package.json

@@ -5,6 +5,7 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
+    "dev:lan": "vite --host",
     "build": "tsc -b && vite build",
     "lint": "oxlint",
     "preview": "vite preview",

src/data/supabaseClient.ts

@@ -1,13 +1,27 @@
 import { createClient } from '@supabase/supabase-js'
 
-const url = import.meta.env.VITE_SUPABASE_URL
+const rawUrl = import.meta.env.VITE_SUPABASE_URL
 const anonKey = import.meta.env.VITE_SUPABASE_ANON_KEY
 
-if (!url || !anonKey) {
+if (!rawUrl || !anonKey) {
   throw new Error(
     'Missing VITE_SUPABASE_URL / VITE_SUPABASE_ANON_KEY. Copy .env.example to .env.local and fill them in ' +
       '(run `npx supabase start` then `npx supabase status` for local values).',
   )
 }
 
-export const supabase = createClient(url, anonKey)
+/** Local Supabase (127.0.0.1/localhost) only: swap in whatever hostname the
+ *  page itself was loaded from. Lets `npm run dev:lan` + a phone on the same
+ *  Wi-Fi work without ever hand-editing VITE_SUPABASE_URL — loading the app
+ *  via the LAN IP makes API calls target that same IP instead of a loopback
+ *  address the phone can't reach. Never touches a real (non-local)
+ *  production URL, so this is a no-op outside local dev. */
+function resolveUrl(value: string): string {
+  const url = new URL(value)
+  if (url.hostname === '127.0.0.1' || url.hostname === 'localhost') {
+    url.hostname = window.location.hostname
+  }
+  return url.toString()
+}
+
+export const supabase = createClient(resolveUrl(rawUrl), anonKey)