From b9b88ddd67e36519e38d9188a008a9a215d066de Mon Sep 17 00:00:00 2001 From: Katerina Skroumpelou Date: Mon, 5 Oct 2026 15:51:26 +0300 Subject: [PATCH 1/4] fix: align skill with adapter deprecation and drop unshipped doc link --- README.md | 4 +- skills/supabase-server/SKILL.md | 74 +++++++++++++++++++++++---------- 2 files changed, 55 insertions(+), 23 deletions(-) diff --git a/README.md b/README.md index ac4835c..5070c54 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ [![pkg.pr.new](https://pkg.pr.new/badge/supabase/server)](https://pkg.pr.new/~/supabase/server) [![Docs](https://img.shields.io/badge/docs-supabase.github.io-3ECF8E?logo=readthedocs&logoColor=white)](https://supabase.github.io/server/) -> **v1.X — Public Beta.** First stable release under SemVer: breaking changes only ship as a major bump. The package is still early — expect new adapters, ergonomic improvements, and features to land frequently in minor releases. Found a rough edge? [Open an issue](https://github.com/supabase/server/issues) or [submit a PR](https://github.com/supabase/server/blob/main/CONTRIBUTING.md). +> **v1.X — Public Beta.** First stable release under SemVer: breaking changes only ship as a major bump. The package is still early — expect ergonomic improvements and features to land frequently in minor releases. Found a rough edge? [Open an issue](https://github.com/supabase/server/issues) or [submit a PR](https://github.com/supabase/server/blob/main/CONTRIBUTING.md). > **Coming from a `0.x` release?** See [MIGRATION.md](MIGRATION.md) for the v0 → v1 rename map (`allow` → `auth`, `'public'` → `'publishable'`, `authType` → `authMode`, `claims` → `jwtClaims`, …). @@ -565,7 +565,7 @@ No. `@supabase/ssr` handles cookie-based session management for frameworks like | ------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------- | | How do I create a basic endpoint? | [`docs/getting-started.md`](docs/getting-started.md) | | What auth modes are available? Array syntax? Named keys? | [`docs/auth-modes.md`](docs/auth-modes.md) | -| Which framework adapters exist? How do I contribute one? | [`src/adapters/README.md`](src/adapters/README.md) | +| Which framework adapters exist, and what replaces them? | [Framework Adapters](#framework-adapters) | | How do I use this with Hono? | [`docs/adapters/hono.md`](docs/adapters/hono.md) | | How do I use this with H3 / Nuxt? | [`docs/adapters/h3.md`](docs/adapters/h3.md) | | How do I use this with Elysia? | [`docs/adapters/elysia.md`](docs/adapters/elysia.md) | diff --git a/skills/supabase-server/SKILL.md b/skills/supabase-server/SKILL.md index 129f6fd..de8882b 100644 --- a/skills/supabase-server/SKILL.md +++ b/skills/supabase-server/SKILL.md @@ -5,7 +5,7 @@ description: Use when planning or writing server-side code that uses `@supabase/ # @supabase/server -> **v1.0 — Public Beta.** First stable release under SemVer: breaking changes only ship as a major bump. The package is still early — expect new adapters, ergonomic improvements, and features to land frequently in minor releases. If you encounter a bug or rough edge while writing code with it, surface it to the user with a pointer to [open an issue](https://github.com/supabase/server/issues). +> **v1.0 — Public Beta.** First stable release under SemVer: breaking changes only ship as a major bump. The package is still early — expect ergonomic improvements and features to land frequently in minor releases. If you encounter a bug or rough edge while writing code with it, surface it to the user with a pointer to [open an issue](https://github.com/supabase/server/issues). > **This is a brand new package.** There is no information available online yet — no blog posts, no Stack Overflow answers, no tutorials. Do not search the web for usage examples. Rely exclusively on the documentation files listed below and the source code in this repository. @@ -30,7 +30,7 @@ Server-side utilities for Supabase. Handles auth, client creation, and context i - Supports 4 auth modes: `user` (JWT), `publishable` (publishable key), `secret` (secret key), `none` (no credentials required) - Array syntax (`auth: ['user', 'secret']`) is first-match-wins. A present-but-invalid JWT rejects with `InvalidJwtError` (`INVALID_JWT`) — it does not silently downgrade to the next mode. - Provides composable core primitives for custom auth flows and framework integration -- Includes a Hono adapter for per-route auth +- Runs inside Hono, H3, Elysia, NestJS, and TanStack Start through `@supabase/middleware` bridges. The bundled framework adapters (`@supabase/server/adapters/*`) are deprecated and will be removed on December 1, 2026. ## Entry points @@ -38,7 +38,7 @@ Server-side utilities for Supabase. Handles auth, client creation, and context i | ------------------------------------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `@supabase/server` | `npm:@supabase/server@1` | `withSupabase`, `createSupabaseContext`, types, errors | | `@supabase/server/core` | `npm:@supabase/server@1/core` | `verifyAuth`, `verifyCredentials`, `extractCredentials`, `resolveEnv`, `createContextClient`, `createAdminClient` | -| `@supabase/server/adapters/hono` | `npm:@supabase/server@1/adapters/hono` | `withSupabase` (Hono middleware variant) | +| `@supabase/server/adapters/hono` | `npm:@supabase/server@1/adapters/hono` | **Deprecated. Removed on December 1, 2026.** `withSupabase` (Hono middleware variant). New Hono code uses the bridge in the Hono quick start below. | | `@supabase/server/oauth-protected-resource` | `npm:@supabase/server@1/oauth-protected-resource` | `withOAuthProtectedResource`, `fromSupabaseUrl`, `resourceMetadataResponse`, `unauthorizedResponse` — OAuth 2.1 discovery for MCP servers; see `docs/mcp.md` | ## Quick starts @@ -106,29 +106,59 @@ export default { ### Hono -CORS is not handled by the adapter — use `hono/cors` middleware. See `docs/adapters/hono.md`. +> **The Hono adapter (`@supabase/server/adapters/hono`) is deprecated and will be removed on December 1, 2026.** New Hono code uses a bridge: one file you copy into your project. It runs `@supabase/middleware` entries inside Hono's middleware slot. The bridge needs `@supabase/server` 1.6.0 or later and Node 22 or later. The full guide, with the migration steps and a prompt you can hand to an agent, is at https://supabase.com/docs/reference/server/frameworks. + +The bridge file is not in the npm package. Fetch it from the repository and keep it as is, comments included: + +```bash +mkdir -p src/lib +curl --fail -o src/lib/supabase-middleware.ts \ + https://raw.githubusercontent.com/supabase/server/main/examples/frameworks/hono/supabase-middleware.ts +``` ```ts -// Node.js / Bun import { Hono } from 'hono' -import { withSupabase } from '@supabase/server/adapters/hono' +import { withRequiredClaims } from '@supabase/server/middleware/required-claims' +import { withSupabaseClient } from '@supabase/server/middleware/client' -const app = new Hono() -app.use('*', withSupabase({ auth: 'user' })) +import { toHono } from './lib/supabase-middleware.js' -app.get('/todos', async (c) => { - const { supabase } = c.var.supabaseContext - const { data } = await supabase.from('todos').select() - return c.json(data) -}) +// `withRequiredClaims` answers 401 to any request without a valid user JWT, +// so the routes below only run for signed-in callers. +const app = new Hono() + .use('*', toHono([withRequiredClaims(), withSupabaseClient()])) + .get('/todos', async (c) => { + const { data, error } = await c.var.supabase.from('todos').select() + if (error) return c.json({ error: error.message }, 500) + return c.json(data) + }) + .get('/me', (c) => c.json({ id: c.var.jwtClaims.sub })) -export default app +export default { fetch: app.fetch } ``` +Register the bridge with `.use()` in the same chain as the routes it gates. Hono applies middleware only to routes added after it. For browser callers, compose `withCors` from `@supabase/middleware/cors` ahead of the gate. On Deno and Supabase Edge Functions, import `hono`, `@supabase/middleware`, and `@supabase/server@1/middleware/*` with the `npm:` specifier. + +**Pick the entries from the adapter's `auth` value.** The adapter rejected requests that failed its `auth` check. `withClaims()` does not. It contributes `jwtClaims: null` for an anonymous request and lets it through. Using it in place of `auth: 'user'` turns a 401 into a 200 with no error. + +| Adapter config | Bridge entries | +| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `auth: 'user'`, or no config | `toHono([withRequiredClaims(), withSupabaseClient()])` | +| `auth: 'none'` | `toHono([withSupabaseClient()])` | +| `auth: 'publishable'` or `auth: 'secret'` | No bridge entry exists. That endpoint stays on `withSupabase({ auth: 'publishable' })` or `withSupabase({ auth: 'secret' })`. Do not hand-roll a key check. | + +Never compose `withClaims()` and `withRequiredClaims()` in one array. Both contribute `jwtClaims`, and the bridge rejects the pair at compile time. Add `withSupabaseAdminClient()` from `@supabase/server/middleware/admin-client` only where the handler reads `supabaseAdmin`. + +The entries contribute flat keys, so handlers read `c.var.supabase` and `c.var.jwtClaims`. No entry contributes `userClaims`. `jwtClaims` is the raw JWT payload: `userClaims.id` becomes `jwtClaims.sub`, `appMetadata` becomes `app_metadata`, and `userMetadata` becomes `user_metadata`. + +
+Deprecated adapter (removed on December 1, 2026) + +Existing code may still import the adapter. Recognize it, and migrate it with the table above. The adapter handles no CORS; it relies on `hono/cors`. See `docs/adapters/hono.md`. + ```ts -// Deno / Supabase Edge Functions -import { Hono } from 'npm:hono' -import { withSupabase } from 'npm:@supabase/server@1/adapters/hono' +import { Hono } from 'hono' +import { withSupabase } from '@supabase/server/adapters/hono' const app = new Hono() app.use('*', withSupabase({ auth: 'user' })) @@ -139,9 +169,11 @@ app.get('/todos', async (c) => { return c.json(data) }) -export default { fetch: app.fetch } +export default app ``` +
+ ### Cookie-based environments (compose with `@supabase/ssr`) For Next.js / SvelteKit / Remix, **compose `@supabase/server` with [`@supabase/ssr`](https://github.com/supabase/ssr)** — they are not replacements for each other. `@supabase/ssr` owns cookies and refresh-token rotation (its middleware is required, otherwise the access token cookie goes stale and verification fails). In your Server Component or Route Handler, use `@supabase/ssr`'s `createServerClient` to read the (middleware-refreshed) session, hand the access token to `verifyCredentials` from `@supabase/server/core`, then build the typed clients with `createContextClient` + `createAdminClient`. See `docs/ssr-frameworks.md` for the full adapter pattern. @@ -436,9 +468,9 @@ The full documentation lives in the `docs/` directory of the `@supabase/server` | ------------------------------------------------------------------------------------------------------ | ----------------------------------------------------- | | How do I create a basic endpoint? | `docs/getting-started.md` | | What auth modes are available? Array syntax? Named keys? | `docs/auth-modes.md` | -| Which framework adapters exist? How do I contribute one? | `src/adapters/README.md` | -| How do I use this with Hono? | `docs/adapters/hono.md` | -| How do I use this with H3 / Nuxt? | `docs/adapters/h3.md` | +| Which framework adapters exist, and what replaces them? | `README.md`, section "Framework Adapters" | +| How do I use the deprecated Hono adapter? | `docs/adapters/hono.md` | +| How do I use the deprecated H3 / Nuxt adapter? | `docs/adapters/h3.md` | | How do I run middleware entries inside Hono, H3, Elysia, NestJS, or TanStack Start without an adapter? | https://supabase.com/docs/reference/server/frameworks | | How do I use low-level primitives for custom flows? | `docs/core-primitives.md` | | How do environment variables work across runtimes? | `docs/environment-variables.md` | From e0284b9807b13ba3f658f872b94f8f5a3f9d6de6 Mon Sep 17 00:00:00 2001 From: Katerina Skroumpelou Date: Mon, 5 Oct 2026 16:00:03 +0300 Subject: [PATCH 2/4] fix: mark adapter docs deprecated and guard skill doc paths in smoke test --- CONTRIBUTING.md | 8 ++++---- docs/adapters/elysia.md | 5 +++++ docs/adapters/h3.md | 5 +++++ docs/adapters/hono.md | 5 +++++ docs/adapters/nestjs.md | 5 +++++ scripts/smoke-pack.mjs | 28 +++++++++++++++++++++++++++- src/adapters/README.md | 33 ++++++++------------------------- 7 files changed, 59 insertions(+), 30 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 980175a..d473832 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -10,7 +10,7 @@ Thank you for your interest in contributing to `@supabase/server`! This document - [Testing](#testing) - [Submitting Changes](#submitting-changes) - [Contributing a middleware](#contributing-a-middleware) -- [Contributing a framework adapter](#contributing-a-framework-adapter) +- [Framework adapters](#framework-adapters) - [Release Process](#release-process) ## Getting Started @@ -212,11 +212,11 @@ Middleware with no Supabase surface lives in its own package on top of [`@supaba **Naming.** The `with` prefix means middleware: composable, chainable, and never the last entry in a chain. A terminal handler resolves the request instead of passing it on; it takes no prefix and lives outside `src/middleware/`. MCP-specific code stays separate from general middleware. When something turns out not to be MCP-specific, rename it and place it by the rules above. -## Contributing a framework adapter +## Framework adapters -Framework adapters (Hono, H3, …) are community-maintained and live in this repo under `src/adapters/`. They have **additional requirements** on top of the general PR guidelines above — tests covering every auth mode, no new runtime deps beyond a peer-dep, matching the existing adapter shape, and updating both adapter tables (in `README.md` and `src/adapters/README.md`). +The adapters under `src/adapters/` (Hono, H3, Elysia, NestJS) are deprecated and will be removed on December 1, 2026. New adapters are not accepted. Framework integration goes through the bridges in [`examples/frameworks`](examples/frameworks) and the [framework integration guide](https://supabase.com/docs/reference/server/frameworks). -See [`src/adapters/README.md`](src/adapters/README.md) for the full checklist before opening an adapter PR. +Bug fixes and framework-version bumps for the existing adapters are welcome until removal. See [`src/adapters/README.md`](src/adapters/README.md) for the maintenance rules. ## Release Process diff --git a/docs/adapters/elysia.md b/docs/adapters/elysia.md index 7b24d96..cb97c12 100644 --- a/docs/adapters/elysia.md +++ b/docs/adapters/elysia.md @@ -1,5 +1,10 @@ # Elysia Adapter +> [!WARNING] +> Adapters are deprecated and will be removed on December 1, 2026. We're no longer accepting new adapter submissions. +> +> New Elysia code uses the bridge in [`examples/frameworks/elysia`](https://github.com/supabase/server/tree/main/examples/frameworks/elysia). The [framework integration guide](https://supabase.com/docs/reference/server/frameworks) covers setup and the steps to move off the adapter. + ## Setup Install Elysia as a peer dependency: diff --git a/docs/adapters/h3.md b/docs/adapters/h3.md index c45563c..d56832a 100644 --- a/docs/adapters/h3.md +++ b/docs/adapters/h3.md @@ -1,5 +1,10 @@ # H3 / Nuxt Adapter +> [!WARNING] +> Adapters are deprecated and will be removed on December 1, 2026. We're no longer accepting new adapter submissions. +> +> New H3 and Nuxt code uses the bridge in [`examples/frameworks/h3`](https://github.com/supabase/server/tree/main/examples/frameworks/h3). The [framework integration guide](https://supabase.com/docs/reference/server/frameworks) covers setup and the steps to move off the adapter. + ## Setup Install H3 as a peer dependency: diff --git a/docs/adapters/hono.md b/docs/adapters/hono.md index 78d5119..119f51e 100644 --- a/docs/adapters/hono.md +++ b/docs/adapters/hono.md @@ -1,5 +1,10 @@ # Hono Adapter +> [!WARNING] +> Adapters are deprecated and will be removed on December 1, 2026. We're no longer accepting new adapter submissions. +> +> New Hono code uses the bridge in [`examples/frameworks/hono`](https://github.com/supabase/server/tree/main/examples/frameworks/hono). The [framework integration guide](https://supabase.com/docs/reference/server/frameworks) covers setup and the steps to move off the adapter. + ## Setup Install Hono as a peer dependency: diff --git a/docs/adapters/nestjs.md b/docs/adapters/nestjs.md index 80e753a..6f54206 100644 --- a/docs/adapters/nestjs.md +++ b/docs/adapters/nestjs.md @@ -1,5 +1,10 @@ # NestJS Adapter +> [!WARNING] +> Adapters are deprecated and will be removed on December 1, 2026. We're no longer accepting new adapter submissions. +> +> New NestJS code uses the guard in [`examples/frameworks/nestjs`](https://github.com/supabase/server/tree/main/examples/frameworks/nestjs). The [framework integration guide](https://supabase.com/docs/reference/server/frameworks) covers setup and the steps to move off the adapter. + ## Setup Install NestJS as a peer dependency: diff --git a/scripts/smoke-pack.mjs b/scripts/smoke-pack.mjs index efab6b1..896b6f5 100644 --- a/scripts/smoke-pack.mjs +++ b/scripts/smoke-pack.mjs @@ -7,6 +7,10 @@ // allowances below is a hard dependency the package does not declare, and it // breaks that consumer on import. // +// Also checks that every doc path the shipped skill names exists in the +// installed package, since the skill points agents at node_modules, not at +// the repository. +// // Run after `pnpm build`: `pnpm smoke:pack`. import { execFileSync } from 'node:child_process' @@ -113,6 +117,28 @@ try { process.exit(1) } + const installed = join(consumer, 'node_modules', pkg.name) + const skill = readFileSync( + join(installed, 'skills/supabase-server/SKILL.md'), + 'utf8', + ) + const docPaths = [ + ...new Set( + [...skill.matchAll(/`([A-Za-z0-9_./-]+\.md)`/g)].map((m) => m[1]), + ), + ] + const missingDocs = docPaths.filter((p) => !existsSync(join(installed, p))) + if (missingDocs.length > 0) { + failed = true + for (const p of missingDocs) { + console.error(`FAIL skill references ${p}, which is not in the package.`) + } + } else { + console.log( + `ok ${docPaths.length} doc paths named in the skill exist in the package`, + ) + } + const loader = ` import { createRequire } from 'node:module' const require = createRequire(import.meta.url) @@ -166,7 +192,7 @@ console.log(JSON.stringify(results)) } if (failed) { - console.error('\nPacked entrypoints failed to load without optional peers.') + console.error('\nThe packed tarball failed the smoke checks above.') process.exit(1) } diff --git a/src/adapters/README.md b/src/adapters/README.md index 31edc07..807a39c 100644 --- a/src/adapters/README.md +++ b/src/adapters/README.md @@ -1,6 +1,9 @@ # Adapters -You're in the adapter source folder. Framework adapters wrap `withSupabase` and `createSupabaseContext` for a specific framework's middleware contract — Hono middleware, H3 event handlers, and so on. Implementations live next to this README under `/`; reference docs live at [`docs/adapters/.md`](../../docs/adapters/). +You're in the adapter source folder. Framework adapters wrap `withSupabase` and `createSupabaseContext` for a specific framework's middleware contract: Hono middleware, H3 event handlers, and so on. Implementations live next to this README under `/`; reference docs live at [`docs/adapters/.md`](../../docs/adapters/). + +> [!WARNING] +> Adapters are deprecated and will be removed on December 1, 2026. New adapters are not accepted. Framework integration goes through the bridges in [`examples/frameworks`](../../examples/frameworks) and the [framework integration guide](https://supabase.com/docs/reference/server/frameworks). ## Available adapters @@ -11,30 +14,10 @@ You're in the adapter source folder. Framework adapters wrap `withSupabase` and | Elysia | `@supabase/server/adapters/elysia` | `^1.4.0` | [docs/adapters/elysia.md](../../docs/adapters/elysia.md) | | NestJS | `@supabase/server/adapters/nestjs` | `^10.0.0 \|\| ^11.0.0` | [docs/adapters/nestjs.md](../../docs/adapters/nestjs.md) | -The framework version reflects what the adapter is tested against. It must match the corresponding entry in [`package.json#peerDependencies`](../../package.json) — if you bump the peer-dep range, update this table too. - -## Community-maintained - -**Every adapter listed above is community-maintained.** Hono, H3, and Elysia all originated as community contributions. Adapters live in this repo and ship with the core package, so users get them with a single `npm install @supabase/server` — no separate package per framework. - -The Supabase team reviews PRs, runs security and regression triage, and ships releases. The original contributor of an adapter is the de-facto domain expert and is expected to be the first responder on framework-version bumps and bug reports for that adapter. - -## Contributing a new adapter - -Before you start, **read [`CONTRIBUTING.md`](../../CONTRIBUTING.md) and agree with it.** That covers the development setup, code style, commit conventions, and PR process. The points below are _additional_ requirements specific to adapter contributions. - -**Code quality bar:** - -- **Tests for every auth mode.** Cover `'user'`, `'publishable'`, `'secret'`, `'none'`, the array form, and the failure paths (missing token, invalid JWT, missing apikey). The Hono adapter's [`hono/middleware.test.ts`](hono/middleware.test.ts) is the canonical reference — your test file should look structurally similar. -- **Strict TypeScript.** No `any`, no `// @ts-ignore`. Public types must be exported from the adapter's `index.ts` so consumers can extend them. -- **No new runtime dependencies** beyond the framework you're adapting. The framework itself goes in `peerDependencies` (and `peerDependenciesMeta` if optional). Don't pull in a wrapper, polyfill, or utility lib just to make the adapter shorter. -- **Match the existing adapter shape.** Export `withSupabase(config, handler)` returning the framework's native middleware/handler type. Use `verifyAuth`, `createContextClient`, and `createAdminClient` from `@supabase/server/core` — never re-implement auth or env handling inside an adapter. -- **Wire up the build outputs.** Add the adapter entry to `package.json#exports`, `jsr.json` (if applicable), and `tsdown.config.ts#entry` so it ships in the published artifact. -- **Docs are required.** Add `docs/adapters/.md` mirroring the structure of [`docs/adapters/hono.md`](../../docs/adapters/hono.md) — at minimum: setup, basic example, per-route auth, CORS note. -- **Update both adapter tables.** Add a row to the table in this `src/adapters/README.md` _and_ the mirror table in the top-level [`README.md`](../../README.md). Keep the framework-version column accurate against `package.json#peerDependencies`. PRs that touch an existing adapter must update the version column if the peer-dep range changed. +The framework version reflects what the adapter is tested against. It must match the corresponding entry in [`package.json#peerDependencies`](../../package.json). A PR that bumps the peer-dep range updates this table and the mirror table in the top-level [`README.md`](../../README.md). -The Supabase team will review the PR against these requirements. Once merged, the adapter ships in the next release as part of `@supabase/server` — no separate package, no extra install for users. As the original contributor, you're expected to be the first responder on framework-version bumps and bug reports for your adapter. +## Maintenance until removal -## Designing an adapter +Every adapter listed above is community-maintained. Hono, H3, and Elysia originated as community contributions. The Supabase team reviews PRs, runs security and regression triage, and ships releases. The original contributor of an adapter is the first responder on framework-version bumps and bug reports for that adapter. -The existing adapters at [`hono/middleware.ts`](hono/middleware.ts), [`h3/middleware.ts`](h3/middleware.ts), and [`elysia/plugin.ts`](elysia/plugin.ts) (siblings of this README) are the canonical templates. The shape every adapter exposes is `withSupabase(config, handler)` returning a framework-native middleware. Keep all auth logic in `@supabase/server/core` — adapters should only translate request/response shapes between the framework and the core primitives. +Bug fixes and framework-version bumps are welcome until the removal date. Read [`CONTRIBUTING.md`](../../CONTRIBUTING.md) first. A fix keeps the existing adapter shape: `withSupabase(config, handler)` returning the framework's native middleware type, auth and env handling through `@supabase/server/core`, no new runtime dependencies, and tests for every auth mode. The Hono adapter's [`hono/middleware.test.ts`](hono/middleware.test.ts) is the reference test file. From ca65b17a81cea68b65fa6c1ba4aee5e17a02eed9 Mon Sep 17 00:00:00 2001 From: Katerina Skroumpelou Date: Mon, 5 Oct 2026 16:23:39 +0300 Subject: [PATCH 3/4] docs: add one line for install --- skills/supabase-server/SKILL.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/skills/supabase-server/SKILL.md b/skills/supabase-server/SKILL.md index de8882b..d5940f2 100644 --- a/skills/supabase-server/SKILL.md +++ b/skills/supabase-server/SKILL.md @@ -106,11 +106,12 @@ export default { ### Hono -> **The Hono adapter (`@supabase/server/adapters/hono`) is deprecated and will be removed on December 1, 2026.** New Hono code uses a bridge: one file you copy into your project. It runs `@supabase/middleware` entries inside Hono's middleware slot. The bridge needs `@supabase/server` 1.6.0 or later and Node 22 or later. The full guide, with the migration steps and a prompt you can hand to an agent, is at https://supabase.com/docs/reference/server/frameworks. +> **The Hono adapter (`@supabase/server/adapters/hono`) is deprecated and will be removed on December 1, 2026.** New Hono code uses a bridge: one file you copy into your project. It runs `@supabase/middleware` entries inside Hono's middleware slot. The bridge needs `@supabase/server` 1.6.0 or later and Node 22 or later. The bridge file imports `@supabase/middleware`, so add it to your project as a direct dependency. `@supabase/server` depends on it, but a strict package manager such as pnpm does not let your code import a transitive dependency. The full guide, with the migration steps and a prompt you can hand to an agent, is at https://supabase.com/docs/reference/server/frameworks. The bridge file is not in the npm package. Fetch it from the repository and keep it as is, comments included: ```bash +npm install @supabase/middleware mkdir -p src/lib curl --fail -o src/lib/supabase-middleware.ts \ https://raw.githubusercontent.com/supabase/server/main/examples/frameworks/hono/supabase-middleware.ts From 4489ddd47a5bb72e3cacc937caecc6bab423bff6 Mon Sep 17 00:00:00 2001 From: Katerina Skroumpelou Date: Mon, 5 Oct 2026 17:20:53 +0300 Subject: [PATCH 4/4] docs: add deprecation note --- src/adapters/elysia/plugin.ts | 5 +++++ src/adapters/h3/middleware.ts | 2 ++ src/adapters/hono/middleware.ts | 2 ++ src/adapters/nestjs/decorator.ts | 3 +++ src/adapters/nestjs/middleware.ts | 2 ++ 5 files changed, 14 insertions(+) diff --git a/src/adapters/elysia/plugin.ts b/src/adapters/elysia/plugin.ts index 8d94ddd..b641da5 100644 --- a/src/adapters/elysia/plugin.ts +++ b/src/adapters/elysia/plugin.ts @@ -14,6 +14,9 @@ import type { * Discriminate in `onError` via `code === 'SupabaseError'`. The original * `AuthError` is available as the typed `.cause`. * + * @deprecated Removed with the Elysia adapter on December 1, 2026. The Elysia + * bridge from the framework integration guide answers auth failures with + * a `Response` instead: https://supabase.com/docs/reference/server/frameworks * @category Adapters */ export class SupabaseError extends Error { @@ -68,6 +71,8 @@ export class SupabaseError extends Error { * app.listen(3000) * ``` * + * @deprecated Removed on December 1, 2026. Use the Elysia bridge from the + * framework integration guide instead: https://supabase.com/docs/reference/server/frameworks * @category Adapters */ // The explicit return type below mirrors Elysia's own generic defaults, which use diff --git a/src/adapters/h3/middleware.ts b/src/adapters/h3/middleware.ts index 8dc3c99..e5e0bbe 100644 --- a/src/adapters/h3/middleware.ts +++ b/src/adapters/h3/middleware.ts @@ -43,6 +43,8 @@ import type { SupabaseContext, WithSupabaseConfig } from '../../types.js' * }) * ``` * + * @deprecated Removed on December 1, 2026. Use the H3 bridge from the + * framework integration guide instead: https://supabase.com/docs/reference/server/frameworks * @category Adapters */ export function withSupabase( diff --git a/src/adapters/hono/middleware.ts b/src/adapters/hono/middleware.ts index dce0e36..0ec2e94 100644 --- a/src/adapters/hono/middleware.ts +++ b/src/adapters/hono/middleware.ts @@ -42,6 +42,8 @@ import type { * export default { fetch: app.fetch } * ``` * + * @deprecated Removed on December 1, 2026. Use the Hono bridge from the + * framework integration guide instead: https://supabase.com/docs/reference/server/frameworks * @category Adapters */ export function withSupabase( diff --git a/src/adapters/nestjs/decorator.ts b/src/adapters/nestjs/decorator.ts index e0c9782..8f009d5 100644 --- a/src/adapters/nestjs/decorator.ts +++ b/src/adapters/nestjs/decorator.ts @@ -33,6 +33,9 @@ import type { SupabaseContext } from '../../types.js' * } * ``` * + * @deprecated Removed with the NestJS adapter on December 1, 2026. The NestJS + * guard bridge from the framework integration guide puts the contributed + * keys on the request instead: https://supabase.com/docs/reference/server/frameworks * @category Adapters */ export const SupabaseCtx: ( diff --git a/src/adapters/nestjs/middleware.ts b/src/adapters/nestjs/middleware.ts index 929a07e..a6c32b8 100644 --- a/src/adapters/nestjs/middleware.ts +++ b/src/adapters/nestjs/middleware.ts @@ -82,6 +82,8 @@ function toWebRequest(req: NestRequestLike): Request { * } * ``` * + * @deprecated Removed on December 1, 2026. Use the NestJS guard bridge from + * the framework integration guide instead: https://supabase.com/docs/reference/server/frameworks * @category Adapters */ export function withSupabase(