Server: SupabaseEnv

Resolved Supabase environment configuration.

Holds the project URL, API keys, and JWKS needed by every other primitive. Typically resolved automatically from environment variables by core.resolveEnv, but can be passed explicitly via the env option.

Parameters

• url

  (Required)

  Supabase project URL (e.g. `"https://.supabase.co"`). Sourced from `SUPABASE_URL`.

• publishableKeys

  (Required)

  Named publishable keys. Sourced from `SUPABASE_PUBLISHABLE_KEYS` (JSON object) or `SUPABASE_PUBLISHABLE_KEY` (single key, stored as `{ default: "" }`).

• secretKeys

  (Required)

  Named secret keys. Sourced from `SUPABASE_SECRET_KEYS` (JSON object) or `SUPABASE_SECRET_KEY` (single key, stored as `{ default: "" }`).

• jwks

  (Required)

  JWKS source used for JWT verification. Sourced from one of (in priority order): - `SUPABASE_JWKS` — inline JSON. Resolves to a `JSONWebKeySet`. - `SUPABASE_JWKS_URL` — remote endpoint. Resolves to a `URL`; keys are fetched lazily and cached in memory (cooldown / max-age handled by `jose`). `https://` is always accepted; plain `http://` is accepted only for loopback hosts (`localhost`, `127.0.0.0/8`, `::1`) to support the Supabase CLI. Any other `http://` URL is rejected to prevent MITM swap-in of a forged signing key. `null` when no JWKS is configured (JWT verification will be unavailable). Each env var is authoritative when set: a malformed value resolves to `null` rather than falling through to the other variable.