@cerefox/memory 0.11.1 → 1.0.0-beta.2

package/dist/bin/cerefox.js

@@ -7184,7 +7184,7 @@ var exports_meta = {};
 __export(exports_meta, {
   PKG_VERSION: () => PKG_VERSION
 });
-var PKG_VERSION = "0.11.1";
+var PKG_VERSION = "1.0.0-beta.2";
 var init_meta = () => {};
 
 // ../../node_modules/.bun/tslib@2.8.1/node_modules/tslib/tslib.js
@@ -7792,7 +7792,7 @@ var require_tslib = __commonJS((exports, module) => {
   });
 });
 
-// ../../node_modules/.bun/@supabase+functions-js@2.108.1/node_modules/@supabase/functions-js/dist/main/helper.js
+// ../../node_modules/.bun/@supabase+functions-js@2.110.2/node_modules/@supabase/functions-js/dist/main/helper.js
 var require_helper = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.resolveFetch = undefined;
@@ -7805,7 +7805,7 @@ var require_helper = __commonJS((exports) => {
   exports.resolveFetch = resolveFetch;
 });
 
-// ../../node_modules/.bun/@supabase+functions-js@2.108.1/node_modules/@supabase/functions-js/dist/main/types.js
+// ../../node_modules/.bun/@supabase+functions-js@2.110.2/node_modules/@supabase/functions-js/dist/main/types.js
 var require_types = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.FunctionRegion = exports.FunctionsHttpError = exports.FunctionsRelayError = exports.FunctionsFetchError = exports.FunctionsError = undefined;
@@ -7866,7 +7866,7 @@ var require_types = __commonJS((exports) => {
   })(FunctionRegion || (exports.FunctionRegion = FunctionRegion = {}));
 });
 
-// ../../node_modules/.bun/@supabase+functions-js@2.108.1/node_modules/@supabase/functions-js/dist/main/FunctionsClient.js
+// ../../node_modules/.bun/@supabase+functions-js@2.110.2/node_modules/@supabase/functions-js/dist/main/FunctionsClient.js
 var require_FunctionsClient = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.FunctionsClient = undefined;
@@ -7902,7 +7902,8 @@ var require_FunctionsClient = __commonJS((exports) => {
             url.searchParams.set("forceFunctionRegion", region);
           }
           let body;
-          if (functionArgs && (headers && !Object.prototype.hasOwnProperty.call(headers, "Content-Type") || !headers)) {
+          const hasContentTypeHeader = !!headers && Object.keys(headers).some((key) => key.toLowerCase() === "content-type");
+          if (functionArgs && !hasContentTypeHeader) {
             if (typeof Blob !== "undefined" && functionArgs instanceof Blob || functionArgs instanceof ArrayBuffer) {
               _headers["Content-Type"] = "application/octet-stream";
               body = functionArgs;
@@ -7979,7 +7980,7 @@ var require_FunctionsClient = __commonJS((exports) => {
   exports.FunctionsClient = FunctionsClient;
 });
 
-// ../../node_modules/.bun/@supabase+functions-js@2.108.1/node_modules/@supabase/functions-js/dist/main/index.js
+// ../../node_modules/.bun/@supabase+functions-js@2.110.2/node_modules/@supabase/functions-js/dist/main/index.js
 var require_main = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.FunctionRegion = exports.FunctionsRelayError = exports.FunctionsHttpError = exports.FunctionsFetchError = exports.FunctionsError = exports.FunctionsClient = undefined;
@@ -8005,7 +8006,7 @@ var require_main = __commonJS((exports) => {
   } });
 });
 
-// ../../node_modules/.bun/@supabase+postgrest-js@2.108.1/node_modules/@supabase/postgrest-js/dist/index.mjs
+// ../../node_modules/.bun/@supabase+postgrest-js@2.110.2/node_modules/@supabase/postgrest-js/dist/index.mjs
 function sleep(ms, signal) {
   return new Promise((resolve) => {
     if (signal === null || signal === undefined ? undefined : signal.aborted) {
@@ -8816,7 +8817,7 @@ var init_dist = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/lib/websocket-factory.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/lib/websocket-factory.js
 var require_websocket_factory = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.WebSocketFactory = undefined;
@@ -8854,24 +8855,10 @@ var require_websocket_factory = __commonJS((exports) => {
       if (_process) {
         const processVersions = _process["versions"];
         if (processVersions && processVersions["node"]) {
-          const versionString = processVersions["node"];
-          const nodeVersion = parseInt(versionString.replace(/^v/, "").split(".")[0]);
-          if (nodeVersion >= 22) {
-            if (typeof globalThis.WebSocket !== "undefined") {
-              return { type: "native", wsConstructor: globalThis.WebSocket };
-            }
-            return {
-              type: "unsupported",
-              error: `Node.js ${nodeVersion} detected but native WebSocket not found.`,
-              workaround: "Provide a WebSocket implementation via the transport option."
-            };
-          }
           return {
             type: "unsupported",
-            error: `Node.js ${nodeVersion} detected without native WebSocket support.`,
-            workaround: `For Node.js < 22, install "ws" package and provide it via the transport option:
-` + `import ws from "ws"
-` + "new RealtimeClient(url, { transport: ws })"
+            error: "Node.js detected but native WebSocket not found.",
+            workaround: "Ensure you are running Node.js 22+ or provide a WebSocket implementation via the transport option."
           };
         }
       }
@@ -8897,7 +8884,7 @@ Suggested solution: ${env.workaround}`;
     static isWebSocketSupported() {
       try {
         const env = this.detectEnvironment();
-        return env.type === "native" || env.type === "ws";
+        return env.type === "native";
       } catch (_a) {
         return false;
       }
@@ -8907,14 +8894,14 @@ Suggested solution: ${env.workaround}`;
   exports.default = WebSocketFactory;
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/lib/version.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/lib/version.js
 var require_version = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.version = undefined;
-  exports.version = "2.108.1";
+  exports.version = "2.110.2";
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/lib/constants.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/lib/constants.js
 var require_constants = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.CONNECTION_STATE = exports.TRANSPORTS = exports.CHANNEL_EVENTS = exports.CHANNEL_STATES = exports.SOCKET_STATES = exports.MAX_PUSH_BUFFER_SIZE = exports.WS_CLOSE_NORMAL = exports.DEFAULT_TIMEOUT = exports.VERSION = exports.DEFAULT_VSN = exports.VSN_2_0_0 = exports.VSN_1_0_0 = exports.DEFAULT_VERSION = undefined;
@@ -8959,7 +8946,7 @@ var require_constants = __commonJS((exports) => {
   };
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/lib/serializer.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/lib/serializer.js
 var require_serializer = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
 
@@ -9104,7 +9091,7 @@ var require_serializer = __commonJS((exports) => {
   exports.default = Serializer;
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/lib/transformers.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/lib/transformers.js
 var require_transformers = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.httpEndpointURL = exports.toTimestampString = exports.toArray = exports.toJson = exports.toNumber = exports.toBoolean = exports.convertCell = exports.convertColumn = exports.convertChangeData = exports.PostgresTypes = undefined;
@@ -9273,7 +9260,7 @@ var require_transformers = __commonJS((exports) => {
   exports.httpEndpointURL = httpEndpointURL;
 });
 
-// ../../node_modules/.bun/@supabase+phoenix@0.4.2/node_modules/@supabase/phoenix/priv/static/phoenix.cjs.js
+// ../../node_modules/.bun/@supabase+phoenix@0.4.4/node_modules/@supabase/phoenix/priv/static/phoenix.cjs.js
 var require_phoenix_cjs = __commonJS((exports, module) => {
   var __defProp2 = Object.defineProperty;
   var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -10651,7 +10638,7 @@ var require_phoenix_cjs = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/phoenix/presenceAdapter.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/phoenix/presenceAdapter.js
 var require_presenceAdapter = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var phoenix_1 = require_phoenix_cjs();
@@ -10724,7 +10711,7 @@ var require_presenceAdapter = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/RealtimePresence.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/RealtimePresence.js
 var require_RealtimePresence = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.REALTIME_PRESENCE_LISTEN_EVENTS = undefined;
@@ -10749,7 +10736,7 @@ var require_RealtimePresence = __commonJS((exports) => {
   exports.default = RealtimePresence;
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/lib/normalizeChannelError.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/lib/normalizeChannelError.js
 var require_normalizeChannelError = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.normalizeChannelError = normalizeChannelError;
@@ -10772,7 +10759,7 @@ var require_normalizeChannelError = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/phoenix/channelAdapter.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/phoenix/channelAdapter.js
 var require_channelAdapter = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var constants_1 = require_constants();
@@ -10874,10 +10861,100 @@ var require_channelAdapter = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/RealtimeChannel.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/RealtimePostgresFilterBuilder.js
+var require_RealtimePostgresFilterBuilder = __commonJS((exports) => {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.postgresChangesFilter = exports.RealtimePostgresFilterBuilder = undefined;
+  var PostgrestReservedCharsRegexp2 = /[,()"\\]/;
+  var needsQuoting = (value) => PostgrestReservedCharsRegexp2.test(value) || value !== value.trim();
+  var quote = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+  var serializeScalar = (value) => {
+    const serialized = value === null ? "null" : String(value);
+    return needsQuoting(serialized) ? quote(serialized) : serialized;
+  };
+  var serializeIsValue = (value) => value === null ? "null" : String(value);
+  var serialize = (operator, value) => {
+    if (operator === "in") {
+      const values = Array.isArray(value) ? value : [value];
+      if (values.length === 0) {
+        throw new Error("Realtime `in` filter requires at least one value.");
+      }
+      const items = Array.from(new Set(values)).map((v) => serializeScalar(v)).join(",");
+      return `in.(${items})`;
+    }
+    if (operator === "is") {
+      return `is.${serializeIsValue(value)}`;
+    }
+    return `${operator}.${serializeScalar(value)}`;
+  };
+
+  class RealtimePostgresFilterBuilder {
+    constructor() {
+      this.filters = [];
+    }
+    add(column, operator, value, negate = false) {
+      const prefix = negate ? "not." : "";
+      this.filters.push(`${column}=${prefix}${serialize(operator, value)}`);
+      return this;
+    }
+    eq(column, value) {
+      return this.add(column, "eq", value);
+    }
+    neq(column, value) {
+      return this.add(column, "neq", value);
+    }
+    gt(column, value) {
+      return this.add(column, "gt", value);
+    }
+    gte(column, value) {
+      return this.add(column, "gte", value);
+    }
+    lt(column, value) {
+      return this.add(column, "lt", value);
+    }
+    lte(column, value) {
+      return this.add(column, "lte", value);
+    }
+    in(column, values) {
+      return this.add(column, "in", values);
+    }
+    like(column, pattern) {
+      return this.add(column, "like", pattern);
+    }
+    ilike(column, pattern) {
+      return this.add(column, "ilike", pattern);
+    }
+    match(column, pattern) {
+      return this.add(column, "match", pattern);
+    }
+    imatch(column, pattern) {
+      return this.add(column, "imatch", pattern);
+    }
+    is(column, value) {
+      return this.add(column, "is", value);
+    }
+    isDistinct(column, value) {
+      return this.add(column, "isdistinct", value);
+    }
+    not(column, operator, value) {
+      return this.add(column, operator, value, true);
+    }
+    build() {
+      return this.filters.join(",");
+    }
+    toString() {
+      return this.build();
+    }
+  }
+  exports.RealtimePostgresFilterBuilder = RealtimePostgresFilterBuilder;
+  var postgresChangesFilter = () => new RealtimePostgresFilterBuilder;
+  exports.postgresChangesFilter = postgresChangesFilter;
+});
+
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/RealtimeChannel.js
 var require_RealtimeChannel = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
-  exports.REALTIME_CHANNEL_STATES = exports.REALTIME_SUBSCRIBE_STATES = exports.REALTIME_LISTEN_TYPES = exports.REALTIME_POSTGRES_CHANGES_LISTEN_EVENT = undefined;
+  exports.REALTIME_CHANNEL_STATES = exports.REALTIME_SUBSCRIBE_STATES = exports.REALTIME_LISTEN_TYPES = exports.REALTIME_POSTGRES_CHANGES_LISTEN_EVENT = exports.postgresChangesFilter = exports.RealtimePostgresFilterBuilder = undefined;
   var tslib_1 = require_tslib();
   var constants_1 = require_constants();
   var RealtimePresence_1 = tslib_1.__importDefault(require_RealtimePresence());
@@ -10885,6 +10962,14 @@ var require_RealtimeChannel = __commonJS((exports) => {
   var transformers_1 = require_transformers();
   var normalizeChannelError_1 = require_normalizeChannelError();
   var channelAdapter_1 = tslib_1.__importDefault(require_channelAdapter());
+  var RealtimePostgresFilterBuilder_1 = require_RealtimePostgresFilterBuilder();
+  var RealtimePostgresFilterBuilder_2 = require_RealtimePostgresFilterBuilder();
+  Object.defineProperty(exports, "RealtimePostgresFilterBuilder", { enumerable: true, get: function() {
+    return RealtimePostgresFilterBuilder_2.RealtimePostgresFilterBuilder;
+  } });
+  Object.defineProperty(exports, "postgresChangesFilter", { enumerable: true, get: function() {
+    return RealtimePostgresFilterBuilder_2.postgresChangesFilter;
+  } });
   var REALTIME_POSTGRES_CHANGES_LISTEN_EVENT;
   (function(REALTIME_POSTGRES_CHANGES_LISTEN_EVENT2) {
     REALTIME_POSTGRES_CHANGES_LISTEN_EVENT2["ALL"] = "*";
@@ -11070,6 +11155,9 @@ var require_RealtimeChannel = __commonJS((exports) => {
       if (response.status === 202) {
         return { success: true };
       }
+      if (response.status === 404) {
+        return Promise.reject(new Error("httpSend() requires Realtime server v2.97.0 or newer; the endpoint returned 404. " + "Update your Supabase CLI to a recent version, or upgrade the Realtime server in your self-hosted setup. " + "See https://github.com/supabase/supabase-js/blob/master/packages/core/realtime-js/migrations/httpsend-server-version.md"));
+      }
       let errorMessage = response.statusText;
       try {
         const errorBody = await response.json();
@@ -11147,6 +11235,10 @@ var require_RealtimeChannel = __commonJS((exports) => {
     }
     _on(type, filter, callback) {
       const typeLower = type.toLocaleLowerCase();
+      const filterValue = filter === null || filter === undefined ? undefined : filter.filter;
+      if (filterValue instanceof RealtimePostgresFilterBuilder_1.RealtimePostgresFilterBuilder || typeof filterValue === "object" && filterValue !== null && typeof filterValue.build === "function") {
+        filter = Object.assign(Object.assign({}, filter), { filter: filterValue.build() });
+      }
       const ref = this.channelAdapter.on(type, callback);
       const binding = {
         type: typeLower,
@@ -11249,7 +11341,7 @@ var require_RealtimeChannel = __commonJS((exports) => {
   exports.default = RealtimeChannel;
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/phoenix/socketAdapter.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/phoenix/socketAdapter.js
 var require_socketAdapter = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var phoenix_1 = require_phoenix_cjs();
@@ -11362,7 +11454,7 @@ var require_socketAdapter = __commonJS((exports) => {
   exports.default = SocketAdapter;
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/RealtimeClient.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/RealtimeClient.js
 var require_RealtimeClient = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var tslib_1 = require_tslib();
@@ -11511,22 +11603,6 @@ var require_RealtimeClient = __commonJS((exports) => {
         this.socketAdapter.connect();
       } catch (error) {
         const errorMessage = error.message;
-        if (errorMessage.includes("Node.js")) {
-          throw new Error(`${errorMessage}
-
-` + `To use Realtime in Node.js, you need to provide a WebSocket implementation:
-
-` + `Option 1: Use Node.js 22+ which has native WebSocket support
-` + `Option 2: Install and provide the "ws" package:
-
-` + `  npm install ws
-
-` + `  import ws from "ws"
-` + `  const client = new RealtimeClient(url, {
-` + `    ...options,
-` + `    transport: ws
-` + "  })");
-        }
         throw new Error(`WebSocket not available: ${errorMessage}`);
       }
       this._handleNodeJsRaceCondition();
@@ -11721,6 +11797,8 @@ var require_RealtimeClient = __commonJS((exports) => {
     }
     _wrapHeartbeatCallback(heartbeatCallback) {
       return (status, latency) => {
+        if (status === "disconnected")
+          return;
         if (status == "sent")
           this._setAuthSafely();
         if (heartbeatCallback)
@@ -11829,15 +11907,21 @@ var require_RealtimeClient = __commonJS((exports) => {
   exports.default = RealtimeClient;
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.108.1/node_modules/@supabase/realtime-js/dist/main/index.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.110.2/node_modules/@supabase/realtime-js/dist/main/index.js
 var require_main2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
-  exports.WebSocketFactory = exports.REALTIME_CHANNEL_STATES = exports.REALTIME_SUBSCRIBE_STATES = exports.REALTIME_PRESENCE_LISTEN_EVENTS = exports.REALTIME_POSTGRES_CHANGES_LISTEN_EVENT = exports.REALTIME_LISTEN_TYPES = exports.RealtimeClient = exports.RealtimeChannel = exports.RealtimePresence = undefined;
+  exports.WebSocketFactory = exports.REALTIME_CHANNEL_STATES = exports.REALTIME_SUBSCRIBE_STATES = exports.REALTIME_PRESENCE_LISTEN_EVENTS = exports.REALTIME_POSTGRES_CHANGES_LISTEN_EVENT = exports.REALTIME_LISTEN_TYPES = exports.postgresChangesFilter = exports.RealtimePostgresFilterBuilder = exports.RealtimeClient = exports.RealtimeChannel = exports.RealtimePresence = undefined;
   var tslib_1 = require_tslib();
   var RealtimeClient_1 = tslib_1.__importDefault(require_RealtimeClient());
   exports.RealtimeClient = RealtimeClient_1.default;
   var RealtimeChannel_1 = tslib_1.__importStar(require_RealtimeChannel());
   exports.RealtimeChannel = RealtimeChannel_1.default;
+  Object.defineProperty(exports, "RealtimePostgresFilterBuilder", { enumerable: true, get: function() {
+    return RealtimeChannel_1.RealtimePostgresFilterBuilder;
+  } });
+  Object.defineProperty(exports, "postgresChangesFilter", { enumerable: true, get: function() {
+    return RealtimeChannel_1.postgresChangesFilter;
+  } });
   Object.defineProperty(exports, "REALTIME_LISTEN_TYPES", { enumerable: true, get: function() {
     return RealtimeChannel_1.REALTIME_LISTEN_TYPES;
   } });
@@ -12159,7 +12243,7 @@ var init_dist2 = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@supabase+storage-js@2.108.1/node_modules/@supabase/storage-js/dist/index.mjs
+// ../../node_modules/.bun/@supabase+storage-js@2.110.2/node_modules/@supabase/storage-js/dist/index.mjs
 function _typeof2(o) {
   "@babel/helpers - typeof";
   return _typeof2 = typeof Symbol == "function" && typeof Symbol.iterator == "symbol" ? function(o$1) {
@@ -12467,7 +12551,7 @@ var StorageError, StorageApiError, StorageUnknownError, resolveFetch = (customFe
       throw error;
     }
   }
-}, DEFAULT_SEARCH_OPTIONS, DEFAULT_FILE_OPTIONS, StorageFileApi, version = "2.108.1", DEFAULT_HEADERS, StorageBucketApi, StorageAnalyticsClient, VectorIndexApi, VectorDataApi, VectorBucketApi, StorageVectorsClient, VectorBucketScope, VectorIndexScope, StorageClient;
+}, DEFAULT_SEARCH_OPTIONS, DEFAULT_FILE_OPTIONS, StorageFileApi, version = "2.110.2", DEFAULT_HEADERS, StorageBucketApi, StorageAnalyticsClient, VectorIndexApi, VectorDataApi, VectorBucketApi, StorageVectorsClient, VectorBucketScope, VectorIndexScope, StorageClient;
 var init_dist3 = __esm(() => {
   init_dist2();
   StorageError = class extends Error {
@@ -12754,18 +12838,33 @@ var init_dist3 = __esm(() => {
         return await remove(_this12.fetch, `${_this12.url}/object/${_this12.bucketId}`, { prefixes: paths }, { headers: _this12.headers });
       });
     }
-    async list(path, options, parameters) {
+    async purgeCache(path, options, parameters) {
       var _this13 = this;
       return _this13.handleOperation(async () => {
-        const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path || "" });
-        return await post(_this13.fetch, `${_this13.url}/object/list/${_this13.bucketId}`, body, { headers: _this13.headers }, parameters);
+        const _path = _this13._getFinalPath(path);
+        const query = new URLSearchParams;
+        if (options === null || options === undefined ? undefined : options.transformations)
+          query.set("transformations", "true");
+        const queryString = query.toString();
+        return await remove(_this13.fetch, `${_this13.url}/cdn/${_path}${queryString ? `?${queryString}` : ""}`, {}, { headers: _this13.headers }, parameters);
       });
     }
-    async listV2(options, parameters) {
+    async list(path, options, parameters) {
       var _this14 = this;
       return _this14.handleOperation(async () => {
+        const sortBy = (options === null || options === undefined ? undefined : options.sortBy) ? _objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS.sortBy), options.sortBy) : DEFAULT_SEARCH_OPTIONS.sortBy;
+        const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, {
+          sortBy,
+          prefix: path || ""
+        });
+        return await post(_this14.fetch, `${_this14.url}/object/list/${_this14.bucketId}`, body, { headers: _this14.headers }, parameters);
+      });
+    }
+    async listV2(options, parameters) {
+      var _this15 = this;
+      return _this15.handleOperation(async () => {
         const body = _objectSpread22({}, options);
-        return await post(_this14.fetch, `${_this14.url}/object/list-v2/${_this14.bucketId}`, body, { headers: _this14.headers }, parameters);
+        return await post(_this15.fetch, `${_this15.url}/object/list-v2/${_this15.bucketId}`, body, { headers: _this15.headers }, parameters);
       });
     }
     encodeMetadata(metadata) {
@@ -12858,6 +12957,16 @@ var init_dist3 = __esm(() => {
         return await remove(_this6.fetch, `${_this6.url}/bucket/${id}`, {}, { headers: _this6.headers });
       });
     }
+    async purgeBucketCache(id, options, parameters) {
+      var _this7 = this;
+      return _this7.handleOperation(async () => {
+        const query = new URLSearchParams;
+        if (options === null || options === undefined ? undefined : options.transformations)
+          query.set("transformations", "true");
+        const queryString = query.toString();
+        return await remove(_this7.fetch, `${_this7.url}/cdn/${id}${queryString ? `?${queryString}` : ""}`, {}, { headers: _this7.headers }, parameters);
+      });
+    }
     listBucketOptionsToQueryString(options) {
       const params = {};
       if (options) {
@@ -13175,21 +13284,22 @@ var init_dist3 = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/version.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/version.js
 var require_version2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.version = undefined;
-  exports.version = "2.108.1";
+  exports.version = "2.110.2";
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/constants.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/constants.js
 var require_constants2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
-  exports.JWKS_TTL = exports.BASE64URL_REGEX = exports.API_VERSIONS = exports.API_VERSION_HEADER_NAME = exports.NETWORK_FAILURE = exports.DEFAULT_HEADERS = exports.AUDIENCE = exports.STORAGE_KEY = exports.GOTRUE_URL = exports.EXPIRY_MARGIN_MS = exports.AUTO_REFRESH_TICK_THRESHOLD = exports.AUTO_REFRESH_TICK_DURATION_MS = undefined;
+  exports.JWKS_TTL = exports.BASE64URL_REGEX = exports.API_VERSIONS = exports.API_VERSION_HEADER_NAME = exports.NETWORK_FAILURE = exports.DEFAULT_HEADERS = exports.AUDIENCE = exports.STORAGE_KEY = exports.GOTRUE_URL = exports.REFRESH_FAILURE_COOLDOWN_MS = exports.EXPIRY_MARGIN_MS = exports.AUTO_REFRESH_TICK_THRESHOLD = exports.AUTO_REFRESH_TICK_DURATION_MS = undefined;
   var version_1 = require_version2();
   exports.AUTO_REFRESH_TICK_DURATION_MS = 30 * 1000;
   exports.AUTO_REFRESH_TICK_THRESHOLD = 3;
   exports.EXPIRY_MARGIN_MS = exports.AUTO_REFRESH_TICK_THRESHOLD * exports.AUTO_REFRESH_TICK_DURATION_MS;
+  exports.REFRESH_FAILURE_COOLDOWN_MS = 2 * exports.AUTO_REFRESH_TICK_DURATION_MS;
   exports.GOTRUE_URL = "http://localhost:9999";
   exports.STORAGE_KEY = "supabase.auth.token";
   exports.AUDIENCE = "";
@@ -13209,7 +13319,7 @@ var require_constants2 = __commonJS((exports) => {
   exports.JWKS_TTL = 10 * 60 * 1000;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/errors.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/errors.js
 var require_errors = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.AuthInvalidJwtError = exports.AuthWeakPasswordError = exports.AuthRefreshDiscardedError = exports.AuthRetryableFetchError = exports.AuthPKCECodeVerifierMissingError = exports.AuthPKCEGrantCodeExchangeError = exports.AuthImplicitGrantRedirectError = exports.AuthInvalidCredentialsError = exports.AuthInvalidTokenResponseError = exports.AuthSessionMissingError = exports.CustomAuthError = exports.AuthUnknownError = exports.AuthApiError = exports.AuthError = undefined;
@@ -13378,7 +13488,7 @@ var require_errors = __commonJS((exports) => {
   exports.AuthInvalidJwtError = AuthInvalidJwtError;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/base64url.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/base64url.js
 var require_base64url = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.byteToBase64URL = byteToBase64URL;
@@ -13566,7 +13676,7 @@ var require_base64url = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/helpers.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/helpers.js
 var require_helpers = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Deferred = exports.removeItemAsync = exports.getItemAsync = exports.setItemAsync = exports.looksLikeFetchResponse = exports.resolveFetch = exports.supportsLocalStorage = exports.isBrowser = undefined;
@@ -13881,7 +13991,7 @@ var require_helpers = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/fetch.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/fetch.js
 var require_fetch = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.handleError = handleError2;
@@ -13910,7 +14020,24 @@ var require_fetch = __commonJS((exports) => {
     }
     return JSON.stringify(err);
   };
-  var NETWORK_ERROR_CODES = [502, 503, 504, 520, 521, 522, 523, 524, 530];
+  var NETWORK_ERROR_CODES = [
+    500,
+    501,
+    502,
+    503,
+    504,
+    520,
+    521,
+    522,
+    523,
+    524,
+    525,
+    526,
+    527,
+    528,
+    529,
+    530
+  ];
   async function handleError2(error) {
     var _a;
     if (!(0, helpers_1.looksLikeFetchResponse)(error)) {
@@ -14046,14 +14173,14 @@ var require_fetch = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/types.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/types.js
 var require_types2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.SIGN_OUT_SCOPES = undefined;
   exports.SIGN_OUT_SCOPES = ["global", "local", "others"];
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/GoTrueAdminApi.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/GoTrueAdminApi.js
 var require_GoTrueAdminApi = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var tslib_1 = require_tslib();
@@ -14500,7 +14627,7 @@ var require_GoTrueAdminApi = __commonJS((exports) => {
   exports.default = GoTrueAdminApi;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/local-storage.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/local-storage.js
 var require_local_storage = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.memoryLocalStorageAdapter = memoryLocalStorageAdapter;
@@ -14519,7 +14646,7 @@ var require_local_storage = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/locks.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/locks.js
 var require_locks = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ProcessLockAcquireTimeoutError = exports.NavigatorLockAcquireTimeoutError = exports.LockAcquireTimeoutError = exports.internals = undefined;
@@ -14693,7 +14820,7 @@ var require_locks = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/polyfills.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/polyfills.js
 var require_polyfills = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.polyfillGlobalThis = polyfillGlobalThis;
@@ -14717,7 +14844,7 @@ var require_polyfills = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/web3/ethereum.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/web3/ethereum.js
 var require_ethereum = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getAddress = getAddress;
@@ -14794,7 +14921,7 @@ ${suffix}`;
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/webauthn.errors.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/webauthn.errors.js
 var require_webauthn_errors = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.WebAuthnUnknownError = exports.WebAuthnError = undefined;
@@ -14981,7 +15108,7 @@ var require_webauthn_errors = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/lib/webauthn.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/lib/webauthn.js
 var require_webauthn = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.WebAuthnApi = exports.DEFAULT_REQUEST_OPTIONS = exports.DEFAULT_CREATION_OPTIONS = exports.webAuthnAbortService = exports.WebAuthnAbortService = exports.identifyAuthenticationError = exports.identifyRegistrationError = exports.isWebAuthnError = exports.WebAuthnError = undefined;
@@ -15435,7 +15562,7 @@ var require_webauthn = __commonJS((exports) => {
   exports.WebAuthnApi = WebAuthnApi;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/GoTrueClient.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/GoTrueClient.js
 var require_GoTrueClient = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var tslib_1 = require_tslib();
@@ -15493,8 +15620,10 @@ var require_GoTrueClient = __commonJS((exports) => {
       this.autoRefreshTickTimeout = null;
       this.visibilityChangedCallback = null;
       this.refreshingDeferred = null;
+      this.lastRefreshFailure = null;
       this._sessionRemovalEpoch = 0;
       this.initializePromise = null;
+      this._pendingInitNotifications = null;
       this.detectSessionInUrl = true;
       this.hasCustomAuthorizationHeader = false;
       this.suppressGetSessionWarning = false;
@@ -15594,6 +15723,9 @@ var require_GoTrueClient = __commonJS((exports) => {
         }
         (_c = this.broadcastChannel) === null || _c === undefined || _c.addEventListener("message", async (event) => {
           this._debug("received broadcast notification from other tab or client", event);
+          if (event.data.event === "TOKEN_REFRESHED" || event.data.event === "SIGNED_IN") {
+            this.lastRefreshFailure = null;
+          }
           try {
             await this._notifyAllSubscribers(event.data.event, event.data.session, false);
           } catch (error) {
@@ -15626,9 +15758,11 @@ var require_GoTrueClient = __commonJS((exports) => {
       return this;
     }
     async initialize() {
+      var _a;
       if (this.initializePromise) {
         return await this.initializePromise;
       }
+      this._pendingInitNotifications = [];
       this.initializePromise = (async () => {
         if (this.lock != null) {
           return await this._acquireLock(this.lockAcquireTimeout, async () => {
@@ -15637,7 +15771,13 @@ var require_GoTrueClient = __commonJS((exports) => {
         }
         return await this._initialize();
       })();
-      return await this.initializePromise;
+      const result = await this.initializePromise;
+      const queue = (_a = this._pendingInitNotifications) !== null && _a !== undefined ? _a : [];
+      this._pendingInitNotifications = null;
+      for (const n of queue) {
+        await this._notifyAllSubscribers(n.event, n.session, n.broadcast);
+      }
+      return result;
     }
     async _initialize() {
       var _a;
@@ -16420,6 +16560,13 @@ var require_GoTrueClient = __commonJS((exports) => {
         }
         const { data: session, error } = await this._callRefreshToken(currentSession.refresh_token);
         if (error) {
+          const accessTokenStillValid = !!(currentSession.expires_at && currentSession.expires_at * 1000 > Date.now());
+          if (accessTokenStillValid) {
+            const stillStored = await (0, helpers_1.getItemAsync)(this.storage, this.storageKey);
+            if (stillStored && stillStored.refresh_token === currentSession.refresh_token) {
+              return this._returnResult({ data: { session: currentSession }, error: null });
+            }
+          }
           return this._returnResult({ data: { session: null }, error });
         }
         return this._returnResult({ data: { session }, error: null });
@@ -16727,6 +16874,10 @@ var require_GoTrueClient = __commonJS((exports) => {
     async _signOut({ scope } = { scope: "global" }) {
       return await this._useSession(async (result) => {
         var _a;
+        const removeCurrentSession = async () => {
+          await this._removeSession();
+          await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+        };
         const { data, error: sessionError } = result;
         if (sessionError && !(0, errors_1.isAuthSessionMissingError)(sessionError)) {
           return this._returnResult({ error: sessionError });
@@ -16736,13 +16887,15 @@ var require_GoTrueClient = __commonJS((exports) => {
           const { error } = await this.admin.signOut(accessToken, scope);
           if (error) {
             if (!((0, errors_1.isAuthApiError)(error) && (error.status === 404 || error.status === 401 || error.status === 403) || (0, errors_1.isAuthSessionMissingError)(error))) {
+              if (scope !== "others") {
+                await removeCurrentSession();
+              }
               return this._returnResult({ error });
             }
           }
         }
         if (scope !== "others") {
-          await this._removeSession();
-          await (0, helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+          await removeCurrentSession();
         }
         return this._returnResult({ error: null });
       });
@@ -17023,10 +17176,6 @@ var require_GoTrueClient = __commonJS((exports) => {
                 this._debug(debugName, "refresh discarded by commit guard", error);
               } else {
                 this._debug(debugName, "refresh failed", error);
-                if (!(0, errors_1.isAuthRetryableFetchError)(error)) {
-                  this._debug(debugName, "refresh failed with a non-retryable error, removing the session", error);
-                  await this._removeSession();
-                }
               }
             }
           }
@@ -17063,6 +17212,10 @@ var require_GoTrueClient = __commonJS((exports) => {
       if (this.refreshingDeferred) {
         return this.refreshingDeferred.promise;
       }
+      if (this.lastRefreshFailure && this.lastRefreshFailure.refreshToken === refreshToken && Date.now() < this.lastRefreshFailure.expiresAt) {
+        this._debug("#_callRefreshToken()", "returning cached failure (cooldown active)");
+        return this.lastRefreshFailure.result;
+      }
       const debugName = `#_callRefreshToken()`;
       this._debug(debugName, "begin");
       try {
@@ -17104,6 +17257,7 @@ var require_GoTrueClient = __commonJS((exports) => {
         }
         await this._notifyAllSubscribers("TOKEN_REFRESHED", data.session);
         const result = { data: data.session, error: null };
+        this.lastRefreshFailure = null;
         this.refreshingDeferred.resolve(result);
         return result;
       } catch (error) {
@@ -17111,8 +17265,19 @@ var require_GoTrueClient = __commonJS((exports) => {
         if ((0, errors_1.isAuthError)(error)) {
           const result = { data: null, error };
           if (!(0, errors_1.isAuthRetryableFetchError)(error)) {
-            await this._removeSession();
+            const storedNow = await (0, helpers_1.getItemAsync)(this.storage, this.storageKey);
+            const accessTokenStillValid = !!((storedNow === null || storedNow === undefined ? undefined : storedNow.expires_at) && storedNow.expires_at * 1000 > Date.now());
+            if (accessTokenStillValid) {
+              this._debug(debugName, "proactive refresh failed, access token still valid — preserving session");
+            } else {
+              await this._removeSession();
+            }
           }
+          this.lastRefreshFailure = {
+            refreshToken,
+            result,
+            expiresAt: Date.now() + constants_1.REFRESH_FAILURE_COOLDOWN_MS
+          };
           (_a = this.refreshingDeferred) === null || _a === undefined || _a.resolve(result);
           return result;
         }
@@ -17124,6 +17289,10 @@ var require_GoTrueClient = __commonJS((exports) => {
       }
     }
     async _notifyAllSubscribers(event, session, broadcast = true) {
+      if (this._pendingInitNotifications !== null && broadcast) {
+        this._pendingInitNotifications.push({ event, session, broadcast });
+        return;
+      }
       const debugName = `#_notifyAllSubscribers(${event})`;
       this._debug(debugName, "begin", session, `broadcast = ${broadcast}`);
       try {
@@ -17173,6 +17342,7 @@ var require_GoTrueClient = __commonJS((exports) => {
     async _removeSession() {
       this._sessionRemovalEpoch += 1;
       this._debug("#_removeSession()");
+      this.lastRefreshFailure = null;
       this.suppressGetSessionWarning = false;
       await (0, helpers_1.removeItemAsync)(this.storage, this.storageKey);
       await (0, helpers_1.removeItemAsync)(this.storage, this.storageKey + "-code-verifier");
@@ -18088,7 +18258,7 @@ var require_GoTrueClient = __commonJS((exports) => {
   exports.default = GoTrueClient;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/AuthAdminApi.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/AuthAdminApi.js
 var require_AuthAdminApi = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var tslib_1 = require_tslib();
@@ -18097,7 +18267,7 @@ var require_AuthAdminApi = __commonJS((exports) => {
   exports.default = AuthAdminApi;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/AuthClient.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/AuthClient.js
 var require_AuthClient = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var tslib_1 = require_tslib();
@@ -18106,7 +18276,7 @@ var require_AuthClient = __commonJS((exports) => {
   exports.default = AuthClient;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.108.1/node_modules/@supabase/auth-js/dist/main/index.js
+// ../../node_modules/.bun/@supabase+auth-js@2.110.2/node_modules/@supabase/auth-js/dist/main/index.js
 var require_main3 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.processLock = exports.lockInternals = exports.NavigatorLockAcquireTimeoutError = exports.navigatorLock = exports.AuthClient = exports.AuthAdminApi = exports.GoTrueClient = exports.GoTrueAdminApi = undefined;
@@ -18136,7 +18306,7 @@ var require_main3 = __commonJS((exports) => {
   } });
 });
 
-// ../../node_modules/.bun/@supabase+supabase-js@2.108.1/node_modules/@supabase/supabase-js/dist/index.mjs
+// ../../node_modules/.bun/@supabase+supabase-js@2.110.2/node_modules/@supabase/supabase-js/dist/index.mjs
 var exports_dist = {};
 __export(exports_dist, {
   createClient: () => createClient,
@@ -18395,9 +18565,9 @@ function shouldShowDeprecationWarning() {
   const versionMatch = processVersion.match(/^v(\d+)\./);
   if (!versionMatch)
     return false;
-  return parseInt(versionMatch[1], 10) <= 18;
+  return parseInt(versionMatch[1], 10) <= 20;
 }
-var import_functions_js, import_realtime_js, import_auth_js, version2 = "2.108.1", JS_ENV = "", JS_RUNTIME_VERSION, _Deno$version, _process$version, _runtimeMeta, DEFAULT_HEADERS2, DEFAULT_GLOBAL_OPTIONS, DEFAULT_DB_OPTIONS, DEFAULT_AUTH_OPTIONS, DEFAULT_REALTIME_OPTIONS, DEFAULT_TRACE_PROPAGATION_OPTIONS, otelModulePromise = null, OTEL_PKG = "@opentelemetry/api", resolveFetch2 = (customFetch) => {
+var import_functions_js, import_realtime_js, import_auth_js, version2 = "2.110.2", JS_ENV = "", JS_RUNTIME_VERSION, _Deno$version, _process$version, _runtimeMeta, DEFAULT_HEADERS2, DEFAULT_GLOBAL_OPTIONS, DEFAULT_DB_OPTIONS, DEFAULT_AUTH_OPTIONS, DEFAULT_REALTIME_OPTIONS, DEFAULT_TRACE_PROPAGATION_OPTIONS, otelModulePromise = null, OTEL_PKG = "@opentelemetry/api", resolveFetch2 = (customFetch) => {
   if (customFetch)
     return (...args) => customFetch(...args);
   return (...args) => fetch(...args);
@@ -18611,7 +18781,7 @@ var init_dist4 = __esm(() => {
     }
   };
   if (shouldShowDeprecationWarning())
-    console.warn("⚠️  Node.js 18 and below are deprecated and will no longer be supported in future versions of @supabase/supabase-js. Please upgrade to Node.js 20 or later. For more information, visit: https://github.com/orgs/supabase/discussions/37217");
+    console.warn("⚠️  Node.js 20 and below are deprecated and will no longer be supported in future versions of @supabase/supabase-js. Please upgrade to Node.js 22 or later. For more information, visit: https://github.com/orgs/supabase/discussions/45715");
 });
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
@@ -22742,6 +22912,7 @@ function loadSettings(opts = {}) {
     supabaseUrl: env2.CEREFOX_SUPABASE_URL ?? "",
     supabaseKey: env2.CEREFOX_SUPABASE_KEY ?? "",
     supabaseAnonKey: env2.CEREFOX_SUPABASE_ANON_KEY ?? "",
+    accessToken: env2.CEREFOX_ACCESS_TOKEN ?? "",
     databaseUrl: env2.CEREFOX_DATABASE_URL ?? "",
     openaiApiKey: env2.CEREFOX_OPENAI_API_KEY ?? env2.OPENAI_API_KEY ?? "",
     fireworksApiKey: env2.CEREFOX_FIREWORKS_API_KEY ?? ""
@@ -25022,6 +25193,126 @@ var init_bundled_docs = __esm(() => {
   PACKAGE_ROOT = findPackageRoot();
 });
 
+// ../../_shared/ingest/chunker.ts
+function cpLen(s) {
+  let n = 0;
+  for (const _ of s)
+    n++;
+  return n;
+}
+function rstripHash(s) {
+  let i = s.length;
+  while (i > 0 && s[i - 1] === "#")
+    i--;
+  return s.slice(0, i);
+}
+function findHeadings(doc) {
+  const out = [];
+  const re = /^(#{1,3})[ \t]+(.+)$/gm;
+  let m;
+  while ((m = re.exec(doc)) !== null) {
+    out.push({ offset: m.index, level: m[1].length, text: rstripHash(m[2]).trim() });
+  }
+  return out;
+}
+function activeHeadings(headings, offset) {
+  const stack = [];
+  for (const h of headings) {
+    if (h.offset > offset)
+      break;
+    while (stack.length && stack[stack.length - 1].level >= h.level)
+      stack.pop();
+    stack.push(h);
+  }
+  return stack;
+}
+function hardSplitCp(s, maxCp) {
+  const out = [];
+  let buf = "";
+  let n = 0;
+  for (const ch of s) {
+    if (n >= maxCp) {
+      out.push(buf);
+      buf = "";
+      n = 0;
+    }
+    buf += ch;
+    n++;
+  }
+  if (buf)
+    out.push(buf);
+  return out;
+}
+function chunkMarkdown(text, maxChunkChars = 4000, _minChunkChars = 100) {
+  const doc = text.trim();
+  if (!doc)
+    return [];
+  if (cpLen(doc) <= maxChunkChars) {
+    return [
+      { chunk_index: 0, heading_path: [], heading_level: 0, title: "", content: doc, char_count: cpLen(doc) }
+    ];
+  }
+  const headings = findHeadings(doc);
+  const parts = doc.split(/(\n{2,})/);
+  const atoms = [];
+  for (let i = 0;i < parts.length; i += 2) {
+    const unit = (parts[i] ?? "") + (parts[i + 1] ?? "");
+    if (unit === "")
+      continue;
+    if (cpLen(unit) > maxChunkChars)
+      atoms.push(...hardSplitCp(unit, maxChunkChars));
+    else
+      atoms.push(unit);
+  }
+  const chunks = [];
+  let buf = "";
+  let bufCp = 0;
+  let bufStart = 0;
+  let offset = 0;
+  const flush = () => {
+    if (buf === "")
+      return;
+    const stack = activeHeadings(headings, bufStart);
+    chunks.push({
+      chunk_index: chunks.length,
+      heading_path: stack.map((h) => h.text),
+      heading_level: stack.length ? stack[stack.length - 1].level : 0,
+      title: stack.length ? stack[stack.length - 1].text : "",
+      content: buf,
+      char_count: bufCp
+    });
+    buf = "";
+    bufCp = 0;
+  };
+  for (const atom of atoms) {
+    const cp = cpLen(atom);
+    if (buf === "") {
+      bufStart = offset;
+      buf = atom;
+      bufCp = cp;
+    } else if (bufCp + cp <= maxChunkChars) {
+      buf += atom;
+      bufCp += cp;
+    } else {
+      flush();
+      bufStart = offset;
+      buf = atom;
+      bufCp = cp;
+    }
+    offset += atom.length;
+  }
+  flush();
+  return chunks;
+}
+function embeddingInputFor(docTitle, chunk) {
+  const breadcrumb = chunk.heading_path.join(" > ");
+  const head2 = breadcrumb ? `# ${docTitle}
+${breadcrumb}` : `# ${docTitle}`;
+  return `${head2}
+${chunk.content}`;
+}
+var CONTENT_FORMAT_BLIND_STITCH = 2;
+
 // ../../_shared/embeddings/index.ts
 function openaiEmbeddingConfig() {
   const env4 = globalThis.process?.env ?? {};
@@ -25033,9 +25324,26 @@ function openaiEmbeddingConfig() {
     dimensions: Number.isNaN(dims) || dims <= 0 ? EMBEDDING_DIMENSIONS : dims
   };
 }
+function embeddingMaxInputChars() {
+  const env4 = globalThis.process?.env ?? {};
+  const raw = Number.parseInt(env4.CEREFOX_EMBED_MAX_INPUT_CHARS ?? "", 10);
+  return Number.isNaN(raw) || raw <= 0 ? DEFAULT_EMBED_MAX_INPUT_CHARS : raw;
+}
+function capEmbeddingInput(text) {
+  const max = embeddingMaxInputChars();
+  if (text.length <= max)
+    return text;
+  let cut = text.slice(0, max);
+  const last = cut.charCodeAt(cut.length - 1);
+  if (last >= 55296 && last <= 56319)
+    cut = cut.slice(0, -1);
+  console.warn(`[embeddings] truncated an embedding input: ${text.length} → ${cut.length} chars ` + `(cap CEREFOX_EMBED_MAX_INPUT_CHARS=${max}). The full content is stored and reconstructed ` + `untouched; only this chunk's embedding uses the prefix (degraded search for this chunk).`);
+  return cut;
+}
 async function getEmbedding(text, apiKey) {
   let lastError = null;
   const cfg = openaiEmbeddingConfig();
+  const input = capEmbeddingInput(text);
   for (let attempt = 0;attempt < EMBEDDING_MAX_RETRIES; attempt++) {
     try {
       const response = await fetch(cfg.url, {
@@ -25046,7 +25354,7 @@ async function getEmbedding(text, apiKey) {
         },
         body: JSON.stringify({
           model: cfg.model,
-          input: text,
+          input,
           dimensions: cfg.dimensions
         })
       });
@@ -25079,6 +25387,7 @@ async function getEmbedding(text, apiKey) {
 async function embedBatchSingleCall(texts, apiKey) {
   let lastError = null;
   const cfg = openaiEmbeddingConfig();
+  const inputs = texts.map(capEmbeddingInput);
   for (let attempt = 0;attempt < EMBEDDING_MAX_RETRIES; attempt++) {
     try {
       const response = await fetch(cfg.url, {
@@ -25089,7 +25398,7 @@ async function embedBatchSingleCall(texts, apiKey) {
         },
         body: JSON.stringify({
           model: cfg.model,
-          input: texts,
+          input: inputs,
           dimensions: cfg.dimensions
         })
       });
@@ -25135,7 +25444,7 @@ async function embedBatch(texts, apiKey, batchSize = EMBEDDING_BATCH_SIZE) {
   }
   return out;
 }
-var OPENAI_EMBEDDING_URL = "https://api.openai.com/v1/embeddings", OPENAI_MODEL = "text-embedding-3-small", EMBEDDING_DIMENSIONS = 768, EMBEDDING_MAX_RETRIES = 3, EMBEDDING_INITIAL_BACKOFF_MS = 500, EMBEDDING_BATCH_SIZE = 96;
+var OPENAI_EMBEDDING_URL = "https://api.openai.com/v1/embeddings", OPENAI_MODEL = "text-embedding-3-small", EMBEDDING_DIMENSIONS = 768, DEFAULT_EMBED_MAX_INPUT_CHARS = 20000, EMBEDDING_MAX_RETRIES = 3, EMBEDDING_INITIAL_BACKOFF_MS = 500, EMBEDDING_BATCH_SIZE = 96;
 
 // ../../node_modules/.bun/underscore@1.13.8/node_modules/underscore/underscore-node-f.cjs
 var require_underscore_node_f = __commonJS((exports) => {
@@ -54039,7 +54348,7 @@ var init_get_document = __esm(() => {
 });
 
 // ../../_shared/mcp-tools/get-help-content.ts
-var HELP_FULL = '# Cerefox Knowledge Base -- Agent Quick Reference\n\nCerefox is a persistent, shared knowledge base. You have **10 MCP tools** (9 of them have CLI equivalents — `cerefox_get_help` is MCP-only). For the full guide, search Cerefox for "How AI Agents Use Cerefox" or call `cerefox_get_help` to retrieve this content over MCP.\n\n## Tools\n\n| Tool | Purpose | Key params |\n|------|---------|------------|\n| `cerefox_search` | Find documents (hybrid FTS + semantic) | `query` (required), `project_name`, `metadata_filter`, `requestor` |\n| `cerefox_ingest` | Save or update a document | `title`, `content` (required), `document_id` (update by ID), `expected_content_hash` (**required on content updates** — see rule 9), `last_write_wins`, `update_if_exists`, `project_name` (single, non-destructive add on update), `project_names` (list, destructive replace on update), `metadata` (omit on update to keep existing tags; `{}` clears), `author` |\n| `cerefox_get_document` | Get full document by ID (header includes `content_hash` — the update token) | `document_id` (required) |\n| `cerefox_list_versions` | Version history of a document | `document_id` (required) |\n| `cerefox_metadata_search` | Find or list docs by metadata, project, or time (no text query) | `metadata_filter`, `project_name` (list a project\'s docs), `updated_since`, `include_content` — **at least one** of metadata_filter/project_name/updated_since/created_since |\n| `cerefox_list_metadata_keys` | Discover available metadata keys | (none required) |\n| `cerefox_list_projects` | List all projects | (none required) |\n| `cerefox_set_document_projects` | Set doc\'s project memberships to exactly the given list (destructive replace; metadata-only, no content change) | `document_id`, `project_names` (required) |\n| `cerefox_get_audit_log` | Query write operation history | `document_id`, `author`, `operation`, `since` |\n| `cerefox_get_help` | Retrieve Cerefox conventions (this reference) over MCP. **Call this whenever uncertain.** | `topic` (optional, case-insensitive H2 substring match) |\n\n## Essential Rules\n\n1. **Search before ingesting** -- check if the document exists first.\n2. **Prefer ID-based updates** -- pass `document_id` from search results for deterministic updates. Falls back to title-matching with `update_if_exists: true`.\n3. **Set `author`/`requestor`** to your name on every call (e.g., "Claude Code", "archiver"). On MCP, pass as parameters. On CLI, pass `--author`/`--author-type`/`--requestor` flags, or rely on `CEREFOX_AUTHOR_NAME`/`CEREFOX_AUTHOR_TYPE`/`CEREFOX_REQUESTOR_NAME` env vars set in the user\'s `.env`.\n4. **Use `document_id` from search results** `[id: uuid]` for get_document and list_versions.\n5. **Add metadata** -- at minimum `type` ("decision-log", "research", "design-doc") and `status` ("active", "draft").\n6. **Write structured Markdown** with H1/H2/H3 headings for good chunking and search.\n7. **Deletes are soft (recoverable); purge is web-UI-only.** If you decide to delete, surface it to the user (`I soft-deleted X — recoverable from the Cerefox web UI trash`). You cannot un-do your own delete from agent code by design.\n8. **Cross-doc links inside content**: **always use `[Text](document-uuid)`.** UUIDs are the only fully reliable link form — stable across title changes, never ambiguous, no encoding gotchas. Every `cerefox_search` result shows `[id: <uuid>]` after the title; grab it and use it. Title-based linking (`[Text](<Title With Spaces>)`) is fragile (breaks on colons, parens, ampersands, brackets — silently navigates to wrong page) — **don\'t write title-based links**; do an extra search to get the UUID instead. Repo-path forms (`[Text](docs/path.md)`) exist for repo-ingested files; don\'t construct manually. See `AGENT_GUIDE.md → Writing linkable content` for the full rule.\n9. **Concurrency: content updates require `expected_content_hash`.** Pass the `content_hash` you read (shown by `cerefox_get_document`, `cerefox_search`, and `cerefox_metadata_search`) when updating a document. If it\'s stale you get a **conflict** — re-read the document, merge your changes into the latest content, retry with the new hash. **Never resolve a conflict by overwriting blindly** — the current content includes another writer\'s work. `last_write_wins: true` skips the check; use it ONLY when an external source of truth makes conflicts meaningless (file re-sync), never to silence a conflict.\n10. **Project memberships — non-destructive by default**: on `cerefox_ingest` updates, **`project_name` (singular) is a non-destructive add** (ensures membership, preserves others). Use **`project_names` (list)** when you want to set the doc\'s full project set in one call (destructive replace). For metadata-only project changes without writing content, use **`cerefox_set_document_projects(document_id, project_names)`** — that tool is the destructive-replace contract made explicit. Never call `cerefox_set_document_projects` with a single name when you mean "add" — that would REMOVE the doc from all other projects. When in doubt, use `cerefox_ingest` with singular `project_name`.\n\n## Update Workflow (ID-based -- preferred)\n\n```\nsearch("topic") -> find doc [id: abc123] -> get_document(abc123) -> note its content_hash -> modify ->\ningest(title="Same Title", content="...", document_id="abc123",\n       expected_content_hash="<the hash you read>", author="my-agent")\n```\n\nOn a **conflict** error: get_document again (fresh content + fresh hash) -> merge your changes -> retry with the new hash.\n\n## Update Workflow (title-based -- fallback)\n\n```\nsearch("topic") -> find doc (note its hash) -> modify ->\ningest(title="Same Title", content="...", update_if_exists=true,\n       expected_content_hash="<the hash you read>", author="my-agent")\n```\n\n## Catch-Up Workflow\n\n```\nmetadata_search(metadata_filter={"type": "decision-log"}, updated_since="2026-03-28T00:00:00Z")\n```\n\n## CLI fallback (when MCP is unavailable)\n\nIf `cerefox_search` is not in your tool list, your user has likely installed the Cerefox CLI. The canonical invocation is plain **`cerefox <subcommand>`** (the TypeScript CLI, installed via `npm install -g @cerefox/memory`). It uses a resource-verb shape (`cerefox document get`, `cerefox project list`, …). The legacy Python `uv run cerefox` is now a frozen husk as of v0.9 — only `uv run cerefox mcp` still works.\n\nSame operations, same conventions. Full reference: [`docs/guides/cli.md`](docs/guides/cli.md). CLI flag names match MCP parameter names exactly (e.g. `metadata_filter` ↔ `--metadata-filter`); common flags also have single-letter short forms (`-f`, `-p`, `-c`, `-m`, `-u`, `-a`, `-r`). Use the canonical long name (what `--help` shows) or its short form — there are no long-form aliases like `--filter` or `--count`.\n\n| MCP tool | CLI |\n|---|---|\n| `cerefox_search` | `cerefox search "<q>" --requestor "<your-name>"` |\n| `cerefox_ingest` (paste) | `printf \'...\' \\| cerefox document ingest --paste --title "<t>" --author "<your-name>" --author-type agent` |\n| `cerefox_ingest` (update by ID) | `printf \'...\' \\| cerefox document ingest --paste --title "<t>" --document-id "<uuid>" --expected-content-hash "<hash>" --author "<your-name>" --author-type agent` |\n| `cerefox_get_document` | `cerefox document get <id> --version-id <vid> --requestor "<your-name>"` |\n| `cerefox_list_versions` | `cerefox document version list <id> --requestor "<your-name>"` |\n| `cerefox_list_projects` | `cerefox project list --requestor "<your-name>"` |\n| `cerefox_list_metadata_keys` | `cerefox metadata keys` |\n| `cerefox_metadata_search` | `cerefox metadata search --metadata-filter \'<json>\' --requestor "<your-name>"` (list a project: `cerefox document list --project <name>`) |\n| `cerefox_set_document_projects` | `cerefox document set-projects <id> <name...> --author "<your-name>" --author-type agent` (or `--clear` to remove all) |\n| `cerefox_get_audit_log` | `cerefox audit list --requestor "<your-name>"` (add `--json` for scripted access) |\n| `cerefox_get_help` | `cerefox guides show agent-quick-reference` (or `cerefox guides list` for the full bundled-docs index) |\n\n**Set identity on every call**, exactly as you would on MCP:\n- Writes (`document ingest`, `document ingest-dir`): `--author "<your-name>" --author-type agent`\n- Reads: `--requestor "<your-name>"`\n\nOr have your user set `CEREFOX_AUTHOR_NAME` / `CEREFOX_AUTHOR_TYPE` / `CEREFOX_REQUESTOR_NAME` in their `.env` to apply defaults once.\n', HELP_SECTIONS, HELP_SECTION_HEADINGS;
+var HELP_FULL = '# Cerefox Knowledge Base -- Agent Quick Reference\n\nCerefox is a persistent, shared knowledge base. You have **10 MCP tools** (9 of them have CLI equivalents — `cerefox_get_help` is MCP-only). For the full guide, search Cerefox for "How AI Agents Use Cerefox" or call `cerefox_get_help` to retrieve this content over MCP.\n\n## Tools\n\n| Tool | Purpose | Key params |\n|------|---------|------------|\n| `cerefox_search` | Find documents (hybrid FTS + semantic) | `query` (required), `project_name`, `metadata_filter`, `requestor` |\n| `cerefox_ingest` | Save or update a document | `title`, `content` (required), `document_id` (update by ID), `expected_content_hash` (**required on content updates** — see rule 9), `last_write_wins`, `update_if_exists`, `project_name` (single, non-destructive add on update), `project_names` (list, destructive replace on update), `metadata` (omit on update to keep existing tags; `{}` clears), `author` |\n| `cerefox_get_document` | Get full document by ID (header includes `content_hash` — the update token) | `document_id` (required) |\n| `cerefox_list_versions` | Version history of a document | `document_id` (required) |\n| `cerefox_metadata_search` | Find or list docs by metadata, project, or time (no text query) | `metadata_filter`, `project_name` (list a project\'s docs), `updated_since`, `include_content` — **at least one** of metadata_filter/project_name/updated_since/created_since |\n| `cerefox_list_metadata_keys` | Discover available metadata keys | (none required) |\n| `cerefox_list_projects` | List all projects | (none required) |\n| `cerefox_set_document_projects` | Set doc\'s project memberships to exactly the given list (destructive replace; metadata-only, no content change) | `document_id`, `project_names` (required) |\n| `cerefox_get_audit_log` | Query write operation history | `document_id`, `author`, `operation`, `since` |\n| `cerefox_get_help` | Retrieve Cerefox conventions (this reference) over MCP. **Call this whenever uncertain.** | `topic` (optional, case-insensitive H2 substring match) |\n\n## Essential Rules\n\n1. **Search before ingesting** -- check if the document exists first.\n2. **Prefer ID-based updates** -- pass `document_id` from search results for deterministic updates. Falls back to title-matching with `update_if_exists: true`.\n3. **Set `author`/`requestor`** to your name on every call (e.g., "Claude Code", "archiver"). On MCP, pass as parameters. On CLI, pass `--author`/`--author-type`/`--requestor` flags, or rely on `CEREFOX_AUTHOR_NAME`/`CEREFOX_AUTHOR_TYPE`/`CEREFOX_REQUESTOR_NAME` env vars set in the user\'s `.env`.\n4. **Use `document_id` from search results** `[id: uuid]` for get_document and list_versions.\n5. **Add metadata** -- at minimum `type` ("decision-log", "research", "design-doc") and `status` ("active", "draft").\n6. **Write structured Markdown** with H1/H2/H3 headings for good chunking and search.\n7. **Deletes are soft (recoverable); purge is web-UI-only.** If you decide to delete, surface it to the user (`I soft-deleted X — recoverable from the Cerefox web UI trash`). You cannot un-do your own delete from agent code by design.\n8. **Cross-doc links inside content**: **always use `[Text](document-uuid)`.** UUIDs are the only fully reliable link form — stable across title changes, never ambiguous, no encoding gotchas. Every `cerefox_search` result shows `[id: <uuid>]` after the title; grab it and use it. Title-based linking (`[Text](<Title With Spaces>)`) is fragile (breaks on colons, parens, ampersands, brackets — silently navigates to wrong page) — **don\'t write title-based links**; do an extra search to get the UUID instead. Repo-path forms (`[Text](docs/path.md)`) exist for repo-ingested files; don\'t construct manually. See `AGENT_GUIDE.md → Writing linkable content` for the full rule.\n9. **Concurrency: content updates require `expected_content_hash`.** Pass the `content_hash` you read (shown by `cerefox_get_document`, `cerefox_search`, and `cerefox_metadata_search`) when updating a document. If it\'s stale you get a **conflict** — re-read the document, merge your changes into the latest content, retry with the new hash. **Never resolve a conflict by overwriting blindly** — the current content includes another writer\'s work. `last_write_wins: true` skips the check; use it ONLY when an external source of truth makes conflicts meaningless (file re-sync), never to silence a conflict.\n10. **Project memberships — non-destructive by default**: on `cerefox_ingest` updates, **`project_name` (singular) is a non-destructive add** (ensures membership, preserves others). Use **`project_names` (list)** when you want to set the doc\'s full project set in one call (destructive replace). For metadata-only project changes without writing content, use **`cerefox_set_document_projects(document_id, project_names)`** — that tool is the destructive-replace contract made explicit. Never call `cerefox_set_document_projects` with a single name when you mean "add" — that would REMOVE the doc from all other projects. When in doubt, use `cerefox_ingest` with singular `project_name`.\n\n## Update Workflow (ID-based -- preferred)\n\n```\nsearch("topic") -> find doc [id: abc123] -> get_document(abc123) -> note its content_hash -> modify ->\ningest(title="Same Title", content="...", document_id="abc123",\n       expected_content_hash="<the hash you read>", author="my-agent")\n```\n\nOn a **conflict** error: get_document again (fresh content + fresh hash) -> merge your changes -> retry with the new hash.\n\n## Update Workflow (title-based -- fallback)\n\n```\nsearch("topic") -> find doc (note its hash) -> modify ->\ningest(title="Same Title", content="...", update_if_exists=true,\n       expected_content_hash="<the hash you read>", author="my-agent")\n```\n\n## Catch-Up Workflow\n\n```\nmetadata_search(metadata_filter={"type": "decision-log"}, updated_since="2026-03-28T00:00:00Z")\n```\n\n## CLI fallback (when MCP is unavailable)\n\nIf `cerefox_search` is not in your tool list, your user has likely installed the Cerefox CLI. The canonical invocation is plain **`cerefox <subcommand>`** (the TypeScript CLI, installed via `npm install -g @cerefox/memory`). It uses a resource-verb shape (`cerefox document get`, `cerefox project list`, …).\n\nSame operations, same conventions. Full reference: [`docs/guides/cli.md`](docs/guides/cli.md). CLI flag names match MCP parameter names exactly (e.g. `metadata_filter` ↔ `--metadata-filter`); common flags also have single-letter short forms (`-f`, `-p`, `-c`, `-m`, `-u`, `-a`, `-r`). Use the canonical long name (what `--help` shows) or its short form — there are no long-form aliases like `--filter` or `--count`.\n\n| MCP tool | CLI |\n|---|---|\n| `cerefox_search` | `cerefox search "<q>" --requestor "<your-name>"` |\n| `cerefox_ingest` (paste) | `printf \'...\' \\| cerefox document ingest --paste --title "<t>" --author "<your-name>" --author-type agent` |\n| `cerefox_ingest` (update by ID) | `printf \'...\' \\| cerefox document ingest --paste --title "<t>" --document-id "<uuid>" --expected-content-hash "<hash>" --author "<your-name>" --author-type agent` |\n| `cerefox_get_document` | `cerefox document get <id> --version-id <vid> --requestor "<your-name>"` |\n| `cerefox_list_versions` | `cerefox document version list <id> --requestor "<your-name>"` |\n| `cerefox_list_projects` | `cerefox project list --requestor "<your-name>"` |\n| `cerefox_list_metadata_keys` | `cerefox metadata keys` |\n| `cerefox_metadata_search` | `cerefox metadata search --metadata-filter \'<json>\' --requestor "<your-name>"` (list a project: `cerefox document list --project <name>`) |\n| `cerefox_set_document_projects` | `cerefox document set-projects <id> <name...> --author "<your-name>" --author-type agent` (or `--clear` to remove all) |\n| `cerefox_get_audit_log` | `cerefox audit list --requestor "<your-name>"` (add `--json` for scripted access) |\n| `cerefox_get_help` | `cerefox guides show agent-quick-reference` (or `cerefox guides list` for the full bundled-docs index) |\n\n**Set identity on every call**, exactly as you would on MCP:\n- Writes (`document ingest`, `document ingest-dir`): `--author "<your-name>" --author-type agent`\n- Reads: `--requestor "<your-name>"`\n\nOr have your user set `CEREFOX_AUTHOR_NAME` / `CEREFOX_AUTHOR_TYPE` / `CEREFOX_REQUESTOR_NAME` in their `.env` to apply defaults once.\n', HELP_SECTIONS, HELP_SECTION_HEADINGS;
 var init_get_help_content = __esm(() => {
   HELP_SECTIONS = {
     Tools: "## Tools\n\n| Tool | Purpose | Key params |\n|------|---------|------------|\n| `cerefox_search` | Find documents (hybrid FTS + semantic) | `query` (required), `project_name`, `metadata_filter`, `requestor` |\n| `cerefox_ingest` | Save or update a document | `title`, `content` (required), `document_id` (update by ID), `expected_content_hash` (**required on content updates** — see rule 9), `last_write_wins`, `update_if_exists`, `project_name` (single, non-destructive add on update), `project_names` (list, destructive replace on update), `metadata` (omit on update to keep existing tags; `{}` clears), `author` |\n| `cerefox_get_document` | Get full document by ID (header includes `content_hash` — the update token) | `document_id` (required) |\n| `cerefox_list_versions` | Version history of a document | `document_id` (required) |\n| `cerefox_metadata_search` | Find or list docs by metadata, project, or time (no text query) | `metadata_filter`, `project_name` (list a project's docs), `updated_since`, `include_content` — **at least one** of metadata_filter/project_name/updated_since/created_since |\n| `cerefox_list_metadata_keys` | Discover available metadata keys | (none required) |\n| `cerefox_list_projects` | List all projects | (none required) |\n| `cerefox_set_document_projects` | Set doc's project memberships to exactly the given list (destructive replace; metadata-only, no content change) | `document_id`, `project_names` (required) |\n| `cerefox_get_audit_log` | Query write operation history | `document_id`, `author`, `operation`, `since` |\n| `cerefox_get_help` | Retrieve Cerefox conventions (this reference) over MCP. **Call this whenever uncertain.** | `topic` (optional, case-insensitive H2 substring match) |",
@@ -54055,7 +54364,7 @@ ingest(title="Same Title", content="...", document_id="abc123",
 On a **conflict** error: get_document again (fresh content + fresh hash) -> merge your changes -> retry with the new hash.`,
     "Update Workflow (title-based -- fallback)": '## Update Workflow (title-based -- fallback)\n\n```\nsearch("topic") -> find doc (note its hash) -> modify ->\ningest(title="Same Title", content="...", update_if_exists=true,\n       expected_content_hash="<the hash you read>", author="my-agent")\n```',
     "Catch-Up Workflow": '## Catch-Up Workflow\n\n```\nmetadata_search(metadata_filter={"type": "decision-log"}, updated_since="2026-03-28T00:00:00Z")\n```',
-    "CLI fallback (when MCP is unavailable)": '## CLI fallback (when MCP is unavailable)\n\nIf `cerefox_search` is not in your tool list, your user has likely installed the Cerefox CLI. The canonical invocation is plain **`cerefox <subcommand>`** (the TypeScript CLI, installed via `npm install -g @cerefox/memory`). It uses a resource-verb shape (`cerefox document get`, `cerefox project list`, …). The legacy Python `uv run cerefox` is now a frozen husk as of v0.9 — only `uv run cerefox mcp` still works.\n\nSame operations, same conventions. Full reference: [`docs/guides/cli.md`](docs/guides/cli.md). CLI flag names match MCP parameter names exactly (e.g. `metadata_filter` ↔ `--metadata-filter`); common flags also have single-letter short forms (`-f`, `-p`, `-c`, `-m`, `-u`, `-a`, `-r`). Use the canonical long name (what `--help` shows) or its short form — there are no long-form aliases like `--filter` or `--count`.\n\n| MCP tool | CLI |\n|---|---|\n| `cerefox_search` | `cerefox search "<q>" --requestor "<your-name>"` |\n| `cerefox_ingest` (paste) | `printf \'...\' \\| cerefox document ingest --paste --title "<t>" --author "<your-name>" --author-type agent` |\n| `cerefox_ingest` (update by ID) | `printf \'...\' \\| cerefox document ingest --paste --title "<t>" --document-id "<uuid>" --expected-content-hash "<hash>" --author "<your-name>" --author-type agent` |\n| `cerefox_get_document` | `cerefox document get <id> --version-id <vid> --requestor "<your-name>"` |\n| `cerefox_list_versions` | `cerefox document version list <id> --requestor "<your-name>"` |\n| `cerefox_list_projects` | `cerefox project list --requestor "<your-name>"` |\n| `cerefox_list_metadata_keys` | `cerefox metadata keys` |\n| `cerefox_metadata_search` | `cerefox metadata search --metadata-filter \'<json>\' --requestor "<your-name>"` (list a project: `cerefox document list --project <name>`) |\n| `cerefox_set_document_projects` | `cerefox document set-projects <id> <name...> --author "<your-name>" --author-type agent` (or `--clear` to remove all) |\n| `cerefox_get_audit_log` | `cerefox audit list --requestor "<your-name>"` (add `--json` for scripted access) |\n| `cerefox_get_help` | `cerefox guides show agent-quick-reference` (or `cerefox guides list` for the full bundled-docs index) |\n\n**Set identity on every call**, exactly as you would on MCP:\n- Writes (`document ingest`, `document ingest-dir`): `--author "<your-name>" --author-type agent`\n- Reads: `--requestor "<your-name>"`\n\nOr have your user set `CEREFOX_AUTHOR_NAME` / `CEREFOX_AUTHOR_TYPE` / `CEREFOX_REQUESTOR_NAME` in their `.env` to apply defaults once.'
+    "CLI fallback (when MCP is unavailable)": '## CLI fallback (when MCP is unavailable)\n\nIf `cerefox_search` is not in your tool list, your user has likely installed the Cerefox CLI. The canonical invocation is plain **`cerefox <subcommand>`** (the TypeScript CLI, installed via `npm install -g @cerefox/memory`). It uses a resource-verb shape (`cerefox document get`, `cerefox project list`, …).\n\nSame operations, same conventions. Full reference: [`docs/guides/cli.md`](docs/guides/cli.md). CLI flag names match MCP parameter names exactly (e.g. `metadata_filter` ↔ `--metadata-filter`); common flags also have single-letter short forms (`-f`, `-p`, `-c`, `-m`, `-u`, `-a`, `-r`). Use the canonical long name (what `--help` shows) or its short form — there are no long-form aliases like `--filter` or `--count`.\n\n| MCP tool | CLI |\n|---|---|\n| `cerefox_search` | `cerefox search "<q>" --requestor "<your-name>"` |\n| `cerefox_ingest` (paste) | `printf \'...\' \\| cerefox document ingest --paste --title "<t>" --author "<your-name>" --author-type agent` |\n| `cerefox_ingest` (update by ID) | `printf \'...\' \\| cerefox document ingest --paste --title "<t>" --document-id "<uuid>" --expected-content-hash "<hash>" --author "<your-name>" --author-type agent` |\n| `cerefox_get_document` | `cerefox document get <id> --version-id <vid> --requestor "<your-name>"` |\n| `cerefox_list_versions` | `cerefox document version list <id> --requestor "<your-name>"` |\n| `cerefox_list_projects` | `cerefox project list --requestor "<your-name>"` |\n| `cerefox_list_metadata_keys` | `cerefox metadata keys` |\n| `cerefox_metadata_search` | `cerefox metadata search --metadata-filter \'<json>\' --requestor "<your-name>"` (list a project: `cerefox document list --project <name>`) |\n| `cerefox_set_document_projects` | `cerefox document set-projects <id> <name...> --author "<your-name>" --author-type agent` (or `--clear` to remove all) |\n| `cerefox_get_audit_log` | `cerefox audit list --requestor "<your-name>"` (add `--json` for scripted access) |\n| `cerefox_get_help` | `cerefox guides show agent-quick-reference` (or `cerefox guides list` for the full bundled-docs index) |\n\n**Set identity on every call**, exactly as you would on MCP:\n- Writes (`document ingest`, `document ingest-dir`): `--author "<your-name>" --author-type agent`\n- Reads: `--requestor "<your-name>"`\n\nOr have your user set `CEREFOX_AUTHOR_NAME` / `CEREFOX_AUTHOR_TYPE` / `CEREFOX_REQUESTOR_NAME` in their `.env` to apply defaults once.'
   };
   HELP_SECTION_HEADINGS = ["Tools", "Essential Rules", "Update Workflow (ID-based -- preferred)", "Update Workflow (title-based -- fallback)", "Catch-Up Workflow", "CLI fallback (when MCP is unavailable)"];
 });
@@ -54122,144 +54431,6 @@ var init_get_help = __esm(() => {
 });
 
 // ../../_shared/mcp-tools/_chunker.ts
-function parseSections2(text) {
-  const lines = text.split(`
-`);
-  const sections = [];
-  let currentHeadings = [];
-  let currentLevel = 0;
-  let bodyLines = [];
-  function collectSection() {
-    const body = bodyLines.join(`
-`).trim();
-    bodyLines = [];
-    let content;
-    if (currentLevel > 0) {
-      const headerLine = "#".repeat(currentLevel) + " " + (currentHeadings[currentHeadings.length - 1] ?? "");
-      content = body ? headerLine + `
-
-` + body : headerLine;
-    } else {
-      content = body;
-    }
-    if (!content.trim())
-      return;
-    sections.push({
-      level: currentLevel,
-      headings: [...currentHeadings],
-      heading: currentHeadings[currentHeadings.length - 1] ?? "",
-      content,
-      body
-    });
-  }
-  for (const line of lines) {
-    const h1 = line.match(/^# (.+)/);
-    const h2 = line.match(/^## (.+)/);
-    const h3 = line.match(/^### (.+)/);
-    if (h1) {
-      collectSection();
-      currentHeadings = [h1[1].trim()];
-      currentLevel = 1;
-    } else if (h2) {
-      collectSection();
-      currentHeadings = [currentHeadings[0] ?? "", h2[1].trim()].filter(Boolean);
-      currentLevel = 2;
-    } else if (h3) {
-      collectSection();
-      currentHeadings = [
-        currentHeadings[0] ?? "",
-        currentHeadings[1] ?? "",
-        h3[1].trim()
-      ].filter(Boolean);
-      currentLevel = 3;
-    } else {
-      bodyLines.push(line);
-    }
-  }
-  collectSection();
-  return sections;
-}
-function makeChunk(headings, level, content) {
-  const title = headings[headings.length - 1] ?? "";
-  return {
-    heading_path: [...headings],
-    heading_level: level,
-    title,
-    content,
-    char_count: content.length
-  };
-}
-function chunkMarkdown2(text) {
-  const trimmed = text.trim();
-  if (!trimmed)
-    return [];
-  if (trimmed.length <= MAX_CHUNK_CHARS) {
-    return [makeChunk([], 0, trimmed)];
-  }
-  const sections = parseSections2(trimmed);
-  const chunks = [];
-  let bufParts = [];
-  let bufHeadings = [];
-  let bufLevel = 0;
-  let bufChars = 0;
-  function flushBuf() {
-    if (bufParts.length === 0)
-      return;
-    chunks.push(makeChunk(bufHeadings, bufLevel, bufParts.join(`
-
-`)));
-    bufParts = [];
-    bufHeadings = [];
-    bufLevel = 0;
-    bufChars = 0;
-  }
-  for (const section of sections) {
-    const { level, headings, heading, content, body } = section;
-    if (content.length > MAX_CHUNK_CHARS) {
-      flushBuf();
-      const headerPrefix = level > 0 ? "#".repeat(level) + " " + heading + `
-
-` : "";
-      const bodyToSplit = body || content;
-      const paragraphs = bodyToSplit.split(/\n\n+/);
-      let sub = "";
-      let isFirst = true;
-      for (const para of paragraphs) {
-        const prefix = isFirst ? headerPrefix : "";
-        if (sub.length + prefix.length + para.length + 2 > MAX_CHUNK_CHARS && sub.length > 0) {
-          chunks.push(makeChunk(headings, level, sub.trim()));
-          sub = para;
-          isFirst = false;
-        } else {
-          sub = sub ? sub + `
-
-` + para : prefix + para;
-          isFirst = false;
-        }
-      }
-      if (sub.trim())
-        chunks.push(makeChunk(headings, level, sub.trim()));
-      continue;
-    }
-    const addition = content.length + (bufParts.length > 0 ? 2 : 0);
-    if (bufChars + addition <= MAX_CHUNK_CHARS) {
-      if (bufParts.length === 0) {
-        bufHeadings = headings;
-        bufLevel = level;
-      }
-      bufParts.push(content);
-      bufChars += addition;
-    } else {
-      flushBuf();
-      bufParts = [content];
-      bufHeadings = headings;
-      bufLevel = level;
-      bufChars = content.length;
-    }
-  }
-  flushBuf();
-  return chunks;
-}
 function normalizeContent(text) {
   return text.trim().replace(/\r\n/g, `
 `).replace(/\r/g, `
@@ -54272,7 +54443,7 @@ async function sha256hex(text) {
   const hash = await crypto.subtle.digest("SHA-256", bytes);
   return Array.from(new Uint8Array(hash)).map((b2) => b2.toString(16).padStart(2, "0")).join("");
 }
-var MAX_CHUNK_CHARS = 4000;
+var init__chunker = () => {};
 
 // ../../_shared/mcp-tools/ingest.ts
 function conflictError(documentId, expectedHash, currentHash) {
@@ -54328,11 +54499,10 @@ async function handler4(supabase, args, ctx) {
     if (!last_write_wins && expected_content_hash && expected_content_hash !== existingDoc.content_hash) {
       throw conflictError(existingDoc.id, expected_content_hash, existingDoc.content_hash);
     }
-    const chunks2 = chunkMarkdown2(content);
+    const chunks2 = chunkMarkdown(content);
     if (chunks2.length === 0)
       throw new Error("Content produced no chunks");
-    const texts2 = chunks2.map((c2) => `# ${title}
-${c2.content}`);
+    const texts2 = chunks2.map((c2) => embeddingInputFor(title, c2));
     const embeddings2 = await embedBatch(texts2, ctx.openaiApiKey);
     const totalChars2 = chunks2.reduce((s, c2) => s + c2.char_count, 0);
     const chunkData2 = chunks2.map((chunk, i) => ({
@@ -54357,7 +54527,8 @@ ${c2.content}`);
       p_author_type: author_type,
       p_source_label: source,
       p_expected_content_hash: expected_content_hash,
-      p_last_write_wins: last_write_wins
+      p_last_write_wins: last_write_wins,
+      p_content_format: CONTENT_FORMAT_BLIND_STITCH
     });
     if (ingestErr2)
       throw mapIngestRpcError(ingestErr2.message, existingDoc.id);
@@ -54386,11 +54557,10 @@ ${c2.content}`);
       if (!last_write_wins && expected_content_hash && expected_content_hash !== existingDoc.content_hash) {
         throw conflictError(existingDoc.id, expected_content_hash, existingDoc.content_hash);
       }
-      const chunks2 = chunkMarkdown2(content);
+      const chunks2 = chunkMarkdown(content);
       if (chunks2.length === 0)
         throw new Error("Content produced no chunks");
-      const texts2 = chunks2.map((c2) => `# ${title}
-${c2.content}`);
+      const texts2 = chunks2.map((c2) => embeddingInputFor(title, c2));
       const embeddings2 = await embedBatch(texts2, ctx.openaiApiKey);
       const totalChars2 = chunks2.reduce((s, c2) => s + c2.char_count, 0);
       const chunkData2 = chunks2.map((chunk, i) => ({
@@ -54415,7 +54585,8 @@ ${c2.content}`);
         p_author_type: author_type,
         p_source_label: source,
         p_expected_content_hash: expected_content_hash,
-        p_last_write_wins: last_write_wins
+        p_last_write_wins: last_write_wins,
+        p_content_format: CONTENT_FORMAT_BLIND_STITCH
       });
       if (ingestErr2)
         throw mapIngestRpcError(ingestErr2.message, existingDoc.id);
@@ -54438,11 +54609,10 @@ ${c2.content}`);
   if (hashMatch?.length) {
     return `Document already up-to-date: "${hashMatch[0].title}" (id: ${hashMatch[0].id}). Content hash unchanged.`;
   }
-  const chunks = chunkMarkdown2(content);
+  const chunks = chunkMarkdown(content);
   if (chunks.length === 0)
     throw new Error("Content produced no chunks");
-  const texts = chunks.map((c2) => `# ${title}
-${c2.content}`);
+  const texts = chunks.map((c2) => embeddingInputFor(title, c2));
   const embeddings = await embedBatch(texts, ctx.openaiApiKey);
   const totalChars = chunks.reduce((s, c2) => s + c2.char_count, 0);
   const chunkData = chunks.map((chunk, i) => ({
@@ -54464,7 +54634,8 @@ ${c2.content}`);
     p_review_status: reviewStatus,
     p_chunks: chunkData,
     p_author: author,
-    p_author_type: author_type
+    p_author_type: author_type,
+    p_content_format: CONTENT_FORMAT_BLIND_STITCH
   });
   if (ingestErr || !ingestResult?.length) {
     throw new Error(`Ingest RPC failed: ${ingestErr?.message ?? "no data returned"}`);
@@ -54487,6 +54658,7 @@ ${c2.content}`);
 }
 var ingestTool;
 var init_ingest = __esm(() => {
+  init__chunker();
   init__projects();
   init_types3();
   ingestTool = {
@@ -63936,7 +64108,7 @@ var require_data = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.bun/fast-uri@3.1.3/node_modules/fast-uri/lib/utils.js
 var require_utils2 = __commonJS((exports, module) => {
   var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
   var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
@@ -64247,7 +64419,7 @@ var require_utils2 = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.bun/fast-uri@3.1.3/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS((exports, module) => {
   var { isUUID } = require_utils2();
   var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
@@ -64421,7 +64593,7 @@ var require_schemes = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.2/node_modules/fast-uri/index.js
+// ../../node_modules/.bun/fast-uri@3.1.3/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS((exports, module) => {
   var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils2();
   var { SCHEMES, getSchemeHandler } = require_schemes();
@@ -64633,7 +64805,7 @@ var require_fast_uri = __commonJS((exports, module) => {
       if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
         if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
           try {
-            parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+            parsed.host = new URL("http://" + parsed.host).hostname;
           } catch (e) {
             parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
           }
@@ -68607,190 +68779,7 @@ import { homedir as homedir4, platform } from "node:os";
 import { dirname, join as join4 } from "node:path";
 import { spawnSync } from "node:child_process";
 
-// ../../node_modules/.bun/smol-toml@1.6.1/node_modules/smol-toml/dist/error.js
-/*!
- * Copyright (c) Squirrel Chat et al., All rights reserved.
- * SPDX-License-Identifier: BSD-3-Clause
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright notice, this
- *    list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright notice,
- *    this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the copyright holder nor the names of its contributors
- *    may be used to endorse or promote products derived from this software without
- *    specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-function getLineColFromPtr(string, ptr) {
-  let lines = string.slice(0, ptr).split(/\r\n|\n|\r/g);
-  return [lines.length, lines.pop().length + 1];
-}
-function makeCodeBlock(string, line, column) {
-  let lines = string.split(/\r\n|\n|\r/g);
-  let codeblock = "";
-  let numberLen = (Math.log10(line + 1) | 0) + 1;
-  for (let i = line - 1;i <= line + 1; i++) {
-    let l2 = lines[i - 1];
-    if (!l2)
-      continue;
-    codeblock += i.toString().padEnd(numberLen, " ");
-    codeblock += ":  ";
-    codeblock += l2;
-    codeblock += `
-`;
-    if (i === line) {
-      codeblock += " ".repeat(numberLen + column + 2);
-      codeblock += `^
-`;
-    }
-  }
-  return codeblock;
-}
-
-class TomlError extends Error {
-  line;
-  column;
-  codeblock;
-  constructor(message, options) {
-    const [line, column] = getLineColFromPtr(options.toml, options.ptr);
-    const codeblock = makeCodeBlock(options.toml, line, column);
-    super(`Invalid TOML document: ${message}
-
-${codeblock}`, options);
-    this.line = line;
-    this.column = column;
-    this.codeblock = codeblock;
-  }
-}
-
-// ../../node_modules/.bun/smol-toml@1.6.1/node_modules/smol-toml/dist/util.js
-/*!
- * Copyright (c) Squirrel Chat et al., All rights reserved.
- * SPDX-License-Identifier: BSD-3-Clause
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright notice, this
- *    list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright notice,
- *    this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the copyright holder nor the names of its contributors
- *    may be used to endorse or promote products derived from this software without
- *    specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-function isEscaped(str, ptr) {
-  let i = 0;
-  while (str[ptr - ++i] === "\\")
-    ;
-  return --i && i % 2;
-}
-function indexOfNewline(str, start = 0, end = str.length) {
-  let idx = str.indexOf(`
-`, start);
-  if (str[idx - 1] === "\r")
-    idx--;
-  return idx <= end ? idx : -1;
-}
-function skipComment(str, ptr) {
-  for (let i = ptr;i < str.length; i++) {
-    let c2 = str[i];
-    if (c2 === `
-`)
-      return i;
-    if (c2 === "\r" && str[i + 1] === `
-`)
-      return i + 1;
-    if (c2 < " " && c2 !== "\t" || c2 === "") {
-      throw new TomlError("control characters are not allowed in comments", {
-        toml: str,
-        ptr
-      });
-    }
-  }
-  return str.length;
-}
-function skipVoid(str, ptr, banNewLines, banComments) {
-  let c2;
-  while (true) {
-    while ((c2 = str[ptr]) === " " || c2 === "\t" || !banNewLines && (c2 === `
-` || c2 === "\r" && str[ptr + 1] === `
-`))
-      ptr++;
-    if (banComments || c2 !== "#")
-      break;
-    ptr = skipComment(str, ptr);
-  }
-  return ptr;
-}
-function skipUntil(str, ptr, sep, end, banNewLines = false) {
-  if (!end) {
-    ptr = indexOfNewline(str, ptr);
-    return ptr < 0 ? str.length : ptr;
-  }
-  for (let i = ptr;i < str.length; i++) {
-    let c2 = str[i];
-    if (c2 === "#") {
-      i = indexOfNewline(str, i);
-    } else if (c2 === sep) {
-      return i + 1;
-    } else if (c2 === end || banNewLines && (c2 === `
-` || c2 === "\r" && str[i + 1] === `
-`)) {
-      return i;
-    }
-  }
-  throw new TomlError("cannot find end of structure", {
-    toml: str,
-    ptr
-  });
-}
-function getStringEnd(str, seek) {
-  let first = str[seek];
-  let target = first === str[seek + 1] && str[seek + 1] === str[seek + 2] ? str.slice(seek, seek + 3) : first;
-  seek += target.length - 1;
-  do
-    seek = str.indexOf(target, ++seek);
-  while (seek > -1 && first !== "'" && isEscaped(str, seek));
-  if (seek > -1) {
-    seek += target.length;
-    if (target.length > 1) {
-      if (str[seek] === first)
-        seek++;
-      if (str[seek] === first)
-        seek++;
-    }
-  }
-  return seek;
-}
-
-// ../../node_modules/.bun/smol-toml@1.6.1/node_modules/smol-toml/dist/date.js
+// ../../node_modules/.bun/smol-toml@1.7.0/node_modules/smol-toml/dist/date.js
 /*!
  * Copyright (c) Squirrel Chat et al., All rights reserved.
  * SPDX-License-Identifier: BSD-3-Clause
@@ -68910,7 +68899,77 @@ class TomlDate extends Date {
   }
 }
 
-// ../../node_modules/.bun/smol-toml@1.6.1/node_modules/smol-toml/dist/primitive.js
+// ../../node_modules/.bun/smol-toml@1.7.0/node_modules/smol-toml/dist/error.js
+/*!
+ * Copyright (c) Squirrel Chat et al., All rights reserved.
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+function getLineColFromPtr(string, ptr) {
+  let lines = string.slice(0, ptr).split(/\r\n|\n|\r/g);
+  return [lines.length, lines.pop().length + 1];
+}
+function makeCodeBlock(string, line, column) {
+  let lines = string.split(/\r\n|\n|\r/g);
+  let codeblock = "";
+  let numberLen = (Math.log10(line + 1) | 0) + 1;
+  for (let i = line - 1;i <= line + 1; i++) {
+    let l2 = lines[i - 1];
+    if (!l2)
+      continue;
+    codeblock += i.toString().padEnd(numberLen, " ");
+    codeblock += ":  ";
+    codeblock += l2;
+    codeblock += `
+`;
+    if (i === line) {
+      codeblock += " ".repeat(numberLen + column + 2);
+      codeblock += `^
+`;
+    }
+  }
+  return codeblock;
+}
+
+class TomlError extends Error {
+  line;
+  column;
+  codeblock;
+  constructor(message, options) {
+    const [line, column] = getLineColFromPtr(options.toml, options.ptr);
+    const codeblock = makeCodeBlock(options.toml, line, column);
+    super(`Invalid TOML document: ${message}
+
+${codeblock}`, options);
+    this.line = line;
+    this.column = column;
+    this.codeblock = codeblock;
+  }
+}
+
+// ../../node_modules/.bun/smol-toml@1.7.0/node_modules/smol-toml/dist/primitive.js
 /*!
  * Copyright (c) Squirrel Chat et al., All rights reserved.
  * SPDX-License-Identifier: BSD-3-Clause
@@ -68941,95 +69000,103 @@ class TomlDate extends Date {
 var INT_REGEX = /^((0x[0-9a-fA-F](_?[0-9a-fA-F])*)|(([+-]|0[ob])?\d(_?\d)*))$/;
 var FLOAT_REGEX = /^[+-]?\d(_?\d)*(\.\d(_?\d)*)?([eE][+-]?\d(_?\d)*)?$/;
 var LEADING_ZERO = /^[+-]?0[0-9_]/;
-var ESCAPE_REGEX = /^[0-9a-f]{2,8}$/i;
-var ESC_MAP = {
-  b: "\b",
-  t: "\t",
-  n: `
-`,
-  f: "\f",
-  r: "\r",
-  e: "\x1B",
-  '"': '"',
-  "\\": "\\"
-};
-function parseString(str, ptr = 0, endPtr = str.length) {
-  let isLiteral = str[ptr] === "'";
-  let isMultiline = str[ptr++] === str[ptr] && str[ptr] === str[ptr + 1];
+function parseString(str, ptr) {
+  let c2 = str[ptr++];
+  let first = c2;
+  let isLiteral = c2 === "'";
+  let isMultiline = c2 === str[ptr] && c2 === str[ptr + 1];
   if (isMultiline) {
-    endPtr -= 2;
-    if (str[ptr += 2] === "\r")
-      ptr++;
-    if (str[ptr] === `
+    if (str[ptr += 2] === `
 `)
       ptr++;
+    else if (str[ptr] === "\r" && str[ptr + 1] === `
+`)
+      ptr += 2;
   }
-  let tmp = 0;
-  let isEscape;
   let parsed = "";
   let sliceStart = ptr;
-  while (ptr < endPtr - 1) {
-    let c2 = str[ptr++];
-    if (c2 === `
-` || c2 === "\r" && str[ptr] === `
-`) {
-      if (!isMultiline) {
-        throw new TomlError("newlines are not allowed in strings", {
-          toml: str,
-          ptr: ptr - 1
-        });
-      }
+  let state = 0;
+  for (let i = ptr;i < str.length; i++) {
+    c2 = str[i];
+    if (isMultiline && (c2 === `
+` || c2 === "\r" && str[i + 1] === `
+`)) {
+      state = state && 3;
     } else if (c2 < " " && c2 !== "\t" || c2 === "") {
       throw new TomlError("control characters are not allowed in strings", {
         toml: str,
-        ptr: ptr - 1
+        ptr: i
       });
-    }
-    if (isEscape) {
-      isEscape = false;
+    } else if ((!state || state === 3) && c2 === first && (!isMultiline || str[i + 1] === first && str[i + 2] === first)) {
+      if (isMultiline) {
+        if (str[i + 3] === first)
+          i++;
+        if (str[i + 3] === first)
+          i++;
+      }
+      return [
+        state ? parsed : parsed + str.slice(sliceStart, i),
+        i + (isMultiline ? 3 : 1)
+      ];
+    } else if (!state) {
+      if (!isLiteral && c2 === "\\") {
+        parsed += str.slice(sliceStart, sliceStart = i);
+        state = 1;
+      }
+    } else if (state === 1) {
       if (c2 === "x" || c2 === "u" || c2 === "U") {
-        let code = str.slice(ptr, ptr += c2 === "x" ? 2 : c2 === "u" ? 4 : 8);
-        if (!ESCAPE_REGEX.test(code)) {
-          throw new TomlError("invalid unicode escape", {
-            toml: str,
-            ptr: tmp
-          });
-        }
-        try {
-          parsed += String.fromCodePoint(parseInt(code, 16));
-        } catch {
-          throw new TomlError("invalid unicode escape", {
-            toml: str,
-            ptr: tmp
-          });
-        }
-      } else if (isMultiline && (c2 === `
-` || c2 === " " || c2 === "\t" || c2 === "\r")) {
-        ptr = skipVoid(str, ptr - 1, true);
-        if (str[ptr] !== `
-` && str[ptr] !== "\r") {
-          throw new TomlError("invalid escape: only line-ending whitespace may be escaped", {
-            toml: str,
-            ptr: tmp
-          });
-        }
-        ptr = skipVoid(str, ptr);
-      } else if (c2 in ESC_MAP) {
-        parsed += ESC_MAP[c2];
+        let value = 0;
+        let len = c2 === "x" ? 2 : c2 === "u" ? 4 : 8;
+        for (let j = 0;j < len; j++, i++) {
+          let hex = str.charCodeAt(i + 1);
+          let digit = hex >= 48 && hex <= 57 ? hex - 48 : hex >= 65 && hex <= 70 ? hex - 65 + 10 : hex >= 97 && hex <= 102 ? hex - 97 + 10 : -1;
+          if (digit < 0)
+            throw new TomlError("invalid non-hex character in unicode escape", { toml: str, ptr: i + 1 });
+          value = value << 4 | digit;
+        }
+        if (value < 0 || value > 1114111 || value >= 55296 && value <= 57343) {
+          throw new TomlError("invalid unicode escape", { toml: str, ptr: i });
+        }
+        parsed += String.fromCodePoint(value);
+        sliceStart = i + 1;
+        state = 0;
+      } else if (c2 === " " || c2 === "\t") {
+        state = 2;
       } else {
-        throw new TomlError("unrecognized escape sequence", {
+        if (c2 === "b")
+          parsed += "\b";
+        else if (c2 === "t")
+          parsed += "\t";
+        else if (c2 === "n")
+          parsed += `
+`;
+        else if (c2 === "f")
+          parsed += "\f";
+        else if (c2 === "r")
+          parsed += "\r";
+        else if (c2 === "e")
+          parsed += "\x1B";
+        else if (c2 === '"')
+          parsed += '"';
+        else if (c2 === "\\")
+          parsed += "\\";
+        else
+          throw new TomlError("unrecognized escape sequence", { toml: str, ptr: i });
+        sliceStart = i + 1;
+        state = 0;
+      }
+    } else if (c2 !== " " && c2 !== "\t") {
+      if (state === 2) {
+        throw new TomlError("invalid escape: only line-ending whitespace may be escaped", {
           toml: str,
-          ptr: tmp
+          ptr: sliceStart
         });
       }
-      sliceStart = ptr;
-    } else if (!isLiteral && c2 === "\\") {
-      tmp = ptr - 1;
-      isEscape = true;
-      parsed += str.slice(sliceStart, tmp);
+      state = !isLiteral && c2 === "\\" ? 1 : 0;
+      sliceStart = i;
     }
   }
-  return parsed + str.slice(sliceStart, endPtr - 1);
+  throw new TomlError("unfinished string", { toml: str, ptr });
 }
 function parseValue(value, toml, ptr, integersAsBigInt) {
   if (value === "true")
@@ -69082,7 +69149,96 @@ function parseValue(value, toml, ptr, integersAsBigInt) {
   return date;
 }
 
-// ../../node_modules/.bun/smol-toml@1.6.1/node_modules/smol-toml/dist/extract.js
+// ../../node_modules/.bun/smol-toml@1.7.0/node_modules/smol-toml/dist/util.js
+/*!
+ * Copyright (c) Squirrel Chat et al., All rights reserved.
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+function indexOfNewline(str, start = 0, end = str.length) {
+  let idx = str.indexOf(`
+`, start);
+  if (str[idx - 1] === "\r")
+    idx--;
+  return idx <= end ? idx : -1;
+}
+function skipComment(str, ptr) {
+  for (let i = ptr;i < str.length; i++) {
+    let c2 = str[i];
+    if (c2 === `
+`)
+      return i;
+    if (c2 === "\r" && str[i + 1] === `
+`)
+      return i + 1;
+    if (c2 < " " && c2 !== "\t" || c2 === "") {
+      throw new TomlError("control characters are not allowed in comments", {
+        toml: str,
+        ptr
+      });
+    }
+  }
+  return str.length;
+}
+function skipVoid(str, ptr, banNewLines, banComments) {
+  let c2;
+  while (true) {
+    while ((c2 = str[ptr]) === " " || c2 === "\t" || !banNewLines && (c2 === `
+` || c2 === "\r" && str[ptr + 1] === `
+`))
+      ptr++;
+    if (banComments || c2 !== "#")
+      break;
+    ptr = skipComment(str, ptr);
+  }
+  return ptr;
+}
+function skipUntil(str, ptr, sep, end, banNewLines = false) {
+  if (!end) {
+    ptr = indexOfNewline(str, ptr);
+    return ptr < 0 ? str.length : ptr;
+  }
+  for (let i = ptr;i < str.length; i++) {
+    let c2 = str[i];
+    if (c2 === "#") {
+      i = indexOfNewline(str, i);
+    } else if (c2 === sep) {
+      return i + 1;
+    } else if (c2 === end || banNewLines && (c2 === `
+` || c2 === "\r" && str[i + 1] === `
+`)) {
+      return i;
+    }
+  }
+  throw new TomlError("cannot find end of structure", {
+    toml: str,
+    ptr
+  });
+}
+
+// ../../node_modules/.bun/smol-toml@1.7.0/node_modules/smol-toml/dist/extract.js
 /*!
  * Copyright (c) Squirrel Chat et al., All rights reserved.
  * SPDX-License-Identifier: BSD-3-Clause
@@ -69142,25 +69298,24 @@ function extractValue(str, ptr, end, depth, integersAsBigInt) {
     }
     return [value, endPtr2];
   }
-  let endPtr;
   if (c2 === '"' || c2 === "'") {
-    endPtr = getStringEnd(str, ptr);
-    let parsed = parseString(str, ptr, endPtr);
+    let [parsed, endPtr2] = parseString(str, ptr);
     if (end) {
-      endPtr = skipVoid(str, endPtr);
-      if (str[endPtr] && str[endPtr] !== "," && str[endPtr] !== end && str[endPtr] !== `
-` && str[endPtr] !== "\r") {
+      endPtr2 = skipVoid(str, endPtr2);
+      if (str[endPtr2] && str[endPtr2] !== "," && str[endPtr2] !== end && str[endPtr2] !== `
+` && str[endPtr2] !== "\r") {
         throw new TomlError("unexpected character encountered", {
           toml: str,
-          ptr: endPtr
+          ptr: endPtr2
         });
       }
-      endPtr += +(str[endPtr] === ",");
+      if (str[endPtr2] === ",")
+        endPtr2++;
     }
-    return [parsed, endPtr];
+    return [parsed, endPtr2];
   }
-  endPtr = skipUntil(str, ptr, ",", end);
-  let slice = sliceAndTrimEndOf(str, ptr, endPtr - +(str[endPtr - 1] === ","));
+  let endPtr = skipUntil(str, ptr, ",", end);
+  let slice = sliceAndTrimEndOf(str, ptr, endPtr - (str[endPtr - 1] === "," ? 1 : 0));
   if (!slice[0]) {
     throw new TomlError("incomplete key-value declaration: no value specified", {
       toml: str,
@@ -69169,7 +69324,8 @@ function extractValue(str, ptr, end, depth, integersAsBigInt) {
   }
   if (end && slice[1] > -1) {
     endPtr = skipVoid(str, ptr + slice[1]);
-    endPtr += +(str[endPtr] === ",");
+    if (str[endPtr] === ",")
+      endPtr++;
   }
   return [
     parseValue(slice[0], str, ptr, integersAsBigInt),
@@ -69177,7 +69333,7 @@ function extractValue(str, ptr, end, depth, integersAsBigInt) {
   ];
 }
 
-// ../../node_modules/.bun/smol-toml@1.6.1/node_modules/smol-toml/dist/struct.js
+// ../../node_modules/.bun/smol-toml@1.7.0/node_modules/smol-toml/dist/struct.js
 /*!
  * Copyright (c) Squirrel Chat et al., All rights reserved.
  * SPDX-License-Identifier: BSD-3-Clause
@@ -69226,13 +69382,7 @@ function parseKey(str, ptr, end = "=") {
             ptr
           });
         }
-        let eos = getStringEnd(str, ptr);
-        if (eos < 0) {
-          throw new TomlError("unfinished string encountered", {
-            toml: str,
-            ptr
-          });
-        }
+        let [part, eos] = parseString(str, ptr);
         dot = str.indexOf(".", eos);
         let strEnd = str.slice(eos, dot < 0 || dot > endPtr ? endPtr : dot);
         let newLine = indexOfNewline(strEnd);
@@ -69257,7 +69407,7 @@ function parseKey(str, ptr, end = "=") {
             });
           }
         }
-        parsed.push(parseString(str, ptr, eos));
+        parsed.push(part);
       } else {
         dot = str.indexOf(".", ptr);
         let part = str.slice(ptr, dot < 0 || dot > endPtr ? endPtr : dot);
@@ -69354,7 +69504,7 @@ function parseArray(str, ptr, depth, integersAsBigInt) {
   return [res, ptr];
 }
 
-// ../../node_modules/.bun/smol-toml@1.6.1/node_modules/smol-toml/dist/parse.js
+// ../../node_modules/.bun/smol-toml@1.7.0/node_modules/smol-toml/dist/parse.js
 /*!
  * Copyright (c) Squirrel Chat et al., All rights reserved.
  * SPDX-License-Identifier: BSD-3-Clause
@@ -69495,7 +69645,7 @@ function parse(toml, { maxDepth = 1000, integersAsBigInt } = {}) {
   return res;
 }
 
-// ../../node_modules/.bun/smol-toml@1.6.1/node_modules/smol-toml/dist/stringify.js
+// ../../node_modules/.bun/smol-toml@1.7.0/node_modules/smol-toml/dist/stringify.js
 /*!
  * Copyright (c) Squirrel Chat et al., All rights reserved.
  * SPDX-License-Identifier: BSD-3-Clause
@@ -69555,7 +69705,7 @@ function stringifyValue(val, type, depth, numberAsFloat) {
       return "inf";
     if (val === -Infinity)
       return "-inf";
-    if (numberAsFloat && Number.isInteger(val))
+    if (Number.isInteger(val) && (numberAsFloat || !Number.isSafeInteger(val)))
       return val.toFixed(1);
     return val.toString();
   }
@@ -69669,7 +69819,7 @@ function stringify(obj2, { maxDepth = 1000, numbersAsFloat = false } = {}) {
   return str;
 }
 
-// ../../node_modules/.bun/smol-toml@1.6.1/node_modules/smol-toml/dist/index.js
+// ../../node_modules/.bun/smol-toml@1.7.0/node_modules/smol-toml/dist/index.js
 /*!
  * Copyright (c) Squirrel Chat et al., All rights reserved.
  * SPDX-License-Identifier: BSD-3-Clause
@@ -70247,6 +70397,17 @@ function parseProjectRef(supabaseUrl) {
     return null;
   }
 }
+var PRIMITIVE_EFS = [
+  "cerefox-search",
+  "cerefox-ingest",
+  "cerefox-metadata",
+  "cerefox-get-document",
+  "cerefox-list-versions",
+  "cerefox-get-audit-log",
+  "cerefox-metadata-search",
+  "cerefox-list-projects"
+];
+var NO_VERIFY_JWT_EFS = new Set(["cerefox-mcp", ...PRIMITIVE_EFS]);
 function listEdgeFunctions(functionsDir) {
   if (!existsSync7(functionsDir))
     return [];
@@ -70411,6 +70572,10 @@ Proceed with deployment to Supabase?`, true);
       const args = ["--yes", "supabase", "functions", "deploy", ef, "--use-api"];
       if (projectRef)
         args.push("--project-ref", projectRef);
+      if (NO_VERIFY_JWT_EFS.has(ef)) {
+        args.push("--no-verify-jwt");
+        info(`     (${ef}: --no-verify-jwt — in-function auth)`);
+      }
       const r = spawnSync2("npx", args, {
         encoding: "utf8",
         stdio: "inherit",
@@ -70429,6 +70594,24 @@ Proceed with deployment to Supabase?`, true);
       process.exit(1);
     }
     println(c.green(`   ✓ Deployed ${efOk} Edge Function(s).`));
+    if (efNames.includes("cerefox-mcp")) {
+      const ref = projectRef ?? "<ref>";
+      println(c.cyan(`
+   ℹ  cerefox-mcp authenticates in-function (OAuth for cloud/mobile Claude).
+` + `      Pin the owner — this is the authorization boundary (else any user who
+` + `      self-registers on your project could get an accepted token):
+` + `        supabase secrets set CEREFOX_OAUTH_OWNER_ID=<owner user uuid> --project-ref ${ref}
+` + "      Setup: docs/guides/setup-supabase.md Step 7 (incl. the client_secret_post gotcha)."));
+    }
+    if (efNames.some((ef) => PRIMITIVE_EFS.includes(ef))) {
+      const ref = projectRef ?? "<ref>";
+      println(c.cyan(`
+   ℹ  The primitive Edge Functions now require the Cerefox access token.
+` + `      If CEREFOX_ACCESS_TOKENS is unset they reject ALL callers (fail closed) —
+` + "      GPT Actions, remote HTTP, and `cerefox doctor`. Generate it now:\n" + `        cerefox token generate
+` + `      (or manually: supabase secrets set CEREFOX_ACCESS_TOKENS=<token> --project-ref ${ref})
+` + "      Migration + client cutover: docs/specs/ef-auth-migration-design.md §6."));
+    }
   }
   println(c.green(`
 ✓ Server deploy complete.`));
@@ -70705,7 +70888,7 @@ function registerVersionArchive(parent) {
   parent.command("unarchive").description("Unarchive a document version (allow version cleanup again).").argument("<version-id>", "UUID of the version (from `cerefox version list`).").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").action((versionId, options) => setArchived(versionId, false, options));
 }
 
-// ../../node_modules/.bun/ora@9.4.0/node_modules/ora/index.js
+// ../../node_modules/.bun/ora@9.4.1/node_modules/ora/index.js
 import process8 from "node:process";
 import { stripVTControlCharacters } from "node:util";
 
@@ -73431,10 +73614,11 @@ function eastAsianWidth(codePoint, { ambiguousAsWide = false } = {}) {
   return 1;
 }
 
-// ../../node_modules/.bun/string-width@8.2.1/node_modules/string-width/index.js
+// ../../node_modules/.bun/string-width@8.2.2/node_modules/string-width/index.js
 var segmenter = new Intl.Segmenter;
-var zeroWidthClusterRegex = /^(?:\p{Default_Ignorable_Code_Point}|\p{Control}|\p{Format}|\p{Mark}|\p{Surrogate})+$/v;
-var leadingNonPrintingRegex = /^[\p{Default_Ignorable_Code_Point}\p{Control}\p{Format}\p{Mark}\p{Surrogate}]+/v;
+var zeroWidthClusterRegex = /^(?:\p{Default_Ignorable_Code_Point}|\p{Control}|\p{Format}|\p{Nonspacing_Mark}|\p{Enclosing_Mark}|\p{Surrogate})+$/v;
+var leadingNonPrintingRegex = /^[\p{Default_Ignorable_Code_Point}\p{Control}\p{Format}\p{Nonspacing_Mark}\p{Enclosing_Mark}\p{Surrogate}]+/v;
+var spacingMarkRegex = /\p{Spacing_Mark}/v;
 var rgiEmojiRegex = /^\p{RGI_Emoji}$/v;
 var unqualifiedKeycapRegex = /^[\d#*]\u20E3$/;
 var extendedPictographicRegex = /\p{Extended_Pictographic}/gu;
@@ -73501,7 +73685,7 @@ function hangulClusterWidth(visibleSegment, eastAsianWidthOptions) {
   }
   return width;
 }
-function trailingHalfwidthWidth(visibleSegment, eastAsianWidthOptions) {
+function trailingWidth(visibleSegment, eastAsianWidthOptions) {
   let extra = 0;
   let first = true;
   for (const character of visibleSegment) {
@@ -73509,7 +73693,7 @@ function trailingHalfwidthWidth(visibleSegment, eastAsianWidthOptions) {
       first = false;
       continue;
     }
-    if (character >= "＀" && character <= "￯") {
+    if (spacingMarkRegex.test(character) || character >= "＀" && character <= "￯") {
       extra += eastAsianWidth(character.codePointAt(0), eastAsianWidthOptions);
     }
   }
@@ -73551,7 +73735,7 @@ function stringWidth(input, options = {}) {
     }
     const codePoint = visibleSegment.codePointAt(0);
     width += eastAsianWidth(codePoint, eastAsianWidthOptions);
-    width += trailingHalfwidthWidth(visibleSegment, eastAsianWidthOptions);
+    width += trailingWidth(visibleSegment, eastAsianWidthOptions);
   }
   return width;
 }
@@ -73628,7 +73812,7 @@ class StdinDiscarder {
 var stdinDiscarder = new StdinDiscarder;
 var stdin_discarder_default = Object.freeze(stdinDiscarder);
 
-// ../../node_modules/.bun/ora@9.4.0/node_modules/ora/index.js
+// ../../node_modules/.bun/ora@9.4.1/node_modules/ora/index.js
 var RENDER_DEFERRAL_TIMEOUT = 200;
 var SYNCHRONIZED_OUTPUT_ENABLE = "\x1B[?2026h";
 var SYNCHRONIZED_OUTPUT_DISABLE = "\x1B[?2026l";
@@ -74003,7 +74187,7 @@ class Ora {
     return this;
   }
   start(text) {
-    if (text) {
+    if (text !== undefined) {
       this.text = text;
     }
     if (this.isSilent) {
@@ -74097,7 +74281,7 @@ import { homedir as homedir5 } from "node:os";
 import { join as join8 } from "node:path";
 
 // ../../_shared/ef-meta/index.ts
-var EF_VERSION = "0.11.1";
+var EF_VERSION = "1.0.0-beta.2";
 
 // src/cli/util/checks.ts
 init_config();
@@ -74148,7 +74332,7 @@ async function checkServerCompatibility(opts) {
   };
   if (!opts.bearer) {
     result.efProbeSkipped = true;
-    result.efSkipReason = "No anon JWT (CEREFOX_SUPABASE_ANON_KEY) configured; Edge Function version check skipped.";
+    result.efSkipReason = "No CEREFOX_ACCESS_TOKEN configured; Edge Function version check skipped.";
     return result;
   }
   let agg = null;
@@ -74446,6 +74630,54 @@ async function checkSchemaVersion() {
     };
   }
 }
+var CONTENT_FORMAT_CHECK_NAME = "content format";
+async function checkContentFormat() {
+  const settings = loadSettings();
+  if (!settings.supabaseUrl || !settings.supabaseKey) {
+    return { name: CONTENT_FORMAT_CHECK_NAME, status: "skipped", detail: "Supabase config missing; skipped." };
+  }
+  try {
+    const url = `${settings.supabaseUrl.replace(/\/$/, "")}/rest/v1/rpc/cerefox_content_format_stats`;
+    const resp = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        apikey: settings.supabaseKey,
+        Authorization: `Bearer ${settings.supabaseKey}`
+      },
+      body: "{}"
+    });
+    if (!resp.ok) {
+      return {
+        name: CONTENT_FORMAT_CHECK_NAME,
+        status: "skipped",
+        detail: `format stats unavailable (${resp.status}); deploy schema 0.8.0 to enable.`
+      };
+    }
+    const rows = await resp.json();
+    const legacy = rows[0]?.legacy_docs ?? 0;
+    const total = rows[0]?.total_docs ?? 0;
+    if (legacy === 0) {
+      return {
+        name: CONTENT_FORMAT_CHECK_NAME,
+        status: "ok",
+        detail: total === 0 ? "no documents yet" : `all ${total} document(s) use the current format`
+      };
+    }
+    return {
+      name: CONTENT_FORMAT_CHECK_NAME,
+      status: "skipped",
+      detail: `${legacy} of ${total} document(s) use the legacy reconstruction format (format 1).`,
+      hint: "They auto-convert on next edit; run `cerefox server reindex` to convert all now. What this means: `cerefox guides show content-format`."
+    };
+  } catch (err) {
+    return {
+      name: CONTENT_FORMAT_CHECK_NAME,
+      status: "skipped",
+      detail: `content-format check skipped: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+}
 function hasCerefoxInJsonFile(path) {
   if (!existsSync9(path))
     return false;
@@ -74555,19 +74787,19 @@ async function checkEdgeFunctionsCompat() {
       detail: "Supabase URL not set; EF version check skipped."
     };
   }
-  if (!settings.supabaseAnonKey) {
+  if (!settings.accessToken) {
     return {
       name: "edge functions",
       status: "skipped",
-      detail: "No CEREFOX_SUPABASE_ANON_KEY set; EF version check skipped.",
-      hint: "Set the legacy anon JWT (eyJ…) to enable client↔server version checks."
+      detail: "No CEREFOX_ACCESS_TOKEN set; EF version check skipped.",
+      hint: "Run `cerefox token generate` to enable client↔server version checks."
     };
   }
   let compat;
   try {
     compat = await checkServerCompatibility({
       aggregatorUrl: aggregatorUrlFor(settings.supabaseUrl),
-      bearer: settings.supabaseAnonKey,
+      bearer: settings.accessToken,
       bundledEf: EF_VERSION
     });
   } catch (err) {
@@ -74634,6 +74866,7 @@ async function runAllChecks(opts = {}) {
     { name: "supabase", phase: "Probing Supabase Data API", run: () => checkSupabase() },
     { name: "openai", phase: "Probing OpenAI embeddings", run: () => checkOpenAI() },
     { name: "schema + RPCs", phase: "Reading schema + RPC version", run: () => checkSchemaVersion() },
+    { name: "content format", phase: "Checking chunk reconstruction format", run: () => checkContentFormat() },
     { name: "edge functions", phase: "Probing Edge Function versions", run: () => checkEdgeFunctionsCompat() },
     { name: "postgres", phase: "Probing Postgres DDL endpoint", run: () => checkPostgres() },
     { name: "mcp clients", phase: "Scanning MCP client configs", run: () => checkMcpConfigs() }
@@ -74816,205 +75049,6 @@ import { basename as basename2, extname as extname3 } from "node:path";
 // src/ingestion/pipeline.ts
 import { readFileSync as readFileSync8 } from "node:fs";
 import { basename, extname as extname2, resolve as resolve3 } from "node:path";
-
-// ../../_shared/ingest/chunker.ts
-function cpLen(s) {
-  let n = 0;
-  for (const _ of s)
-    n++;
-  return n;
-}
-function cpSlice(s, start, end) {
-  const arr = [...s];
-  return arr.slice(start, end).join("");
-}
-function rstripHash(s) {
-  let i = s.length;
-  while (i > 0 && s[i - 1] === "#")
-    i--;
-  return s.slice(0, i);
-}
-var HEADING_RE = /^(#{1,3})\s+(.+)$/gm;
-var PARAGRAPH_SEP = /\n{2,}/;
-function parseSections(text) {
-  const segments = [];
-  HEADING_RE.lastIndex = 0;
-  const parts = text.split(HEADING_RE);
-  const preamble = parts[0]?.trim() ?? "";
-  if (preamble) {
-    segments.push([0, "", preamble]);
-  }
-  for (let i = 1;i + 2 < parts.length + 1; i += 3) {
-    if (i + 2 > parts.length)
-      break;
-    const hashes = parts[i] ?? "";
-    const headingText = rstripHash(parts[i + 1] ?? "").trim();
-    const body = (parts[i + 2] ?? "").trim();
-    segments.push([hashes.length, headingText, body]);
-  }
-  return segments;
-}
-function appendChunk(chunks, content, path, level, heading, opts = {}) {
-  const forceNew = opts.forceNew ?? true;
-  const minChunkChars = opts.minChunkChars ?? 0;
-  if (!forceNew && cpLen(content) < minChunkChars && chunks.length > 0) {
-    const prev = chunks[chunks.length - 1];
-    prev.content = `${prev.content}
-
-${content}`;
-    prev.char_count = cpLen(prev.content);
-    return;
-  }
-  const title = level > 0 ? heading : path[path.length - 1] ?? "";
-  chunks.push({
-    chunk_index: chunks.length,
-    heading_path: [...path],
-    heading_level: level,
-    title,
-    content,
-    char_count: cpLen(content)
-  });
-}
-function splitParagraphs(text, maxChars) {
-  const paragraphs = text.split(PARAGRAPH_SEP).filter((p) => p.trim() !== "");
-  if (paragraphs.length === 0)
-    return [];
-  const result = [];
-  let currentParts = [];
-  let currentLen = 0;
-  for (const para of paragraphs) {
-    const paraLen = cpLen(para);
-    const addition = paraLen + (currentParts.length > 0 ? 2 : 0);
-    if (currentLen + addition <= maxChars) {
-      currentParts.push(para);
-      currentLen += addition;
-    } else if (currentParts.length > 0) {
-      result.push(currentParts.join(`
-
-`));
-      currentParts = [para];
-      currentLen = paraLen;
-    } else {
-      const step = Math.floor(maxChars / 2);
-      for (let start = 0;start < paraLen; start += step) {
-        result.push(cpSlice(para, start, start + maxChars));
-      }
-      currentParts = [];
-      currentLen = 0;
-    }
-  }
-  if (currentParts.length > 0) {
-    result.push(currentParts.join(`
-
-`));
-  }
-  return result;
-}
-function chunkMarkdown(text, maxChunkChars = 4000, minChunkChars = 100) {
-  const stripped = text.trim();
-  if (!stripped)
-    return [];
-  if (cpLen(stripped) <= maxChunkChars) {
-    return [
-      {
-        chunk_index: 0,
-        heading_path: [],
-        heading_level: 0,
-        title: "",
-        content: stripped,
-        char_count: cpLen(stripped)
-      }
-    ];
-  }
-  const sections = parseSections(stripped);
-  const chunks = [];
-  let headingStack = [];
-  let bufParts = [];
-  let bufPath = [];
-  let bufLevel = 0;
-  let bufHeading = "";
-  let bufChars = 0;
-  const flushBuf = () => {
-    if (bufParts.length === 0)
-      return;
-    const content = bufParts.join(`
-
-`);
-    appendChunk(chunks, content, bufPath, bufLevel, bufHeading, {
-      forceNew: true
-    });
-    bufParts = [];
-    bufPath = [];
-    bufLevel = 0;
-    bufHeading = "";
-    bufChars = 0;
-  };
-  for (const [level, heading, body] of sections) {
-    let path;
-    if (level > 0) {
-      headingStack = headingStack.slice(0, level - 1);
-      headingStack.push(heading);
-      path = [...headingStack];
-    } else {
-      path = [];
-    }
-    let content;
-    if (level > 0) {
-      const headerLine = "#".repeat(level) + " " + heading;
-      content = body ? `${headerLine}
-
-${body}` : headerLine;
-    } else {
-      content = body;
-    }
-    if (content.trim() === "")
-      continue;
-    const contentLen = cpLen(content);
-    if (contentLen > maxChunkChars) {
-      flushBuf();
-      const headerPrefix = level > 0 ? `${"#".repeat(level)} ${heading}
-
-` : "";
-      const pieces = splitParagraphs(body, maxChunkChars);
-      for (let i = 0;i < pieces.length; i++) {
-        const rawPiece = pieces[i];
-        const piece = (i === 0 ? headerPrefix + rawPiece : rawPiece).trim();
-        if (!piece)
-          continue;
-        appendChunk(chunks, piece, path, level, heading, {
-          forceNew: i === 0,
-          minChunkChars
-        });
-      }
-      if (pieces.length === 0) {
-        appendChunk(chunks, content, path, level, heading, { forceNew: true });
-      }
-      continue;
-    }
-    const addition = contentLen + (bufParts.length > 0 ? 2 : 0);
-    if (bufChars + addition <= maxChunkChars) {
-      if (bufParts.length === 0) {
-        bufPath = path;
-        bufLevel = level;
-        bufHeading = heading;
-      }
-      bufParts.push(content);
-      bufChars += addition;
-    } else {
-      flushBuf();
-      bufParts = [content];
-      bufPath = path;
-      bufLevel = level;
-      bufHeading = heading;
-      bufChars = contentLen;
-    }
-  }
-  flushBuf();
-  for (let i = 0;i < chunks.length; i++) {
-    chunks[i].chunk_index = i;
-  }
-  return chunks;
-}
 // ../../_shared/ingest/pipeline-helpers.ts
 import { createHash } from "node:crypto";
 function normalizeForHash(text) {
@@ -75151,6 +75185,8 @@ class IngestionDbBridge {
       params.p_retention_hours = args.retentionHours;
     if (args.cleanupEnabled !== undefined)
       params.p_cleanup_enabled = args.cleanupEnabled;
+    if (args.contentFormat !== undefined)
+      params.p_content_format = args.contentFormat;
     if (args.documentId !== null) {
       params.p_expected_content_hash = args.expectedContentHash ?? null;
       params.p_last_write_wins = args.lastWriteWins ?? false;
@@ -75393,8 +75429,7 @@ class IngestionPipeline {
     const sourcePath = sourcePathOpt ?? deriveSourcePath(title);
     let chunkRows = [];
     if (chunks.length > 0) {
-      const texts = chunks.map((c2) => `# ${title}
-${c2.content}`);
+      const texts = chunks.map((c2) => embeddingInputFor(title, c2));
       const embeddings = await embedBatch(texts, this.apiKey);
       chunkRows = chunks.map((c2, i) => ({
         chunk_index: c2.chunk_index,
@@ -75417,6 +75452,7 @@ ${c2.content}`);
       metadata: validatedMeta,
       reviewStatus,
       chunks: chunkRows,
+      contentFormat: CONTENT_FORMAT_BLIND_STITCH,
       author,
       authorType
     });
@@ -75481,8 +75517,7 @@ ${c2.content}`);
       }
       await this.db.updateDocumentRow(documentId, updates);
       if (titleChanged) {
-        const texts = actualChunks.map((c2) => `# ${title}
-${c2.content}`);
+        const texts = actualChunks.map((c2) => embeddingInputFor(title, c2));
         try {
           const embeddings = await embedBatch(texts, this.apiKey);
           for (let i = 0;i < actualChunks.length; i++) {
@@ -75530,8 +75565,7 @@ ${c2.content}`);
     const totalChars = chunks.reduce((acc, c2) => acc + c2.char_count, 0);
     let chunkRows = [];
     if (chunks.length > 0) {
-      const texts = chunks.map((c2) => `# ${title}
-${c2.content}`);
+      const texts = chunks.map((c2) => embeddingInputFor(title, c2));
       const embeddings = await embedBatch(texts, this.apiKey);
       chunkRows = chunks.map((c2, i) => ({
         chunk_index: c2.chunk_index,
@@ -75555,6 +75589,7 @@ ${c2.content}`);
       metadata: metaToWrite,
       reviewStatus,
       chunks: chunkRows,
+      contentFormat: CONTENT_FORMAT_BLIND_STITCH,
       author,
       authorType,
       sourceLabel: source,
@@ -75975,6 +76010,7 @@ function buildEnvFile(answers) {
   if (answers.CEREFOX_AUTHOR_TYPE) {
     lines.push(`CEREFOX_AUTHOR_TYPE=${answers.CEREFOX_AUTHOR_TYPE}`);
   }
+  lines.push("", "# ── Optional: connect cloud/mobile Claude over OAuth (setup-supabase.md Step 7) ──", "# These are only needed for the optional claude.ai / Claude-mobile OAuth feature.", "# The Cerefox access token gates the Edge Functions (GPT Actions, remote MCP,", "# and doctor's version check). It is written here automatically by", "# `cerefox token generate` — you don't set it by hand:", "# CEREFOX_ACCESS_TOKEN=cfx_pat_...", "# The PUBLISHABLE key is public-safe (no KB access) — used by the consent-page", "# Cloudflare Worker deploy (cloudflare/cerefox-consent/deploy.sh reads this):", "# CEREFOX_SUPABASE_PUBLISHABLE_KEY=sb_publishable_...");
   return lines.join(`
 `) + `
 `;
@@ -77003,21 +77039,205 @@ function registerStatus(program2) {
   program2.command("status").description("Quick sanity check (fast subset of `cerefox doctor`).").option("--json", "Emit machine-readable JSON.").action(action31);
 }
 
+// src/cli/commands/token.ts
+init_cli_core();
+init_config();
+import { randomBytes } from "node:crypto";
+import { spawnSync as spawnSync7 } from "node:child_process";
+
+// src/cli/util/env-file.ts
+import { copyFileSync as copyFileSync3, existsSync as existsSync12, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname5 } from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function upsertEnvVar(path, key, value, opts = {}) {
+  const line = `${key}=${value}`;
+  const header = opts.comment ? `# ${opts.comment}
+` : "";
+  if (!existsSync12(path)) {
+    writeFileSync5(path, `${header}${line}
+`, { mode: 384 });
+    return { path, action: "created" };
+  }
+  const original = readFileSync13(path, "utf8");
+  let backupPath;
+  if (!opts.noBackup) {
+    backupPath = `${path}.pre-cerefox.bak`;
+    copyFileSync3(path, backupPath);
+  }
+  const re = new RegExp(`^(\\s*)${escapeRegExp(key)}=.*$`, "m");
+  let next;
+  let action32;
+  if (re.test(original)) {
+    next = original.replace(re, `$1${line}`);
+    action32 = "updated";
+  } else {
+    const base = original.endsWith(`
+`) ? original : `${original}
+`;
+    next = `${base}
+${header}${line}
+`;
+    action32 = "added";
+  }
+  writeFileSync5(path, next);
+  return { path, action: action32, backupPath };
+}
+function readEnvVar(path, key) {
+  if (!existsSync12(path))
+    return null;
+  const m = readFileSync13(path, "utf8").match(new RegExp(`^\\s*${escapeRegExp(key)}=(.*)$`, "m"));
+  return m ? m[1].trim() : null;
+}
+function envGitignoreWarning(path) {
+  try {
+    const dir = dirname5(path);
+    const inTree = spawnSync6("git", ["-C", dir, "rev-parse", "--is-inside-work-tree"], {
+      encoding: "utf8"
+    });
+    if (inTree.status !== 0 || inTree.stdout.trim() !== "true")
+      return null;
+    const ignored = spawnSync6("git", ["-C", dir, "check-ignore", "-q", path]);
+    if (ignored.status === 0)
+      return null;
+    return `${path} is inside a git repo and is NOT gitignored — add it to .gitignore ` + `before committing (it now holds a secret access token).`;
+  } catch {
+    return null;
+  }
+}
+
+// src/cli/commands/token.ts
+var SECRET_NAME = "CEREFOX_ACCESS_TOKENS";
+var LOCAL_NAME = "CEREFOX_ACCESS_TOKEN";
+var PREFIX = "cfx_pat_";
+function mintToken() {
+  return PREFIX + randomBytes(32).toString("base64url");
+}
+function mask(token) {
+  return token.length <= 16 ? "…" : `${token.slice(0, PREFIX.length + 4)}…${token.slice(-4)}`;
+}
+function parseProjectRef2(supabaseUrl) {
+  if (!supabaseUrl)
+    return null;
+  try {
+    const label = new URL(supabaseUrl).hostname.split(".")[0];
+    return /^[a-z0-9]{20}$/.test(label) ? label : null;
+  } catch {
+    return null;
+  }
+}
+function setSecret(setValue, projectRef, dryRun) {
+  const args = ["--yes", "supabase", "secrets", "set", `${SECRET_NAME}=${setValue}`];
+  if (projectRef)
+    args.push("--project-ref", projectRef);
+  if (dryRun) {
+    const shown = setValue.split(",").map(mask).join(",");
+    println(c.dim(`   (dry-run) npx supabase secrets set ${SECRET_NAME}=${shown}` + (projectRef ? ` --project-ref ${projectRef}` : "")));
+    return;
+  }
+  const r = spawnSync7("npx", args, { encoding: "utf8", stdio: "inherit" });
+  if (r.status !== 0) {
+    throw userError(`Failed to set the ${SECRET_NAME} Function secret.`, "Install the Supabase CLI and link the project (or pass --project-ref <ref>).");
+  }
+  println(c.green(`   ✓ Set ${SECRET_NAME} on Supabase.`));
+}
+function writeLocalEnv(token, opts) {
+  if (!opts.env)
+    return;
+  if (opts.dryRun) {
+    println(c.dim(`   (dry-run) would upsert ${LOCAL_NAME} in ${resolveEnvFile()}`));
+    return;
+  }
+  const envPath = resolveEnvFile();
+  const r = upsertEnvVar(envPath, LOCAL_NAME, token, {
+    noBackup: !opts.backup,
+    comment: "── Cerefox access token — Edge Function credential (managed by `cerefox token`) ──"
+  });
+  println(c.green(`   ✓ ${r.action === "created" ? "Wrote" : "Updated"} ${LOCAL_NAME} in ${r.path}`));
+  if (r.backupPath)
+    println(c.dim(`     backup: ${r.backupPath}`));
+  const warn2 = envGitignoreWarning(envPath);
+  if (warn2)
+    eprintln(c.yellow(`   ⚠  ${warn2}`));
+}
+function printTokenOnce(token) {
+  println("");
+  println(c.bold("   Your Cerefox access token (shown once — store it securely):"));
+  println(`   ${c.green(token)}`);
+  println("");
+  println(c.dim("   Paste it into any token-bearing client:"));
+  println(c.dim("     • Custom GPT → Configure → Actions → Authentication → API Key (Bearer)"));
+  println(c.dim("     • Remote HTTP MCP → the Authorization: Bearer header"));
+  println(c.dim("   If the GPT Actions schema changed this release, re-paste it too"));
+  println(c.dim("   (see docs/guides/connect-agents.md). Lose the token → `cerefox token rotate`."));
+}
+function generateAction(opts) {
+  const projectRef = opts.projectRef ?? parseProjectRef2(loadSettings().supabaseUrl);
+  const token = mintToken();
+  println(c.bold("Generating a Cerefox access token…"));
+  setSecret(token, projectRef, opts.dryRun);
+  writeLocalEnv(token, opts);
+  if (!opts.dryRun)
+    printTokenOnce(token);
+}
+function rotateAction(opts) {
+  const projectRef = opts.projectRef ?? parseProjectRef2(loadSettings().supabaseUrl);
+  const envPath = resolveEnvFile();
+  const current = readEnvVar(envPath, LOCAL_NAME);
+  if (opts.finalize) {
+    if (!current) {
+      throw userError(`No ${LOCAL_NAME} in ${envPath} to finalize to.`, "Run `cerefox token generate` or `cerefox token rotate` first.");
+    }
+    println(c.bold("Finalizing rotation (dropping the previous token)…"));
+    setSecret(current, projectRef, opts.dryRun);
+    if (!opts.dryRun)
+      println(c.green("   ✓ Only the current token is accepted now."));
+    return;
+  }
+  const token = mintToken();
+  const setValue = current ? `${token},${current}` : token;
+  println(c.bold("Rotating the Cerefox access token…"));
+  setSecret(setValue, projectRef, opts.dryRun);
+  writeLocalEnv(token, opts);
+  if (!opts.dryRun) {
+    printTokenOnce(token);
+    println("");
+    println(c.yellow(`   Both the new and previous tokens are accepted right now. Update every
+` + "   client to the new token, then run `cerefox token rotate --finalize`\n" + "   to stop accepting the old one."));
+  }
+}
+function listAction2() {
+  const envPath = resolveEnvFile();
+  const local = readEnvVar(envPath, LOCAL_NAME);
+  println(c.bold("Cerefox access token"));
+  println(local ? `   local (${LOCAL_NAME} in ${envPath}): ${c.green(mask(local))}` : c.dim(`   no ${LOCAL_NAME} in ${envPath} — run \`cerefox token generate\``));
+  println(c.dim(`   The server-side accepted set (${SECRET_NAME}) is write-only; list names/digests
+` + "   with: npx supabase secrets list"));
+}
+function registerToken(program2) {
+  const token = program2.command("token").description("Manage the Cerefox Edge Function access token(s).");
+  token.command("generate").description("Mint a token, set the Supabase secret, and write it to .env.").option("--project-ref <ref>", "Supabase project ref (default: derived from CEREFOX_SUPABASE_URL).").option("--no-env", "Do not write CEREFOX_ACCESS_TOKEN to .env.").option("--no-backup", "Skip the .pre-cerefox.bak backup of an existing .env.").option("--dry-run", "Print the plan without minting or writing anything.").action(generateAction);
+  token.command("rotate").description("Mint a new token accepted alongside the old (zero-downtime); --finalize drops the old.").option("--finalize", "Stop accepting the previous token (run after clients migrate).").option("--project-ref <ref>", "Supabase project ref (default: derived from CEREFOX_SUPABASE_URL).").option("--no-env", "Do not write CEREFOX_ACCESS_TOKEN to .env.").option("--no-backup", "Skip the .pre-cerefox.bak backup of an existing .env.").option("--dry-run", "Print the plan without minting or writing anything.").action(rotateAction);
+  token.command("list").description("Show the local token (masked) and where the server-side set lives.").action(listAction2);
+}
+
 // src/cli/program.ts
 init_sync_self_docs();
 
 // src/cli/commands/web.ts
 init_cli_core();
 
-// ../../node_modules/.bun/@hono+node-server@2.0.4+8bc17dcb8a4189a6/node_modules/@hono/node-server/dist/constants-BLSFu_RU.mjs
+// ../../node_modules/.bun/@hono+node-server@2.0.8+68404363cdc13251/node_modules/@hono/node-server/dist/constants-BLSFu_RU.mjs
 var X_ALREADY_SENT = "x-hono-already-sent";
 
-// ../../node_modules/.bun/@hono+node-server@2.0.4+8bc17dcb8a4189a6/node_modules/@hono/node-server/dist/index.mjs
+// ../../node_modules/.bun/@hono+node-server@2.0.8+68404363cdc13251/node_modules/@hono/node-server/dist/index.mjs
 import { STATUS_CODES, createServer } from "node:http";
 import { Http2ServerRequest, constants } from "node:http2";
 import { Readable } from "node:stream";
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/helper/websocket/index.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/helper/websocket/index.js
 var WSContext = class {
   #init;
   constructor(init) {
@@ -77065,7 +77285,7 @@ var defineWebSocketHelper = (handler11) => {
   };
 };
 
-// ../../node_modules/.bun/@hono+node-server@2.0.4+8bc17dcb8a4189a6/node_modules/@hono/node-server/dist/index.mjs
+// ../../node_modules/.bun/@hono+node-server@2.0.8+68404363cdc13251/node_modules/@hono/node-server/dist/index.mjs
 var RequestError = class extends Error {
   constructor(message, options) {
     super(message, options);
@@ -77506,7 +77726,8 @@ var Response$1 = class Response$12 {
     const liveHeaders = cache && cache[2] instanceof Headers ? cache[2] : undefined;
     delete this[cacheKey];
     return this[responseCache] ||= new GlobalResponse(this.#body, liveHeaders ? {
-      ...this.#init,
+      status: this.#init?.status,
+      statusText: this.#init?.statusText,
       headers: liveHeaders
     } : this.#init);
   }
@@ -78199,7 +78420,7 @@ var serve = (options, listeningListener) => {
   return server;
 };
 
-// ../../node_modules/.bun/@hono+node-server@2.0.4+8bc17dcb8a4189a6/node_modules/@hono/node-server/dist/utils/stream.mjs
+// ../../node_modules/.bun/@hono+node-server@2.0.8+68404363cdc13251/node_modules/@hono/node-server/dist/utils/stream.mjs
 import { Readable as Readable2 } from "node:stream";
 import { versions as versions2 } from "node:process";
 var pr54206Applied = () => {
@@ -78265,7 +78486,7 @@ var createStreamBody = (stream, useNativeReadableToWeb = useReadableToWeb) => {
   });
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/utils/mime.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/utils/mime.js
 var getMimeType = (filename, mimes = baseMimes) => {
   const regexp = /\.([a-zA-Z0-9]+?)$/;
   const match = filename.match(regexp);
@@ -78334,8 +78555,8 @@ var _baseMimes = {
 };
 var baseMimes = _baseMimes;
 
-// ../../node_modules/.bun/@hono+node-server@2.0.4+8bc17dcb8a4189a6/node_modules/@hono/node-server/dist/serve-static.mjs
-import { createReadStream, existsSync as existsSync12, statSync as statSync5 } from "node:fs";
+// ../../node_modules/.bun/@hono+node-server@2.0.8+68404363cdc13251/node_modules/@hono/node-server/dist/serve-static.mjs
+import { createReadStream, existsSync as existsSync13, statSync as statSync5 } from "node:fs";
 import { join as join12 } from "node:path";
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 var ENCODINGS = {
@@ -78368,7 +78589,7 @@ var tryDecodeURI = (str) => tryDecode(str, decodeURI);
 var serveStatic = (options = { root: "" }) => {
   const root = options.root || "";
   const optionPath = options.path;
-  if (root !== "" && !existsSync12(root))
+  if (root !== "" && !existsSync13(root))
     console.error(`serveStatic: root path '${root}' is not found, are you sure it's correct?`);
   return async (c2, next) => {
     if (c2.finalized)
@@ -78379,7 +78600,7 @@ var serveStatic = (options = { root: "" }) => {
     else
       try {
         filename = tryDecodeURI(c2.req.path);
-        if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}/.test(filename))
+        if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename))
           throw new Error;
       } catch {
         await options.onNotFound?.(c2.req.path, c2);
@@ -78398,7 +78619,7 @@ var serveStatic = (options = { root: "" }) => {
     }
     const mimeType = getMimeType(path);
     c2.header("Content-Type", mimeType || "application/octet-stream");
-    if (options.precompressed && (!mimeType || COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {
+    if (options.precompressed && (!mimeType || mimeType === "application/octet-stream" || COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {
       const acceptEncodingSet = new Set(c2.req.header("Accept-Encoding")?.split(",").map((encoding) => encoding.trim()));
       for (const encoding of ENCODINGS_ORDERED_KEYS) {
         if (!acceptEncodingSet.has(encoding))
@@ -78446,11 +78667,11 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // src/web/server.ts
-import { existsSync as existsSync16 } from "node:fs";
-import { readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync17 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 import { join as join16 } from "node:path";
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/compose.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
   return (context, next) => {
     let index = -1;
@@ -78494,21 +78715,39 @@ var compose = (middleware, onError, onNotFound) => {
   };
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/request/constants.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/utils/body.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/utils/buffer.js
+var bufferToFormData = (arrayBuffer, contentType2) => {
+  const response = new Response(arrayBuffer, {
+    headers: {
+      "Content-Type": contentType2.replace(/^[^;]+/, (mediaType) => mediaType.toLowerCase())
+    }
+  });
+  return response.formData();
+};
+
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/utils/body.js
+var isRawRequest = (request) => ("headers" in request);
 var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
-  const headers = request instanceof HonoRequest ? request.raw.headers : request.headers;
+  const headers = isRawRequest(request) ? request.headers : request.raw.headers;
   const contentType2 = headers.get("Content-Type");
-  if (contentType2?.startsWith("multipart/form-data") || contentType2?.startsWith("application/x-www-form-urlencoded")) {
+  const mediaType = contentType2?.split(";")[0].trim().toLowerCase();
+  if (mediaType === "multipart/form-data" || mediaType === "application/x-www-form-urlencoded") {
     return parseFormData(request, { all, dot });
   }
   return {};
 };
 async function parseFormData(request, options) {
-  const formData = await request.formData();
+  const headers = isRawRequest(request) ? request.headers : request.raw.headers;
+  const arrayBuffer = await request.arrayBuffer();
+  const formDataPromise = bufferToFormData(arrayBuffer, headers.get("Content-Type") || "");
+  if (!isRawRequest(request)) {
+    request.bodyCache.formData = formDataPromise;
+  }
+  const formData = await formDataPromise;
   if (formData) {
     return convertFormDataToBodyData(formData, options);
   }
@@ -78568,7 +78807,7 @@ var handleParsingNestedValues = (form, key, value) => {
   });
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/utils/url.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/utils/url.js
 var splitPath = (path) => {
   const paths = path.split("/");
   if (paths[0] === "") {
@@ -78768,7 +79007,7 @@ var getQueryParams = (url, key) => {
 };
 var decodeURIComponent_ = decodeURIComponent;
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/request.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/request.js
 var tryDecodeURIComponent = (str) => tryDecode2(str, decodeURIComponent_);
 var HonoRequest = class {
   raw;
@@ -78882,7 +79121,7 @@ var HonoRequest = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/utils/html.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/utils/html.js
 var HtmlEscapedCallbackPhase = {
   Stringify: 1,
   BeforeStream: 2,
@@ -78920,7 +79159,7 @@ var resolveCallback = async (str, phase, preserveCallbacks, context, buffer2) =>
   }
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/context.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/context.js
 var TEXT_PLAIN = "text/plain; charset=UTF-8";
 var setDefaultContentType = (contentType2, headers) => {
   return {
@@ -79087,7 +79326,7 @@ var Context = class {
   };
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/router.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/router.js
 var METHOD_NAME_ALL = "ALL";
 var METHOD_NAME_ALL_LOWERCASE = "all";
 var METHODS = ["get", "post", "put", "delete", "options", "patch"];
@@ -79095,10 +79334,10 @@ var MESSAGE_MATCHER_IS_ALREADY_BUILT = "Can not add a route since the matcher is
 var UnsupportedPathError = class extends Error {
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/utils/constants.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/utils/constants.js
 var COMPOSED_HANDLER = "__COMPOSED_HANDLER";
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/hono-base.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/hono-base.js
 var notFoundHandler = (c2) => {
   return c2.text("404 Not Found", 404);
 };
@@ -79322,7 +79561,7 @@ var Hono = class _Hono {
   };
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/router/reg-exp-router/matcher.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
 function match(method, path) {
   const matchers = this.buildAllMatchers();
@@ -79343,7 +79582,7 @@ function match(method, path) {
   return match2(method, path);
 }
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/router/reg-exp-router/node.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/router/reg-exp-router/node.js
 var LABEL_REG_EXP_STR = "[^/]+";
 var ONLY_WILDCARD_REG_EXP_STR = ".*";
 var TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
@@ -79447,7 +79686,7 @@ var Node = class _Node {
   }
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/router/reg-exp-router/trie.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/router/reg-exp-router/trie.js
 var Trie = class {
   #context = { varIndex: 0 };
   #root = new Node;
@@ -79503,7 +79742,7 @@ var Trie = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/router/reg-exp-router/router.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/router/reg-exp-router/router.js
 var nullMatcher = [/^$/, [], /* @__PURE__ */ Object.create(null)];
 var wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
 function buildWildcardRegExp(path) {
@@ -79668,7 +79907,7 @@ var RegExpRouter = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/router/reg-exp-router/prepared-router.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/router/reg-exp-router/prepared-router.js
 var PreparedRegExpRouter = class {
   name = "PreparedRegExpRouter";
   #matchers;
@@ -79740,7 +79979,7 @@ var PreparedRegExpRouter = class {
   match = match;
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/router/smart-router/router.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/router/smart-router/router.js
 var SmartRouter = class {
   name = "SmartRouter";
   #routers = [];
@@ -79795,7 +80034,7 @@ var SmartRouter = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/router/trie-router/node.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/router/trie-router/node.js
 var emptyParams = /* @__PURE__ */ Object.create(null);
 var hasChildren = (children) => {
   for (const _ in children) {
@@ -79929,6 +80168,9 @@ var Node2 = class _Node2 {
             if (m) {
               params[name] = m[0];
               this.#pushHandlerSets(handlerSets, child, method, node.#params, params);
+              if (m[0].length === restPathString.length && child.#children["*"]) {
+                this.#pushHandlerSets(handlerSets, child.#children["*"], method, node.#params, params);
+              }
               if (hasChildren(child.#children)) {
                 child.#params = params;
                 const componentCount = m[0].match(/\//)?.length ?? 0;
@@ -79964,7 +80206,7 @@ var Node2 = class _Node2 {
   }
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/router/trie-router/router.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/router/trie-router/router.js
 var TrieRouter = class {
   name = "TrieRouter";
   #node;
@@ -79986,7 +80228,7 @@ var TrieRouter = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/hono.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/hono.js
 var Hono2 = class extends Hono {
   constructor(options = {}) {
     super(options);
@@ -79996,7 +80238,7 @@ var Hono2 = class extends Hono {
   }
 };
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/utils/color.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/utils/color.js
 function getColorEnabled() {
   const { process: process10, Deno: Deno2 } = globalThis;
   const isNoColor = typeof Deno2?.noColor === "boolean" ? Deno2.noColor : process10 !== undefined ? "NO_COLOR" in process10?.env : false;
@@ -80015,7 +80257,7 @@ async function getColorEnabledAsync() {
   return !isNoColor;
 }
 
-// ../../node_modules/.bun/hono@4.12.25/node_modules/hono/dist/middleware/logger/index.js
+// ../../node_modules/.bun/hono@4.12.29/node_modules/hono/dist/middleware/logger/index.js
 var humanize = (times) => {
   const [delimiter, separator] = [",", "."];
   const orderTimes = times.map((v) => v.replace(/(\d)(?=(\d\d\d)+(?!\d))/g, "$1" + delimiter));
@@ -81376,12 +81618,12 @@ import { execFileSync } from "node:child_process";
 
 // src/web/docs.ts
 import {
-  existsSync as existsSync13,
-  readFileSync as readFileSync13,
+  existsSync as existsSync14,
+  readFileSync as readFileSync14,
   readdirSync as readdirSync6,
   statSync as statSync6
 } from "node:fs";
-import { basename as basename5, dirname as dirname5, join as join13, resolve as resolve5 } from "node:path";
+import { basename as basename5, dirname as dirname6, join as join13, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var TOP_LEVEL_DOCS = [
   { filename: "README.md", path: "README.md", category: "readme" },
@@ -81397,7 +81639,7 @@ var TOP_LEVEL_DOCS = [
   }
 ];
 function moduleDir2() {
-  return dirname5(fileURLToPath3(import.meta.url));
+  return dirname6(fileURLToPath3(import.meta.url));
 }
 function resolveDocsRoots() {
   const here = moduleDir2();
@@ -81409,7 +81651,7 @@ function resolveDocsRoots() {
   let pkgTopLevel = null;
   for (const pkg of pkgRootCandidates) {
     const guides = join13(pkg, "docs", "guides");
-    if (existsSync13(guides) && statSync6(guides).isDirectory()) {
+    if (existsSync14(guides) && statSync6(guides).isDirectory()) {
       pkgGuides = guides;
       pkgTopLevel = pkg;
       break;
@@ -81421,13 +81663,13 @@ function resolveDocsRoots() {
   return {
     pkgGuides,
     pkgTopLevel,
-    repoGuides: existsSync13(repoGuides) ? repoGuides : null,
-    repoTopLevel: existsSync13(join13(repoTopLevel, "README.md")) ? repoTopLevel : null
+    repoGuides: existsSync14(repoGuides) ? repoGuides : null,
+    repoTopLevel: existsSync14(join13(repoTopLevel, "README.md")) ? repoTopLevel : null
   };
 }
 function readH1(filePath) {
   try {
-    const content = readFileSync13(filePath, "utf8");
+    const content = readFileSync14(filePath, "utf8");
     const match2 = content.match(/^#\s+(.+?)\s*$/m);
     return match2 ? match2[1] : null;
   } catch {
@@ -81448,7 +81690,7 @@ function listBundledDocs2() {
   if (topRoot) {
     for (const t of TOP_LEVEL_DOCS) {
       const abs = join13(topRoot, t.filename);
-      if (existsSync13(abs)) {
+      if (existsSync14(abs)) {
         entries.push(entryForFile(abs, t.path, t.category));
       }
     }
@@ -81475,9 +81717,9 @@ function readDoc(docPath) {
   if (!candidate.startsWith(rootResolved + "/") && candidate !== rootResolved) {
     return null;
   }
-  if (existsSync13(candidate) && statSync6(candidate).isFile()) {
+  if (existsSync14(candidate) && statSync6(candidate).isFile()) {
     try {
-      return readFileSync13(candidate, "utf8");
+      return readFileSync14(candidate, "utf8");
     } catch {
       return null;
     }
@@ -81522,17 +81764,17 @@ function registerMetaRoutes(app, ctx) {
   app.get("/api/v1/schema-version", async (c2) => {
     let bundled = null;
     try {
-      const { readFileSync: readFileSync14, existsSync: existsSync14 } = await import("node:fs");
+      const { readFileSync: readFileSync15, existsSync: existsSync15 } = await import("node:fs");
       const { fileURLToPath: fileURLToPath4 } = await import("node:url");
-      const { dirname: dirname6, join: join14 } = await import("node:path");
-      const here = dirname6(fileURLToPath4(import.meta.url));
+      const { dirname: dirname7, join: join14 } = await import("node:path");
+      const here = dirname7(fileURLToPath4(import.meta.url));
       const candidates = [
         join14(here, "..", "..", "..", "db", "schema.sql"),
         join14(here, "..", "..", "..", "..", "..", "src", "cerefox", "db", "schema.sql")
       ];
       for (const path of candidates) {
-        if (existsSync14(path)) {
-          const sql = readFileSync14(path, "utf8");
+        if (existsSync15(path)) {
+          const sql = readFileSync15(path, "utf8");
           const match2 = sql.match(SCHEMA_VERSION_RE2);
           bundled = match2 ? match2[1] : null;
           break;
@@ -81628,7 +81870,7 @@ function registerPostgrestProxy(app) {
 
 // src/web/routes/preferences.ts
 init_config();
-import { existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync4, readFileSync as readFileSync15, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join14 } from "node:path";
 function isTheme(v) {
   return v === "auto" || v === "light" || v === "dark";
@@ -81638,7 +81880,7 @@ function prefsFile() {
 }
 function readPrefs() {
   try {
-    const raw2 = JSON.parse(readFileSync14(prefsFile(), "utf8"));
+    const raw2 = JSON.parse(readFileSync15(prefsFile(), "utf8"));
     if (isTheme(raw2.theme))
       return { theme: raw2.theme };
   } catch {}
@@ -81654,9 +81896,9 @@ function registerPreferencesRoutes(app) {
     const next = { ...readPrefs(), theme: body.theme };
     try {
       const dir = userStateDir();
-      if (!existsSync14(dir))
+      if (!existsSync15(dir))
         mkdirSync4(dir, { recursive: true });
-      writeFileSync5(prefsFile(), `${JSON.stringify(next, null, 2)}
+      writeFileSync6(prefsFile(), `${JSON.stringify(next, null, 2)}
 `);
     } catch (err) {
       return c2.json({ detail: err instanceof Error ? err.message : String(err) }, 500);
@@ -81726,14 +81968,14 @@ function registerProjectsRoutes(app, ctx) {
 }
 
 // src/web/static.ts
-import { existsSync as existsSync15, statSync as statSync7 } from "node:fs";
-import { dirname as dirname6, join as join15 } from "node:path";
+import { existsSync as existsSync16, statSync as statSync7 } from "node:fs";
+import { dirname as dirname7, join as join15 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function moduleDir3() {
-  return dirname6(fileURLToPath4(import.meta.url));
+  return dirname7(fileURLToPath4(import.meta.url));
 }
 function isUsableSpaDir(dir) {
-  return existsSync15(dir) && statSync7(dir).isDirectory() && existsSync15(join15(dir, "index.html"));
+  return existsSync16(dir) && statSync7(dir).isDirectory() && existsSync16(join15(dir, "index.html"));
 }
 function resolveSpaDist() {
   const here = moduleDir3();
@@ -81755,7 +81997,7 @@ function resolveStaticDir() {
     join15(here, "..", "..", "..", "..", "web", "static")
   ];
   for (const c2 of candidates) {
-    if (existsSync15(c2) && statSync7(c2).isDirectory())
+    if (existsSync16(c2) && statSync7(c2).isDirectory())
       return c2;
   }
   return null;
@@ -81842,8 +82084,8 @@ function buildApp(ctx = buildWebContext()) {
       rewriteRequestPath: (path) => path.replace(/^\/app/, "") || "/"
     }));
     const indexPath = join16(spaDist, "index.html");
-    if (existsSync16(indexPath)) {
-      const indexHtml = readFileSync15(indexPath, "utf8");
+    if (existsSync17(indexPath)) {
+      const indexHtml = readFileSync16(indexPath, "utf8");
       app.get("/app/*", (c2) => c2.html(indexHtml));
     }
   }
@@ -81855,13 +82097,13 @@ class CompatibilityError extends Error {
 }
 async function assertServerCompatible() {
   const settings = loadSettings();
-  if (!settings.supabaseUrl || !settings.supabaseAnonKey)
+  if (!settings.supabaseUrl || !settings.accessToken)
     return;
   let compat2;
   try {
     compat2 = await checkServerCompatibility({
       aggregatorUrl: aggregatorUrlFor(settings.supabaseUrl),
-      bearer: settings.supabaseAnonKey,
+      bearer: settings.accessToken,
       bundledEf: EF_VERSION
     });
   } catch {
@@ -81901,12 +82143,12 @@ async function buildWebServer(options = {}) {
 // src/web/daemon.ts
 import { spawn } from "node:child_process";
 import {
-  existsSync as existsSync17,
+  existsSync as existsSync18,
   mkdirSync as mkdirSync5,
   openSync,
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync17,
   rmSync,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 import { join as join17 } from "node:path";
@@ -81915,14 +82157,14 @@ var PID_FILE = join17(STATE_DIR, "web.pid");
 var LOG_FILE = join17(STATE_DIR, "web.log");
 var daemonPaths = { stateDir: STATE_DIR, pidFile: PID_FILE, logFile: LOG_FILE };
 function ensureStateDir() {
-  if (!existsSync17(STATE_DIR))
+  if (!existsSync18(STATE_DIR))
     mkdirSync5(STATE_DIR, { recursive: true });
 }
 function readPidFile() {
-  if (!existsSync17(PID_FILE))
+  if (!existsSync18(PID_FILE))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync16(PID_FILE, "utf8"));
+    const parsed = JSON.parse(readFileSync17(PID_FILE, "utf8"));
     if (typeof parsed.pid !== "number")
       return null;
     return {
@@ -81937,7 +82179,7 @@ function readPidFile() {
 }
 function writePidFile(info3) {
   ensureStateDir();
-  writeFileSync6(PID_FILE, JSON.stringify(info3, null, 2) + `
+  writeFileSync7(PID_FILE, JSON.stringify(info3, null, 2) + `
 `, "utf8");
 }
 function removePidFile() {
@@ -82235,6 +82477,7 @@ Learn more:
   registerMcp(program2);
   registerWeb(program2);
   registerCompletion(program2);
+  registerToken(program2);
   const document2 = program2.command("document").description("Documents: get, list, edit, delete, restore, ingest, ingest-dir, version.");
   moveInto(document2, registerGetDoc, "get");
   moveInto(document2, registerListDocs, "list");
@@ -82285,7 +82528,7 @@ Learn more:
 
 // src/bin/cerefox.ts
 async function bareEntryPoint() {
-  const { existsSync: existsSync18 } = await import("node:fs");
+  const { existsSync: existsSync19 } = await import("node:fs");
   const { resolveEnvFile: resolveEnvFile2 } = await Promise.resolve().then(() => (init_config(), exports_config));
   const { c: c2, println: println2 } = await Promise.resolve().then(() => (init_cli_core(), exports_cli_core));
   const { PKG_VERSION: PKG_VERSION2 } = await Promise.resolve().then(() => (init_meta(), exports_meta));
@@ -82294,7 +82537,7 @@ async function bareEntryPoint() {
   println2("");
   let configExists = false;
   try {
-    configExists = existsSync18(resolveEnvFile2());
+    configExists = existsSync19(resolveEnvFile2());
   } catch {}
   if (!configExists) {
     println2(c2.yellow("⚠ No config detected."));