better-supabase 0.12.0 → 0.14.0

package/dist/client-WzuQExHk.js

@@ -0,0 +1,253 @@
+import { n as dbError } from "./errors-03ysrOt4.js";
+import { r as err } from "./result-B3m7xtRY.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { n as whileSignedIn, t as defineController } from "./controller-BEliOBOv.js";
+import { t as conversationTopic } from "./rows-Bb0EPupt.js";
+//#region src/blocks/messaging/client.ts
+const TYPING_EVENT = "typing";
+/** How often a held `setTyping(true)` broadcasts again. */
+const TYPING_RESEND_MS = 3e3;
+const order = (a, b) => {
+	const left = (a.sentAt ?? a.createdAt).epochMilliseconds;
+	const right = (b.sentAt ?? b.createdAt).epochMilliseconds;
+	if (left !== right) return left - right;
+	return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+};
+/** `messages` with `incoming` added or replaced, oldest first. */
+function merge(messages, incoming) {
+	const byId = new Map(messages.map((message) => [message.id, message]));
+	for (const message of incoming) byId.set(message.id, message);
+	return [...byId.values()].toSorted(order);
+}
+const text = (value) => typeof value === "string" ? value : void 0;
+/**
+* One conversation, or one thread, for the signed-in user: loads the latest
+* page, keeps it current from the conversation's Realtime pings, tracks who is
+* typing, and moves the read marker as messages arrive.
+*/
+function createMessagesController(options) {
+	const { client, conversationId } = options;
+	const threadId = options.threadId ?? null;
+	const limit = options.limit ?? 50;
+	const autoRead = options.markRead ?? true;
+	const typingTimeout = options.typingTimeout ?? 6e3;
+	return defineController({
+		messages: void 0,
+		hasOlder: false,
+		typing: [],
+		status: "closed",
+		error: void 0
+	}, (state) => {
+		let ticket = 0;
+		let handle;
+		let me;
+		let typingSentAt = 0;
+		const typers = /* @__PURE__ */ new Map();
+		const shows = (message) => message.conversationId === conversationId && (threadId === null ? message.threadId === void 0 || message.broadcast : message.threadId === threadId);
+		const page = (before) => threadId === null ? client.list(conversationId ?? "", {
+			limit,
+			...before?.sentAt === void 0 ? {} : { before: {
+				sentAt: before.sentAt,
+				id: before.id
+			} }
+		}) : client.replies(threadId, { limit });
+		const markRead = async () => {
+			if (conversationId === null) return;
+			await client.markRead(conversationId, threadId === null ? {} : { threadId });
+		};
+		const put = (incoming) => {
+			state.set((current) => ({
+				error: void 0,
+				messages: merge(current.messages ?? [], incoming.filter(shows))
+			}));
+		};
+		const refresh = async () => {
+			if (conversationId === null) return;
+			ticket += 1;
+			const request = ticket;
+			const result = await page();
+			if (request !== ticket) return;
+			if (!result.ok) {
+				state.set({ error: result.error });
+				return;
+			}
+			state.set({
+				messages: merge([], result.data),
+				hasOlder: threadId === null && result.data.length >= limit,
+				error: void 0
+			});
+			if (autoRead) await markRead();
+		};
+		const stopTyping = (userId) => {
+			clearTimeout(typers.get(userId));
+			if (typers.delete(userId)) state.set({ typing: [...typers.keys()] });
+		};
+		const heard = (userId, typing) => {
+			if (userId === me) return;
+			stopTyping(userId);
+			if (typing) {
+				typers.set(userId, setTimeout(() => {
+					stopTyping(userId);
+				}, typingTimeout));
+				state.set({ typing: [...typers.keys()] });
+			}
+		};
+		const ping = async (event, payload) => {
+			const data = isRecord(payload) ? payload : {};
+			if (event === TYPING_EVENT) {
+				const userId = text(data["userId"]);
+				if (userId !== void 0) heard(userId, data["typing"] !== false);
+				return;
+			}
+			const messageId = text(data["messageId"]);
+			if (messageId === void 0) return;
+			const result = await client.get(messageId);
+			if (!result.ok || result.data === void 0) return;
+			const message = result.data;
+			if (message.authorId !== void 0) stopTyping(message.authorId);
+			if (!shows(message)) return;
+			put([message]);
+			if (autoRead && event === "message" && message.authorId !== me) await markRead();
+		};
+		const written = (result) => {
+			if (result.ok) {
+				ticket += 1;
+				put([result.data]);
+			} else state.set({ error: result.error });
+			return result;
+		};
+		return {
+			actions: {
+				refresh,
+				markRead,
+				send: async (body, draft = {}) => {
+					if (conversationId === null) return err(dbError("invalid_input", "No conversation is open"));
+					typingSentAt = 0;
+					handle?.send(TYPING_EVENT, {
+						conversationId,
+						userId: me,
+						typing: false
+					});
+					return written(await client.send(conversationId, {
+						...draft,
+						...threadId === null || draft.parentId !== void 0 ? {} : { parentId: threadId },
+						body
+					}));
+				},
+				edit: async (id, edition) => written(await client.edit(id, edition)),
+				remove: async (id) => {
+					const result = await client.remove(id);
+					if (result.ok) {
+						const fresh = await client.get(id);
+						if (fresh.ok && fresh.data !== void 0) put([fresh.data]);
+					} else state.set({ error: result.error });
+					return result;
+				},
+				pin: async (id, pinned = true) => written(await client.pin(id, pinned)),
+				resolve: async (id, resolved = true) => written(await client.resolve(id, resolved)),
+				loadOlder: async () => {
+					const oldest = state.get().messages?.[0];
+					if (conversationId === null || threadId !== null || oldest === void 0) return;
+					const result = await page(oldest);
+					if (!result.ok) {
+						state.set({ error: result.error });
+						return;
+					}
+					state.set((current) => ({
+						messages: merge(current.messages ?? [], result.data),
+						hasOlder: result.data.length >= limit
+					}));
+				},
+				setTyping: (typing) => {
+					if (handle === void 0 || me === void 0) return;
+					const now = Date.now();
+					if (typing && now - typingSentAt < TYPING_RESEND_MS) return;
+					typingSentAt = typing ? now : 0;
+					handle.send(TYPING_EVENT, {
+						conversationId,
+						userId: me,
+						typing
+					});
+				}
+			},
+			start: () => conversationId === null ? void 0 : whileSignedIn(options.auth, (userId) => {
+				me = userId;
+				refresh();
+				handle = options.ports.topic(conversationTopic(conversationId, options.topic), {
+					onMessage: (event, payload) => void ping(event, payload),
+					onRejoin: () => void refresh(),
+					onStatus: (status) => {
+						state.set({ status });
+					}
+				});
+				return () => {
+					handle?.leave();
+					handle = void 0;
+					me = void 0;
+					for (const timer of typers.values()) clearTimeout(timer);
+					typers.clear();
+					state.set({ typing: [] });
+				};
+			})
+		};
+	});
+}
+/**
+* The caller's conversations with their unread and mention counts, loaded again
+* when a message arrives in one of them.
+*/
+function createConversationsController(options) {
+	const watch = options.watch ?? 50;
+	return defineController({
+		conversations: void 0,
+		status: "closed",
+		error: void 0
+	}, (state) => {
+		let ticket = 0;
+		const joined = /* @__PURE__ */ new Map();
+		const follow = (ids) => {
+			const wanted = new Set(ids.slice(0, watch));
+			for (const [id, handle] of joined) if (!wanted.has(id)) {
+				handle.leave();
+				joined.delete(id);
+			}
+			for (const id of wanted) if (!joined.has(id)) joined.set(id, options.ports.topic(conversationTopic(id, options.topic), {
+				onMessage: (event) => {
+					if (event === "message") refresh();
+				},
+				onRejoin: () => void 0,
+				onStatus: (status) => {
+					state.set({ status });
+				}
+			}));
+		};
+		const refresh = async () => {
+			if (!options.enabled) return;
+			ticket += 1;
+			const request = ticket;
+			const result = await options.client.conversations({
+				...options.kinds === void 0 ? {} : { kinds: options.kinds },
+				...options.limit === void 0 ? {} : { limit: options.limit }
+			});
+			if (request !== ticket) return;
+			if (result.ok) {
+				state.set({
+					conversations: result.data,
+					error: void 0
+				});
+				follow(result.data.map((conversation) => conversation.id));
+			} else state.set({ error: result.error });
+		};
+		return {
+			actions: { refresh },
+			start: () => options.enabled ? whileSignedIn(options.auth, () => {
+				refresh();
+				return () => {
+					follow([]);
+				};
+			}) : void 0
+		};
+	});
+}
+//#endregion
+export { createMessagesController as n, createConversationsController as t };

package/dist/client-Y_HnZGF4.js

@@ -0,0 +1,51 @@
+import { n as whileSignedIn, t as defineController } from "./controller-BEliOBOv.js";
+//#region src/blocks/notifications/client.ts
+/** The default badge number: the items whose `readAt` is `null`. */
+const unreadCount = (items) => items.filter((item) => typeof item === "object" && item !== null && "readAt" in item && item.readAt === null).length;
+/**
+* The signed-in user's notifications, kept current: loads them, then loads
+* again after each broadcast on `topic` and after the channel rejoins.
+*/
+function createNotificationsController(options) {
+	const countOf = options.count ?? unreadCount;
+	return defineController({
+		items: void 0,
+		count: 0,
+		status: "closed",
+		error: void 0
+	}, (state) => {
+		const refresh = async () => {
+			try {
+				const merged = (await Promise.all([options.load, ...options.sources ?? []].map((source) => source()))).flat();
+				const items = options.sort ? merged.toSorted(options.sort) : merged;
+				state.set({
+					items,
+					count: countOf(items),
+					error: void 0
+				});
+			} catch (cause) {
+				state.set({ error: cause });
+			}
+		};
+		return {
+			actions: { refresh },
+			start: () => whileSignedIn(options.auth, () => {
+				refresh();
+				if (!options.topic) return;
+				const { leave } = options.ports.topic(options.topic, {
+					onMessage: (event, payload) => {
+						options.onMessage?.(event, payload);
+						refresh();
+					},
+					onRejoin: () => void refresh(),
+					onStatus: (status) => {
+						state.set({ status });
+					}
+				});
+				return leave;
+			})
+		};
+	});
+}
+//#endregion
+export { unreadCount as n, createNotificationsController as t };

package/dist/client-bDXsvSXp.d.ts

@@ -0,0 +1,90 @@
+import { b as DbError, f as Result } from "./result-C6jDfedy.js";
+import { at as AttachmentStatus, dt as NewAttachment } from "./define-block-COpcS6aT.js";
+import { n as Controller } from "./controller-DAD4hbl4.js";
+//#region src/blocks/attachments/client.d.ts
+/** Where `start` told the browser to send the bytes. */
+interface AttachmentUploadTicket {
+  readonly id: string;
+  /** The signed upload URL from `attachments.upload` or `replace`. */
+  readonly signedUrl: string;
+}
+/** What `confirm` and `refresh` answer: `null` when the caller can't tell. */
+type AttachmentScanState = {
+  readonly status: AttachmentStatus;
+} | null;
+/** One file to upload. */
+interface AttachmentFileInput {
+  readonly file: Blob;
+  readonly name: string;
+  /** Default the blob's `type`, or `application/octet-stream`. */
+  readonly mimeType?: string;
+  readonly width?: number;
+  readonly height?: number;
+  readonly pages?: number;
+}
+/**
+ * Sends `body` to the signed URL and reports the share sent, from 0 to 1. The
+ * default PUTs it with `XMLHttpRequest`, which React DOM and React Native both
+ * have.
+ */
+type AttachmentSend = (ticket: AttachmentUploadTicket, body: Blob, progress: (fraction: number) => void, signal: AbortSignal) => Promise<Result<null>>;
+interface AttachmentUploadControllerOptions {
+  /**
+   * Creates the pending record and signs the upload:
+   * `attachments.upload(subject, file)`, or a server action that calls it.
+   */
+  readonly start: (file: NewAttachment) => PromiseLike<Result<AttachmentUploadTicket>>;
+  /** Marks the upload done: `attachments.confirm(id)`, or a server action. */
+  readonly confirm: (id: string) => PromiseLike<Result<AttachmentScanState>>;
+  /**
+   * Reads the file's scan status again, so an upload waits in `scanning` until
+   * the scanner answers. Without it an upload ends once confirmed.
+   */
+  readonly refresh?: (id: string) => PromiseLike<Result<AttachmentScanState>>;
+  readonly send?: AttachmentSend;
+  /** Milliseconds between scan checks. Default 2000. */
+  readonly pollInterval?: number;
+  /** Runs once a file is uploaded (and scanned clean, with `refresh`). */
+  readonly onUploaded?: (id: string) => void | Promise<void>;
+}
+type AttachmentUploadStatus = "uploading" | "confirming" | "scanning" | "done" | "blocked" | "error";
+interface AttachmentUploadItem {
+  /** A local key, stable for the upload's life. */
+  readonly key: string;
+  readonly name: string;
+  readonly mimeType: string;
+  readonly size: number;
+  readonly status: AttachmentUploadStatus;
+  /** The share of the bytes sent, from 0 to 1. */
+  readonly progress: number;
+  /** The attachment id once `start` created the record. */
+  readonly id: string | undefined;
+  readonly error: DbError | undefined;
+}
+interface AttachmentUploadSnapshot {
+  readonly uploads: readonly AttachmentUploadItem[];
+  /** Whether any upload is still sending, confirming or waiting for its scan. */
+  readonly busy: boolean;
+}
+interface AttachmentUploadActions {
+  /** Starts uploading each file, side by side. */
+  readonly add: (files: readonly AttachmentFileInput[]) => void;
+  /** Starts a failed upload again from the beginning. */
+  readonly retry: (key: string) => void;
+  /** Stops an upload and drops it from the list. */
+  readonly dismiss: (key: string) => void;
+  /** Drops the uploads that ended. */
+  readonly clear: () => void;
+}
+type AttachmentUploadController = Controller<AttachmentUploadSnapshot, AttachmentUploadActions>;
+/** The default `send`: a PUT to the signed URL with upload progress. */
+declare const xhrSend: AttachmentSend;
+/**
+ * Uploads files to a record: each one is created (`start`), sent to its signed
+ * URL with progress (`send`), confirmed (`confirm`) and, with `refresh`,
+ * watched until the scan answers. Uploads run side by side; a failed one stays
+ * in the list with its error until it is retried or dismissed.
+ */
+declare function createAttachmentUploadController(options: AttachmentUploadControllerOptions): AttachmentUploadController;
+//#endregion
+export { AttachmentUploadController as a, AttachmentUploadSnapshot as c, createAttachmentUploadController as d, xhrSend as f, AttachmentUploadActions as i, AttachmentUploadStatus as l, AttachmentScanState as n, AttachmentUploadControllerOptions as o, AttachmentSend as r, AttachmentUploadItem as s, AttachmentFileInput as t, AttachmentUploadTicket as u };

package/dist/client-bx3Bk7c5.d.ts

@@ -0,0 +1,64 @@
+import { b as DbError, f as Result } from "./result-C6jDfedy.js";
+import { n as Controller, t as AuthPort } from "./controller-DAD4hbl4.js";
+import { d as CreateApiKeyInput, f as CreatedApiKey, l as ApiKeys, t as ApiKey } from "./api-keys-CboAenU8.js";
+//#region src/blocks/api-keys/client.d.ts
+/** What `create` takes: the organization comes from the controller. */
+type ApiKeyDraft = Omit<CreateApiKeyInput, "organizationId">;
+/** A key change that committed, for `onChanged`. */
+type ApiKeyChange = {
+  readonly kind: "created";
+  readonly key: ApiKey;
+} | {
+  readonly kind: "revoked";
+  readonly id: string;
+};
+interface ApiKeysControllerOptions {
+  readonly client: Pick<ApiKeys, "list" | "create" | "revoke">;
+  readonly auth: AuthPort;
+  /**
+   * The organization whose keys to list and create: all of them for its
+   * managers, the caller's own for everyone else. `null` lists the caller's
+   * personal keys.
+   */
+  readonly organizationId: string | null;
+  /**
+   * Runs after a key was created or revoked, such as a server action that
+   * completes an onboarding step. A throw is kept in `error`.
+   */
+  readonly onChanged?: (change: ApiKeyChange) => void | Promise<void>;
+}
+interface ApiKeysSnapshot {
+  /** Newest first; `undefined` until the first load. */
+  readonly keys: readonly ApiKey[] | undefined;
+  /** Whether a key is being created. */
+  readonly creating: boolean;
+  /**
+   * The key `create` made, with its token, which is shown once; until
+   * `dismiss`.
+   */
+  readonly created: CreatedApiKey | undefined;
+  /** The key ids with a revoke in flight. */
+  readonly revoking: readonly string[];
+  readonly error: DbError | undefined;
+}
+interface ApiKeysActions {
+  /**
+   * Creates a key and keeps its token in `created`; a failure is also kept in
+   * `error`.
+   */
+  readonly create: (draft: ApiKeyDraft) => Promise<Result<CreatedApiKey>>;
+  /** Revokes a key at once, then loads the list again. */
+  readonly revoke: (id: string) => Promise<Result<boolean>>;
+  /** Forgets `created` and `error`, such as when the token dialog closes. */
+  readonly dismiss: () => void;
+  readonly refresh: () => Promise<void>;
+}
+type ApiKeysController = Controller<ApiKeysSnapshot, ApiKeysActions>;
+/**
+ * The API keys of an organization (or the caller's personal keys) for an API
+ * keys table: `create` returns the token once, `revoke` revokes a key, and both
+ * load the list again.
+ */
+declare function createApiKeysController(options: ApiKeysControllerOptions): ApiKeysController;
+//#endregion
+export { ApiKeysControllerOptions as a, ApiKeysController as i, ApiKeyDraft as n, ApiKeysSnapshot as o, ApiKeysActions as r, createApiKeysController as s, ApiKeyChange as t };

package/dist/client-jgDU7Roj.d.ts

@@ -0,0 +1,144 @@
+import { b as DbError, f as Result } from "./result-C6jDfedy.js";
+import { t as Aal } from "./mfa-wrx1rqJT.js";
+import { n as Controller, t as AuthPort } from "./controller-DAD4hbl4.js";
+import { t as AuthReply } from "./auth-reply-Dj124sbX.js";
+//#region src/blocks/mfa/client.d.ts
+/** A factor as `auth.mfa.listFactors()` returns it. */
+interface RawMfaFactor {
+  readonly id: string;
+  readonly friendly_name?: string;
+  readonly factor_type: string;
+  readonly status: string;
+}
+/** The part of `supabase.auth.mfa` the MFA controllers call. */
+interface MfaApi {
+  listFactors(): PromiseLike<AuthReply<{
+    readonly all: readonly RawMfaFactor[];
+  }>>;
+  enroll(params: {
+    factorType: "totp";
+    friendlyName?: string;
+    issuer?: string;
+  }): PromiseLike<AuthReply<{
+    readonly id: string;
+    readonly totp: {
+      readonly qr_code: string;
+      readonly secret: string;
+      readonly uri: string;
+    };
+  }>>;
+  challengeAndVerify(params: {
+    factorId: string;
+    code: string;
+  }): PromiseLike<AuthReply<unknown>>;
+  unenroll(params: {
+    factorId: string;
+  }): PromiseLike<AuthReply<unknown>>;
+  getAuthenticatorAssuranceLevel(): PromiseLike<AuthReply<{
+    readonly currentLevel: string | null;
+    readonly nextLevel: string | null;
+  }>>;
+}
+interface MfaFactor {
+  readonly id: string;
+  readonly name: string | undefined;
+  /** `totp`, `phone` or `webauthn`. */
+  readonly type: string;
+  /** False for an enrolment the user hasn't confirmed with a code yet. */
+  readonly verified: boolean;
+}
+/** A TOTP factor waiting for its first code. */
+interface MfaEnrollment {
+  readonly factorId: string;
+  /** An SVG data URL of the QR code for authenticator apps. */
+  readonly qrCode: string;
+  /** The secret, for typing into an authenticator by hand. */
+  readonly secret: string;
+  readonly uri: string;
+}
+interface MfaAssurance {
+  /** The session's level; `undefined` until the first load. */
+  readonly level: Aal | undefined;
+  /**
+   * `aal2` when the user has a verified factor, so a challenge can raise the
+   * session.
+   */
+  readonly nextLevel: Aal | undefined;
+}
+/** Whether `error` is the `INSUFFICIENT_AAL` refusal that asks for a step-up. */
+declare function needsStepUp(error: DbError | undefined): boolean;
+interface MfaControllerOptions {
+  /** `supabase.auth.mfa` of the browser client. */
+  readonly mfa: MfaApi;
+  readonly auth: AuthPort;
+  /** The issuer authenticator apps show; default: the Auth Site URL's host. */
+  readonly issuer?: string;
+}
+interface MfaSnapshot extends MfaAssurance {
+  /** Every factor, verified or not; `undefined` until the first load. */
+  readonly factors: readonly MfaFactor[] | undefined;
+  /** The TOTP factor `enroll` made, until `verify` or `cancel`. */
+  readonly enrollment: MfaEnrollment | undefined;
+  /** Whether an enrol, verify or unenrol call is in flight. */
+  readonly pending: boolean;
+  readonly error: DbError | undefined;
+}
+interface MfaActions {
+  /** Enrols a TOTP factor and keeps its QR code in `enrollment`. */
+  readonly enroll: (input?: {
+    readonly name?: string;
+  }) => Promise<Result<MfaEnrollment>>;
+  /**
+   * Confirms `enrollment` with a code from the app; the session is `aal2` after
+   * it.
+   */
+  readonly verify: (code: string) => Promise<Result<MfaAssurance>>;
+  /** Removes the unconfirmed factor of `enrollment`. */
+  readonly cancel: () => Promise<void>;
+  /** Removes a factor; removing a verified one needs an `aal2` session. */
+  readonly unenroll: (factorId: string) => Promise<Result<boolean>>;
+  /** Forgets `error`. */
+  readonly dismiss: () => void;
+  readonly refresh: () => Promise<void>;
+}
+type MfaController = Controller<MfaSnapshot, MfaActions>;
+/**
+ * A user's MFA factors for a security settings page: `enroll` shows a QR code,
+ * `verify` confirms it with the first code, and `unenroll` removes a factor.
+ * The assurance level is read again after each change.
+ */
+declare function createMfaController(options: MfaControllerOptions): MfaController;
+interface StepUpControllerOptions {
+  /** `supabase.auth.mfa` of the browser client. */
+  readonly mfa: MfaApi;
+  readonly auth: AuthPort;
+}
+interface StepUpSnapshot extends MfaAssurance {
+  /**
+   * The verified factors a code can come from; `undefined` until the first
+   * load.
+   */
+  readonly factors: readonly MfaFactor[] | undefined;
+  /** Whether the session is `aal2`. */
+  readonly satisfied: boolean;
+  readonly verifying: boolean;
+  readonly error: DbError | undefined;
+}
+interface StepUpActions {
+  /**
+   * Challenges a verified factor (the first one by default) with `code`, then
+   * reads the session's level again.
+   */
+  readonly verify: (code: string, factorId?: string) => Promise<Result<MfaAssurance>>;
+  readonly dismiss: () => void;
+  readonly refresh: () => Promise<void>;
+}
+type StepUpController = Controller<StepUpSnapshot, StepUpActions>;
+/**
+ * Raises the session to `aal2` before a call that `checkAal` guards: show it
+ * when an error passes `needsStepUp`, then retry the call once `satisfied` is
+ * true.
+ */
+declare function createStepUpController(options: StepUpControllerOptions): StepUpController;
+//#endregion
+export { MfaControllerOptions as a, MfaSnapshot as c, StepUpController as d, StepUpControllerOptions as f, needsStepUp as g, createStepUpController as h, MfaController as i, RawMfaFactor as l, createMfaController as m, MfaApi as n, MfaEnrollment as o, StepUpSnapshot as p, MfaAssurance as r, MfaFactor as s, MfaActions as t, StepUpActions as u };

package/dist/client-kRvHKAKS.js

@@ -0,0 +1,60 @@
+import { t as defineController } from "./controller-BEliOBOv.js";
+import { t as tenantOf } from "./tenant-DnMqeNIM.js";
+//#region src/auth/entitlements.ts
+/**
+* Whether the session's plan-features claim grants `key` in `tenantId`. `claim`
+* is `config.claims.features` (default `features`), the claim
+* `better_supabase.feature_claims()` fills, or `{ claim, keys }` when
+* `entitlements.claim.keys` writes short codes. The claim is as fresh as the
+* token: enforce it in RLS with `better_supabase.has_entitlement()`, and
+* refresh the session after checkout. A tenant left out by
+* `entitlements.claim.maxTenants` reads as not granted. Takes a server session
+* or the client's `useAuth()` snapshot.
+*/
+function hasEntitlement(session, tenantId, key, claim = "features") {
+	const options = typeof claim === "string" ? { claim } : claim;
+	const claims = "kind" in session ? session.kind === "user" ? session.claims : void 0 : session.claims;
+	if (!isRecord(claims)) return false;
+	const features = claims[options.claim ?? "features"];
+	if (!isRecord(features) || !Object.hasOwn(features, tenantId)) return false;
+	const keys = features[tenantId];
+	const code = options.keys?.[key] ?? key;
+	return Array.isArray(keys) && keys.includes(code);
+}
+const isRecord = (value) => typeof value === "object" && value !== null;
+//#endregion
+//#region src/blocks/entitlements/client.ts
+/**
+* Whether the active organization's plan includes `feature`, from the session's
+* plan-features claim. It updates when the session does, so a session refresh
+* after checkout opens the gate. UX only: enforce the feature in RLS with
+* `better_supabase.has_entitlement()`.
+*/
+function createFeatureGateController(options) {
+	const read = () => {
+		const session = options.auth.current();
+		if (session.status === "loading") return {
+			allowed: void 0,
+			organizationId: void 0
+		};
+		const organizationId = options.organizationId ?? tenantOf(session, options.tenantClaim);
+		return {
+			allowed: organizationId === void 0 ? false : hasEntitlement(session, organizationId, options.feature, options.claim),
+			organizationId
+		};
+	};
+	return defineController(read(), (state) => {
+		const recheck = () => {
+			state.set(read());
+		};
+		return {
+			actions: { recheck },
+			start: () => {
+				recheck();
+				return options.auth.subscribe(recheck);
+			}
+		};
+	});
+}
+//#endregion
+export { hasEntitlement as n, createFeatureGateController as t };