@supacloud/lite 0.33.0 → 0.33.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.33.2](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.33.1...supacloud-lite-v0.33.2) (2026-10-25)
+
+
+### Bug Fixes
+
+* **lite:** preserve shared realtime presence sessions ([#2242](https://github.com/vibeunion/supacloud/issues/2242)) ([b6cff5a](https://github.com/vibeunion/supacloud/commit/b6cff5a4117a093fb7c75034bf09575eddb74bd8))
+
+
+### Miscellaneous Chores
+
+* **deps:** refresh the Elysia runtime and dependency matrix ([#2243](https://github.com/vibeunion/supacloud/issues/2243)) ([917ff0f](https://github.com/vibeunion/supacloud/commit/917ff0fa81e3c47d86d18e8c58fff79c0f0f67f5))
+
+## [0.33.1](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.33.0...supacloud-lite-v0.33.1) (2026-10-19)
+
+
+### Miscellaneous Chores
+
+* **lite:** restore Supabase SDK 2.118.0 ([#2161](https://github.com/vibeunion/supacloud/issues/2161)) ([0c7d4d0](https://github.com/vibeunion/supacloud/commit/0c7d4d08ed10cce4adcf5d30c9e7e473bc7f492a))
+
 ## [0.33.0](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.32.0...supacloud-lite-v0.33.0) (2026-10-19)
 
 

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.33.0",
+  version: "0.33.2",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -47,7 +47,7 @@ var package_default = {
     clean: "bun -e 'import { $ } from \"bun\"; await $`rm -rf dist`'",
     dev: "bun run src/cli.ts start",
     start: "bun run src/cli.ts start",
-    test: "bun test --timeout 20000",
+    test: "bun run scripts/run-tests.ts",
     "test:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun test test/native-engine.test.ts test/qauth-workflow-matrix.test.ts test/maker-checker-workflow.test.ts test/commands-artifacts.test.ts --timeout 180000",
     "test:graphql": "SUPACLOUD_LITE_TEST_GRAPHQL=1 bun test test/graphql-native.test.ts --timeout 180000",
     benchmark: "bun run scripts/benchmark.ts",
@@ -67,31 +67,31 @@ var package_default = {
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "0.20.0",
+    "@supacloud/db": "0.20.1",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
-    typebox: "1.3.37"
+    typebox: "1.4.2"
   },
   devDependencies: {
-    "@supacloud/app": "0.30.0",
-    "@supacloud/contracts": "0.13.0",
-    "@supacloud/compiler": "0.49.0",
-    "@supacloud/elysia": "0.35.0",
-    "@supabase/supabase-js": "^2.117.3",
+    "@supacloud/app": "0.33.0",
+    "@supacloud/contracts": "0.15.1",
+    "@supacloud/compiler": "0.51.1",
+    "@supacloud/elysia": "0.36.1",
+    "@supabase/supabase-js": "^2.118.0",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
-    elysia: "2.0.0-beta.32",
-    jose: "^6.2.12",
+    elysia: "2.0.0-rc.0",
+    jose: "^6.2.13",
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "0.20.0",
-    "@supacloud/app": "0.30.0",
-    "@supacloud/compiler": "0.49.0",
-    "@supacloud/elysia": "0.35.0",
-    "@supacloud/contracts": "0.13.0",
-    "@supacloud/commands": "0.11.0",
-    "@supacloud/delivery": "0.21.0",
+    "@supacloud/db": "0.20.1",
+    "@supacloud/app": "0.33.0",
+    "@supacloud/compiler": "0.51.1",
+    "@supacloud/elysia": "0.36.1",
+    "@supacloud/contracts": "0.15.1",
+    "@supacloud/commands": "0.11.1",
+    "@supacloud/delivery": "0.21.1",
     "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
@@ -245,7 +245,7 @@ function isAllowedRedirect(requested, siteUrl, allowList = []) {
 var encoder2 = new TextEncoder;
 var decoder2 = new TextDecoder;
 var strictDecoder = new TextDecoder("utf-8", { fatal: true });
-var MAX_INT32 = 2 ** 32;
+var UINT32_RANGE = 2 ** 32;
 function concat(...buffers) {
   const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
   let i = 0;
@@ -404,23 +404,23 @@ function isDisjoint(...headers) {
 function decodeBase64url(value, label, ErrorClass) {
   try {
     return decode(value);
-  } catch {
-    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  } catch (cause) {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`, { cause });
   }
 }
-function encodeBase64url(value, label, ErrorClass) {
+function encodeAsciiMember(value, label, ErrorClass) {
   try {
     return encode(value);
-  } catch {
-    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  } catch (cause) {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`, { cause });
   }
 }
-function parseJoseHeader(b64, ErrorClass, message) {
+function parseJoseHeader(encodedProtectedHeader, ErrorClass, message) {
   let parsed;
   try {
-    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
-  } catch {
-    throw new ErrorClass(message);
+    parsed = JSON.parse(strictDecoder.decode(decode(encodedProtectedHeader)));
+  } catch (cause) {
+    throw new ErrorClass(message, { cause });
   }
   if (!isObject(parsed))
     throw new ErrorClass(message);
@@ -478,15 +478,15 @@ var jwkMatchesOp = (entry, key, usage) => {
   }
 };
 async function prepareKey(entry, key, usage) {
-  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+  const { alg, secret } = entry, requiresPrivateKey = usage === "decrypt" || usage === "sign";
   if (secret && key instanceof Uint8Array)
     return key;
   let normalized, keyObject;
   if (isObject(key)) {
     if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
       throw invalidKeyType(alg, key, secret);
-    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === undefined && normalized.priv === undefined)))
-      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (requiresPrivateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === undefined && normalized.priv === undefined)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${requiresPrivateKey ? "private" : "public"} JWK`);
     if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
       return decode(normalized.k);
     if (!Object.isFrozen(key)) {
@@ -496,7 +496,7 @@ async function prepareKey(entry, key, usage) {
   } else {
     if (!isKeyLike(key))
       throw invalidKeyType(alg, key, secret);
-    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    const expectedType = secret ? "secret" : requiresPrivateKey ? "private" : "public";
     if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
       throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
     if (isCryptoKey(key))
@@ -635,8 +635,8 @@ function eddsa() {
     usages: sig
   };
 }
-function mldsa(bits) {
-  const subtle = { name: `ML-DSA-${bits}` };
+function mldsa(parameterSet) {
+  const subtle = { name: `ML-DSA-${parameterSet}` };
   return {
     kty: ["AKP"],
     subtle,
@@ -674,21 +674,23 @@ function jwsAlgorithm(alg) {
 function prepareVerify(options) {
   return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
 }
-function parseProtectedHeader(encodedProtected) {
-  return encodedProtected === undefined ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+function parseProtectedHeader(encodedProtectedHeader) {
+  return encodedProtectedHeader === undefined ? {} : parseJoseHeader(encodedProtectedHeader, JWSInvalid, "JWS Protected Header is invalid");
 }
 function encodeCompactUnencodedPayload(payload) {
   try {
     return encode(payload);
-  } catch {
-    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+  } catch (cause) {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters", {
+      cause
+    });
   }
 }
 async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
-  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
-  if (!isDisjoint(parsedProt, header))
+  const { protected: encodedProtectedHeader, header, payload: inputPayload } = jws, protectedHeader = parsedProtected ?? parseProtectedHeader(encodedProtectedHeader);
+  if (!isDisjoint(protectedHeader, header))
     throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  const joseHeader = { ...protectedHeader, ...header }, b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], protectedHeader, joseHeader)), { alg } = joseHeader;
   if (typeof alg != "string" || !alg)
     throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
   if (shared[0] && !shared[0].has(alg))
@@ -700,17 +702,19 @@ async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedP
     throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
   const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
   let resolvedKey = false;
-  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
-  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array, encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+  typeof key == "function" && (key = await key(protectedHeader, jws), resolvedKey = true);
+  const entry = jwsAlgorithm(alg), signingInput = concat(encodedProtectedHeader !== undefined ? encode(encodedProtectedHeader) : new Uint8Array, encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeAsciiMember(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), verificationKey = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(verificationKey, entry.subtle, "verify");
   entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
   let verified = false;
   try {
-    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
-  } catch {}
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, signingInput);
+  } catch (cause) {
+    throw new JWSSignatureVerificationFailed(undefined, { cause });
+  }
   if (!verified)
     throw new JWSSignatureVerificationFailed;
   const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
-  return encodedProtected !== undefined && (result.protectedHeader = parsedProt), header !== undefined && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
+  return encodedProtectedHeader !== undefined && (result.protectedHeader = protectedHeader), header !== undefined && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: verificationKey }, b64] : [result, b64];
 }
 async function verifyCompact(jws, shared, key) {
   if (jws instanceof Uint8Array && (jws = decoder2.decode(jws)), typeof jws != "string")
@@ -740,8 +744,8 @@ function secs(str) {
   typeof str != "string" && invalidDuration();
   const matched = REGEX.exec(str);
   (!matched || matched[4] && matched[1]) && invalidDuration();
-  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+  const value = parseFloat(matched[2]), durationSeconds = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(durationSeconds) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -durationSeconds : durationSeconds;
 }
 function validateInput(label, input) {
   if (!Number.isFinite(input))
@@ -753,33 +757,35 @@ var normalizeTyp = (value) => {
   return value.includes("/") ? normalized : `application/${normalized}`;
 };
 var checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
-function validateNumericDate(payload, claim, required = false) {
-  const value = payload[claim];
+function validateNumericDate(claimsSet, claim, required = false) {
+  const value = claimsSet[claim];
   if (!(value === undefined && !required)) {
     if (typeof value != "number")
-      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, claimsSet, claim, "invalid");
     return value;
   }
 }
-function unexpectedClaim(payload, claim) {
-  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+function unexpectedClaim(claimsSet, claim) {
+  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, claimsSet, claim, checkFailed);
 }
-function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-  let payload;
+function validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {
+  let claimsSet;
   try {
-    payload = JSON.parse(strictDecoder.decode(encodedPayload));
-  } catch {}
-  if (!isObject(payload))
+    claimsSet = JSON.parse(strictDecoder.decode(claimsSetBytes));
+  } catch (cause) {
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object", { cause });
+  }
+  if (!isObject(claimsSet))
     throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
   const { typ } = options;
   if (typ !== undefined && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
-    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', claimsSet, "typ", checkFailed);
   const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
   maxTokenAge !== undefined && presenceCheck.push("iat"), audience !== undefined && presenceCheck.push("aud"), subject !== undefined && presenceCheck.push("sub"), issuer !== undefined && presenceCheck.push("iss");
   for (const claim of new Set(presenceCheck.reverse()))
-    if (!Object.hasOwn(payload, claim))
-      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-  issuer !== undefined && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== undefined && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== undefined && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+    if (!Object.hasOwn(claimsSet, claim))
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claimsSet, claim, "missing");
+  issuer !== undefined && !(Array.isArray(issuer) ? issuer : [issuer]).includes(claimsSet.iss) && unexpectedClaim(claimsSet, "iss"), subject !== undefined && claimsSet.sub !== subject && unexpectedClaim(claimsSet, "sub"), audience !== undefined && !checkAudiencePresence(claimsSet.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(claimsSet, "aud");
   const { clockTolerance } = options;
   let tolerance = 0;
   if (typeof clockTolerance == "string")
@@ -790,20 +796,20 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
     tolerance = clockTolerance;
   }
   validateInput("clockTolerance option", tolerance);
-  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === undefined ? /* @__PURE__ */ new Date : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== undefined), nbf = validateNumericDate(payload, "nbf");
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === undefined ? /* @__PURE__ */ new Date : currentDate)), iat = validateNumericDate(claimsSet, "iat", maxTokenAge !== undefined), nbf = validateNumericDate(claimsSet, "nbf");
   if (nbf !== undefined && nbf > now + tolerance)
-    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
-  const exp = validateNumericDate(payload, "exp");
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', claimsSet, "nbf", checkFailed);
+  const exp = validateNumericDate(claimsSet, "exp");
   if (exp !== undefined && exp <= now - tolerance)
-    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+    throw new JWTExpired('"exp" claim timestamp check failed', claimsSet, "exp", checkFailed);
   if (maxTokenAge !== undefined) {
     const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
     if (age - tolerance > max)
-      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', claimsSet, "iat", checkFailed);
     if (age < -tolerance)
-      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', claimsSet, "iat", checkFailed);
   }
-  return payload;
+  return claimsSet;
 }
 
 // node_modules/jose/dist/webapi/jwt/verify.js
@@ -838,7 +844,9 @@ function createLocalJWKSet(jwks) {
   let snapshot;
   try {
     snapshot = structuredClone(jwks);
-  } catch {}
+  } catch (cause) {
+    throw new JWKSInvalid("JSON Web Key Set malformed", { cause });
+  }
   if (!isJwkSet(snapshot))
     throw new JWKSInvalid("JSON Web Key Set malformed");
   const metadata = snapshot.keys.map((jwk) => {
@@ -872,7 +880,7 @@ function isCloudflareWorkers() {
   return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 var USER_AGENT;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.13");
 var customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url, {
@@ -881,14 +889,14 @@ async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
     redirect: "manual",
     headers
   }).catch((err) => {
-    throw err.name === "TimeoutError" ? new JWKSTimeout : err;
+    throw err.name === "TimeoutError" ? new JWKSTimeout(undefined, { cause: err }) : err;
   });
   if (response.status !== 200)
     throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
   try {
     return await response.json();
-  } catch {
-    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  } catch (cause) {
+    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON", { cause });
   }
 }
 var jwksCache = /* @__PURE__ */ Symbol();
@@ -9772,8 +9780,7 @@ class RealtimeEngine {
       private: isPrivate,
       canBroadcast
     };
-    if (this.resolveExternalToken)
-      this.leaveChannel(conn, msg.topic);
+    this.leaveChannel(conn, msg.topic);
     conn.channels.set(msg.topic, channel);
     this.scheduleExternalExpiry(conn, channel);
     this.reply(conn, msg, "ok", {
@@ -9813,21 +9820,32 @@ class RealtimeEngine {
     if (channel.expiryTimer)
       clearTimeout(channel.expiryTimer);
     conn.channels.delete(topic);
-    const state = this.presence.get(topic);
-    if (state?.has(channel.presenceKey)) {
-      const metas = state.get(channel.presenceKey);
-      if (!metas)
-        return;
+    this.removePresence(channel);
+  }
+  removePresence(channel) {
+    const presenceRef = channel.presenceRef;
+    if (!presenceRef)
+      return;
+    channel.presenceRef = undefined;
+    const state = this.presence.get(channel.topic);
+    const current = state?.get(channel.presenceKey);
+    const leaving = current?.metas.find((meta) => meta.phx_ref === presenceRef);
+    if (!state || !current || !leaving)
+      return;
+    const remaining = current.metas.filter((meta) => meta.phx_ref !== presenceRef);
+    if (remaining.length > 0) {
+      state.set(channel.presenceKey, { metas: remaining });
+    } else {
       state.delete(channel.presenceKey);
       if (state.size === 0)
-        this.presence.delete(topic);
-      this.broadcastToTopic(topic, {
-        topic,
-        event: "presence_diff",
-        payload: { joins: {}, leaves: { [channel.presenceKey]: metas } },
-        ref: null
-      });
+        this.presence.delete(channel.topic);
     }
+    this.broadcastToTopic(channel.topic, {
+      topic: channel.topic,
+      event: "presence_diff",
+      payload: { joins: {}, leaves: { [channel.presenceKey]: { metas: [leaving] } } },
+      ref: null
+    });
   }
   scheduleExternalExpiry(conn, channel) {
     if (channel.expiryTimer)
@@ -9907,23 +9925,30 @@ class RealtimeEngine {
       return;
     const event = String(msg.payload?.event ?? "").toLowerCase();
     if (event === "track") {
-      const meta = {
-        ...msg.payload?.payload ?? {},
-        phx_ref: `F${this.phxRefCounter++}`
-      };
+      const payload = { ...msg.payload?.payload ?? {} };
+      delete payload.phx_ref;
+      delete payload.phx_ref_prev;
       let state = this.presence.get(msg.topic);
       if (!state) {
         state = new Map;
         this.presence.set(msg.topic, state);
       }
-      const previous = state.get(channel.presenceKey);
-      state.set(channel.presenceKey, { metas: [meta] });
+      const current = state.get(channel.presenceKey);
+      const previous = current?.metas.find((meta) => meta.phx_ref === channel.presenceRef);
+      const meta = {
+        ...payload,
+        phx_ref: `F${this.phxRefCounter++}`,
+        ...previous ? { phx_ref_prev: previous.phx_ref } : {}
+      };
+      const others = current?.metas.filter((meta) => meta.phx_ref !== channel.presenceRef) ?? [];
+      state.set(channel.presenceKey, { metas: [...others, meta] });
+      channel.presenceRef = meta.phx_ref;
       this.broadcastToTopic(msg.topic, {
         topic: msg.topic,
         event: "presence_diff",
         payload: {
           joins: { [channel.presenceKey]: { metas: [meta] } },
-          leaves: previous ? { [channel.presenceKey]: previous } : {}
+          leaves: previous ? { [channel.presenceKey]: { metas: [previous] } } : {}
         },
         ref: null
       });
@@ -9932,19 +9957,7 @@ class RealtimeEngine {
       return;
     }
     if (event === "untrack") {
-      const state = this.presence.get(msg.topic);
-      const metas = state?.get(channel.presenceKey);
-      if (state && metas) {
-        state.delete(channel.presenceKey);
-        if (state.size === 0)
-          this.presence.delete(msg.topic);
-        this.broadcastToTopic(msg.topic, {
-          topic: msg.topic,
-          event: "presence_diff",
-          payload: { joins: {}, leaves: { [channel.presenceKey]: metas } },
-          ref: null
-        });
-      }
+      this.removePresence(channel);
       if (msg.ref)
         this.reply(conn, msg, "ok", {});
     }

package/dist/index.js

@@ -88,7 +88,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.33.0",
+  version: "0.33.2",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -127,7 +127,7 @@ var package_default = {
     clean: "bun -e 'import { $ } from \"bun\"; await $`rm -rf dist`'",
     dev: "bun run src/cli.ts start",
     start: "bun run src/cli.ts start",
-    test: "bun test --timeout 20000",
+    test: "bun run scripts/run-tests.ts",
     "test:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun test test/native-engine.test.ts test/qauth-workflow-matrix.test.ts test/maker-checker-workflow.test.ts test/commands-artifacts.test.ts --timeout 180000",
     "test:graphql": "SUPACLOUD_LITE_TEST_GRAPHQL=1 bun test test/graphql-native.test.ts --timeout 180000",
     benchmark: "bun run scripts/benchmark.ts",
@@ -147,31 +147,31 @@ var package_default = {
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "0.20.0",
+    "@supacloud/db": "0.20.1",
     "exact-mirror": "1.2.6",
     tar: "^7.5.22",
-    typebox: "1.3.37"
+    typebox: "1.4.2"
   },
   devDependencies: {
-    "@supacloud/app": "0.30.0",
-    "@supacloud/contracts": "0.13.0",
-    "@supacloud/compiler": "0.49.0",
-    "@supacloud/elysia": "0.35.0",
-    "@supabase/supabase-js": "^2.117.3",
+    "@supacloud/app": "0.33.0",
+    "@supacloud/contracts": "0.15.1",
+    "@supacloud/compiler": "0.51.1",
+    "@supacloud/elysia": "0.36.1",
+    "@supabase/supabase-js": "^2.118.0",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
-    elysia: "2.0.0-beta.32",
-    jose: "^6.2.12",
+    elysia: "2.0.0-rc.0",
+    jose: "^6.2.13",
     typescript: "^7.0.2"
   },
   overrides: {
-    "@supacloud/db": "0.20.0",
-    "@supacloud/app": "0.30.0",
-    "@supacloud/compiler": "0.49.0",
-    "@supacloud/elysia": "0.35.0",
-    "@supacloud/contracts": "0.13.0",
-    "@supacloud/commands": "0.11.0",
-    "@supacloud/delivery": "0.21.0",
+    "@supacloud/db": "0.20.1",
+    "@supacloud/app": "0.33.0",
+    "@supacloud/compiler": "0.51.1",
+    "@supacloud/elysia": "0.36.1",
+    "@supacloud/contracts": "0.15.1",
+    "@supacloud/commands": "0.11.1",
+    "@supacloud/delivery": "0.21.1",
     "@graphql-tools/utils": "^12.0.4"
   },
   engines: {
@@ -251,7 +251,7 @@ function isAllowedRedirect(requested, siteUrl, allowList = []) {
 var encoder2 = new TextEncoder;
 var decoder2 = new TextDecoder;
 var strictDecoder = new TextDecoder("utf-8", { fatal: true });
-var MAX_INT32 = 2 ** 32;
+var UINT32_RANGE = 2 ** 32;
 function concat(...buffers) {
   const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
   let i = 0;
@@ -410,23 +410,23 @@ function isDisjoint(...headers) {
 function decodeBase64url(value, label, ErrorClass) {
   try {
     return decode(value);
-  } catch {
-    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  } catch (cause) {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`, { cause });
   }
 }
-function encodeBase64url(value, label, ErrorClass) {
+function encodeAsciiMember(value, label, ErrorClass) {
   try {
     return encode(value);
-  } catch {
-    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  } catch (cause) {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`, { cause });
   }
 }
-function parseJoseHeader(b64, ErrorClass, message) {
+function parseJoseHeader(encodedProtectedHeader, ErrorClass, message) {
   let parsed;
   try {
-    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
-  } catch {
-    throw new ErrorClass(message);
+    parsed = JSON.parse(strictDecoder.decode(decode(encodedProtectedHeader)));
+  } catch (cause) {
+    throw new ErrorClass(message, { cause });
   }
   if (!isObject(parsed))
     throw new ErrorClass(message);
@@ -484,15 +484,15 @@ var jwkMatchesOp = (entry, key, usage) => {
   }
 };
 async function prepareKey(entry, key, usage) {
-  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+  const { alg, secret } = entry, requiresPrivateKey = usage === "decrypt" || usage === "sign";
   if (secret && key instanceof Uint8Array)
     return key;
   let normalized, keyObject;
   if (isObject(key)) {
     if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
       throw invalidKeyType(alg, key, secret);
-    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === undefined && normalized.priv === undefined)))
-      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (requiresPrivateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === undefined && normalized.priv === undefined)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${requiresPrivateKey ? "private" : "public"} JWK`);
     if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
       return decode(normalized.k);
     if (!Object.isFrozen(key)) {
@@ -502,7 +502,7 @@ async function prepareKey(entry, key, usage) {
   } else {
     if (!isKeyLike(key))
       throw invalidKeyType(alg, key, secret);
-    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    const expectedType = secret ? "secret" : requiresPrivateKey ? "private" : "public";
     if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
       throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
     if (isCryptoKey(key))
@@ -641,8 +641,8 @@ function eddsa() {
     usages: sig
   };
 }
-function mldsa(bits) {
-  const subtle = { name: `ML-DSA-${bits}` };
+function mldsa(parameterSet) {
+  const subtle = { name: `ML-DSA-${parameterSet}` };
   return {
     kty: ["AKP"],
     subtle,
@@ -680,21 +680,23 @@ function jwsAlgorithm(alg) {
 function prepareVerify(options) {
   return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
 }
-function parseProtectedHeader(encodedProtected) {
-  return encodedProtected === undefined ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+function parseProtectedHeader(encodedProtectedHeader) {
+  return encodedProtectedHeader === undefined ? {} : parseJoseHeader(encodedProtectedHeader, JWSInvalid, "JWS Protected Header is invalid");
 }
 function encodeCompactUnencodedPayload(payload) {
   try {
     return encode(payload);
-  } catch {
-    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+  } catch (cause) {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters", {
+      cause
+    });
   }
 }
 async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
-  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
-  if (!isDisjoint(parsedProt, header))
+  const { protected: encodedProtectedHeader, header, payload: inputPayload } = jws, protectedHeader = parsedProtected ?? parseProtectedHeader(encodedProtectedHeader);
+  if (!isDisjoint(protectedHeader, header))
     throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  const joseHeader = { ...protectedHeader, ...header }, b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], protectedHeader, joseHeader)), { alg } = joseHeader;
   if (typeof alg != "string" || !alg)
     throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
   if (shared[0] && !shared[0].has(alg))
@@ -706,17 +708,19 @@ async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedP
     throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
   const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
   let resolvedKey = false;
-  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
-  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array, encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+  typeof key == "function" && (key = await key(protectedHeader, jws), resolvedKey = true);
+  const entry = jwsAlgorithm(alg), signingInput = concat(encodedProtectedHeader !== undefined ? encode(encodedProtectedHeader) : new Uint8Array, encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeAsciiMember(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), verificationKey = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(verificationKey, entry.subtle, "verify");
   entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
   let verified = false;
   try {
-    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
-  } catch {}
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, signingInput);
+  } catch (cause) {
+    throw new JWSSignatureVerificationFailed(undefined, { cause });
+  }
   if (!verified)
     throw new JWSSignatureVerificationFailed;
   const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
-  return encodedProtected !== undefined && (result.protectedHeader = parsedProt), header !== undefined && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
+  return encodedProtectedHeader !== undefined && (result.protectedHeader = protectedHeader), header !== undefined && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: verificationKey }, b64] : [result, b64];
 }
 async function verifyCompact(jws, shared, key) {
   if (jws instanceof Uint8Array && (jws = decoder2.decode(jws)), typeof jws != "string")
@@ -746,8 +750,8 @@ function secs(str) {
   typeof str != "string" && invalidDuration();
   const matched = REGEX.exec(str);
   (!matched || matched[4] && matched[1]) && invalidDuration();
-  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+  const value = parseFloat(matched[2]), durationSeconds = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(durationSeconds) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -durationSeconds : durationSeconds;
 }
 function validateInput(label, input) {
   if (!Number.isFinite(input))
@@ -759,33 +763,35 @@ var normalizeTyp = (value) => {
   return value.includes("/") ? normalized : `application/${normalized}`;
 };
 var checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
-function validateNumericDate(payload, claim, required = false) {
-  const value = payload[claim];
+function validateNumericDate(claimsSet, claim, required = false) {
+  const value = claimsSet[claim];
   if (!(value === undefined && !required)) {
     if (typeof value != "number")
-      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, claimsSet, claim, "invalid");
     return value;
   }
 }
-function unexpectedClaim(payload, claim) {
-  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+function unexpectedClaim(claimsSet, claim) {
+  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, claimsSet, claim, checkFailed);
 }
-function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-  let payload;
+function validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {
+  let claimsSet;
   try {
-    payload = JSON.parse(strictDecoder.decode(encodedPayload));
-  } catch {}
-  if (!isObject(payload))
+    claimsSet = JSON.parse(strictDecoder.decode(claimsSetBytes));
+  } catch (cause) {
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object", { cause });
+  }
+  if (!isObject(claimsSet))
     throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
   const { typ } = options;
   if (typ !== undefined && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
-    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', claimsSet, "typ", checkFailed);
   const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
   maxTokenAge !== undefined && presenceCheck.push("iat"), audience !== undefined && presenceCheck.push("aud"), subject !== undefined && presenceCheck.push("sub"), issuer !== undefined && presenceCheck.push("iss");
   for (const claim of new Set(presenceCheck.reverse()))
-    if (!Object.hasOwn(payload, claim))
-      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-  issuer !== undefined && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== undefined && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== undefined && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+    if (!Object.hasOwn(claimsSet, claim))
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claimsSet, claim, "missing");
+  issuer !== undefined && !(Array.isArray(issuer) ? issuer : [issuer]).includes(claimsSet.iss) && unexpectedClaim(claimsSet, "iss"), subject !== undefined && claimsSet.sub !== subject && unexpectedClaim(claimsSet, "sub"), audience !== undefined && !checkAudiencePresence(claimsSet.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(claimsSet, "aud");
   const { clockTolerance } = options;
   let tolerance = 0;
   if (typeof clockTolerance == "string")
@@ -796,20 +802,20 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
     tolerance = clockTolerance;
   }
   validateInput("clockTolerance option", tolerance);
-  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === undefined ? /* @__PURE__ */ new Date : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== undefined), nbf = validateNumericDate(payload, "nbf");
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === undefined ? /* @__PURE__ */ new Date : currentDate)), iat = validateNumericDate(claimsSet, "iat", maxTokenAge !== undefined), nbf = validateNumericDate(claimsSet, "nbf");
   if (nbf !== undefined && nbf > now + tolerance)
-    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
-  const exp = validateNumericDate(payload, "exp");
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', claimsSet, "nbf", checkFailed);
+  const exp = validateNumericDate(claimsSet, "exp");
   if (exp !== undefined && exp <= now - tolerance)
-    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+    throw new JWTExpired('"exp" claim timestamp check failed', claimsSet, "exp", checkFailed);
   if (maxTokenAge !== undefined) {
     const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
     if (age - tolerance > max)
-      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', claimsSet, "iat", checkFailed);
     if (age < -tolerance)
-      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', claimsSet, "iat", checkFailed);
   }
-  return payload;
+  return claimsSet;
 }
 
 // node_modules/jose/dist/webapi/jwt/verify.js
@@ -844,7 +850,9 @@ function createLocalJWKSet(jwks) {
   let snapshot;
   try {
     snapshot = structuredClone(jwks);
-  } catch {}
+  } catch (cause) {
+    throw new JWKSInvalid("JSON Web Key Set malformed", { cause });
+  }
   if (!isJwkSet(snapshot))
     throw new JWKSInvalid("JSON Web Key Set malformed");
   const metadata = snapshot.keys.map((jwk) => {
@@ -878,7 +886,7 @@ function isCloudflareWorkers() {
   return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 var USER_AGENT;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.13");
 var customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url, {
@@ -887,14 +895,14 @@ async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
     redirect: "manual",
     headers
   }).catch((err) => {
-    throw err.name === "TimeoutError" ? new JWKSTimeout : err;
+    throw err.name === "TimeoutError" ? new JWKSTimeout(undefined, { cause: err }) : err;
   });
   if (response.status !== 200)
     throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
   try {
     return await response.json();
-  } catch {
-    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  } catch (cause) {
+    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON", { cause });
   }
 }
 var jwksCache = /* @__PURE__ */ Symbol();
@@ -9766,8 +9774,7 @@ class RealtimeEngine {
       private: isPrivate,
       canBroadcast
     };
-    if (this.resolveExternalToken)
-      this.leaveChannel(conn, msg.topic);
+    this.leaveChannel(conn, msg.topic);
     conn.channels.set(msg.topic, channel);
     this.scheduleExternalExpiry(conn, channel);
     this.reply(conn, msg, "ok", {
@@ -9807,21 +9814,32 @@ class RealtimeEngine {
     if (channel.expiryTimer)
       clearTimeout(channel.expiryTimer);
     conn.channels.delete(topic);
-    const state = this.presence.get(topic);
-    if (state?.has(channel.presenceKey)) {
-      const metas = state.get(channel.presenceKey);
-      if (!metas)
-        return;
+    this.removePresence(channel);
+  }
+  removePresence(channel) {
+    const presenceRef = channel.presenceRef;
+    if (!presenceRef)
+      return;
+    channel.presenceRef = undefined;
+    const state = this.presence.get(channel.topic);
+    const current = state?.get(channel.presenceKey);
+    const leaving = current?.metas.find((meta) => meta.phx_ref === presenceRef);
+    if (!state || !current || !leaving)
+      return;
+    const remaining = current.metas.filter((meta) => meta.phx_ref !== presenceRef);
+    if (remaining.length > 0) {
+      state.set(channel.presenceKey, { metas: remaining });
+    } else {
       state.delete(channel.presenceKey);
       if (state.size === 0)
-        this.presence.delete(topic);
-      this.broadcastToTopic(topic, {
-        topic,
-        event: "presence_diff",
-        payload: { joins: {}, leaves: { [channel.presenceKey]: metas } },
-        ref: null
-      });
+        this.presence.delete(channel.topic);
     }
+    this.broadcastToTopic(channel.topic, {
+      topic: channel.topic,
+      event: "presence_diff",
+      payload: { joins: {}, leaves: { [channel.presenceKey]: { metas: [leaving] } } },
+      ref: null
+    });
   }
   scheduleExternalExpiry(conn, channel) {
     if (channel.expiryTimer)
@@ -9901,23 +9919,30 @@ class RealtimeEngine {
       return;
     const event = String(msg.payload?.event ?? "").toLowerCase();
     if (event === "track") {
-      const meta = {
-        ...msg.payload?.payload ?? {},
-        phx_ref: `F${this.phxRefCounter++}`
-      };
+      const payload = { ...msg.payload?.payload ?? {} };
+      delete payload.phx_ref;
+      delete payload.phx_ref_prev;
       let state = this.presence.get(msg.topic);
       if (!state) {
         state = new Map;
         this.presence.set(msg.topic, state);
       }
-      const previous = state.get(channel.presenceKey);
-      state.set(channel.presenceKey, { metas: [meta] });
+      const current = state.get(channel.presenceKey);
+      const previous = current?.metas.find((meta) => meta.phx_ref === channel.presenceRef);
+      const meta = {
+        ...payload,
+        phx_ref: `F${this.phxRefCounter++}`,
+        ...previous ? { phx_ref_prev: previous.phx_ref } : {}
+      };
+      const others = current?.metas.filter((meta) => meta.phx_ref !== channel.presenceRef) ?? [];
+      state.set(channel.presenceKey, { metas: [...others, meta] });
+      channel.presenceRef = meta.phx_ref;
       this.broadcastToTopic(msg.topic, {
         topic: msg.topic,
         event: "presence_diff",
         payload: {
           joins: { [channel.presenceKey]: { metas: [meta] } },
-          leaves: previous ? { [channel.presenceKey]: previous } : {}
+          leaves: previous ? { [channel.presenceKey]: { metas: [previous] } } : {}
         },
         ref: null
       });
@@ -9926,19 +9951,7 @@ class RealtimeEngine {
       return;
     }
     if (event === "untrack") {
-      const state = this.presence.get(msg.topic);
-      const metas = state?.get(channel.presenceKey);
-      if (state && metas) {
-        state.delete(channel.presenceKey);
-        if (state.size === 0)
-          this.presence.delete(msg.topic);
-        this.broadcastToTopic(msg.topic, {
-          topic: msg.topic,
-          event: "presence_diff",
-          payload: { joins: {}, leaves: { [channel.presenceKey]: metas } },
-          ref: null
-        });
-      }
+      this.removePresence(channel);
       if (msg.ref)
         this.reply(conn, msg, "ok", {});
     }

package/dist/runtime/realtime/engine.d.ts

@@ -57,6 +57,7 @@ export declare class RealtimeEngine {
     private handleMessage;
     private handleJoin;
     private leaveChannel;
+    private removePresence;
     private scheduleExternalExpiry;
     /**
      * Phoenix binary serializer, kind 3 (userBroadcastPush):

package/dist/runtime/realtime/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/runtime/realtime/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAY,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAI3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IACrC,wEAAwE;IACxE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5C;AAgED,uFAAuF;AACvF,qBAAa,cAAc;IAUvB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,oBAAoB,CAAC;IAX/B,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,cAAc,CAAI;IAC1B,OAAO,CAAC,aAAa,CAAI;IACzB,0BAA0B;IAC1B,OAAO,CAAC,QAAQ,CAAgD;IAChE,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,eAAe,CAAiC;gBAG9C,EAAE,EAAE,QAAQ,EACZ,SAAS,CAAC,EAAE,MAAM,YAAA,EAClB,oBAAoB,CAAC,GAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,aAAA;IAG3E,oEAAoE;YACtD,gBAAgB;IAS9B;;;;;OAKG;YACW,gBAAgB;IA0C9B,6EAA6E;IAC7E,OAAO,CAAC,mBAAmB;IAc3B,iFAAiF;IAC3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAa5B,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB3B,qEAAqE;IACrE,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG;QAChE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,KAAK,IAAI,CAAA;QAC9C,OAAO,EAAE,MAAM,IAAI,CAAA;KACpB;IAcD,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,KAAK;YAUC,aAAa;YA+Eb,UAAU;IA0GxB,OAAO,CAAC,YAAY;IAqBpB,OAAO,CAAC,sBAAsB;IAY9B;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IA+BpB,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,cAAc;IA+CtB,OAAO,CAAC,gBAAgB;YAQV,WAAW;IAoDzB;;;;;;;OAOG;YACW,MAAM;IA6BpB,OAAO,CAAC,cAAc;CAUvB;AAkBD,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CA2BjF"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/runtime/realtime/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAY,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAI3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAA;IACrC,wEAAwE;IACxE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5C;AAkED,uFAAuF;AACvF,qBAAa,cAAc;IAUvB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,oBAAoB,CAAC;IAX/B,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,cAAc,CAAI;IAC1B,OAAO,CAAC,aAAa,CAAI;IACzB,0BAA0B;IAC1B,OAAO,CAAC,QAAQ,CAAgD;IAChE,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,eAAe,CAAiC;gBAG9C,EAAE,EAAE,QAAQ,EACZ,SAAS,CAAC,EAAE,MAAM,YAAA,EAClB,oBAAoB,CAAC,GAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,aAAA;IAG3E,oEAAoE;YACtD,gBAAgB;IAS9B;;;;;OAKG;YACW,gBAAgB;IA0C9B,6EAA6E;IAC7E,OAAO,CAAC,mBAAmB;IAc3B,iFAAiF;IAC3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAa5B,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB3B,qEAAqE;IACrE,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG;QAChE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,KAAK,IAAI,CAAA;QAC9C,OAAO,EAAE,MAAM,IAAI,CAAA;KACpB;IAcD,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,KAAK;YAUC,aAAa;YA+Eb,UAAU;IA0GxB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,sBAAsB;IAY9B;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IA+BpB,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,cAAc;IA4CtB,OAAO,CAAC,gBAAgB;YAQV,WAAW;IAoDzB;;;;;;;OAOG;YACW,MAAM;IA6BpB,OAAO,CAAC,cAAc;CAUvB;AAkBD,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CA2BjF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.33.0",
+  "version": "0.33.2",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   "type": "module",
   "license": "Apache-2.0",
@@ -39,7 +39,7 @@
     "clean": "bun -e 'import { $ } from \"bun\"; await $`rm -rf dist`'",
     "dev": "bun run src/cli.ts start",
     "start": "bun run src/cli.ts start",
-    "test": "bun test --timeout 20000",
+    "test": "bun run scripts/run-tests.ts",
     "test:native": "SUPACLOUD_LITE_TEST_NATIVE=1 bun test test/native-engine.test.ts test/qauth-workflow-matrix.test.ts test/maker-checker-workflow.test.ts test/commands-artifacts.test.ts --timeout 180000",
     "test:graphql": "SUPACLOUD_LITE_TEST_GRAPHQL=1 bun test test/graphql-native.test.ts --timeout 180000",
     "benchmark": "bun run scripts/benchmark.ts",
@@ -59,31 +59,31 @@
     "@electric-sql/pglite-pgmq": "0.0.8",
     "@electric-sql/pglite-pgvector": "0.0.11",
     "@electric-sql/pglite-postgis": "0.2.10",
-    "@supacloud/db": "0.20.0",
+    "@supacloud/db": "0.20.1",
     "exact-mirror": "1.2.6",
     "tar": "^7.5.22",
-    "typebox": "1.3.37"
+    "typebox": "1.4.2"
   },
   "devDependencies": {
-    "@supacloud/app": "0.30.0",
-    "@supacloud/contracts": "0.13.0",
-    "@supacloud/compiler": "0.49.0",
-    "@supacloud/elysia": "0.35.0",
-    "@supabase/supabase-js": "^2.117.3",
+    "@supacloud/app": "0.33.0",
+    "@supacloud/contracts": "0.15.1",
+    "@supacloud/compiler": "0.51.1",
+    "@supacloud/elysia": "0.36.1",
+    "@supabase/supabase-js": "^2.118.0",
     "@types/bun": "^1.4.3",
     "effect": "4.0.5",
-    "elysia": "2.0.0-beta.32",
-    "jose": "^6.2.12",
+    "elysia": "2.0.0-rc.0",
+    "jose": "^6.2.13",
     "typescript": "^7.0.2"
   },
   "overrides": {
-    "@supacloud/db": "0.20.0",
-    "@supacloud/app": "0.30.0",
-    "@supacloud/compiler": "0.49.0",
-    "@supacloud/elysia": "0.35.0",
-    "@supacloud/contracts": "0.13.0",
-    "@supacloud/commands": "0.11.0",
-    "@supacloud/delivery": "0.21.0",
+    "@supacloud/db": "0.20.1",
+    "@supacloud/app": "0.33.0",
+    "@supacloud/compiler": "0.51.1",
+    "@supacloud/elysia": "0.36.1",
+    "@supacloud/contracts": "0.15.1",
+    "@supacloud/commands": "0.11.1",
+    "@supacloud/delivery": "0.21.1",
     "@graphql-tools/utils": "^12.0.4"
   },
   "engines": {