supabase-server

Use when planning or writing server-side code that uses @supabase/server — Edge Functions, Hono apps, webhook handlers, or any backend that creates Supabase clients or validates inbound auth. Trigger before writing or modifying any file that imports from @supabase/server (or sub-paths like @supabase/server/core); calls withSupabase, createSupabaseContext, createAdminClient, createContextClient, verifyAuth, verifyCredentials, or extractCredentials; configures an auth: mode ('none' | 'publishable' | 'secret' | 'user', or keyed variants like 'secret:*'); or lives under supabase/functions/ and authenticates an inbound request. Also trigger during planning — if a plan mentions any of the above, load the skill before drafting code; do not extrapolate auth: values or auth modes from neighboring functions. Also trigger when you see legacy patterns to migrate to this package — Deno.serve, createClient(Deno.env.get('SUPABASE_URL')), imports from esm.sh/@supabase or deno.land/std, usage of SUPABASE_ANON_KEY / SUPABASE_SERVICE_ROLE_KEY, or the deprecated allow: config option / removed 'always' / 'public' mode values / removed authType field.