@aurabase/core 0.5.2 → 0.5.4

package/dist/index.cjs

@@ -5,15 +5,60 @@ var AuraError = class _AuraError extends Error {
   status;
   code;
   details;
+  retryAfter;
   /** Marqueur runtime pour `isAuraError` (détection cross-realm/cross-bundle). */
   __isAuraError = true;
-  constructor(status, body) {
-    const message = body?.error?.message ?? body?.message ?? `HTTP ${status}`;
-    super(message);
+  constructor(status, body, headers) {
+    let rawMessage = body?.error?.message ?? body?.message ?? (status === 429 ? "Trop de requ\xEAtes, veuillez patienter avant de r\xE9essayer." : `HTTP ${status}`);
+    let retryAfterSec;
+    if (headers) {
+      const getHeader = (name) => {
+        if (typeof headers.get === "function") {
+          return headers.get(name);
+        }
+        const record = headers;
+        return record[name] ?? record[name.toLowerCase()];
+      };
+      const ra = getHeader("retry-after") ?? getHeader("x-ratelimit-after");
+      if (ra) {
+        const sec = parseInt(ra, 10);
+        if (!isNaN(sec)) {
+          retryAfterSec = sec;
+          if (status === 429) {
+            rawMessage = `Trop de requ\xEAtes, veuillez patienter ${sec} seconde${sec > 1 ? "s" : ""} avant de r\xE9essayer.`;
+          }
+        }
+      }
+    }
+    super(rawMessage);
     this.name = "AuraError";
     this.status = status;
-    this.code = body?.error?.code ?? `http_${status}`;
     this.details = body;
+    if (retryAfterSec !== void 0) {
+      this.retryAfter = retryAfterSec;
+    }
+    const rawCode = body?.error?.code;
+    const lowerMsg = rawMessage.toLowerCase();
+    const isGenericHttpCode = typeof rawCode !== "string" || rawCode === "UNAUTHORIZED" || rawCode === "BAD_REQUEST" || rawCode === "CONFLICT" || rawCode === "RATE_LIMITED" || rawCode.startsWith("http_");
+    if (!isGenericHttpCode) {
+      this.code = rawCode;
+    } else if (status === 429 || rawCode === "RATE_LIMITED" || rawCode === "http_429") {
+      this.code = "rate_limit_exceeded";
+    } else if (status === 401 && (lowerMsg.includes("identifiants") || lowerMsg.includes("credentials") || lowerMsg.includes("mot de passe incorrect"))) {
+      this.code = "invalid_credentials";
+    } else if (status === 401 && lowerMsg.includes("r\xE9voqu\xE9e")) {
+      this.code = "session_revoked";
+    } else if (status === 401 && lowerMsg.includes("expir\xE9")) {
+      this.code = "session_expired";
+    } else if (status === 400 && (lowerMsg.includes("mot de passe") || lowerMsg.includes("password"))) {
+      this.code = "weak_password";
+    } else if (status === 409 && (lowerMsg.includes("d\xE9j\xE0 utilis\xE9") || lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
+      this.code = "email_already_in_use";
+    } else if (status === 404 && lowerMsg.includes("utilisateur")) {
+      this.code = "user_not_found";
+    } else {
+      this.code = rawCode ?? `http_${status}`;
+    }
     Object.setPrototypeOf(this, _AuraError.prototype);
   }
   get isNotFound() {
@@ -300,6 +345,15 @@ function unwrapEnvelope(body) {
   }
   return body;
 }
+function parseContentRangeTotal(headerVal) {
+  if (!headerVal) return void 0;
+  const parts = headerVal.split("/");
+  if (parts.length === 2 && parts[1] !== "*") {
+    const n = parseInt(parts[1], 10);
+    if (!Number.isNaN(n)) return n;
+  }
+  return void 0;
+}
 async function readTextBounded(res, timeoutMs) {
   const body = res.body;
   if (!body || typeof body.getReader !== "function" || !(timeoutMs > 0)) {
@@ -648,11 +702,12 @@ async function fetchWithAuth(url, init, client) {
         try {
           body2 = JSON.parse(errRead.text);
         } catch {
+          body2 = { message: errRead.text.trim() };
         }
       } else if (!errRead.ok && errRead.timedOut) {
         emitAuraEvent(client.onEvent, client.debug, { kind: "timeout", url });
       }
-      return { data: null, error: new AuraError(res.status, body2) };
+      return { data: null, error: new AuraError(res.status, body2, res.headers) };
     }
     const read = await readTextBounded(res, bodyTimeoutMs);
     if (!read.ok) {
@@ -680,7 +735,11 @@ async function fetchWithAuth(url, init, client) {
     }
     const raw = read.text;
     if (raw.trim() === "") {
-      return { data: null, error: null };
+      const cr2 = res.headers.get("content-range") ?? res.headers.get("Content-Range");
+      const totalFromCr2 = parseContentRangeTotal(cr2);
+      const meta2 = totalFromCr2 !== void 0 ? { total: totalFromCr2 } : void 0;
+      const count2 = totalFromCr2 !== void 0 ? totalFromCr2 : null;
+      return { data: null, error: null, meta: meta2, count: count2 };
     }
     let body;
     try {
@@ -699,11 +758,15 @@ async function fetchWithAuth(url, init, client) {
       };
     }
     const unwrapped = unwrapEnvelope(body);
-    const meta = body !== null && typeof body === "object" && "meta" in body ? body.meta : void 0;
+    const cr = res.headers.get("content-range") ?? res.headers.get("Content-Range");
+    const totalFromCr = parseContentRangeTotal(cr);
+    const rawMeta = body !== null && typeof body === "object" && "meta" in body ? body.meta : void 0;
+    const meta = rawMeta !== void 0 ? rawMeta : totalFromCr !== void 0 ? { total: totalFromCr } : void 0;
+    const count = meta?.total !== void 0 ? meta.total : totalFromCr ?? null;
     if (unwrapped === null) {
-      return { data: null, error: null, meta };
+      return { data: null, error: null, meta, count };
     }
-    return { data: unwrapped, error: null, meta };
+    return { data: unwrapped, error: null, meta, count };
   }
 }
 
@@ -789,14 +852,15 @@ var LocalAuthStore = class extends BaseAuthStore {
    * (`clientScope`, dérivée de l'URL du projet).
    */
   _removePkceVerifiers() {
-    if (typeof localStorage === "undefined") return;
+    const storage = this._getStorage();
+    if (!storage) return;
     try {
       const toRemove = [];
-      for (let i = 0; i < localStorage.length; i++) {
-        const k = localStorage.key(i);
+      for (let i = 0; i < storage.length; i++) {
+        const k = storage.key(i);
         if (k && /^aura-.*-(pkce-code-verifier|oauth-implicit-initiated)$/.test(k)) toRemove.push(k);
       }
-      for (const k of toRemove) localStorage.removeItem(k);
+      for (const k of toRemove) storage.removeItem(k);
     } catch {
       this._emitStorageBlocked("removePkceVerifiers");
     }
@@ -807,17 +871,19 @@ var LocalAuthStore = class extends BaseAuthStore {
   // ne survivrait pas à ce cycle de navigation.
   setItem(key, value) {
     super.setItem(key, value);
-    if (typeof localStorage === "undefined") return;
+    const storage = this._getStorage();
+    if (!storage) return;
     try {
-      localStorage.setItem(key, value);
+      storage.setItem(key, value);
     } catch {
       this._emitStorageBlocked("setItem");
     }
   }
   getItem(key) {
-    if (typeof localStorage === "undefined") return super.getItem(key);
+    const storage = this._getStorage();
+    if (!storage) return super.getItem(key);
     try {
-      const v = localStorage.getItem(key);
+      const v = storage.getItem(key);
       if (v !== null) return v;
     } catch {
       this._emitStorageBlocked("getItem");
@@ -826,9 +892,10 @@ var LocalAuthStore = class extends BaseAuthStore {
   }
   removeItem(key) {
     super.removeItem(key);
-    if (typeof localStorage === "undefined") return;
+    const storage = this._getStorage();
+    if (!storage) return;
     try {
-      localStorage.removeItem(key);
+      storage.removeItem(key);
     } catch {
       this._emitStorageBlocked("removeItem");
     }
@@ -871,10 +938,40 @@ var LocalAuthStore = class extends BaseAuthStore {
     return parts.join("; ");
   }
   // -- Private ----------------------------------------------------------------
+  _getStorage() {
+    if (typeof window !== "undefined" && typeof window.localStorage !== "undefined") {
+      return window.localStorage;
+    }
+    const g = globalThis;
+    if (typeof g !== "undefined") {
+      const proc = g.process;
+      if (typeof proc !== "undefined") {
+        const env = proc.env;
+        const isTest = !!(env?.VITEST || env?.NODE_ENV === "test" || env?.JEST_WORKER_ID);
+        const execArgv = proc.execArgv;
+        const hasFlag = Array.isArray(execArgv) && execArgv.some((a) => typeof a === "string" && a.startsWith("--localstorage-file"));
+        if (isTest || hasFlag) {
+          try {
+            const s = g.localStorage;
+            if (s && typeof s.getItem === "function") return s;
+          } catch {
+          }
+        }
+        return null;
+      }
+      try {
+        const s = g.localStorage;
+        if (s && typeof s.getItem === "function") return s;
+      } catch {
+      }
+    }
+    return null;
+  }
   _loadFromStorage() {
-    if (typeof localStorage === "undefined") return;
+    const storage = this._getStorage();
+    if (!storage) return;
     try {
-      const raw = localStorage.getItem(this.key);
+      const raw = storage.getItem(this.key);
       if (!raw) return;
       const parsed = JSON.parse(raw);
       if (parsed.token && parsed.refreshToken && parsed.user) {
@@ -885,22 +982,24 @@ var LocalAuthStore = class extends BaseAuthStore {
     }
   }
   _persist() {
-    if (typeof localStorage === "undefined") return;
+    const storage = this._getStorage();
+    if (!storage) return;
     const data = {
       token: this.token,
       refreshToken: this.refreshToken,
       user: this.user
     };
     try {
-      localStorage.setItem(this.key, JSON.stringify(data));
+      storage.setItem(this.key, JSON.stringify(data));
     } catch {
       this._emitStorageBlocked("persist");
     }
   }
   _removeStorage() {
-    if (typeof localStorage === "undefined") return;
+    const storage = this._getStorage();
+    if (!storage) return;
     try {
-      localStorage.removeItem(this.key);
+      storage.removeItem(this.key);
     } catch {
       this._emitStorageBlocked("removeStorage");
     }

package/dist/index.d.cts

@@ -14,15 +14,16 @@
  *  - storage/path.ts   : invalid_path
  *  - db/QueryBuilder.ts: PGRST116 (parité PostgREST : `.single()` sur 0/plusieurs lignes)
  */
-type AuraErrorCode = 'no_session' | 'timeout' | 'network_error' | 'invalid_response' | 'refresh_discarded' | 'unverifiable_token' | 'no_code_verifier' | 'pkce_generation_failed' | 'missing_email' | 'jwks_fetch_failed' | 'signature_invalid' | 'token_expired' | 'token_not_yet_valid' | 'invalid_jwt' | 'unsupported_alg' | 'no_matching_key' | 'invalid_issuer' | 'invalid_audience' | 'invalid_path' | 'PGRST116' | (string & {});
+type AuraErrorCode = 'no_session' | 'timeout' | 'network_error' | 'invalid_response' | 'refresh_discarded' | 'unverifiable_token' | 'no_code_verifier' | 'pkce_generation_failed' | 'missing_email' | 'jwks_fetch_failed' | 'signature_invalid' | 'token_expired' | 'token_not_yet_valid' | 'invalid_jwt' | 'unsupported_alg' | 'no_matching_key' | 'invalid_issuer' | 'invalid_audience' | 'invalid_path' | 'PGRST116' | 'invalid_credentials' | 'weak_password' | 'email_already_in_use' | 'user_not_found' | 'rate_limit_exceeded' | 'session_expired' | 'session_revoked' | (string & {});
 /**
  * Structured error thrown/returned by the Aurabase SDK.
- * Mirrors the backend's `AuraError` JSON shape.
+ * Mirrors the backend's `AuraError` JSON shape with semantic DX normalization.
  */
 declare class AuraError extends Error {
     readonly status: number;
     readonly code: AuraErrorCode;
     readonly details: unknown;
+    readonly retryAfter?: number;
     /** Marqueur runtime pour `isAuraError` (détection cross-realm/cross-bundle). */
     protected readonly __isAuraError = true;
     constructor(status: number, body?: {
@@ -31,7 +32,7 @@ declare class AuraError extends Error {
             message?: string;
         };
         message?: string;
-    } | null);
+    } | null, headers?: Headers | Record<string, string | null | undefined>);
     get isNotFound(): boolean;
     get isUnauthorized(): boolean;
     get isForbidden(): boolean;
@@ -93,6 +94,11 @@ interface AuraSuccess<T> {
     data: T;
     error: null;
     meta?: Meta;
+    /**
+     * Nombre total de lignes correspondant à la requête (dérivé de meta.total).
+     * Renseigné quand un décompte explicite est demandé (.count('exact' | ...)).
+     */
+    count?: number | null;
 }
 /**
  * Réponse en SUCCÈS SANS contenu — `data` ET `error` nuls.
@@ -117,6 +123,10 @@ interface AuraNoContent {
     data: null;
     error: null;
     meta?: Meta;
+    /**
+     * Nombre total de lignes (dérivé de meta.total).
+     */
+    count?: number | null;
 }
 /**
  * Réponse en ÉCHEC. `data` y est `null` par construction — aucun producteur du
@@ -126,6 +136,7 @@ interface AuraFailure {
     data: null;
     error: AuraError;
     meta?: Meta;
+    count?: number | null;
 }
 /**
  * Enveloppe de réponse du SDK : union à TROIS membres.
@@ -175,19 +186,47 @@ interface User {
     created_at: string;
     last_sign_in_at?: string | null;
 }
+interface Session {
+    access_token: string;
+    refresh_token: string;
+    /** Alias camelCase pour parité DX Supabase/JS */
+    accessToken?: string;
+    /** Alias camelCase pour parité DX Supabase/JS */
+    refreshToken?: string;
+    token_type: string;
+    expires_in: number;
+    expires_at?: number;
+    user: User;
+    provider_token?: string | null;
+    provider_refresh_token?: string | null;
+}
 interface TokenPair {
     access_token: string;
     refresh_token: string;
+    /** Alias camelCase pour parité DX Supabase/JS */
+    accessToken?: string;
+    /** Alias camelCase pour parité DX Supabase/JS */
+    refreshToken?: string;
     token_type: string;
     expires_in: number;
     user: User;
     provider_token?: string | null;
     provider_refresh_token?: string | null;
+    /** Sous-objet session pour parité DX Supabase (`data.session.access_token`). */
+    session?: Session;
+    mfaChallenge?: undefined;
 }
 interface MfaChallenge {
     mfa_required: true;
     mfa_token: string;
     mfa_setup_required?: boolean;
+    session?: undefined;
+    /** Alias ergonomique aligné sur la documentation officielle */
+    mfaChallenge?: {
+        mfaRequired: boolean;
+        mfaToken: string;
+        mfaSetupRequired?: boolean;
+    };
 }
 type LoginResponse = TokenPair | MfaChallenge;
 type AuthEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED' | 'USER_UPDATED' | 'MFA_CHALLENGE' | 'PASSWORD_RECOVERY';
@@ -204,6 +243,8 @@ interface AuthChangePayload {
     event: AuthEvent;
     user: User | null;
     accessToken: string | null;
+    /** Session complète pour parité DX Supabase */
+    session?: Session | null;
     /** Présent uniquement si `event === 'MFA_CHALLENGE'`. */
     mfaToken?: string;
     /** Présent uniquement si `event === 'MFA_CHALLENGE'`. */
@@ -674,6 +715,51 @@ interface CdcPayload {
     record: Record<string, unknown>;
     old_record: Record<string, unknown> | null;
     _truncated?: boolean;
+    [key: string]: unknown;
+}
+/** Base commune des métadonnées pour un événement CDC PostgreSQL */
+interface RealtimePostgresChangesBasePayload {
+    schema: string;
+    table: string;
+    commit_timestamp: string;
+    errors?: string[];
+    id: string;
+    topic: string;
+    timestamp: string;
+    payload: CdcPayload | Record<string, unknown>;
+    event: 'insert' | 'update' | 'delete';
+}
+/** Payload enrichi pour un événement CDC PostgreSQL d'insertion */
+interface RealtimePostgresInsertPayload<T = Record<string, unknown>> extends RealtimePostgresChangesBasePayload {
+    eventType: 'INSERT';
+    event: 'insert';
+    new: T;
+    old: null;
+}
+/** Payload enrichi pour un événement CDC PostgreSQL de mise à jour */
+interface RealtimePostgresUpdatePayload<T = Record<string, unknown>> extends RealtimePostgresChangesBasePayload {
+    eventType: 'UPDATE';
+    event: 'update';
+    new: T;
+    old: Partial<T>;
+}
+/** Payload enrichi pour un événement CDC PostgreSQL de suppression */
+interface RealtimePostgresDeletePayload<T = Record<string, unknown>> extends RealtimePostgresChangesBasePayload {
+    eventType: 'DELETE';
+    event: 'delete';
+    new: null;
+    old: Partial<T> | null;
+}
+/** Union discriminée par eventType pour les événements CDC PostgreSQL */
+type RealtimePostgresChangesPayload<T = Record<string, unknown>> = RealtimePostgresInsertPayload<T> | RealtimePostgresUpdatePayload<T> | RealtimePostgresDeletePayload<T>;
+/** Événement broadcast reçu avec payload typé */
+interface RealtimeBroadcastEvent<T = Record<string, unknown>> {
+    event: string;
+    payload: T;
+    id?: string;
+    topic?: string;
+    timestamp?: string;
+    allowed_sub_ids?: string[];
 }
 /** Status de subscription */
 type RealtimeSubscribeStatus = 'SUBSCRIBED' | 'CLOSED' | 'CHANNEL_ERROR' | 'TIMED_OUT';
@@ -791,7 +877,12 @@ interface ChannelConfig {
     };
     /** Configuration présence directe */
     presence?: {
-        /** Clé de présence — permet de regrouper plusieurs onglets/devices du même user */
+        /**
+         * @deprecated La présence distribuée est indexée de manière autoritaire par le serveur
+         * à l'aide de l'identité vérifiée (`user_id` extrait du JWT) et de l'identifiant de connexion WebSocket
+         * (`client_id` dans NATS KV). Une clé libre côté client n'est pas utilisée pour partitionner le cluster
+         * afin d'empêcher les collisions d'état et les risques d'usurpation d'identité.
+         */
         key?: string;
     };
     /** Configuration compatible Supabase sous `config` */
@@ -801,6 +892,9 @@ interface ChannelConfig {
             self?: boolean;
         };
         presence?: {
+            /**
+             * @deprecated Voir `ChannelConfig.presence.key`. L'identité de présence est sécurisée par `user_id`/`client_id`.
+             */
             key?: string;
         };
         private?: boolean;
@@ -1141,16 +1235,160 @@ interface NotificationStats {
         dead_lettered: number;
     }>;
 }
+type NotificationChannel = 'email' | 'sms' | 'push' | 'webhook';
+type NotificationStatus = 'queued' | 'processing' | 'sent' | 'failed' | 'delivered' | 'expired' | 'dead_lettered';
+type NotificationStatsWindow = '1h' | '24h' | '7d' | '30d';
+type NotificationAttemptStatus = 'processing' | 'sent' | 'failed' | 'retry_scheduled' | 'dead_lettered';
+type SettingsSource = 'project' | 'environment' | 'none';
+interface SmtpPublicSettings {
+    configured: boolean;
+    source: SettingsSource;
+    host?: string | null;
+    port?: number | null;
+    user?: string | null;
+    password_set: boolean;
+    from_email?: string | null;
+    from_name?: string | null;
+    tls: boolean;
+}
+interface TwilioPublicSettings {
+    configured: boolean;
+    source: SettingsSource;
+    account_sid_prefix?: string | null;
+    auth_token_set: boolean;
+    from_number?: string | null;
+    status_callback_url?: string | null;
+}
+interface FcmPublicSettings {
+    configured: boolean;
+    source: SettingsSource;
+    project_id?: string | null;
+    service_account_json_set: boolean;
+    legacy_server_key_present: boolean;
+    api: string;
+}
+interface ApnsPublicSettings {
+    configured: boolean;
+    source: SettingsSource;
+    key_id?: string | null;
+    team_id?: string | null;
+    private_key_set: boolean;
+    bundle_id?: string | null;
+    production: boolean;
+}
+interface WebhookPublicSettings {
+    configured: boolean;
+    source: SettingsSource;
+    max_retries: number;
+    retry_delay_ms: number;
+    timeout_secs: number;
+    secret_set: boolean;
+    signature_tolerance_secs: number;
+}
+interface QuotaPublicSettings {
+    source: SettingsSource;
+    project_rate_limit_per_minute: number;
+    channel_rate_limit_per_minute: number;
+    batch_max_size: number;
+}
+interface SmtpSettingsPatch {
+    host?: string | null;
+    port?: number | null;
+    user?: string | null;
+    password?: string | null;
+    from_email?: string | null;
+    from_name?: string | null;
+    tls?: boolean | null;
+}
+interface TwilioSettingsPatch {
+    account_sid?: string | null;
+    auth_token?: string | null;
+    from_number?: string | null;
+}
+interface FcmSettingsPatch {
+    project_id?: string | null;
+    service_account_json?: string | null;
+}
+interface ApnsSettingsPatch {
+    key_id?: string | null;
+    team_id?: string | null;
+    private_key_b64?: string | null;
+    bundle_id?: string | null;
+    production?: boolean | null;
+}
+interface WebhookSettingsPatch {
+    max_retries?: number | null;
+    retry_delay_ms?: number | null;
+    timeout_secs?: number | null;
+    secret?: string | null;
+}
+interface QuotaSettingsPatch {
+    project_rate_limit_per_minute?: number | null;
+    channel_rate_limit_per_minute?: number | null;
+    batch_max_size?: number | null;
+}
+interface NotificationSettingsPatch {
+    smtp?: SmtpSettingsPatch | null;
+    twilio?: TwilioSettingsPatch | null;
+    fcm?: FcmSettingsPatch | null;
+    apns?: ApnsSettingsPatch | null;
+    webhook?: WebhookSettingsPatch | null;
+    quotas?: QuotaSettingsPatch | null;
+}
 interface NotificationSettings {
     project_id: string;
-    smtp?: Record<string, unknown>;
-    twilio?: Record<string, unknown>;
-    fcm?: Record<string, unknown>;
-    apns?: Record<string, unknown>;
-    webhook?: Record<string, unknown>;
-    quotas?: Record<string, unknown>;
+    smtp?: SmtpPublicSettings | Record<string, unknown>;
+    twilio?: TwilioPublicSettings | Record<string, unknown>;
+    fcm?: FcmPublicSettings | Record<string, unknown>;
+    apns?: ApnsPublicSettings | Record<string, unknown>;
+    webhook?: WebhookPublicSettings | Record<string, unknown>;
+    quotas?: QuotaPublicSettings | Record<string, unknown>;
     updated_at?: string | null;
 }
+type NotificationSettingsPublic = NotificationSettings;
+interface CreateNotificationRuleRequest {
+    name: string;
+    trigger_type: string;
+    condition?: Record<string, unknown>;
+    template_id?: string | null;
+    channel: NotificationChannel;
+    recipient_expr: string;
+    delay_seconds?: number;
+}
+interface UpdateNotificationRuleRequest {
+    name?: string;
+    enabled?: boolean;
+    trigger_type?: string;
+    condition?: Record<string, unknown>;
+    template_id?: string | null;
+    channel?: NotificationChannel;
+    recipient_expr?: string;
+    delay_seconds?: number;
+}
+interface SendNotificationOptions {
+    channel: NotificationChannel;
+    recipient: string;
+    body?: string;
+    subject?: string;
+    templateId?: string;
+    template_id?: string;
+    variables?: Record<string, unknown>;
+    metadata?: Record<string, unknown>;
+    idempotencyKey?: string;
+    idempotency_key?: string;
+}
+interface SendNotificationItem {
+    channel: NotificationChannel;
+    recipient: string;
+    body?: string;
+    subject?: string;
+    templateId?: string;
+    template_id?: string;
+    variables?: Record<string, unknown>;
+    metadata?: Record<string, unknown>;
+    idempotencyKey?: string;
+    idempotency_key?: string;
+}
 interface NotificationRule {
     id: string;
     project_id: string;
@@ -1158,7 +1396,7 @@ interface NotificationRule {
     trigger_type: string;
     condition: Record<string, unknown>;
     template_id?: string | null;
-    channel: 'email' | 'sms' | 'push' | 'webhook';
+    channel: NotificationChannel;
     recipient_expr: string;
     enabled: boolean;
     delay_seconds: number;
@@ -1513,6 +1751,10 @@ interface GetClaimsResult {
         kid?: string;
         typ?: string;
     };
+    sub?: string;
+    email?: string | null;
+    role?: string;
+    [key: string]: unknown;
 }
 
 type AuthChangeCallback = (token: string | null, user: User | null) => void;
@@ -1584,6 +1826,8 @@ interface AuraClientLike {
      */
     readonly baseUrl: string;
     readonly apiKey: string | null;
+    /** Identifiant optionnel du projet résolu ou configuré sur le client */
+    readonly projectId?: string;
     readonly fetchFn: typeof globalThis.fetch;
     readonly authStore: BaseAuthStore;
     /** Consommé uniquement par le service realtime (refresh proactif du token). */
@@ -1771,9 +2015,10 @@ declare class LocalAuthStore extends BaseAuthStore {
      * Serialize current auth state into a `Set-Cookie` value.
      */
     exportToCookie(options?: CookieOptions): string;
+    private _getStorage;
     private _loadFromStorage;
     private _persist;
     private _removeStorage;
 }
 
-export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationStats, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeEvent, type RealtimeListenType, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationRequest, type SerializeCookieOptions, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type SessionInfo, type SignInRequest, type SignUpRequest, type StorageBucket, type SubscribeCallback, type TokenPair, type UpdateUserRequest, type UploadResult, type User, type UserStats, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.d.ts

@@ -14,15 +14,16 @@
  *  - storage/path.ts   : invalid_path
  *  - db/QueryBuilder.ts: PGRST116 (parité PostgREST : `.single()` sur 0/plusieurs lignes)
  */
-type AuraErrorCode = 'no_session' | 'timeout' | 'network_error' | 'invalid_response' | 'refresh_discarded' | 'unverifiable_token' | 'no_code_verifier' | 'pkce_generation_failed' | 'missing_email' | 'jwks_fetch_failed' | 'signature_invalid' | 'token_expired' | 'token_not_yet_valid' | 'invalid_jwt' | 'unsupported_alg' | 'no_matching_key' | 'invalid_issuer' | 'invalid_audience' | 'invalid_path' | 'PGRST116' | (string & {});
+type AuraErrorCode = 'no_session' | 'timeout' | 'network_error' | 'invalid_response' | 'refresh_discarded' | 'unverifiable_token' | 'no_code_verifier' | 'pkce_generation_failed' | 'missing_email' | 'jwks_fetch_failed' | 'signature_invalid' | 'token_expired' | 'token_not_yet_valid' | 'invalid_jwt' | 'unsupported_alg' | 'no_matching_key' | 'invalid_issuer' | 'invalid_audience' | 'invalid_path' | 'PGRST116' | 'invalid_credentials' | 'weak_password' | 'email_already_in_use' | 'user_not_found' | 'rate_limit_exceeded' | 'session_expired' | 'session_revoked' | (string & {});
 /**
  * Structured error thrown/returned by the Aurabase SDK.
- * Mirrors the backend's `AuraError` JSON shape.
+ * Mirrors the backend's `AuraError` JSON shape with semantic DX normalization.
  */
 declare class AuraError extends Error {
     readonly status: number;
     readonly code: AuraErrorCode;
     readonly details: unknown;
+    readonly retryAfter?: number;
     /** Marqueur runtime pour `isAuraError` (détection cross-realm/cross-bundle). */
     protected readonly __isAuraError = true;
     constructor(status: number, body?: {
@@ -31,7 +32,7 @@ declare class AuraError extends Error {
             message?: string;
         };
         message?: string;
-    } | null);
+    } | null, headers?: Headers | Record<string, string | null | undefined>);
     get isNotFound(): boolean;
     get isUnauthorized(): boolean;
     get isForbidden(): boolean;
@@ -93,6 +94,11 @@ interface AuraSuccess<T> {
     data: T;
     error: null;
     meta?: Meta;
+    /**
+     * Nombre total de lignes correspondant à la requête (dérivé de meta.total).
+     * Renseigné quand un décompte explicite est demandé (.count('exact' | ...)).
+     */
+    count?: number | null;
 }
 /**
  * Réponse en SUCCÈS SANS contenu — `data` ET `error` nuls.
@@ -117,6 +123,10 @@ interface AuraNoContent {
     data: null;
     error: null;
     meta?: Meta;
+    /**
+     * Nombre total de lignes (dérivé de meta.total).
+     */
+    count?: number | null;
 }
 /**
  * Réponse en ÉCHEC. `data` y est `null` par construction — aucun producteur du
@@ -126,6 +136,7 @@ interface AuraFailure {
     data: null;
     error: AuraError;
     meta?: Meta;
+    count?: number | null;
 }
 /**
  * Enveloppe de réponse du SDK : union à TROIS membres.
@@ -175,19 +186,47 @@ interface User {
     created_at: string;
     last_sign_in_at?: string | null;
 }
+interface Session {
+    access_token: string;
+    refresh_token: string;
+    /** Alias camelCase pour parité DX Supabase/JS */
+    accessToken?: string;
+    /** Alias camelCase pour parité DX Supabase/JS */
+    refreshToken?: string;
+    token_type: string;
+    expires_in: number;
+    expires_at?: number;
+    user: User;
+    provider_token?: string | null;
+    provider_refresh_token?: string | null;
+}
 interface TokenPair {
     access_token: string;
     refresh_token: string;
+    /** Alias camelCase pour parité DX Supabase/JS */
+    accessToken?: string;
+    /** Alias camelCase pour parité DX Supabase/JS */
+    refreshToken?: string;
     token_type: string;
     expires_in: number;
     user: User;
     provider_token?: string | null;
     provider_refresh_token?: string | null;
+    /** Sous-objet session pour parité DX Supabase (`data.session.access_token`). */
+    session?: Session;
+    mfaChallenge?: undefined;
 }
 interface MfaChallenge {
     mfa_required: true;
     mfa_token: string;
     mfa_setup_required?: boolean;
+    session?: undefined;
+    /** Alias ergonomique aligné sur la documentation officielle */
+    mfaChallenge?: {
+        mfaRequired: boolean;
+        mfaToken: string;
+        mfaSetupRequired?: boolean;
+    };
 }
 type LoginResponse = TokenPair | MfaChallenge;
 type AuthEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED' | 'USER_UPDATED' | 'MFA_CHALLENGE' | 'PASSWORD_RECOVERY';
@@ -204,6 +243,8 @@ interface AuthChangePayload {
     event: AuthEvent;
     user: User | null;
     accessToken: string | null;
+    /** Session complète pour parité DX Supabase */
+    session?: Session | null;
     /** Présent uniquement si `event === 'MFA_CHALLENGE'`. */
     mfaToken?: string;
     /** Présent uniquement si `event === 'MFA_CHALLENGE'`. */
@@ -674,6 +715,51 @@ interface CdcPayload {
     record: Record<string, unknown>;
     old_record: Record<string, unknown> | null;
     _truncated?: boolean;
+    [key: string]: unknown;
+}
+/** Base commune des métadonnées pour un événement CDC PostgreSQL */
+interface RealtimePostgresChangesBasePayload {
+    schema: string;
+    table: string;
+    commit_timestamp: string;
+    errors?: string[];
+    id: string;
+    topic: string;
+    timestamp: string;
+    payload: CdcPayload | Record<string, unknown>;
+    event: 'insert' | 'update' | 'delete';
+}
+/** Payload enrichi pour un événement CDC PostgreSQL d'insertion */
+interface RealtimePostgresInsertPayload<T = Record<string, unknown>> extends RealtimePostgresChangesBasePayload {
+    eventType: 'INSERT';
+    event: 'insert';
+    new: T;
+    old: null;
+}
+/** Payload enrichi pour un événement CDC PostgreSQL de mise à jour */
+interface RealtimePostgresUpdatePayload<T = Record<string, unknown>> extends RealtimePostgresChangesBasePayload {
+    eventType: 'UPDATE';
+    event: 'update';
+    new: T;
+    old: Partial<T>;
+}
+/** Payload enrichi pour un événement CDC PostgreSQL de suppression */
+interface RealtimePostgresDeletePayload<T = Record<string, unknown>> extends RealtimePostgresChangesBasePayload {
+    eventType: 'DELETE';
+    event: 'delete';
+    new: null;
+    old: Partial<T> | null;
+}
+/** Union discriminée par eventType pour les événements CDC PostgreSQL */
+type RealtimePostgresChangesPayload<T = Record<string, unknown>> = RealtimePostgresInsertPayload<T> | RealtimePostgresUpdatePayload<T> | RealtimePostgresDeletePayload<T>;
+/** Événement broadcast reçu avec payload typé */
+interface RealtimeBroadcastEvent<T = Record<string, unknown>> {
+    event: string;
+    payload: T;
+    id?: string;
+    topic?: string;
+    timestamp?: string;
+    allowed_sub_ids?: string[];
 }
 /** Status de subscription */
 type RealtimeSubscribeStatus = 'SUBSCRIBED' | 'CLOSED' | 'CHANNEL_ERROR' | 'TIMED_OUT';
@@ -791,7 +877,12 @@ interface ChannelConfig {
     };
     /** Configuration présence directe */
     presence?: {
-        /** Clé de présence — permet de regrouper plusieurs onglets/devices du même user */
+        /**
+         * @deprecated La présence distribuée est indexée de manière autoritaire par le serveur
+         * à l'aide de l'identité vérifiée (`user_id` extrait du JWT) et de l'identifiant de connexion WebSocket
+         * (`client_id` dans NATS KV). Une clé libre côté client n'est pas utilisée pour partitionner le cluster
+         * afin d'empêcher les collisions d'état et les risques d'usurpation d'identité.
+         */
         key?: string;
     };
     /** Configuration compatible Supabase sous `config` */
@@ -801,6 +892,9 @@ interface ChannelConfig {
             self?: boolean;
         };
         presence?: {
+            /**
+             * @deprecated Voir `ChannelConfig.presence.key`. L'identité de présence est sécurisée par `user_id`/`client_id`.
+             */
             key?: string;
         };
         private?: boolean;
@@ -1141,16 +1235,160 @@ interface NotificationStats {
         dead_lettered: number;
     }>;
 }
+type NotificationChannel = 'email' | 'sms' | 'push' | 'webhook';
+type NotificationStatus = 'queued' | 'processing' | 'sent' | 'failed' | 'delivered' | 'expired' | 'dead_lettered';
+type NotificationStatsWindow = '1h' | '24h' | '7d' | '30d';
+type NotificationAttemptStatus = 'processing' | 'sent' | 'failed' | 'retry_scheduled' | 'dead_lettered';
+type SettingsSource = 'project' | 'environment' | 'none';
+interface SmtpPublicSettings {
+    configured: boolean;
+    source: SettingsSource;
+    host?: string | null;
+    port?: number | null;
+    user?: string | null;
+    password_set: boolean;
+    from_email?: string | null;
+    from_name?: string | null;
+    tls: boolean;
+}
+interface TwilioPublicSettings {
+    configured: boolean;
+    source: SettingsSource;
+    account_sid_prefix?: string | null;
+    auth_token_set: boolean;
+    from_number?: string | null;
+    status_callback_url?: string | null;
+}
+interface FcmPublicSettings {
+    configured: boolean;
+    source: SettingsSource;
+    project_id?: string | null;
+    service_account_json_set: boolean;
+    legacy_server_key_present: boolean;
+    api: string;
+}
+interface ApnsPublicSettings {
+    configured: boolean;
+    source: SettingsSource;
+    key_id?: string | null;
+    team_id?: string | null;
+    private_key_set: boolean;
+    bundle_id?: string | null;
+    production: boolean;
+}
+interface WebhookPublicSettings {
+    configured: boolean;
+    source: SettingsSource;
+    max_retries: number;
+    retry_delay_ms: number;
+    timeout_secs: number;
+    secret_set: boolean;
+    signature_tolerance_secs: number;
+}
+interface QuotaPublicSettings {
+    source: SettingsSource;
+    project_rate_limit_per_minute: number;
+    channel_rate_limit_per_minute: number;
+    batch_max_size: number;
+}
+interface SmtpSettingsPatch {
+    host?: string | null;
+    port?: number | null;
+    user?: string | null;
+    password?: string | null;
+    from_email?: string | null;
+    from_name?: string | null;
+    tls?: boolean | null;
+}
+interface TwilioSettingsPatch {
+    account_sid?: string | null;
+    auth_token?: string | null;
+    from_number?: string | null;
+}
+interface FcmSettingsPatch {
+    project_id?: string | null;
+    service_account_json?: string | null;
+}
+interface ApnsSettingsPatch {
+    key_id?: string | null;
+    team_id?: string | null;
+    private_key_b64?: string | null;
+    bundle_id?: string | null;
+    production?: boolean | null;
+}
+interface WebhookSettingsPatch {
+    max_retries?: number | null;
+    retry_delay_ms?: number | null;
+    timeout_secs?: number | null;
+    secret?: string | null;
+}
+interface QuotaSettingsPatch {
+    project_rate_limit_per_minute?: number | null;
+    channel_rate_limit_per_minute?: number | null;
+    batch_max_size?: number | null;
+}
+interface NotificationSettingsPatch {
+    smtp?: SmtpSettingsPatch | null;
+    twilio?: TwilioSettingsPatch | null;
+    fcm?: FcmSettingsPatch | null;
+    apns?: ApnsSettingsPatch | null;
+    webhook?: WebhookSettingsPatch | null;
+    quotas?: QuotaSettingsPatch | null;
+}
 interface NotificationSettings {
     project_id: string;
-    smtp?: Record<string, unknown>;
-    twilio?: Record<string, unknown>;
-    fcm?: Record<string, unknown>;
-    apns?: Record<string, unknown>;
-    webhook?: Record<string, unknown>;
-    quotas?: Record<string, unknown>;
+    smtp?: SmtpPublicSettings | Record<string, unknown>;
+    twilio?: TwilioPublicSettings | Record<string, unknown>;
+    fcm?: FcmPublicSettings | Record<string, unknown>;
+    apns?: ApnsPublicSettings | Record<string, unknown>;
+    webhook?: WebhookPublicSettings | Record<string, unknown>;
+    quotas?: QuotaPublicSettings | Record<string, unknown>;
     updated_at?: string | null;
 }
+type NotificationSettingsPublic = NotificationSettings;
+interface CreateNotificationRuleRequest {
+    name: string;
+    trigger_type: string;
+    condition?: Record<string, unknown>;
+    template_id?: string | null;
+    channel: NotificationChannel;
+    recipient_expr: string;
+    delay_seconds?: number;
+}
+interface UpdateNotificationRuleRequest {
+    name?: string;
+    enabled?: boolean;
+    trigger_type?: string;
+    condition?: Record<string, unknown>;
+    template_id?: string | null;
+    channel?: NotificationChannel;
+    recipient_expr?: string;
+    delay_seconds?: number;
+}
+interface SendNotificationOptions {
+    channel: NotificationChannel;
+    recipient: string;
+    body?: string;
+    subject?: string;
+    templateId?: string;
+    template_id?: string;
+    variables?: Record<string, unknown>;
+    metadata?: Record<string, unknown>;
+    idempotencyKey?: string;
+    idempotency_key?: string;
+}
+interface SendNotificationItem {
+    channel: NotificationChannel;
+    recipient: string;
+    body?: string;
+    subject?: string;
+    templateId?: string;
+    template_id?: string;
+    variables?: Record<string, unknown>;
+    metadata?: Record<string, unknown>;
+    idempotencyKey?: string;
+    idempotency_key?: string;
+}
 interface NotificationRule {
     id: string;
     project_id: string;
@@ -1158,7 +1396,7 @@ interface NotificationRule {
     trigger_type: string;
     condition: Record<string, unknown>;
     template_id?: string | null;
-    channel: 'email' | 'sms' | 'push' | 'webhook';
+    channel: NotificationChannel;
     recipient_expr: string;
     enabled: boolean;
     delay_seconds: number;
@@ -1513,6 +1751,10 @@ interface GetClaimsResult {
         kid?: string;
         typ?: string;
     };
+    sub?: string;
+    email?: string | null;
+    role?: string;
+    [key: string]: unknown;
 }
 
 type AuthChangeCallback = (token: string | null, user: User | null) => void;
@@ -1584,6 +1826,8 @@ interface AuraClientLike {
      */
     readonly baseUrl: string;
     readonly apiKey: string | null;
+    /** Identifiant optionnel du projet résolu ou configuré sur le client */
+    readonly projectId?: string;
     readonly fetchFn: typeof globalThis.fetch;
     readonly authStore: BaseAuthStore;
     /** Consommé uniquement par le service realtime (refresh proactif du token). */
@@ -1771,9 +2015,10 @@ declare class LocalAuthStore extends BaseAuthStore {
      * Serialize current auth state into a `Set-Cookie` value.
      */
     exportToCookie(options?: CookieOptions): string;
+    private _getStorage;
     private _loadFromStorage;
     private _persist;
     private _removeStorage;
 }
 
-export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationStats, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeEvent, type RealtimeListenType, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationRequest, type SerializeCookieOptions, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type SessionInfo, type SignInRequest, type SignUpRequest, type StorageBucket, type SubscribeCallback, type TokenPair, type UpdateUserRequest, type UploadResult, type User, type UserStats, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.js

@@ -3,15 +3,60 @@ var AuraError = class _AuraError extends Error {
   status;
   code;
   details;
+  retryAfter;
   /** Marqueur runtime pour `isAuraError` (détection cross-realm/cross-bundle). */
   __isAuraError = true;
-  constructor(status, body) {
-    const message = body?.error?.message ?? body?.message ?? `HTTP ${status}`;
-    super(message);
+  constructor(status, body, headers) {
+    let rawMessage = body?.error?.message ?? body?.message ?? (status === 429 ? "Trop de requ\xEAtes, veuillez patienter avant de r\xE9essayer." : `HTTP ${status}`);
+    let retryAfterSec;
+    if (headers) {
+      const getHeader = (name) => {
+        if (typeof headers.get === "function") {
+          return headers.get(name);
+        }
+        const record = headers;
+        return record[name] ?? record[name.toLowerCase()];
+      };
+      const ra = getHeader("retry-after") ?? getHeader("x-ratelimit-after");
+      if (ra) {
+        const sec = parseInt(ra, 10);
+        if (!isNaN(sec)) {
+          retryAfterSec = sec;
+          if (status === 429) {
+            rawMessage = `Trop de requ\xEAtes, veuillez patienter ${sec} seconde${sec > 1 ? "s" : ""} avant de r\xE9essayer.`;
+          }
+        }
+      }
+    }
+    super(rawMessage);
     this.name = "AuraError";
     this.status = status;
-    this.code = body?.error?.code ?? `http_${status}`;
     this.details = body;
+    if (retryAfterSec !== void 0) {
+      this.retryAfter = retryAfterSec;
+    }
+    const rawCode = body?.error?.code;
+    const lowerMsg = rawMessage.toLowerCase();
+    const isGenericHttpCode = typeof rawCode !== "string" || rawCode === "UNAUTHORIZED" || rawCode === "BAD_REQUEST" || rawCode === "CONFLICT" || rawCode === "RATE_LIMITED" || rawCode.startsWith("http_");
+    if (!isGenericHttpCode) {
+      this.code = rawCode;
+    } else if (status === 429 || rawCode === "RATE_LIMITED" || rawCode === "http_429") {
+      this.code = "rate_limit_exceeded";
+    } else if (status === 401 && (lowerMsg.includes("identifiants") || lowerMsg.includes("credentials") || lowerMsg.includes("mot de passe incorrect"))) {
+      this.code = "invalid_credentials";
+    } else if (status === 401 && lowerMsg.includes("r\xE9voqu\xE9e")) {
+      this.code = "session_revoked";
+    } else if (status === 401 && lowerMsg.includes("expir\xE9")) {
+      this.code = "session_expired";
+    } else if (status === 400 && (lowerMsg.includes("mot de passe") || lowerMsg.includes("password"))) {
+      this.code = "weak_password";
+    } else if (status === 409 && (lowerMsg.includes("d\xE9j\xE0 utilis\xE9") || lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
+      this.code = "email_already_in_use";
+    } else if (status === 404 && lowerMsg.includes("utilisateur")) {
+      this.code = "user_not_found";
+    } else {
+      this.code = rawCode ?? `http_${status}`;
+    }
     Object.setPrototypeOf(this, _AuraError.prototype);
   }
   get isNotFound() {
@@ -298,6 +343,15 @@ function unwrapEnvelope(body) {
   }
   return body;
 }
+function parseContentRangeTotal(headerVal) {
+  if (!headerVal) return void 0;
+  const parts = headerVal.split("/");
+  if (parts.length === 2 && parts[1] !== "*") {
+    const n = parseInt(parts[1], 10);
+    if (!Number.isNaN(n)) return n;
+  }
+  return void 0;
+}
 async function readTextBounded(res, timeoutMs) {
   const body = res.body;
   if (!body || typeof body.getReader !== "function" || !(timeoutMs > 0)) {
@@ -646,11 +700,12 @@ async function fetchWithAuth(url, init, client) {
         try {
           body2 = JSON.parse(errRead.text);
         } catch {
+          body2 = { message: errRead.text.trim() };
         }
       } else if (!errRead.ok && errRead.timedOut) {
         emitAuraEvent(client.onEvent, client.debug, { kind: "timeout", url });
       }
-      return { data: null, error: new AuraError(res.status, body2) };
+      return { data: null, error: new AuraError(res.status, body2, res.headers) };
     }
     const read = await readTextBounded(res, bodyTimeoutMs);
     if (!read.ok) {
@@ -678,7 +733,11 @@ async function fetchWithAuth(url, init, client) {
     }
     const raw = read.text;
     if (raw.trim() === "") {
-      return { data: null, error: null };
+      const cr2 = res.headers.get("content-range") ?? res.headers.get("Content-Range");
+      const totalFromCr2 = parseContentRangeTotal(cr2);
+      const meta2 = totalFromCr2 !== void 0 ? { total: totalFromCr2 } : void 0;
+      const count2 = totalFromCr2 !== void 0 ? totalFromCr2 : null;
+      return { data: null, error: null, meta: meta2, count: count2 };
     }
     let body;
     try {
@@ -697,11 +756,15 @@ async function fetchWithAuth(url, init, client) {
       };
     }
     const unwrapped = unwrapEnvelope(body);
-    const meta = body !== null && typeof body === "object" && "meta" in body ? body.meta : void 0;
+    const cr = res.headers.get("content-range") ?? res.headers.get("Content-Range");
+    const totalFromCr = parseContentRangeTotal(cr);
+    const rawMeta = body !== null && typeof body === "object" && "meta" in body ? body.meta : void 0;
+    const meta = rawMeta !== void 0 ? rawMeta : totalFromCr !== void 0 ? { total: totalFromCr } : void 0;
+    const count = meta?.total !== void 0 ? meta.total : totalFromCr ?? null;
     if (unwrapped === null) {
-      return { data: null, error: null, meta };
+      return { data: null, error: null, meta, count };
     }
-    return { data: unwrapped, error: null, meta };
+    return { data: unwrapped, error: null, meta, count };
   }
 }
 
@@ -787,14 +850,15 @@ var LocalAuthStore = class extends BaseAuthStore {
    * (`clientScope`, dérivée de l'URL du projet).
    */
   _removePkceVerifiers() {
-    if (typeof localStorage === "undefined") return;
+    const storage = this._getStorage();
+    if (!storage) return;
     try {
       const toRemove = [];
-      for (let i = 0; i < localStorage.length; i++) {
-        const k = localStorage.key(i);
+      for (let i = 0; i < storage.length; i++) {
+        const k = storage.key(i);
         if (k && /^aura-.*-(pkce-code-verifier|oauth-implicit-initiated)$/.test(k)) toRemove.push(k);
       }
-      for (const k of toRemove) localStorage.removeItem(k);
+      for (const k of toRemove) storage.removeItem(k);
     } catch {
       this._emitStorageBlocked("removePkceVerifiers");
     }
@@ -805,17 +869,19 @@ var LocalAuthStore = class extends BaseAuthStore {
   // ne survivrait pas à ce cycle de navigation.
   setItem(key, value) {
     super.setItem(key, value);
-    if (typeof localStorage === "undefined") return;
+    const storage = this._getStorage();
+    if (!storage) return;
     try {
-      localStorage.setItem(key, value);
+      storage.setItem(key, value);
     } catch {
       this._emitStorageBlocked("setItem");
     }
   }
   getItem(key) {
-    if (typeof localStorage === "undefined") return super.getItem(key);
+    const storage = this._getStorage();
+    if (!storage) return super.getItem(key);
     try {
-      const v = localStorage.getItem(key);
+      const v = storage.getItem(key);
       if (v !== null) return v;
     } catch {
       this._emitStorageBlocked("getItem");
@@ -824,9 +890,10 @@ var LocalAuthStore = class extends BaseAuthStore {
   }
   removeItem(key) {
     super.removeItem(key);
-    if (typeof localStorage === "undefined") return;
+    const storage = this._getStorage();
+    if (!storage) return;
     try {
-      localStorage.removeItem(key);
+      storage.removeItem(key);
     } catch {
       this._emitStorageBlocked("removeItem");
     }
@@ -869,10 +936,40 @@ var LocalAuthStore = class extends BaseAuthStore {
     return parts.join("; ");
   }
   // -- Private ----------------------------------------------------------------
+  _getStorage() {
+    if (typeof window !== "undefined" && typeof window.localStorage !== "undefined") {
+      return window.localStorage;
+    }
+    const g = globalThis;
+    if (typeof g !== "undefined") {
+      const proc = g.process;
+      if (typeof proc !== "undefined") {
+        const env = proc.env;
+        const isTest = !!(env?.VITEST || env?.NODE_ENV === "test" || env?.JEST_WORKER_ID);
+        const execArgv = proc.execArgv;
+        const hasFlag = Array.isArray(execArgv) && execArgv.some((a) => typeof a === "string" && a.startsWith("--localstorage-file"));
+        if (isTest || hasFlag) {
+          try {
+            const s = g.localStorage;
+            if (s && typeof s.getItem === "function") return s;
+          } catch {
+          }
+        }
+        return null;
+      }
+      try {
+        const s = g.localStorage;
+        if (s && typeof s.getItem === "function") return s;
+      } catch {
+      }
+    }
+    return null;
+  }
   _loadFromStorage() {
-    if (typeof localStorage === "undefined") return;
+    const storage = this._getStorage();
+    if (!storage) return;
     try {
-      const raw = localStorage.getItem(this.key);
+      const raw = storage.getItem(this.key);
       if (!raw) return;
       const parsed = JSON.parse(raw);
       if (parsed.token && parsed.refreshToken && parsed.user) {
@@ -883,22 +980,24 @@ var LocalAuthStore = class extends BaseAuthStore {
     }
   }
   _persist() {
-    if (typeof localStorage === "undefined") return;
+    const storage = this._getStorage();
+    if (!storage) return;
     const data = {
       token: this.token,
       refreshToken: this.refreshToken,
       user: this.user
     };
     try {
-      localStorage.setItem(this.key, JSON.stringify(data));
+      storage.setItem(this.key, JSON.stringify(data));
     } catch {
       this._emitStorageBlocked("persist");
     }
   }
   _removeStorage() {
-    if (typeof localStorage === "undefined") return;
+    const storage = this._getStorage();
+    if (!storage) return;
     try {
-      localStorage.removeItem(this.key);
+      storage.removeItem(this.key);
     } catch {
       this._emitStorageBlocked("removeStorage");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/core",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Cœur du SDK Aurabase : fetch résilient, erreurs, stores auth, types de réponse (infrastructure interne)",
   "type": "module",
   "main": "dist/index.cjs",