@cerefox/memory 0.9.10 → 0.10.0

package/dist/bin/cerefox.js

@@ -7184,7 +7184,7 @@ var exports_meta = {};
 __export(exports_meta, {
   PKG_VERSION: () => PKG_VERSION
 });
-var PKG_VERSION = "0.9.10";
+var PKG_VERSION = "0.10.0";
 var init_meta = () => {};
 
 // ../../node_modules/.bun/tslib@2.8.1/node_modules/tslib/tslib.js
@@ -7792,7 +7792,7 @@ var require_tslib = __commonJS((exports, module) => {
   });
 });
 
-// ../../node_modules/.bun/@supabase+functions-js@2.106.2/node_modules/@supabase/functions-js/dist/main/helper.js
+// ../../node_modules/.bun/@supabase+functions-js@2.107.0/node_modules/@supabase/functions-js/dist/main/helper.js
 var require_helper = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.resolveFetch = undefined;
@@ -7805,7 +7805,7 @@ var require_helper = __commonJS((exports) => {
   exports.resolveFetch = resolveFetch;
 });
 
-// ../../node_modules/.bun/@supabase+functions-js@2.106.2/node_modules/@supabase/functions-js/dist/main/types.js
+// ../../node_modules/.bun/@supabase+functions-js@2.107.0/node_modules/@supabase/functions-js/dist/main/types.js
 var require_types = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.FunctionRegion = exports.FunctionsHttpError = exports.FunctionsRelayError = exports.FunctionsFetchError = exports.FunctionsError = undefined;
@@ -7866,7 +7866,7 @@ var require_types = __commonJS((exports) => {
   })(FunctionRegion || (exports.FunctionRegion = FunctionRegion = {}));
 });
 
-// ../../node_modules/.bun/@supabase+functions-js@2.106.2/node_modules/@supabase/functions-js/dist/main/FunctionsClient.js
+// ../../node_modules/.bun/@supabase+functions-js@2.107.0/node_modules/@supabase/functions-js/dist/main/FunctionsClient.js
 var require_FunctionsClient = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.FunctionsClient = undefined;
@@ -7979,7 +7979,7 @@ var require_FunctionsClient = __commonJS((exports) => {
   exports.FunctionsClient = FunctionsClient;
 });
 
-// ../../node_modules/.bun/@supabase+functions-js@2.106.2/node_modules/@supabase/functions-js/dist/main/index.js
+// ../../node_modules/.bun/@supabase+functions-js@2.107.0/node_modules/@supabase/functions-js/dist/main/index.js
 var require_main = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.FunctionRegion = exports.FunctionsRelayError = exports.FunctionsHttpError = exports.FunctionsFetchError = exports.FunctionsError = exports.FunctionsClient = undefined;
@@ -8005,7 +8005,7 @@ var require_main = __commonJS((exports) => {
   } });
 });
 
-// ../../node_modules/.bun/@supabase+postgrest-js@2.106.2/node_modules/@supabase/postgrest-js/dist/index.mjs
+// ../../node_modules/.bun/@supabase+postgrest-js@2.107.0/node_modules/@supabase/postgrest-js/dist/index.mjs
 function sleep(ms, signal) {
   return new Promise((resolve) => {
     if (signal === null || signal === undefined ? undefined : signal.aborted) {
@@ -8250,7 +8250,19 @@ ${cause.stack}`;
         else if (_this2.headers.get("Accept") && ((_this$headers$get = _this2.headers.get("Accept")) === null || _this$headers$get === undefined ? undefined : _this$headers$get.includes("application/vnd.pgrst.plan+text")))
           data = body;
         else
-          data = JSON.parse(body);
+          try {
+            data = JSON.parse(body);
+          } catch (_unused) {
+            error = { message: body };
+            data = null;
+            if (_this2.shouldThrowOnError)
+              throw new PostgrestError({
+                message: body,
+                details: "",
+                hint: "",
+                code: ""
+              });
+          }
       }
       const countHeader = (_this$headers$get2 = _this2.headers.get("Prefer")) === null || _this$headers$get2 === undefined ? undefined : _this$headers$get2.match(/count=(exact|planned|estimated)/);
       const contentRange = (_res$headers$get2 = res.headers.get("content-range")) === null || _res$headers$get2 === undefined ? undefined : _res$headers$get2.split("/");
@@ -8282,7 +8294,7 @@ ${cause.stack}`;
           status = 200;
           statusText = "OK";
         }
-      } catch (_unused) {
+      } catch (_unused2) {
         if (res.status === 404 && body === "") {
           status = 204;
           statusText = "No Content";
@@ -8795,7 +8807,7 @@ var init_dist = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/lib/websocket-factory.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/lib/websocket-factory.js
 var require_websocket_factory = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.WebSocketFactory = undefined;
@@ -8886,14 +8898,14 @@ Suggested solution: ${env.workaround}`;
   exports.default = WebSocketFactory;
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/lib/version.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/lib/version.js
 var require_version = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.version = undefined;
-  exports.version = "2.106.2";
+  exports.version = "2.107.0";
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/lib/constants.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/lib/constants.js
 var require_constants = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.CONNECTION_STATE = exports.TRANSPORTS = exports.CHANNEL_EVENTS = exports.CHANNEL_STATES = exports.SOCKET_STATES = exports.MAX_PUSH_BUFFER_SIZE = exports.WS_CLOSE_NORMAL = exports.DEFAULT_TIMEOUT = exports.VERSION = exports.DEFAULT_VSN = exports.VSN_2_0_0 = exports.VSN_1_0_0 = exports.DEFAULT_VERSION = undefined;
@@ -8938,7 +8950,7 @@ var require_constants = __commonJS((exports) => {
   };
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/lib/serializer.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/lib/serializer.js
 var require_serializer = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
 
@@ -9083,7 +9095,7 @@ var require_serializer = __commonJS((exports) => {
   exports.default = Serializer;
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/lib/transformers.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/lib/transformers.js
 var require_transformers = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.httpEndpointURL = exports.toTimestampString = exports.toArray = exports.toJson = exports.toNumber = exports.toBoolean = exports.convertCell = exports.convertColumn = exports.convertChangeData = exports.PostgresTypes = undefined;
@@ -10630,7 +10642,7 @@ var require_phoenix_cjs = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/phoenix/presenceAdapter.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/phoenix/presenceAdapter.js
 var require_presenceAdapter = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var phoenix_1 = require_phoenix_cjs();
@@ -10703,7 +10715,7 @@ var require_presenceAdapter = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/RealtimePresence.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/RealtimePresence.js
 var require_RealtimePresence = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.REALTIME_PRESENCE_LISTEN_EVENTS = undefined;
@@ -10728,7 +10740,7 @@ var require_RealtimePresence = __commonJS((exports) => {
   exports.default = RealtimePresence;
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/lib/normalizeChannelError.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/lib/normalizeChannelError.js
 var require_normalizeChannelError = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.normalizeChannelError = normalizeChannelError;
@@ -10751,7 +10763,7 @@ var require_normalizeChannelError = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/phoenix/channelAdapter.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/phoenix/channelAdapter.js
 var require_channelAdapter = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var constants_1 = require_constants();
@@ -10853,7 +10865,7 @@ var require_channelAdapter = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/RealtimeChannel.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/RealtimeChannel.js
 var require_RealtimeChannel = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.REALTIME_CHANNEL_STATES = exports.REALTIME_SUBSCRIBE_STATES = exports.REALTIME_LISTEN_TYPES = exports.REALTIME_POSTGRES_CHANGES_LISTEN_EVENT = undefined;
@@ -11027,28 +11039,25 @@ var require_RealtimeChannel = __commonJS((exports) => {
       if (payload === undefined || payload === null) {
         return Promise.reject(new Error("Payload is required for httpSend()"));
       }
+      const isBinary = payload instanceof ArrayBuffer || ArrayBuffer.isView(payload);
       const headers = {
         apikey: this.socket.apiKey ? this.socket.apiKey : "",
-        "Content-Type": "application/json"
+        "Content-Type": isBinary ? "application/octet-stream" : "application/json"
       };
       if (this.socket.accessTokenValue) {
         headers["Authorization"] = `Bearer ${this.socket.accessTokenValue}`;
       }
+      const url = new URL(this.broadcastEndpointURL);
+      url.pathname += `/${encodeURIComponent(this.subTopic)}/events/${encodeURIComponent(event)}`;
+      if (this.private) {
+        url.searchParams.set("private", "true");
+      }
       const options = {
         method: "POST",
         headers,
-        body: JSON.stringify({
-          messages: [
-            {
-              topic: this.subTopic,
-              event,
-              payload,
-              private: this.private
-            }
-          ]
-        })
+        body: isBinary ? payload : JSON.stringify(payload)
       };
-      const response = await this._fetchWithTimeout(this.broadcastEndpointURL, options, (_a = opts.timeout) !== null && _a !== undefined ? _a : this.timeout);
+      const response = await this._fetchWithTimeout(url.toString(), options, (_a = opts.timeout) !== null && _a !== undefined ? _a : this.timeout);
       if (response.status === 202) {
         return { success: true };
       }
@@ -11231,7 +11240,7 @@ var require_RealtimeChannel = __commonJS((exports) => {
   exports.default = RealtimeChannel;
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/phoenix/socketAdapter.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/phoenix/socketAdapter.js
 var require_socketAdapter = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var phoenix_1 = require_phoenix_cjs();
@@ -11344,7 +11353,7 @@ var require_socketAdapter = __commonJS((exports) => {
   exports.default = SocketAdapter;
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/RealtimeClient.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/RealtimeClient.js
 var require_RealtimeClient = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var tslib_1 = require_tslib();
@@ -11811,7 +11820,7 @@ var require_RealtimeClient = __commonJS((exports) => {
   exports.default = RealtimeClient;
 });
 
-// ../../node_modules/.bun/@supabase+realtime-js@2.106.2/node_modules/@supabase/realtime-js/dist/main/index.js
+// ../../node_modules/.bun/@supabase+realtime-js@2.107.0/node_modules/@supabase/realtime-js/dist/main/index.js
 var require_main2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.WebSocketFactory = exports.REALTIME_CHANNEL_STATES = exports.REALTIME_SUBSCRIBE_STATES = exports.REALTIME_PRESENCE_LISTEN_EVENTS = exports.REALTIME_POSTGRES_CHANGES_LISTEN_EVENT = exports.REALTIME_LISTEN_TYPES = exports.RealtimeClient = exports.RealtimeChannel = exports.RealtimePresence = undefined;
@@ -12141,7 +12150,7 @@ var init_dist2 = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@supabase+storage-js@2.106.2/node_modules/@supabase/storage-js/dist/index.mjs
+// ../../node_modules/.bun/@supabase+storage-js@2.107.0/node_modules/@supabase/storage-js/dist/index.mjs
 function _typeof2(o) {
   "@babel/helpers - typeof";
   return _typeof2 = typeof Symbol == "function" && typeof Symbol.iterator == "symbol" ? function(o$1) {
@@ -12449,7 +12458,7 @@ var StorageError, StorageApiError, StorageUnknownError, resolveFetch = (customFe
       throw error;
     }
   }
-}, DEFAULT_SEARCH_OPTIONS, DEFAULT_FILE_OPTIONS, StorageFileApi, version = "2.106.2", DEFAULT_HEADERS, StorageBucketApi, StorageAnalyticsClient, VectorIndexApi, VectorDataApi, VectorBucketApi, StorageVectorsClient, VectorBucketScope, VectorIndexScope, StorageClient;
+}, DEFAULT_SEARCH_OPTIONS, DEFAULT_FILE_OPTIONS, StorageFileApi, version = "2.107.0", DEFAULT_HEADERS, StorageBucketApi, StorageAnalyticsClient, VectorIndexApi, VectorDataApi, VectorBucketApi, StorageVectorsClient, VectorBucketScope, VectorIndexScope, StorageClient;
 var init_dist3 = __esm(() => {
   init_dist2();
   StorageError = class extends Error {
@@ -13157,14 +13166,14 @@ var init_dist3 = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/version.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/version.js
 var require_version2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.version = undefined;
-  exports.version = "2.106.2";
+  exports.version = "2.107.0";
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/constants.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/constants.js
 var require_constants2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.JWKS_TTL = exports.BASE64URL_REGEX = exports.API_VERSIONS = exports.API_VERSION_HEADER_NAME = exports.NETWORK_FAILURE = exports.DEFAULT_HEADERS = exports.AUDIENCE = exports.STORAGE_KEY = exports.GOTRUE_URL = exports.EXPIRY_MARGIN_MS = exports.AUTO_REFRESH_TICK_THRESHOLD = exports.AUTO_REFRESH_TICK_DURATION_MS = undefined;
@@ -13191,16 +13200,17 @@ var require_constants2 = __commonJS((exports) => {
   exports.JWKS_TTL = 10 * 60 * 1000;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/errors.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/errors.js
 var require_errors = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
-  exports.AuthInvalidJwtError = exports.AuthWeakPasswordError = exports.AuthRetryableFetchError = exports.AuthPKCECodeVerifierMissingError = exports.AuthPKCEGrantCodeExchangeError = exports.AuthImplicitGrantRedirectError = exports.AuthInvalidCredentialsError = exports.AuthInvalidTokenResponseError = exports.AuthSessionMissingError = exports.CustomAuthError = exports.AuthUnknownError = exports.AuthApiError = exports.AuthError = undefined;
+  exports.AuthInvalidJwtError = exports.AuthWeakPasswordError = exports.AuthRefreshDiscardedError = exports.AuthRetryableFetchError = exports.AuthPKCECodeVerifierMissingError = exports.AuthPKCEGrantCodeExchangeError = exports.AuthImplicitGrantRedirectError = exports.AuthInvalidCredentialsError = exports.AuthInvalidTokenResponseError = exports.AuthSessionMissingError = exports.CustomAuthError = exports.AuthUnknownError = exports.AuthApiError = exports.AuthError = undefined;
   exports.isAuthError = isAuthError;
   exports.isAuthApiError = isAuthApiError;
   exports.isAuthSessionMissingError = isAuthSessionMissingError;
   exports.isAuthImplicitGrantRedirectError = isAuthImplicitGrantRedirectError;
   exports.isAuthPKCECodeVerifierMissingError = isAuthPKCECodeVerifierMissingError;
   exports.isAuthRetryableFetchError = isAuthRetryableFetchError;
+  exports.isAuthRefreshDiscardedError = isAuthRefreshDiscardedError;
   exports.isAuthWeakPasswordError = isAuthWeakPasswordError;
 
   class AuthError extends Error {
@@ -13327,6 +13337,16 @@ var require_errors = __commonJS((exports) => {
     return isAuthError(error) && error.name === "AuthRetryableFetchError";
   }
 
+  class AuthRefreshDiscardedError extends CustomAuthError {
+    constructor(message = "Refresh result discarded: session state changed mid-flight (e.g., concurrent signOut)") {
+      super(message, "AuthRefreshDiscardedError", 409, undefined);
+    }
+  }
+  exports.AuthRefreshDiscardedError = AuthRefreshDiscardedError;
+  function isAuthRefreshDiscardedError(error) {
+    return isAuthError(error) && error.name === "AuthRefreshDiscardedError";
+  }
+
   class AuthWeakPasswordError extends CustomAuthError {
     constructor(message, status, reasons) {
       super(message, "AuthWeakPasswordError", status, "weak_password");
@@ -13349,7 +13369,7 @@ var require_errors = __commonJS((exports) => {
   exports.AuthInvalidJwtError = AuthInvalidJwtError;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/base64url.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/base64url.js
 var require_base64url = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.byteToBase64URL = byteToBase64URL;
@@ -13537,7 +13557,7 @@ var require_base64url = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/helpers.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/helpers.js
 var require_helpers = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Deferred = exports.removeItemAsync = exports.getItemAsync = exports.setItemAsync = exports.looksLikeFetchResponse = exports.resolveFetch = exports.supportsLocalStorage = exports.isBrowser = undefined;
@@ -13852,7 +13872,7 @@ var require_helpers = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/fetch.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/fetch.js
 var require_fetch = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.handleError = handleError2;
@@ -14017,14 +14037,14 @@ var require_fetch = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/types.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/types.js
 var require_types2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.SIGN_OUT_SCOPES = undefined;
   exports.SIGN_OUT_SCOPES = ["global", "local", "others"];
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/GoTrueAdminApi.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/GoTrueAdminApi.js
 var require_GoTrueAdminApi = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var tslib_1 = require_tslib();
@@ -14034,12 +14054,6 @@ var require_GoTrueAdminApi = __commonJS((exports) => {
   var errors_1 = require_errors();
 
   class GoTrueAdminApi {
-    _encodePathSegment(segment) {
-      if (segment === "." || segment === "..") {
-        throw new errors_1.AuthError("Invalid path segment");
-      }
-      return encodeURIComponent(segment);
-    }
     constructor({ url = "", headers = {}, fetch: fetch2, experimental }) {
       this.url = url;
       this.headers = headers;
@@ -14307,8 +14321,7 @@ var require_GoTrueAdminApi = __commonJS((exports) => {
     }
     async _getOAuthClient(clientId) {
       try {
-        const encodedClientId = this._encodePathSegment(clientId);
-        return await (0, fetch_1._request)(this.fetch, "GET", `${this.url}/admin/oauth/clients/${encodedClientId}`, {
+        return await (0, fetch_1._request)(this.fetch, "GET", `${this.url}/admin/oauth/clients/${clientId}`, {
           headers: this.headers,
           xform: (client) => {
             return { data: client, error: null };
@@ -14323,8 +14336,7 @@ var require_GoTrueAdminApi = __commonJS((exports) => {
     }
     async _updateOAuthClient(clientId, params) {
       try {
-        const encodedClientId = this._encodePathSegment(clientId);
-        return await (0, fetch_1._request)(this.fetch, "PUT", `${this.url}/admin/oauth/clients/${encodedClientId}`, {
+        return await (0, fetch_1._request)(this.fetch, "PUT", `${this.url}/admin/oauth/clients/${clientId}`, {
           body: params,
           headers: this.headers,
           xform: (client) => {
@@ -14340,8 +14352,7 @@ var require_GoTrueAdminApi = __commonJS((exports) => {
     }
     async _deleteOAuthClient(clientId) {
       try {
-        const encodedClientId = this._encodePathSegment(clientId);
-        await (0, fetch_1._request)(this.fetch, "DELETE", `${this.url}/admin/oauth/clients/${encodedClientId}`, {
+        await (0, fetch_1._request)(this.fetch, "DELETE", `${this.url}/admin/oauth/clients/${clientId}`, {
           headers: this.headers,
           noResolveJson: true
         });
@@ -14355,8 +14366,7 @@ var require_GoTrueAdminApi = __commonJS((exports) => {
     }
     async _regenerateOAuthClientSecret(clientId) {
       try {
-        const encodedClientId = this._encodePathSegment(clientId);
-        return await (0, fetch_1._request)(this.fetch, "POST", `${this.url}/admin/oauth/clients/${encodedClientId}/regenerate_secret`, {
+        return await (0, fetch_1._request)(this.fetch, "POST", `${this.url}/admin/oauth/clients/${clientId}/regenerate_secret`, {
           headers: this.headers,
           xform: (client) => {
             return { data: client, error: null };
@@ -14408,8 +14418,7 @@ var require_GoTrueAdminApi = __commonJS((exports) => {
     }
     async _getCustomProvider(identifier) {
       try {
-        const encodedIdentifier = this._encodePathSegment(identifier);
-        return await (0, fetch_1._request)(this.fetch, "GET", `${this.url}/admin/custom-providers/${encodedIdentifier}`, {
+        return await (0, fetch_1._request)(this.fetch, "GET", `${this.url}/admin/custom-providers/${identifier}`, {
           headers: this.headers,
           xform: (provider) => {
             return { data: provider, error: null };
@@ -14424,8 +14433,7 @@ var require_GoTrueAdminApi = __commonJS((exports) => {
     }
     async _updateCustomProvider(identifier, params) {
       try {
-        const encodedIdentifier = this._encodePathSegment(identifier);
-        return await (0, fetch_1._request)(this.fetch, "PUT", `${this.url}/admin/custom-providers/${encodedIdentifier}`, {
+        return await (0, fetch_1._request)(this.fetch, "PUT", `${this.url}/admin/custom-providers/${identifier}`, {
           body: params,
           headers: this.headers,
           xform: (provider) => {
@@ -14441,8 +14449,7 @@ var require_GoTrueAdminApi = __commonJS((exports) => {
     }
     async _deleteCustomProvider(identifier) {
       try {
-        const encodedIdentifier = this._encodePathSegment(identifier);
-        await (0, fetch_1._request)(this.fetch, "DELETE", `${this.url}/admin/custom-providers/${encodedIdentifier}`, {
+        await (0, fetch_1._request)(this.fetch, "DELETE", `${this.url}/admin/custom-providers/${identifier}`, {
           headers: this.headers,
           noResolveJson: true
         });
@@ -14484,7 +14491,7 @@ var require_GoTrueAdminApi = __commonJS((exports) => {
   exports.default = GoTrueAdminApi;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/local-storage.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/local-storage.js
 var require_local_storage = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.memoryLocalStorageAdapter = memoryLocalStorageAdapter;
@@ -14503,7 +14510,7 @@ var require_local_storage = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/locks.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/locks.js
 var require_locks = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ProcessLockAcquireTimeoutError = exports.NavigatorLockAcquireTimeoutError = exports.LockAcquireTimeoutError = exports.internals = undefined;
@@ -14677,7 +14684,7 @@ var require_locks = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/polyfills.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/polyfills.js
 var require_polyfills = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.polyfillGlobalThis = polyfillGlobalThis;
@@ -14701,7 +14708,7 @@ var require_polyfills = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/web3/ethereum.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/web3/ethereum.js
 var require_ethereum = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getAddress = getAddress;
@@ -14778,7 +14785,7 @@ ${suffix}`;
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/webauthn.errors.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/webauthn.errors.js
 var require_webauthn_errors = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.WebAuthnUnknownError = exports.WebAuthnError = undefined;
@@ -14965,7 +14972,7 @@ var require_webauthn_errors = __commonJS((exports) => {
   }
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/lib/webauthn.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/lib/webauthn.js
 var require_webauthn = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.WebAuthnApi = exports.DEFAULT_REQUEST_OPTIONS = exports.DEFAULT_CREATION_OPTIONS = exports.webAuthnAbortService = exports.WebAuthnAbortService = exports.identifyAuthenticationError = exports.identifyRegistrationError = exports.isWebAuthnError = exports.WebAuthnError = undefined;
@@ -15419,7 +15426,7 @@ var require_webauthn = __commonJS((exports) => {
   exports.WebAuthnApi = WebAuthnApi;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/GoTrueClient.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/GoTrueClient.js
 var require_GoTrueClient = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var tslib_1 = require_tslib();
@@ -15451,9 +15458,6 @@ var require_GoTrueClient = __commonJS((exports) => {
     skipAutoInitialize: false,
     experimental: {}
   };
-  async function lockNoOp(name, acquireTimeout, fn) {
-    return await fn();
-  }
   var GLOBAL_JWKS = {};
 
   class GoTrueClient {
@@ -15472,7 +15476,7 @@ var require_GoTrueClient = __commonJS((exports) => {
       GLOBAL_JWKS[this.storageKey] = Object.assign(Object.assign({}, GLOBAL_JWKS[this.storageKey]), { cachedAt: value });
     }
     constructor(options) {
-      var _a, _b, _c, _d;
+      var _a, _b, _c;
       this.userStorage = null;
       this.memoryStorage = null;
       this.stateChangeEmitters = new Map;
@@ -15480,10 +15484,12 @@ var require_GoTrueClient = __commonJS((exports) => {
       this.autoRefreshTickTimeout = null;
       this.visibilityChangedCallback = null;
       this.refreshingDeferred = null;
+      this._sessionRemovalEpoch = 0;
       this.initializePromise = null;
       this.detectSessionInUrl = true;
       this.hasCustomAuthorizationHeader = false;
       this.suppressGetSessionWarning = false;
+      this.lock = null;
       this.lockAcquired = false;
       this.pendingInLock = [];
       this.broadcastChannel = null;
@@ -15515,18 +15521,13 @@ var require_GoTrueClient = __commonJS((exports) => {
       this.url = settings.url;
       this.headers = settings.headers;
       this.fetch = (0, helpers_1.resolveFetch)(settings.fetch);
-      this.lock = settings.lock || lockNoOp;
       this.detectSessionInUrl = settings.detectSessionInUrl;
       this.flowType = settings.flowType;
       this.hasCustomAuthorizationHeader = settings.hasCustomAuthorizationHeader;
       this.throwOnError = settings.throwOnError;
       this.lockAcquireTimeout = settings.lockAcquireTimeout;
-      if (settings.lock) {
+      if (settings.lock != null) {
         this.lock = settings.lock;
-      } else if (this.persistSession && (0, helpers_1.isBrowser)() && ((_c = globalThis === null || globalThis === undefined ? undefined : globalThis.navigator) === null || _c === undefined ? undefined : _c.locks)) {
-        this.lock = locks_1.navigatorLock;
-      } else {
-        this.lock = lockNoOp;
       }
       if (!this.jwks) {
         this.jwks = { keys: [] };
@@ -15582,7 +15583,7 @@ var require_GoTrueClient = __commonJS((exports) => {
         } catch (e) {
           console.error("Failed to create a new BroadcastChannel, multi-tab state changes will not be available", e);
         }
-        (_d = this.broadcastChannel) === null || _d === undefined || _d.addEventListener("message", async (event) => {
+        (_c = this.broadcastChannel) === null || _c === undefined || _c.addEventListener("message", async (event) => {
           this._debug("received broadcast notification from other tab or client", event);
           try {
             await this._notifyAllSubscribers(event.data.event, event.data.session, false);
@@ -15620,9 +15621,12 @@ var require_GoTrueClient = __commonJS((exports) => {
         return await this.initializePromise;
       }
       this.initializePromise = (async () => {
-        return await this._acquireLock(this.lockAcquireTimeout, async () => {
-          return await this._initialize();
-        });
+        if (this.lock != null) {
+          return await this._acquireLock(this.lockAcquireTimeout, async () => {
+            return await this._initialize();
+          });
+        }
+        return await this._initialize();
       })();
       return await this.initializePromise;
     }
@@ -15827,9 +15831,12 @@ var require_GoTrueClient = __commonJS((exports) => {
     }
     async exchangeCodeForSession(authCode) {
       await this.initializePromise;
-      return this._acquireLock(this.lockAcquireTimeout, async () => {
-        return this._exchangeCodeForSession(authCode);
-      });
+      if (this.lock != null) {
+        return this._acquireLock(this.lockAcquireTimeout, async () => {
+          return this._exchangeCodeForSession(authCode);
+        });
+      }
+      return this._exchangeCodeForSession(authCode);
     }
     async signInWithWeb3(credentials) {
       const { chain } = credentials;
@@ -16221,9 +16228,12 @@ var require_GoTrueClient = __commonJS((exports) => {
     }
     async reauthenticate() {
       await this.initializePromise;
-      return await this._acquireLock(this.lockAcquireTimeout, async () => {
-        return await this._reauthenticate();
-      });
+      if (this.lock != null) {
+        return await this._acquireLock(this.lockAcquireTimeout, async () => {
+          return await this._reauthenticate();
+        });
+      }
+      return await this._reauthenticate();
     }
     async _reauthenticate() {
       try {
@@ -16286,12 +16296,16 @@ var require_GoTrueClient = __commonJS((exports) => {
     }
     async getSession() {
       await this.initializePromise;
-      const result = await this._acquireLock(this.lockAcquireTimeout, async () => {
-        return this._useSession(async (result2) => {
-          return result2;
+      if (this.lock != null) {
+        return await this._acquireLock(this.lockAcquireTimeout, async () => {
+          return this._useSession(async (result) => {
+            return result;
+          });
         });
+      }
+      return await this._useSession(async (result) => {
+        return result;
       });
-      return result;
     }
     async _acquireLock(acquireTimeout, fn) {
       this._debug("#_acquireLock", "begin", acquireTimeout);
@@ -16346,7 +16360,7 @@ var require_GoTrueClient = __commonJS((exports) => {
     }
     async __loadSession() {
       this._debug("#__loadSession()", "begin");
-      if (!this.lockAcquired) {
+      if (this.lock != null && !this.lockAcquired) {
         this._debug("#__loadSession()", "used outside of an acquired lock!", new Error().stack);
       }
       try {
@@ -16398,9 +16412,14 @@ var require_GoTrueClient = __commonJS((exports) => {
         return await this._getUser(jwt);
       }
       await this.initializePromise;
-      const result = await this._acquireLock(this.lockAcquireTimeout, async () => {
-        return await this._getUser();
-      });
+      let result;
+      if (this.lock != null) {
+        result = await this._acquireLock(this.lockAcquireTimeout, async () => {
+          return await this._getUser();
+        });
+      } else {
+        result = await this._getUser();
+      }
       if (result.data.user) {
         this.suppressGetSessionWarning = true;
       }
@@ -16443,9 +16462,12 @@ var require_GoTrueClient = __commonJS((exports) => {
     }
     async updateUser(attributes, options = {}) {
       await this.initializePromise;
-      return await this._acquireLock(this.lockAcquireTimeout, async () => {
-        return await this._updateUser(attributes, options);
-      });
+      if (this.lock != null) {
+        return await this._acquireLock(this.lockAcquireTimeout, async () => {
+          return await this._updateUser(attributes, options);
+        });
+      }
+      return await this._updateUser(attributes, options);
     }
     async _updateUser(attributes, options = {}) {
       try {
@@ -16488,9 +16510,12 @@ var require_GoTrueClient = __commonJS((exports) => {
     }
     async setSession(currentSession) {
       await this.initializePromise;
-      return await this._acquireLock(this.lockAcquireTimeout, async () => {
-        return await this._setSession(currentSession);
-      });
+      if (this.lock != null) {
+        return await this._acquireLock(this.lockAcquireTimeout, async () => {
+          return await this._setSession(currentSession);
+        });
+      }
+      return await this._setSession(currentSession);
     }
     async _setSession(currentSession) {
       try {
@@ -16541,9 +16566,12 @@ var require_GoTrueClient = __commonJS((exports) => {
     }
     async refreshSession(currentSession) {
       await this.initializePromise;
-      return await this._acquireLock(this.lockAcquireTimeout, async () => {
-        return await this._refreshSession(currentSession);
-      });
+      if (this.lock != null) {
+        return await this._acquireLock(this.lockAcquireTimeout, async () => {
+          return await this._refreshSession(currentSession);
+        });
+      }
+      return await this._refreshSession(currentSession);
     }
     async _refreshSession(currentSession) {
       try {
@@ -16661,7 +16689,7 @@ var require_GoTrueClient = __commonJS((exports) => {
       if (typeof this.detectSessionInUrl === "function") {
         return this.detectSessionInUrl(new URL(window.location.href), params);
       }
-      return Boolean(params.access_token || params.error_description);
+      return Boolean(params.access_token || params.error || params.error_description || params.error_code);
     }
     async _isPKCECallback(params) {
       const currentStorageContent = await (0, helpers_1.getItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
@@ -16669,9 +16697,12 @@ var require_GoTrueClient = __commonJS((exports) => {
     }
     async signOut(options = { scope: "global" }) {
       await this.initializePromise;
-      return await this._acquireLock(this.lockAcquireTimeout, async () => {
-        return await this._signOut(options);
-      });
+      if (this.lock != null) {
+        return await this._acquireLock(this.lockAcquireTimeout, async () => {
+          return await this._signOut(options);
+        });
+      }
+      return await this._signOut(options);
     }
     async _signOut({ scope } = { scope: "global" }) {
       return await this._useSession(async (result) => {
@@ -16710,9 +16741,13 @@ var require_GoTrueClient = __commonJS((exports) => {
       this.stateChangeEmitters.set(id, subscription);
       (async () => {
         await this.initializePromise;
-        await this._acquireLock(this.lockAcquireTimeout, async () => {
-          this._emitInitialSession(id);
-        });
+        if (this.lock != null) {
+          await this._acquireLock(this.lockAcquireTimeout, async () => {
+            this._emitInitialSession(id);
+          });
+        } else {
+          await this._emitInitialSession(id);
+        }
       })();
       return { data: { subscription } };
     }
@@ -16881,7 +16916,7 @@ var require_GoTrueClient = __commonJS((exports) => {
       }
     }
     async _refreshAccessToken(refreshToken) {
-      const debugName = `#_refreshAccessToken(${refreshToken.substring(0, 5)}...)`;
+      const debugName = `#_refreshAccessToken()`;
       this._debug(debugName, "begin");
       try {
         const startedAt = Date.now();
@@ -16964,10 +16999,14 @@ var require_GoTrueClient = __commonJS((exports) => {
           if (this.autoRefreshToken && currentSession.refresh_token) {
             const { error } = await this._callRefreshToken(currentSession.refresh_token);
             if (error) {
-              console.error(error);
-              if (!(0, errors_1.isAuthRetryableFetchError)(error)) {
-                this._debug(debugName, "refresh failed with a non-retryable error, removing the session", error);
-                await this._removeSession();
+              if ((0, errors_1.isAuthRefreshDiscardedError)(error)) {
+                this._debug(debugName, "refresh discarded by commit guard", error);
+              } else {
+                console.error(error);
+                if (!(0, errors_1.isAuthRetryableFetchError)(error)) {
+                  this._debug(debugName, "refresh failed with a non-retryable error, removing the session", error);
+                  await this._removeSession();
+                }
               }
             }
           }
@@ -17004,16 +17043,45 @@ var require_GoTrueClient = __commonJS((exports) => {
       if (this.refreshingDeferred) {
         return this.refreshingDeferred.promise;
       }
-      const debugName = `#_callRefreshToken(${refreshToken.substring(0, 5)}...)`;
+      const debugName = `#_callRefreshToken()`;
       this._debug(debugName, "begin");
       try {
         this.refreshingDeferred = new helpers_1.Deferred;
+        const storedAtStart = await (0, helpers_1.getItemAsync)(this.storage, this.storageKey);
         const { data, error } = await this._refreshAccessToken(refreshToken);
         if (error)
           throw error;
         if (!data.session)
           throw new errors_1.AuthSessionMissingError;
+        const storedAfter = await (0, helpers_1.getItemAsync)(this.storage, this.storageKey);
+        const storageChangedUnderUs = storedAtStart !== null && (storedAfter === null || storedAfter.refresh_token !== storedAtStart.refresh_token);
+        if (storageChangedUnderUs) {
+          this._debug(debugName, "commit guard: storage changed since refresh started, discarding rotated tokens", {
+            startedWith: "present",
+            nowHolds: storedAfter ? "replaced" : "cleared"
+          });
+          const discarded = {
+            data: null,
+            error: new errors_1.AuthRefreshDiscardedError
+          };
+          this.refreshingDeferred.resolve(discarded);
+          return discarded;
+        }
+        const epochBeforeSave = this._sessionRemovalEpoch;
         await this._saveSession(data.session);
+        if (this._sessionRemovalEpoch !== epochBeforeSave) {
+          this._debug(debugName, "commit guard (post-save): _removeSession ran during _saveSession, undoing write");
+          await (0, helpers_1.removeItemAsync)(this.storage, this.storageKey);
+          if (this.userStorage) {
+            await (0, helpers_1.removeItemAsync)(this.userStorage, this.storageKey + "-user");
+          }
+          const discarded = {
+            data: null,
+            error: new errors_1.AuthRefreshDiscardedError
+          };
+          this.refreshingDeferred.resolve(discarded);
+          return discarded;
+        }
         await this._notifyAllSubscribers("TOKEN_REFRESHED", data.session);
         const result = { data: data.session, error: null };
         this.refreshingDeferred.resolve(result);
@@ -17083,6 +17151,7 @@ var require_GoTrueClient = __commonJS((exports) => {
       }
     }
     async _removeSession() {
+      this._sessionRemovalEpoch += 1;
       this._debug("#_removeSession()");
       this.suppressGetSessionWarning = false;
       await (0, helpers_1.removeItemAsync)(this.storage, this.storageKey);
@@ -17147,38 +17216,74 @@ var require_GoTrueClient = __commonJS((exports) => {
       this._removeVisibilityChangedCallback();
       await this._stopAutoRefresh();
     }
+    async dispose() {
+      var _a;
+      this._removeVisibilityChangedCallback();
+      await this._stopAutoRefresh();
+      (_a = this.broadcastChannel) === null || _a === undefined || _a.close();
+      this.broadcastChannel = null;
+      this.stateChangeEmitters.clear();
+    }
     async _autoRefreshTokenTick() {
       this._debug("#_autoRefreshTokenTick()", "begin");
-      try {
-        await this._acquireLock(0, async () => {
-          try {
-            const now = Date.now();
+      if (this.lock != null) {
+        try {
+          await this._acquireLock(0, async () => {
             try {
-              return await this._useSession(async (result) => {
-                const { data: { session } } = result;
-                if (!session || !session.refresh_token || !session.expires_at) {
-                  this._debug("#_autoRefreshTokenTick()", "no session");
-                  return;
-                }
-                const expiresInTicks = Math.floor((session.expires_at * 1000 - now) / constants_1.AUTO_REFRESH_TICK_DURATION_MS);
-                this._debug("#_autoRefreshTokenTick()", `access token expires in ${expiresInTicks} ticks, a tick lasts ${constants_1.AUTO_REFRESH_TICK_DURATION_MS}ms, refresh threshold is ${constants_1.AUTO_REFRESH_TICK_THRESHOLD} ticks`);
-                if (expiresInTicks <= constants_1.AUTO_REFRESH_TICK_THRESHOLD) {
-                  await this._callRefreshToken(session.refresh_token);
-                }
-              });
-            } catch (e) {
-              console.error("Auto refresh tick failed with error. This is likely a transient error.", e);
+              const now = Date.now();
+              try {
+                return await this._useSession(async (result) => {
+                  const { data: { session } } = result;
+                  if (!session || !session.refresh_token || !session.expires_at) {
+                    this._debug("#_autoRefreshTokenTick()", "no session");
+                    return;
+                  }
+                  const expiresInTicks = Math.floor((session.expires_at * 1000 - now) / constants_1.AUTO_REFRESH_TICK_DURATION_MS);
+                  this._debug("#_autoRefreshTokenTick()", `access token expires in ${expiresInTicks} ticks, a tick lasts ${constants_1.AUTO_REFRESH_TICK_DURATION_MS}ms, refresh threshold is ${constants_1.AUTO_REFRESH_TICK_THRESHOLD} ticks`);
+                  if (expiresInTicks <= constants_1.AUTO_REFRESH_TICK_THRESHOLD) {
+                    await this._callRefreshToken(session.refresh_token);
+                  }
+                });
+              } catch (e) {
+                console.error("Auto refresh tick failed with error. This is likely a transient error.", e);
+              }
+            } finally {
+              this._debug("#_autoRefreshTokenTick()", "end");
             }
-          } finally {
-            this._debug("#_autoRefreshTokenTick()", "end");
+          });
+        } catch (e) {
+          if (e instanceof locks_1.LockAcquireTimeoutError) {
+            this._debug("auto refresh token tick lock not available");
+          } else {
+            throw e;
           }
-        });
-      } catch (e) {
-        if (e instanceof locks_1.LockAcquireTimeoutError) {
-          this._debug("auto refresh token tick lock not available");
-        } else {
-          throw e;
         }
+        return;
+      }
+      if (this.refreshingDeferred !== null) {
+        this._debug("#_autoRefreshTokenTick()", "refresh already in flight, skipping");
+        return;
+      }
+      try {
+        const now = Date.now();
+        try {
+          await this._useSession(async (result) => {
+            const { data: { session } } = result;
+            if (!session || !session.refresh_token || !session.expires_at) {
+              this._debug("#_autoRefreshTokenTick()", "no session");
+              return;
+            }
+            const expiresInTicks = Math.floor((session.expires_at * 1000 - now) / constants_1.AUTO_REFRESH_TICK_DURATION_MS);
+            this._debug("#_autoRefreshTokenTick()", `access token expires in ${expiresInTicks} ticks, a tick lasts ${constants_1.AUTO_REFRESH_TICK_DURATION_MS}ms, refresh threshold is ${constants_1.AUTO_REFRESH_TICK_THRESHOLD} ticks`);
+            if (expiresInTicks <= constants_1.AUTO_REFRESH_TICK_THRESHOLD) {
+              await this._callRefreshToken(session.refresh_token);
+            }
+          });
+        } catch (e) {
+          console.error("Auto refresh tick failed with error. This is likely a transient error.", e);
+        }
+      } finally {
+        this._debug("#_autoRefreshTokenTick()", "end");
       }
     }
     async _handleVisibilityChange() {
@@ -17212,13 +17317,21 @@ var require_GoTrueClient = __commonJS((exports) => {
         }
         if (!calledFromInitialize) {
           await this.initializePromise;
-          await this._acquireLock(this.lockAcquireTimeout, async () => {
+          if (this.lock != null) {
+            await this._acquireLock(this.lockAcquireTimeout, async () => {
+              if (document.visibilityState !== "visible") {
+                this._debug(methodName, "acquired the lock to recover the session, but the browser visibilityState is no longer visible, aborting");
+                return;
+              }
+              await this._recoverAndRefresh();
+            });
+          } else {
             if (document.visibilityState !== "visible") {
-              this._debug(methodName, "acquired the lock to recover the session, but the browser visibilityState is no longer visible, aborting");
+              this._debug(methodName, "visibilityState is no longer visible, skipping recovery");
               return;
             }
             await this._recoverAndRefresh();
-          });
+          }
         }
       } else if (document.visibilityState === "hidden") {
         if (this.autoRefreshToken) {
@@ -17301,7 +17414,7 @@ var require_GoTrueClient = __commonJS((exports) => {
       }
     }
     async _verify(params) {
-      return this._acquireLock(this.lockAcquireTimeout, async () => {
+      const run = async () => {
         try {
           return await this._useSession(async (result) => {
             var _a;
@@ -17330,10 +17443,14 @@ var require_GoTrueClient = __commonJS((exports) => {
           }
           throw error;
         }
-      });
+      };
+      if (this.lock != null) {
+        return this._acquireLock(this.lockAcquireTimeout, run);
+      }
+      return run();
     }
     async _challenge(params) {
-      return this._acquireLock(this.lockAcquireTimeout, async () => {
+      const run = async () => {
         try {
           return await this._useSession(async (result) => {
             var _a;
@@ -17372,7 +17489,11 @@ var require_GoTrueClient = __commonJS((exports) => {
           }
           throw error;
         }
-      });
+      };
+      if (this.lock != null) {
+        return this._acquireLock(this.lockAcquireTimeout, run);
+      }
+      return run();
     }
     async _challengeAndVerify(params) {
       const { data: challengeData, error: challengeError } = await this._challenge({
@@ -17630,7 +17751,11 @@ var require_GoTrueClient = __commonJS((exports) => {
         }
         const { header, payload, signature, raw: { header: rawHeader, payload: rawPayload } } = (0, helpers_1.decodeJWT)(token);
         if (!(options === null || options === undefined ? undefined : options.allowExpired)) {
-          (0, helpers_1.validateExp)(payload.exp);
+          try {
+            (0, helpers_1.validateExp)(payload.exp);
+          } catch (e) {
+            throw new errors_1.AuthInvalidJwtError(e instanceof Error ? e.message : "JWT validation failed");
+          }
         }
         const signingKey = !header.alg || header.alg.startsWith("HS") || !header.kid || !(("crypto" in globalThis) && ("subtle" in globalThis.crypto)) ? null : await this.fetchJwk(header.kid, (options === null || options === undefined ? undefined : options.keys) ? { keys: options.keys } : options === null || options === undefined ? undefined : options.jwks);
         if (!signingKey) {
@@ -17943,7 +18068,7 @@ var require_GoTrueClient = __commonJS((exports) => {
   exports.default = GoTrueClient;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/AuthAdminApi.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/AuthAdminApi.js
 var require_AuthAdminApi = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var tslib_1 = require_tslib();
@@ -17952,7 +18077,7 @@ var require_AuthAdminApi = __commonJS((exports) => {
   exports.default = AuthAdminApi;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/AuthClient.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/AuthClient.js
 var require_AuthClient = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   var tslib_1 = require_tslib();
@@ -17961,7 +18086,7 @@ var require_AuthClient = __commonJS((exports) => {
   exports.default = AuthClient;
 });
 
-// ../../node_modules/.bun/@supabase+auth-js@2.106.2/node_modules/@supabase/auth-js/dist/main/index.js
+// ../../node_modules/.bun/@supabase+auth-js@2.107.0/node_modules/@supabase/auth-js/dist/main/index.js
 var require_main3 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.processLock = exports.lockInternals = exports.NavigatorLockAcquireTimeoutError = exports.navigatorLock = exports.AuthClient = exports.AuthAdminApi = exports.GoTrueClient = exports.GoTrueAdminApi = undefined;
@@ -17991,7 +18116,7 @@ var require_main3 = __commonJS((exports) => {
   } });
 });
 
-// ../../node_modules/.bun/@supabase+supabase-js@2.106.2/node_modules/@supabase/supabase-js/dist/index.mjs
+// ../../node_modules/.bun/@supabase+supabase-js@2.107.0/node_modules/@supabase/supabase-js/dist/index.mjs
 var exports_dist = {};
 __export(exports_dist, {
   createClient: () => createClient,
@@ -18252,7 +18377,7 @@ function shouldShowDeprecationWarning() {
     return false;
   return parseInt(versionMatch[1], 10) <= 18;
 }
-var import_functions_js, import_realtime_js, import_auth_js, version2 = "2.106.2", JS_ENV = "", DEFAULT_HEADERS2, DEFAULT_GLOBAL_OPTIONS, DEFAULT_DB_OPTIONS, DEFAULT_AUTH_OPTIONS, DEFAULT_REALTIME_OPTIONS, DEFAULT_TRACE_PROPAGATION_OPTIONS, otelModulePromise = null, OTEL_PKG = "@opentelemetry/api", resolveFetch2 = (customFetch) => {
+var import_functions_js, import_realtime_js, import_auth_js, version2 = "2.107.0", JS_ENV = "", JS_RUNTIME_VERSION, _Deno$version, _process$version, _runtimeMeta, DEFAULT_HEADERS2, DEFAULT_GLOBAL_OPTIONS, DEFAULT_DB_OPTIONS, DEFAULT_AUTH_OPTIONS, DEFAULT_REALTIME_OPTIONS, DEFAULT_TRACE_PROPAGATION_OPTIONS, otelModulePromise = null, OTEL_PKG = "@opentelemetry/api", resolveFetch2 = (customFetch) => {
   if (customFetch)
     return (...args) => customFetch(...args);
   return (...args) => fetch(...args);
@@ -18432,15 +18557,21 @@ var init_dist4 = __esm(() => {
   import_auth_js = __toESM(require_main3(), 1);
   __reExport(exports_dist, __toESM(require_main2(), 1));
   __reExport(exports_dist, __toESM(require_main3(), 1));
-  if (typeof Deno !== "undefined")
+  if (typeof Deno !== "undefined") {
     JS_ENV = "deno";
-  else if (typeof document !== "undefined")
+    JS_RUNTIME_VERSION = (_Deno$version = Deno.version) === null || _Deno$version === undefined ? undefined : _Deno$version.deno;
+  } else if (typeof document !== "undefined")
     JS_ENV = "web";
   else if (typeof navigator !== "undefined" && navigator.product === "ReactNative")
     JS_ENV = "react-native";
-  else
+  else {
     JS_ENV = "node";
-  DEFAULT_HEADERS2 = { "X-Client-Info": `supabase-js-${JS_ENV}/${version2}` };
+    JS_RUNTIME_VERSION = typeof process !== "undefined" ? (_process$version = process.version) === null || _process$version === undefined ? undefined : _process$version.replace(/^v/, "") : undefined;
+  }
+  _runtimeMeta = [`runtime=${JS_ENV}`];
+  if (JS_RUNTIME_VERSION)
+    _runtimeMeta.push(`runtime-version=${JS_RUNTIME_VERSION}`);
+  DEFAULT_HEADERS2 = { "X-Client-Info": `supabase-js/${version2}; ${_runtimeMeta.join("; ")}` };
   DEFAULT_GLOBAL_OPTIONS = { headers: DEFAULT_HEADERS2 };
   DEFAULT_DB_OPTIONS = { schema: "public" };
   DEFAULT_AUTH_OPTIONS = {
@@ -79881,6 +80012,19 @@ function registerConfigRoutes(app, ctx) {
     return c2.json({ key, value });
   });
 }
+// src/web/usage.ts
+function logWebUsage(ctx, params) {
+  Promise.resolve(ctx.supabase.rpc("cerefox_log_usage", {
+    p_operation: params.operation,
+    p_access_path: "webapp",
+    p_requestor: params.requestor ?? "web-ui",
+    p_document_id: params.document_id ?? null,
+    p_project_id: params.project_id ?? null,
+    p_query_text: params.query_text ?? null,
+    p_result_count: params.result_count ?? null,
+    p_extra: {}
+  })).catch(() => {});
+}
 
 // src/web/routes/discovery.ts
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -80207,6 +80351,7 @@ function registerDiscoveryRoutes(app, ctx) {
         results = results.filter((r) => statusMap.get(r.document_id) === reviewStatus);
       }
     }
+    logWebUsage(ctx, { operation: "search", query_text: q, result_count: results.length });
     return c2.json({
       results,
       query: q,
@@ -80504,6 +80649,7 @@ function registerDocumentReadRoutes(app, ctx) {
     const meta = await getDocumentRow(ctx, documentId);
     const projectIds = await listDocumentProjectIds(ctx, documentId);
     const versions3 = await listDocumentVersions(ctx, documentId);
+    logWebUsage(ctx, { operation: "get-document", document_id: documentId });
     return c2.json({
       document_id: documentId,
       full_content: doc2.full_content ?? "",
@@ -80848,6 +80994,7 @@ function registerIngestRoutes(app, ctx) {
       };
       if (result.note)
         resp.note = result.note;
+      logWebUsage(ctx, { operation: "ingest", document_id: result.documentId });
       return c2.json(resp, 200);
     } catch (err) {
       return c2.json(notReady(err instanceof Error ? err.message : String(err)), 200);
@@ -80903,6 +81050,7 @@ function registerIngestRoutes(app, ctx) {
         authorType: "user"
       });
       const skipped = result.action === "skipped";
+      logWebUsage(ctx, { operation: "ingest", document_id: result.documentId });
       return c2.json({
         success: !skipped,
         document_id: result.documentId,
@@ -80951,6 +81099,7 @@ function registerIngestRoutes(app, ctx) {
         author: "web-ui",
         authorType: "user"
       });
+      logWebUsage(ctx, { operation: "ingest", document_id: result.documentId });
       return c2.json({
         success: true,
         document_id: result.documentId,
@@ -81174,6 +81323,51 @@ function registerMetaRoutes(app, ctx) {
   });
 }
 
+// src/web/routes/postgrest-proxy.ts
+var STRIP_RESPONSE_HEADERS = [
+  "connection",
+  "keep-alive",
+  "transfer-encoding",
+  "content-length",
+  "content-encoding",
+  "te",
+  "trailer",
+  "upgrade",
+  "proxy-authenticate",
+  "proxy-authorization"
+];
+function registerPostgrestProxy(app) {
+  const upstream = (process.env.CEREFOX_POSTGREST_UPSTREAM ?? "").trim().replace(/\/+$/, "");
+  if (!upstream)
+    return;
+  app.all("/rest/v1/*", async (c2) => {
+    const url = new URL(c2.req.url);
+    const path = url.pathname.replace(/^\/rest\/v1/, "");
+    const target = `${upstream}${path}${url.search}`;
+    const headers = new Headers(c2.req.raw.headers);
+    headers.delete("host");
+    headers.delete("accept-encoding");
+    const method = c2.req.method;
+    const init = { method, headers };
+    if (method !== "GET" && method !== "HEAD") {
+      init.body = c2.req.raw.body;
+      init.duplex = "half";
+    }
+    let resp;
+    try {
+      resp = await fetch(target, init);
+    } catch (err) {
+      return c2.json({
+        detail: `PostgREST upstream unreachable: ${err instanceof Error ? err.message : String(err)}`
+      }, 502);
+    }
+    const respHeaders = new Headers(resp.headers);
+    for (const h of STRIP_RESPONSE_HEADERS)
+      respHeaders.delete(h);
+    return new Response(resp.body, { status: resp.status, headers: respHeaders });
+  });
+}
+
 // src/web/routes/preferences.ts
 init_config();
 import { existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync5 } from "node:fs";
@@ -81371,6 +81565,7 @@ function buildApp(ctx = buildWebContext()) {
     app.post("/api/v1/ingest/file", ingest503);
     app.post("/api/v1/documents/:document_id/upload", ingest503);
   }
+  registerPostgrestProxy(app);
   const staticDir = resolveStaticDir();
   if (staticDir) {
     app.use("/static/*", serveStatic({
@@ -81744,7 +81939,10 @@ function registerRenameHusks(program2) {
   }
 }
 function buildProgram() {
-  const program2 = new Command("cerefox").description("Cerefox — user-owned shared memory for AI agents.").version(PKG_VERSION, "-v, --version", "Print the cerefox version and exit.").addOption(new Option("--json", "Emit machine-readable JSON on stdout instead of the default human text. " + "Available on read commands; ignored on commands without a JSON shape.").hideHelp()).showHelpAfterError("(run `cerefox --help` for usage)").enablePositionalOptions().addHelpText("after", "\nResource groups (run `cerefox <group> --help`):\n" + `  document   get · list · edit · delete · restore · ingest · ingest-dir · version {list·archive·unarchive}
+  const progName = process.env.CEREFOX_PROG_NAME || "cerefox";
+  const program2 = new Command(progName).description("Cerefox — user-owned shared memory for AI agents.").version(PKG_VERSION, "-v, --version", `Print the ${progName} version and exit.`).addOption(new Option("--json", "Emit machine-readable JSON on stdout instead of the default human text. " + "Available on read commands; ignored on commands without a JSON shape.").hideHelp()).showHelpAfterError(`(run \`${progName} --help\` for usage)`).enablePositionalOptions().addHelpText("after", `
+Resource groups (run \`${progName} <group> --help\`):
+` + `  document   get · list · edit · delete · restore · ingest · ingest-dir · version {list·archive·unarchive}
 ` + `  project    list · create · edit · delete
 ` + `  metadata   keys · search
 ` + `  audit      list
@@ -81766,8 +81964,8 @@ Exit codes:
 ` + `  1  user error         3  not found (document / version / project)
 ` + `
 Learn more:
-` + `  cerefox docs --list                     # bundled docs (offline)
-` + `  cerefox doctor                          # diagnose your install
+` + `  ${progName} guides list                  # bundled docs (offline)
+` + `  ${progName} doctor                       # diagnose your install
 ` + `  https://github.com/fstamatelopoulos/cerefox
 `);
   registerSearch(program2);