@starci/hfs 4.9.9 → 4.10.0

package/scaffold/supabase-ports.mjs

@@ -1,26 +0,0 @@
-// supabase-ports.mjs - the local Supabase ports of one lite app, derived from its project name.
-// The Supabase CLI default ports (54321-54329) belong to whichever stack starts first, so a scaffolded app never uses them: it
-// writes its own port block into supabase/config.toml, one block of ten consecutive ports per project name, so two apps (and a
-// proof run beside another stack) never contend. The same name always gets the same block.
-
-/** The first port of the block range and how many blocks it holds (41000-44999); clear of the CLI defaults (543xx) and of the Next dev port. */
-const RANGE_START = 41000;
-const BLOCK_SIZE = 10;
-const BLOCK_COUNT = 400;
-/** The offsets inside one block, by config.toml section. */
-const OFFSETS = Object.freeze({ shadow: 0, api: 1, db: 2, studio: 3, inbucket: 4, analytics: 7, pooler: 9 });
-
-/** The template variables of the port block: `supabasePort<Name>` for every section above. */
-export const SUPABASE_PORT_VARIABLES = Object.freeze(Object.keys(OFFSETS).map((key) => `supabasePort${key[0].toUpperCase()}${key.slice(1)}`));
-
-/** FNV-1a over the project name: stable, dependency-free. */
-const hash = (text) => [...text].reduce((value, char) => Math.imul(value ^ char.charCodeAt(0), 16777619) >>> 0, 2166136261);
-
-/** The first port of the project's block. */
-const supabasePortBase = (project) => RANGE_START + (hash(String(project)) % BLOCK_COUNT) * BLOCK_SIZE;
-
-/** { supabasePortApi: '41231', ... }: the variables a skeleton file fills. */
-export function supabasePortVars(project) {
-  const base = supabasePortBase(project);
-  return Object.fromEntries(Object.entries(OFFSETS).map(([key, offset]) => [`supabasePort${key[0].toUpperCase()}${key.slice(1)}`, String(base + offset)]));
-}

package/templates/app/package-scripts/supabase.json

@@ -1,7 +0,0 @@
-    "db:start": "supabase start",
-    "db:stop": "supabase stop",
-    "db:reset": "supabase db reset",
-    "db:new": "supabase migration new",
-    "db:push": "supabase db push",
-    "db:types": "npm run contract:emit",
-    "db:lint": "{{appBinary}} check --fast",

package/templates/app/skeleton-lite/supabase/config.toml

@@ -1,48 +0,0 @@
-project_id = "{{project}}"
-
-[api]
-enabled = true
-port = {{supabasePortApi}}
-schemas = []
-extra_search_path = ["public", "extensions"]
-max_rows = 1000
-
-[db]
-port = {{supabasePortDb}}
-shadow_port = {{supabasePortShadow}}
-major_version = 17
-
-[db.pooler]
-enabled = false
-port = {{supabasePortPooler}}
-
-[studio]
-port = {{supabasePortStudio}}
-
-[inbucket]
-port = {{supabasePortInbucket}}
-
-[analytics]
-port = {{supabasePortAnalytics}}
-
-[edge_runtime]
-enabled = false
-
-[storage]
-enabled = true
-file_size_limit = "50MiB"
-
-[auth]
-enabled = true
-site_url = "http://127.0.0.1:3000"
-additional_redirect_urls = ["http://127.0.0.1:3000/"]
-enable_signup = false
-jwt_expiry = 3600
-
-[auth.email]
-enable_signup = false
-
-[auth.external.google]
-enabled = false
-client_id = "env(SUPABASE_AUTH_GOOGLE_CLIENT_ID)"
-secret = "env(SUPABASE_AUTH_GOOGLE_SECRET)"

package/templates/be/inbox/platform/event-bus/persistence/event-bus.sql.ts.tpl

@@ -1,5 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/** Writes only the typed envelope; a reactor or job reads the committed row afterward. */
-export const INSERT_OUTBOX_EVENT = sql`INSERT INTO public.event_bus (event_id, event_name, payload, correlation_id)
-VALUES ($1, $2, $3::jsonb, $4)`

package/templates/be/inbox/platform/inbox/persistence/inbox.rows.ts.tpl

@@ -1,33 +0,0 @@
-/** The JSON envelope makes a completed null value distinct from a pending SQL-null outcome. */
-export interface ClientOutcomeRow<T> {
-    /** The operation's complete JSON result, including expected refusals. */
-    readonly value: T
-}
-
-/** The row returned by the atomic client claim. */
-export interface ClaimClientRow<T> {
-    /** The digest recorded by the first operation under this scoped key. */
-    readonly request_fingerprint: string | null
-    /** The saved result, or null only for a claim inserted by this transaction. */
-    readonly outcome: ClientOutcomeRow<T> | null
-    /** An existing row had no completed outcome, so it must never run an effect again. */
-    readonly incomplete: boolean
-}
-
-/** The persisted outcome returned to the first caller. */
-export interface SavedClientOutcomeRow<T> {
-    /** The normalized JSON result as the database stores it. */
-    readonly outcome: ClientOutcomeRow<T>
-}
-
-/** A claimed or deleted delivery key returned by inbox persistence. */
-export interface InboxEventRow {
-    /** The event or client key owned by the row. */
-    readonly event_id: string
-}
-
-/** The bounded retention batch's aggregate result. */
-export interface InboxSweepRow {
-    /** Number of completed client claims removed by this transaction. */
-    readonly deleted_count: number
-}

package/templates/be/inbox/platform/inbox/persistence/inbox.sql.ts.tpl

@@ -1,33 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/** The unique source and delivery id let only one transaction record or process each delivery. */
-export const CLAIM_EVENT = sql`INSERT INTO public.inbox (source, event_id)
-VALUES ($1, $2)
-ON CONFLICT (source, event_id) DO NOTHING
-RETURNING event_id`
-
-/** A conflicting insert locks the existing row and returns its committed fingerprint and outcome after the winner commits. */
-export const CLAIM_CLIENT = sql`INSERT INTO public.inbox (source, event_id, request_fingerprint, claimed_at)
-VALUES ($1, $2, $3, $4)
-ON CONFLICT (source, event_id) DO UPDATE SET outcome = COALESCE(inbox.outcome, '{}'::jsonb)
-RETURNING request_fingerprint, outcome, (outcome IS NOT NULL AND (jsonb_typeof(outcome) <> 'object' OR NOT (outcome ? 'value'))) AS incomplete`
-
-/** The JSON envelope distinguishes a completed null result from an uncompleted claim in this transaction. */
-export const SAVE_CLIENT_OUTCOME = sql`WITH saved AS (
-    UPDATE public.inbox SET outcome = $3::jsonb
-    WHERE source = $1 AND event_id = $2
-    RETURNING outcome
-)
-SELECT outcome FROM saved LIMIT 1`
-
-/** Retention never deletes delivery rows or an incomplete claim; its bounded batch skips rows held by active retries. */
-export const SWEEP_CLIENTS = sql`WITH expired AS (
-    SELECT source, event_id FROM public.inbox
-    WHERE source LIKE 'client:%' AND request_fingerprint IS NOT NULL AND outcome IS NOT NULL AND jsonb_typeof(outcome) = 'object' AND outcome ? 'value' AND claimed_at < $1
-    ORDER BY claimed_at, source, event_id LIMIT $2 FOR UPDATE SKIP LOCKED
-), deleted AS (
-DELETE FROM public.inbox AS claims USING expired
-WHERE claims.source = expired.source AND claims.event_id = expired.event_id
-RETURNING claims.event_id
-)
-SELECT count(*)::int AS deleted_count FROM deleted`

package/templates/be/inbox/sql.ts.tpl

@@ -1,16 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/** Records one pending @@provider@@ delivery and returns its durable inbox identity only to the winning transaction. */
-export const INSERT_@@providerUpper@@_INBOX = sql`INSERT INTO public.@@table@@ (provider, delivery_id, payload)
-VALUES ($1, $2, $3::jsonb)
-ON CONFLICT (provider, delivery_id) DO NOTHING
-RETURNING id`
-
-/** The reactor or job marks a recorded delivery complete in the transaction that applies its effect. Never called by the intake. */
-export const COMPLETE_@@providerUpper@@_INBOX = sql`WITH completed AS (
-    UPDATE public.@@table@@
-    SET processed_at = now()
-    WHERE id = $1
-    RETURNING id
-)
-SELECT id FROM completed`

package/templates/be/patterns/jobs/platform-lite/persistence.jobs.sql.ts.tpl

@@ -1,33 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/**
- * Claims a delivery in one statement ($1 kind, $2 job key, $3 worker, $4 lease end, $5 payload, $6 instant). A new key inserts the row
- * with token 1; an existing key is claimed again only when the job failed or its lease expired, and then the token is bumped by the
- * store. A done job and a live claim match nothing, so no row comes back.
- */
-export const CLAIM_JOB = sql`INSERT INTO public.jobs (kind, job_key, status, fencing_token, claimed_by, lease_expires_at, payload, created_at, updated_at)
-    VALUES ($1, $2, 'running', 1, $3, $4, $5::jsonb, $6, $6)
-    ON CONFLICT (job_key) DO UPDATE
-       SET fencing_token = jobs.fencing_token + 1, claimed_by = $3, lease_expires_at = $4, status = 'running', error = NULL, updated_at = $6
-     WHERE jobs.status = 'failed' OR (jobs.status = 'running' AND jobs.lease_expires_at < $6)
-    RETURNING id, kind, fencing_token, current_step, payload`
-
-/** The guarded writes wrap their UPDATE in a CTE: TypeORM returns a bare `UPDATE ... RETURNING` as `[rows, count]`, a SELECT as rows. */
-
-/** Records a step ($1 job id, $2 expected token, $3 step, $4 instant); no row comes back when the token is stale. */
-export const ADVANCE_JOB = sql`WITH changed AS (UPDATE public.jobs SET current_step = $3, updated_at = $4
-    WHERE id = $1 AND fencing_token = $2 AND status = 'running'
-       RETURNING id)
-    SELECT id FROM changed`
-
-/** Completes the job ($1 job id, $2 expected token, $3 instant). */
-export const COMPLETE_JOB = sql`WITH changed AS (UPDATE public.jobs SET status = 'done', lease_expires_at = NULL, updated_at = $3
-    WHERE id = $1 AND fencing_token = $2 AND status = 'running'
-       RETURNING id)
-    SELECT id FROM changed`
-
-/** Fails the job ($1 job id, $2 expected token, $3 reason, $4 instant). */
-export const FAIL_JOB = sql`WITH changed AS (UPDATE public.jobs SET status = 'failed', error = $3, lease_expires_at = NULL, updated_at = $4
-    WHERE id = $1 AND fencing_token = $2 AND status = 'running'
-       RETURNING id)
-    SELECT id FROM changed`

package/templates/be/patterns/queues/platform-lite/persistence.queue.sql.ts.tpl

@@ -1,12 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/** Writes one job in the outbox ($1 queue, $2 payload, $3 instant, $4 correlation id); the relay hands it to BullMQ after the commit. */
-export const INSERT_QUEUE_ROW = sql`INSERT INTO public.queue (queue, payload, created_at, correlation_id)
-    VALUES ($1, $2::jsonb, $3, $4)`
-
-/** Locks and reads the oldest rows that wait ($1 batch size); a second relay skips the rows this one holds. */
-export const SELECT_WAITING_ROWS = sql`SELECT id, queue, payload, coalesce(correlation_id, id::text) AS "correlationId" FROM public.queue
-    WHERE sent_at IS NULL ORDER BY created_at, id LIMIT $1 FOR UPDATE SKIP LOCKED`
-
-/** Marks the rows as handed to BullMQ ($1 ids, $2 instant). */
-export const MARK_ROWS_SENT = sql`UPDATE public.queue SET sent_at = $2 WHERE id = ANY($1::uuid[])`

package/templates/be/skeleton-lite/src/modules/integrations/supabase/errors/supabase.error.ts

@@ -1,16 +0,0 @@
-import { DomainError } from "@modules/platform/errors"
-import type { ErrorKind } from "@modules/platform/errors"
-
-/** Codes of the Supabase integration. */
-export enum SupabaseErrorCode {
-    /** The access token failed signature or required-claim verification. */
-    AccessTokenInvalid = "SUPABASE_ACCESS_TOKEN_INVALID",
-}
-
-/** How each Supabase integration code travels. */
-export const SUPABASE_ERROR_KINDS: Record<SupabaseErrorCode, ErrorKind> = {
-    [SupabaseErrorCode.AccessTokenInvalid]: "unauthenticated",
-}
-
-/** The one error class of the Supabase integration. */
-export class SupabaseError extends DomainError<SupabaseErrorCode> {}

package/templates/be/skeleton-lite/src/modules/integrations/supabase/index.ts

@@ -1,6 +0,0 @@
-export { createSupabaseAdminClient } from "./supabase.client"
-export { parseSupabaseConfig } from "./supabase.config"
-export { SUPABASE_ACCESS_TOKEN_VERIFIER, SUPABASE_ADMIN_CLIENT } from "./supabase.decorators"
-export { SUPABASE_ERROR_KINDS, SupabaseErrorCode } from "./errors/supabase.error"
-export { createSupabaseAccessTokenVerifier } from "./supabase.jwks"
-export type { SupabaseOptions, VerifySupabaseAccessToken } from "./supabase.options"

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.client.spec.ts

@@ -1,27 +0,0 @@
-import { Test } from "@nestjs/testing"
-import { Secret } from "@modules/platform/config"
-import { createSupabaseAdminClient } from "./supabase.client"
-import type { SupabaseAdminClient } from "./supabase.client"
-import { SUPABASE_ADMIN_CLIENT } from "./supabase.decorators"
-
-describe("createSupabaseAdminClient", () => {
-    it("exposes only the Auth administration and Storage surfaces of a session-less service client", async () => {
-        const moduleRef = await Test.createTestingModule({
-            providers: [
-                {
-                    provide: SUPABASE_ADMIN_CLIENT,
-                    useFactory: () =>
-                        createSupabaseAdminClient({
-                            url: "http://127.0.0.1:54321",
-                            serviceRoleKey: new Secret("service-role"),
-                        }),
-                },
-            ],
-        }).compile()
-        const client = moduleRef.get<SupabaseAdminClient>(SUPABASE_ADMIN_CLIENT)
-
-        expect(Object.keys(client).sort()).toEqual(["auth", "storage"])
-        expect(typeof client.auth.createUser).toBe("function")
-        expect(typeof client.storage.from).toBe("function")
-    })
-})

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.client.ts

@@ -1,24 +0,0 @@
-import { createClient } from "@supabase/supabase-js"
-import type { SupabaseClient } from "@supabase/supabase-js"
-import type { Database } from "../../../../../supabase/types/database.types"
-import type { SupabaseOptions } from "./supabase.options"
-
-/** The privileged surface exposed by this integration: Auth administration and Storage, never database queries. */
-export interface SupabaseAdminClient {
-    /** Supabase Auth administration. */
-    readonly auth: SupabaseClient<Database>["auth"]["admin"]
-    /** Supabase Storage administration. */
-    readonly storage: SupabaseClient<Database>["storage"]
-}
-
-/** Creates the back-end-only client and narrows it to Auth and Storage administration. */
-export const createSupabaseAdminClient = (options: SupabaseOptions): SupabaseAdminClient => {
-    const client: SupabaseClient<Database> = createClient<Database>(options.url, options.serviceRoleKey.reveal(), {
-        auth: {
-            autoRefreshToken: false,
-            detectSessionInUrl: false,
-            persistSession: false,
-        },
-    })
-    return { auth: client.auth.admin, storage: client.storage }
-}

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.config.ts

@@ -1,8 +0,0 @@
-import type { EnvSource } from "@modules/platform/config"
-import type { SupabaseOptions } from "./supabase.options"
-
-/** Reads Supabase configuration with no credential or localhost defaults. */
-export const parseSupabaseConfig = (env: EnvSource): SupabaseOptions => ({
-    url: env.url("SUPABASE_URL"),
-    serviceRoleKey: env.secret("SUPABASE_SERVICE_ROLE_KEY"),
-})

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.decorators.ts

@@ -1,17 +0,0 @@
-import { injector } from "@modules/platform/composition"
-import type { TypedParameterDecorator } from "@modules/platform/composition"
-import type { SupabaseAdminClient } from "./supabase.client"
-import type { VerifySupabaseAccessToken } from "./supabase.options"
-
-/** Token of the integration's Auth and Storage administrator. */
-export const SUPABASE_ADMIN_CLIENT: unique symbol = Symbol("integrations.supabase.admin-client")
-/** Token of the cryptographic Supabase access-token verifier. */
-export const SUPABASE_ACCESS_TOKEN_VERIFIER: unique symbol = Symbol("integrations.supabase.access-token-verifier")
-
-/** Injects the Auth and Storage administrator. Parameter type: SupabaseAdminClient. */
-export const InjectSupabaseAdminClient = (): TypedParameterDecorator<SupabaseAdminClient> =>
-    injector<SupabaseAdminClient>(SUPABASE_ADMIN_CLIENT)
-
-/** Injects the access-token verifier. Parameter type: VerifySupabaseAccessToken. */
-export const InjectSupabaseAccessTokenVerifier = (): TypedParameterDecorator<VerifySupabaseAccessToken> =>
-    injector<VerifySupabaseAccessToken>(SUPABASE_ACCESS_TOKEN_VERIFIER)

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.jwks.ts

@@ -1,32 +0,0 @@
-import { createRemoteJWKSet, jwtVerify } from "jose"
-import { ok, refused } from "@modules/platform/primitives"
-import { SupabaseErrorCode } from "./errors/supabase.error"
-import type { SupabaseOptions, SupabasePrincipal, VerifySupabaseAccessToken } from "./supabase.options"
-
-const AUDIENCE = "authenticated"
-
-/** Creates the verifier for this project's remote JWKS, exact issuer, authenticated audience and pinned algorithm. */
-export const createSupabaseAccessTokenVerifier = (options: SupabaseOptions): VerifySupabaseAccessToken => {
-    const issuer = `${options.url.replace(/\/$/, "")}/auth/v1`
-    const keys = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`))
-    return async (token) => {
-        try {
-            const { payload } = await jwtVerify(token, keys, {
-                algorithms: ["ES256"],
-                audience: AUDIENCE,
-                issuer,
-            })
-            if (typeof payload.sub !== "string" || typeof payload.exp !== "number" || payload.role !== AUDIENCE) {
-                return refused(SupabaseErrorCode.AccessTokenInvalid)
-            }
-            const principal: SupabasePrincipal = {
-                id: payload.sub,
-                role: AUDIENCE,
-                ...(typeof payload.email === "string" ? { email: payload.email } : {}),
-            }
-            return ok(principal)
-        } catch (cause) {
-            return refused(SupabaseErrorCode.AccessTokenInvalid, { cause: String(cause) })
-        }
-    }
-}

package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.options.ts

@@ -1,24 +0,0 @@
-import type { Secret } from "@modules/platform/config"
-import type { Outcome } from "@modules/platform/primitives"
-import type { SupabaseErrorCode } from "./errors/supabase.error"
-
-/** The verified identity claims admitted from a Supabase access token. */
-export interface SupabasePrincipal {
-    /** The Auth user identifier from the verified `sub` claim. */
-    readonly id: string
-    /** The verified email claim when the provider issued one. */
-    readonly email?: string
-    /** Supabase's authenticated role, required by the verifier. */
-    readonly role: "authenticated"
-}
-
-/** Verifies one bearer token and returns only claims that passed every cryptographic and semantic check. */
-export type VerifySupabaseAccessToken = (token: string) => Promise<Outcome<SupabasePrincipal, SupabaseErrorCode>>
-
-/** Supabase configuration parsed once at API boot. */
-export interface SupabaseOptions {
-    /** The project origin, used for Auth, Storage, issuer and JWKS endpoints. */
-    readonly url: string
-    /** The service-role credential, held only by the back-end integration. */
-    readonly serviceRoleKey: Secret
-}

package/templates/be/table/rows.ts.tpl

@@ -1,4 +0,0 @@
-import type { Database } from "../../../../../../supabase/types/database.types"
-
-/** One generated row of public.{{table}}. */
-export type {{Name}}Row = Database["public"]["Tables"]["{{table}}"]["Row"]

package/templates/be/table/sql.api.ts.tpl

@@ -1,7 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/** Reads one public.{{table}} row by id and owner through a branded SQL statement. */
-export const FIND_{{upper}} = sql`SELECT id FROM public.{{tableSql}} WHERE id = $1 AND owner_id = $2 LIMIT 1`
-
-/** Inserts one public.{{table}} row owned by the principal and returns its id. */
-export const INSERT_{{upper}} = sql`INSERT INTO public.{{tableSql}} (owner_id) VALUES ($1) RETURNING id`

package/templates/be/table/sql.ts.tpl

@@ -1,4 +0,0 @@
-import { sql } from "@modules/platform/database"
-
-/** Reads one public.{{table}} row by id and owner through a branded SQL statement. */
-export const FIND_{{upper}} = sql`SELECT id FROM public.{{tableSql}} WHERE id = $1 AND owner_id = $2 LIMIT 1`

package/templates/fe/auth/supabase-client.ts.tpl

@@ -1,38 +0,0 @@
-const sessionOf = (session: Session | null): AuthSession | undefined =>
-    session === null
-        ? undefined
-        : { userId: session.user.id, ...(session.user.email === undefined ? {} : { email: session.user.email }) }
-
-/** A Supabase Auth error as the provider reports it: its HTTP status, its code and its message. */
-type ProviderError = {
-    readonly status: number | undefined
-    readonly code: string | undefined
-    readonly message: string
-}
-
-/** The failure kind of a Supabase Auth error: refused credentials, rejected input, or the provider unavailable. */
-const kindOf = (status: number | undefined): string => {
-    if (status === 400 || status === 401 || status === 403) return "refused"
-    return status === 422 ? "invalid" : "unavailable"
-}
-
-/** The failure of a Supabase Auth call, or undefined when it succeeded. */
-const failureOf = (error: ProviderError | null): AuthFailure | undefined =>
-    error === null
-        ? undefined
-        : { code: error.code ?? String(error.status ?? "auth"), kind: kindOf(error.status), message: error.message }
-
-/** The Supabase Auth adapter shared by browser and cookie-backed PKCE flows. */
-export const authClient: AuthClient = {
-    session: async () => sessionOf((await authOf().getSession()).data.session),
-    accessToken: async () => (await authOf().getSession()).data.session?.access_token,
-    refreshAccessToken: async () => (await authOf().refreshSession()).data.session?.access_token,
-    signInWithPassword: async (email, password) =>
-        failureOf((await authOf().signInWithPassword({ email, password })).error),
-    signOut: async () => failureOf((await authOf().signOut()).error),
-    // Supabase reports INITIAL_SESSION on subscribe, then every change: the subscription alone keeps the session current.
-    onChange: (listener) => {
-        const { data } = authOf().onAuthStateChange((_event, session) => listener(sessionOf(session)))
-        return () => data.subscription.unsubscribe()
-    },
-}

package/templates/fe/skeleton/apps/__app__/src/app/auth/callback/route.ts

@@ -1,11 +0,0 @@
-import { NextResponse } from "next/server"
-import { exchangeAuthCode } from "@/modules/auth/server"
-import { APP_ROUTES } from "@/modules/routes"
-
-/** The opt-in Supabase PKCE callback only exchanges the code and redirects home. */
-export const GET = async (request: Request): Promise<NextResponse> => {
-    const url = new URL(request.url)
-    const code = url.searchParams.get("code")
-    if (code) await exchangeAuthCode(code)
-    return NextResponse.redirect(new URL(APP_ROUTES.home, url.origin))
-}

package/templates/fe/skeleton/apps/__app__/src/modules/auth/pkce-client.ts

@@ -1,18 +0,0 @@
-import { createBrowserClient } from "@supabase/ssr"
-import type { Session, SupabaseClient } from "@supabase/supabase-js"
-import { supabaseAnonKey, supabaseUrl } from "@/modules/config"
-import type { AuthClient, AuthFailure, AuthSession } from "./contracts"
-
-let client: SupabaseClient | undefined
-
-/**
- * The cookie-backed browser client of the opt-in server PKCE flow, used for Supabase Auth only.
- * The callback exchanges the code; this client shares its verifier and session cookies. It never calls `.from()`, `.rpc()` or storage:
- * data goes through modules/api to the back end, which verifies the access token.
- */
-const supabase = (): SupabaseClient =>
-    (client ??= createBrowserClient(supabaseUrl(), supabaseAnonKey(), {
-        auth: { flowType: "pkce", detectSessionInUrl: false, persistSession: true, autoRefreshToken: true },
-    }))
-
-// {{> fe/auth/supabase-client.ts.tpl}}

package/templates/fe/skeleton/apps/__app__/src/modules/auth/server.ts

@@ -1,19 +0,0 @@
-import "server-only"
-import { createServerClient } from "@supabase/ssr"
-import { cookies } from "next/headers"
-import { supabaseAnonKey, supabaseUrl } from "@/modules/config"
-
-/** The server auth owner reads the PKCE verifier and persists the exchanged session in cookies. */
-export const exchangeAuthCode = async (code: string): Promise<void> => {
-    const cookieStore = await cookies()
-    const client = createServerClient(supabaseUrl(), supabaseAnonKey(), {
-        cookies: {
-            getAll: () => cookieStore.getAll(),
-            setAll: (values) => {
-                for (const { name, value, options } of values) cookieStore.set(name, value, options)
-            },
-        },
-    })
-    const { error } = await client.auth.exchangeCodeForSession(code)
-    if (error) throw error
-}