fix(auth): replace navigator.locks with in-process serial lock to avoid 'lock stolen' aborts

apps/desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ChatApp",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "identifier": "com.meinname.chatapp",
   "build": {
     "beforeDevCommand": "pnpm vite:dev",

packages/shared/src/supabase/client.ts

@@ -5,6 +5,20 @@ import type { Database, SupabaseConfig } from './types.js';
 // Typed client alias used throughout the app.
 export type AppSupabaseClient = SupabaseClient<Database>;
 
+// Inline serial lock — replaces Supabase's default `navigator.locks` based
+// lock that occasionally throws "Lock was stolen by another request" when
+// the same origin opens multiple tabs / Tauri windows / HMR-reloaded
+// modules. We only have one client instance per process so a simple promise
+// chain serialises token-refresh fine without cross-tab coordination.
+const acquireLock = (() => {
+  let chain: Promise<unknown> = Promise.resolve();
+  return async <R>(_name: string, _acquireTimeout: number, fn: () => Promise<R>): Promise<R> => {
+    const next = chain.then(() => fn(), () => fn());
+    chain = next.catch(() => undefined);
+    return next;
+  };
+})();
+
 export function createClient(config: SupabaseConfig): AppSupabaseClient {
   return createSupabaseClient<Database>(config.url, config.anonKey, {
     auth: {
@@ -12,6 +26,7 @@ export function createClient(config: SupabaseConfig): AppSupabaseClient {
       autoRefreshToken: true,
       persistSession: true,
       detectSessionInUrl: config.detectSessionInUrl ?? false,
+      lock: acquireLock,
     },
   });
 }