@aurabase/core 0.4.0 → 0.4.1

package/dist/index.cjs

@@ -235,6 +235,56 @@ function unwrapEnvelope(body) {
   }
   return body;
 }
+async function readTextBounded(res, timeoutMs) {
+  const body = res.body;
+  if (!body || typeof body.getReader !== "function" || !(timeoutMs > 0)) {
+    try {
+      return { ok: true, text: await res.text() };
+    } catch (err) {
+      return {
+        ok: false,
+        timedOut: false,
+        message: err instanceof Error ? err.message : "read failed"
+      };
+    }
+  }
+  let timer;
+  const TIMED_OUT = /* @__PURE__ */ Symbol("body-timeout");
+  try {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let out = "";
+    const deadline = new Promise((resolve) => {
+      timer = setTimeout(() => resolve(TIMED_OUT), timeoutMs);
+      timer.unref?.();
+    });
+    for (; ; ) {
+      const step = await Promise.race([reader.read(), deadline]);
+      if (step === TIMED_OUT) {
+        await reader.cancel().catch(() => {
+        });
+        return {
+          ok: false,
+          timedOut: true,
+          message: `Response body not fully received within ${timeoutMs}ms`
+        };
+      }
+      if (step.done) {
+        out += decoder.decode();
+        return { ok: true, text: out };
+      }
+      if (step.value) out += decoder.decode(step.value, { stream: true });
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      timedOut: false,
+      message: err instanceof Error ? err.message : "read failed"
+    };
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 var inflightRefreshes = /* @__PURE__ */ new WeakMap();
 async function doRefresh(client) {
   const store = client.authStore;
@@ -248,26 +298,57 @@ async function doRefresh(client) {
   const epoch = store.removalEpoch;
   const headers = { "Content-Type": "application/json" };
   if (client.apiKey) headers["apikey"] = client.apiKey;
+  const timeoutMs = client.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  let timedOut = false;
+  let refreshTimer;
+  let refreshSignal;
+  if (timeoutMs > 0 && typeof AbortController !== "undefined") {
+    const ctrl = new AbortController();
+    refreshTimer = setTimeout(() => {
+      timedOut = true;
+      ctrl.abort();
+    }, timeoutMs);
+    refreshTimer.unref?.();
+    refreshSignal = ctrl.signal;
+  }
+  const clearRefreshTimer = () => {
+    if (refreshTimer) {
+      clearTimeout(refreshTimer);
+      refreshTimer = void 0;
+    }
+  };
   let res;
   try {
     res = await client.fetchFn(`${client.baseUrl}/v1/auth/${client.projectId}/refresh`, {
       method: "POST",
       headers,
-      body: serializeBody({ refresh_token: rt })
+      body: serializeBody({ refresh_token: rt }),
+      signal: refreshSignal
     });
   } catch (err) {
+    clearRefreshTimer();
+    if (timedOut) {
+      emitAuraEvent(client.onEvent, client.debug, {
+        kind: "timeout",
+        url: `${client.baseUrl}/v1/auth/${client.projectId}/refresh`
+      });
+    }
     return {
       data: null,
       error: new AuraError(0, {
-        error: { code: "network_error", message: err instanceof Error ? err.message : "Network request failed" }
+        error: timedOut ? { code: "timeout", message: `Refresh timed out after ${timeoutMs}ms` } : { code: "network_error", message: err instanceof Error ? err.message : "Network request failed" }
       })
     };
   }
+  clearRefreshTimer();
   if (!res.ok) {
     let body2 = null;
-    try {
-      body2 = await res.json();
-    } catch {
+    const errRead = await readTextBounded(res, timeoutMs);
+    if (errRead.ok && errRead.text.trim() !== "") {
+      try {
+        body2 = JSON.parse(errRead.text);
+      } catch {
+      }
     }
     const code = typeof body2?.error?.code === "string" ? body2.error.code : null;
     const definitivelyRejected = res.status === 403 || res.status === 401 && code === "REFRESH_TOKEN_REJECTED";
@@ -279,8 +360,23 @@ async function doRefresh(client) {
     return { data: null, error: new AuraError(res.status, body2) };
   }
   let body;
+  const okRead = await readTextBounded(res, timeoutMs);
+  if (!okRead.ok) {
+    if (okRead.timedOut) {
+      emitAuraEvent(client.onEvent, client.debug, {
+        kind: "timeout",
+        url: `${client.baseUrl}/v1/auth/${client.projectId}/refresh`
+      });
+    }
+    return {
+      data: null,
+      error: new AuraError(0, {
+        error: okRead.timedOut ? { code: "timeout", message: `Refresh body not received within ${timeoutMs}ms` } : { code: "invalid_response", message: `Invalid refresh response (${okRead.message})` }
+      })
+    };
+  }
   try {
-    body = await res.json();
+    body = JSON.parse(okRead.text);
   } catch {
     return {
       data: null,
@@ -373,6 +469,7 @@ async function fetchWithAuth(url, init, client) {
   const isFormData = typeof FormData !== "undefined" && init.body instanceof FormData;
   const timeoutMs = client.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
   const applyTimeout = timeoutMs > 0 && init.signal === void 0 && !isFormData;
+  const bodyTimeoutMs = init.signal === void 0 ? timeoutMs : 0;
   let attempt = 0;
   for (; ; ) {
     const headers = { ...init.headers };
@@ -462,26 +559,42 @@ async function fetchWithAuth(url, init, client) {
     }
     if (!res.ok) {
       let body2 = null;
-      try {
-        body2 = await res.json();
-      } catch {
+      const errRead = await readTextBounded(res, bodyTimeoutMs);
+      if (errRead.ok && errRead.text.trim() !== "") {
+        try {
+          body2 = JSON.parse(errRead.text);
+        } catch {
+        }
+      } else if (!errRead.ok && errRead.timedOut) {
+        emitAuraEvent(client.onEvent, client.debug, { kind: "timeout", url });
       }
       return { data: null, error: new AuraError(res.status, body2) };
     }
-    let raw;
-    try {
-      raw = await res.text();
-    } catch (err) {
+    const read = await readTextBounded(res, bodyTimeoutMs);
+    if (!read.ok) {
+      if (read.timedOut) {
+        emitAuraEvent(client.onEvent, client.debug, { kind: "timeout", url });
+        return {
+          data: null,
+          error: new AuraError(0, {
+            error: {
+              code: "timeout",
+              message: `Response body not fully received within ${bodyTimeoutMs}ms (HTTP ${res.status})`
+            }
+          })
+        };
+      }
       return {
         data: null,
         error: new AuraError(0, {
           error: {
             code: "invalid_response",
-            message: `Unreadable response body (HTTP ${res.status}): ${err instanceof Error ? err.message : "read failed"}`
+            message: `Unreadable response body (HTTP ${res.status}): ${read.message}`
           }
         })
       };
     }
+    const raw = read.text;
     if (raw.trim() === "") {
       return { data: null, error: null };
     }
@@ -709,6 +822,7 @@ exports.AuraError = AuraError;
 exports.BaseAuthStore = BaseAuthStore;
 exports.BaseService = BaseService;
 exports.DEFAULT_MAX_RETRIES = DEFAULT_MAX_RETRIES;
+exports.DEFAULT_REQUEST_TIMEOUT_MS = DEFAULT_REQUEST_TIMEOUT_MS;
 exports.LocalAuthStore = LocalAuthStore;
 exports.RETRYABLE_METHODS = RETRYABLE_METHODS;
 exports.RETRYABLE_STATUS = RETRYABLE_STATUS;

package/dist/index.d.cts

@@ -1098,6 +1098,8 @@ interface AuraClientLike {
     readonly debug?: boolean;
 }
 
+/** Timeout par défaut d'une requête HTTP (borne un serveur qui « hang »). */
+declare const DEFAULT_REQUEST_TIMEOUT_MS = 30000;
 /** Point d'entrée unique du refresh, dédupliqué par client (single-flight). */
 declare function refreshOnce(client: AuraClientLike): Promise<AuraResponse<TokenPair>>;
 interface FetchInit {
@@ -1228,4 +1230,4 @@ declare function abortableSleep(ms: number, signal?: AbortSignal): Promise<void>
 /** True si l'erreur `fetch` est une annulation utilisateur (jamais rejouée). */
 declare function isAbortError(err: unknown): boolean;
 
-export { type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CronJob, DEFAULT_MAX_RETRIES, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationStats, type NotificationTemplate, type NotificationTemplatePreview, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeEvent, type RealtimeListenType, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationRequest, type SerializeCookieOptions, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type SessionInfo, type SignInRequest, type SignUpRequest, type StorageBucket, type SubscribeCallback, type TokenPair, type UpdateUserRequest, type UploadResult, type User, type UserStats, abortableSleep, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationStats, type NotificationTemplate, type NotificationTemplatePreview, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeEvent, type RealtimeListenType, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationRequest, type SerializeCookieOptions, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type SessionInfo, type SignInRequest, type SignUpRequest, type StorageBucket, type SubscribeCallback, type TokenPair, type UpdateUserRequest, type UploadResult, type User, type UserStats, abortableSleep, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.d.ts

@@ -1098,6 +1098,8 @@ interface AuraClientLike {
     readonly debug?: boolean;
 }
 
+/** Timeout par défaut d'une requête HTTP (borne un serveur qui « hang »). */
+declare const DEFAULT_REQUEST_TIMEOUT_MS = 30000;
 /** Point d'entrée unique du refresh, dédupliqué par client (single-flight). */
 declare function refreshOnce(client: AuraClientLike): Promise<AuraResponse<TokenPair>>;
 interface FetchInit {
@@ -1228,4 +1230,4 @@ declare function abortableSleep(ms: number, signal?: AbortSignal): Promise<void>
 /** True si l'erreur `fetch` est une annulation utilisateur (jamais rejouée). */
 declare function isAbortError(err: unknown): boolean;
 
-export { type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CronJob, DEFAULT_MAX_RETRIES, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationStats, type NotificationTemplate, type NotificationTemplatePreview, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeEvent, type RealtimeListenType, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationRequest, type SerializeCookieOptions, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type SessionInfo, type SignInRequest, type SignUpRequest, type StorageBucket, type SubscribeCallback, type TokenPair, type UpdateUserRequest, type UploadResult, type User, type UserStats, abortableSleep, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationStats, type NotificationTemplate, type NotificationTemplatePreview, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeEvent, type RealtimeListenType, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationRequest, type SerializeCookieOptions, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type SessionInfo, type SignInRequest, type SignUpRequest, type StorageBucket, type SubscribeCallback, type TokenPair, type UpdateUserRequest, type UploadResult, type User, type UserStats, abortableSleep, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.js

@@ -233,6 +233,56 @@ function unwrapEnvelope(body) {
   }
   return body;
 }
+async function readTextBounded(res, timeoutMs) {
+  const body = res.body;
+  if (!body || typeof body.getReader !== "function" || !(timeoutMs > 0)) {
+    try {
+      return { ok: true, text: await res.text() };
+    } catch (err) {
+      return {
+        ok: false,
+        timedOut: false,
+        message: err instanceof Error ? err.message : "read failed"
+      };
+    }
+  }
+  let timer;
+  const TIMED_OUT = /* @__PURE__ */ Symbol("body-timeout");
+  try {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let out = "";
+    const deadline = new Promise((resolve) => {
+      timer = setTimeout(() => resolve(TIMED_OUT), timeoutMs);
+      timer.unref?.();
+    });
+    for (; ; ) {
+      const step = await Promise.race([reader.read(), deadline]);
+      if (step === TIMED_OUT) {
+        await reader.cancel().catch(() => {
+        });
+        return {
+          ok: false,
+          timedOut: true,
+          message: `Response body not fully received within ${timeoutMs}ms`
+        };
+      }
+      if (step.done) {
+        out += decoder.decode();
+        return { ok: true, text: out };
+      }
+      if (step.value) out += decoder.decode(step.value, { stream: true });
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      timedOut: false,
+      message: err instanceof Error ? err.message : "read failed"
+    };
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 var inflightRefreshes = /* @__PURE__ */ new WeakMap();
 async function doRefresh(client) {
   const store = client.authStore;
@@ -246,26 +296,57 @@ async function doRefresh(client) {
   const epoch = store.removalEpoch;
   const headers = { "Content-Type": "application/json" };
   if (client.apiKey) headers["apikey"] = client.apiKey;
+  const timeoutMs = client.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  let timedOut = false;
+  let refreshTimer;
+  let refreshSignal;
+  if (timeoutMs > 0 && typeof AbortController !== "undefined") {
+    const ctrl = new AbortController();
+    refreshTimer = setTimeout(() => {
+      timedOut = true;
+      ctrl.abort();
+    }, timeoutMs);
+    refreshTimer.unref?.();
+    refreshSignal = ctrl.signal;
+  }
+  const clearRefreshTimer = () => {
+    if (refreshTimer) {
+      clearTimeout(refreshTimer);
+      refreshTimer = void 0;
+    }
+  };
   let res;
   try {
     res = await client.fetchFn(`${client.baseUrl}/v1/auth/${client.projectId}/refresh`, {
       method: "POST",
       headers,
-      body: serializeBody({ refresh_token: rt })
+      body: serializeBody({ refresh_token: rt }),
+      signal: refreshSignal
     });
   } catch (err) {
+    clearRefreshTimer();
+    if (timedOut) {
+      emitAuraEvent(client.onEvent, client.debug, {
+        kind: "timeout",
+        url: `${client.baseUrl}/v1/auth/${client.projectId}/refresh`
+      });
+    }
     return {
       data: null,
       error: new AuraError(0, {
-        error: { code: "network_error", message: err instanceof Error ? err.message : "Network request failed" }
+        error: timedOut ? { code: "timeout", message: `Refresh timed out after ${timeoutMs}ms` } : { code: "network_error", message: err instanceof Error ? err.message : "Network request failed" }
       })
     };
   }
+  clearRefreshTimer();
   if (!res.ok) {
     let body2 = null;
-    try {
-      body2 = await res.json();
-    } catch {
+    const errRead = await readTextBounded(res, timeoutMs);
+    if (errRead.ok && errRead.text.trim() !== "") {
+      try {
+        body2 = JSON.parse(errRead.text);
+      } catch {
+      }
     }
     const code = typeof body2?.error?.code === "string" ? body2.error.code : null;
     const definitivelyRejected = res.status === 403 || res.status === 401 && code === "REFRESH_TOKEN_REJECTED";
@@ -277,8 +358,23 @@ async function doRefresh(client) {
     return { data: null, error: new AuraError(res.status, body2) };
   }
   let body;
+  const okRead = await readTextBounded(res, timeoutMs);
+  if (!okRead.ok) {
+    if (okRead.timedOut) {
+      emitAuraEvent(client.onEvent, client.debug, {
+        kind: "timeout",
+        url: `${client.baseUrl}/v1/auth/${client.projectId}/refresh`
+      });
+    }
+    return {
+      data: null,
+      error: new AuraError(0, {
+        error: okRead.timedOut ? { code: "timeout", message: `Refresh body not received within ${timeoutMs}ms` } : { code: "invalid_response", message: `Invalid refresh response (${okRead.message})` }
+      })
+    };
+  }
   try {
-    body = await res.json();
+    body = JSON.parse(okRead.text);
   } catch {
     return {
       data: null,
@@ -371,6 +467,7 @@ async function fetchWithAuth(url, init, client) {
   const isFormData = typeof FormData !== "undefined" && init.body instanceof FormData;
   const timeoutMs = client.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
   const applyTimeout = timeoutMs > 0 && init.signal === void 0 && !isFormData;
+  const bodyTimeoutMs = init.signal === void 0 ? timeoutMs : 0;
   let attempt = 0;
   for (; ; ) {
     const headers = { ...init.headers };
@@ -460,26 +557,42 @@ async function fetchWithAuth(url, init, client) {
     }
     if (!res.ok) {
       let body2 = null;
-      try {
-        body2 = await res.json();
-      } catch {
+      const errRead = await readTextBounded(res, bodyTimeoutMs);
+      if (errRead.ok && errRead.text.trim() !== "") {
+        try {
+          body2 = JSON.parse(errRead.text);
+        } catch {
+        }
+      } else if (!errRead.ok && errRead.timedOut) {
+        emitAuraEvent(client.onEvent, client.debug, { kind: "timeout", url });
       }
       return { data: null, error: new AuraError(res.status, body2) };
     }
-    let raw;
-    try {
-      raw = await res.text();
-    } catch (err) {
+    const read = await readTextBounded(res, bodyTimeoutMs);
+    if (!read.ok) {
+      if (read.timedOut) {
+        emitAuraEvent(client.onEvent, client.debug, { kind: "timeout", url });
+        return {
+          data: null,
+          error: new AuraError(0, {
+            error: {
+              code: "timeout",
+              message: `Response body not fully received within ${bodyTimeoutMs}ms (HTTP ${res.status})`
+            }
+          })
+        };
+      }
       return {
         data: null,
         error: new AuraError(0, {
           error: {
             code: "invalid_response",
-            message: `Unreadable response body (HTTP ${res.status}): ${err instanceof Error ? err.message : "read failed"}`
+            message: `Unreadable response body (HTTP ${res.status}): ${read.message}`
           }
         })
       };
     }
+    const raw = read.text;
     if (raw.trim() === "") {
       return { data: null, error: null };
     }
@@ -703,4 +816,4 @@ function serializeCookieHeader(name, value, options = {}) {
   return parts.join("; ");
 }
 
-export { AuraError, BaseAuthStore, BaseService, DEFAULT_MAX_RETRIES, LocalAuthStore, RETRYABLE_METHODS, RETRYABLE_STATUS, abortableSleep, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AuraError, BaseAuthStore, BaseService, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, LocalAuthStore, RETRYABLE_METHODS, RETRYABLE_STATUS, abortableSleep, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/core",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Cœur du SDK Aurabase : fetch résilient, erreurs, stores auth, types de réponse (infrastructure interne)",
   "type": "module",
   "main": "dist/index.cjs",
@@ -45,6 +45,7 @@
     "core"
   ],
   "devDependencies": {
+    "@types/node": "20.14.15",
     "tsup": "^8.0.0",
     "typescript": "^5.5.0",
     "vitest": "^4.1.6"
@@ -53,6 +54,7 @@
     "build": "tsup",
     "test": "vitest run && tsc --noEmit -p tsconfig.test-d.json",
     "test:types": "tsc --noEmit -p tsconfig.test-d.json",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "typecheck:tests": "tsc --noEmit -p tsconfig.test.json"
   }
 }