@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/release-flags.js

@@ -0,0 +1,183 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { filterPluginsByReleaseFlags, isReleaseFlagKey, isReleaseFlagOnForOrg, parseOrgReleaseFlagOverrides, parseReleaseFlagValue, RELEASE_FLAGS, resolveEffectivePlan } from "@aglyn/aglyn/server";
+import { findUserByUidAcrossPools } from "./auth-pools.js";
+import { firebaseAdmin } from "./firebase-admin.js";
+/**
+ * Server-side release-flag verdicts (AGL-422): the tenant loader and the
+ * API dispatchers subtract flagged-off plugins, so the server needs the
+ * same Remote Config values the console client activates. The admin SDK
+ * template read is cached with a short TTL — flag flips propagate within
+ * a minute without a per-request round trip.
+ *
+ * Fail-open to the REGISTRY DEFAULTS (not "all on"): environments without
+ * Remote Config (emulator e2e, local dev) behave exactly like an
+ * unpublished template does on the client, so verdicts agree across
+ * surfaces.
+ */ const TTL_MS = 60000;
+let cache;
+let pending;
+const registryDefaults = ()=>Object.fromEntries(RELEASE_FLAGS.map((definition)=>[
+            definition.key,
+            {
+                enabled: definition.defaultEnabled
+            }
+        ]));
+export async function getServerReleaseFlagValues() {
+    if (cache && Date.now() - cache.at < TTL_MS) return cache.values;
+    if (!pending) {
+        pending = (async ()=>{
+            const values = registryDefaults();
+            try {
+                const template = await firebaseAdmin.app().remoteConfig().getTemplate();
+                for (const definition of RELEASE_FLAGS){
+                    const parameter = template.parameters[definition.key];
+                    const defaultValue = parameter == null ? void 0 : parameter.defaultValue;
+                    const raw = defaultValue && 'value' in defaultValue ? defaultValue.value : undefined;
+                    values[definition.key] = parseReleaseFlagValue(raw, definition.defaultEnabled);
+                }
+            } catch (unused) {
+            // No Remote Config here (emulator/local) — registry defaults gate.
+            }
+            cache = {
+                at: Date.now(),
+                values
+            };
+            return values;
+        })().finally(()=>{
+            pending = undefined;
+        });
+    }
+    return pending;
+}
+const orgCache = new Map();
+/**
+ * Both halves of the per-org answer from ONE cached document read.
+ *
+ * Sharing the read is the point: `plan` and `releaseFlags` live on the same
+ * org document, this runs on every published page render and every API
+ * dispatch, and fetching the tier separately would have doubled the hot-path
+ * Firestore traffic to learn something already in hand.
+ */ export async function getOrgReleaseFlagTargeting(orgId) {
+    if (!orgId) return {
+        overrides: {},
+        plan: null
+    };
+    const hit = orgCache.get(orgId);
+    if (hit && Date.now() - hit.at < TTL_MS) return hit.targeting;
+    const targeting = {
+        overrides: {},
+        plan: null
+    };
+    try {
+        const snapshot = await firebaseAdmin.app().firestore().collection('orgs').doc(orgId).get();
+        const data = snapshot.data();
+        targeting.overrides = parseOrgReleaseFlagOverrides(data == null ? void 0 : data['releaseFlags']);
+        // Only when a document actually came back. `snapshot.data()` is undefined
+        // for a missing doc, and `resolveEffectivePlan` would read that as Free.
+        if (data) targeting.plan = resolveEffectivePlan(data);
+    } catch (unused) {
+    // No Firestore here, or the doc is unreadable — inherit, never fail.
+    }
+    orgCache.set(orgId, {
+        at: Date.now(),
+        targeting
+    });
+    return targeting;
+}
+export async function getOrgReleaseFlagOverrides(orgId) {
+    return (await getOrgReleaseFlagTargeting(orgId)).overrides;
+}
+/**
+ * The verdict for ONE flag and ONE org, overrides applied (AGL-1635).
+ *
+ * The surfaces that gate a single flag server-side — the tenant admin bar
+ * slot, edit-context redemption, edit-access minting — resolve through here
+ * rather than reading `getServerReleaseFlagValues()` and calling
+ * `isReleaseFlagOn` themselves, so a per-org grant reaches all of them at
+ * once. A gate that kept the old two-step would silently ignore overrides,
+ * which is the failure this issue exists to fix.
+ */ export async function isServerReleaseFlagOnForOrg(flagKey, orgId) {
+    const [values, targeting] = await Promise.all([
+        getServerReleaseFlagValues(),
+        getOrgReleaseFlagTargeting(orgId)
+    ]);
+    return isReleaseFlagOnForOrg(flagKey, values[flagKey], orgId != null ? orgId : null, targeting.overrides, targeting.plan);
+}
+/** Test seam: drops both caches so a spec can change a verdict. */ export function __resetReleaseFlagCaches() {
+    cache = undefined;
+    orgCache.clear();
+}
+/**
+ * The server half of the plugin release gate (AGL-422): subtracts
+ * flagged-off first-party plugins from an effective set. The staff bypass is
+ * only paid for when something was actually subtracted AND the request
+ * carries a bearer token — the common all-flags-on path never verifies.
+ *
+ * `orgId` is the ONLY subject: it selects the per-org overrides (AGL-1635)
+ * and it is the rollout bucket. AGL-1635 took a separate `subjectId` here
+ * because callers fell back to a hostId when the org lookup missed, and a
+ * hostId must never be read as an org id. AGL-1656 removed that fallback
+ * instead of accommodating it — a hostId and an orgId hash to different
+ * buckets, so a mid-rollout flag could land the published site and the
+ * console on opposite sides of the same percentage for the same workspace.
+ * With one subject the two cannot disagree by construction, and there is no
+ * longer a parameter through which a non-org subject could be reintroduced.
+ */ export async function filterEnabledPluginsByReleaseFlags(pluginIds, options) {
+    var _options_authorization;
+    const [values, targeting] = await Promise.all([
+        getServerReleaseFlagValues(),
+        getOrgReleaseFlagTargeting(options.orgId)
+    ]);
+    const isFlagOn = (flagKey)=>{
+        var _options_orgId;
+        return isReleaseFlagKey(flagKey) ? isReleaseFlagOnForOrg(flagKey, values[flagKey], (_options_orgId = options.orgId) != null ? _options_orgId : null, targeting.overrides, targeting.plan) : true;
+    };
+    const filtered = filterPluginsByReleaseFlags(pluginIds, isFlagOn);
+    if (filtered.length === pluginIds.length) return filtered;
+    const authorization = (_options_authorization = options.authorization) != null ? _options_authorization : '';
+    if (authorization.startsWith('Bearer ')) {
+        try {
+            const decoded = await firebaseAdmin.app().auth().verifyIdToken(authorization.slice('Bearer '.length));
+            if (decoded['staff'] === true) return [
+                ...pluginIds
+            ];
+        } catch (unused) {
+        // Invalid token — gate as anonymous.
+        }
+        return filtered;
+    }
+    if (options.subjectUid) {
+        // The same claim the token path reads, looked up by account: a staff
+        // member's own provider redirect carries no token, and previewing a dark
+        // plugin has to survive the round trip their session started. Paid only
+        // when a flag actually subtracted something and a route vouched for the
+        // account. Across every auth pool (AGL-1122): a staff member who signs in
+        // through SSO is a tenant user the project pool does not hold.
+        try {
+            var _account_record_customClaims;
+            const account = await findUserByUidAcrossPools(options.subjectUid);
+            if ((account == null ? void 0 : (_account_record_customClaims = account.record.customClaims) == null ? void 0 : _account_record_customClaims['staff']) === true) return [
+                ...pluginIds
+            ];
+        } catch (unused) {
+        // Auth did not answer — gate as anonymous.
+        }
+    }
+    return filtered;
+}
+
+//# sourceMappingURL=release-flags.js.map

package/src/lib/server/release-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/release-flags.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  filterPluginsByReleaseFlags,\n  isReleaseFlagKey,\n  isReleaseFlagOnForOrg,\n  parseOrgReleaseFlagOverrides,\n  parseReleaseFlagValue,\n  RELEASE_FLAGS,\n  resolveEffectivePlan,\n  type OrgPlan,\n  type OrgReleaseFlagOverrides,\n  type ReleaseFlagKey,\n  type ReleaseFlagValue,\n} from '@aglyn/aglyn/server'\nimport { findUserByUidAcrossPools } from './auth-pools'\nimport { firebaseAdmin } from './firebase-admin'\n\n/**\n * Server-side release-flag verdicts (AGL-422): the tenant loader and the\n * API dispatchers subtract flagged-off plugins, so the server needs the\n * same Remote Config values the console client activates. The admin SDK\n * template read is cached with a short TTL — flag flips propagate within\n * a minute without a per-request round trip.\n *\n * Fail-open to the REGISTRY DEFAULTS (not \"all on\"): environments without\n * Remote Config (emulator e2e, local dev) behave exactly like an\n * unpublished template does on the client, so verdicts agree across\n * surfaces.\n */\n\nconst TTL_MS = 60_000\n\nlet cache:\n  | { at: number; values: Record<ReleaseFlagKey, ReleaseFlagValue> }\n  | undefined\nlet pending:\n  | Promise<Record<ReleaseFlagKey, ReleaseFlagValue>>\n  | undefined\n\nconst registryDefaults = (): Record<ReleaseFlagKey, ReleaseFlagValue> =>\n  Object.fromEntries(\n    RELEASE_FLAGS.map((definition) => [\n      definition.key,\n      { enabled: definition.defaultEnabled },\n    ]),\n  ) as Record<ReleaseFlagKey, ReleaseFlagValue>\n\nexport async function getServerReleaseFlagValues(): Promise<\n  Record<ReleaseFlagKey, ReleaseFlagValue>\n> {\n  if (cache && Date.now() - cache.at < TTL_MS) return cache.values\n  if (!pending) {\n    pending = (async () => {\n      const values = registryDefaults()\n      try {\n        const template = await firebaseAdmin.app().remoteConfig().getTemplate()\n        for (const definition of RELEASE_FLAGS) {\n          const parameter = template.parameters[definition.key]\n          const defaultValue = parameter?.defaultValue\n          const raw =\n            defaultValue && 'value' in defaultValue\n              ? defaultValue.value\n              : undefined\n          values[definition.key] = parseReleaseFlagValue(\n            raw,\n            definition.defaultEnabled,\n          )\n        }\n      } catch {\n        // No Remote Config here (emulator/local) — registry defaults gate.\n      }\n      cache = { at: Date.now(), values }\n      return values\n    })().finally(() => {\n      pending = undefined\n    })\n  }\n  return pending\n}\n\n/**\n * Per-org release-flag overrides (AGL-1635), read off `orgs/{orgId}`.\n *\n * Cached on the same TTL as the template read above, and for the same\n * reason: these are consulted on every published page render and every API\n * dispatch, so an uncached read would add a Firestore round trip to the hot\n * path. A grant therefore takes up to a minute to land, matching how long a\n * flag flip already takes — one propagation story, not two.\n *\n * Keyed by orgId because a subject may be a uid or a hostId, and only an\n * org can carry overrides. Failure is silent and yields `{}`: a missing org\n * doc or a denied read must gate exactly as \"no override set\", never as an\n * error that takes a published page down.\n */\n/**\n * What one org read answers about release flags: the staff overrides, and\n * the org's EFFECTIVE plan for tier targeting (AGL-2486).\n *\n * `plan` is null when the read did not produce an org document — missing,\n * denied, or no Firestore at all. Deliberately not `'free'`: an org whose\n * doc could not be read has an UNKNOWN tier, and\n * `resolveEffectivePlan(undefined)` answers `'free'`, which would hand a\n * Free-targeted flag to every org the read failed for. The two cases have to\n * stay distinguishable at the boundary, because the evaluator treats an\n * unknown plan as a refusal and a known `'free'` as a match.\n */\ninterface OrgReleaseFlagTargeting {\n  overrides: OrgReleaseFlagOverrides\n  plan: OrgPlan | null\n}\n\nconst orgCache = new Map<string, { at: number; targeting: OrgReleaseFlagTargeting }>()\n\n/**\n * Both halves of the per-org answer from ONE cached document read.\n *\n * Sharing the read is the point: `plan` and `releaseFlags` live on the same\n * org document, this runs on every published page render and every API\n * dispatch, and fetching the tier separately would have doubled the hot-path\n * Firestore traffic to learn something already in hand.\n */\nexport async function getOrgReleaseFlagTargeting(\n  orgId: string | null | undefined,\n): Promise<OrgReleaseFlagTargeting> {\n  if (!orgId) return { overrides: {}, plan: null }\n  const hit = orgCache.get(orgId)\n  if (hit && Date.now() - hit.at < TTL_MS) return hit.targeting\n  const targeting: OrgReleaseFlagTargeting = { overrides: {}, plan: null }\n  try {\n    const snapshot = await firebaseAdmin\n      .app()\n      .firestore()\n      .collection('orgs')\n      .doc(orgId)\n      .get()\n    const data = snapshot.data()\n    targeting.overrides = parseOrgReleaseFlagOverrides(data?.['releaseFlags'])\n    // Only when a document actually came back. `snapshot.data()` is undefined\n    // for a missing doc, and `resolveEffectivePlan` would read that as Free.\n    if (data) targeting.plan = resolveEffectivePlan(data as any)\n  } catch {\n    // No Firestore here, or the doc is unreadable — inherit, never fail.\n  }\n  orgCache.set(orgId, { at: Date.now(), targeting })\n  return targeting\n}\n\nexport async function getOrgReleaseFlagOverrides(\n  orgId: string | null | undefined,\n): Promise<OrgReleaseFlagOverrides> {\n  return (await getOrgReleaseFlagTargeting(orgId)).overrides\n}\n\n/**\n * The verdict for ONE flag and ONE org, overrides applied (AGL-1635).\n *\n * The surfaces that gate a single flag server-side — the tenant admin bar\n * slot, edit-context redemption, edit-access minting — resolve through here\n * rather than reading `getServerReleaseFlagValues()` and calling\n * `isReleaseFlagOn` themselves, so a per-org grant reaches all of them at\n * once. A gate that kept the old two-step would silently ignore overrides,\n * which is the failure this issue exists to fix.\n */\nexport async function isServerReleaseFlagOnForOrg(\n  flagKey: ReleaseFlagKey,\n  orgId: string | null | undefined,\n): Promise<boolean> {\n  const [values, targeting] = await Promise.all([\n    getServerReleaseFlagValues(),\n    getOrgReleaseFlagTargeting(orgId),\n  ])\n  return isReleaseFlagOnForOrg(\n    flagKey,\n    values[flagKey],\n    orgId ?? null,\n    targeting.overrides,\n    targeting.plan,\n  )\n}\n\n/** Test seam: drops both caches so a spec can change a verdict. */\nexport function __resetReleaseFlagCaches(): void {\n  cache = undefined\n  orgCache.clear()\n}\n\n/**\n * The server half of the plugin release gate (AGL-422): subtracts\n * flagged-off first-party plugins from an effective set. The staff bypass is\n * only paid for when something was actually subtracted AND the request\n * carries a bearer token — the common all-flags-on path never verifies.\n *\n * `orgId` is the ONLY subject: it selects the per-org overrides (AGL-1635)\n * and it is the rollout bucket. AGL-1635 took a separate `subjectId` here\n * because callers fell back to a hostId when the org lookup missed, and a\n * hostId must never be read as an org id. AGL-1656 removed that fallback\n * instead of accommodating it — a hostId and an orgId hash to different\n * buckets, so a mid-rollout flag could land the published site and the\n * console on opposite sides of the same percentage for the same workspace.\n * With one subject the two cannot disagree by construction, and there is no\n * longer a parameter through which a non-org subject could be reintroduced.\n */\nexport async function filterEnabledPluginsByReleaseFlags(\n  pluginIds: readonly string[],\n  options: {\n    /**\n     * The org this request belongs to: rollout bucket AND override key.\n     * Null when no org could be resolved — a subject-less request gets the\n     * fully-enabled flags only, never a partial rollout.\n     */\n    orgId?: string | null\n    /** Raw Authorization header, when the caller has one (API dispatch). */\n    authorization?: string | null\n    /**\n     * The account a TOKENLESS request acts for, as its route proved it\n     * (AGL-2978) — see `PluginApiRequestSubject.uid`. Consulted for the staff\n     * preview only, and only when the request carries no bearer token: a\n     * request with a token is the token's, whatever else it names.\n     */\n    subjectUid?: string | null\n  },\n): Promise<string[]> {\n  const [values, targeting] = await Promise.all([\n    getServerReleaseFlagValues(),\n    getOrgReleaseFlagTargeting(options.orgId),\n  ])\n  const isFlagOn = (flagKey: string): boolean =>\n    isReleaseFlagKey(flagKey)\n      ? isReleaseFlagOnForOrg(\n          flagKey,\n          values[flagKey],\n          options.orgId ?? null,\n          targeting.overrides,\n          targeting.plan,\n        )\n      : true\n  const filtered = filterPluginsByReleaseFlags(pluginIds, isFlagOn)\n  if (filtered.length === pluginIds.length) return filtered\n\n  const authorization = options.authorization ?? ''\n  if (authorization.startsWith('Bearer ')) {\n    try {\n      const decoded = await firebaseAdmin\n        .app()\n        .auth()\n        .verifyIdToken(authorization.slice('Bearer '.length))\n      if (decoded['staff'] === true) return [...pluginIds]\n    } catch {\n      // Invalid token — gate as anonymous.\n    }\n    return filtered\n  }\n  if (options.subjectUid) {\n    // The same claim the token path reads, looked up by account: a staff\n    // member's own provider redirect carries no token, and previewing a dark\n    // plugin has to survive the round trip their session started. Paid only\n    // when a flag actually subtracted something and a route vouched for the\n    // account. Across every auth pool (AGL-1122): a staff member who signs in\n    // through SSO is a tenant user the project pool does not hold.\n    try {\n      const account = await findUserByUidAcrossPools(options.subjectUid)\n      if (account?.record.customClaims?.['staff'] === true) return [...pluginIds]\n    } catch {\n      // Auth did not answer — gate as anonymous.\n    }\n  }\n  return filtered\n}\n"],"names":["filterPluginsByReleaseFlags","isReleaseFlagKey","isReleaseFlagOnForOrg","parseOrgReleaseFlagOverrides","parseReleaseFlagValue","RELEASE_FLAGS","resolveEffectivePlan","findUserByUidAcrossPools","firebaseAdmin","TTL_MS","cache","pending","registryDefaults","Object","fromEntries","map","definition","key","enabled","defaultEnabled","getServerReleaseFlagValues","Date","now","at","values","template","app","remoteConfig","getTemplate","parameter","parameters","defaultValue","raw","value","undefined","finally","orgCache","Map","getOrgReleaseFlagTargeting","orgId","overrides","plan","hit","get","targeting","snapshot","firestore","collection","doc","data","set","getOrgReleaseFlagOverrides","isServerReleaseFlagOnForOrg","flagKey","Promise","all","__resetReleaseFlagCaches","clear","filterEnabledPluginsByReleaseFlags","pluginIds","options","isFlagOn","filtered","length","authorization","startsWith","decoded","auth","verifyIdToken","slice","subjectUid","account","record","customClaims"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,2BAA2B,EAC3BC,gBAAgB,EAChBC,qBAAqB,EACrBC,4BAA4B,EAC5BC,qBAAqB,EACrBC,aAAa,EACbC,oBAAoB,QAKf,sBAAqB;AAC5B,SAASC,wBAAwB,QAAQ,kBAAc;AACvD,SAASC,aAAa,QAAQ,sBAAkB;AAEhD;;;;;;;;;;;CAWC,GAED,MAAMC,SAAS;AAEf,IAAIC;AAGJ,IAAIC;AAIJ,MAAMC,mBAAmB,IACvBC,OAAOC,WAAW,CAChBT,cAAcU,GAAG,CAAC,CAACC,aAAe;YAChCA,WAAWC,GAAG;YACd;gBAAEC,SAASF,WAAWG,cAAc;YAAC;SACtC;AAGL,OAAO,eAAeC;IAGpB,IAAIV,SAASW,KAAKC,GAAG,KAAKZ,MAAMa,EAAE,GAAGd,QAAQ,OAAOC,MAAMc,MAAM;IAChE,IAAI,CAACb,SAAS;QACZA,UAAU,AAAC,CAAA;YACT,MAAMa,SAASZ;YACf,IAAI;gBACF,MAAMa,WAAW,MAAMjB,cAAckB,GAAG,GAAGC,YAAY,GAAGC,WAAW;gBACrE,KAAK,MAAMZ,cAAcX,cAAe;oBACtC,MAAMwB,YAAYJ,SAASK,UAAU,CAACd,WAAWC,GAAG,CAAC;oBACrD,MAAMc,eAAeF,6BAAAA,UAAWE,YAAY;oBAC5C,MAAMC,MACJD,gBAAgB,WAAWA,eACvBA,aAAaE,KAAK,GAClBC;oBACNV,MAAM,CAACR,WAAWC,GAAG,CAAC,GAAGb,sBACvB4B,KACAhB,WAAWG,cAAc;gBAE7B;YACF,EAAE,eAAM;YACN,mEAAmE;YACrE;YACAT,QAAQ;gBAAEa,IAAIF,KAAKC,GAAG;gBAAIE;YAAO;YACjC,OAAOA;QACT,CAAA,IAAKW,OAAO,CAAC;YACXxB,UAAUuB;QACZ;IACF;IACA,OAAOvB;AACT;AAiCA,MAAMyB,WAAW,IAAIC;AAErB;;;;;;;CAOC,GACD,OAAO,eAAeC,2BACpBC,KAAgC;IAEhC,IAAI,CAACA,OAAO,OAAO;QAAEC,WAAW,CAAC;QAAGC,MAAM;IAAK;IAC/C,MAAMC,MAAMN,SAASO,GAAG,CAACJ;IACzB,IAAIG,OAAOrB,KAAKC,GAAG,KAAKoB,IAAInB,EAAE,GAAGd,QAAQ,OAAOiC,IAAIE,SAAS;IAC7D,MAAMA,YAAqC;QAAEJ,WAAW,CAAC;QAAGC,MAAM;IAAK;IACvE,IAAI;QACF,MAAMI,WAAW,MAAMrC,cACpBkB,GAAG,GACHoB,SAAS,GACTC,UAAU,CAAC,QACXC,GAAG,CAACT,OACJI,GAAG;QACN,MAAMM,OAAOJ,SAASI,IAAI;QAC1BL,UAAUJ,SAAS,GAAGrC,6BAA6B8C,wBAAAA,IAAM,CAAC,eAAe;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,IAAIA,MAAML,UAAUH,IAAI,GAAGnC,qBAAqB2C;IAClD,EAAE,eAAM;IACN,qEAAqE;IACvE;IACAb,SAASc,GAAG,CAACX,OAAO;QAAEhB,IAAIF,KAAKC,GAAG;QAAIsB;IAAU;IAChD,OAAOA;AACT;AAEA,OAAO,eAAeO,2BACpBZ,KAAgC;IAEhC,OAAO,AAAC,CAAA,MAAMD,2BAA2BC,MAAK,EAAGC,SAAS;AAC5D;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeY,4BACpBC,OAAuB,EACvBd,KAAgC;IAEhC,MAAM,CAACf,QAAQoB,UAAU,GAAG,MAAMU,QAAQC,GAAG,CAAC;QAC5CnC;QACAkB,2BAA2BC;KAC5B;IACD,OAAOrC,sBACLmD,SACA7B,MAAM,CAAC6B,QAAQ,EACfd,gBAAAA,QAAS,MACTK,UAAUJ,SAAS,EACnBI,UAAUH,IAAI;AAElB;AAEA,iEAAiE,GACjE,OAAO,SAASe;IACd9C,QAAQwB;IACRE,SAASqB,KAAK;AAChB;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,eAAeC,mCACpBC,SAA4B,EAC5BC,OAgBC;QAmBqBA;IAjBtB,MAAM,CAACpC,QAAQoB,UAAU,GAAG,MAAMU,QAAQC,GAAG,CAAC;QAC5CnC;QACAkB,2BAA2BsB,QAAQrB,KAAK;KACzC;IACD,MAAMsB,WAAW,CAACR;YAKVO;eAJN3D,iBAAiBoD,WACbnD,sBACEmD,SACA7B,MAAM,CAAC6B,QAAQ,GACfO,iBAAAA,QAAQrB,KAAK,YAAbqB,iBAAiB,MACjBhB,UAAUJ,SAAS,EACnBI,UAAUH,IAAI,IAEhB;;IACN,MAAMqB,WAAW9D,4BAA4B2D,WAAWE;IACxD,IAAIC,SAASC,MAAM,KAAKJ,UAAUI,MAAM,EAAE,OAAOD;IAEjD,MAAME,iBAAgBJ,yBAAAA,QAAQI,aAAa,YAArBJ,yBAAyB;IAC/C,IAAII,cAAcC,UAAU,CAAC,YAAY;QACvC,IAAI;YACF,MAAMC,UAAU,MAAM1D,cACnBkB,GAAG,GACHyC,IAAI,GACJC,aAAa,CAACJ,cAAcK,KAAK,CAAC,UAAUN,MAAM;YACrD,IAAIG,OAAO,CAAC,QAAQ,KAAK,MAAM,OAAO;mBAAIP;aAAU;QACtD,EAAE,eAAM;QACN,qCAAqC;QACvC;QACA,OAAOG;IACT;IACA,IAAIF,QAAQU,UAAU,EAAE;QACtB,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI;gBAEEC;YADJ,MAAMA,UAAU,MAAMhE,yBAAyBqD,QAAQU,UAAU;YACjE,IAAIC,CAAAA,4BAAAA,+BAAAA,QAASC,MAAM,CAACC,YAAY,qBAA5BF,4BAA8B,CAAC,QAAQ,MAAK,MAAM,OAAO;mBAAIZ;aAAU;QAC7E,EAAE,eAAM;QACN,2CAA2C;QAC7C;IACF;IACA,OAAOG;AACT"}

package/src/lib/server/replay-erasures.d.ts

@@ -0,0 +1,126 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * How long `adminAudit` rows stay queryable before `/api/admin/audit-archive`
+ * moves them to Storage. A replay window older than this cannot be answered
+ * from Firestore at all, which is the one failure mode that must not look
+ * like "nothing to replay".
+ */
+export declare const AUDIT_HOT_WINDOW_MS: number;
+/** What happened to one erasure that had to be re-applied. */
+export interface ReplayedErasure {
+    kind: 'org' | 'user';
+    /** The org id or uid the original erasure destroyed. */
+    id: string;
+    /**
+     * - `replayed` — it had come back and has been erased again.
+     * - `absent` — nothing was resurrected; the restore did not reach it.
+     * - `blocked` — it came back and could NOT be erased again. The reason is
+     *   on `detail`, and this is the outcome a human has to act on.
+     */
+    outcome: 'replayed' | 'absent' | 'blocked';
+    detail?: string;
+}
+export interface ReplayErasuresResult {
+    /** Snapshot instant the restore was taken from — the replay's lower bound. */
+    sinceMs: number;
+    /** True when nothing was written: a plan, not a replay. */
+    dryRun: boolean;
+    /**
+     * Set when the answer cannot be trusted. Today the only value is
+     * `'audit-window'`: `sinceMs` predates the hot `adminAudit` window, so rows
+     * naming erasures inside the restored span may already be in the Storage
+     * archive and this run cannot see them. **An empty list under this warning
+     * is not evidence that there was nothing to replay.**
+     */
+    incomplete?: 'audit-window';
+    /** Audit rows examined. */
+    examined: number;
+    entries: ReplayedErasure[];
+    /** Convenience for the exit code — any `blocked` entry, or `incomplete`. */
+    ok: boolean;
+}
+/**
+ * Re-apply every erasure a restore resurrected (AGL-1975).
+ *
+ * Live DPA §11 promises, in terms: *"a deletion instruction survives any
+ * restoration — data deleted at Customer's instruction and later restored from
+ * a backup will be deleted again."* Nothing implemented it. This does.
+ *
+ * **The reason it is needed is specific, not theoretical.** A Firestore import
+ * is **merge-by-id, not replace** (`docs/DISASTER_RECOVERY.md` Procedures C
+ * and D both say so), so importing a pre-erasure export into `(default)`
+ * silently reinstates every document an erasure deleted — the whole org tree,
+ * the profile, the support threads — alongside the recovery it was actually
+ * run for. It happens during an incident, when nobody is reading a DPA, and
+ * nothing anywhere says it happened.
+ *
+ * **It calls `eraseOrg`/`eraseUser` and implements no cascade of its own.**
+ * That is the AGL-1481 rule and this is exactly the shape it was written for:
+ * a replay tool with its own copy of the sweep list would be a second
+ * implementation of a cascade delete, and the last one drifted within a week —
+ * so a replay would faithfully re-erase the six collections somebody
+ * remembered and quietly leave the four they did not.
+ *
+ * ## The two things that make a naive replay fail
+ *
+ *   1. **`eraseOrg` refuses without a live request.** It re-reads
+ *      `erasureRequestedAt` and the 7-day hold, deliberately, so a stale or
+ *      cancelled request can never delete. A restored org may carry no request
+ *      at all: if the customer asked AFTER the snapshot was taken, the
+ *      resurrected document predates the ask. The audit row is what closes
+ *      that — `after.requestedAt` records which request the original run
+ *      fulfilled — so the request is reinstated at its original instant before
+ *      the erasure is re-run. The hold is satisfied by construction: that
+ *      instant is in the past by at least the hold, or the first erasure would
+ *      not have executed either.
+ *   2. **`eraseUser` refuses an org owner.** A restore can bring back both a
+ *      person and the workspace they owned, and `userErasureBlockers` then
+ *      correctly refuses to cascade. That is reported as `blocked`, never
+ *      forced: cascading here would delete a workspace as a side effect of
+ *      replaying a personal-account erasure, which is precisely the consent
+ *      boundary `eraseUser` exists to hold. Erase the org first — usually it
+ *      has its own audit row in the same list — and run this again.
+ *
+ * ## Why the audit window is a first-class result and not a log line
+ *
+ * The rows this reads are hot for 90 days before the archiver moves them to
+ * Storage. That comfortably covers the 7-day PITR window and the ≤7-day usable
+ * managed backup. It does **not** cover a 90-day-old GCS export, where the
+ * erasure record and the export can age out within days of each other. A
+ * replay over a window that old returns an empty list for two
+ * indistinguishable reasons — nothing was erased, or nothing is left to read —
+ * so it says `incomplete: 'audit-window'` and reports `ok: false`. An empty
+ * list is not the same as a clean bill, and this is the one place that
+ * distinction decides whether a published promise was kept.
+ *
+ * The query is a range on `at` alone, with the action filtered in memory
+ * rather than in the query. `where('action','in',[…]).where('at','>=',…)`
+ * needs a composite index that does not exist, and an erasure replay is not
+ * where anybody should discover a `FAILED_PRECONDITION` — a single-field range
+ * is auto-indexed everywhere, including a freshly restored database whose
+ * composite indexes are still building.
+ */
+export declare function replayErasuresSince(options: {
+    /** The instant the restored snapshot was taken. */
+    sinceMs: number;
+    /** Report what WOULD be re-erased and change nothing. Default true. */
+    dryRun?: boolean;
+    /** Who is answerable, for the new audit rows. */
+    actorUid?: string;
+    now?: number;
+}): Promise<ReplayErasuresResult>;

package/src/lib/server/replay-erasures.js

@@ -0,0 +1,217 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { FieldValue, Timestamp } from "firebase-admin/firestore";
+import { firebaseAdmin } from "./firebase-admin.js";
+import { eraseOrg, eraseUser } from "./erase.js";
+/**
+ * How long `adminAudit` rows stay queryable before `/api/admin/audit-archive`
+ * moves them to Storage. A replay window older than this cannot be answered
+ * from Firestore at all, which is the one failure mode that must not look
+ * like "nothing to replay".
+ */ export const AUDIT_HOT_WINDOW_MS = 90 * 24 * 60 * 60 * 1000;
+/**
+ * Re-apply every erasure a restore resurrected (AGL-1975).
+ *
+ * Live DPA §11 promises, in terms: *"a deletion instruction survives any
+ * restoration — data deleted at Customer's instruction and later restored from
+ * a backup will be deleted again."* Nothing implemented it. This does.
+ *
+ * **The reason it is needed is specific, not theoretical.** A Firestore import
+ * is **merge-by-id, not replace** (`docs/DISASTER_RECOVERY.md` Procedures C
+ * and D both say so), so importing a pre-erasure export into `(default)`
+ * silently reinstates every document an erasure deleted — the whole org tree,
+ * the profile, the support threads — alongside the recovery it was actually
+ * run for. It happens during an incident, when nobody is reading a DPA, and
+ * nothing anywhere says it happened.
+ *
+ * **It calls `eraseOrg`/`eraseUser` and implements no cascade of its own.**
+ * That is the AGL-1481 rule and this is exactly the shape it was written for:
+ * a replay tool with its own copy of the sweep list would be a second
+ * implementation of a cascade delete, and the last one drifted within a week —
+ * so a replay would faithfully re-erase the six collections somebody
+ * remembered and quietly leave the four they did not.
+ *
+ * ## The two things that make a naive replay fail
+ *
+ *   1. **`eraseOrg` refuses without a live request.** It re-reads
+ *      `erasureRequestedAt` and the 7-day hold, deliberately, so a stale or
+ *      cancelled request can never delete. A restored org may carry no request
+ *      at all: if the customer asked AFTER the snapshot was taken, the
+ *      resurrected document predates the ask. The audit row is what closes
+ *      that — `after.requestedAt` records which request the original run
+ *      fulfilled — so the request is reinstated at its original instant before
+ *      the erasure is re-run. The hold is satisfied by construction: that
+ *      instant is in the past by at least the hold, or the first erasure would
+ *      not have executed either.
+ *   2. **`eraseUser` refuses an org owner.** A restore can bring back both a
+ *      person and the workspace they owned, and `userErasureBlockers` then
+ *      correctly refuses to cascade. That is reported as `blocked`, never
+ *      forced: cascading here would delete a workspace as a side effect of
+ *      replaying a personal-account erasure, which is precisely the consent
+ *      boundary `eraseUser` exists to hold. Erase the org first — usually it
+ *      has its own audit row in the same list — and run this again.
+ *
+ * ## Why the audit window is a first-class result and not a log line
+ *
+ * The rows this reads are hot for 90 days before the archiver moves them to
+ * Storage. That comfortably covers the 7-day PITR window and the ≤7-day usable
+ * managed backup. It does **not** cover a 90-day-old GCS export, where the
+ * erasure record and the export can age out within days of each other. A
+ * replay over a window that old returns an empty list for two
+ * indistinguishable reasons — nothing was erased, or nothing is left to read —
+ * so it says `incomplete: 'audit-window'` and reports `ok: false`. An empty
+ * list is not the same as a clean bill, and this is the one place that
+ * distinction decides whether a published promise was kept.
+ *
+ * The query is a range on `at` alone, with the action filtered in memory
+ * rather than in the query. `where('action','in',[…]).where('at','>=',…)`
+ * needs a composite index that does not exist, and an erasure replay is not
+ * where anybody should discover a `FAILED_PRECONDITION` — a single-field range
+ * is auto-indexed everywhere, including a freshly restored database whose
+ * composite indexes are still building.
+ */ export async function replayErasuresSince(options) {
+    const { sinceMs, dryRun = true, actorUid = 'script:replay-erasures', now = Date.now() } = options;
+    const firestore = firebaseAdmin.app().firestore();
+    const incomplete = now - sinceMs > AUDIT_HOT_WINDOW_MS ? 'audit-window' : undefined;
+    const rows = await firestore.collection('adminAudit').where('at', '>=', Timestamp.fromMillis(sinceMs)).orderBy('at', 'asc').get();
+    const entries = [];
+    for (const row of rows.docs){
+        var _row_get, _target_split_, _result_blockers;
+        const action = row.get('action');
+        if (action !== 'org.erased' && action !== 'user.erased') continue;
+        const target = String((_row_get = row.get('target')) != null ? _row_get : '');
+        const kind = action === 'org.erased' ? 'org' : 'user';
+        const id = (_target_split_ = target.split('/')[1]) != null ? _target_split_ : '';
+        if (!id) continue;
+        if (kind === 'org') {
+            var _ref;
+            var _row_get1;
+            const orgRef = firestore.collection('orgs').doc(id);
+            const org = await orgRef.get();
+            if (!org.exists) {
+                entries.push({
+                    kind,
+                    id,
+                    outcome: 'absent'
+                });
+                continue;
+            }
+            // Which request the original run fulfilled. Without it a restored org
+            // that was never asked to be erased before the snapshot is refused with
+            // `no-request` — the erasure would silently not replay.
+            const requestedAt = Number((_ref = (_row_get1 = row.get('after')) == null ? void 0 : _row_get1.requestedAt) != null ? _ref : 0);
+            if (dryRun) {
+                entries.push({
+                    kind,
+                    id,
+                    outcome: 'replayed',
+                    detail: 'would re-erase (plan)'
+                });
+                continue;
+            }
+            if (requestedAt) {
+                await orgRef.set({
+                    erasureRequestedAt: Timestamp.fromMillis(requestedAt)
+                }, {
+                    merge: true
+                });
+            }
+            const result = await eraseOrg(id, {
+                actorUid
+            });
+            entries.push(result.ok ? {
+                kind,
+                id,
+                outcome: 'replayed'
+            } : {
+                kind,
+                id,
+                outcome: 'blocked',
+                detail: result.skippedReason
+            });
+            continue;
+        }
+        // A person. `profiles/{uid}` is checked as well as `users/{uid}`: the
+        // public identity is a separate top-level document (AGL-1970), so a
+        // restore can bring it back on its own.
+        const [user, profile] = await Promise.all([
+            firestore.collection('users').doc(id).get(),
+            firestore.collection('profiles').doc(id).get()
+        ]);
+        if (!user.exists && !profile.exists) {
+            entries.push({
+                kind,
+                id,
+                outcome: 'absent'
+            });
+            continue;
+        }
+        if (dryRun) {
+            entries.push({
+                kind,
+                id,
+                outcome: 'replayed',
+                detail: 'would re-erase (plan)'
+            });
+            continue;
+        }
+        const result = await eraseUser(id);
+        entries.push(result.ok ? {
+            kind,
+            id,
+            outcome: 'replayed'
+        } : {
+            kind,
+            id,
+            outcome: 'blocked',
+            // `owns-orgs` is the one a human has to act on: erase the
+            // workspace first, then run this again.
+            detail: result.skippedReason === 'owns-orgs' ? `owns-orgs (${((_result_blockers = result.blockers) != null ? _result_blockers : []).map((blocker)=>blocker.orgId).join(', ')})` : result.skippedReason
+        });
+    }
+    const blocked = entries.some((entry)=>entry.outcome === 'blocked');
+    // A record that the promise was kept — or that it could not be. Written on
+    // a real run only: a plan did not replay anything, and an audit row saying
+    // it did is the mistake this shape has to make impossible.
+    if (!dryRun) {
+        await firestore.collection('adminAudit').add({
+            actorUid,
+            action: 'erasures.replayed',
+            target: `restore/${new Date(sinceMs).toISOString()}`,
+            before: {
+                examined: rows.size
+            },
+            after: {
+                sinceMs,
+                incomplete: incomplete != null ? incomplete : null,
+                replayed: entries.filter((e)=>e.outcome === 'replayed').length,
+                absent: entries.filter((e)=>e.outcome === 'absent').length,
+                blocked: entries.filter((e)=>e.outcome === 'blocked').length
+            },
+            at: FieldValue.serverTimestamp()
+        }).catch(()=>undefined);
+    }
+    return {
+        sinceMs,
+        dryRun,
+        incomplete,
+        examined: rows.size,
+        entries,
+        ok: !blocked && !incomplete
+    };
+}
+
+//# sourceMappingURL=replay-erasures.js.map

package/src/lib/server/replay-erasures.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/replay-erasures.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { FieldValue, Timestamp } from 'firebase-admin/firestore'\nimport { firebaseAdmin } from './firebase-admin'\nimport { eraseOrg, eraseUser } from './erase'\n\n/**\n * How long `adminAudit` rows stay queryable before `/api/admin/audit-archive`\n * moves them to Storage. A replay window older than this cannot be answered\n * from Firestore at all, which is the one failure mode that must not look\n * like \"nothing to replay\".\n */\nexport const AUDIT_HOT_WINDOW_MS = 90 * 24 * 60 * 60 * 1000\n\n/** What happened to one erasure that had to be re-applied. */\nexport interface ReplayedErasure {\n  kind: 'org' | 'user'\n  /** The org id or uid the original erasure destroyed. */\n  id: string\n  /**\n   * - `replayed` — it had come back and has been erased again.\n   * - `absent` — nothing was resurrected; the restore did not reach it.\n   * - `blocked` — it came back and could NOT be erased again. The reason is\n   *   on `detail`, and this is the outcome a human has to act on.\n   */\n  outcome: 'replayed' | 'absent' | 'blocked'\n  detail?: string\n}\n\nexport interface ReplayErasuresResult {\n  /** Snapshot instant the restore was taken from — the replay's lower bound. */\n  sinceMs: number\n  /** True when nothing was written: a plan, not a replay. */\n  dryRun: boolean\n  /**\n   * Set when the answer cannot be trusted. Today the only value is\n   * `'audit-window'`: `sinceMs` predates the hot `adminAudit` window, so rows\n   * naming erasures inside the restored span may already be in the Storage\n   * archive and this run cannot see them. **An empty list under this warning\n   * is not evidence that there was nothing to replay.**\n   */\n  incomplete?: 'audit-window'\n  /** Audit rows examined. */\n  examined: number\n  entries: ReplayedErasure[]\n  /** Convenience for the exit code — any `blocked` entry, or `incomplete`. */\n  ok: boolean\n}\n\n/**\n * Re-apply every erasure a restore resurrected (AGL-1975).\n *\n * Live DPA §11 promises, in terms: *\"a deletion instruction survives any\n * restoration — data deleted at Customer's instruction and later restored from\n * a backup will be deleted again.\"* Nothing implemented it. This does.\n *\n * **The reason it is needed is specific, not theoretical.** A Firestore import\n * is **merge-by-id, not replace** (`docs/DISASTER_RECOVERY.md` Procedures C\n * and D both say so), so importing a pre-erasure export into `(default)`\n * silently reinstates every document an erasure deleted — the whole org tree,\n * the profile, the support threads — alongside the recovery it was actually\n * run for. It happens during an incident, when nobody is reading a DPA, and\n * nothing anywhere says it happened.\n *\n * **It calls `eraseOrg`/`eraseUser` and implements no cascade of its own.**\n * That is the AGL-1481 rule and this is exactly the shape it was written for:\n * a replay tool with its own copy of the sweep list would be a second\n * implementation of a cascade delete, and the last one drifted within a week —\n * so a replay would faithfully re-erase the six collections somebody\n * remembered and quietly leave the four they did not.\n *\n * ## The two things that make a naive replay fail\n *\n *   1. **`eraseOrg` refuses without a live request.** It re-reads\n *      `erasureRequestedAt` and the 7-day hold, deliberately, so a stale or\n *      cancelled request can never delete. A restored org may carry no request\n *      at all: if the customer asked AFTER the snapshot was taken, the\n *      resurrected document predates the ask. The audit row is what closes\n *      that — `after.requestedAt` records which request the original run\n *      fulfilled — so the request is reinstated at its original instant before\n *      the erasure is re-run. The hold is satisfied by construction: that\n *      instant is in the past by at least the hold, or the first erasure would\n *      not have executed either.\n *   2. **`eraseUser` refuses an org owner.** A restore can bring back both a\n *      person and the workspace they owned, and `userErasureBlockers` then\n *      correctly refuses to cascade. That is reported as `blocked`, never\n *      forced: cascading here would delete a workspace as a side effect of\n *      replaying a personal-account erasure, which is precisely the consent\n *      boundary `eraseUser` exists to hold. Erase the org first — usually it\n *      has its own audit row in the same list — and run this again.\n *\n * ## Why the audit window is a first-class result and not a log line\n *\n * The rows this reads are hot for 90 days before the archiver moves them to\n * Storage. That comfortably covers the 7-day PITR window and the ≤7-day usable\n * managed backup. It does **not** cover a 90-day-old GCS export, where the\n * erasure record and the export can age out within days of each other. A\n * replay over a window that old returns an empty list for two\n * indistinguishable reasons — nothing was erased, or nothing is left to read —\n * so it says `incomplete: 'audit-window'` and reports `ok: false`. An empty\n * list is not the same as a clean bill, and this is the one place that\n * distinction decides whether a published promise was kept.\n *\n * The query is a range on `at` alone, with the action filtered in memory\n * rather than in the query. `where('action','in',[…]).where('at','>=',…)`\n * needs a composite index that does not exist, and an erasure replay is not\n * where anybody should discover a `FAILED_PRECONDITION` — a single-field range\n * is auto-indexed everywhere, including a freshly restored database whose\n * composite indexes are still building.\n */\nexport async function replayErasuresSince(options: {\n  /** The instant the restored snapshot was taken. */\n  sinceMs: number\n  /** Report what WOULD be re-erased and change nothing. Default true. */\n  dryRun?: boolean\n  /** Who is answerable, for the new audit rows. */\n  actorUid?: string\n  now?: number\n}): Promise<ReplayErasuresResult> {\n  const {\n    sinceMs,\n    dryRun = true,\n    actorUid = 'script:replay-erasures',\n    now = Date.now(),\n  } = options\n  const firestore = firebaseAdmin.app().firestore()\n\n  const incomplete =\n    now - sinceMs > AUDIT_HOT_WINDOW_MS ? ('audit-window' as const) : undefined\n\n  const rows = await firestore\n    .collection('adminAudit')\n    .where('at', '>=', Timestamp.fromMillis(sinceMs))\n    .orderBy('at', 'asc')\n    .get()\n\n  const entries: ReplayedErasure[] = []\n  for (const row of rows.docs) {\n    const action = row.get('action') as string | undefined\n    if (action !== 'org.erased' && action !== 'user.erased') continue\n    const target = String(row.get('target') ?? '')\n    const kind = action === 'org.erased' ? 'org' : 'user'\n    const id = target.split('/')[1] ?? ''\n    if (!id) continue\n\n    if (kind === 'org') {\n      const orgRef = firestore.collection('orgs').doc(id)\n      const org = await orgRef.get()\n      if (!org.exists) {\n        entries.push({ kind, id, outcome: 'absent' })\n        continue\n      }\n      // Which request the original run fulfilled. Without it a restored org\n      // that was never asked to be erased before the snapshot is refused with\n      // `no-request` — the erasure would silently not replay.\n      const requestedAt = Number(row.get('after')?.requestedAt ?? 0)\n      if (dryRun) {\n        entries.push({\n          kind,\n          id,\n          outcome: 'replayed',\n          detail: 'would re-erase (plan)',\n        })\n        continue\n      }\n      if (requestedAt) {\n        await orgRef.set(\n          { erasureRequestedAt: Timestamp.fromMillis(requestedAt) },\n          { merge: true },\n        )\n      }\n      const result = await eraseOrg(id, { actorUid })\n      entries.push(\n        result.ok\n          ? { kind, id, outcome: 'replayed' }\n          : { kind, id, outcome: 'blocked', detail: result.skippedReason },\n      )\n      continue\n    }\n\n    // A person. `profiles/{uid}` is checked as well as `users/{uid}`: the\n    // public identity is a separate top-level document (AGL-1970), so a\n    // restore can bring it back on its own.\n    const [user, profile] = await Promise.all([\n      firestore.collection('users').doc(id).get(),\n      firestore.collection('profiles').doc(id).get(),\n    ])\n    if (!user.exists && !profile.exists) {\n      entries.push({ kind, id, outcome: 'absent' })\n      continue\n    }\n    if (dryRun) {\n      entries.push({\n        kind,\n        id,\n        outcome: 'replayed',\n        detail: 'would re-erase (plan)',\n      })\n      continue\n    }\n    const result = await eraseUser(id)\n    entries.push(\n      result.ok\n        ? { kind, id, outcome: 'replayed' }\n        : {\n            kind,\n            id,\n            outcome: 'blocked',\n            // `owns-orgs` is the one a human has to act on: erase the\n            // workspace first, then run this again.\n            detail:\n              result.skippedReason === 'owns-orgs'\n                ? `owns-orgs (${(result.blockers ?? [])\n                    .map((blocker) => blocker.orgId)\n                    .join(', ')})`\n                : result.skippedReason,\n          },\n    )\n  }\n\n  const blocked = entries.some((entry) => entry.outcome === 'blocked')\n\n  // A record that the promise was kept — or that it could not be. Written on\n  // a real run only: a plan did not replay anything, and an audit row saying\n  // it did is the mistake this shape has to make impossible.\n  if (!dryRun) {\n    await firestore\n      .collection('adminAudit')\n      .add({\n        actorUid,\n        action: 'erasures.replayed',\n        target: `restore/${new Date(sinceMs).toISOString()}`,\n        before: { examined: rows.size },\n        after: {\n          sinceMs,\n          incomplete: incomplete ?? null,\n          replayed: entries.filter((e) => e.outcome === 'replayed').length,\n          absent: entries.filter((e) => e.outcome === 'absent').length,\n          blocked: entries.filter((e) => e.outcome === 'blocked').length,\n        },\n        at: FieldValue.serverTimestamp(),\n      })\n      .catch(() => undefined)\n  }\n\n  return {\n    sinceMs,\n    dryRun,\n    incomplete,\n    examined: rows.size,\n    entries,\n    ok: !blocked && !incomplete,\n  }\n}\n"],"names":["FieldValue","Timestamp","firebaseAdmin","eraseOrg","eraseUser","AUDIT_HOT_WINDOW_MS","replayErasuresSince","options","sinceMs","dryRun","actorUid","now","Date","firestore","app","incomplete","undefined","rows","collection","where","fromMillis","orderBy","get","entries","row","docs","target","result","action","String","kind","id","split","orgRef","doc","org","exists","push","outcome","requestedAt","Number","detail","set","erasureRequestedAt","merge","ok","skippedReason","user","profile","Promise","all","blockers","map","blocker","orgId","join","blocked","some","entry","add","toISOString","before","examined","size","after","replayed","filter","e","length","absent","at","serverTimestamp","catch"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,EAAEC,SAAS,QAAQ,2BAA0B;AAChE,SAASC,aAAa,QAAQ,sBAAkB;AAChD,SAASC,QAAQ,EAAEC,SAAS,QAAQ,aAAS;AAE7C;;;;;CAKC,GACD,OAAO,MAAMC,sBAAsB,KAAK,KAAK,KAAK,KAAK,KAAI;AAqC3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4DC,GACD,OAAO,eAAeC,oBAAoBC,OAQzC;IACC,MAAM,EACJC,OAAO,EACPC,SAAS,IAAI,EACbC,WAAW,wBAAwB,EACnCC,MAAMC,KAAKD,GAAG,EAAE,EACjB,GAAGJ;IACJ,MAAMM,YAAYX,cAAcY,GAAG,GAAGD,SAAS;IAE/C,MAAME,aACJJ,MAAMH,UAAUH,sBAAuB,iBAA2BW;IAEpE,MAAMC,OAAO,MAAMJ,UAChBK,UAAU,CAAC,cACXC,KAAK,CAAC,MAAM,MAAMlB,UAAUmB,UAAU,CAACZ,UACvCa,OAAO,CAAC,MAAM,OACdC,GAAG;IAEN,MAAMC,UAA6B,EAAE;IACrC,KAAK,MAAMC,OAAOP,KAAKQ,IAAI,CAAE;YAGLD,UAEXE,gBAsEkBC;QA1E7B,MAAMC,SAASJ,IAAIF,GAAG,CAAC;QACvB,IAAIM,WAAW,gBAAgBA,WAAW,eAAe;QACzD,MAAMF,SAASG,QAAOL,WAAAA,IAAIF,GAAG,CAAC,qBAARE,WAAqB;QAC3C,MAAMM,OAAOF,WAAW,eAAe,QAAQ;QAC/C,MAAMG,MAAKL,iBAAAA,OAAOM,KAAK,CAAC,IAAI,CAAC,EAAE,YAApBN,iBAAwB;QACnC,IAAI,CAACK,IAAI;QAET,IAAID,SAAS,OAAO;;gBAUSN;YAT3B,MAAMS,SAASpB,UAAUK,UAAU,CAAC,QAAQgB,GAAG,CAACH;YAChD,MAAMI,MAAM,MAAMF,OAAOX,GAAG;YAC5B,IAAI,CAACa,IAAIC,MAAM,EAAE;gBACfb,QAAQc,IAAI,CAAC;oBAAEP;oBAAMC;oBAAIO,SAAS;gBAAS;gBAC3C;YACF;YACA,sEAAsE;YACtE,wEAAwE;YACxE,wDAAwD;YACxD,MAAMC,cAAcC,gBAAOhB,YAAAA,IAAIF,GAAG,CAAC,6BAARE,UAAkBe,WAAW,mBAAI;YAC5D,IAAI9B,QAAQ;gBACVc,QAAQc,IAAI,CAAC;oBACXP;oBACAC;oBACAO,SAAS;oBACTG,QAAQ;gBACV;gBACA;YACF;YACA,IAAIF,aAAa;gBACf,MAAMN,OAAOS,GAAG,CACd;oBAAEC,oBAAoB1C,UAAUmB,UAAU,CAACmB;gBAAa,GACxD;oBAAEK,OAAO;gBAAK;YAElB;YACA,MAAMjB,SAAS,MAAMxB,SAAS4B,IAAI;gBAAErB;YAAS;YAC7Ca,QAAQc,IAAI,CACVV,OAAOkB,EAAE,GACL;gBAAEf;gBAAMC;gBAAIO,SAAS;YAAW,IAChC;gBAAER;gBAAMC;gBAAIO,SAAS;gBAAWG,QAAQd,OAAOmB,aAAa;YAAC;YAEnE;QACF;QAEA,sEAAsE;QACtE,oEAAoE;QACpE,wCAAwC;QACxC,MAAM,CAACC,MAAMC,QAAQ,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACxCrC,UAAUK,UAAU,CAAC,SAASgB,GAAG,CAACH,IAAIT,GAAG;YACzCT,UAAUK,UAAU,CAAC,YAAYgB,GAAG,CAACH,IAAIT,GAAG;SAC7C;QACD,IAAI,CAACyB,KAAKX,MAAM,IAAI,CAACY,QAAQZ,MAAM,EAAE;YACnCb,QAAQc,IAAI,CAAC;gBAAEP;gBAAMC;gBAAIO,SAAS;YAAS;YAC3C;QACF;QACA,IAAI7B,QAAQ;YACVc,QAAQc,IAAI,CAAC;gBACXP;gBACAC;gBACAO,SAAS;gBACTG,QAAQ;YACV;YACA;QACF;QACA,MAAMd,SAAS,MAAMvB,UAAU2B;QAC/BR,QAAQc,IAAI,CACVV,OAAOkB,EAAE,GACL;YAAEf;YAAMC;YAAIO,SAAS;QAAW,IAChC;YACER;YACAC;YACAO,SAAS;YACT,0DAA0D;YAC1D,wCAAwC;YACxCG,QACEd,OAAOmB,aAAa,KAAK,cACrB,CAAC,WAAW,EAAE,EAACnB,mBAAAA,OAAOwB,QAAQ,YAAfxB,mBAAmB,EAAE,EACjCyB,GAAG,CAAC,CAACC,UAAYA,QAAQC,KAAK,EAC9BC,IAAI,CAAC,MAAM,CAAC,CAAC,GAChB5B,OAAOmB,aAAa;QAC5B;IAER;IAEA,MAAMU,UAAUjC,QAAQkC,IAAI,CAAC,CAACC,QAAUA,MAAMpB,OAAO,KAAK;IAE1D,2EAA2E;IAC3E,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,CAAC7B,QAAQ;QACX,MAAMI,UACHK,UAAU,CAAC,cACXyC,GAAG,CAAC;YACHjD;YACAkB,QAAQ;YACRF,QAAQ,CAAC,QAAQ,EAAE,IAAId,KAAKJ,SAASoD,WAAW,IAAI;YACpDC,QAAQ;gBAAEC,UAAU7C,KAAK8C,IAAI;YAAC;YAC9BC,OAAO;gBACLxD;gBACAO,UAAU,EAAEA,qBAAAA,aAAc;gBAC1BkD,UAAU1C,QAAQ2C,MAAM,CAAC,CAACC,IAAMA,EAAE7B,OAAO,KAAK,YAAY8B,MAAM;gBAChEC,QAAQ9C,QAAQ2C,MAAM,CAAC,CAACC,IAAMA,EAAE7B,OAAO,KAAK,UAAU8B,MAAM;gBAC5DZ,SAASjC,QAAQ2C,MAAM,CAAC,CAACC,IAAMA,EAAE7B,OAAO,KAAK,WAAW8B,MAAM;YAChE;YACAE,IAAItE,WAAWuE,eAAe;QAChC,GACCC,KAAK,CAAC,IAAMxD;IACjB;IAEA,OAAO;QACLR;QACAC;QACAM;QACA+C,UAAU7C,KAAK8C,IAAI;QACnBxC;QACAsB,IAAI,CAACW,WAAW,CAACzC;IACnB;AACF"}