@aurabase/core 0.6.1 → 0.7.0

package/README.md

@@ -149,7 +149,7 @@ function hydrateFromCookieHeader(cookieHeader: string) {
 const store = hydrateFromCookieHeader(`${CLE}=%7B%22token%22%3Anull%7D`)
 
 // Après une mutation de session, sérialiser l'état courant en Set-Cookie.
-const setCookieValue = store.exportToCookie({ path: '/', secure: true, sameSite: 'Lax', httpOnly: true })
+const setCookieValue = store.exportToCookie({ path: '/', secure: true, sameSite: 'lax', httpOnly: true })
 ```
 
 `store.persistent` indique si le store survit à un redirect pleine page (`false` pour `BaseAuthStore`, `true` pour `LocalAuthStore`) — c'est ce flag que le flux OAuth PKCE utilise pour décider s'il peut stocker un `code_verifier` de façon fiable.

package/dist/index.cjs

@@ -1,15 +1,51 @@
 'use strict';
 
 // src/AuraError.ts
+var LEGACY_LOWERCASE_CODES = /* @__PURE__ */ new Set([
+  "NO_SESSION",
+  "TIMEOUT",
+  "NETWORK_ERROR",
+  "INVALID_RESPONSE",
+  "REFRESH_DISCARDED",
+  "UNVERIFIABLE_TOKEN",
+  "NO_CODE_VERIFIER",
+  "PKCE_GENERATION_FAILED",
+  "MISSING_EMAIL",
+  "JWKS_FETCH_FAILED",
+  "SIGNATURE_INVALID",
+  "TOKEN_EXPIRED",
+  "TOKEN_NOT_YET_VALID",
+  "INVALID_JWT",
+  "UNSUPPORTED_ALG",
+  "NO_MATCHING_KEY",
+  "INVALID_ISSUER",
+  "INVALID_AUDIENCE",
+  "INVALID_PATH",
+  "INVALID_CREDENTIALS",
+  "WEAK_PASSWORD",
+  "EMAIL_ALREADY_IN_USE",
+  "USER_NOT_FOUND",
+  "SESSION_EXPIRED",
+  "INVALID_OTP",
+  "SESSION_REVOKED"
+]);
+function normalizeErrorCode(code) {
+  return code.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase();
+}
 var AuraError = class _AuraError extends Error {
   status;
   code;
   details;
   retryAfter;
+  /**
+   * Piste de correction fournie par le serveur (ex. refus RLS : quelle politique créer). J1-010.
+   */
+  hint;
   /** Marqueur runtime pour `isAuraError` (détection cross-realm/cross-bundle). */
   __isAuraError = true;
   constructor(status, body, headers) {
-    let rawMessage = body?.error?.message ?? body?.message ?? (status === 429 ? "Trop de requ\xEAtes, veuillez patienter avant de r\xE9essayer." : `HTTP ${status}`);
+    const serverMessage = body?.error?.message ?? body?.message;
+    let rawMessage = serverMessage ?? (status === 429 ? "Too many requests, please wait before retrying." : `HTTP ${status}`);
     let retryAfterSec;
     if (headers) {
       const getHeader = (name) => {
@@ -24,8 +60,8 @@ var AuraError = class _AuraError extends Error {
         const sec = parseInt(ra, 10);
         if (!isNaN(sec)) {
           retryAfterSec = sec;
-          if (status === 429) {
-            rawMessage = `Trop de requ\xEAtes, veuillez patienter ${sec} seconde${sec > 1 ? "s" : ""} avant de r\xE9essayer.`;
+          if (status === 429 && !serverMessage) {
+            rawMessage = `Too many requests, please wait ${sec} second${sec > 1 ? "s" : ""} before retrying.`;
           }
         }
       }
@@ -37,46 +73,47 @@ var AuraError = class _AuraError extends Error {
     if (retryAfterSec !== void 0) {
       this.retryAfter = retryAfterSec;
     }
-    const rawCode = body?.error?.code;
+    const hint = body?.error?.hint;
+    if (typeof hint === "string" && hint) {
+      this.hint = hint;
+    }
+    const rawCode = typeof body?.error?.code === "string" ? body.error.code : void 0;
+    const canonical = rawCode ? normalizeErrorCode(rawCode) : void 0;
     const lowerMsg = rawMessage.toLowerCase();
-    if (rawCode === "INVALID_CREDENTIALS" || rawCode === "invalid_credentials") {
-      this.code = "invalid_credentials";
-    } else if (rawCode === "EMAIL_ALREADY_IN_USE" || rawCode === "USER_ALREADY_EXISTS" || rawCode === "email_already_in_use") {
-      this.code = "email_already_in_use";
-    } else if (rawCode === "WEAK_PASSWORD" || rawCode === "weak_password") {
-      this.code = "weak_password";
-    } else if (rawCode === "USER_NOT_FOUND" || rawCode === "user_not_found") {
-      this.code = "user_not_found";
-    } else if (rawCode === "SESSION_EXPIRED" || rawCode === "session_expired") {
-      this.code = "session_expired";
-    } else if (rawCode === "SESSION_REVOKED" || rawCode === "session_revoked") {
-      this.code = "session_revoked";
-    } else if (rawCode === "INVALID_OTP" || rawCode === "invalid_otp") {
-      this.code = "invalid_otp";
-    } else if (rawCode === "RATE_LIMITED" || rawCode === "rate_limit_exceeded" || status === 429) {
-      this.code = "rate_limit_exceeded";
+    if (canonical === "USER_ALREADY_EXISTS") {
+      this.code = "EMAIL_ALREADY_IN_USE";
+    } else if (canonical === "TOKEN_EXPIRED" && status === 401) {
+      this.code = "SESSION_EXPIRED";
+    } else if (canonical === "RATE_LIMIT_EXCEEDED") {
+      this.code = "RATE_LIMITED";
+    } else if (canonical && !isGenericCode(canonical)) {
+      this.code = canonical;
+    } else if (status === 429) {
+      this.code = "RATE_LIMITED";
+    } else if (status === 401 && lowerMsg.includes("credentials")) {
+      this.code = "INVALID_CREDENTIALS";
+    } else if (status === 401 && lowerMsg.includes("revoked")) {
+      this.code = "SESSION_REVOKED";
+    } else if (status === 401 && lowerMsg.includes("expired")) {
+      this.code = "SESSION_EXPIRED";
+    } else if (status === 400 && lowerMsg.includes("password")) {
+      this.code = "WEAK_PASSWORD";
+    } else if (status === 409 && (lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
+      this.code = "EMAIL_ALREADY_IN_USE";
+    } else if (status === 404 && lowerMsg.includes("user not found")) {
+      this.code = "USER_NOT_FOUND";
     } else {
-      const isGenericHttpCode = typeof rawCode !== "string" || rawCode === "UNAUTHORIZED" || rawCode === "BAD_REQUEST" || rawCode === "CONFLICT" || rawCode.startsWith("http_");
-      if (!isGenericHttpCode) {
-        this.code = rawCode;
-      } else if (status === 401 && (lowerMsg.includes("identifiants") || lowerMsg.includes("credentials") || lowerMsg.includes("mot de passe incorrect"))) {
-        this.code = "invalid_credentials";
-      } else if (status === 401 && lowerMsg.includes("r\xE9voqu\xE9e")) {
-        this.code = "session_revoked";
-      } else if (status === 401 && lowerMsg.includes("expir\xE9")) {
-        this.code = "session_expired";
-      } else if (status === 400 && (lowerMsg.includes("mot de passe") || lowerMsg.includes("password"))) {
-        this.code = "weak_password";
-      } else if (status === 409 && (lowerMsg.includes("d\xE9j\xE0 utilis\xE9") || lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
-        this.code = "email_already_in_use";
-      } else if (status === 404 && lowerMsg.includes("utilisateur")) {
-        this.code = "user_not_found";
-      } else {
-        this.code = rawCode ?? `http_${status}`;
-      }
+      this.code = canonical ?? `HTTP_${status}`;
     }
     Object.setPrototypeOf(this, _AuraError.prototype);
   }
+  /**
+   * @deprecated Ancienne forme en minuscules de `code` (`invalid_credentials`, `no_session`…).
+   * Utilisez `error.code`, toujours en SCREAMING_SNAKE.
+   */
+  get legacyCode() {
+    return LEGACY_LOWERCASE_CODES.has(this.code) ? this.code.toLowerCase() : this.code;
+  }
   get isNotFound() {
     return this.status === 404;
   }
@@ -89,7 +126,17 @@ var AuraError = class _AuraError extends Error {
   get isRateLimited() {
     return this.status === 429;
   }
+  /**
+   * Quota mensuel du plan atteint (HTTP 403, `code: 'QUOTA_EXCEEDED'`). Le message nomme la
+   * métrique, l'usage, la limite et la date de remise à zéro ; ce n'est pas un refus d'autorisation.
+   */
+  get isQuotaExceeded() {
+    return this.code === "QUOTA_EXCEEDED";
+  }
 };
+function isGenericCode(code) {
+  return code === "UNAUTHORIZED" || code === "BAD_REQUEST" || code === "CONFLICT" || code.startsWith("HTTP_");
+}
 function isAuraError(error) {
   return error instanceof AuraError || typeof error === "object" && error !== null && error.__isAuraError === true;
 }
@@ -245,6 +292,24 @@ function decodeJwtPayload(token) {
     return null;
   }
 }
+function userFromAccessToken(token) {
+  const c = decodeJwtPayload(token);
+  if (!c || typeof c.sub !== "string") return null;
+  const meta = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
+  const amr = Array.isArray(c.amr) ? c.amr : [];
+  return {
+    id: c.sub,
+    email: typeof c.email === "string" ? c.email : null,
+    role: "authenticated",
+    email_verified: false,
+    is_banned: false,
+    is_anonymous: amr.some((a) => a?.method === "anonymous"),
+    mfa_enabled: c.aal === "aal2",
+    user_metadata: meta(c.user_metadata),
+    app_metadata: meta(c.app_metadata),
+    created_at: ""
+  };
+}
 function isTokenExpired(token, marginSec = 0) {
   const payload = decodeJwtPayload(token);
   if (!payload || typeof payload.exp !== "number") return true;
@@ -354,6 +419,17 @@ var BaseAuthStore = class {
 // src/fetch.ts
 var REFRESH_MARGIN_SEC = 30;
 var RETRY_AFTER_CAP_MS = 6e4;
+function networkErrorMessage(err, url) {
+  const cause = err?.cause;
+  const reason = cause?.code ?? cause?.message ?? (err instanceof Error ? err.message : "request failed");
+  let target = url;
+  try {
+    const u = new URL(url);
+    target = `${u.origin}${u.pathname}`;
+  } catch {
+  }
+  return `Cannot reach ${target} (${reason}). Check the project URL (NEXT_PUBLIC_AURABASE_URL) and your network.`;
+}
 var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
 function unwrapEnvelope(body) {
   if (body !== null && typeof body === "object" && "data" in body) {
@@ -475,7 +551,7 @@ async function doRefresh(client) {
       error: new AuraError(0, {
         error: timedOut ? { code: "timeout", message: `Refresh timed out after ${timeoutMs}ms` } : {
           code: "network_error",
-          message: err instanceof Error ? err.message : "Network request failed"
+          message: networkErrorMessage(err, `${client.baseUrl}/v1/auth/refresh`)
         }
       })
     };
@@ -676,7 +752,7 @@ async function fetchWithAuth(url, init, client) {
         error: new AuraError(0, {
           error: timedOut ? { code: "timeout", message: `Request timed out after ${timeoutMs}ms` } : {
             code: "network_error",
-            message: err instanceof Error ? err.message : "Network request failed"
+            message: networkErrorMessage(err, url)
           }
         })
       };
@@ -825,13 +901,16 @@ function parseCookieHeader(header) {
   }
   return result;
 }
+function sameSiteAttribute(v) {
+  return v.charAt(0).toUpperCase() + v.slice(1);
+}
 function serializeCookieHeader(name, value, options = {}) {
   const parts = [`${name}=${encodeURIComponent(value)}`];
   if (options.path) parts.push(`Path=${options.path}`);
   if (options.domain) parts.push(`Domain=${options.domain}`);
   if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
   if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
+  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
   if (options.httpOnly) parts.push("HttpOnly");
   return parts.join("; ");
 }
@@ -922,6 +1001,9 @@ var LocalAuthStore = class extends BaseAuthStore {
   /**
    * Populate the store from a raw `Cookie` header string (server-side).
    * Looks for the key matching `this.key`.
+   *
+   * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
+   * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
    */
   loadFromCookie(cookieString) {
     const prefix = `${this.key}=`;
@@ -930,20 +1012,22 @@ var LocalAuthStore = class extends BaseAuthStore {
     try {
       const raw = decodeURIComponent(entry.slice(prefix.length));
       const parsed = JSON.parse(raw);
-      if (parsed.token && parsed.refreshToken && parsed.user) {
-        super.save(parsed.token, parsed.refreshToken, parsed.user);
+      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
+      if (parsed.token && parsed.refreshToken && user) {
+        super.save(parsed.token, parsed.refreshToken, user);
       }
     } catch {
     }
   }
   /**
-   * Serialize current auth state into a `Set-Cookie` value.
+   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+   * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
+   * (5 KB of metadata gave 4 cookies and 13 139 bytes).
    */
   exportToCookie(options = {}) {
     const data = {
       token: this.token,
-      refreshToken: this.refreshToken,
-      user: this.user
+      refreshToken: this.refreshToken
     };
     const encoded = encodeURIComponent(JSON.stringify(data));
     const parts = [`${this.key}=${encoded}`];
@@ -951,7 +1035,7 @@ var LocalAuthStore = class extends BaseAuthStore {
     if (options.domain) parts.push(`Domain=${options.domain}`);
     if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
     if (options.secure) parts.push("Secure");
-    if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
+    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
     if (options.httpOnly) parts.push("HttpOnly");
     return parts.join("; ");
   }

package/dist/index.d.cts

@@ -14,7 +14,7 @@
  *  - storage/path.ts   : invalid_path
  *  - db/QueryBuilder.ts: PGRST116 (parité PostgREST : `.single()` sur 0/plusieurs lignes)
  */
-type AuraErrorCode = 'no_session' | 'timeout' | 'network_error' | 'invalid_response' | 'refresh_discarded' | 'unverifiable_token' | 'no_code_verifier' | 'pkce_generation_failed' | 'missing_email' | 'jwks_fetch_failed' | 'signature_invalid' | 'token_expired' | 'token_not_yet_valid' | 'invalid_jwt' | 'unsupported_alg' | 'no_matching_key' | 'invalid_issuer' | 'invalid_audience' | 'invalid_path' | 'PGRST116' | 'invalid_credentials' | 'weak_password' | 'email_already_in_use' | 'user_not_found' | 'rate_limit_exceeded' | 'session_expired' | 'invalid_otp' | 'session_revoked' | (string & {});
+type AuraErrorCode = 'NO_SESSION' | 'TIMEOUT' | 'NETWORK_ERROR' | 'INVALID_RESPONSE' | 'REFRESH_DISCARDED' | 'UNVERIFIABLE_TOKEN' | 'NO_CODE_VERIFIER' | 'PKCE_GENERATION_FAILED' | 'MISSING_EMAIL' | 'JWKS_FETCH_FAILED' | 'SIGNATURE_INVALID' | 'TOKEN_EXPIRED' | 'TOKEN_NOT_YET_VALID' | 'INVALID_JWT' | 'UNSUPPORTED_ALG' | 'NO_MATCHING_KEY' | 'INVALID_ISSUER' | 'INVALID_AUDIENCE' | 'INVALID_PATH' | 'PGRST116' | 'INVALID_CREDENTIALS' | 'WEAK_PASSWORD' | 'PASSWORD_REQUIRED' | 'EMAIL_ALREADY_IN_USE' | 'USER_NOT_FOUND' | 'USER_BANNED' | 'EMAIL_NOT_CONFIRMED' | 'RATE_LIMITED' | 'SESSION_EXPIRED' | 'INVALID_OTP' | 'SESSION_REVOKED' | 'MFA_CODE_INVALID' | 'MFA_CODE_ALREADY_USED' | 'TOTP_CODE_REUSED' | 'MFA_CHALLENGE_EXPIRED' | (string & {});
 /**
  * Structured error thrown/returned by the Aurabase SDK.
  * Mirrors the backend's `AuraError` JSON shape with semantic DX normalization.
@@ -24,19 +24,35 @@ declare class AuraError extends Error {
     readonly code: AuraErrorCode;
     readonly details: unknown;
     readonly retryAfter?: number;
+    /**
+     * Piste de correction fournie par le serveur (ex. refus RLS : quelle politique créer). J1-010.
+     */
+    readonly hint?: string;
     /** Marqueur runtime pour `isAuraError` (détection cross-realm/cross-bundle). */
     protected readonly __isAuraError = true;
     constructor(status: number, body?: {
         error?: {
             code?: string;
             message?: string;
+            hint?: string;
+            details?: unknown;
         };
         message?: string;
     } | null, headers?: Headers | Record<string, string | null | undefined>);
+    /**
+     * @deprecated Ancienne forme en minuscules de `code` (`invalid_credentials`, `no_session`…).
+     * Utilisez `error.code`, toujours en SCREAMING_SNAKE.
+     */
+    get legacyCode(): string;
     get isNotFound(): boolean;
     get isUnauthorized(): boolean;
     get isForbidden(): boolean;
     get isRateLimited(): boolean;
+    /**
+     * Quota mensuel du plan atteint (HTTP 403, `code: 'QUOTA_EXCEEDED'`). Le message nomme la
+     * métrique, l'usage, la limite et la date de remise à zéro ; ce n'est pas un refus d'autorisation.
+     */
+    get isQuotaExceeded(): boolean;
 }
 declare function isAuraError(error: unknown): error is AuraError;
 
@@ -189,10 +205,6 @@ interface User {
 interface Session {
     access_token: string;
     refresh_token: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    accessToken?: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    refreshToken?: string;
     token_type: string;
     expires_in: number;
     expires_at?: number;
@@ -203,30 +215,20 @@ interface Session {
 interface TokenPair {
     access_token: string;
     refresh_token: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    accessToken?: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    refreshToken?: string;
     token_type: string;
     expires_in: number;
     user: User;
     provider_token?: string | null;
     provider_refresh_token?: string | null;
-    /** Sous-objet session pour parité DX Supabase (`data.session.access_token`). */
-    session?: Session;
-    mfaChallenge?: undefined;
+    /** Sous-objet session pour parité DX Supabase (`data.session.access_token`).
+     * `null` après une inscription sur un projet qui exige un e-mail vérifié (AUTH-002). */
+    session?: Session | null;
 }
 interface MfaChallenge {
     mfa_required: true;
     mfa_token: string;
     mfa_setup_required?: boolean;
     session?: undefined;
-    /** Alias ergonomique aligné sur la documentation officielle */
-    mfaChallenge?: {
-        mfaRequired: boolean;
-        mfaToken: string;
-        mfaSetupRequired?: boolean;
-    };
 }
 type LoginResponse = TokenPair | MfaChallenge;
 type AuthEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED' | 'USER_UPDATED' | 'MFA_CHALLENGE' | 'PASSWORD_RECOVERY';
@@ -361,9 +363,35 @@ interface MfaEnrollResponse {
     otpauth_url: string;
     secret: string;
 }
-interface MfaVerifyRequest {
+/**
+ * Relève un défi MFA : exactement UN facteur parmi `code` (TOTP à 6 chiffres), `recovery_code`
+ * (code de secours `XXXXXXXX-XXXXXXXX`) et `sms_code` (code reçu après `auth.mfa.sms.send`).
+ * Pour une passkey, utilisez `auth.mfa.webauthn.verify`.
+ */
+type MfaVerifyRequest = {
     mfa_token: string;
     code: string;
+} | {
+    mfa_token: string;
+    recovery_code: string;
+} | {
+    mfa_token: string;
+    sms_code: string;
+};
+/** Facteur MFA utilisable pour relever un défi (`auth.mfa.factors`). */
+type MfaFactorType = 'totp' | 'webauthn' | 'sms';
+/** Passkey WebAuthn enrôlée (`auth.mfa.webauthn.list`). */
+interface PasskeyInfo {
+    id: string;
+    friendly_name: string;
+    created_at: string;
+    last_used_at: string | null;
+}
+/** Résultat de l'enrôlement d'une passkey. `recovery_codes` n'est présent que si cette passkey est le premier facteur du compte. */
+interface PasskeyRegisterResult {
+    id: string;
+    friendly_name: string;
+    recovery_codes?: string[];
 }
 interface SessionInfo {
     id: string;
@@ -1490,6 +1518,11 @@ interface AuraClientOptions {
          * Défaut : `true` en navigateur, no-op hors navigateur (SSR/Node).
          */
         detectSessionInUrl?: boolean;
+        /**
+         * AUTH-015 — flux OAuth par défaut de `signInWithOAuth` pour ce client (`'pkce'` recommandé
+         * en navigateur). Une option `flowType` passée à l'appel reste prioritaire.
+         */
+        flowType?: 'pkce' | 'implicit';
     };
     fetch?: typeof globalThis.fetch;
     /**
@@ -1773,7 +1806,7 @@ interface AdminUpdateUserRequest {
     mfa_enabled?: boolean;
     revoke_sessions?: boolean;
 }
-type GenerateLinkType = 'magic' | 'recovery' | 'invite';
+type GenerateLinkType = 'signup' | 'magic' | 'recovery' | 'invite';
 interface GenerateLinkResult {
     link: string;
     token: string;
@@ -1927,7 +1960,8 @@ interface SerializeCookieOptions {
     domain?: string;
     maxAge?: number;
     secure?: boolean;
-    sameSite?: 'Strict' | 'Lax' | 'None';
+    /** Minuscules : forme acceptée par `ResponseCookie` de Next.js (`'lax' | 'strict' | 'none'`). */
+    sameSite?: 'strict' | 'lax' | 'none';
     httpOnly?: boolean;
 }
 /**
@@ -1935,7 +1969,6 @@ interface SerializeCookieOptions {
  */
 declare function serializeCookieHeader(name: string, value: string, options?: SerializeCookieOptions): string;
 
-/** Timeout par défaut d'une requête HTTP (borne un serveur qui « hang »). */
 declare const DEFAULT_REQUEST_TIMEOUT_MS = 30000;
 /** Point d'entrée unique du refresh, dédupliqué par client (single-flight). */
 declare function refreshOnce(client: AuraClientLike): Promise<AuraResponse<TokenPair>>;
@@ -2010,7 +2043,7 @@ interface CookieOptions {
     domain?: string;
     maxAge?: number;
     secure?: boolean;
-    sameSite?: 'Strict' | 'Lax' | 'None';
+    sameSite?: 'strict' | 'lax' | 'none';
     httpOnly?: boolean;
 }
 /**
@@ -2053,10 +2086,15 @@ declare class LocalAuthStore extends BaseAuthStore {
     /**
      * Populate the store from a raw `Cookie` header string (server-side).
      * Looks for the key matching `this.key`.
+     *
+     * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
+     * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
      */
     loadFromCookie(cookieString: string): void;
     /**
-     * Serialize current auth state into a `Set-Cookie` value.
+     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+     * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
+     * (5 KB of metadata gave 4 cookies and 13 139 bytes).
      */
     exportToCookie(options?: CookieOptions): string;
     private _getStorage;
@@ -2065,4 +2103,4 @@ declare class LocalAuthStore extends BaseAuthStore {
     private _removeStorage;
 }
 
-export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaFactorType, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasskeyInfo, type PasskeyRegisterResult, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.d.ts

@@ -14,7 +14,7 @@
  *  - storage/path.ts   : invalid_path
  *  - db/QueryBuilder.ts: PGRST116 (parité PostgREST : `.single()` sur 0/plusieurs lignes)
  */
-type AuraErrorCode = 'no_session' | 'timeout' | 'network_error' | 'invalid_response' | 'refresh_discarded' | 'unverifiable_token' | 'no_code_verifier' | 'pkce_generation_failed' | 'missing_email' | 'jwks_fetch_failed' | 'signature_invalid' | 'token_expired' | 'token_not_yet_valid' | 'invalid_jwt' | 'unsupported_alg' | 'no_matching_key' | 'invalid_issuer' | 'invalid_audience' | 'invalid_path' | 'PGRST116' | 'invalid_credentials' | 'weak_password' | 'email_already_in_use' | 'user_not_found' | 'rate_limit_exceeded' | 'session_expired' | 'invalid_otp' | 'session_revoked' | (string & {});
+type AuraErrorCode = 'NO_SESSION' | 'TIMEOUT' | 'NETWORK_ERROR' | 'INVALID_RESPONSE' | 'REFRESH_DISCARDED' | 'UNVERIFIABLE_TOKEN' | 'NO_CODE_VERIFIER' | 'PKCE_GENERATION_FAILED' | 'MISSING_EMAIL' | 'JWKS_FETCH_FAILED' | 'SIGNATURE_INVALID' | 'TOKEN_EXPIRED' | 'TOKEN_NOT_YET_VALID' | 'INVALID_JWT' | 'UNSUPPORTED_ALG' | 'NO_MATCHING_KEY' | 'INVALID_ISSUER' | 'INVALID_AUDIENCE' | 'INVALID_PATH' | 'PGRST116' | 'INVALID_CREDENTIALS' | 'WEAK_PASSWORD' | 'PASSWORD_REQUIRED' | 'EMAIL_ALREADY_IN_USE' | 'USER_NOT_FOUND' | 'USER_BANNED' | 'EMAIL_NOT_CONFIRMED' | 'RATE_LIMITED' | 'SESSION_EXPIRED' | 'INVALID_OTP' | 'SESSION_REVOKED' | 'MFA_CODE_INVALID' | 'MFA_CODE_ALREADY_USED' | 'TOTP_CODE_REUSED' | 'MFA_CHALLENGE_EXPIRED' | (string & {});
 /**
  * Structured error thrown/returned by the Aurabase SDK.
  * Mirrors the backend's `AuraError` JSON shape with semantic DX normalization.
@@ -24,19 +24,35 @@ declare class AuraError extends Error {
     readonly code: AuraErrorCode;
     readonly details: unknown;
     readonly retryAfter?: number;
+    /**
+     * Piste de correction fournie par le serveur (ex. refus RLS : quelle politique créer). J1-010.
+     */
+    readonly hint?: string;
     /** Marqueur runtime pour `isAuraError` (détection cross-realm/cross-bundle). */
     protected readonly __isAuraError = true;
     constructor(status: number, body?: {
         error?: {
             code?: string;
             message?: string;
+            hint?: string;
+            details?: unknown;
         };
         message?: string;
     } | null, headers?: Headers | Record<string, string | null | undefined>);
+    /**
+     * @deprecated Ancienne forme en minuscules de `code` (`invalid_credentials`, `no_session`…).
+     * Utilisez `error.code`, toujours en SCREAMING_SNAKE.
+     */
+    get legacyCode(): string;
     get isNotFound(): boolean;
     get isUnauthorized(): boolean;
     get isForbidden(): boolean;
     get isRateLimited(): boolean;
+    /**
+     * Quota mensuel du plan atteint (HTTP 403, `code: 'QUOTA_EXCEEDED'`). Le message nomme la
+     * métrique, l'usage, la limite et la date de remise à zéro ; ce n'est pas un refus d'autorisation.
+     */
+    get isQuotaExceeded(): boolean;
 }
 declare function isAuraError(error: unknown): error is AuraError;
 
@@ -189,10 +205,6 @@ interface User {
 interface Session {
     access_token: string;
     refresh_token: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    accessToken?: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    refreshToken?: string;
     token_type: string;
     expires_in: number;
     expires_at?: number;
@@ -203,30 +215,20 @@ interface Session {
 interface TokenPair {
     access_token: string;
     refresh_token: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    accessToken?: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    refreshToken?: string;
     token_type: string;
     expires_in: number;
     user: User;
     provider_token?: string | null;
     provider_refresh_token?: string | null;
-    /** Sous-objet session pour parité DX Supabase (`data.session.access_token`). */
-    session?: Session;
-    mfaChallenge?: undefined;
+    /** Sous-objet session pour parité DX Supabase (`data.session.access_token`).
+     * `null` après une inscription sur un projet qui exige un e-mail vérifié (AUTH-002). */
+    session?: Session | null;
 }
 interface MfaChallenge {
     mfa_required: true;
     mfa_token: string;
     mfa_setup_required?: boolean;
     session?: undefined;
-    /** Alias ergonomique aligné sur la documentation officielle */
-    mfaChallenge?: {
-        mfaRequired: boolean;
-        mfaToken: string;
-        mfaSetupRequired?: boolean;
-    };
 }
 type LoginResponse = TokenPair | MfaChallenge;
 type AuthEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED' | 'USER_UPDATED' | 'MFA_CHALLENGE' | 'PASSWORD_RECOVERY';
@@ -361,9 +363,35 @@ interface MfaEnrollResponse {
     otpauth_url: string;
     secret: string;
 }
-interface MfaVerifyRequest {
+/**
+ * Relève un défi MFA : exactement UN facteur parmi `code` (TOTP à 6 chiffres), `recovery_code`
+ * (code de secours `XXXXXXXX-XXXXXXXX`) et `sms_code` (code reçu après `auth.mfa.sms.send`).
+ * Pour une passkey, utilisez `auth.mfa.webauthn.verify`.
+ */
+type MfaVerifyRequest = {
     mfa_token: string;
     code: string;
+} | {
+    mfa_token: string;
+    recovery_code: string;
+} | {
+    mfa_token: string;
+    sms_code: string;
+};
+/** Facteur MFA utilisable pour relever un défi (`auth.mfa.factors`). */
+type MfaFactorType = 'totp' | 'webauthn' | 'sms';
+/** Passkey WebAuthn enrôlée (`auth.mfa.webauthn.list`). */
+interface PasskeyInfo {
+    id: string;
+    friendly_name: string;
+    created_at: string;
+    last_used_at: string | null;
+}
+/** Résultat de l'enrôlement d'une passkey. `recovery_codes` n'est présent que si cette passkey est le premier facteur du compte. */
+interface PasskeyRegisterResult {
+    id: string;
+    friendly_name: string;
+    recovery_codes?: string[];
 }
 interface SessionInfo {
     id: string;
@@ -1490,6 +1518,11 @@ interface AuraClientOptions {
          * Défaut : `true` en navigateur, no-op hors navigateur (SSR/Node).
          */
         detectSessionInUrl?: boolean;
+        /**
+         * AUTH-015 — flux OAuth par défaut de `signInWithOAuth` pour ce client (`'pkce'` recommandé
+         * en navigateur). Une option `flowType` passée à l'appel reste prioritaire.
+         */
+        flowType?: 'pkce' | 'implicit';
     };
     fetch?: typeof globalThis.fetch;
     /**
@@ -1773,7 +1806,7 @@ interface AdminUpdateUserRequest {
     mfa_enabled?: boolean;
     revoke_sessions?: boolean;
 }
-type GenerateLinkType = 'magic' | 'recovery' | 'invite';
+type GenerateLinkType = 'signup' | 'magic' | 'recovery' | 'invite';
 interface GenerateLinkResult {
     link: string;
     token: string;
@@ -1927,7 +1960,8 @@ interface SerializeCookieOptions {
     domain?: string;
     maxAge?: number;
     secure?: boolean;
-    sameSite?: 'Strict' | 'Lax' | 'None';
+    /** Minuscules : forme acceptée par `ResponseCookie` de Next.js (`'lax' | 'strict' | 'none'`). */
+    sameSite?: 'strict' | 'lax' | 'none';
     httpOnly?: boolean;
 }
 /**
@@ -1935,7 +1969,6 @@ interface SerializeCookieOptions {
  */
 declare function serializeCookieHeader(name: string, value: string, options?: SerializeCookieOptions): string;
 
-/** Timeout par défaut d'une requête HTTP (borne un serveur qui « hang »). */
 declare const DEFAULT_REQUEST_TIMEOUT_MS = 30000;
 /** Point d'entrée unique du refresh, dédupliqué par client (single-flight). */
 declare function refreshOnce(client: AuraClientLike): Promise<AuraResponse<TokenPair>>;
@@ -2010,7 +2043,7 @@ interface CookieOptions {
     domain?: string;
     maxAge?: number;
     secure?: boolean;
-    sameSite?: 'Strict' | 'Lax' | 'None';
+    sameSite?: 'strict' | 'lax' | 'none';
     httpOnly?: boolean;
 }
 /**
@@ -2053,10 +2086,15 @@ declare class LocalAuthStore extends BaseAuthStore {
     /**
      * Populate the store from a raw `Cookie` header string (server-side).
      * Looks for the key matching `this.key`.
+     *
+     * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
+     * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
      */
     loadFromCookie(cookieString: string): void;
     /**
-     * Serialize current auth state into a `Set-Cookie` value.
+     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+     * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
+     * (5 KB of metadata gave 4 cookies and 13 139 bytes).
      */
     exportToCookie(options?: CookieOptions): string;
     private _getStorage;
@@ -2065,4 +2103,4 @@ declare class LocalAuthStore extends BaseAuthStore {
     private _removeStorage;
 }
 
-export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaFactorType, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasskeyInfo, type PasskeyRegisterResult, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.js

@@ -1,13 +1,49 @@
 // src/AuraError.ts
+var LEGACY_LOWERCASE_CODES = /* @__PURE__ */ new Set([
+  "NO_SESSION",
+  "TIMEOUT",
+  "NETWORK_ERROR",
+  "INVALID_RESPONSE",
+  "REFRESH_DISCARDED",
+  "UNVERIFIABLE_TOKEN",
+  "NO_CODE_VERIFIER",
+  "PKCE_GENERATION_FAILED",
+  "MISSING_EMAIL",
+  "JWKS_FETCH_FAILED",
+  "SIGNATURE_INVALID",
+  "TOKEN_EXPIRED",
+  "TOKEN_NOT_YET_VALID",
+  "INVALID_JWT",
+  "UNSUPPORTED_ALG",
+  "NO_MATCHING_KEY",
+  "INVALID_ISSUER",
+  "INVALID_AUDIENCE",
+  "INVALID_PATH",
+  "INVALID_CREDENTIALS",
+  "WEAK_PASSWORD",
+  "EMAIL_ALREADY_IN_USE",
+  "USER_NOT_FOUND",
+  "SESSION_EXPIRED",
+  "INVALID_OTP",
+  "SESSION_REVOKED"
+]);
+function normalizeErrorCode(code) {
+  return code.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase();
+}
 var AuraError = class _AuraError extends Error {
   status;
   code;
   details;
   retryAfter;
+  /**
+   * Piste de correction fournie par le serveur (ex. refus RLS : quelle politique créer). J1-010.
+   */
+  hint;
   /** Marqueur runtime pour `isAuraError` (détection cross-realm/cross-bundle). */
   __isAuraError = true;
   constructor(status, body, headers) {
-    let rawMessage = body?.error?.message ?? body?.message ?? (status === 429 ? "Trop de requ\xEAtes, veuillez patienter avant de r\xE9essayer." : `HTTP ${status}`);
+    const serverMessage = body?.error?.message ?? body?.message;
+    let rawMessage = serverMessage ?? (status === 429 ? "Too many requests, please wait before retrying." : `HTTP ${status}`);
     let retryAfterSec;
     if (headers) {
       const getHeader = (name) => {
@@ -22,8 +58,8 @@ var AuraError = class _AuraError extends Error {
         const sec = parseInt(ra, 10);
         if (!isNaN(sec)) {
           retryAfterSec = sec;
-          if (status === 429) {
-            rawMessage = `Trop de requ\xEAtes, veuillez patienter ${sec} seconde${sec > 1 ? "s" : ""} avant de r\xE9essayer.`;
+          if (status === 429 && !serverMessage) {
+            rawMessage = `Too many requests, please wait ${sec} second${sec > 1 ? "s" : ""} before retrying.`;
           }
         }
       }
@@ -35,46 +71,47 @@ var AuraError = class _AuraError extends Error {
     if (retryAfterSec !== void 0) {
       this.retryAfter = retryAfterSec;
     }
-    const rawCode = body?.error?.code;
+    const hint = body?.error?.hint;
+    if (typeof hint === "string" && hint) {
+      this.hint = hint;
+    }
+    const rawCode = typeof body?.error?.code === "string" ? body.error.code : void 0;
+    const canonical = rawCode ? normalizeErrorCode(rawCode) : void 0;
     const lowerMsg = rawMessage.toLowerCase();
-    if (rawCode === "INVALID_CREDENTIALS" || rawCode === "invalid_credentials") {
-      this.code = "invalid_credentials";
-    } else if (rawCode === "EMAIL_ALREADY_IN_USE" || rawCode === "USER_ALREADY_EXISTS" || rawCode === "email_already_in_use") {
-      this.code = "email_already_in_use";
-    } else if (rawCode === "WEAK_PASSWORD" || rawCode === "weak_password") {
-      this.code = "weak_password";
-    } else if (rawCode === "USER_NOT_FOUND" || rawCode === "user_not_found") {
-      this.code = "user_not_found";
-    } else if (rawCode === "SESSION_EXPIRED" || rawCode === "session_expired") {
-      this.code = "session_expired";
-    } else if (rawCode === "SESSION_REVOKED" || rawCode === "session_revoked") {
-      this.code = "session_revoked";
-    } else if (rawCode === "INVALID_OTP" || rawCode === "invalid_otp") {
-      this.code = "invalid_otp";
-    } else if (rawCode === "RATE_LIMITED" || rawCode === "rate_limit_exceeded" || status === 429) {
-      this.code = "rate_limit_exceeded";
+    if (canonical === "USER_ALREADY_EXISTS") {
+      this.code = "EMAIL_ALREADY_IN_USE";
+    } else if (canonical === "TOKEN_EXPIRED" && status === 401) {
+      this.code = "SESSION_EXPIRED";
+    } else if (canonical === "RATE_LIMIT_EXCEEDED") {
+      this.code = "RATE_LIMITED";
+    } else if (canonical && !isGenericCode(canonical)) {
+      this.code = canonical;
+    } else if (status === 429) {
+      this.code = "RATE_LIMITED";
+    } else if (status === 401 && lowerMsg.includes("credentials")) {
+      this.code = "INVALID_CREDENTIALS";
+    } else if (status === 401 && lowerMsg.includes("revoked")) {
+      this.code = "SESSION_REVOKED";
+    } else if (status === 401 && lowerMsg.includes("expired")) {
+      this.code = "SESSION_EXPIRED";
+    } else if (status === 400 && lowerMsg.includes("password")) {
+      this.code = "WEAK_PASSWORD";
+    } else if (status === 409 && (lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
+      this.code = "EMAIL_ALREADY_IN_USE";
+    } else if (status === 404 && lowerMsg.includes("user not found")) {
+      this.code = "USER_NOT_FOUND";
     } else {
-      const isGenericHttpCode = typeof rawCode !== "string" || rawCode === "UNAUTHORIZED" || rawCode === "BAD_REQUEST" || rawCode === "CONFLICT" || rawCode.startsWith("http_");
-      if (!isGenericHttpCode) {
-        this.code = rawCode;
-      } else if (status === 401 && (lowerMsg.includes("identifiants") || lowerMsg.includes("credentials") || lowerMsg.includes("mot de passe incorrect"))) {
-        this.code = "invalid_credentials";
-      } else if (status === 401 && lowerMsg.includes("r\xE9voqu\xE9e")) {
-        this.code = "session_revoked";
-      } else if (status === 401 && lowerMsg.includes("expir\xE9")) {
-        this.code = "session_expired";
-      } else if (status === 400 && (lowerMsg.includes("mot de passe") || lowerMsg.includes("password"))) {
-        this.code = "weak_password";
-      } else if (status === 409 && (lowerMsg.includes("d\xE9j\xE0 utilis\xE9") || lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
-        this.code = "email_already_in_use";
-      } else if (status === 404 && lowerMsg.includes("utilisateur")) {
-        this.code = "user_not_found";
-      } else {
-        this.code = rawCode ?? `http_${status}`;
-      }
+      this.code = canonical ?? `HTTP_${status}`;
     }
     Object.setPrototypeOf(this, _AuraError.prototype);
   }
+  /**
+   * @deprecated Ancienne forme en minuscules de `code` (`invalid_credentials`, `no_session`…).
+   * Utilisez `error.code`, toujours en SCREAMING_SNAKE.
+   */
+  get legacyCode() {
+    return LEGACY_LOWERCASE_CODES.has(this.code) ? this.code.toLowerCase() : this.code;
+  }
   get isNotFound() {
     return this.status === 404;
   }
@@ -87,7 +124,17 @@ var AuraError = class _AuraError extends Error {
   get isRateLimited() {
     return this.status === 429;
   }
+  /**
+   * Quota mensuel du plan atteint (HTTP 403, `code: 'QUOTA_EXCEEDED'`). Le message nomme la
+   * métrique, l'usage, la limite et la date de remise à zéro ; ce n'est pas un refus d'autorisation.
+   */
+  get isQuotaExceeded() {
+    return this.code === "QUOTA_EXCEEDED";
+  }
 };
+function isGenericCode(code) {
+  return code === "UNAUTHORIZED" || code === "BAD_REQUEST" || code === "CONFLICT" || code.startsWith("HTTP_");
+}
 function isAuraError(error) {
   return error instanceof AuraError || typeof error === "object" && error !== null && error.__isAuraError === true;
 }
@@ -243,6 +290,24 @@ function decodeJwtPayload(token) {
     return null;
   }
 }
+function userFromAccessToken(token) {
+  const c = decodeJwtPayload(token);
+  if (!c || typeof c.sub !== "string") return null;
+  const meta = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
+  const amr = Array.isArray(c.amr) ? c.amr : [];
+  return {
+    id: c.sub,
+    email: typeof c.email === "string" ? c.email : null,
+    role: "authenticated",
+    email_verified: false,
+    is_banned: false,
+    is_anonymous: amr.some((a) => a?.method === "anonymous"),
+    mfa_enabled: c.aal === "aal2",
+    user_metadata: meta(c.user_metadata),
+    app_metadata: meta(c.app_metadata),
+    created_at: ""
+  };
+}
 function isTokenExpired(token, marginSec = 0) {
   const payload = decodeJwtPayload(token);
   if (!payload || typeof payload.exp !== "number") return true;
@@ -352,6 +417,17 @@ var BaseAuthStore = class {
 // src/fetch.ts
 var REFRESH_MARGIN_SEC = 30;
 var RETRY_AFTER_CAP_MS = 6e4;
+function networkErrorMessage(err, url) {
+  const cause = err?.cause;
+  const reason = cause?.code ?? cause?.message ?? (err instanceof Error ? err.message : "request failed");
+  let target = url;
+  try {
+    const u = new URL(url);
+    target = `${u.origin}${u.pathname}`;
+  } catch {
+  }
+  return `Cannot reach ${target} (${reason}). Check the project URL (NEXT_PUBLIC_AURABASE_URL) and your network.`;
+}
 var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
 function unwrapEnvelope(body) {
   if (body !== null && typeof body === "object" && "data" in body) {
@@ -473,7 +549,7 @@ async function doRefresh(client) {
       error: new AuraError(0, {
         error: timedOut ? { code: "timeout", message: `Refresh timed out after ${timeoutMs}ms` } : {
           code: "network_error",
-          message: err instanceof Error ? err.message : "Network request failed"
+          message: networkErrorMessage(err, `${client.baseUrl}/v1/auth/refresh`)
         }
       })
     };
@@ -674,7 +750,7 @@ async function fetchWithAuth(url, init, client) {
         error: new AuraError(0, {
           error: timedOut ? { code: "timeout", message: `Request timed out after ${timeoutMs}ms` } : {
             code: "network_error",
-            message: err instanceof Error ? err.message : "Network request failed"
+            message: networkErrorMessage(err, url)
           }
         })
       };
@@ -823,13 +899,16 @@ function parseCookieHeader(header) {
   }
   return result;
 }
+function sameSiteAttribute(v) {
+  return v.charAt(0).toUpperCase() + v.slice(1);
+}
 function serializeCookieHeader(name, value, options = {}) {
   const parts = [`${name}=${encodeURIComponent(value)}`];
   if (options.path) parts.push(`Path=${options.path}`);
   if (options.domain) parts.push(`Domain=${options.domain}`);
   if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
   if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
+  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
   if (options.httpOnly) parts.push("HttpOnly");
   return parts.join("; ");
 }
@@ -920,6 +999,9 @@ var LocalAuthStore = class extends BaseAuthStore {
   /**
    * Populate the store from a raw `Cookie` header string (server-side).
    * Looks for the key matching `this.key`.
+   *
+   * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
+   * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
    */
   loadFromCookie(cookieString) {
     const prefix = `${this.key}=`;
@@ -928,20 +1010,22 @@ var LocalAuthStore = class extends BaseAuthStore {
     try {
       const raw = decodeURIComponent(entry.slice(prefix.length));
       const parsed = JSON.parse(raw);
-      if (parsed.token && parsed.refreshToken && parsed.user) {
-        super.save(parsed.token, parsed.refreshToken, parsed.user);
+      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
+      if (parsed.token && parsed.refreshToken && user) {
+        super.save(parsed.token, parsed.refreshToken, user);
       }
     } catch {
     }
   }
   /**
-   * Serialize current auth state into a `Set-Cookie` value.
+   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+   * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
+   * (5 KB of metadata gave 4 cookies and 13 139 bytes).
    */
   exportToCookie(options = {}) {
     const data = {
       token: this.token,
-      refreshToken: this.refreshToken,
-      user: this.user
+      refreshToken: this.refreshToken
     };
     const encoded = encodeURIComponent(JSON.stringify(data));
     const parts = [`${this.key}=${encoded}`];
@@ -949,7 +1033,7 @@ var LocalAuthStore = class extends BaseAuthStore {
     if (options.domain) parts.push(`Domain=${options.domain}`);
     if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
     if (options.secure) parts.push("Secure");
-    if (options.sameSite) parts.push(`SameSite=${options.sameSite}`);
+    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
     if (options.httpOnly) parts.push("HttpOnly");
     return parts.join("; ");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/core",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Cœur du SDK Aurabase : fetch résilient, erreurs, stores auth, types de réponse (infrastructure interne)",
   "type": "module",
   "main": "dist/index.cjs",
@@ -31,12 +31,12 @@
   "author": "Aurabase",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/daylami555/aurabase.git",
+    "url": "git+https://github.com/Aurabase-cloud/Aurabase.git",
     "directory": "aurabase-js/packages/core"
   },
   "homepage": "https://aurabase.cloud",
   "bugs": {
-    "url": "https://github.com/daylami555/aurabase/issues"
+    "url": "https://github.com/Aurabase-cloud/Aurabase/issues"
   },
   "keywords": [
     "aurabase",