@aurabase/aurabase-js 0.3.0

package/packages/aurabase/tests/rt-alias-public-e2e.test.ts

@@ -0,0 +1,235 @@
+// ---------------------------------------------------------------------------
+// E2E réel (stack live) — Lot realtime / correctif `rt-alias-public-rls`.
+// Réf. : docs/superpowers/specs/2026-07-13-rt-alias-public-rls-design.md
+//
+// PROUVE la correction du bug backend : un client abonné via l'ALIAS PUBLIC
+// `db:public.{table}` (le canal auquel s'abonnent réellement Studio et le SDK)
+// reçoit bien les events postgres_changes.
+//
+// AVANT le fix : le CDC ne collectait `allowed_sub_ids` que sur le canal
+// GÉNÉRIQUE (schéma physique `project_<uuid>`) ; un abonné via l'alias public
+// n'y figurait jamais → branche fail-closed déclenchée MÊME SANS policy RLS →
+// 0 INSERT/UPDATE reçu. C'est d'ailleurs pourquoi le test frère
+// `realtime-filter-e2e.test.ts` s'abonne, lui, au canal générique pour
+// contourner ce bug (cf. son commentaire l.142-147).
+//
+// APRÈS le fix (cdc/postgres.rs → get_subscribers_for_channels sur les 3
+// formes) : l'abonné via l'alias public est inclus dans le calcul RLS et reçoit
+// les events autorisés. Ce test s'abonne DONC volontairement à `db:public.*`.
+//
+// Mécanisme d'activation realtime + auth WS : identiques au test frère
+// (PUT /v1/db/{project}/schema/tables/{table}/realtime, JWT via signUp/signIn).
+// Gaté par RUN_E2E + credentials ; skip gracieux sur infra transitoire.
+// ---------------------------------------------------------------------------
+
+import { describe, it, expect } from 'vitest'
+import { createClient, createAdminClient } from '../src/index'
+import type { AuraResponse, RealtimeEvent, RealtimeSubscribeStatus } from '../src/index'
+
+const URL = process.env.AURA_E2E_URL
+const PROJECT = process.env.AURA_E2E_PROJECT
+const ANON = process.env.AURA_E2E_ANON_KEY
+const SERVICE = process.env.AURA_E2E_SERVICE_KEY
+const RUN = Boolean(process.env.RUN_E2E && URL && PROJECT && ANON && SERVICE)
+
+const TRANSIENT_STATUS = new Set([408, 429, 502, 503, 504])
+
+async function retryTransient<T>(fn: () => Promise<AuraResponse<T>>): Promise<AuraResponse<T>> {
+  let res = await fn()
+  for (let i = 0; i < 10 && res.error && TRANSIENT_STATUS.has(res.error.status); i++) {
+    await new Promise((r) => setTimeout(r, 1000))
+    res = await fn()
+  }
+  return res
+}
+
+async function retryFetchTransient(fn: () => Promise<Response>): Promise<Response> {
+  let res = await fn()
+  for (let i = 0; i < 10 && TRANSIENT_STATUS.has(res.status); i++) {
+    await new Promise((r) => setTimeout(r, 1000))
+    res = await fn()
+  }
+  return res
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((r) => setTimeout(r, ms))
+}
+
+type CdcRecord = Record<string, unknown>
+interface CdcPayload {
+  schema: string
+  table: string
+  type: 'INSERT' | 'UPDATE' | 'DELETE'
+  record: CdcRecord
+  old_record: CdcRecord | null
+}
+
+function waitForSubscribeStatus(
+  doSubscribe: (cb: (status: RealtimeSubscribeStatus, err?: Error) => void) => void,
+  timeoutMs: number,
+): Promise<{ status: RealtimeSubscribeStatus; err?: Error } | 'timeout'> {
+  return new Promise((resolve) => {
+    let done = false
+    const timer = setTimeout(() => {
+      if (!done) {
+        done = true
+        resolve('timeout')
+      }
+    }, timeoutMs)
+    doSubscribe((status, err) => {
+      if (done) return
+      done = true
+      clearTimeout(timer)
+      resolve({ status, err })
+    })
+  })
+}
+
+describe.runIf(RUN)('realtime alias public E2E réel — un abonné à db:public.{table} reçoit les events', () => {
+  it(
+    "l'alias public db:public.{table} délivre bien l'INSERT (régression du bug allowed_sub_ids)",
+    async () => {
+      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
+      const anon = createClient(URL!, PROJECT!, ANON!)
+      const suffix = process.env.AURA_E2E_SUFFIX ?? Math.random().toString(36).slice(2, 8)
+      const table = `rt_pub_${suffix}`
+      // On s'abonne à l'ALIAS PUBLIC (et NON au canal générique physique) :
+      // c'est précisément le chemin qui donnait 0 event avant le correctif.
+      const channelName = `db:public.${table}`
+      const email = `rt-alias-public-e2e-${suffix}@aurabase.dev`
+      const password = 'EndUserPassword123!'
+
+      let tableCreated = false
+      let userId: string | null = null
+
+      try {
+        // -- 1. Setup service_role : table jetable + GRANT + reload PostgREST ----
+        await admin.db.sql(`DROP TABLE IF EXISTS ${table}`)
+        const createRes = await admin.db.sql(
+          `CREATE TABLE ${table} (
+             id serial PRIMARY KEY,
+             body text NOT NULL DEFAULT ''
+           )`,
+        )
+        if (createRes.error) {
+          // eslint-disable-next-line no-console
+          console.warn(
+            `[rt-alias-public-e2e] SKIP (infra: CREATE TABLE a échoué — ${createRes.error.status} ` +
+              `${createRes.error.message ?? ''}).`,
+          )
+          return
+        }
+        tableCreated = true
+        await admin.db.sql(`GRANT ALL ON ${table} TO PUBLIC`)
+        await admin.db.sql(`SELECT pg_notify('pgrst', 'reload schema')`)
+
+        // -- 2. Activer le realtime CDC pour cette table (service_role) ---------
+        //     (aucune policy RLS n'est créée : le bug se déclenchait MÊME sans RLS)
+        const enableRes = await retryFetchTransient(() =>
+          fetch(`${admin.baseUrl}/v1/db/${admin.projectId}/schema/tables/${table}/realtime`, {
+            method: 'PUT',
+            headers: { apikey: SERVICE!, 'content-type': 'application/json' },
+            body: JSON.stringify({ enabled: true }),
+          }),
+        )
+        if (!enableRes.ok) {
+          // eslint-disable-next-line no-console
+          console.warn(
+            `[rt-alias-public-e2e] SKIP (infra: PUT .../schema/tables/${table}/realtime → ` +
+              `${enableRes.status}).`,
+          )
+          return
+        }
+
+        // -- 3. Utilisateur jetable (anon key) — le WS exige un vrai JWT --------
+        const signUpRes = await retryTransient(() => anon.auth.signUp({ email, password }))
+        if (signUpRes.error && TRANSIENT_STATUS.has(signUpRes.error.status)) {
+          // eslint-disable-next-line no-console
+          console.warn(`[rt-alias-public-e2e] SKIP (infra: signUp — ${signUpRes.error.status}).`)
+          return
+        }
+        expect(signUpRes.error).toBeNull()
+
+        const loginRes = await retryTransient(() => anon.auth.signInWithPassword({ email, password }))
+        if (loginRes.error && TRANSIENT_STATUS.has(loginRes.error.status)) {
+          // eslint-disable-next-line no-console
+          console.warn(`[rt-alias-public-e2e] SKIP (infra: signIn — ${loginRes.error.status}).`)
+          return
+        }
+        expect(loginRes.error).toBeNull()
+        const loginData = loginRes.data as { user: { id: string } } | null
+        userId = loginData?.user.id ?? null
+
+        // -- 4. Laisser le filtre CDC se rafraîchir (add-tables, ~3s) -----------
+        await sleep(4000)
+
+        // -- 5. Connexion WS + abonnement à l'ALIAS PUBLIC ----------------------
+        anon.realtime.connect()
+        const received: RealtimeEvent<CdcPayload>[] = []
+        const channel = anon.channel(channelName)
+        channel.on(
+          'postgres_changes',
+          // `schema` omis (le payload porte le schéma physique) — on isole la
+          // livraison via l'alias public, table filtrée par nom.
+          { event: '*', table },
+          (payload) => received.push(payload as RealtimeEvent<CdcPayload>),
+        )
+
+        const result = await waitForSubscribeStatus((cb) => channel.subscribe(cb), 15_000)
+        if (result === 'timeout' || result.status !== 'SUBSCRIBED') {
+          // eslint-disable-next-line no-console
+          console.warn(
+            `[rt-alias-public-e2e] SKIP (WS/CDC pas prêt — ` +
+              `${result === 'timeout' ? 'timeout SUBSCRIBED' : `statut ${result.status}`}).`,
+          )
+          return
+        }
+
+        // -- 6. INSERT une ligne via service_role -------------------------------
+        const marker = `hello-${suffix}`
+        const ins = await admin.db.sql(`INSERT INTO ${table} (body) VALUES ($1)`, [marker])
+        expect(ins.error).toBeNull()
+
+        // -- 7. Fenêtre de collecte CDC (poll WAL + pub/sub) --------------------
+        await sleep(8_000)
+
+        // -- 8. ASSERTION : l'event a bien été livré via l'alias public ---------
+        const gotInsert = received.some(
+          (e) => e.payload?.type === 'INSERT' && e.payload?.record?.body === marker,
+        )
+        expect(
+          gotInsert,
+          `aucun INSERT reçu via l'alias public ${channelName} — le bug allowed_sub_ids n'est PAS corrigé ` +
+            `(events reçus: ${received.length})`,
+        ).toBe(true)
+      } finally {
+        try {
+          anon.realtime.removeAllChannels()
+        } catch {
+          /* best-effort */
+        }
+        try {
+          anon.realtime.disconnect()
+        } catch {
+          /* best-effort */
+        }
+        if (userId) {
+          try {
+            await admin.authAdmin.deleteUser(userId)
+          } catch {
+            /* best-effort */
+          }
+        }
+        if (tableCreated) {
+          try {
+            await admin.db.sql(`DROP TABLE IF EXISTS ${table}`)
+          } catch {
+            /* best-effort */
+          }
+        }
+      }
+    },
+    120_000,
+  )
+})

package/packages/aurabase/tests/rt-http-broadcast-e2e.test.ts

@@ -0,0 +1,124 @@
+// ---------------------------------------------------------------------------
+// E2E réel (stack live) — Lot sdk-realtime / correctif `rt-http-broadcast`.
+// Réf. : docs/superpowers/specs/2026-07-13-rt-http-broadcast-design.md
+//
+// PROUVE que `realtime.httpBroadcast(channel, event, payload)` (envoi REST hors
+// WebSocket, POST /v1/realtime/{project}/broadcast) est bien distribué à un
+// abonné connecté en WebSocket sur le même canal broadcast. Valide le contrat
+// backend { channel (préfixé projet), payload:{ event, ... } } de bout en bout.
+//
+// Gaté par RUN_E2E + credentials ; skip gracieux sur infra transitoire.
+// ---------------------------------------------------------------------------
+
+import { describe, it, expect } from 'vitest'
+import { createClient } from '../src/index'
+import type { RealtimeSubscribeStatus } from '../src/index'
+
+const URL = process.env.AURA_E2E_URL
+const PROJECT = process.env.AURA_E2E_PROJECT
+const ANON = process.env.AURA_E2E_ANON_KEY
+const SERVICE = process.env.AURA_E2E_SERVICE_KEY
+const RUN = Boolean(process.env.RUN_E2E && URL && PROJECT && ANON && SERVICE)
+
+const TRANSIENT_STATUS = new Set([408, 429, 502, 503, 504])
+const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms))
+
+function waitForSubscribeStatus(
+  doSubscribe: (cb: (status: RealtimeSubscribeStatus, err?: Error) => void) => void,
+  timeoutMs: number,
+): Promise<{ status: RealtimeSubscribeStatus } | 'timeout'> {
+  return new Promise((resolve) => {
+    let done = false
+    const timer = setTimeout(() => {
+      if (!done) {
+        done = true
+        resolve('timeout')
+      }
+    }, timeoutMs)
+    doSubscribe((status) => {
+      if (done) return
+      done = true
+      clearTimeout(timer)
+      resolve({ status })
+    })
+  })
+}
+
+describe.runIf(RUN)('realtime httpBroadcast E2E réel — REST → WebSocket', () => {
+  it(
+    'un broadcast émis via httpBroadcast (REST) est livré à un abonné WebSocket du même canal',
+    async () => {
+      const anon = createClient(URL!, PROJECT!, ANON!)
+      const suffix = process.env.AURA_E2E_SUFFIX ?? Math.random().toString(36).slice(2, 8)
+      const channelName = `httpbcast-${suffix}`
+      const evt = 'ping'
+      const marker = `hello-${suffix}`
+      const email = `rt-httpbcast-e2e-${suffix}@aurabase.dev`
+      const password = 'EndUserPassword123!'
+
+      let userId: string | null = null
+      const received: unknown[] = []
+
+      try {
+        // Le WS exige un vrai JWT → utilisateur jetable via la clé anon.
+        const signUp = await anon.auth.signUp({ email, password })
+        if (signUp.error && TRANSIENT_STATUS.has(signUp.error.status)) {
+          console.warn(`[rt-http-broadcast-e2e] SKIP (signUp ${signUp.error.status}).`)
+          return
+        }
+        const login = await anon.auth.signInWithPassword({ email, password })
+        if (login.error && TRANSIENT_STATUS.has(login.error.status)) {
+          console.warn(`[rt-http-broadcast-e2e] SKIP (signIn ${login.error.status}).`)
+          return
+        }
+        expect(login.error).toBeNull()
+        userId = (login.data as { user?: { id: string } } | null)?.user?.id ?? null
+
+        anon.realtime.connect()
+        const channel = anon.channel(channelName)
+        channel.on('broadcast', { event: evt }, (payload) => received.push(payload))
+
+        const res = await waitForSubscribeStatus((cb) => channel.subscribe(cb), 15_000)
+        if (res === 'timeout' || res.status !== 'SUBSCRIBED') {
+          console.warn(
+            `[rt-http-broadcast-e2e] SKIP (WS pas prêt — ${res === 'timeout' ? 'timeout' : res.status}).`,
+          )
+          return
+        }
+
+        // Émission REST (hors WS) — le cœur du correctif.
+        const bcast = await anon.realtime.httpBroadcast(channelName, evt, { msg: marker })
+        if (bcast.error && TRANSIENT_STATUS.has(bcast.error.status)) {
+          console.warn(`[rt-http-broadcast-e2e] SKIP (httpBroadcast ${bcast.error.status}).`)
+          return
+        }
+        expect(bcast.error, `httpBroadcast a échoué: ${JSON.stringify(bcast.error)}`).toBeNull()
+
+        // Fenêtre de livraison WS.
+        await sleep(6_000)
+
+        const got = received.some((r) => JSON.stringify(r).includes(marker))
+        expect(
+          got,
+          `le broadcast REST n'a pas été livré à l'abonné WS (reçus: ${JSON.stringify(received)})`,
+        ).toBe(true)
+      } finally {
+        try {
+          anon.realtime.removeAllChannels()
+          anon.realtime.disconnect()
+        } catch {
+          /* best-effort */
+        }
+        if (userId) {
+          try {
+            const admin = createClient(URL!, PROJECT!, SERVICE!)
+            await admin.authAdmin?.deleteUser?.(userId)
+          } catch {
+            /* best-effort */
+          }
+        }
+      }
+    },
+    90_000,
+  )
+})

package/packages/aurabase/tests/service-role-guard.test.ts

@@ -0,0 +1,99 @@
+import { describe, it, expect, afterEach, vi } from 'vitest'
+import { createClient, createAdminClient, AuraClient } from '../src/index'
+
+const BASE = 'http://guard.local'
+const PROJECT = 'proj-guard'
+
+afterEach(() => {
+  delete (globalThis as unknown as { window?: unknown }).window
+  delete (globalThis as unknown as { DedicatedWorkerGlobalScope?: unknown }).DedicatedWorkerGlobalScope
+  delete (globalThis as unknown as { SharedWorkerGlobalScope?: unknown }).SharedWorkerGlobalScope
+  vi.restoreAllMocks()
+})
+
+describe('Garde service_role — authAdmin getter (I3, durci)', () => {
+  it('THROW en contexte navigateur (window défini) au lieu de warn', () => {
+    // Client construit hors navigateur (pas de window) : OK.
+    const client = createClient(BASE, PROJECT, 'aura_anon_x', {
+      auth: { autoRefresh: false, persistSession: false },
+    })
+    // Simule un navigateur.
+    ;(globalThis as unknown as { window: unknown }).window = {}
+    expect(() => client.authAdmin).toThrow(/navigateur/)
+  })
+
+  it('accessible en contexte serveur (pas de window)', () => {
+    const client = createClient(BASE, PROJECT, 'aura_anon_x', {
+      auth: { autoRefresh: false, persistSession: false },
+    })
+    // Ne throw pas hors navigateur.
+    expect(() => client.authAdmin).not.toThrow()
+  })
+})
+
+describe('Garde service_role — createClient côté navigateur (SEC-F5, throw par défaut)', () => {
+  it('clé aura_sk_ (service_role) en navigateur → THROW par défaut (refuseServiceRoleInBrowser)', () => {
+    ;(globalThis as unknown as { window: unknown }).window = {}
+
+    expect(() =>
+      createClient(BASE, PROJECT, 'aura_sk_secret', {
+        auth: { autoRefresh: false, persistSession: false },
+      }),
+    ).toThrow(/service_role/)
+  })
+
+  it('clé aura_sk_ en navigateur avec refuseServiceRoleInBrowser:false → warn seulement (échappatoire)', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    ;(globalThis as unknown as { window: unknown }).window = {}
+
+    expect(() =>
+      createClient(BASE, PROJECT, 'aura_sk_secret', {
+        auth: { autoRefresh: false, persistSession: false },
+        refuseServiceRoleInBrowser: false,
+      }),
+    ).not.toThrow()
+
+    const warned = warn.mock.calls.some((c) => String(c[0]).includes('service_role'))
+    expect(warned).toBe(true)
+  })
+
+  it('clé anon (aura_anon_) en navigateur → PAS de throw ni warning service_role (usage légitime)', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    ;(globalThis as unknown as { window: unknown }).window = {}
+
+    createClient(BASE, PROJECT, 'aura_anon_public', {
+      auth: { autoRefresh: false, persistSession: false },
+    })
+
+    const warnedSrole = warn.mock.calls.some((c) => String(c[0]).includes('service_role'))
+    expect(warnedSrole).toBe(false)
+  })
+
+  it('clé aura_sk_ hors navigateur (serveur) → PAS de warning', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    createClient(BASE, PROJECT, 'aura_sk_secret', {
+      auth: { autoRefresh: false, persistSession: false },
+    })
+    const warnedSrole = warn.mock.calls.some((c) => String(c[0]).includes('service_role'))
+    expect(warnedSrole).toBe(false)
+  })
+})
+
+describe('Garde service_role — createAdminClient (E21, étendue aux workers navigateur)', () => {
+  it('THROW en contexte navigateur (window)', () => {
+    ;(globalThis as unknown as { window: unknown }).window = {}
+    expect(() => createAdminClient(BASE, PROJECT, 'aura_sk_x')).toThrow(/navigateur/)
+  })
+
+  it('THROW dans un Web Worker navigateur (DedicatedWorkerGlobalScope, sans window)', () => {
+    ;(globalThis as unknown as { DedicatedWorkerGlobalScope: unknown }).DedicatedWorkerGlobalScope =
+      function () {}
+    expect(() => createAdminClient(BASE, PROJECT, 'aura_sk_x')).toThrow(/navigateur/)
+  })
+
+  it('OK en contexte serveur (ni window ni worker navigateur)', () => {
+    const admin = createAdminClient(BASE, PROJECT, 'aura_sk_x')
+    expect(admin).toBeInstanceOf(AuraClient)
+    expect(admin.apiKey).toBe('aura_sk_x')
+  })
+})

package/packages/aurabase/tests/ssr.test.ts

@@ -0,0 +1,91 @@
+import { describe, it, expect } from 'vitest'
+import { createServerClient } from '../src/ssr'
+import type { User } from '@aurabase/core'
+
+function b64url(o: unknown) { return btoa(JSON.stringify(o)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '') }
+function validJwt() { return `${b64url({ alg: 'HS256' })}.${b64url({ sub: 'u1', exp: Math.floor(Date.now() / 1000) + 3600 })}.s` }
+function user(metaSize = 0): User {
+  return {
+    id: 'u1', email: 't@e.com', role: 'authenticated', email_verified: true,
+    is_banned: false, is_anonymous: false, mfa_enabled: false,
+    user_metadata: metaSize ? { blob: 'x'.repeat(metaSize) } : {},
+    app_metadata: {}, created_at: '2025-01-01T00:00:00Z',
+  }
+}
+
+/** Faux magasin de cookies : setAll écrit / expire (maxAge 0), getAll relit. */
+function jar(initial: Array<{ name: string; value: string }> = []) {
+  const store = new Map(initial.map((c) => [c.name, c.value]))
+  return {
+    getAll: () => [...store].map(([name, value]) => ({ name, value })),
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    setAll: (cs: Array<{ name: string; value: string; options: any }>) =>
+      cs.forEach(({ name, value, options }) => {
+        if (options?.maxAge === 0) store.delete(name)
+        else store.set(name, value)
+      }),
+    store,
+  }
+}
+
+describe('createServerClient — cookies SSR', () => {
+  it('secure calé sur le protocole : false en http (dev), true en https', () => {
+    const httpCalls: Array<{ options: { secure?: boolean } }> = []
+    const http = createServerClient('http://localhost:8080', 'p', {
+      apiKey: 'k',
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      cookies: { getAll: () => [], setAll: (cs: any) => httpCalls.push(...cs) },
+    })
+    http.authStore.save(validJwt(), 'rt', user())
+    expect(httpCalls[0].options.secure).toBe(false)
+
+    const httpsCalls: Array<{ options: { secure?: boolean } }> = []
+    const https = createServerClient('https://api.example.com', 'p', {
+      apiKey: 'k',
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      cookies: { getAll: () => [], setAll: (cs: any) => httpsCalls.push(...cs) },
+    })
+    https.authStore.save(validJwt(), 'rt', user())
+    expect(httpsCalls[0].options.secure).toBe(true)
+  })
+
+  it('session normale → un seul cookie ; round-trip write→read restaure la session', () => {
+    const j = jar()
+    const tok = validJwt()
+    const c1 = createServerClient('https://x', 'p', { apiKey: 'k', cookies: j })
+    c1.authStore.save(tok, 'rt', user())
+    // un seul cookie, pas de chunk
+    expect([...j.store.keys()]).toEqual(['aura-p-auth'])
+
+    const c2 = createServerClient('https://x', 'p', { apiKey: 'k', cookies: j })
+    expect(c2.authStore.token).toBe(tok)
+    expect(c2.authStore.user?.id).toBe('u1')
+  })
+
+  it('session volumineuse → fragmentée en chunks .0/.1… ; round-trip la reconstitue', () => {
+    const j = jar()
+    const tok = validJwt()
+    const c1 = createServerClient('https://x', 'p', { apiKey: 'k', cookies: j })
+    c1.authStore.save(tok, 'rt', user(5000)) // > MAX_CHUNK_SIZE → chunks
+    const names = [...j.store.keys()]
+    expect(names).toContain('aura-p-auth.0')
+    expect(names).toContain('aura-p-auth.1')
+    expect(names).not.toContain('aura-p-auth') // pas de cookie unique quand chunké
+
+    const c2 = createServerClient('https://x', 'p', { apiKey: 'k', cookies: j })
+    expect(c2.authStore.token).toBe(tok)
+    expect(c2.authStore.user?.user_metadata?.blob).toBe('x'.repeat(5000))
+  })
+
+  it('signout (clear) expire les cookies auth présents', () => {
+    const j = jar()
+    const c1 = createServerClient('https://x', 'p', { apiKey: 'k', cookies: j })
+    c1.authStore.save(validJwt(), 'rt', user())
+    expect(j.store.size).toBe(1)
+
+    // Nouveau client qui charge le cookie, puis signout.
+    const c2 = createServerClient('https://x', 'p', { apiKey: 'k', cookies: j })
+    c2.authStore.clear()
+    expect(j.store.size).toBe(0) // cookie expiré/supprimé
+  })
+})