@ingram-tech/nk-auth 0.7.5 → 0.8.0

package/README.md

@@ -6,23 +6,22 @@ composable presets each Ingram Next.js site spreads into its *own*
 plain Better Auth (prime directive), keeping full plugin type inference. Import
 only what you need from focused subpaths.
 
-`better-auth`, `pg`, `@better-auth/passkey`, `@supabase/supabase-js` are
-**peer dependencies** so there's exactly one Better Auth copy in the app.
+`better-auth`, `pg`, `@better-auth/passkey` are **peer dependencies** so there's
+exactly one Better Auth copy in the app.
 
 | Export (subpath) | For |
 | --- | --- |
-| `rlsJwtOptions` (`./jwt`) | Supabase RLS bridge token (`role:"authenticated"`) |
 | `backendJwtOptions` / `verifyBackendJwt` (`./jwt`) | a JWT for the site's own backend API (custom `audience`) |
 | `nkOrganizationDefaults`, `lastActiveOrganizationHooks`, `lastActiveOrganizationUserField` (`./organization`) | org-plugin defaults + active-org restore/persist |
 | `createAuthPool` (`./pool`) | `pg` Pool with optional SSL CA verification |
-| `bcryptPassword`, `makeEmailSenders`, `makePasskeyOptions`, `uuidGenerateId` (`./`) | password migration, email hooks, passkeys, UUID ids |
-| `createServerSupabase` (`./`) | RLS-aware supabase-js client (attaches the session JWT) |
+| `bcryptPassword`, `makeEmailSenders`, `makePasskeyOptions`, `uuidGenerateId` (`./`) | password verification, email hooks, passkeys, UUID ids |
 | `createAuthHelpers`, `safeNext` (`./server`) | validated App Router session helpers (`getSession` / `getUser` / `requireSession` / `requireUser` / `redirectIfAuthenticated`) with automatic `next` + stale-cookie signalling; `safeNext` validates a `?next=` param |
 | `createAuthMiddleware` (`./middleware`) | loop-safe edge middleware: gates unauthenticated users off protected paths, preserves `next`, and clears a stale session cookie so a bad session self-heals |
 
-> **Supabase Auth → Better Auth + RLS migration?** Read
-> [`docs/better-auth-migration.md`](../../docs/better-auth-migration.md) — the
-> RLS bridge, the migration runbook, and the gotchas.
+> **Data access + RLS** is owned by [`@ingram-tech/nk-db`](../nk-db): query over a
+> direct `pg` connection and enforce per-request Row Level Security with
+> `withRls` / `withRlsTransaction` (claims taken from the Better Auth session — no
+> JWT minting, no PostgREST). nk-auth no longer ships a Supabase data client.
 >
 > **Backend-JWT + org sites** (a backend API plus the org plugin): compose `createAuthPool`,
 > `backendJwtOptions({ audience })`, `nkOrganizationDefaults`, and
@@ -37,7 +36,7 @@ only what you need from focused subpaths.
 ## Install
 
 ```bash
-bun add @ingram-tech/nk-auth @supabase/supabase-js better-auth @better-auth/passkey pg bcrypt
+bun add @ingram-tech/nk-auth better-auth @better-auth/passkey pg bcrypt
 ```
 
 Set the env contract (validated by `keys.ts`):
@@ -45,46 +44,42 @@ Set the env contract (validated by `keys.ts`):
 ```dotenv
 BETTER_AUTH_SECRET=…            # openssl rand -hex 32
 BETTER_AUTH_URL=https://example.com
-DATABASE_URL=…                  # DIRECT Postgres (session pooler / :5432), NOT PostgREST
-NEXT_PUBLIC_SUPABASE_URL=…
-NEXT_PUBLIC_SUPABASE_ANON_KEY=…
+DATABASE_URL=…                  # direct Postgres connection (:5432)
 ```
 
 ## 1. Apply the schema
 
 ```bash
 cp node_modules/@ingram-tech/nk-auth/migrations/0001_better_auth.sql \
-   supabase/migrations/$(date +%Y%m%d%H%M%S)_better_auth.sql
+   migrations/$(date +%Y%m%d%H%M%S)_better_auth.sql
 ```
 
 It creates Better Auth's tables (`user`, `session`, `account`, `verification`,
 `jwks`, `passkey`), defaults new user ids to UUIDs, and puts **deny-all RLS** on
-all of them (they're exposed via PostgREST; Better Auth uses its own privileged
-connection). Reconcile against your pinned `better-auth` with
-`npx @better-auth/cli generate` after upgrades.
+all of them (Better Auth reaches them through its own privileged connection).
+Reconcile against your pinned `better-auth` with `npx @better-auth/cli generate`
+after upgrades.
 
 ## 2. Configure the server
 
 This package is **not** a `betterAuth()` wrapper — your site calls `betterAuth`
 itself and spreads in our presets. That keeps full Better Auth type inference at
 the call site (so `auth.api.*` stays typed) and keeps the site plain Better Auth,
-per the prime directive. The presets carry the RLS-preserving bits.
+per the prime directive.
 
 ```ts
 // lib/auth.ts
 import { passkey } from "@better-auth/passkey";
-import { fromAddress, sendEmail } from "@ingram-tech/email";
+import { fromAddress, sendEmail } from "@ingram-tech/nk-email";
 import {
 	authBasePath,
 	authEnv,
 	bcryptPassword,
 	makeEmailSenders,
 	makePasskeyOptions,
-	rlsJwtOptions,
 	uuidGenerateId,
 } from "@ingram-tech/nk-auth";
 import { betterAuth } from "better-auth";
-import { jwt } from "better-auth/plugins/jwt";
 import { Pool } from "pg";
 
 const env = authEnv();
@@ -98,14 +93,14 @@ export const auth = betterAuth({
 	baseURL: env.baseURL,
 	basePath: authBasePath, // mount at /auth, not the framework default /api/auth
 	advanced: { database: { generateId: uuidGenerateId } }, // UUIDv7 ids
-	// ^ stored as hyphenated UUIDv7 (uuid columns / Supabase RLS stay valid).
+	// ^ stored as hyphenated UUIDv7 (uuid columns / RLS policies stay valid).
 	// To show those same ids as prefixed base58 on the wire/UI — `team_…`,
 	// matching the Ingram Cloud API's `agt_`/`smt_` ids — skin them with
 	// `toPrefixedId(uuid, "team")` / recover with `fromPrefixedId`. `base58Id`
 	// mints a fresh one directly for text-id sites. All from `@ingram-tech/nk-auth`.
 	emailAndPassword: {
 		enabled: true,
-		password: bcryptPassword, // verifies migrated Supabase bcrypt hashes
+		password: bcryptPassword, // bcrypt verifier (Better Auth defaults to scrypt)
 		sendResetPassword: email.sendResetPassword,
 	},
 	emailVerification: { sendVerificationEmail: email.sendVerificationEmail },
@@ -116,7 +111,6 @@ export const auth = betterAuth({
 		},
 	},
 	plugins: [
-		jwt(rlsJwtOptions), // the RLS bridge
 		passkey(makePasskeyOptions({ rpId: "example.com", rpName: "Example", origin: env.baseURL })),
 	],
 });
@@ -132,29 +126,11 @@ export const { GET, POST } = auth.handler;
 
 ## 3. Query data with RLS intact
 
-Always go through `createServerSupabase` instead of constructing supabase-js
-yourself — it attaches the Better Auth JWT so `auth.uid()` keeps working. Wire
-`getToken` to your instance's jwt endpoint (fully typed because *your* site owns
-the `betterAuth` call):
-
-```ts
-import { authEnv, createServerSupabase } from "@ingram-tech/nk-auth";
-import { auth } from "@/lib/auth";
-
-export async function GET(request: Request) {
-	const env = authEnv();
-	const supabase = createServerSupabase({
-		getToken: async () =>
-			(await auth.api.getToken({ headers: request.headers }))?.token ?? null,
-		supabaseUrl: env.supabaseUrl,
-		supabaseAnonKey: env.supabaseAnonKey,
-	});
-	// Reads/writes run as the signed-in user; existing RLS policies apply.
-	const { data, error } = await supabase.from("notes").select("*");
-	if (error) throw new Error(error.message);
-	return Response.json(data);
-}
-```
+Data access lives in [`@ingram-tech/nk-db`](../nk-db), not here. Query over the
+direct `pg` connection and wrap reads/writes in `withRls` / `withRlsTransaction`,
+which set `request.jwt.claims` + `SET LOCAL ROLE` per transaction from the Better
+Auth session — so `auth.uid()` policies fire unchanged, with no JWT minting and
+no PostgREST. See its README for the pattern.
 
 ## 4. Client
 
@@ -263,12 +239,3 @@ the cookie-present case the guard reads it from the `x-nk-auth-path` header
 middleware injects — so the self-heal (next + clearing) needs the middleware.
 Sites that skip middleware still get validated gating from the server helpers,
 just without automatic `next`/clearing.
-
-## RLS bridge (the important part)
-
-`auth.uid()` reads the `sub` claim of the JWT PostgREST receives. The `jwt`
-plugin (configured here) mints an asymmetric token with `sub` = the user's UUID
-and `role: "authenticated"`, exposed at `/auth/jwks`. Register that JWKS URL
-as a Supabase **third-party auth** issuer, and every existing policy works
-unchanged. Full rationale and the HS256 fallback:
-[`docs/better-auth-migration.md`](../../docs/better-auth-migration.md).

package/dist/index.d.ts

@@ -1,9 +1,8 @@
-export { type BackendJwtConfig, backendJwtOptions, rlsJwtOptions, verifyBackendJwt, } from "./jwt.js";
+export { type BackendJwtConfig, backendJwtOptions, verifyBackendJwt } from "./jwt.js";
 export { base58Id, fromPrefixedId, toPrefixedId, uuidGenerateId } from "./id.js";
 export { type AuthEnv, authEnv, isConfigured } from "./keys.js";
 export { bcryptPassword, makeEmailSenders, makePasskeyOptions, type PasskeyConfig, type SendEmail, } from "./options.js";
 export { lastActiveOrganizationHooks, lastActiveOrganizationUserField, nkOrganizationDefaults, } from "./organization.js";
 export { authBasePath } from "./paths.js";
 export { createAuthPool } from "./pool.js";
-export { createServerSupabase, type ServerSupabaseConfig } from "./supabase.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACN,KAAK,gBAAgB,EACrB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -1,13 +1,12 @@
 // Server entry — the Ingram Better Auth foundation. Browser re-exports live at
 // "@ingram-tech/nk-auth/client" so importing the server presets never pulls in
 // React. Focused subpaths (./jwt, ./organization, ./pool) let a site import
-// only what it needs (e.g. avoid bcrypt/supabase when it uses neither).
-export { backendJwtOptions, rlsJwtOptions, verifyBackendJwt, } from "./jwt.js";
+// only what it needs (e.g. avoid bcrypt when it doesn't use passwords).
+export { backendJwtOptions, verifyBackendJwt } from "./jwt.js";
 export { base58Id, fromPrefixedId, toPrefixedId, uuidGenerateId } from "./id.js";
 export { authEnv, isConfigured } from "./keys.js";
 export { bcryptPassword, makeEmailSenders, makePasskeyOptions, } from "./options.js";
 export { lastActiveOrganizationHooks, lastActiveOrganizationUserField, nkOrganizationDefaults, } from "./organization.js";
 export { authBasePath } from "./paths.js";
 export { createAuthPool } from "./pool.js";
-export { createServerSupabase } from "./supabase.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AAExE,OAAO,EAEN,iBAAiB,EACjB,aAAa,EACb,gBAAgB,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAgB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GAGlB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAA6B,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AAExE,OAAO,EAAyB,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAgB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GAGlB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,2BAA2B,EAC3B,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/jwt.d.ts

@@ -1,19 +1,11 @@
 import type { JwtOptions } from "better-auth/plugins/jwt";
 import { type JWTPayload } from "jose";
 /**
- * `jwt` plugin presets. Two shapes, because Ingram sites mint JWTs for two
- * different audiences:
- *
- *   - `rlsJwtOptions` — a Supabase RLS bridge token (`role: "authenticated"`),
- *     so PostgREST's `auth.uid()` keeps working. See docs/better-auth-migration.md.
- *   - `backendJwtOptions` — a short-lived token for a site's OWN backend API
- *     (a specific `audience`), typically carrying extra claims the site adds via
- *     `auth.api.signJWT`.
- *
- * Both default to EdDSA (Better Auth's default), exposed at `/api/auth/jwks`.
+ * `jwt` plugin preset for a site's OWN backend API: a short-lived token with a
+ * specific `audience`, typically carrying extra claims the site adds via
+ * `auth.api.signJWT`. Defaults to EdDSA (Better Auth's default), with the JWKS
+ * exposed at `/api/auth/jwks` so the backend can verify it (`verifyBackendJwt`).
  */
-/** Supabase RLS bridge: mints `sub` = user id, `role`/`aud` = "authenticated". */
-export declare const rlsJwtOptions: JwtOptions;
 export interface BackendJwtConfig {
     /** Expected audience of the site's backend, e.g. "ingram-wiki-backend". */
     audience: string;

package/dist/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAsB,KAAK,UAAU,EAAa,MAAM,MAAM,CAAC;AAEtE;;;;;;;;;;;GAWG;AAEH,kFAAkF;AAClF,eAAO,MAAM,aAAa,EAAE,UAS3B,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAChC,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,GAAI,QAAQ,gBAAgB,KAAG,UAM3D,CAAC;AAIH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAU,QAAQ;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf,KAAG,OAAO,CAAC,UAAU,CAerB,CAAC"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAsB,KAAK,UAAU,EAAa,MAAM,MAAM,CAAC;AAEtE;;;;;GAKG;AAEH,MAAM,WAAW,gBAAgB;IAChC,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,GAAI,QAAQ,gBAAgB,KAAG,UAM3D,CAAC;AAIH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAU,QAAQ;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf,KAAG,OAAO,CAAC,UAAU,CAerB,CAAC"}

package/dist/jwt.js

@@ -1,27 +1,4 @@
 import { createRemoteJWKSet, jwtVerify } from "jose";
-/**
- * `jwt` plugin presets. Two shapes, because Ingram sites mint JWTs for two
- * different audiences:
- *
- *   - `rlsJwtOptions` — a Supabase RLS bridge token (`role: "authenticated"`),
- *     so PostgREST's `auth.uid()` keeps working. See docs/better-auth-migration.md.
- *   - `backendJwtOptions` — a short-lived token for a site's OWN backend API
- *     (a specific `audience`), typically carrying extra claims the site adds via
- *     `auth.api.signJWT`.
- *
- * Both default to EdDSA (Better Auth's default), exposed at `/api/auth/jwks`.
- */
-/** Supabase RLS bridge: mints `sub` = user id, `role`/`aud` = "authenticated". */
-export const rlsJwtOptions = {
-    jwks: { keyPairConfig: { alg: "EdDSA" } },
-    jwt: {
-        definePayload: ({ user }) => ({
-            sub: user.id,
-            role: "authenticated",
-            aud: "authenticated",
-        }),
-    },
-};
 /** `jwt` plugin options for a backend-API token (custom audience). */
 export const backendJwtOptions = (config) => ({
     disableSettingJwtHeader: config.disableSettingJwtHeader,

package/dist/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAmB,SAAS,EAAE,MAAM,MAAM,CAAC;AAEtE;;;;;;;;;;;GAWG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAe;IACxC,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IACzC,GAAG,EAAE;QACJ,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7B,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,eAAe;YACrB,GAAG,EAAE,eAAe;SACpB,CAAC;KACF;CACD,CAAC;AAcF,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAwB,EAAc,EAAE,CAAC,CAAC;IAC3E,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;IACvD,GAAG,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;KACrC;CACD,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAMtC,EAAuB,EAAE;IACzB,MAAM,GAAG,GACR,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;QACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,CAAC,OAAO,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC"}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAmB,SAAS,EAAE,MAAM,MAAM,CAAC;AAqBtE,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAwB,EAAc,EAAE,CAAC,CAAC;IAC3E,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;IACvD,GAAG,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;KACrC;CACD,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAMtC,EAAuB,EAAE;IACzB,MAAM,GAAG,GACR,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;QACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,CAAC,OAAO,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC"}

package/dist/keys.d.ts

@@ -4,22 +4,17 @@
  * Following the "each package owns its own env validation" pattern. Env vars are
  * external input, so we parse them with Zod (per docs/code-style.md) rather than
  * reading `process.env` ad hoc. `authEnv()` returns a validated, config-shaped
- * object you can spread straight into `createAuth` / `createServerSupabase`.
+ * object you can spread straight into your `betterAuth()` call.
  *
  * Required:
- *   BETTER_AUTH_SECRET             — session/CSRF signing key (`openssl rand -hex 32`)
- *   BETTER_AUTH_URL                — canonical site origin, e.g. "https://example.com"
- *   DATABASE_URL                   — DIRECT Postgres connection for Better Auth
- *                                    (session-mode pooler or :5432, NOT PostgREST)
- *   NEXT_PUBLIC_SUPABASE_URL       — Supabase project URL (for the data client)
- *   NEXT_PUBLIC_SUPABASE_ANON_KEY  — Supabase anon key (RLS still enforced)
+ *   BETTER_AUTH_SECRET  — session/CSRF signing key (`openssl rand -hex 32`)
+ *   BETTER_AUTH_URL     — canonical site origin, e.g. "https://example.com"
+ *   DATABASE_URL        — direct Postgres connection for Better Auth (:5432)
  */
 export interface AuthEnv {
     secret: string;
     baseURL: string;
     databaseUrl: string;
-    supabaseUrl: string;
-    supabaseAnonKey: string;
 }
 /**
  * Read and validate all nk-auth env vars at once. Throws a single error listing

package/dist/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAYH,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,QAAO,OAgB1B,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,YAAY,QAAO,OAAgD,CAAC"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,QAAO,OAc1B,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,YAAY,QAAO,OAAgD,CAAC"}

package/dist/keys.js

@@ -4,23 +4,18 @@
  * Following the "each package owns its own env validation" pattern. Env vars are
  * external input, so we parse them with Zod (per docs/code-style.md) rather than
  * reading `process.env` ad hoc. `authEnv()` returns a validated, config-shaped
- * object you can spread straight into `createAuth` / `createServerSupabase`.
+ * object you can spread straight into your `betterAuth()` call.
  *
  * Required:
- *   BETTER_AUTH_SECRET             — session/CSRF signing key (`openssl rand -hex 32`)
- *   BETTER_AUTH_URL                — canonical site origin, e.g. "https://example.com"
- *   DATABASE_URL                   — DIRECT Postgres connection for Better Auth
- *                                    (session-mode pooler or :5432, NOT PostgREST)
- *   NEXT_PUBLIC_SUPABASE_URL       — Supabase project URL (for the data client)
- *   NEXT_PUBLIC_SUPABASE_ANON_KEY  — Supabase anon key (RLS still enforced)
+ *   BETTER_AUTH_SECRET  — session/CSRF signing key (`openssl rand -hex 32`)
+ *   BETTER_AUTH_URL     — canonical site origin, e.g. "https://example.com"
+ *   DATABASE_URL        — direct Postgres connection for Better Auth (:5432)
  */
 import { z } from "zod";
 const schema = z.object({
     BETTER_AUTH_SECRET: z.string().min(1),
     BETTER_AUTH_URL: z.string().url(),
     DATABASE_URL: z.string().min(1),
-    NEXT_PUBLIC_SUPABASE_URL: z.string().url(),
-    NEXT_PUBLIC_SUPABASE_ANON_KEY: z.string().min(1),
 });
 /**
  * Read and validate all nk-auth env vars at once. Throws a single error listing
@@ -40,8 +35,6 @@ export const authEnv = () => {
         secret: env.BETTER_AUTH_SECRET,
         baseURL: env.BETTER_AUTH_URL,
         databaseUrl: env.DATABASE_URL,
-        supabaseUrl: env.NEXT_PUBLIC_SUPABASE_URL,
-        supabaseAnonKey: env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
     };
 };
 /** Whether nk-auth is fully configured (lets callers degrade in local/dev). */

package/dist/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1C,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC;AAUH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,GAAY,EAAE;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,kBAAkB;QAC9B,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,WAAW,EAAE,GAAG,CAAC,wBAAwB;QACzC,eAAe,EAAE,GAAG,CAAC,6BAA6B;KAClD,CAAC;AACH,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,GAAY,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAQH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,GAAY,EAAE;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,kBAAkB;QAC9B,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,WAAW,EAAE,GAAG,CAAC,YAAY;KAC7B,CAAC;AACH,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,GAAY,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC"}

package/dist/options.d.ts

@@ -30,7 +30,7 @@ export interface PasskeyConfig {
 }
 /** Build `passkey` plugin options. Use as `passkey(makePasskeyOptions(cfg))`. */
 export declare const makePasskeyOptions: (cfg: PasskeyConfig) => PasskeyOptions;
-/** Send one transactional email (wire to `@ingram-tech/email`'s `sendEmail`). */
+/** Send one transactional email (wire to `@ingram-tech/nk-email`'s `sendEmail`). */
 export type SendEmail = (message: {
     to: string;
     subject: string;

package/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;GAQG;AAEH;;;GAGG;AACH,eAAO,MAAM,cAAc;qBACT,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC;kCAItC;QACF,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KACjB,KAAG,OAAO,CAAC,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,GAAI,KAAK,aAAa,KAAG,cAItD,CAAC;AAEH,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACZ,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,SAAS;wCAI5C;QACF,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;KACZ,KAAG,OAAO,CAAC,IAAI,CAAC;4CAMd;QACF,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;KACZ,KAAG,OAAO,CAAC,IAAI,CAAC;CAGhB,CAAC"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;GAQG;AAEH;;;GAGG;AACH,eAAO,MAAM,cAAc;qBACT,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC;kCAItC;QACF,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KACjB,KAAG,OAAO,CAAC,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC1B;AAED,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,GAAI,KAAK,aAAa,KAAG,cAItD,CAAC;AAEH,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACZ,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,SAAS;wCAI5C;QACF,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;KACZ,KAAG,OAAO,CAAC,IAAI,CAAC;4CAMd;QACF,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACxB,GAAG,EAAE,MAAM,CAAC;KACZ,KAAG,OAAO,CAAC,IAAI,CAAC;CAGhB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-tech/nk-auth",
-	"version": "0.7.5",
+	"version": "0.8.0",
 	"description": "The Ingram Better Auth foundation: composable presets (org, dual-shape JWT, Supabase RLS bridge, active-org hooks, pg pool) for Next.js sites.",
 	"license": "MIT",
 	"type": "module",
@@ -61,7 +61,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@ingram-tech/nk-db": "^0.8.0",
+		"@ingram-tech/nk-db": "^0.9.0",
 		"bcrypt": "^6.0.0",
 		"jose": "^6.0.0",
 		"zod": "^4.0.0"
@@ -93,7 +93,7 @@
 	},
 	"devDependencies": {
 		"@better-auth/passkey": "^1.6.0",
-		"@ingram-tech/nk-dev": "workspace:*",
+		"@ingram-tech/nk-dev": "0.2.3",
 		"@supabase/supabase-js": "^2.45.0",
 		"@types/bcrypt": "^6.0.0",
 		"@types/node": "^25.0.0",

package/dist/supabase.d.ts

@@ -1,26 +0,0 @@
-import { type SupabaseClient } from "@supabase/supabase-js";
-/**
- * The RLS-aware Supabase data client — the single chokepoint that keeps Row
- * Level Security working after the move off Supabase Auth.
- *
- * Instead of `supabase.auth`, it pulls the Better Auth session JWT (via the
- * injected `getToken`) and hands it to supabase-js's v2 `accessToken` callback.
- * PostgREST then sets `request.jwt.claims`, so `auth.uid()` (and every existing
- * policy) keeps returning the right user. With no session, `getToken` yields
- * `null` and the request runs as `anon` — RLS is still enforced, never bypassed.
- *
- * Sites should import THIS rather than constructing supabase-js directly, so the
- * token bridge can't be forgotten. (Enforce with a Biome/GritQL rule banning raw
- * `createClient` for data — see docs/better-auth-migration.md.)
- *
- * Wire `getToken` to the site's own Better Auth instance, e.g.:
- *   getToken: async () => (await auth.api.getToken({ headers }))?.token ?? null
- */
-export interface ServerSupabaseConfig {
-    /** Returns the current request's Better Auth JWT, or null when signed out. */
-    getToken: () => Promise<string | null>;
-    supabaseUrl: string;
-    supabaseAnonKey: string;
-}
-export declare const createServerSupabase: (config: ServerSupabaseConfig) => SupabaseClient;
-//# sourceMappingURL=supabase.d.ts.map

package/dist/supabase.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,oBAAoB;IACpC,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,oBAAoB,GAAI,QAAQ,oBAAoB,KAAG,cAMjE,CAAC"}

package/dist/supabase.js

@@ -1,8 +0,0 @@
-import { createClient } from "@supabase/supabase-js";
-export const createServerSupabase = (config) => createClient(config.supabaseUrl, config.supabaseAnonKey, {
-    accessToken: async () => {
-        const token = await config.getToken();
-        return token ?? "";
-    },
-});
-//# sourceMappingURL=supabase.js.map

package/dist/supabase.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../src/supabase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AA2B1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAA4B,EAAkB,EAAE,CACpF,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,eAAe,EAAE;IACxD,WAAW,EAAE,KAAK,IAAI,EAAE;QACvB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,KAAK,IAAI,EAAE,CAAC;IACpB,CAAC;CACD,CAAC,CAAC"}