@cerefox/memory 1.10.1 → 1.12.0

package/dist/bin/cerefox.js

@@ -7440,7 +7440,7 @@ var exports_meta = {};
 __export(exports_meta, {
   PKG_VERSION: () => PKG_VERSION
 });
-var PKG_VERSION = "1.10.1";
+var PKG_VERSION = "1.12.0";
 var init_meta = () => {};
 
 // ../../_shared/config/paths.ts
@@ -7468,12 +7468,12 @@ function resolveConfigDir(opts = {}) {
   }
   const here = opts.cwd ?? processCwd();
   const cwdEnv = join(here, ".env");
-  if (existsSync(cwdEnv) && cwdEnvHasCerefoxKey(cwdEnv)) {
+  if (existsSync(cwdEnv) && envFileHasCerefoxKey(cwdEnv)) {
     return resolvePath(here);
   }
   return userState;
 }
-function cwdEnvHasCerefoxKey(envPath) {
+function envFileHasCerefoxKey(envPath) {
   try {
     const contents = readFileSync(envPath, "utf8");
     return /^\s*CEREFOX_[A-Z0-9_]+\s*=/m.test(contents);
@@ -7494,7 +7494,7 @@ function isDevMode(opts = {}) {
     return false;
   const here = opts.cwd ?? processCwd();
   const cwdEnv = join(here, ".env");
-  return existsSync(cwdEnv) && cwdEnvHasCerefoxKey(cwdEnv);
+  return existsSync(cwdEnv) && envFileHasCerefoxKey(cwdEnv);
 }
 var USER_STATE_DIR_NAME = ".cerefox";
 var init_paths = () => {};
@@ -7520,11 +7520,11 @@ function parseDotenv(content) {
   return result;
 }
 function loadEnv(opts = {}) {
-  if (_loaded) {
+  const envPath = resolveEnvFile(opts);
+  if (_loadedPath === envPath) {
     return { path: "(already loaded)", vars: 0 };
   }
-  _loaded = true;
-  const envPath = resolveEnvFile(opts);
+  _loadedPath = envPath;
   let content;
   try {
     content = readFileSync2(envPath, "utf8");
@@ -7555,7 +7555,7 @@ function loadSettings(opts = {}) {
     fireworksApiKey: env2.CEREFOX_FIREWORKS_API_KEY ?? ""
   };
 }
-var KV_LINE, _loaded = false;
+var KV_LINE, _loadedPath = null;
 var init_env = __esm(() => {
   init_paths();
   KV_LINE = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/;
@@ -7565,6 +7565,7 @@ var init_env = __esm(() => {
 var exports_config = {};
 __export(exports_config, {
   USER_STATE_DIR_NAME: () => USER_STATE_DIR_NAME,
+  envFileHasCerefoxKey: () => envFileHasCerefoxKey,
   isDevMode: () => isDevMode,
   loadEnv: () => loadEnv,
   loadSettings: () => loadSettings,
@@ -26002,7 +26003,7 @@ var init_bundled_docs = __esm(() => {
 });
 
 // ../../_shared/ef-meta/index.ts
-var EF_VERSION = "1.10.1", CEREFOX_VERSION = "1.10.1", EF_LAST_CHANGED = "1.10.1";
+var EF_VERSION = "1.12.0", CEREFOX_VERSION = "1.12.0", EF_LAST_CHANGED = "1.11.0";
 var init_ef_meta = () => {};
 
 // ../../_shared/compatibility/index.ts
@@ -43253,7 +43254,7 @@ var require_nodes = __commonJS(function(exports) {
   }
 });
 
-// ../../node_modules/.bun/@xmldom+xmldom@0.8.13/node_modules/@xmldom/xmldom/lib/conventions.js
+// ../../node_modules/.bun/@xmldom+xmldom@0.8.15/node_modules/@xmldom/xmldom/lib/conventions.js
 var require_conventions = __commonJS(function(exports) {
   function find(list, predicate, ac) {
     if (ac === undefined) {
@@ -43307,18 +43308,25 @@ var require_conventions = __commonJS(function(exports) {
     XML: "http://www.w3.org/XML/1998/namespace",
     XMLNS: "http://www.w3.org/2000/xmlns/"
   });
+  var nameStartChar = /[A-Z_a-z\xC0-\xD6\xD8-\xF6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD]/;
+  var nameChar = new RegExp("[\\-\\.0-9" + nameStartChar.source.slice(1, -1) + "\\u00B7\\u0300-\\u036F\\u203F-\\u2040]");
+  var tagNamePattern = new RegExp("^" + nameStartChar.source + nameChar.source + "*(?::" + nameStartChar.source + nameChar.source + "*)?$");
   exports.assign = assign;
   exports.find = find;
   exports.freeze = freeze;
   exports.MIME_TYPE = MIME_TYPE;
   exports.NAMESPACE = NAMESPACE;
+  exports.nameStartChar = nameStartChar;
+  exports.nameChar = nameChar;
+  exports.tagNamePattern = tagNamePattern;
 });
 
-// ../../node_modules/.bun/@xmldom+xmldom@0.8.13/node_modules/@xmldom/xmldom/lib/dom.js
+// ../../node_modules/.bun/@xmldom+xmldom@0.8.15/node_modules/@xmldom/xmldom/lib/dom.js
 var require_dom = __commonJS(function(exports) {
   var conventions = require_conventions();
   var find = conventions.find;
   var NAMESPACE = conventions.NAMESPACE;
+  var tagNamePattern = conventions.tagNamePattern;
   function notEmptyString(input) {
     return input !== "";
   }
@@ -43459,7 +43467,9 @@ var require_dom = __commonJS(function(exports) {
     return this[i] || null;
   };
   _extends(LiveNodeList, NodeList);
-  function NamedNodeMap() {}
+  function NamedNodeMap() {
+    this._nameIndex = Object.create(null);
+  }
   function _findNodeIndex(list, node) {
     var i = list.length;
     while (i--) {
@@ -43468,12 +43478,22 @@ var require_dom = __commonJS(function(exports) {
       }
     }
   }
+  function _nnmIndexAdd(list, attr) {
+    list._nameIndex[attr.nodeName] = attr;
+  }
+  function _nnmIndexRemove(list, attr) {
+    if (list._nameIndex[attr.nodeName] === attr) {
+      delete list._nameIndex[attr.nodeName];
+    }
+  }
   function _addNamedNode(el, list, newAttr, oldAttr) {
     if (oldAttr) {
       list[_findNodeIndex(list, oldAttr)] = newAttr;
+      _nnmIndexRemove(list, oldAttr);
     } else {
       list[list.length++] = newAttr;
     }
+    _nnmIndexAdd(list, newAttr);
     if (el) {
       newAttr.ownerElement = el;
       var doc = el.ownerDocument;
@@ -43491,6 +43511,7 @@ var require_dom = __commonJS(function(exports) {
         list[i] = list[++i];
       }
       list.length = lastIndex;
+      _nnmIndexRemove(list, attr);
       if (el) {
         var doc = el.ownerDocument;
         if (doc) {
@@ -43519,7 +43540,7 @@ var require_dom = __commonJS(function(exports) {
       if (el && el != this._ownerElement) {
         throw new DOMException(INUSE_ATTRIBUTE_ERR);
       }
-      var oldAttr = this.getNamedItem(attr.nodeName);
+      var oldAttr = this._nameIndex[attr.nodeName];
       _addNamedNode(this._ownerElement, this, attr, oldAttr);
       return oldAttr;
     },
@@ -43623,8 +43644,29 @@ var require_dom = __commonJS(function(exports) {
           while (child) {
             var next = child.nextSibling;
             if (next !== null && next.nodeType === TEXT_NODE && child.nodeType === TEXT_NODE) {
-              node.removeChild(next);
-              child.appendData(next.data);
+              var tail = [];
+              var sibling = next;
+              while (sibling !== null && sibling.nodeType === TEXT_NODE) {
+                tail.push(sibling.data);
+                sibling = sibling.nextSibling;
+              }
+              var removed = child.nextSibling;
+              while (removed !== sibling) {
+                var following = removed.nextSibling;
+                removed.parentNode = null;
+                removed.previousSibling = null;
+                removed.nextSibling = null;
+                removed = following;
+              }
+              child.nextSibling = sibling;
+              if (sibling !== null) {
+                sibling.previousSibling = child;
+              } else {
+                node.lastChild = child;
+              }
+              child.appendData(tail.join(""));
+              _onUpdateChild(node.ownerDocument, node);
+              child = sibling;
             } else {
               child = next;
             }
@@ -44082,6 +44124,9 @@ var require_dom = __commonJS(function(exports) {
       return node;
     },
     createEntityReference: function(name) {
+      if (!tagNamePattern.test(name)) {
+        throw new DOMException(INVALID_CHARACTER_ERR, 'not a valid xml name "' + name + '"');
+      }
       var node = new EntityReference;
       node.ownerDocument = this;
       node.nodeName = name;
@@ -44329,7 +44374,10 @@ var require_dom = __commonJS(function(exports) {
     }
     return true;
   }
-  function addSerializedAttribute(buf, qualifiedName, value) {
+  function addSerializedAttribute(buf, qualifiedName, value, requireWellFormed) {
+    if (requireWellFormed && !tagNamePattern.test(qualifiedName)) {
+      throw new DOMException(INVALID_STATE_ERR, 'The attribute name "' + qualifiedName + '" is not a valid XML QName');
+    }
     buf.push(" ", qualifiedName, '="', value.replace(/[<>&"\t\n\r]/g, _xmlEncoder), '"');
   }
   function serializeToString(node, buf, isHTML, nodeFilter, visibleNamespaces, requireWellFormed) {
@@ -44387,6 +44435,9 @@ var require_dom = __commonJS(function(exports) {
                 }
               }
             }
+            if (requireWellFormed && !tagNamePattern.test(prefixedNodeName)) {
+              throw new DOMException(INVALID_STATE_ERR, 'The element name "' + prefixedNodeName + '" is not a valid XML QName');
+            }
             buf.push("<", prefixedNodeName);
             var childNs = ns.slice();
             for (var i = 0;i < len; i++) {
@@ -44402,7 +44453,7 @@ var require_dom = __commonJS(function(exports) {
               if (needNamespaceDefine(attr, html, childNs)) {
                 var attrPrefix = attr.prefix || "";
                 var uri = attr.namespaceURI;
-                addSerializedAttribute(buf, attrPrefix ? "xmlns:" + attrPrefix : "xmlns", uri);
+                addSerializedAttribute(buf, attrPrefix ? "xmlns:" + attrPrefix : "xmlns", uri, requireWellFormed);
                 childNs.push({ prefix: attrPrefix, namespace: uri });
               }
               var filteredAttr = nodeFilter ? nodeFilter(attr) : attr;
@@ -44410,14 +44461,14 @@ var require_dom = __commonJS(function(exports) {
                 if (typeof filteredAttr === "string") {
                   buf.push(filteredAttr);
                 } else {
-                  addSerializedAttribute(buf, filteredAttr.name, filteredAttr.value);
+                  addSerializedAttribute(buf, filteredAttr.name, filteredAttr.value, requireWellFormed);
                 }
               }
             }
             if (nodeName === prefixedNodeName && needNamespaceDefine(n, html, childNs)) {
               var nodePrefix = n.prefix || "";
               var uri = n.namespaceURI;
-              addSerializedAttribute(buf, nodePrefix ? "xmlns:" + nodePrefix : "xmlns", uri);
+              addSerializedAttribute(buf, nodePrefix ? "xmlns:" + nodePrefix : "xmlns", uri, requireWellFormed);
               childNs.push({ prefix: nodePrefix, namespace: uri });
             }
             var child = n.firstChild;
@@ -44444,7 +44495,7 @@ var require_dom = __commonJS(function(exports) {
           case DOCUMENT_FRAGMENT_NODE:
             return { ns: ns.slice(), isHTML: html, tag: null };
           case ATTRIBUTE_NODE:
-            addSerializedAttribute(buf, n.name, n.value);
+            addSerializedAttribute(buf, n.name, n.value, requireWellFormed);
             return null;
           case TEXT_NODE:
             buf.push(n.data.replace(/[<&>]/g, _xmlEncoder));
@@ -44463,6 +44514,9 @@ var require_dom = __commonJS(function(exports) {
             return null;
           case DOCUMENT_TYPE_NODE:
             if (requireWellFormed) {
+              if (!tagNamePattern.test(n.name)) {
+                throw new DOMException(INVALID_STATE_ERR, 'The doctype name "' + n.name + '" is not a valid XML Name');
+              }
               if (n.publicId && !/^("[\x20\r\na-zA-Z0-9\-()+,.\/:=?;!*#@$_%']*"|'[\x20\r\na-zA-Z0-9\-()+,.\/:=?;!*#@$_%'"]*')$/.test(n.publicId)) {
                 throw new DOMException(INVALID_STATE_ERR, "DocumentType publicId is not a valid PubidLiteral");
               }
@@ -44493,12 +44547,20 @@ var require_dom = __commonJS(function(exports) {
             }
             return null;
           case PROCESSING_INSTRUCTION_NODE:
-            if (requireWellFormed && n.data.indexOf("?>") !== -1) {
-              throw new DOMException(INVALID_STATE_ERR, 'The ProcessingInstruction data contains "?>"');
+            if (requireWellFormed) {
+              if (!tagNamePattern.test(n.target) || n.target.indexOf(":") !== -1 || n.target.toLowerCase() === "xml") {
+                throw new DOMException(INVALID_STATE_ERR, 'The processing instruction target "' + n.target + '" is not a valid XML NCName or is reserved');
+              }
+              if (n.data.indexOf("?>") !== -1) {
+                throw new DOMException(INVALID_STATE_ERR, 'The ProcessingInstruction data contains "?>"');
+              }
             }
             buf.push("<?", n.target, " ", n.data, "?>");
             return null;
           case ENTITY_REFERENCE_NODE:
+            if (requireWellFormed && !tagNamePattern.test(n.nodeName)) {
+              throw new DOMException(INVALID_STATE_ERR, 'The entity reference name "' + n.nodeName + '" is not a valid XML Name');
+            }
             buf.push("&", n.nodeName, ";");
             return null;
           default:
@@ -44637,7 +44699,7 @@ var require_dom = __commonJS(function(exports) {
   exports.XMLSerializer = XMLSerializer;
 });
 
-// ../../node_modules/.bun/@xmldom+xmldom@0.8.13/node_modules/@xmldom/xmldom/lib/entities.js
+// ../../node_modules/.bun/@xmldom+xmldom@0.8.15/node_modules/@xmldom/xmldom/lib/entities.js
 var require_entities = __commonJS(function(exports) {
   var freeze = require_conventions().freeze;
   exports.XML_ENTITIES = freeze({
@@ -46778,12 +46840,10 @@ var require_entities = __commonJS(function(exports) {
   exports.entityMap = exports.HTML_ENTITIES;
 });
 
-// ../../node_modules/.bun/@xmldom+xmldom@0.8.13/node_modules/@xmldom/xmldom/lib/sax.js
+// ../../node_modules/.bun/@xmldom+xmldom@0.8.15/node_modules/@xmldom/xmldom/lib/sax.js
 var require_sax = __commonJS(function(exports) {
   var NAMESPACE = require_conventions().NAMESPACE;
-  var nameStartChar = /[A-Z_a-z\xC0-\xD6\xD8-\xF6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD]/;
-  var nameChar = new RegExp("[\\-\\.0-9" + nameStartChar.source.slice(1, -1) + "\\u00B7\\u0300-\\u036F\\u203F-\\u2040]");
-  var tagNamePattern = new RegExp("^" + nameStartChar.source + nameChar.source + "*(?::" + nameStartChar.source + nameChar.source + "*)?$");
+  var tagNamePattern = require_conventions().tagNamePattern;
   var S_TAG = 0;
   var S_ATTR = 1;
   var S_ATTR_SPACE = 2;
@@ -46872,7 +46932,7 @@ var require_sax = __commonJS(function(exports) {
         switch (source.charAt(tagStart + 1)) {
           case "/":
             var end = source.indexOf(">", tagStart + 3);
-            var tagName = source.substring(tagStart + 2, end).replace(/[ \t\n\r]+$/g, "");
+            var tagName = source.substring(tagStart + 2, end).replace(/^([\s\S]*?[^ \t\n\r])?[ \t\n\r]*$/, "$1");
             var config = parseStack.pop();
             if (end < 0) {
               tagName = source.substring(tagStart + 2).replace(/[\s<].*/, "");
@@ -46882,6 +46942,8 @@ var require_sax = __commonJS(function(exports) {
               tagName = tagName.replace(/[\s<].*/, "");
               errorHandler.error("end tag name: " + tagName + " maybe not complete");
               end = tagStart + 1 + tagName.length;
+            } else if (/[ \t\n\r]/.test(tagName) && tagNamePattern.test(tagName.split(/[ \t\n\r]/)[0])) {
+              errorHandler.error('end tag name is followed by whitespace and trailing content: "' + tagName + '"');
             }
             var localNSMap = config.localNSMap;
             var endMatch = config.tagName == tagName;
@@ -46978,6 +47040,9 @@ var require_sax = __commonJS(function(exports) {
     var s = S_TAG;
     while (true) {
       var c2 = source.charAt(p);
+      if (s === S_TAG && c2 === "<") {
+        throw new Error("unexpected < in tag name: " + source.slice(start, p));
+      }
       switch (c2) {
         case "=":
           if (s === S_ATTR) {
@@ -47145,7 +47210,7 @@ var require_sax = __commonJS(function(exports) {
       if (nsPrefix !== false) {
         if (localNSMap == null) {
           localNSMap = {};
-          _copy(currentNSMap, currentNSMap = {});
+          currentNSMap = Object.create(currentNSMap);
         }
         currentNSMap[nsPrefix] = localNSMap[nsPrefix] = value;
         a.uri = NAMESPACE.XMLNS;
@@ -47334,7 +47399,7 @@ var require_sax = __commonJS(function(exports) {
   exports.ParseError = ParseError;
 });
 
-// ../../node_modules/.bun/@xmldom+xmldom@0.8.13/node_modules/@xmldom/xmldom/lib/dom-parser.js
+// ../../node_modules/.bun/@xmldom+xmldom@0.8.15/node_modules/@xmldom/xmldom/lib/dom-parser.js
 var require_dom_parser = __commonJS(function(exports) {
   var conventions = require_conventions();
   var dom = require_dom();
@@ -47537,7 +47602,7 @@ var require_dom_parser = __commonJS(function(exports) {
   exports.DOMParser = DOMParser;
 });
 
-// ../../node_modules/.bun/@xmldom+xmldom@0.8.13/node_modules/@xmldom/xmldom/lib/index.js
+// ../../node_modules/.bun/@xmldom+xmldom@0.8.15/node_modules/@xmldom/xmldom/lib/index.js
 var require_lib5 = __commonJS(function(exports) {
   var dom = require_dom();
   exports.DOMImplementation = dom.DOMImplementation;
@@ -55096,9 +55161,13 @@ var init_audit_log = __esm(() => {
   };
 });
 
+// ../../_shared/mcp-tools/access-paths.ts
+var init_access_paths = () => {};
+
 // ../../_shared/mcp-tools/types.ts
 var McpInvalidParams;
 var init_types3 = __esm(() => {
+  init_access_paths();
   McpInvalidParams = class McpInvalidParams extends Error {
     constructor(message) {
       super(message);
@@ -66863,13 +66932,32 @@ var require_data = __commonJS(function(exports, module) {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/utils.js
 var require_utils2 = __commonJS(function(exports, module) {
   var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
   var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+  var isPort = RegExp.prototype.test.bind(/^\d*$/u);
   var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
   var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
-  var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+  var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
+  var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
+  var isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
+  var BYTE_HEX = new Array(256);
+  {
+    const HEX_DIGITS = "0123456789ABCDEF";
+    for (let i = 0;i < 256; i++) {
+      BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
+    }
+  }
+  function percentEncodeNonAscii(cp) {
+    if (cp < 2048) {
+      return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
+    }
+    if (cp < 65536) {
+      return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+    }
+    return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+  }
   function stringArrayToHexStripped(input) {
     let acc = "";
     let code = 0;
@@ -66894,91 +66982,122 @@ var require_utils2 = __commonJS(function(exports, module) {
     }
     return acc;
   }
+  var isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/);
+  var isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/);
+  var isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/);
   var nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
-  function consumeIsZone(buffer2) {
-    buffer2.length = 0;
-    return true;
-  }
-  function consumeHextets(buffer2, address, output) {
-    if (buffer2.length) {
-      const hex = stringArrayToHexStripped(buffer2);
-      if (hex !== "") {
-        address.push(hex);
-      } else {
-        output.error = true;
-        return false;
+  function isZoneIdentifier(zone) {
+    if (zone.length === 0)
+      return false;
+    for (let i = 0;i < zone.length; i++) {
+      if (isZoneCharacter(zone[i]))
+        continue;
+      if (zone[i] === "%" && i + 2 < zone.length && isHexPair(zone.slice(i + 1, i + 3))) {
+        i += 2;
+        continue;
       }
-      buffer2.length = 0;
+      return false;
     }
     return true;
   }
-  function getIPV6(input) {
-    let tokenCount = 0;
-    const output = { error: false, address: "", zone: "" };
-    const address = [];
-    const buffer2 = [];
-    let endipv6Encountered = false;
-    let endIpv6 = false;
-    let consume = consumeHextets;
-    for (let i = 0;i < input.length; i++) {
-      const cursor = input[i];
-      if (cursor === "[" || cursor === "]") {
-        continue;
-      }
-      if (cursor === ":") {
-        if (endipv6Encountered === true) {
-          endIpv6 = true;
-        }
-        if (!consume(buffer2, address, output)) {
-          break;
-        }
-        if (++tokenCount > 7) {
-          output.error = true;
-          break;
+  function compressIPv6ZeroRun(hextets) {
+    let bestStart = -1;
+    let bestLength = 0;
+    let runStart = -1;
+    let runLength = 0;
+    for (let i = 0;i < hextets.length; i++) {
+      if (hextets[i] === "0") {
+        if (runStart === -1)
+          runStart = i;
+        runLength++;
+        if (runLength > bestLength) {
+          bestLength = runLength;
+          bestStart = runStart;
         }
-        if (i > 0 && input[i - 1] === ":") {
-          endipv6Encountered = true;
-        }
-        address.push(":");
-        continue;
-      } else if (cursor === "%") {
-        if (!consume(buffer2, address, output)) {
-          break;
-        }
-        consume = consumeIsZone;
       } else {
-        buffer2.push(cursor);
-        continue;
+        runStart = -1;
+        runLength = 0;
       }
     }
-    if (buffer2.length) {
-      if (consume === consumeIsZone) {
-        output.zone = buffer2.join("");
-      } else if (endIpv6) {
-        address.push(buffer2.join(""));
-      } else {
-        address.push(stringArrayToHexStripped(buffer2));
+    if (bestLength < 2)
+      return hextets.join(":");
+    const head2 = hextets.slice(0, bestStart).join(":");
+    const tail = hextets.slice(bestStart + bestLength).join(":");
+    return head2 + "::" + tail;
+  }
+  function normalizeIPv6Address(input) {
+    const compression = input.indexOf("::");
+    if (compression !== -1 && input.indexOf("::", compression + 1) !== -1)
+      return;
+    const left = compression === -1 ? input.split(":") : input.slice(0, compression).split(":");
+    const right = compression === -1 ? [] : input.slice(compression + 2).split(":");
+    if (compression !== -1) {
+      if (left.length === 1 && left[0] === "")
+        left.length = 0;
+      if (right.length === 1 && right[0] === "")
+        right.length = 0;
+    }
+    const parts = left.concat(right);
+    let hextetCount = 0;
+    for (let i = 0;i < parts.length; i++) {
+      const part = parts[i];
+      if (part === "")
+        return;
+      if (part.indexOf(".") !== -1) {
+        if (i !== parts.length - 1 || compression !== -1 && right.length === 0 || !isIPv4(part))
+          return;
+        hextetCount += 2;
+        continue;
       }
+      if (!isHextet(part))
+        return;
+      parts[i] = parseInt(part, 16).toString(16);
+      hextetCount++;
     }
-    output.address = address.join("");
-    return output;
+    if (compression === -1) {
+      if (hextetCount !== 8)
+        return;
+      return compressIPv6ZeroRun(parts);
+    }
+    if (hextetCount >= 8)
+      return;
+    const expanded = parts.slice(0, left.length);
+    for (let i = hextetCount;i < 8; i++)
+      expanded.push("0");
+    for (let i = left.length;i < parts.length; i++)
+      expanded.push(parts[i]);
+    return compressIPv6ZeroRun(expanded);
   }
   function normalizeIPv6(host) {
-    if (findToken(host, ":") < 2) {
-      return { host, isIPV6: false };
-    }
-    const ipv62 = getIPV6(host);
-    if (!ipv62.error) {
-      let newHost = ipv62.address;
-      let escapedHost = ipv62.address;
-      if (ipv62.zone) {
-        newHost += "%" + ipv62.zone;
-        escapedHost += "%25" + ipv62.zone;
-      }
-      return { host: newHost, isIPV6: true, escapedHost };
-    } else {
-      return { host, isIPV6: false };
-    }
+    const bracketed = host[0] === "[" && host[host.length - 1] === "]";
+    const hasBracket = host[0] === "[" || host[host.length - 1] === "]";
+    if (hasBracket && !bracketed)
+      return { host, isIPV6: false, error: true };
+    let input = bracketed ? host.slice(1, -1) : host;
+    if (bracketed && isIPvFuture(input)) {
+      input = input.toLowerCase();
+      return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true };
+    }
+    if (findToken(input, ":") < 2) {
+      return { host, isIPV6: false, error: bracketed };
+    }
+    let zoneIdentifier = "";
+    const zoneSeparator = input.indexOf("%");
+    if (zoneSeparator !== -1) {
+      const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === "%25" ? 3 : 1;
+      zoneIdentifier = input.slice(zoneSeparator + separatorLength);
+      if (!isZoneIdentifier(zoneIdentifier))
+        return { host, isIPV6: false, error: true };
+      input = input.slice(0, zoneSeparator);
+    }
+    const address = normalizeIPv6Address(input);
+    if (address === undefined)
+      return { host, isIPV6: false, error: true };
+    return {
+      host: address + (zoneIdentifier ? "%" + zoneIdentifier : ""),
+      escapedHost: address + (zoneIdentifier ? "%25" + zoneIdentifier : ""),
+      isIPV6: true
+    };
   }
   function findToken(str, token) {
     let ind = 0;
@@ -67098,7 +67217,8 @@ var require_utils2 = __commonJS(function(exports, module) {
   function normalizePathEncoding(input) {
     let output = "";
     for (let i = 0;i < input.length; i++) {
-      if (input[i] === "%" && i + 2 < input.length) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
         const hex = input.slice(i + 1, i + 3);
         if (isHexPair(hex)) {
           const normalizedHex = hex.toUpperCase();
@@ -67112,10 +67232,152 @@ var require_utils2 = __commonJS(function(exports, module) {
           continue;
         }
       }
-      if (isPathCharacter(input[i])) {
-        output += input[i];
+      if (isPathCharacter(ch)) {
+        output += ch;
+      } else {
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function serializePathEncoding(input, pathNoScheme = false) {
+    let output = "";
+    let firstSegment = pathNoScheme && input[0] !== "/";
+    for (let i = 0;i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          output += "%" + hex.toUpperCase();
+          i += 2;
+          continue;
+        }
+      }
+      if (ch === "/") {
+        firstSegment = false;
+      }
+      if (isPathCharacter(ch) && (ch !== ":" || !firstSegment)) {
+        output += ch;
+      } else {
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function encodeComponent(input, isAllowed) {
+    let output = "";
+    for (let i = 0;i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          output += "%" + hex.toUpperCase();
+          i += 2;
+          continue;
+        }
+      }
+      if (isAllowed(ch)) {
+        output += ch;
+      } else {
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function encodeUserinfo(input) {
+    return encodeComponent(input, isUserinfoCharacter);
+  }
+  function encodeQuery(input) {
+    return encodeComponent(input, isQueryFragmentCharacter);
+  }
+  function encodeFragment(input) {
+    return encodeComponent(input, isQueryFragmentCharacter);
+  }
+  function isEscapeSafe(cp) {
+    return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+  }
+  function normalizeQueryFragmentEncoding(input) {
+    let output = "";
+    for (let i = 0;i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          const normalizedHex = hex.toUpperCase();
+          const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+          if (isUnreserved(decoded)) {
+            output += decoded;
+          } else {
+            output += "%" + normalizedHex;
+          }
+          i += 2;
+          continue;
+        }
+      }
+      if (isQueryFragmentCharacter(ch)) {
+        output += ch;
       } else {
-        output += escape(input[i]);
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
       }
     }
     return output;
@@ -67138,14 +67400,18 @@ var require_utils2 = __commonJS(function(exports, module) {
   function recomposeAuthority(component) {
     const uriTokens = [];
     if (component.userinfo !== undefined) {
-      uriTokens.push(component.userinfo);
+      uriTokens.push(encodeUserinfo(component.userinfo));
       uriTokens.push("@");
     }
     if (component.host !== undefined) {
-      let host = unescape(component.host);
+      let host = component.host;
       if (!isIPv4(host)) {
-        const ipV6res = normalizeIPv6(host);
-        if (ipV6res.isIPV6 === true) {
+        let ipV6res = normalizeIPv6(host);
+        if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+          host = normalizePercentEncoding(host, true);
+          ipV6res = normalizeIPv6(host);
+        }
+        if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
           host = `[${ipV6res.escapedHost}]`;
         } else {
           host = reescapeHostDelimiters(host, false);
@@ -67154,8 +67420,12 @@ var require_utils2 = __commonJS(function(exports, module) {
       uriTokens.push(host);
     }
     if (typeof component.port === "number" || typeof component.port === "string") {
+      const port = String(component.port);
+      if (!isPort(port)) {
+        throw new TypeError("URI port is malformed.");
+      }
       uriTokens.push(":");
-      uriTokens.push(String(component.port));
+      uriTokens.push(port);
     }
     return uriTokens.length ? uriTokens.join("") : undefined;
   }
@@ -67165,6 +67435,11 @@ var require_utils2 = __commonJS(function(exports, module) {
     reescapeHostDelimiters,
     normalizePercentEncoding,
     normalizePathEncoding,
+    serializePathEncoding,
+    normalizeQueryFragmentEncoding,
+    encodeUserinfo,
+    encodeQuery,
+    encodeFragment,
     escapePreservingEscapes,
     removeDotSegments,
     isIPv4,
@@ -67174,10 +67449,10 @@ var require_utils2 = __commonJS(function(exports, module) {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS(function(exports, module) {
   var { isUUID } = require_utils2();
-  var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
+  var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
   var supportedSchemeNames = [
     "http",
     "https",
@@ -67232,9 +67507,10 @@ var require_schemes = __commonJS(function(exports, module) {
       wsComponent.secure = undefined;
     }
     if (wsComponent.resourceName) {
-      const [path, query] = wsComponent.resourceName.split("?");
+      const queryIndex = wsComponent.resourceName.indexOf("?");
+      const path = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
       wsComponent.path = path && path !== "/" ? path : undefined;
-      wsComponent.query = query;
+      wsComponent.query = queryIndex === -1 ? undefined : wsComponent.resourceName.slice(queryIndex + 1);
       wsComponent.resourceName = undefined;
     }
     wsComponent.fragment = undefined;
@@ -67246,7 +67522,7 @@ var require_schemes = __commonJS(function(exports, module) {
       return urnComponent;
     }
     const matches = urnComponent.path.match(URN_REG);
-    if (matches) {
+    if (matches && matches[0] === urnComponent.path) {
       const scheme = options.scheme || urnComponent.scheme || "urn";
       urnComponent.nid = matches[1].toLowerCase();
       urnComponent.nss = matches[2];
@@ -67348,10 +67624,19 @@ var require_schemes = __commonJS(function(exports, module) {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.5/node_modules/fast-uri/index.js
+// ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS(function(exports, module) {
-  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils2();
+  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils2();
   var { SCHEMES, getSchemeHandler } = require_schemes();
+  var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
+  var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+  function decodeValidScheme(scheme) {
+    const decodedScheme = unescape(String(scheme));
+    if (!VALID_SCHEME.test(decodedScheme)) {
+      throw new TypeError(MALFORMED_SCHEME_ERROR);
+    }
+    return decodedScheme;
+  }
   function normalize(uri, options) {
     if (typeof uri === "string") {
       uri = normalizeString(uri, options);
@@ -67362,12 +67647,34 @@ var require_fast_uri = __commonJS(function(exports, module) {
   }
   function resolve4(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-    const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
-    const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
-    if (baseMalformed || relativeMalformed) {
+    const {
+      parsed: baseParsed,
+      malformedAuthorityOrPort: baseMalformed,
+      malformedPercentEncoding: baseMalformedPercentEncoding,
+      malformedSchemeSpecific: baseMalformedSchemeSpecific,
+      malformedHost: baseMalformedHost,
+      malformedScheme: baseMalformedScheme
+    } = parseWithStatus(baseURI, schemelessOptions);
+    const {
+      parsed: relativeParsed,
+      malformedAuthorityOrPort: relativeMalformed,
+      malformedPercentEncoding: relativeMalformedPercentEncoding,
+      malformedSchemeSpecific: relativeMalformedSchemeSpecific,
+      malformedHost: relativeMalformedHost,
+      malformedScheme: relativeMalformedScheme
+    } = parseWithStatus(relativeURI, schemelessOptions);
+    if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
       throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
     }
     const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
+    const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
+    const resolvedHost = resolved.host;
+    const resolvedHostIsIP = resolvedHost !== undefined && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+    canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
+    const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !/\P{ASCII}/u.test(resolvedHost);
+    if (resolved.error && !encodedASCIIHost) {
+      throw new Error(resolved.error);
+    }
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
@@ -67427,7 +67734,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
   function equal(uriA, uriB, options) {
     const normalizedA = normalizeComparableURI(uriA, options);
     const normalizedB = normalizeComparableURI(uriB, options);
-    return normalizedA !== undefined && normalizedB !== undefined && normalizedA.toLowerCase() === normalizedB.toLowerCase();
+    return normalizedA !== undefined && normalizedB !== undefined && normalizedA === normalizedB;
   }
   function serialize(cmpts, opts) {
     const component = {
@@ -67448,20 +67755,23 @@ var require_fast_uri = __commonJS(function(exports, module) {
     };
     const options = Object.assign({}, opts);
     const uriTokens = [];
+    if (component.scheme) {
+      component.scheme = decodeValidScheme(component.scheme);
+    }
     const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
     if (schemeHandler && schemeHandler.serialize)
       schemeHandler.serialize(component, options);
+    const hasAuthority = component.userinfo !== undefined || component.host !== undefined || component.port !== undefined;
+    const pathNoScheme = !options.skipEscape && component.scheme === undefined && !hasAuthority;
     if (component.path !== undefined) {
       if (!options.skipEscape) {
-        component.path = escapePreservingEscapes(component.path);
-        if (component.scheme !== undefined) {
-          component.path = component.path.split("%3A").join(":");
-        }
+        component.path = serializePathEncoding(component.path, pathNoScheme);
       } else {
         component.path = normalizePercentEncoding(component.path);
       }
     }
     if (options.reference !== "suffix" && component.scheme) {
+      component.scheme = decodeValidScheme(component.scheme);
       uriTokens.push(component.scheme, ":");
     }
     const authority = recomposeAuthority(component);
@@ -67479,16 +67789,19 @@ var require_fast_uri = __commonJS(function(exports, module) {
       if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
         s = removeDotSegments(s);
       }
+      if (pathNoScheme) {
+        s = serializePathEncoding(s, true);
+      }
       if (authority === undefined && s[0] === "/" && s[1] === "/") {
         s = "/%2F" + s.slice(2);
       }
       uriTokens.push(s);
     }
     if (component.query !== undefined) {
-      uriTokens.push("?", component.query);
+      uriTokens.push("?", encodeQuery(component.query));
     }
     if (component.fragment !== undefined) {
-      uriTokens.push("#", component.fragment);
+      uriTokens.push("#", encodeFragment(component.fragment));
     }
     return uriTokens.join("");
   }
@@ -67504,6 +67817,36 @@ var require_fast_uri = __commonJS(function(exports, module) {
     }
     return;
   }
+  function hasMalformedPercentEncoding(component) {
+    if (component === undefined)
+      return false;
+    let percent = component.indexOf("%");
+    while (percent !== -1) {
+      if (percent + 2 >= component.length || !/^[\da-f]{2}$/iu.test(component.slice(percent + 1, percent + 3))) {
+        return true;
+      }
+      percent = component.indexOf("%", percent + 3);
+    }
+    return false;
+  }
+  function isIPLiteral(host) {
+    return host[0] === "[" && host[host.length - 1] === "]";
+  }
+  function hasMalformedComponentPercentEncoding(matches) {
+    const host = matches[4];
+    return hasMalformedPercentEncoding(matches[3]) || host !== undefined && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+  }
+  function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+    if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+      try {
+        parsed.host = new URL("http://" + parsed.host).hostname;
+      } catch (e) {
+        parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+        return true;
+      }
+    }
+    return false;
+  }
   function parseWithStatus(uri, opts) {
     const options = Object.assign({}, opts);
     const parsed = {
@@ -67516,6 +67859,11 @@ var require_fast_uri = __commonJS(function(exports, module) {
       fragment: undefined
     };
     let malformedAuthorityOrPort = false;
+    let malformedPercentEncoding = false;
+    let malformedSchemeSpecific = false;
+    let malformedHost = false;
+    let malformedIPLiteral = false;
+    let malformedScheme = false;
     let isIP = false;
     if (options.reference === "suffix") {
       if (options.scheme) {
@@ -67552,6 +67900,19 @@ var require_fast_uri = __commonJS(function(exports, module) {
       parsed.path = matches[6] || "";
       parsed.query = matches[7];
       parsed.fragment = matches[8];
+      if (parsed.scheme !== undefined) {
+        const decodedScheme = unescape(parsed.scheme);
+        if (VALID_SCHEME.test(decodedScheme)) {
+          parsed.scheme = decodedScheme.toLowerCase();
+        } else {
+          parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
+          malformedScheme = true;
+        }
+      }
+      malformedPercentEncoding = hasMalformedComponentPercentEncoding(matches);
+      if (malformedPercentEncoding) {
+        parsed.error = parsed.error || "URI contains malformed percent-encoding.";
+      }
       if (isNaN(parsed.port)) {
         parsed.port = matches[5];
       }
@@ -67563,9 +67924,16 @@ var require_fast_uri = __commonJS(function(exports, module) {
       if (parsed.host) {
         const ipv4result = isIPv4(parsed.host);
         if (ipv4result === false) {
+          const bracketedIPLiteral = isIPLiteral(parsed.host);
+          const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
           const ipv6result = normalizeIPv6(parsed.host);
-          parsed.host = ipv6result.host.toLowerCase();
-          isIP = ipv6result.isIPV6;
+          isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
+          malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
+          parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
+          if (malformedIPLiteral) {
+            parsed.error = parsed.error || "URI host is malformed.";
+            malformedAuthorityOrPort = true;
+          }
         } else {
           isIP = true;
         }
@@ -67583,42 +67951,36 @@ var require_fast_uri = __commonJS(function(exports, module) {
         parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
       }
       const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-        if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
-          try {
-            parsed.host = new URL("http://" + parsed.host).hostname;
-          } catch (e) {
-            parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
-          }
-        }
+      if (!malformedIPLiteral) {
+        malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
       }
       if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
         if (uri.indexOf("%") !== -1) {
-          if (parsed.scheme !== undefined) {
-            parsed.scheme = unescape(parsed.scheme);
-          }
-          if (parsed.host !== undefined) {
-            parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+          if (parsed.host !== undefined && !malformedIPLiteral) {
+            const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+            parsed.host = reescapeHostDelimiters(host, isIP);
           }
         }
         if (parsed.path) {
           parsed.path = normalizePathEncoding(parsed.path);
         }
+        if (parsed.query) {
+          parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+        }
         if (parsed.fragment) {
-          try {
-            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
-          } catch {
-            parsed.error = parsed.error || "URI malformed";
-          }
+          parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
         }
       }
       if (schemeHandler && schemeHandler.parse) {
         schemeHandler.parse(parsed, options);
+        if (schemeHandler === SCHEMES.urn && parsed.nid === undefined) {
+          malformedSchemeSpecific = true;
+        }
       }
     } else {
       parsed.error = parsed.error || "URI can not be parsed.";
     }
-    return { parsed, malformedAuthorityOrPort };
+    return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
   }
   function parse8(uri, opts) {
     return parseWithStatus(uri, opts).parsed;
@@ -67627,20 +67989,28 @@ var require_fast_uri = __commonJS(function(exports, module) {
     return normalizeStringWithStatus(uri, opts).normalized;
   }
   function normalizeStringWithStatus(uri, opts) {
-    const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+    const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
     return {
-      normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
-      malformedAuthorityOrPort
+      normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+      malformedAuthorityOrPort,
+      malformedPercentEncoding,
+      malformedSchemeSpecific,
+      malformedHost,
+      malformedScheme
     };
   }
   function normalizeComparableURI(uri, opts) {
-    if (typeof uri === "string") {
-      const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
-      return malformedAuthorityOrPort ? undefined : normalized;
+    if (typeof uri !== "string" && typeof uri !== "object") {
+      return;
     }
-    if (typeof uri === "object") {
-      return serialize(uri, opts);
+    let value;
+    try {
+      value = typeof uri === "string" ? uri : serialize(uri, opts);
+    } catch {
+      return;
     }
+    const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
+    return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized;
   }
   var fastUri = {
     SCHEMES,
@@ -73587,6 +73957,7 @@ Proceed with deployment to Supabase?`, true);
 ▶  Deploying ${efNames.length} Edge Function(s)…`));
     let efOk = 0;
     const efFailed = [];
+    const efOutput = [];
     for (const ef of efNames) {
       info(`   deploying ${ef}…`);
       const workdir = assets.functionsDir.replace(/\/functions$/, "").replace(/\/supabase$/, "");
@@ -73599,19 +73970,40 @@ Proceed with deployment to Supabase?`, true);
       }
       const r = spawnSync2("npx", args, {
         encoding: "utf8",
-        stdio: "inherit",
+        stdio: ["inherit", "pipe", "pipe"],
         cwd: workdir,
         timeout: 120000
       });
+      if (r.stdout)
+        process.stdout.write(r.stdout);
+      if (r.stderr)
+        process.stderr.write(r.stderr);
       if (r.status === 0)
         efOk++;
-      else
+      else {
         efFailed.push(ef);
+        efOutput.push(`${r.stdout ?? ""}
+${r.stderr ?? ""}`);
+      }
     }
     if (efFailed.length > 0) {
       eprintln(c.red(`
 ✗ ${efFailed.length} Edge Function(s) failed: ${efFailed.join(", ")}`));
-      eprintln(c.dim("   Re-run `cerefox server deploy --functions-only` after fixing the cause."));
+      if (upstreamRegistryRace(efOutput.join(`
+`))) {
+        eprintln("");
+        eprintln(c.yellow("   This looks like an UPSTREAM package-registry race, not a problem"));
+        eprintln(c.yellow("   with your Cerefox install:"));
+        eprintln(c.dim("     The Edge Functions import `jsr:@supabase/supabase-js@2`. When Supabase"));
+        eprintln(c.dim("     publishes a new version, JSR and npm do not land at the same instant;"));
+        eprintln(c.dim("     a deploy in that gap resolves a JSR package whose npm dependency is not"));
+        eprintln(c.dim("     published yet, and bundling fails."));
+        eprintln(c.dim("     Your deployed functions were NOT changed — the previous version is"));
+        eprintln(c.dim("     still serving, so nothing is down."));
+        eprintln(c.cyan("   → Wait a few minutes, then re-run: cerefox server deploy --functions-only"));
+      } else {
+        eprintln(c.dim("   Re-run `cerefox server deploy --functions-only` after fixing the cause."));
+      }
       process.exit(1);
     }
     println(c.green(`   ✓ Deployed ${efOk} Edge Function(s).`));
@@ -73639,6 +74031,9 @@ Proceed with deployment to Supabase?`, true);
   println(c.dim("Verify with: cerefox doctor"));
   println(c.dim("Refresh the bundled guides: cerefox guides ingest"));
 }
+function upstreamRegistryRace(output) {
+  return /Failed to bundle the function/i.test(output) && /Could not find npm package/i.test(output);
+}
 function registerDeployServer(program2) {
   program2.command("deploy-server").description("Deploy/update the Cerefox server side (schema + RPCs + Edge Functions) on Supabase.").option("--dry-run", "Print the plan + pre-flight without deploying.").option("--schema-only", "Deploy/update only the schema + RPCs (skip Edge Functions).").option("--functions-only", "Deploy only the Edge Functions (skip the schema/RPCs).").option("--project-ref <ref>", "Supabase project ref for Edge Function deploys (default: derived from CEREFOX_SUPABASE_URL).").option("--yes", "Non-interactive (skip the deployment confirmation).").action(action10);
 }
@@ -77982,21 +78377,22 @@ function checkMcpConfigs() {
     detail: found.join(", ")
   };
 }
-function checkLegacyShadowEnv() {
-  const home = homedir6();
-  const homeEnv = join9(home, USER_STATE_DIR_NAME, ".env");
-  const cwdEnv = join9(process.cwd(), ".env");
-  if (!existsSync10(homeEnv) || !existsSync10(cwdEnv))
+function checkLegacyShadowEnv(opts = {}) {
+  const activeEnv = resolveEnvFile(opts);
+  const cwdEnv = join9(opts.cwd ?? process.cwd(), ".env");
+  if (!existsSync10(activeEnv) || !existsSync10(cwdEnv))
     return null;
   try {
-    if (realpathSync(homeEnv) === realpathSync(cwdEnv))
+    if (realpathSync(activeEnv) === realpathSync(cwdEnv))
       return null;
   } catch {}
+  if (!envFileHasCerefoxKey(cwdEnv))
+    return null;
   return {
     name: "legacy env",
     status: "skipped",
-    detail: `${cwdEnv} (shadowed by ~/.cerefox/.env)`,
-    hint: "Shadowed by ~/.cerefox/.env and no longer read by anything (Python was removed at v1.0.0). Safe to delete."
+    detail: `${cwdEnv} (shadowed by ${activeEnv})`,
+    hint: `Shadowed by ${activeEnv} and no longer read by anything (Python was removed at v1.0.0). Safe to delete.`
   };
 }
 async function checkPostgres() {
@@ -80929,11 +81325,10 @@ function registerStatus(program2) {
   program2.command("status").description("Quick sanity check (fast subset of `cerefox doctor`).").option("--json", "Emit machine-readable JSON.").action(action34);
 }
 
-// src/cli/commands/token.ts
+// src/cli/commands/api-key.ts
 init_cli_core();
 init_config();
 import { randomBytes } from "node:crypto";
-import { spawnSync as spawnSync7 } from "node:child_process";
 
 // src/cli/util/env-file.ts
 import { copyFileSync as copyFileSync3, existsSync as existsSync14, readFileSync as readFileSync15, writeFileSync as writeFileSync5 } from "node:fs";
@@ -80998,14 +81393,214 @@ function envGitignoreWarning(path) {
   }
 }
 
+// ../../node_modules/.bun/@hono+node-server@2.0.12+19b9adbcbc3b652f/node_modules/@hono/node-server/dist/conninfo.mjs
+var getConnInfo = (c2) => {
+  const bindings = c2.env.server ? c2.env.server : c2.env;
+  const address = bindings.incoming.socket.remoteAddress;
+  const port = bindings.incoming.socket.remotePort;
+  const family = bindings.incoming.socket.remoteFamily;
+  return { remote: {
+    address,
+    port,
+    addressType: family === "IPv4" ? "IPv4" : family === "IPv6" ? "IPv6" : undefined
+  } };
+};
+
+// ../../_shared/mcp-auth/index.ts
+function constantTimeEqual(a, b2) {
+  const ab = new TextEncoder().encode(a);
+  const bb = new TextEncoder().encode(b2);
+  const len = Math.max(ab.length, bb.length);
+  let diff = ab.length ^ bb.length;
+  for (let i = 0;i < len; i++) {
+    diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
+  }
+  return diff === 0;
+}
+
+// ../../_shared/ef-auth/index.ts
+function parseAccessTokens(raw) {
+  if (!raw)
+    return [];
+  return raw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+}
+var BEARER_PREFIX = "Bearer ";
+function checkAccessToken(authorizationHeader, config2) {
+  if (!authorizationHeader || !authorizationHeader.startsWith(BEARER_PREFIX)) {
+    return { ok: false, reason: "no_token" };
+  }
+  const token = authorizationHeader.slice(BEARER_PREFIX.length).trim();
+  if (!token)
+    return { ok: false, reason: "no_token" };
+  if (config2.tokens.length === 0) {
+    return {
+      ok: false,
+      reason: "no_tokens_configured",
+      detail: "CEREFOX_ACCESS_TOKENS is unset/empty; refusing to accept-all"
+    };
+  }
+  let matched = false;
+  for (const accepted of config2.tokens) {
+    if (constantTimeEqual(token, accepted))
+      matched = true;
+  }
+  return matched ? { ok: true } : { ok: false, reason: "bad_token" };
+}
+
+// src/web/auth.ts
+var API_KEY_PREFIX = "cfx_lak_";
+var LOOPBACK_ADDRESSES = new Set([
+  "127.0.0.1",
+  "::1",
+  "::ffff:127.0.0.1"
+]);
+function isLoopbackAddress(address) {
+  if (!address)
+    return false;
+  return LOOPBACK_ADDRESSES.has(address.trim().toLowerCase());
+}
+function decideAuth(input) {
+  const keys = input.configuredKeys.trim();
+  if (!keys)
+    return { allow: true, reason: "disabled" };
+  const local = isLoopbackAddress(input.remoteAddress);
+  if (local && !input.requireKeyEverywhere) {
+    return { allow: true, reason: "loopback" };
+  }
+  const result = checkAccessToken(input.authorization, {
+    tokens: parseAccessTokens(keys)
+  });
+  if (result.ok)
+    return { allow: true, reason: "valid_key" };
+  if (result.reason === "no_token") {
+    return {
+      allow: false,
+      reason: "no_key",
+      message: local ? "This server requires an API key on every request (CEREFOX_API_REQUIRE_KEY is set). " + "Send it as `Authorization: Bearer <key>`." : "This request did not come from the local machine, so it needs the server's API key " + "as `Authorization: Bearer <key>`. Print it with `cerefox api-key show` " + "(or `cerefox-local api-key` for a container install)."
+    };
+  }
+  return {
+    allow: false,
+    reason: "bad_key",
+    message: "The API key presented is not valid for this server."
+  };
+}
+function apiAuth() {
+  return async (c2, next) => {
+    const decision = decideAuth({
+      remoteAddress: remoteAddressOf(c2),
+      authorization: c2.req.header("Authorization") ?? null,
+      configuredKeys: process.env.CEREFOX_API_KEY ?? "",
+      requireKeyEverywhere: (process.env.CEREFOX_API_REQUIRE_KEY ?? "") === "1"
+    });
+    if (decision.allow)
+      return next();
+    return c2.json({ detail: decision.message }, 401, {
+      "WWW-Authenticate": 'Bearer realm="cerefox"'
+    });
+  };
+}
+function remoteAddressOf(c2) {
+  try {
+    return getConnInfo(c2).remote.address;
+  } catch {
+    return;
+  }
+}
+
+// src/cli/commands/api-key.ts
+var ENV_NAME = "CEREFOX_API_KEY";
+function mint() {
+  return API_KEY_PREFIX + randomBytes(32).toString("base64url");
+}
+function mask(key) {
+  const body = key.startsWith(API_KEY_PREFIX) ? key.slice(API_KEY_PREFIX.length) : key;
+  if (body.length <= 8)
+    return `${API_KEY_PREFIX}****`;
+  return `${API_KEY_PREFIX}${body.slice(0, 4)}…${body.slice(-4)}`;
+}
+function containerHint() {
+  eprintln(c.dim(`   Running Cerefox Local (Docker)? This is not the command you want — the
+` + "   container mints its own key at boot. Read it with: cerefox-local api-key"));
+}
+function writeKey(key, opts, verb) {
+  const envPath = resolveEnvFile();
+  if (opts.dryRun) {
+    println(c.dim(`DRY-RUN: would ${verb} ${ENV_NAME} in ${envPath}`));
+    return;
+  }
+  const result = upsertEnvVar(envPath, ENV_NAME, key, {
+    noBackup: !opts.backup,
+    comment: "Local API key for /api/v1 + /rest/v1 (cerefox api-key). Never sent to Supabase."
+  });
+  println(`   ${result.action} ${c.bold(ENV_NAME)} in ${envPath}`);
+  if (result.backupPath)
+    println(c.dim(`   backup: ${result.backupPath}`));
+  println("");
+  println(c.bold("   Your API key (shown once, in full):"));
+  println(`   ${c.green(key)}`);
+  println("");
+  println(c.dim(`   A caller that is NOT on this machine sends it as:
+` + `     Authorization: Bearer <key>
+` + "   Callers on this machine (the web UI, local agents) need nothing."));
+  envGitignoreWarning(envPath);
+}
+function generateAction(opts) {
+  const envPath = resolveEnvFile();
+  const existing = readEnvVar(envPath, ENV_NAME);
+  if (existing) {
+    throw userError(`${ENV_NAME} is already set in ${envPath} (${mask(existing)}).`, "Use `cerefox api-key show` to see it, or `cerefox api-key rotate` to replace it. " + "Refusing to overwrite silently: any client already configured with the old key " + "would start getting 401s with no indication why.");
+  }
+  println(c.bold("Minting a local API key"));
+  writeKey(mint(), opts, "write");
+  containerHint();
+}
+function rotateAction(opts) {
+  const envPath = resolveEnvFile();
+  const existing = readEnvVar(envPath, ENV_NAME);
+  if (!existing) {
+    throw userError(`No ${ENV_NAME} in ${envPath} — nothing to rotate.`, "Run `cerefox api-key generate` first.");
+  }
+  println(c.bold("Rotating the local API key"));
+  println(c.dim(`   replacing ${mask(existing)}`));
+  writeKey(mint(), opts, "replace");
+  println(c.yellow(`   The previous key stops working as soon as the server restarts.
+` + "   Update every remote client, then: cerefox web restart"));
+}
+function showAction2() {
+  const envPath = resolveEnvFile();
+  const key = readEnvVar(envPath, ENV_NAME);
+  println(c.bold("Local API key"));
+  if (!key) {
+    println(c.dim(`   none set in ${envPath}`));
+    println(c.dim(`   The server is not gated: callers from any interface it is bound to can
+` + `   reach it without a credential. That is fine while it binds 127.0.0.1.
+` + "   Mint one with: cerefox api-key generate"));
+    containerHint();
+    return;
+  }
+  println(`   ${c.green(key)}   ${c.dim(`(${ENV_NAME} in ${envPath})`)}`);
+  println(c.dim("   Remote callers send:  Authorization: Bearer <key>"));
+}
+function registerApiKey(program2) {
+  const group = program2.command("api-key").description("Manage the local API key for /api/v1 (loopback callers need none).");
+  group.command("generate").description("Mint a local API key and write it to .env. Refuses if one exists.").option("--no-backup", "Skip the .pre-cerefox.bak backup of an existing .env.").option("--dry-run", "Print the plan without minting or writing anything.").action(generateAction);
+  group.command("rotate").description("Replace the existing key. Remote clients must be updated.").option("--no-backup", "Skip the .pre-cerefox.bak backup of an existing .env.").option("--dry-run", "Print the plan without minting or writing anything.").action(rotateAction);
+  group.command("show").description("Print the local API key, in full, for pasting into a client.").action(showAction2);
+}
+
 // src/cli/commands/token.ts
+init_cli_core();
+init_config();
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { spawnSync as spawnSync7 } from "node:child_process";
 var SECRET_NAME = "CEREFOX_ACCESS_TOKENS";
 var LOCAL_NAME = "CEREFOX_ACCESS_TOKEN";
 var PREFIX = "cfx_pat_";
 function mintToken() {
-  return PREFIX + randomBytes(32).toString("base64url");
+  return PREFIX + randomBytes2(32).toString("base64url");
 }
-function mask(token) {
+function mask2(token) {
   return token.length <= 16 ? "…" : `${token.slice(0, PREFIX.length + 4)}…${token.slice(-4)}`;
 }
 function parseProjectRef2(supabaseUrl) {
@@ -81023,7 +81618,7 @@ function setSecret(setValue, projectRef, dryRun) {
   if (projectRef)
     args.push("--project-ref", projectRef);
   if (dryRun) {
-    const shown = setValue.split(",").map(mask).join(",");
+    const shown = setValue.split(",").map(mask2).join(",");
     println(c.dim(`   (dry-run) npx supabase secrets set ${SECRET_NAME}=${shown}` + (projectRef ? ` --project-ref ${projectRef}` : "")));
     return;
   }
@@ -81063,7 +81658,7 @@ function printTokenOnce(token) {
   println(c.dim("   If the GPT Actions schema changed this release, re-paste it too"));
   println(c.dim("   (see docs/guides/connect-agents.md). Lose the token → `cerefox token rotate`."));
 }
-function generateAction(opts) {
+function generateAction2(opts) {
   const projectRef = opts.projectRef ?? parseProjectRef2(loadSettings().supabaseUrl);
   const token = mintToken();
   println(c.bold("Generating a Cerefox access token…"));
@@ -81072,7 +81667,7 @@ function generateAction(opts) {
   if (!opts.dryRun)
     printTokenOnce(token);
 }
-function rotateAction(opts) {
+function rotateAction2(opts) {
   const projectRef = opts.projectRef ?? parseProjectRef2(loadSettings().supabaseUrl);
   const envPath = resolveEnvFile();
   const current = readEnvVar(envPath, LOCAL_NAME);
@@ -81102,14 +81697,14 @@ function listAction2() {
   const envPath = resolveEnvFile();
   const local = readEnvVar(envPath, LOCAL_NAME);
   println(c.bold("Cerefox access token"));
-  println(local ? `   local (${LOCAL_NAME} in ${envPath}): ${c.green(mask(local))}` : c.dim(`   no ${LOCAL_NAME} in ${envPath} — run \`cerefox token generate\``));
+  println(local ? `   local (${LOCAL_NAME} in ${envPath}): ${c.green(mask2(local))}` : c.dim(`   no ${LOCAL_NAME} in ${envPath} — run \`cerefox token generate\``));
   println(c.dim(`   The server-side accepted set (${SECRET_NAME}) is write-only; list names/digests
 ` + "   with: npx supabase secrets list"));
 }
 function registerToken(program2) {
   const token = program2.command("token").description("Manage the Cerefox Edge Function access token(s).");
-  token.command("generate").description("Mint a token, set the Supabase secret, and write it to .env.").option("--project-ref <ref>", "Supabase project ref (default: derived from CEREFOX_SUPABASE_URL).").option("--no-env", "Do not write CEREFOX_ACCESS_TOKEN to .env.").option("--no-backup", "Skip the .pre-cerefox.bak backup of an existing .env.").option("--dry-run", "Print the plan without minting or writing anything.").action(generateAction);
-  token.command("rotate").description("Mint a new token accepted alongside the old (zero-downtime); --finalize drops the old.").option("--finalize", "Stop accepting the previous token (run after clients migrate).").option("--project-ref <ref>", "Supabase project ref (default: derived from CEREFOX_SUPABASE_URL).").option("--no-env", "Do not write CEREFOX_ACCESS_TOKEN to .env.").option("--no-backup", "Skip the .pre-cerefox.bak backup of an existing .env.").option("--dry-run", "Print the plan without minting or writing anything.").action(rotateAction);
+  token.command("generate").description("Mint a token, set the Supabase secret, and write it to .env.").option("--project-ref <ref>", "Supabase project ref (default: derived from CEREFOX_SUPABASE_URL).").option("--no-env", "Do not write CEREFOX_ACCESS_TOKEN to .env.").option("--no-backup", "Skip the .pre-cerefox.bak backup of an existing .env.").option("--dry-run", "Print the plan without minting or writing anything.").action(generateAction2);
+  token.command("rotate").description("Mint a new token accepted alongside the old (zero-downtime); --finalize drops the old.").option("--finalize", "Stop accepting the previous token (run after clients migrate).").option("--project-ref <ref>", "Supabase project ref (default: derived from CEREFOX_SUPABASE_URL).").option("--no-env", "Do not write CEREFOX_ACCESS_TOKEN to .env.").option("--no-backup", "Skip the .pre-cerefox.bak backup of an existing .env.").option("--dry-run", "Print the plan without minting or writing anything.").action(rotateAction2);
   token.command("list").description("Show the local token (masked) and where the server-side set lives.").action(listAction2);
 }
 
@@ -84457,7 +85052,7 @@ var CONFIG_CATALOG = [
   },
   {
     key: "require_requestor_identity",
-    description: "Require a requestor/author on MCP tool calls.",
+    description: "Require a requestor/author. Enforced on the Edge Functions (incl. remote MCP) ONLY — not local MCP, /api/v1 or the CLI.",
     kind: "boolean",
     defaultValue: "false",
     group: "Governance",
@@ -84569,6 +85164,78 @@ function validateConfigValue(key, value) {
 
 // src/web/routes/config.ts
 init_config();
+
+// src/web/identity.ts
+var DEFAULT_WEB_AUTHOR = "web-ui";
+var DEFAULT_WEB_AUTHOR_TYPE = "user";
+var WEB_UI_IDENTITY = {
+  author: DEFAULT_WEB_AUTHOR,
+  authorType: DEFAULT_WEB_AUTHOR_TYPE,
+  requestor: DEFAULT_WEB_AUTHOR,
+  accessPath: "webapp",
+  named: false
+};
+var HEADER = {
+  author: "x-cerefox-author",
+  authorType: "x-cerefox-author-type",
+  requestor: "x-cerefox-requestor"
+};
+function readField(c2, headerName, body, bodyKey) {
+  const header = c2.req.header(headerName);
+  if (header !== undefined) {
+    if (header.trim() === "") {
+      return { ok: false, detail: `${headerName} must not be blank.` };
+    }
+    return { ok: true, value: header.trim() };
+  }
+  if (body && bodyKey in body) {
+    const raw2 = body[bodyKey];
+    if (raw2 === null || raw2 === undefined)
+      return { ok: true, value: undefined };
+    if (typeof raw2 !== "string") {
+      return { ok: false, detail: `${bodyKey} must be a string.` };
+    }
+    if (raw2.trim() === "") {
+      return { ok: false, detail: `${bodyKey} must not be blank.` };
+    }
+    return { ok: true, value: raw2.trim() };
+  }
+  return { ok: true, value: undefined };
+}
+function resolveCallerIdentity(c2, body) {
+  const author = readField(c2, HEADER.author, body, "author");
+  if (!author.ok)
+    return author;
+  const requestor = readField(c2, HEADER.requestor, body, "requestor");
+  if (!requestor.ok)
+    return requestor;
+  const authorType = readField(c2, HEADER.authorType, body, "author_type");
+  if (!authorType.ok)
+    return authorType;
+  if (authorType.value !== undefined && authorType.value !== "user" && authorType.value !== "agent") {
+    return {
+      ok: false,
+      detail: `author_type must be "user" or "agent" (got ${JSON.stringify(authorType.value)}).`
+    };
+  }
+  const named = author.value !== undefined || requestor.value !== undefined || authorType.value !== undefined;
+  if (!named)
+    return { ok: true, identity: WEB_UI_IDENTITY };
+  const resolvedAuthor = author.value ?? requestor.value ?? DEFAULT_WEB_AUTHOR;
+  const resolvedRequestor = requestor.value ?? author.value ?? DEFAULT_WEB_AUTHOR;
+  return {
+    ok: true,
+    identity: {
+      author: resolvedAuthor,
+      authorType: authorType.value ?? DEFAULT_WEB_AUTHOR_TYPE,
+      requestor: resolvedRequestor,
+      accessPath: "api",
+      named: true
+    }
+  };
+}
+
+// src/web/routes/config.ts
 init__utils();
 function unwrapScalarRpc(data) {
   if (typeof data === "string")
@@ -84640,11 +85307,14 @@ function registerConfigRoutes(app, ctx) {
     const invalid = validateConfigValue(key, value);
     if (invalid)
       return c2.json({ detail: invalid }, 400);
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const { error: error3 } = await ctx.supabase.rpc("cerefox_set_config", {
       p_key: key,
       p_value: value,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType
     });
     if (error3) {
       const remediation = storeWriteRemediation(error3.message ?? "", "cerefox_set_config");
@@ -84662,8 +85332,8 @@ init__utils();
 function logWebUsage(ctx, params) {
   Promise.resolve(ctx.supabase.rpc("cerefox_log_usage", {
     p_operation: params.operation,
-    p_access_path: "webapp",
-    p_requestor: params.requestor ?? "web-ui",
+    p_access_path: params.access_path ?? "webapp",
+    p_requestor: params.requestor ?? DEFAULT_WEB_AUTHOR,
     p_document_id: params.document_id ?? null,
     p_project_id: params.project_id ?? null,
     p_query_text: params.query_text ?? null,
@@ -84989,7 +85659,16 @@ function registerDiscoveryRoutes(app, ctx) {
         results = results.filter((r) => statusMap.get(r.document_id) === reviewStatus);
       }
     }
-    logWebUsage(ctx, { operation: "search", query_text: q, result_count: results.length });
+    const who = resolveCallerIdentity(c2);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
+    logWebUsage(ctx, {
+      operation: "search",
+      query_text: q,
+      result_count: results.length,
+      requestor: who.identity.requestor,
+      access_path: who.identity.accessPath
+    });
     return c2.json({
       results,
       query: q,
@@ -85314,7 +85993,15 @@ function registerDocumentReadRoutes(app, ctx) {
     const meta = await getDocumentRow(ctx, documentId);
     const projectIds = await listDocumentProjectIds(ctx, documentId);
     const versions3 = await listDocumentVersions(ctx, documentId);
-    logWebUsage(ctx, { operation: "get-document", document_id: documentId });
+    const who = resolveCallerIdentity(c2);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
+    logWebUsage(ctx, {
+      operation: "get-document",
+      document_id: documentId,
+      requestor: who.identity.requestor,
+      access_path: who.identity.accessPath
+    });
     return c2.json({
       document_id: documentId,
       full_content: doc2.full_content ?? "",
@@ -85451,6 +86138,9 @@ function registerDocumentWriteRoutes(app, ctx) {
     } catch {
       return c2.json({ success: false, error: "Invalid JSON body" }, 400);
     }
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const title = String(body.title ?? "").trim();
     const content = String(body.content ?? "");
     const projectIds = Array.isArray(body.project_ids) ? body.project_ids : [];
@@ -85491,8 +86181,8 @@ function registerDocumentWriteRoutes(app, ctx) {
           source: "manual",
           projectIds: Array.isArray(body.project_ids) ? body.project_ids : undefined,
           metadata: body.metadata != null ? metadata : undefined,
-          author: "web-ui",
-          authorType: "user",
+          author: who.identity.author,
+          authorType: who.identity.authorType,
           expectedContentHash: typeof body.expected_content_hash === "string" ? body.expected_content_hash : null
         });
         return c2.json({ success: true, reindexed: result.reindexed });
@@ -85537,9 +86227,9 @@ function registerDocumentWriteRoutes(app, ctx) {
         title: body.title !== undefined && title !== doc2.title ? title : undefined,
         metadata: body.metadata != null ? metadata : undefined,
         projectIds: Array.isArray(body.project_ids) ? projectIds : undefined,
-        author: "web-ui",
-        authorType: "user",
-        accessPath: "webapp"
+        author: who.identity.author,
+        authorType: who.identity.authorType,
+        accessPath: who.identity.accessPath
       });
       return c2.json({ success: true, reindexed: false, ...facets });
     } catch (err) {
@@ -85556,10 +86246,20 @@ function registerDocumentWriteRoutes(app, ctx) {
   });
   app.delete("/api/v1/documents/:document_id", async (c2) => {
     const documentId = c2.req.param("document_id");
+    const who = resolveCallerIdentity(c2);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
+    const expectedHash = (c2.req.header("x-cerefox-expected-content-hash") ?? c2.req.query("expected_content_hash") ?? "").trim();
+    if (who.identity.named && expectedHash === "") {
+      return c2.json({
+        detail: "CEREFOX_TOKEN_REQUIRED: an identified caller must send the content_hash it read, " + "as the X-Cerefox-Expected-Content-Hash header or an expected_content_hash query " + "parameter. A delete must follow a read."
+      }, 400);
+    }
     const { data, error: error3 } = await ctx.supabase.rpc("cerefox_delete_document", {
       p_document_id: documentId,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType,
+      p_expected_content_hash: expectedHash === "" ? null : expectedHash
     });
     if (error3) {
       if (isDocumentNotFoundError(error3)) {
@@ -85572,10 +86272,13 @@ function registerDocumentWriteRoutes(app, ctx) {
   });
   app.post("/api/v1/documents/:document_id/restore", async (c2) => {
     const documentId = c2.req.param("document_id");
+    const who = resolveCallerIdentity(c2);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const { data, error: error3 } = await ctx.supabase.rpc("cerefox_restore_document", {
       p_document_id: documentId,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType
     });
     if (error3) {
       if (isDocumentNotFoundError(error3)) {
@@ -85588,10 +86291,13 @@ function registerDocumentWriteRoutes(app, ctx) {
   });
   app.delete("/api/v1/documents/:document_id/purge", async (c2) => {
     const documentId = c2.req.param("document_id");
+    const who = resolveCallerIdentity(c2);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const { error: error3 } = await ctx.supabase.rpc("cerefox_purge_document", {
       p_document_id: documentId,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType
     });
     if (error3)
       return c2.json({ detail: error3.message }, 500);
@@ -85605,6 +86311,9 @@ function registerDocumentWriteRoutes(app, ctx) {
     } catch {
       return c2.json({ detail: "Invalid JSON body" }, 400);
     }
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const status = body.status;
     if (status !== "approved" && status !== "pending_review") {
       return c2.json({ detail: `Invalid status: ${JSON.stringify(status)}` }, 400);
@@ -85619,7 +86328,8 @@ function registerDocumentWriteRoutes(app, ctx) {
       return c2.json({ detail: error3.message }, 500);
     await createAuditEntry(ctx, {
       operation: "status-change",
-      author: "user",
+      author: who.identity.author,
+      authorType: who.identity.authorType,
       documentId,
       description: `Review status changed from '${oldStatus}' to '${status}'`
     });
@@ -85634,6 +86344,9 @@ function registerDocumentWriteRoutes(app, ctx) {
     } catch {
       return c2.json({ detail: "Invalid JSON body" }, 400);
     }
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const archived = Boolean(body.archived);
     const { data, error: error3 } = await ctx.supabase.from("cerefox_document_versions").update({ archived }).eq("id", versionId).select("document_id, version_number").maybeSingle();
     if (error3)
@@ -85642,7 +86355,8 @@ function registerDocumentWriteRoutes(app, ctx) {
     const op = archived ? "archive" : "unarchive";
     await createAuditEntry(ctx, {
       operation: op,
-      author: "user",
+      author: who.identity.author,
+      authorType: who.identity.authorType,
       documentId: ver?.document_id ?? documentId,
       versionId,
       description: `Version ${ver?.version_number ?? "?"} ${op}d`
@@ -85652,7 +86366,22 @@ function registerDocumentWriteRoutes(app, ctx) {
 }
 // src/web/routes/ingest.ts
 function notReady(error3) {
-  return { success: false, error: error3 };
+  return { success: false, error: error3, detail: error3 };
+}
+function ingestFailure(err) {
+  if (err instanceof ConcurrencyConflictError) {
+    return [
+      {
+        ...notReady(err.message),
+        ...err.currentHash ? { current_hash: err.currentHash } : {}
+      },
+      409
+    ];
+  }
+  if (err instanceof ConcurrencyTokenRequiredError) {
+    return [notReady(err.message), 400];
+  }
+  return [notReady(err instanceof Error ? err.message : String(err)), 500];
 }
 function registerIngestRoutes(app, ctx) {
   app.post("/api/v1/ingest", async (c2) => {
@@ -85671,6 +86400,9 @@ function registerIngestRoutes(app, ctx) {
       return c2.json(notReady("Title is required."), 200);
     if (!content.trim())
       return c2.json(notReady("Content cannot be empty."), 200);
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     try {
       const pipeline2 = new IngestionPipeline({
         supabase: ctx.supabase,
@@ -85684,8 +86416,8 @@ function registerIngestRoutes(app, ctx) {
         metadata: body.metadata ?? null,
         updateExisting: Boolean(body.update_existing),
         documentId: body.document_id ?? null,
-        author: "web-ui",
-        authorType: "user"
+        author: who.identity.author,
+        authorType: who.identity.authorType
       });
       const skipped = result.action === "skipped";
       const resp = {
@@ -85697,10 +86429,16 @@ function registerIngestRoutes(app, ctx) {
       };
       if (result.note)
         resp.note = result.note;
-      logWebUsage(ctx, { operation: "ingest", document_id: result.documentId });
+      logWebUsage(ctx, {
+        operation: "ingest",
+        document_id: result.documentId,
+        requestor: who.identity.requestor,
+        access_path: who.identity.accessPath
+      });
       return c2.json(resp, 200);
     } catch (err) {
-      return c2.json(notReady(err instanceof Error ? err.message : String(err)), 200);
+      const [body2, status] = ingestFailure(err);
+      return c2.json(body2, status);
     }
   });
   app.post("/api/v1/ingest/file", async (c2) => {
@@ -85736,6 +86474,9 @@ function registerIngestRoutes(app, ctx) {
         metadata = null;
       }
     }
+    const who = resolveCallerIdentity(c2, form);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     try {
       const pipeline2 = new IngestionPipeline({
         supabase: ctx.supabase,
@@ -85749,11 +86490,16 @@ function registerIngestRoutes(app, ctx) {
         projectIds,
         metadata,
         updateExisting,
-        author: "web-ui",
-        authorType: "user"
+        author: who.identity.author,
+        authorType: who.identity.authorType
       });
       const skipped = result.action === "skipped";
-      logWebUsage(ctx, { operation: "ingest", document_id: result.documentId });
+      logWebUsage(ctx, {
+        operation: "ingest",
+        document_id: result.documentId,
+        requestor: who.identity.requestor,
+        access_path: who.identity.accessPath
+      });
       return c2.json({
         success: !skipped,
         document_id: result.documentId,
@@ -85763,7 +86509,8 @@ function registerIngestRoutes(app, ctx) {
         ...result.note ? { note: result.note } : {}
       }, 200);
     } catch (err) {
-      return c2.json(notReady(err instanceof Error ? err.message : String(err)), 200);
+      const [body, status] = ingestFailure(err);
+      return c2.json(body, status);
     }
   });
   app.post("/api/v1/documents/:document_id/upload", async (c2) => {
@@ -85790,6 +86537,9 @@ function registerIngestRoutes(app, ctx) {
     if (!existing)
       return c2.json(notReady("Document not found"), 404);
     const title = existing.title || file.name || "Untitled";
+    const who = resolveCallerIdentity(c2, form);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     try {
       const pipeline2 = new IngestionPipeline({
         supabase: ctx.supabase,
@@ -85800,10 +86550,17 @@ function registerIngestRoutes(app, ctx) {
         text,
         title,
         source: "file",
-        author: "web-ui",
-        authorType: "user"
+        author: who.identity.author,
+        authorType: who.identity.authorType,
+        expectedContentHash: typeof form.expected_content_hash === "string" && form.expected_content_hash.trim() !== "" ? form.expected_content_hash.trim() : null,
+        lastWriteWins: String(form.last_write_wins ?? "") === "true"
+      });
+      logWebUsage(ctx, {
+        operation: "ingest",
+        document_id: result.documentId,
+        requestor: who.identity.requestor,
+        access_path: who.identity.accessPath
       });
-      logWebUsage(ctx, { operation: "ingest", document_id: result.documentId });
       return c2.json({
         success: true,
         document_id: result.documentId,
@@ -85811,7 +86568,8 @@ function registerIngestRoutes(app, ctx) {
         updated: result.reindexed
       }, 200);
     } catch (err) {
-      return c2.json(notReady(err instanceof Error ? err.message : String(err)), 200);
+      const [body, status] = ingestFailure(err);
+      return c2.json(body, status);
     }
   });
 }
@@ -86154,11 +86912,14 @@ function registerProjectsRoutes(app, ctx) {
     if (!name)
       return c2.json({ detail: "Project name is required" }, 400);
     const description = String(body.description ?? "").trim();
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const { data, error: error3 } = await ctx.supabase.rpc("cerefox_create_project", {
       p_name: name,
       p_description: description,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType
     });
     if (error3) {
       const msg = error3.message ?? "";
@@ -86194,12 +86955,15 @@ function registerProjectsRoutes(app, ctx) {
     if (Object.keys(update).length === 0) {
       return c2.json({ detail: "Nothing to update — pass name and/or description" }, 400);
     }
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const { data, error: error3 } = await ctx.supabase.rpc("cerefox_update_project", {
       p_project_id: projectId,
       p_name: update.name ?? null,
       p_description: update.description ?? null,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType
     });
     if (error3) {
       const msg = error3.message ?? "";
@@ -86217,10 +86981,13 @@ function registerProjectsRoutes(app, ctx) {
   });
   app.delete("/api/v1/projects/:project_id", async (c2) => {
     const projectId = c2.req.param("project_id");
+    const who = resolveCallerIdentity(c2);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const { data, error: error3 } = await ctx.supabase.rpc("cerefox_delete_project", {
       p_project_id: projectId,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType
     });
     if (error3)
       return c2.json({ detail: error3.message }, 500);
@@ -86313,6 +87080,8 @@ function buildApp(ctx = buildWebContext()) {
   if (true) {
     app.use(logger((message, ...rest) => console.log(`${localTimestamp()}  ${message}`, ...rest)));
   }
+  app.use("/api/v1/*", apiAuth());
+  app.use("/rest/v1/*", apiAuth());
   registerMetaRoutes(app, ctx);
   registerPreferencesRoutes(app);
   if (ctx) {
@@ -86395,6 +87164,14 @@ async function buildWebServer(options = {}) {
   const host = options.host ?? "127.0.0.1";
   const port = options.port ?? 8000;
   await assertServerCompatible();
+  if (!isLoopbackAddress(host) && !(process.env.CEREFOX_API_KEY ?? "").trim()) {
+    console.warn(`
+⚠  Binding ${host} with NO API key configured.
+` + `   Every read, write, delete and purge on this server is reachable by
+` + `   anything that can connect to port ${port}, with no credential.
+` + `   Mint one:  cerefox api-key generate
+`);
+  }
   const app = buildApp();
   const server = serve({ fetch: app.fetch, hostname: host, port });
   return {
@@ -86769,6 +87546,7 @@ Learn more:
   registerWeb(program2);
   registerCompletion(program2);
   registerToken(program2);
+  registerApiKey(program2);
   const document2 = program2.command("document").description("Documents: get, list, edit, delete, restore, ingest, ingest-dir, version.");
   moveInto(document2, registerGetDoc, "get");
   moveInto(document2, registerListDocs, "list");