@depup/supabase__auth-js 2.103.0-depup.0 → 2.110.8-depup.0

package/dist/module/GoTrueClient.js

@@ -1,15 +1,15 @@
 import GoTrueAdminApi from './GoTrueAdminApi';
-import { AUTO_REFRESH_TICK_DURATION_MS, AUTO_REFRESH_TICK_THRESHOLD, DEFAULT_HEADERS, EXPIRY_MARGIN_MS, GOTRUE_URL, JWKS_TTL, STORAGE_KEY, } from './lib/constants';
-import { AuthImplicitGrantRedirectError, AuthInvalidCredentialsError, AuthInvalidJwtError, AuthInvalidTokenResponseError, AuthPKCECodeVerifierMissingError, AuthPKCEGrantCodeExchangeError, AuthSessionMissingError, AuthUnknownError, isAuthApiError, isAuthError, isAuthImplicitGrantRedirectError, isAuthRetryableFetchError, isAuthSessionMissingError, } from './lib/errors';
+import { AUTO_REFRESH_TICK_DURATION_MS, AUTO_REFRESH_TICK_THRESHOLD, DEFAULT_HEADERS, EXPIRY_MARGIN_MS, GOTRUE_URL, JWKS_TTL, REFRESH_FAILURE_COOLDOWN_MS, STORAGE_KEY, } from './lib/constants';
+import { AuthImplicitGrantRedirectError, AuthInvalidCredentialsError, AuthInvalidJwtError, AuthInvalidTokenResponseError, AuthPKCECodeVerifierMissingError, AuthPKCEGrantCodeExchangeError, AuthRefreshDiscardedError, AuthSessionMissingError, AuthUnknownError, isAuthApiError, isAuthError, isAuthImplicitGrantRedirectError, isAuthRefreshDiscardedError, isAuthRetryableFetchError, isAuthSessionMissingError, } from './lib/errors';
 import { _request, _sessionResponse, _sessionResponsePassword, _ssoResponse, _userResponse, } from './lib/fetch';
-import { decodeJWT, deepClone, Deferred, generateCallbackId, getAlgorithm, getCodeChallengeAndMethod, getItemAsync, insecureUserWarningProxy, isBrowser, parseParametersFromURL, removeItemAsync, resolveFetch, retryable, setItemAsync, sleep, supportsLocalStorage, userNotAvailableProxy, validateExp, } from './lib/helpers';
+import { assertPasskeyExperimentalEnabled, decodeJWT, deepClone, Deferred, generateCallbackId, getAlgorithm, getCodeChallengeAndMethod, getItemAsync, insecureUserWarningProxy, isBrowser, parseParametersFromURL, removeItemAsync, resolveFetch, retryable, setItemAsync, sleep, supportsLocalStorage, userNotAvailableProxy, validateExp, } from './lib/helpers';
 import { memoryLocalStorageAdapter } from './lib/local-storage';
-import { LockAcquireTimeoutError, navigatorLock } from './lib/locks';
+import { LockAcquireTimeoutError } from './lib/locks';
 import { polyfillGlobalThis } from './lib/polyfills';
 import { version } from './lib/version';
 import { bytesToBase64URL, stringToUint8Array } from './lib/base64url';
 import { createSiweMessage, fromHex, getAddress, toHex, } from './lib/web3/ethereum';
-import { deserializeCredentialCreationOptions, deserializeCredentialRequestOptions, serializeCredentialCreationResponse, serializeCredentialRequestResponse, WebAuthnApi, } from './lib/webauthn';
+import { createCredential, deserializeCredentialCreationOptions, deserializeCredentialRequestOptions, getCredential, serializeCredentialCreationResponse, serializeCredentialRequestResponse, browserSupportsWebAuthn, webAuthnAbortService, WebAuthnApi, } from './lib/webauthn';
 polyfillGlobalThis(); // Make "globalThis" available
 const DEFAULT_OPTIONS = {
     url: GOTRUE_URL,
@@ -22,9 +22,16 @@ const DEFAULT_OPTIONS = {
     debug: false,
     hasCustomAuthorizationHeader: false,
     throwOnError: false,
-    lockAcquireTimeout: 5000, // 5 seconds
+    lockAcquireTimeout: 5000, // 5 seconds. Only used when a custom `lock` is supplied. TODO(v3): remove.
     skipAutoInitialize: false,
+    experimental: {},
 };
+/**
+ * No-op lock used internally as a placeholder. Kept so older test setups that
+ * inject this exact reference do not break; new code never sees it because
+ * `this.lock` stays `null` when no custom lock is supplied (lockless path).
+ * TODO(v3): remove with the legacy lock path.
+ */
 async function lockNoOp(name, acquireTimeout, fn) {
     return await fn();
 }
@@ -58,13 +65,21 @@ class GoTrueClient {
     /**
      * Create a new client for use in the browser.
      *
-     * @example
+     * @example Using supabase-js (recommended)
+     * ```ts
+     * import { createClient } from '@supabase/supabase-js'
+     *
+     * const supabase = createClient('https://xyzcompany.supabase.co', 'your-publishable-key')
+     * const { data, error } = await supabase.auth.getUser()
+     * ```
+     *
+     * @example Standalone import for bundle-sensitive environments
      * ```ts
      * import { GoTrueClient } from '@supabase/auth-js'
      *
      * const auth = new GoTrueClient({
      *   url: 'https://xyzcompany.supabase.co/auth/v1',
-     *   headers: { apikey: 'public-anon-key' },
+     *   headers: { apikey: 'your-publishable-key' },
      *   storageKey: 'supabase-auth',
      * })
      * ```
@@ -81,6 +96,29 @@ class GoTrueClient {
         this.autoRefreshTickTimeout = null;
         this.visibilityChangedCallback = null;
         this.refreshingDeferred = null;
+        /**
+         * Cache of the most recent refresh failure, keyed by the refresh token
+         * that failed. Serial callers passing the *same* token within
+         * `REFRESH_FAILURE_COOLDOWN_MS` (including subsequent auto-refresh ticks)
+         * receive this cached result instead of firing another `/token` request.
+         * Callers passing a *different* token (token rotation pickup, explicit
+         * `setSession`/`refreshSession({ refresh_token })`, multi-account switch)
+         * bypass the cache and attempt a fresh refresh as they should.
+         * Cleared on any successful refresh (locally or via BroadcastChannel from
+         * another tab) and on `_removeSession`.
+         *
+         * Pairs with `refreshingDeferred`: concurrent callers share the in-flight
+         * promise, serial callers within the cooldown share the failure result.
+         */
+        this.lastRefreshFailure = null;
+        /**
+         * Monotonic counter incremented at the top of `_removeSession`, before any
+         * `await`. The commit guard inside `_callRefreshToken` captures this value
+         * before `_saveSession` and re-checks it after, so a `signOut` that
+         * interleaves inside `_saveSession`'s storage-write awaits is still caught
+         * (the post-fetch storage snapshot alone misses that window).
+         */
+        this._sessionRemovalEpoch = 0;
         /**
          * Keeps track of the async client initialization.
          * When null or not yet resolved the auth state is `unknown`
@@ -88,9 +126,29 @@ class GoTrueClient {
          * Keep extra care to never reject or throw uncaught errors
          */
         this.initializePromise = null;
+        /**
+         * Non-null only while `initialize()` is running. While open,
+         * `_notifyAllSubscribers` enqueues init-chain notifications (those fired with
+         * `broadcast = true`, i.e. from `_recoverAndRefresh`) into this array instead
+         * of firing directly, so that `initializePromise` is guaranteed to be
+         * resolved before any subscriber callback runs. Callbacks that call
+         * `getSession()` / `getUser()` etc. would otherwise deadlock because those
+         * methods await `initializePromise`. Notifications from the incoming
+         * BroadcastChannel handler (`broadcast = false`) are not enqueued — they fire
+         * immediately. Flushed (in order) by `initialize()` after `initializePromise`
+         * settles.
+         */
+        this._pendingInitNotifications = null;
         this.detectSessionInUrl = true;
         this.hasCustomAuthorizationHeader = false;
         this.suppressGetSessionWarning = false;
+        /**
+         * Custom lock function passed via `settings.lock`. When non-null, every auth
+         * operation runs inside `_acquireLock`. When null (the default), the client
+         * uses its lockless coordination (refresh single-flight + commit guard).
+         * TODO(v3): remove along with the legacy lock path.
+         */
+        this.lock = null;
         this.lockAcquired = false;
         this.pendingInLock = [];
         /**
@@ -115,29 +173,32 @@ class GoTrueClient {
         }
         this.persistSession = settings.persistSession;
         this.autoRefreshToken = settings.autoRefreshToken;
+        this.experimental = (_b = settings.experimental) !== null && _b !== void 0 ? _b : {};
         this.admin = new GoTrueAdminApi({
             url: settings.url,
             headers: settings.headers,
             fetch: settings.fetch,
+            experimental: this.experimental,
         });
         this.url = settings.url;
         this.headers = settings.headers;
         this.fetch = resolveFetch(settings.fetch);
-        this.lock = settings.lock || lockNoOp;
         this.detectSessionInUrl = settings.detectSessionInUrl;
         this.flowType = settings.flowType;
         this.hasCustomAuthorizationHeader = settings.hasCustomAuthorizationHeader;
         this.throwOnError = settings.throwOnError;
+        // Always wire `lockAcquireTimeout` even on the lockless path: consumers
+        // (including supabase-js tests) read it off the client to verify option
+        // flow-through.
         this.lockAcquireTimeout = settings.lockAcquireTimeout;
-        if (settings.lock) {
+        // TODO(v3): remove. Legacy opt-in path preserved for backwards
+        // compatibility with callers passing a custom `lock` (typically React
+        // Native `processLock` or Node multi-process setups). When `settings.lock`
+        // is null the client uses its lockless coordination — no `navigator.locks`
+        // by default, no implicit `processLock`.
+        if (settings.lock != null) {
             this.lock = settings.lock;
         }
-        else if (this.persistSession && isBrowser() && ((_b = globalThis === null || globalThis === void 0 ? void 0 : globalThis.navigator) === null || _b === void 0 ? void 0 : _b.locks)) {
-            this.lock = navigatorLock;
-        }
-        else {
-            this.lock = lockNoOp;
-        }
         if (!this.jwks) {
             this.jwks = { keys: [] };
             this.jwks_cached_at = Number.MIN_SAFE_INTEGER;
@@ -159,6 +220,15 @@ class GoTrueClient {
             listGrants: this._listOAuthGrants.bind(this),
             revokeGrant: this._revokeOAuthGrant.bind(this),
         };
+        this.passkey = {
+            startRegistration: this._startPasskeyRegistration.bind(this),
+            verifyRegistration: this._verifyPasskeyRegistration.bind(this),
+            startAuthentication: this._startPasskeyAuthentication.bind(this),
+            verifyAuthentication: this._verifyPasskeyAuthentication.bind(this),
+            list: this._listPasskeys.bind(this),
+            update: this._updatePasskey.bind(this),
+            delete: this._deletePasskey.bind(this),
+        };
         if (this.persistSession) {
             if (settings.storage) {
                 this.storage = settings.storage;
@@ -189,6 +259,12 @@ class GoTrueClient {
             }
             (_c = this.broadcastChannel) === null || _c === void 0 ? void 0 : _c.addEventListener('message', async (event) => {
                 this._debug('received broadcast notification from other tab or client', event);
+                // Another tab successfully refreshed or signed in — any cached
+                // failure in this tab is stale and should not block the next
+                // refresh attempt.
+                if (event.data.event === 'TOKEN_REFRESHED' || event.data.event === 'SIGNED_IN') {
+                    this.lastRefreshFailure = null;
+                }
                 try {
                     await this._notifyAllSubscribers(event.data.event, event.data.session, false); // broadcast = false so we don't get an endless loop of messages
                 }
@@ -234,22 +310,55 @@ class GoTrueClient {
         return this;
     }
     /**
-     * Initializes the client session either from the url or from storage.
-     * This method is automatically called when instantiating the client, but should also be called
-     * manually when checking for an error from an auth redirect (oauth, magiclink, password recovery, etc).
+     * Initialize the auth client by loading the session from storage or
+     * detecting it from the URL after an OAuth, magic-link, or password-recovery
+     * redirect.
+     *
+     * **Most callers do not need to invoke this directly.** The client calls it
+     * automatically during construction, and to react to sign-in events (including
+     * post-redirect events) you should subscribe to `onAuthStateChange` rather
+     * than awaiting `initialize()`.
+     *
+     * You only need to call it manually when you have opted out of the automatic
+     * call by passing `skipAutoInitialize: true` — for example, in an SSR context
+     * where you need to control initialization timing. In that case, awaiting
+     * `initialize()` returns the resolved session result (or any error encountered
+     * while detecting it from the URL).
      *
      * @category Auth
      */
     async initialize() {
+        var _a;
         if (this.initializePromise) {
             return await this.initializePromise;
         }
+        // Open the notification queue before _initialize() runs so that every
+        // _notifyAllSubscribers call inside the init chain enqueues instead of
+        // firing. Without this, a callback receiving SIGNED_IN (or TOKEN_REFRESHED
+        // / SIGNED_OUT) during _recoverAndRefresh would deadlock if it called
+        // getSession() / getUser() — those methods await initializePromise, which
+        // can only resolve after the callback returns, which can only return after
+        // getSession() resolves. The queue is flushed below after initializePromise
+        // has settled, so callbacks run with a fully resolved initializePromise.
+        this._pendingInitNotifications = [];
         this.initializePromise = (async () => {
-            return await this._acquireLock(this.lockAcquireTimeout, async () => {
-                return await this._initialize();
-            });
+            if (this.lock != null) {
+                // TODO(v3): remove legacy lock path
+                return await this._acquireLock(this.lockAcquireTimeout, async () => {
+                    return await this._initialize();
+                });
+            }
+            return await this._initialize();
         })();
-        return await this.initializePromise;
+        const result = await this.initializePromise;
+        // initializePromise is now resolved — flush queued notifications in order.
+        // Callbacks can safely call getSession() / getUser() / signOut() etc.
+        const queue = (_a = this._pendingInitNotifications) !== null && _a !== void 0 ? _a : [];
+        this._pendingInitNotifications = null;
+        for (const n of queue) {
+            await this._notifyAllSubscribers(n.event, n.session, n.broadcast);
+        }
+        return result;
     }
     /**
      * IMPORTANT:
@@ -783,6 +892,21 @@ class GoTrueClient {
      *   password: 'some-password',
      * })
      * ```
+     *
+     * @exampleDescription Handling errors
+     * Log the full `error` object so fields like `code`, `status`, and `name` aren't hidden. The `error.code` (e.g. `'invalid_credentials'`, `'email_not_confirmed'`) is often more useful for branching than `error.message`, and the full object surfaces both.
+     *
+     * @example Handling errors
+     * ```js
+     * const { data, error } = await supabase.auth.signInWithPassword({
+     *   email: 'example@email.com',
+     *   password: 'example-password',
+     * })
+     * if (error) {
+     *   console.error(error)
+     *   return
+     * }
+     * ```
      */
     async signInWithPassword(credentials) {
         try {
@@ -1098,9 +1222,13 @@ class GoTrueClient {
      */
     async exchangeCodeForSession(authCode) {
         await this.initializePromise;
-        return this._acquireLock(this.lockAcquireTimeout, async () => {
-            return this._exchangeCodeForSession(authCode);
-        });
+        if (this.lock != null) {
+            // TODO(v3): remove legacy lock path
+            return this._acquireLock(this.lockAcquireTimeout, async () => {
+                return this._exchangeCodeForSession(authCode);
+            });
+        }
+        return this._exchangeCodeForSession(authCode);
     }
     /**
      * Signs in a user by verifying a message signed by the user's private key.
@@ -1202,7 +1330,7 @@ class GoTrueClient {
         }
     }
     async signInWithEthereum(credentials) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
+        var _a, _b, _c, _d, _f, _g, _h, _j, _k, _l, _m;
         // TODO: flatten type
         let message;
         let signature;
@@ -1262,11 +1390,11 @@ class GoTrueClient {
                 version: '1',
                 chainId: chainId,
                 nonce: (_c = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _c === void 0 ? void 0 : _c.nonce,
-                issuedAt: (_e = (_d = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _d === void 0 ? void 0 : _d.issuedAt) !== null && _e !== void 0 ? _e : new Date(),
-                expirationTime: (_f = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _f === void 0 ? void 0 : _f.expirationTime,
-                notBefore: (_g = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _g === void 0 ? void 0 : _g.notBefore,
-                requestId: (_h = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _h === void 0 ? void 0 : _h.requestId,
-                resources: (_j = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _j === void 0 ? void 0 : _j.resources,
+                issuedAt: (_f = (_d = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _d === void 0 ? void 0 : _d.issuedAt) !== null && _f !== void 0 ? _f : new Date(),
+                expirationTime: (_g = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _g === void 0 ? void 0 : _g.expirationTime,
+                notBefore: (_h = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _h === void 0 ? void 0 : _h.notBefore,
+                requestId: (_j = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _j === void 0 ? void 0 : _j.requestId,
+                resources: (_k = options === null || options === void 0 ? void 0 : options.signInWithEthereum) === null || _k === void 0 ? void 0 : _k.resources,
             };
             message = createSiweMessage(siweMessage);
             // Sign message
@@ -1279,8 +1407,8 @@ class GoTrueClient {
             const { data, error } = await _request(this.fetch, 'POST', `${this.url}/token?grant_type=web3`, {
                 headers: this.headers,
                 body: Object.assign({ chain: 'ethereum', message,
-                    signature }, (((_k = credentials.options) === null || _k === void 0 ? void 0 : _k.captchaToken)
-                    ? { gotrue_meta_security: { captcha_token: (_l = credentials.options) === null || _l === void 0 ? void 0 : _l.captchaToken } }
+                    signature }, (((_l = credentials.options) === null || _l === void 0 ? void 0 : _l.captchaToken)
+                    ? { gotrue_meta_security: { captcha_token: (_m = credentials.options) === null || _m === void 0 ? void 0 : _m.captchaToken } }
                     : null)),
                 xform: _sessionResponse,
             });
@@ -1305,7 +1433,7 @@ class GoTrueClient {
         }
     }
     async signInWithSolana(credentials) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
+        var _a, _b, _c, _d, _f, _g, _h, _j, _k, _l, _m, _o;
         let message;
         let signature;
         if ('message' in credentials) {
@@ -1390,17 +1518,17 @@ class GoTrueClient {
                     ...(((_d = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _d === void 0 ? void 0 : _d.notBefore)
                         ? [`Not Before: ${options.signInWithSolana.notBefore}`]
                         : []),
-                    ...(((_e = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _e === void 0 ? void 0 : _e.expirationTime)
+                    ...(((_f = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _f === void 0 ? void 0 : _f.expirationTime)
                         ? [`Expiration Time: ${options.signInWithSolana.expirationTime}`]
                         : []),
-                    ...(((_f = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _f === void 0 ? void 0 : _f.chainId)
+                    ...(((_g = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _g === void 0 ? void 0 : _g.chainId)
                         ? [`Chain ID: ${options.signInWithSolana.chainId}`]
                         : []),
-                    ...(((_g = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _g === void 0 ? void 0 : _g.nonce) ? [`Nonce: ${options.signInWithSolana.nonce}`] : []),
-                    ...(((_h = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _h === void 0 ? void 0 : _h.requestId)
+                    ...(((_h = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _h === void 0 ? void 0 : _h.nonce) ? [`Nonce: ${options.signInWithSolana.nonce}`] : []),
+                    ...(((_j = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _j === void 0 ? void 0 : _j.requestId)
                         ? [`Request ID: ${options.signInWithSolana.requestId}`]
                         : []),
-                    ...(((_k = (_j = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _j === void 0 ? void 0 : _j.resources) === null || _k === void 0 ? void 0 : _k.length)
+                    ...(((_l = (_k = options === null || options === void 0 ? void 0 : options.signInWithSolana) === null || _k === void 0 ? void 0 : _k.resources) === null || _l === void 0 ? void 0 : _l.length)
                         ? [
                             'Resources',
                             ...options.signInWithSolana.resources.map((resource) => `- ${resource}`),
@@ -1417,8 +1545,8 @@ class GoTrueClient {
         try {
             const { data, error } = await _request(this.fetch, 'POST', `${this.url}/token?grant_type=web3`, {
                 headers: this.headers,
-                body: Object.assign({ chain: 'solana', message, signature: bytesToBase64URL(signature) }, (((_l = credentials.options) === null || _l === void 0 ? void 0 : _l.captchaToken)
-                    ? { gotrue_meta_security: { captcha_token: (_m = credentials.options) === null || _m === void 0 ? void 0 : _m.captchaToken } }
+                body: Object.assign({ chain: 'solana', message, signature: bytesToBase64URL(signature) }, (((_m = credentials.options) === null || _m === void 0 ? void 0 : _m.captchaToken)
+                    ? { gotrue_meta_security: { captcha_token: (_o = credentials.options) === null || _o === void 0 ? void 0 : _o.captchaToken } }
                     : null)),
                 xform: _sessionResponse,
             });
@@ -1470,7 +1598,7 @@ class GoTrueClient {
             }
             if (data.session) {
                 await this._saveSession(data.session);
-                await this._notifyAllSubscribers('SIGNED_IN', data.session);
+                await this._notifyAllSubscribers(redirectType === 'recovery' ? 'PASSWORD_RECOVERY' : 'SIGNED_IN', data.session);
             }
             return this._returnResult({ data: Object.assign(Object.assign({}, data), { redirectType: redirectType !== null && redirectType !== void 0 ? redirectType : null }), error });
         }
@@ -1673,7 +1801,7 @@ class GoTrueClient {
      * ```
      */
     async signInWithOtp(credentials) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _f;
         try {
             if ('email' in credentials) {
                 const { email, options } = credentials;
@@ -1706,7 +1834,7 @@ class GoTrueClient {
                         data: (_c = options === null || options === void 0 ? void 0 : options.data) !== null && _c !== void 0 ? _c : {},
                         create_user: (_d = options === null || options === void 0 ? void 0 : options.shouldCreateUser) !== null && _d !== void 0 ? _d : true,
                         gotrue_meta_security: { captcha_token: options === null || options === void 0 ? void 0 : options.captchaToken },
-                        channel: (_e = options === null || options === void 0 ? void 0 : options.channel) !== null && _e !== void 0 ? _e : 'sms',
+                        channel: (_f = options === null || options === void 0 ? void 0 : options.channel) !== null && _f !== void 0 ? _f : 'sms',
                     },
                 });
                 return this._returnResult({
@@ -1952,7 +2080,7 @@ class GoTrueClient {
      * ```
      */
     async signInWithSSO(params) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _f;
         try {
             let codeChallenge = null;
             let codeChallengeMethod = null;
@@ -1968,7 +2096,7 @@ class GoTrueClient {
                 xform: _ssoResponse,
             });
             // Automatically redirect in browser unless skipBrowserRedirect is true
-            if (((_d = result.data) === null || _d === void 0 ? void 0 : _d.url) && isBrowser() && !((_e = params.options) === null || _e === void 0 ? void 0 : _e.skipBrowserRedirect)) {
+            if (((_d = result.data) === null || _d === void 0 ? void 0 : _d.url) && isBrowser() && !((_f = params.options) === null || _f === void 0 ? void 0 : _f.skipBrowserRedirect)) {
                 window.location.assign(result.data.url);
             }
             return this._returnResult(result);
@@ -2004,9 +2132,13 @@ class GoTrueClient {
      */
     async reauthenticate() {
         await this.initializePromise;
-        return await this._acquireLock(this.lockAcquireTimeout, async () => {
-            return await this._reauthenticate();
-        });
+        if (this.lock != null) {
+            // TODO(v3): remove legacy lock path
+            return await this._acquireLock(this.lockAcquireTimeout, async () => {
+                return await this._reauthenticate();
+            });
+        }
+        return await this._reauthenticate();
     }
     async _reauthenticate() {
         try {
@@ -2094,15 +2226,26 @@ class GoTrueClient {
             const endpoint = `${this.url}/resend`;
             if ('email' in credentials) {
                 const { email, type, options } = credentials;
+                let codeChallenge = null;
+                let codeChallengeMethod = null;
+                if (this.flowType === 'pkce') {
+                    ;
+                    [codeChallenge, codeChallengeMethod] = await getCodeChallengeAndMethod(this.storage, this.storageKey);
+                }
                 const { error } = await _request(this.fetch, 'POST', endpoint, {
                     headers: this.headers,
                     body: {
                         email,
                         type,
                         gotrue_meta_security: { captcha_token: options === null || options === void 0 ? void 0 : options.captchaToken },
+                        code_challenge: codeChallenge,
+                        code_challenge_method: codeChallengeMethod,
                     },
                     redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
                 });
+                if (error) {
+                    await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+                }
                 return this._returnResult({ data: { user: null, session: null }, error });
             }
             else if ('phone' in credentials) {
@@ -2123,6 +2266,7 @@ class GoTrueClient {
             throw new AuthInvalidCredentialsError('You must provide either an email or phone number and a type');
         }
         catch (error) {
+            await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
             if (isAuthError(error)) {
                 return this._returnResult({ data: { user: null, session: null }, error });
             }
@@ -2138,7 +2282,7 @@ class GoTrueClient {
      * to the client. If that storage is based on request cookies for example,
      * the values in it may not be authentic and therefore it's strongly advised
      * against using this method and its results in such circumstances. A warning
-     * will be emitted if this is detected. Use {@link #getUser()} instead.
+     * will be emitted if this is detected. Use {@link GoTrueClient.getUser} instead.
      *
      * @category Auth
      *
@@ -2149,7 +2293,7 @@ class GoTrueClient {
      * - If the session's access token is expired or is about to expire, this method will use the refresh token to refresh the session.
      * - When using in a browser, or you've called `startAutoRefresh()` in your environment (React Native, etc.) this function always returns a valid access token without refreshing the session itself, as this is done in the background. This function returns very fast.
      * - **IMPORTANT SECURITY NOTICE:** If using an insecure storage medium, such as cookies or request headers, the user object returned by this function **must not be trusted**. Always verify the JWT using `getClaims()` or your own JWT verification library to securely establish the user's identity and access. You can also use `getUser()` to fetch the user object directly from the Auth server for this purpose.
-     * - When using in a browser, this function is synchronized across all tabs using the [LockManager](https://developer.mozilla.org/en-US/docs/Web/API/LockManager) API. In other environments make sure you've defined a proper `lock` property, if necessary, to make sure there are no race conditions while the session is being refreshed.
+     * - Cross-tab refresh races are handled by the GoTrue server (the rotated token from the first tab is returned to subsequent tabs via the parent-of-active mechanism), so no client-side serialization is needed.
      *
      * @example Get the session data
      * ```js
@@ -2216,15 +2360,24 @@ class GoTrueClient {
      */
     async getSession() {
         await this.initializePromise;
-        const result = await this._acquireLock(this.lockAcquireTimeout, async () => {
-            return this._useSession(async (result) => {
-                return result;
+        if (this.lock != null) {
+            // TODO(v3): remove legacy lock path
+            return await this._acquireLock(this.lockAcquireTimeout, async () => {
+                return this._useSession(async (result) => {
+                    return result;
+                });
             });
+        }
+        return await this._useSession(async (result) => {
+            return result;
         });
-        return result;
     }
     /**
      * Acquires a global lock based on the storage key.
+     *
+     * TODO(v3): remove along with the legacy lock path. Only called when
+     * `this.lock` is non-null (custom lock supplied via constructor). The
+     * default lockless path bypasses this entirely.
      */
     async _acquireLock(acquireTimeout, fn) {
         this._debug('#_acquireLock', 'begin', acquireTimeout);
@@ -2241,7 +2394,7 @@ class GoTrueClient {
                     try {
                         await result;
                     }
-                    catch (e) {
+                    catch (_e) {
                         // we just care if it finished
                     }
                 })());
@@ -2280,15 +2433,17 @@ class GoTrueClient {
         }
     }
     /**
-     * Use instead of {@link #getSession} inside the library. It is
-     * semantically usually what you want, as getting a session involves some
-     * processing afterwards that requires only one client operating on the
-     * session at once across multiple tabs or processes.
+     * Use instead of {@link GoTrueClient.getSession} inside the library. Loads the session
+     * via `__loadSession` (which may trigger a refresh if the access token is
+     * within the expiry margin) and runs `fn` with the result.
      */
     async _useSession(fn) {
         this._debug('#_useSession', 'begin');
         try {
-            // the use of __loadSession here is the only correct use of the function!
+            // Concurrent callers may both reach __loadSession; storage reads are
+            // idempotent, and the only write path inside it (refresh) is
+            // single-flighted downstream by `refreshingDeferred` in
+            // `_callRefreshToken`. No serialization is needed at this layer.
             const result = await this.__loadSession();
             return await fn(result);
         }
@@ -2299,11 +2454,12 @@ class GoTrueClient {
     /**
      * NEVER USE DIRECTLY!
      *
-     * Always use {@link #_useSession}.
+     * Always use `_useSession`.
      */
     async __loadSession() {
         this._debug('#__loadSession()', 'begin');
-        if (!this.lockAcquired) {
+        if (this.lock != null && !this.lockAcquired) {
+            // TODO(v3): remove. Only meaningful on the legacy lock path.
             this._debug('#__loadSession()', 'used outside of an acquired lock!', new Error().stack);
         }
         try {
@@ -2357,6 +2513,25 @@ class GoTrueClient {
             }
             const { data: session, error } = await this._callRefreshToken(currentSession.refresh_token);
             if (error) {
+                // Proactive-preserve mirror: `_callRefreshToken` keeps the session
+                // in storage when refresh fails non-retryably but the access token
+                // is still inside its real expiry window. Hand the caller the
+                // still-valid session instead of translating the refresh error
+                // into `session: null`. If the access token has actually expired,
+                // the session is genuinely dead and the error stands. Explicit
+                // refresh entry points (`refreshSession`, `setSession`)
+                // intentionally bypass this fallback — they want to know the
+                // refresh failed.
+                const accessTokenStillValid = !!(currentSession.expires_at && currentSession.expires_at * 1000 > Date.now());
+                if (accessTokenStillValid) {
+                    // Race guard: a concurrent `signOut` may have cleared storage
+                    // during the refresh attempt. Don't hand back a session that no
+                    // longer exists on disk.
+                    const stillStored = (await getItemAsync(this.storage, this.storageKey));
+                    if (stillStored && stillStored.refresh_token === currentSession.refresh_token) {
+                        return this._returnResult({ data: { session: currentSession }, error: null });
+                    }
+                }
                 return this._returnResult({ data: { session: null }, error });
             }
             return this._returnResult({ data: { session }, error: null });
@@ -2446,9 +2621,16 @@ class GoTrueClient {
             return await this._getUser(jwt);
         }
         await this.initializePromise;
-        const result = await this._acquireLock(this.lockAcquireTimeout, async () => {
-            return await this._getUser();
-        });
+        let result;
+        if (this.lock != null) {
+            // TODO(v3): remove legacy lock path
+            result = await this._acquireLock(this.lockAcquireTimeout, async () => {
+                return await this._getUser();
+            });
+        }
+        else {
+            result = await this._getUser();
+        }
         if (result.data.user) {
             this.suppressGetSessionWarning = true;
         }
@@ -2609,9 +2791,13 @@ class GoTrueClient {
      */
     async updateUser(attributes, options = {}) {
         await this.initializePromise;
-        return await this._acquireLock(this.lockAcquireTimeout, async () => {
-            return await this._updateUser(attributes, options);
-        });
+        if (this.lock != null) {
+            // TODO(v3): remove legacy lock path
+            return await this._acquireLock(this.lockAcquireTimeout, async () => {
+                return await this._updateUser(attributes, options);
+            });
+        }
+        return await this._updateUser(attributes, options);
     }
     async _updateUser(attributes, options = {}) {
         try {
@@ -2780,9 +2966,13 @@ class GoTrueClient {
      */
     async setSession(currentSession) {
         await this.initializePromise;
-        return await this._acquireLock(this.lockAcquireTimeout, async () => {
-            return await this._setSession(currentSession);
-        });
+        if (this.lock != null) {
+            // TODO(v3): remove legacy lock path
+            return await this._acquireLock(this.lockAcquireTimeout, async () => {
+                return await this._setSession(currentSession);
+            });
+        }
+        return await this._setSession(currentSession);
     }
     async _setSession(currentSession) {
         try {
@@ -2960,9 +3150,13 @@ class GoTrueClient {
      */
     async refreshSession(currentSession) {
         await this.initializePromise;
-        return await this._acquireLock(this.lockAcquireTimeout, async () => {
-            return await this._refreshSession(currentSession);
-        });
+        if (this.lock != null) {
+            // TODO(v3): remove legacy lock path
+            return await this._acquireLock(this.lockAcquireTimeout, async () => {
+                return await this._refreshSession(currentSession);
+            });
+        }
+        return await this._refreshSession(currentSession);
     }
     async _refreshSession(currentSession) {
         try {
@@ -2999,6 +3193,7 @@ class GoTrueClient {
      * Gets the session data from a URL string
      */
     async _getSessionFromURL(params, callbackUrlType) {
+        var _a;
         try {
             if (!isBrowser())
                 throw new AuthImplicitGrantRedirectError('No browser detected.');
@@ -3037,7 +3232,10 @@ class GoTrueClient {
                 const url = new URL(window.location.href);
                 url.searchParams.delete('code');
                 window.history.replaceState(window.history.state, '', url.toString());
-                return { data: { session: data.session, redirectType: null }, error: null };
+                return {
+                    data: { session: data.session, redirectType: (_a = data.redirectType) !== null && _a !== void 0 ? _a : null },
+                    error: null,
+                };
             }
             const { provider_token, provider_refresh_token, access_token, refresh_token, expires_in, expires_at, token_type, } = params;
             if (!access_token || !expires_in || !refresh_token || !token_type) {
@@ -3096,7 +3294,7 @@ class GoTrueClient {
         if (typeof this.detectSessionInUrl === 'function') {
             return this.detectSessionInUrl(new URL(window.location.href), params);
         }
-        return Boolean(params.access_token || params.error_description);
+        return Boolean(params.access_token || params.error || params.error_description || params.error_code);
     }
     /**
      * Checks if the current URL and backing storage contain parameters given by a PKCE flow
@@ -3113,37 +3311,56 @@ class GoTrueClient {
      *
      * If using `others` scope, no `SIGNED_OUT` event is fired!
      *
+     * **Warning:** the default `scope` is `'global'`. This signs the user out of
+     * **every device they are currently signed in on**, not just the current
+     * tab/session. If you only want to sign the user out of the current session
+     * (the behavior most other auth libraries default to), pass
+     * `{ scope: 'local' }` explicitly.
+     *
      * @category Auth
      *
      * @remarks
      * - In order to use the `signOut()` method, the user needs to be signed in first.
-     * - By default, `signOut()` uses the global scope, which signs out all other sessions that the user is logged into as well. Customize this behavior by passing a scope parameter.
+     * - By default, `signOut()` uses the **global** scope, which signs out the user
+     *   on every device they are signed in on (not just the current one). Pass
+     *   `{ scope: 'local' }` to only sign out the current session. This is
+     *   usually what apps want on a "Sign out" button, especially when users
+     *   sign in from multiple devices and do not expect signing out of one to
+     *   terminate the others.
      * - Since Supabase Auth uses JWTs for authentication, the access token JWT will be valid until it's expired. When the user signs out, Supabase revokes the refresh token and deletes the JWT from the client-side. This does not revoke the JWT and it will still be valid until it expires.
      *
-     * @example Sign out (all sessions)
+     * @example Sign out of every device (global – default)
      * ```js
      * const { error } = await supabase.auth.signOut()
      * ```
      *
-     * @example Sign out (current session)
+     * @example Sign out only the current session (recommended for most apps)
      * ```js
      * const { error } = await supabase.auth.signOut({ scope: 'local' })
      * ```
      *
-     * @example Sign out (other sessions)
+     * @example Sign out of all other sessions, keep the current one
      * ```js
      * const { error } = await supabase.auth.signOut({ scope: 'others' })
      * ```
      */
     async signOut(options = { scope: 'global' }) {
         await this.initializePromise;
-        return await this._acquireLock(this.lockAcquireTimeout, async () => {
-            return await this._signOut(options);
-        });
+        if (this.lock != null) {
+            // TODO(v3): remove legacy lock path
+            return await this._acquireLock(this.lockAcquireTimeout, async () => {
+                return await this._signOut(options);
+            });
+        }
+        return await this._signOut(options);
     }
     async _signOut({ scope } = { scope: 'global' }) {
         return await this._useSession(async (result) => {
             var _a;
+            const removeCurrentSession = async () => {
+                await this._removeSession();
+                await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+            };
             const { data, error: sessionError } = result;
             if (sessionError && !isAuthSessionMissingError(sessionError)) {
                 return this._returnResult({ error: sessionError });
@@ -3157,13 +3374,15 @@ class GoTrueClient {
                     if (!((isAuthApiError(error) &&
                         (error.status === 404 || error.status === 401 || error.status === 403)) ||
                         isAuthSessionMissingError(error))) {
+                        if (scope !== 'others') {
+                            await removeCurrentSession();
+                        }
                         return this._returnResult({ error });
                     }
                 }
             }
             if (scope !== 'others') {
-                await this._removeSession();
-                await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+                await removeCurrentSession();
             }
             return this._returnResult({ error: null });
         });
@@ -3175,18 +3394,8 @@ class GoTrueClient {
      * - Subscribes to important events occurring on the user's session.
      * - Use on the frontend/client. It is less useful on the server.
      * - Events are emitted across tabs to keep your application's UI up-to-date. Some events can fire very frequently, based on the number of tabs open. Use a quick and efficient callback function, and defer or debounce as many operations as you can to be performed outside of the callback.
-     * - **Important:** A callback can be an `async` function and it runs synchronously during the processing of the changes causing the event. You can easily create a dead-lock by using `await` on a call to another method of the Supabase library.
-     *   - Avoid using `async` functions as callbacks.
-     *   - Limit the number of `await` calls in `async` callbacks.
-     *   - Do not use other Supabase functions in the callback function. If you must, dispatch the functions once the callback has finished executing. Use this as a quick way to achieve this:
-     *     ```js
-     *     supabase.auth.onAuthStateChange((event, session) => {
-     *       setTimeout(async () => {
-     *         // await on other Supabase function here
-     *         // this runs right after the callback has finished
-     *       }, 0)
-     *     })
-     *     ```
+     * - Callbacks can be `async` and can safely call other Supabase auth methods (`getUser`, `setSession`, etc.) from inside the callback.
+     * - Keep callbacks quick. Events are awaited in order, so a slow callback delays subsequent events to subscribers in this tab.
      * - Emitted events:
      *   - `INITIAL_SESSION`
      *     - Emitted right after the Supabase client is constructed and the initial session from storage is loaded.
@@ -3369,9 +3578,15 @@ class GoTrueClient {
         this.stateChangeEmitters.set(id, subscription);
         (async () => {
             await this.initializePromise;
-            await this._acquireLock(this.lockAcquireTimeout, async () => {
-                this._emitInitialSession(id);
-            });
+            if (this.lock != null) {
+                // TODO(v3): remove legacy lock path
+                await this._acquireLock(this.lockAcquireTimeout, async () => {
+                    this._emitInitialSession(id);
+                });
+            }
+            else {
+                await this._emitInitialSession(id);
+            }
         })();
         return { data: { subscription } };
     }
@@ -3388,7 +3603,10 @@ class GoTrueClient {
             catch (err) {
                 await ((_b = this.stateChangeEmitters.get(id)) === null || _b === void 0 ? void 0 : _b.callback('INITIAL_SESSION', null));
                 this._debug('INITIAL_SESSION', 'callback id', id, 'error', err);
-                if (isAuthSessionMissingError(err)) {
+                if (isAuthSessionMissingError(err) || isAuthRetryableFetchError(err)) {
+                    // A missing session or a transient/aborted network failure (e.g. a
+                    // superseded page navigation cancelling the in-flight request) is
+                    // not an application error — warn rather than surface it raw.
                     console.warn(err);
                 }
                 else {
@@ -3584,7 +3802,7 @@ class GoTrueClient {
         var _a;
         try {
             const { data, error } = await this._useSession(async (result) => {
-                var _a, _b, _c, _d, _e;
+                var _a, _b, _c, _d, _f;
                 const { data, error } = result;
                 if (error)
                     throw error;
@@ -3596,7 +3814,7 @@ class GoTrueClient {
                 });
                 return await _request(this.fetch, 'GET', url, {
                     headers: this.headers,
-                    jwt: (_e = (_d = data.session) === null || _d === void 0 ? void 0 : _d.access_token) !== null && _e !== void 0 ? _e : undefined,
+                    jwt: (_f = (_d = data.session) === null || _d === void 0 ? void 0 : _d.access_token) !== null && _f !== void 0 ? _f : undefined,
                 });
             });
             if (error)
@@ -3713,7 +3931,10 @@ class GoTrueClient {
      * @param refreshToken A valid refresh token that was returned on login.
      */
     async _refreshAccessToken(refreshToken) {
-        const debugName = `#_refreshAccessToken(${refreshToken.substring(0, 5)}...)`;
+        // Refresh tokens are long-lived bearer credentials; do NOT include any
+        // fragment of the token in the debug tag, even when `debug: true` is
+        // enabled (logs may be forwarded to third-party services).
+        const debugName = `#_refreshAccessToken()`;
         this._debug(debugName, 'begin');
         try {
             const startedAt = Date.now();
@@ -3820,10 +4041,17 @@ class GoTrueClient {
                 if (this.autoRefreshToken && currentSession.refresh_token) {
                     const { error } = await this._callRefreshToken(currentSession.refresh_token);
                     if (error) {
-                        console.error(error);
-                        if (!isAuthRetryableFetchError(error)) {
-                            this._debug(debugName, 'refresh failed with a non-retryable error, removing the session', error);
-                            await this._removeSession();
+                        // `_callRefreshToken` is the single source of truth for refresh
+                        // outcomes: it removes the session itself when the access token
+                        // is actually expired, and preserves it when the token is still
+                        // valid (proactive-preserve). Don't second-guess that here — a
+                        // local `_removeSession` would emit a duplicate `SIGNED_OUT` on
+                        // genuine failures and undo the proactive-preserve at init time.
+                        if (isAuthRefreshDiscardedError(error)) {
+                            this._debug(debugName, 'refresh discarded by commit guard', error);
+                        }
+                        else {
+                            this._debug(debugName, 'refresh failed', error);
                         }
                     }
                 }
@@ -3856,7 +4084,16 @@ class GoTrueClient {
         }
         catch (err) {
             this._debug(debugName, 'error', err);
-            console.error(err);
+            if (isAuthRetryableFetchError(err)) {
+                // Transient/aborted network failure during session recovery (e.g. a
+                // superseded page navigation cancelling the in-flight request). Warn
+                // rather than surface it raw; the session is untouched and recovery
+                // will run again on the next load.
+                console.warn(err);
+            }
+            else {
+                console.error(err);
+            }
             return;
         }
         finally {
@@ -3872,18 +4109,91 @@ class GoTrueClient {
         if (this.refreshingDeferred) {
             return this.refreshingDeferred.promise;
         }
-        const debugName = `#_callRefreshToken(${refreshToken.substring(0, 5)}...)`;
+        // Serial failure cooldown: callers passing the *same* refresh token
+        // after a recent failure receive the cached result instead of firing
+        // another `/token` request. This caps the proactive-refresh storm
+        // where every `getSession()` call inside the 90s EXPIRY_MARGIN_MS
+        // window kept re-firing against the same broken refresh token during
+        // outages. Concurrent callers already share `refreshingDeferred`; this
+        // cache covers serial callers spaced across cooldown windows.
+        //
+        // Token-keyed so callers with a fresh refresh token (rotation pickup
+        // from another tab, explicit `setSession`/`refreshSession({ refresh_token })`,
+        // multi-account switch) bypass the cache and attempt a real refresh.
+        if (this.lastRefreshFailure &&
+            this.lastRefreshFailure.refreshToken === refreshToken &&
+            Date.now() < this.lastRefreshFailure.expiresAt) {
+            this._debug('#_callRefreshToken()', 'returning cached failure (cooldown active)');
+            return this.lastRefreshFailure.result;
+        }
+        // Refresh tokens are long-lived bearer credentials; do NOT include any
+        // fragment of the token in the debug tag, even when `debug: true` is
+        // enabled (logs may be forwarded to third-party services).
+        const debugName = `#_callRefreshToken()`;
         this._debug(debugName, 'begin');
         try {
             this.refreshingDeferred = new Deferred();
+            // Snapshot storage before the fetch. The commit guard discards the
+            // rotated tokens only when a non-null pre-fetch snapshot changed under
+            // us — typical case: a concurrent `signOut` ran `_removeSession`, or
+            // another tab's refresh rewrote the slot. Callers passing
+            // externally-sourced tokens (SSR cookie handoff, multi-account
+            // switching, `setSession`/`refreshSession({ refresh_token })`) may
+            // start from a null snapshot OR from a non-null snapshot whose
+            // refresh_token differs from the one they're hydrating; in both
+            // cases the guard fires only when storage was *modified between
+            // snapshots*, not when the input token disagrees with what's stored.
+            const storedAtStart = (await getItemAsync(this.storage, this.storageKey));
             const { data, error } = await this._refreshAccessToken(refreshToken);
             if (error)
                 throw error;
             if (!data.session)
                 throw new AuthSessionMissingError();
+            const storedAfter = (await getItemAsync(this.storage, this.storageKey));
+            const storageChangedUnderUs = storedAtStart !== null &&
+                (storedAfter === null || storedAfter.refresh_token !== storedAtStart.refresh_token);
+            if (storageChangedUnderUs) {
+                this._debug(debugName, 'commit guard: storage changed since refresh started, discarding rotated tokens', {
+                    // Presence indicators only — never log refresh token fragments,
+                    // even partial. Logs may be forwarded to third-party services.
+                    startedWith: 'present',
+                    nowHolds: storedAfter ? 'replaced' : 'cleared',
+                });
+                const discarded = {
+                    data: null,
+                    error: new AuthRefreshDiscardedError(),
+                };
+                this.refreshingDeferred.resolve(discarded);
+                return discarded;
+            }
+            // Second leg of the commit guard: close the TOCTOU window between the
+            // synchronous `storageChangedUnderUs` check and the actual storage
+            // writes inside `_saveSession`. A concurrent `signOut → _removeSession`
+            // can land inside `_saveSession`'s `await setItemAsync(...)` yields and
+            // clear storage just before we overwrite it. Capture the epoch BEFORE
+            // the save and re-check after; if it advanced, undo the write directly
+            // (do NOT call `_removeSession` — that would emit a duplicate
+            // SIGNED_OUT for the concurrent signOut that already fired one).
+            const epochBeforeSave = this._sessionRemovalEpoch;
             await this._saveSession(data.session);
+            if (this._sessionRemovalEpoch !== epochBeforeSave) {
+                this._debug(debugName, 'commit guard (post-save): _removeSession ran during _saveSession, undoing write');
+                await removeItemAsync(this.storage, this.storageKey);
+                if (this.userStorage) {
+                    await removeItemAsync(this.userStorage, this.storageKey + '-user');
+                }
+                const discarded = {
+                    data: null,
+                    error: new AuthRefreshDiscardedError(),
+                };
+                this.refreshingDeferred.resolve(discarded);
+                return discarded;
+            }
             await this._notifyAllSubscribers('TOKEN_REFRESHED', data.session);
             const result = { data: data.session, error: null };
+            // Refresh succeeded — clear any cached failure so the next caller
+            // (including the auto-refresh ticker) attempts a real refresh again.
+            this.lastRefreshFailure = null;
             this.refreshingDeferred.resolve(result);
             return result;
         }
@@ -3892,8 +4202,35 @@ class GoTrueClient {
             if (isAuthError(error)) {
                 const result = { data: null, error };
                 if (!isAuthRetryableFetchError(error)) {
-                    await this._removeSession();
+                    // Proactive vs reactive distinction: a refresh fires whenever
+                    // the access token is within EXPIRY_MARGIN_MS of expiry. If the
+                    // access token is *still valid* at this moment, the refresh was
+                    // proactive and the existing session is still usable until its
+                    // real expiry — destroying it now would log out a user whose
+                    // access token works. If the access token has actually expired,
+                    // the refresh token is the only credential left and it just got
+                    // rejected — the session is genuinely dead. `__loadSession`
+                    // mirrors this distinction on the read path so callers see the
+                    // preserved session instead of `session: null`.
+                    const storedNow = (await getItemAsync(this.storage, this.storageKey));
+                    const accessTokenStillValid = !!((storedNow === null || storedNow === void 0 ? void 0 : storedNow.expires_at) && storedNow.expires_at * 1000 > Date.now());
+                    if (accessTokenStillValid) {
+                        this._debug(debugName, 'proactive refresh failed, access token still valid — preserving session');
+                    }
+                    else {
+                        await this._removeSession();
+                    }
                 }
+                // Cache the failure so serial callers (and the next auto-refresh
+                // tick) passing the same refresh token within the cooldown window
+                // receive it synchronously instead of firing another `/token`
+                // call. Set after the optional `_removeSession` above (which
+                // clears the cache as part of teardown) so the cache survives.
+                this.lastRefreshFailure = {
+                    refreshToken,
+                    result,
+                    expiresAt: Date.now() + REFRESH_FAILURE_COOLDOWN_MS,
+                };
                 (_a = this.refreshingDeferred) === null || _a === void 0 ? void 0 : _a.resolve(result);
                 return result;
             }
@@ -3906,6 +4243,19 @@ class GoTrueClient {
         }
     }
     async _notifyAllSubscribers(event, session, broadcast = true) {
+        if (this._pendingInitNotifications !== null && broadcast) {
+            // We're inside initialize() before initializePromise has resolved, and
+            // this notification originates from the init chain (_recoverAndRefresh),
+            // which always fires with broadcast = true. Enqueue instead of firing so
+            // that callbacks can safely call getSession() / getUser() without
+            // deadlocking on initializePromise.
+            //
+            // Notifications with broadcast = false come from the incoming
+            // BroadcastChannel handler (a cross-tab event), not the init chain, so
+            // they are fired immediately to preserve multi-tab ordering.
+            this._pendingInitNotifications.push({ event, session, broadcast });
+            return;
+        }
         const debugName = `#_notifyAllSubscribers(${event})`;
         this._debug(debugName, 'begin', session, `broadcast = ${broadcast}`);
         try {
@@ -3942,7 +4292,6 @@ class GoTrueClient {
         // _saveSession is always called whenever a new session has been acquired
         // so we can safely suppress the warning returned by future getSession calls
         this.suppressGetSessionWarning = true;
-        await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
         // Create a shallow copy to work with, to avoid mutating the original session object if it's used elsewhere
         const sessionToProcess = Object.assign({}, session);
         const userIsProxy = sessionToProcess.user && sessionToProcess.user.__isUserNotAvailableProxy === true;
@@ -3975,7 +4324,15 @@ class GoTrueClient {
         }
     }
     async _removeSession() {
+        // Bump synchronously, BEFORE any `await`, so that `_callRefreshToken`'s
+        // post-save check sees the increment whenever this method has started —
+        // even if it hasn't finished. Pairs with the epoch check in
+        // `_callRefreshToken`. See `_sessionRemovalEpoch` field doc.
+        this._sessionRemovalEpoch += 1;
         this._debug('#_removeSession()');
+        // The session is gone — no point holding on to a cached refresh failure
+        // for a token that no longer exists. Synchronous, before any `await`.
+        this.lastRefreshFailure = null;
         this.suppressGetSessionWarning = false;
         await removeItemAsync(this.storage, this.storageKey);
         await removeItemAsync(this.storage, this.storageKey + '-code-verifier');
@@ -3988,8 +4345,8 @@ class GoTrueClient {
     /**
      * Removes any registered visibilitychange callback.
      *
-     * {@see #startAutoRefresh}
-     * {@see #stopAutoRefresh}
+     * {@link GoTrueClient.startAutoRefresh}
+     * {@link GoTrueClient.stopAutoRefresh}
      */
     _removeVisibilityChangedCallback() {
         this._debug('#_removeVisibilityChangedCallback()');
@@ -4005,7 +4362,7 @@ class GoTrueClient {
         }
     }
     /**
-     * This is the private implementation of {@link #startAutoRefresh}. Use this
+     * This is the private implementation of {@link GoTrueClient.startAutoRefresh}. Use this
      * within the library.
      */
     async _startAutoRefresh() {
@@ -4047,7 +4404,7 @@ class GoTrueClient {
         }
     }
     /**
-     * This is the private implementation of {@link #stopAutoRefresh}. Use this
+     * This is the private implementation of {@link GoTrueClient.stopAutoRefresh}. Use this
      * within the library.
      */
     async _stopAutoRefresh() {
@@ -4083,7 +4440,7 @@ class GoTrueClient {
      * platform's foreground indication mechanism and call these methods
      * appropriately to conserve resources.
      *
-     * {@see #stopAutoRefresh}
+     * {@link GoTrueClient.stopAutoRefresh}
      *
      * @category Auth
      *
@@ -4117,7 +4474,7 @@ class GoTrueClient {
      * If you call this method any managed visibility change callback will be
      * removed and you must manage visibility changes on your own.
      *
-     * See {@link #startAutoRefresh} for more details.
+     * See {@link GoTrueClient.startAutoRefresh} for more details.
      *
      * @category Auth
      *
@@ -4145,47 +4502,122 @@ class GoTrueClient {
         this._removeVisibilityChangedCallback();
         await this._stopAutoRefresh();
     }
+    /**
+     * Tears down the client's background work: stops the auto-refresh interval,
+     * removes the `visibilitychange` listener, closes the cross-tab
+     * `BroadcastChannel`, and clears registered `onAuthStateChange` subscribers.
+     *
+     * Call this from cleanup hooks when the client is being replaced before
+     * its JS realm is destroyed. React Strict Mode and HMR are the common
+     * cases. Any in-flight `fetch` calls continue to completion and may still
+     * write to storage; dispose doesn't abort them or erase storage.
+     *
+     * Lifecycle caveat: because in-flight refreshes are not aborted, a
+     * disposed instance can still persist a rotated session to storage after
+     * `dispose()` returns. A subsequent `createClient` against the same
+     * `storageKey` will pick up that session on its next read. If you need
+     * strict isolation between client lifecycles, await any pending auth
+     * operation before calling `dispose()` (or change the `storageKey` for
+     * the replacement client).
+     *
+     * Safe to call repeatedly.
+     *
+     * @category Auth
+     *
+     * @example Cleanup on React unmount
+     * ```ts
+     * useEffect(() => {
+     *   const client = createClient(...)
+     *   return () => { client.auth.dispose() }
+     * }, [])
+     * ```
+     */
+    async dispose() {
+        var _a;
+        this._removeVisibilityChangedCallback();
+        await this._stopAutoRefresh();
+        (_a = this.broadcastChannel) === null || _a === void 0 ? void 0 : _a.close();
+        this.broadcastChannel = null;
+        this.stateChangeEmitters.clear();
+    }
     /**
      * Runs the auto refresh token tick.
      */
     async _autoRefreshTokenTick() {
         this._debug('#_autoRefreshTokenTick()', 'begin');
-        try {
-            await this._acquireLock(0, async () => {
-                try {
-                    const now = Date.now();
+        if (this.lock != null) {
+            // TODO(v3): remove legacy lock path. Uses `_acquireLock(0, ...)` which
+            // throws `LockAcquireTimeoutError` immediately if the lock is held —
+            // that's the fail-fast skip path that lets the tick bail out instead
+            // of queuing behind a long-running operation.
+            try {
+                await this._acquireLock(0, async () => {
                     try {
-                        return await this._useSession(async (result) => {
-                            const { data: { session }, } = result;
-                            if (!session || !session.refresh_token || !session.expires_at) {
-                                this._debug('#_autoRefreshTokenTick()', 'no session');
-                                return;
-                            }
-                            // session will expire in this many ticks (or has already expired if <= 0)
-                            const expiresInTicks = Math.floor((session.expires_at * 1000 - now) / AUTO_REFRESH_TICK_DURATION_MS);
-                            this._debug('#_autoRefreshTokenTick()', `access token expires in ${expiresInTicks} ticks, a tick lasts ${AUTO_REFRESH_TICK_DURATION_MS}ms, refresh threshold is ${AUTO_REFRESH_TICK_THRESHOLD} ticks`);
-                            if (expiresInTicks <= AUTO_REFRESH_TICK_THRESHOLD) {
-                                await this._callRefreshToken(session.refresh_token);
-                            }
-                        });
+                        const now = Date.now();
+                        try {
+                            return await this._useSession(async (result) => {
+                                const { data: { session }, } = result;
+                                if (!session || !session.refresh_token || !session.expires_at) {
+                                    this._debug('#_autoRefreshTokenTick()', 'no session');
+                                    return;
+                                }
+                                const expiresInTicks = Math.floor((session.expires_at * 1000 - now) / AUTO_REFRESH_TICK_DURATION_MS);
+                                this._debug('#_autoRefreshTokenTick()', `access token expires in ${expiresInTicks} ticks, a tick lasts ${AUTO_REFRESH_TICK_DURATION_MS}ms, refresh threshold is ${AUTO_REFRESH_TICK_THRESHOLD} ticks`);
+                                if (expiresInTicks <= AUTO_REFRESH_TICK_THRESHOLD) {
+                                    await this._callRefreshToken(session.refresh_token);
+                                }
+                            });
+                        }
+                        catch (e) {
+                            console.error('Auto refresh tick failed with error. This is likely a transient error.', e);
+                        }
                     }
-                    catch (e) {
-                        console.error('Auto refresh tick failed with error. This is likely a transient error.', e);
+                    finally {
+                        this._debug('#_autoRefreshTokenTick()', 'end');
                     }
+                });
+            }
+            catch (e) {
+                if (e instanceof LockAcquireTimeoutError) {
+                    this._debug('auto refresh token tick lock not available');
                 }
-                finally {
-                    this._debug('#_autoRefreshTokenTick()', 'end');
+                else {
+                    throw e;
                 }
-            });
+            }
+            return;
         }
-        catch (e) {
-            if (e.isAcquireTimeout || e instanceof LockAcquireTimeoutError) {
-                this._debug('auto refresh token tick lock not available');
+        // Lockless default: skip if a refresh is already in flight.
+        // `_callRefreshToken` also dedupes via the same field; this is just a
+        // fast-path skip to avoid an unnecessary storage read.
+        if (this.refreshingDeferred !== null) {
+            this._debug('#_autoRefreshTokenTick()', 'refresh already in flight, skipping');
+            return;
+        }
+        try {
+            const now = Date.now();
+            try {
+                await this._useSession(async (result) => {
+                    const { data: { session }, } = result;
+                    if (!session || !session.refresh_token || !session.expires_at) {
+                        this._debug('#_autoRefreshTokenTick()', 'no session');
+                        return;
+                    }
+                    // session will expire in this many ticks (or has already expired if <= 0)
+                    const expiresInTicks = Math.floor((session.expires_at * 1000 - now) / AUTO_REFRESH_TICK_DURATION_MS);
+                    this._debug('#_autoRefreshTokenTick()', `access token expires in ${expiresInTicks} ticks, a tick lasts ${AUTO_REFRESH_TICK_DURATION_MS}ms, refresh threshold is ${AUTO_REFRESH_TICK_THRESHOLD} ticks`);
+                    if (expiresInTicks <= AUTO_REFRESH_TICK_THRESHOLD) {
+                        await this._callRefreshToken(session.refresh_token);
+                    }
+                });
             }
-            else {
-                throw e;
+            catch (e) {
+                console.error('Auto refresh tick failed with error. This is likely a transient error.', e);
             }
         }
+        finally {
+            this._debug('#_autoRefreshTokenTick()', 'end');
+        }
     }
     /**
      * Registers callbacks on the browser / platform, which in-turn run
@@ -4234,18 +4666,26 @@ class GoTrueClient {
             if (!calledFromInitialize) {
                 // called when the visibility has changed, i.e. the browser
                 // transitioned from hidden -> visible so we need to see if the session
-                // should be recovered immediately... but to do that we need to acquire
-                // the lock first asynchronously
+                // should be recovered
                 await this.initializePromise;
-                await this._acquireLock(this.lockAcquireTimeout, async () => {
+                if (this.lock != null) {
+                    // TODO(v3): remove legacy lock path
+                    await this._acquireLock(this.lockAcquireTimeout, async () => {
+                        if (document.visibilityState !== 'visible') {
+                            this._debug(methodName, 'acquired the lock to recover the session, but the browser visibilityState is no longer visible, aborting');
+                            return;
+                        }
+                        await this._recoverAndRefresh();
+                    });
+                }
+                else {
                     if (document.visibilityState !== 'visible') {
-                        this._debug(methodName, 'acquired the lock to recover the session, but the browser visibilityState is no longer visible, aborting');
-                        // visibility has changed while waiting for the lock, abort
+                        this._debug(methodName, 'visibilityState is no longer visible, skipping recovery');
                         return;
                     }
                     // recover the session
                     await this._recoverAndRefresh();
-                });
+                }
             }
         }
         else if (document.visibilityState === 'hidden') {
@@ -4341,7 +4781,7 @@ class GoTrueClient {
         }
     }
     async _verify(params) {
-        return this._acquireLock(this.lockAcquireTimeout, async () => {
+        const run = async () => {
             try {
                 return await this._useSession(async (result) => {
                     var _a;
@@ -4375,10 +4815,15 @@ class GoTrueClient {
                 }
                 throw error;
             }
-        });
+        };
+        if (this.lock != null) {
+            // TODO(v3): remove legacy lock path
+            return this._acquireLock(this.lockAcquireTimeout, run);
+        }
+        return run();
     }
     async _challenge(params) {
-        return this._acquireLock(this.lockAcquireTimeout, async () => {
+        const run = async () => {
             try {
                 return await this._useSession(async (result) => {
                     var _a;
@@ -4418,14 +4863,17 @@ class GoTrueClient {
                 }
                 throw error;
             }
-        });
+        };
+        if (this.lock != null) {
+            // TODO(v3): remove legacy lock path
+            return this._acquireLock(this.lockAcquireTimeout, run);
+        }
+        return run();
     }
     /**
-     * {@see GoTrueMFAApi#challengeAndVerify}
+     * {@link GoTrueMFAApi#challengeAndVerify}
      */
     async _challengeAndVerify(params) {
-        // both _challenge and _verify independently acquire the lock, so no need
-        // to acquire it here
         const { data: challengeData, error: challengeError } = await this._challenge({
             factorId: params.factorId,
         });
@@ -4439,11 +4887,10 @@ class GoTrueClient {
         });
     }
     /**
-     * {@see GoTrueMFAApi#listFactors}
+     * {@link GoTrueMFAApi#listFactors}
      */
     async _listFactors() {
         var _a;
-        // use #getUser instead of #_getUser as the former acquires a lock
         const { data: { user }, error: userError, } = await this.getUser();
         if (userError) {
             return { data: null, error: userError };
@@ -4468,7 +4915,7 @@ class GoTrueClient {
         };
     }
     /**
-     * {@see GoTrueMFAApi#getAuthenticatorAssuranceLevel}
+     * {@link GoTrueMFAApi#getAuthenticatorAssuranceLevel}
      */
     async _getAuthenticatorAssuranceLevel(jwt) {
         var _a, _b, _c, _d;
@@ -4719,15 +5166,15 @@ class GoTrueClient {
      * Extracts the JWT claims present in the access token by first verifying the
      * JWT against the server's JSON Web Key Set endpoint
      * `/.well-known/jwks.json` which is often cached, resulting in significantly
-     * faster responses. Prefer this method over {@link #getUser} which always
+     * faster responses. Prefer this method over {@link GoTrueClient.getUser} which always
      * sends a request to the Auth server for each JWT.
      *
      * If the project is not using an asymmetric JWT signing key (like ECC or
-     * RSA) it always sends a request to the Auth server (similar to {@link
-     * #getUser}) to verify the JWT.
+     * RSA) it always sends a request to the Auth server (similar to
+     * {@link GoTrueClient.getUser}) to verify the JWT.
      *
      * @param jwt An optional specific JWT you wish to verify, not the one you
-     *            can obtain from {@link #getSession}.
+     *            can obtain from {@link GoTrueClient.getSession}.
      * @param options Various additional options that allow you to customize the
      *                behavior of this method.
      *
@@ -4792,8 +5239,14 @@ class GoTrueClient {
             }
             const { header, payload, signature, raw: { header: rawHeader, payload: rawPayload }, } = decodeJWT(token);
             if (!(options === null || options === void 0 ? void 0 : options.allowExpired)) {
-                // Reject expired JWTs should only happen if jwt argument was passed
-                validateExp(payload.exp);
+                // Reject expired JWTs should only happen if jwt argument was passed.
+                // Rethrow as AuthInvalidJwtError so the outer catch converts it to { data, error }.
+                try {
+                    validateExp(payload.exp);
+                }
+                catch (e) {
+                    throw new AuthInvalidJwtError(e instanceof Error ? e.message : 'JWT validation failed');
+                }
             }
             const signingKey = !header.alg ||
                 header.alg.startsWith('HS') ||
@@ -4844,6 +5297,335 @@ class GoTrueClient {
             throw error;
         }
     }
+    // --- Passkey Methods ---
+    /**
+     * Sign in with a passkey. Handles the full WebAuthn ceremony:
+     * 1. Fetches authentication challenge from server
+     * 2. Prompts user via navigator.credentials.get()
+     * 3. Verifies credential with server and creates session
+     *
+     * Requires `auth.experimental.passkey: true`.
+     *
+     * @category Auth
+     */
+    async signInWithPasskey(credentials) {
+        var _a, _b, _c;
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            if (!browserSupportsWebAuthn()) {
+                return this._returnResult({
+                    data: null,
+                    error: new AuthUnknownError('Browser does not support WebAuthn', null),
+                });
+            }
+            // 1. Get challenge options from server
+            const { data: options, error: optionsError } = await this._startPasskeyAuthentication({
+                options: { captchaToken: (_a = credentials === null || credentials === void 0 ? void 0 : credentials.options) === null || _a === void 0 ? void 0 : _a.captchaToken },
+            });
+            if (optionsError || !options) {
+                return this._returnResult({ data: null, error: optionsError });
+            }
+            // 2. Deserialize and prompt user via browser WebAuthn API
+            const publicKeyOptions = deserializeCredentialRequestOptions(options.options);
+            const signal = (_c = (_b = credentials === null || credentials === void 0 ? void 0 : credentials.options) === null || _b === void 0 ? void 0 : _b.signal) !== null && _c !== void 0 ? _c : webAuthnAbortService.createNewAbortSignal();
+            const { data: credential, error: credentialError } = await getCredential({
+                publicKey: publicKeyOptions,
+                signal,
+            });
+            if (credentialError || !credential) {
+                return this._returnResult({
+                    data: null,
+                    error: credentialError !== null && credentialError !== void 0 ? credentialError : new AuthUnknownError('WebAuthn ceremony failed', null),
+                });
+            }
+            // 3. Serialize and verify with server
+            const serialized = serializeCredentialRequestResponse(credential);
+            return this._verifyPasskeyAuthentication({
+                challengeId: options.challenge_id,
+                credential: serialized,
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Register a passkey for the current authenticated user. Handles the full WebAuthn ceremony:
+     * 1. Fetches registration challenge from server
+     * 2. Prompts user via navigator.credentials.create()
+     * 3. Verifies credential with server
+     *
+     * Requires an active session. Requires `auth.experimental.passkey: true`.
+     *
+     * @category Auth
+     */
+    async registerPasskey(credentials) {
+        var _a, _b;
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            if (!browserSupportsWebAuthn()) {
+                return this._returnResult({
+                    data: null,
+                    error: new AuthUnknownError('Browser does not support WebAuthn', null),
+                });
+            }
+            // 1. Get challenge options from server
+            const { data: options, error: optionsError } = await this._startPasskeyRegistration();
+            if (optionsError || !options) {
+                return this._returnResult({ data: null, error: optionsError });
+            }
+            // 2. Deserialize and prompt user via browser WebAuthn API
+            const publicKeyOptions = deserializeCredentialCreationOptions(options.options);
+            const signal = (_b = (_a = credentials === null || credentials === void 0 ? void 0 : credentials.options) === null || _a === void 0 ? void 0 : _a.signal) !== null && _b !== void 0 ? _b : webAuthnAbortService.createNewAbortSignal();
+            const { data: credential, error: credentialError } = await createCredential({
+                publicKey: publicKeyOptions,
+                signal,
+            });
+            if (credentialError || !credential) {
+                return this._returnResult({
+                    data: null,
+                    error: credentialError !== null && credentialError !== void 0 ? credentialError : new AuthUnknownError('WebAuthn ceremony failed', null),
+                });
+            }
+            // 3. Serialize and verify with server
+            const serialized = serializeCredentialCreationResponse(credential);
+            return this._verifyPasskeyRegistration({
+                challengeId: options.challenge_id,
+                credential: serialized,
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Start passkey registration for the current authenticated user.
+     * Returns WebAuthn credential creation options to pass to navigator.credentials.create().
+     */
+    async _startPasskeyRegistration() {
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                if (!session) {
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                const { data, error } = await _request(this.fetch, 'POST', `${this.url}/passkeys/registration/options`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    body: {},
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Verify passkey registration with the credential response.
+     * The credentialResponse should be the serialized output of navigator.credentials.create().
+     */
+    async _verifyPasskeyRegistration(params) {
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                if (!session) {
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                const { data, error } = await _request(this.fetch, 'POST', `${this.url}/passkeys/registration/verify`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    body: {
+                        challenge_id: params.challengeId,
+                        credential: params.credential,
+                    },
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Start passkey authentication.
+     * Returns WebAuthn credential request options to pass to navigator.credentials.get().
+     */
+    async _startPasskeyAuthentication(params) {
+        var _a;
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            const { data, error } = await _request(this.fetch, 'POST', `${this.url}/passkeys/authentication/options`, {
+                headers: this.headers,
+                body: {
+                    gotrue_meta_security: { captcha_token: (_a = params === null || params === void 0 ? void 0 : params.options) === null || _a === void 0 ? void 0 : _a.captchaToken },
+                },
+            });
+            if (error) {
+                return this._returnResult({ data: null, error });
+            }
+            return this._returnResult({ data, error: null });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Verify passkey authentication and create a session.
+     * The credential should be the serialized output of navigator.credentials.get().
+     */
+    async _verifyPasskeyAuthentication(params) {
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            const { data, error } = await _request(this.fetch, 'POST', `${this.url}/passkeys/authentication/verify`, {
+                headers: this.headers,
+                body: {
+                    challenge_id: params.challengeId,
+                    credential: params.credential,
+                },
+                xform: _sessionResponse,
+            });
+            if (error) {
+                return this._returnResult({ data: null, error });
+            }
+            if (data.session) {
+                await this._saveSession(data.session);
+                await this._notifyAllSubscribers('SIGNED_IN', data.session);
+            }
+            return this._returnResult({ data, error: null });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * List all passkeys for the current user.
+     */
+    async _listPasskeys() {
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                if (!session) {
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                const { data, error } = await _request(this.fetch, 'GET', `${this.url}/passkeys`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    xform: (data) => ({ data, error: null }),
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Update a passkey.
+     */
+    async _updatePasskey(params) {
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                if (!session) {
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                const { data, error } = await _request(this.fetch, 'PATCH', `${this.url}/passkeys/${params.passkeyId}`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    body: { friendly_name: params.friendlyName },
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Delete a passkey.
+     */
+    async _deletePasskey(params) {
+        assertPasskeyExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                if (!session) {
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                const { error } = await _request(this.fetch, 'DELETE', `${this.url}/passkeys/${params.passkeyId}`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    noResolveJson: true,
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data: null, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
 }
 GoTrueClient.nextInstanceID = {};
 export default GoTrueClient;