createClient() called inside a request handler — avoids connection reuse

What it is

createClient() is called inside a request handler, so a new Supabase client is constructed on every request.

Why it matters

Each client brings its own transport, so connections are not reused between requests. Under load this exhausts ephemeral ports and adds setup latency to every call.

How to fix it

Hold the anon or service-role client at module scope, where it carries no per-user state. A client that carries a user session must NOT be shared: mutating one module-scope client with setSession() per request lets concurrent requests observe each other's session. Build that one per request — the cost is the client object, not a connection — or memoise it per request with a request-scoped cache.