@avelonjs/supabase 0.1.0

package/src/database/fixtures.ts

@@ -0,0 +1,206 @@
+import type { SQL } from 'bun'
+
+/** SQL that provisions assay fixtures, upsert RPC, and a minimal auth.uid() helper. */
+export const SUPABASE_ASSAY_FIXTURE_SQL = `
+DO $roles$ BEGIN
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'anon') THEN
+    CREATE ROLE anon NOLOGIN NOINHERIT;
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'authenticated') THEN
+    CREATE ROLE authenticated NOLOGIN NOINHERIT;
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'service_role') THEN
+    CREATE ROLE service_role NOLOGIN NOINHERIT BYPASSRLS;
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'authenticator') THEN
+    CREATE ROLE authenticator LOGIN NOINHERIT PASSWORD 'avelon';
+  END IF;
+END
+$roles$;
+
+GRANT anon TO authenticator;
+GRANT authenticated TO authenticator;
+GRANT service_role TO authenticator;
+
+DO $connect$ BEGIN
+  EXECUTE format(
+    'GRANT CONNECT ON DATABASE %I TO authenticator, anon, authenticated, service_role',
+    current_database()
+  );
+END
+$connect$;
+
+CREATE SCHEMA IF NOT EXISTS auth;
+
+CREATE OR REPLACE FUNCTION auth.uid()
+RETURNS text
+LANGUAGE sql
+STABLE
+AS $$
+  SELECT COALESCE(
+    NULLIF(current_setting('request.jwt.claim.sub', true), ''),
+    NULLIF(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub'
+  );
+$$;
+
+DROP TABLE IF EXISTS assay_reactions CASCADE;
+DROP TABLE IF EXISTS assay_comments CASCADE;
+DROP TABLE IF EXISTS assay_posts CASCADE;
+DROP TABLE IF EXISTS assay_profiles CASCADE;
+DROP TABLE IF EXISTS assay_users CASCADE;
+DROP FUNCTION IF EXISTS assay_echo(jsonb);
+DROP FUNCTION IF EXISTS avelon_upsert_subset(text, jsonb, text[], text[], text[]);
+
+CREATE TABLE assay_users (
+  id text PRIMARY KEY,
+  email text NOT NULL UNIQUE,
+  name text NOT NULL,
+  age integer NOT NULL,
+  nickname text
+);
+
+CREATE TABLE assay_profiles (
+  id text PRIMARY KEY,
+  user_id text NOT NULL UNIQUE REFERENCES assay_users(id) ON DELETE CASCADE,
+  bio text NOT NULL
+);
+
+CREATE TABLE assay_posts (
+  id text PRIMARY KEY,
+  user_id text NOT NULL REFERENCES assay_users(id) ON DELETE CASCADE,
+  title text NOT NULL,
+  score integer NOT NULL,
+  published_at timestamptz
+);
+
+CREATE TABLE assay_comments (
+  id text PRIMARY KEY,
+  post_id text NOT NULL REFERENCES assay_posts(id) ON DELETE CASCADE,
+  body text NOT NULL,
+  position integer NOT NULL
+);
+
+CREATE TABLE assay_reactions (
+  id text PRIMARY KEY,
+  comment_id text NOT NULL REFERENCES assay_comments(id) ON DELETE CASCADE,
+  kind text NOT NULL
+);
+
+CREATE OR REPLACE FUNCTION assay_echo(args jsonb)
+RETURNS jsonb
+LANGUAGE sql
+IMMUTABLE
+AS $$
+  SELECT args;
+$$;
+
+CREATE OR REPLACE FUNCTION avelon_upsert_subset(
+  target_table text,
+  input_rows jsonb,
+  conflict_columns text[],
+  update_columns text[],
+  returning_columns text[] DEFAULT NULL
+) RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY INVOKER
+SET search_path = pg_catalog, public
+AS $function$
+DECLARE
+  table_oid regclass;
+  qualified_table text;
+  insert_columns text[];
+  all_columns text[];
+  insert_sql text;
+  conflict_sql text;
+  update_sql text;
+  returning_sql text;
+  statement text;
+  result jsonb;
+BEGIN
+  IF target_table !~ '^assay_[a-z0-9_]+$' THEN
+    RAISE EXCEPTION 'invalid target table';
+  END IF;
+  qualified_table := format('public.%I', target_table);
+  table_oid := to_regclass(qualified_table);
+  IF table_oid IS NULL THEN
+    RAISE EXCEPTION 'target table does not exist';
+  END IF;
+  IF jsonb_typeof(input_rows) <> 'array' OR jsonb_array_length(input_rows) = 0 THEN
+    RAISE EXCEPTION 'input_rows must be a non-empty array';
+  END IF;
+
+  SELECT array_agg(key ORDER BY key)
+    INTO insert_columns
+    FROM jsonb_object_keys(input_rows -> 0) AS key;
+  IF insert_columns IS NULL OR cardinality(insert_columns) = 0 THEN
+    RAISE EXCEPTION 'input rows must not be empty';
+  END IF;
+  IF conflict_columns IS NULL OR cardinality(conflict_columns) = 0
+     OR update_columns IS NULL OR cardinality(update_columns) = 0 THEN
+    RAISE EXCEPTION 'conflict and update columns must be non-empty';
+  END IF;
+
+  all_columns := insert_columns || conflict_columns || update_columns || COALESCE(returning_columns, ARRAY[]::text[]);
+  IF EXISTS (
+    SELECT 1
+      FROM unnest(all_columns) AS requested(column_name)
+     WHERE requested.column_name !~ '^[A-Za-z_][A-Za-z0-9_]*$'
+        OR NOT EXISTS (
+          SELECT 1
+            FROM pg_attribute
+           WHERE attrelid = table_oid
+             AND attname = requested.column_name
+             AND attnum > 0
+             AND NOT attisdropped
+        )
+  ) THEN
+    RAISE EXCEPTION 'unknown or invalid column';
+  END IF;
+
+  SELECT string_agg(format('%I', column_name), ', ')
+    INTO insert_sql
+    FROM unnest(insert_columns) AS columns(column_name);
+  SELECT string_agg(format('%I', column_name), ', ')
+    INTO conflict_sql
+    FROM unnest(conflict_columns) AS columns(column_name);
+  SELECT string_agg(format('%1$I = EXCLUDED.%1$I', column_name), ', ')
+    INTO update_sql
+    FROM unnest(update_columns) AS columns(column_name);
+  IF returning_columns IS NULL THEN
+    returning_sql := '*';
+  ELSE
+    SELECT string_agg(format('%I', column_name), ', ')
+      INTO returning_sql
+      FROM unnest(returning_columns) AS columns(column_name);
+  END IF;
+
+  statement := format(
+    'WITH input AS (SELECT * FROM jsonb_populate_recordset(NULL::%1$s, $1)), affected AS (' ||
+    'INSERT INTO %1$s (%2$s) SELECT %2$s FROM input ' ||
+    'ON CONFLICT (%3$s) DO UPDATE SET %4$s RETURNING %5$s) ' ||
+    'SELECT COALESCE(jsonb_agg(to_jsonb(affected)), ''[]''::jsonb) FROM affected',
+    qualified_table,
+    insert_sql,
+    conflict_sql,
+    update_sql,
+    returning_sql
+  );
+  EXECUTE statement USING input_rows INTO result;
+  RETURN result;
+END;
+$function$;
+
+GRANT USAGE ON SCHEMA public TO anon, authenticated, service_role;
+GRANT USAGE ON SCHEMA auth TO anon, authenticated, service_role;
+GRANT ALL ON ALL TABLES IN SCHEMA public TO anon, authenticated, service_role;
+GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO anon, authenticated, service_role;
+GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO anon, authenticated, service_role;
+GRANT EXECUTE ON FUNCTION auth.uid() TO anon, authenticated, service_role;
+
+NOTIFY pgrst, 'reload schema';
+`
+
+/** Provisions empty assay fixtures and helper routines for live Supabase database tests. */
+export async function resetSupabaseAssayFixtures(sql: SQL): Promise<void> {
+  await sql.unsafe(SUPABASE_ASSAY_FIXTURE_SQL)
+}

package/src/database/index.ts

@@ -0,0 +1,17 @@
+export { compilePostgrest, applyPostgrestPredicate, type CompiledPostgrestRequest } from './compile'
+export {
+  createSupabaseDatabase,
+  SupabaseDatabase,
+  supabaseDatabaseCapabilities,
+  type SupabaseDatabaseOptions,
+} from './driver'
+export { mapPostgrestError, SUPABASE_DATABASE_ERROR_MAP } from './errors'
+export { resetSupabaseAssayFixtures, SUPABASE_ASSAY_FIXTURE_SQL } from './fixtures'
+export { combinedPredicate, normalizePredicate } from './normalize'
+export {
+  compileAllWardPolicies,
+  compileWardPredicate,
+  compileWardPolicySql,
+  type WardPolicy,
+} from './wards'
+export type { PostgresMigration } from '@avelonjs/postgres'

package/src/database/normalize.ts

@@ -0,0 +1 @@
+export { combinedPredicate, normalizePredicate } from '@avelonjs/postgres'

package/src/database/wards.ts

@@ -0,0 +1,124 @@
+import { Invalid, type CompareOp, type Predicate } from '@avelonjs/core'
+import { normalizePredicate } from '@avelonjs/postgres'
+
+/** One ward policy synchronized into Postgres RLS. */
+export interface WardPolicy {
+  /** Stable policy name. */
+  name: string
+  /** Target table. */
+  table: string
+  /** SQL command the policy covers. */
+  command: 'select' | 'insert' | 'update' | 'delete' | 'all'
+  /** USING expression for read/update/delete (and ALL). */
+  using?: Predicate | boolean
+  /** WITH CHECK expression for insert/update (and ALL). */
+  check?: Predicate | boolean
+  /** Role the policy applies to. Defaults to `authenticated`. */
+  role?: string
+}
+
+function invalid(message: string): never {
+  throw new Invalid(message, { metadata: { fields: { ward: [message] } } })
+}
+
+function quoteIdentifier(identifier: string): string {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    invalid(`Ward identifier '${identifier}' is not a simple SQL identifier.`)
+  }
+  return `"${identifier}"`
+}
+
+const SQL_OPERATOR: Record<CompareOp, string> = {
+  '=': '=',
+  '!=': '<>',
+  '<': '<',
+  '<=': '<=',
+  '>': '>',
+  '>=': '>=',
+  like: 'LIKE',
+  ilike: 'ILIKE',
+}
+
+/**
+ * Compiles a ward predicate into a Postgres RLS boolean SQL expression.
+ *
+ * Values are inlined only when they are JSON-safe literals. Actor claims use `auth.uid()` via the
+ * reserved compare form `{ kind: 'compare', column, op: '=', value: { claim: 'uid' } }`.
+ */
+export function compileWardPredicate(predicate: Predicate | boolean): string {
+  if (typeof predicate === 'boolean') return predicate ? 'TRUE' : 'FALSE'
+  return compileNormalized(normalizePredicate(predicate))
+}
+
+function compileNormalized(predicate: Predicate): string {
+  switch (predicate.kind) {
+    case 'const':
+      return predicate.value ? 'TRUE' : 'FALSE'
+    case 'compare':
+      return `${quoteIdentifier(predicate.column)} ${SQL_OPERATOR[predicate.op]} ${compileValue(predicate.value)}`
+    case 'null':
+      return `${quoteIdentifier(predicate.column)} IS ${predicate.negated ? 'NOT ' : ''}NULL`
+    case 'in':
+      if (predicate.values.length === 0) return predicate.negated ? 'TRUE' : 'FALSE'
+      return `${quoteIdentifier(predicate.column)} ${predicate.negated ? 'NOT ' : ''}IN (${predicate.values.map(compileValue).join(', ')})`
+    case 'and':
+      return `(${predicate.predicates.map(compileNormalized).join(' AND ')})`
+    case 'or':
+      return `(${predicate.predicates.map(compileNormalized).join(' OR ')})`
+    case 'not':
+      return `NOT (${compileNormalized(predicate.predicate)})`
+  }
+}
+
+function compileValue(value: unknown): string {
+  if (isClaim(value)) {
+    if (value.claim === 'uid') return 'auth.uid()::text'
+    invalid(`Unsupported auth claim '${value.claim}'.`)
+  }
+  if (typeof value === 'string') return `'${value.replaceAll("'", "''")}'`
+  if (typeof value === 'number' && Number.isFinite(value)) return String(value)
+  if (typeof value === 'boolean') return value ? 'TRUE' : 'FALSE'
+  if (value === null) return 'NULL'
+  invalid(`Ward predicate value type '${typeof value}' cannot compile to RLS SQL.`)
+}
+
+function isClaim(value: unknown): value is { claim: string } {
+  return typeof value === 'object' && value !== null && 'claim' in value && typeof (value as { claim: unknown }).claim === 'string'
+}
+
+/** Builds DROP/CREATE POLICY statements for one ward policy. */
+export function compileWardPolicySql(policy: WardPolicy): string[] {
+  const role = quoteIdentifier(policy.role ?? 'authenticated')
+  const table = quoteIdentifier(policy.table)
+  const name = quoteIdentifier(policy.name)
+  const command = policy.command.toUpperCase()
+  const statements = [`DROP POLICY IF EXISTS ${name} ON ${table}`]
+
+  const using =
+    policy.using === undefined ? undefined : compileWardPredicate(policy.using)
+  const check =
+    policy.check === undefined ? undefined : compileWardPredicate(policy.check)
+
+  if (policy.command === 'insert' && check === undefined) {
+    invalid(`Insert ward policy '${policy.name}' requires a check predicate.`)
+  }
+  if (
+    (policy.command === 'select' || policy.command === 'delete') &&
+    using === undefined
+  ) {
+    invalid(`Ward policy '${policy.name}' requires a using predicate.`)
+  }
+
+  let create = `CREATE POLICY ${name} ON ${table} FOR ${command} TO ${role}`
+  if (using !== undefined) create += ` USING (${using})`
+  if (check !== undefined) create += ` WITH CHECK (${check})`
+  statements.push(create)
+  statements.push(`ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY`)
+  statements.push(`ALTER TABLE ${table} FORCE ROW LEVEL SECURITY`)
+  return statements
+}
+
+/** Compiles every registered ward into ordered SQL statements. */
+export function compileAllWardPolicies(policies: readonly WardPolicy[]): string[] {
+  return policies.flatMap(compileWardPolicySql)
+}

package/src/identity/cookies.ts

@@ -0,0 +1,57 @@
+import type { RequestCookies } from '@avelonjs/core'
+import type { SupabaseSession } from './types'
+
+/** Default cookie name used when no project-ref chunked cookie is configured. */
+export const DEFAULT_SESSION_COOKIE = 'sb-avelon-auth-token'
+
+/** Reads and parses the session cookie, returning null when absent or malformed. */
+export function readSessionCookie(
+  cookies: RequestCookies,
+  cookieName: string,
+): SupabaseSession | null {
+  const raw = cookies.get(cookieName)
+  if (raw === undefined || raw.length === 0) return null
+  try {
+    const parsed = JSON.parse(raw) as Partial<SupabaseSession> & { expiresAt?: string }
+    if (
+      typeof parsed.id !== 'string' ||
+      typeof parsed.accessToken !== 'string' ||
+      typeof parsed.refreshToken !== 'string' ||
+      typeof parsed.expiresAt !== 'string'
+    ) {
+      return null
+    }
+    const expiresAt = new Date(parsed.expiresAt)
+    if (Number.isNaN(expiresAt.getTime()) || expiresAt.getTime() <= Date.now()) return null
+    return {
+      id: parsed.id,
+      accessToken: parsed.accessToken,
+      refreshToken: parsed.refreshToken,
+      expiresAt,
+    }
+  } catch {
+    return null
+  }
+}
+
+/** Writes the session cookie for the current request scope. */
+export function writeSessionCookie(
+  cookies: RequestCookies,
+  cookieName: string,
+  session: SupabaseSession,
+): void {
+  cookies.set(
+    cookieName,
+    JSON.stringify({
+      id: session.id,
+      accessToken: session.accessToken,
+      refreshToken: session.refreshToken,
+      expiresAt: session.expiresAt.toISOString(),
+    }),
+  )
+}
+
+/** Clears the session cookie for the current request scope. */
+export function clearSessionCookie(cookies: RequestCookies, cookieName: string): void {
+  cookies.delete(cookieName)
+}

package/src/identity/driver.ts

@@ -0,0 +1,251 @@
+import {
+  Invalid,
+  Unauthenticated,
+  type IdentityDriver,
+  type MagicLinkIdentitySurface,
+  type PasswordIdentitySurface,
+  type RequestCookies,
+} from '@avelonjs/core'
+import {
+  clearSessionCookie,
+  DEFAULT_SESSION_COOKIE,
+  readSessionCookie,
+  writeSessionCookie,
+} from './cookies'
+import type { SupabaseActor, SupabaseSession } from './types'
+
+/** Exact capability declaration for the Supabase identity driver. */
+export const supabaseIdentityCapabilities = {
+  passwords: true,
+  magicLinks: true,
+  oauth: false,
+  organizations: false,
+  mfa: [] as const,
+} as const
+
+/** Construction options for {@link createSupabaseIdentity}. */
+export interface SupabaseIdentityOptions {
+  /** GoTrue Auth base URL, e.g. `http://127.0.0.1:54321/auth/v1`. */
+  authUrl?: string
+  /** Publishable or service API key sent as `apikey`. */
+  apiKey?: string
+  /** Configured identity instance name. */
+  instance?: string
+  /** Session cookie name written into the request cookie jar. */
+  cookieName?: string
+}
+
+interface TokenResponse {
+  user?: { id?: string; email?: string | null }
+  access_token?: string
+  refresh_token?: string
+  expires_in?: number
+  error?: string
+  error_description?: string
+  msg?: string
+}
+
+/**
+ * Supabase Auth identity driver.
+ *
+ * The config-time factory receives request-scoped cookies explicitly. Session state lives in that
+ * cookie jar so SSR and route handlers share one request-local identity view.
+ */
+export class SupabaseIdentity
+  implements
+    IdentityDriver<
+      typeof supabaseIdentityCapabilities,
+      { authUrl: string },
+      SupabaseActor,
+      SupabaseSession
+    >,
+    PasswordIdentitySurface<SupabaseActor>,
+    MagicLinkIdentitySurface
+{
+  readonly name = 'supabase'
+  readonly instance: string
+  readonly capabilities = supabaseIdentityCapabilities
+
+  readonly #cookies: RequestCookies
+  readonly #authUrl: string
+  readonly #apiKey: string
+  readonly #cookieName: string
+
+  constructor(cookies: RequestCookies, options: Required<SupabaseIdentityOptions>) {
+    this.#cookies = cookies
+    this.#authUrl = options.authUrl.replace(/\/$/, '')
+    this.#apiKey = options.apiKey
+    this.#cookieName = options.cookieName
+    this.instance = options.instance
+  }
+
+  raw(): { authUrl: string } {
+    return { authUrl: this.#authUrl }
+  }
+
+  async user(): Promise<SupabaseActor | null> {
+    const session = readSessionCookie(this.#cookies, this.#cookieName)
+    if (!session) return null
+    const response = await this.#request('/user', {
+      method: 'GET',
+      headers: this.#authHeaders(session.accessToken),
+    })
+    if (!response.ok) return null
+    const body = (await response.json()) as { id?: string; email?: string | null }
+    if (typeof body.id !== 'string' || typeof body.email !== 'string') return null
+    return { id: body.id, email: body.email }
+  }
+
+  async session(): Promise<SupabaseSession | null> {
+    return readSessionCookie(this.#cookies, this.#cookieName)
+  }
+
+  async signOut(): Promise<void> {
+    const session = readSessionCookie(this.#cookies, this.#cookieName)
+    if (!session) {
+      throw new Unauthenticated('No authenticated session is present.', {
+        metadata: { guard: 'identity' },
+      })
+    }
+    await this.#request('/logout', {
+      method: 'POST',
+      headers: this.#authHeaders(session.accessToken),
+    })
+    clearSessionCookie(this.#cookies, this.#cookieName)
+  }
+
+  async register(email: string, password: string): Promise<SupabaseActor> {
+    const response = await this.#request('/signup', {
+      method: 'POST',
+      headers: this.#jsonHeaders(),
+      body: JSON.stringify({ email, password }),
+    })
+    const body = (await response.json()) as TokenResponse
+    if (!response.ok) {
+      throw new Invalid(body.error_description ?? body.msg ?? body.error ?? 'Registration failed.', {
+        metadata: { fields: { email: ['Registration failed'] } },
+      })
+    }
+    return this.#commitSession(body)
+  }
+
+  async signInWithPassword(email: string, password: string): Promise<SupabaseActor> {
+    const response = await this.#request('/token?grant_type=password', {
+      method: 'POST',
+      headers: this.#jsonHeaders(),
+      body: JSON.stringify({ email, password }),
+    })
+    const body = (await response.json()) as TokenResponse
+    if (!response.ok) {
+      throw new Unauthenticated(body.error_description ?? body.error ?? 'Invalid login credentials.', {
+        metadata: { guard: 'identity' },
+      })
+    }
+    return this.#commitSession(body)
+  }
+
+  async sendPasswordReset(email: string): Promise<void> {
+    await this.#request('/recover', {
+      method: 'POST',
+      headers: this.#jsonHeaders(),
+      body: JSON.stringify({ email }),
+    })
+  }
+
+  async resetPassword(token: string, password: string): Promise<void> {
+    const response = await this.#request('/verify', {
+      method: 'POST',
+      headers: this.#jsonHeaders(),
+      body: JSON.stringify({ type: 'recovery', token, password }),
+    })
+    if (!response.ok) {
+      const body = (await response.json()) as TokenResponse
+      throw new Invalid(body.error_description ?? body.error ?? 'Password reset failed.', {
+        metadata: { fields: { token: ['Invalid recovery token'] } },
+      })
+    }
+  }
+
+  async updatePassword(password: string): Promise<void> {
+    const session = readSessionCookie(this.#cookies, this.#cookieName)
+    if (!session) {
+      throw new Unauthenticated('No authenticated session is present.', {
+        metadata: { guard: 'identity' },
+      })
+    }
+    const response = await this.#request('/user', {
+      method: 'PUT',
+      headers: { ...this.#jsonHeaders(), ...this.#authHeaders(session.accessToken) },
+      body: JSON.stringify({ password }),
+    })
+    if (!response.ok) {
+      throw new Unauthenticated('No authenticated session is present.', {
+        metadata: { guard: 'identity' },
+      })
+    }
+  }
+
+  async sendMagicLink(email: string, redirectTo?: string): Promise<void> {
+    await this.#request('/otp', {
+      method: 'POST',
+      headers: this.#jsonHeaders(),
+      body: JSON.stringify({ email, create_user: true, gotrue_meta_security: {}, ...(redirectTo ? { email_redirect_to: redirectTo } : {}) }),
+    })
+  }
+
+  #commitSession(body: TokenResponse): SupabaseActor {
+    if (
+      typeof body.user?.id !== 'string' ||
+      typeof body.user.email !== 'string' ||
+      typeof body.access_token !== 'string' ||
+      typeof body.refresh_token !== 'string'
+    ) {
+      throw new Invalid('Auth response was missing a session.', {
+        metadata: { fields: { session: ['Incomplete auth response'] } },
+      })
+    }
+    const expiresIn = typeof body.expires_in === 'number' ? body.expires_in : 3600
+    const session: SupabaseSession = {
+      id: body.access_token,
+      accessToken: body.access_token,
+      refreshToken: body.refresh_token,
+      expiresAt: new Date(Date.now() + expiresIn * 1000),
+    }
+    writeSessionCookie(this.#cookies, this.#cookieName, session)
+    return { id: body.user.id, email: body.user.email }
+  }
+
+  #jsonHeaders(): Record<string, string> {
+    return {
+      apikey: this.#apiKey,
+      'Content-Type': 'application/json',
+    }
+  }
+
+  #authHeaders(accessToken: string): Record<string, string> {
+    return {
+      apikey: this.#apiKey,
+      Authorization: `Bearer ${accessToken}`,
+    }
+  }
+
+  async #request(path: string, init: RequestInit): Promise<Response> {
+    return fetch(`${this.#authUrl}${path}`, init)
+  }
+}
+
+/**
+ * Creates the config-time identity factory pinned by conformance:
+ * `(cookies: RequestCookies) => SupabaseIdentity`.
+ */
+export function createSupabaseIdentity(
+  options: SupabaseIdentityOptions = {},
+): (cookies: RequestCookies) => SupabaseIdentity {
+  const resolved: Required<SupabaseIdentityOptions> = {
+    authUrl: options.authUrl ?? process.env.SUPABASE_AUTH_URL ?? 'http://127.0.0.1:54321/auth/v1',
+    apiKey: options.apiKey ?? process.env.SUPABASE_ANON_KEY ?? 'local-anon-key',
+    instance: options.instance ?? 'default',
+    cookieName: options.cookieName ?? DEFAULT_SESSION_COOKIE,
+  }
+  return (cookies) => new SupabaseIdentity(cookies, resolved)
+}

package/src/identity/index.ts

@@ -0,0 +1,14 @@
+export {
+  clearSessionCookie,
+  DEFAULT_SESSION_COOKIE,
+  readSessionCookie,
+  writeSessionCookie,
+} from './cookies'
+export {
+  createSupabaseIdentity,
+  SupabaseIdentity,
+  supabaseIdentityCapabilities,
+  type SupabaseIdentityOptions,
+} from './driver'
+export { LocalAuthServer } from './local-auth'
+export type { SupabaseActor, SupabaseSession } from './types'