@aurabase/core 0.6.0 → 0.6.2

package/README.md

@@ -149,7 +149,7 @@ function hydrateFromCookieHeader(cookieHeader: string) {
 const store = hydrateFromCookieHeader(`${CLE}=%7B%22token%22%3Anull%7D`)
 
 // Après une mutation de session, sérialiser l'état courant en Set-Cookie.
-const setCookieValue = store.exportToCookie({ path: '/', secure: true, sameSite: 'Lax', httpOnly: true })
+const setCookieValue = store.exportToCookie({ path: '/', secure: true, sameSite: 'lax', httpOnly: true })
 ```
 
 `store.persistent` indique si le store survit à un redirect pleine page (`false` pour `BaseAuthStore`, `true` pour `LocalAuthStore`) — c'est ce flag que le flux OAuth PKCE utilise pour décider s'il peut stocker un `code_verifier` de façon fiable.

package/dist/index.cjs

@@ -1,15 +1,51 @@
 'use strict';
 
 // src/AuraError.ts
+var LEGACY_LOWERCASE_CODES = /* @__PURE__ */ new Set([
+  "NO_SESSION",
+  "TIMEOUT",
+  "NETWORK_ERROR",
+  "INVALID_RESPONSE",
+  "REFRESH_DISCARDED",
+  "UNVERIFIABLE_TOKEN",
+  "NO_CODE_VERIFIER",
+  "PKCE_GENERATION_FAILED",
+  "MISSING_EMAIL",
+  "JWKS_FETCH_FAILED",
+  "SIGNATURE_INVALID",
+  "TOKEN_EXPIRED",
+  "TOKEN_NOT_YET_VALID",
+  "INVALID_JWT",
+  "UNSUPPORTED_ALG",
+  "NO_MATCHING_KEY",
+  "INVALID_ISSUER",
+  "INVALID_AUDIENCE",
+  "INVALID_PATH",
+  "INVALID_CREDENTIALS",
+  "WEAK_PASSWORD",
+  "EMAIL_ALREADY_IN_USE",
+  "USER_NOT_FOUND",
+  "SESSION_EXPIRED",
+  "INVALID_OTP",
+  "SESSION_REVOKED"
+]);
+function normalizeErrorCode(code) {
+  return code.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase();
+}
 var AuraError = class _AuraError extends Error {
   status;
   code;
   details;
   retryAfter;
+  /**
+   * Piste de correction fournie par le serveur (ex. refus RLS : quelle politique créer). J1-010.
+   */
+  hint;
   /** Marqueur runtime pour `isAuraError` (détection cross-realm/cross-bundle). */
   __isAuraError = true;
   constructor(status, body, headers) {
-    let rawMessage = body?.error?.message ?? body?.message ?? (status === 429 ? "Trop de requ\xEAtes, veuillez patienter avant de r\xE9essayer." : `HTTP ${status}`);
+    const serverMessage = body?.error?.message ?? body?.message;
+    let rawMessage = serverMessage ?? (status === 429 ? "Too many requests, please wait before retrying." : `HTTP ${status}`);
     let retryAfterSec;
     if (headers) {
       const getHeader = (name) => {
@@ -24,8 +60,8 @@ var AuraError = class _AuraError extends Error {
         const sec = parseInt(ra, 10);
         if (!isNaN(sec)) {
           retryAfterSec = sec;
-          if (status === 429) {
-            rawMessage = `Trop de requ\xEAtes, veuillez patienter ${sec} seconde${sec > 1 ? "s" : ""} avant de r\xE9essayer.`;
+          if (status === 429 && !serverMessage) {
+            rawMessage = `Too many requests, please wait ${sec} second${sec > 1 ? "s" : ""} before retrying.`;
           }
         }
       }
@@ -37,30 +73,47 @@ var AuraError = class _AuraError extends Error {
     if (retryAfterSec !== void 0) {
       this.retryAfter = retryAfterSec;
     }
-    const rawCode = body?.error?.code;
+    const hint = body?.error?.hint;
+    if (typeof hint === "string" && hint) {
+      this.hint = hint;
+    }
+    const rawCode = typeof body?.error?.code === "string" ? body.error.code : void 0;
+    const canonical = rawCode ? normalizeErrorCode(rawCode) : void 0;
     const lowerMsg = rawMessage.toLowerCase();
-    const isGenericHttpCode = typeof rawCode !== "string" || rawCode === "UNAUTHORIZED" || rawCode === "BAD_REQUEST" || rawCode === "CONFLICT" || rawCode === "RATE_LIMITED" || rawCode.startsWith("http_");
-    if (!isGenericHttpCode) {
-      this.code = rawCode;
-    } else if (status === 429 || rawCode === "RATE_LIMITED" || rawCode === "http_429") {
-      this.code = "rate_limit_exceeded";
+    if (canonical === "USER_ALREADY_EXISTS") {
+      this.code = "EMAIL_ALREADY_IN_USE";
+    } else if (canonical === "TOKEN_EXPIRED" && status === 401) {
+      this.code = "SESSION_EXPIRED";
+    } else if (canonical === "RATE_LIMIT_EXCEEDED") {
+      this.code = "RATE_LIMITED";
+    } else if (canonical && !isGenericCode(canonical)) {
+      this.code = canonical;
+    } else if (status === 429) {
+      this.code = "RATE_LIMITED";
     } else if (status === 401 && (lowerMsg.includes("identifiants") || lowerMsg.includes("credentials") || lowerMsg.includes("mot de passe incorrect"))) {
-      this.code = "invalid_credentials";
-    } else if (status === 401 && lowerMsg.includes("r\xE9voqu\xE9e")) {
-      this.code = "session_revoked";
-    } else if (status === 401 && lowerMsg.includes("expir\xE9")) {
-      this.code = "session_expired";
+      this.code = "INVALID_CREDENTIALS";
+    } else if (status === 401 && (lowerMsg.includes("r\xE9voqu\xE9e") || lowerMsg.includes("revoked"))) {
+      this.code = "SESSION_REVOKED";
+    } else if (status === 401 && (lowerMsg.includes("expir\xE9") || lowerMsg.includes("expired"))) {
+      this.code = "SESSION_EXPIRED";
     } else if (status === 400 && (lowerMsg.includes("mot de passe") || lowerMsg.includes("password"))) {
-      this.code = "weak_password";
+      this.code = "WEAK_PASSWORD";
     } else if (status === 409 && (lowerMsg.includes("d\xE9j\xE0 utilis\xE9") || lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
-      this.code = "email_already_in_use";
-    } else if (status === 404 && lowerMsg.includes("utilisateur")) {
-      this.code = "user_not_found";
+      this.code = "EMAIL_ALREADY_IN_USE";
+    } else if (status === 404 && (lowerMsg.includes("utilisateur") || lowerMsg.includes("user not found"))) {
+      this.code = "USER_NOT_FOUND";
     } else {
-      this.code = rawCode ?? `http_${status}`;
+      this.code = canonical ?? `HTTP_${status}`;
     }
     Object.setPrototypeOf(this, _AuraError.prototype);
   }
+  /**
+   * @deprecated Ancienne forme en minuscules de `code` (`invalid_credentials`, `no_session`…).
+   * Utilisez `error.code`, toujours en SCREAMING_SNAKE.
+   */
+  get legacyCode() {
+    return LEGACY_LOWERCASE_CODES.has(this.code) ? this.code.toLowerCase() : this.code;
+  }
   get isNotFound() {
     return this.status === 404;
   }
@@ -73,7 +126,17 @@ var AuraError = class _AuraError extends Error {
   get isRateLimited() {
     return this.status === 429;
   }
+  /**
+   * Quota mensuel du plan atteint (HTTP 403, `code: 'QUOTA_EXCEEDED'`). Le message nomme la
+   * métrique, l'usage, la limite et la date de remise à zéro ; ce n'est pas un refus d'autorisation.
+   */
+  get isQuotaExceeded() {
+    return this.code === "QUOTA_EXCEEDED";
+  }
 };
+function isGenericCode(code) {
+  return code === "UNAUTHORIZED" || code === "BAD_REQUEST" || code === "CONFLICT" || code.startsWith("HTTP_");
+}
 function isAuraError(error) {
   return error instanceof AuraError || typeof error === "object" && error !== null && error.__isAuraError === true;
 }
@@ -338,6 +401,17 @@ var BaseAuthStore = class {
 // src/fetch.ts
 var REFRESH_MARGIN_SEC = 30;
 var RETRY_AFTER_CAP_MS = 6e4;
+function networkErrorMessage(err, url) {
+  const cause = err?.cause;
+  const reason = cause?.code ?? cause?.message ?? (err instanceof Error ? err.message : "request failed");
+  let target = url;
+  try {
+    const u = new URL(url);
+    target = `${u.origin}${u.pathname}`;
+  } catch {
+  }
+  return `Cannot reach ${target} (${reason}). Check the project URL (NEXT_PUBLIC_AURABASE_URL) and your network.`;
+}
 var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
 function unwrapEnvelope(body) {
   if (body !== null && typeof body === "object" && "data" in body) {
@@ -459,7 +533,7 @@ async function doRefresh(client) {
       error: new AuraError(0, {
         error: timedOut ? { code: "timeout", message: `Refresh timed out after ${timeoutMs}ms` } : {
           code: "network_error",
-          message: err instanceof Error ? err.message : "Network request failed"
+          message: networkErrorMessage(err, `${client.baseUrl}/v1/auth/refresh`)
         }
       })
     };
@@ -660,7 +734,7 @@ async function fetchWithAuth(url, init, client) {
         error: new AuraError(0, {
           error: timedOut ? { code: "timeout", message: `Request timed out after ${timeoutMs}ms` } : {
             code: "network_error",
-            message: err instanceof Error ? err.message : "Network request failed"
+            message: networkErrorMessage(err, url)
           }
         })
       };
@@ -693,7 +767,9 @@ async function fetchWithAuth(url, init, client) {
       }
     }
     if (res.status === 204) {
-      return { data: null, error: null };
+      const totalFromCr2 = parseContentRangeTotal(res.headers.get("content-range"));
+      if (totalFromCr2 === void 0) return { data: null, error: null };
+      return { data: null, error: null, meta: { total: totalFromCr2 }, count: totalFromCr2 };
     }
     if (!res.ok) {
       let body2 = null;
@@ -807,13 +883,16 @@ function parseCookieHeader(header) {
   }
   return result;
 }
+function sameSiteAttribute(v) {
+  return v.charAt(0).toUpperCase() + v.slice(1);
+}
 function serializeCookieHeader(name, value, options = {}) {
   const parts = [`${name}=${encodeURIComponent(value)}`];
   if (options.path) parts.push(`Path=${options.path}`);
   if (options.domain) parts.push(`Domain=${options.domain}`);
   if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
   if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
+  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
   if (options.httpOnly) parts.push("HttpOnly");
   return parts.join("; ");
 }
@@ -933,7 +1012,7 @@ var LocalAuthStore = class extends BaseAuthStore {
     if (options.domain) parts.push(`Domain=${options.domain}`);
     if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
     if (options.secure) parts.push("Secure");
-    if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
+    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
     if (options.httpOnly) parts.push("HttpOnly");
     return parts.join("; ");
   }

package/dist/index.d.cts

@@ -14,7 +14,7 @@
  *  - storage/path.ts   : invalid_path
  *  - db/QueryBuilder.ts: PGRST116 (parité PostgREST : `.single()` sur 0/plusieurs lignes)
  */
-type AuraErrorCode = 'no_session' | 'timeout' | 'network_error' | 'invalid_response' | 'refresh_discarded' | 'unverifiable_token' | 'no_code_verifier' | 'pkce_generation_failed' | 'missing_email' | 'jwks_fetch_failed' | 'signature_invalid' | 'token_expired' | 'token_not_yet_valid' | 'invalid_jwt' | 'unsupported_alg' | 'no_matching_key' | 'invalid_issuer' | 'invalid_audience' | 'invalid_path' | 'PGRST116' | 'invalid_credentials' | 'weak_password' | 'email_already_in_use' | 'user_not_found' | 'rate_limit_exceeded' | 'session_expired' | 'session_revoked' | (string & {});
+type AuraErrorCode = 'NO_SESSION' | 'TIMEOUT' | 'NETWORK_ERROR' | 'INVALID_RESPONSE' | 'REFRESH_DISCARDED' | 'UNVERIFIABLE_TOKEN' | 'NO_CODE_VERIFIER' | 'PKCE_GENERATION_FAILED' | 'MISSING_EMAIL' | 'JWKS_FETCH_FAILED' | 'SIGNATURE_INVALID' | 'TOKEN_EXPIRED' | 'TOKEN_NOT_YET_VALID' | 'INVALID_JWT' | 'UNSUPPORTED_ALG' | 'NO_MATCHING_KEY' | 'INVALID_ISSUER' | 'INVALID_AUDIENCE' | 'INVALID_PATH' | 'PGRST116' | 'INVALID_CREDENTIALS' | 'WEAK_PASSWORD' | 'EMAIL_ALREADY_IN_USE' | 'USER_NOT_FOUND' | 'RATE_LIMITED' | 'SESSION_EXPIRED' | 'INVALID_OTP' | 'SESSION_REVOKED' | (string & {});
 /**
  * Structured error thrown/returned by the Aurabase SDK.
  * Mirrors the backend's `AuraError` JSON shape with semantic DX normalization.
@@ -24,6 +24,10 @@ declare class AuraError extends Error {
     readonly code: AuraErrorCode;
     readonly details: unknown;
     readonly retryAfter?: number;
+    /**
+     * Piste de correction fournie par le serveur (ex. refus RLS : quelle politique créer). J1-010.
+     */
+    readonly hint?: string;
     /** Marqueur runtime pour `isAuraError` (détection cross-realm/cross-bundle). */
     protected readonly __isAuraError = true;
     constructor(status: number, body?: {
@@ -33,10 +37,20 @@ declare class AuraError extends Error {
         };
         message?: string;
     } | null, headers?: Headers | Record<string, string | null | undefined>);
+    /**
+     * @deprecated Ancienne forme en minuscules de `code` (`invalid_credentials`, `no_session`…).
+     * Utilisez `error.code`, toujours en SCREAMING_SNAKE.
+     */
+    get legacyCode(): string;
     get isNotFound(): boolean;
     get isUnauthorized(): boolean;
     get isForbidden(): boolean;
     get isRateLimited(): boolean;
+    /**
+     * Quota mensuel du plan atteint (HTTP 403, `code: 'QUOTA_EXCEEDED'`). Le message nomme la
+     * métrique, l'usage, la limite et la date de remise à zéro ; ce n'est pas un refus d'autorisation.
+     */
+    get isQuotaExceeded(): boolean;
 }
 declare function isAuraError(error: unknown): error is AuraError;
 
@@ -260,12 +274,18 @@ interface AuthChangePayload {
 interface SignUpRequest {
     email: string;
     password: string;
+    name?: string;
     captcha_token?: string;
+    options?: {
+        emailRedirectTo?: string;
+        data?: Record<string, unknown>;
+    };
 }
 interface SignInRequest {
     email: string;
     password: string;
     captcha_token?: string;
+    mfa?: 'required' | 'optional';
 }
 interface MagicLinkRequest {
     email: string;
@@ -329,6 +349,10 @@ interface OAuthSignInOptions {
      */
     flowType?: 'pkce' | 'implicit';
 }
+interface OAuthSignInObjectOptions extends OAuthSignInOptions {
+    provider: string;
+    options?: OAuthSignInOptions;
+}
 interface PasswordResetRequest {
     email: string;
 }
@@ -646,7 +670,7 @@ interface ObjectMeta {
     metadata: Record<string, string>;
 }
 /** Événement serveur brut reçu via WebSocket (union discriminée par type) */
-type ServerMessage = ServerSubscribedMsg | ServerEventMsg | ServerPongMsg | ServerErrorMsg | ServerTokenRefreshedMsg | ServerPresenceStateMsg | BroadcastAckMessage;
+type ServerMessage = ServerSubscribedMsg | ServerEventMsg | ServerPongMsg | ServerErrorMsg | ServerTokenRefreshedMsg | ServerPresenceStateMsg | BroadcastAckMessage | ServerChannelRecoveredMsg;
 interface ServerSubscribedMsg {
     type: 'subscribed';
     channel: string;
@@ -689,6 +713,14 @@ interface ServerPresenceStateMsg {
     channel: string;
     presences: PresenceInfo[];
 }
+/**
+ * L'écoute `postgres_changes` qui avait valu une erreur (`CHANNEL_ERROR`) à ce canal est rétablie :
+ * les changements reprennent. Le SDK repasse le canal en `SUBSCRIBED`.
+ */
+interface ServerChannelRecoveredMsg {
+    type: 'channel_recovered';
+    channel: string;
+}
 /** Événement realtime (CDC, broadcast, presence) */
 interface RealtimeEvent<T = Record<string, unknown>> {
     id: string;
@@ -741,6 +773,11 @@ interface RealtimePostgresUpdatePayload<T = Record<string, unknown>> extends Rea
     eventType: 'UPDATE';
     event: 'update';
     new: T;
+    /**
+     * Colonnes de **clé primaire** de l'ancienne ligne seulement (`{}` si la table n'en a pas), jamais
+     * ses autres valeurs : la sécurité au niveau des lignes n'est évaluée que sur la nouvelle ligne.
+     * Si la clé a changé, ce sont les valeurs d'avant.
+     */
     old: Partial<T>;
 }
 /** Payload enrichi pour un événement CDC PostgreSQL de suppression */
@@ -748,6 +785,7 @@ interface RealtimePostgresDeletePayload<T = Record<string, unknown>> extends Rea
     eventType: 'DELETE';
     event: 'delete';
     new: null;
+    /** Colonnes de **clé primaire** de la ligne supprimée seulement (`{}` si la table n'en a pas). */
     old: Partial<T> | null;
 }
 /** Union discriminée par eventType pour les événements CDC PostgreSQL */
@@ -803,12 +841,14 @@ interface PostgresChangesFilter {
      * (defense-in-depth) : il ne peut que sur-filtrer, jamais faire fuiter un
      * event que le serveur aurait dû exclure.
      *
+     * **INSERT / UPDATE** : le prédicat est évalué sur la **nouvelle ligne** (`record`).
+     *
      * **DELETE** : le prédicat est évalué sur l'**ancienne ligne** (`old_record`),
-     * puisque le `record` d'un DELETE est vide côté CDC. Si votre table utilise
-     * `REPLICA IDENTITY DEFAULT`, `old_record` ne contient que la clé primaire —
-     * un filtre sur une autre colonne exclura systématiquement les DELETE, **sauf
-     * `is.null`/`isdistinct`** qui traitent une colonne absente comme `NULL` et
-     * peuvent donc matcher même sans cette colonne dans `old_record`.
+     * puisque le `record` d'un DELETE est vide côté CDC. `old_record` ne contient
+     * que la clé primaire (UPDATE comme DELETE) — un filtre sur une autre colonne
+     * exclura systématiquement les DELETE, **sauf `is.null`/`isdistinct`** qui
+     * traitent une colonne absente comme `NULL` et peuvent donc matcher même sans
+     * cette colonne dans `old_record`.
      */
     filter?: string;
 }
@@ -847,9 +887,13 @@ interface BroadcastFilter {
  *   consultable pour ce canal — laisser passer serait fail-open). C'est le modèle de
  *   Phoenix, dont dérive le protocole Supabase Realtime : on rejoint un topic avant d'y
  *   pousser quoi que ce soit. Appelez `.subscribe()` — et vérifiez le statut qu'il rend.
+ * - `'invalid_payload'` — le `payload` porte lui-même une clé `event`. Le nom de l'événement
+ *   voyage dans le payload du fil (`{ event, ...payload }`) : une clé `event` du payload
+ *   l'écraserait et le message serait routé sous un autre nom chez les abonnés. Rien n'est
+ *   émis ; renommez la clé (`eventName`, `kind`…).
  * - `'error'` — l'envoi lui-même a levé une exception (sérialisation, transport).
  */
-type BroadcastSendStatus = 'ok' | 'timeout' | 'not_connected' | 'requires_subscription' | 'error';
+type BroadcastSendStatus = 'ok' | 'timeout' | 'not_connected' | 'requires_subscription' | 'invalid_payload' | 'error';
 /** Config pour presence */
 interface PresenceFilter {
     event: 'sync' | 'join' | 'leave';
@@ -1897,7 +1941,8 @@ interface SerializeCookieOptions {
     domain?: string;
     maxAge?: number;
     secure?: boolean;
-    sameSite?: 'Strict' | 'Lax' | 'None';
+    /** Minuscules : forme acceptée par `ResponseCookie` de Next.js (`'lax' | 'strict' | 'none'`). */
+    sameSite?: 'strict' | 'lax' | 'none';
     httpOnly?: boolean;
 }
 /**
@@ -1905,7 +1950,6 @@ interface SerializeCookieOptions {
  */
 declare function serializeCookieHeader(name: string, value: string, options?: SerializeCookieOptions): string;
 
-/** Timeout par défaut d'une requête HTTP (borne un serveur qui « hang »). */
 declare const DEFAULT_REQUEST_TIMEOUT_MS = 30000;
 /** Point d'entrée unique du refresh, dédupliqué par client (single-flight). */
 declare function refreshOnce(client: AuraClientLike): Promise<AuraResponse<TokenPair>>;
@@ -1980,7 +2024,7 @@ interface CookieOptions {
     domain?: string;
     maxAge?: number;
     secure?: boolean;
-    sameSite?: 'Strict' | 'Lax' | 'None';
+    sameSite?: 'strict' | 'lax' | 'none';
     httpOnly?: boolean;
 }
 /**
@@ -2035,4 +2079,4 @@ declare class LocalAuthStore extends BaseAuthStore {
     private _removeStorage;
 }
 
-export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.d.ts

@@ -14,7 +14,7 @@
  *  - storage/path.ts   : invalid_path
  *  - db/QueryBuilder.ts: PGRST116 (parité PostgREST : `.single()` sur 0/plusieurs lignes)
  */
-type AuraErrorCode = 'no_session' | 'timeout' | 'network_error' | 'invalid_response' | 'refresh_discarded' | 'unverifiable_token' | 'no_code_verifier' | 'pkce_generation_failed' | 'missing_email' | 'jwks_fetch_failed' | 'signature_invalid' | 'token_expired' | 'token_not_yet_valid' | 'invalid_jwt' | 'unsupported_alg' | 'no_matching_key' | 'invalid_issuer' | 'invalid_audience' | 'invalid_path' | 'PGRST116' | 'invalid_credentials' | 'weak_password' | 'email_already_in_use' | 'user_not_found' | 'rate_limit_exceeded' | 'session_expired' | 'session_revoked' | (string & {});
+type AuraErrorCode = 'NO_SESSION' | 'TIMEOUT' | 'NETWORK_ERROR' | 'INVALID_RESPONSE' | 'REFRESH_DISCARDED' | 'UNVERIFIABLE_TOKEN' | 'NO_CODE_VERIFIER' | 'PKCE_GENERATION_FAILED' | 'MISSING_EMAIL' | 'JWKS_FETCH_FAILED' | 'SIGNATURE_INVALID' | 'TOKEN_EXPIRED' | 'TOKEN_NOT_YET_VALID' | 'INVALID_JWT' | 'UNSUPPORTED_ALG' | 'NO_MATCHING_KEY' | 'INVALID_ISSUER' | 'INVALID_AUDIENCE' | 'INVALID_PATH' | 'PGRST116' | 'INVALID_CREDENTIALS' | 'WEAK_PASSWORD' | 'EMAIL_ALREADY_IN_USE' | 'USER_NOT_FOUND' | 'RATE_LIMITED' | 'SESSION_EXPIRED' | 'INVALID_OTP' | 'SESSION_REVOKED' | (string & {});
 /**
  * Structured error thrown/returned by the Aurabase SDK.
  * Mirrors the backend's `AuraError` JSON shape with semantic DX normalization.
@@ -24,6 +24,10 @@ declare class AuraError extends Error {
     readonly code: AuraErrorCode;
     readonly details: unknown;
     readonly retryAfter?: number;
+    /**
+     * Piste de correction fournie par le serveur (ex. refus RLS : quelle politique créer). J1-010.
+     */
+    readonly hint?: string;
     /** Marqueur runtime pour `isAuraError` (détection cross-realm/cross-bundle). */
     protected readonly __isAuraError = true;
     constructor(status: number, body?: {
@@ -33,10 +37,20 @@ declare class AuraError extends Error {
         };
         message?: string;
     } | null, headers?: Headers | Record<string, string | null | undefined>);
+    /**
+     * @deprecated Ancienne forme en minuscules de `code` (`invalid_credentials`, `no_session`…).
+     * Utilisez `error.code`, toujours en SCREAMING_SNAKE.
+     */
+    get legacyCode(): string;
     get isNotFound(): boolean;
     get isUnauthorized(): boolean;
     get isForbidden(): boolean;
     get isRateLimited(): boolean;
+    /**
+     * Quota mensuel du plan atteint (HTTP 403, `code: 'QUOTA_EXCEEDED'`). Le message nomme la
+     * métrique, l'usage, la limite et la date de remise à zéro ; ce n'est pas un refus d'autorisation.
+     */
+    get isQuotaExceeded(): boolean;
 }
 declare function isAuraError(error: unknown): error is AuraError;
 
@@ -260,12 +274,18 @@ interface AuthChangePayload {
 interface SignUpRequest {
     email: string;
     password: string;
+    name?: string;
     captcha_token?: string;
+    options?: {
+        emailRedirectTo?: string;
+        data?: Record<string, unknown>;
+    };
 }
 interface SignInRequest {
     email: string;
     password: string;
     captcha_token?: string;
+    mfa?: 'required' | 'optional';
 }
 interface MagicLinkRequest {
     email: string;
@@ -329,6 +349,10 @@ interface OAuthSignInOptions {
      */
     flowType?: 'pkce' | 'implicit';
 }
+interface OAuthSignInObjectOptions extends OAuthSignInOptions {
+    provider: string;
+    options?: OAuthSignInOptions;
+}
 interface PasswordResetRequest {
     email: string;
 }
@@ -646,7 +670,7 @@ interface ObjectMeta {
     metadata: Record<string, string>;
 }
 /** Événement serveur brut reçu via WebSocket (union discriminée par type) */
-type ServerMessage = ServerSubscribedMsg | ServerEventMsg | ServerPongMsg | ServerErrorMsg | ServerTokenRefreshedMsg | ServerPresenceStateMsg | BroadcastAckMessage;
+type ServerMessage = ServerSubscribedMsg | ServerEventMsg | ServerPongMsg | ServerErrorMsg | ServerTokenRefreshedMsg | ServerPresenceStateMsg | BroadcastAckMessage | ServerChannelRecoveredMsg;
 interface ServerSubscribedMsg {
     type: 'subscribed';
     channel: string;
@@ -689,6 +713,14 @@ interface ServerPresenceStateMsg {
     channel: string;
     presences: PresenceInfo[];
 }
+/**
+ * L'écoute `postgres_changes` qui avait valu une erreur (`CHANNEL_ERROR`) à ce canal est rétablie :
+ * les changements reprennent. Le SDK repasse le canal en `SUBSCRIBED`.
+ */
+interface ServerChannelRecoveredMsg {
+    type: 'channel_recovered';
+    channel: string;
+}
 /** Événement realtime (CDC, broadcast, presence) */
 interface RealtimeEvent<T = Record<string, unknown>> {
     id: string;
@@ -741,6 +773,11 @@ interface RealtimePostgresUpdatePayload<T = Record<string, unknown>> extends Rea
     eventType: 'UPDATE';
     event: 'update';
     new: T;
+    /**
+     * Colonnes de **clé primaire** de l'ancienne ligne seulement (`{}` si la table n'en a pas), jamais
+     * ses autres valeurs : la sécurité au niveau des lignes n'est évaluée que sur la nouvelle ligne.
+     * Si la clé a changé, ce sont les valeurs d'avant.
+     */
     old: Partial<T>;
 }
 /** Payload enrichi pour un événement CDC PostgreSQL de suppression */
@@ -748,6 +785,7 @@ interface RealtimePostgresDeletePayload<T = Record<string, unknown>> extends Rea
     eventType: 'DELETE';
     event: 'delete';
     new: null;
+    /** Colonnes de **clé primaire** de la ligne supprimée seulement (`{}` si la table n'en a pas). */
     old: Partial<T> | null;
 }
 /** Union discriminée par eventType pour les événements CDC PostgreSQL */
@@ -803,12 +841,14 @@ interface PostgresChangesFilter {
      * (defense-in-depth) : il ne peut que sur-filtrer, jamais faire fuiter un
      * event que le serveur aurait dû exclure.
      *
+     * **INSERT / UPDATE** : le prédicat est évalué sur la **nouvelle ligne** (`record`).
+     *
      * **DELETE** : le prédicat est évalué sur l'**ancienne ligne** (`old_record`),
-     * puisque le `record` d'un DELETE est vide côté CDC. Si votre table utilise
-     * `REPLICA IDENTITY DEFAULT`, `old_record` ne contient que la clé primaire —
-     * un filtre sur une autre colonne exclura systématiquement les DELETE, **sauf
-     * `is.null`/`isdistinct`** qui traitent une colonne absente comme `NULL` et
-     * peuvent donc matcher même sans cette colonne dans `old_record`.
+     * puisque le `record` d'un DELETE est vide côté CDC. `old_record` ne contient
+     * que la clé primaire (UPDATE comme DELETE) — un filtre sur une autre colonne
+     * exclura systématiquement les DELETE, **sauf `is.null`/`isdistinct`** qui
+     * traitent une colonne absente comme `NULL` et peuvent donc matcher même sans
+     * cette colonne dans `old_record`.
      */
     filter?: string;
 }
@@ -847,9 +887,13 @@ interface BroadcastFilter {
  *   consultable pour ce canal — laisser passer serait fail-open). C'est le modèle de
  *   Phoenix, dont dérive le protocole Supabase Realtime : on rejoint un topic avant d'y
  *   pousser quoi que ce soit. Appelez `.subscribe()` — et vérifiez le statut qu'il rend.
+ * - `'invalid_payload'` — le `payload` porte lui-même une clé `event`. Le nom de l'événement
+ *   voyage dans le payload du fil (`{ event, ...payload }`) : une clé `event` du payload
+ *   l'écraserait et le message serait routé sous un autre nom chez les abonnés. Rien n'est
+ *   émis ; renommez la clé (`eventName`, `kind`…).
  * - `'error'` — l'envoi lui-même a levé une exception (sérialisation, transport).
  */
-type BroadcastSendStatus = 'ok' | 'timeout' | 'not_connected' | 'requires_subscription' | 'error';
+type BroadcastSendStatus = 'ok' | 'timeout' | 'not_connected' | 'requires_subscription' | 'invalid_payload' | 'error';
 /** Config pour presence */
 interface PresenceFilter {
     event: 'sync' | 'join' | 'leave';
@@ -1897,7 +1941,8 @@ interface SerializeCookieOptions {
     domain?: string;
     maxAge?: number;
     secure?: boolean;
-    sameSite?: 'Strict' | 'Lax' | 'None';
+    /** Minuscules : forme acceptée par `ResponseCookie` de Next.js (`'lax' | 'strict' | 'none'`). */
+    sameSite?: 'strict' | 'lax' | 'none';
     httpOnly?: boolean;
 }
 /**
@@ -1905,7 +1950,6 @@ interface SerializeCookieOptions {
  */
 declare function serializeCookieHeader(name: string, value: string, options?: SerializeCookieOptions): string;
 
-/** Timeout par défaut d'une requête HTTP (borne un serveur qui « hang »). */
 declare const DEFAULT_REQUEST_TIMEOUT_MS = 30000;
 /** Point d'entrée unique du refresh, dédupliqué par client (single-flight). */
 declare function refreshOnce(client: AuraClientLike): Promise<AuraResponse<TokenPair>>;
@@ -1980,7 +2024,7 @@ interface CookieOptions {
     domain?: string;
     maxAge?: number;
     secure?: boolean;
-    sameSite?: 'Strict' | 'Lax' | 'None';
+    sameSite?: 'strict' | 'lax' | 'none';
     httpOnly?: boolean;
 }
 /**
@@ -2035,4 +2079,4 @@ declare class LocalAuthStore extends BaseAuthStore {
     private _removeStorage;
 }
 
-export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.js

@@ -1,13 +1,49 @@
 // src/AuraError.ts
+var LEGACY_LOWERCASE_CODES = /* @__PURE__ */ new Set([
+  "NO_SESSION",
+  "TIMEOUT",
+  "NETWORK_ERROR",
+  "INVALID_RESPONSE",
+  "REFRESH_DISCARDED",
+  "UNVERIFIABLE_TOKEN",
+  "NO_CODE_VERIFIER",
+  "PKCE_GENERATION_FAILED",
+  "MISSING_EMAIL",
+  "JWKS_FETCH_FAILED",
+  "SIGNATURE_INVALID",
+  "TOKEN_EXPIRED",
+  "TOKEN_NOT_YET_VALID",
+  "INVALID_JWT",
+  "UNSUPPORTED_ALG",
+  "NO_MATCHING_KEY",
+  "INVALID_ISSUER",
+  "INVALID_AUDIENCE",
+  "INVALID_PATH",
+  "INVALID_CREDENTIALS",
+  "WEAK_PASSWORD",
+  "EMAIL_ALREADY_IN_USE",
+  "USER_NOT_FOUND",
+  "SESSION_EXPIRED",
+  "INVALID_OTP",
+  "SESSION_REVOKED"
+]);
+function normalizeErrorCode(code) {
+  return code.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase();
+}
 var AuraError = class _AuraError extends Error {
   status;
   code;
   details;
   retryAfter;
+  /**
+   * Piste de correction fournie par le serveur (ex. refus RLS : quelle politique créer). J1-010.
+   */
+  hint;
   /** Marqueur runtime pour `isAuraError` (détection cross-realm/cross-bundle). */
   __isAuraError = true;
   constructor(status, body, headers) {
-    let rawMessage = body?.error?.message ?? body?.message ?? (status === 429 ? "Trop de requ\xEAtes, veuillez patienter avant de r\xE9essayer." : `HTTP ${status}`);
+    const serverMessage = body?.error?.message ?? body?.message;
+    let rawMessage = serverMessage ?? (status === 429 ? "Too many requests, please wait before retrying." : `HTTP ${status}`);
     let retryAfterSec;
     if (headers) {
       const getHeader = (name) => {
@@ -22,8 +58,8 @@ var AuraError = class _AuraError extends Error {
         const sec = parseInt(ra, 10);
         if (!isNaN(sec)) {
           retryAfterSec = sec;
-          if (status === 429) {
-            rawMessage = `Trop de requ\xEAtes, veuillez patienter ${sec} seconde${sec > 1 ? "s" : ""} avant de r\xE9essayer.`;
+          if (status === 429 && !serverMessage) {
+            rawMessage = `Too many requests, please wait ${sec} second${sec > 1 ? "s" : ""} before retrying.`;
           }
         }
       }
@@ -35,30 +71,47 @@ var AuraError = class _AuraError extends Error {
     if (retryAfterSec !== void 0) {
       this.retryAfter = retryAfterSec;
     }
-    const rawCode = body?.error?.code;
+    const hint = body?.error?.hint;
+    if (typeof hint === "string" && hint) {
+      this.hint = hint;
+    }
+    const rawCode = typeof body?.error?.code === "string" ? body.error.code : void 0;
+    const canonical = rawCode ? normalizeErrorCode(rawCode) : void 0;
     const lowerMsg = rawMessage.toLowerCase();
-    const isGenericHttpCode = typeof rawCode !== "string" || rawCode === "UNAUTHORIZED" || rawCode === "BAD_REQUEST" || rawCode === "CONFLICT" || rawCode === "RATE_LIMITED" || rawCode.startsWith("http_");
-    if (!isGenericHttpCode) {
-      this.code = rawCode;
-    } else if (status === 429 || rawCode === "RATE_LIMITED" || rawCode === "http_429") {
-      this.code = "rate_limit_exceeded";
+    if (canonical === "USER_ALREADY_EXISTS") {
+      this.code = "EMAIL_ALREADY_IN_USE";
+    } else if (canonical === "TOKEN_EXPIRED" && status === 401) {
+      this.code = "SESSION_EXPIRED";
+    } else if (canonical === "RATE_LIMIT_EXCEEDED") {
+      this.code = "RATE_LIMITED";
+    } else if (canonical && !isGenericCode(canonical)) {
+      this.code = canonical;
+    } else if (status === 429) {
+      this.code = "RATE_LIMITED";
     } else if (status === 401 && (lowerMsg.includes("identifiants") || lowerMsg.includes("credentials") || lowerMsg.includes("mot de passe incorrect"))) {
-      this.code = "invalid_credentials";
-    } else if (status === 401 && lowerMsg.includes("r\xE9voqu\xE9e")) {
-      this.code = "session_revoked";
-    } else if (status === 401 && lowerMsg.includes("expir\xE9")) {
-      this.code = "session_expired";
+      this.code = "INVALID_CREDENTIALS";
+    } else if (status === 401 && (lowerMsg.includes("r\xE9voqu\xE9e") || lowerMsg.includes("revoked"))) {
+      this.code = "SESSION_REVOKED";
+    } else if (status === 401 && (lowerMsg.includes("expir\xE9") || lowerMsg.includes("expired"))) {
+      this.code = "SESSION_EXPIRED";
     } else if (status === 400 && (lowerMsg.includes("mot de passe") || lowerMsg.includes("password"))) {
-      this.code = "weak_password";
+      this.code = "WEAK_PASSWORD";
     } else if (status === 409 && (lowerMsg.includes("d\xE9j\xE0 utilis\xE9") || lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
-      this.code = "email_already_in_use";
-    } else if (status === 404 && lowerMsg.includes("utilisateur")) {
-      this.code = "user_not_found";
+      this.code = "EMAIL_ALREADY_IN_USE";
+    } else if (status === 404 && (lowerMsg.includes("utilisateur") || lowerMsg.includes("user not found"))) {
+      this.code = "USER_NOT_FOUND";
     } else {
-      this.code = rawCode ?? `http_${status}`;
+      this.code = canonical ?? `HTTP_${status}`;
     }
     Object.setPrototypeOf(this, _AuraError.prototype);
   }
+  /**
+   * @deprecated Ancienne forme en minuscules de `code` (`invalid_credentials`, `no_session`…).
+   * Utilisez `error.code`, toujours en SCREAMING_SNAKE.
+   */
+  get legacyCode() {
+    return LEGACY_LOWERCASE_CODES.has(this.code) ? this.code.toLowerCase() : this.code;
+  }
   get isNotFound() {
     return this.status === 404;
   }
@@ -71,7 +124,17 @@ var AuraError = class _AuraError extends Error {
   get isRateLimited() {
     return this.status === 429;
   }
+  /**
+   * Quota mensuel du plan atteint (HTTP 403, `code: 'QUOTA_EXCEEDED'`). Le message nomme la
+   * métrique, l'usage, la limite et la date de remise à zéro ; ce n'est pas un refus d'autorisation.
+   */
+  get isQuotaExceeded() {
+    return this.code === "QUOTA_EXCEEDED";
+  }
 };
+function isGenericCode(code) {
+  return code === "UNAUTHORIZED" || code === "BAD_REQUEST" || code === "CONFLICT" || code.startsWith("HTTP_");
+}
 function isAuraError(error) {
   return error instanceof AuraError || typeof error === "object" && error !== null && error.__isAuraError === true;
 }
@@ -336,6 +399,17 @@ var BaseAuthStore = class {
 // src/fetch.ts
 var REFRESH_MARGIN_SEC = 30;
 var RETRY_AFTER_CAP_MS = 6e4;
+function networkErrorMessage(err, url) {
+  const cause = err?.cause;
+  const reason = cause?.code ?? cause?.message ?? (err instanceof Error ? err.message : "request failed");
+  let target = url;
+  try {
+    const u = new URL(url);
+    target = `${u.origin}${u.pathname}`;
+  } catch {
+  }
+  return `Cannot reach ${target} (${reason}). Check the project URL (NEXT_PUBLIC_AURABASE_URL) and your network.`;
+}
 var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
 function unwrapEnvelope(body) {
   if (body !== null && typeof body === "object" && "data" in body) {
@@ -457,7 +531,7 @@ async function doRefresh(client) {
       error: new AuraError(0, {
         error: timedOut ? { code: "timeout", message: `Refresh timed out after ${timeoutMs}ms` } : {
           code: "network_error",
-          message: err instanceof Error ? err.message : "Network request failed"
+          message: networkErrorMessage(err, `${client.baseUrl}/v1/auth/refresh`)
         }
       })
     };
@@ -658,7 +732,7 @@ async function fetchWithAuth(url, init, client) {
         error: new AuraError(0, {
           error: timedOut ? { code: "timeout", message: `Request timed out after ${timeoutMs}ms` } : {
             code: "network_error",
-            message: err instanceof Error ? err.message : "Network request failed"
+            message: networkErrorMessage(err, url)
           }
         })
       };
@@ -691,7 +765,9 @@ async function fetchWithAuth(url, init, client) {
       }
     }
     if (res.status === 204) {
-      return { data: null, error: null };
+      const totalFromCr2 = parseContentRangeTotal(res.headers.get("content-range"));
+      if (totalFromCr2 === void 0) return { data: null, error: null };
+      return { data: null, error: null, meta: { total: totalFromCr2 }, count: totalFromCr2 };
     }
     if (!res.ok) {
       let body2 = null;
@@ -805,13 +881,16 @@ function parseCookieHeader(header) {
   }
   return result;
 }
+function sameSiteAttribute(v) {
+  return v.charAt(0).toUpperCase() + v.slice(1);
+}
 function serializeCookieHeader(name, value, options = {}) {
   const parts = [`${name}=${encodeURIComponent(value)}`];
   if (options.path) parts.push(`Path=${options.path}`);
   if (options.domain) parts.push(`Domain=${options.domain}`);
   if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
   if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
+  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
   if (options.httpOnly) parts.push("HttpOnly");
   return parts.join("; ");
 }
@@ -931,7 +1010,7 @@ var LocalAuthStore = class extends BaseAuthStore {
     if (options.domain) parts.push(`Domain=${options.domain}`);
     if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
     if (options.secure) parts.push("Secure");
-    if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
+    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
     if (options.httpOnly) parts.push("HttpOnly");
     return parts.join("; ");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/core",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Cœur du SDK Aurabase : fetch résilient, erreurs, stores auth, types de réponse (infrastructure interne)",
   "type": "module",
   "main": "dist/index.cjs",
@@ -31,12 +31,12 @@
   "author": "Aurabase",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/daylami555/aurabase.git",
+    "url": "git+https://github.com/Aurabase-cloud/Aurabase.git",
     "directory": "aurabase-js/packages/core"
   },
   "homepage": "https://aurabase.cloud",
   "bugs": {
-    "url": "https://github.com/daylami555/aurabase/issues"
+    "url": "https://github.com/Aurabase-cloud/Aurabase/issues"
   },
   "keywords": [
     "aurabase",