Problem

v2.106.0 introduced @supabase/tracing with a dynamic import('@opentelemetry/api'). Rolldown bundles @supabase/tracing's ESM source into dist/index.cjs of supabase-js (it prefers ESM for tree-shaking), so the literal import() ends up in the CJS bundle. hermesc — the Hermes bytecode compiler used for every React Native release build — rejects import() at parse time, before any dead-code elimination, breaking every RN release build with Invalid expression encountered.

The ESM build of supabase-js has a parallel problem: when downstream consumers build through Turbopack / webpack / Vite without @opentelemetry/api installed, those bundlers try to statically resolve the specifier and fail with Module not found: Can't resolve '@opentelemetry/api'. Magic comments suppress this — but Rolldown drops them, and Turbopack only honors them in a specific shape.

Fixes #2380.

Fix

Two independent changes in packages/core/supabase-js/tsdown.config.ts:

1. CJS bundle — alias @supabase/tracing to its CJS main file

inputOptions: (_options, format) => {
  if (format === 'cjs') {
    return {
      resolve: {
        alias: {
          '@supabase/tracing': createRequire(import.meta.url).resolve('@supabase/tracing'),
        },
      },
    }
  }
}

tsc's CJS emit (packages/shared/tracing/dist/main/index.js) already lowers import() to require(). The alias bypasses the import export condition Rolldown's platform: 'node' default would otherwise pick. Result: dist/index.cjs ends up with require() (Hermes-safe; also CSP-safe — no new Function()). dist/index.mjs keeps native import() (valid ESM; Metro resolves the require condition for React Native and never sees the ESM bundle).

2. ESM bundle — inject canonical bundler-ignore comments after rolldown's printer runs

const injectBundlerIgnoreComments = (): Plugin => ({
  name: 'inject-bundler-ignore-comments',
  generateBundle(_options, bundle) {
    for (const [fileName, chunk] of Object.entries(bundle)) {
      if (chunk.type !== 'chunk' || !fileName.endsWith('.mjs')) continue
      chunk.code = chunk.code.replace(
        /import\(\s*([A-Za-z_$][\w$]*)\s*\)/g,
        'import(/* webpackIgnore: true */ /* turbopackIgnore: true */ /* @vite-ignore */ $1)'
      )
    }
  },
})

Rolldown's printer only preserves comments containing @vite-ignore, @__PURE__, or @__NO_SIDE_EFFECTS__ — standalone /* webpackIgnore */ and /* turbopackIgnore */ blocks get stripped. Turbopack only honors /* turbopackIgnore: true */ when it occupies its own block (every Next.js internal usage is single-purpose; multi-keyword blocks are silently ignored — this is what broke 2.106.1-beta.2 on Vercel). The two constraints cannot be satisfied from source.

The plugin runs after rolldown's printer and rewrites every import() in dist/index.mjs into the canonical single-purpose shape that all three bundlers accept. extract.ts is correspondingly reverted to a bare import(OTEL_PKG) — source-side magic comments are dead weight.

Regression test

packages/core/supabase-js/test/bundle-hermes-compat.test.cjs (wired into the module-resolution CI job) asserts three properties of the built dist files:

1. dist/index.cjs contains no import( expression — Hermes-safe / React Native compatible.
2. dist/index.cjs contains no new Function( — browser strict-CSP safe.
3. Every import( in dist/index.mjs is in the canonical shape: /* webpackIgnore: true */ /* turbopackIgnore: true */ /* @vite-ignore */ <ident>, each directive in its own block. Multi-keyword blocks fail this check explicitly.

Verification

• 2.106.1-beta.0 confirmed working for Hermes/RN by @sbs44, @ryanshepps, @7ttp.
• Spencer's hermesc repro (expo export:embed + hermesc) exits 0.
• Next beta (post-merge) needs validation against Turbopack on the multiplayer.dev Vercel branch that surfaced the Turbopack regression.