@ai-matrx/auth 0.3.4 → 0.3.6

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog — @ai-matrx/auth
 
+## 0.3.6
+### Unreleased
+- New `@ai-matrx/auth/browser` (`createBrowserSupabase`, shared code path with `createNextSupabase().browserClient()`).
+- New `MATRX_AUTH_COOKIE` ({ current, legacy }). BREAKING: `DEFAULT_AUTH_COOKIE_NAME` removed; the default cookie name is now `sb-matrx-auth-v2`.
+
+## 0.3.5
+
+Automatic changed-only republish (docs/metadata drift since the last tag — see
+`git diff npm/auth/v0.3.4..npm/auth/v0.3.5 -- apps/shared/auth`).
+No source changes intended and no consumer action required.
+
 ## 0.3.4
 
 Automatic changed-only republish (docs/metadata drift since the last tag — see

package/README.md

@@ -22,6 +22,7 @@ const credentials = sessionCredentials(supabase);   // hand to @ai-matrx/api's c
 | `/session-identity` | who is acting, live from the session |
 | `/cookies` | the domain-wide auth cookie and the active-organization cookie |
 | `/next` | every Next.js Supabase client (browser, RSC, route, middleware) |
+| `/browser` | the framework-free browser Supabase client over the shared auth cookie (non-Next apps) |
 | `/react` | `useSession`, `useActiveOrganization`, `useSessionIdentity` |
 | `/node` | `fileStorage` — a script's session survives between runs |
 | `/testing` | fake sessions for tests |

package/dist/{auth-cookie-DWx6Q3xo.d.cts → auth-cookie-QPVLJJwP.d.cts}

@@ -48,7 +48,16 @@ interface AuthCookieValue {
     name: string;
     value: string;
 }
-declare const DEFAULT_AUTH_COOKIE_NAME = "sb-matrx-auth";
+/**
+ * THE one auth-cookie name pair every Matrx host binds to. `current` is the live storage key;
+ * `legacy` is the superseded key (West-project era) that `migrateLegacyCookies` seeds from and
+ * the middleware clears. Every caller passes this pair; the old single-name default (which was
+ * the LEGACY name) is retired.
+ */
+declare const MATRX_AUTH_COOKIE: {
+    readonly current: "sb-matrx-auth-v2";
+    readonly legacy: "sb-matrx-auth";
+};
 interface CreateAuthCookieArgs {
     /** The apex domain one login must span (e.g. `"aimatrx.com"`). */
     apexDomain: string;
@@ -165,4 +174,4 @@ interface ReconciledAuthCookies {
 declare function parseCookieHeader(header: string | null | undefined): AuthCookieValue[];
 declare function createAuthCookie(args: CreateAuthCookieArgs): AuthCookie;
 
-export { type AuthCookie as A, type CreateAuthCookieArgs as C, DEFAULT_AUTH_COOKIE_NAME as D, type ReconciledAuthCookies as R, type AuthCookieOptions as a, type AuthCookieValue as b, createAuthCookie as c, parseCookieHeader as p };
+export { type AuthCookie as A, type CreateAuthCookieArgs as C, MATRX_AUTH_COOKIE as M, type ReconciledAuthCookies as R, type AuthCookieOptions as a, type AuthCookieValue as b, createAuthCookie as c, parseCookieHeader as p };

package/dist/{auth-cookie-DWx6Q3xo.d.ts → auth-cookie-QPVLJJwP.d.ts}

@@ -48,7 +48,16 @@ interface AuthCookieValue {
     name: string;
     value: string;
 }
-declare const DEFAULT_AUTH_COOKIE_NAME = "sb-matrx-auth";
+/**
+ * THE one auth-cookie name pair every Matrx host binds to. `current` is the live storage key;
+ * `legacy` is the superseded key (West-project era) that `migrateLegacyCookies` seeds from and
+ * the middleware clears. Every caller passes this pair; the old single-name default (which was
+ * the LEGACY name) is retired.
+ */
+declare const MATRX_AUTH_COOKIE: {
+    readonly current: "sb-matrx-auth-v2";
+    readonly legacy: "sb-matrx-auth";
+};
 interface CreateAuthCookieArgs {
     /** The apex domain one login must span (e.g. `"aimatrx.com"`). */
     apexDomain: string;
@@ -165,4 +174,4 @@ interface ReconciledAuthCookies {
 declare function parseCookieHeader(header: string | null | undefined): AuthCookieValue[];
 declare function createAuthCookie(args: CreateAuthCookieArgs): AuthCookie;
 
-export { type AuthCookie as A, type CreateAuthCookieArgs as C, DEFAULT_AUTH_COOKIE_NAME as D, type ReconciledAuthCookies as R, type AuthCookieOptions as a, type AuthCookieValue as b, createAuthCookie as c, parseCookieHeader as p };
+export { type AuthCookie as A, type CreateAuthCookieArgs as C, MATRX_AUTH_COOKIE as M, type ReconciledAuthCookies as R, type AuthCookieOptions as a, type AuthCookieValue as b, createAuthCookie as c, parseCookieHeader as p };

package/dist/browser.cjs

@@ -0,0 +1,192 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/browser.ts
+var browser_exports = {};
+__export(browser_exports, {
+  MATRX_AUTH_COOKIE: () => MATRX_AUTH_COOKIE,
+  createAuthCookie: () => createAuthCookie,
+  createBrowserSupabase: () => createBrowserSupabase
+});
+module.exports = __toCommonJS(browser_exports);
+
+// src/browser/supabase.ts
+var import_ssr = require("@supabase/ssr");
+
+// src/cookies/auth-cookie.ts
+var MATRX_AUTH_COOKIE = {
+  current: "sb-matrx-auth-v2",
+  legacy: "sb-matrx-auth"
+};
+function parseCookieHeader(header) {
+  if (!header) return [];
+  const out = [];
+  for (const pair of header.split(";")) {
+    const eq = pair.indexOf("=");
+    const name = (eq === -1 ? pair : pair.slice(0, eq)).trim();
+    if (!name) continue;
+    const raw = eq === -1 ? "" : pair.slice(eq + 1).trim();
+    let value = raw;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {
+    }
+    out.push({ name, value });
+  }
+  return out;
+}
+function belongsToStorageKey(name, storageKey) {
+  if (name === storageKey) return true;
+  if (!name.startsWith(`${storageKey}.`)) return false;
+  return /^(0|[1-9][0-9]*)$/.test(name.slice(storageKey.length + 1));
+}
+function renamedCookie(cookie, from, to) {
+  if (cookie.name === from) return { ...cookie, name: to };
+  const prefix = `${from}.`;
+  if (!cookie.name.startsWith(prefix)) return null;
+  const chunk = cookie.name.slice(prefix.length);
+  if (!/^(0|[1-9][0-9]*)$/.test(chunk)) return null;
+  return { ...cookie, name: `${to}.${chunk}` };
+}
+function createAuthCookie(args) {
+  const cookieName = args.cookieName ?? MATRX_AUTH_COOKIE.current;
+  const legacyCookieName = args.legacyCookieName;
+  const apex = args.apexDomain.toLowerCase();
+  const optionsForHost = (host) => {
+    const normalized = (host ?? "").toLowerCase();
+    const hostname = normalized.startsWith("[") ? normalized.slice(1, normalized.indexOf("]")) : normalized === "::1" ? normalized : normalized.split(":")[0] ?? "";
+    const loopback = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || /^127(?:\.(?:0|[1-9]\d{0,2})){3}$/.test(hostname) && hostname.split(".").every((part) => Number(part) <= 255);
+    const secure = !loopback;
+    const onApex = hostname === apex || hostname.endsWith(`.${apex}`);
+    return onApex ? { name: cookieName, domain: `.${apex}`, secure } : { name: cookieName, secure };
+  };
+  const isCurrentCookie = (name) => belongsToStorageKey(name, cookieName);
+  const isAuthCookie = (name) => isCurrentCookie(name) || legacyCookieName !== void 0 && (name === legacyCookieName || name.startsWith(`${legacyCookieName}.`));
+  const reconcile = (cookies) => {
+    const seen = /* @__PURE__ */ new Map();
+    const out = [];
+    const shadowed = /* @__PURE__ */ new Set();
+    for (const cookie of cookies) {
+      const at = seen.get(cookie.name);
+      if (at === void 0) {
+        seen.set(cookie.name, out.length);
+        out.push({ name: cookie.name, value: cookie.value });
+        continue;
+      }
+      if (!isAuthCookie(cookie.name)) continue;
+      shadowed.add(cookie.name);
+      const held = out[at];
+      if (held !== void 0 && held.value.length === 0) {
+        out[at] = { name: cookie.name, value: cookie.value };
+      }
+    }
+    const ambiguous = /* @__PURE__ */ new Set();
+    const ambiguousKeys = [];
+    const byName = new Map(out.map((cookie) => [cookie.name, cookie]));
+    const storageKeys = [cookieName, ...legacyCookieName ? [legacyCookieName] : []];
+    for (const storageKey of storageKeys) {
+      const unchunked = byName.get(storageKey);
+      const firstChunk = byName.get(`${storageKey}.0`);
+      if (!unchunked?.value || !firstChunk?.value) continue;
+      ambiguousKeys.push(storageKey);
+      for (const { name } of out) {
+        if (belongsToStorageKey(name, storageKey)) ambiguous.add(name);
+      }
+    }
+    const resolved = ambiguous.size === 0 ? out : out.filter(({ name }) => !ambiguous.has(name));
+    const shadowedNames = [...shadowed];
+    const ambiguousNames = [...ambiguous];
+    return {
+      cookies: resolved,
+      shadowedNames,
+      ambiguousNames,
+      ambiguousKeys,
+      split: shadowedNames.length > 0 || ambiguousNames.length > 0
+    };
+  };
+  return {
+    cookieName,
+    legacyCookieName,
+    optionsForHost,
+    reconcile,
+    browserOptions: () => optionsForHost(
+      typeof window !== "undefined" ? window.location.hostname : null
+    ),
+    isCurrentCookie,
+    migrateLegacyCookies: (cookies) => {
+      if (!legacyCookieName) return [];
+      if (cookies.some(({ name }) => isCurrentCookie(name))) return [];
+      return cookies.flatMap((cookie) => {
+        const renamed = renamedCookie(cookie, legacyCookieName, cookieName);
+        return renamed ? [renamed] : [];
+      });
+    }
+  };
+}
+
+// src/browser/supabase.ts
+var BROWSER_SLOT = /* @__PURE__ */ Symbol.for("ai-matrx.data.next.browser-client");
+function readBrowserSlot() {
+  return globalThis[BROWSER_SLOT];
+}
+function writeBrowserSlot(slot) {
+  globalThis[BROWSER_SLOT] = slot;
+}
+function browserCookieAdapter(authCookie) {
+  return {
+    getAll: () => authCookie.reconcile(
+      typeof document === "undefined" ? [] : parseCookieHeader(document.cookie)
+    ).cookies,
+    setAll: (cookiesToSet) => {
+      if (typeof document === "undefined") return;
+      for (const cookie of cookiesToSet) {
+        const options = cookie.options ?? {};
+        const parts = [
+          `${cookie.name}=${encodeURIComponent(cookie.value)}`,
+          `Path=${typeof options.path === "string" ? options.path : "/"}`
+        ];
+        if (typeof options.domain === "string") {
+          parts.push(`Domain=${options.domain}`);
+        }
+        if (typeof options.maxAge === "number") {
+          parts.push(`Max-Age=${options.maxAge}`);
+        }
+        if (typeof options.sameSite === "string") {
+          parts.push(`SameSite=${options.sameSite}`);
+        }
+        if (options.secure === true || location.protocol === "https:") parts.push("Secure");
+        document.cookie = parts.join("; ");
+      }
+    }
+  };
+}
+function createBrowserSupabase(config) {
+  const slotKey = `${config.url}|${config.key}|${config.authCookie.cookieName}`;
+  const existing = readBrowserSlot();
+  if (existing && existing.key === slotKey) {
+    return existing.client;
+  }
+  const raw = (0, import_ssr.createBrowserClient)(config.url, config.key, {
+    cookieOptions: config.authCookie.browserOptions(),
+    cookies: browserCookieAdapter(config.authCookie)
+  });
+  const client = config.wrapBrowserClient ? config.wrapBrowserClient(raw) : raw;
+  writeBrowserSlot({ key: slotKey, client });
+  return client;
+}

package/dist/browser.d.cts

@@ -0,0 +1,34 @@
+import { createBrowserClient } from '@supabase/ssr';
+import { A as AuthCookie } from './auth-cookie-QPVLJJwP.cjs';
+export { a as AuthCookieOptions, b as AuthCookieValue, C as CreateAuthCookieArgs, M as MATRX_AUTH_COOKIE, R as ReconciledAuthCookies, c as createAuthCookie } from './auth-cookie-QPVLJJwP.cjs';
+
+/**
+ * @ai-matrx/auth/browser — the framework-free browser Supabase client.
+ *
+ * This is the browser half of `createNextSupabase`, MOVED here (not rewritten) so a non-Next app
+ * (the Vite Office app) and the Next apps share ONE code path: the `globalThis`-slot singleton,
+ * `authCookie.browserOptions()` (the host decides the cookie scope: apex hosts `.aimatrx.com`,
+ * loopback and `*.localhost` host-only), and the reconcile-guarded cookie adapter.
+ * `createNextSupabase(...).browserClient()` calls `createBrowserSupabase` below.
+ *
+ * Imports nothing from `next/*` and nothing from `../next/supabase`.
+ */
+
+type DatabaseLike = Record<string, unknown>;
+type NextBrowserClient<DB extends DatabaseLike> = ReturnType<typeof createBrowserClient<DB>>;
+interface CreateBrowserSupabaseConfig {
+    /** `https://db.matrxserver.com`. */
+    url: string;
+    /** The `sb_publishable_*` key. */
+    key: string;
+    /** `createAuthCookie({ cookieName: MATRX_AUTH_COOKIE.current, legacyCookieName: MATRX_AUTH_COOKIE.legacy, … })`. */
+    authCookie: AuthCookie;
+    /**
+     * Host wrapper applied to the BROWSER client only (diagnostics/error capture). Must not change
+     * query behavior.
+     */
+    wrapBrowserClient?: <C extends object>(client: C) => C;
+}
+declare function createBrowserSupabase<DB extends DatabaseLike = DatabaseLike>(config: CreateBrowserSupabaseConfig): NextBrowserClient<DB>;
+
+export { AuthCookie, type CreateBrowserSupabaseConfig, type DatabaseLike, type NextBrowserClient, createBrowserSupabase };

package/dist/browser.d.ts

@@ -0,0 +1,34 @@
+import { createBrowserClient } from '@supabase/ssr';
+import { A as AuthCookie } from './auth-cookie-QPVLJJwP.js';
+export { a as AuthCookieOptions, b as AuthCookieValue, C as CreateAuthCookieArgs, M as MATRX_AUTH_COOKIE, R as ReconciledAuthCookies, c as createAuthCookie } from './auth-cookie-QPVLJJwP.js';
+
+/**
+ * @ai-matrx/auth/browser — the framework-free browser Supabase client.
+ *
+ * This is the browser half of `createNextSupabase`, MOVED here (not rewritten) so a non-Next app
+ * (the Vite Office app) and the Next apps share ONE code path: the `globalThis`-slot singleton,
+ * `authCookie.browserOptions()` (the host decides the cookie scope: apex hosts `.aimatrx.com`,
+ * loopback and `*.localhost` host-only), and the reconcile-guarded cookie adapter.
+ * `createNextSupabase(...).browserClient()` calls `createBrowserSupabase` below.
+ *
+ * Imports nothing from `next/*` and nothing from `../next/supabase`.
+ */
+
+type DatabaseLike = Record<string, unknown>;
+type NextBrowserClient<DB extends DatabaseLike> = ReturnType<typeof createBrowserClient<DB>>;
+interface CreateBrowserSupabaseConfig {
+    /** `https://db.matrxserver.com`. */
+    url: string;
+    /** The `sb_publishable_*` key. */
+    key: string;
+    /** `createAuthCookie({ cookieName: MATRX_AUTH_COOKIE.current, legacyCookieName: MATRX_AUTH_COOKIE.legacy, … })`. */
+    authCookie: AuthCookie;
+    /**
+     * Host wrapper applied to the BROWSER client only (diagnostics/error capture). Must not change
+     * query behavior.
+     */
+    wrapBrowserClient?: <C extends object>(client: C) => C;
+}
+declare function createBrowserSupabase<DB extends DatabaseLike = DatabaseLike>(config: CreateBrowserSupabaseConfig): NextBrowserClient<DB>;
+
+export { AuthCookie, type CreateBrowserSupabaseConfig, type DatabaseLike, type NextBrowserClient, createBrowserSupabase };

package/dist/browser.js

@@ -0,0 +1,169 @@
+// src/browser/supabase.ts
+import { createBrowserClient } from "@supabase/ssr";
+
+// src/cookies/auth-cookie.ts
+var MATRX_AUTH_COOKIE = {
+  current: "sb-matrx-auth-v2",
+  legacy: "sb-matrx-auth"
+};
+function parseCookieHeader(header) {
+  if (!header) return [];
+  const out = [];
+  for (const pair of header.split(";")) {
+    const eq = pair.indexOf("=");
+    const name = (eq === -1 ? pair : pair.slice(0, eq)).trim();
+    if (!name) continue;
+    const raw = eq === -1 ? "" : pair.slice(eq + 1).trim();
+    let value = raw;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {
+    }
+    out.push({ name, value });
+  }
+  return out;
+}
+function belongsToStorageKey(name, storageKey) {
+  if (name === storageKey) return true;
+  if (!name.startsWith(`${storageKey}.`)) return false;
+  return /^(0|[1-9][0-9]*)$/.test(name.slice(storageKey.length + 1));
+}
+function renamedCookie(cookie, from, to) {
+  if (cookie.name === from) return { ...cookie, name: to };
+  const prefix = `${from}.`;
+  if (!cookie.name.startsWith(prefix)) return null;
+  const chunk = cookie.name.slice(prefix.length);
+  if (!/^(0|[1-9][0-9]*)$/.test(chunk)) return null;
+  return { ...cookie, name: `${to}.${chunk}` };
+}
+function createAuthCookie(args) {
+  const cookieName = args.cookieName ?? MATRX_AUTH_COOKIE.current;
+  const legacyCookieName = args.legacyCookieName;
+  const apex = args.apexDomain.toLowerCase();
+  const optionsForHost = (host) => {
+    const normalized = (host ?? "").toLowerCase();
+    const hostname = normalized.startsWith("[") ? normalized.slice(1, normalized.indexOf("]")) : normalized === "::1" ? normalized : normalized.split(":")[0] ?? "";
+    const loopback = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || /^127(?:\.(?:0|[1-9]\d{0,2})){3}$/.test(hostname) && hostname.split(".").every((part) => Number(part) <= 255);
+    const secure = !loopback;
+    const onApex = hostname === apex || hostname.endsWith(`.${apex}`);
+    return onApex ? { name: cookieName, domain: `.${apex}`, secure } : { name: cookieName, secure };
+  };
+  const isCurrentCookie = (name) => belongsToStorageKey(name, cookieName);
+  const isAuthCookie = (name) => isCurrentCookie(name) || legacyCookieName !== void 0 && (name === legacyCookieName || name.startsWith(`${legacyCookieName}.`));
+  const reconcile = (cookies) => {
+    const seen = /* @__PURE__ */ new Map();
+    const out = [];
+    const shadowed = /* @__PURE__ */ new Set();
+    for (const cookie of cookies) {
+      const at = seen.get(cookie.name);
+      if (at === void 0) {
+        seen.set(cookie.name, out.length);
+        out.push({ name: cookie.name, value: cookie.value });
+        continue;
+      }
+      if (!isAuthCookie(cookie.name)) continue;
+      shadowed.add(cookie.name);
+      const held = out[at];
+      if (held !== void 0 && held.value.length === 0) {
+        out[at] = { name: cookie.name, value: cookie.value };
+      }
+    }
+    const ambiguous = /* @__PURE__ */ new Set();
+    const ambiguousKeys = [];
+    const byName = new Map(out.map((cookie) => [cookie.name, cookie]));
+    const storageKeys = [cookieName, ...legacyCookieName ? [legacyCookieName] : []];
+    for (const storageKey of storageKeys) {
+      const unchunked = byName.get(storageKey);
+      const firstChunk = byName.get(`${storageKey}.0`);
+      if (!unchunked?.value || !firstChunk?.value) continue;
+      ambiguousKeys.push(storageKey);
+      for (const { name } of out) {
+        if (belongsToStorageKey(name, storageKey)) ambiguous.add(name);
+      }
+    }
+    const resolved = ambiguous.size === 0 ? out : out.filter(({ name }) => !ambiguous.has(name));
+    const shadowedNames = [...shadowed];
+    const ambiguousNames = [...ambiguous];
+    return {
+      cookies: resolved,
+      shadowedNames,
+      ambiguousNames,
+      ambiguousKeys,
+      split: shadowedNames.length > 0 || ambiguousNames.length > 0
+    };
+  };
+  return {
+    cookieName,
+    legacyCookieName,
+    optionsForHost,
+    reconcile,
+    browserOptions: () => optionsForHost(
+      typeof window !== "undefined" ? window.location.hostname : null
+    ),
+    isCurrentCookie,
+    migrateLegacyCookies: (cookies) => {
+      if (!legacyCookieName) return [];
+      if (cookies.some(({ name }) => isCurrentCookie(name))) return [];
+      return cookies.flatMap((cookie) => {
+        const renamed = renamedCookie(cookie, legacyCookieName, cookieName);
+        return renamed ? [renamed] : [];
+      });
+    }
+  };
+}
+
+// src/browser/supabase.ts
+var BROWSER_SLOT = /* @__PURE__ */ Symbol.for("ai-matrx.data.next.browser-client");
+function readBrowserSlot() {
+  return globalThis[BROWSER_SLOT];
+}
+function writeBrowserSlot(slot) {
+  globalThis[BROWSER_SLOT] = slot;
+}
+function browserCookieAdapter(authCookie) {
+  return {
+    getAll: () => authCookie.reconcile(
+      typeof document === "undefined" ? [] : parseCookieHeader(document.cookie)
+    ).cookies,
+    setAll: (cookiesToSet) => {
+      if (typeof document === "undefined") return;
+      for (const cookie of cookiesToSet) {
+        const options = cookie.options ?? {};
+        const parts = [
+          `${cookie.name}=${encodeURIComponent(cookie.value)}`,
+          `Path=${typeof options.path === "string" ? options.path : "/"}`
+        ];
+        if (typeof options.domain === "string") {
+          parts.push(`Domain=${options.domain}`);
+        }
+        if (typeof options.maxAge === "number") {
+          parts.push(`Max-Age=${options.maxAge}`);
+        }
+        if (typeof options.sameSite === "string") {
+          parts.push(`SameSite=${options.sameSite}`);
+        }
+        if (options.secure === true || location.protocol === "https:") parts.push("Secure");
+        document.cookie = parts.join("; ");
+      }
+    }
+  };
+}
+function createBrowserSupabase(config) {
+  const slotKey = `${config.url}|${config.key}|${config.authCookie.cookieName}`;
+  const existing = readBrowserSlot();
+  if (existing && existing.key === slotKey) {
+    return existing.client;
+  }
+  const raw = createBrowserClient(config.url, config.key, {
+    cookieOptions: config.authCookie.browserOptions(),
+    cookies: browserCookieAdapter(config.authCookie)
+  });
+  const client = config.wrapBrowserClient ? config.wrapBrowserClient(raw) : raw;
+  writeBrowserSlot({ key: slotKey, client });
+  return client;
+}
+export {
+  MATRX_AUTH_COOKIE,
+  createAuthCookie,
+  createBrowserSupabase
+};

package/dist/{claims-KrRxsfaG.d.cts → claims-Vno769TE.d.cts}

@@ -148,4 +148,4 @@ declare function createClaimsCache(client: ClaimsCapableClient & {
     };
 }, options: ClaimsCacheOptions): () => Promise<ClaimsResult>;
 
-export { type ApiClaimsUser as A, type ClaimsCacheOptions as C, PROJECT_SIGNING_KEYS as P, type ClaimsCapableClient as a, type ClaimsProfile as b, type ClaimsResult as c, PROJECT_SIGNING_KEY_AUTHORITIES as d, accountFlagsFor as e, confirmUnverifiableSession as f, createClaimsCache as g, getClaimsUser as h, isAuthTransportFailure as i, isSignedOutError as j, isUnverifiableTokenError as k, isUnverifiableTokenRefusal as l, looksLikeJwt as m, profileFromClaims as n, pinnedSigningKeysFor as p, userFromClaims as u };
+export { type ApiClaimsUser as A, type ClaimsCapableClient as C, PROJECT_SIGNING_KEYS as P, type ClaimsCacheOptions as a, type ClaimsProfile as b, type ClaimsResult as c, PROJECT_SIGNING_KEY_AUTHORITIES as d, accountFlagsFor as e, confirmUnverifiableSession as f, createClaimsCache as g, getClaimsUser as h, isAuthTransportFailure as i, isSignedOutError as j, isUnverifiableTokenError as k, isUnverifiableTokenRefusal as l, looksLikeJwt as m, profileFromClaims as n, pinnedSigningKeysFor as p, userFromClaims as u };

package/dist/{claims-KrRxsfaG.d.ts → claims-Vno769TE.d.ts}

@@ -148,4 +148,4 @@ declare function createClaimsCache(client: ClaimsCapableClient & {
     };
 }, options: ClaimsCacheOptions): () => Promise<ClaimsResult>;
 
-export { type ApiClaimsUser as A, type ClaimsCacheOptions as C, PROJECT_SIGNING_KEYS as P, type ClaimsCapableClient as a, type ClaimsProfile as b, type ClaimsResult as c, PROJECT_SIGNING_KEY_AUTHORITIES as d, accountFlagsFor as e, confirmUnverifiableSession as f, createClaimsCache as g, getClaimsUser as h, isAuthTransportFailure as i, isSignedOutError as j, isUnverifiableTokenError as k, isUnverifiableTokenRefusal as l, looksLikeJwt as m, profileFromClaims as n, pinnedSigningKeysFor as p, userFromClaims as u };
+export { type ApiClaimsUser as A, type ClaimsCapableClient as C, PROJECT_SIGNING_KEYS as P, type ClaimsCacheOptions as a, type ClaimsProfile as b, type ClaimsResult as c, PROJECT_SIGNING_KEY_AUTHORITIES as d, accountFlagsFor as e, confirmUnverifiableSession as f, createClaimsCache as g, getClaimsUser as h, isAuthTransportFailure as i, isSignedOutError as j, isUnverifiableTokenError as k, isUnverifiableTokenRefusal as l, looksLikeJwt as m, profileFromClaims as n, pinnedSigningKeysFor as p, userFromClaims as u };

package/dist/cookies.cjs

@@ -22,7 +22,7 @@ var cookies_exports = {};
 __export(cookies_exports, {
   DEFAULT_ACTIVE_ORG_COOKIE_MAX_AGE: () => DEFAULT_ACTIVE_ORG_COOKIE_MAX_AGE,
   DEFAULT_ACTIVE_ORG_COOKIE_NAME: () => DEFAULT_ACTIVE_ORG_COOKIE_NAME,
-  DEFAULT_AUTH_COOKIE_NAME: () => DEFAULT_AUTH_COOKIE_NAME,
+  MATRX_AUTH_COOKIE: () => MATRX_AUTH_COOKIE,
   createActiveOrgCookie: () => createActiveOrgCookie,
   createAuthCookie: () => createAuthCookie,
   decodeActiveOrgSelection: () => decodeActiveOrgSelection,
@@ -32,7 +32,10 @@ __export(cookies_exports, {
 module.exports = __toCommonJS(cookies_exports);
 
 // src/cookies/auth-cookie.ts
-var DEFAULT_AUTH_COOKIE_NAME = "sb-matrx-auth";
+var MATRX_AUTH_COOKIE = {
+  current: "sb-matrx-auth-v2",
+  legacy: "sb-matrx-auth"
+};
 function parseCookieHeader(header) {
   if (!header) return [];
   const out = [];
@@ -64,7 +67,7 @@ function renamedCookie(cookie, from, to) {
   return { ...cookie, name: `${to}.${chunk}` };
 }
 function createAuthCookie(args) {
-  const cookieName = args.cookieName ?? DEFAULT_AUTH_COOKIE_NAME;
+  const cookieName = args.cookieName ?? MATRX_AUTH_COOKIE.current;
   const legacyCookieName = args.legacyCookieName;
   const apex = args.apexDomain.toLowerCase();
   const optionsForHost = (host) => {

package/dist/cookies.d.cts

@@ -1,4 +1,4 @@
-export { A as AuthCookie, a as AuthCookieOptions, b as AuthCookieValue, C as CreateAuthCookieArgs, D as DEFAULT_AUTH_COOKIE_NAME, R as ReconciledAuthCookies, c as createAuthCookie, p as parseCookieHeader } from './auth-cookie-DWx6Q3xo.cjs';
+export { A as AuthCookie, a as AuthCookieOptions, b as AuthCookieValue, C as CreateAuthCookieArgs, M as MATRX_AUTH_COOKIE, R as ReconciledAuthCookies, c as createAuthCookie, p as parseCookieHeader } from './auth-cookie-QPVLJJwP.cjs';
 
 /**
  * THE ACTIVE-ORGANIZATION COOKIE — one browser-stored "which organization am I

package/dist/cookies.d.ts

@@ -1,4 +1,4 @@
-export { A as AuthCookie, a as AuthCookieOptions, b as AuthCookieValue, C as CreateAuthCookieArgs, D as DEFAULT_AUTH_COOKIE_NAME, R as ReconciledAuthCookies, c as createAuthCookie, p as parseCookieHeader } from './auth-cookie-DWx6Q3xo.js';
+export { A as AuthCookie, a as AuthCookieOptions, b as AuthCookieValue, C as CreateAuthCookieArgs, M as MATRX_AUTH_COOKIE, R as ReconciledAuthCookies, c as createAuthCookie, p as parseCookieHeader } from './auth-cookie-QPVLJJwP.js';
 
 /**
  * THE ACTIVE-ORGANIZATION COOKIE — one browser-stored "which organization am I

package/dist/cookies.js

@@ -1,5 +1,8 @@
 // src/cookies/auth-cookie.ts
-var DEFAULT_AUTH_COOKIE_NAME = "sb-matrx-auth";
+var MATRX_AUTH_COOKIE = {
+  current: "sb-matrx-auth-v2",
+  legacy: "sb-matrx-auth"
+};
 function parseCookieHeader(header) {
   if (!header) return [];
   const out = [];
@@ -31,7 +34,7 @@ function renamedCookie(cookie, from, to) {
   return { ...cookie, name: `${to}.${chunk}` };
 }
 function createAuthCookie(args) {
-  const cookieName = args.cookieName ?? DEFAULT_AUTH_COOKIE_NAME;
+  const cookieName = args.cookieName ?? MATRX_AUTH_COOKIE.current;
   const legacyCookieName = args.legacyCookieName;
   const apex = args.apexDomain.toLowerCase();
   const optionsForHost = (host) => {
@@ -201,7 +204,7 @@ function createActiveOrgCookie(args) {
 export {
   DEFAULT_ACTIVE_ORG_COOKIE_MAX_AGE,
   DEFAULT_ACTIVE_ORG_COOKIE_NAME,
-  DEFAULT_AUTH_COOKIE_NAME,
+  MATRX_AUTH_COOKIE,
   createActiveOrgCookie,
   createAuthCookie,
   decodeActiveOrgSelection,

package/dist/index.d.cts

@@ -5,7 +5,7 @@ export { C as ChromeStorageAreaLike, a as StorageUnavailableError, b as browserS
 import { SupabaseClient, User } from '@supabase/supabase-js';
 export { AuthChangeEvent, Session, User, UserAttributes } from '@supabase/supabase-js';
 export { CredentialsPort, MatrxCredential, MatrxCredentialKind } from './credentials.cjs';
-export { A as ApiClaimsUser, C as ClaimsCacheOptions, a as ClaimsCapableClient, b as ClaimsProfile, c as ClaimsResult, P as PROJECT_SIGNING_KEYS, d as PROJECT_SIGNING_KEY_AUTHORITIES, e as accountFlagsFor, f as confirmUnverifiableSession, g as createClaimsCache, h as getClaimsUser, i as isAuthTransportFailure, j as isSignedOutError, k as isUnverifiableTokenError, l as isUnverifiableTokenRefusal, m as looksLikeJwt, p as pinnedSigningKeysFor, n as profileFromClaims, u as userFromClaims } from './claims-KrRxsfaG.cjs';
+export { A as ApiClaimsUser, a as ClaimsCacheOptions, C as ClaimsCapableClient, b as ClaimsProfile, c as ClaimsResult, P as PROJECT_SIGNING_KEYS, d as PROJECT_SIGNING_KEY_AUTHORITIES, e as accountFlagsFor, f as confirmUnverifiableSession, g as createClaimsCache, h as getClaimsUser, i as isAuthTransportFailure, j as isSignedOutError, k as isUnverifiableTokenError, l as isUnverifiableTokenRefusal, m as looksLikeJwt, p as pinnedSigningKeysFor, n as profileFromClaims, u as userFromClaims } from './claims-Vno769TE.cjs';
 
 /** How long a request may wait for the first auth report before going anyway. */
 declare const SESSION_ATTACH_BUDGET_MS = 3000;

package/dist/index.d.ts

@@ -5,7 +5,7 @@ export { C as ChromeStorageAreaLike, a as StorageUnavailableError, b as browserS
 import { SupabaseClient, User } from '@supabase/supabase-js';
 export { AuthChangeEvent, Session, User, UserAttributes } from '@supabase/supabase-js';
 export { CredentialsPort, MatrxCredential, MatrxCredentialKind } from './credentials.js';
-export { A as ApiClaimsUser, C as ClaimsCacheOptions, a as ClaimsCapableClient, b as ClaimsProfile, c as ClaimsResult, P as PROJECT_SIGNING_KEYS, d as PROJECT_SIGNING_KEY_AUTHORITIES, e as accountFlagsFor, f as confirmUnverifiableSession, g as createClaimsCache, h as getClaimsUser, i as isAuthTransportFailure, j as isSignedOutError, k as isUnverifiableTokenError, l as isUnverifiableTokenRefusal, m as looksLikeJwt, p as pinnedSigningKeysFor, n as profileFromClaims, u as userFromClaims } from './claims-KrRxsfaG.js';
+export { A as ApiClaimsUser, a as ClaimsCacheOptions, C as ClaimsCapableClient, b as ClaimsProfile, c as ClaimsResult, P as PROJECT_SIGNING_KEYS, d as PROJECT_SIGNING_KEY_AUTHORITIES, e as accountFlagsFor, f as confirmUnverifiableSession, g as createClaimsCache, h as getClaimsUser, i as isAuthTransportFailure, j as isSignedOutError, k as isUnverifiableTokenError, l as isUnverifiableTokenRefusal, m as looksLikeJwt, p as pinnedSigningKeysFor, n as profileFromClaims, u as userFromClaims } from './claims-Vno769TE.js';
 
 /** How long a request may wait for the first auth report before going anyway. */
 declare const SESSION_ATTACH_BUDGET_MS = 3000;

package/dist/matrx-oauth.cjs

@@ -131,7 +131,7 @@ function personIdFromAccessToken(token) {
     expiresAtMs: typeof payload.exp === "number" ? payload.exp * 1e3 : null
   };
 }
-function extractErrorMessage(raw) {
+function oauthErrorFromBody(raw) {
   try {
     const j = JSON.parse(raw);
     for (const key of ["error_description", "error_message", "msg", "error", "code"]) {
@@ -268,7 +268,7 @@ function createMatrxOAuth(config, ports) {
       };
     }
     const code = String(body["error"] ?? body["error_code"] ?? res.status);
-    const detail = extractErrorMessage(text) ?? text.slice(0, 200);
+    const detail = oauthErrorFromBody(text) ?? text.slice(0, 200);
     if (isExchange) {
       throw new MatrxOAuthError("token_exchange_failed", `Token exchange failed (${res.status}): ${detail}`);
     }

package/dist/matrx-oauth.js

@@ -97,7 +97,7 @@ function personIdFromAccessToken(token) {
     expiresAtMs: typeof payload.exp === "number" ? payload.exp * 1e3 : null
   };
 }
-function extractErrorMessage(raw) {
+function oauthErrorFromBody(raw) {
   try {
     const j = JSON.parse(raw);
     for (const key of ["error_description", "error_message", "msg", "error", "code"]) {
@@ -234,7 +234,7 @@ function createMatrxOAuth(config, ports) {
       };
     }
     const code = String(body["error"] ?? body["error_code"] ?? res.status);
-    const detail = extractErrorMessage(text) ?? text.slice(0, 200);
+    const detail = oauthErrorFromBody(text) ?? text.slice(0, 200);
     if (isExchange) {
       throw new MatrxOAuthError("token_exchange_failed", `Token exchange failed (${res.status}): ${detail}`);
     }

package/dist/next.cjs

@@ -23,7 +23,7 @@ __export(next_exports, {
   AMBIGUOUS_AUTH_COOKIE_HEADER: () => AMBIGUOUS_AUTH_COOKIE_HEADER,
   AUTH_COOKIE_RESPONSE_HEADERS: () => AUTH_COOKIE_RESPONSE_HEADERS,
   AUTH_REFRESH_CEILING_MS: () => AUTH_REFRESH_CEILING_MS,
-  DEFAULT_AUTH_COOKIE_NAME: () => DEFAULT_AUTH_COOKIE_NAME,
+  MATRX_AUTH_COOKIE: () => MATRX_AUTH_COOKIE,
   MissingSupabaseIdentityError: () => MissingSupabaseIdentityError,
   SPLIT_COOKIE_JAR_HEADER: () => SPLIT_COOKIE_JAR_HEADER,
   createAuthBudget: () => createAuthBudget,
@@ -38,10 +38,16 @@ __export(next_exports, {
 module.exports = __toCommonJS(next_exports);
 
 // src/next/supabase.ts
+var import_ssr2 = require("@supabase/ssr");
+
+// src/browser/supabase.ts
 var import_ssr = require("@supabase/ssr");
 
 // src/cookies/auth-cookie.ts
-var DEFAULT_AUTH_COOKIE_NAME = "sb-matrx-auth";
+var MATRX_AUTH_COOKIE = {
+  current: "sb-matrx-auth-v2",
+  legacy: "sb-matrx-auth"
+};
 function parseCookieHeader(header) {
   if (!header) return [];
   const out = [];
@@ -73,7 +79,7 @@ function renamedCookie(cookie, from, to) {
   return { ...cookie, name: `${to}.${chunk}` };
 }
 function createAuthCookie(args) {
-  const cookieName = args.cookieName ?? DEFAULT_AUTH_COOKIE_NAME;
+  const cookieName = args.cookieName ?? MATRX_AUTH_COOKIE.current;
   const legacyCookieName = args.legacyCookieName;
   const apex = args.apexDomain.toLowerCase();
   const optionsForHost = (host) => {
@@ -148,6 +154,57 @@ function createAuthCookie(args) {
   };
 }
 
+// src/browser/supabase.ts
+var BROWSER_SLOT = /* @__PURE__ */ Symbol.for("ai-matrx.data.next.browser-client");
+function readBrowserSlot() {
+  return globalThis[BROWSER_SLOT];
+}
+function writeBrowserSlot(slot) {
+  globalThis[BROWSER_SLOT] = slot;
+}
+function browserCookieAdapter(authCookie) {
+  return {
+    getAll: () => authCookie.reconcile(
+      typeof document === "undefined" ? [] : parseCookieHeader(document.cookie)
+    ).cookies,
+    setAll: (cookiesToSet) => {
+      if (typeof document === "undefined") return;
+      for (const cookie of cookiesToSet) {
+        const options = cookie.options ?? {};
+        const parts = [
+          `${cookie.name}=${encodeURIComponent(cookie.value)}`,
+          `Path=${typeof options.path === "string" ? options.path : "/"}`
+        ];
+        if (typeof options.domain === "string") {
+          parts.push(`Domain=${options.domain}`);
+        }
+        if (typeof options.maxAge === "number") {
+          parts.push(`Max-Age=${options.maxAge}`);
+        }
+        if (typeof options.sameSite === "string") {
+          parts.push(`SameSite=${options.sameSite}`);
+        }
+        if (options.secure === true || location.protocol === "https:") parts.push("Secure");
+        document.cookie = parts.join("; ");
+      }
+    }
+  };
+}
+function createBrowserSupabase(config) {
+  const slotKey = `${config.url}|${config.key}|${config.authCookie.cookieName}`;
+  const existing = readBrowserSlot();
+  if (existing && existing.key === slotKey) {
+    return existing.client;
+  }
+  const raw = (0, import_ssr.createBrowserClient)(config.url, config.key, {
+    cookieOptions: config.authCookie.browserOptions(),
+    cookies: browserCookieAdapter(config.authCookie)
+  });
+  const client = config.wrapBrowserClient ? config.wrapBrowserClient(raw) : raw;
+  writeBrowserSlot({ key: slotKey, client });
+  return client;
+}
+
 // src/next/supabase.ts
 var RESPONSE_COOKIE_ATTRIBUTES = [
   "domain",
@@ -305,13 +362,6 @@ async function resolveIdentity(client, budget) {
     return unreachable(cause);
   }
 }
-var BROWSER_SLOT = /* @__PURE__ */ Symbol.for("ai-matrx.data.next.browser-client");
-function readBrowserSlot() {
-  return globalThis[BROWSER_SLOT];
-}
-function writeBrowserSlot(slot) {
-  globalThis[BROWSER_SLOT] = slot;
-}
 function createNextSupabase(config) {
   const url = requireIdentity(config.supabaseUrl, "NEXT_PUBLIC_SUPABASE_URL");
   const key = requireIdentity(
@@ -323,47 +373,12 @@ function createNextSupabase(config) {
     ...config.cookieName !== void 0 ? { cookieName: config.cookieName } : {},
     ...config.legacyCookieName !== void 0 ? { legacyCookieName: config.legacyCookieName } : {}
   });
-  const wrap = config.wrapBrowserClient;
-  const slotKey = `${url}|${key}|${authCookie.cookieName}`;
-  const browserCookieAdapter = () => ({
-    getAll: () => authCookie.reconcile(
-      typeof document === "undefined" ? [] : parseCookieHeader(document.cookie)
-    ).cookies,
-    setAll: (cookiesToSet) => {
-      if (typeof document === "undefined") return;
-      for (const cookie of cookiesToSet) {
-        const options = cookie.options ?? {};
-        const parts = [
-          `${cookie.name}=${encodeURIComponent(cookie.value)}`,
-          `Path=${typeof options.path === "string" ? options.path : "/"}`
-        ];
-        if (typeof options.domain === "string") {
-          parts.push(`Domain=${options.domain}`);
-        }
-        if (typeof options.maxAge === "number") {
-          parts.push(`Max-Age=${options.maxAge}`);
-        }
-        if (typeof options.sameSite === "string") {
-          parts.push(`SameSite=${options.sameSite}`);
-        }
-        if (options.secure === true || location.protocol === "https:") parts.push("Secure");
-        document.cookie = parts.join("; ");
-      }
-    }
+  const browserClient = () => createBrowserSupabase({
+    url,
+    key,
+    authCookie,
+    ...config.wrapBrowserClient !== void 0 ? { wrapBrowserClient: config.wrapBrowserClient } : {}
   });
-  const browserClient = () => {
-    const existing = readBrowserSlot();
-    if (existing && existing.key === slotKey) {
-      return existing.client;
-    }
-    const raw = (0, import_ssr.createBrowserClient)(url, key, {
-      cookieOptions: authCookie.browserOptions(),
-      cookies: browserCookieAdapter()
-    });
-    const client = wrap ? wrap(raw) : raw;
-    writeBrowserSlot({ key: slotKey, client });
-    return client;
-  };
   const reconciledGetAll = (getAllRaw, cookieHeader) => {
     const parsed = parseCookieHeader(cookieHeader);
     if (parsed.length > 0) {
@@ -380,7 +395,7 @@ function createNextSupabase(config) {
   }) => {
     const written = /* @__PURE__ */ new Set();
     const budget = createAuthBudget(AUTH_RESOLVE_TIMEOUT_MS);
-    return (0, import_ssr.createServerClient)(url, key, {
+    return (0, import_ssr2.createServerClient)(url, key, {
       cookieOptions: authCookie.optionsForHost(host),
       global: { fetch: budget.fetch },
       cookies: {
@@ -422,7 +437,7 @@ function createNextSupabase(config) {
   }) => {
     const written = /* @__PURE__ */ new Set();
     const budget = createAuthBudget(AUTH_RESOLVE_TIMEOUT_MS);
-    return (0, import_ssr.createServerClient)(url, key, {
+    return (0, import_ssr2.createServerClient)(url, key, {
       cookieOptions: authCookie.optionsForHost(host),
       global: { fetch: budget.fetch },
       cookies: {
@@ -520,7 +535,7 @@ function createNextSupabase(config) {
       }
       response = next;
     };
-    const client = (0, import_ssr.createServerClient)(url, key, {
+    const client = (0, import_ssr2.createServerClient)(url, key, {
       cookieOptions: hostCookieOptions,
       // Identity calls out of THIS pass share one deadline; see createAuthBudget.
       global: { fetch: budget.fetch },
@@ -543,7 +558,7 @@ function createNextSupabase(config) {
         ).map(({ name, value }) => ({
           name,
           value,
-          options: { ...import_ssr.DEFAULT_COOKIE_OPTIONS, ...cookieOptions }
+          options: { ...import_ssr2.DEFAULT_COOKIE_OPTIONS, ...cookieOptions }
         }))
       );
     }
@@ -554,7 +569,7 @@ function createNextSupabase(config) {
       }
     }
     if (authCookie.legacyCookieName && !authUnavailable) {
-      await (0, import_ssr.clearAuthCookiesAtScopes)({
+      await (0, import_ssr2.clearAuthCookiesAtScopes)({
         getAll: () => readCookies(),
         setAll: (cookiesToSet, headers) => {
           applyCookies(
@@ -585,7 +600,7 @@ function createNextSupabase(config) {
               name,
               value,
               options: {
-                ...import_ssr.DEFAULT_COOKIE_OPTIONS,
+                ...import_ssr2.DEFAULT_COOKIE_OPTIONS,
                 domain: hostCookieOptions.domain,
                 path: "/",
                 // A Domain-scoped auth cookie only ever exists on https here,

package/dist/next.d.cts

@@ -1,8 +1,9 @@
-import { createServerClient, createBrowserClient } from '@supabase/ssr';
-import { b as AuthCookieValue, A as AuthCookie, a as AuthCookieOptions } from './auth-cookie-DWx6Q3xo.cjs';
-export { C as CreateAuthCookieArgs, D as DEFAULT_AUTH_COOKIE_NAME, c as createAuthCookie } from './auth-cookie-DWx6Q3xo.cjs';
+import { createServerClient } from '@supabase/ssr';
+import { DatabaseLike, NextBrowserClient } from './browser.cjs';
+import { b as AuthCookieValue, A as AuthCookie, a as AuthCookieOptions } from './auth-cookie-QPVLJJwP.cjs';
+export { C as CreateAuthCookieArgs, M as MATRX_AUTH_COOKIE, c as createAuthCookie } from './auth-cookie-QPVLJJwP.cjs';
 import { SupabaseClient } from '@supabase/supabase-js';
-import { a as ClaimsCapableClient, A as ApiClaimsUser } from './claims-KrRxsfaG.cjs';
+import { C as ClaimsCapableClient, A as ApiClaimsUser } from './claims-Vno769TE.cjs';
 
 /**
  * @ai-matrx/data/next — the Next.js Supabase binding.
@@ -40,13 +41,6 @@ import { a as ClaimsCapableClient, A as ApiClaimsUser } from './claims-KrRxsfaG.
  * non-Next consumer's graph.
  */
 
-/**
- * A `Database` type as generated by Supabase. Deliberately structural: the
- * package never imports a host's generated types, and a host that has not
- * generated any still gets a working (untyped-rows) client.
- */
-type DatabaseLike = Record<string, unknown>;
-type NextBrowserClient<DB extends DatabaseLike> = ReturnType<typeof createBrowserClient<DB>>;
 type NextServerClient<DB extends DatabaseLike> = ReturnType<typeof createServerClient<DB>>;
 /** A cookie to write, as `@supabase/ssr` hands it to `setAll`. */
 interface CookieToSet {
@@ -134,7 +128,7 @@ interface NextSupabaseConfig {
     publishableKey: string | undefined;
     /** The apex domain one login must span, e.g. `"aimatrx.com"`. */
     apexDomain: string;
-    /** Auth cookie name. Defaults to the package's `sb-matrx-auth`. */
+    /** Auth cookie name. Defaults to `MATRX_AUTH_COOKIE.current`. */
     cookieName?: string;
     /** A superseded storage key to migrate from and then clear. */
     legacyCookieName?: string;
@@ -462,4 +456,4 @@ declare function createServiceClient<Database = unknown>(options: {
     secretKey: string | null | undefined;
 }): SupabaseClient<Database>;
 
-export { AMBIGUOUS_AUTH_COOKIE_HEADER, AUTH_COOKIE_RESPONSE_HEADERS, AUTH_REFRESH_CEILING_MS, type AuthBudget, AuthCookie, AuthCookieOptions, AuthCookieValue, type CookieToSet, type DatabaseLike, type MiddlewareResponse, type MiddlewareSession, type MiddlewareSessionArgs, MissingSupabaseIdentityError, type NextBrowserClient, type NextServerClient, type NextSupabase, type NextSupabaseConfig, type RequestCookieJar, type RequestLike, type ResponseCookie, type ResponseCookieJar, SPLIT_COOKIE_JAR_HEADER, type ServerAuthOptions, type ServerAuthState, type ServerCookieStore, type VerifyRequestOptions, createAuthBudget, createNextSupabase, createServerAuth, createServiceClient, serializeSetCookie, toResponseCookie, verifyRequest };
+export { AMBIGUOUS_AUTH_COOKIE_HEADER, AUTH_COOKIE_RESPONSE_HEADERS, AUTH_REFRESH_CEILING_MS, type AuthBudget, AuthCookie, AuthCookieOptions, AuthCookieValue, type CookieToSet, DatabaseLike, type MiddlewareResponse, type MiddlewareSession, type MiddlewareSessionArgs, MissingSupabaseIdentityError, NextBrowserClient, type NextServerClient, type NextSupabase, type NextSupabaseConfig, type RequestCookieJar, type RequestLike, type ResponseCookie, type ResponseCookieJar, SPLIT_COOKIE_JAR_HEADER, type ServerAuthOptions, type ServerAuthState, type ServerCookieStore, type VerifyRequestOptions, createAuthBudget, createNextSupabase, createServerAuth, createServiceClient, serializeSetCookie, toResponseCookie, verifyRequest };

package/dist/next.d.ts

@@ -1,8 +1,9 @@
-import { createServerClient, createBrowserClient } from '@supabase/ssr';
-import { b as AuthCookieValue, A as AuthCookie, a as AuthCookieOptions } from './auth-cookie-DWx6Q3xo.js';
-export { C as CreateAuthCookieArgs, D as DEFAULT_AUTH_COOKIE_NAME, c as createAuthCookie } from './auth-cookie-DWx6Q3xo.js';
+import { createServerClient } from '@supabase/ssr';
+import { DatabaseLike, NextBrowserClient } from './browser.js';
+import { b as AuthCookieValue, A as AuthCookie, a as AuthCookieOptions } from './auth-cookie-QPVLJJwP.js';
+export { C as CreateAuthCookieArgs, M as MATRX_AUTH_COOKIE, c as createAuthCookie } from './auth-cookie-QPVLJJwP.js';
 import { SupabaseClient } from '@supabase/supabase-js';
-import { a as ClaimsCapableClient, A as ApiClaimsUser } from './claims-KrRxsfaG.js';
+import { C as ClaimsCapableClient, A as ApiClaimsUser } from './claims-Vno769TE.js';
 
 /**
  * @ai-matrx/data/next — the Next.js Supabase binding.
@@ -40,13 +41,6 @@ import { a as ClaimsCapableClient, A as ApiClaimsUser } from './claims-KrRxsfaG.
  * non-Next consumer's graph.
  */
 
-/**
- * A `Database` type as generated by Supabase. Deliberately structural: the
- * package never imports a host's generated types, and a host that has not
- * generated any still gets a working (untyped-rows) client.
- */
-type DatabaseLike = Record<string, unknown>;
-type NextBrowserClient<DB extends DatabaseLike> = ReturnType<typeof createBrowserClient<DB>>;
 type NextServerClient<DB extends DatabaseLike> = ReturnType<typeof createServerClient<DB>>;
 /** A cookie to write, as `@supabase/ssr` hands it to `setAll`. */
 interface CookieToSet {
@@ -134,7 +128,7 @@ interface NextSupabaseConfig {
     publishableKey: string | undefined;
     /** The apex domain one login must span, e.g. `"aimatrx.com"`. */
     apexDomain: string;
-    /** Auth cookie name. Defaults to the package's `sb-matrx-auth`. */
+    /** Auth cookie name. Defaults to `MATRX_AUTH_COOKIE.current`. */
     cookieName?: string;
     /** A superseded storage key to migrate from and then clear. */
     legacyCookieName?: string;
@@ -462,4 +456,4 @@ declare function createServiceClient<Database = unknown>(options: {
     secretKey: string | null | undefined;
 }): SupabaseClient<Database>;
 
-export { AMBIGUOUS_AUTH_COOKIE_HEADER, AUTH_COOKIE_RESPONSE_HEADERS, AUTH_REFRESH_CEILING_MS, type AuthBudget, AuthCookie, AuthCookieOptions, AuthCookieValue, type CookieToSet, type DatabaseLike, type MiddlewareResponse, type MiddlewareSession, type MiddlewareSessionArgs, MissingSupabaseIdentityError, type NextBrowserClient, type NextServerClient, type NextSupabase, type NextSupabaseConfig, type RequestCookieJar, type RequestLike, type ResponseCookie, type ResponseCookieJar, SPLIT_COOKIE_JAR_HEADER, type ServerAuthOptions, type ServerAuthState, type ServerCookieStore, type VerifyRequestOptions, createAuthBudget, createNextSupabase, createServerAuth, createServiceClient, serializeSetCookie, toResponseCookie, verifyRequest };
+export { AMBIGUOUS_AUTH_COOKIE_HEADER, AUTH_COOKIE_RESPONSE_HEADERS, AUTH_REFRESH_CEILING_MS, type AuthBudget, AuthCookie, AuthCookieOptions, AuthCookieValue, type CookieToSet, DatabaseLike, type MiddlewareResponse, type MiddlewareSession, type MiddlewareSessionArgs, MissingSupabaseIdentityError, NextBrowserClient, type NextServerClient, type NextSupabase, type NextSupabaseConfig, type RequestCookieJar, type RequestLike, type ResponseCookie, type ResponseCookieJar, SPLIT_COOKIE_JAR_HEADER, type ServerAuthOptions, type ServerAuthState, type ServerCookieStore, type VerifyRequestOptions, createAuthBudget, createNextSupabase, createServerAuth, createServiceClient, serializeSetCookie, toResponseCookie, verifyRequest };

package/dist/next.js

@@ -1,13 +1,18 @@
 // src/next/supabase.ts
 import {
   clearAuthCookiesAtScopes,
-  createBrowserClient,
   createServerClient,
   DEFAULT_COOKIE_OPTIONS
 } from "@supabase/ssr";
 
+// src/browser/supabase.ts
+import { createBrowserClient } from "@supabase/ssr";
+
 // src/cookies/auth-cookie.ts
-var DEFAULT_AUTH_COOKIE_NAME = "sb-matrx-auth";
+var MATRX_AUTH_COOKIE = {
+  current: "sb-matrx-auth-v2",
+  legacy: "sb-matrx-auth"
+};
 function parseCookieHeader(header) {
   if (!header) return [];
   const out = [];
@@ -39,7 +44,7 @@ function renamedCookie(cookie, from, to) {
   return { ...cookie, name: `${to}.${chunk}` };
 }
 function createAuthCookie(args) {
-  const cookieName = args.cookieName ?? DEFAULT_AUTH_COOKIE_NAME;
+  const cookieName = args.cookieName ?? MATRX_AUTH_COOKIE.current;
   const legacyCookieName = args.legacyCookieName;
   const apex = args.apexDomain.toLowerCase();
   const optionsForHost = (host) => {
@@ -114,6 +119,57 @@ function createAuthCookie(args) {
   };
 }
 
+// src/browser/supabase.ts
+var BROWSER_SLOT = /* @__PURE__ */ Symbol.for("ai-matrx.data.next.browser-client");
+function readBrowserSlot() {
+  return globalThis[BROWSER_SLOT];
+}
+function writeBrowserSlot(slot) {
+  globalThis[BROWSER_SLOT] = slot;
+}
+function browserCookieAdapter(authCookie) {
+  return {
+    getAll: () => authCookie.reconcile(
+      typeof document === "undefined" ? [] : parseCookieHeader(document.cookie)
+    ).cookies,
+    setAll: (cookiesToSet) => {
+      if (typeof document === "undefined") return;
+      for (const cookie of cookiesToSet) {
+        const options = cookie.options ?? {};
+        const parts = [
+          `${cookie.name}=${encodeURIComponent(cookie.value)}`,
+          `Path=${typeof options.path === "string" ? options.path : "/"}`
+        ];
+        if (typeof options.domain === "string") {
+          parts.push(`Domain=${options.domain}`);
+        }
+        if (typeof options.maxAge === "number") {
+          parts.push(`Max-Age=${options.maxAge}`);
+        }
+        if (typeof options.sameSite === "string") {
+          parts.push(`SameSite=${options.sameSite}`);
+        }
+        if (options.secure === true || location.protocol === "https:") parts.push("Secure");
+        document.cookie = parts.join("; ");
+      }
+    }
+  };
+}
+function createBrowserSupabase(config) {
+  const slotKey = `${config.url}|${config.key}|${config.authCookie.cookieName}`;
+  const existing = readBrowserSlot();
+  if (existing && existing.key === slotKey) {
+    return existing.client;
+  }
+  const raw = createBrowserClient(config.url, config.key, {
+    cookieOptions: config.authCookie.browserOptions(),
+    cookies: browserCookieAdapter(config.authCookie)
+  });
+  const client = config.wrapBrowserClient ? config.wrapBrowserClient(raw) : raw;
+  writeBrowserSlot({ key: slotKey, client });
+  return client;
+}
+
 // src/next/supabase.ts
 var RESPONSE_COOKIE_ATTRIBUTES = [
   "domain",
@@ -271,13 +327,6 @@ async function resolveIdentity(client, budget) {
     return unreachable(cause);
   }
 }
-var BROWSER_SLOT = /* @__PURE__ */ Symbol.for("ai-matrx.data.next.browser-client");
-function readBrowserSlot() {
-  return globalThis[BROWSER_SLOT];
-}
-function writeBrowserSlot(slot) {
-  globalThis[BROWSER_SLOT] = slot;
-}
 function createNextSupabase(config) {
   const url = requireIdentity(config.supabaseUrl, "NEXT_PUBLIC_SUPABASE_URL");
   const key = requireIdentity(
@@ -289,47 +338,12 @@ function createNextSupabase(config) {
     ...config.cookieName !== void 0 ? { cookieName: config.cookieName } : {},
     ...config.legacyCookieName !== void 0 ? { legacyCookieName: config.legacyCookieName } : {}
   });
-  const wrap = config.wrapBrowserClient;
-  const slotKey = `${url}|${key}|${authCookie.cookieName}`;
-  const browserCookieAdapter = () => ({
-    getAll: () => authCookie.reconcile(
-      typeof document === "undefined" ? [] : parseCookieHeader(document.cookie)
-    ).cookies,
-    setAll: (cookiesToSet) => {
-      if (typeof document === "undefined") return;
-      for (const cookie of cookiesToSet) {
-        const options = cookie.options ?? {};
-        const parts = [
-          `${cookie.name}=${encodeURIComponent(cookie.value)}`,
-          `Path=${typeof options.path === "string" ? options.path : "/"}`
-        ];
-        if (typeof options.domain === "string") {
-          parts.push(`Domain=${options.domain}`);
-        }
-        if (typeof options.maxAge === "number") {
-          parts.push(`Max-Age=${options.maxAge}`);
-        }
-        if (typeof options.sameSite === "string") {
-          parts.push(`SameSite=${options.sameSite}`);
-        }
-        if (options.secure === true || location.protocol === "https:") parts.push("Secure");
-        document.cookie = parts.join("; ");
-      }
-    }
+  const browserClient = () => createBrowserSupabase({
+    url,
+    key,
+    authCookie,
+    ...config.wrapBrowserClient !== void 0 ? { wrapBrowserClient: config.wrapBrowserClient } : {}
   });
-  const browserClient = () => {
-    const existing = readBrowserSlot();
-    if (existing && existing.key === slotKey) {
-      return existing.client;
-    }
-    const raw = createBrowserClient(url, key, {
-      cookieOptions: authCookie.browserOptions(),
-      cookies: browserCookieAdapter()
-    });
-    const client = wrap ? wrap(raw) : raw;
-    writeBrowserSlot({ key: slotKey, client });
-    return client;
-  };
   const reconciledGetAll = (getAllRaw, cookieHeader) => {
     const parsed = parseCookieHeader(cookieHeader);
     if (parsed.length > 0) {
@@ -758,7 +772,7 @@ export {
   AMBIGUOUS_AUTH_COOKIE_HEADER,
   AUTH_COOKIE_RESPONSE_HEADERS,
   AUTH_REFRESH_CEILING_MS,
-  DEFAULT_AUTH_COOKIE_NAME,
+  MATRX_AUTH_COOKIE,
   MissingSupabaseIdentityError,
   SPLIT_COOKIE_JAR_HEADER,
   createAuthBudget,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-matrx/auth",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "AI Matrx sign-in, session and organizations for every app: sign in/out, session storage and refresh per platform (browser, Next.js, extension, desktop, Node), the current person, their organizations and favourites, the one active organization (held requests, never a list filter), and the credentials @ai-matrx/data and @ai-matrx/api read.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -92,6 +92,16 @@
         "default": "./dist/next.cjs"
       }
     },
+    "./browser": {
+      "import": {
+        "types": "./dist/browser.d.ts",
+        "default": "./dist/browser.js"
+      },
+      "require": {
+        "types": "./dist/browser.d.cts",
+        "default": "./dist/browser.cjs"
+      }
+    },
     "./react": {
       "import": {
         "types": "./dist/react.d.ts",
@@ -211,5 +221,5 @@
     "test": "vitest run",
     "verify:tarball": "node ./scripts/verify-tarball.mjs"
   },
-  "gitHead": "d08db9b7b169f5c98fa59c9de985a367ba33c27f"
+  "gitHead": "cd85c8a24fbc3f8eb2f2c450142cbdbd6130b31f"
 }