@ai-matrx/auth 0.1.3 → 0.2.0

package/dist/next.cjs

@@ -29,8 +29,11 @@ __export(next_exports, {
   createAuthBudget: () => createAuthBudget,
   createAuthCookie: () => createAuthCookie,
   createNextSupabase: () => createNextSupabase,
+  createServerAuth: () => createServerAuth,
+  createServiceClient: () => createServiceClient,
   serializeSetCookie: () => serializeSetCookie,
-  toResponseCookie: () => toResponseCookie
+  toResponseCookie: () => toResponseCookie,
+  verifyRequest: () => verifyRequest
 });
 module.exports = __toCommonJS(next_exports);
 
@@ -653,3 +656,132 @@ function createNextSupabase(config) {
     middlewareSession
   };
 }
+
+// src/server-auth.ts
+var import_supabase_js2 = require("@supabase/supabase-js");
+
+// src/claims.ts
+var import_supabase_js = require("@supabase/supabase-js");
+async function getClaimsUser(client, jwt, options) {
+  const { data, error } = options ? await client.auth.getClaims(jwt, options) : await client.auth.getClaims(jwt);
+  if (error) {
+    if (isSignedOutError(error)) return { data: { user: null }, error: null };
+    return { data: { user: null }, error };
+  }
+  if (!data?.claims) return { data: { user: null }, error: null };
+  const user = userFromClaims(data.claims);
+  if (!user) {
+    return {
+      data: { user: null },
+      error: new import_supabase_js.AuthError("Verified token carries no `sub` claim", 401, "bad_jwt")
+    };
+  }
+  return { data: { user }, error: null };
+}
+var BUDGET_EXHAUSTED_STATUS = 408;
+var BUDGET_EXHAUSTED_CODE = "auth_budget_exhausted";
+function isAuthTransportFailure2(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return true;
+  const status = error.status;
+  if (status === 0 || status === 504 || status === 503) return true;
+  return status === BUDGET_EXHAUSTED_STATUS || error.code === BUDGET_EXHAUSTED_CODE;
+}
+function isSignedOutError(error) {
+  return error instanceof import_supabase_js.AuthSessionMissingError || error.name === "AuthSessionMissingError" || error.code === "session_not_found";
+}
+function userFromClaims(claims) {
+  if (!claims || typeof claims.sub !== "string") return null;
+  return {
+    ...claims,
+    id: claims.sub,
+    app_metadata: claims.app_metadata ?? {},
+    user_metadata: claims.user_metadata ?? {}
+  };
+}
+function accountFlagsFor(claims) {
+  if (!claims) return { isGuest: false, hasAccount: false };
+  const isGuest = claims.is_anonymous === true;
+  return { isGuest, hasAccount: !isGuest };
+}
+var PROJECT_SIGNING_KEY_AUTHORITIES = [
+  "db.matrxserver.com",
+  "brsgrqvjdzwihsvnfqkf.supabase.co"
+];
+var PROJECT_SIGNING_KEYS = [
+  {
+    alg: "ES256",
+    crv: "P-256",
+    ext: true,
+    key_ops: ["verify"],
+    kid: "a00aed0b-202c-483a-91ff-fc74719a3bb2",
+    kty: "EC",
+    use: "sig",
+    x: "guqOsgjJqGVU6g_K0iIXKrzixlkeXKOqkPUQCconp6U",
+    y: "39zQtkzlfQuPf_MtIhYmMdxNQpIR2Pkl11AToywaslY"
+  }
+];
+function pinnedSigningKeysFor(supabaseUrl) {
+  if (!supabaseUrl) return [];
+  let host;
+  try {
+    host = new URL(supabaseUrl).host.toLowerCase();
+  } catch {
+    return [];
+  }
+  return PROJECT_SIGNING_KEY_AUTHORITIES.includes(host) ? PROJECT_SIGNING_KEYS : [];
+}
+
+// src/server-auth.ts
+function createServerAuth(options) {
+  const warn = options.warn ?? ((m) => console.warn(m));
+  const resolveOnce = async () => {
+    const client = await options.createClient();
+    const {
+      data: { user },
+      error
+    } = await getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.supabaseUrl) } });
+    const authUnavailable = !user && error !== null && isAuthTransportFailure2(error);
+    if (authUnavailable) {
+      warn(
+        `[getServerAuth] identity could not be verified on this attempt \u2014 rendering without a user, NOT as signed out. Cause: ${error?.name ?? "unknown"}: ${error?.message ?? ""}`
+      );
+    }
+    return { isAuthenticated: !!user, user, authUnavailable, ...accountFlagsFor(user) };
+  };
+  const door = async () => {
+    const first = await resolveOnce();
+    if (!first.authUnavailable) return first;
+    await new Promise((resolve) => setTimeout(resolve, options.retryAfterMs ?? 250));
+    const second = await resolveOnce();
+    if (!second.authUnavailable) warn("[getServerAuth] identity verified on the retry \u2014 the first attempt's budget was spent.");
+    return second;
+  };
+  return options.cache ? options.cache(door) : door;
+}
+async function verifyRequest(request, options) {
+  const header = request.headers.get("Authorization") ?? request.headers.get("authorization");
+  if (header?.startsWith("Bearer ")) {
+    const token = header.slice(7);
+    const client2 = (0, import_supabase_js2.createClient)(options.url, options.publishableKey, {
+      global: { headers: { Authorization: `Bearer ${token}` } },
+      auth: { persistSession: false, autoRefreshToken: false }
+    });
+    const { data: data2, error: error2 } = await getClaimsUser(client2, token, {
+      jwks: { keys: pinnedSigningKeysFor(options.url) }
+    });
+    return { user: data2.user, error: error2 };
+  }
+  if (!options.cookieClient) return { user: null, error: null };
+  const client = await options.cookieClient();
+  const { data, error } = await getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.url) } });
+  return { user: data.user, error };
+}
+function createServiceClient(options) {
+  const url = options.url?.trim();
+  const key = options.secretKey?.trim();
+  if (!url) throw new Error("createServiceClient: the Supabase URL is not configured");
+  if (!key) throw new Error("createServiceClient: the secret key (SUPABASE_SECRET_KEY) is not configured");
+  return (0, import_supabase_js2.createClient)(url, key, { auth: { persistSession: false, autoRefreshToken: false } });
+}

package/dist/next.d.cts

@@ -1,6 +1,8 @@
 import { createServerClient, createBrowserClient } from '@supabase/ssr';
 import { b as AuthCookieValue, A as AuthCookie, a as AuthCookieOptions } from './auth-cookie-DWx6Q3xo.cjs';
 export { C as CreateAuthCookieArgs, D as DEFAULT_AUTH_COOKIE_NAME, c as createAuthCookie } from './auth-cookie-DWx6Q3xo.cjs';
+import { SupabaseClient } from '@supabase/supabase-js';
+import { a as ClaimsCapableClient, A as ApiClaimsUser } from './claims-DXdbe3cW.cjs';
 
 /**
  * @ai-matrx/data/next — the Next.js Supabase binding.
@@ -386,4 +388,78 @@ interface NextSupabase<DB extends DatabaseLike> {
 }
 declare function createNextSupabase<DB extends DatabaseLike = DatabaseLike>(config: NextSupabaseConfig): NextSupabase<DB>;
 
-export { AMBIGUOUS_AUTH_COOKIE_HEADER, AUTH_COOKIE_RESPONSE_HEADERS, AUTH_REFRESH_CEILING_MS, type AuthBudget, AuthCookie, AuthCookieOptions, AuthCookieValue, type CookieToSet, type DatabaseLike, type MiddlewareResponse, type MiddlewareSession, type MiddlewareSessionArgs, MissingSupabaseIdentityError, type NextBrowserClient, type NextServerClient, type NextSupabase, type NextSupabaseConfig, type RequestCookieJar, type ResponseCookie, type ResponseCookieJar, SPLIT_COOKIE_JAR_HEADER, type ServerCookieStore, createAuthBudget, createNextSupabase, serializeSetCookie, toResponseCookie };
+/**
+ * Server identity doors (moved from the website's `utils/supabase/{getServerAuth,resolveUser,
+ * adminClient}.ts`, 2026-10-12). Framework-free: the app injects how it builds its cookie client,
+ * and (for Next) React's `cache()` so one request resolves once. Exported from `/next` and `/node`.
+ */
+
+interface ServerAuthState {
+    /** `true` when the request carries a locally verified access token. */
+    isAuthenticated: boolean;
+    /** The verified caller (claims, `id` = `sub`), or `null` for guests and unresolvable requests. */
+    user: ApiClaimsUser | null;
+    /**
+     * `true` when no verdict could be REACHED (authority/JWKS unreachable, identity budget spent).
+     * The person is NOT signed out: never bounce to sign-in on it. Never set for a token that was
+     * judged bad — that is a settled answer, the same line the proxy draws.
+     */
+    authUnavailable: boolean;
+    /** `true` for a guest (anonymous) session. */
+    isGuest: boolean;
+    /** `isAuthenticated && !isGuest` — the flag account UI keys on. */
+    hasAccount: boolean;
+}
+interface ServerAuthOptions {
+    /** A FRESH cookie-bound client per attempt (the identity budget belongs to the client). */
+    createClient: () => Promise<ClaimsCapableClient> | ClaimsCapableClient;
+    /** The URL the app talks to — decides which pinned keys apply. */
+    supabaseUrl: string | null | undefined;
+    /** React's `cache` on a Next server, so the whole tree shares one resolve per request. */
+    cache?: <F extends (...args: never[]) => unknown>(fn: F) => F;
+    /** Wait before the one retry (default 250ms). */
+    retryAfterMs?: number;
+    /** Where the "could not verify" warnings go (default `console.warn`). */
+    warn?: (message: string) => void;
+}
+/**
+ * Build THE server identity door: claims verified locally, asked twice before it hands anyone
+ * "could not verify" (that is almost always one cold first load spending its budget).
+ *
+ *   export const getServerAuth = createServerAuth({ createClient, supabaseUrl, cache });
+ */
+declare function createServerAuth(options: ServerAuthOptions): () => Promise<ServerAuthState>;
+/** The bit of a request this needs: its headers (a `Request`, a `NextRequest`, a Node shim). */
+interface RequestLike {
+    headers: {
+        get(name: string): string | null;
+    };
+}
+interface VerifyRequestOptions {
+    url: string;
+    /** The publishable key (`sb_publishable_*`). */
+    publishableKey: string;
+    /** The app's cookie-bound client, used when the request carries no Bearer token. */
+    cookieClient?: () => Promise<ClaimsCapableClient> | ClaimsCapableClient;
+}
+/**
+ * Who is calling this API route: a Bearer token (public/mobile/extension/desktop clients) or the
+ * session cookie (browser). `user` is null when the caller is signed out OR could not be verified;
+ * `error` tells the two apart (null = settled signed out).
+ */
+declare function verifyRequest(request: RequestLike, options: VerifyRequestOptions): Promise<{
+    user: ApiClaimsUser | null;
+    error: Error | null;
+}>;
+/**
+ * THE service (secret-key) client — server-only, bypasses row security. The package's browser
+ * clients refuse a secret key by design (`SecretKeyRefusedError`); this is the one door for it.
+ * Never ship it to a browser bundle: it lives in `/node` and `/next` only.
+ */
+declare function createServiceClient<Database = unknown>(options: {
+    url: string | null | undefined;
+    /** `sb_secret_*` (the legacy service-role JWT is banned). */
+    secretKey: string | null | undefined;
+}): SupabaseClient<Database>;
+
+export { AMBIGUOUS_AUTH_COOKIE_HEADER, AUTH_COOKIE_RESPONSE_HEADERS, AUTH_REFRESH_CEILING_MS, type AuthBudget, AuthCookie, AuthCookieOptions, AuthCookieValue, type CookieToSet, type DatabaseLike, type MiddlewareResponse, type MiddlewareSession, type MiddlewareSessionArgs, MissingSupabaseIdentityError, type NextBrowserClient, type NextServerClient, type NextSupabase, type NextSupabaseConfig, type RequestCookieJar, type RequestLike, type ResponseCookie, type ResponseCookieJar, SPLIT_COOKIE_JAR_HEADER, type ServerAuthOptions, type ServerAuthState, type ServerCookieStore, type VerifyRequestOptions, createAuthBudget, createNextSupabase, createServerAuth, createServiceClient, serializeSetCookie, toResponseCookie, verifyRequest };

package/dist/next.d.ts

@@ -1,6 +1,8 @@
 import { createServerClient, createBrowserClient } from '@supabase/ssr';
 import { b as AuthCookieValue, A as AuthCookie, a as AuthCookieOptions } from './auth-cookie-DWx6Q3xo.js';
 export { C as CreateAuthCookieArgs, D as DEFAULT_AUTH_COOKIE_NAME, c as createAuthCookie } from './auth-cookie-DWx6Q3xo.js';
+import { SupabaseClient } from '@supabase/supabase-js';
+import { a as ClaimsCapableClient, A as ApiClaimsUser } from './claims-DXdbe3cW.js';
 
 /**
  * @ai-matrx/data/next — the Next.js Supabase binding.
@@ -386,4 +388,78 @@ interface NextSupabase<DB extends DatabaseLike> {
 }
 declare function createNextSupabase<DB extends DatabaseLike = DatabaseLike>(config: NextSupabaseConfig): NextSupabase<DB>;
 
-export { AMBIGUOUS_AUTH_COOKIE_HEADER, AUTH_COOKIE_RESPONSE_HEADERS, AUTH_REFRESH_CEILING_MS, type AuthBudget, AuthCookie, AuthCookieOptions, AuthCookieValue, type CookieToSet, type DatabaseLike, type MiddlewareResponse, type MiddlewareSession, type MiddlewareSessionArgs, MissingSupabaseIdentityError, type NextBrowserClient, type NextServerClient, type NextSupabase, type NextSupabaseConfig, type RequestCookieJar, type ResponseCookie, type ResponseCookieJar, SPLIT_COOKIE_JAR_HEADER, type ServerCookieStore, createAuthBudget, createNextSupabase, serializeSetCookie, toResponseCookie };
+/**
+ * Server identity doors (moved from the website's `utils/supabase/{getServerAuth,resolveUser,
+ * adminClient}.ts`, 2026-10-12). Framework-free: the app injects how it builds its cookie client,
+ * and (for Next) React's `cache()` so one request resolves once. Exported from `/next` and `/node`.
+ */
+
+interface ServerAuthState {
+    /** `true` when the request carries a locally verified access token. */
+    isAuthenticated: boolean;
+    /** The verified caller (claims, `id` = `sub`), or `null` for guests and unresolvable requests. */
+    user: ApiClaimsUser | null;
+    /**
+     * `true` when no verdict could be REACHED (authority/JWKS unreachable, identity budget spent).
+     * The person is NOT signed out: never bounce to sign-in on it. Never set for a token that was
+     * judged bad — that is a settled answer, the same line the proxy draws.
+     */
+    authUnavailable: boolean;
+    /** `true` for a guest (anonymous) session. */
+    isGuest: boolean;
+    /** `isAuthenticated && !isGuest` — the flag account UI keys on. */
+    hasAccount: boolean;
+}
+interface ServerAuthOptions {
+    /** A FRESH cookie-bound client per attempt (the identity budget belongs to the client). */
+    createClient: () => Promise<ClaimsCapableClient> | ClaimsCapableClient;
+    /** The URL the app talks to — decides which pinned keys apply. */
+    supabaseUrl: string | null | undefined;
+    /** React's `cache` on a Next server, so the whole tree shares one resolve per request. */
+    cache?: <F extends (...args: never[]) => unknown>(fn: F) => F;
+    /** Wait before the one retry (default 250ms). */
+    retryAfterMs?: number;
+    /** Where the "could not verify" warnings go (default `console.warn`). */
+    warn?: (message: string) => void;
+}
+/**
+ * Build THE server identity door: claims verified locally, asked twice before it hands anyone
+ * "could not verify" (that is almost always one cold first load spending its budget).
+ *
+ *   export const getServerAuth = createServerAuth({ createClient, supabaseUrl, cache });
+ */
+declare function createServerAuth(options: ServerAuthOptions): () => Promise<ServerAuthState>;
+/** The bit of a request this needs: its headers (a `Request`, a `NextRequest`, a Node shim). */
+interface RequestLike {
+    headers: {
+        get(name: string): string | null;
+    };
+}
+interface VerifyRequestOptions {
+    url: string;
+    /** The publishable key (`sb_publishable_*`). */
+    publishableKey: string;
+    /** The app's cookie-bound client, used when the request carries no Bearer token. */
+    cookieClient?: () => Promise<ClaimsCapableClient> | ClaimsCapableClient;
+}
+/**
+ * Who is calling this API route: a Bearer token (public/mobile/extension/desktop clients) or the
+ * session cookie (browser). `user` is null when the caller is signed out OR could not be verified;
+ * `error` tells the two apart (null = settled signed out).
+ */
+declare function verifyRequest(request: RequestLike, options: VerifyRequestOptions): Promise<{
+    user: ApiClaimsUser | null;
+    error: Error | null;
+}>;
+/**
+ * THE service (secret-key) client — server-only, bypasses row security. The package's browser
+ * clients refuse a secret key by design (`SecretKeyRefusedError`); this is the one door for it.
+ * Never ship it to a browser bundle: it lives in `/node` and `/next` only.
+ */
+declare function createServiceClient<Database = unknown>(options: {
+    url: string | null | undefined;
+    /** `sb_secret_*` (the legacy service-role JWT is banned). */
+    secretKey: string | null | undefined;
+}): SupabaseClient<Database>;
+
+export { AMBIGUOUS_AUTH_COOKIE_HEADER, AUTH_COOKIE_RESPONSE_HEADERS, AUTH_REFRESH_CEILING_MS, type AuthBudget, AuthCookie, AuthCookieOptions, AuthCookieValue, type CookieToSet, type DatabaseLike, type MiddlewareResponse, type MiddlewareSession, type MiddlewareSessionArgs, MissingSupabaseIdentityError, type NextBrowserClient, type NextServerClient, type NextSupabase, type NextSupabaseConfig, type RequestCookieJar, type RequestLike, type ResponseCookie, type ResponseCookieJar, SPLIT_COOKIE_JAR_HEADER, type ServerAuthOptions, type ServerAuthState, type ServerCookieStore, type VerifyRequestOptions, createAuthBudget, createNextSupabase, createServerAuth, createServiceClient, serializeSetCookie, toResponseCookie, verifyRequest };

package/dist/next.js

@@ -622,6 +622,138 @@ function createNextSupabase(config) {
     middlewareSession
   };
 }
+
+// src/server-auth.ts
+import { createClient } from "@supabase/supabase-js";
+
+// src/claims.ts
+import {
+  AuthError,
+  AuthSessionMissingError
+} from "@supabase/supabase-js";
+async function getClaimsUser(client, jwt, options) {
+  const { data, error } = options ? await client.auth.getClaims(jwt, options) : await client.auth.getClaims(jwt);
+  if (error) {
+    if (isSignedOutError(error)) return { data: { user: null }, error: null };
+    return { data: { user: null }, error };
+  }
+  if (!data?.claims) return { data: { user: null }, error: null };
+  const user = userFromClaims(data.claims);
+  if (!user) {
+    return {
+      data: { user: null },
+      error: new AuthError("Verified token carries no `sub` claim", 401, "bad_jwt")
+    };
+  }
+  return { data: { user }, error: null };
+}
+var BUDGET_EXHAUSTED_STATUS = 408;
+var BUDGET_EXHAUSTED_CODE = "auth_budget_exhausted";
+function isAuthTransportFailure2(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return true;
+  const status = error.status;
+  if (status === 0 || status === 504 || status === 503) return true;
+  return status === BUDGET_EXHAUSTED_STATUS || error.code === BUDGET_EXHAUSTED_CODE;
+}
+function isSignedOutError(error) {
+  return error instanceof AuthSessionMissingError || error.name === "AuthSessionMissingError" || error.code === "session_not_found";
+}
+function userFromClaims(claims) {
+  if (!claims || typeof claims.sub !== "string") return null;
+  return {
+    ...claims,
+    id: claims.sub,
+    app_metadata: claims.app_metadata ?? {},
+    user_metadata: claims.user_metadata ?? {}
+  };
+}
+function accountFlagsFor(claims) {
+  if (!claims) return { isGuest: false, hasAccount: false };
+  const isGuest = claims.is_anonymous === true;
+  return { isGuest, hasAccount: !isGuest };
+}
+var PROJECT_SIGNING_KEY_AUTHORITIES = [
+  "db.matrxserver.com",
+  "brsgrqvjdzwihsvnfqkf.supabase.co"
+];
+var PROJECT_SIGNING_KEYS = [
+  {
+    alg: "ES256",
+    crv: "P-256",
+    ext: true,
+    key_ops: ["verify"],
+    kid: "a00aed0b-202c-483a-91ff-fc74719a3bb2",
+    kty: "EC",
+    use: "sig",
+    x: "guqOsgjJqGVU6g_K0iIXKrzixlkeXKOqkPUQCconp6U",
+    y: "39zQtkzlfQuPf_MtIhYmMdxNQpIR2Pkl11AToywaslY"
+  }
+];
+function pinnedSigningKeysFor(supabaseUrl) {
+  if (!supabaseUrl) return [];
+  let host;
+  try {
+    host = new URL(supabaseUrl).host.toLowerCase();
+  } catch {
+    return [];
+  }
+  return PROJECT_SIGNING_KEY_AUTHORITIES.includes(host) ? PROJECT_SIGNING_KEYS : [];
+}
+
+// src/server-auth.ts
+function createServerAuth(options) {
+  const warn = options.warn ?? ((m) => console.warn(m));
+  const resolveOnce = async () => {
+    const client = await options.createClient();
+    const {
+      data: { user },
+      error
+    } = await getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.supabaseUrl) } });
+    const authUnavailable = !user && error !== null && isAuthTransportFailure2(error);
+    if (authUnavailable) {
+      warn(
+        `[getServerAuth] identity could not be verified on this attempt \u2014 rendering without a user, NOT as signed out. Cause: ${error?.name ?? "unknown"}: ${error?.message ?? ""}`
+      );
+    }
+    return { isAuthenticated: !!user, user, authUnavailable, ...accountFlagsFor(user) };
+  };
+  const door = async () => {
+    const first = await resolveOnce();
+    if (!first.authUnavailable) return first;
+    await new Promise((resolve) => setTimeout(resolve, options.retryAfterMs ?? 250));
+    const second = await resolveOnce();
+    if (!second.authUnavailable) warn("[getServerAuth] identity verified on the retry \u2014 the first attempt's budget was spent.");
+    return second;
+  };
+  return options.cache ? options.cache(door) : door;
+}
+async function verifyRequest(request, options) {
+  const header = request.headers.get("Authorization") ?? request.headers.get("authorization");
+  if (header?.startsWith("Bearer ")) {
+    const token = header.slice(7);
+    const client2 = createClient(options.url, options.publishableKey, {
+      global: { headers: { Authorization: `Bearer ${token}` } },
+      auth: { persistSession: false, autoRefreshToken: false }
+    });
+    const { data: data2, error: error2 } = await getClaimsUser(client2, token, {
+      jwks: { keys: pinnedSigningKeysFor(options.url) }
+    });
+    return { user: data2.user, error: error2 };
+  }
+  if (!options.cookieClient) return { user: null, error: null };
+  const client = await options.cookieClient();
+  const { data, error } = await getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.url) } });
+  return { user: data.user, error };
+}
+function createServiceClient(options) {
+  const url = options.url?.trim();
+  const key = options.secretKey?.trim();
+  if (!url) throw new Error("createServiceClient: the Supabase URL is not configured");
+  if (!key) throw new Error("createServiceClient: the secret key (SUPABASE_SECRET_KEY) is not configured");
+  return createClient(url, key, { auth: { persistSession: false, autoRefreshToken: false } });
+}
 export {
   AMBIGUOUS_AUTH_COOKIE_HEADER,
   AUTH_COOKIE_RESPONSE_HEADERS,
@@ -632,6 +764,9 @@ export {
   createAuthBudget,
   createAuthCookie,
   createNextSupabase,
+  createServerAuth,
+  createServiceClient,
   serializeSetCookie,
-  toResponseCookie
+  toResponseCookie,
+  verifyRequest
 };

package/dist/node.cjs

@@ -20,9 +20,143 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/node.ts
 var node_exports = {};
 __export(node_exports, {
-  fileStorage: () => fileStorage
+  createServerAuth: () => createServerAuth,
+  createServiceClient: () => createServiceClient,
+  fileStorage: () => fileStorage,
+  verifyRequest: () => verifyRequest
 });
 module.exports = __toCommonJS(node_exports);
+
+// src/server-auth.ts
+var import_supabase_js2 = require("@supabase/supabase-js");
+
+// src/claims.ts
+var import_supabase_js = require("@supabase/supabase-js");
+async function getClaimsUser(client, jwt, options) {
+  const { data, error } = options ? await client.auth.getClaims(jwt, options) : await client.auth.getClaims(jwt);
+  if (error) {
+    if (isSignedOutError(error)) return { data: { user: null }, error: null };
+    return { data: { user: null }, error };
+  }
+  if (!data?.claims) return { data: { user: null }, error: null };
+  const user = userFromClaims(data.claims);
+  if (!user) {
+    return {
+      data: { user: null },
+      error: new import_supabase_js.AuthError("Verified token carries no `sub` claim", 401, "bad_jwt")
+    };
+  }
+  return { data: { user }, error: null };
+}
+var BUDGET_EXHAUSTED_STATUS = 408;
+var BUDGET_EXHAUSTED_CODE = "auth_budget_exhausted";
+function isAuthTransportFailure(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return true;
+  const status = error.status;
+  if (status === 0 || status === 504 || status === 503) return true;
+  return status === BUDGET_EXHAUSTED_STATUS || error.code === BUDGET_EXHAUSTED_CODE;
+}
+function isSignedOutError(error) {
+  return error instanceof import_supabase_js.AuthSessionMissingError || error.name === "AuthSessionMissingError" || error.code === "session_not_found";
+}
+function userFromClaims(claims) {
+  if (!claims || typeof claims.sub !== "string") return null;
+  return {
+    ...claims,
+    id: claims.sub,
+    app_metadata: claims.app_metadata ?? {},
+    user_metadata: claims.user_metadata ?? {}
+  };
+}
+function accountFlagsFor(claims) {
+  if (!claims) return { isGuest: false, hasAccount: false };
+  const isGuest = claims.is_anonymous === true;
+  return { isGuest, hasAccount: !isGuest };
+}
+var PROJECT_SIGNING_KEY_AUTHORITIES = [
+  "db.matrxserver.com",
+  "brsgrqvjdzwihsvnfqkf.supabase.co"
+];
+var PROJECT_SIGNING_KEYS = [
+  {
+    alg: "ES256",
+    crv: "P-256",
+    ext: true,
+    key_ops: ["verify"],
+    kid: "a00aed0b-202c-483a-91ff-fc74719a3bb2",
+    kty: "EC",
+    use: "sig",
+    x: "guqOsgjJqGVU6g_K0iIXKrzixlkeXKOqkPUQCconp6U",
+    y: "39zQtkzlfQuPf_MtIhYmMdxNQpIR2Pkl11AToywaslY"
+  }
+];
+function pinnedSigningKeysFor(supabaseUrl) {
+  if (!supabaseUrl) return [];
+  let host;
+  try {
+    host = new URL(supabaseUrl).host.toLowerCase();
+  } catch {
+    return [];
+  }
+  return PROJECT_SIGNING_KEY_AUTHORITIES.includes(host) ? PROJECT_SIGNING_KEYS : [];
+}
+
+// src/server-auth.ts
+function createServerAuth(options) {
+  const warn = options.warn ?? ((m) => console.warn(m));
+  const resolveOnce = async () => {
+    const client = await options.createClient();
+    const {
+      data: { user },
+      error
+    } = await getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.supabaseUrl) } });
+    const authUnavailable = !user && error !== null && isAuthTransportFailure(error);
+    if (authUnavailable) {
+      warn(
+        `[getServerAuth] identity could not be verified on this attempt \u2014 rendering without a user, NOT as signed out. Cause: ${error?.name ?? "unknown"}: ${error?.message ?? ""}`
+      );
+    }
+    return { isAuthenticated: !!user, user, authUnavailable, ...accountFlagsFor(user) };
+  };
+  const door = async () => {
+    const first = await resolveOnce();
+    if (!first.authUnavailable) return first;
+    await new Promise((resolve) => setTimeout(resolve, options.retryAfterMs ?? 250));
+    const second = await resolveOnce();
+    if (!second.authUnavailable) warn("[getServerAuth] identity verified on the retry \u2014 the first attempt's budget was spent.");
+    return second;
+  };
+  return options.cache ? options.cache(door) : door;
+}
+async function verifyRequest(request, options) {
+  const header = request.headers.get("Authorization") ?? request.headers.get("authorization");
+  if (header?.startsWith("Bearer ")) {
+    const token = header.slice(7);
+    const client2 = (0, import_supabase_js2.createClient)(options.url, options.publishableKey, {
+      global: { headers: { Authorization: `Bearer ${token}` } },
+      auth: { persistSession: false, autoRefreshToken: false }
+    });
+    const { data: data2, error: error2 } = await getClaimsUser(client2, token, {
+      jwks: { keys: pinnedSigningKeysFor(options.url) }
+    });
+    return { user: data2.user, error: error2 };
+  }
+  if (!options.cookieClient) return { user: null, error: null };
+  const client = await options.cookieClient();
+  const { data, error } = await getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.url) } });
+  return { user: data.user, error };
+}
+function createServiceClient(options) {
+  const url = options.url?.trim();
+  const key = options.secretKey?.trim();
+  if (!url) throw new Error("createServiceClient: the Supabase URL is not configured");
+  if (!key) throw new Error("createServiceClient: the secret key (SUPABASE_SECRET_KEY) is not configured");
+  return (0, import_supabase_js2.createClient)(url, key, { auth: { persistSession: false, autoRefreshToken: false } });
+}
+
+// src/node.ts
 function builtin(name) {
   const get = globalThis.process?.getBuiltinModule;
   if (!get) throw new Error(`fileStorage needs Node >= 20.16 (process.getBuiltinModule) to reach node:${name}`);
@@ -57,5 +191,8 @@ function fileStorage(path) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  fileStorage
+  createServerAuth,
+  createServiceClient,
+  fileStorage,
+  verifyRequest
 });