[sweatybridge]

🔍 Description

What changed?

Implements the RFC "Namespaced sessions on a shared branch".

• createClient(url, key, { namespace: 's07' }): prefixes Realtime topics (s07:room) and Storage paths (s07/a.png), sends x-supabase-namespace on every request, and adds the namespace to the default auth storageKey. Unset = no change.
• namespaceFrom(req): lets server code adopt the caller's namespace. The header is added to corsHeaders.
• storage-js pathPrefix: prefixes input paths and strips the prefix from returned paths/names. fullPath is left as is.
• @supabase/supabase-js/dev: devSession({ slot, branchRef, signInAs }) with branch/key guards, test sign-in, uniq(), and a scoped adminClient({ scope }).

Why was this change needed?

Lets many dev sessions share one branch without a branch per session.

🔄 Breaking changes

• This PR contains no breaking changes

📋 Checklist

• I have read the Contributing Guidelines
• My PR title follows the conventional commit format
• I have run pnpm nx format
• I have added tests for new functionality
• I have updated documentation

📝 Additional notes

How the RFC's open questions are answered here:

• Storage prefix: applies to all buckets; no per-bucket opt-out yet (Q1).
• Separators: : for topics, / for paths (Q2).
• Header: x-supabase-namespace (Q3).
• NODE_ENV=production: devSession refuses to run (Q6).
• Admin upsert: only allowed with ignoreDuplicates: true, since an update on conflict could overwrite rows outside the scope.

The capability matrix has no feature for these yet, so the new symbols are under the top-level supporting_symbols in sdk-compliance.yaml until one is added in supabase/sdk.

The storage-js integration suites were not run locally because Docker isn't available.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JGHpsXzX74YQxtqBX35BTx

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@supabase/auth-js

npm i https://pkg.pr.new/@supabase/auth-js@2791

@supabase/functions-js

npm i https://pkg.pr.new/@supabase/functions-js@2791

@supabase/postgrest-js

npm i https://pkg.pr.new/@supabase/postgrest-js@2791

@supabase/realtime-js

npm i https://pkg.pr.new/@supabase/realtime-js@2791

@supabase/storage-js

npm i https://pkg.pr.new/@supabase/storage-js@2791

@supabase/supabase-js

npm i https://pkg.pr.new/@supabase/supabase-js@2791

commit: a0933a1

[coveralls]

coverage: 82.725% (+0.5%) from 82.263% — claude/linear-document-impl-j0jjpn into master

[sweatybridge]

Integration Tests (All Platforms) fails in the Deno targets only. esm.sh returns 500 (no space left on device) for every PR build, master commits included, so the Deno tests and the CORS edge functions can't import supabase-js. Not caused by this PR, and there's no fix on our side. I'll re-run the job once esm.sh recovers.

---

Generated by Claude Code