@aurabase/aurabase-js 0.3.0

package/packages/core/tests/mocks.ts

@@ -0,0 +1,139 @@
+// ---------------------------------------------------------------------------
+// FetchMock -- intercepts globalThis.fetch for deterministic SDK tests
+// ---------------------------------------------------------------------------
+
+export interface RequestMock {
+  method: string
+  url: string | RegExp
+  replyCode: number
+  replyBody?: unknown
+  replyHeaders?: Record<string, string>
+}
+
+export interface FetchCall {
+  url: string
+  method: string
+  headers: Headers
+  body?: unknown
+}
+
+export class FetchMock {
+  private originalFetch?: typeof fetch
+  private mocks: RequestMock[] = []
+  calls: FetchCall[] = []
+
+  /** Register a mock response. */
+  on(mock: RequestMock): void {
+    this.mocks.push(mock)
+  }
+
+  /** Replace globalThis.fetch with the mock implementation. */
+  init(): void {
+    this.originalFetch = globalThis.fetch
+    globalThis.fetch = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      const url = typeof input === 'string' ? input : input.toString()
+      const method = (init?.method ?? 'GET').toUpperCase()
+      const headers = new Headers(init?.headers)
+      let body: unknown
+      if (typeof init?.body === 'string') {
+        try {
+          body = JSON.parse(init.body)
+        } catch {
+          body = init.body
+        }
+      } else {
+        body = init?.body
+      }
+      this.calls.push({ url, method, headers, body })
+
+      for (const mock of this.mocks) {
+        const urlMatch =
+          mock.url instanceof RegExp ? mock.url.test(url) : mock.url === url
+        if (urlMatch && mock.method.toUpperCase() === method) {
+          return new Response(
+            mock.replyBody !== undefined ? JSON.stringify(mock.replyBody) : null,
+            {
+              status: mock.replyCode,
+              headers: {
+                'Content-Type': 'application/json',
+                ...mock.replyHeaders,
+              },
+            },
+          )
+        }
+      }
+
+      throw new Error(`FetchMock: no mock for ${method} ${url}`)
+    }
+  }
+
+  /** Restore the original globalThis.fetch. */
+  restore(): void {
+    if (this.originalFetch) {
+      globalThis.fetch = this.originalFetch
+    }
+  }
+
+  /** Remove all registered mocks. */
+  clearMocks(): void {
+    this.mocks = []
+    this.calls = []
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Helpers -- reusable test data factories
+// ---------------------------------------------------------------------------
+
+import type { User, TokenPair } from '../src/types'
+
+/** Build a fake JWT whose payload encodes the given exp (seconds since epoch). */
+export function fakeJwt(exp: number): string {
+  const header = btoa(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '')
+  const payload = btoa(JSON.stringify({ sub: 'user-1', exp }))
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '')
+  const sig = 'fake_sig'
+  return `${header}.${payload}.${sig}`
+}
+
+/** A JWT that expires far in the future. */
+export function validJwt(): string {
+  return fakeJwt(Math.floor(Date.now() / 1000) + 3600)
+}
+
+/** A JWT that is already expired. */
+export function expiredJwt(): string {
+  return fakeJwt(Math.floor(Date.now() / 1000) - 60)
+}
+
+export function fakeUser(overrides: Partial<User> = {}): User {
+  return {
+    id: 'user-1',
+    email: 'test@example.com',
+    role: 'authenticated',
+    email_verified: true,
+    is_banned: false,
+    is_anonymous: false,
+    mfa_enabled: false,
+    user_metadata: {},
+    app_metadata: {},
+    created_at: '2025-01-01T00:00:00Z',
+    ...overrides,
+  }
+}
+
+export function fakeTokenPair(overrides: Partial<TokenPair> = {}): TokenPair {
+  return {
+    access_token: validJwt(),
+    refresh_token: 'rt_fake_refresh',
+    token_type: 'bearer',
+    expires_in: 3600,
+    user: fakeUser(),
+    ...overrides,
+  }
+}

package/packages/core/tests/observability.test.ts

@@ -0,0 +1,86 @@
+// ---------------------------------------------------------------------------
+// emitAuraEvent (LOT 3, finding I8) -- observability hook helper
+// ---------------------------------------------------------------------------
+
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { emitAuraEvent, type AuraObservabilityEvent } from '../src/types'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe('emitAuraEvent', () => {
+  it('appelle onEvent avec l’événement tel quel', () => {
+    const received: AuraObservabilityEvent[] = []
+    const event: AuraObservabilityEvent = { kind: 'timeout', url: 'http://x/y' }
+    emitAuraEvent((e) => received.push(e), false, event)
+    expect(received).toEqual([event])
+  })
+
+  it('ne fait rien si onEvent est undefined (pas de throw)', () => {
+    expect(() => emitAuraEvent(undefined, false, { kind: 'refresh-success' })).not.toThrow()
+  })
+
+  it('NE THROW JAMAIS si le hook onEvent lève une exception', () => {
+    const boom = () => {
+      throw new Error('consumer hook boom')
+    }
+    expect(() =>
+      emitAuraEvent(boom, false, { kind: 'refresh-discarded', reason: 'test' }),
+    ).not.toThrow()
+  })
+
+  it('debug:true journalise via console.debug en plus du hook', () => {
+    const spy = vi.spyOn(console, 'debug').mockImplementation(() => {})
+    const received: AuraObservabilityEvent[] = []
+    const event: AuraObservabilityEvent = { kind: 'jwks-fetch-failed', baseUrl: 'http://x' }
+    emitAuraEvent((e) => received.push(e), true, event)
+    expect(spy).toHaveBeenCalledWith('[aurabase]', event)
+    expect(received).toEqual([event])
+  })
+
+  it('debug:true SANS onEvent journalise quand même via console.debug', () => {
+    const spy = vi.spyOn(console, 'debug').mockImplementation(() => {})
+    emitAuraEvent(undefined, true, { kind: 'storage-blocked', op: 'setItem' })
+    expect(spy).toHaveBeenCalledTimes(1)
+  })
+
+  it('debug:false (ou omis) ne journalise pas', () => {
+    const spy = vi.spyOn(console, 'debug').mockImplementation(() => {})
+    emitAuraEvent(() => {}, false, { kind: 'refresh-success' })
+    expect(spy).not.toHaveBeenCalled()
+  })
+
+  it('minor 6a : RÉDIGE la query/fragment de `url` (retry/timeout) — pas de fuite de capacité bearer', () => {
+    const received: AuraObservabilityEvent[] = []
+    emitAuraEvent((e) => received.push(e), false, {
+      kind: 'retry',
+      attempt: 1,
+      url: 'https://api.host/v1/db/proj/rest/posts?apikey=aura_sk_secret&token=abc#frag',
+    })
+    const got = received[0] as { kind: string; url: string }
+    expect(got.url).toBe('https://api.host/v1/db/proj/rest/posts')
+    expect(got.url).not.toContain('apikey')
+    expect(got.url).not.toContain('token')
+    expect(got.url).not.toContain('#')
+  })
+
+  it('minor 6a : `url` sans query est inchangée ; `baseUrl` (jwks) jamais touché', () => {
+    const received: AuraObservabilityEvent[] = []
+    emitAuraEvent((e) => received.push(e), false, { kind: 'timeout', url: 'http://x/y' })
+    emitAuraEvent((e) => received.push(e), false, { kind: 'jwks-fetch-failed', baseUrl: 'http://x' })
+    expect((received[0] as { url: string }).url).toBe('http://x/y')
+    expect((received[1] as { baseUrl: string }).baseUrl).toBe('http://x')
+  })
+
+  it('une exception dans console.debug ne casse pas non plus l’émission', () => {
+    vi.spyOn(console, 'debug').mockImplementation(() => {
+      throw new Error('console boom')
+    })
+    const received: AuraObservabilityEvent[] = []
+    expect(() =>
+      emitAuraEvent((e) => received.push(e), true, { kind: 'refresh-success' }),
+    ).not.toThrow()
+    expect(received).toHaveLength(1)
+  })
+})

package/packages/core/tests/refresh-hardening.test.ts

@@ -0,0 +1,164 @@
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { refreshOnce } from '../src/fetch'
+import { BaseAuthStore } from '../src/stores/BaseAuthStore'
+import type { AuraClientLike } from '../src/client'
+import { fakeTokenPair, fakeUser, validJwt } from './mocks'
+
+afterEach(() => vi.useRealTimers())
+
+function client(fetchFn: typeof globalThis.fetch, store = new BaseAuthStore()): AuraClientLike {
+  store.save(validJwt(), 'rt_current', fakeUser())
+  return {
+    baseUrl: 'http://x',
+    projectId: 'p',
+    apiKey: 'k',
+    fetchFn,
+    authStore: store,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    auth: { refreshSession: async () => ({ data: null, error: null }) as any },
+  }
+}
+
+describe('BaseAuthStore.removalEpoch', () => {
+  it('incrémente à chaque clear()', () => {
+    const s = new BaseAuthStore()
+    expect(s.removalEpoch).toBe(0)
+    s.clear()
+    expect(s.removalEpoch).toBe(1)
+    s.clear()
+    expect(s.removalEpoch).toBe(2)
+  })
+})
+
+describe('commit-guard : refresh jeté si clear() concurrent', () => {
+  it('ne sauvegarde pas les tokens si la session a été vidée pendant le refresh', async () => {
+    const store = new BaseAuthStore()
+    let resolveFetch: (r: Response) => void
+    const fetchFn = vi.fn().mockImplementation(
+      () => new Promise<Response>((res) => { resolveFetch = res }),
+    )
+    const c = client(fetchFn as unknown as typeof globalThis.fetch, store)
+    const p = refreshOnce(c)
+    store.clear() // un signOut arrive pendant l'await du fetch
+    resolveFetch!(
+      new Response(JSON.stringify(fakeTokenPair({ refresh_token: 'rt_new' })), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    )
+    const res = await p
+    expect(res.error?.status).toBe(409)
+    expect(res.error?.code).toBe('refresh_discarded')
+    expect(store.token).toBeNull() // pas ressuscité
+  })
+})
+
+describe('proactive-preserve + commit-guard (sans cooldown)', () => {
+  it('échec transitoire (5xx) préserve la session ET ne cache PAS (2e refresh re-tape le réseau)', async () => {
+    const store = new BaseAuthStore()
+    store.save(validJwt(), 'rt_stable', fakeUser())
+    const fetchFn = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ error: { code: 'server_error', message: 'boom' } }), {
+        status: 500,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    )
+    const c = {
+      baseUrl: 'http://x', projectId: 'p', apiKey: 'k',
+      fetchFn: fetchFn as unknown as typeof globalThis.fetch, authStore: store,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      auth: { refreshSession: async () => ({ data: null, error: null }) as any },
+    } as AuraClientLike
+    const r1 = await refreshOnce(c)
+    expect(r1.error).toBeTruthy()
+    expect(store.token).not.toBeNull() // 5xx transitoire → session PRÉSERVÉE
+    const r2 = await refreshOnce(c)
+    expect(r2.error).toBeTruthy()
+    expect(fetchFn).toHaveBeenCalledTimes(2) // PAS de cooldown → 2e re-tape le réseau
+  })
+
+  it('FIX1 succès : un signIn concurrent (rt différent) n’est PAS écrasé par le refresh de l’ancien token', async () => {
+    const store = new BaseAuthStore()
+    store.save(validJwt(), 'rt_old', fakeUser())
+    let resolveFetch!: (r: Response) => void
+    const fetchFn = vi.fn().mockImplementation(() => new Promise<Response>((res) => { resolveFetch = res }))
+    const c = {
+      baseUrl: 'http://x', projectId: 'p', apiKey: 'k',
+      fetchFn: fetchFn as unknown as typeof globalThis.fetch, authStore: store,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      auth: { refreshSession: async () => ({ data: null, error: null }) as any },
+    } as AuraClientLike
+    const p = refreshOnce(c)
+    store.save(validJwt(), 'rt_new', fakeUser()) // signIn concurrent
+    resolveFetch(new Response(JSON.stringify(fakeTokenPair({ refresh_token: 'rt_rotated' })), {
+      status: 200, headers: { 'Content-Type': 'application/json' },
+    }))
+    const r = await p
+    expect(r.error?.code).toBe('refresh_discarded')
+    expect(store.refreshToken).toBe('rt_new') // session neuve PRÉSERVÉE
+  })
+
+  it('FIX1 échec : un signIn concurrent n’est PAS effacé par un 401 sur l’ancien token', async () => {
+    const store = new BaseAuthStore()
+    store.save(validJwt(), 'rt_old', fakeUser())
+    let resolveFetch!: (r: Response) => void
+    const fetchFn = vi.fn().mockImplementation(() => new Promise<Response>((res) => { resolveFetch = res }))
+    const c = {
+      baseUrl: 'http://x', projectId: 'p', apiKey: 'k',
+      fetchFn: fetchFn as unknown as typeof globalThis.fetch, authStore: store,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      auth: { refreshSession: async () => ({ data: null, error: null }) as any },
+    } as AuraClientLike
+    const p = refreshOnce(c)
+    store.save(validJwt(), 'rt_new', fakeUser()) // signIn concurrent
+    resolveFetch(new Response(JSON.stringify({ error: { code: 'invalid_grant', message: 'revoked' } }), {
+      status: 401, headers: { 'Content-Type': 'application/json' },
+    }))
+    await p
+    expect(store.token).not.toBeNull() // NON effacée
+    expect(store.refreshToken).toBe('rt_new') // session neuve intacte
+  })
+
+  it('rejet définitif (401) → session détruite', async () => {
+    const store = new BaseAuthStore()
+    store.save(validJwt(), 'rt_x', fakeUser())
+    const fetchFn = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ error: { code: 'invalid_grant', message: 'revoked' } }), {
+        status: 401,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    )
+    const c = {
+      baseUrl: 'http://x',
+      projectId: 'p',
+      apiKey: 'k',
+      fetchFn: fetchFn as unknown as typeof globalThis.fetch,
+      authStore: store,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      auth: { refreshSession: async () => ({ data: null, error: null }) as any },
+    } as AuraClientLike
+    const r = await refreshOnce(c)
+    expect(r.error?.status).toBe(401)
+    expect(store.token).toBeNull() // session morte
+  })
+})
+
+describe('FIX4 : corps de succès non-JSON', () => {
+  it('un 200 au corps non-JSON renvoie invalid_response (pas de throw) et préserve la session', async () => {
+    const store = new BaseAuthStore()
+    const fetchFn = vi.fn().mockResolvedValue(
+      // 200 OK mais corps HTML (proxy mal configuré) → res.json() throw.
+      new Response('<html>Service Unavailable</html>', {
+        status: 200,
+        headers: { 'Content-Type': 'text/html' },
+      }),
+    )
+    const c = client(fetchFn as unknown as typeof globalThis.fetch, store)
+    // Ne doit PAS rejeter : refreshOnce renvoie toujours un AuraResponse.
+    const r = await refreshOnce(c)
+    expect(r.data).toBeNull()
+    expect(r.error?.code).toBe('invalid_response')
+    // Un succès illisible n'est pas un rejet définitif → session préservée.
+    expect(store.token).not.toBeNull()
+  })
+})

package/packages/core/tests/refresh-observability.test.ts

@@ -0,0 +1,111 @@
+// ---------------------------------------------------------------------------
+// Observabilité du refresh (LOT 3, finding I8) : refresh-success / refresh-discarded
+// ---------------------------------------------------------------------------
+//
+// NOTE : n'utilise PAS le pattern `resolveFetch` manuel de `refresh-hardening.test.ts`
+// (pré-existant, flaky indépendamment de ce lot — cf. Web Locks LOT 2). On s'appuie
+// à la place sur `mockResolvedValue` (le fetch est déjà résolu, mais `await` cède
+// quand même la main le temps d'un microtask), ce qui suffit à ouvrir la fenêtre de
+// course nécessaire au test `refresh-discarded` sans dépendre d'un timing fragile.
+
+import { describe, it, expect, afterEach, vi } from 'vitest'
+import { refreshOnce } from '../src/fetch'
+import { BaseAuthStore } from '../src/stores/BaseAuthStore'
+import type { AuraClientLike } from '../src/client'
+import { fakeTokenPair, fakeUser, validJwt } from './mocks'
+import type { AuraObservabilityEvent } from '../src/types'
+
+afterEach(() => vi.useRealTimers())
+
+function client(
+  fetchFn: typeof globalThis.fetch,
+  onEvent: (e: AuraObservabilityEvent) => void,
+  store = new BaseAuthStore(),
+): AuraClientLike {
+  store.save(validJwt(), 'rt_current', fakeUser())
+  return {
+    baseUrl: 'http://x',
+    projectId: 'p',
+    apiKey: 'k',
+    fetchFn,
+    authStore: store,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    auth: { refreshSession: async () => ({ data: null, error: null }) as any },
+    onEvent,
+  }
+}
+
+describe('refreshOnce — observabilité (onEvent)', () => {
+  it('émet {kind:"refresh-success"} quand le refresh aboutit', async () => {
+    const events: AuraObservabilityEvent[] = []
+    const fetchFn = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify(fakeTokenPair({ refresh_token: 'rt_new' })), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    )
+    const store = new BaseAuthStore()
+    const c = client(fetchFn as unknown as typeof globalThis.fetch, (e) => events.push(e), store)
+    // rt_current doit correspondre au refresh_token utilisé par doRefresh (posé par client()).
+    const res = await refreshOnce(c)
+    expect(res.error).toBeNull()
+    expect(events).toContainEqual({ kind: 'refresh-success' })
+  })
+
+  it('émet {kind:"refresh-discarded", reason} quand la session change pendant le refresh (commit-guard)', async () => {
+    const events: AuraObservabilityEvent[] = []
+    const store = new BaseAuthStore()
+    let resolveFetch!: (r: Response) => void
+    const fetchFn = vi.fn().mockImplementation(
+      () => new Promise<Response>((res) => { resolveFetch = res }),
+    )
+    const c = client(fetchFn as unknown as typeof globalThis.fetch, (e) => events.push(e), store)
+    const p = refreshOnce(c)
+    // NOTE (à jour) : `withRefreshLock` est GATÉ sur `window` — hors navigateur (ces
+    // tests s'exécutent sous Node SANS `window`), `navigator.locks` n'est PAS utilisé
+    // même s'il existe (Node ≥21) ; `doRefresh` s'exécute donc directement (single-flight
+    // in-process seul). On garde néanmoins `waitFor` (robuste au timing des microtasks)
+    // pour laisser `doRefresh` atteindre `await client.fetchFn(...)` (donc `resolveFetch`
+    // assigné) avant d'intercaler le `clear()` concurrent.
+    await vi.waitFor(() => expect(fetchFn).toHaveBeenCalled(), { timeout: 2000, interval: 5 })
+    store.clear() // un signOut concurrent s'intercale avant la résolution du fetch
+    resolveFetch(
+      new Response(JSON.stringify(fakeTokenPair({ refresh_token: 'rt_new_from_server' })), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    )
+    const res = await p
+    expect(res.error?.code).toBe('refresh_discarded')
+    const discarded = events.find((e) => e.kind === 'refresh-discarded')
+    expect(discarded).toBeDefined()
+    expect((discarded as { kind: 'refresh-discarded'; reason: string }).reason).toEqual(
+      expect.any(String),
+    )
+    // Pas de refresh-success émis dans ce scénario.
+    expect(events.some((e) => e.kind === 'refresh-success')).toBe(false)
+  })
+
+  it('onEvent absent (undefined) : aucun throw, comportement inchangé', async () => {
+    const fetchFn = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify(fakeTokenPair({ refresh_token: 'rt_new' })), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    )
+    const store = new BaseAuthStore()
+    store.save(validJwt(), 'rt_current', fakeUser())
+    const c: AuraClientLike = {
+      baseUrl: 'http://x',
+      projectId: 'p',
+      apiKey: 'k',
+      fetchFn: fetchFn as unknown as typeof globalThis.fetch,
+      authStore: store,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      auth: { refreshSession: async () => ({ data: null, error: null }) as any },
+      // onEvent volontairement omis
+    }
+    const res = await refreshOnce(c)
+    expect(res.error).toBeNull()
+  })
+})

package/packages/core/tests/retry.test.ts

@@ -0,0 +1,106 @@
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import {
+  isRetryableStatus,
+  isRetryableMethod,
+  computeBackoff,
+  parseRetryAfter,
+  abortableSleep,
+  isAbortError,
+  DEFAULT_MAX_RETRIES,
+} from '../src/retry'
+
+describe('retry — prédicats', () => {
+  it('isRetryableStatus', () => {
+    for (const s of [408, 429, 502, 503, 504]) expect(isRetryableStatus(s)).toBe(true)
+    for (const s of [200, 400, 401, 404, 500, 501]) expect(isRetryableStatus(s)).toBe(false)
+  })
+  it('isRetryableMethod (insensible à la casse)', () => {
+    for (const m of ['GET', 'get', 'HEAD', 'head']) expect(isRetryableMethod(m)).toBe(true)
+    for (const m of ['POST', 'PATCH', 'DELETE', 'PUT']) expect(isRetryableMethod(m)).toBe(false)
+  })
+  it('DEFAULT_MAX_RETRIES vaut 3', () => {
+    expect(DEFAULT_MAX_RETRIES).toBe(3)
+  })
+})
+
+describe('computeBackoff — full jitter', () => {
+  it('borne = min(500·2^attempt, 10000)', () => {
+    expect(computeBackoff(0, () => 1)).toBe(500)
+    expect(computeBackoff(1, () => 1)).toBe(1000)
+    expect(computeBackoff(2, () => 1)).toBe(2000)
+    expect(computeBackoff(10, () => 1)).toBe(10000) // plafonné
+  })
+  it('rand=0 → 0', () => {
+    expect(computeBackoff(3, () => 0)).toBe(0)
+  })
+  it('valeur ∈ [0, borne]', () => {
+    const v = computeBackoff(2, () => 0.5)
+    expect(v).toBeGreaterThanOrEqual(0)
+    expect(v).toBeLessThanOrEqual(2000)
+  })
+})
+
+describe('parseRetryAfter', () => {
+  it('secondes → ms', () => {
+    expect(parseRetryAfter('5')).toBe(5000)
+    expect(parseRetryAfter('0')).toBe(0)
+  })
+  it('HTTP-date → delta ms (now injecté)', () => {
+    const now = 1_000_000_000_000
+    const future = new Date(now + 3000).toUTCString()
+    expect(parseRetryAfter(future, now)).toBe(3000)
+  })
+  it('date passée → 0 (jamais négatif)', () => {
+    const now = 1_000_000_000_000
+    const past = new Date(now - 5000).toUTCString()
+    expect(parseRetryAfter(past, now)).toBe(0)
+  })
+  it('null ou garbage → null', () => {
+    expect(parseRetryAfter(null)).toBeNull()
+    expect(parseRetryAfter('not-a-date')).toBeNull()
+  })
+})
+
+describe('abortableSleep', () => {
+  afterEach(() => vi.useRealTimers())
+  it('résout après le délai', async () => {
+    vi.useFakeTimers()
+    let done = false
+    const p = abortableSleep(1000).then(() => {
+      done = true
+    })
+    await vi.advanceTimersByTimeAsync(999)
+    expect(done).toBe(false)
+    await vi.advanceTimersByTimeAsync(1)
+    await p
+    expect(done).toBe(true)
+  })
+  it('signal déjà aborté → résout immédiatement', async () => {
+    const ac = new AbortController()
+    ac.abort()
+    await expect(abortableSleep(100000, ac.signal)).resolves.toBeUndefined()
+  })
+  it('abort pendant l’attente → résout tôt (sans rejeter)', async () => {
+    vi.useFakeTimers()
+    const ac = new AbortController()
+    let done = false
+    const p = abortableSleep(100000, ac.signal).then(() => {
+      done = true
+    })
+    ac.abort()
+    await p
+    expect(done).toBe(true)
+  })
+})
+
+describe('isAbortError', () => {
+  it('reconnaît AbortError', () => {
+    expect(isAbortError({ name: 'AbortError' })).toBe(true)
+    expect(isAbortError(new DOMException('x', 'AbortError'))).toBe(true)
+  })
+  it('rejette le reste', () => {
+    expect(isAbortError(new Error('boom'))).toBe(false)
+    expect(isAbortError(null)).toBe(false)
+    expect(isAbortError('AbortError')).toBe(false)
+  })
+})

package/packages/core/tests/serialize.test.ts

@@ -0,0 +1,12 @@
+import { describe, it, expect } from 'vitest'
+import { serializeBody } from '../src/serialize'
+
+describe('serializeBody', () => {
+  it('sérialise un objet normal', () => {
+    expect(serializeBody({ a: 1, b: 'x' })).toBe('{"a":1,"b":"x"}')
+  })
+  it('convertit les bigint en string (pas de TypeError)', () => {
+    expect(serializeBody({ id: 10n })).toBe('{"id":"10"}')
+    expect(serializeBody({ big: 9007199254740993n })).toBe('{"big":"9007199254740993"}')
+  })
+})