feat(supabase_flutter)!: use a system web auth session for OAuth, SSO and identity linking

.coderabbit.yaml

@@ -0,0 +1,4 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  commit_status: true
+  fail_commit_status: false

.github/workflows/build.yml

@@ -22,10 +22,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup Dart
-        uses: dart-lang/setup-dart@e51d8e571e22473a2ddebf0ef8a2123f0ab2c02c # v1.7.1
+      - name: Setup Flutter
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
-          sdk: stable
+          channel: 'stable'
+          cache: true
 
       - name: Detect affected packages
         id: detect
@@ -99,10 +100,7 @@ jobs:
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
           channel: 'stable'
-          # Caching the latest stable is flaky: the cached SDK contains
-          # runner-image-specific binaries that break silently when the runner
-          # image is updated.
-          cache: false
+          cache: true
 
       - name: Show Flutter version
         run: flutter --version

.github/workflows/release-pana.yml

@@ -0,0 +1,78 @@
+name: Release Pana
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  pana:
+    name: Pana (${{ matrix.package }})
+    if: startsWith(github.event.pull_request.title, 'chore(release):')
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        package:
+          - functions_client
+          - gotrue
+          - postgrest
+          - realtime_client
+          - storage_client
+          - supabase
+          - supabase_common
+          - supabase_flutter
+          - yet_another_json_isolate
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup Flutter
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        with:
+          cache: true
+
+      - name: Setup Melos
+        uses: bluefireteam/melos-action@2982f8e4fc92440a219490009d6d05195cb1a6a5 # v3.8.0
+
+      - name: Activate pana
+        run: dart pub global activate pana
+
+      - name: Run pana
+        working-directory: packages/${{ matrix.package }}
+        env:
+          PACKAGE: ${{ matrix.package }}
+        run: |
+          set -euo pipefail
+
+          pana --no-dartdoc --json . > pana.json
+
+          echo "### Pana — $PACKAGE" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Section | Points | Status |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| --- | --- | --- |" >> "$GITHUB_STEP_SUMMARY"
+          jq -r '.report.sections[] | "| \(.id) | \(.grantedPoints)/\(.maxPoints) | \(.status) |"' pana.json >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "Tags: $(jq -r '[.tags[]] | join(", ")' pana.json)" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+
+          web=$(jq -r 'any(.tags[]?; . == "platform:web")' pana.json)
+          wasm=$(jq -r 'any(.tags[]?; . == "is:wasm-ready")' pana.json)
+
+          if [ "$web" = "true" ] && [ "$wasm" != "true" ]; then
+            echo "::error::$PACKAGE supports web (platform:web) but is not WASM-ready. A published package that supports web must compile to WASM. See https://dart.dev/web/wasm"
+            exit 1
+          fi
+
+          echo "$PACKAGE passed the pana web/WASM check (web=$web, wasm-ready=$wasm)."

.github/workflows/sync-compliance.yml

@@ -0,0 +1,16 @@
+name: Sync SDK Compliance Matrix
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+jobs:
+  sync:
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: supabase/sdk/.github/workflows/sync-sdk-compliance.yml@d9f43f5be4056adc33c65fe54f1c9ed1714d67e0
+    secrets:
+      app-id: ${{ secrets.APP_ID }}
+      private-key: ${{ secrets.PRIVATE_KEY }}

.github/workflows/test.yml

@@ -27,10 +27,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup Dart
-        uses: dart-lang/setup-dart@e51d8e571e22473a2ddebf0ef8a2123f0ab2c02c # v1.7.1
+      - name: Setup Flutter
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
-          sdk: stable
+          channel: 'stable'
+          cache: true
 
       - name: Detect affected packages
         id: detect
@@ -63,7 +64,7 @@ jobs:
           echo "Affected packages:"
           echo "$CHANGED"
 
-          DART_PACKAGES="functions_client gotrue postgrest realtime_client storage_client supabase yet_another_json_isolate"
+          DART_PACKAGES="functions_client gotrue postgrest realtime_client storage_client supabase supabase_common yet_another_json_isolate"
 
           entries=()
           for package in $DART_PACKAGES; do
@@ -120,7 +121,7 @@ jobs:
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
           channel: ${{ matrix.channel }}
-          cache: false
+          cache: true
 
       - name: Show Flutter version
         run: flutter --version
@@ -144,7 +145,7 @@ jobs:
         if: ${{ matrix.package.backend }}
         uses: supabase/setup-cli@3c2f5e2ae34c34e428e8e206e2c4d21fa2d20fbf # v2.1.1
         with:
-          version: 2.106.0
+          version: 2.109.1
 
       - name: Print Supabase CLI version
         if: ${{ matrix.package.backend }}
@@ -204,6 +205,7 @@ jobs:
       - name: Upload coverage to Coveralls
         if: ${{ matrix.channel == 'stable' }}
         uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
+        continue-on-error: true
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           parallel: true
@@ -251,10 +253,7 @@ jobs:
         with:
           flutter-version: ${{ matrix.flutter-version != 'latest' && matrix.flutter-version || '' }}
           channel: 'stable'
-          # Caching the latest stable is flaky: the cached SDK contains
-          # runner-image-specific binaries that break silently when the runner
-          # image is updated. Pinned versions like 3.35.x are stable to cache.
-          cache: ${{ matrix.flutter-version != 'latest' }}
+          cache: true
 
       - name: Show Flutter version
         run: flutter --version
@@ -285,6 +284,7 @@ jobs:
       - name: Upload coverage to Coveralls
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.flutter-version == 'latest' }}
         uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
+        continue-on-error: true
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           parallel: true
@@ -296,11 +296,6 @@ jobs:
         if: ${{ matrix.os == 'ubuntu-latest' && matrix.flutter-version == 'latest'}}
         run: flutter test --platform chrome
 
-      - name: Build example for web (WASM)
-        if: ${{ matrix.os == 'ubuntu-latest' && matrix.flutter-version == 'latest'}}
-        working-directory: packages/supabase_flutter/example
-        run: flutter build web --wasm
-
   dcm:
     name: DCM
     needs: changes
@@ -338,10 +333,12 @@ jobs:
     steps:
       - name: Close parallel coverage build
         uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
+        continue-on-error: true
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           parallel-finished: true
-          carryforward: 'functions_client,gotrue,postgrest,realtime_client,storage_client,supabase,yet_another_json_isolate,supabase_flutter'
+          carryforward: 'functions_client,gotrue,postgrest,realtime_client,storage_client,supabase,supabase_common,yet_another_json_isolate,supabase_flutter'
+          fail-on-error: false
 
   test-result:
     name: Test result

.github/workflows/validate-capabilities.yml

@@ -6,9 +6,11 @@ on:
 
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   validate:
     permissions:
       contents: read
+      pull-requests: write
     uses: supabase/sdk/.github/workflows/validate-sdk-compliance-dart.yml@main

.github/workflows/wasm.yml

@@ -0,0 +1,125 @@
+name: WASM
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    name: Detect affected packages
+    runs-on: ubuntu-latest
+    outputs:
+      flutter: ${{ steps.detect.outputs.flutter }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Setup Flutter
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        with:
+          channel: 'stable'
+          cache: true
+
+      - name: Detect affected packages
+        id: detect
+        run: |
+          set -euo pipefail
+
+          dart pub global activate melos
+
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            BASE="${{ github.event.pull_request.base.sha }}"
+          else
+            BASE="${{ github.event.before }}"
+          fi
+
+          FORCE_ALL=false
+          if [ -z "$BASE" ] || [ "$BASE" = "0000000000000000000000000000000000000000" ]; then
+            FORCE_ALL=true
+          elif git diff --name-only "$BASE...HEAD" \
+              | grep -qE '^(\.github/workflows/wasm\.yml|pubspec\.yaml|pubspec\.lock|supabase/)'; then
+            FORCE_ALL=true
+          fi
+
+          if [ "$FORCE_ALL" = "true" ]; then
+            echo "Running all packages."
+            CHANGED=$(melos list --json | jq -r '.[].name')
+          else
+            CHANGED=$(melos list --json --diff="$BASE...HEAD" --include-dependents | jq -r '.[].name')
+          fi
+
+          echo "Affected packages:"
+          echo "$CHANGED"
+
+          if echo "$CHANGED" | grep -qx "supabase_flutter"; then
+            echo "flutter=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "flutter=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  test-wasm:
+    name: Test and build WASM
+    needs: changes
+    if: ${{ needs.changes.outputs.flutter == 'true' }}
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: packages/supabase_flutter
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup Flutter
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        with:
+          channel: 'stable'
+          # Caching the latest stable is flaky: the cached SDK contains
+          # runner-image-specific binaries that break silently when the runner
+          # image is updated.
+          cache: false
+
+      - name: Show Flutter version
+        run: flutter --version
+
+      - name: Bootstrap workspace
+        run: |
+          cd ../../
+          dart pub global activate melos
+          melos bootstrap
+
+      - name: Test web (WASM)
+        # Serial compilation avoids the memory pressure from parallel dart2wasm
+        # runs that previously caused suite loading timeouts in CI.
+        run: flutter test --platform chrome --wasm --concurrency=1
+
+      - name: Build example for web (WASM)
+        working-directory: packages/supabase_flutter/example
+        run: flutter build web --wasm
+
+  wasm-result:
+    name: WASM result
+    needs: [changes, test-wasm]
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify all jobs succeeded
+        run: |
+          if ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}; then
+            echo "One or more jobs failed or were cancelled."
+            exit 1
+          fi
+          echo "All required jobs passed or were skipped."

.sdk-parse-ignore

@@ -7,3 +7,13 @@
 # Prefer annotating such declarations with `@internal` (from package:meta): the
 # extractor honours it and excludes them from the scan. Use this file only for
 # paths that cannot carry that annotation, e.g. generated sources.
+
+# supabase_common is an internal, cross-package helper library. Its public
+# symbols are imported by the other packages, so they cannot be marked
+# @internal (that would trigger invalid_use_of_internal_member in the
+# consumers). Exclude the whole package from the public-API scan instead.
+packages/supabase_common/
+
+# The examples are standalone demo apps, not part of the published SDK, so their
+# public classes are not capability-matrix symbols.
+examples/