@supabase/supabase-js 2.105.5-beta.8 → 2.105.5-beta.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supabase/supabase-js",
-  "version": "2.105.5-beta.8",
+  "version": "2.105.5-beta.9",
   "description": "Isomorphic Javascript SDK for Supabase",
   "keywords": [
     "javascript",
@@ -48,14 +48,46 @@
     "url": "https://github.com/supabase/supabase-js.git",
     "directory": "packages/core/supabase-js"
   },
+  "scripts": {
+    "build": "tsdown",
+    "build:watch": "tsdown --watch",
+    "test": "npm run test:types && npm run test:run",
+    "test:all": "npm run test:types && npm run test:run && npm run test:integration && npm run test:integration:browser",
+    "test:run": "jest --runInBand --detectOpenHandles",
+    "test:unit": "jest --runInBand --detectOpenHandles test/unit",
+    "test:coverage": "jest --runInBand --coverage --testPathIgnorePatterns=\"test/integration|test/deno|\\.[mc]js$\"",
+    "test:integration": "jest --runInBand --detectOpenHandles test/integration.test.ts",
+    "test:integration:browser": "deno test --allow-all test/integration.browser.test.ts",
+    "test:edge-functions": "cd test/deno && npm run test:edge-functions",
+    "test:deno": "cd test/deno && npm run test",
+    "test:watch": "jest --watch --verbose false --silent false",
+    "test:node:playwright": "cd test/integration/node-browser && npm install && cp ../../../dist/umd/supabase.js . && npm run test",
+    "test:bun": "cd test/integration/bun && bun install && bun test",
+    "test:expo": "cd test/integration/expo && npm test",
+    "test:next": "cd test/integration/next && npm test",
+    "test:types": "tsd --files test/types/index.test-d.ts && tsd --typings dist/cors.d.cts --files test/types/cors.test-d.ts && jsr publish --dry-run --allow-dirty",
+    "test:exports": "attw --pack . --ignore-rules no-resolution",
+    "test:esm": "node test/module-resolution.test.mjs && node test/module-resolution-cors.test.mjs",
+    "test:cjs": "node test/module-resolution.test.cjs && node test/module-resolution-cors.test.cjs",
+    "test:module-resolution": "npm run test:exports && npm run test:esm && npm run test:cjs",
+    "docs": "typedoc --entryPoints src/index.ts --entryPoints src/cors.ts --out docs/v2",
+    "docs:json": "typedoc --entryPoints src/index.ts --entryPoints src/cors.ts --json docs/v2/spec.json --excludeExternals",
+    "serve:coverage": "npx nx test:coverage supabase-js && npx --yes serve test/coverage",
+    "update:test-deps": "npm run update:test-deps:expo && npm run update:test-deps:next && npm run update:test-deps:deno && npm run update:test-deps:bun",
+    "update:test-deps:expo": "cd test/integration/expo && npm install",
+    "update:test-deps:next": "cd test/integration/next && npm install",
+    "update:test-deps:deno": "cd test/deno && npm install",
+    "update:test-deps:bun": "cd test/integration/bun && bun install"
+  },
   "dependencies": {
-    "@supabase/auth-js": "2.105.5-beta.8",
-    "@supabase/postgrest-js": "2.105.5-beta.8",
-    "@supabase/functions-js": "2.105.5-beta.8",
-    "@supabase/realtime-js": "2.105.5-beta.8",
-    "@supabase/storage-js": "2.105.5-beta.8"
+    "@supabase/auth-js": "2.105.5-beta.9",
+    "@supabase/functions-js": "2.105.5-beta.9",
+    "@supabase/postgrest-js": "2.105.5-beta.9",
+    "@supabase/realtime-js": "2.105.5-beta.9",
+    "@supabase/storage-js": "2.105.5-beta.9"
   },
   "devDependencies": {
+    "@supabase/tracing": "*",
     "jsr": "^0.13.5",
     "puppeteer": "^24.9.0"
   },
@@ -87,36 +119,5 @@
   },
   "engines": {
     "node": ">=20.0.0"
-  },
-  "scripts": {
-    "build": "tsdown",
-    "build:watch": "tsdown --watch",
-    "test": "npm run test:types && npm run test:run",
-    "test:all": "npm run test:types && npm run test:run && npm run test:integration && npm run test:integration:browser",
-    "test:run": "jest --runInBand --detectOpenHandles",
-    "test:unit": "jest --runInBand --detectOpenHandles test/unit",
-    "test:coverage": "jest --runInBand --coverage --testPathIgnorePatterns=\"test/integration|test/deno|\\.[mc]js$\"",
-    "test:integration": "jest --runInBand --detectOpenHandles test/integration.test.ts",
-    "test:integration:browser": "deno test --allow-all --node-modules-dir=auto test/integration.browser.test.ts",
-    "test:edge-functions": "cd test/deno && npm run test:edge-functions",
-    "test:deno": "cd test/deno && npm run test",
-    "test:watch": "jest --watch --verbose false --silent false",
-    "test:node:playwright": "cd test/integration/node-browser && npm install && cp ../../../dist/umd/supabase.js . && npm run test",
-    "test:bun": "cd test/integration/bun && bun install && bun test",
-    "test:expo": "cd test/integration/expo && npm test",
-    "test:next": "cd test/integration/next && npm test",
-    "test:types": "tsd --files test/types/index.test-d.ts && tsd --typings dist/cors.d.cts --files test/types/cors.test-d.ts && jsr publish --dry-run --allow-dirty",
-    "test:exports": "attw --pack . --ignore-rules no-resolution",
-    "test:esm": "node test/module-resolution.test.mjs && node test/module-resolution-cors.test.mjs",
-    "test:cjs": "node test/module-resolution.test.cjs && node test/module-resolution-cors.test.cjs",
-    "test:module-resolution": "npm run test:exports && npm run test:esm && npm run test:cjs",
-    "docs": "typedoc --entryPoints src/index.ts --entryPoints src/cors.ts --out docs/v2",
-    "docs:json": "typedoc --entryPoints src/index.ts --entryPoints src/cors.ts --json docs/v2/spec.json --excludeExternals",
-    "serve:coverage": "pnpm nx test:coverage supabase-js && pnpm dlx serve test/coverage",
-    "update:test-deps": "pnpm run update:test-deps:expo && pnpm run update:test-deps:next && pnpm run update:test-deps:deno && pnpm run update:test-deps:bun",
-    "update:test-deps:expo": "cd test/integration/expo && pnpm install --ignore-workspace",
-    "update:test-deps:next": "cd test/integration/next && pnpm install --ignore-workspace",
-    "update:test-deps:deno": "cd test/deno && pnpm install --ignore-workspace",
-    "update:test-deps:bun": "cd test/integration/bun && bun install"
   }
-}
+}

package/src/SupabaseClient.ts

@@ -18,9 +18,14 @@ import {
   DEFAULT_DB_OPTIONS,
   DEFAULT_GLOBAL_OPTIONS,
   DEFAULT_REALTIME_OPTIONS,
+  DEFAULT_TRACE_PROPAGATION_OPTIONS,
 } from './lib/constants'
 import { fetchWithAuth } from './lib/fetch'
-import { applySettingDefaults, validateSupabaseUrl } from './lib/helpers'
+import {
+  applySettingDefaults,
+  validateSupabaseUrl,
+  type ResolvedSupabaseClientOptions,
+} from './lib/helpers'
 import { SupabaseAuthClient } from './lib/SupabaseAuthClient'
 import type {
   Fetch,
@@ -89,6 +94,7 @@ export default class SupabaseClient<
   protected accessToken?: () => Promise<string | null>
 
   protected headers: Record<string, string>
+  protected settings?: ResolvedSupabaseClientOptions<SchemaName>
 
   /**
    * Create a new client for use in the browser.
@@ -298,9 +304,11 @@ export default class SupabaseClient<
       realtime: DEFAULT_REALTIME_OPTIONS,
       auth: { ...DEFAULT_AUTH_OPTIONS, storageKey: defaultStorageKey },
       global: DEFAULT_GLOBAL_OPTIONS,
+      tracePropagation: DEFAULT_TRACE_PROPAGATION_OPTIONS,
     }
 
     const settings = applySettingDefaults(options ?? {}, DEFAULTS)
+    this.settings = settings
 
     this.storageKey = settings.auth.storageKey ?? ''
     this.headers = settings.global.headers ?? {}
@@ -325,7 +333,13 @@ export default class SupabaseClient<
       })
     }
 
-    this.fetch = fetchWithAuth(supabaseKey, this._getAccessToken.bind(this), settings.global.fetch)
+    this.fetch = fetchWithAuth(
+      supabaseKey,
+      supabaseUrl,
+      this._getAccessToken.bind(this),
+      settings.global.fetch,
+      settings.tracePropagation
+    )
     this.realtime = this._initRealtimeClient({
       headers: this.headers,
       accessToken: this._getAccessToken.bind(this),

package/src/lib/constants.ts

@@ -1,6 +1,6 @@
 // constants.ts
 import { RealtimeClientOptions } from '@supabase/realtime-js'
-import { SupabaseAuthClientOptions } from './types'
+import { SupabaseAuthClientOptions, TracePropagationOptions } from './types'
 import { version } from './version'
 
 let JS_ENV = ''
@@ -33,3 +33,8 @@ export const DEFAULT_AUTH_OPTIONS: SupabaseAuthClientOptions = {
 }
 
 export const DEFAULT_REALTIME_OPTIONS: RealtimeClientOptions = {}
+
+export const DEFAULT_TRACE_PROPAGATION_OPTIONS: TracePropagationOptions = {
+  enabled: false,
+  respectSamplingDecision: true,
+}

package/src/lib/fetch.ts

@@ -1,3 +1,13 @@
+import {
+  extractTraceContext,
+  parseTraceParent,
+  shouldPropagateToTarget,
+  getDefaultPropagationTargets,
+  type TraceContext,
+  type TracePropagationTarget,
+} from '@supabase/tracing'
+import type { TracePropagationOptions } from './types'
+
 type Fetch = typeof fetch
 
 export const resolveFetch = (customFetch?: Fetch): Fetch => {
@@ -13,12 +23,22 @@ export const resolveHeadersConstructor = () => {
 
 export const fetchWithAuth = (
   supabaseKey: string,
+  supabaseUrl: string,
   getAccessToken: () => Promise<string | null>,
-  customFetch?: Fetch
+  customFetch?: Fetch,
+  tracePropagationOptions?: TracePropagationOptions
 ): Fetch => {
   const fetch = resolveFetch(customFetch)
   const HeadersConstructor = resolveHeadersConstructor()
 
+  // Pre-compute trace propagation state once. When disabled, the per-request
+  // path skips all tracing work with a single truthy check.
+  const traceEnabled = tracePropagationOptions?.enabled === true
+  const respectSampling = tracePropagationOptions?.respectSamplingDecision !== false
+  const traceTargets: TracePropagationTarget[] | null = traceEnabled
+    ? getDefaultPropagationTargets(supabaseUrl)
+    : null
+
   return async (input, init) => {
     const accessToken = (await getAccessToken()) ?? supabaseKey
     let headers = new HeadersConstructor(init?.headers)
@@ -31,6 +51,50 @@ export const fetchWithAuth = (
       headers.set('Authorization', `Bearer ${accessToken}`)
     }
 
+    if (traceTargets) {
+      const traceHeaders = await getTraceHeaders(input, traceTargets, respectSampling)
+
+      if (traceHeaders) {
+        if (traceHeaders.traceparent && !headers.has('traceparent')) {
+          headers.set('traceparent', traceHeaders.traceparent)
+        }
+        if (traceHeaders.tracestate && !headers.has('tracestate')) {
+          headers.set('tracestate', traceHeaders.tracestate)
+        }
+        if (traceHeaders.baggage && !headers.has('baggage')) {
+          headers.set('baggage', traceHeaders.baggage)
+        }
+      }
+    }
+
     return fetch(input, { ...init, headers })
   }
 }
+
+async function getTraceHeaders(
+  input: RequestInfo | URL,
+  targets: TracePropagationTarget[],
+  respectSampling: boolean
+): Promise<TraceContext | null> {
+  const targetUrl: string | URL =
+    typeof input === 'string' ? input : input instanceof URL ? input : input.url
+
+  if (!shouldPropagateToTarget(targetUrl, targets)) {
+    return null
+  }
+
+  const traceContext = await extractTraceContext()
+
+  if (!traceContext || !traceContext.traceparent) {
+    return null
+  }
+
+  if (respectSampling) {
+    const parsed = parseTraceParent(traceContext.traceparent)
+    if (parsed && !parsed.isSampled) {
+      return null
+    }
+  }
+
+  return traceContext
+}

package/src/lib/helpers.ts

@@ -1,5 +1,11 @@
 // helpers.ts
-import { SupabaseClientOptions } from './types'
+import { SupabaseClientOptions, TracePropagationOptions } from './types'
+
+function normalizeTracePropagation(
+  value: TracePropagationOptions | boolean | undefined
+): TracePropagationOptions | undefined {
+  return typeof value === 'boolean' ? { enabled: value } : value
+}
 
 export function uuid() {
   return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function (c) {
@@ -15,6 +21,13 @@ export function ensureTrailingSlash(url: string): string {
 
 export const isBrowser = () => typeof window !== 'undefined'
 
+export type ResolvedSupabaseClientOptions<SchemaName> = Omit<
+  Required<SupabaseClientOptions<SchemaName>>,
+  'tracePropagation'
+> & {
+  tracePropagation: TracePropagationOptions
+}
+
 export function applySettingDefaults<
   Database = any,
   SchemaName extends string & keyof Database = 'public' extends keyof Database
@@ -23,7 +36,7 @@ export function applySettingDefaults<
 >(
   options: SupabaseClientOptions<SchemaName>,
   defaults: SupabaseClientOptions<any>
-): Required<SupabaseClientOptions<SchemaName>> {
+): ResolvedSupabaseClientOptions<SchemaName> {
   const {
     db: dbOptions,
     auth: authOptions,
@@ -37,7 +50,11 @@ export function applySettingDefaults<
     global: DEFAULT_GLOBAL_OPTIONS,
   } = defaults
 
-  const result: Required<SupabaseClientOptions<SchemaName>> = {
+  // Accept either a boolean shorthand or an options object on both sides.
+  const tracePropagationOptions = normalizeTracePropagation(options.tracePropagation)
+  const DEFAULT_TRACE_PROPAGATION_OPTIONS = normalizeTracePropagation(defaults.tracePropagation)
+
+  const result: ResolvedSupabaseClientOptions<SchemaName> = {
     db: {
       ...DEFAULT_DB_OPTIONS,
       ...dbOptions,
@@ -59,6 +76,14 @@ export function applySettingDefaults<
         ...(globalOptions?.headers ?? {}),
       },
     },
+    tracePropagation: {
+      enabled:
+        tracePropagationOptions?.enabled ?? DEFAULT_TRACE_PROPAGATION_OPTIONS?.enabled ?? false,
+      respectSamplingDecision:
+        tracePropagationOptions?.respectSamplingDecision ??
+        DEFAULT_TRACE_PROPAGATION_OPTIONS?.respectSamplingDecision ??
+        true,
+    },
     accessToken: async () => '',
   }
 

package/src/lib/rest/types/common/common.ts

@@ -5,7 +5,7 @@
  * Source: packages/core/postgrest-js/src/types/common/
  *
  * To update this file, modify the source in postgrest-js and run:
- *   pnpm run codegen
+ *   npm run codegen
  */
 
 // Types that are shared between supabase-js and postgrest-js

package/src/lib/rest/types/common/rpc.ts

@@ -5,7 +5,7 @@
  * Source: packages/core/postgrest-js/src/types/common/
  *
  * To update this file, modify the source in postgrest-js and run:
- *   pnpm run codegen
+ *   npm run codegen
  */
 
 import type { GenericFunction, GenericSchema, GenericSetofOption } from './common'

package/src/lib/types.ts

@@ -25,6 +25,42 @@ export interface SupabaseAuthClientOptions extends GoTrueClientOptions {}
 
 export type Fetch = typeof fetch
 
+/**
+ * Configuration options for trace context propagation.
+ *
+ * Enables distributed tracing across Supabase services using W3C Trace Context
+ * and OpenTelemetry standards. When enabled, the SDK automatically attaches
+ * trace context headers (traceparent, tracestate, baggage) to outgoing requests
+ * to Supabase domains.
+ *
+ * @see https://www.w3.org/TR/trace-context/
+ * @see https://opentelemetry.io/docs/concepts/context-propagation/
+ */
+export interface TracePropagationOptions {
+  /**
+   * Enable trace propagation. Disabled by default.
+   *
+   * When enabled, automatically detects and propagates active trace context
+   * from the OpenTelemetry API to outgoing Supabase requests. Trace context
+   * is only propagated to Supabase domains (*.supabase.co, *.supabase.in,
+   * localhost) for security.
+   *
+   * @default false
+   */
+  enabled?: boolean
+
+  /**
+   * Respect upstream sampling decisions.
+   *
+   * When true, trace context will not be propagated if the upstream trace
+   * indicates non-sampling (sampled flag = 0 in traceparent header).
+   * This helps reduce overhead when traces are not being collected.
+   *
+   * @default true
+   */
+  respectSamplingDecision?: boolean
+}
+
 export type SupabaseClientOptions<SchemaName> = {
   /**
    * The Postgres schema which your tables belong to. Must be on the list of exposed schemas in Supabase. Defaults to `public`.
@@ -175,6 +211,28 @@ export type SupabaseClientOptions<SchemaName> = {
    * authentications concurrently in the same application.
    */
   accessToken?: () => Promise<string | null>
+  /**
+   * Enable OpenTelemetry / W3C trace context propagation to Supabase services.
+   *
+   * Disabled by default. Pass `true` for the common case (auto-detect an
+   * active OTel context and inject `traceparent` / `tracestate` / `baggage`
+   * headers) or an object for fine-grained control.
+   *
+   * Requires `@opentelemetry/api` to be installed in your application; if
+   * not present, the SDK silently no-ops.
+   *
+   * @example
+   * ```ts
+   * // Shorthand — opt in with defaults.
+   * createClient(url, key, { tracePropagation: true })
+   *
+   * // Advanced — always propagate, even for non-sampled traces.
+   * createClient(url, key, {
+   *   tracePropagation: { enabled: true, respectSamplingDecision: false },
+   * })
+   * ```
+   */
+  tracePropagation?: TracePropagationOptions | boolean
 }
 
 /**

package/src/lib/version.ts

@@ -4,4 +4,4 @@
 // - Debugging and support (identifying which version is running)
 // - Telemetry and logging (version reporting in errors/analytics)
 // - Ensuring build artifacts match the published package version
-export const version = '2.105.5-beta.8'
+export const version = '2.105.5-beta.9'

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2020 Supabase
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.