org-admin

Step 1 of 2. Produces the full export (rules with audit history, gaps, staleness, calibration/contradiction findings, ROI counters, onboarding events, key/connection metadata — never secrets) and mints a confirmation token scoped to this org. Calling this again before confirming just re-exports and overwrites the previous token (the old one stops working) — there is deliberately no limit on how many times an admin can re-request before actually confirming.

Step 2 of 2 — irreversible. Requires the exact token /request just issued for THIS org (never another org's — the key is org-scoped, so a caller can never hold a valid token for anyone but their own org), unexpired, unused. Deletes apps/store's rules mirror first (the more likely-to-fail-partway network call), then every org-scoped Postgres row — see gnt.org_offboarding.delete_org_postgres_data for the full, authoritative table list.

body.full additionally deletes Better Auth's own organization/member/ invitation rows and this org's orgs row (see delete_better_auth_org's own docstring for why those are normally left alone) — this is the self-service "delete my account" path (Settings → Organization), checked here before anything destructive runs: only a solo-member org can go this route, since wiping the organization out from under other members would break their own access to it with no warning.