better-supabase 0.5.0 → 0.6.0

package/dist/blocks/data-lifecycle/index.d.ts

@@ -0,0 +1,251 @@
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult, w as ErrorMapper } from "../../result-D7y2fT87.js";
+import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
+import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } from "../../provider-BH5UWZJ6.js";
+import { r as BlockTemporalOptions } from "../../block-helpers-CKtbFcRv.js";
+import { m as JobHandler } from "../../queue-CLJurhdy.js";
+import { r as EventSink } from "../../cloud-event-C1JCc1bH.js";
+//#region src/blocks/data-lifecycle/data-lifecycle.d.ts
+interface StorageReply<T> {
+  readonly data: T | null;
+  readonly error: unknown;
+}
+/** An entry of `storage.from(bucket).list(prefix)`; folders have no `id`. */
+interface StorageEntry {
+  readonly name: string;
+  readonly id: string | null;
+}
+/** The `supabase.storage.from(bucket)` methods the lifecycle blocks use. */
+interface LifecycleBucket {
+  upload(path: string, body: Blob, options?: {
+    contentType?: string;
+    upsert?: boolean;
+  }): PromiseLike<StorageReply<unknown>>;
+  createSignedUrl(path: string, expiresIn: number, options?: {
+    download?: string | boolean;
+  }): PromiseLike<StorageReply<{
+    readonly signedUrl: string;
+  }>>;
+  list(path?: string, options?: {
+    limit?: number;
+    offset?: number;
+  }): PromiseLike<StorageReply<readonly StorageEntry[]>>;
+  remove(paths: string[]): PromiseLike<StorageReply<unknown>>;
+}
+/** `supabase.storage`, typed structurally. */
+interface LifecycleStorage {
+  from(bucket: string): LifecycleBucket;
+}
+type DataExportStatus = "pending" | "running" | "ready" | "failed";
+interface DataExport {
+  readonly id: string;
+  readonly subject: "user" | "organization";
+  readonly userId: string | undefined;
+  readonly organizationId: string | undefined;
+  readonly status: DataExportStatus;
+  readonly bucket: string;
+  /** Object paths, one file per table: `{id}/{schema.table}.ndjson` (or `.csv`). */
+  readonly files: readonly string[];
+  readonly error: string | undefined;
+  readonly requestedBy: string | undefined;
+  readonly requestedAt: Temporal.Instant;
+  readonly completedAt: Temporal.Instant | undefined;
+  /** After this the files are no longer served. */
+  readonly expiresAt: Temporal.Instant | undefined;
+}
+interface OrganizationDeletion {
+  readonly organizationId: string;
+  readonly requestedBy: string | undefined;
+  readonly requestedAt: Temporal.Instant;
+  readonly purgeAfter: Temporal.Instant;
+  readonly cancelledAt: Temporal.Instant | undefined;
+  readonly purgedAt: Temporal.Instant | undefined;
+}
+interface DataExportDownload {
+  readonly export: DataExport;
+  /** One signed URL per file, keyed by the table it holds. */
+  readonly files: readonly {
+    readonly table: string;
+    readonly url: string;
+  }[];
+}
+interface DataLifecycleOptions extends BlockTemporalOptions {
+  /** The caller's transport (`rpcTransport(supabase)`). */
+  readonly transport: BlockTransport;
+  /** The caller's `supabase.storage`, for `download`. */
+  readonly storage?: LifecycleStorage;
+  /** The module schema (`sql.modules.data-lifecycle.schema`), default `better_supabase`. */
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+  /** Lifetime of a signed download URL in seconds. Default 300. */
+  readonly downloadTtl?: number;
+}
+interface DataLifecycle {
+  /** Exports the caller's data, or a tenant's with `organizationId` (needs `organization.export`). */
+  requestExport(options?: {
+    readonly organizationId?: string;
+  }): AsyncResult<DataExport>;
+  /** The caller's exports, or a tenant's, newest first. */
+  exports(organizationId?: string): AsyncResult<readonly DataExport[]>;
+  /** Signed URLs for a ready export's files. */
+  download(exportId: string): AsyncResult<DataExportDownload>;
+  /**
+   * Disables the tenant and schedules its purge after `grace` (an
+   * interval such as `30 days` or a `Temporal.Duration`; default the
+   * module's `grace` option). Needs `organization.delete`.
+   */
+  requestOrganizationDeletion(organizationId: string, options?: {
+    readonly grace?: Temporal.Duration | string;
+  }): AsyncResult<OrganizationDeletion>;
+  /** The requester or an owner cancels; `undefined` when nothing is pending. */
+  cancelOrganizationDeletion(organizationId: string): AsyncResult<OrganizationDeletion | undefined>;
+  /** The pending deletion, for members of the organization. */
+  organizationDeletion(organizationId: string): AsyncResult<OrganizationDeletion | undefined>;
+}
+/** Exports and organization deletion as the caller. */
+export declare function createDataLifecycle(options: DataLifecycleOptions): DataLifecycle;
+interface DataExporterOptions extends BlockTemporalOptions {
+  /** A service-role transport: the export functions are granted to `service_role` only. */
+  readonly transport: BlockTransport;
+  /** A service-role `supabase.storage`, to write the files. */
+  readonly storage: LifecycleStorage;
+  readonly schema?: string;
+  /** Rows read per call. Default 1000. */
+  readonly pageSize?: number;
+  /** The outbox `typePrefix`. Default `dev.better-supabase`. */
+  readonly typePrefix?: string;
+  /**
+   * `ndjson` (default) writes one JSON object per line; `csv` writes RFC
+   * 4180 CSV with a header row, nested values as JSON and formula-looking
+   * text prefixed with `'`, for people who open exports in a spreadsheet.
+   */
+  readonly format?: "ndjson" | "csv";
+  readonly concurrency?: number;
+}
+/** The payload `job` expects. */
+interface DataExportJob {
+  readonly exportId: string;
+}
+interface DataExporter {
+  /**
+   * Writes one NDJSON file per table, then marks the export ready (which
+   * emits `data_export.completed`). A failure marks it failed and returns the error.
+   */
+  run(exportId: string, signal?: AbortSignal): AsyncResult<DataExport>;
+  /** A jobs handler: `queue.work('data-exports', exporter.job)`. */
+  readonly job: JobHandler<DataExportJob>;
+  /** An outbox sink that runs each `data_export.requested` export. */
+  sink(): EventSink;
+}
+/** Runs requested exports with a service-role client. */
+export declare function createDataExporter(options: DataExporterOptions): DataExporter;
+interface OrganizationPurgerOptions extends BlockTemporalOptions {
+  /** A service-role transport: `purge_organization()` is granted to `service_role` only. */
+  readonly transport: BlockTransport;
+  /** A service-role `supabase.storage`, to remove each bucket's organization prefix. */
+  readonly storage?: LifecycleStorage;
+  /**
+   * Buckets to clear: a name, for a bucket whose paths start with the
+   * organization id (`attachments`), or `{ bucket, path }` with a path
+   * template such as `orgs/{organizationId}/files`, or a function that
+   * returns the prefixes, for buckets laid out another way.
+   */
+  readonly buckets?: readonly PurgeBucket[];
+  /** `createBilling(...)`, to cancel the subscription first. */
+  readonly billing?: {
+    cancelSubscription(organizationId: string): AsyncResult<unknown>;
+  };
+  /**
+   * Revokes the `credential_ref`s in the rows the purge deletes (provider
+   * keys, connector servers and grants, workflow credentials) before it
+   * deletes them. Only refs that carry the organization as their `tenant`
+   * are revoked; the rest are returned in `credentials.unrevoked`.
+   */
+  readonly credentials?: CredentialProvider;
+  /**
+   * Also run the `sql.modules.data-lifecycle.options.anonymize` rules in
+   * `job`, after the due purges. Default false.
+   */
+  readonly anonymize?: boolean;
+  readonly schema?: string;
+}
+/** A bucket the purger clears, and where the organization's objects are. */
+type PurgeBucket = string | {
+  readonly bucket: string;
+  /** A prefix template with `{organizationId}`, or the prefixes for an id. */
+  readonly path: string | ((organizationId: string) => string | readonly string[]);
+};
+/** A `credential_ref` the purge deleted without revoking it. */
+interface UnrevokedCredential {
+  /** `schema.table`. */
+  readonly table: string;
+  readonly column: string;
+  readonly ref: CredentialRef;
+  readonly subject: CredentialSubject;
+  /**
+   * `foreign`: the ref doesn't carry the organization as its tenant, so it
+   * may name a credential that someone else still uses; `no_provider`: the
+   * purger has no `credentials`; `not_revocable`: the provider can't revoke it.
+   */
+  readonly reason: "foreign" | "no_provider" | "not_revocable";
+}
+interface OrganizationPurge {
+  readonly organizationId: string;
+  /** Rows deleted per table. */
+  readonly deleted: Readonly<Record<string, number>>;
+  /** Objects removed per bucket. */
+  readonly removed: Readonly<Record<string, number>>;
+  readonly credentials: {
+    /** Refs revoked through `credentials`. */
+    readonly revoked: number;
+    /** Refs in the purged rows the provider still holds, for the app to handle. */
+    readonly unrevoked: readonly UnrevokedCredential[];
+  };
+}
+interface OrganizationPurger {
+  /**
+   * Checks that the deletion is due, cancels billing, revokes the
+   * organization's credentials, removes the Storage prefixes, then deletes
+   * the rows.
+   */
+  purge(organizationId: string): AsyncResult<OrganizationPurge>;
+  /** Purges every deletion past its grace period, oldest first; stops at the first error. */
+  purgeDue(options?: {
+    readonly limit?: number;
+  }): AsyncResult<readonly OrganizationPurge[]>;
+  /** A jobs handler for a cron queue: purges what is due. */
+  readonly job: JobHandler<{
+    readonly limit?: number;
+  }>;
+  /**
+   * Removes the files of exports past their `expiresAt` from Storage, then
+   * their rows; returns how many exports it removed. Needs `storage`.
+   */
+  purgeExports(options?: {
+    readonly limit?: number;
+  }): AsyncResult<number>;
+  /**
+   * Applies the `options.anonymize` rules to the rows whose time is up, at
+   * most `limit` (1000) per rule; returns the rows anonymized per table.
+   */
+  anonymizeDue(options?: {
+    readonly limit?: number;
+  }): AsyncResult<Readonly<Record<string, number>>>;
+}
+/** Purges organizations whose deletion grace period is over. */
+export declare function createOrganizationPurger(options: OrganizationPurgerOptions): OrganizationPurger;
+//#endregion
+//#region src/sql/modules/data-lifecycle.d.ts
+/** An app table in `options.tables`: its user and tenant columns. */
+interface LifecycleTable {
+  /** The column holding the user id, for user exports. */
+  readonly user?: string;
+  /** The tenant column, for organization exports and the purge. */
+  readonly tenant?: string;
+  /** Delete its tenant rows in the purge. Default true. */
+  readonly purge?: boolean;
+  readonly omit?: readonly string[];
+  readonly export?: boolean;
+}
+//#endregion
+export { type BlockTransport, type DataExport, type DataExportDownload, type DataExportJob, type DataExportStatus, type DataExporter, type DataExporterOptions, type DataLifecycle, type DataLifecycleOptions, type LifecycleBucket, type LifecycleStorage, type LifecycleTable, type OrganizationDeletion, type OrganizationPurge, type OrganizationPurger, type OrganizationPurgerOptions, type PurgeBucket, type StorageEntry, type UnrevokedCredential, rpcTransport, sqlTransport };

package/dist/blocks/data-lifecycle/index.js

@@ -0,0 +1,353 @@
+import { n as dbError } from "../../errors-B11Duf73.js";
+import { a as ok, r as err, t as AsyncResult } from "../../result-DzUbqgdW.js";
+import { n as credentialRefInTenant } from "../../provider-Di3sRutW.js";
+import { n as rpcTransport, r as sqlTransport } from "../../block-transport-BLr-ZgLc.js";
+import { D as stringsOf, O as textOf, c as errorText, d as isRecord, h as optionalText, i as blockCall, k as toInstant, m as optionalInstant, n as applyTemporal, x as recordsOf, y as recordOf } from "../../block-helpers-DWHxHsEQ.js";
+import { t as toCsv } from "../../csv-CPAzEmB6.js";
+import { t as fromStorageError } from "../../errors-DLjJHPLK.js";
+//#region src/blocks/data-lifecycle/data-lifecycle.ts
+const EXPORT_STATUSES = [
+	"pending",
+	"running",
+	"ready",
+	"failed"
+];
+function exportOf(value) {
+	const row = recordOf(value, "data_exports");
+	const status = EXPORT_STATUSES.find((candidate) => candidate === row["status"]);
+	if (status === void 0) throw new TypeError(`Unknown export status ${JSON.stringify(row["status"])}`);
+	return {
+		id: textOf(row["id"]),
+		subject: row["subject"] === "organization" ? "organization" : "user",
+		userId: optionalText(row["user_id"]),
+		organizationId: optionalText(row["organization_id"]),
+		status,
+		bucket: textOf(row["bucket"]),
+		files: stringsOf(row["files"]),
+		error: optionalText(row["error"]),
+		requestedBy: optionalText(row["requested_by"]),
+		requestedAt: toInstant(textOf(row["requested_at"])),
+		completedAt: optionalInstant(row["completed_at"]),
+		expiresAt: optionalInstant(row["expires_at"])
+	};
+}
+function deletionOf(value) {
+	const row = recordOf(value, "organization_deletions");
+	return {
+		organizationId: textOf(row["organization_id"]),
+		requestedBy: optionalText(row["requested_by"]),
+		requestedAt: toInstant(textOf(row["requested_at"])),
+		purgeAfter: toInstant(textOf(row["purge_after"])),
+		cancelledAt: optionalInstant(row["cancelled_at"]),
+		purgedAt: optionalInstant(row["purged_at"])
+	};
+}
+const optionalDeletion = (value) => isRecord(value) ? deletionOf(value) : void 0;
+function stored(reply) {
+	return AsyncResult.from(async () => {
+		try {
+			const { data, error } = await reply;
+			if (error) return err(fromStorageError(error, "storage.objects"));
+			if (data === null || data === void 0) return err(dbError("network", "Storage returned no data"));
+			return ok(data);
+		} catch (cause) {
+			return err(fromStorageError(cause, "storage.objects"));
+		}
+	});
+}
+/** The table a file holds: `{id}/public.projects.ndjson` gives `public.projects`. */
+const tableOf = (path) => path.slice(path.lastIndexOf("/") + 1).replace(/\.(ndjson|csv)$/, "");
+/** Exports and organization deletion as the caller. */
+function createDataLifecycle(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const ttl = options.downloadTtl ?? 300;
+	return {
+		requestExport: (request = {}) => call("request_data_export", request.organizationId === void 0 ? { subject: "user" } : {
+			subject: "organization",
+			tenant: request.organizationId
+		}, exportOf),
+		exports: (organizationId) => call("list_data_exports", { tenant: organizationId }, (value) => recordsOf(value, "list_data_exports").map(exportOf)),
+		download: (exportId) => call("get_data_export", { id: exportId }, (value) => value).andThen(async (value) => {
+			if (!isRecord(value)) return err(dbError("not_found", "No export you can see has this id", { hint: "DATA_EXPORT_NOT_FOUND" }));
+			const found = exportOf(value);
+			if (found.status !== "ready") return err(dbError("invalid_request", "The export is not ready", { hint: "DATA_EXPORT_NOT_READY" }));
+			if (!options.storage) return err(dbError("invalid_request", "Pass storage to createDataLifecycle to download exports"));
+			const bucket = options.storage.from(found.bucket);
+			const files = [];
+			for (const path of found.files) {
+				const signed = await stored(bucket.createSignedUrl(path, ttl, { download: true }));
+				if (!signed.ok) return signed;
+				files.push({
+					table: tableOf(path),
+					url: signed.data.signedUrl
+				});
+			}
+			return ok({
+				export: found,
+				files
+			});
+		}),
+		requestOrganizationDeletion: (organizationId, request = {}) => call("request_organization_deletion", {
+			tenant: organizationId,
+			grace: request.grace === void 0 ? void 0 : String(request.grace)
+		}, deletionOf),
+		cancelOrganizationDeletion: (organizationId) => call("cancel_organization_deletion", { tenant: organizationId }, optionalDeletion),
+		organizationDeletion: (organizationId) => call("organization_deletion", { tenant: organizationId }, optionalDeletion)
+	};
+}
+/** Runs requested exports with a service-role client. */
+function createDataExporter(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema);
+	const pageSize = options.pageSize ?? 1e3;
+	const concurrency = options.concurrency ?? 4;
+	if (!Number.isInteger(concurrency) || concurrency < 1) throw new TypeError("createDataExporter: concurrency must be a whole number above zero");
+	const prefix = `${options.typePrefix ?? "dev.better-supabase"}.`;
+	const write = async (claimed, tables, signal) => {
+		const bucket = options.storage.from(claimed.bucket);
+		const csv = options.format === "csv";
+		const exportTable = async (table) => {
+			const lines = [];
+			const records = [];
+			let after;
+			do {
+				signal?.throwIfAborted();
+				const page = await call("data_export_rows", {
+					id: claimed.id,
+					table_name: table,
+					after,
+					page_size: pageSize
+				}, (value) => recordOf(value, "data_export_rows"));
+				if (!page.ok) return page;
+				const rows = Array.isArray(page.data["rows"]) ? page.data["rows"] : [];
+				for (const row of rows) if (csv) records.push(isRecord(row) ? row : { value: row });
+				else lines.push(JSON.stringify(row));
+				after = optionalText(page.data["after"]);
+			} while (after !== void 0);
+			const path = `${claimed.id}/${table}.${csv ? "csv" : "ndjson"}`;
+			const contentType = csv ? "text/csv" : "application/x-ndjson";
+			const body = new Blob(csv ? records.length === 0 ? [] : [toCsv(records)] : lines.length === 0 ? [] : [`${lines.join("\n")}\n`], { type: contentType });
+			const uploaded = await stored(bucket.upload(path, body, {
+				contentType,
+				upsert: true
+			}));
+			return uploaded.ok ? ok(path) : uploaded;
+		};
+		const files = [];
+		let failed;
+		let next = 0;
+		let stopped = false;
+		const worker = async () => {
+			while (!stopped && failed === void 0 && next < tables.length) {
+				const index = next;
+				next += 1;
+				let written;
+				try {
+					written = await exportTable(tables[index]);
+				} catch (cause) {
+					stopped = true;
+					throw cause;
+				}
+				if (!written.ok) {
+					failed ??= written;
+					return;
+				}
+				files[index] = written.data;
+			}
+		};
+		await Promise.all(Array.from({ length: Math.min(concurrency, tables.length) }, worker));
+		return failed ?? ok(files);
+	};
+	const run = (exportId, signal) => call("claim_data_export", { id: exportId }, (value) => value).andThen(async (value) => {
+		if (!isRecord(value)) return err(dbError("not_found", "No pending export has this id", { hint: "DATA_EXPORT_NOT_FOUND" }));
+		const claimed = exportOf(value);
+		let written;
+		try {
+			written = await write(claimed, stringsOf(value["tables"]), signal);
+		} catch (cause) {
+			written = err(dbError(signal?.aborted ? "aborted" : "raised", errorText(cause), { hint: "DATA_EXPORT_FAILED" }));
+		}
+		if (!written.ok) {
+			await call("fail_data_export", {
+				id: claimed.id,
+				error: written.error.message
+			}, () => void 0);
+			return written;
+		}
+		return call("complete_data_export", {
+			id: claimed.id,
+			files: written.data
+		}, exportOf);
+	});
+	return {
+		run,
+		job: async (payload, _job, signal) => {
+			await run(payload.exportId, signal).orThrow();
+		},
+		sink: () => ({ async send(events) {
+			for (const event of events) {
+				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "data_export.requested" || !isRecord(event.data)) continue;
+				const id = optionalText(event.data["exportId"]);
+				if (id !== void 0) await run(id).orThrow();
+			}
+		} })
+	};
+}
+/** The prefixes an entry of `buckets` clears for an organization. */
+function bucketPrefixes(entry, organizationId) {
+	if (typeof entry === "string") return ok({
+		bucket: entry,
+		prefixes: [organizationId]
+	});
+	const paths = typeof entry.path === "function" ? entry.path(organizationId) : entry.path.replaceAll("{organizationId}", organizationId);
+	const prefixes = (typeof paths === "string" ? [paths] : [...paths]).map((path) => path.replace(/\/+$/, ""));
+	const unsafe = prefixes.find((prefix) => !prefix.includes(organizationId));
+	if (unsafe !== void 0) return err(dbError("invalid_request", `buckets.${entry.bucket}: the prefix "${unsafe}" doesn't contain the organization id, so it could clear other tenants' objects`));
+	return ok({
+		bucket: entry.bucket,
+		prefixes
+	});
+}
+const REMOVE_BATCH = 1e3;
+async function removePrefix(bucket, prefix) {
+	const files = [];
+	const folders = [prefix];
+	while (folders.length > 0) {
+		const folder = folders.pop() ?? prefix;
+		for (let offset = 0;; offset += REMOVE_BATCH) {
+			const page = await stored(bucket.list(folder, {
+				limit: REMOVE_BATCH,
+				offset
+			}));
+			if (!page.ok) return page;
+			for (const entry of page.data) {
+				const path = `${folder}/${entry.name}`;
+				if (entry.id === null) folders.push(path);
+				else files.push(path);
+			}
+			if (page.data.length < REMOVE_BATCH) break;
+		}
+	}
+	for (let start = 0; start < files.length; start += REMOVE_BATCH) {
+		const removed = await stored(bucket.remove(files.slice(start, start + REMOVE_BATCH)));
+		if (!removed.ok) return removed;
+	}
+	return ok(files.length);
+}
+function purgeCredentialOf(value) {
+	if (!isRecord(value)) return void 0;
+	const ref = value["ref"];
+	if (!isRecord(ref) || typeof ref["provider"] !== "string") return void 0;
+	const userId = optionalText(value["user_id"]);
+	return {
+		table: textOf(value["table"]),
+		column: textOf(value["column"]),
+		ref,
+		subject: userId === void 0 ? { type: "app" } : {
+			type: "user",
+			id: userId
+		},
+		inTenant: value["in_tenant"] === true
+	};
+}
+/** Purges organizations whose deletion grace period is over. */
+function createOrganizationPurger(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema);
+	const revokeCredentials = (organizationId, rows) => AsyncResult.from(async () => {
+		let revoked = 0;
+		const unrevoked = [];
+		const keep = (row, reason) => {
+			unrevoked.push({
+				table: row.table,
+				column: row.column,
+				ref: row.ref,
+				subject: row.subject,
+				reason
+			});
+		};
+		for (const row of rows) if (!row.inTenant || !credentialRefInTenant(row.ref, organizationId)) keep(row, "foreign");
+		else if (options.credentials === void 0) keep(row, "no_provider");
+		else if (options.credentials.capabilities(row.ref).revoke) {
+			const result = await options.credentials.revoke(row.ref, { subject: row.subject });
+			if (!result.ok) return result;
+			revoked += 1;
+		} else keep(row, "not_revocable");
+		return ok({
+			revoked,
+			unrevoked
+		});
+	});
+	const purge = (organizationId) => AsyncResult.from(async () => {
+		const refs = await call("organization_credential_refs", { tenant: organizationId }, (value) => Array.isArray(value) ? value.flatMap((row) => {
+			const parsed = purgeCredentialOf(row);
+			return parsed ? [parsed] : [];
+		}) : []);
+		if (!refs.ok) return refs;
+		if (options.billing) {
+			const cancelled = await options.billing.cancelSubscription(organizationId);
+			if (!cancelled.ok) return cancelled;
+		}
+		const credentials = await revokeCredentials(organizationId, refs.data);
+		if (!credentials.ok) return credentials;
+		const removed = {};
+		for (const entry of options.buckets ?? []) {
+			if (!options.storage) return err(dbError("invalid_request", "Pass storage to clear buckets"));
+			const target = bucketPrefixes(entry, organizationId);
+			if (!target.ok) return target;
+			const { bucket, prefixes } = target.data;
+			for (const prefix of prefixes) {
+				const count = await removePrefix(options.storage.from(bucket), prefix);
+				if (!count.ok) return count;
+				removed[bucket] = (removed[bucket] ?? 0) + count.data;
+			}
+		}
+		return call("purge_organization", { tenant: organizationId }, (value) => {
+			const row = recordOf(value, "purge_organization");
+			const deleted = isRecord(row["deleted"]) ? row["deleted"] : {};
+			return {
+				organizationId: textOf(row["organizationId"]),
+				deleted: Object.fromEntries(Object.entries(deleted).map(([table, count]) => [table, Number(count)])),
+				removed,
+				credentials: credentials.data
+			};
+		});
+	});
+	const purgeDue = (due = {}) => call("due_organization_deletions", { max_rows: due.limit }, (value) => recordsOf(value, "due_organization_deletions").map(deletionOf)).andThen(async (deletions) => {
+		const purged = [];
+		for (const deletion of deletions) {
+			const result = await purge(deletion.organizationId);
+			if (!result.ok) return result;
+			purged.push(result.data);
+		}
+		return ok(purged);
+	});
+	const purgeExports = (expired = {}) => call("expired_data_exports", { max_rows: expired.limit ?? 100 }, (value) => recordsOf(value, "expired_data_exports").map((row) => ({
+		id: textOf(row["id"]),
+		bucket: textOf(row["bucket"]),
+		files: Array.isArray(row["files"]) ? row["files"].filter((file) => typeof file === "string") : []
+	}))).andThen(async (exports) => {
+		if (exports.length === 0) return ok(0);
+		const storage = options.storage;
+		if (!storage) return err(dbError("invalid_request", "Pass storage to remove export files"));
+		for (const entry of exports) for (let start = 0; start < entry.files.length; start += REMOVE_BATCH) {
+			const removed = await stored(storage.from(entry.bucket).remove(entry.files.slice(start, start + REMOVE_BATCH)));
+			if (!removed.ok) return removed;
+		}
+		return call("forget_data_exports", { ids: exports.map((entry) => entry.id) }, (value) => Number(value ?? 0));
+	});
+	const anonymizeDue = (due = {}) => call("anonymize_due", { max_rows: due.limit }, (value) => Object.fromEntries(Object.entries(isRecord(value) ? value : {}).map(([table, count]) => [table, Number(count)])));
+	return {
+		purgeExports,
+		purge,
+		purgeDue,
+		anonymizeDue,
+		job: async (payload) => {
+			await purgeDue(payload).orThrow();
+			if (options.anonymize) await anonymizeDue().orThrow();
+		}
+	};
+}
+//#endregion
+export { createDataExporter, createDataLifecycle, createOrganizationPurger, rpcTransport, sqlTransport };

package/dist/blocks/entitlements/index.d.ts

@@ -0,0 +1,14 @@
+import { t as AsyncResult } from "../../result-D7y2fT87.js";
+import { t as SqlClient } from "../../executor-DbvExCFC.js";
+import { i as hasEntitlement, n as EntitlementKey, t as EntitlementClaimOptions } from "../../entitlements-DHrY2UDZ.js";
+//#region src/blocks/entitlements/entitlements.d.ts
+/** The Stripe event sent when a customer's active entitlements change. */
+export declare const ENTITLEMENTS_UPDATED = "entitlements.active_entitlement_summary.updated";
+/**
+ * Users whose `memberships` claim carries the entitlements of the Stripe
+ * customer in an `entitlements.active_entitlement_summary.updated` event, so
+ * a job can invalidate their sessions. Empty for other payloads.
+ */
+export declare function entitlementMembers(sql: SqlClient, payload: unknown): AsyncResult<readonly string[]>;
+//#endregion
+export { type EntitlementClaimOptions, type EntitlementKey, hasEntitlement };

package/dist/blocks/entitlements/index.js

@@ -0,0 +1,25 @@
+import { n as entitlementMembers, t as ENTITLEMENTS_UPDATED } from "../../entitlements-DRl6ZJUm.js";
+//#region src/auth/entitlements.ts
+/**
+* Whether the session's plan-features claim grants `key` in `tenantId`.
+* `claim` is `config.claims.features` (default `features`), the claim
+* `better_supabase.feature_claims()` fills, or `{ claim, keys }` when
+* `entitlements.claim.keys` writes short codes. The claim is as fresh as the
+* token: enforce it in RLS with `better_supabase.has_entitlement()`, and
+* refresh the session after checkout. A tenant left out by
+* `entitlements.claim.maxTenants` reads as not granted.
+*/
+function hasEntitlement(session, tenantId, key, claim = "features") {
+	if (session.kind !== "user") return false;
+	const options = typeof claim === "string" ? { claim } : claim;
+	const claims = session.claims;
+	if (!isRecord(claims)) return false;
+	const features = claims[options.claim ?? "features"];
+	if (!isRecord(features) || !Object.hasOwn(features, tenantId)) return false;
+	const keys = features[tenantId];
+	const code = options.keys?.[key] ?? key;
+	return Array.isArray(keys) && keys.includes(code);
+}
+const isRecord = (value) => typeof value === "object" && value !== null;
+//#endregion
+export { ENTITLEMENTS_UPDATED, entitlementMembers, hasEntitlement };