refactor: adopt @supabase/middleware importable getEnv API

Port from the @supabase/web-middleware PR-9 preview to
@supabase/middleware at main (0641674), which dropped ctx._runtime:

- withSupabase seeds the middleware chain via seedContext() instead of
  faking a { _runtime } facet (the engine now marks contexts with a
  symbol, so the structural fake no longer works)
- withPostgres defaults its connection string from the importable
  getEnv('SUPABASE_DB_URL') instead of ctx._runtime.getEnv
- tests use vi.stubEnv for the env fallback; withClaims tests call the
  handler as a bare fetch entry

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mandarini

package.json

@@ -201,7 +201,7 @@
     "vitest": "^4.1.0"
   },
   "dependencies": {
-    "@supabase/web-middleware": "https://pkg.pr.new/supabase/web-middleware/@supabase/web-middleware@9",
+    "@supabase/middleware": "https://pkg.pr.new/supabase/middleware/@supabase/middleware@0641674",
     "jose": "^6.2.0"
   }
 }

pnpm-lock.yaml

@@ -14,8 +14,6 @@ function tokenFor(claims: Record<string, unknown>): string {
   return `header.${base64url(claims)}.sig`
 }
 
-const runtime = { name: 'node' as const, getEnv: () => undefined }
-
 describe('withClaims', () => {
   it('decodes the Bearer token payload into ctx.jwtClaims', async () => {
     let seen: unknown
@@ -24,13 +22,13 @@ describe('withClaims', () => {
       return Response.json({ ok: true })
     })
 
+    // Called bare, the way a runtime invokes a fetch entry — no prerequisites.
     await handler(
       new Request('http://localhost', {
         headers: {
           Authorization: `Bearer ${tokenFor({ sub: 'u1', role: 'authenticated' })}`,
         },
       }),
-      { _runtime: runtime },
     )
 
     expect(seen).toEqual({ sub: 'u1', role: 'authenticated' })
@@ -43,7 +41,7 @@ describe('withClaims', () => {
       return Response.json({ ok: true })
     })
 
-    await handler(new Request('http://localhost'), { _runtime: runtime })
+    await handler(new Request('http://localhost'))
 
     expect(seen).toBeNull()
   })
@@ -59,7 +57,6 @@ describe('withClaims', () => {
       new Request('http://localhost', {
         headers: { Authorization: 'Bearer not-a-jwt' },
       }),
-      { _runtime: runtime },
     )
 
     expect(seen).toBeNull()

src/middleware/claims/index.test.ts

@@ -1,4 +1,4 @@
-import { defineMiddleware } from '@supabase/web-middleware'
+import { defineMiddleware } from '@supabase/middleware'
 
 /**
  * Loosely-typed JWT claims contributed by {@link withClaims}.

src/middleware/claims/index.ts

@@ -19,12 +19,7 @@ vi.mock('pg', () => {
   return { default: { Pool }, Pool }
 })
 
-const runtime = {
-  name: 'node' as const,
-  getEnv: (k: string) =>
-    k === 'SUPABASE_DB_URL' ? 'postgres://localhost/test' : undefined,
-}
-
+const { seedContext } = await import('@supabase/middleware')
 const { withPostgres } = await import('./index.js')
 
 describe('withPostgres', () => {
@@ -33,16 +28,23 @@ describe('withPostgres', () => {
     h.clientQuery.mockClear()
     h.connect.mockClear()
     h.release.mockClear()
+    // The connection-string default reads the importable getEnv, which falls
+    // back to the host env in tests.
+    vi.stubEnv('SUPABASE_DB_URL', 'postgres://localhost/test')
+  })
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    vi.restoreAllMocks()
   })
-  afterEach(() => vi.restoreAllMocks())
 
   it('returns 500 when no connection string is available', async () => {
+    vi.stubEnv('SUPABASE_DB_URL', undefined)
     const handler = withPostgres({ connectionString: undefined }, async () =>
       Response.json({ ok: true }),
     )
 
     const res = await handler(new Request('http://localhost'), {
-      _runtime: { name: 'node', getEnv: () => undefined },
+      ...seedContext(),
       jwtClaims: null,
     })
 
@@ -57,7 +59,7 @@ describe('withPostgres', () => {
     })
 
     await handler(new Request('http://localhost'), {
-      _runtime: runtime,
+      ...seedContext(),
       jwtClaims: { sub: 'u1', role: 'authenticated' },
     })
 
@@ -78,7 +80,7 @@ describe('withPostgres', () => {
     })
 
     await handler(new Request('http://localhost'), {
-      _runtime: runtime,
+      ...seedContext(),
       jwtClaims: { sub: 'attacker', role: 'service_role' },
     })
 
@@ -112,7 +114,7 @@ describe('withPostgres', () => {
 
     await expect(
       handler(new Request('http://localhost'), {
-        _runtime: runtime,
+        ...seedContext(),
         jwtClaims: { role: 'authenticated' },
       }),
     ).rejects.toThrow('boom')
@@ -151,7 +153,7 @@ describe('withPostgres', () => {
 
     await expect(
       handler(new Request('http://localhost'), {
-        _runtime: runtime,
+        ...seedContext(),
         jwtClaims: { role: 'authenticated' },
       }),
     ).rejects.toThrow(

src/middleware/postgres/index.test.ts

@@ -1,4 +1,4 @@
-import { defineMiddleware } from '@supabase/web-middleware'
+import { defineMiddleware, getEnv } from '@supabase/middleware'
 import pg from 'pg'
 
 const { Pool } = pg
@@ -41,7 +41,7 @@ export interface PostgresApi {
  * @category Middleware
  */
 export interface WithPostgresConfig {
-  /** Defaults to `ctx._runtime.getEnv('SUPABASE_DB_URL')`. */
+  /** Defaults to `getEnv('SUPABASE_DB_URL')` (from `@supabase/middleware`). */
   connectionString?: string
 }
 
@@ -90,7 +90,7 @@ export const withPostgres = defineMiddleware<
   key: 'postgres',
   run: (config) => async (_req, ctx) => {
     const connectionString =
-      config?.connectionString ?? ctx._runtime.getEnv('SUPABASE_DB_URL')
+      config?.connectionString ?? getEnv('SUPABASE_DB_URL')
     if (!connectionString) {
       return Response.json({ error: 'no SUPABASE_DB_URL' }, { status: 500 })
     }

src/middleware/postgres/index.ts

@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { defineMiddleware } from '@supabase/web-middleware'
+import { defineMiddleware } from '@supabase/middleware'
 
 import { _resetAllowDeprecationWarned } from './core/utils/deprecation.js'
 import { withSupabase } from './with-supabase.js'

src/with-supabase.test.ts

@@ -1,16 +1,17 @@
 import { addCorsHeaders, buildCorsHeaders, isCorsDisabled } from './cors.js'
 import { createSupabaseContext } from './create-supabase-context.js'
 import type { SupabaseContext, WithSupabaseConfig } from './types.js'
-import type { Entry } from '@supabase/web-middleware'
+import { seedContext } from '@supabase/middleware'
+import type { Entry } from '@supabase/middleware'
 
 type AnyEntry = Entry<string, object, unknown>
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 type AnyHandler = (req: Request, ctx: any) => Promise<Response>
 
 /**
  * Accumulate the ctx contributions of a middleware tuple — same logic as
- * `pipeline`'s internal `Accumulate`, seeded from `object` (no `BaseContext`
- * or `_runtime` in the visible ctx type; see implementation note below).
+ * `pipeline`'s internal `Accumulate`, seeded from `object` (the engine reserves
+ * no ctx keys; see implementation note below).
  */
 type MiddlewareCtx<Entries extends readonly AnyEntry[]> =
   Entries extends readonly [
@@ -55,7 +56,7 @@ export function withSupabase<Database = unknown>(
 
 /**
  * Variant that accepts a `middleware` array — each `withFoo(config)` call
- * returns an `Entry` from `@supabase/web-middleware`. Middleware run **after**
+ * returns an `Entry` from `@supabase/middleware`. Middleware run **after**
  * the Supabase context is established; they receive `ctx.supabase`,
  * `ctx.userClaims`, etc. already present and contribute their own typed keys
  * on top. (This is the server leg of a Plugin: the package's middleware goes
@@ -86,7 +87,7 @@ export function withSupabase<Database = unknown>(
  * (the Supabase context is merged before the middleware run) but not at the
  * type level — a full implementation would widen the prerequisite-validation
  * seed to include `SupabaseContext`. Ordering and collision checks within the
- * middleware array work normally via `web-middleware`'s runtime chain.
+ * middleware array work normally via `@supabase/middleware`'s runtime chain.
  */
 export function withSupabase<
   Database = unknown,
@@ -135,19 +136,10 @@ export function withSupabase<Database = unknown>(
       const composed = (
         config.middleware as readonly AnyEntry[]
       ).reduceRight<AnyHandler>((h, entry) => entry(h), handler)
-      // Seed _runtime so web-middleware entries recognise this as an upstream
-      // context (isContext() checks for _runtime.getEnv). Falls through to
-      // process.env; a full implementation would bridge to SupabaseEnv.
-      const g = globalThis as {
-        process?: { env?: Record<string, string | undefined> }
-      }
-      response = await composed(req, {
-        ...ctx,
-        _runtime: {
-          name: 'unknown' as const,
-          getEnv: (key: string): string | undefined => g.process?.env?.[key],
-        },
-      })
+      // seedContext() stamps the engine's context marker so middleware entries
+      // recognise this as an upstream context. Env access happens through the
+      // engine's importable getEnv — no per-ctx facet to bridge.
+      response = await composed(req, { ...seedContext(), ...ctx })
     } else {
       response = await handler(req, ctx as object)
     }