Bug:jsDelivr +esm breaks Supabase JS v2 due to default imports of modules exporting default null

[troop194roselle-art]

Summary

Using Supabase JS v2 directly in a browser via jsDelivr +esm can fail at runtime with errors such as:

Uncaught TypeError: Cannot read properties of null (reading 'AuthClient')
Uncaught TypeError: Cannot read properties of null (reading 'FunctionsHttpError')

Environment

• Browser ESM (<script type="module">)
• No bundler
• Import via:
  import { createClient } from 'https://cdn.jsdelivr.net/npm/@supabase/supabase-js@2/+esm';

Root Cause

Several Supabase submodules (e.g. @supabase/auth-js, @supabase/functions-js) explicitly define:
export default null;
and expose their APIs exclusively via named exports (e.g. AuthClient, FunctionsHttpError).

The jsDelivr +esm rewrite imports these modules using default imports:
import s from 'https://cdn.jsdelivr.net/npm/@supabase/auth-js@2/+esm';
Because the default export is explicitly null, the imported value is null, causing runtime failures when Supabase JS accesses:
s.AuthClient
s.FunctionsHttpError

This affects multiple submodules.

Minimal Reproduction

<script type="module"> import { createClient } from 'https://cdn.jsdelivr.net/npm/@supabase/supabase-js@2/+esm';

  const supabase = createClient(
    'https://PROJECT_ID.supabase.co',
    'PUBLIC_ANON_KEY'
  );

  console.log(supabase);
</script>

The script loads, then fails at runtime when auth or functions code is evaluated.

Why this matters

unpkg.com cannot be used as a fallback because it does not rewrite bare imports

jsDelivr +esm is the only documented way to use Supabase JS without a bundler

This results in runtime failures without user misconfiguration

How I worked around this locally

To isolate the issue, I copied the jsDelivr-generated ESM output of @supabase/supabase-js locally and modified its imports.

Specifically:
I modified
import { createClient } from 'https://cdn.jsdelivr.net/npm/@supabase/auth-js@2/+esm';
to
import {createClient } from './localClient.js';

Original (jsDelivr output) was copied to localClient.js.

1. I replaced default imports of Supabase submodules with namespace imports.
2. Example change for @supabase/auth-js:

Original (jsDelivr output):
import s from "https://cdn.jsdelivr.net/npm/@supabase/auth-js@2/+esm";

then modified locally to:
import * as s from "https://cdn.jsdelivr.net/npm/@supabase/auth-js@2/+esm";

What is required to resolve this issue

The jsDelivr +esm output must not import Supabase submodules using default imports when those modules explicitly define export default null.

Specifically, imports such as:

import s from "https://cdn.jsdelivr.net/npm/@supabase/auth-js@2/+esm";
must be replaced with namespace or named imports, for example:
import * as s from "https://cdn.jsdelivr.net/npm/@supabase/auth-js@2/+esm";