fix(cookies): keep domain-scoped deletion in name-keyed cookie stores

[thribhuvan003]

since #240 added the host-only also-clear, removeItem, the setItem chunk cleanup and applyServerStorage emit two entries for the same cookie name when a domain is configured — the domain clear first, then the host-only one. next.js backs its cookie store with a map keyed by name only (ResponseCookies from @edge-runtime/cookies), so the second host-only entry (no Domain) overwrites the first and only that reaches the browser. browsers match cookies by (name, domain, path), so the domain-scoped session cookie the library itself set never gets deleted and signOut() leaves the session stuck for any project that sets cookieOptions.domain.

this flips the order so the host-only clear comes first and the domain clear last. name-keyed stores keep the domain deletion (the one that matches what we set) and only drop the best-effort host-only cleanup; adapters that emit a Set-Cookie per entry still get both. no behaviour change when no domain is configured.

the tests added in #240 asserted the payload order, so they passed even though the collapse happens one layer down in the cookie store — i added a test that runs removeItem through a name-keyed store and checks the surviving deletion still carries the domain (fails on the old order), and updated the three existing order assertions to match.

fixes #256

[mandarini]

Hi @thribhuvan003, thank you so much for contributing to Supabase! 💚

This is a great catch and a great fix. I went and pulled the actual @edge-runtime/cookies source that Next.js ships to confirm the root cause myself, and you are exactly right: ResponseCookies stores everything in a Map keyed only by cookie name, so the later set() call always wins. Reordering so the host-only clear goes first and the domain clear goes last is the right call, and it is nice that it needs no change at all when no domain is configured.

One thing I would like to see before merging: the new describe("name-keyed cookie store (Next.js ResponseCookies semantics)") test is a really good idea, but it calls createStorageFromOptions(..., false) and exercises storage.removeItem, which is the browser storage path. createServerClient, which is what actually powers signOut() in Next.js Route Handlers and Server Actions (the exact scenario in #256), goes through applyServerStorage instead. Would you be up for adding an equivalent name-keyed-store simulation test that runs through applyServerStorage? The existing applyServerStorage test still only checks the emitted order, so it would not catch a regression in the map-collapse behavior specifically for that path the way your new test does for removeItem.

Everything else here looks solid to me, the reorder is applied consistently across all three sites and I did not find any interaction with the dedup logic from #246.

Thank you again for digging into this and fixing it properly rather than just papering over the symptom, it makes a real difference for anyone running cookieOptions.domain in production.

[mandarini]

Read my comment above please! THank you!

[thribhuvan003]

thanks for the thorough review @mandarini, and for pulling the edge-runtime source to double check it! 💚

good call on the server path — added a test that runs the same name-keyed map through applyServerStorage (the signOut route-handler path from #256). it does catch the collapse specifically: on the old ordering it fails with the domain deletion getting overwritten (expected undefined to be '.example.com'), and passes with the reorder. full suite still green.