{"version":3,"sources":["jsdelivr-header.js","/npm/@supabase/supabase-js@2.116.0/src/lib/tracingRegistry.ts","/npm/@supabase/supabase-js@2.116.0/src/lib/version.ts","/npm/@supabase/supabase-js@2.116.0/src/lib/constants.ts","/npm/shared/tracing/dist/module/parse.js","/npm/shared/tracing/dist/module/validate.js","/npm/shared/tracing/dist/module/defaults.js","/npm/@supabase/supabase-js@2.116.0/src/lib/fetch.ts","/npm/@supabase/supabase-js@2.116.0/src/lib/helpers.ts","/npm/@supabase/supabase-js@2.116.0/src/lib/SupabaseAuthClient.ts","/npm/@supabase/supabase-js@2.116.0/src/SupabaseClient.ts","/npm/@supabase/supabase-js@2.116.0/src/index.ts"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA,+wBCQA,MAAM,EAAgB,OAAO,IAAI,6CAAA,EAgBjC,SAAgB,GAA8D,CAC5E,OAAQ,WAA6B,CAAA,ECzBvC,MAAa,EAAU,UCDvB,IAAI,EAAS,GACT,EAEJ,GAAI,OAAO,KAAS,IAAa,OAC/B,EAAS,OAET,GAAA,EAAqB,KAAK,WAAA,MAAA,IAAA,OAAA,OAAA,EAAS,aAC1B,OAAO,SAAa,IAC7B,EAAS,cACA,OAAO,UAAc,KAAe,UAAU,UAAY,cACnE,EAAS,mBACJ,OACL,EAAS,OACT,MAAM,EAAY,WAAmB,QACrC,EAAA,GAAA,OAAA,EAAqB,EAAW,WAAA,MAAA,IAAA,OAAA,OAAA,EAAY,QAAQ,KAAM,EAAA,EAG5D,MAAM,EAAe,CAAC,WAAW,CAAA,EAAA,EAC7B,GACF,EAAa,KAAK,mBAAmB,CAAA,EAAA,EAGvC,MAAa,EAAkB,CAC7B,gBAAiB,eAAe,CAAA,KAAY,EAAa,KAAK,IAAA,CAAK,EAAA,EAGxD,EAAyB,CACpC,QAAS,CAAA,EAGE,EAAqB,CAChC,OAAQ,QAAA,EAGG,EAAkD,CAC7D,iBAAkB,GAClB,eAAgB,GAChB,mBAAoB,GACpB,SAAU,UACX,EAEY,EAAkD,CAAA,EAElD,EAA6D,CACxE,QAAS,GACT,wBAAyB,EAC1B,ECvBD,SAAgB,EAAiB,EAAa,CAC1C,GAAI,CAAC,GAAe,OAAO,GAAgB,SACvC,OAAO,KAGX,MAAM,EAAQ,EAAY,MAAM,GAAA,EAEhC,GAAI,EAAM,SAAW,EACjB,OAAO,KAEX,KAAM,CAAC,EAAS,EAAS,EAAU,CAAA,EAAc,EAEjD,GAAI,EAAQ,SAAW,GACnB,EAAQ,SAAW,IACnB,EAAS,SAAW,IACpB,EAAW,SAAW,EACtB,OAAO,KAGX,MAAM,EAAW,eAQjB,MAPI,CAAC,EAAS,KAAK,CAAA,GACf,CAAC,EAAS,KAAK,CAAA,GACf,CAAC,EAAS,KAAK,CAAA,GACf,CAAC,EAAS,KAAK,CAAA,GAIf,IAAY,oCAAsC,IAAa,mBACxD,KAKJ,CACH,QAAA,EACA,QAAA,EACA,SAAA,EACA,WAAA,EACA,WAPU,SAAS,EAAY,EAAA,EACR,KAAU,CAOpC,ECtCL,SAAgB,EAAwB,EAAW,EAAS,CACxD,GAAI,CAAC,GAAa,CAAC,GAAW,EAAQ,SAAW,EAC7C,MAAO,GAEX,IAAI,EACJ,GAAI,aAAqB,IACrB,EAAM,MAGN,IAAI,CACA,EAAM,IAAI,IAAI,CAAA,OAEJ,CAEV,MAAO,GAIf,UAAW,KAAU,EACjB,GAAI,CACA,GAAI,OAAO,GAAW,UAEd,GAAA,EAAkB,EAAI,SAAU,CAAA,EAChC,MAAO,WAGN,aAAkB,QAEnB,GAAA,EAAO,KAAK,EAAI,QAAA,EAChB,MAAO,WAGN,OAAO,GAAW,YAEnB,EAAO,CAAA,EACP,MAAO,QAIL,CAEV,SAGR,MAAO,GASX,SAAS,EAAkB,EAAU,EAAQ,CAEzC,GAAI,IAAW,EACX,MAAO,GAGX,GAAI,EAAO,WAAW,IAAA,EAAO,CACzB,MAAM,EAAS,EAAO,MAAM,CAAA,EAE5B,GAAI,EAAS,SAAS,CAAA,IAGd,IAAa,GAAU,EAAS,SAAS,IAAM,CAAA,GAC/C,MAAO,GAInB,MAAO,GCtFX,SAAgB,EAA6B,EAAa,CACtD,MAAM,EAAU,CAAA,EAEhB,GAAI,CACA,MAAM,EAAM,IAAI,IAAI,CAAA,EACpB,EAAQ,KAAK,EAAI,QAAA,OAEP,CAAA,CAKd,OAAA,EAAQ,KAAK,gBAAiB,eAAA,EAE9B,EAAQ,KAAK,YAAa,YAAa,OAAA,EAChC,4uCChBX,MAAa,GAAgB,GACvB,EACF,IAAW,IAA4B,EAAY,GAAG,CAAA,EAExD,IAAW,IAA4B,MAAM,GAAG,CAAA,EAGrC,GAAA,IACJ,QASH,EAAe,GACnB,EAAI,WAAW,iBAAA,GAAsB,EAAI,WAAW,YAAA,EAEhD,GAAkB,WAElB,EAAoB,IAAI,IAOjB,GAAqB,GAAsB,SACtD,GAAI,CAAC,EAAI,WAAW,KAAA,GAAU,EAAY,CAAA,GAAQ,EAAI,WAAW,EAAA,EAC/D,OAEF,MAAM,GAAA,GAAA,EAAU,EAAI,MAAM,mBAAA,KAAoB,MAAA,IAAA,OAAA,OAAA,EAAG,CAAA,KAAA,MAAA,IAAA,OAAA,EAAM,UACnD,EAAkB,IAAI,CAAA,IAG1B,EAAkB,IAAI,CAAA,EACtB,QAAQ,KACN,0OAAA,IAMS,EAAA,CACX,EACA,EACA,EACA,EACA,EACA,IACU,CACV,MAAM,EAAQ,GAAa,CAAA,EACrB,EAAqB,GAAA,EAIrB,EAAe,GAAyB,UAAY,GACpD,EAAkB,GAAyB,0BAA4B,GACvE,EAAgD,EAClD,EAA6B,CAAA,EAC7B,KAKE,EAAmB,EAAE,GAAS,oBAAsB,EAAY,CAAA,GAEtE,MAAO,OAAO,EAAO,IAAS,CAC5B,MAAM,EAAY,MAAM,EAAA,EACxB,IAAI,EAAU,IAAI,EAAmB,GAAM,OAAA,EAM3C,GAJK,EAAQ,IAAI,QAAA,GACf,EAAQ,IAAI,SAAU,CAAA,EAGpB,CAAC,EAAQ,IAAI,eAAA,EAAkB,CACjC,MAAM,EAAS,IAAc,EAAmB,EAAc,MAC1D,GACF,EAAQ,IAAI,gBAAiB,UAAU,CAAA,EAAA,EAI3C,GAAI,EAAc,CAChB,MAAM,EAAe,GAAgB,EAAO,EAAc,CAAA,EAEtD,IACE,EAAa,aAAe,CAAC,EAAQ,IAAI,aAAA,GAC3C,EAAQ,IAAI,cAAe,EAAa,WAAA,EAEtC,EAAa,YAAc,CAAC,EAAQ,IAAI,YAAA,GAC1C,EAAQ,IAAI,aAAc,EAAa,UAAA,EAErC,EAAa,SAAW,CAAC,EAAQ,IAAI,SAAA,GACvC,EAAQ,IAAI,UAAW,EAAa,OAAA,GAK1C,OAAO,EAAM,EAAA,EAAA,EAAA,CAAA,EAAY,CAAA,EAAA,CAAA,EAAA,CAAM,QAAA,CAAA,CAAA,CAAA,IAInC,IAAI,EAA8B,GAC9B,EAAyB,GAoB7B,SAAS,GACP,EACA,EACA,EACqB,CAOrB,MAAM,EAAsB,EAAA,EAE5B,GAAI,CAAC,EACH,OAAK,IACH,EAA8B,GAC9B,QAAQ,KACN,+TAAA,GAMG,KAMT,GAAI,CAAC,EAFH,OAAO,GAAU,UAAmB,aAAiB,IAAzB,EAAuC,EAAM,IAEnC,CAAA,EACtC,OAAO,KAGT,MAAM,EAAe,EAAA,EAErB,GAAI,CAAC,GAAgB,CAAC,EAAa,YAAa,OAM9C,GAAA,EAAA,GAAA,OAAA,EAAI,EAAc,eAAA,MAAA,IAAA,SAAA,EAAa,QAAU,CAAC,EAAwB,CAChE,EAAyB,GACzB,MAAM,EAAa,EAAa,YAAY,SAAS,cAAA,EACjD,kFACA,8EACJ,QAAQ,KACN,6GACuB,EAAa,YAAY,KAAK,IAAA,CAAK,0EAExD,CAAA,EAGN,OAAO,KAGT,GAAI,EAAiB,CACnB,MAAM,EAAS,EAAiB,EAAa,WAAA,EAC7C,GAAI,GAAU,CAAC,EAAO,UAAA,MAKb,CAAE,YAAa,EAAa,WAAA,EAIvC,OAAO,ECzMT,SAAS,EACP,EACqC,CACrC,OAAO,OAAO,GAAU,UAAY,CAAE,QAAS,CAAA,EAAU,EAW3D,SAAgB,GAAoB,EAAqB,CACvD,OAAO,EAAI,SAAS,GAAA,EAAO,EAAM,EAAM,IAKzC,IAAI,EAAuB,GAU3B,SAAgB,GAA0B,EAAwB,CAC5D,GAIF,OAAO,GAAY,UACnB,IAAY,MACZ,EAAE,WAAY,IACb,EAAiC,SAAW,SAI/C,EAAuB,GACvB,QAAQ,KACN,0MAAA,GAsBJ,SAAgB,GAMd,EACA,EAC2C,iBAC3C,KAAM,CACJ,GAAI,EACJ,KAAM,EACN,SAAU,EACV,OAAQ,CAAA,EACN,EACE,CACJ,GAAI,EACJ,KAAM,EACN,SAAU,EACV,OAAQ,CAAA,EACN,EAGE,EAA0B,EAA0B,EAAQ,gBAAA,EAC5D,EAAoC,EAA0B,EAAS,gBAAA,EAEvE,EAAoD,CACxD,GAAA,EAAA,EAAA,CAAA,EACK,CAAA,EACA,CAAA,EAEL,KAAA,EAAA,EAAA,CAAA,EACK,CAAA,EACA,CAAA,EAEL,SAAA,EAAA,EAAA,CAAA,EACK,CAAA,EACA,CAAA,EAEL,QAAS,CAAA,EACT,OAAA,EAAA,EAAA,EAAA,CAAA,EACK,CAAA,EACA,CAAA,EAAA,CAAA,EAAA,CACH,QAAA,EAAA,EAAA,CAAA,GAAA,EACM,GAAwB,WAAA,MAAA,IAAA,OAAA,EAAW,CAAA,CAAE,GAAA,EACrC,GAAe,WAAA,MAAA,IAAA,OAAA,EAAW,CAAA,CAAE,CAAA,CAAA,EAGpC,iBAAkB,CAChB,SAAA,GAAA,EACE,GAAyB,WAAA,MAAA,IAAA,OAAA,EAAW,GAAmC,WAAA,MAAA,IAAA,OAAA,EAAW,GACpF,yBAAA,GAAA,EACE,GAAyB,2BAAA,MAAA,IAAA,OAAA,EACzB,GAAmC,2BAAA,MAAA,IAAA,OAAA,EACnC,EACH,EACD,YAAa,SAAY,EAC1B,EAED,OAAI,EAAQ,YACV,EAAO,YAAc,EAAQ,YAG7B,OAAQ,EAAe,YAGlB,EAUT,SAAgB,GAAoB,EAA0B,CAC5D,MAAM,EAAa,GAAa,KAAA,EAEhC,GAAI,CAAC,EACH,MAAM,IAAI,MAAM,0BAAA,EAGlB,GAAI,CAAC,EAAW,MAAM,eAAA,EACpB,MAAM,IAAI,MAAM,yDAAA,EAGlB,GAAI,CACF,OAAO,IAAI,IAAI,GAAoB,CAAA,CAAW,CACxC,MAAA,CACN,MAAM,MAAM,iDAAA,GC5JhB,IAAa,GAAb,cAAwC,CAAW,CACjD,YAAY,EAAoC,CAC9C,MAAM,CAAA,ICwCW,EAArB,KA+BE,CA+OA,YACE,EACA,EACA,EACA,SAHU,KAAA,YAAA,EACA,KAAA,YAAA,EAGV,MAAM,EAAU,GAAoB,CAAA,EACpC,GAAI,CAAC,EAAa,MAAM,IAAI,MAAM,0BAAA,EAClC,GAAkB,CAAA,EAClB,GAA0B,CAAA,EAE1B,KAAK,YAAc,IAAI,IAAI,cAAe,CAAA,EAC1C,KAAK,YAAY,SAAW,KAAK,YAAY,SAAS,QAAQ,OAAQ,IAAA,EACtE,KAAK,QAAU,IAAI,IAAI,UAAW,CAAA,EAClC,KAAK,WAAa,IAAI,IAAI,aAAc,CAAA,EACxC,KAAK,aAAe,IAAI,IAAI,eAAgB,CAAA,EAG5C,MAAM,EAAoB,MAAM,EAAQ,SAAS,MAAM,GAAA,EAAK,CAAA,CAAA,cACtD,EAAW,CACf,GAAI,EACJ,SAAU,EACV,KAAA,EAAA,EAAA,CAAA,EAAW,CAAA,EAAA,CAAA,EAAA,CAAsB,WAAY,CAAA,CAAA,EAC7C,OAAQ,EACR,iBAAkB,CACnB,EAEK,EAAW,GAAqB,GAAW,CAAA,EAAI,CAAA,EAMrD,GALA,KAAK,SAAW,EAEhB,KAAK,YAAA,EAAa,EAAS,KAAK,cAAA,MAAA,IAAA,OAAA,EAAc,GAC9C,KAAK,SAAA,EAAU,EAAS,OAAO,WAAA,MAAA,IAAA,OAAA,EAAW,CAAA,EAErC,EAAS,YAOZ,KAAK,YAAc,EAAS,YAE5B,KAAK,KAAO,IAAI,MAA0B,CAAA,EAAW,CACnD,IAAA,CAAM,EAAG,IAAS,CAChB,MAAM,IAAI,MACR,6GAA6G,OAC3G,CAAA,CACD,kBAAC,GAGP,MAjBwB,OACzB,KAAK,KAAO,KAAK,yBAAA,EACf,EAAS,QAAA,MAAA,IAAA,OAAA,EAAQ,CAAA,EACjB,KAAK,QACL,EAAS,OAAO,KAAA,CAEb,CAgBP,KAAK,MAAQ,EACX,EACA,EACA,KAAK,iBAAiB,KAAK,IAAA,EAC3B,EAAS,OAAO,MAChB,EAAS,gBAAA,EAIX,KAAK,eAAiB,EACpB,EACA,EACA,KAAK,iBAAiB,KAAK,IAAA,EAC3B,EAAS,OAAO,MAChB,EAAS,iBACT,CAAE,mBAAoB,EAAA,CAAM,EAE9B,KAAK,SAAW,KAAK,oBAAA,EAAA,CACnB,QAAS,KAAK,QACd,YAAa,KAAK,gBAAgB,KAAK,IAAA,EACvC,MAAO,KAAK,KACT,EAAA,EAAS,QAAA,CAAA,EAEV,KAAK,aAGP,QAAQ,QAAQ,KAAK,YAAA,CAAa,EAC/B,KAAM,GAAU,KAAK,SAAS,QAAQ,CAAA,CAAM,EAC5C,MAAO,GAAM,QAAQ,KAAK,6CAA8C,CAAA,CAAE,EAG/E,KAAK,KAAO,IAAI,EAAgB,IAAI,IAAI,UAAW,CAAA,EAAS,KAAM,CAChE,QAAS,KAAK,QACd,OAAQ,EAAS,GAAG,OACpB,MAAO,KAAK,MACZ,QAAS,EAAS,GAAG,QACrB,eAAgB,EAAS,GAAG,eAC5B,MAAO,EAAS,GAAG,MACpB,EAED,KAAK,QAAU,IAAI,EACjB,KAAK,WAAW,KAChB,KAAK,QACL,KAAK,MACL,GAAS,OAAA,EAGN,EAAS,aACZ,KAAK,qBAAA,EAOT,IAAI,WAA6B,CAC/B,OAAO,IAAI,EAAgB,KAAK,aAAa,KAAM,CACjD,QAAS,KAAK,QACd,YAAa,KAAK,eACnB,EAgBH,KAAK,EAAqE,CACxE,OAAO,KAAK,KAAK,KAAK,CAAA,EAWxB,OACE,EAMA,CACA,OAAO,KAAK,KAAK,OAAsB,CAAA,EAkBzC,gBAAyE,CACvE,OAAO,KAAK,KAAK,eAAA,EA2BnB,IAME,EACA,EAAa,CAAA,EACb,EAII,CACF,KAAM,GACN,IAAK,GACL,MAAO,QAUT,CACA,OAAO,KAAK,KAAK,IAAI,EAAI,EAAM,CAAA,EAmBjC,QAAQ,EAAc,EAA+B,CAAE,OAAQ,CAAA,CAAE,EAAqB,CACpF,OAAO,KAAK,SAAS,QAAQ,EAAM,CAAA,EAarC,aAAiC,CAC/B,OAAO,KAAK,SAAS,YAAA,EAmBvB,cAAc,EAAkE,CAC9E,OAAO,KAAK,SAAS,cAAc,CAAA,EAgBrC,mBAA8D,CAC5D,OAAO,KAAK,SAAS,kBAAA,EAQvB,MAAc,kBAA2C,gBACvD,GAAI,EAAK,YACP,OAAO,MAAM,EAAK,YAAA,EAGpB,KAAM,CAAE,KAAA,CAAA,EAAS,MAAM,EAAK,KAAK,WAAA,EAEjC,OAAA,GAAA,EAAO,EAAK,WAAA,MAAA,IAAA,OAAA,OAAA,EAAS,gBAAA,MAAA,IAAA,OAAA,EAAgB,KAGvC,MAAc,iBAAkB,cAC9B,OAAA,EAAQ,MAAM,EAAK,iBAAA,KAAkB,MAAA,IAAA,OAAA,EAAK,EAAK,YAGzC,wBACN,CACE,iBAAA,EACA,eAAA,EACA,mBAAA,EACA,QAAA,EACA,YAAA,EACA,WAAA,EACA,SAAA,EACA,KAAA,EACA,MAAA,EACA,aAAA,EACA,aAAA,EACA,mBAAA,EACA,mBAAA,CAAA,EAEF,EACA,EACA,CACA,MAAM,EAAc,CAClB,cAAe,UAAU,KAAK,WAAA,GAC9B,OAAQ,GAAG,KAAK,WAAA,EACjB,EACD,OAAO,IAAI,GAAmB,CAC5B,IAAK,KAAK,QAAQ,KAClB,QAAA,EAAA,EAAA,CAAA,EAAc,CAAA,EAAgB,CAAA,EAClB,WAAA,EACZ,iBAAA,EACA,eAAA,EACA,mBAAA,EACA,QAAA,EACA,YAAA,EACA,SAAA,EACA,KAAA,EACA,MAAA,EACA,aAAA,EACA,aAAA,EACA,MAAA,EACA,mBAAA,EACA,mBAAA,EAGA,6BAA8B,OAAO,KAAK,KAAK,OAAA,EAAS,KACrD,GAAQ,EAAI,YAAA,IAAkB,eAAA,EAElC,EAGK,oBAAoB,EAAgC,CAC1D,OAAO,IAAI,EAAe,KAAK,YAAY,KAAA,EAAA,EAAA,CAAA,EACtC,CAAA,EAAA,CAAA,EAAA,CACH,OAAA,EAAA,EAAA,CAAA,EAAa,CAAE,OAAQ,KAAK,WAAA,CAAa,EAAK,GAAS,MAAA,CAAA,CAAA,CAAA,EAInD,sBAAuB,CAI7B,OAHa,KAAK,KAAK,kBAAA,CAAmB,EAAO,IAAY,CAC3D,KAAK,oBAAoB,EAAO,SAAU,GAAS,YAAA,CACnD,CAAA,EAIJ,oBACE,EACA,EACA,EACA,EAEG,IAAU,mBAAqB,IAAU,aAAe,IAAU,oBACnE,KAAK,qBAAuB,GAE5B,KAAK,mBAAqB,EAC1B,KAAK,SAAS,QAAQ,CAAA,GACb,IAAU,eACnB,KAAK,SAAS,QAAA,EACV,GAAU,WAAW,KAAK,KAAK,QAAA,EACnC,KAAK,mBAAqB,UClpBhC,MAAa,GAAA,CAcX,EACA,EACA,IAEO,IAAI,EACT,EACA,EACA,CAAA,EAKJ,SAAS,IAAwC,CAE/C,GAAI,OAAO,OAAW,KAAgB,WAAmB,OAAY,OACnE,MAAO,GAKT,MAAM,EAAY,WAAmB,QACrC,GAAI,CAAC,EACH,MAAO,GAGT,MAAM,EAAiB,EAAS,QAChC,GAAoC,GAAmB,KACrD,MAAO,GAGT,MAAM,EAAe,EAAe,MAAM,WAAA,EAC1C,OAAK,EAIgB,SAAS,EAAa,CAAA,EAAI,EAAA,GACxB,GAJd,GAOP,GAAA,GACF,QAAQ,KACN,uPAAA","file":"/npm/@supabase/supabase-js@2.116.0/dist/index.mjs/+esm","sourceRoot":"","sourcesContent":["/**\n * Bundled by jsDelivr using Rollup v4.62.2 and esbuild v0.28.1.\n * Original file: /npm/@supabase/supabase-js@2.116.0/dist/index.mjs\n *\n * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files\n */\n","import type { TraceContextExtractor } from '@supabase/tracing'\n\nexport type { TraceContextExtractor }\n\n// The extractor lives in a `Symbol.for()`-keyed slot on `globalThis` rather\n// than a module-level variable. Bundlers and the ESM/CJS dual build can load\n// this module more than once in a single application (e.g. the tracing\n// subpath resolved to `dist/tracing.mjs` while the main entry resolves to\n// `dist/index.cjs`) — separate module instances would each get their own\n// variable, but they all share the global symbol registry.\n//\n// The symbol string is a de-facto stable contract: module-resolution tests\n// read the slot directly, and changing it orphans registrations from other\n// copies of this package in the same process.\nconst EXTRACTOR_KEY = Symbol.for('@supabase/supabase-js.traceContextExtractor')\n\ntype ExtractorSlot = { [EXTRACTOR_KEY]?: TraceContextExtractor }\n\n/**\n * Register the trace context extractor used by all Supabase clients in this\n * process. Called by the `@supabase/supabase-js/tracing` subpath as an import\n * side effect; the last registration wins.\n */\nexport function registerTraceContextExtractor(extractor: TraceContextExtractor): void {\n ;(globalThis as ExtractorSlot)[EXTRACTOR_KEY] = extractor\n}\n\n/**\n * The currently registered trace context extractor, if any.\n */\nexport function getTraceContextExtractor(): TraceContextExtractor | undefined {\n return (globalThis as ExtractorSlot)[EXTRACTOR_KEY]\n}\n\n/**\n * For tests only. Removes the registered extractor.\n *\n * @internal\n */\nexport function _unregisterTraceContextExtractor(): void {\n delete (globalThis as ExtractorSlot)[EXTRACTOR_KEY]\n}\n","// Generated automatically during releases by scripts/update-version-files.ts\n// This file provides runtime access to the package version for:\n// - HTTP request headers (e.g., X-Client-Info header for API requests)\n// - Debugging and support (identifying which version is running)\n// - Telemetry and logging (version reporting in errors/analytics)\n// - Ensuring build artifacts match the published package version\nexport const version = '2.116.0'\n","// constants.ts\nimport { RealtimeClientOptions } from '@supabase/realtime-js'\nimport { SupabaseAuthClientOptions, TracePropagationOptions } from './types'\nimport { version } from './version'\n\nlet JS_ENV = ''\nlet JS_RUNTIME_VERSION: string | undefined\n// @ts-ignore\nif (typeof Deno !== 'undefined') {\n JS_ENV = 'deno'\n // @ts-ignore\n JS_RUNTIME_VERSION = Deno.version?.deno\n} else if (typeof document !== 'undefined') {\n JS_ENV = 'web'\n} else if (typeof navigator !== 'undefined' && navigator.product === 'ReactNative') {\n JS_ENV = 'react-native'\n} else {\n JS_ENV = 'node'\n const _process = (globalThis as any)['process']\n JS_RUNTIME_VERSION = _process?.['version']?.replace(/^v/, '')\n}\n\nconst _runtimeMeta = [`runtime=${JS_ENV}`]\nif (JS_RUNTIME_VERSION) {\n _runtimeMeta.push(`runtime-version=${JS_RUNTIME_VERSION}`)\n}\n\nexport const DEFAULT_HEADERS = {\n 'X-Client-Info': `supabase-js/${version}; ${_runtimeMeta.join('; ')}`,\n}\n\nexport const DEFAULT_GLOBAL_OPTIONS = {\n headers: DEFAULT_HEADERS,\n}\n\nexport const DEFAULT_DB_OPTIONS = {\n schema: 'public',\n}\n\nexport const DEFAULT_AUTH_OPTIONS: SupabaseAuthClientOptions = {\n autoRefreshToken: true,\n persistSession: true,\n detectSessionInUrl: true,\n flowType: 'implicit',\n}\n\nexport const DEFAULT_REALTIME_OPTIONS: RealtimeClientOptions = {}\n\nexport const DEFAULT_TRACE_PROPAGATION_OPTIONS: TracePropagationOptions = {\n enabled: false,\n respectSamplingDecision: true,\n}\n","/**\n * Parse W3C traceparent header according to the specification.\n *\n * The traceparent header format is: version-traceid-parentid-traceflags\n * - version: 2 hex digits (currently always \"00\")\n * - traceid: 32 hex digits (128-bit trace identifier)\n * - parentid: 16 hex digits (64-bit span/parent identifier)\n * - traceflags: 2 hex digits (8-bit flags, bit 0 is sampled flag)\n *\n * @param traceparent - The traceparent header value\n * @returns Parsed traceparent object, or null if invalid format\n *\n * @see https://www.w3.org/TR/trace-context/#traceparent-header\n *\n * @example\n * ```typescript\n * const parsed = parseTraceParent('00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01')\n *\n * console.log(parsed)\n * // {\n * // version: '00',\n * // traceId: '0af7651916cd43dd8448eb211c80319c',\n * // parentId: 'b7ad6b7169203331',\n * // traceFlags: '01',\n * // isSampled: true\n * // }\n * ```\n */\nexport function parseTraceParent(traceparent) {\n if (!traceparent || typeof traceparent !== 'string') {\n return null;\n }\n // Split by hyphen\n const parts = traceparent.split('-');\n // Must have exactly 4 parts\n if (parts.length !== 4) {\n return null;\n }\n const [version, traceId, parentId, traceFlags] = parts;\n // Validate field lengths according to W3C spec\n if (version.length !== 2 ||\n traceId.length !== 32 ||\n parentId.length !== 16 ||\n traceFlags.length !== 2) {\n return null;\n }\n // Validate that all fields are valid hexadecimal\n const hexRegex = /^[0-9a-f]+$/i;\n if (!hexRegex.test(version) ||\n !hexRegex.test(traceId) ||\n !hexRegex.test(parentId) ||\n !hexRegex.test(traceFlags)) {\n return null;\n }\n // Validate that trace-id and parent-id are not all zeros (invalid per spec)\n if (traceId === '00000000000000000000000000000000' || parentId === '0000000000000000') {\n return null;\n }\n // Parse sampling decision from trace-flags (bit 0)\n const flags = parseInt(traceFlags, 16);\n const isSampled = (flags & 0x01) === 0x01;\n return {\n version,\n traceId,\n parentId,\n traceFlags,\n isSampled,\n };\n}\n//# sourceMappingURL=parse.js.map","/**\n * Check if trace context should be propagated to the target URL.\n *\n * This function checks if the target URL matches any of the configured\n * propagation targets. Targets can be:\n * - String: Exact hostname match or wildcard domain (*.example.com)\n * - RegExp: Pattern matching hostname\n * - Function: Custom logic to determine if URL should receive trace context\n *\n * @param targetUrl - The URL to check\n * @param targets - Array of propagation targets\n * @returns True if trace context should be propagated, false otherwise\n *\n * @example\n * ```typescript\n * const targets = [\n * 'myproject.supabase.co', // Exact match\n * '*.supabase.co', // Wildcard domain\n * /.*\\.supabase\\.co$/, // Regex pattern\n * (url) => url.hostname === 'localhost' // Custom function\n * ]\n *\n * shouldPropagateToTarget('https://myproject.supabase.co/rest/v1/table', targets)\n * // true\n *\n * shouldPropagateToTarget('https://evil.com/api', targets)\n * // false\n * ```\n */\nexport function shouldPropagateToTarget(targetUrl, targets) {\n if (!targetUrl || !targets || targets.length === 0) {\n return false;\n }\n let url;\n if (targetUrl instanceof URL) {\n url = targetUrl;\n }\n else {\n try {\n url = new URL(targetUrl);\n }\n catch (error) {\n // Invalid URL\n return false;\n }\n }\n // Check each target\n for (const target of targets) {\n try {\n if (typeof target === 'string') {\n // String matcher: exact match or wildcard domain\n if (matchStringTarget(url.hostname, target)) {\n return true;\n }\n }\n else if (target instanceof RegExp) {\n // Regex matcher\n if (target.test(url.hostname)) {\n return true;\n }\n }\n else if (typeof target === 'function') {\n // Function matcher\n if (target(url)) {\n return true;\n }\n }\n }\n catch (error) {\n // Ignore errors from individual matchers and continue\n continue;\n }\n }\n return false;\n}\n/**\n * Match hostname against string target (exact match or wildcard)\n *\n * @param hostname - The hostname to check\n * @param target - The target pattern (exact or wildcard)\n * @returns True if hostname matches target\n */\nfunction matchStringTarget(hostname, target) {\n // Exact match\n if (target === hostname) {\n return true;\n }\n // Wildcard domain match (*.example.com)\n if (target.startsWith('*.')) {\n const domain = target.slice(2); // Remove \"*.\"\n // Check if hostname ends with the domain\n if (hostname.endsWith(domain)) {\n // Ensure it's either an exact match or has a subdomain\n // (prevents \"notexample.com\" from matching \"*.example.com\")\n if (hostname === domain || hostname.endsWith('.' + domain)) {\n return true;\n }\n }\n }\n return false;\n}\n//# sourceMappingURL=validate.js.map","/**\n * Generate default propagation targets based on the Supabase project URL.\n *\n * By default, trace context is only propagated to Supabase domains for\n * security. This prevents leaking trace context to potentially malicious\n * third-party services.\n *\n * Wildcard strings (e.g. `*.supabase.co`) are matched with linear string\n * operations rather than regex, avoiding ReDoS risk.\n *\n * @param supabaseUrl - The Supabase project URL\n * @returns Array of default propagation targets\n */\nexport function getDefaultPropagationTargets(supabaseUrl) {\n const targets = [];\n // Add exact project hostname\n try {\n const url = new URL(supabaseUrl);\n targets.push(url.hostname);\n }\n catch (error) {\n // Invalid URL, skip exact hostname\n }\n // Supabase cloud domains. Use wildcard strings (not regex) — these are\n // matched by linear hostname-suffix checks, so there is no ReDoS surface.\n targets.push('*.supabase.co', '*.supabase.in');\n // Localhost and loopback addresses for local development.\n targets.push('localhost', '127.0.0.1', '[::1]');\n return targets;\n}\n//# sourceMappingURL=defaults.js.map","import {\n parseTraceParent,\n shouldPropagateToTarget,\n getDefaultPropagationTargets,\n type TraceContext,\n type TracePropagationTarget,\n} from '@supabase/tracing'\nimport { getTraceContextExtractor } from './tracingRegistry'\nimport type { TracePropagationOptions } from './types'\n\ntype Fetch = typeof fetch\n\nexport const resolveFetch = (customFetch?: Fetch): Fetch => {\n if (customFetch) {\n return (...args: Parameters) => customFetch(...args)\n }\n return (...args: Parameters) => fetch(...args)\n}\n\nexport const resolveHeadersConstructor = () => {\n return Headers\n}\n\n/**\n * New-format Supabase API keys (`sb_publishable_…` / `sb_secret_…`) are not JWTs and\n * must never be sent as a Bearer token — they belong only in the `apikey` header.\n * All other keys (legacy JWT keys, `sb_temp_…` temporary keys, unrecognized `sb_`\n * subtypes) keep the Bearer fallback.\n */\nconst isNewApiKey = (key: string): boolean =>\n key.startsWith('sb_publishable_') || key.startsWith('sb_secret_')\n\nconst TEMP_KEY_PREFIX = 'sb_temp_'\n\nconst warnedKeySubtypes = new Set()\n\n/**\n * Warn (once per subtype) when an `sb_` key isn't a subtype this SDK version recognizes.\n * Never throws — the server, not the SDK, decides key validity. The key value is never\n * included in the message.\n */\nexport const checkApiKeyFormat = (key: string): void => {\n if (!key.startsWith('sb_') || isNewApiKey(key) || key.startsWith(TEMP_KEY_PREFIX)) {\n return\n }\n const subtype = key.match(/^sb_[a-zA-Z0-9]+_/)?.[0] ?? 'unknown'\n if (warnedKeySubtypes.has(subtype)) {\n return\n }\n warnedKeySubtypes.add(subtype)\n console.warn(\n '@supabase/supabase-js: Unrecognized Supabase API key format. The client will proceed ' +\n 'and send this key as-is; if you see authentication errors you may need to upgrade ' +\n '@supabase/supabase-js to a version that recognizes this key type.'\n )\n}\n\nexport const fetchWithAuth = (\n supabaseKey: string,\n supabaseUrl: string,\n getAccessToken: () => Promise,\n customFetch?: Fetch,\n tracePropagationOptions?: TracePropagationOptions,\n options?: { omitApiKeyAsBearer?: boolean }\n): Fetch => {\n const fetch = resolveFetch(customFetch)\n const HeadersConstructor = resolveHeadersConstructor()\n\n // Pre-compute trace propagation state once. When disabled, the per-request\n // path skips all tracing work with a single truthy check.\n const traceEnabled = tracePropagationOptions?.enabled === true\n const respectSampling = tracePropagationOptions?.respectSamplingDecision !== false\n const traceTargets: TracePropagationTarget[] | null = traceEnabled\n ? getDefaultPropagationTargets(supabaseUrl)\n : null\n\n // Whether the API key may be used as the `Authorization` Bearer fallback when there is no\n // session token. Disabled for Edge Functions with a new-format key (see `isNewApiKey`).\n // Static per instance, so it is computed once here rather than on every request.\n const allowKeyAsBearer = !(options?.omitApiKeyAsBearer && isNewApiKey(supabaseKey))\n\n return async (input, init) => {\n const realToken = await getAccessToken()\n let headers = new HeadersConstructor(init?.headers)\n\n if (!headers.has('apikey')) {\n headers.set('apikey', supabaseKey)\n }\n\n if (!headers.has('Authorization')) {\n const bearer = realToken ?? (allowKeyAsBearer ? supabaseKey : null)\n if (bearer) {\n headers.set('Authorization', `Bearer ${bearer}`)\n }\n }\n\n if (traceTargets) {\n const traceHeaders = getTraceHeaders(input, traceTargets, respectSampling)\n\n if (traceHeaders) {\n if (traceHeaders.traceparent && !headers.has('traceparent')) {\n headers.set('traceparent', traceHeaders.traceparent)\n }\n if (traceHeaders.tracestate && !headers.has('tracestate')) {\n headers.set('tracestate', traceHeaders.tracestate)\n }\n if (traceHeaders.baggage && !headers.has('baggage')) {\n headers.set('baggage', traceHeaders.baggage)\n }\n }\n }\n\n return fetch(input, { ...init, headers })\n }\n}\n\nlet warnedMissingTracingRuntime = false\nlet warnedNonW3CPropagator = false\n\n/**\n * For tests only. Resets the one-time missing-tracing-runtime warning.\n *\n * @internal\n */\nexport function _resetTracingRuntimeWarning(): void {\n warnedMissingTracingRuntime = false\n}\n\n/**\n * For tests only. Resets the one-time non-W3C-propagator warning.\n *\n * @internal\n */\nexport function _resetNonW3CPropagatorWarning(): void {\n warnedNonW3CPropagator = false\n}\n\nfunction getTraceHeaders(\n input: RequestInfo | URL,\n targets: TracePropagationTarget[],\n respectSampling: boolean\n): TraceContext | null {\n // Read the registry before the target check so the warning fires on the\n // first request with tracing enabled, not only on Supabase-target ones.\n // Reading per request (one globalThis property access) deliberately\n // supports late registration: with ESM evaluation order, `createClient`\n // can run in a module evaluated before the application entry point's\n // `import '@supabase/supabase-js/tracing'`.\n const extractTraceContext = getTraceContextExtractor()\n\n if (!extractTraceContext) {\n if (!warnedMissingTracingRuntime) {\n warnedMissingTracingRuntime = true\n console.warn(\n '@supabase/supabase-js: tracePropagation is enabled but the tracing runtime is not loaded, ' +\n \"so trace headers will not be attached. Add `import '@supabase/supabase-js/tracing'` at \" +\n 'your application entry point (requires the OpenTelemetry API package to be installed). ' +\n 'The CDN/UMD build does not support trace propagation.'\n )\n }\n return null\n }\n\n const targetUrl: string | URL =\n typeof input === 'string' ? input : input instanceof URL ? input : input.url\n\n if (!shouldPropagateToTarget(targetUrl, targets)) {\n return null\n }\n\n const traceContext = extractTraceContext()\n\n if (!traceContext || !traceContext.traceparent) {\n // An active propagator that writes vendor headers but no W3C\n // `traceparent` (e.g. Sentry without `propagateTraceparent: true`) is\n // otherwise indistinguishable from \"no active trace\" — warn once so the\n // user learns why no trace headers are attached. An empty carrier means\n // no active trace: normal, stay silent.\n if (traceContext?.carrierKeys?.length && !warnedNonW3CPropagator) {\n warnedNonW3CPropagator = true\n const sentryHint = traceContext.carrierKeys.includes('sentry-trace')\n ? ' Sentry detected: set `propagateTraceparent: true` in Sentry.init() to emit it.'\n : ' Configure your tracing SDK to emit W3C trace context on outgoing requests.'\n console.warn(\n '@supabase/supabase-js: tracePropagation is enabled and a tracing SDK is active, but its ' +\n `propagator wrote [${traceContext.carrierKeys.join(', ')}] and no W3C traceparent header, ` +\n 'so trace headers will not be attached.' +\n sentryHint\n )\n }\n return null\n }\n\n if (respectSampling) {\n const parsed = parseTraceParent(traceContext.traceparent)\n if (parsed && !parsed.isSampled) {\n // Unsampled traces still carry `traceparent` so Supabase logs get a\n // trace_id to correlate on; the flag stays `00`, so downstream tracing\n // never records it as sampled. `tracestate` and `baggage` (the\n // vendor/application data channels) are withheld on these requests.\n return { traceparent: traceContext.traceparent }\n }\n }\n\n return traceContext\n}\n","// helpers.ts\nimport { SupabaseClientOptions, TracePropagationOptions } from './types'\n\nfunction normalizeTracePropagation(\n value: TracePropagationOptions | boolean | undefined\n): TracePropagationOptions | undefined {\n return typeof value === 'boolean' ? { enabled: value } : value\n}\n\nexport function uuid() {\n return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function (c) {\n var r = (Math.random() * 16) | 0,\n v = c == 'x' ? r : (r & 0x3) | 0x8\n return v.toString(16)\n })\n}\n\nexport function ensureTrailingSlash(url: string): string {\n return url.endsWith('/') ? url : url + '/'\n}\n\nexport const isBrowser = () => typeof window !== 'undefined'\n\nlet warnedTopLevelSchema = false\n\n/**\n * Warn (once per process) when `schema` is passed at the top level of the client options\n * instead of under `db`. A top-level `schema` is not part of the options shape and is\n * ignored, so queries silently go to the default schema. Never throws.\n *\n * Only `undefined` counts as unset, matching `db.schema`, where any other value is sent\n * as the profile header.\n */\nexport function checkTopLevelSchemaOption(options: unknown): void {\n if (warnedTopLevelSchema) {\n return\n }\n if (\n typeof options !== 'object' ||\n options === null ||\n !('schema' in options) ||\n (options as { schema?: unknown }).schema === undefined\n ) {\n return\n }\n warnedTopLevelSchema = true\n console.warn(\n '@supabase/supabase-js: The \"schema\" option must be nested under \"db\", ' +\n \"e.g. createClient(url, key, { db: { schema: 'myschema' } }). \" +\n 'A top-level \"schema\" is ignored and queries go to the default schema.'\n )\n}\n\n/**\n * For tests only. Resets the one-time top-level `schema` warning.\n *\n * @internal\n */\nexport function _resetTopLevelSchemaWarning(): void {\n warnedTopLevelSchema = false\n}\n\nexport type ResolvedSupabaseClientOptions = Omit<\n Required>,\n 'tracePropagation'\n> & {\n tracePropagation: TracePropagationOptions\n}\n\nexport function applySettingDefaults<\n Database = any,\n SchemaName extends string & keyof Database = 'public' extends keyof Database\n ? 'public'\n : string & keyof Database,\n>(\n options: SupabaseClientOptions,\n defaults: SupabaseClientOptions\n): ResolvedSupabaseClientOptions {\n const {\n db: dbOptions,\n auth: authOptions,\n realtime: realtimeOptions,\n global: globalOptions,\n } = options\n const {\n db: DEFAULT_DB_OPTIONS,\n auth: DEFAULT_AUTH_OPTIONS,\n realtime: DEFAULT_REALTIME_OPTIONS,\n global: DEFAULT_GLOBAL_OPTIONS,\n } = defaults\n\n // Accept either a boolean shorthand or an options object on both sides.\n const tracePropagationOptions = normalizeTracePropagation(options.tracePropagation)\n const DEFAULT_TRACE_PROPAGATION_OPTIONS = normalizeTracePropagation(defaults.tracePropagation)\n\n const result: ResolvedSupabaseClientOptions = {\n db: {\n ...DEFAULT_DB_OPTIONS,\n ...dbOptions,\n },\n auth: {\n ...DEFAULT_AUTH_OPTIONS,\n ...authOptions,\n },\n realtime: {\n ...DEFAULT_REALTIME_OPTIONS,\n ...realtimeOptions,\n },\n storage: {},\n global: {\n ...DEFAULT_GLOBAL_OPTIONS,\n ...globalOptions,\n headers: {\n ...(DEFAULT_GLOBAL_OPTIONS?.headers ?? {}),\n ...(globalOptions?.headers ?? {}),\n },\n },\n tracePropagation: {\n enabled:\n tracePropagationOptions?.enabled ?? DEFAULT_TRACE_PROPAGATION_OPTIONS?.enabled ?? false,\n respectSamplingDecision:\n tracePropagationOptions?.respectSamplingDecision ??\n DEFAULT_TRACE_PROPAGATION_OPTIONS?.respectSamplingDecision ??\n true,\n },\n accessToken: async () => '',\n }\n\n if (options.accessToken) {\n result.accessToken = options.accessToken\n } else {\n // hack around Required<>\n delete (result as any).accessToken\n }\n\n return result\n}\n\n/**\n * Validates a Supabase client URL\n *\n * @param {string} supabaseUrl - The Supabase client URL string.\n * @returns {URL} - The validated base URL.\n * @throws {Error}\n */\nexport function validateSupabaseUrl(supabaseUrl: string): URL {\n const trimmedUrl = supabaseUrl?.trim()\n\n if (!trimmedUrl) {\n throw new Error('supabaseUrl is required.')\n }\n\n if (!trimmedUrl.match(/^https?:\\/\\//i)) {\n throw new Error('Invalid supabaseUrl: Must be a valid HTTP or HTTPS URL.')\n }\n\n try {\n return new URL(ensureTrailingSlash(trimmedUrl))\n } catch {\n throw Error('Invalid supabaseUrl: Provided URL is malformed.')\n }\n}\n","import { AuthClient } from '@supabase/auth-js'\nimport { SupabaseAuthClientOptions } from './types'\n\nexport class SupabaseAuthClient extends AuthClient {\n constructor(options: SupabaseAuthClientOptions) {\n super(options)\n }\n}\n","import type { AuthChangeEvent } from '@supabase/auth-js'\nimport { FunctionsClient } from '@supabase/functions-js'\nimport {\n PostgrestClient,\n type PostgrestFilterBuilder,\n type PostgrestOpenApiSpec,\n type PostgrestQueryBuilder,\n type PostgrestSingleResponse,\n} from '@supabase/postgrest-js'\nimport {\n type RealtimeChannel,\n type RealtimeChannelOptions,\n RealtimeClient,\n type RealtimeClientOptions,\n type RealtimeRemoveChannelResponse,\n} from '@supabase/realtime-js'\nimport { StorageClient as SupabaseStorageClient } from '@supabase/storage-js'\nimport {\n DEFAULT_AUTH_OPTIONS,\n DEFAULT_DB_OPTIONS,\n DEFAULT_GLOBAL_OPTIONS,\n DEFAULT_REALTIME_OPTIONS,\n DEFAULT_TRACE_PROPAGATION_OPTIONS,\n} from './lib/constants'\nimport { checkApiKeyFormat, fetchWithAuth } from './lib/fetch'\nimport {\n applySettingDefaults,\n checkTopLevelSchemaOption,\n validateSupabaseUrl,\n type ResolvedSupabaseClientOptions,\n} from './lib/helpers'\nimport { SupabaseAuthClient } from './lib/SupabaseAuthClient'\nimport type {\n Fetch,\n GenericSchema,\n SupabaseAuthClientOptions,\n SupabaseClientOptions,\n} from './lib/types'\nimport { GetRpcFunctionFilterBuilderByArgs } from './lib/rest/types/common/rpc'\n\n/**\n * Supabase Client.\n *\n * An isomorphic Javascript client for interacting with Postgres.\n */\nexport default class SupabaseClient<\n Database = any,\n // The second type parameter is also used for specifying db_schema, so we\n // support both cases.\n // TODO: Allow setting db_schema from ClientOptions.\n SchemaNameOrClientOptions extends\n | (string & keyof Omit)\n | { PostgrestVersion: string } = 'public' extends keyof Omit\n ? 'public'\n : string & keyof Omit,\n SchemaName extends string & keyof Omit =\n SchemaNameOrClientOptions extends string & keyof Omit\n ? SchemaNameOrClientOptions\n : 'public' extends keyof Omit\n ? 'public'\n : string & keyof Omit, '__InternalSupabase'>,\n Schema extends Omit[SchemaName] extends GenericSchema\n ? Omit[SchemaName]\n : never = Omit[SchemaName] extends GenericSchema\n ? Omit[SchemaName]\n : never,\n ClientOptions extends { PostgrestVersion: string } = SchemaNameOrClientOptions extends string &\n keyof Omit\n ? // If the version isn't explicitly set, look for it in the __InternalSupabase object to infer the right version\n Database extends { __InternalSupabase: { PostgrestVersion: string } }\n ? Database['__InternalSupabase']\n : // otherwise default to 12\n { PostgrestVersion: '12' }\n : SchemaNameOrClientOptions extends { PostgrestVersion: string }\n ? SchemaNameOrClientOptions\n : never,\n> {\n /**\n * Supabase Auth allows you to create and manage user sessions for access to data that is secured by access policies.\n */\n auth: SupabaseAuthClient\n realtime: RealtimeClient\n /**\n * Supabase Storage allows you to manage user-generated content, such as photos or videos.\n */\n storage: SupabaseStorageClient\n\n protected realtimeUrl: URL\n protected authUrl: URL\n protected storageUrl: URL\n protected functionsUrl: URL\n protected rest: PostgrestClient\n protected storageKey: string\n protected fetch?: Fetch\n protected functionsFetch?: Fetch\n protected changedAccessToken?: string\n protected accessToken?: () => Promise\n\n protected headers: Record\n protected settings?: ResolvedSupabaseClientOptions\n\n /**\n * Create a new client for use in the browser.\n *\n * @category Initializing\n *\n * @param supabaseUrl The unique Supabase URL which is supplied when you create a new project in your project dashboard.\n * @param supabaseKey The unique Supabase Key which is supplied when you create a new project in your project dashboard.\n * @param options Optional configuration for the client:\n * - `db.schema` — You can switch in between schemas. The schema needs to be on the list of exposed schemas inside Supabase.\n * - `auth.autoRefreshToken` — Set to `true` if you want to automatically refresh the token before expiring.\n * - `auth.persistSession` — Set to `true` if you want to automatically save the user session into local storage.\n * - `auth.detectSessionInUrl` — Set to `true` if you want to automatically detect OAuth grants in the URL and sign in the user.\n * - `realtime` — Options passed along to the realtime-js constructor.\n * - `storage` — Options passed along to the storage-js constructor.\n * - `global.fetch` — A custom fetch implementation.\n * - `global.headers` — Any additional headers to send with each network request.\n *\n * @example Creating a client\n * ```js\n * import { createClient } from '@supabase/supabase-js'\n *\n * // Create a single supabase client for interacting with your database\n * const supabase = createClient('https://xyzcompany.supabase.co', 'your-publishable-key')\n * ```\n *\n * @example With a custom domain\n * ```js\n * import { createClient } from '@supabase/supabase-js'\n *\n * // Use a custom domain as the supabase URL\n * const supabase = createClient('https://my-custom-domain.com', 'your-publishable-key')\n * ```\n *\n * @example With additional parameters\n * ```js\n * import { createClient } from '@supabase/supabase-js'\n *\n * const options = {\n * db: {\n * schema: 'public',\n * },\n * auth: {\n * autoRefreshToken: true,\n * persistSession: true,\n * detectSessionInUrl: true\n * },\n * global: {\n * headers: { 'x-my-custom-header': 'my-app-name' },\n * },\n * }\n * const supabase = createClient(\"https://xyzcompany.supabase.co\", \"your-publishable-key\", options)\n * ```\n *\n * @exampleDescription With custom schemas\n * By default the API server points to the `public` schema. You can enable other database schemas within the Dashboard.\n * Go to [Settings > API > Exposed schemas](/dashboard/project/_/settings/api) and add the schema which you want to expose to the API.\n *\n * Note: each client connection can only access a single schema, so the code above can access the `other_schema` schema but cannot access the `public` schema.\n *\n * @example With custom schemas\n * ```js\n * import { createClient } from '@supabase/supabase-js'\n *\n * const supabase = createClient('https://xyzcompany.supabase.co', 'your-publishable-key', {\n * // Provide a custom schema. Defaults to \"public\".\n * db: { schema: 'other_schema' }\n * })\n * ```\n *\n * @exampleDescription Custom fetch implementation\n * `supabase-js` uses the runtime's global `fetch` to make HTTP requests,\n * but an alternative `fetch` implementation can be provided as an option.\n * This is useful in environments where the global `fetch` is unavailable or where you want to customize request behavior.\n *\n * @example Custom fetch implementation\n * ```js\n * import { createClient } from '@supabase/supabase-js'\n *\n * const supabase = createClient('https://xyzcompany.supabase.co', 'your-publishable-key', {\n * global: { fetch: fetch.bind(globalThis) }\n * })\n * ```\n *\n * @exampleDescription React Native options with AsyncStorage\n * For React Native we recommend using `AsyncStorage` as the storage implementation for Supabase Auth.\n *\n * @example React Native options with AsyncStorage\n * ```js\n * import 'react-native-url-polyfill/auto'\n * import { createClient } from '@supabase/supabase-js'\n * import AsyncStorage from \"@react-native-async-storage/async-storage\";\n *\n * const supabase = createClient(\"https://xyzcompany.supabase.co\", \"your-publishable-key\", {\n * auth: {\n * storage: AsyncStorage,\n * autoRefreshToken: true,\n * persistSession: true,\n * detectSessionInUrl: false,\n * },\n * });\n * ```\n *\n * @exampleDescription React Native options with Expo SecureStore\n * If you wish to encrypt the user's session information, you can use `aes-js` and store the encryption key in Expo SecureStore.\n * The `aes-js` library, a reputable JavaScript-only implementation of the AES encryption algorithm in CTR mode.\n * A new 256-bit encryption key is generated using the `react-native-get-random-values` library.\n * This key is stored inside Expo's SecureStore, while the value is encrypted and placed inside AsyncStorage.\n *\n * Please make sure that:\n * - You keep the `expo-secure-store`, `aes-js` and `react-native-get-random-values` libraries up-to-date.\n * - Choose the correct [`SecureStoreOptions`](https://docs.expo.dev/versions/latest/sdk/securestore/#securestoreoptions) for your app's needs.\n * E.g. [`SecureStore.WHEN_UNLOCKED`](https://docs.expo.dev/versions/latest/sdk/securestore/#securestorewhen_unlocked) regulates when the data can be accessed.\n * - Carefully consider optimizations or other modifications to the above example, as those can lead to introducing subtle security vulnerabilities.\n *\n * @example React Native options with Expo SecureStore\n * ```ts\n * import 'react-native-url-polyfill/auto'\n * import { createClient } from '@supabase/supabase-js'\n * import AsyncStorage from '@react-native-async-storage/async-storage';\n * import * as SecureStore from 'expo-secure-store';\n * import * as aesjs from 'aes-js';\n * import 'react-native-get-random-values';\n *\n * // As Expo's SecureStore does not support values larger than 2048\n * // bytes, an AES-256 key is generated and stored in SecureStore, while\n * // it is used to encrypt/decrypt values stored in AsyncStorage.\n * class LargeSecureStore {\n * private async _encrypt(key: string, value: string) {\n * const encryptionKey = crypto.getRandomValues(new Uint8Array(256 / 8));\n *\n * const cipher = new aesjs.ModeOfOperation.ctr(encryptionKey, new aesjs.Counter(1));\n * const encryptedBytes = cipher.encrypt(aesjs.utils.utf8.toBytes(value));\n *\n * await SecureStore.setItemAsync(key, aesjs.utils.hex.fromBytes(encryptionKey));\n *\n * return aesjs.utils.hex.fromBytes(encryptedBytes);\n * }\n *\n * private async _decrypt(key: string, value: string) {\n * const encryptionKeyHex = await SecureStore.getItemAsync(key);\n * if (!encryptionKeyHex) {\n * return encryptionKeyHex;\n * }\n *\n * const cipher = new aesjs.ModeOfOperation.ctr(aesjs.utils.hex.toBytes(encryptionKeyHex), new aesjs.Counter(1));\n * const decryptedBytes = cipher.decrypt(aesjs.utils.hex.toBytes(value));\n *\n * return aesjs.utils.utf8.fromBytes(decryptedBytes);\n * }\n *\n * async getItem(key: string) {\n * const encrypted = await AsyncStorage.getItem(key);\n * if (!encrypted) { return encrypted; }\n *\n * return await this._decrypt(key, encrypted);\n * }\n *\n * async removeItem(key: string) {\n * await AsyncStorage.removeItem(key);\n * await SecureStore.deleteItemAsync(key);\n * }\n *\n * async setItem(key: string, value: string) {\n * const encrypted = await this._encrypt(key, value);\n *\n * await AsyncStorage.setItem(key, encrypted);\n * }\n * }\n *\n * const supabase = createClient(\"https://xyzcompany.supabase.co\", \"your-publishable-key\", {\n * auth: {\n * storage: new LargeSecureStore(),\n * autoRefreshToken: true,\n * persistSession: true,\n * detectSessionInUrl: false,\n * },\n * });\n * ```\n *\n * @example With a database query\n * ```ts\n * import { createClient } from '@supabase/supabase-js'\n *\n * const supabase = createClient('https://xyzcompany.supabase.co', 'your-publishable-key')\n *\n * const { data } = await supabase.from('profiles').select('*')\n * ```\n *\n * @exampleDescription With OpenTelemetry tracing\n * Opt in to W3C trace context propagation so the `trace_id` from your\n * client-side spans is attached to Supabase requests and appears in API\n * Gateway and Edge Function logs. Requires `@opentelemetry/api` to be\n * installed in your application and the tracing runtime to be loaded via\n * `import '@supabase/supabase-js/tracing'`. See [Tracing with the JS SDK](https://supabase.com/docs/guides/telemetry/client-side-tracing).\n *\n * @example With OpenTelemetry tracing\n * ```ts\n * import '@supabase/supabase-js/tracing'\n * import { createClient } from '@supabase/supabase-js'\n * import { trace } from '@opentelemetry/api'\n *\n * const supabase = createClient('https://xyzcompany.supabase.co', 'your-publishable-key', {\n * tracePropagation: true,\n * })\n *\n * const tracer = trace.getTracer('my-app')\n *\n * await tracer.startActiveSpan('fetch-users', async (span) => {\n * // Outgoing request carries the active trace context.\n * const { data, error } = await supabase.from('users').select('*')\n * span.end()\n * })\n * ```\n */\n constructor(\n protected supabaseUrl: string,\n protected supabaseKey: string,\n options?: SupabaseClientOptions\n ) {\n const baseUrl = validateSupabaseUrl(supabaseUrl)\n if (!supabaseKey) throw new Error('supabaseKey is required.')\n checkApiKeyFormat(supabaseKey)\n checkTopLevelSchemaOption(options)\n\n this.realtimeUrl = new URL('realtime/v1', baseUrl)\n this.realtimeUrl.protocol = this.realtimeUrl.protocol.replace('http', 'ws')\n this.authUrl = new URL('auth/v1', baseUrl)\n this.storageUrl = new URL('storage/v1', baseUrl)\n this.functionsUrl = new URL('functions/v1', baseUrl)\n\n // default storage key uses the supabase project ref as a namespace\n const defaultStorageKey = `sb-${baseUrl.hostname.split('.')[0]}-auth-token`\n const DEFAULTS = {\n db: DEFAULT_DB_OPTIONS,\n realtime: DEFAULT_REALTIME_OPTIONS,\n auth: { ...DEFAULT_AUTH_OPTIONS, storageKey: defaultStorageKey },\n global: DEFAULT_GLOBAL_OPTIONS,\n tracePropagation: DEFAULT_TRACE_PROPAGATION_OPTIONS,\n }\n\n const settings = applySettingDefaults(options ?? {}, DEFAULTS)\n this.settings = settings\n\n this.storageKey = settings.auth.storageKey ?? ''\n this.headers = settings.global.headers ?? {}\n\n if (!settings.accessToken) {\n this.auth = this._initSupabaseAuthClient(\n settings.auth ?? {},\n this.headers,\n settings.global.fetch\n )\n } else {\n this.accessToken = settings.accessToken\n\n this.auth = new Proxy({} as any, {\n get: (_, prop) => {\n throw new Error(\n `@supabase/supabase-js: Supabase Client is configured with the accessToken option, accessing supabase.auth.${String(\n prop\n )} is not possible`\n )\n },\n })\n }\n\n // The fetch wrappers receive the raw session token (null when there is no session) and\n // decide the `Authorization` fallback themselves, so the API-key fallback lives in one place.\n this.fetch = fetchWithAuth(\n supabaseKey,\n supabaseUrl,\n this._getSessionToken.bind(this),\n settings.global.fetch,\n settings.tracePropagation\n )\n // Edge Functions use a dedicated fetch that never falls back to a new-format API key in\n // the Authorization header (see `isNewApiKey` in ./lib/fetch). Other services use `this.fetch`.\n this.functionsFetch = fetchWithAuth(\n supabaseKey,\n supabaseUrl,\n this._getSessionToken.bind(this),\n settings.global.fetch,\n settings.tracePropagation,\n { omitApiKeyAsBearer: true }\n )\n this.realtime = this._initRealtimeClient({\n headers: this.headers,\n accessToken: this._getAccessToken.bind(this),\n fetch: this.fetch,\n ...settings.realtime,\n })\n if (this.accessToken) {\n // Start auth immediately to avoid race condition with channel subscriptions\n // Wrap Promise to avoid Firefox extension cross-context Promise access errors\n Promise.resolve(this.accessToken())\n .then((token) => this.realtime.setAuth(token))\n .catch((e) => console.warn('Failed to set initial Realtime auth token:', e))\n }\n\n this.rest = new PostgrestClient(new URL('rest/v1', baseUrl).href, {\n headers: this.headers,\n schema: settings.db.schema,\n fetch: this.fetch,\n timeout: settings.db.timeout,\n urlLengthLimit: settings.db.urlLengthLimit,\n retry: settings.db.retry,\n })\n\n this.storage = new SupabaseStorageClient(\n this.storageUrl.href,\n this.headers,\n this.fetch,\n options?.storage\n )\n\n if (!settings.accessToken) {\n this._listenForAuthEvents()\n }\n }\n\n /**\n * Supabase Functions allows you to deploy and invoke edge functions.\n */\n get functions(): FunctionsClient {\n return new FunctionsClient(this.functionsUrl.href, {\n headers: this.headers,\n customFetch: this.functionsFetch,\n })\n }\n\n // NOTE: signatures must be kept in sync with PostgrestClient.from\n from<\n TableName extends string & keyof Schema['Tables'],\n Table extends Schema['Tables'][TableName],\n >(relation: TableName): PostgrestQueryBuilder\n from(\n relation: ViewName\n ): PostgrestQueryBuilder\n /**\n * Perform a query on a table or a view.\n *\n * @param relation - The table or view name to query\n */\n from(relation: string): PostgrestQueryBuilder {\n return this.rest.from(relation)\n }\n\n // NOTE: signatures must be kept in sync with PostgrestClient.schema\n /**\n * Select a schema to query or perform an function (rpc) call.\n *\n * The schema needs to be on the list of exposed schemas inside Supabase.\n *\n * @param schema - The schema to query\n */\n schema>(\n schema: DynamicSchema\n ): PostgrestClient<\n Database,\n ClientOptions,\n DynamicSchema,\n Database[DynamicSchema] extends GenericSchema ? Database[DynamicSchema] : any\n > {\n return this.rest.schema(schema)\n }\n\n // NOTE: signatures must be kept in sync with PostgrestClient.getOpenApiSpec\n /**\n * Fetch the OpenAPI description PostgREST publishes for this client's schema.\n *\n * The document lists only the tables, views and functions the caller's role\n * holds privileges on. The request carries the same `apikey` and\n * `Authorization` headers as every other query, so the description is scoped\n * to the signed-in user. Call `.schema()` first to describe a schema other\n * than the client default.\n *\n * @example\n * ```ts\n * const { data, error } = await supabase.getOpenApiSpec()\n * ```\n */\n getOpenApiSpec(): Promise> {\n return this.rest.getOpenApiSpec()\n }\n\n // NOTE: signatures must be kept in sync with PostgrestClient.rpc\n /**\n * Perform a function call.\n *\n * @param fn - The function name to call\n * @param args - The arguments to pass to the function call\n * @param options - Named parameters\n * @param options.head - When set to `true`, `data` will not be returned.\n * Useful if you only need the count.\n * @param options.get - When set to `true`, the function will be called with\n * read-only access mode.\n * @param options.count - Count algorithm to use to count rows returned by the\n * function. Only applicable for [set-returning\n * functions](https://www.postgresql.org/docs/current/functions-srf.html).\n *\n * `\"exact\"`: Exact but slow count algorithm. Performs a `COUNT(*)` under the\n * hood.\n *\n * `\"planned\"`: Approximated but fast count algorithm. Uses the Postgres\n * statistics under the hood.\n *\n * `\"estimated\"`: Uses exact count for low numbers and planned count for high\n * numbers.\n */\n rpc<\n FnName extends string & keyof Schema['Functions'],\n Args extends Schema['Functions'][FnName]['Args'] = never,\n FilterBuilder extends GetRpcFunctionFilterBuilderByArgs =\n GetRpcFunctionFilterBuilderByArgs,\n >(\n fn: FnName,\n args: Args = {} as Args,\n options: {\n head?: boolean\n get?: boolean\n count?: 'exact' | 'planned' | 'estimated'\n } = {\n head: false,\n get: false,\n count: undefined,\n }\n ): PostgrestFilterBuilder<\n ClientOptions,\n Schema,\n FilterBuilder['Row'],\n FilterBuilder['Result'],\n FilterBuilder['RelationName'],\n FilterBuilder['Relationships'],\n 'RPC'\n > {\n return this.rest.rpc(fn, args, options) as unknown as PostgrestFilterBuilder<\n ClientOptions,\n Schema,\n FilterBuilder['Row'],\n FilterBuilder['Result'],\n FilterBuilder['RelationName'],\n FilterBuilder['Relationships'],\n 'RPC'\n >\n }\n\n /**\n * Creates a Realtime channel with Broadcast, Presence, and Postgres Changes.\n *\n * @param {string} name - The name of the Realtime channel.\n * @param {Object} opts - The options to pass to the Realtime channel.\n *\n * @category Realtime\n */\n channel(name: string, opts: RealtimeChannelOptions = { config: {} }): RealtimeChannel {\n return this.realtime.channel(name, opts)\n }\n\n /**\n * Returns all Realtime channels.\n *\n * @category Realtime\n *\n * @example Get all channels\n * ```js\n * const channels = supabase.getChannels()\n * ```\n */\n getChannels(): RealtimeChannel[] {\n return this.realtime.getChannels()\n }\n\n /**\n * Unsubscribes and removes Realtime channel from Realtime client.\n *\n * @param {RealtimeChannel} channel - The name of the Realtime channel.\n *\n *\n * @category Realtime\n *\n * @remarks\n * - Removing a channel is a great way to maintain the performance of your project's Realtime service as well as your database if you're listening to Postgres changes. Supabase will automatically handle cleanup 30 seconds after a client is disconnected, but unused channels may cause degradation as more clients are simultaneously subscribed.\n *\n * @example Removes a channel\n * ```js\n * supabase.removeChannel(myChannel)\n * ```\n */\n removeChannel(channel: RealtimeChannel): Promise {\n return this.realtime.removeChannel(channel)\n }\n\n /**\n * Unsubscribes and removes all Realtime channels from Realtime client.\n *\n * @category Realtime\n *\n * @remarks\n * - Removing channels is a great way to maintain the performance of your project's Realtime service as well as your database if you're listening to Postgres changes. Supabase will automatically handle cleanup 30 seconds after a client is disconnected, but unused channels may cause degradation as more clients are simultaneously subscribed.\n *\n * @example Remove all channels\n * ```js\n * supabase.removeAllChannels()\n * ```\n */\n removeAllChannels(): Promise {\n return this.realtime.removeAllChannels()\n }\n\n /**\n * The raw session token — the custom `accessToken` result or the signed-in user's JWT —\n * or `null` when there is no session. Unlike {@link _getAccessToken} it does not fall back\n * to `supabaseKey`, so callers can distinguish \"no session\" from \"has session\".\n */\n private async _getSessionToken(): Promise {\n if (this.accessToken) {\n return await this.accessToken()\n }\n\n const { data } = await this.auth.getSession()\n\n return data.session?.access_token ?? null\n }\n\n private async _getAccessToken() {\n return (await this._getSessionToken()) ?? this.supabaseKey\n }\n\n private _initSupabaseAuthClient(\n {\n autoRefreshToken,\n persistSession,\n detectSessionInUrl,\n storage,\n userStorage,\n storageKey,\n flowType,\n lock,\n debug,\n throwOnError,\n experimental,\n lockAcquireTimeout,\n skipAutoInitialize,\n }: SupabaseAuthClientOptions,\n headers?: Record,\n fetch?: Fetch\n ) {\n const authHeaders = {\n Authorization: `Bearer ${this.supabaseKey}`,\n apikey: `${this.supabaseKey}`,\n }\n return new SupabaseAuthClient({\n url: this.authUrl.href,\n headers: { ...authHeaders, ...headers },\n storageKey: storageKey,\n autoRefreshToken,\n persistSession,\n detectSessionInUrl,\n storage,\n userStorage,\n flowType,\n lock,\n debug,\n throwOnError,\n experimental,\n fetch,\n lockAcquireTimeout,\n skipAutoInitialize,\n // auth checks if there is a custom authorizaiton header using this flag\n // so it knows whether to return an error when getUser is called with no session\n hasCustomAuthorizationHeader: Object.keys(this.headers).some(\n (key) => key.toLowerCase() === 'authorization'\n ),\n })\n }\n\n private _initRealtimeClient(options: RealtimeClientOptions) {\n return new RealtimeClient(this.realtimeUrl.href, {\n ...options,\n params: { ...{ apikey: this.supabaseKey }, ...options?.params },\n })\n }\n\n private _listenForAuthEvents() {\n const data = this.auth.onAuthStateChange((event, session) => {\n this._handleTokenChanged(event, 'CLIENT', session?.access_token)\n })\n return data\n }\n\n private _handleTokenChanged(\n event: AuthChangeEvent,\n source: 'CLIENT' | 'STORAGE',\n token?: string\n ) {\n if (\n (event === 'TOKEN_REFRESHED' || event === 'SIGNED_IN' || event === 'INITIAL_SESSION') &&\n this.changedAccessToken !== token\n ) {\n this.changedAccessToken = token\n this.realtime.setAuth(token)\n } else if (event === 'SIGNED_OUT') {\n this.realtime.setAuth()\n if (source == 'STORAGE') this.auth.signOut()\n this.changedAccessToken = undefined\n }\n }\n}\n","import SupabaseClient from './SupabaseClient'\nimport type { SupabaseClientOptions } from './lib/types'\n\nexport * from '@supabase/auth-js'\nexport type { User as AuthUser, Session as AuthSession } from '@supabase/auth-js'\nexport type {\n PostgrestResponse,\n PostgrestSingleResponse,\n PostgrestMaybeSingleResponse,\n PostgrestOpenApiSpec,\n PostgrestBuilder,\n PostgrestFilterBuilder,\n PostgrestTransformBuilder,\n PostgrestQueryBuilder,\n} from '@supabase/postgrest-js'\nexport { PostgrestError } from '@supabase/postgrest-js'\nexport { StorageApiError } from '@supabase/storage-js'\nexport type { FunctionInvokeOptions } from '@supabase/functions-js'\nexport {\n FunctionsHttpError,\n FunctionsFetchError,\n FunctionsRelayError,\n FunctionsError,\n FunctionRegion,\n} from '@supabase/functions-js'\nexport * from '@supabase/realtime-js'\nexport { default as SupabaseClient } from './SupabaseClient'\nexport type {\n SupabaseClientOptions,\n TracePropagationOptions,\n QueryResult,\n QueryData,\n QueryError,\n DatabaseWithoutInternals,\n} from './lib/types'\n\n/**\n * Creates a new Supabase Client.\n *\n * @example Creating a Supabase client\n * ```ts\n * import { createClient } from '@supabase/supabase-js'\n *\n * const supabase = createClient('https://xyzcompany.supabase.co', 'your-publishable-key')\n * const { data, error } = await supabase.from('profiles').select('*')\n * ```\n */\nexport const createClient = <\n Database = any,\n SchemaNameOrClientOptions extends\n | (string & keyof Omit)\n | { PostgrestVersion: string } = 'public' extends keyof Omit\n ? 'public'\n : string & keyof Omit,\n SchemaName extends string & keyof Omit =\n SchemaNameOrClientOptions extends string & keyof Omit\n ? SchemaNameOrClientOptions\n : 'public' extends keyof Omit\n ? 'public'\n : string & keyof Omit, '__InternalSupabase'>,\n>(\n supabaseUrl: string,\n supabaseKey: string,\n options?: SupabaseClientOptions\n): SupabaseClient => {\n return new SupabaseClient(\n supabaseUrl,\n supabaseKey,\n options\n )\n}\n\n// Check for Node.js <= 20 deprecation\nfunction shouldShowDeprecationWarning(): boolean {\n // Skip in browser and Deno environments\n if (typeof window !== 'undefined' || (globalThis as any)['Deno'] !== undefined) {\n return false\n }\n\n // Skip if process is not available (e.g., Edge Runtime)\n // Use dynamic property access to avoid Next.js Edge Runtime static analysis warnings\n const _process = (globalThis as any)['process']\n if (!_process) {\n return false\n }\n\n const processVersion = _process['version']\n if (processVersion === undefined || processVersion === null) {\n return false\n }\n\n const versionMatch = processVersion.match(/^v(\\d+)\\./)\n if (!versionMatch) {\n return false\n }\n\n const majorVersion = parseInt(versionMatch[1], 10)\n return majorVersion <= 20\n}\n\nif (shouldShowDeprecationWarning()) {\n console.warn(\n `⚠️ Node.js 20 and below are deprecated and will no longer be supported in future versions of @supabase/supabase-js. ` +\n `Please upgrade to Node.js 22 or later. ` +\n `For more information, visit: https://github.com/orgs/supabase/discussions/45715`\n )\n}\n"]}