@aurabase/aurabase-js 0.6.1 → 0.7.0

package/README.md

@@ -2,25 +2,33 @@
 
 Client JavaScript/TypeScript officiel pour [Aurabase](https://aurabase.cloud) : la plateforme Backend-as-a-Service open-source haute performance propulsée par Rust.
 
-[![npm version](https://img.shields.io/npm/v/@aurabase/aurabase-js)](https://www.npmjs.com/package/@aurabase/aurabase-js) [![license](https://img.shields.io/badge/license-MIT-blue)](https://github.com/daylami555/aurabase/blob/main/LICENSE)
+[![npm version](https://img.shields.io/npm/v/@aurabase/aurabase-js)](https://www.npmjs.com/package/@aurabase/aurabase-js) [![license](https://img.shields.io/badge/license-MIT-blue)](https://github.com/Aurabase-cloud/Aurabase/blob/main/LICENSE)
 
 🌐 **Site officiel** : [https://aurabase.cloud](https://aurabase.cloud)  
 📖 **Documentation** : [https://aurabase.cloud/docs](https://aurabase.cloud)  
-🐙 **GitHub** : [daylami555/aurabase](https://github.com/daylami555/aurabase)
+🐙 **GitHub** : [Aurabase-cloud/Aurabase](https://github.com/Aurabase-cloud/Aurabase)
 
 ## Installation
 
 ```bash
 npm i @aurabase/aurabase-js
+# ou
+pnpm add @aurabase/aurabase-js
+yarn add @aurabase/aurabase-js
+bun add @aurabase/aurabase-js
 ```
 
+> **Attention au nom.** Le paquet officiel est `@aurabase/aurabase-js` (avec la portée `@aurabase/`). Le paquet `aurabase-js` sans portée n'est **pas** maintenu par Aurabase : ne l'installez pas.
+
 ## Rôle
 
 Ce package ne réimplémente aucune logique de service : il compose `AuthService`, `DatabaseService`, `StorageService`, `RealtimeService`, `FunctionsService`, `AiService` et `NotificationsService` (chacun dans son propre package `@aurabase/*`) derrière un seul client.
 
 - `createClient(projectUrl, apiKey, options?)` — client applicatif standard. **L'URL est le projet** : chaque projet est servi sur son propre sous-domaine (`https://<slug>.aurabase.cloud`) et la passerelle injecte elle-même le `project_id` dans le chemin. Aucun identifiant de projet dans le code client.
-- `createAdminClient(projectUrl, serviceRoleKey, options?)` — client serveur avec `authAdmin` (clé `service_role`, jamais côté navigateur).
-- `@aurabase/aurabase-js/ssr` — `createServerClient`/`createBrowserClient` pour Next.js et frameworks SSR (cookies, session partagée serveur/navigateur).
+- `createAdminClient(projectUrl, serviceRoleKey, options?)` — client serveur avec `authAdmin` (clé `service_role`, jamais côté navigateur : gestion des utilisateurs, impersonation RFC 8693, import d'utilisateurs bcrypt/Argon2id).
+- `@aurabase/aurabase-js/ssr` — `createServerClient`/`createBrowserClient` pour Next.js et frameworks SSR (cookies légers, session partagée serveur/navigateur).
+- `@aurabase/aurabase-js/react` — Hooks React (`useAuraSession`, `useAuraUser`) et contexte pour applications React / Next.js Client Components.
+- `@aurabase/aurabase-js/nextjs` — Helpers pour Next.js App Router (Middleware de rafraîchissement de session, Server Actions).
 
 ## Quick Start
 
@@ -33,7 +41,7 @@ const { data, error } = await aura.db
   .from('posts')
   .select('id,title,published')
   .eq('published', true)
-  .order('created_at', 'desc')
+  .order('created_at', { ascending: false })
   .limit(10)
 
 if (error) {

package/dist/{AuraClient-BWdcX_k0.d.cts → AuraClient-B1OOZCSX.d.cts}

@@ -65,6 +65,7 @@ declare class AuraClient<Database = any, Schema extends GenericSchema = Database
     private readonly _persistSession;
     private readonly _autoRefresh;
     private readonly _detectSessionInUrl;
+    private readonly _flowType;
     /**
      * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
      * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).

package/dist/{AuraClient-BWdcX_k0.d.ts → AuraClient-B1OOZCSX.d.ts}

@@ -65,6 +65,7 @@ declare class AuraClient<Database = any, Schema extends GenericSchema = Database
     private readonly _persistSession;
     private readonly _autoRefresh;
     private readonly _detectSessionInUrl;
+    private readonly _flowType;
     /**
      * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
      * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).

package/dist/index.cjs

@@ -56,11 +56,27 @@ var AuraClient = class {
   _persistSession;
   _autoRefresh;
   _detectSessionInUrl;
+  _flowType;
   /**
    * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
    * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).
    */
   constructor(baseUrl, apiKey, options) {
+    if (typeof baseUrl !== "string" || baseUrl.trim() === "") {
+      throw new Error(
+        "[aurabase] Project URL is required: set NEXT_PUBLIC_AURABASE_URL to the project URL shown in Studio \u203A Settings \u203A Connection (e.g. http://<slug>.localhost:8080), then pass it to createClient(url, key)."
+      );
+    }
+    if (!/^https?:\/\//i.test(baseUrl.trim())) {
+      throw new Error(
+        `[aurabase] baseUrl must start with http:// or https:// (got "${baseUrl}"): copy the project URL from Studio \u203A Settings \u203A Connection (e.g. http://<slug>.localhost:8080).`
+      );
+    }
+    if (apiKey === void 0 || apiKey === null) {
+      throw new Error(
+        "[aurabase] API key is required: set NEXT_PUBLIC_AURABASE_ANON_KEY (browser) or AURABASE_SERVICE_ROLE_KEY (server only) to a key shown in Studio \u203A Settings \u203A Connection, then pass it to createClient(url, key)."
+      );
+    }
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     const resolvedOptions = options;
     this.apiKey = apiKey || null;
@@ -72,17 +88,18 @@ var AuraClient = class {
     this.debug = resolvedOptions?.debug;
     if (!this.apiKey && typeof console !== "undefined") {
       console.warn(
-        "[aurabase] No API key provided. Most operations require an API key (apikey header). Only public auth routes (register, login, refresh) will work without one."
+        // AUTH-041 — la passerelle refuse TOUTE requête sans clé (401), y compris register/login.
+        "[aurabase] No API key provided: every request will be refused (401). Pass the anon key shown in Studio \u203A Settings \u203A Connection."
       );
     }
     if (typeof console !== "undefined" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(this.baseUrl)) {
       console.warn(
-        "[aurabase] Attention : en local, l'URL du projet doit inclure le sous-domaine (ex: http://<slug>.localhost:8080) pour permettre la r\xE9solution automatique du projet par la passerelle."
+        "[aurabase] Warning: locally, the project URL must include the sub-domain (e.g. http://<slug>.localhost:8080) so that the gateway can resolve the project automatically."
       );
     }
     if (this.apiKey?.startsWith(SERVICE_ROLE_KEY_PREFIX) && isBrowserContext()) {
       const refuse = resolvedOptions?.refuseServiceRoleInBrowser ?? true;
-      const message = "[aurabase] S\xC9CURIT\xC9 : une cl\xE9 service_role (aura_sk_\u2026) est fournie \xE0 createClient() dans un contexte navigateur. Cette cl\xE9 \xE0 privil\xE8ges \xE9lev\xE9s NE DOIT JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez une cl\xE9 anon (aura_anon_\u2026) c\xF4t\xE9 client, et createAdminClient() c\xF4t\xE9 serveur pour les op\xE9rations d'administration.";
+      const message = "[aurabase] SECURITY: a service_role key (aura_sk_\u2026) is passed to createClient() in a browser context. This high-privilege key MUST NEVER be exposed client-side (it would leak into the bundle). Use an anon key (aura_anon_\u2026) on the client, and createAdminClient() on the server for administration operations.";
       if (refuse) {
         throw new Error(message);
       } else if (typeof console !== "undefined") {
@@ -107,6 +124,7 @@ var AuraClient = class {
     this._persistSession = resolvedOptions?.auth?.persistSession !== false;
     this._autoRefresh = resolvedOptions?.auth?.autoRefresh ?? true;
     this._detectSessionInUrl = resolvedOptions?.auth?.detectSessionInUrl;
+    this._flowType = resolvedOptions?.auth?.flowType;
     if (this._autoRefresh && this._persistSession && typeof window !== "undefined") {
       void this.auth;
     }
@@ -131,7 +149,8 @@ var AuraClient = class {
       this._auth = new auth.AuthService(this, {
         autoRefresh: this._autoRefresh,
         persistSession: this._persistSession,
-        detectSessionInUrl: this._detectSessionInUrl
+        detectSessionInUrl: this._detectSessionInUrl,
+        flowType: this._flowType
       });
       this._auth.onAuthStateChange(({ event, accessToken }) => {
         if (this._realtime) {
@@ -152,7 +171,7 @@ var AuraClient = class {
   get authAdmin() {
     if (isBrowserContext()) {
       throw new Error(
-        "[aurabase] S\xC9CURIT\xC9 : authAdmin est inaccessible dans un contexte navigateur. L'API admin requiert une cl\xE9 service_role qui ne doit JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez createAdminClient() c\xF4t\xE9 serveur uniquement."
+        "[aurabase] SECURITY: authAdmin is not available in a browser context. The admin API requires a service_role key, which must NEVER be exposed client-side (it would leak into the bundle). Use createAdminClient() on the server only."
       );
     }
     if (!this._authAdmin) this._authAdmin = new auth.AuthAdminService(this);
@@ -255,7 +274,7 @@ function createClient(baseUrl, apiKey, options) {
 function createAdminClient(baseUrl, serviceRoleKey, options) {
   if (isBrowserContext()) {
     throw new Error(
-      "[aurabase] createAdminClient() ne doit jamais \xEAtre appel\xE9 c\xF4t\xE9 navigateur : la cl\xE9 service_role serait expos\xE9e dans le bundle. \xC0 utiliser uniquement c\xF4t\xE9 serveur."
+      "[aurabase] createAdminClient() must never be called in a browser: the service_role key would be exposed in the bundle. Use it on the server only."
     );
   }
   return new AuraClient(baseUrl, serviceRoleKey, options);
@@ -333,6 +352,10 @@ Object.defineProperty(exports, "RealtimeService", {
   enumerable: true,
   get: function () { return realtime.RealtimeService; }
 });
+Object.defineProperty(exports, "StorageBucketClient", {
+  enumerable: true,
+  get: function () { return storage.StorageBucketClient; }
+});
 Object.defineProperty(exports, "StorageService", {
   enumerable: true,
   get: function () { return storage.StorageService; }

package/dist/index.d.cts

@@ -7,7 +7,7 @@ export { FunctionsHttpError, FunctionsRelayError, FunctionsResponseType, Functio
 export { NotificationsAdminService, NotificationsService } from '@aurabase/notifications';
 export { AuraChannel, RealtimeService } from '@aurabase/realtime';
 export { StorageBucketClient, StorageService } from '@aurabase/storage';
-import { A as AuraClient } from './AuraClient-BWdcX_k0.cjs';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.cjs';
 
 /**
  * Create a new Aurabase client instance.
@@ -38,7 +38,7 @@ declare function createClient<Database = any>(baseUrl: string, apiKey: string, o
  * @example
  * ```ts
  * // server-side only (API route, edge function, backend)
- * const admin = createAdminClient(projectUrl, process.env.SERVICE_ROLE_KEY!)
+ * const admin = createAdminClient(projectUrl, process.env.AURABASE_SERVICE_ROLE_KEY!)
  * await admin.authAdmin.listUsers()
  * ```
  */

package/dist/index.d.ts

@@ -7,7 +7,7 @@ export { FunctionsHttpError, FunctionsRelayError, FunctionsResponseType, Functio
 export { NotificationsAdminService, NotificationsService } from '@aurabase/notifications';
 export { AuraChannel, RealtimeService } from '@aurabase/realtime';
 export { StorageBucketClient, StorageService } from '@aurabase/storage';
-import { A as AuraClient } from './AuraClient-BWdcX_k0.js';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.js';
 
 /**
  * Create a new Aurabase client instance.
@@ -38,7 +38,7 @@ declare function createClient<Database = any>(baseUrl: string, apiKey: string, o
  * @example
  * ```ts
  * // server-side only (API route, edge function, backend)
- * const admin = createAdminClient(projectUrl, process.env.SERVICE_ROLE_KEY!)
+ * const admin = createAdminClient(projectUrl, process.env.AURABASE_SERVICE_ROLE_KEY!)
  * await admin.authAdmin.listUsers()
  * ```
  */

package/dist/index.js

@@ -13,7 +13,7 @@ export { NotificationsAdminService, NotificationsService } from '@aurabase/notif
 import { RealtimeService } from '@aurabase/realtime';
 export { AuraChannel, RealtimeService } from '@aurabase/realtime';
 import { StorageService } from '@aurabase/storage';
-export { StorageService } from '@aurabase/storage';
+export { StorageBucketClient, StorageService } from '@aurabase/storage';
 
 // src/index.ts
 function isBrowserContext() {
@@ -62,11 +62,27 @@ var AuraClient = class {
   _persistSession;
   _autoRefresh;
   _detectSessionInUrl;
+  _flowType;
   /**
    * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
    * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).
    */
   constructor(baseUrl, apiKey, options) {
+    if (typeof baseUrl !== "string" || baseUrl.trim() === "") {
+      throw new Error(
+        "[aurabase] Project URL is required: set NEXT_PUBLIC_AURABASE_URL to the project URL shown in Studio \u203A Settings \u203A Connection (e.g. http://<slug>.localhost:8080), then pass it to createClient(url, key)."
+      );
+    }
+    if (!/^https?:\/\//i.test(baseUrl.trim())) {
+      throw new Error(
+        `[aurabase] baseUrl must start with http:// or https:// (got "${baseUrl}"): copy the project URL from Studio \u203A Settings \u203A Connection (e.g. http://<slug>.localhost:8080).`
+      );
+    }
+    if (apiKey === void 0 || apiKey === null) {
+      throw new Error(
+        "[aurabase] API key is required: set NEXT_PUBLIC_AURABASE_ANON_KEY (browser) or AURABASE_SERVICE_ROLE_KEY (server only) to a key shown in Studio \u203A Settings \u203A Connection, then pass it to createClient(url, key)."
+      );
+    }
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     const resolvedOptions = options;
     this.apiKey = apiKey || null;
@@ -78,17 +94,18 @@ var AuraClient = class {
     this.debug = resolvedOptions?.debug;
     if (!this.apiKey && typeof console !== "undefined") {
       console.warn(
-        "[aurabase] No API key provided. Most operations require an API key (apikey header). Only public auth routes (register, login, refresh) will work without one."
+        // AUTH-041 — la passerelle refuse TOUTE requête sans clé (401), y compris register/login.
+        "[aurabase] No API key provided: every request will be refused (401). Pass the anon key shown in Studio \u203A Settings \u203A Connection."
       );
     }
     if (typeof console !== "undefined" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(this.baseUrl)) {
       console.warn(
-        "[aurabase] Attention : en local, l'URL du projet doit inclure le sous-domaine (ex: http://<slug>.localhost:8080) pour permettre la r\xE9solution automatique du projet par la passerelle."
+        "[aurabase] Warning: locally, the project URL must include the sub-domain (e.g. http://<slug>.localhost:8080) so that the gateway can resolve the project automatically."
       );
     }
     if (this.apiKey?.startsWith(SERVICE_ROLE_KEY_PREFIX) && isBrowserContext()) {
       const refuse = resolvedOptions?.refuseServiceRoleInBrowser ?? true;
-      const message = "[aurabase] S\xC9CURIT\xC9 : une cl\xE9 service_role (aura_sk_\u2026) est fournie \xE0 createClient() dans un contexte navigateur. Cette cl\xE9 \xE0 privil\xE8ges \xE9lev\xE9s NE DOIT JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez une cl\xE9 anon (aura_anon_\u2026) c\xF4t\xE9 client, et createAdminClient() c\xF4t\xE9 serveur pour les op\xE9rations d'administration.";
+      const message = "[aurabase] SECURITY: a service_role key (aura_sk_\u2026) is passed to createClient() in a browser context. This high-privilege key MUST NEVER be exposed client-side (it would leak into the bundle). Use an anon key (aura_anon_\u2026) on the client, and createAdminClient() on the server for administration operations.";
       if (refuse) {
         throw new Error(message);
       } else if (typeof console !== "undefined") {
@@ -113,6 +130,7 @@ var AuraClient = class {
     this._persistSession = resolvedOptions?.auth?.persistSession !== false;
     this._autoRefresh = resolvedOptions?.auth?.autoRefresh ?? true;
     this._detectSessionInUrl = resolvedOptions?.auth?.detectSessionInUrl;
+    this._flowType = resolvedOptions?.auth?.flowType;
     if (this._autoRefresh && this._persistSession && typeof window !== "undefined") {
       void this.auth;
     }
@@ -137,7 +155,8 @@ var AuraClient = class {
       this._auth = new AuthService(this, {
         autoRefresh: this._autoRefresh,
         persistSession: this._persistSession,
-        detectSessionInUrl: this._detectSessionInUrl
+        detectSessionInUrl: this._detectSessionInUrl,
+        flowType: this._flowType
       });
       this._auth.onAuthStateChange(({ event, accessToken }) => {
         if (this._realtime) {
@@ -158,7 +177,7 @@ var AuraClient = class {
   get authAdmin() {
     if (isBrowserContext()) {
       throw new Error(
-        "[aurabase] S\xC9CURIT\xC9 : authAdmin est inaccessible dans un contexte navigateur. L'API admin requiert une cl\xE9 service_role qui ne doit JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez createAdminClient() c\xF4t\xE9 serveur uniquement."
+        "[aurabase] SECURITY: authAdmin is not available in a browser context. The admin API requires a service_role key, which must NEVER be exposed client-side (it would leak into the bundle). Use createAdminClient() on the server only."
       );
     }
     if (!this._authAdmin) this._authAdmin = new AuthAdminService(this);
@@ -261,7 +280,7 @@ function createClient(baseUrl, apiKey, options) {
 function createAdminClient(baseUrl, serviceRoleKey, options) {
   if (isBrowserContext()) {
     throw new Error(
-      "[aurabase] createAdminClient() ne doit jamais \xEAtre appel\xE9 c\xF4t\xE9 navigateur : la cl\xE9 service_role serait expos\xE9e dans le bundle. \xC0 utiliser uniquement c\xF4t\xE9 serveur."
+      "[aurabase] createAdminClient() must never be called in a browser: the service_role key would be exposed in the bundle. Use it on the server only."
     );
   }
   return new AuraClient(baseUrl, serviceRoleKey, options);

package/dist/nextjs.cjs

@@ -56,11 +56,27 @@ var AuraClient = class {
   _persistSession;
   _autoRefresh;
   _detectSessionInUrl;
+  _flowType;
   /**
    * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
    * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).
    */
   constructor(baseUrl, apiKey, options) {
+    if (typeof baseUrl !== "string" || baseUrl.trim() === "") {
+      throw new Error(
+        "[aurabase] Project URL is required: set NEXT_PUBLIC_AURABASE_URL to the project URL shown in Studio \u203A Settings \u203A Connection (e.g. http://<slug>.localhost:8080), then pass it to createClient(url, key)."
+      );
+    }
+    if (!/^https?:\/\//i.test(baseUrl.trim())) {
+      throw new Error(
+        `[aurabase] baseUrl must start with http:// or https:// (got "${baseUrl}"): copy the project URL from Studio \u203A Settings \u203A Connection (e.g. http://<slug>.localhost:8080).`
+      );
+    }
+    if (apiKey === void 0 || apiKey === null) {
+      throw new Error(
+        "[aurabase] API key is required: set NEXT_PUBLIC_AURABASE_ANON_KEY (browser) or AURABASE_SERVICE_ROLE_KEY (server only) to a key shown in Studio \u203A Settings \u203A Connection, then pass it to createClient(url, key)."
+      );
+    }
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     const resolvedOptions = options;
     this.apiKey = apiKey || null;
@@ -72,17 +88,18 @@ var AuraClient = class {
     this.debug = resolvedOptions?.debug;
     if (!this.apiKey && typeof console !== "undefined") {
       console.warn(
-        "[aurabase] No API key provided. Most operations require an API key (apikey header). Only public auth routes (register, login, refresh) will work without one."
+        // AUTH-041 — la passerelle refuse TOUTE requête sans clé (401), y compris register/login.
+        "[aurabase] No API key provided: every request will be refused (401). Pass the anon key shown in Studio \u203A Settings \u203A Connection."
       );
     }
     if (typeof console !== "undefined" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(this.baseUrl)) {
       console.warn(
-        "[aurabase] Attention : en local, l'URL du projet doit inclure le sous-domaine (ex: http://<slug>.localhost:8080) pour permettre la r\xE9solution automatique du projet par la passerelle."
+        "[aurabase] Warning: locally, the project URL must include the sub-domain (e.g. http://<slug>.localhost:8080) so that the gateway can resolve the project automatically."
       );
     }
     if (this.apiKey?.startsWith(SERVICE_ROLE_KEY_PREFIX) && isBrowserContext()) {
       const refuse = resolvedOptions?.refuseServiceRoleInBrowser ?? true;
-      const message = "[aurabase] S\xC9CURIT\xC9 : une cl\xE9 service_role (aura_sk_\u2026) est fournie \xE0 createClient() dans un contexte navigateur. Cette cl\xE9 \xE0 privil\xE8ges \xE9lev\xE9s NE DOIT JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez une cl\xE9 anon (aura_anon_\u2026) c\xF4t\xE9 client, et createAdminClient() c\xF4t\xE9 serveur pour les op\xE9rations d'administration.";
+      const message = "[aurabase] SECURITY: a service_role key (aura_sk_\u2026) is passed to createClient() in a browser context. This high-privilege key MUST NEVER be exposed client-side (it would leak into the bundle). Use an anon key (aura_anon_\u2026) on the client, and createAdminClient() on the server for administration operations.";
       if (refuse) {
         throw new Error(message);
       } else if (typeof console !== "undefined") {
@@ -107,6 +124,7 @@ var AuraClient = class {
     this._persistSession = resolvedOptions?.auth?.persistSession !== false;
     this._autoRefresh = resolvedOptions?.auth?.autoRefresh ?? true;
     this._detectSessionInUrl = resolvedOptions?.auth?.detectSessionInUrl;
+    this._flowType = resolvedOptions?.auth?.flowType;
     if (this._autoRefresh && this._persistSession && typeof window !== "undefined") {
       void this.auth;
     }
@@ -131,7 +149,8 @@ var AuraClient = class {
       this._auth = new auth$1.AuthService(this, {
         autoRefresh: this._autoRefresh,
         persistSession: this._persistSession,
-        detectSessionInUrl: this._detectSessionInUrl
+        detectSessionInUrl: this._detectSessionInUrl,
+        flowType: this._flowType
       });
       this._auth.onAuthStateChange(({ event, accessToken }) => {
         if (this._realtime) {
@@ -152,7 +171,7 @@ var AuraClient = class {
   get authAdmin() {
     if (isBrowserContext()) {
       throw new Error(
-        "[aurabase] S\xC9CURIT\xC9 : authAdmin est inaccessible dans un contexte navigateur. L'API admin requiert une cl\xE9 service_role qui ne doit JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez createAdminClient() c\xF4t\xE9 serveur uniquement."
+        "[aurabase] SECURITY: authAdmin is not available in a browser context. The admin API requires a service_role key, which must NEVER be exposed client-side (it would leak into the bundle). Use createAdminClient() on the server only."
       );
     }
     if (!this._authAdmin) this._authAdmin = new auth$1.AuthAdminService(this);
@@ -248,6 +267,7 @@ var AuraClient = class {
   }
 };
 var MAX_CHUNK_SIZE = 3600;
+var WARN_COOKIE_BYTES = 8 * 1024;
 function createServerClient(baseUrl, apiKey, options) {
   const cookieName = `aura-${core.clientScope(baseUrl)}-auth`;
   const store = new core.LocalAuthStore(cookieName);
@@ -263,12 +283,13 @@ function createServerClient(baseUrl, apiKey, options) {
   const defaultCookieOpts = {
     path: "/",
     secure: baseUrl.startsWith("https://"),
-    sameSite: "Lax",
+    sameSite: "lax",
     httpOnly: true,
     maxAge: 60 * 60 * 24 * 30,
     // 30 days
     ...options.cookieOptions
   };
+  let tailleAvertie = false;
   store.onChange(() => {
     const toSet = [];
     const used = /* @__PURE__ */ new Set();
@@ -293,15 +314,46 @@ function createServerClient(baseUrl, apiKey, options) {
         }
       }
     }
+    const total = toSet.filter((c) => used.has(c.name)).reduce((n, c) => n + c.name.length + encodeURIComponent(c.value).length, 0);
+    if (total > WARN_COOKIE_BYTES && !tailleAvertie) {
+      tailleAvertie = true;
+      console.warn(
+        `[aurabase] The session cookie is ${total} bytes (more than 8 KB): servers and proxies often reject requests above that size (431). The access token carries user_metadata: store less in user_metadata and keep large data in your own tables.`
+      );
+    }
     const expireOpts = { ...defaultCookieOpts, maxAge: 0 };
     for (const name of initialNames) {
       if (!used.has(name)) toSet.push({ name, value: "", options: expireOpts });
     }
     if (toSet.length > 0) options.cookies.setAll(toSet);
   });
-  return new AuraClient(baseUrl, apiKey, {
+  const client = new AuraClient(baseUrl, apiKey, {
     auth: { persistSession: false, storage: store }
   });
+  const getUser = client.auth.getUser.bind(client.auth);
+  const getSession = client.auth.getSession.bind(client.auth);
+  let verifie = null;
+  let averti = false;
+  client.auth.getUser = (async (...args) => {
+    const r = await getUser(...args);
+    verifie = !r.error && r.data ? r.data : null;
+    return r;
+  });
+  client.auth.getSession = (async () => {
+    const r = await getSession();
+    if (verifie) {
+      if (r.data.session) r.data.session = { ...r.data.session, user: verifie };
+      return { ...r, user: r.data.session ? verifie : null };
+    }
+    if (!averti) {
+      averti = true;
+      console.warn(
+        "[aurabase] getSession() on the server returns the session read from the cookie without verifying it: never use it to authorize a request. Call auth.getUser() (verified by the server) first."
+      );
+    }
+    return r;
+  });
+  return client;
 }
 
 // src/nextjs.ts
@@ -321,15 +373,15 @@ function createAuthMiddleware(options = {}) {
     const nextServer = await loadNextModule("next/server");
     if (!nextServer?.NextResponse) {
       throw new Error(
-        "[@aurabase/nextjs] Next.js n'est pas install\xE9. createAuthMiddleware n\xE9cessite next/server."
+        "[@aurabase/nextjs] Next.js is not installed. createAuthMiddleware requires next/server."
       );
     }
     const { NextResponse } = nextServer;
-    const projectUrl = options.projectUrl ?? process.env.NEXT_PUBLIC_AURABASE_URL ?? process.env.AURABASE_URL ?? "";
-    const anonKey = options.anonKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? process.env.AURABASE_ANON_KEY ?? "";
+    const projectUrl = options.projectUrl ?? process.env.NEXT_PUBLIC_AURABASE_URL ?? "";
+    const anonKey = options.anonKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? "";
     if (!projectUrl || !anonKey) {
       console.warn(
-        "[@aurabase/nextjs] Variables d'environnement manquantes : NEXT_PUBLIC_AURABASE_URL ou NEXT_PUBLIC_AURABASE_ANON_KEY non d\xE9finies."
+        "[@aurabase/nextjs] Missing environment variables: NEXT_PUBLIC_AURABASE_URL or NEXT_PUBLIC_AURABASE_ANON_KEY is not set."
       );
       return NextResponse.next({ request });
     }
@@ -346,9 +398,9 @@ function createAuthMiddleware(options = {}) {
     const client = createServerClient(projectUrl, anonKey, {
       cookies: cookieHandler
     });
-    const { data: sessionData } = await client.auth.getSession();
-    const session = sessionData?.session ?? null;
-    const user = session?.user ?? null;
+    const { data: verifiedUser } = await client.auth.getUser();
+    const user = verifiedUser ?? null;
+    const session = user ? (await client.auth.getSession()).data?.session ?? null : null;
     const pathname = request.nextUrl.pathname;
     const publicPatterns = options.publicRoutes ?? ["/", "/login", "/signup", "/auth/callback"];
     const isPublic = publicPatterns.some((pattern) => {
@@ -370,8 +422,8 @@ function createAuthMiddleware(options = {}) {
   };
 }
 function createClientForServerComponent(cookieStore, projectUrl, apiKey) {
-  const url = projectUrl ?? process.env.NEXT_PUBLIC_AURABASE_URL ?? process.env.AURABASE_URL ?? "";
-  const key = apiKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? process.env.AURABASE_ANON_KEY ?? "";
+  const url = projectUrl ?? process.env.NEXT_PUBLIC_AURABASE_URL ?? "";
+  const key = apiKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? "";
   return createServerClient(url, key, {
     cookies: {
       getAll: () => cookieStore.getAll(),
@@ -381,8 +433,8 @@ function createClientForServerComponent(cookieStore, projectUrl, apiKey) {
   });
 }
 function createClientForServerAction(cookieStore, projectUrl, apiKey) {
-  const url = projectUrl ?? process.env.NEXT_PUBLIC_AURABASE_URL ?? process.env.AURABASE_URL ?? "";
-  const key = apiKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? process.env.AURABASE_ANON_KEY ?? "";
+  const url = projectUrl ?? process.env.NEXT_PUBLIC_AURABASE_URL ?? "";
+  const key = apiKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? "";
   return createServerClient(url, key, {
     cookies: {
       getAll: () => cookieStore.getAll(),
@@ -397,13 +449,13 @@ function createClientForServerAction(cookieStore, projectUrl, apiKey) {
 async function auth(options) {
   const nextHeaders = await loadNextModule("next/headers");
   if (!nextHeaders?.cookies) {
-    throw new Error("[@aurabase/nextjs] auth() ne peut \xEAtre appel\xE9 que dans un environnement Next.js App Router.");
+    throw new Error("[@aurabase/nextjs] auth() can only be called in a Next.js App Router environment.");
   }
   const cookieStore = await nextHeaders.cookies();
   const client = createClientForServerComponent(cookieStore, options?.projectUrl, options?.apiKey);
-  const { data } = await client.auth.getSession();
-  const session = data?.session ?? null;
-  const user = session?.user ?? null;
+  const { data: verifiedUser } = await client.auth.getUser();
+  const user = verifiedUser ?? null;
+  const session = user ? (await client.auth.getSession()).data?.session ?? null : null;
   return {
     userId: user?.id ?? null,
     user,

package/dist/nextjs.d.cts

@@ -1,4 +1,4 @@
-import { A as AuraClient } from './AuraClient-BWdcX_k0.cjs';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.cjs';
 import { User, Session } from '@aurabase/core';
 import '@aurabase/ai';
 import '@aurabase/auth';
@@ -53,9 +53,9 @@ interface AuthContextParam {
     request: NextRequestLike;
 }
 interface AuthMiddlewareOptions {
-    /** Project URL (defaults to process.env.NEXT_PUBLIC_AURABASE_URL or process.env.AURABASE_URL). */
+    /** Project URL (defaults to process.env.NEXT_PUBLIC_AURABASE_URL, the only variable name read). */
     projectUrl?: string;
-    /** Anon API Key (defaults to process.env.NEXT_PUBLIC_AURABASE_ANON_KEY or process.env.AURABASE_ANON_KEY). */
+    /** Anon API Key (defaults to process.env.NEXT_PUBLIC_AURABASE_ANON_KEY, the only variable name read). */
     anonKey?: string;
     /** List of route patterns that do not require authentication (e.g. ['/', '/login', '/signup', '/auth/*']). */
     publicRoutes?: string[];

package/dist/nextjs.d.ts

@@ -1,4 +1,4 @@
-import { A as AuraClient } from './AuraClient-BWdcX_k0.js';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.js';
 import { User, Session } from '@aurabase/core';
 import '@aurabase/ai';
 import '@aurabase/auth';
@@ -53,9 +53,9 @@ interface AuthContextParam {
     request: NextRequestLike;
 }
 interface AuthMiddlewareOptions {
-    /** Project URL (defaults to process.env.NEXT_PUBLIC_AURABASE_URL or process.env.AURABASE_URL). */
+    /** Project URL (defaults to process.env.NEXT_PUBLIC_AURABASE_URL, the only variable name read). */
     projectUrl?: string;
-    /** Anon API Key (defaults to process.env.NEXT_PUBLIC_AURABASE_ANON_KEY or process.env.AURABASE_ANON_KEY). */
+    /** Anon API Key (defaults to process.env.NEXT_PUBLIC_AURABASE_ANON_KEY, the only variable name read). */
     anonKey?: string;
     /** List of route patterns that do not require authentication (e.g. ['/', '/login', '/signup', '/auth/*']). */
     publicRoutes?: string[];

package/dist/nextjs.js

@@ -54,11 +54,27 @@ var AuraClient = class {
   _persistSession;
   _autoRefresh;
   _detectSessionInUrl;
+  _flowType;
   /**
    * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
    * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).
    */
   constructor(baseUrl, apiKey, options) {
+    if (typeof baseUrl !== "string" || baseUrl.trim() === "") {
+      throw new Error(
+        "[aurabase] Project URL is required: set NEXT_PUBLIC_AURABASE_URL to the project URL shown in Studio \u203A Settings \u203A Connection (e.g. http://<slug>.localhost:8080), then pass it to createClient(url, key)."
+      );
+    }
+    if (!/^https?:\/\//i.test(baseUrl.trim())) {
+      throw new Error(
+        `[aurabase] baseUrl must start with http:// or https:// (got "${baseUrl}"): copy the project URL from Studio \u203A Settings \u203A Connection (e.g. http://<slug>.localhost:8080).`
+      );
+    }
+    if (apiKey === void 0 || apiKey === null) {
+      throw new Error(
+        "[aurabase] API key is required: set NEXT_PUBLIC_AURABASE_ANON_KEY (browser) or AURABASE_SERVICE_ROLE_KEY (server only) to a key shown in Studio \u203A Settings \u203A Connection, then pass it to createClient(url, key)."
+      );
+    }
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     const resolvedOptions = options;
     this.apiKey = apiKey || null;
@@ -70,17 +86,18 @@ var AuraClient = class {
     this.debug = resolvedOptions?.debug;
     if (!this.apiKey && typeof console !== "undefined") {
       console.warn(
-        "[aurabase] No API key provided. Most operations require an API key (apikey header). Only public auth routes (register, login, refresh) will work without one."
+        // AUTH-041 — la passerelle refuse TOUTE requête sans clé (401), y compris register/login.
+        "[aurabase] No API key provided: every request will be refused (401). Pass the anon key shown in Studio \u203A Settings \u203A Connection."
       );
     }
     if (typeof console !== "undefined" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(this.baseUrl)) {
       console.warn(
-        "[aurabase] Attention : en local, l'URL du projet doit inclure le sous-domaine (ex: http://<slug>.localhost:8080) pour permettre la r\xE9solution automatique du projet par la passerelle."
+        "[aurabase] Warning: locally, the project URL must include the sub-domain (e.g. http://<slug>.localhost:8080) so that the gateway can resolve the project automatically."
       );
     }
     if (this.apiKey?.startsWith(SERVICE_ROLE_KEY_PREFIX) && isBrowserContext()) {
       const refuse = resolvedOptions?.refuseServiceRoleInBrowser ?? true;
-      const message = "[aurabase] S\xC9CURIT\xC9 : une cl\xE9 service_role (aura_sk_\u2026) est fournie \xE0 createClient() dans un contexte navigateur. Cette cl\xE9 \xE0 privil\xE8ges \xE9lev\xE9s NE DOIT JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez une cl\xE9 anon (aura_anon_\u2026) c\xF4t\xE9 client, et createAdminClient() c\xF4t\xE9 serveur pour les op\xE9rations d'administration.";
+      const message = "[aurabase] SECURITY: a service_role key (aura_sk_\u2026) is passed to createClient() in a browser context. This high-privilege key MUST NEVER be exposed client-side (it would leak into the bundle). Use an anon key (aura_anon_\u2026) on the client, and createAdminClient() on the server for administration operations.";
       if (refuse) {
         throw new Error(message);
       } else if (typeof console !== "undefined") {
@@ -105,6 +122,7 @@ var AuraClient = class {
     this._persistSession = resolvedOptions?.auth?.persistSession !== false;
     this._autoRefresh = resolvedOptions?.auth?.autoRefresh ?? true;
     this._detectSessionInUrl = resolvedOptions?.auth?.detectSessionInUrl;
+    this._flowType = resolvedOptions?.auth?.flowType;
     if (this._autoRefresh && this._persistSession && typeof window !== "undefined") {
       void this.auth;
     }
@@ -129,7 +147,8 @@ var AuraClient = class {
       this._auth = new AuthService(this, {
         autoRefresh: this._autoRefresh,
         persistSession: this._persistSession,
-        detectSessionInUrl: this._detectSessionInUrl
+        detectSessionInUrl: this._detectSessionInUrl,
+        flowType: this._flowType
       });
       this._auth.onAuthStateChange(({ event, accessToken }) => {
         if (this._realtime) {
@@ -150,7 +169,7 @@ var AuraClient = class {
   get authAdmin() {
     if (isBrowserContext()) {
       throw new Error(
-        "[aurabase] S\xC9CURIT\xC9 : authAdmin est inaccessible dans un contexte navigateur. L'API admin requiert une cl\xE9 service_role qui ne doit JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez createAdminClient() c\xF4t\xE9 serveur uniquement."
+        "[aurabase] SECURITY: authAdmin is not available in a browser context. The admin API requires a service_role key, which must NEVER be exposed client-side (it would leak into the bundle). Use createAdminClient() on the server only."
       );
     }
     if (!this._authAdmin) this._authAdmin = new AuthAdminService(this);
@@ -246,6 +265,7 @@ var AuraClient = class {
   }
 };
 var MAX_CHUNK_SIZE = 3600;
+var WARN_COOKIE_BYTES = 8 * 1024;
 function createServerClient(baseUrl, apiKey, options) {
   const cookieName = `aura-${clientScope(baseUrl)}-auth`;
   const store = new LocalAuthStore(cookieName);
@@ -261,12 +281,13 @@ function createServerClient(baseUrl, apiKey, options) {
   const defaultCookieOpts = {
     path: "/",
     secure: baseUrl.startsWith("https://"),
-    sameSite: "Lax",
+    sameSite: "lax",
     httpOnly: true,
     maxAge: 60 * 60 * 24 * 30,
     // 30 days
     ...options.cookieOptions
   };
+  let tailleAvertie = false;
   store.onChange(() => {
     const toSet = [];
     const used = /* @__PURE__ */ new Set();
@@ -291,15 +312,46 @@ function createServerClient(baseUrl, apiKey, options) {
         }
       }
     }
+    const total = toSet.filter((c) => used.has(c.name)).reduce((n, c) => n + c.name.length + encodeURIComponent(c.value).length, 0);
+    if (total > WARN_COOKIE_BYTES && !tailleAvertie) {
+      tailleAvertie = true;
+      console.warn(
+        `[aurabase] The session cookie is ${total} bytes (more than 8 KB): servers and proxies often reject requests above that size (431). The access token carries user_metadata: store less in user_metadata and keep large data in your own tables.`
+      );
+    }
     const expireOpts = { ...defaultCookieOpts, maxAge: 0 };
     for (const name of initialNames) {
       if (!used.has(name)) toSet.push({ name, value: "", options: expireOpts });
     }
     if (toSet.length > 0) options.cookies.setAll(toSet);
   });
-  return new AuraClient(baseUrl, apiKey, {
+  const client = new AuraClient(baseUrl, apiKey, {
     auth: { persistSession: false, storage: store }
   });
+  const getUser = client.auth.getUser.bind(client.auth);
+  const getSession = client.auth.getSession.bind(client.auth);
+  let verifie = null;
+  let averti = false;
+  client.auth.getUser = (async (...args) => {
+    const r = await getUser(...args);
+    verifie = !r.error && r.data ? r.data : null;
+    return r;
+  });
+  client.auth.getSession = (async () => {
+    const r = await getSession();
+    if (verifie) {
+      if (r.data.session) r.data.session = { ...r.data.session, user: verifie };
+      return { ...r, user: r.data.session ? verifie : null };
+    }
+    if (!averti) {
+      averti = true;
+      console.warn(
+        "[aurabase] getSession() on the server returns the session read from the cookie without verifying it: never use it to authorize a request. Call auth.getUser() (verified by the server) first."
+      );
+    }
+    return r;
+  });
+  return client;
 }
 
 // src/nextjs.ts
@@ -319,15 +371,15 @@ function createAuthMiddleware(options = {}) {
     const nextServer = await loadNextModule("next/server");
     if (!nextServer?.NextResponse) {
       throw new Error(
-        "[@aurabase/nextjs] Next.js n'est pas install\xE9. createAuthMiddleware n\xE9cessite next/server."
+        "[@aurabase/nextjs] Next.js is not installed. createAuthMiddleware requires next/server."
       );
     }
     const { NextResponse } = nextServer;
-    const projectUrl = options.projectUrl ?? process.env.NEXT_PUBLIC_AURABASE_URL ?? process.env.AURABASE_URL ?? "";
-    const anonKey = options.anonKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? process.env.AURABASE_ANON_KEY ?? "";
+    const projectUrl = options.projectUrl ?? process.env.NEXT_PUBLIC_AURABASE_URL ?? "";
+    const anonKey = options.anonKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? "";
     if (!projectUrl || !anonKey) {
       console.warn(
-        "[@aurabase/nextjs] Variables d'environnement manquantes : NEXT_PUBLIC_AURABASE_URL ou NEXT_PUBLIC_AURABASE_ANON_KEY non d\xE9finies."
+        "[@aurabase/nextjs] Missing environment variables: NEXT_PUBLIC_AURABASE_URL or NEXT_PUBLIC_AURABASE_ANON_KEY is not set."
       );
       return NextResponse.next({ request });
     }
@@ -344,9 +396,9 @@ function createAuthMiddleware(options = {}) {
     const client = createServerClient(projectUrl, anonKey, {
       cookies: cookieHandler
     });
-    const { data: sessionData } = await client.auth.getSession();
-    const session = sessionData?.session ?? null;
-    const user = session?.user ?? null;
+    const { data: verifiedUser } = await client.auth.getUser();
+    const user = verifiedUser ?? null;
+    const session = user ? (await client.auth.getSession()).data?.session ?? null : null;
     const pathname = request.nextUrl.pathname;
     const publicPatterns = options.publicRoutes ?? ["/", "/login", "/signup", "/auth/callback"];
     const isPublic = publicPatterns.some((pattern) => {
@@ -368,8 +420,8 @@ function createAuthMiddleware(options = {}) {
   };
 }
 function createClientForServerComponent(cookieStore, projectUrl, apiKey) {
-  const url = projectUrl ?? process.env.NEXT_PUBLIC_AURABASE_URL ?? process.env.AURABASE_URL ?? "";
-  const key = apiKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? process.env.AURABASE_ANON_KEY ?? "";
+  const url = projectUrl ?? process.env.NEXT_PUBLIC_AURABASE_URL ?? "";
+  const key = apiKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? "";
   return createServerClient(url, key, {
     cookies: {
       getAll: () => cookieStore.getAll(),
@@ -379,8 +431,8 @@ function createClientForServerComponent(cookieStore, projectUrl, apiKey) {
   });
 }
 function createClientForServerAction(cookieStore, projectUrl, apiKey) {
-  const url = projectUrl ?? process.env.NEXT_PUBLIC_AURABASE_URL ?? process.env.AURABASE_URL ?? "";
-  const key = apiKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? process.env.AURABASE_ANON_KEY ?? "";
+  const url = projectUrl ?? process.env.NEXT_PUBLIC_AURABASE_URL ?? "";
+  const key = apiKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? "";
   return createServerClient(url, key, {
     cookies: {
       getAll: () => cookieStore.getAll(),
@@ -395,13 +447,13 @@ function createClientForServerAction(cookieStore, projectUrl, apiKey) {
 async function auth(options) {
   const nextHeaders = await loadNextModule("next/headers");
   if (!nextHeaders?.cookies) {
-    throw new Error("[@aurabase/nextjs] auth() ne peut \xEAtre appel\xE9 que dans un environnement Next.js App Router.");
+    throw new Error("[@aurabase/nextjs] auth() can only be called in a Next.js App Router environment.");
   }
   const cookieStore = await nextHeaders.cookies();
   const client = createClientForServerComponent(cookieStore, options?.projectUrl, options?.apiKey);
-  const { data } = await client.auth.getSession();
-  const session = data?.session ?? null;
-  const user = session?.user ?? null;
+  const { data: verifiedUser } = await client.auth.getUser();
+  const user = verifiedUser ?? null;
+  const session = user ? (await client.auth.getSession()).data?.session ?? null : null;
   return {
     userId: user?.id ?? null,
     user,

package/dist/react.d.cts

@@ -1,5 +1,5 @@
 import { User, Session } from '@aurabase/core';
-import { A as AuraClient } from './AuraClient-BWdcX_k0.cjs';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.cjs';
 import '@aurabase/ai';
 import '@aurabase/auth';
 import '@aurabase/db';

package/dist/react.d.ts

@@ -1,5 +1,5 @@
 import { User, Session } from '@aurabase/core';
-import { A as AuraClient } from './AuraClient-BWdcX_k0.js';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.js';
 import '@aurabase/ai';
 import '@aurabase/auth';
 import '@aurabase/db';

package/dist/ssr.cjs

@@ -56,11 +56,27 @@ var AuraClient = class {
   _persistSession;
   _autoRefresh;
   _detectSessionInUrl;
+  _flowType;
   /**
    * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
    * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).
    */
   constructor(baseUrl, apiKey, options) {
+    if (typeof baseUrl !== "string" || baseUrl.trim() === "") {
+      throw new Error(
+        "[aurabase] Project URL is required: set NEXT_PUBLIC_AURABASE_URL to the project URL shown in Studio \u203A Settings \u203A Connection (e.g. http://<slug>.localhost:8080), then pass it to createClient(url, key)."
+      );
+    }
+    if (!/^https?:\/\//i.test(baseUrl.trim())) {
+      throw new Error(
+        `[aurabase] baseUrl must start with http:// or https:// (got "${baseUrl}"): copy the project URL from Studio \u203A Settings \u203A Connection (e.g. http://<slug>.localhost:8080).`
+      );
+    }
+    if (apiKey === void 0 || apiKey === null) {
+      throw new Error(
+        "[aurabase] API key is required: set NEXT_PUBLIC_AURABASE_ANON_KEY (browser) or AURABASE_SERVICE_ROLE_KEY (server only) to a key shown in Studio \u203A Settings \u203A Connection, then pass it to createClient(url, key)."
+      );
+    }
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     const resolvedOptions = options;
     this.apiKey = apiKey || null;
@@ -72,17 +88,18 @@ var AuraClient = class {
     this.debug = resolvedOptions?.debug;
     if (!this.apiKey && typeof console !== "undefined") {
       console.warn(
-        "[aurabase] No API key provided. Most operations require an API key (apikey header). Only public auth routes (register, login, refresh) will work without one."
+        // AUTH-041 — la passerelle refuse TOUTE requête sans clé (401), y compris register/login.
+        "[aurabase] No API key provided: every request will be refused (401). Pass the anon key shown in Studio \u203A Settings \u203A Connection."
       );
     }
     if (typeof console !== "undefined" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(this.baseUrl)) {
       console.warn(
-        "[aurabase] Attention : en local, l'URL du projet doit inclure le sous-domaine (ex: http://<slug>.localhost:8080) pour permettre la r\xE9solution automatique du projet par la passerelle."
+        "[aurabase] Warning: locally, the project URL must include the sub-domain (e.g. http://<slug>.localhost:8080) so that the gateway can resolve the project automatically."
       );
     }
     if (this.apiKey?.startsWith(SERVICE_ROLE_KEY_PREFIX) && isBrowserContext()) {
       const refuse = resolvedOptions?.refuseServiceRoleInBrowser ?? true;
-      const message = "[aurabase] S\xC9CURIT\xC9 : une cl\xE9 service_role (aura_sk_\u2026) est fournie \xE0 createClient() dans un contexte navigateur. Cette cl\xE9 \xE0 privil\xE8ges \xE9lev\xE9s NE DOIT JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez une cl\xE9 anon (aura_anon_\u2026) c\xF4t\xE9 client, et createAdminClient() c\xF4t\xE9 serveur pour les op\xE9rations d'administration.";
+      const message = "[aurabase] SECURITY: a service_role key (aura_sk_\u2026) is passed to createClient() in a browser context. This high-privilege key MUST NEVER be exposed client-side (it would leak into the bundle). Use an anon key (aura_anon_\u2026) on the client, and createAdminClient() on the server for administration operations.";
       if (refuse) {
         throw new Error(message);
       } else if (typeof console !== "undefined") {
@@ -107,6 +124,7 @@ var AuraClient = class {
     this._persistSession = resolvedOptions?.auth?.persistSession !== false;
     this._autoRefresh = resolvedOptions?.auth?.autoRefresh ?? true;
     this._detectSessionInUrl = resolvedOptions?.auth?.detectSessionInUrl;
+    this._flowType = resolvedOptions?.auth?.flowType;
     if (this._autoRefresh && this._persistSession && typeof window !== "undefined") {
       void this.auth;
     }
@@ -131,7 +149,8 @@ var AuraClient = class {
       this._auth = new auth.AuthService(this, {
         autoRefresh: this._autoRefresh,
         persistSession: this._persistSession,
-        detectSessionInUrl: this._detectSessionInUrl
+        detectSessionInUrl: this._detectSessionInUrl,
+        flowType: this._flowType
       });
       this._auth.onAuthStateChange(({ event, accessToken }) => {
         if (this._realtime) {
@@ -152,7 +171,7 @@ var AuraClient = class {
   get authAdmin() {
     if (isBrowserContext()) {
       throw new Error(
-        "[aurabase] S\xC9CURIT\xC9 : authAdmin est inaccessible dans un contexte navigateur. L'API admin requiert une cl\xE9 service_role qui ne doit JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez createAdminClient() c\xF4t\xE9 serveur uniquement."
+        "[aurabase] SECURITY: authAdmin is not available in a browser context. The admin API requires a service_role key, which must NEVER be exposed client-side (it would leak into the bundle). Use createAdminClient() on the server only."
       );
     }
     if (!this._authAdmin) this._authAdmin = new auth.AuthAdminService(this);
@@ -248,6 +267,7 @@ var AuraClient = class {
   }
 };
 var MAX_CHUNK_SIZE = 3600;
+var WARN_COOKIE_BYTES = 8 * 1024;
 function createServerClient(baseUrl, apiKey, options) {
   const cookieName = `aura-${core.clientScope(baseUrl)}-auth`;
   const store = new core.LocalAuthStore(cookieName);
@@ -263,12 +283,13 @@ function createServerClient(baseUrl, apiKey, options) {
   const defaultCookieOpts = {
     path: "/",
     secure: baseUrl.startsWith("https://"),
-    sameSite: "Lax",
+    sameSite: "lax",
     httpOnly: true,
     maxAge: 60 * 60 * 24 * 30,
     // 30 days
     ...options.cookieOptions
   };
+  let tailleAvertie = false;
   store.onChange(() => {
     const toSet = [];
     const used = /* @__PURE__ */ new Set();
@@ -293,15 +314,46 @@ function createServerClient(baseUrl, apiKey, options) {
         }
       }
     }
+    const total = toSet.filter((c) => used.has(c.name)).reduce((n, c) => n + c.name.length + encodeURIComponent(c.value).length, 0);
+    if (total > WARN_COOKIE_BYTES && !tailleAvertie) {
+      tailleAvertie = true;
+      console.warn(
+        `[aurabase] The session cookie is ${total} bytes (more than 8 KB): servers and proxies often reject requests above that size (431). The access token carries user_metadata: store less in user_metadata and keep large data in your own tables.`
+      );
+    }
     const expireOpts = { ...defaultCookieOpts, maxAge: 0 };
     for (const name of initialNames) {
       if (!used.has(name)) toSet.push({ name, value: "", options: expireOpts });
     }
     if (toSet.length > 0) options.cookies.setAll(toSet);
   });
-  return new AuraClient(baseUrl, apiKey, {
+  const client = new AuraClient(baseUrl, apiKey, {
     auth: { persistSession: false, storage: store }
   });
+  const getUser = client.auth.getUser.bind(client.auth);
+  const getSession = client.auth.getSession.bind(client.auth);
+  let verifie = null;
+  let averti = false;
+  client.auth.getUser = (async (...args) => {
+    const r = await getUser(...args);
+    verifie = !r.error && r.data ? r.data : null;
+    return r;
+  });
+  client.auth.getSession = (async () => {
+    const r = await getSession();
+    if (verifie) {
+      if (r.data.session) r.data.session = { ...r.data.session, user: verifie };
+      return { ...r, user: r.data.session ? verifie : null };
+    }
+    if (!averti) {
+      averti = true;
+      console.warn(
+        "[aurabase] getSession() on the server returns the session read from the cookie without verifying it: never use it to authorize a request. Call auth.getUser() (verified by the server) first."
+      );
+    }
+    return r;
+  });
+  return client;
 }
 function createBrowserClient(baseUrl, apiKey, options) {
   return new AuraClient(baseUrl, apiKey, options);

package/dist/ssr.d.cts

@@ -1,6 +1,6 @@
 import { SerializeCookieOptions, AuraClientOptions } from '@aurabase/core';
 export { SerializeCookieOptions, parseCookieHeader, serializeCookieHeader } from '@aurabase/core';
-import { A as AuraClient } from './AuraClient-BWdcX_k0.cjs';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.cjs';
 import '@aurabase/ai';
 import '@aurabase/auth';
 import '@aurabase/db';
@@ -18,7 +18,7 @@ import '@aurabase/storage';
  *
  * export async function middleware(request) {
  *   let response = NextResponse.next({ request })
- *   const client = createServerClient(PROJECT_URL, ANON_KEY, {
+ *   const client = createServerClient(NEXT_PUBLIC_AURABASE_URL, NEXT_PUBLIC_AURABASE_ANON_KEY, {
  *     cookies: {
  *       getAll: () => request.cookies.getAll(),
  *       setAll: (cookies) => {
@@ -29,7 +29,9 @@ import '@aurabase/storage';
  *       },
  *     },
  *   })
- *   await client.auth.getSession()
+ *   // getUser() renouvelle les jetons ET fait vérifier l'utilisateur par le serveur.
+ *   // Ne jamais autoriser avec getSession() côté serveur : elle lit le cookie sans le vérifier.
+ *   const { data: user } = await client.auth.getUser()
  *   return response
  * }
  * ```

package/dist/ssr.d.ts

@@ -1,6 +1,6 @@
 import { SerializeCookieOptions, AuraClientOptions } from '@aurabase/core';
 export { SerializeCookieOptions, parseCookieHeader, serializeCookieHeader } from '@aurabase/core';
-import { A as AuraClient } from './AuraClient-BWdcX_k0.js';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.js';
 import '@aurabase/ai';
 import '@aurabase/auth';
 import '@aurabase/db';
@@ -18,7 +18,7 @@ import '@aurabase/storage';
  *
  * export async function middleware(request) {
  *   let response = NextResponse.next({ request })
- *   const client = createServerClient(PROJECT_URL, ANON_KEY, {
+ *   const client = createServerClient(NEXT_PUBLIC_AURABASE_URL, NEXT_PUBLIC_AURABASE_ANON_KEY, {
  *     cookies: {
  *       getAll: () => request.cookies.getAll(),
  *       setAll: (cookies) => {
@@ -29,7 +29,9 @@ import '@aurabase/storage';
  *       },
  *     },
  *   })
- *   await client.auth.getSession()
+ *   // getUser() renouvelle les jetons ET fait vérifier l'utilisateur par le serveur.
+ *   // Ne jamais autoriser avec getSession() côté serveur : elle lit le cookie sans le vérifier.
+ *   const { data: user } = await client.auth.getUser()
  *   return response
  * }
  * ```

package/dist/ssr.js

@@ -55,11 +55,27 @@ var AuraClient = class {
   _persistSession;
   _autoRefresh;
   _detectSessionInUrl;
+  _flowType;
   /**
    * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
    * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).
    */
   constructor(baseUrl, apiKey, options) {
+    if (typeof baseUrl !== "string" || baseUrl.trim() === "") {
+      throw new Error(
+        "[aurabase] Project URL is required: set NEXT_PUBLIC_AURABASE_URL to the project URL shown in Studio \u203A Settings \u203A Connection (e.g. http://<slug>.localhost:8080), then pass it to createClient(url, key)."
+      );
+    }
+    if (!/^https?:\/\//i.test(baseUrl.trim())) {
+      throw new Error(
+        `[aurabase] baseUrl must start with http:// or https:// (got "${baseUrl}"): copy the project URL from Studio \u203A Settings \u203A Connection (e.g. http://<slug>.localhost:8080).`
+      );
+    }
+    if (apiKey === void 0 || apiKey === null) {
+      throw new Error(
+        "[aurabase] API key is required: set NEXT_PUBLIC_AURABASE_ANON_KEY (browser) or AURABASE_SERVICE_ROLE_KEY (server only) to a key shown in Studio \u203A Settings \u203A Connection, then pass it to createClient(url, key)."
+      );
+    }
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     const resolvedOptions = options;
     this.apiKey = apiKey || null;
@@ -71,17 +87,18 @@ var AuraClient = class {
     this.debug = resolvedOptions?.debug;
     if (!this.apiKey && typeof console !== "undefined") {
       console.warn(
-        "[aurabase] No API key provided. Most operations require an API key (apikey header). Only public auth routes (register, login, refresh) will work without one."
+        // AUTH-041 — la passerelle refuse TOUTE requête sans clé (401), y compris register/login.
+        "[aurabase] No API key provided: every request will be refused (401). Pass the anon key shown in Studio \u203A Settings \u203A Connection."
       );
     }
     if (typeof console !== "undefined" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(this.baseUrl)) {
       console.warn(
-        "[aurabase] Attention : en local, l'URL du projet doit inclure le sous-domaine (ex: http://<slug>.localhost:8080) pour permettre la r\xE9solution automatique du projet par la passerelle."
+        "[aurabase] Warning: locally, the project URL must include the sub-domain (e.g. http://<slug>.localhost:8080) so that the gateway can resolve the project automatically."
       );
     }
     if (this.apiKey?.startsWith(SERVICE_ROLE_KEY_PREFIX) && isBrowserContext()) {
       const refuse = resolvedOptions?.refuseServiceRoleInBrowser ?? true;
-      const message = "[aurabase] S\xC9CURIT\xC9 : une cl\xE9 service_role (aura_sk_\u2026) est fournie \xE0 createClient() dans un contexte navigateur. Cette cl\xE9 \xE0 privil\xE8ges \xE9lev\xE9s NE DOIT JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez une cl\xE9 anon (aura_anon_\u2026) c\xF4t\xE9 client, et createAdminClient() c\xF4t\xE9 serveur pour les op\xE9rations d'administration.";
+      const message = "[aurabase] SECURITY: a service_role key (aura_sk_\u2026) is passed to createClient() in a browser context. This high-privilege key MUST NEVER be exposed client-side (it would leak into the bundle). Use an anon key (aura_anon_\u2026) on the client, and createAdminClient() on the server for administration operations.";
       if (refuse) {
         throw new Error(message);
       } else if (typeof console !== "undefined") {
@@ -106,6 +123,7 @@ var AuraClient = class {
     this._persistSession = resolvedOptions?.auth?.persistSession !== false;
     this._autoRefresh = resolvedOptions?.auth?.autoRefresh ?? true;
     this._detectSessionInUrl = resolvedOptions?.auth?.detectSessionInUrl;
+    this._flowType = resolvedOptions?.auth?.flowType;
     if (this._autoRefresh && this._persistSession && typeof window !== "undefined") {
       void this.auth;
     }
@@ -130,7 +148,8 @@ var AuraClient = class {
       this._auth = new AuthService(this, {
         autoRefresh: this._autoRefresh,
         persistSession: this._persistSession,
-        detectSessionInUrl: this._detectSessionInUrl
+        detectSessionInUrl: this._detectSessionInUrl,
+        flowType: this._flowType
       });
       this._auth.onAuthStateChange(({ event, accessToken }) => {
         if (this._realtime) {
@@ -151,7 +170,7 @@ var AuraClient = class {
   get authAdmin() {
     if (isBrowserContext()) {
       throw new Error(
-        "[aurabase] S\xC9CURIT\xC9 : authAdmin est inaccessible dans un contexte navigateur. L'API admin requiert une cl\xE9 service_role qui ne doit JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez createAdminClient() c\xF4t\xE9 serveur uniquement."
+        "[aurabase] SECURITY: authAdmin is not available in a browser context. The admin API requires a service_role key, which must NEVER be exposed client-side (it would leak into the bundle). Use createAdminClient() on the server only."
       );
     }
     if (!this._authAdmin) this._authAdmin = new AuthAdminService(this);
@@ -247,6 +266,7 @@ var AuraClient = class {
   }
 };
 var MAX_CHUNK_SIZE = 3600;
+var WARN_COOKIE_BYTES = 8 * 1024;
 function createServerClient(baseUrl, apiKey, options) {
   const cookieName = `aura-${clientScope(baseUrl)}-auth`;
   const store = new LocalAuthStore(cookieName);
@@ -262,12 +282,13 @@ function createServerClient(baseUrl, apiKey, options) {
   const defaultCookieOpts = {
     path: "/",
     secure: baseUrl.startsWith("https://"),
-    sameSite: "Lax",
+    sameSite: "lax",
     httpOnly: true,
     maxAge: 60 * 60 * 24 * 30,
     // 30 days
     ...options.cookieOptions
   };
+  let tailleAvertie = false;
   store.onChange(() => {
     const toSet = [];
     const used = /* @__PURE__ */ new Set();
@@ -292,15 +313,46 @@ function createServerClient(baseUrl, apiKey, options) {
         }
       }
     }
+    const total = toSet.filter((c) => used.has(c.name)).reduce((n, c) => n + c.name.length + encodeURIComponent(c.value).length, 0);
+    if (total > WARN_COOKIE_BYTES && !tailleAvertie) {
+      tailleAvertie = true;
+      console.warn(
+        `[aurabase] The session cookie is ${total} bytes (more than 8 KB): servers and proxies often reject requests above that size (431). The access token carries user_metadata: store less in user_metadata and keep large data in your own tables.`
+      );
+    }
     const expireOpts = { ...defaultCookieOpts, maxAge: 0 };
     for (const name of initialNames) {
       if (!used.has(name)) toSet.push({ name, value: "", options: expireOpts });
     }
     if (toSet.length > 0) options.cookies.setAll(toSet);
   });
-  return new AuraClient(baseUrl, apiKey, {
+  const client = new AuraClient(baseUrl, apiKey, {
     auth: { persistSession: false, storage: store }
   });
+  const getUser = client.auth.getUser.bind(client.auth);
+  const getSession = client.auth.getSession.bind(client.auth);
+  let verifie = null;
+  let averti = false;
+  client.auth.getUser = (async (...args) => {
+    const r = await getUser(...args);
+    verifie = !r.error && r.data ? r.data : null;
+    return r;
+  });
+  client.auth.getSession = (async () => {
+    const r = await getSession();
+    if (verifie) {
+      if (r.data.session) r.data.session = { ...r.data.session, user: verifie };
+      return { ...r, user: r.data.session ? verifie : null };
+    }
+    if (!averti) {
+      averti = true;
+      console.warn(
+        "[aurabase] getSession() on the server returns the session read from the cookie without verifying it: never use it to authorize a request. Call auth.getUser() (verified by the server) first."
+      );
+    }
+    return r;
+  });
+  return client;
 }
 function createBrowserClient(baseUrl, apiKey, options) {
   return new AuraClient(baseUrl, apiKey, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/aurabase-js",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Official JavaScript/TypeScript client for Aurabase BaaS",
   "type": "module",
   "main": "dist/index.cjs",
@@ -37,6 +37,7 @@
         "default": "./dist/nextjs.cjs"
       }
     },
+    "./package.json": "./package.json",
     "./react": {
       "import": {
         "types": "./dist/react.d.ts",
@@ -61,12 +62,12 @@
   "author": "Aurabase",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/daylami555/aurabase.git",
+    "url": "git+https://github.com/Aurabase-cloud/Aurabase.git",
     "directory": "aurabase-js/packages/aurabase"
   },
   "homepage": "https://aurabase.cloud",
   "bugs": {
-    "url": "https://github.com/daylami555/aurabase/issues"
+    "url": "https://github.com/Aurabase-cloud/Aurabase/issues"
   },
   "keywords": [
     "aurabase",
@@ -76,14 +77,14 @@
     "client"
   ],
   "dependencies": {
-    "@aurabase/realtime": "0.6.1",
-    "@aurabase/functions": "0.6.1",
-    "@aurabase/ai": "0.6.1",
-    "@aurabase/storage": "0.6.1",
-    "@aurabase/notifications": "0.6.1",
-    "@aurabase/db": "0.6.1",
-    "@aurabase/core": "0.6.1",
-    "@aurabase/auth": "0.6.1"
+    "@aurabase/core": "0.7.0",
+    "@aurabase/auth": "0.7.0",
+    "@aurabase/storage": "0.7.0",
+    "@aurabase/ai": "0.7.0",
+    "@aurabase/functions": "0.7.0",
+    "@aurabase/notifications": "0.7.0",
+    "@aurabase/db": "0.7.0",
+    "@aurabase/realtime": "0.7.0"
   },
   "devDependencies": {
     "@types/node": "20.14.15",