+            dryRun
+        });
+        step = 'credentials';
+        // Credentials and routing BEFORE content (AGL-1444/AGL-1448). The org doc
+        // survives until the recursiveDelete at the end, so a key presented — or a
+        // sign-in routed, or a console domain resolved — mid-erasure would still
+        // pass the org gate and reach a half-deleted workspace. Revoking first
+        // closes that window as well as the permanent one.
+        progress.apiKeys = await eraseOrgApiKeys(orgId, dryRun);
+        progress.outreachMailboxCredentials = await eraseOrgOutreachMailboxCredentials(orgId, dryRun);
+        progress.ssoDomains = await eraseOrgSsoDomains(orgId, dryRun);
+        progress.consoleDomains = await releaseOrgConsoleDomains(orgId, dryRun);
+        progress.apiIdempotency = await eraseOrgIdempotencyKeys(orgId, dryRun);
+        // The org's PUBLIC marketplace identity (AGL-1970). Here rather than with
+        // the Stripe step, though it carries a payout id, because `publisherHandles`
+        // is a live name reservation and belongs with the other reservations this
+        // step releases — and because the profile is world-readable, so the sooner
+        // it stops resolving the smaller the mid-erasure window.
+        const publisher = await eraseOrgPublisherIdentity(orgId, dryRun);
+        progress.publisherHandles = publisher.handles;
+        progress.publisherProfile = publisher.profile;
+        progress.listingsRetained = publisher.listingsRetained;
+        // Support threads (AGL-1971). Its own step because it is the only sweep
+        // here that walks a subtree per row, so it is the one most likely to be
+        // where a large workspace's erasure runs out of time — and a failure that
+        // cannot say WHICH step stopped it is the AGL-1455 defect again.
+        step = 'support';
+        progress.supportTickets = await eraseOrgSupportTickets(orgId, dryRun);
+        /*
+     * Hosts (Storage + routing + Firestore trees + the sending domain).
+     *
+     * Each site's dedicated domain is released here rather than by a sweep
+     * that never existed: a workspace erasure used to leave one plan-capped
+     * provider slot and three zone records per site standing forever, with
+     * the DKIM key still live under a label a future site could claim.
+     *
+     * The driver is passed in and may be absent, and either way the erasure
+     * finishes. What the vendors refuse is recorded as a debt on the label
+     * claim, which survives the `recursiveDelete` of both the host and the
+     * org, and the reaper settles it.
+     */ step = 'hosts';
+        progress.hosts = 0;
+        progress.sendingDomains = {
+            released: 0,
+            deferred: 0,
+            protected: 0
+        };
+        for (const host of hosts.docs){
+            if (!dryRun) {
+                const erased = await eraseHost(host.id, {
+                    tearDownSendingDomain
+                });
+                if (erased.sendingDomain === 'released') {
+                    progress.sendingDomains.released += 1;
+                }
+                if (erased.sendingDomain === 'deferred') {
+                    progress.sendingDomains.deferred += 1;
+                }
+                if (erased.sendingDomain === 'protected') {
+                    progress.sendingDomains.protected += 1;
+                }
+            }
+            progress.hosts += 1;
+        }
+        // The backstop for what the loop above cannot enumerate (AGL-1448): a
+        // `hostIndex` row whose `hosts` document is already gone. AFTER the loop
+        // deliberately — the loop's own fail-soft delete is one of the things
+        // that creates them, so sweeping first would leave this run's orphans
+        // behind for a retry that can no longer see them.
+        progress.hostIndex = await eraseOrgHostIndex(orgId, dryRun);
+        // Org-level Storage (media/dataset assets outside the host prefix).
+        step = 'org-storage';
+        if (!dryRun) {
+            try {
+                await storageBucket().deleteFiles({
+                    prefix: `orgs/${orgId}/`
+                });
+            } catch (error) {
+                console.error(`eraseOrg: org storage cleanup failed for ${orgId}`, error);
+            }
+            // The org library's copies at the delivery provider (AGL-2824); each
+            // site's went with its `eraseHost` above.
+            await eraseMediaDeliveryScope({
+                collection: 'orgs',
+                scopeId: orgId
+            });
+        }
+        // Stripe: the customer at the processor, AND the local reverse index that
+        // correlates that identity back to this workspace (AGL-1448). Deleting
+        // only the first left exactly the record AGL-1028 denied to every client.
+        step = 'stripe';
+        // `readOrgBilling` hands back the customer for THIS deployment's Stripe
+        // mode (AGL-2486), which is the only one `deleteStripeCustomer` could act
+        // on anyway — it spends `STRIPE_SECRET_KEY`, and a live key cannot delete a
+        // test customer. Known residue, deliberately not chased here: an org that
+        // was also exercised in TEST mode leaves its test customer standing at
+        // Stripe after a live erasure. That is synthetic data created by us, not
+        // subject data supplied by the workspace, and reaching it would mean
+        // erasure spending a second API key in a mode this deployment is not in.
+        if (!dryRun) await deleteStripeCustomer(stripeCustomerId);
+        progress.stripeIndex = await eraseOrgStripeIndex(orgId, dryRun);
+        // Members' reverse index into this org.
+        step = 'members';
+        if (!dryRun) {
+            for (const member of members.docs){
+                await firestore.collection('users').doc(member.id).collection('orgs').doc(orgId).delete().catch(()=>undefined);
+            }
+        }
+        // The backstop for the members loop (AGL-1448): a `hostMemberships`
+        // projection belonging to somebody who has LEFT the org, whom
+        // `deleteHostProjectionForAllMembers` cannot enumerate because the
+        // membership it would start from is already gone. Collection-group —
+        // see the note on the function, and the index it owes.
+        progress.hostMemberships = await eraseOrgHostMemberships(orgId, dryRun);
+        // The org subtree, then every slug reservation it has ever held — the
+        // current one and each rename tombstone (AGL-1448), with the matching
+        // `{slug}.aglyn.com` detached (AGL-1136).
+        step = 'org-tree';
+        if (!dryRun) await firestore.recursiveDelete(orgRef);
+        step = 'slugs';
+        progress.slugs = await eraseOrgSlugs(orgId, slug, dryRun);
+    } catch (error) {
+        console.error(`eraseOrg: ${step} failed for ${orgId}`, error);
+        await recordErasureFailure({
+            orgId,
+            step,
+            error,
+            actorUid,
+            requestedAt: requestedMs,
+            before,
+            // How far it got, so the next reader knows what is already destroyed.
+            after: _extends({}, progress)
+        });
+        throw error;
+    }
+    // A plan (AGL-1481). Every sweep above ran its query and skipped its write,
+    // so these are the counts the real run would report — reached through the
+    // same code, which is the whole point of the operator script calling this
+    // function instead of listing the sweeps a second time. No audit row: an
+    // erasure that did not happen is not a record of one.
+    if (dryRun) {
+        return _extends({
+            ok: false,
+            skippedReason: 'dry-run'
+        }, progress, {
+            hosts: hosts.size,
+            members: members.size
+        });
+    }
+    // The proof of erasure, and now the only record of it: actor, action,
+    // target, the request it fulfilled, the inventory found and what each sweep
+    // destroyed. Ids and counts — never the content (AGL-1443).
+    await firestore.collection('adminAudit').add({
+        actorUid,
+        action: 'org.erased',
+        target: `orgs/${orgId}`,
+        before,
+        after: _extends({
+            requestedAt: requestedMs
+        }, withoutRequest ? {
+            withoutRequest: withoutRequest.reason
+        } : {}, progress),
+        at: FieldValue.serverTimestamp()
+    }).catch(()=>undefined);
+    return _extends({
+        ok: true
+    }, progress, {
+        hosts: hosts.size,
+        members: members.size
+    });
+}
+/**
+ * Strip an erased person from the support threads they wrote in, WITHOUT
+ * destroying the threads (AGL-1971).
+ *
+ * The asymmetry with `eraseOrgSupportTickets` is the whole point and is worth
+ * stating rather than assuming. A ticket belongs to an ORG, not to the person
+ * who happened to open it: it is the workspace's support history, other people
+ * on the roster can read it, and it is evidence in a dispute the workspace may
+ * still be having with us. Erasing one member must not delete it — and cannot,
+ * honestly: for that thread Aglyn is the processor and the ORG is the
+ * controller, so deleting it on a member's instruction is acting without the
+ * controller's instruction, which `docs/PRIVACY_REQUESTS.md` §6 refuses in the
+ * mirror-image case. `eraseUser` also already refuses to cascade into
+ * `eraseOrg` for exactly this reason.
+ *
+ * So the narrow correct action is redaction: `authorId` and `authorEmail` go
+ * to `null` and `authorErased: true` marks why, on that person's messages
+ * only. What remains is the message BODY, deliberately — it is the workspace's
+ * record of a conversation with us, and it is the workspace's to delete. An
+ * erasure of the ORG destroys it, which is the path that reaches it.
+ *
+ * **A collection-group query, not a walk over their current memberships.** The
+ * membership walk is the tempting version and it is wrong in a specific way:
+ * `eraseUser` only knows the orgs the person belongs to NOW, so every ticket
+ * they wrote in a workspace they have since left would keep their email — the
+ * residual is invisible and grows with tenure. `messages` is used as a
+ * subcollection name by `supportTickets` and by nothing else in the repo, so
+ * the group is exactly the right set. It needs the COLLECTION_GROUP index
+ * override on `messages.authorId` in `cloud/firebase-firestore.indexes.json`,
+ * added with this change.
+ *
+ * Returns the number of messages redacted, or **`null` when the query could
+ * not run** — a missing index in an environment where it was never deployed.
+ * `null` is not zero and the caller must not flatten it: it means this erasure
+ * did not reach the support messages at all, and an erasure that quietly
+ * reports success for a step it skipped is the failure this whole file is
+ * organised against. It is reported in the result and in the audit row rather
+ * than thrown, because the account deletion itself must still complete.
+ */ async function redactUserSupportMessages(uid) {
+    if (!uid) return 0;
+    const firestore = firebaseAdmin.app().firestore();
+    let rows;
+    try {
+        rows = await firestore.collectionGroup('messages').where('authorId', '==', uid).get();
+    } catch (error) {
+        console.error(`eraseUser: support message redaction could not run for ${uid}`, error);
+        return null;
+    }
+    for(let index = 0; index < rows.docs.length; index += 400){
+        const batch = firestore.batch();
+        for (const doc of rows.docs.slice(index, index + 400)){
+            batch.set(doc.ref, {
+                authorId: null,
+                authorEmail: null,
+                authorErased: true
+            }, {
+                merge: true
+            });
+        }
+        await batch.commit();
+    }
+    return rows.size;
+}
+/**
+ * Which orgs block erasing `uid` (AGL-1140).
+ *
+ * Pure so the policy can be tested without Firestore, because the policy is
+ * the part worth arguing about — the deletion itself is mechanical.
+ *
+ * **Owning an org blocks erasure, always.** Not only when it bills, and not
+ * only when other members would be stranded. The alternative — cascading
+ * into `eraseOrg` — deletes a workspace, its sites and its data as a side
+ * effect of someone closing a personal account, and no consent given to the
+ * second act was given to the first. Blocking is recoverable; a cascade is
+ * not.
+ *
+ * A live subscription and stranded members are reported rather than gating,
+ * so the message can say WHY this org needs attention instead of a bare
+ * refusal — "transfer ownership" is useless advice if you do not know which
+ * of eleven workspaces is the problem.
+ */ export function userErasureBlockers(uid, orgs) {
+    return orgs.filter((org)=>org.ownerUid === uid).map((org)=>({
+            orgId: org.orgId,
+            orgName: org.orgName,
+            hasLiveSubscription: org.hasLiveSubscription,
+            // The owner themselves is a member; anyone beyond that is stranded.
+            otherMembers: Math.max(0, org.memberCount - 1)
+        }));
+}
+/**
+ * Which of an account's addresses a second account is also known to hold.
+ *
+ * Pure, and separate from the sweep, for the same reason `userErasureBlockers`
+ * is: the policy is the arguable part. The mechanical part is deleting rows.
+ *
+ * ⚠️ `shared` is evidence in ONE direction. True proves a second holder;
+ * false only means none was found, because no lookup exists for an account
+ * holding an address through a federated provider. So this finds every case
+ * we can SEE and cannot promise there is no other — which is exactly why the
+ * sweep still tombstones every address it erases.
+ */ export function sharedAddressBlockers(set) {
+    return set.addresses.filter((entry)=>entry.shared === true).map((entry)=>({
+            key: entry.key,
+            sources: [
+                ...entry.sources
+            ]
+        }));
+}
+/**
+ * Permanently erase a person's account (AGL-1140).
+ *
+ * Nothing did this before: `eraseHost`, `eraseSubtree` and `eraseOrg` existed
+ * and no path anywhere deleted a `users/{uid}`. That was survivable while the
+ * doc held a name and a phone; AGL-1133 added a postal address, and "we have
+ * no mechanism to delete it" is a bad answer to an erasure request.
+ *
+ * `eraseOrg` is deliberately NOT the model here. An org is a workspace with
+ * one owner; a person belongs to many orgs, so erasing them must not take
+ * anything with it that outlives them.
+ *
+ * Order matters:
+ *   1. Refuse if they own an org — see `userErasureBlockers`.
+ *   1b. Refuse if a second account holds one of their addresses — see
+ *      `sharedAddressBlockers`. Both refusals come before any delete, so a
+ *      blocked erasure leaves the account exactly as it was.
+ *   2. Remove their membership from every org they belong to, so no roster
+ *      keeps their email and no host projection keeps granting them access.
+ *      This runs BEFORE the profile delete: a half-erased account that still
+ *      appears on a roster is worse than one not yet started.
+ *   3. Delete the `users/{uid}` subtree, the avatar, the world-readable
+ *      `profiles/{uid}` public identity (AGL-1970), redact their name and
+ *      email off every support message they wrote (AGL-1971), then the auth
+ *      record last — once that is gone there is no uid to retry with.
+ */ export async function eraseUser(uid) {
+    var _ref;
+    const firestore = firebaseAdmin.app().firestore();
+    const userRef = firestore.collection('users').doc(uid);
+    const snapshot = await userRef.get();
+    const membership = await userRef.collection('orgs').get();
+    // An absent profile doc is not an absent account — the doc is only born on
+    // first save (AGL-1127), so the auth record and the org memberships can
+    // outlive it. Treat "nothing anywhere" as not-found, not "no doc".
+    if (!snapshot.exists && membership.empty) {
+        const record = await findUserByUidAcrossPools(uid).catch(()=>null);
+        if (!record) return {
+            ok: false,
+            skippedReason: 'not-found'
+        };
+    }
+    const candidates = [];
+    for (const row of membership.docs){
+        var _org_get, _org_get1, _members_data_count;
+        const orgRef = firestore.collection('orgs').doc(row.id);
+        const [org, members] = await Promise.all([
+            orgRef.get(),
+            orgRef.collection('members').count().get()
+        ]);
+        if (!org.exists) continue;
+        candidates.push({
+            orgId: row.id,
+            orgName: String((_org_get = org.get('name')) != null ? _org_get : row.id),
+            ownerUid: (_org_get1 = org.get('ownerUid')) != null ? _org_get1 : null,
+            hasLiveSubscription: isBillingSubscription(org.data()),
+            memberCount: Number((_members_data_count = members.data().count) != null ? _members_data_count : 0)
+        });
+    }
+    const blockers = userErasureBlockers(uid, candidates);
+    if (blockers.length) {
+        return {
+            ok: false,
+            skippedReason: 'owns-orgs',
+            blockers
+        };
+    }
+    // Inventory BEFORE anything is deleted. Taken after the membership sweep
+    // below, this under-reported: `removeOrgMember` empties `users/{uid}/orgs`,
+    // and Firestore does not list a collection with no documents in it — so a
+    // live run erased three subcollections and the audit record named two.
+    // An erasure audit trail that understates what it destroyed is the one
+    // record that has to be right. Measured 2026-08-01 (AGL-1140).
+    const subcollections = (await userRef.listCollections()).map((c)=>c.id);
+    /*
+   * EVERY ADDRESS, RESOLVED BEFORE ANY OF THEM IS DESTROYED.
+   *
+   * Two of the three sources are erased by this function itself:
+   * `users/{uid}/emails` goes with the `recursiveDelete` below, and the Auth
+   * record — the only place the primary lives — goes at the very end. Reading
+   * them afterwards is reading nothing, and an erasure that resolves an empty
+   * address set sweeps nothing while reporting success. That is the exact
+   * shape of a spec passing because its fixture never reached the code, and
+   * here it would be a live erasure reporting a completeness it does not have.
+   *
+   * `detectShared` because the SHARED case changes what the caller is told,
+   * not what is destroyed — see `eraseEmailDeliveriesForAddresses`.
+   */ const pooledForAddresses = await findUserByUidAcrossPools(uid).catch(()=>null);
+    const addressSet = await resolveAccountAddresses({
+        uid,
+        record: (_ref = pooledForAddresses == null ? void 0 : pooledForAddresses.record) != null ? _ref : null,
+        detectShared: true,
+        firestore
+    }).catch(()=>({
+            uid,
+            primary: null,
+            addresses: [],
+            incomplete: true
+        }));
+    /*
+   * A SECOND ACCOUNT HOLDS ONE OF THESE ADDRESSES — REFUSE, HERE.
+   *
+   * The delivery log is filed under the address, so an address two accounts
+   * hold has one set of rows answering "what did you send me" for two account
+   * records. Whether that is one human with two accounts (the ordinary live
+   * shape — a federated provider address that is another account's primary)
+   * or a genuinely shared role mailbox like `billing@` decides whether
+   * erasing those rows honours a request or destroys a stranger's history,
+   * and NOTHING readable here distinguishes them. The data records that two
+   * accounts name one address; it records nothing about the humans.
+   *
+   * Both automatic answers are unacceptable, and they fail differently:
+   * erasing the second party's mail cannot be undone, while leaving it and
+   * reporting the erasure complete is the gap this whole area was opened to
+   * close. So neither is chosen — the erasure stops and says why.
+   *
+   * BEFORE the membership sweep, deliberately. A refusal raised after the
+   * account is half-deleted is not a refusal, and the uid is the only handle
+   * a human has to act on this: erase the auth record and there is no longer
+   * anything to look at, no way to see which address was contested, and no
+   * way to run the erasure once the question is settled. Refusing while the
+   * account is whole is the only version of this that stays reversible.
+   *
+   * The remedy is ordinary staff work, not a special path: decide whether the
+   * accounts are one person, detach the address from this one or merge them,
+   * then run the erasure again. `/admin/users/[uid]` already lists this
+   * account's addresses and marks the shared ones.
+   */ const contested = sharedAddressBlockers(addressSet);
+    if (contested.length) {
+        return {
+            ok: false,
+            skippedReason: 'shared-address',
+            sharedAddresses: contested
+        };
+    }
+    // Memberships first — a roster row carries their email and a host
+    // projection carries their access, and both outlive the profile doc.
+    for (const candidate of candidates){
+        await removeOrgMember(candidate.orgId, uid).catch((error)=>{
+            console.error(`eraseUser: membership cleanup failed for ${candidate.orgId}`, error);
+        });
+    }
+    // What the plugins keep about the person (AGL-2939). A document under an
+    // org keyed by the uid is the shape no recursive delete on this path can
+    // see — the same shape as the delivery log below. Each plugin's eraser
+    // gets every workspace the person was in, because the memberships above
+    // are already gone; one that fails is recorded as `null` and the erasure
+    // goes on.
+    const plugins = await runPluginUserErasers({
+        uid,
+        orgIds: candidates.map((candidate)=>candidate.orgId)
+    });
+    // The avatar outlives the doc otherwise.
+    let photo = false;
+    try {
+        await storageBucket().deleteFiles({
+            prefix: `users/${uid}/`
+        });
+        photo = true;
+    } catch (error) {
+        console.error(`eraseUser: storage cleanup failed for ${uid}`, error);
+    }
+    await firestore.recursiveDelete(userRef);
+    // `profiles/{uid}` — the person's PUBLIC identity (AGL-1970).
+    //
+    // A separate top-level collection keyed by the uid AS THE DOCUMENT ID, so
+    // `recursiveDelete(users/{uid})` above never reaches it and no reader
+    // scanning this function for a sweep list is prompted to notice it. It is
+    // `allow read: if true` in the rules and carries `handle`, `displayName`,
+    // and `stripeAccountId`/`stripeChargesEnabled` — a Stripe Connect payout
+    // destination written server-side after KYC. An erased person therefore
+    // stayed publicly listed with a live payment-account identifier attached,
+    // which Privacy Policy §5 ("a genuine recursive delete… we keep no copy of
+    // the erased content") says in terms does not happen.
+    //
+    // No tombstone, unlike the org's publisher profile: the only reader of the
+    // display name is the support forum's author rendering, and a forum post
+    // losing its author name is the intended outcome of erasing its author.
+    //
+    // `recursiveDelete` rather than `delete` — nothing writes a subcollection
+    // under a profile today, and a document delete would silently orphan the
+    // first thing that does.
+    let profile = false;
+    try {
+        const profileRef = firestore.collection('profiles').doc(uid);
+        profile = (await profileRef.get()).exists;
+        await firestore.recursiveDelete(profileRef);
+    } catch (error) {
+        console.error(`eraseUser: public profile delete failed for ${uid}`, error);
+    }
+    // Their name and email off every support message they wrote, in any
+    // workspace, past or present (AGL-1971). The threads are the orgs' and
+    // survive — see `redactUserSupportMessages`.
+    const supportMessagesRedacted = await redactUserSupportMessages(uid);
+    // Auth record LAST: once it is gone there is no uid to retry with, and
+    // `authForPool` is required because a project-level delete cannot see an
+    // SSO account at all (AGL-1122).
+    //
+    // The lookup is hoisted above the delete because the DELIVERY LOG is filed
+    // under the ADDRESS, not the uid, and the auth record is the last place the
+    // address exists. Erase it while there is still something to erase it by.
+    let authRecord = false;
+    let emailDeliveries = 0;
+    /** Addresses actually swept — not the same as the ones we hold, on failure. */ let erasedAddressCount = 0;
+    /** Addresses left intact because a second account also holds them. */ let contestedAddressCount = 0;
+    /** Identity-index rows released, one per address that had one. */ let emailIdentityIndex = 0;
+    try {
+        const record = await findUserByUidAcrossPools(uid);
+        if (record) {
+            var _ref1, _ref2, _ref3;
+            /*
+       * `emailDeliveries/{sha256(address)}/messages` — every subject we ever
+       * sent this person, with the times they opened and clicked. Personal
+       * data by any reading of it, and reachable from neither
+       * `recursiveDelete(users/{uid})` nor `profiles/{uid}` because it is
+       * keyed by address in a third top-level collection. The same shape as
+       * the `profiles/{uid}` omission this function already documents above:
+       * a store nothing in the sweep list would prompt a reader to notice.
+       *
+       * EVERY ADDRESS, not the current primary. Passing one address left a
+       * prior or provider-supplied address holding its full history —
+       * recipient, subjects, open and click times — after the request had
+       * been honoured and reported complete.
+       *
+       * Best-effort, like every other step here — a log that survives must
+       * not stop the auth record from going.
+       */ const sweep = await eraseEmailDeliveriesForAddresses(addressSet.addresses, firestore).catch(()=>null);
+            emailDeliveries = (_ref1 = sweep == null ? void 0 : sweep.removed) != null ? _ref1 : 0;
+            erasedAddressCount = (_ref2 = sweep == null ? void 0 : sweep.addresses.length) != null ? _ref2 : 0;
+            contestedAddressCount = (_ref3 = sweep == null ? void 0 : sweep.contestedAddresses.length) != null ? _ref3 : 0;
+            /*
+       * `emailIdentityIndex/{address}` — the SAME omission one collection
+       * over.
+       *
+       * A top-level collection keyed by the address IN THE CLEAR, holding
+       * `{uid, address, claimedAt}`. `recursiveDelete(users/{uid})` cannot
+       * see it for exactly the reason it cannot see the delivery log, so an
+       * erased account left a readable address still pointing at its uid.
+       *
+       * Released rather than tombstoned, unlike the delivery log: this is a
+       * uniqueness claim, and `removeAccountEmail` already argues that
+       * holding one after the address is gone burns the address for whoever
+       * might legitimately want it next.
+       *
+       * ⛔ Only rows this uid actually owns. The index is the guard against
+       * two accounts holding one address, and deleting another account's
+       * claim would hand their sign-in identifier to the next taker.
+       */ for (const entry of addressSet.addresses){
+                try {
+                    const ref = firestore.collection(EMAIL_IDENTITY_INDEX_COLLECTION).doc(entry.address);
+                    const indexed = await ref.get();
+                    if (indexed.exists && indexed.get('uid') === uid) {
+                        await ref.delete();
+                        emailIdentityIndex += 1;
+                    }
+                } catch (error) {
+                    console.error(`eraseUser: identity index release failed for ${uid}`, error);
+                }
+            }
+            await authForPool(record.tenantId).deleteUser(uid);
+            authRecord = true;
+        }
+    } catch (error) {
+        console.error(`eraseUser: auth record delete failed for ${uid}`, error);
+    }
+    /*
+   * WHAT THE ADDRESS SWEEP ACTUALLY COVERED.
+   *
+   * Counts, never the addresses themselves: this collection is readable by
+   * any staff role and `maskEmailAddress` exists because an audit row holding
+   * a readable address made `adminAudit` the leakier of the two stores for
+   * the same data. An erasure record listing the addresses it destroyed would
+   * be the sharpest version of that — it would preserve, in the clear, the
+   * exact set the request existed to remove.
+   *
+   * `addressesIncomplete` is the one that matters to a reader. It says a
+   * source could not be read, so the sweep may have missed an address the
+   * account held — the difference between "erased everywhere" and "erased
+   * everywhere we could see", which is the difference a regulator asks about.
+   */ const addressSweep = {
+        resolved: addressSet.addresses.length,
+        erased: erasedAddressCount,
+        contested: contestedAddressCount,
+        incomplete: addressSet.incomplete
+    };
+    await firestore.collection('adminAudit').add({
+        actorUid: 'system:erase-user',
+        action: 'user.erased',
+        target: `users/${uid}`,
+        before: {
+            orgs: candidates.length
+        },
+        after: {
+            subcollections,
+            authRecord,
+            photo,
+            profile,
+            supportMessagesRedacted,
+            plugins,
+            emailDeliveries,
+            emailIdentityIndex,
+            addressSweep
+        },
+        at: FieldValue.serverTimestamp()
+    }).catch(()=>undefined);
+    return {
+        ok: true,
+        deleted: {
+            subcollections,
+            authRecord,
+            photo,
+            profile,
+            supportMessagesRedacted,
+            plugins,
+            emailDeliveries,
+            emailIdentityIndex,
+            addressSweep
+        }
+    };
+}
+
+//# sourceMappingURL=erase.js.map