@ai-matrx/auth 0.1.4 → 0.2.0

package/dist/matrx-oauth.js

@@ -0,0 +1,437 @@
+// src/matrx-oauth.ts
+var MatrxOAuthError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "MatrxOAuthError";
+    this.code = code;
+  }
+};
+var GrantRefusedError = class extends MatrxOAuthError {
+  serverCode;
+  constructor(serverCode, detail) {
+    super("grant_refused", `sign-in refused (${serverCode}): ${detail}`);
+    this.name = "GrantRefusedError";
+    this.serverCode = serverCode;
+  }
+};
+var TransientAuthError = class extends MatrxOAuthError {
+  constructor(detail) {
+    super("transient", detail);
+    this.name = "TransientAuthError";
+  }
+};
+var TERMINAL_CODES = /* @__PURE__ */ new Set([
+  "invalid_grant",
+  "invalid_request",
+  "unauthorized_client",
+  "refresh_token_not_found",
+  "refresh_token_already_used",
+  "session_expired",
+  "session_not_found"
+]);
+function base64UrlEncode(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.byteLength; i++) s += String.fromCharCode(bytes[i]);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecodeToString(input) {
+  const b64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  const bin = atob(padded);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return new TextDecoder().decode(bytes);
+}
+function generateCodeVerifier() {
+  return base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+}
+async function codeChallengeFor(verifier) {
+  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64UrlEncode(new Uint8Array(hash));
+}
+function generateState() {
+  return base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function buildAuthorizeUrl(input) {
+  const url = new URL(`${input.authUrl.replace(/\/+$/, "")}/auth/v1/oauth/authorize`);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", input.clientId);
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  url.searchParams.set("state", input.state);
+  url.searchParams.set("code_challenge", input.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("scope", input.scope);
+  return url.toString();
+}
+function parseCallbackUrl(callbackUrl) {
+  const u = new URL(callbackUrl);
+  const error = u.searchParams.get("error") || u.searchParams.get("error_description");
+  if (error) throw new MatrxOAuthError("callback_error", `OAuth error: ${error}`);
+  const code = u.searchParams.get("code");
+  const returnedState = u.searchParams.get("state");
+  if (!code || !returnedState) throw new MatrxOAuthError("callback_incomplete", "OAuth callback missing code/state");
+  return { code, returnedState };
+}
+function personIdFromAccessToken(token) {
+  const part = token.split(".")[1];
+  if (!part) throw new MatrxOAuthError("invalid_token", "the access token is not a JWT");
+  let payload;
+  try {
+    payload = JSON.parse(base64UrlDecodeToString(part));
+  } catch {
+    throw new MatrxOAuthError("invalid_token", "the access token payload is unreadable");
+  }
+  if (typeof payload.sub !== "string" || payload.sub.length === 0) {
+    throw new MatrxOAuthError("invalid_token", "the access token has no subject");
+  }
+  return {
+    personId: payload.sub,
+    email: typeof payload.email === "string" && payload.email.length > 0 ? payload.email : null,
+    expiresAtMs: typeof payload.exp === "number" ? payload.exp * 1e3 : null
+  };
+}
+function extractErrorMessage(raw) {
+  try {
+    const j = JSON.parse(raw);
+    for (const key of ["error_description", "error_message", "msg", "error", "code"]) {
+      const v = j[key];
+      if (typeof v === "string" && v.length > 0) return v;
+    }
+  } catch {
+  }
+  return null;
+}
+function createMatrxOAuth(config, ports) {
+  if (!config.clientId) {
+    throw new MatrxOAuthError(
+      "config_missing",
+      "The OAuth client id is not set. Register this app as a public PKCE client in the Matrx auth server, then pass its client id."
+    );
+  }
+  if (!config.authUrl || !config.redirectUri) {
+    throw new MatrxOAuthError("config_missing", "The OAuth auth server URL and redirect URI are required.");
+  }
+  if (typeof crypto === "undefined" || !crypto.subtle) {
+    throw new MatrxOAuthError("unsupported_environment", "WebCrypto is not available here, so sign-in cannot run.");
+  }
+  const base = config.authUrl.replace(/\/+$/, "");
+  const scope = config.scope ?? "email profile";
+  const refreshLeadMs = config.refreshLeadMs ?? 6e4;
+  const attemptTtlMs = config.attemptTtlMs ?? 6e5;
+  const timeoutMs = config.requestTimeoutMs ?? 15e3;
+  const prefix = config.storageKeyPrefix ?? "matrx-oauth";
+  const SESSION_KEY = `${prefix}.session`;
+  const ACTIVE_KEY = `${prefix}.active-attempt`;
+  const pendingKey = (state) => `${prefix}.pkce.${state}`;
+  const storage = ports.storage;
+  const pending = ports.pendingStorage ?? ports.storage;
+  const now = ports.now ?? Date.now;
+  const doFetch = (...args) => (ports.fetch ?? fetch)(...args);
+  const listeners = /* @__PURE__ */ new Set();
+  const emit = (e) => {
+    for (const l of [...listeners]) {
+      try {
+        l(e);
+      } catch {
+      }
+    }
+  };
+  let chain = Promise.resolve();
+  const lock = ports.lock ?? ((fn) => {
+    const run = chain.then(fn, fn);
+    chain = run.catch(() => void 0);
+    return run;
+  });
+  const seal = (s) => ports.seal ? ports.seal.encrypt(s) : Promise.resolve(s);
+  const unseal = (s) => ports.seal ? ports.seal.decrypt(s) : Promise.resolve(s);
+  async function loadStored() {
+    const raw = await storage.getItem(SESSION_KEY);
+    if (!raw) return null;
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed?.v !== 1 || typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string") {
+        throw new Error("shape");
+      }
+      return parsed;
+    } catch {
+      await storage.removeItem(SESSION_KEY);
+      emit({ type: "signed_out", reason: "unreadable" });
+      return null;
+    }
+  }
+  const toSession = (s) => ({
+    personId: s.personId,
+    email: s.email,
+    accessToken: s.accessToken,
+    expiresAtMs: s.expiresAtMs
+  });
+  async function clearLocal() {
+    const stored = await loadStored();
+    await storage.removeItem(SESSION_KEY);
+    await pending.removeItem(ACTIVE_KEY);
+    return stored?.accessToken ?? null;
+  }
+  async function tokenRequest(form) {
+    let res;
+    try {
+      res = await doFetch(`${base}/auth/v1/oauth/token`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          accept: "application/json",
+          ...config.publishableKey ? { apikey: config.publishableKey } : {}
+        },
+        body: new URLSearchParams(form).toString(),
+        ...typeof AbortSignal !== "undefined" && "timeout" in AbortSignal ? { signal: AbortSignal.timeout(timeoutMs) } : {}
+      });
+    } catch (error) {
+      throw new TransientAuthError(`the sign-in service is unreachable: ${String(error).slice(0, 200)}`);
+    }
+    const type = res.headers.get("content-type") ?? "";
+    const text = await res.text().catch(() => "");
+    const isExchange = form["grant_type"] === "authorization_code";
+    if (!type.includes("json")) {
+      throw new TransientAuthError(`the sign-in service answered ${res.status} with ${type || "no content type"}`);
+    }
+    let body;
+    try {
+      body = JSON.parse(text);
+    } catch {
+      throw new TransientAuthError(`the sign-in service answered ${res.status} with unreadable JSON`);
+    }
+    if (res.ok) {
+      const access = body["access_token"];
+      if (typeof access !== "string" || access.length === 0) {
+        throw new TransientAuthError("the token response carried no access token");
+      }
+      const refresh = body["refresh_token"];
+      const expiresIn = typeof body["expires_in"] === "number" && body["expires_in"] > 0 ? body["expires_in"] : 3600;
+      return {
+        accessToken: access,
+        refreshToken: typeof refresh === "string" && refresh.length > 0 ? refresh : null,
+        expiresAtMs: now() + expiresIn * 1e3
+      };
+    }
+    const code = String(body["error"] ?? body["error_code"] ?? res.status);
+    const detail = extractErrorMessage(text) ?? text.slice(0, 200);
+    if (isExchange) {
+      throw new MatrxOAuthError("token_exchange_failed", `Token exchange failed (${res.status}): ${detail}`);
+    }
+    if ((res.status === 400 || res.status === 401 || res.status === 403) && TERMINAL_CODES.has(code)) {
+      throw new GrantRefusedError(code, String(body["error_description"] ?? body["msg"] ?? body["message"] ?? ""));
+    }
+    throw new TransientAuthError(`the sign-in service answered ${res.status} ${code}: ${detail.slice(0, 200)}`);
+  }
+  async function commit(tokens, attemptId) {
+    if (!tokens.refreshToken) {
+      throw new MatrxOAuthError("token_exchange_failed", "Token exchange failed: the sign-in returned no refresh token");
+    }
+    const claims = personIdFromAccessToken(tokens.accessToken);
+    if (ports.beforeCommit) await ports.beforeCommit(tokens.accessToken);
+    const sealed = await seal(tokens.refreshToken);
+    return lock(async () => {
+      if (attemptId !== void 0 && await pending.getItem(ACTIVE_KEY) !== attemptId) {
+        throw new MatrxOAuthError("superseded", "This sign-in attempt was superseded by a newer authentication change");
+      }
+      const stored = {
+        v: 1,
+        clientId: config.clientId,
+        personId: claims.personId,
+        email: claims.email,
+        accessToken: tokens.accessToken,
+        refreshToken: sealed,
+        expiresAtMs: tokens.expiresAtMs
+      };
+      await storage.setItem(SESSION_KEY, JSON.stringify(stored));
+      return toSession(stored);
+    });
+  }
+  async function signIn() {
+    const verifier = generateCodeVerifier();
+    const challenge = await codeChallengeFor(verifier);
+    const state = generateState();
+    const attemptId = `oauth:${state}`;
+    const attempt = { verifier, createdAtMs: now(), attemptId };
+    await lock(async () => {
+      await pending.setItem(pendingKey(state), JSON.stringify(attempt));
+      await pending.setItem(ACTIVE_KEY, attemptId);
+    });
+    try {
+      const url = buildAuthorizeUrl({
+        authUrl: base,
+        clientId: config.clientId,
+        redirectUri: config.redirectUri,
+        state,
+        challenge,
+        scope
+      });
+      const callbackUrl = await ports.openAuthorization(url, { state, redirectUri: config.redirectUri });
+      const { code, returnedState } = parseCallbackUrl(callbackUrl);
+      if (!constantTimeEqual(returnedState, state)) {
+        throw new MatrxOAuthError("state_mismatch", "OAuth state mismatch \u2014 possible CSRF, ignoring response");
+      }
+      const raw = await pending.getItem(pendingKey(state));
+      let recovered = null;
+      try {
+        recovered = raw ? JSON.parse(raw) : null;
+      } catch {
+        recovered = null;
+      }
+      if (!recovered || recovered.verifier !== verifier) {
+        throw new MatrxOAuthError("verifier_lost", "Could not recover code_verifier for this sign-in attempt");
+      }
+      if (now() - recovered.createdAtMs > attemptTtlMs) {
+        throw new MatrxOAuthError("attempt_expired", "This sign-in took too long and expired. Start again.");
+      }
+      const tokens = await tokenRequest({
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        code,
+        code_verifier: recovered.verifier,
+        redirect_uri: config.redirectUri
+      });
+      const session = await commit(tokens, attemptId);
+      emit({ type: "signed_in", session });
+      return session;
+    } finally {
+      try {
+        await pending.removeItem(pendingKey(state));
+      } catch {
+      }
+    }
+  }
+  let inflight = null;
+  async function refreshNow(rejected) {
+    const stored = await loadStored();
+    if (!stored) return null;
+    if (stored.clientId !== config.clientId) {
+      await lock(clearLocal);
+      emit({ type: "signed_out", reason: "client_changed" });
+      return null;
+    }
+    if (stored.expiresAtMs - now() > refreshLeadMs && (!rejected || stored.accessToken !== rejected)) {
+      return stored.accessToken;
+    }
+    let refreshToken;
+    try {
+      refreshToken = await unseal(stored.refreshToken);
+    } catch {
+      await lock(async () => {
+        const again = await loadStored();
+        if (again && again.refreshToken === stored.refreshToken) await clearLocal();
+      });
+      emit({ type: "signed_out", reason: "unreadable" });
+      return null;
+    }
+    let tokens;
+    try {
+      tokens = await tokenRequest({ grant_type: "refresh_token", client_id: config.clientId, refresh_token: refreshToken });
+    } catch (error) {
+      if (error instanceof GrantRefusedError) {
+        const outcome = await lock(async () => {
+          const current = await loadStored();
+          if (!current) return { kind: "gone" };
+          if (current.refreshToken !== stored.refreshToken) return { kind: "rotated", token: current.accessToken };
+          await clearLocal();
+          return { kind: "cleared" };
+        });
+        if (outcome.kind === "rotated") return outcome.token;
+        if (outcome.kind === "cleared") emit({ type: "signed_out", reason: "session_ended" });
+        return null;
+      }
+      if (stored.expiresAtMs > now() && stored.accessToken !== rejected) return stored.accessToken;
+      throw error;
+    }
+    const claims = personIdFromAccessToken(tokens.accessToken);
+    if (claims.personId !== stored.personId) {
+      await lock(clearLocal);
+      emit({ type: "signed_out", reason: "person_changed" });
+      return null;
+    }
+    const sealedNew = tokens.refreshToken ? await seal(tokens.refreshToken) : stored.refreshToken;
+    const result = await lock(async () => {
+      const current = await loadStored();
+      if (!current) return null;
+      if (current.refreshToken !== stored.refreshToken) return { token: current.accessToken, session: null };
+      const next = {
+        ...current,
+        email: claims.email ?? current.email,
+        accessToken: tokens.accessToken,
+        refreshToken: sealedNew,
+        expiresAtMs: tokens.expiresAtMs
+      };
+      await storage.setItem(SESSION_KEY, JSON.stringify(next));
+      return { token: next.accessToken, session: toSession(next) };
+    });
+    if (!result) return null;
+    if (result.session) emit({ type: "refreshed", session: result.session });
+    return result.token;
+  }
+  function singleFlight(rejected) {
+    inflight ??= refreshNow(rejected).finally(() => {
+      inflight = null;
+    });
+    return inflight;
+  }
+  return {
+    signIn,
+    async getAccessToken() {
+      const stored = await loadStored();
+      if (!stored) return null;
+      if (stored.clientId === config.clientId && stored.expiresAtMs - now() > refreshLeadMs) return stored.accessToken;
+      return singleFlight();
+    },
+    refresh: (rejectedAccessToken) => singleFlight(rejectedAccessToken),
+    async getSession() {
+      const stored = await loadStored();
+      return stored ? toSession(stored) : null;
+    },
+    async getPersonId() {
+      const stored = await loadStored();
+      return stored ? personIdFromAccessToken(stored.accessToken).personId : null;
+    },
+    async signOut() {
+      const access = await lock(clearLocal);
+      emit({ type: "signed_out", reason: "user" });
+      if (!access) return { revoked: null };
+      try {
+        const res = await doFetch(`${base}/auth/v1/logout?scope=local`, {
+          method: "POST",
+          headers: {
+            authorization: `Bearer ${access}`,
+            ...config.publishableKey ? { apikey: config.publishableKey } : {}
+          }
+        });
+        return { revoked: res.ok || res.status === 401 || res.status === 403 || res.status === 404 };
+      } catch {
+        return { revoked: false };
+      }
+    },
+    onChange(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    }
+  };
+}
+export {
+  GrantRefusedError,
+  MatrxOAuthError,
+  TransientAuthError,
+  buildAuthorizeUrl,
+  codeChallengeFor,
+  constantTimeEqual,
+  createMatrxOAuth,
+  generateCodeVerifier,
+  generateState,
+  parseCallbackUrl,
+  personIdFromAccessToken
+};

package/dist/next.cjs

@@ -29,8 +29,11 @@ __export(next_exports, {
   createAuthBudget: () => createAuthBudget,
   createAuthCookie: () => createAuthCookie,
   createNextSupabase: () => createNextSupabase,
+  createServerAuth: () => createServerAuth,
+  createServiceClient: () => createServiceClient,
   serializeSetCookie: () => serializeSetCookie,
-  toResponseCookie: () => toResponseCookie
+  toResponseCookie: () => toResponseCookie,
+  verifyRequest: () => verifyRequest
 });
 module.exports = __toCommonJS(next_exports);
 
@@ -653,3 +656,132 @@ function createNextSupabase(config) {
     middlewareSession
   };
 }
+
+// src/server-auth.ts
+var import_supabase_js2 = require("@supabase/supabase-js");
+
+// src/claims.ts
+var import_supabase_js = require("@supabase/supabase-js");
+async function getClaimsUser(client, jwt, options) {
+  const { data, error } = options ? await client.auth.getClaims(jwt, options) : await client.auth.getClaims(jwt);
+  if (error) {
+    if (isSignedOutError(error)) return { data: { user: null }, error: null };
+    return { data: { user: null }, error };
+  }
+  if (!data?.claims) return { data: { user: null }, error: null };
+  const user = userFromClaims(data.claims);
+  if (!user) {
+    return {
+      data: { user: null },
+      error: new import_supabase_js.AuthError("Verified token carries no `sub` claim", 401, "bad_jwt")
+    };
+  }
+  return { data: { user }, error: null };
+}
+var BUDGET_EXHAUSTED_STATUS = 408;
+var BUDGET_EXHAUSTED_CODE = "auth_budget_exhausted";
+function isAuthTransportFailure2(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return true;
+  const status = error.status;
+  if (status === 0 || status === 504 || status === 503) return true;
+  return status === BUDGET_EXHAUSTED_STATUS || error.code === BUDGET_EXHAUSTED_CODE;
+}
+function isSignedOutError(error) {
+  return error instanceof import_supabase_js.AuthSessionMissingError || error.name === "AuthSessionMissingError" || error.code === "session_not_found";
+}
+function userFromClaims(claims) {
+  if (!claims || typeof claims.sub !== "string") return null;
+  return {
+    ...claims,
+    id: claims.sub,
+    app_metadata: claims.app_metadata ?? {},
+    user_metadata: claims.user_metadata ?? {}
+  };
+}
+function accountFlagsFor(claims) {
+  if (!claims) return { isGuest: false, hasAccount: false };
+  const isGuest = claims.is_anonymous === true;
+  return { isGuest, hasAccount: !isGuest };
+}
+var PROJECT_SIGNING_KEY_AUTHORITIES = [
+  "db.matrxserver.com",
+  "brsgrqvjdzwihsvnfqkf.supabase.co"
+];
+var PROJECT_SIGNING_KEYS = [
+  {
+    alg: "ES256",
+    crv: "P-256",
+    ext: true,
+    key_ops: ["verify"],
+    kid: "a00aed0b-202c-483a-91ff-fc74719a3bb2",
+    kty: "EC",
+    use: "sig",
+    x: "guqOsgjJqGVU6g_K0iIXKrzixlkeXKOqkPUQCconp6U",
+    y: "39zQtkzlfQuPf_MtIhYmMdxNQpIR2Pkl11AToywaslY"
+  }
+];
+function pinnedSigningKeysFor(supabaseUrl) {
+  if (!supabaseUrl) return [];
+  let host;
+  try {
+    host = new URL(supabaseUrl).host.toLowerCase();
+  } catch {
+    return [];
+  }
+  return PROJECT_SIGNING_KEY_AUTHORITIES.includes(host) ? PROJECT_SIGNING_KEYS : [];
+}
+
+// src/server-auth.ts
+function createServerAuth(options) {
+  const warn = options.warn ?? ((m) => console.warn(m));
+  const resolveOnce = async () => {
+    const client = await options.createClient();
+    const {
+      data: { user },
+      error
+    } = await getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.supabaseUrl) } });
+    const authUnavailable = !user && error !== null && isAuthTransportFailure2(error);
+    if (authUnavailable) {
+      warn(
+        `[getServerAuth] identity could not be verified on this attempt \u2014 rendering without a user, NOT as signed out. Cause: ${error?.name ?? "unknown"}: ${error?.message ?? ""}`
+      );
+    }
+    return { isAuthenticated: !!user, user, authUnavailable, ...accountFlagsFor(user) };
+  };
+  const door = async () => {
+    const first = await resolveOnce();
+    if (!first.authUnavailable) return first;
+    await new Promise((resolve) => setTimeout(resolve, options.retryAfterMs ?? 250));
+    const second = await resolveOnce();
+    if (!second.authUnavailable) warn("[getServerAuth] identity verified on the retry \u2014 the first attempt's budget was spent.");
+    return second;
+  };
+  return options.cache ? options.cache(door) : door;
+}
+async function verifyRequest(request, options) {
+  const header = request.headers.get("Authorization") ?? request.headers.get("authorization");
+  if (header?.startsWith("Bearer ")) {
+    const token = header.slice(7);
+    const client2 = (0, import_supabase_js2.createClient)(options.url, options.publishableKey, {
+      global: { headers: { Authorization: `Bearer ${token}` } },
+      auth: { persistSession: false, autoRefreshToken: false }
+    });
+    const { data: data2, error: error2 } = await getClaimsUser(client2, token, {
+      jwks: { keys: pinnedSigningKeysFor(options.url) }
+    });
+    return { user: data2.user, error: error2 };
+  }
+  if (!options.cookieClient) return { user: null, error: null };
+  const client = await options.cookieClient();
+  const { data, error } = await getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.url) } });
+  return { user: data.user, error };
+}
+function createServiceClient(options) {
+  const url = options.url?.trim();
+  const key = options.secretKey?.trim();
+  if (!url) throw new Error("createServiceClient: the Supabase URL is not configured");
+  if (!key) throw new Error("createServiceClient: the secret key (SUPABASE_SECRET_KEY) is not configured");
+  return (0, import_supabase_js2.createClient)(url, key, { auth: { persistSession: false, autoRefreshToken: false } });
+}

package/dist/next.d.cts

@@ -1,6 +1,8 @@
 import { createServerClient, createBrowserClient } from '@supabase/ssr';
 import { b as AuthCookieValue, A as AuthCookie, a as AuthCookieOptions } from './auth-cookie-DWx6Q3xo.cjs';
 export { C as CreateAuthCookieArgs, D as DEFAULT_AUTH_COOKIE_NAME, c as createAuthCookie } from './auth-cookie-DWx6Q3xo.cjs';
+import { SupabaseClient } from '@supabase/supabase-js';
+import { a as ClaimsCapableClient, A as ApiClaimsUser } from './claims-DXdbe3cW.cjs';
 
 /**
  * @ai-matrx/data/next — the Next.js Supabase binding.
@@ -386,4 +388,78 @@ interface NextSupabase<DB extends DatabaseLike> {
 }
 declare function createNextSupabase<DB extends DatabaseLike = DatabaseLike>(config: NextSupabaseConfig): NextSupabase<DB>;
 
-export { AMBIGUOUS_AUTH_COOKIE_HEADER, AUTH_COOKIE_RESPONSE_HEADERS, AUTH_REFRESH_CEILING_MS, type AuthBudget, AuthCookie, AuthCookieOptions, AuthCookieValue, type CookieToSet, type DatabaseLike, type MiddlewareResponse, type MiddlewareSession, type MiddlewareSessionArgs, MissingSupabaseIdentityError, type NextBrowserClient, type NextServerClient, type NextSupabase, type NextSupabaseConfig, type RequestCookieJar, type ResponseCookie, type ResponseCookieJar, SPLIT_COOKIE_JAR_HEADER, type ServerCookieStore, createAuthBudget, createNextSupabase, serializeSetCookie, toResponseCookie };
+/**
+ * Server identity doors (moved from the website's `utils/supabase/{getServerAuth,resolveUser,
+ * adminClient}.ts`, 2026-10-12). Framework-free: the app injects how it builds its cookie client,
+ * and (for Next) React's `cache()` so one request resolves once. Exported from `/next` and `/node`.
+ */
+
+interface ServerAuthState {
+    /** `true` when the request carries a locally verified access token. */
+    isAuthenticated: boolean;
+    /** The verified caller (claims, `id` = `sub`), or `null` for guests and unresolvable requests. */
+    user: ApiClaimsUser | null;
+    /**
+     * `true` when no verdict could be REACHED (authority/JWKS unreachable, identity budget spent).
+     * The person is NOT signed out: never bounce to sign-in on it. Never set for a token that was
+     * judged bad — that is a settled answer, the same line the proxy draws.
+     */
+    authUnavailable: boolean;
+    /** `true` for a guest (anonymous) session. */
+    isGuest: boolean;
+    /** `isAuthenticated && !isGuest` — the flag account UI keys on. */
+    hasAccount: boolean;
+}
+interface ServerAuthOptions {
+    /** A FRESH cookie-bound client per attempt (the identity budget belongs to the client). */
+    createClient: () => Promise<ClaimsCapableClient> | ClaimsCapableClient;
+    /** The URL the app talks to — decides which pinned keys apply. */
+    supabaseUrl: string | null | undefined;
+    /** React's `cache` on a Next server, so the whole tree shares one resolve per request. */
+    cache?: <F extends (...args: never[]) => unknown>(fn: F) => F;
+    /** Wait before the one retry (default 250ms). */
+    retryAfterMs?: number;
+    /** Where the "could not verify" warnings go (default `console.warn`). */
+    warn?: (message: string) => void;
+}
+/**
+ * Build THE server identity door: claims verified locally, asked twice before it hands anyone
+ * "could not verify" (that is almost always one cold first load spending its budget).
+ *
+ *   export const getServerAuth = createServerAuth({ createClient, supabaseUrl, cache });
+ */
+declare function createServerAuth(options: ServerAuthOptions): () => Promise<ServerAuthState>;
+/** The bit of a request this needs: its headers (a `Request`, a `NextRequest`, a Node shim). */
+interface RequestLike {
+    headers: {
+        get(name: string): string | null;
+    };
+}
+interface VerifyRequestOptions {
+    url: string;
+    /** The publishable key (`sb_publishable_*`). */
+    publishableKey: string;
+    /** The app's cookie-bound client, used when the request carries no Bearer token. */
+    cookieClient?: () => Promise<ClaimsCapableClient> | ClaimsCapableClient;
+}
+/**
+ * Who is calling this API route: a Bearer token (public/mobile/extension/desktop clients) or the
+ * session cookie (browser). `user` is null when the caller is signed out OR could not be verified;
+ * `error` tells the two apart (null = settled signed out).
+ */
+declare function verifyRequest(request: RequestLike, options: VerifyRequestOptions): Promise<{
+    user: ApiClaimsUser | null;
+    error: Error | null;
+}>;
+/**
+ * THE service (secret-key) client — server-only, bypasses row security. The package's browser
+ * clients refuse a secret key by design (`SecretKeyRefusedError`); this is the one door for it.
+ * Never ship it to a browser bundle: it lives in `/node` and `/next` only.
+ */
+declare function createServiceClient<Database = unknown>(options: {
+    url: string | null | undefined;
+    /** `sb_secret_*` (the legacy service-role JWT is banned). */
+    secretKey: string | null | undefined;
+}): SupabaseClient<Database>;
+
+export { AMBIGUOUS_AUTH_COOKIE_HEADER, AUTH_COOKIE_RESPONSE_HEADERS, AUTH_REFRESH_CEILING_MS, type AuthBudget, AuthCookie, AuthCookieOptions, AuthCookieValue, type CookieToSet, type DatabaseLike, type MiddlewareResponse, type MiddlewareSession, type MiddlewareSessionArgs, MissingSupabaseIdentityError, type NextBrowserClient, type NextServerClient, type NextSupabase, type NextSupabaseConfig, type RequestCookieJar, type RequestLike, type ResponseCookie, type ResponseCookieJar, SPLIT_COOKIE_JAR_HEADER, type ServerAuthOptions, type ServerAuthState, type ServerCookieStore, type VerifyRequestOptions, createAuthBudget, createNextSupabase, createServerAuth, createServiceClient, serializeSetCookie, toResponseCookie, verifyRequest };