feat: drop alpha labels, deprecate adapters, pin doc imports to @1

README.md

@@ -32,7 +32,7 @@ One import. One line of config. Auth is validated, clients are ready, CORS is ha
 
 ```bash
 # Deno / Supabase Edge Functions (no install — import directly)
-import { withSupabase } from "npm:@supabase/server";
+import { withSupabase } from "npm:@supabase/server@1";
 
 # npm
 npm install @supabase/server
@@ -279,16 +279,16 @@ withSupabase(
 
 Called with config only, `withSupabase(config)` returns an entry for `pipeline` from `@supabase/middleware`. Entries placed after it in the array receive the Supabase context and contribute their own typed keys; entries placed before it run ahead of the auth gate. The first-party entries live on the `@supabase/server/middleware/*` subpaths; see [Postgres](#postgres-rls-scoped-queries).
 
-> **Alpha.** Composing `withSupabase` as a `pipeline` entry and the
-> `@supabase/server/middleware/*` subpaths track `@supabase/middleware` 0.x —
-> entry shapes and context keys may change between 0.x releases. The
-> `withSupabase(config, handler)` form is stable.
-
 ## Framework Adapters
 
 Adapters wrap `withSupabase` for a specific framework's middleware contract. They ship inside `@supabase/server`, so a single `npm install @supabase/server` covers the framework you're using — no separate package per adapter.
 
-> **Adapters are a community-driven initiative.** They're developed, maintained, and evolved by contributors — including responding to upstream framework changes. See [`src/adapters/README.md`](src/adapters/README.md) for the contribution requirements (tests, types, docs, build wiring) if you'd like to add or help maintain one.
+> [!WARNING]
+> Adapters are deprecated and will be removed on December 1, 2026. Use [middleware](https://github.com/supabase/middleware) to integrate `@supabase/server` with your framework.
+>
+> We're no longer accepting new adapter submissions.
+>
+> For Hono, H3, Elysia, NestJS, or TanStack Start, use the framework bridges in [`examples/frameworks`](./examples/frameworks). Read the [framework integration guide](https://supabase.com/docs/reference/server/frameworks) for setup steps.
 
 | Framework | Import                             | Framework version      | Docs                                               |
 | --------- | ---------------------------------- | ---------------------- | -------------------------------------------------- |
@@ -463,11 +463,6 @@ export default {
 
 ## Postgres (RLS-scoped queries)
 
-> **Alpha.** Composing `withSupabase` as a `pipeline` entry and the
-> `@supabase/server/middleware/*` subpaths track `@supabase/middleware` 0.x —
-> entry shapes and context keys may change between 0.x releases. The
-> `withSupabase(config, handler)` form is stable.
-
 When PostgREST isn't the right tool — joins, CTEs, window functions — `withPostgresClient` puts a direct Postgres connection on `ctx.postgres`, scoped to the caller by RLS:
 
 ```ts
@@ -547,22 +542,22 @@ No. `@supabase/ssr` handles cookie-based session management for frameworks like
 
 ## Exports
 
-| Export                                        | What's in it                                                                                                                                     |
-| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `@supabase/server`                            | `withSupabase`, `createSupabaseContext`                                                                                                          |
-| `@supabase/server/core`                       | `verifyAuth`, `verifyCredentials`, `extractCredentials`, `createContextClient`, `createAdminClient`, `resolveEnv`                                |
-| `@supabase/server/adapters/hono`              | `withSupabase` (Hono middleware)                                                                                                                 |
-| `@supabase/server/adapters/h3`                | `withSupabase` (H3 / Nuxt middleware)                                                                                                            |
-| `@supabase/server/adapters/elysia`            | `withSupabase` (Elysia plugin)                                                                                                                   |
-| `@supabase/server/adapters/nestjs`            | `withSupabase` (NestJS guard), `SupabaseCtx` (param decorator)                                                                                   |
-| `@supabase/server/middleware/client`          | **Alpha.** `withSupabaseClient` (RLS-scoped `ctx.supabase` client)                                                                               |
-| `@supabase/server/middleware/admin-client`    | **Alpha.** `withSupabaseAdminClient` (`ctx.supabaseAdmin`, bypasses RLS)                                                                         |
-| `@supabase/server/middleware/claims`          | **Alpha.** `withClaims` (JWKS-verified `ctx.jwtClaims`)                                                                                          |
-| `@supabase/server/middleware/required-claims` | **Alpha.** `withRequiredClaims` (user-mode auth gate, non-null `ctx.jwtClaims`)                                                                  |
-| `@supabase/server/middleware/postgres`        | **Alpha.** `withPostgresClient` (RLS-scoped `ctx.postgres` client)                                                                               |
-| `@supabase/server/middleware/postgres-admin`  | **Alpha.** `withPostgresAdminClient` (`ctx.postgresAdmin`, bypasses RLS)                                                                         |
-| `@supabase/server/oauth-protected-resource`   | **Alpha.** `withOAuthProtectedResource`, `fromSupabaseUrl`, `resourceMetadataResponse`, `unauthorizedResponse`; see [`docs/mcp.md`](docs/mcp.md) |
-| `@supabase/server/peer/supabase-js`           | Re-exported `supabase-js` types (`SupabaseClient`, `PostgrestError`, …)                                                                          |
+| Export                                        | What's in it                                                                                                                          |
+| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| `@supabase/server`                            | `withSupabase`, `createSupabaseContext`                                                                                               |
+| `@supabase/server/core`                       | `verifyAuth`, `verifyCredentials`, `extractCredentials`, `createContextClient`, `createAdminClient`, `resolveEnv`                     |
+| `@supabase/server/adapters/hono`              | `withSupabase` (Hono middleware)                                                                                                      |
+| `@supabase/server/adapters/h3`                | `withSupabase` (H3 / Nuxt middleware)                                                                                                 |
+| `@supabase/server/adapters/elysia`            | `withSupabase` (Elysia plugin)                                                                                                        |
+| `@supabase/server/adapters/nestjs`            | `withSupabase` (NestJS guard), `SupabaseCtx` (param decorator)                                                                        |
+| `@supabase/server/middleware/client`          | `withSupabaseClient` (RLS-scoped `ctx.supabase` client)                                                                               |
+| `@supabase/server/middleware/admin-client`    | `withSupabaseAdminClient` (`ctx.supabaseAdmin`, bypasses RLS)                                                                         |
+| `@supabase/server/middleware/claims`          | `withClaims` (JWKS-verified `ctx.jwtClaims`)                                                                                          |
+| `@supabase/server/middleware/required-claims` | `withRequiredClaims` (user-mode auth gate, non-null `ctx.jwtClaims`)                                                                  |
+| `@supabase/server/middleware/postgres`        | `withPostgresClient` (RLS-scoped `ctx.postgres` client)                                                                               |
+| `@supabase/server/middleware/postgres-admin`  | `withPostgresAdminClient` (`ctx.postgresAdmin`, bypasses RLS)                                                                         |
+| `@supabase/server/oauth-protected-resource`   | `withOAuthProtectedResource`, `fromSupabaseUrl`, `resourceMetadataResponse`, `unauthorizedResponse`; see [`docs/mcp.md`](docs/mcp.md) |
+| `@supabase/server/peer/supabase-js`           | Re-exported `supabase-js` types (`SupabaseClient`, `PostgrestError`, …)                                                               |
 
 ## Documentation
 

docs/api-reference.md

@@ -49,10 +49,6 @@ pipeline(
 
 Entries before `withSupabase` see every request, including unauthenticated ones, and observe its `401` responses on the way out. Entries after it receive the full `SupabaseContext` and may declare prerequisites on its keys; an entry contributing one of those keys is a compile-time conflict. Nesting works the same way: `withOAuthProtectedResource(withSupabase(config, handler))` places the OAuth middleware ahead of the gate, `withSupabase(config, withPostgresClient(handler))` places Postgres behind it. Placing `withOAuthProtectedResource` directly after `withSupabase` with an auth mode that requires credentials is refused when the stack is built; a pre-auth middleware separated from `withSupabase` by another entry is not detected and must be ordered by hand.
 
-> **Alpha.** The entry form and the `@supabase/server/middleware/*` subpaths
-> track `@supabase/middleware` 0.x — entry shapes and context keys may change
-> between 0.x releases. Everything else in `@supabase/server` is stable.
-
 ### createSupabaseContext
 
 ```ts
@@ -203,11 +199,6 @@ Defaults to `auth: 'user'` when config is omitted.
 
 ## @supabase/server/middleware/claims
 
-> **Alpha.** Composing `withSupabase` as a `pipeline` entry and the
-> `@supabase/server/middleware/*` subpaths track `@supabase/middleware` 0.x —
-> entry shapes and context keys may change between 0.x releases. The
-> `withSupabase(config, handler)` form is stable.
-
 ### withClaims
 
 ```ts
@@ -249,11 +240,6 @@ interface WithClaimsConfig {
 
 ## @supabase/server/middleware/required-claims
 
-> **Alpha.** Composing `withSupabase` as a `pipeline` entry and the
-> `@supabase/server/middleware/*` subpaths track `@supabase/middleware` 0.x —
-> entry shapes and context keys may change between 0.x releases. The
-> `withSupabase(config, handler)` form is stable.
-
 ### withRequiredClaims
 
 ```ts
@@ -316,11 +302,6 @@ interface WithRequiredClaimsConfig {
 
 ## @supabase/server/middleware/postgres
 
-> **Alpha.** Composing `withSupabase` as a `pipeline` entry and the
-> `@supabase/server/middleware/*` subpaths track `@supabase/middleware` 0.x —
-> entry shapes and context keys may change between 0.x releases. The
-> `withSupabase(config, handler)` form is stable.
-
 ### withPostgresClient
 
 ```ts
@@ -430,11 +411,6 @@ The minimal claims shape `withPostgresClient` requires upstream at `ctx.jwtClaim
 
 ## @supabase/server/middleware/postgres-admin
 
-> **Alpha.** Composing `withSupabase` as a `pipeline` entry and the
-> `@supabase/server/middleware/*` subpaths track `@supabase/middleware` 0.x —
-> entry shapes and context keys may change between 0.x releases. The
-> `withSupabase(config, handler)` form is stable.
-
 ### withPostgresAdminClient
 
 ```ts
@@ -470,9 +446,6 @@ interface WithPostgresAdminClientConfig {
 
 ## @supabase/server/oauth-protected-resource
 
-> **Alpha.** The config shape, the contributed context key, and the metadata
-> route may change in a minor release.
-
 Also re-exported from `@supabase/server`. See [`docs/mcp.md`](mcp.md) for the MCP server walkthrough.
 
 ### withOAuthProtectedResource

docs/error-handling.md

@@ -38,7 +38,7 @@ Access-Control-Expose-Headers: x-supabase-server-error
 
 The code is repeated in the `x-supabase-server-error` response header, and added to `Access-Control-Expose-Headers` so cross-origin browser code can actually read it.
 
-Every layer that answers a request directly uses this shape: `withSupabase`, and the middleware that short-circuit (`withClaims`, `withRequiredClaims`, `withPostgresClient`, `withPostgresAdminClient`, `withOAuthProtectedResource`). The `@supabase/server/middleware/*` subpaths and `@supabase/server/oauth-protected-resource` are alpha; the error payload documented here is stable either way.
+Every layer that answers a request directly uses this shape: `withSupabase`, and the middleware that short-circuit (`withClaims`, `withRequiredClaims`, `withPostgresClient`, `withPostgresAdminClient`, `withOAuthProtectedResource`).
 
 ## Trimming the response body
 

docs/getting-started.md

@@ -4,7 +4,7 @@
 
 ```bash
 # Deno (import directly)
-import { withSupabase } from 'npm:@supabase/server'
+import { withSupabase } from 'npm:@supabase/server@1'
 
 # npm
 npm install @supabase/server

docs/mcp.md

@@ -1,11 +1,5 @@
 # MCP servers
 
-> **Alpha.** `withOAuthProtectedResource` and composing `withSupabase` as a
-> `pipeline` entry track `@supabase/middleware` 0.x. The config shape, the
-> contributed context key, and the metadata route may change in a minor
-> release. The nested `withOAuthProtectedResource(withSupabase(config, handler))`
-> form is stable.
-
 An MCP server your app exposes to its users is an HTTP endpoint that MCP clients (Claude, ChatGPT, Cursor, VS Code, Claude Code) call after an OAuth 2.1 flow. `@supabase/server` covers the two Supabase-specific parts: OAuth discovery for the client, and turning the user's token into an RLS-scoped Supabase client for your tools. The MCP transport and the tools come from any MCP library.
 
 ```ts

docs/postgres.md

@@ -1,10 +1,5 @@
 # Postgres (`ctx.postgres`)
 
-> **Alpha.** Composing `withSupabase` as a `pipeline` entry and the
-> `@supabase/server/middleware/*` subpaths track `@supabase/middleware` 0.x —
-> entry shapes and context keys may change between 0.x releases. The
-> `withSupabase(config, handler)` form is stable.
-
 Two middleware give you a direct Postgres connection, mirroring the `ctx.supabase` / `ctx.supabaseAdmin` pair:
 
 | Middleware                | Subpath                       | Contributes         | RLS                            |

e2e/supabase/functions/server-e2e/deno.json

@@ -5,7 +5,7 @@
     "@supabase/server/middleware/postgres-admin": "../_vendor/package/dist/middleware/postgres-admin/index.mjs",
     "@supabase/supabase-js": "npm:@supabase/supabase-js@2",
     "@supabase/supabase-js/cors": "npm:@supabase/supabase-js@2/cors",
-    "@supabase/middleware": "npm:@supabase/middleware@0.5.0",
+    "@supabase/middleware": "npm:@supabase/middleware@1.0.0",
     "jose": "npm:jose@6",
     "pg": "npm:pg@8"
   }

package.json

@@ -257,7 +257,7 @@
     "vitest": "^5.0.0"
   },
   "dependencies": {
-    "@supabase/middleware": "^0.6.0",
+    "@supabase/middleware": "^1.0.0",
     "jose": "^6.2.0"
   }
 }