@aglyn/tenant-data-admin 1.0.0-beta.221 → 1.0.0-beta.222

package/src/lib/server/erase-person.d.ts

@@ -25,36 +25,24 @@ export interface ErasePersonOptions {
     now?: number;
 }
 /**
- * Counts, never identities: this is what the request document and the
- * audit row record, and both are read by people who must not learn the
- * address from them.
+ * Counts, never identities: this is what the request document and the audit
+ * row record, and both are read by people who must not learn the address
+ * from them.
  */
 export interface ErasePersonCounts {
     /** Sites in the workspace the sweep walked. */
     hosts: number;
     /** Suppression rows written, one per site. */
     hostsSuppressed: number;
-    /** Contact documents deleted — the row every site shared. */
-    contacts: number;
-    /** Companies whose contact count moved down. */
-    companyLinks: number;
-    /** Deals whose `contactId` was removed. */
-    deals: number;
-    tasks: number;
-    activities: number;
-    /** `hosts/{hostId}/leads/{personKey}` rows deleted. */
-    leads: number;
-    /** Audience-list member rows deleted, across every list. */
-    listMemberships: number;
-    /** Orders with the buyer's identity removed; the record stays. */
-    orders: number;
-    /** Bookings with the person's identity removed; the record stays. */
-    bookings: number;
+    /** The person's records the record system named, by count. */
+    records: number;
     /** Delivery-log messages deleted under the address. */
     emailDeliveries: number;
     /**
-     * Each plugin's share (AGL-2981), by plugin id: its eraser's own counts,
-     * or `null` for an eraser that failed — its data may remain.
+     * Each plugin's share (AGL-2981, AGL-3080), by plugin id: its eraser's own
+     * counts — the record system's people, a shop's orders, a calendar's
+     * bookings, an audience's members — or `null` for an eraser that failed:
+     * its data may remain.
      */
     plugins: Record<string, PluginPersonErasureReport | null>;
 }
@@ -67,50 +55,42 @@ export type ErasePersonResult = ({
 /**
  * Remove one person from one workspace (AGL-2623).
  *
- * `planContactDetach` is deliberately not consulted: the CRM's delete is a
- * detach that leaves the row for the other holders, and this is the act
- * that must not. The contact document goes whole — every site's facet,
- * every consent entry, every attribution — and with it everything the
- * workspace keeps beside the person.
+ * The platform's part is the door and the log; everything the workspace keeps
+ * ABOUT the person is a plugin's, erased through `plugin-person-erasure`.
  *
  * ## Order
  *
- *   1. **Suppress first.** One row per site on the per-site suppression
- *      list, before any delete: a form filled in while the sweep runs must
- *      already find the door closed, or the sweep deletes a row that the
- *      capture re-creates a moment later.
- *   2. The plugins' share: every eraser registered on
- *      `plugin-person-erasure`, handed the address, its key and the ids of
- *      the contacts about to go, while those documents still exist.
- *   3. The contact and its satellites — company counts, deals unlinked,
- *      tasks and activities deleted — by the contact's id, then the
- *      document itself.
- *   4. Leads, list memberships, orders and bookings by the address, on
- *      every site of the workspace.
- *   5. The delivery log, last: it is filed under the address alone, and the
- *      tombstone it leaves is what keeps a later import from refilling it.
+ *   1. **Suppress first.** One row per site on the per-site suppression list,
+ *      before any delete: a form filled in while the sweep runs must already
+ *      find the door closed, or the sweep deletes a row that the capture
+ *      re-creates a moment later.
+ *   2. **The plugins' shares** (`runPluginPersonErasure`): the plugin that
+ *      keeps people names the person's records; every other plugin erases
+ *      what it keeps — keyed by those records or by the address — and the
+ *      record system erases the records themselves last. A share the
+ *      erasure promises is REQUIRED: a missing one refuses the erasure before
+ *      anything is erased, and a failed one fails it after the rest ran, so
+ *      the job retries rather than reporting a person erased who is not.
+ *   3. **The delivery log**, last: it is filed under the address alone, and
+ *      the tombstone it leaves is what keeps a later import from refilling it.
  *
  * ## What is anonymized rather than deleted
  *
- * An order is the merchant's record of a sale and a booking of an
- * appointment; the amounts, the line items and the tax are theirs to keep
- * and the law expects them kept. The person is taken OFF those records —
- * name, email, phone, addresses — and a stamp says when. A deal is the
- * team's own pipeline record and is unlinked. Everything else that names
- * the person is about the person and is deleted.
+ * Each plugin's own business: an order is the merchant's record of a sale
+ * and a booking of an appointment, and the law expects them kept, so the
+ * person is taken OFF them; a deal is the team's pipeline record and is
+ * unlinked. Everything else that names the person is about the person and is
+ * deleted. `PERSON_ERASURE_REMOVES` / `RETAINS` say so to the admin.
  *
  * ## What is not reached, and why
  *
  * A form submission keeps the address inside `fields`, under whatever the
  * form called it — there is no key to query by and a scan of every
- * submission on every site is unbounded. A site member's login is their
- * own account. A subscription carries the address it bills, and a live one
- * cannot be anonymized without breaking its receipts. Each is named to the
- * admin by the dialog so they can finish by hand.
+ * submission on every site is unbounded. A site member's login is their own
+ * account. Each is named to the admin by the dialog so they can finish by
+ * hand.
  *
- * Every sweep is best-effort against the others: a failure in one is
- * logged and counted as zero, and the request's counts say what happened.
- * The caller decides whether zero contacts on a person it could see is a
- * failure to retry.
+ * The suppression and the log are best-effort against each other: a failure
+ * in one is logged and counted as zero, and the counts say what happened.
  */
 export declare function erasePerson(options: ErasePersonOptions): Promise<ErasePersonResult>;

package/src/lib/server/erase-person.js

@@ -18,71 +18,53 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
 // The leaves, not the barrel — see `email-suppression.ts` for why: a spec
 // of this sweep substitutes a store, not the pure helpers it leans on.
 import { normalizeContactEmail } from "@aglyn/aglyn/app-utils/contacts";
-import { CRM_COLLECTIONS } from "@aglyn/aglyn/app-utils/crm";
 import { personKey } from "@aglyn/aglyn/app-utils/person-key";
-import { runPluginPersonErasers } from "@aglyn/aglyn/plugin-manager/plugin-person-erasure";
-import { runPluginEventHandlers } from "@aglyn/aglyn/plugin-manager/plugin-events";
-import { companyContactsCountFields } from "./contact-company-link.js";
+import { missingRequiredPersonErasersAfterRepair, runPluginPersonErasure } from "@aglyn/aglyn/plugin-manager/plugin-person-erasure";
 import { eraseEmailDeliveriesForAddresses } from "./email-delivery-log.js";
 import { suppressEmailForHostErasure } from "./email-suppression.js";
 import firebaseAdmin from "./firebase-admin.js";
-import { listMemberDocIds } from "./list-members.js";
 import { addAdminAudit } from "./admin-audit-write.js";
 const defaultFirestore = ()=>firebaseAdmin.app().firestore();
-/** Firestore caps a batch at 500 writes; a page under it keeps a margin. */ const PAGE = 400;
-/**
- * A pathological collection must not hold the erasure open indefinitely:
- * twenty pages of four hundred is eight thousand rows of one kind for one
- * person, past anything a real relationship produces.
- */ const MAX_PAGES = 20;
 /**
  * Remove one person from one workspace (AGL-2623).
  *
- * `planContactDetach` is deliberately not consulted: the CRM's delete is a
- * detach that leaves the row for the other holders, and this is the act
- * that must not. The contact document goes whole — every site's facet,
- * every consent entry, every attribution — and with it everything the
- * workspace keeps beside the person.
+ * The platform's part is the door and the log; everything the workspace keeps
+ * ABOUT the person is a plugin's, erased through `plugin-person-erasure`.
  *
  * ## Order
  *
- *   1. **Suppress first.** One row per site on the per-site suppression
- *      list, before any delete: a form filled in while the sweep runs must
- *      already find the door closed, or the sweep deletes a row that the
- *      capture re-creates a moment later.
- *   2. The plugins' share: every eraser registered on
- *      `plugin-person-erasure`, handed the address, its key and the ids of
- *      the contacts about to go, while those documents still exist.
- *   3. The contact and its satellites — company counts, deals unlinked,
- *      tasks and activities deleted — by the contact's id, then the
- *      document itself.
- *   4. Leads, list memberships, orders and bookings by the address, on
- *      every site of the workspace.
- *   5. The delivery log, last: it is filed under the address alone, and the
- *      tombstone it leaves is what keeps a later import from refilling it.
+ *   1. **Suppress first.** One row per site on the per-site suppression list,
+ *      before any delete: a form filled in while the sweep runs must already
+ *      find the door closed, or the sweep deletes a row that the capture
+ *      re-creates a moment later.
+ *   2. **The plugins' shares** (`runPluginPersonErasure`): the plugin that
+ *      keeps people names the person's records; every other plugin erases
+ *      what it keeps — keyed by those records or by the address — and the
+ *      record system erases the records themselves last. A share the
+ *      erasure promises is REQUIRED: a missing one refuses the erasure before
+ *      anything is erased, and a failed one fails it after the rest ran, so
+ *      the job retries rather than reporting a person erased who is not.
+ *   3. **The delivery log**, last: it is filed under the address alone, and
+ *      the tombstone it leaves is what keeps a later import from refilling it.
  *
  * ## What is anonymized rather than deleted
  *
- * An order is the merchant's record of a sale and a booking of an
- * appointment; the amounts, the line items and the tax are theirs to keep
- * and the law expects them kept. The person is taken OFF those records —
- * name, email, phone, addresses — and a stamp says when. A deal is the
- * team's own pipeline record and is unlinked. Everything else that names
- * the person is about the person and is deleted.
+ * Each plugin's own business: an order is the merchant's record of a sale
+ * and a booking of an appointment, and the law expects them kept, so the
+ * person is taken OFF them; a deal is the team's pipeline record and is
+ * unlinked. Everything else that names the person is about the person and is
+ * deleted. `PERSON_ERASURE_REMOVES` / `RETAINS` say so to the admin.
  *
  * ## What is not reached, and why
  *
  * A form submission keeps the address inside `fields`, under whatever the
  * form called it — there is no key to query by and a scan of every
- * submission on every site is unbounded. A site member's login is their
- * own account. A subscription carries the address it bills, and a live one
- * cannot be anonymized without breaking its receipts. Each is named to the
- * admin by the dialog so they can finish by hand.
+ * submission on every site is unbounded. A site member's login is their own
+ * account. Each is named to the admin by the dialog so they can finish by
+ * hand.
  *
- * Every sweep is best-effort against the others: a failure in one is
- * logged and counted as zero, and the request's counts say what happened.
- * The caller decides whether zero contacts on a person it could see is a
- * failure to retry.
+ * The suppression and the log are best-effort against each other: a failure
+ * in one is logged and counted as zero, and the counts say what happened.
  */ export async function erasePerson(options) {
     var _options_firestore, _options_now;
     const email = normalizeContactEmail(options.email);
@@ -92,20 +74,19 @@ const defaultFirestore = ()=>firebaseAdmin.app().firestore();
         skippedReason: 'invalid-email'
     };
     const db = (_options_firestore = options.firestore) != null ? _options_firestore : defaultFirestore();
-    const now = (_options_now = options.now) != null ? _options_now : Date.now();
-    const orgRef = db.collection('orgs').doc(options.orgId);
+    /*
+   * A share the erasure promises that this process cannot run — even after
+   * its boot step has run once more — refuses the whole erasure BEFORE it
+   * writes anything: the request stays queued for a process whose boot
+   * registered it, rather than reporting a person erased who is still on file.
+   */ const missing = await missingRequiredPersonErasersAfterRepair();
+    if (missing.length) {
+        throw new Error(`erasePerson refused: ${missing.join(', ')} declared a required person eraser ` + 'and none is registered in this process');
+    }
     const counts = {
         hosts: 0,
         hostsSuppressed: 0,
-        contacts: 0,
-        companyLinks: 0,
-        deals: 0,
-        tasks: 0,
-        activities: 0,
-        leads: 0,
-        listMemberships: 0,
-        orders: 0,
-        bookings: 0,
+        records: 0,
         emailDeliveries: 0,
         plugins: {}
     };
@@ -124,151 +105,18 @@ const defaultFirestore = ()=>firebaseAdmin.app().firestore();
             console.error(`erasePerson: suppression write failed for ${hostId}`, error);
         }
     }
-    const contacts = await orgRef.collection('contacts').where('email', '==', email).get();
-    // What the plugins keep about the person (AGL-2981): records filed under
-    // the organization by the contact or by the address, which none of the
-    // sweeps here can see. Every site's door is already closed above, and
-    // the contacts are still there for an eraser that reads one. Isolated
-    // per plugin: one that fails is recorded as `null` and the erasure goes
-    // on. This erasure has no plan of its own, so it is never a dry run.
-    counts.plugins = await runPluginPersonErasers({
+    // Every site's door is already closed above. This erasure has no plan of
+    // its own, so it is never a dry run. A required share that is missing or
+    // failed THROWS here, and the request stays queued for the next run.
+    const shares = await runPluginPersonErasure({
         orgId: options.orgId,
         email,
         key,
-        contactIds: contacts.docs.map((contact)=>String(contact.id)),
-        dryRun: false
+        dryRun: false,
+        atMs: (_options_now = options.now) != null ? _options_now : Date.now()
     });
-    for (const contact of contacts.docs){
-        const contactId = String(contact.id);
-        const companyIds = contact.get('companyIds');
-        const linked = Array.isArray(companyIds) ? companyIds.filter((id)=>typeof id === 'string' && !!id) : [];
-        for (const companyId of new Set(linked)){
-            try {
-                await orgRef.collection(CRM_COLLECTIONS.companies).doc(companyId).update(companyContactsCountFields(-1));
-                counts.companyLinks += 1;
-            } catch (error) {
-                console.error(`erasePerson: company count could not move for ${companyId}`, error);
-            }
-        }
-        counts.deals += await updateWhere(db, orgRef.collection(CRM_COLLECTIONS.deals), 'contactId', contactId, {
-            contactId: FieldValue.delete(),
-            updatedAt: FieldValue.serverTimestamp()
-        });
-        counts.tasks += await deleteWhere(db, orgRef.collection(CRM_COLLECTIONS.tasks), 'contactId', contactId);
-        counts.activities += await deleteWhere(db, orgRef.collection(CRM_COLLECTIONS.activities), 'contactId', contactId);
-        try {
-            await contact.ref.delete();
-            counts.contacts += 1;
-        } catch (error) {
-            console.error(`erasePerson: contact delete failed for ${contactId}`, error);
-        }
-    }
-    const erasedOrder = {
-        customerEmail: null,
-        customerName: null,
-        shippingAddress: FieldValue.delete(),
-        billingAddress: FieldValue.delete(),
-        customerErasedAtMs: now
-    };
-    /*
-   * The address also lives in what the orders list queries by (AGL-3321):
-   * its lower-cased key, its search prefixes, and the quick search's token
-   * array, which holds those prefixes beside the order number's and the item
-   * names'. The first two go; the prefixes are taken back out of the third.
-   * A prefix the number or an item name shares with the address goes with
-   * it — a search for that prefix misses this order until the orders
-   * backfill restamps it — and nothing left on the order answers to the
-   * address.
-   */ const erasedOrderFor = (data)=>{
-        const addressTokens = new Set(Array.isArray(data == null ? void 0 : data.customerEmailTokens) ? data.customerEmailTokens : []);
-        return _extends({}, erasedOrder, {
-            customerEmailLower: null,
-            customerEmailTokens: []
-        }, Array.isArray(data == null ? void 0 : data.searchTokens) ? {
-            searchTokens: data.searchTokens.filter((token)=>!addressTokens.has(token))
-        } : {});
-    };
-    const erasedBooking = {
-        email: null,
-        name: FieldValue.delete(),
-        phone: FieldValue.delete(),
-        customerErasedAtMs: now
-    };
-    /*
-   * THE ORG ROW, ONCE (AGL-3275) — and then every legacy row still standing.
-   *
-   * A lead is one document for the whole org now, so the delete leaves the
-   * per-site loop. It is not the caller that may assume the migration is
-   * finished, though: until AGL-3276 has folded every site and AGL-3277 has
-   * removed the fallback, a person can still be held at
-   * `hosts/{hostId}/leads`, and an erasure that deleted only the org row would
-   * leave that copy behind. So both are swept, and `counts.leads` is what was
-   * actually destroyed rather than how many places were looked at.
-   */ /*
-   * Every lead row this erasure removes, as it stood (AGL-3330). A plugin
-   * that keeps a figure over leads — a form counts the people it filed —
-   * is told once the rows are gone, through `host.records.removed`, so its
-   * figure drops by the person this erasure removed and by nothing else.
-   */ const erasedLeads = [];
-    try {
-        const orgLead = orgRef.collection('leads').doc(key);
-        const orgLeadSnapshot = await orgLead.get();
-        if (orgLeadSnapshot.exists) {
-            var _orgLeadSnapshot_data;
-            erasedLeads.push({
-                id: key,
-                data: (_orgLeadSnapshot_data = orgLeadSnapshot.data()) != null ? _orgLeadSnapshot_data : {}
-            });
-            await orgLead.delete();
-            counts.leads += 1;
-        }
-    } catch (error) {
-        console.error('erasePerson: org lead delete failed', error);
-    }
-    for (const hostId of hostIds){
-        const hostRef = db.collection('hosts').doc(hostId);
-        try {
-            const lead = hostRef.collection('leads').doc(key);
-            const leadSnapshot = await lead.get();
-            if (leadSnapshot.exists) {
-                var _leadSnapshot_data;
-                erasedLeads.push({
-                    id: key,
-                    data: (_leadSnapshot_data = leadSnapshot.data()) != null ? _leadSnapshot_data : {}
-                });
-                await lead.delete();
-                counts.leads += 1;
-            }
-        } catch (error) {
-            console.error(`erasePerson: legacy lead delete failed for ${hostId}`, error);
-        }
-        counts.orders += await updateWhere(db, hostRef.collection('orders'), 'customerEmail', email, erasedOrderFor);
-        counts.bookings += await updateWhere(db, hostRef.collection('bookings'), 'email', email, erasedBooking);
-    }
-    if (erasedLeads.length) {
-        // Isolated per plugin by the seam, and never the erasure's failure.
-        await runPluginEventHandlers('host.records.removed', {
-            orgId: options.orgId,
-            hostIds,
-            collection: 'leads',
-            records: erasedLeads
-        }).catch((error)=>console.error('erasePerson: records-removed event failed', error));
-    }
-    try {
-        const memberIds = listMemberDocIds(email);
-        const lists = await orgRef.collection('lists').get();
-        for (const list of lists.docs){
-            const refs = memberIds.map((id)=>list.ref.collection('members').doc(id));
-            const found = await db.getAll(...refs);
-            for (const member of found){
-                if (!member.exists) continue;
-                await member.ref.delete();
-                counts.listMemberships += 1;
-            }
-        }
-    } catch (error) {
-        console.error('erasePerson: list membership sweep failed', error);
-    }
+    counts.records = shares.contactIds.length;
+    counts.plugins = shares.reports;
     try {
         const sweep = await eraseEmailDeliveriesForAddresses([
             {
@@ -291,48 +139,5 @@ const defaultFirestore = ()=>firebaseAdmin.app().firestore();
         ok: true
     }, counts);
 }
-/**
- * Delete every document in `collection` whose `field` equals `value`, a
- * page at a time. Returns how many went; a failure logs and stops, and the
- * count says how far it got.
- */ async function deleteWhere(db, collection, field, value) {
-    let removed = 0;
-    try {
-        for(let pass = 0; pass < MAX_PAGES; pass += 1){
-            const page = await collection.where(field, '==', value).limit(PAGE).get();
-            if (page.empty) break;
-            const batch = db.batch();
-            page.docs.forEach((doc)=>batch.delete(doc.ref));
-            await batch.commit();
-            removed += page.size;
-            if (page.size < PAGE) break;
-        }
-    } catch (error) {
-        console.error(`erasePerson: delete sweep failed on ${field}`, error);
-    }
-    return removed;
-}
-/**
- * Apply `patch` to every document in `collection` whose `field` equals
- * `value`. Because the patch clears the very field that was matched on, a
- * second page never sees the first page's rows again, so the loop needs no
- * cursor; the page cap is the only bound.
- */ async function updateWhere(db, collection, field, value, patch) {
-    let changed = 0;
-    try {
-        for(let pass = 0; pass < MAX_PAGES; pass += 1){
-            const page = await collection.where(field, '==', value).limit(PAGE).get();
-            if (page.empty) break;
-            const batch = db.batch();
-            page.docs.forEach((doc)=>batch.update(doc.ref, typeof patch === 'function' ? patch(doc.data()) : patch));
-            await batch.commit();
-            changed += page.size;
-            if (page.size < PAGE) break;
-        }
-    } catch (error) {
-        console.error(`erasePerson: update sweep failed on ${field}`, error);
-    }
-    return changed;
-}
 
 //# sourceMappingURL=erase-person.js.map

package/src/lib/server/erase-person.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/erase-person.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { FieldValue } from 'firebase-admin/firestore'\n// The leaves, not the barrel — see `email-suppression.ts` for why: a spec\n// of this sweep substitutes a store, not the pure helpers it leans on.\nimport { normalizeContactEmail } from '@aglyn/aglyn/app-utils/contacts'\nimport { CRM_COLLECTIONS } from '@aglyn/aglyn/app-utils/crm'\nimport { personKey } from '@aglyn/aglyn/app-utils/person-key'\nimport {\n  runPluginPersonErasers,\n  type PluginPersonErasureReport,\n} from '@aglyn/aglyn/plugin-manager/plugin-person-erasure'\nimport { runPluginEventHandlers } from '@aglyn/aglyn/plugin-manager/plugin-events'\nimport { companyContactsCountFields } from './contact-company-link'\nimport { eraseEmailDeliveriesForAddresses } from './email-delivery-log'\nimport { suppressEmailForHostErasure } from './email-suppression'\nimport firebaseAdmin from './firebase-admin'\nimport { listMemberDocIds } from './list-members'\nimport { addAdminAudit } from './admin-audit-write'\n\nconst defaultFirestore = () => firebaseAdmin.app().firestore()\n\n/** Firestore caps a batch at 500 writes; a page under it keeps a margin. */\nconst PAGE = 400\n\n/**\n * A pathological collection must not hold the erasure open indefinitely:\n * twenty pages of four hundred is eight thousand rows of one kind for one\n * person, past anything a real relationship produces.\n */\nconst MAX_PAGES = 20\n\nexport interface ErasePersonOptions {\n  orgId: string\n  /** Any spelling; normalized before anything is looked up. */\n  email: unknown\n  /** Injectable for tests; defaults to the admin app's Firestore. */\n  firestore?: any\n  /** Injectable for tests; defaults to `Date.now()`. */\n  now?: number\n}\n\n/**\n * Counts, never identities: this is what the request document and the\n * audit row record, and both are read by people who must not learn the\n * address from them.\n */\nexport interface ErasePersonCounts {\n  /** Sites in the workspace the sweep walked. */\n  hosts: number\n  /** Suppression rows written, one per site. */\n  hostsSuppressed: number\n  /** Contact documents deleted — the row every site shared. */\n  contacts: number\n  /** Companies whose contact count moved down. */\n  companyLinks: number\n  /** Deals whose `contactId` was removed. */\n  deals: number\n  tasks: number\n  activities: number\n  /** `hosts/{hostId}/leads/{personKey}` rows deleted. */\n  leads: number\n  /** Audience-list member rows deleted, across every list. */\n  listMemberships: number\n  /** Orders with the buyer's identity removed; the record stays. */\n  orders: number\n  /** Bookings with the person's identity removed; the record stays. */\n  bookings: number\n  /** Delivery-log messages deleted under the address. */\n  emailDeliveries: number\n  /**\n   * Each plugin's share (AGL-2981), by plugin id: its eraser's own counts,\n   * or `null` for an eraser that failed — its data may remain.\n   */\n  plugins: Record<string, PluginPersonErasureReport | null>\n}\n\nexport type ErasePersonResult =\n  | ({ ok: true } & ErasePersonCounts)\n  | { ok: false; skippedReason: 'invalid-email' }\n\n/**\n * Remove one person from one workspace (AGL-2623).\n *\n * `planContactDetach` is deliberately not consulted: the CRM's delete is a\n * detach that leaves the row for the other holders, and this is the act\n * that must not. The contact document goes whole — every site's facet,\n * every consent entry, every attribution — and with it everything the\n * workspace keeps beside the person.\n *\n * ## Order\n *\n *   1. **Suppress first.** One row per site on the per-site suppression\n *      list, before any delete: a form filled in while the sweep runs must\n *      already find the door closed, or the sweep deletes a row that the\n *      capture re-creates a moment later.\n *   2. The plugins' share: every eraser registered on\n *      `plugin-person-erasure`, handed the address, its key and the ids of\n *      the contacts about to go, while those documents still exist.\n *   3. The contact and its satellites — company counts, deals unlinked,\n *      tasks and activities deleted — by the contact's id, then the\n *      document itself.\n *   4. Leads, list memberships, orders and bookings by the address, on\n *      every site of the workspace.\n *   5. The delivery log, last: it is filed under the address alone, and the\n *      tombstone it leaves is what keeps a later import from refilling it.\n *\n * ## What is anonymized rather than deleted\n *\n * An order is the merchant's record of a sale and a booking of an\n * appointment; the amounts, the line items and the tax are theirs to keep\n * and the law expects them kept. The person is taken OFF those records —\n * name, email, phone, addresses — and a stamp says when. A deal is the\n * team's own pipeline record and is unlinked. Everything else that names\n * the person is about the person and is deleted.\n *\n * ## What is not reached, and why\n *\n * A form submission keeps the address inside `fields`, under whatever the\n * form called it — there is no key to query by and a scan of every\n * submission on every site is unbounded. A site member's login is their\n * own account. A subscription carries the address it bills, and a live one\n * cannot be anonymized without breaking its receipts. Each is named to the\n * admin by the dialog so they can finish by hand.\n *\n * Every sweep is best-effort against the others: a failure in one is\n * logged and counted as zero, and the request's counts say what happened.\n * The caller decides whether zero contacts on a person it could see is a\n * failure to retry.\n */\nexport async function erasePerson(\n  options: ErasePersonOptions,\n): Promise<ErasePersonResult> {\n  const email = normalizeContactEmail(options.email)\n  const key = email ? personKey(email) : null\n  if (!email || !key) return { ok: false, skippedReason: 'invalid-email' }\n  const db = options.firestore ?? defaultFirestore()\n  const now = options.now ?? Date.now()\n  const orgRef = db.collection('orgs').doc(options.orgId)\n\n  const counts: ErasePersonCounts = {\n    hosts: 0,\n    hostsSuppressed: 0,\n    contacts: 0,\n    companyLinks: 0,\n    deals: 0,\n    tasks: 0,\n    activities: 0,\n    leads: 0,\n    listMemberships: 0,\n    orders: 0,\n    bookings: 0,\n    emailDeliveries: 0,\n    plugins: {},\n  }\n\n  const hosts = await db\n    .collection('hosts')\n    .where('orgId', '==', options.orgId)\n    .get()\n  const hostIds: string[] = hosts.docs.map((doc: any) => String(doc.id))\n  counts.hosts = hostIds.length\n\n  for (const hostId of hostIds) {\n    try {\n      const written = await suppressEmailForHostErasure({ hostId, email, firestore: db })\n      if (written) counts.hostsSuppressed += 1\n    } catch (error) {\n      console.error(`erasePerson: suppression write failed for ${hostId}`, error)\n    }\n  }\n\n  const contacts = await orgRef.collection('contacts').where('email', '==', email).get()\n\n  // What the plugins keep about the person (AGL-2981): records filed under\n  // the organization by the contact or by the address, which none of the\n  // sweeps here can see. Every site's door is already closed above, and\n  // the contacts are still there for an eraser that reads one. Isolated\n  // per plugin: one that fails is recorded as `null` and the erasure goes\n  // on. This erasure has no plan of its own, so it is never a dry run.\n  counts.plugins = await runPluginPersonErasers({\n    orgId: options.orgId,\n    email,\n    key,\n    contactIds: contacts.docs.map((contact: any) => String(contact.id)),\n    dryRun: false,\n  })\n\n  for (const contact of contacts.docs) {\n    const contactId = String(contact.id)\n    const companyIds: unknown = contact.get('companyIds')\n    const linked = Array.isArray(companyIds)\n      ? companyIds.filter((id): id is string => typeof id === 'string' && !!id)\n      : []\n    for (const companyId of new Set(linked)) {\n      try {\n        await orgRef\n          .collection(CRM_COLLECTIONS.companies)\n          .doc(companyId)\n          .update(companyContactsCountFields(-1))\n        counts.companyLinks += 1\n      } catch (error) {\n        console.error(`erasePerson: company count could not move for ${companyId}`, error)\n      }\n    }\n    counts.deals += await updateWhere(\n      db,\n      orgRef.collection(CRM_COLLECTIONS.deals),\n      'contactId',\n      contactId,\n      { contactId: FieldValue.delete(), updatedAt: FieldValue.serverTimestamp() },\n    )\n    counts.tasks += await deleteWhere(db, orgRef.collection(CRM_COLLECTIONS.tasks), 'contactId', contactId)\n    counts.activities += await deleteWhere(\n      db,\n      orgRef.collection(CRM_COLLECTIONS.activities),\n      'contactId',\n      contactId,\n    )\n    try {\n      await contact.ref.delete()\n      counts.contacts += 1\n    } catch (error) {\n      console.error(`erasePerson: contact delete failed for ${contactId}`, error)\n    }\n  }\n\n  const erasedOrder = {\n    customerEmail: null,\n    customerName: null,\n    shippingAddress: FieldValue.delete(),\n    billingAddress: FieldValue.delete(),\n    customerErasedAtMs: now,\n  }\n  /*\n   * The address also lives in what the orders list queries by (AGL-3321):\n   * its lower-cased key, its search prefixes, and the quick search's token\n   * array, which holds those prefixes beside the order number's and the item\n   * names'. The first two go; the prefixes are taken back out of the third.\n   * A prefix the number or an item name shares with the address goes with\n   * it — a search for that prefix misses this order until the orders\n   * backfill restamps it — and nothing left on the order answers to the\n   * address.\n   */\n  const erasedOrderFor = (data: Record<string, unknown> | undefined) => {\n    const addressTokens = new Set(\n      Array.isArray(data?.customerEmailTokens) ? data.customerEmailTokens : [],\n    )\n    return {\n      ...erasedOrder,\n      customerEmailLower: null,\n      customerEmailTokens: [],\n      ...(Array.isArray(data?.searchTokens)\n        ? {\n            searchTokens: data.searchTokens.filter(\n              (token: unknown) => !addressTokens.has(token),\n            ),\n          }\n        : {}),\n    }\n  }\n  const erasedBooking = {\n    email: null,\n    name: FieldValue.delete(),\n    phone: FieldValue.delete(),\n    customerErasedAtMs: now,\n  }\n  /*\n   * THE ORG ROW, ONCE (AGL-3275) — and then every legacy row still standing.\n   *\n   * A lead is one document for the whole org now, so the delete leaves the\n   * per-site loop. It is not the caller that may assume the migration is\n   * finished, though: until AGL-3276 has folded every site and AGL-3277 has\n   * removed the fallback, a person can still be held at\n   * `hosts/{hostId}/leads`, and an erasure that deleted only the org row would\n   * leave that copy behind. So both are swept, and `counts.leads` is what was\n   * actually destroyed rather than how many places were looked at.\n   */\n  /*\n   * Every lead row this erasure removes, as it stood (AGL-3330). A plugin\n   * that keeps a figure over leads — a form counts the people it filed —\n   * is told once the rows are gone, through `host.records.removed`, so its\n   * figure drops by the person this erasure removed and by nothing else.\n   */\n  const erasedLeads: Array<{ id: string; data: Record<string, unknown> }> = []\n  try {\n    const orgLead = orgRef.collection('leads').doc(key)\n    const orgLeadSnapshot = await orgLead.get()\n    if (orgLeadSnapshot.exists) {\n      erasedLeads.push({ id: key, data: orgLeadSnapshot.data() ?? {} })\n      await orgLead.delete()\n      counts.leads += 1\n    }\n  } catch (error) {\n    console.error('erasePerson: org lead delete failed', error)\n  }\n  for (const hostId of hostIds) {\n    const hostRef = db.collection('hosts').doc(hostId)\n    try {\n      const lead = hostRef.collection('leads').doc(key)\n      const leadSnapshot = await lead.get()\n      if (leadSnapshot.exists) {\n        erasedLeads.push({ id: key, data: leadSnapshot.data() ?? {} })\n        await lead.delete()\n        counts.leads += 1\n      }\n    } catch (error) {\n      console.error(`erasePerson: legacy lead delete failed for ${hostId}`, error)\n    }\n    counts.orders += await updateWhere(db, hostRef.collection('orders'), 'customerEmail', email, erasedOrderFor)\n    counts.bookings += await updateWhere(db, hostRef.collection('bookings'), 'email', email, erasedBooking)\n  }\n\n  if (erasedLeads.length) {\n    // Isolated per plugin by the seam, and never the erasure's failure.\n    await runPluginEventHandlers('host.records.removed', {\n      orgId: options.orgId,\n      hostIds,\n      collection: 'leads',\n      records: erasedLeads,\n    }).catch((error) => console.error('erasePerson: records-removed event failed', error))\n  }\n\n  try {\n    const memberIds = listMemberDocIds(email)\n    const lists = await orgRef.collection('lists').get()\n    for (const list of lists.docs) {\n      const refs = memberIds.map((id) => list.ref.collection('members').doc(id))\n      const found = await db.getAll(...refs)\n      for (const member of found) {\n        if (!member.exists) continue\n        await member.ref.delete()\n        counts.listMemberships += 1\n      }\n    }\n  } catch (error) {\n    console.error('erasePerson: list membership sweep failed', error)\n  }\n\n  try {\n    const sweep = await eraseEmailDeliveriesForAddresses([{ address: email }], db)\n    counts.emailDeliveries = sweep.removed\n  } catch (error) {\n    console.error('erasePerson: delivery log sweep failed', error)\n  }\n\n  await addAdminAudit(db, {\n    actorUid: 'system:erase-person',\n    action: 'person.erased',\n    target: `orgs/${options.orgId}/people/${key}`,\n    before: null,\n    after: counts,\n    at: FieldValue.serverTimestamp(),\n  })\n    .catch(() => undefined)\n\n  return { ok: true, ...counts }\n}\n\n/**\n * Delete every document in `collection` whose `field` equals `value`, a\n * page at a time. Returns how many went; a failure logs and stops, and the\n * count says how far it got.\n */\nasync function deleteWhere(\n  db: any,\n  collection: any,\n  field: string,\n  value: string,\n): Promise<number> {\n  let removed = 0\n  try {\n    for (let pass = 0; pass < MAX_PAGES; pass += 1) {\n      const page = await collection.where(field, '==', value).limit(PAGE).get()\n      if (page.empty) break\n      const batch = db.batch()\n      page.docs.forEach((doc: any) => batch.delete(doc.ref))\n      await batch.commit()\n      removed += page.size\n      if (page.size < PAGE) break\n    }\n  } catch (error) {\n    console.error(`erasePerson: delete sweep failed on ${field}`, error)\n  }\n  return removed\n}\n\n/**\n * Apply `patch` to every document in `collection` whose `field` equals\n * `value`. Because the patch clears the very field that was matched on, a\n * second page never sees the first page's rows again, so the loop needs no\n * cursor; the page cap is the only bound.\n */\nasync function updateWhere(\n  db: any,\n  collection: any,\n  field: string,\n  value: string,\n  patch: Record<string, unknown> | ((data: Record<string, unknown> | undefined) => Record<string, unknown>),\n): Promise<number> {\n  let changed = 0\n  try {\n    for (let pass = 0; pass < MAX_PAGES; pass += 1) {\n      const page = await collection.where(field, '==', value).limit(PAGE).get()\n      if (page.empty) break\n      const batch = db.batch()\n      page.docs.forEach((doc: any) =>\n        batch.update(doc.ref, typeof patch === 'function' ? patch(doc.data()) : patch),\n      )\n      await batch.commit()\n      changed += page.size\n      if (page.size < PAGE) break\n    }\n  } catch (error) {\n    console.error(`erasePerson: update sweep failed on ${field}`, error)\n  }\n  return changed\n}\n"],"names":["FieldValue","normalizeContactEmail","CRM_COLLECTIONS","personKey","runPluginPersonErasers","runPluginEventHandlers","companyContactsCountFields","eraseEmailDeliveriesForAddresses","suppressEmailForHostErasure","firebaseAdmin","listMemberDocIds","addAdminAudit","defaultFirestore","app","firestore","PAGE","MAX_PAGES","erasePerson","options","email","key","ok","skippedReason","db","now","Date","orgRef","collection","doc","orgId","counts","hosts","hostsSuppressed","contacts","companyLinks","deals","tasks","activities","leads","listMemberships","orders","bookings","emailDeliveries","plugins","where","get","hostIds","docs","map","String","id","length","hostId","written","error","console","contactIds","contact","dryRun","contactId","companyIds","linked","Array","isArray","filter","companyId","Set","companies","update","updateWhere","delete","updatedAt","serverTimestamp","deleteWhere","ref","erasedOrder","customerEmail","customerName","shippingAddress","billingAddress","customerErasedAtMs","erasedOrderFor","data","addressTokens","customerEmailTokens","customerEmailLower","searchTokens","token","has","erasedBooking","name","phone","erasedLeads","orgLead","orgLeadSnapshot","exists","push","hostRef","lead","leadSnapshot","records","catch","memberIds","lists","list","refs","found","getAll","member","sweep","address","removed","actorUid","action","target","before","after","at","undefined","field","value","pass","page","limit","empty","batch","forEach","commit","size","patch","changed"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,2BAA0B;AACrD,0EAA0E;AAC1E,uEAAuE;AACvE,SAASC,qBAAqB,QAAQ,kCAAiC;AACvE,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,SAAS,QAAQ,oCAAmC;AAC7D,SACEC,sBAAsB,QAEjB,oDAAmD;AAC1D,SAASC,sBAAsB,QAAQ,4CAA2C;AAClF,SAASC,0BAA0B,QAAQ,4BAAwB;AACnE,SAASC,gCAAgC,QAAQ,0BAAsB;AACvE,SAASC,2BAA2B,QAAQ,yBAAqB;AACjE,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,gBAAgB,QAAQ,oBAAgB;AACjD,SAASC,aAAa,QAAQ,yBAAqB;AAEnD,MAAMC,mBAAmB,IAAMH,cAAcI,GAAG,GAAGC,SAAS;AAE5D,0EAA0E,GAC1E,MAAMC,OAAO;AAEb;;;;CAIC,GACD,MAAMC,YAAY;AAmDlB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDC,GACD,OAAO,eAAeC,YACpBC,OAA2B;QAKhBA,oBACCA;IAJZ,MAAMC,QAAQlB,sBAAsBiB,QAAQC,KAAK;IACjD,MAAMC,MAAMD,QAAQhB,UAAUgB,SAAS;IACvC,IAAI,CAACA,SAAS,CAACC,KAAK,OAAO;QAAEC,IAAI;QAAOC,eAAe;IAAgB;IACvE,MAAMC,MAAKL,qBAAAA,QAAQJ,SAAS,YAAjBI,qBAAqBN;IAChC,MAAMY,OAAMN,eAAAA,QAAQM,GAAG,YAAXN,eAAeO,KAAKD,GAAG;IACnC,MAAME,SAASH,GAAGI,UAAU,CAAC,QAAQC,GAAG,CAACV,QAAQW,KAAK;IAEtD,MAAMC,SAA4B;QAChCC,OAAO;QACPC,iBAAiB;QACjBC,UAAU;QACVC,cAAc;QACdC,OAAO;QACPC,OAAO;QACPC,YAAY;QACZC,OAAO;QACPC,iBAAiB;QACjBC,QAAQ;QACRC,UAAU;QACVC,iBAAiB;QACjBC,SAAS,CAAC;IACZ;IAEA,MAAMZ,QAAQ,MAAMR,GACjBI,UAAU,CAAC,SACXiB,KAAK,CAAC,SAAS,MAAM1B,QAAQW,KAAK,EAClCgB,GAAG;IACN,MAAMC,UAAoBf,MAAMgB,IAAI,CAACC,GAAG,CAAC,CAACpB,MAAaqB,OAAOrB,IAAIsB,EAAE;IACpEpB,OAAOC,KAAK,GAAGe,QAAQK,MAAM;IAE7B,KAAK,MAAMC,UAAUN,QAAS;QAC5B,IAAI;YACF,MAAMO,UAAU,MAAM7C,4BAA4B;gBAAE4C;gBAAQjC;gBAAOL,WAAWS;YAAG;YACjF,IAAI8B,SAASvB,OAAOE,eAAe,IAAI;QACzC,EAAE,OAAOsB,OAAO;YACdC,QAAQD,KAAK,CAAC,CAAC,0CAA0C,EAAEF,QAAQ,EAAEE;QACvE;IACF;IAEA,MAAMrB,WAAW,MAAMP,OAAOC,UAAU,CAAC,YAAYiB,KAAK,CAAC,SAAS,MAAMzB,OAAO0B,GAAG;IAEpF,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,qEAAqE;IACrEf,OAAOa,OAAO,GAAG,MAAMvC,uBAAuB;QAC5CyB,OAAOX,QAAQW,KAAK;QACpBV;QACAC;QACAoC,YAAYvB,SAASc,IAAI,CAACC,GAAG,CAAC,CAACS,UAAiBR,OAAOQ,QAAQP,EAAE;QACjEQ,QAAQ;IACV;IAEA,KAAK,MAAMD,WAAWxB,SAASc,IAAI,CAAE;QACnC,MAAMY,YAAYV,OAAOQ,QAAQP,EAAE;QACnC,MAAMU,aAAsBH,QAAQZ,GAAG,CAAC;QACxC,MAAMgB,SAASC,MAAMC,OAAO,CAACH,cACzBA,WAAWI,MAAM,CAAC,CAACd,KAAqB,OAAOA,OAAO,YAAY,CAAC,CAACA,MACpE,EAAE;QACN,KAAK,MAAMe,aAAa,IAAIC,IAAIL,QAAS;YACvC,IAAI;gBACF,MAAMnC,OACHC,UAAU,CAACzB,gBAAgBiE,SAAS,EACpCvC,GAAG,CAACqC,WACJG,MAAM,CAAC9D,2BAA2B,CAAC;gBACtCwB,OAAOI,YAAY,IAAI;YACzB,EAAE,OAAOoB,OAAO;gBACdC,QAAQD,KAAK,CAAC,CAAC,8CAA8C,EAAEW,WAAW,EAAEX;YAC9E;QACF;QACAxB,OAAOK,KAAK,IAAI,MAAMkC,YACpB9C,IACAG,OAAOC,UAAU,CAACzB,gBAAgBiC,KAAK,GACvC,aACAwB,WACA;YAAEA,WAAW3D,WAAWsE,MAAM;YAAIC,WAAWvE,WAAWwE,eAAe;QAAG;QAE5E1C,OAAOM,KAAK,IAAI,MAAMqC,YAAYlD,IAAIG,OAAOC,UAAU,CAACzB,gBAAgBkC,KAAK,GAAG,aAAauB;QAC7F7B,OAAOO,UAAU,IAAI,MAAMoC,YACzBlD,IACAG,OAAOC,UAAU,CAACzB,gBAAgBmC,UAAU,GAC5C,aACAsB;QAEF,IAAI;YACF,MAAMF,QAAQiB,GAAG,CAACJ,MAAM;YACxBxC,OAAOG,QAAQ,IAAI;QACrB,EAAE,OAAOqB,OAAO;YACdC,QAAQD,KAAK,CAAC,CAAC,uCAAuC,EAAEK,WAAW,EAAEL;QACvE;IACF;IAEA,MAAMqB,cAAc;QAClBC,eAAe;QACfC,cAAc;QACdC,iBAAiB9E,WAAWsE,MAAM;QAClCS,gBAAgB/E,WAAWsE,MAAM;QACjCU,oBAAoBxD;IACtB;IACA;;;;;;;;;GASC,GACD,MAAMyD,iBAAiB,CAACC;QACtB,MAAMC,gBAAgB,IAAIjB,IACxBJ,MAAMC,OAAO,CAACmB,wBAAAA,KAAME,mBAAmB,IAAIF,KAAKE,mBAAmB,GAAG,EAAE;QAE1E,OAAO,aACFT;YACHU,oBAAoB;YACpBD,qBAAqB,EAAE;WACnBtB,MAAMC,OAAO,CAACmB,wBAAAA,KAAMI,YAAY,IAChC;YACEA,cAAcJ,KAAKI,YAAY,CAACtB,MAAM,CACpC,CAACuB,QAAmB,CAACJ,cAAcK,GAAG,CAACD;QAE3C,IACA,CAAC;IAET;IACA,MAAME,gBAAgB;QACpBtE,OAAO;QACPuE,MAAM1F,WAAWsE,MAAM;QACvBqB,OAAO3F,WAAWsE,MAAM;QACxBU,oBAAoBxD;IACtB;IACA;;;;;;;;;;GAUC,GACD;;;;;GAKC,GACD,MAAMoE,cAAoE,EAAE;IAC5E,IAAI;QACF,MAAMC,UAAUnE,OAAOC,UAAU,CAAC,SAASC,GAAG,CAACR;QAC/C,MAAM0E,kBAAkB,MAAMD,QAAQhD,GAAG;QACzC,IAAIiD,gBAAgBC,MAAM,EAAE;gBACQD;YAAlCF,YAAYI,IAAI,CAAC;gBAAE9C,IAAI9B;gBAAK8D,IAAI,GAAEY,wBAAAA,gBAAgBZ,IAAI,cAApBY,wBAA0B,CAAC;YAAE;YAC/D,MAAMD,QAAQvB,MAAM;YACpBxC,OAAOQ,KAAK,IAAI;QAClB;IACF,EAAE,OAAOgB,OAAO;QACdC,QAAQD,KAAK,CAAC,uCAAuCA;IACvD;IACA,KAAK,MAAMF,UAAUN,QAAS;QAC5B,MAAMmD,UAAU1E,GAAGI,UAAU,CAAC,SAASC,GAAG,CAACwB;QAC3C,IAAI;YACF,MAAM8C,OAAOD,QAAQtE,UAAU,CAAC,SAASC,GAAG,CAACR;YAC7C,MAAM+E,eAAe,MAAMD,KAAKrD,GAAG;YACnC,IAAIsD,aAAaJ,MAAM,EAAE;oBACWI;gBAAlCP,YAAYI,IAAI,CAAC;oBAAE9C,IAAI9B;oBAAK8D,IAAI,GAAEiB,qBAAAA,aAAajB,IAAI,cAAjBiB,qBAAuB,CAAC;gBAAE;gBAC5D,MAAMD,KAAK5B,MAAM;gBACjBxC,OAAOQ,KAAK,IAAI;YAClB;QACF,EAAE,OAAOgB,OAAO;YACdC,QAAQD,KAAK,CAAC,CAAC,2CAA2C,EAAEF,QAAQ,EAAEE;QACxE;QACAxB,OAAOU,MAAM,IAAI,MAAM6B,YAAY9C,IAAI0E,QAAQtE,UAAU,CAAC,WAAW,iBAAiBR,OAAO8D;QAC7FnD,OAAOW,QAAQ,IAAI,MAAM4B,YAAY9C,IAAI0E,QAAQtE,UAAU,CAAC,aAAa,SAASR,OAAOsE;IAC3F;IAEA,IAAIG,YAAYzC,MAAM,EAAE;QACtB,oEAAoE;QACpE,MAAM9C,uBAAuB,wBAAwB;YACnDwB,OAAOX,QAAQW,KAAK;YACpBiB;YACAnB,YAAY;YACZyE,SAASR;QACX,GAAGS,KAAK,CAAC,CAAC/C,QAAUC,QAAQD,KAAK,CAAC,6CAA6CA;IACjF;IAEA,IAAI;QACF,MAAMgD,YAAY5F,iBAAiBS;QACnC,MAAMoF,QAAQ,MAAM7E,OAAOC,UAAU,CAAC,SAASkB,GAAG;QAClD,KAAK,MAAM2D,QAAQD,MAAMxD,IAAI,CAAE;YAC7B,MAAM0D,OAAOH,UAAUtD,GAAG,CAAC,CAACE,KAAOsD,KAAK9B,GAAG,CAAC/C,UAAU,CAAC,WAAWC,GAAG,CAACsB;YACtE,MAAMwD,QAAQ,MAAMnF,GAAGoF,MAAM,IAAIF;YACjC,KAAK,MAAMG,UAAUF,MAAO;gBAC1B,IAAI,CAACE,OAAOb,MAAM,EAAE;gBACpB,MAAMa,OAAOlC,GAAG,CAACJ,MAAM;gBACvBxC,OAAOS,eAAe,IAAI;YAC5B;QACF;IACF,EAAE,OAAOe,OAAO;QACdC,QAAQD,KAAK,CAAC,6CAA6CA;IAC7D;IAEA,IAAI;QACF,MAAMuD,QAAQ,MAAMtG,iCAAiC;YAAC;gBAAEuG,SAAS3F;YAAM;SAAE,EAAEI;QAC3EO,OAAOY,eAAe,GAAGmE,MAAME,OAAO;IACxC,EAAE,OAAOzD,OAAO;QACdC,QAAQD,KAAK,CAAC,0CAA0CA;IAC1D;IAEA,MAAM3C,cAAcY,IAAI;QACtByF,UAAU;QACVC,QAAQ;QACRC,QAAQ,CAAC,KAAK,EAAEhG,QAAQW,KAAK,CAAC,QAAQ,EAAET,KAAK;QAC7C+F,QAAQ;QACRC,OAAOtF;QACPuF,IAAIrH,WAAWwE,eAAe;IAChC,GACG6B,KAAK,CAAC,IAAMiB;IAEf,OAAO;QAAEjG,IAAI;OAASS;AACxB;AAEA;;;;CAIC,GACD,eAAe2C,YACblD,EAAO,EACPI,UAAe,EACf4F,KAAa,EACbC,KAAa;IAEb,IAAIT,UAAU;IACd,IAAI;QACF,IAAK,IAAIU,OAAO,GAAGA,OAAOzG,WAAWyG,QAAQ,EAAG;YAC9C,MAAMC,OAAO,MAAM/F,WAAWiB,KAAK,CAAC2E,OAAO,MAAMC,OAAOG,KAAK,CAAC5G,MAAM8B,GAAG;YACvE,IAAI6E,KAAKE,KAAK,EAAE;YAChB,MAAMC,QAAQtG,GAAGsG,KAAK;YACtBH,KAAK3E,IAAI,CAAC+E,OAAO,CAAC,CAAClG,MAAaiG,MAAMvD,MAAM,CAAC1C,IAAI8C,GAAG;YACpD,MAAMmD,MAAME,MAAM;YAClBhB,WAAWW,KAAKM,IAAI;YACpB,IAAIN,KAAKM,IAAI,GAAGjH,MAAM;QACxB;IACF,EAAE,OAAOuC,OAAO;QACdC,QAAQD,KAAK,CAAC,CAAC,oCAAoC,EAAEiE,OAAO,EAAEjE;IAChE;IACA,OAAOyD;AACT;AAEA;;;;;CAKC,GACD,eAAe1C,YACb9C,EAAO,EACPI,UAAe,EACf4F,KAAa,EACbC,KAAa,EACbS,KAAyG;IAEzG,IAAIC,UAAU;IACd,IAAI;QACF,IAAK,IAAIT,OAAO,GAAGA,OAAOzG,WAAWyG,QAAQ,EAAG;YAC9C,MAAMC,OAAO,MAAM/F,WAAWiB,KAAK,CAAC2E,OAAO,MAAMC,OAAOG,KAAK,CAAC5G,MAAM8B,GAAG;YACvE,IAAI6E,KAAKE,KAAK,EAAE;YAChB,MAAMC,QAAQtG,GAAGsG,KAAK;YACtBH,KAAK3E,IAAI,CAAC+E,OAAO,CAAC,CAAClG,MACjBiG,MAAMzD,MAAM,CAACxC,IAAI8C,GAAG,EAAE,OAAOuD,UAAU,aAAaA,MAAMrG,IAAIsD,IAAI,MAAM+C;YAE1E,MAAMJ,MAAME,MAAM;YAClBG,WAAWR,KAAKM,IAAI;YACpB,IAAIN,KAAKM,IAAI,GAAGjH,MAAM;QACxB;IACF,EAAE,OAAOuC,OAAO;QACdC,QAAQD,KAAK,CAAC,CAAC,oCAAoC,EAAEiE,OAAO,EAAEjE;IAChE;IACA,OAAO4E;AACT"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/erase-person.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { FieldValue } from 'firebase-admin/firestore'\n// The leaves, not the barrel — see `email-suppression.ts` for why: a spec\n// of this sweep substitutes a store, not the pure helpers it leans on.\nimport { normalizeContactEmail } from '@aglyn/aglyn/app-utils/contacts'\nimport { personKey } from '@aglyn/aglyn/app-utils/person-key'\nimport {\n  missingRequiredPersonErasersAfterRepair,\n  runPluginPersonErasure,\n  type PluginPersonErasureReport,\n} from '@aglyn/aglyn/plugin-manager/plugin-person-erasure'\nimport { eraseEmailDeliveriesForAddresses } from './email-delivery-log'\nimport { suppressEmailForHostErasure } from './email-suppression'\nimport firebaseAdmin from './firebase-admin'\nimport { addAdminAudit } from './admin-audit-write'\n\nconst defaultFirestore = () => firebaseAdmin.app().firestore()\n\nexport interface ErasePersonOptions {\n  orgId: string\n  /** Any spelling; normalized before anything is looked up. */\n  email: unknown\n  /** Injectable for tests; defaults to the admin app's Firestore. */\n  firestore?: any\n  /** Injectable for tests; defaults to `Date.now()`. */\n  now?: number\n}\n\n/**\n * Counts, never identities: this is what the request document and the audit\n * row record, and both are read by people who must not learn the address\n * from them.\n */\nexport interface ErasePersonCounts {\n  /** Sites in the workspace the sweep walked. */\n  hosts: number\n  /** Suppression rows written, one per site. */\n  hostsSuppressed: number\n  /** The person's records the record system named, by count. */\n  records: number\n  /** Delivery-log messages deleted under the address. */\n  emailDeliveries: number\n  /**\n   * Each plugin's share (AGL-2981, AGL-3080), by plugin id: its eraser's own\n   * counts — the record system's people, a shop's orders, a calendar's\n   * bookings, an audience's members — or `null` for an eraser that failed:\n   * its data may remain.\n   */\n  plugins: Record<string, PluginPersonErasureReport | null>\n}\n\nexport type ErasePersonResult =\n  | ({ ok: true } & ErasePersonCounts)\n  | { ok: false; skippedReason: 'invalid-email' }\n\n/**\n * Remove one person from one workspace (AGL-2623).\n *\n * The platform's part is the door and the log; everything the workspace keeps\n * ABOUT the person is a plugin's, erased through `plugin-person-erasure`.\n *\n * ## Order\n *\n *   1. **Suppress first.** One row per site on the per-site suppression list,\n *      before any delete: a form filled in while the sweep runs must already\n *      find the door closed, or the sweep deletes a row that the capture\n *      re-creates a moment later.\n *   2. **The plugins' shares** (`runPluginPersonErasure`): the plugin that\n *      keeps people names the person's records; every other plugin erases\n *      what it keeps — keyed by those records or by the address — and the\n *      record system erases the records themselves last. A share the\n *      erasure promises is REQUIRED: a missing one refuses the erasure before\n *      anything is erased, and a failed one fails it after the rest ran, so\n *      the job retries rather than reporting a person erased who is not.\n *   3. **The delivery log**, last: it is filed under the address alone, and\n *      the tombstone it leaves is what keeps a later import from refilling it.\n *\n * ## What is anonymized rather than deleted\n *\n * Each plugin's own business: an order is the merchant's record of a sale\n * and a booking of an appointment, and the law expects them kept, so the\n * person is taken OFF them; a deal is the team's pipeline record and is\n * unlinked. Everything else that names the person is about the person and is\n * deleted. `PERSON_ERASURE_REMOVES` / `RETAINS` say so to the admin.\n *\n * ## What is not reached, and why\n *\n * A form submission keeps the address inside `fields`, under whatever the\n * form called it — there is no key to query by and a scan of every\n * submission on every site is unbounded. A site member's login is their own\n * account. Each is named to the admin by the dialog so they can finish by\n * hand.\n *\n * The suppression and the log are best-effort against each other: a failure\n * in one is logged and counted as zero, and the counts say what happened.\n */\nexport async function erasePerson(options: ErasePersonOptions): Promise<ErasePersonResult> {\n  const email = normalizeContactEmail(options.email)\n  const key = email ? personKey(email) : null\n  if (!email || !key) return { ok: false, skippedReason: 'invalid-email' }\n  const db = options.firestore ?? defaultFirestore()\n  /*\n   * A share the erasure promises that this process cannot run — even after\n   * its boot step has run once more — refuses the whole erasure BEFORE it\n   * writes anything: the request stays queued for a process whose boot\n   * registered it, rather than reporting a person erased who is still on file.\n   */\n  const missing = await missingRequiredPersonErasersAfterRepair()\n  if (missing.length) {\n    throw new Error(\n      `erasePerson refused: ${missing.join(', ')} declared a required person eraser ` +\n        'and none is registered in this process',\n    )\n  }\n\n  const counts: ErasePersonCounts = {\n    hosts: 0,\n    hostsSuppressed: 0,\n    records: 0,\n    emailDeliveries: 0,\n    plugins: {},\n  }\n\n  const hosts = await db.collection('hosts').where('orgId', '==', options.orgId).get()\n  const hostIds: string[] = hosts.docs.map((doc: any) => String(doc.id))\n  counts.hosts = hostIds.length\n\n  for (const hostId of hostIds) {\n    try {\n      const written = await suppressEmailForHostErasure({ hostId, email, firestore: db })\n      if (written) counts.hostsSuppressed += 1\n    } catch (error) {\n      console.error(`erasePerson: suppression write failed for ${hostId}`, error)\n    }\n  }\n\n  // Every site's door is already closed above. This erasure has no plan of\n  // its own, so it is never a dry run. A required share that is missing or\n  // failed THROWS here, and the request stays queued for the next run.\n  const shares = await runPluginPersonErasure({\n    orgId: options.orgId,\n    email,\n    key,\n    dryRun: false,\n    atMs: options.now ?? Date.now(),\n  })\n  counts.records = shares.contactIds.length\n  counts.plugins = shares.reports\n\n  try {\n    const sweep = await eraseEmailDeliveriesForAddresses([{ address: email }], db)\n    counts.emailDeliveries = sweep.removed\n  } catch (error) {\n    console.error('erasePerson: delivery log sweep failed', error)\n  }\n\n  await addAdminAudit(db, {\n    actorUid: 'system:erase-person',\n    action: 'person.erased',\n    target: `orgs/${options.orgId}/people/${key}`,\n    before: null,\n    after: counts,\n    at: FieldValue.serverTimestamp(),\n  }).catch(() => undefined)\n\n  return { ok: true, ...counts }\n}\n"],"names":["FieldValue","normalizeContactEmail","personKey","missingRequiredPersonErasersAfterRepair","runPluginPersonErasure","eraseEmailDeliveriesForAddresses","suppressEmailForHostErasure","firebaseAdmin","addAdminAudit","defaultFirestore","app","firestore","erasePerson","options","email","key","ok","skippedReason","db","missing","length","Error","join","counts","hosts","hostsSuppressed","records","emailDeliveries","plugins","collection","where","orgId","get","hostIds","docs","map","doc","String","id","hostId","written","error","console","shares","dryRun","atMs","now","Date","contactIds","reports","sweep","address","removed","actorUid","action","target","before","after","at","serverTimestamp","catch","undefined"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,2BAA0B;AACrD,0EAA0E;AAC1E,uEAAuE;AACvE,SAASC,qBAAqB,QAAQ,kCAAiC;AACvE,SAASC,SAAS,QAAQ,oCAAmC;AAC7D,SACEC,uCAAuC,EACvCC,sBAAsB,QAEjB,oDAAmD;AAC1D,SAASC,gCAAgC,QAAQ,0BAAsB;AACvE,SAASC,2BAA2B,QAAQ,yBAAqB;AACjE,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,aAAa,QAAQ,yBAAqB;AAEnD,MAAMC,mBAAmB,IAAMF,cAAcG,GAAG,GAAGC,SAAS;AAuC5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCC,GACD,OAAO,eAAeC,YAAYC,OAA2B;QAIhDA,oBA4CHA;IA/CR,MAAMC,QAAQb,sBAAsBY,QAAQC,KAAK;IACjD,MAAMC,MAAMD,QAAQZ,UAAUY,SAAS;IACvC,IAAI,CAACA,SAAS,CAACC,KAAK,OAAO;QAAEC,IAAI;QAAOC,eAAe;IAAgB;IACvE,MAAMC,MAAKL,qBAAAA,QAAQF,SAAS,YAAjBE,qBAAqBJ;IAChC;;;;;GAKC,GACD,MAAMU,UAAU,MAAMhB;IACtB,IAAIgB,QAAQC,MAAM,EAAE;QAClB,MAAM,IAAIC,MACR,CAAC,qBAAqB,EAAEF,QAAQG,IAAI,CAAC,MAAM,mCAAmC,CAAC,GAC7E;IAEN;IAEA,MAAMC,SAA4B;QAChCC,OAAO;QACPC,iBAAiB;QACjBC,SAAS;QACTC,iBAAiB;QACjBC,SAAS,CAAC;IACZ;IAEA,MAAMJ,QAAQ,MAAMN,GAAGW,UAAU,CAAC,SAASC,KAAK,CAAC,SAAS,MAAMjB,QAAQkB,KAAK,EAAEC,GAAG;IAClF,MAAMC,UAAoBT,MAAMU,IAAI,CAACC,GAAG,CAAC,CAACC,MAAaC,OAAOD,IAAIE,EAAE;IACpEf,OAAOC,KAAK,GAAGS,QAAQb,MAAM;IAE7B,KAAK,MAAMmB,UAAUN,QAAS;QAC5B,IAAI;YACF,MAAMO,UAAU,MAAMlC,4BAA4B;gBAAEiC;gBAAQzB;gBAAOH,WAAWO;YAAG;YACjF,IAAIsB,SAASjB,OAAOE,eAAe,IAAI;QACzC,EAAE,OAAOgB,OAAO;YACdC,QAAQD,KAAK,CAAC,CAAC,0CAA0C,EAAEF,QAAQ,EAAEE;QACvE;IACF;IAEA,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,MAAME,SAAS,MAAMvC,uBAAuB;QAC1C2B,OAAOlB,QAAQkB,KAAK;QACpBjB;QACAC;QACA6B,QAAQ;QACRC,IAAI,GAAEhC,eAAAA,QAAQiC,GAAG,YAAXjC,eAAekC,KAAKD,GAAG;IAC/B;IACAvB,OAAOG,OAAO,GAAGiB,OAAOK,UAAU,CAAC5B,MAAM;IACzCG,OAAOK,OAAO,GAAGe,OAAOM,OAAO;IAE/B,IAAI;QACF,MAAMC,QAAQ,MAAM7C,iCAAiC;YAAC;gBAAE8C,SAASrC;YAAM;SAAE,EAAEI;QAC3EK,OAAOI,eAAe,GAAGuB,MAAME,OAAO;IACxC,EAAE,OAAOX,OAAO;QACdC,QAAQD,KAAK,CAAC,0CAA0CA;IAC1D;IAEA,MAAMjC,cAAcU,IAAI;QACtBmC,UAAU;QACVC,QAAQ;QACRC,QAAQ,CAAC,KAAK,EAAE1C,QAAQkB,KAAK,CAAC,QAAQ,EAAEhB,KAAK;QAC7CyC,QAAQ;QACRC,OAAOlC;QACPmC,IAAI1D,WAAW2D,eAAe;IAChC,GAAGC,KAAK,CAAC,IAAMC;IAEf,OAAO;QAAE7C,IAAI;OAASO;AACxB"}

package/src/lib/server/host-visitor-records.d.ts

@@ -24,7 +24,7 @@
  * split as `visitorWriteRateLimitRefusal`, and for the same reason.
  */
 import { type VisitorRecordKind } from '@aglyn/aglyn/server';
-import { type ResolvedCampaignTouch } from './campaign-conversion-attribution';
+import { type PluginConversionTouch } from '@aglyn/aglyn/plugin-manager/plugin-conversion-credit';
 import type { ConsentGroup, ScopeToken } from '@aglyn/aglyn/server';
 /**
  * A lead's one home: `orgs/{orgId}/leads/{personKey}` (AGL-3275).
@@ -142,7 +142,7 @@ export declare function leadForWrite(hostId: string, key: string): Promise<{
  * count as shipped.
  *
  * Two audiences, one call, in exactly `recordAbuseCeilingTrip`'s shape
- * (`apps/tenant/app/api/forms/submit/route.ts`, AGL-1655):
+ * (`libs/plugins/forms/src/lib/server/form-submit.ts`, AGL-1655):
  *
  *  - A durable per-month refusal count at
  *    `hosts/{id}/counters/{siteMembers|leads}Refused`. Counters are excluded
@@ -219,6 +219,12 @@ export interface HostLeadInput {
      * the same rule `upsertHostContact` applies.
      */
     disclosedConsentGroup?: string | null;
+    /**
+     * A phone the capture learned (AGL-3493), E.164 as the door normalized
+     * it. Written only when the lead holds none: a number a rep typed on the
+     * lead, or an earlier capture brought, is not replaced by this one.
+     */
+    phoneFill?: string;
 }
 /**
  * Record one lead at `hosts/{hostId}/leads/{personKey}`, bounded by
@@ -285,7 +291,9 @@ export declare function addHostLeadOutcome(options: {
      */
     ceiling?: number;
     /**
-     * The campaign this person came from, already resolved by the door.
+     * Where this person arrived from, already resolved by the door through the
+     * plugin that credits outcomes (`plugin-conversion-credit`), and opaque
+     * here.
      *
      * Resolved rather than raw, and passed rather than looked up, because one
      * visitor action reaches several writers: a form submission that creates a
@@ -293,7 +301,7 @@ export declare function addHostLeadOutcome(options: {
      * door that hands none — every order path, every import — attributes
      * nothing, which is how a lead that no campaign caused stays uncredited.
      */
-    touch?: ResolvedCampaignTouch | null;
+    touch?: PluginConversionTouch | null;
 }): Promise<HostLeadOutcome>;
 /** What {@link addHostLeadOutcome} did with one capture. */
 export interface HostLeadOutcome {