@aurabase/aurabase-js 0.3.0

package/packages/core/tests/auth-store.test.ts

@@ -0,0 +1,300 @@
+// ---------------------------------------------------------------------------
+// BaseAuthStore + LocalAuthStore tests
+// ---------------------------------------------------------------------------
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+import { BaseAuthStore, isTokenExpired } from '../src/stores/BaseAuthStore'
+import { LocalAuthStore } from '../src/stores/LocalAuthStore'
+import { fakeUser, fakeJwt, validJwt, expiredJwt } from './mocks'
+
+// ---------------------------------------------------------------------------
+// BaseAuthStore
+// ---------------------------------------------------------------------------
+
+describe('BaseAuthStore', () => {
+  let store: BaseAuthStore
+
+  beforeEach(() => {
+    store = new BaseAuthStore()
+  })
+
+  it('starts with null token/user', () => {
+    expect(store.token).toBeNull()
+    expect(store.refreshToken).toBeNull()
+    expect(store.user).toBeNull()
+  })
+
+  it('save() stores token, refreshToken and user', () => {
+    const user = fakeUser()
+    store.save('tok_1', 'rt_1', user)
+
+    expect(store.token).toBe('tok_1')
+    expect(store.refreshToken).toBe('rt_1')
+    expect(store.user).toEqual(user)
+  })
+
+  it('clear() resets to null', () => {
+    store.save('tok_1', 'rt_1', fakeUser())
+    store.clear()
+
+    expect(store.token).toBeNull()
+    expect(store.refreshToken).toBeNull()
+    expect(store.user).toBeNull()
+  })
+
+  it('onChange fires callback on save and clear', () => {
+    const events: Array<{ token: string | null; user: unknown }> = []
+    store.onChange((token, user) => {
+      events.push({ token, user })
+    })
+
+    const user = fakeUser()
+    store.save('tok_1', 'rt_1', user)
+    store.clear()
+
+    expect(events).toHaveLength(2)
+    expect(events[0].token).toBe('tok_1')
+    expect(events[1].token).toBeNull()
+  })
+
+  it('unsubscribe stops receiving events', () => {
+    const events: string[] = []
+    const unsub = store.onChange((token) => {
+      events.push(token ?? 'null')
+    })
+
+    store.save('tok_1', 'rt_1', fakeUser())
+    expect(events).toHaveLength(1)
+
+    unsub()
+    store.save('tok_2', 'rt_2', fakeUser())
+    // Should still be 1 since we unsubscribed
+    expect(events).toHaveLength(1)
+  })
+
+  it('isValid returns true for a non-expired JWT', () => {
+    store.save(validJwt(), 'rt', fakeUser())
+    expect(store.isValid).toBe(true)
+  })
+
+  it('isValid returns false for an expired JWT', () => {
+    store.save(expiredJwt(), 'rt', fakeUser())
+    expect(store.isValid).toBe(false)
+  })
+
+  it('isValid returns false when no token is set', () => {
+    expect(store.isValid).toBe(false)
+  })
+
+  it('subscriber errors do not break the store', () => {
+    store.onChange(() => {
+      throw new Error('subscriber boom')
+    })
+    const events: string[] = []
+    store.onChange((token) => events.push(token ?? 'null'))
+
+    // Should not throw
+    store.save('tok_1', 'rt_1', fakeUser())
+    expect(events).toHaveLength(1)
+    expect(events[0]).toBe('tok_1')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// isTokenExpired
+// ---------------------------------------------------------------------------
+
+describe('isTokenExpired', () => {
+  it('returns false for a future-exp token', () => {
+    const future = fakeJwt(Math.floor(Date.now() / 1000) + 3600)
+    expect(isTokenExpired(future)).toBe(false)
+  })
+
+  it('returns true for a past-exp token', () => {
+    const past = fakeJwt(Math.floor(Date.now() / 1000) - 60)
+    expect(isTokenExpired(past)).toBe(true)
+  })
+
+  it('respects margin parameter', () => {
+    // Token expires in 10 seconds, but margin is 30 -- should be "expired"
+    const almostExpired = fakeJwt(Math.floor(Date.now() / 1000) + 10)
+    expect(isTokenExpired(almostExpired, 30)).toBe(true)
+  })
+
+  it('returns true for malformed tokens', () => {
+    expect(isTokenExpired('not-a-jwt')).toBe(true)
+    expect(isTokenExpired('')).toBe(true)
+    expect(isTokenExpired('a.b')).toBe(true)
+  })
+})
+
+// ---------------------------------------------------------------------------
+// LocalAuthStore (mocked localStorage)
+// ---------------------------------------------------------------------------
+
+describe('LocalAuthStore', () => {
+  let mockStorage: Record<string, string>
+
+  beforeEach(() => {
+    mockStorage = {}
+    // Mock localStorage
+    const storage = {
+      getItem: vi.fn((key: string) => mockStorage[key] ?? null),
+      setItem: vi.fn((key: string, value: string) => {
+        mockStorage[key] = value
+      }),
+      removeItem: vi.fn((key: string) => {
+        delete mockStorage[key]
+      }),
+      clear: vi.fn(() => {
+        mockStorage = {}
+      }),
+      get length() {
+        return Object.keys(mockStorage).length
+      },
+      key: vi.fn((index: number) => Object.keys(mockStorage)[index] ?? null),
+    }
+
+    Object.defineProperty(globalThis, 'localStorage', {
+      value: storage,
+      writable: true,
+      configurable: true,
+    })
+  })
+
+  afterEach(() => {
+    // Clean up
+    delete (globalThis as any).localStorage
+  })
+
+  it('persists to localStorage on save', () => {
+    const store = new LocalAuthStore()
+    store.save('tok_1', 'rt_1', fakeUser())
+
+    const raw = mockStorage['aurabase_auth']
+    expect(raw).toBeDefined()
+    const parsed = JSON.parse(raw)
+    expect(parsed.token).toBe('tok_1')
+    expect(parsed.refreshToken).toBe('rt_1')
+    expect(parsed.user.id).toBe('user-1')
+  })
+
+  it('clears localStorage on clear()', () => {
+    const store = new LocalAuthStore()
+    store.save('tok_1', 'rt_1', fakeUser())
+    expect(mockStorage['aurabase_auth']).toBeDefined()
+
+    store.clear()
+    expect(mockStorage['aurabase_auth']).toBeUndefined()
+  })
+
+  it('loads from localStorage on construction', () => {
+    // Pre-populate storage
+    mockStorage['aurabase_auth'] = JSON.stringify({
+      token: 'tok_pre',
+      refreshToken: 'rt_pre',
+      user: fakeUser({ email: 'stored@example.com' }),
+    })
+
+    const store = new LocalAuthStore()
+
+    expect(store.token).toBe('tok_pre')
+    expect(store.refreshToken).toBe('rt_pre')
+    expect(store.user?.email).toBe('stored@example.com')
+  })
+
+  it('uses custom key', () => {
+    const store = new LocalAuthStore('custom_key')
+    store.save('tok_1', 'rt_1', fakeUser())
+
+    expect(mockStorage['custom_key']).toBeDefined()
+    expect(mockStorage['aurabase_auth']).toBeUndefined()
+  })
+
+  it('handles corrupted localStorage gracefully', () => {
+    mockStorage['aurabase_auth'] = 'not valid json {'
+
+    // Should not throw
+    const store = new LocalAuthStore()
+    expect(store.token).toBeNull()
+  })
+
+  it('exportToCookie produces valid Set-Cookie string', () => {
+    const store = new LocalAuthStore()
+    store.save('tok_1', 'rt_1', fakeUser())
+
+    const cookie = store.exportToCookie({
+      path: '/',
+      secure: true,
+      sameSite: 'Lax',
+      maxAge: 86400,
+    })
+
+    expect(cookie).toContain('aurabase_auth=')
+    expect(cookie).toContain('Path=/')
+    expect(cookie).toContain('Secure')
+    expect(cookie).toContain('SameSite=Lax')
+    expect(cookie).toContain('Max-Age=86400')
+  })
+
+  it('LOT 3 (I8) : setItem qui throw (quota) émet storage-blocked sans casser save()', () => {
+    const store = new LocalAuthStore()
+    const events: Array<{ kind: string; op?: string }> = []
+    store.setObservabilityHook((e) => events.push(e as { kind: string; op?: string }), false)
+
+    const original = (globalThis as any).localStorage.setItem
+    ;(globalThis as any).localStorage.setItem = vi.fn(() => {
+      throw new Error('QuotaExceededError')
+    })
+
+    // save() ne throw jamais malgré le localStorage bloqué.
+    expect(() => store.save('tok_1', 'rt_1', fakeUser())).not.toThrow()
+    expect(store.token).toBe('tok_1') // état en mémoire toujours à jour
+
+    // save() persiste via `_persist()` (op 'persist'), pas via le `setItem` public
+    // override (réservé au stockage clé/valeur générique — PKCE `code_verifier`).
+    expect(events).toContainEqual({ kind: 'storage-blocked', op: 'persist' })
+
+    ;(globalThis as any).localStorage.setItem = original
+  })
+
+  it('LOT 3 (I8) : setItem (générique, ex. PKCE) qui throw émet storage-blocked op:"setItem"', () => {
+    const store = new LocalAuthStore()
+    const events: Array<{ kind: string; op?: string }> = []
+    store.setObservabilityHook((e) => events.push(e as { kind: string; op?: string }), false)
+
+    const original = (globalThis as any).localStorage.setItem
+    ;(globalThis as any).localStorage.setItem = vi.fn(() => {
+      throw new Error('QuotaExceededError')
+    })
+
+    expect(() => store.setItem('some-key', 'some-value')).not.toThrow()
+    expect(events).toContainEqual({ kind: 'storage-blocked', op: 'setItem' })
+
+    ;(globalThis as any).localStorage.setItem = original
+  })
+
+  it('LOT 3 (I8) : sans hook câblé, aucun throw / no-op silencieux', () => {
+    const store = new LocalAuthStore()
+    ;(globalThis as any).localStorage.setItem = vi.fn(() => {
+      throw new Error('blocked')
+    })
+    expect(() => store.save('tok_1', 'rt_1', fakeUser())).not.toThrow()
+  })
+
+  it('loadFromCookie restores auth state', () => {
+    const store = new LocalAuthStore()
+    const data = {
+      token: 'tok_cookie',
+      refreshToken: 'rt_cookie',
+      user: fakeUser({ email: 'cookie@example.com' }),
+    }
+    const cookieString = `other=val; aurabase_auth=${encodeURIComponent(JSON.stringify(data))}; foo=bar`
+
+    store.loadFromCookie(cookieString)
+
+    expect(store.token).toBe('tok_cookie')
+    expect(store.refreshToken).toBe('rt_cookie')
+    expect(store.user?.email).toBe('cookie@example.com')
+  })
+})

package/packages/core/tests/error-code.test.ts

@@ -0,0 +1,61 @@
+// ---------------------------------------------------------------------------
+// AuraErrorCode (LOT 3, finding I4) -- taxonomie d'erreurs typée
+// ---------------------------------------------------------------------------
+
+// NOTE : le test type-level proprement dit (vérifié par `tsc`, pas seulement par
+// vitest qui transpile/strip les types) vit dans
+// `packages/aurabase/tests/types/error-code.test-d.ts` (chaîné à `pnpm --filter
+// aurabase test` via `tsconfig.test-d.json`). Ici : couverture RUNTIME uniquement.
+import { describe, it, expect } from 'vitest'
+import { AuraError, type AuraErrorCode } from '../src/AuraError'
+
+describe('AuraErrorCode', () => {
+  it('un code connu (littéral de l’union) est accepté et préservé au runtime', () => {
+    const e = new AuraError(0, { error: { code: 'timeout', message: 'x' } })
+    expect(e.code).toBe('timeout')
+    // Sanity : assignable à AuraErrorCode sans cast (autocomplétion sur les littéraux connus).
+    const code: AuraErrorCode = e.code
+    expect(code).toBe('timeout')
+  })
+
+  it('reste ouvert à un code backend arbitraire non listé (pattern LiteralUnion)', () => {
+    const e = new AuraError(422, { error: { code: 'some_backend_specific_code', message: 'x' } })
+    expect(e.code).toBe('some_backend_specific_code')
+    const code: AuraErrorCode = e.code
+    expect(code).toBe('some_backend_specific_code')
+  })
+
+  it('fallback http_<status> quand aucun code n’est fourni par le backend', () => {
+    const e = new AuraError(503)
+    expect(e.code).toBe('http_503')
+  })
+
+  it('couvre tous les codes SDK-side connus (échantillon représentatif)', () => {
+    const knownCodes: AuraErrorCode[] = [
+      'no_session',
+      'timeout',
+      'network_error',
+      'invalid_response',
+      'refresh_discarded',
+      'unverifiable_token',
+      'no_code_verifier',
+      'pkce_generation_failed',
+      'missing_email',
+      'jwks_fetch_failed',
+      'signature_invalid',
+      'token_expired',
+      'token_not_yet_valid',
+      'invalid_jwt',
+      'unsupported_alg',
+      'no_matching_key',
+      'invalid_issuer',
+      'invalid_audience',
+      'invalid_path',
+      'PGRST116',
+    ]
+    for (const code of knownCodes) {
+      const e = new AuraError(0, { error: { code, message: 'x' } })
+      expect(e.code).toBe(code)
+    }
+  })
+})

package/packages/core/tests/error.test.ts

@@ -0,0 +1,24 @@
+import { describe, it, expect } from 'vitest'
+import { AuraError, isAuraError } from '../src/AuraError'
+
+describe('AuraError / isAuraError', () => {
+  it('reconnaît une vraie instance et expose les helpers', () => {
+    const e = new AuraError(429, { error: { code: 'rate_limited', message: 'slow down' } })
+    expect(isAuraError(e)).toBe(true)
+    expect(e.isRateLimited).toBe(true)
+    expect(e.status).toBe(429)
+  })
+  it('les instances portent le marqueur __isAuraError (détection cross-realm réelle)', () => {
+    // Le correctif : une vraie instance doit exposer le marqueur au runtime,
+    // pour être détectée même quand `instanceof` échoue (autre bundle/realm).
+    expect((new AuraError(500) as unknown as Record<string, unknown>).__isAuraError).toBe(true)
+  })
+  it('reconnaît un objet marqué __isAuraError (cross-realm simulé)', () => {
+    expect(isAuraError({ __isAuraError: true })).toBe(true)
+  })
+  it('rejette un objet quelconque', () => {
+    expect(isAuraError({})).toBe(false)
+    expect(isAuraError(null)).toBe(false)
+    expect(isAuraError(new Error('x'))).toBe(false)
+  })
+})

package/packages/core/tests/fetch.test.ts

@@ -0,0 +1,286 @@
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { fetchWithAuth, type FetchInit } from '../src/fetch'
+import { BaseAuthStore } from '../src/stores/BaseAuthStore'
+import type { AuraClientLike } from '../src/client'
+import type { AuraObservabilityEvent } from '../src/types'
+
+// fetch séquentiel : renvoie les réponses dans l'ordre, compte les appels.
+function seqFetch(
+  responses: Array<{ status: number; body?: unknown; headers?: Record<string, string>; throw?: unknown }>,
+) {
+  const calls: Array<{ url: string; init: RequestInit }> = []
+  let i = 0
+  const fn = async (url: string, init: RequestInit): Promise<Response> => {
+    calls.push({ url, init })
+    const r = responses[Math.min(i, responses.length - 1)]
+    i++
+    if (r.throw) throw r.throw
+    return new Response(r.body !== undefined ? JSON.stringify(r.body) : null, {
+      status: r.status,
+      headers: { 'Content-Type': 'application/json', ...r.headers },
+    })
+  }
+  return { fn, calls }
+}
+
+function makeClient(
+  fetchFn: typeof globalThis.fetch,
+  retryConfig?: { enabled: boolean; maxRetries: number },
+  onEvent?: (e: AuraObservabilityEvent) => void,
+): AuraClientLike {
+  return {
+    baseUrl: 'http://localhost:8080',
+    projectId: 'proj-1',
+    apiKey: 'aura_anon_x',
+    fetchFn,
+    authStore: new BaseAuthStore(),
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    auth: { refreshSession: async () => ({ data: null, error: null }) as any },
+    ...(retryConfig ? { retryConfig } : {}),
+    ...(onEvent ? { onEvent } : {}),
+  }
+}
+
+afterEach(() => vi.useRealTimers())
+
+describe('fetchWithAuth — minor 6b : corps JSON non-objet (null/primitif) sans throw', () => {
+  it('200 avec corps primitif (number) → data = valeur, pas de throw ni perte', async () => {
+    const { fn } = seqFetch([{ status: 200, body: 42 }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const res = await fetchWithAuth<number>('http://x/y', { method: 'GET' }, client)
+    expect(res.error).toBeNull()
+    expect(res.data).toBe(42)
+  })
+
+  it('200 avec corps JSON `null` → data = null, error = null (pas de `in` sur null)', async () => {
+    const { fn } = seqFetch([{ status: 200, body: null }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const res = await fetchWithAuth<unknown>('http://x/y', { method: 'GET' }, client)
+    expect(res.error).toBeNull()
+    expect(res.data).toBeNull()
+  })
+
+  it('200 avec corps tableau (pas d’enveloppe) → data = tableau tel quel', async () => {
+    const { fn } = seqFetch([{ status: 200, body: [1, 2, 3] }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const res = await fetchWithAuth<number[]>('http://x/y', { method: 'GET' }, client)
+    expect(res.error).toBeNull()
+    expect(res.data).toEqual([1, 2, 3])
+  })
+})
+
+describe('fetchWithAuth — retry transitoire', () => {
+  it('GET 503 puis 200 → retry puis succès', async () => {
+    vi.useFakeTimers()
+    const { fn, calls } = seqFetch([{ status: 503 }, { status: 200, body: { ok: true } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const p = fetchWithAuth<{ ok: boolean }>('http://x/y', { method: 'GET' }, client)
+    await vi.advanceTimersByTimeAsync(600)
+    const res = await p
+    expect(res.error).toBeNull()
+    expect(res.data).toEqual({ ok: true })
+    expect(calls.length).toBe(2)
+    expect(calls[1].init.headers).toMatchObject({ 'X-Retry-Count': '1' })
+  })
+
+  it('GET erreur réseau puis 200 → retry puis succès', async () => {
+    vi.useFakeTimers()
+    const { fn, calls } = seqFetch([{ status: 0, throw: new Error('ECONNRESET') }, { status: 200, body: { ok: 1 } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
+    await vi.advanceTimersByTimeAsync(600)
+    const res = await p
+    expect(res.error).toBeNull()
+    expect(calls.length).toBe(2)
+  })
+
+  it('POST 503 → PAS de retry', async () => {
+    const { fn, calls } = seqFetch([{ status: 503, body: { error: { code: 'x', message: 'down' } } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const res = await fetchWithAuth('http://x/y', { method: 'POST', body: { a: 1 } }, client)
+    expect(res.error?.status).toBe(503)
+    expect(calls.length).toBe(1)
+  })
+
+  it('GET 503 en boucle → borné à maxRetries (3) puis erreur', async () => {
+    vi.useFakeTimers()
+    const { fn, calls } = seqFetch([{ status: 503 }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
+    await vi.advanceTimersByTimeAsync(60000)
+    const res = await p
+    expect(res.error?.status).toBe(503)
+    expect(calls.length).toBe(4) // 1 + 3 retries
+  })
+
+  it('Retry-After prioritaire sur le backoff', async () => {
+    vi.useFakeTimers()
+    const { fn, calls } = seqFetch([
+      { status: 503, headers: { 'Retry-After': '2' } },
+      { status: 200, body: { ok: true } },
+    ])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
+    await vi.advanceTimersByTimeAsync(600) // > backoff max (500) mais < 2000
+    expect(calls.length).toBe(1)
+    await vi.advanceTimersByTimeAsync(1500) // total 2100 > 2000
+    await p
+    expect(calls.length).toBe(2)
+  })
+
+  it('AbortError → aucun retry', async () => {
+    const { fn, calls } = seqFetch([
+      { status: 0, throw: Object.assign(new Error('aborted'), { name: 'AbortError' }) },
+    ])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const res = await fetchWithAuth('http://x/y', { method: 'GET' }, client)
+    expect(res.error?.code).toBe('network_error')
+    expect(calls.length).toBe(1)
+  })
+
+  it('retry désactivé (client) → aucun retry sur 503', async () => {
+    const { fn, calls } = seqFetch([{ status: 503, body: {} }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch, { enabled: false, maxRetries: 0 })
+    const res = await fetchWithAuth('http://x/y', { method: 'GET' }, client)
+    expect(res.error?.status).toBe(503)
+    expect(calls.length).toBe(1)
+  })
+
+  it('skipRetry par requête → aucun retry', async () => {
+    const { fn, calls } = seqFetch([{ status: 503, body: {} }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const init: FetchInit = { method: 'GET', skipRetry: true }
+    const res = await fetchWithAuth('http://x/y', init, client)
+    expect(res.error?.status).toBe(503)
+    expect(calls.length).toBe(1)
+  })
+
+  it('LOT 3 (I5) : `{data:null,meta:null}` (enveloppe vide honnête) → res.data === null (pas l’enveloppe)', async () => {
+    const { fn } = seqFetch([{ status: 200, body: { data: null, meta: null } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const res = await fetchWithAuth('http://x/y', { method: 'POST', body: {} }, client)
+    expect(res.error).toBeNull()
+    expect(res.data).toBeNull()
+  })
+
+  it('LOT 3 (I5) : corps SANS clé `data` (legacy non enveloppé) → res.data === le corps entier', async () => {
+    const { fn } = seqFetch([{ status: 200, body: { message: 'ok', extra: 1 } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const res = await fetchWithAuth('http://x/y', { method: 'GET' }, client)
+    expect(res.error).toBeNull()
+    expect(res.data).toEqual({ message: 'ok', extra: 1 })
+  })
+
+  it('corps avec bigint → sérialisé en string', async () => {
+    const { fn, calls } = seqFetch([{ status: 200, body: { ok: true } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    await fetchWithAuth('http://x/y', { method: 'POST', body: { id: 7n } }, client)
+    expect(calls[0].init.body).toBe('{"id":"7"}')
+  })
+
+  it('LOT 3 (I8) : GET 503 puis 200 → onEvent reçoit {kind:"retry", attempt:1, status:503, url}', async () => {
+    vi.useFakeTimers()
+    const events: AuraObservabilityEvent[] = []
+    const { fn } = seqFetch([{ status: 503 }, { status: 200, body: { ok: true } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch, undefined, (e) => events.push(e))
+    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
+    await vi.advanceTimersByTimeAsync(600)
+    await p
+    expect(events).toContainEqual({ kind: 'retry', attempt: 1, status: 503, url: 'http://x/y' })
+  })
+
+  it('LOT 3 (I8) : erreur réseau puis 200 → onEvent reçoit {kind:"retry", attempt:1, url} (sans status)', async () => {
+    vi.useFakeTimers()
+    const events: AuraObservabilityEvent[] = []
+    const { fn } = seqFetch([{ status: 0, throw: new Error('ECONNRESET') }, { status: 200, body: { ok: 1 } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch, undefined, (e) => events.push(e))
+    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
+    await vi.advanceTimersByTimeAsync(600)
+    await p
+    expect(events).toContainEqual({ kind: 'retry', attempt: 1, url: 'http://x/y' })
+  })
+
+  it('LOT 3 (I8) : plusieurs retries → un événement par tentative, attempt croissant', async () => {
+    vi.useFakeTimers()
+    const events: AuraObservabilityEvent[] = []
+    const { fn } = seqFetch([{ status: 503 }, { status: 503 }, { status: 200, body: { ok: true } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch, undefined, (e) => events.push(e))
+    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
+    await vi.advanceTimersByTimeAsync(60000)
+    await p
+    const retries = events.filter((e) => e.kind === 'retry')
+    expect(retries.map((e) => (e as { attempt: number }).attempt)).toEqual([1, 2])
+  })
+
+  it('LOT 3 (I8) : onEvent absent → aucun throw, comportement inchangé', async () => {
+    vi.useFakeTimers()
+    const { fn, calls } = seqFetch([{ status: 503 }, { status: 200, body: { ok: true } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
+    await vi.advanceTimersByTimeAsync(600)
+    const res = await p
+    expect(res.error).toBeNull()
+    expect(calls.length).toBe(2)
+  })
+
+  it('LOT 3 (I8) : un onEvent qui throw ne casse pas la requête', async () => {
+    vi.useFakeTimers()
+    const { fn } = seqFetch([{ status: 503 }, { status: 200, body: { ok: true } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch, undefined, () => {
+      throw new Error('consumer onEvent boom')
+    })
+    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
+    await vi.advanceTimersByTimeAsync(600)
+    const res = await p
+    expect(res.error).toBeNull()
+    expect(res.data).toEqual({ ok: true })
+  })
+
+  it('LOT D : authToken override gagne sur store.token (Authorization = Bearer authToken)', async () => {
+    const { fn, calls } = seqFetch([{ status: 200, body: { ok: true } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    client.authStore.save('store-token', 'refresh', { id: 'u_store' } as any)
+    const init: FetchInit = { method: 'GET', authToken: 'foreign-token', skipAuthRefresh: true }
+    await fetchWithAuth('http://x/y', init, client)
+    const headers = calls[0].init.headers as Record<string, string>
+    expect(headers['Authorization']).toBe('Bearer foreign-token')
+    // apikey toujours envoyé (parité Supabase), inchangé.
+    expect(headers['apikey']).toBe('aura_anon_x')
+  })
+
+  it('LOT D : sans authToken → store.token (comportement inchangé)', async () => {
+    const { fn, calls } = seqFetch([{ status: 200, body: { ok: true } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    client.authStore.save('store-token', 'refresh', { id: 'u_store' } as any)
+    const init: FetchInit = { method: 'GET', skipAuthRefresh: true }
+    await fetchWithAuth('http://x/y', init, client)
+    const headers = calls[0].init.headers as Record<string, string>
+    expect(headers['Authorization']).toBe('Bearer store-token')
+  })
+
+  it('LOT D : authToken sans session (store vide) → Authorization = Bearer authToken', async () => {
+    const { fn, calls } = seqFetch([{ status: 200, body: { ok: true } }])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const init: FetchInit = { method: 'GET', authToken: 'foreign-token', skipAuthRefresh: true }
+    await fetchWithAuth('http://x/y', init, client)
+    const headers = calls[0].init.headers as Record<string, string>
+    expect(headers['Authorization']).toBe('Bearer foreign-token')
+  })
+
+  it('Retry-After énorme (86400) est plafonné à 60000ms', async () => {
+    vi.useFakeTimers()
+    const { fn, calls } = seqFetch([
+      { status: 503, headers: { 'Retry-After': '86400' } },
+      { status: 200, body: { ok: true } },
+    ])
+    const client = makeClient(fn as unknown as typeof globalThis.fetch)
+    const p = fetchWithAuth('http://x/y', { method: 'GET' }, client)
+    await vi.advanceTimersByTimeAsync(59_999)
+    expect(calls.length).toBe(1) // pas encore rejoué
+    await vi.advanceTimersByTimeAsync(1) // total 60000 → plafond atteint
+    await p
+    expect(calls.length).toBe(2)
+  })
+})