@aurabase/aurabase-js 0.3.0 → 0.4.0

package/packages/core/tests/auth-store.test.ts

@@ -1,300 +0,0 @@
-// ---------------------------------------------------------------------------
-// BaseAuthStore + LocalAuthStore tests
-// ---------------------------------------------------------------------------
-
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
-import { BaseAuthStore, isTokenExpired } from '../src/stores/BaseAuthStore'
-import { LocalAuthStore } from '../src/stores/LocalAuthStore'
-import { fakeUser, fakeJwt, validJwt, expiredJwt } from './mocks'
-
-// ---------------------------------------------------------------------------
-// BaseAuthStore
-// ---------------------------------------------------------------------------
-
-describe('BaseAuthStore', () => {
-  let store: BaseAuthStore
-
-  beforeEach(() => {
-    store = new BaseAuthStore()
-  })
-
-  it('starts with null token/user', () => {
-    expect(store.token).toBeNull()
-    expect(store.refreshToken).toBeNull()
-    expect(store.user).toBeNull()
-  })
-
-  it('save() stores token, refreshToken and user', () => {
-    const user = fakeUser()
-    store.save('tok_1', 'rt_1', user)
-
-    expect(store.token).toBe('tok_1')
-    expect(store.refreshToken).toBe('rt_1')
-    expect(store.user).toEqual(user)
-  })
-
-  it('clear() resets to null', () => {
-    store.save('tok_1', 'rt_1', fakeUser())
-    store.clear()
-
-    expect(store.token).toBeNull()
-    expect(store.refreshToken).toBeNull()
-    expect(store.user).toBeNull()
-  })
-
-  it('onChange fires callback on save and clear', () => {
-    const events: Array<{ token: string | null; user: unknown }> = []
-    store.onChange((token, user) => {
-      events.push({ token, user })
-    })
-
-    const user = fakeUser()
-    store.save('tok_1', 'rt_1', user)
-    store.clear()
-
-    expect(events).toHaveLength(2)
-    expect(events[0].token).toBe('tok_1')
-    expect(events[1].token).toBeNull()
-  })
-
-  it('unsubscribe stops receiving events', () => {
-    const events: string[] = []
-    const unsub = store.onChange((token) => {
-      events.push(token ?? 'null')
-    })
-
-    store.save('tok_1', 'rt_1', fakeUser())
-    expect(events).toHaveLength(1)
-
-    unsub()
-    store.save('tok_2', 'rt_2', fakeUser())
-    // Should still be 1 since we unsubscribed
-    expect(events).toHaveLength(1)
-  })
-
-  it('isValid returns true for a non-expired JWT', () => {
-    store.save(validJwt(), 'rt', fakeUser())
-    expect(store.isValid).toBe(true)
-  })
-
-  it('isValid returns false for an expired JWT', () => {
-    store.save(expiredJwt(), 'rt', fakeUser())
-    expect(store.isValid).toBe(false)
-  })
-
-  it('isValid returns false when no token is set', () => {
-    expect(store.isValid).toBe(false)
-  })
-
-  it('subscriber errors do not break the store', () => {
-    store.onChange(() => {
-      throw new Error('subscriber boom')
-    })
-    const events: string[] = []
-    store.onChange((token) => events.push(token ?? 'null'))
-
-    // Should not throw
-    store.save('tok_1', 'rt_1', fakeUser())
-    expect(events).toHaveLength(1)
-    expect(events[0]).toBe('tok_1')
-  })
-})
-
-// ---------------------------------------------------------------------------
-// isTokenExpired
-// ---------------------------------------------------------------------------
-
-describe('isTokenExpired', () => {
-  it('returns false for a future-exp token', () => {
-    const future = fakeJwt(Math.floor(Date.now() / 1000) + 3600)
-    expect(isTokenExpired(future)).toBe(false)
-  })
-
-  it('returns true for a past-exp token', () => {
-    const past = fakeJwt(Math.floor(Date.now() / 1000) - 60)
-    expect(isTokenExpired(past)).toBe(true)
-  })
-
-  it('respects margin parameter', () => {
-    // Token expires in 10 seconds, but margin is 30 -- should be "expired"
-    const almostExpired = fakeJwt(Math.floor(Date.now() / 1000) + 10)
-    expect(isTokenExpired(almostExpired, 30)).toBe(true)
-  })
-
-  it('returns true for malformed tokens', () => {
-    expect(isTokenExpired('not-a-jwt')).toBe(true)
-    expect(isTokenExpired('')).toBe(true)
-    expect(isTokenExpired('a.b')).toBe(true)
-  })
-})
-
-// ---------------------------------------------------------------------------
-// LocalAuthStore (mocked localStorage)
-// ---------------------------------------------------------------------------
-
-describe('LocalAuthStore', () => {
-  let mockStorage: Record<string, string>
-
-  beforeEach(() => {
-    mockStorage = {}
-    // Mock localStorage
-    const storage = {
-      getItem: vi.fn((key: string) => mockStorage[key] ?? null),
-      setItem: vi.fn((key: string, value: string) => {
-        mockStorage[key] = value
-      }),
-      removeItem: vi.fn((key: string) => {
-        delete mockStorage[key]
-      }),
-      clear: vi.fn(() => {
-        mockStorage = {}
-      }),
-      get length() {
-        return Object.keys(mockStorage).length
-      },
-      key: vi.fn((index: number) => Object.keys(mockStorage)[index] ?? null),
-    }
-
-    Object.defineProperty(globalThis, 'localStorage', {
-      value: storage,
-      writable: true,
-      configurable: true,
-    })
-  })
-
-  afterEach(() => {
-    // Clean up
-    delete (globalThis as any).localStorage
-  })
-
-  it('persists to localStorage on save', () => {
-    const store = new LocalAuthStore()
-    store.save('tok_1', 'rt_1', fakeUser())
-
-    const raw = mockStorage['aurabase_auth']
-    expect(raw).toBeDefined()
-    const parsed = JSON.parse(raw)
-    expect(parsed.token).toBe('tok_1')
-    expect(parsed.refreshToken).toBe('rt_1')
-    expect(parsed.user.id).toBe('user-1')
-  })
-
-  it('clears localStorage on clear()', () => {
-    const store = new LocalAuthStore()
-    store.save('tok_1', 'rt_1', fakeUser())
-    expect(mockStorage['aurabase_auth']).toBeDefined()
-
-    store.clear()
-    expect(mockStorage['aurabase_auth']).toBeUndefined()
-  })
-
-  it('loads from localStorage on construction', () => {
-    // Pre-populate storage
-    mockStorage['aurabase_auth'] = JSON.stringify({
-      token: 'tok_pre',
-      refreshToken: 'rt_pre',
-      user: fakeUser({ email: 'stored@example.com' }),
-    })
-
-    const store = new LocalAuthStore()
-
-    expect(store.token).toBe('tok_pre')
-    expect(store.refreshToken).toBe('rt_pre')
-    expect(store.user?.email).toBe('stored@example.com')
-  })
-
-  it('uses custom key', () => {
-    const store = new LocalAuthStore('custom_key')
-    store.save('tok_1', 'rt_1', fakeUser())
-
-    expect(mockStorage['custom_key']).toBeDefined()
-    expect(mockStorage['aurabase_auth']).toBeUndefined()
-  })
-
-  it('handles corrupted localStorage gracefully', () => {
-    mockStorage['aurabase_auth'] = 'not valid json {'
-
-    // Should not throw
-    const store = new LocalAuthStore()
-    expect(store.token).toBeNull()
-  })
-
-  it('exportToCookie produces valid Set-Cookie string', () => {
-    const store = new LocalAuthStore()
-    store.save('tok_1', 'rt_1', fakeUser())
-
-    const cookie = store.exportToCookie({
-      path: '/',
-      secure: true,
-      sameSite: 'Lax',
-      maxAge: 86400,
-    })
-
-    expect(cookie).toContain('aurabase_auth=')
-    expect(cookie).toContain('Path=/')
-    expect(cookie).toContain('Secure')
-    expect(cookie).toContain('SameSite=Lax')
-    expect(cookie).toContain('Max-Age=86400')
-  })
-
-  it('LOT 3 (I8) : setItem qui throw (quota) émet storage-blocked sans casser save()', () => {
-    const store = new LocalAuthStore()
-    const events: Array<{ kind: string; op?: string }> = []
-    store.setObservabilityHook((e) => events.push(e as { kind: string; op?: string }), false)
-
-    const original = (globalThis as any).localStorage.setItem
-    ;(globalThis as any).localStorage.setItem = vi.fn(() => {
-      throw new Error('QuotaExceededError')
-    })
-
-    // save() ne throw jamais malgré le localStorage bloqué.
-    expect(() => store.save('tok_1', 'rt_1', fakeUser())).not.toThrow()
-    expect(store.token).toBe('tok_1') // état en mémoire toujours à jour
-
-    // save() persiste via `_persist()` (op 'persist'), pas via le `setItem` public
-    // override (réservé au stockage clé/valeur générique — PKCE `code_verifier`).
-    expect(events).toContainEqual({ kind: 'storage-blocked', op: 'persist' })
-
-    ;(globalThis as any).localStorage.setItem = original
-  })
-
-  it('LOT 3 (I8) : setItem (générique, ex. PKCE) qui throw émet storage-blocked op:"setItem"', () => {
-    const store = new LocalAuthStore()
-    const events: Array<{ kind: string; op?: string }> = []
-    store.setObservabilityHook((e) => events.push(e as { kind: string; op?: string }), false)
-
-    const original = (globalThis as any).localStorage.setItem
-    ;(globalThis as any).localStorage.setItem = vi.fn(() => {
-      throw new Error('QuotaExceededError')
-    })
-
-    expect(() => store.setItem('some-key', 'some-value')).not.toThrow()
-    expect(events).toContainEqual({ kind: 'storage-blocked', op: 'setItem' })
-
-    ;(globalThis as any).localStorage.setItem = original
-  })
-
-  it('LOT 3 (I8) : sans hook câblé, aucun throw / no-op silencieux', () => {
-    const store = new LocalAuthStore()
-    ;(globalThis as any).localStorage.setItem = vi.fn(() => {
-      throw new Error('blocked')
-    })
-    expect(() => store.save('tok_1', 'rt_1', fakeUser())).not.toThrow()
-  })
-
-  it('loadFromCookie restores auth state', () => {
-    const store = new LocalAuthStore()
-    const data = {
-      token: 'tok_cookie',
-      refreshToken: 'rt_cookie',
-      user: fakeUser({ email: 'cookie@example.com' }),
-    }
-    const cookieString = `other=val; aurabase_auth=${encodeURIComponent(JSON.stringify(data))}; foo=bar`
-
-    store.loadFromCookie(cookieString)
-
-    expect(store.token).toBe('tok_cookie')
-    expect(store.refreshToken).toBe('rt_cookie')
-    expect(store.user?.email).toBe('cookie@example.com')
-  })
-})

package/packages/core/tests/error-code.test.ts

@@ -1,61 +0,0 @@
-// ---------------------------------------------------------------------------
-// AuraErrorCode (LOT 3, finding I4) -- taxonomie d'erreurs typée
-// ---------------------------------------------------------------------------
-
-// NOTE : le test type-level proprement dit (vérifié par `tsc`, pas seulement par
-// vitest qui transpile/strip les types) vit dans
-// `packages/aurabase/tests/types/error-code.test-d.ts` (chaîné à `pnpm --filter
-// aurabase test` via `tsconfig.test-d.json`). Ici : couverture RUNTIME uniquement.
-import { describe, it, expect } from 'vitest'
-import { AuraError, type AuraErrorCode } from '../src/AuraError'
-
-describe('AuraErrorCode', () => {
-  it('un code connu (littéral de l’union) est accepté et préservé au runtime', () => {
-    const e = new AuraError(0, { error: { code: 'timeout', message: 'x' } })
-    expect(e.code).toBe('timeout')
-    // Sanity : assignable à AuraErrorCode sans cast (autocomplétion sur les littéraux connus).
-    const code: AuraErrorCode = e.code
-    expect(code).toBe('timeout')
-  })
-
-  it('reste ouvert à un code backend arbitraire non listé (pattern LiteralUnion)', () => {
-    const e = new AuraError(422, { error: { code: 'some_backend_specific_code', message: 'x' } })
-    expect(e.code).toBe('some_backend_specific_code')
-    const code: AuraErrorCode = e.code
-    expect(code).toBe('some_backend_specific_code')
-  })
-
-  it('fallback http_<status> quand aucun code n’est fourni par le backend', () => {
-    const e = new AuraError(503)
-    expect(e.code).toBe('http_503')
-  })
-
-  it('couvre tous les codes SDK-side connus (échantillon représentatif)', () => {
-    const knownCodes: AuraErrorCode[] = [
-      'no_session',
-      'timeout',
-      'network_error',
-      'invalid_response',
-      'refresh_discarded',
-      'unverifiable_token',
-      'no_code_verifier',
-      'pkce_generation_failed',
-      'missing_email',
-      'jwks_fetch_failed',
-      'signature_invalid',
-      'token_expired',
-      'token_not_yet_valid',
-      'invalid_jwt',
-      'unsupported_alg',
-      'no_matching_key',
-      'invalid_issuer',
-      'invalid_audience',
-      'invalid_path',
-      'PGRST116',
-    ]
-    for (const code of knownCodes) {
-      const e = new AuraError(0, { error: { code, message: 'x' } })
-      expect(e.code).toBe(code)
-    }
-  })
-})

package/packages/core/tests/error.test.ts

@@ -1,24 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { AuraError, isAuraError } from '../src/AuraError'
-
-describe('AuraError / isAuraError', () => {
-  it('reconnaît une vraie instance et expose les helpers', () => {
-    const e = new AuraError(429, { error: { code: 'rate_limited', message: 'slow down' } })
-    expect(isAuraError(e)).toBe(true)
-    expect(e.isRateLimited).toBe(true)
-    expect(e.status).toBe(429)
-  })
-  it('les instances portent le marqueur __isAuraError (détection cross-realm réelle)', () => {
-    // Le correctif : une vraie instance doit exposer le marqueur au runtime,
-    // pour être détectée même quand `instanceof` échoue (autre bundle/realm).
-    expect((new AuraError(500) as unknown as Record<string, unknown>).__isAuraError).toBe(true)
-  })
-  it('reconnaît un objet marqué __isAuraError (cross-realm simulé)', () => {
-    expect(isAuraError({ __isAuraError: true })).toBe(true)
-  })
-  it('rejette un objet quelconque', () => {
-    expect(isAuraError({})).toBe(false)
-    expect(isAuraError(null)).toBe(false)
-    expect(isAuraError(new Error('x'))).toBe(false)
-  })
-})

package/packages/core/tests/fetch.test.ts

@@ -1,286 +0,0 @@
-import { describe, it, expect, vi, afterEach } from 'vitest'
-import { fetchWithAuth, type FetchInit } from '../src/fetch'
-import { BaseAuthStore } from '../src/stores/BaseAuthStore'
-import type { AuraClientLike } from '../src/client'
-import type { AuraObservabilityEvent } from '../src/types'
-
-// fetch séquentiel : renvoie les réponses dans l'ordre, compte les appels.
-function seqFetch(
-  responses: Array<{ status: number; body?: unknown; headers?: Record<string, string>; throw?: unknown }>,
-) {
-  const calls: Array<{ url: string; init: RequestInit }> = []
-  let i = 0
-  const fn = async (url: string, init: RequestInit): Promise<Response> => {
-    calls.push({ url, init })
-    const r = responses[Math.min(i, responses.length - 1)]
-    i++
-    if (r.throw) throw r.throw
-    return new Response(r.body !== undefined ? JSON.stringify(r.body) : null, {
-      status: r.status,
-      headers: { 'Content-Type': 'application/json', ...r.headers },
-    })
-  }
-  return { fn, calls }
-}
-
-function makeClient(
-  fetchFn: typeof globalThis.fetch,
-  retryConfig?: { enabled: boolean; maxRetries: number },
-  onEvent?: (e: AuraObservabilityEvent) => void,
-): AuraClientLike {
-  return {
-    baseUrl: 'http://localhost:8080',
-    projectId: 'proj-1',
-    apiKey: 'aura_anon_x',
-    fetchFn,
-    authStore: new BaseAuthStore(),
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    auth: { refreshSession: async () => ({ data: null, error: null }) as any },
-    ...(retryConfig ? { retryConfig } : {}),
-    ...(onEvent ? { onEvent } : {}),
-  }
-}
-
-afterEach(() => vi.useRealTimers())
-
-describe('fetchWithAuth — minor 6b : corps JSON non-objet (null/primitif) sans throw', () => {
-  it('200 avec corps primitif (number) → data = valeur, pas de throw ni perte', async () => {
-    const { fn } = seqFetch([{ status: 200, body: 42 }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const res = await fetchWithAuth<number>('http://x/y', { method: 'GET' }, client)
-    expect(res.error).toBeNull()
-    expect(res.data).toBe(42)
-  })
-
-  it('200 avec corps JSON `null` → data = null, error = null (pas de `in` sur null)', async () => {
-    const { fn } = seqFetch([{ status: 200, body: null }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const res = await fetchWithAuth<unknown>('http://x/y', { method: 'GET' }, client)
-    expect(res.error).toBeNull()
-    expect(res.data).toBeNull()
-  })
-
-  it('200 avec corps tableau (pas d’enveloppe) → data = tableau tel quel', async () => {
-    const { fn } = seqFetch([{ status: 200, body: [1, 2, 3] }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const res = await fetchWithAuth<number[]>('http://x/y', { method: 'GET' }, client)
-    expect(res.error).toBeNull()
-    expect(res.data).toEqual([1, 2, 3])
-  })
-})
-
-describe('fetchWithAuth — retry transitoire', () => {
-  it('GET 503 puis 200 → retry puis succès', async () => {
-    vi.useFakeTimers()
-    const { fn, calls } = seqFetch([{ status: 503 }, { status: 200, body: { ok: true } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const p = fetchWithAuth<{ ok: boolean }>('http://x/y', { method: 'GET' }, client)
-    await vi.advanceTimersByTimeAsync(600)
-    const res = await p
-    expect(res.error).toBeNull()
-    expect(res.data).toEqual({ ok: true })
-    expect(calls.length).toBe(2)
-    expect(calls[1].init.headers).toMatchObject({ 'X-Retry-Count': '1' })
-  })
-
-  it('GET erreur réseau puis 200 → retry puis succès', async () => {
-    vi.useFakeTimers()
-    const { fn, calls } = seqFetch([{ status: 0, throw: new Error('ECONNRESET') }, { status: 200, body: { ok: 1 } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
-    await vi.advanceTimersByTimeAsync(600)
-    const res = await p
-    expect(res.error).toBeNull()
-    expect(calls.length).toBe(2)
-  })
-
-  it('POST 503 → PAS de retry', async () => {
-    const { fn, calls } = seqFetch([{ status: 503, body: { error: { code: 'x', message: 'down' } } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const res = await fetchWithAuth('http://x/y', { method: 'POST', body: { a: 1 } }, client)
-    expect(res.error?.status).toBe(503)
-    expect(calls.length).toBe(1)
-  })
-
-  it('GET 503 en boucle → borné à maxRetries (3) puis erreur', async () => {
-    vi.useFakeTimers()
-    const { fn, calls } = seqFetch([{ status: 503 }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
-    await vi.advanceTimersByTimeAsync(60000)
-    const res = await p
-    expect(res.error?.status).toBe(503)
-    expect(calls.length).toBe(4) // 1 + 3 retries
-  })
-
-  it('Retry-After prioritaire sur le backoff', async () => {
-    vi.useFakeTimers()
-    const { fn, calls } = seqFetch([
-      { status: 503, headers: { 'Retry-After': '2' } },
-      { status: 200, body: { ok: true } },
-    ])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
-    await vi.advanceTimersByTimeAsync(600) // > backoff max (500) mais < 2000
-    expect(calls.length).toBe(1)
-    await vi.advanceTimersByTimeAsync(1500) // total 2100 > 2000
-    await p
-    expect(calls.length).toBe(2)
-  })
-
-  it('AbortError → aucun retry', async () => {
-    const { fn, calls } = seqFetch([
-      { status: 0, throw: Object.assign(new Error('aborted'), { name: 'AbortError' }) },
-    ])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const res = await fetchWithAuth('http://x/y', { method: 'GET' }, client)
-    expect(res.error?.code).toBe('network_error')
-    expect(calls.length).toBe(1)
-  })
-
-  it('retry désactivé (client) → aucun retry sur 503', async () => {
-    const { fn, calls } = seqFetch([{ status: 503, body: {} }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch, { enabled: false, maxRetries: 0 })
-    const res = await fetchWithAuth('http://x/y', { method: 'GET' }, client)
-    expect(res.error?.status).toBe(503)
-    expect(calls.length).toBe(1)
-  })
-
-  it('skipRetry par requête → aucun retry', async () => {
-    const { fn, calls } = seqFetch([{ status: 503, body: {} }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const init: FetchInit = { method: 'GET', skipRetry: true }
-    const res = await fetchWithAuth('http://x/y', init, client)
-    expect(res.error?.status).toBe(503)
-    expect(calls.length).toBe(1)
-  })
-
-  it('LOT 3 (I5) : `{data:null,meta:null}` (enveloppe vide honnête) → res.data === null (pas l’enveloppe)', async () => {
-    const { fn } = seqFetch([{ status: 200, body: { data: null, meta: null } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const res = await fetchWithAuth('http://x/y', { method: 'POST', body: {} }, client)
-    expect(res.error).toBeNull()
-    expect(res.data).toBeNull()
-  })
-
-  it('LOT 3 (I5) : corps SANS clé `data` (legacy non enveloppé) → res.data === le corps entier', async () => {
-    const { fn } = seqFetch([{ status: 200, body: { message: 'ok', extra: 1 } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const res = await fetchWithAuth('http://x/y', { method: 'GET' }, client)
-    expect(res.error).toBeNull()
-    expect(res.data).toEqual({ message: 'ok', extra: 1 })
-  })
-
-  it('corps avec bigint → sérialisé en string', async () => {
-    const { fn, calls } = seqFetch([{ status: 200, body: { ok: true } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    await fetchWithAuth('http://x/y', { method: 'POST', body: { id: 7n } }, client)
-    expect(calls[0].init.body).toBe('{"id":"7"}')
-  })
-
-  it('LOT 3 (I8) : GET 503 puis 200 → onEvent reçoit {kind:"retry", attempt:1, status:503, url}', async () => {
-    vi.useFakeTimers()
-    const events: AuraObservabilityEvent[] = []
-    const { fn } = seqFetch([{ status: 503 }, { status: 200, body: { ok: true } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch, undefined, (e) => events.push(e))
-    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
-    await vi.advanceTimersByTimeAsync(600)
-    await p
-    expect(events).toContainEqual({ kind: 'retry', attempt: 1, status: 503, url: 'http://x/y' })
-  })
-
-  it('LOT 3 (I8) : erreur réseau puis 200 → onEvent reçoit {kind:"retry", attempt:1, url} (sans status)', async () => {
-    vi.useFakeTimers()
-    const events: AuraObservabilityEvent[] = []
-    const { fn } = seqFetch([{ status: 0, throw: new Error('ECONNRESET') }, { status: 200, body: { ok: 1 } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch, undefined, (e) => events.push(e))
-    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
-    await vi.advanceTimersByTimeAsync(600)
-    await p
-    expect(events).toContainEqual({ kind: 'retry', attempt: 1, url: 'http://x/y' })
-  })
-
-  it('LOT 3 (I8) : plusieurs retries → un événement par tentative, attempt croissant', async () => {
-    vi.useFakeTimers()
-    const events: AuraObservabilityEvent[] = []
-    const { fn } = seqFetch([{ status: 503 }, { status: 503 }, { status: 200, body: { ok: true } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch, undefined, (e) => events.push(e))
-    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
-    await vi.advanceTimersByTimeAsync(60000)
-    await p
-    const retries = events.filter((e) => e.kind === 'retry')
-    expect(retries.map((e) => (e as { attempt: number }).attempt)).toEqual([1, 2])
-  })
-
-  it('LOT 3 (I8) : onEvent absent → aucun throw, comportement inchangé', async () => {
-    vi.useFakeTimers()
-    const { fn, calls } = seqFetch([{ status: 503 }, { status: 200, body: { ok: true } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
-    await vi.advanceTimersByTimeAsync(600)
-    const res = await p
-    expect(res.error).toBeNull()
-    expect(calls.length).toBe(2)
-  })
-
-  it('LOT 3 (I8) : un onEvent qui throw ne casse pas la requête', async () => {
-    vi.useFakeTimers()
-    const { fn } = seqFetch([{ status: 503 }, { status: 200, body: { ok: true } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch, undefined, () => {
-      throw new Error('consumer onEvent boom')
-    })
-    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
-    await vi.advanceTimersByTimeAsync(600)
-    const res = await p
-    expect(res.error).toBeNull()
-    expect(res.data).toEqual({ ok: true })
-  })
-
-  it('LOT D : authToken override gagne sur store.token (Authorization = Bearer authToken)', async () => {
-    const { fn, calls } = seqFetch([{ status: 200, body: { ok: true } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    client.authStore.save('store-token', 'refresh', { id: 'u_store' } as any)
-    const init: FetchInit = { method: 'GET', authToken: 'foreign-token', skipAuthRefresh: true }
-    await fetchWithAuth('http://x/y', init, client)
-    const headers = calls[0].init.headers as Record<string, string>
-    expect(headers['Authorization']).toBe('Bearer foreign-token')
-    // apikey toujours envoyé (parité Supabase), inchangé.
-    expect(headers['apikey']).toBe('aura_anon_x')
-  })
-
-  it('LOT D : sans authToken → store.token (comportement inchangé)', async () => {
-    const { fn, calls } = seqFetch([{ status: 200, body: { ok: true } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    client.authStore.save('store-token', 'refresh', { id: 'u_store' } as any)
-    const init: FetchInit = { method: 'GET', skipAuthRefresh: true }
-    await fetchWithAuth('http://x/y', init, client)
-    const headers = calls[0].init.headers as Record<string, string>
-    expect(headers['Authorization']).toBe('Bearer store-token')
-  })
-
-  it('LOT D : authToken sans session (store vide) → Authorization = Bearer authToken', async () => {
-    const { fn, calls } = seqFetch([{ status: 200, body: { ok: true } }])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const init: FetchInit = { method: 'GET', authToken: 'foreign-token', skipAuthRefresh: true }
-    await fetchWithAuth('http://x/y', init, client)
-    const headers = calls[0].init.headers as Record<string, string>
-    expect(headers['Authorization']).toBe('Bearer foreign-token')
-  })
-
-  it('Retry-After énorme (86400) est plafonné à 60000ms', async () => {
-    vi.useFakeTimers()
-    const { fn, calls } = seqFetch([
-      { status: 503, headers: { 'Retry-After': '86400' } },
-      { status: 200, body: { ok: true } },
-    ])
-    const client = makeClient(fn as unknown as typeof globalThis.fetch)
-    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
-    await vi.advanceTimersByTimeAsync(59_999)
-    expect(calls.length).toBe(1) // pas encore rejoué
-    await vi.advanceTimersByTimeAsync(1) // total 60000 → plafond atteint
-    await p
-    expect(calls.length).toBe(2)
-  })
-})