// Server-only — never import this in client components.
//
// The privileged ("service-role") Supabase client. This client bypasses
// Row-Level Security and must only be reached from trusted server paths
// (owner API routes, provisioning, email notifications, admin tooling).
//
// The env-reading and validation are delegated to `./privileged-env` so
// there is exactly one place in the repository where
// `SUPABASE_SERVICE_ROLE_KEY` is loaded. See
// `docs/security/service-role-key-rotation.md` for rotation procedure.

import { createClient as createSupabaseClient } from '@supabase/supabase-js'
import { requirePrivilegedSupabaseEnv } from './privileged-env'

export function createAdminClient() {
  const { url, serviceRoleKey } = requirePrivilegedSupabaseEnv()

  return createSupabaseClient(url, serviceRoleKey, {
    auth: {
      autoRefreshToken: false,
      persistSession: false,
    },
  })
}