@glideco/compliance-export

npm install @glideco/compliance-export

import {
  validateRange,
  splitIntoMonthlyShards,
} from '@glideco/compliance-export';
import { parseISO } from 'date-fns';

const range = {
  since: parseISO('2025-01-01T00:00:00Z'),
  until: parseISO('2026-06-30T23:59:59Z'),
};

const v = validateRange(range);
if (v.ok) {
  // Within one year — single-shot export.
  await enqueueExport(range);
} else if (v.reason === 'exceeds-one-year') {
  // Fragment into monthly shards (18 shards for the range above).
  const shards = splitIntoMonthlyShards(range);
  for (const shard of shards) {
    await enqueueExport(shard);
  }
  return { fragmented: true, count: shards.length };
} else {
  // v.reason === 'invalid-range' (since >= until) or other edge cases.
  throw new Error(v.message);
}

import { buildEnvelope } from '@glideco/compliance-export';

const envelope = buildEnvelope({
  entityId: 'entity_gbl_0bdf3c',
  entityName: 'Glide Operator Co',
  range: {
    since: new Date('2026-01-01T00:00:00Z'),
    until: new Date('2026-01-31T23:59:59Z'),
  },
  rows: dbRows.map((r) => ({
    id: r.id,
    createdAt: r.createdAt,
    action: r.action,
    riskVerdict: r.riskVerdict,
    vendorUsed: r.vendorUsed,
    onChainTx: r.onChainTx,
    policyVersion: r.policyVersion,
    redactedFieldsBitmap: r.redactedFieldsBitmap,
  })),
});

return Response.json(envelope);

import { GetObjectCommand, S3Client } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
import { refreshSignedUrl, type Signer } from '@glideco/compliance-export';

const s3 = new S3Client({ region: 'us-east-1' });

const signer: Signer = async ({ bucket, key, expiresInSeconds }) => {
  const url = await getSignedUrl(
    s3,
    new GetObjectCommand({ Bucket: bucket, Key: key }),
    { expiresIn: expiresInSeconds },
  );
  return {
    url,
    expiresAt: new Date(Date.now() + expiresInSeconds * 1000),
  };
};

// In the polling tRPC endpoint:
const fresh = await refreshSignedUrl({
  signer,
  bucket: process.env.S3_EXPORTS_BUCKET!,
  key: row.s3Key,
  current: row.cachedUrl
    ? { url: row.cachedUrl, expiresAt: row.cachedUrlExpiresAt }
    : null,
});

await db
  .update(complianceExports)
  .set({ cachedUrl: fresh.url, cachedUrlExpiresAt: fresh.expiresAt })
  .where(eq(complianceExports.id, row.id));

import {
  S3StandardStorage,
  S3GlacierInstantStorage,
  S3GlacierDeepStorage,
} from '@glideco/compliance-export';
import {
  S3Client,
  PutObjectCommand,
  GetObjectCommand,
} from '@aws-sdk/client-s3';

const s3 = new S3Client({ region: 'eu-west-1' });
const commands = {
  put: (args) => new PutObjectCommand(args),
  get: (args) => new GetObjectCommand(args),
};

// Cold tier — millisecond retrieval, lower cost than STANDARD.
const cold = new S3GlacierInstantStorage({
  client: s3,
  commands,
  bucket: 'glide-activity-logs',
  keyPrefix: 'tenants/entity_gbl_0bdf3c',
});

const archived = await cold.archive({
  rowId: 'row_a1b2c3',
  body: JSON.stringify(logRow),
  metadata: { entityId: 'entity_gbl_0bdf3c', exportShardId: 'shard_2026_01' },
});
// archived = { key: 'tenants/entity_gbl_0bdf3c/cold/row_a1b2c3.json', bytes: 412, ... }

// Regulatory tier — minutes-to-hours retrieval; operator opts in per entity.
const regulatory = new S3GlacierDeepStorage({
  client: s3,
  commands,
  bucket: 'glide-activity-logs-regulatory',
  keyPrefix: 'tenants/entity_gbl_0bdf3c',
});