@nodaro/sdk 1.6.0 → 1.7.0

package/dist/supabase-browser.cjs

@@ -0,0 +1,71 @@
+'use strict';
+
+var ssr = require('@supabase/ssr');
+
+// src/supabase-browser.ts
+function legacyStorageKey(url) {
+  return `sb-${new URL(url).hostname.split(".")[0]}-auth-token`;
+}
+function domainApplies(hostname, cookieDomain) {
+  const bare = cookieDomain.replace(/^\./, "");
+  return hostname === bare || hostname.endsWith(`.${bare}`);
+}
+function migrateLegacySession(client, url) {
+  if (typeof localStorage === "undefined") return null;
+  const key = legacyStorageKey(url);
+  const raw = localStorage.getItem(key);
+  if (!raw) return null;
+  return (async () => {
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed.access_token && parsed.refresh_token) {
+        await client.auth.setSession({
+          access_token: parsed.access_token,
+          refresh_token: parsed.refresh_token
+        });
+      }
+    } catch {
+    } finally {
+      localStorage.removeItem(key);
+    }
+  })();
+}
+function createSharedSupabaseClient(opts) {
+  const hostname = typeof location !== "undefined" ? location.hostname : "";
+  const domain = opts.cookieDomain && domainApplies(hostname, opts.cookieDomain) ? opts.cookieDomain : void 0;
+  const client = ssr.createBrowserClient(opts.url, opts.anonKey, {
+    // Each app keeps its own module-level singleton; per-call instances keep
+    // tests deterministic.
+    isSingleton: false,
+    cookieOptions: {
+      ...domain ? { domain } : {},
+      path: "/",
+      sameSite: "lax",
+      secure: typeof location !== "undefined" && location.protocol === "https:",
+      // Long-lived cookie; real session validity is governed by refresh-token
+      // rotation, not cookie lifetime.
+      maxAge: 60 * 60 * 24 * 365
+    },
+    auth: {
+      flowType: "pkce",
+      detectSessionInUrl: true,
+      // Bypass Navigator Lock API: prevents AbortError from
+      // @supabase/auth-js/locks.ts during session synchronization; cross-tab
+      // coordination is non-critical for these apps.
+      lock: async (_name, _acquireTimeout, fn) => fn()
+    }
+  });
+  const migration = migrateLegacySession(client, opts.url);
+  if (migration) {
+    const orig = client.auth.getSession.bind(client.auth);
+    client.auth.getSession = async () => {
+      await migration;
+      return orig();
+    };
+  }
+  return client;
+}
+
+exports.createSharedSupabaseClient = createSharedSupabaseClient;
+//# sourceMappingURL=supabase-browser.cjs.map
+//# sourceMappingURL=supabase-browser.cjs.map

package/dist/supabase-browser.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/supabase-browser.ts"],"names":["createBrowserClient"],"mappings":";;;;;AAwBA,SAAS,iBAAiB,GAAA,EAAqB;AAC7C,EAAA,OAAO,CAAA,GAAA,EAAM,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,SAAS,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAC,CAAA,WAAA,CAAA;AAClD;AAEA,SAAS,aAAA,CAAc,UAAkB,YAAA,EAA+B;AACtE,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC3C,EAAA,OAAO,aAAa,IAAA,IAAQ,QAAA,CAAS,QAAA,CAAS,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAC1D;AASA,SAAS,oBAAA,CACP,QACA,GAAA,EACsB;AACtB,EAAA,IAAI,OAAO,YAAA,KAAiB,WAAA,EAAa,OAAO,IAAA;AAChD,EAAA,MAAM,GAAA,GAAM,iBAAiB,GAAG,CAAA;AAChC,EAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,CAAQ,GAAG,CAAA;AACpC,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,OAAA,CAAQ,YAAY;AAClB,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAI7B,MAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,MAAA,CAAO,aAAA,EAAe;AAC/C,QAAA,MAAM,MAAA,CAAO,KAAK,UAAA,CAAW;AAAA,UAC3B,cAAc,MAAA,CAAO,YAAA;AAAA,UACrB,eAAe,MAAA,CAAO;AAAA,SACvB,CAAA;AAAA,MACH;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,WAAW,GAAG,CAAA;AAAA,IAC7B;AAAA,EACF,CAAA,GAAG;AACL;AAEO,SAAS,2BACd,IAAA,EACoB;AACpB,EAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,WAAA,GAAc,SAAS,QAAA,GAAW,EAAA;AACvE,EAAA,MAAM,MAAA,GACJ,KAAK,YAAA,IAAgB,aAAA,CAAc,UAAU,IAAA,CAAK,YAAY,CAAA,GAC1D,IAAA,CAAK,YAAA,GACL,MAAA;AAEN,EAAA,MAAM,MAAA,GAASA,uBAAA,CAAwB,IAAA,CAAK,GAAA,EAAK,KAAK,OAAA,EAAS;AAAA;AAAA;AAAA,IAG7D,WAAA,EAAa,KAAA;AAAA,IACb,aAAA,EAAe;AAAA,MACb,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW,EAAC;AAAA,MAC3B,IAAA,EAAM,GAAA;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,MAAA,EAAQ,OAAO,QAAA,KAAa,WAAA,IAAe,SAAS,QAAA,KAAa,QAAA;AAAA;AAAA;AAAA,MAGjE,MAAA,EAAQ,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK;AAAA,KACzB;AAAA,IACA,IAAA,EAAM;AAAA,MACJ,QAAA,EAAU,MAAA;AAAA,MACV,kBAAA,EAAoB,IAAA;AAAA;AAAA;AAAA;AAAA,MAIpB,IAAA,EAAM,OACJ,KAAA,EACA,eAAA,EACA,OACe,EAAA;AAAG;AACtB,GACD,CAAA;AAED,EAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,MAAA,EAA+B,IAAA,CAAK,GAAG,CAAA;AAC9E,EAAA,IAAI,SAAA,EAAW;AAGb,IAAA,MAAM,OAAO,MAAA,CAAO,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,OAAO,IAAI,CAAA;AACpD,IAAA,MAAA,CAAO,IAAA,CAAK,aAAa,YAAY;AACnC,MAAA,MAAM,SAAA;AACN,MAAA,OAAO,IAAA,EAAK;AAAA,IACd,CAAA;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT","file":"supabase-browser.cjs","sourcesContent":["import { createBrowserClient } from \"@supabase/ssr\"\nimport type { SupabaseClient } from \"@supabase/supabase-js\"\n\n/**\n * Browser Supabase client with session storage in cookies instead of\n * localStorage, so several apps on sibling subdomains (e.g. app/studio/voice\n * on *.nodaro.ai) share one login: sign in on any of them, signed in on all;\n * sign out anywhere, signed out everywhere (supabase-js signOut defaults to\n * the global scope).\n */\nexport interface SharedSupabaseOptions {\n  /** Supabase project URL (https://<ref>.supabase.co). */\n  url: string\n  anonKey: string\n  /**\n   * Cookie Domain for cross-subdomain sharing (e.g. \".nodaro.ai\"). Applied\n   * only when the page's hostname is that domain or a subdomain of it; on any\n   * other host (localhost, preview URLs) cookies stay host-only, which keeps\n   * local dev on per-origin sessions.\n   */\n  cookieDomain?: string\n}\n\n/** supabase-js's default localStorage key: `sb-<project-ref>-auth-token`. */\nfunction legacyStorageKey(url: string): string {\n  return `sb-${new URL(url).hostname.split(\".\")[0]}-auth-token`\n}\n\nfunction domainApplies(hostname: string, cookieDomain: string): boolean {\n  const bare = cookieDomain.replace(/^\\./, \"\")\n  return hostname === bare || hostname.endsWith(`.${bare}`)\n}\n\n/**\n * One-time adoption of a pre-cookie session this origin left in localStorage,\n * so already-signed-in users survive the storage switch. setSession persists\n * through the client's (cookie) storage; dead tokens reject and the user is\n * simply signed out. The legacy key is removed in every outcome.\n * Returns null when there is nothing to migrate.\n */\nfunction migrateLegacySession(\n  client: SupabaseClient<any>,\n  url: string\n): Promise<void> | null {\n  if (typeof localStorage === \"undefined\") return null\n  const key = legacyStorageKey(url)\n  const raw = localStorage.getItem(key)\n  if (!raw) return null\n  return (async () => {\n    try {\n      const parsed = JSON.parse(raw) as {\n        access_token?: string\n        refresh_token?: string\n      }\n      if (parsed.access_token && parsed.refresh_token) {\n        await client.auth.setSession({\n          access_token: parsed.access_token,\n          refresh_token: parsed.refresh_token,\n        })\n      }\n    } catch {\n      // Unparseable or dead legacy session — discard; the user logs in again.\n    } finally {\n      localStorage.removeItem(key)\n    }\n  })()\n}\n\nexport function createSharedSupabaseClient<Db = any>(\n  opts: SharedSupabaseOptions\n): SupabaseClient<Db> {\n  const hostname = typeof location !== \"undefined\" ? location.hostname : \"\"\n  const domain =\n    opts.cookieDomain && domainApplies(hostname, opts.cookieDomain)\n      ? opts.cookieDomain\n      : undefined\n\n  const client = createBrowserClient<Db>(opts.url, opts.anonKey, {\n    // Each app keeps its own module-level singleton; per-call instances keep\n    // tests deterministic.\n    isSingleton: false,\n    cookieOptions: {\n      ...(domain ? { domain } : {}),\n      path: \"/\",\n      sameSite: \"lax\",\n      secure: typeof location !== \"undefined\" && location.protocol === \"https:\",\n      // Long-lived cookie; real session validity is governed by refresh-token\n      // rotation, not cookie lifetime.\n      maxAge: 60 * 60 * 24 * 365,\n    },\n    auth: {\n      flowType: \"pkce\",\n      detectSessionInUrl: true,\n      // Bypass Navigator Lock API: prevents AbortError from\n      // @supabase/auth-js/locks.ts during session synchronization; cross-tab\n      // coordination is non-critical for these apps.\n      lock: async <R>(\n        _name: string,\n        _acquireTimeout: number,\n        fn: () => Promise<R>\n      ): Promise<R> => fn(),\n    },\n  })\n\n  const migration = migrateLegacySession(client as SupabaseClient<any>, opts.url)\n  if (migration) {\n    // Gate reads on the one-time migration so the first getSession() after the\n    // storage switch can't race it — keeps call sites unchanged in the apps.\n    const orig = client.auth.getSession.bind(client.auth)\n    client.auth.getSession = async () => {\n      await migration\n      return orig()\n    }\n  }\n\n  return client\n}\n"]}

package/dist/supabase-browser.d.cts

@@ -0,0 +1,24 @@
+import { SupabaseClient } from '@supabase/supabase-js';
+
+/**
+ * Browser Supabase client with session storage in cookies instead of
+ * localStorage, so several apps on sibling subdomains (e.g. app/studio/voice
+ * on *.nodaro.ai) share one login: sign in on any of them, signed in on all;
+ * sign out anywhere, signed out everywhere (supabase-js signOut defaults to
+ * the global scope).
+ */
+interface SharedSupabaseOptions {
+    /** Supabase project URL (https://<ref>.supabase.co). */
+    url: string;
+    anonKey: string;
+    /**
+     * Cookie Domain for cross-subdomain sharing (e.g. ".nodaro.ai"). Applied
+     * only when the page's hostname is that domain or a subdomain of it; on any
+     * other host (localhost, preview URLs) cookies stay host-only, which keeps
+     * local dev on per-origin sessions.
+     */
+    cookieDomain?: string;
+}
+declare function createSharedSupabaseClient<Db = any>(opts: SharedSupabaseOptions): SupabaseClient<Db>;
+
+export { type SharedSupabaseOptions, createSharedSupabaseClient };

package/dist/supabase-browser.d.ts

@@ -0,0 +1,24 @@
+import { SupabaseClient } from '@supabase/supabase-js';
+
+/**
+ * Browser Supabase client with session storage in cookies instead of
+ * localStorage, so several apps on sibling subdomains (e.g. app/studio/voice
+ * on *.nodaro.ai) share one login: sign in on any of them, signed in on all;
+ * sign out anywhere, signed out everywhere (supabase-js signOut defaults to
+ * the global scope).
+ */
+interface SharedSupabaseOptions {
+    /** Supabase project URL (https://<ref>.supabase.co). */
+    url: string;
+    anonKey: string;
+    /**
+     * Cookie Domain for cross-subdomain sharing (e.g. ".nodaro.ai"). Applied
+     * only when the page's hostname is that domain or a subdomain of it; on any
+     * other host (localhost, preview URLs) cookies stay host-only, which keeps
+     * local dev on per-origin sessions.
+     */
+    cookieDomain?: string;
+}
+declare function createSharedSupabaseClient<Db = any>(opts: SharedSupabaseOptions): SupabaseClient<Db>;
+
+export { type SharedSupabaseOptions, createSharedSupabaseClient };

package/dist/supabase-browser.js

@@ -0,0 +1,69 @@
+import { createBrowserClient } from '@supabase/ssr';
+
+// src/supabase-browser.ts
+function legacyStorageKey(url) {
+  return `sb-${new URL(url).hostname.split(".")[0]}-auth-token`;
+}
+function domainApplies(hostname, cookieDomain) {
+  const bare = cookieDomain.replace(/^\./, "");
+  return hostname === bare || hostname.endsWith(`.${bare}`);
+}
+function migrateLegacySession(client, url) {
+  if (typeof localStorage === "undefined") return null;
+  const key = legacyStorageKey(url);
+  const raw = localStorage.getItem(key);
+  if (!raw) return null;
+  return (async () => {
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed.access_token && parsed.refresh_token) {
+        await client.auth.setSession({
+          access_token: parsed.access_token,
+          refresh_token: parsed.refresh_token
+        });
+      }
+    } catch {
+    } finally {
+      localStorage.removeItem(key);
+    }
+  })();
+}
+function createSharedSupabaseClient(opts) {
+  const hostname = typeof location !== "undefined" ? location.hostname : "";
+  const domain = opts.cookieDomain && domainApplies(hostname, opts.cookieDomain) ? opts.cookieDomain : void 0;
+  const client = createBrowserClient(opts.url, opts.anonKey, {
+    // Each app keeps its own module-level singleton; per-call instances keep
+    // tests deterministic.
+    isSingleton: false,
+    cookieOptions: {
+      ...domain ? { domain } : {},
+      path: "/",
+      sameSite: "lax",
+      secure: typeof location !== "undefined" && location.protocol === "https:",
+      // Long-lived cookie; real session validity is governed by refresh-token
+      // rotation, not cookie lifetime.
+      maxAge: 60 * 60 * 24 * 365
+    },
+    auth: {
+      flowType: "pkce",
+      detectSessionInUrl: true,
+      // Bypass Navigator Lock API: prevents AbortError from
+      // @supabase/auth-js/locks.ts during session synchronization; cross-tab
+      // coordination is non-critical for these apps.
+      lock: async (_name, _acquireTimeout, fn) => fn()
+    }
+  });
+  const migration = migrateLegacySession(client, opts.url);
+  if (migration) {
+    const orig = client.auth.getSession.bind(client.auth);
+    client.auth.getSession = async () => {
+      await migration;
+      return orig();
+    };
+  }
+  return client;
+}
+
+export { createSharedSupabaseClient };
+//# sourceMappingURL=supabase-browser.js.map
+//# sourceMappingURL=supabase-browser.js.map

package/dist/supabase-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/supabase-browser.ts"],"names":[],"mappings":";;;AAwBA,SAAS,iBAAiB,GAAA,EAAqB;AAC7C,EAAA,OAAO,CAAA,GAAA,EAAM,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,SAAS,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAC,CAAA,WAAA,CAAA;AAClD;AAEA,SAAS,aAAA,CAAc,UAAkB,YAAA,EAA+B;AACtE,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAC3C,EAAA,OAAO,aAAa,IAAA,IAAQ,QAAA,CAAS,QAAA,CAAS,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA;AAC1D;AASA,SAAS,oBAAA,CACP,QACA,GAAA,EACsB;AACtB,EAAA,IAAI,OAAO,YAAA,KAAiB,WAAA,EAAa,OAAO,IAAA;AAChD,EAAA,MAAM,GAAA,GAAM,iBAAiB,GAAG,CAAA;AAChC,EAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,CAAQ,GAAG,CAAA;AACpC,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,OAAA,CAAQ,YAAY;AAClB,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAI7B,MAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,MAAA,CAAO,aAAA,EAAe;AAC/C,QAAA,MAAM,MAAA,CAAO,KAAK,UAAA,CAAW;AAAA,UAC3B,cAAc,MAAA,CAAO,YAAA;AAAA,UACrB,eAAe,MAAA,CAAO;AAAA,SACvB,CAAA;AAAA,MACH;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,WAAW,GAAG,CAAA;AAAA,IAC7B;AAAA,EACF,CAAA,GAAG;AACL;AAEO,SAAS,2BACd,IAAA,EACoB;AACpB,EAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,WAAA,GAAc,SAAS,QAAA,GAAW,EAAA;AACvE,EAAA,MAAM,MAAA,GACJ,KAAK,YAAA,IAAgB,aAAA,CAAc,UAAU,IAAA,CAAK,YAAY,CAAA,GAC1D,IAAA,CAAK,YAAA,GACL,MAAA;AAEN,EAAA,MAAM,MAAA,GAAS,mBAAA,CAAwB,IAAA,CAAK,GAAA,EAAK,KAAK,OAAA,EAAS;AAAA;AAAA;AAAA,IAG7D,WAAA,EAAa,KAAA;AAAA,IACb,aAAA,EAAe;AAAA,MACb,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW,EAAC;AAAA,MAC3B,IAAA,EAAM,GAAA;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,MAAA,EAAQ,OAAO,QAAA,KAAa,WAAA,IAAe,SAAS,QAAA,KAAa,QAAA;AAAA;AAAA;AAAA,MAGjE,MAAA,EAAQ,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK;AAAA,KACzB;AAAA,IACA,IAAA,EAAM;AAAA,MACJ,QAAA,EAAU,MAAA;AAAA,MACV,kBAAA,EAAoB,IAAA;AAAA;AAAA;AAAA;AAAA,MAIpB,IAAA,EAAM,OACJ,KAAA,EACA,eAAA,EACA,OACe,EAAA;AAAG;AACtB,GACD,CAAA;AAED,EAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,MAAA,EAA+B,IAAA,CAAK,GAAG,CAAA;AAC9E,EAAA,IAAI,SAAA,EAAW;AAGb,IAAA,MAAM,OAAO,MAAA,CAAO,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,OAAO,IAAI,CAAA;AACpD,IAAA,MAAA,CAAO,IAAA,CAAK,aAAa,YAAY;AACnC,MAAA,MAAM,SAAA;AACN,MAAA,OAAO,IAAA,EAAK;AAAA,IACd,CAAA;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT","file":"supabase-browser.js","sourcesContent":["import { createBrowserClient } from \"@supabase/ssr\"\nimport type { SupabaseClient } from \"@supabase/supabase-js\"\n\n/**\n * Browser Supabase client with session storage in cookies instead of\n * localStorage, so several apps on sibling subdomains (e.g. app/studio/voice\n * on *.nodaro.ai) share one login: sign in on any of them, signed in on all;\n * sign out anywhere, signed out everywhere (supabase-js signOut defaults to\n * the global scope).\n */\nexport interface SharedSupabaseOptions {\n  /** Supabase project URL (https://<ref>.supabase.co). */\n  url: string\n  anonKey: string\n  /**\n   * Cookie Domain for cross-subdomain sharing (e.g. \".nodaro.ai\"). Applied\n   * only when the page's hostname is that domain or a subdomain of it; on any\n   * other host (localhost, preview URLs) cookies stay host-only, which keeps\n   * local dev on per-origin sessions.\n   */\n  cookieDomain?: string\n}\n\n/** supabase-js's default localStorage key: `sb-<project-ref>-auth-token`. */\nfunction legacyStorageKey(url: string): string {\n  return `sb-${new URL(url).hostname.split(\".\")[0]}-auth-token`\n}\n\nfunction domainApplies(hostname: string, cookieDomain: string): boolean {\n  const bare = cookieDomain.replace(/^\\./, \"\")\n  return hostname === bare || hostname.endsWith(`.${bare}`)\n}\n\n/**\n * One-time adoption of a pre-cookie session this origin left in localStorage,\n * so already-signed-in users survive the storage switch. setSession persists\n * through the client's (cookie) storage; dead tokens reject and the user is\n * simply signed out. The legacy key is removed in every outcome.\n * Returns null when there is nothing to migrate.\n */\nfunction migrateLegacySession(\n  client: SupabaseClient<any>,\n  url: string\n): Promise<void> | null {\n  if (typeof localStorage === \"undefined\") return null\n  const key = legacyStorageKey(url)\n  const raw = localStorage.getItem(key)\n  if (!raw) return null\n  return (async () => {\n    try {\n      const parsed = JSON.parse(raw) as {\n        access_token?: string\n        refresh_token?: string\n      }\n      if (parsed.access_token && parsed.refresh_token) {\n        await client.auth.setSession({\n          access_token: parsed.access_token,\n          refresh_token: parsed.refresh_token,\n        })\n      }\n    } catch {\n      // Unparseable or dead legacy session — discard; the user logs in again.\n    } finally {\n      localStorage.removeItem(key)\n    }\n  })()\n}\n\nexport function createSharedSupabaseClient<Db = any>(\n  opts: SharedSupabaseOptions\n): SupabaseClient<Db> {\n  const hostname = typeof location !== \"undefined\" ? location.hostname : \"\"\n  const domain =\n    opts.cookieDomain && domainApplies(hostname, opts.cookieDomain)\n      ? opts.cookieDomain\n      : undefined\n\n  const client = createBrowserClient<Db>(opts.url, opts.anonKey, {\n    // Each app keeps its own module-level singleton; per-call instances keep\n    // tests deterministic.\n    isSingleton: false,\n    cookieOptions: {\n      ...(domain ? { domain } : {}),\n      path: \"/\",\n      sameSite: \"lax\",\n      secure: typeof location !== \"undefined\" && location.protocol === \"https:\",\n      // Long-lived cookie; real session validity is governed by refresh-token\n      // rotation, not cookie lifetime.\n      maxAge: 60 * 60 * 24 * 365,\n    },\n    auth: {\n      flowType: \"pkce\",\n      detectSessionInUrl: true,\n      // Bypass Navigator Lock API: prevents AbortError from\n      // @supabase/auth-js/locks.ts during session synchronization; cross-tab\n      // coordination is non-critical for these apps.\n      lock: async <R>(\n        _name: string,\n        _acquireTimeout: number,\n        fn: () => Promise<R>\n      ): Promise<R> => fn(),\n    },\n  })\n\n  const migration = migrateLegacySession(client as SupabaseClient<any>, opts.url)\n  if (migration) {\n    // Gate reads on the one-time migration so the first getSession() after the\n    // storage switch can't race it — keeps call sites unchanged in the apps.\n    const orig = client.auth.getSession.bind(client.auth)\n    client.auth.getSession = async () => {\n      await migration\n      return orig()\n    }\n  }\n\n  return client\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodaro/sdk",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Typed REST client for the Nodaro API — workflows, jobs, executions, apps, characters, and more.",
   "type": "module",
   "license": "Apache-2.0",
@@ -19,6 +19,11 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
+    },
+    "./supabase": {
+      "types": "./dist/supabase-browser.d.ts",
+      "import": "./dist/supabase-browser.js",
+      "require": "./dist/supabase-browser.cjs"
     }
   },
   "files": [
@@ -36,8 +41,20 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@nodaro/shared": "^1.9.0",
-    "@nodaro/prompts": "^1.0.1"
+    "@nodaro/shared": "^1.13.0",
+    "@nodaro/prompts": "^1.2.1"
+  },
+  "peerDependencies": {
+    "@supabase/ssr": "^0.12.3",
+    "@supabase/supabase-js": "^2.110.5"
+  },
+  "peerDependenciesMeta": {
+    "@supabase/ssr": {
+      "optional": true
+    },
+    "@supabase/supabase-js": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^4.1.2",