@aurabase/core 0.6.2 → 0.7.1

package/dist/index.cjs

@@ -90,17 +90,21 @@ var AuraError = class _AuraError extends Error {
       this.code = canonical;
     } else if (status === 429) {
       this.code = "RATE_LIMITED";
-    } else if (status === 401 && (lowerMsg.includes("identifiants") || lowerMsg.includes("credentials") || lowerMsg.includes("mot de passe incorrect"))) {
+    } else if (status === 401 && lowerMsg.includes("credentials")) {
       this.code = "INVALID_CREDENTIALS";
-    } else if (status === 401 && (lowerMsg.includes("r\xE9voqu\xE9e") || lowerMsg.includes("revoked"))) {
+    } else if (status === 401 && lowerMsg.includes("revoked")) {
       this.code = "SESSION_REVOKED";
-    } else if (status === 401 && (lowerMsg.includes("expir\xE9") || lowerMsg.includes("expired"))) {
+    } else if (status === 401 && lowerMsg.includes("expired")) {
       this.code = "SESSION_EXPIRED";
-    } else if (status === 400 && (lowerMsg.includes("mot de passe") || lowerMsg.includes("password"))) {
+    } else if (status === 400 && (lowerMsg.includes("current password") || lowerMsg.includes("old password") || lowerMsg.includes("password") && lowerMsg.includes("required"))) {
+      this.code = lowerMsg.includes("incorrect") || lowerMsg.includes("invalid") ? "INVALID_CURRENT_PASSWORD" : "CURRENT_PASSWORD_REQUIRED";
+    } else if (status === 400 && lowerMsg.includes("password") && (lowerMsg.includes("weak") || lowerMsg.includes("length") || lowerMsg.includes("strength") || lowerMsg.includes("character") || lowerMsg.includes("digit") || lowerMsg.includes("pwned") || lowerMsg.includes("too short") || lowerMsg.includes("too common"))) {
       this.code = "WEAK_PASSWORD";
-    } else if (status === 409 && (lowerMsg.includes("d\xE9j\xE0 utilis\xE9") || lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
+    } else if (status === 400 && lowerMsg.includes("password")) {
+      this.code = "INVALID_PASSWORD";
+    } else if (status === 409 && (lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
       this.code = "EMAIL_ALREADY_IN_USE";
-    } else if (status === 404 && (lowerMsg.includes("utilisateur") || lowerMsg.includes("user not found"))) {
+    } else if (status === 404 && lowerMsg.includes("user not found")) {
       this.code = "USER_NOT_FOUND";
     } else {
       this.code = canonical ?? `HTTP_${status}`;
@@ -279,6 +283,33 @@ var AUTH_SETTINGS_WRITABLE_FIELDS = [
   "hook_secret"
 ];
 
+// src/cookie-utils.ts
+function parseCookieHeader(header) {
+  const result = {};
+  if (!header) return result;
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    const key = pair.slice(0, idx).trim();
+    const value = pair.slice(idx + 1).trim();
+    if (key) result[key] = decodeURIComponent(value);
+  }
+  return result;
+}
+function sameSiteAttribute(v) {
+  return v.charAt(0).toUpperCase() + v.slice(1);
+}
+function serializeCookieHeader(name, value, options = {}) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  if (options.path) parts.push(`Path=${options.path}`);
+  if (options.domain) parts.push(`Domain=${options.domain}`);
+  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+  if (options.secure) parts.push("Secure");
+  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+  if (options.httpOnly) parts.push("HttpOnly");
+  return parts.join("; ");
+}
+
 // src/stores/BaseAuthStore.ts
 function decodeJwtPayload(token) {
   try {
@@ -292,6 +323,24 @@ function decodeJwtPayload(token) {
     return null;
   }
 }
+function userFromAccessToken(token) {
+  const c = decodeJwtPayload(token);
+  if (!c || typeof c.sub !== "string") return null;
+  const meta = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
+  const amr = Array.isArray(c.amr) ? c.amr : [];
+  return {
+    id: c.sub,
+    email: typeof c.email === "string" ? c.email : null,
+    role: "authenticated",
+    email_verified: false,
+    is_banned: false,
+    is_anonymous: amr.some((a) => a?.method === "anonymous"),
+    mfa_enabled: c.aal === "aal2",
+    user_metadata: meta(c.user_metadata),
+    app_metadata: meta(c.app_metadata),
+    created_at: ""
+  };
+}
 function isTokenExpired(token, marginSec = 0) {
   const payload = decodeJwtPayload(token);
   if (!payload || typeof payload.exp !== "number") return true;
@@ -305,6 +354,7 @@ var BaseAuthStore = class {
    * le flux PKCE : le `code_verifier` doit survivre au redirect OAuth.
    */
   persistent = false;
+  key;
   _token = null;
   _refreshToken = null;
   _user = null;
@@ -315,6 +365,9 @@ var BaseAuthStore = class {
   /** Hook d'observabilité (LOT 3) — câblé par `AuraClient` via `setObservabilityHook`. */
   _onEvent;
   _debug = false;
+  constructor(key = "aura-auth") {
+    this.key = key;
+  }
   // -- Getters ----------------------------------------------------------------
   /** Compteur incrémenté à chaque `clear()` — sert au commit-guard anti-race du refresh. */
   get removalEpoch() {
@@ -376,6 +429,43 @@ var BaseAuthStore = class {
   _emitStorageBlocked(op) {
     emitAuraEvent(this._onEvent, this._debug, { kind: "storage-blocked", op });
   }
+  /**
+   * Populate the store from a raw `Cookie` header string (server-side).
+   * Looks for the key matching `this.key`.
+   */
+  loadFromCookie(cookieString) {
+    const prefix = `${this.key}=`;
+    const entry = cookieString.split(";").map((c) => c.trim()).find((c) => c.startsWith(prefix));
+    if (!entry) return;
+    try {
+      const raw = decodeURIComponent(entry.slice(prefix.length));
+      const parsed = JSON.parse(raw);
+      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
+      if (parsed.token && parsed.refreshToken && user) {
+        this.save(parsed.token, parsed.refreshToken, user);
+      }
+    } catch {
+    }
+  }
+  /**
+   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+   * `user_metadata` is already inside the access token.
+   */
+  exportToCookie(options = {}) {
+    const data = {
+      token: this.token,
+      refreshToken: this.refreshToken
+    };
+    const encoded = encodeURIComponent(JSON.stringify(data));
+    const parts = [`${this.key}=${encoded}`];
+    if (options.path) parts.push(`Path=${options.path}`);
+    if (options.domain) parts.push(`Domain=${options.domain}`);
+    if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+    if (options.secure) parts.push("Secure");
+    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+    if (options.httpOnly) parts.push("HttpOnly");
+    return parts.join("; ");
+  }
   // -- Event emitter ----------------------------------------------------------
   /**
    * Register a callback that fires whenever the auth state changes.
@@ -870,45 +960,16 @@ var BaseService = class {
   }
 };
 
-// src/cookie-utils.ts
-function parseCookieHeader(header) {
-  const result = {};
-  if (!header) return result;
-  for (const pair of header.split(";")) {
-    const idx = pair.indexOf("=");
-    if (idx === -1) continue;
-    const key = pair.slice(0, idx).trim();
-    const value = pair.slice(idx + 1).trim();
-    if (key) result[key] = decodeURIComponent(value);
-  }
-  return result;
-}
-function sameSiteAttribute(v) {
-  return v.charAt(0).toUpperCase() + v.slice(1);
-}
-function serializeCookieHeader(name, value, options = {}) {
-  const parts = [`${name}=${encodeURIComponent(value)}`];
-  if (options.path) parts.push(`Path=${options.path}`);
-  if (options.domain) parts.push(`Domain=${options.domain}`);
-  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-  if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
-  if (options.httpOnly) parts.push("HttpOnly");
-  return parts.join("; ");
-}
-
 // src/stores/LocalAuthStore.ts
 var LocalAuthStore = class extends BaseAuthStore {
   /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
   persistent = true;
-  key;
   /**
    * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
    *            `aura-${clientScope(baseUrl)}-auth`.
    */
   constructor(key) {
-    super();
-    this.key = key;
+    super(key);
     this._loadFromStorage();
   }
   // -- Overrides --------------------------------------------------------------
@@ -983,6 +1044,9 @@ var LocalAuthStore = class extends BaseAuthStore {
   /**
    * Populate the store from a raw `Cookie` header string (server-side).
    * Looks for the key matching `this.key`.
+   *
+   * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
+   * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
    */
   loadFromCookie(cookieString) {
     const prefix = `${this.key}=`;
@@ -991,20 +1055,22 @@ var LocalAuthStore = class extends BaseAuthStore {
     try {
       const raw = decodeURIComponent(entry.slice(prefix.length));
       const parsed = JSON.parse(raw);
-      if (parsed.token && parsed.refreshToken && parsed.user) {
-        super.save(parsed.token, parsed.refreshToken, parsed.user);
+      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
+      if (parsed.token && parsed.refreshToken && user) {
+        super.save(parsed.token, parsed.refreshToken, user);
       }
     } catch {
     }
   }
   /**
-   * Serialize current auth state into a `Set-Cookie` value.
+   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+   * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
+   * (5 KB of metadata gave 4 cookies and 13 139 bytes).
    */
   exportToCookie(options = {}) {
     const data = {
       token: this.token,
-      refreshToken: this.refreshToken,
-      user: this.user
+      refreshToken: this.refreshToken
     };
     const encoded = encodeURIComponent(JSON.stringify(data));
     const parts = [`${this.key}=${encoded}`];

package/dist/index.d.cts

@@ -14,7 +14,7 @@
  *  - storage/path.ts   : invalid_path
  *  - db/QueryBuilder.ts: PGRST116 (parité PostgREST : `.single()` sur 0/plusieurs lignes)
  */
-type AuraErrorCode = 'NO_SESSION' | 'TIMEOUT' | 'NETWORK_ERROR' | 'INVALID_RESPONSE' | 'REFRESH_DISCARDED' | 'UNVERIFIABLE_TOKEN' | 'NO_CODE_VERIFIER' | 'PKCE_GENERATION_FAILED' | 'MISSING_EMAIL' | 'JWKS_FETCH_FAILED' | 'SIGNATURE_INVALID' | 'TOKEN_EXPIRED' | 'TOKEN_NOT_YET_VALID' | 'INVALID_JWT' | 'UNSUPPORTED_ALG' | 'NO_MATCHING_KEY' | 'INVALID_ISSUER' | 'INVALID_AUDIENCE' | 'INVALID_PATH' | 'PGRST116' | 'INVALID_CREDENTIALS' | 'WEAK_PASSWORD' | 'EMAIL_ALREADY_IN_USE' | 'USER_NOT_FOUND' | 'RATE_LIMITED' | 'SESSION_EXPIRED' | 'INVALID_OTP' | 'SESSION_REVOKED' | (string & {});
+type AuraErrorCode = 'NO_SESSION' | 'TIMEOUT' | 'NETWORK_ERROR' | 'INVALID_RESPONSE' | 'REFRESH_DISCARDED' | 'UNVERIFIABLE_TOKEN' | 'NO_CODE_VERIFIER' | 'PKCE_GENERATION_FAILED' | 'MISSING_EMAIL' | 'JWKS_FETCH_FAILED' | 'SIGNATURE_INVALID' | 'TOKEN_EXPIRED' | 'TOKEN_NOT_YET_VALID' | 'INVALID_JWT' | 'UNSUPPORTED_ALG' | 'NO_MATCHING_KEY' | 'INVALID_ISSUER' | 'INVALID_AUDIENCE' | 'INVALID_PATH' | 'PGRST116' | 'INVALID_CREDENTIALS' | 'WEAK_PASSWORD' | 'PASSWORD_REQUIRED' | 'EMAIL_ALREADY_IN_USE' | 'USER_NOT_FOUND' | 'USER_BANNED' | 'EMAIL_NOT_CONFIRMED' | 'RATE_LIMITED' | 'SESSION_EXPIRED' | 'INVALID_OTP' | 'SESSION_REVOKED' | 'MFA_CODE_INVALID' | 'MFA_CODE_ALREADY_USED' | 'TOTP_CODE_REUSED' | 'MFA_CHALLENGE_EXPIRED' | (string & {});
 /**
  * Structured error thrown/returned by the Aurabase SDK.
  * Mirrors the backend's `AuraError` JSON shape with semantic DX normalization.
@@ -34,6 +34,8 @@ declare class AuraError extends Error {
         error?: {
             code?: string;
             message?: string;
+            hint?: string;
+            details?: unknown;
         };
         message?: string;
     } | null, headers?: Headers | Record<string, string | null | undefined>);
@@ -201,12 +203,10 @@ interface User {
     last_sign_in_at?: string | null;
 }
 interface Session {
+    /** Identifiant unique de la session (UUID ou 'sess_...'), dérivé du claim `session_id` du JWT. */
+    id?: string;
     access_token: string;
     refresh_token: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    accessToken?: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    refreshToken?: string;
     token_type: string;
     expires_in: number;
     expires_at?: number;
@@ -217,30 +217,20 @@ interface Session {
 interface TokenPair {
     access_token: string;
     refresh_token: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    accessToken?: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    refreshToken?: string;
     token_type: string;
     expires_in: number;
     user: User;
     provider_token?: string | null;
     provider_refresh_token?: string | null;
-    /** Sous-objet session pour parité DX Supabase (`data.session.access_token`). */
-    session?: Session;
-    mfaChallenge?: undefined;
+    /** Sous-objet session pour parité DX Supabase (`data.session.access_token`).
+     * `null` après une inscription sur un projet qui exige un e-mail vérifié (AUTH-002). */
+    session?: Session | null;
 }
 interface MfaChallenge {
     mfa_required: true;
     mfa_token: string;
     mfa_setup_required?: boolean;
     session?: undefined;
-    /** Alias ergonomique aligné sur la documentation officielle */
-    mfaChallenge?: {
-        mfaRequired: boolean;
-        mfaToken: string;
-        mfaSetupRequired?: boolean;
-    };
 }
 type LoginResponse = TokenPair | MfaChallenge;
 type AuthEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED' | 'USER_UPDATED' | 'MFA_CHALLENGE' | 'PASSWORD_RECOVERY';
@@ -279,6 +269,7 @@ interface SignUpRequest {
     options?: {
         emailRedirectTo?: string;
         data?: Record<string, unknown>;
+        preventEmailEnumeration?: boolean;
     };
 }
 interface SignInRequest {
@@ -375,9 +366,46 @@ interface MfaEnrollResponse {
     otpauth_url: string;
     secret: string;
 }
-interface MfaVerifyRequest {
-    mfa_token: string;
+/**
+ * Relève un défi MFA : exactement UN facteur parmi `code` (TOTP à 6 chiffres), `recovery_code`
+ * (code de secours `XXXXXXXX-XXXXXXXX`) et `sms_code` (code reçu après `auth.mfa.sms.send`).
+ * Pour une passkey, utilisez `auth.mfa.webauthn.verify`.
+ */
+type MfaVerifyRequest = {
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     code: string;
+} | {
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
+    recovery_code: string;
+    recoveryCode?: string;
+} | {
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
+    sms_code: string;
+    smsCode?: string;
+};
+/** Facteur MFA utilisable pour relever un défi (`auth.mfa.factors`). */
+type MfaFactorType = 'totp' | 'webauthn' | 'sms';
+/** Passkey WebAuthn enrôlée (`auth.mfa.webauthn.list`). */
+interface PasskeyInfo {
+    id: string;
+    friendly_name: string;
+    created_at: string;
+    last_used_at: string | null;
+}
+/** Résultat de l'enrôlement d'une passkey. `recovery_codes` n'est présent que si cette passkey est le premier facteur du compte. */
+interface PasskeyRegisterResult {
+    id: string;
+    friendly_name: string;
+    recovery_codes?: string[];
 }
 interface SessionInfo {
     id: string;
@@ -1504,6 +1532,11 @@ interface AuraClientOptions {
          * Défaut : `true` en navigateur, no-op hors navigateur (SSR/Node).
          */
         detectSessionInUrl?: boolean;
+        /**
+         * AUTH-015 — flux OAuth par défaut de `signInWithOAuth` pour ce client (`'pkce'` recommandé
+         * en navigateur). Une option `flowType` passée à l'appel reste prioritaire.
+         */
+        flowType?: 'pkce' | 'implicit';
     };
     fetch?: typeof globalThis.fetch;
     /**
@@ -1787,7 +1820,7 @@ interface AdminUpdateUserRequest {
     mfa_enabled?: boolean;
     revoke_sessions?: boolean;
 }
-type GenerateLinkType = 'magic' | 'recovery' | 'invite';
+type GenerateLinkType = 'signup' | 'magic' | 'recovery' | 'invite';
 interface GenerateLinkResult {
     link: string;
     token: string;
@@ -1820,6 +1853,19 @@ type AuthChangeCallback = (token: string | null, user: User | null) => void;
  * Check whether a JWT has expired (or will expire within `marginSec` seconds).
  */
 declare function isTokenExpired(token: string, marginSec?: number): boolean;
+interface CookieOptions {
+    path?: string;
+    domain?: string;
+    maxAge?: number;
+    secure?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    httpOnly?: boolean;
+}
+interface StoredAuth {
+    token: string | null;
+    refreshToken: string | null;
+    user: User | null;
+}
 /**
  * In-memory auth store with an event-emitter pattern.
  * Can be extended (see LocalAuthStore) for persistence.
@@ -1831,6 +1877,7 @@ declare class BaseAuthStore {
      * le flux PKCE : le `code_verifier` doit survivre au redirect OAuth.
      */
     readonly persistent: boolean;
+    protected readonly key: string;
     private _token;
     private _refreshToken;
     private _user;
@@ -1841,6 +1888,7 @@ declare class BaseAuthStore {
     /** Hook d'observabilité (LOT 3) — câblé par `AuraClient` via `setObservabilityHook`. */
     private _onEvent?;
     private _debug;
+    constructor(key?: string);
     /** Compteur incrémenté à chaque `clear()` — sert au commit-guard anti-race du refresh. */
     get removalEpoch(): number;
     get token(): string | null;
@@ -1862,6 +1910,16 @@ declare class BaseAuthStore {
     setObservabilityHook(onEvent: ((event: AuraObservabilityEvent) => void) | undefined, debug: boolean | undefined): void;
     /** Émet `{kind:'storage-blocked', op}` — ne throw jamais (voir `emitAuraEvent`). */
     protected _emitStorageBlocked(op: string): void;
+    /**
+     * Populate the store from a raw `Cookie` header string (server-side).
+     * Looks for the key matching `this.key`.
+     */
+    loadFromCookie(cookieString: string): void;
+    /**
+     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+     * `user_metadata` is already inside the access token.
+     */
+    exportToCookie(options?: CookieOptions): string;
     /**
      * Register a callback that fires whenever the auth state changes.
      * Returns an unsubscribe function.
@@ -2019,14 +2077,6 @@ declare function clientScope(baseUrl: string): string;
 /** JSON.stringify avec support des bigint (sérialisés en string). */
 declare function serializeBody(body: unknown): string;
 
-interface CookieOptions {
-    path?: string;
-    domain?: string;
-    maxAge?: number;
-    secure?: boolean;
-    sameSite?: 'strict' | 'lax' | 'none';
-    httpOnly?: boolean;
-}
 /**
  * Auth store backed by `localStorage` (browser) with cookie helpers for SSR.
  *
@@ -2043,7 +2093,6 @@ interface CookieOptions {
 declare class LocalAuthStore extends BaseAuthStore {
     /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
     readonly persistent = true;
-    private readonly key;
     /**
      * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
      *            `aura-${clientScope(baseUrl)}-auth`.
@@ -2067,10 +2116,15 @@ declare class LocalAuthStore extends BaseAuthStore {
     /**
      * Populate the store from a raw `Cookie` header string (server-side).
      * Looks for the key matching `this.key`.
+     *
+     * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
+     * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
      */
     loadFromCookie(cookieString: string): void;
     /**
-     * Serialize current auth state into a `Set-Cookie` value.
+     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+     * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
+     * (5 KB of metadata gave 4 cookies and 13 139 bytes).
      */
     exportToCookie(options?: CookieOptions): string;
     private _getStorage;
@@ -2079,4 +2133,4 @@ declare class LocalAuthStore extends BaseAuthStore {
     private _removeStorage;
 }
 
-export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CookieOptions, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaFactorType, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasskeyInfo, type PasskeyRegisterResult, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type StoredAuth, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.d.ts

@@ -14,7 +14,7 @@
  *  - storage/path.ts   : invalid_path
  *  - db/QueryBuilder.ts: PGRST116 (parité PostgREST : `.single()` sur 0/plusieurs lignes)
  */
-type AuraErrorCode = 'NO_SESSION' | 'TIMEOUT' | 'NETWORK_ERROR' | 'INVALID_RESPONSE' | 'REFRESH_DISCARDED' | 'UNVERIFIABLE_TOKEN' | 'NO_CODE_VERIFIER' | 'PKCE_GENERATION_FAILED' | 'MISSING_EMAIL' | 'JWKS_FETCH_FAILED' | 'SIGNATURE_INVALID' | 'TOKEN_EXPIRED' | 'TOKEN_NOT_YET_VALID' | 'INVALID_JWT' | 'UNSUPPORTED_ALG' | 'NO_MATCHING_KEY' | 'INVALID_ISSUER' | 'INVALID_AUDIENCE' | 'INVALID_PATH' | 'PGRST116' | 'INVALID_CREDENTIALS' | 'WEAK_PASSWORD' | 'EMAIL_ALREADY_IN_USE' | 'USER_NOT_FOUND' | 'RATE_LIMITED' | 'SESSION_EXPIRED' | 'INVALID_OTP' | 'SESSION_REVOKED' | (string & {});
+type AuraErrorCode = 'NO_SESSION' | 'TIMEOUT' | 'NETWORK_ERROR' | 'INVALID_RESPONSE' | 'REFRESH_DISCARDED' | 'UNVERIFIABLE_TOKEN' | 'NO_CODE_VERIFIER' | 'PKCE_GENERATION_FAILED' | 'MISSING_EMAIL' | 'JWKS_FETCH_FAILED' | 'SIGNATURE_INVALID' | 'TOKEN_EXPIRED' | 'TOKEN_NOT_YET_VALID' | 'INVALID_JWT' | 'UNSUPPORTED_ALG' | 'NO_MATCHING_KEY' | 'INVALID_ISSUER' | 'INVALID_AUDIENCE' | 'INVALID_PATH' | 'PGRST116' | 'INVALID_CREDENTIALS' | 'WEAK_PASSWORD' | 'PASSWORD_REQUIRED' | 'EMAIL_ALREADY_IN_USE' | 'USER_NOT_FOUND' | 'USER_BANNED' | 'EMAIL_NOT_CONFIRMED' | 'RATE_LIMITED' | 'SESSION_EXPIRED' | 'INVALID_OTP' | 'SESSION_REVOKED' | 'MFA_CODE_INVALID' | 'MFA_CODE_ALREADY_USED' | 'TOTP_CODE_REUSED' | 'MFA_CHALLENGE_EXPIRED' | (string & {});
 /**
  * Structured error thrown/returned by the Aurabase SDK.
  * Mirrors the backend's `AuraError` JSON shape with semantic DX normalization.
@@ -34,6 +34,8 @@ declare class AuraError extends Error {
         error?: {
             code?: string;
             message?: string;
+            hint?: string;
+            details?: unknown;
         };
         message?: string;
     } | null, headers?: Headers | Record<string, string | null | undefined>);
@@ -201,12 +203,10 @@ interface User {
     last_sign_in_at?: string | null;
 }
 interface Session {
+    /** Identifiant unique de la session (UUID ou 'sess_...'), dérivé du claim `session_id` du JWT. */
+    id?: string;
     access_token: string;
     refresh_token: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    accessToken?: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    refreshToken?: string;
     token_type: string;
     expires_in: number;
     expires_at?: number;
@@ -217,30 +217,20 @@ interface Session {
 interface TokenPair {
     access_token: string;
     refresh_token: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    accessToken?: string;
-    /** Alias camelCase pour parité DX Supabase/JS */
-    refreshToken?: string;
     token_type: string;
     expires_in: number;
     user: User;
     provider_token?: string | null;
     provider_refresh_token?: string | null;
-    /** Sous-objet session pour parité DX Supabase (`data.session.access_token`). */
-    session?: Session;
-    mfaChallenge?: undefined;
+    /** Sous-objet session pour parité DX Supabase (`data.session.access_token`).
+     * `null` après une inscription sur un projet qui exige un e-mail vérifié (AUTH-002). */
+    session?: Session | null;
 }
 interface MfaChallenge {
     mfa_required: true;
     mfa_token: string;
     mfa_setup_required?: boolean;
     session?: undefined;
-    /** Alias ergonomique aligné sur la documentation officielle */
-    mfaChallenge?: {
-        mfaRequired: boolean;
-        mfaToken: string;
-        mfaSetupRequired?: boolean;
-    };
 }
 type LoginResponse = TokenPair | MfaChallenge;
 type AuthEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED' | 'USER_UPDATED' | 'MFA_CHALLENGE' | 'PASSWORD_RECOVERY';
@@ -279,6 +269,7 @@ interface SignUpRequest {
     options?: {
         emailRedirectTo?: string;
         data?: Record<string, unknown>;
+        preventEmailEnumeration?: boolean;
     };
 }
 interface SignInRequest {
@@ -375,9 +366,46 @@ interface MfaEnrollResponse {
     otpauth_url: string;
     secret: string;
 }
-interface MfaVerifyRequest {
-    mfa_token: string;
+/**
+ * Relève un défi MFA : exactement UN facteur parmi `code` (TOTP à 6 chiffres), `recovery_code`
+ * (code de secours `XXXXXXXX-XXXXXXXX`) et `sms_code` (code reçu après `auth.mfa.sms.send`).
+ * Pour une passkey, utilisez `auth.mfa.webauthn.verify`.
+ */
+type MfaVerifyRequest = {
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     code: string;
+} | {
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
+    recovery_code: string;
+    recoveryCode?: string;
+} | {
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
+    sms_code: string;
+    smsCode?: string;
+};
+/** Facteur MFA utilisable pour relever un défi (`auth.mfa.factors`). */
+type MfaFactorType = 'totp' | 'webauthn' | 'sms';
+/** Passkey WebAuthn enrôlée (`auth.mfa.webauthn.list`). */
+interface PasskeyInfo {
+    id: string;
+    friendly_name: string;
+    created_at: string;
+    last_used_at: string | null;
+}
+/** Résultat de l'enrôlement d'une passkey. `recovery_codes` n'est présent que si cette passkey est le premier facteur du compte. */
+interface PasskeyRegisterResult {
+    id: string;
+    friendly_name: string;
+    recovery_codes?: string[];
 }
 interface SessionInfo {
     id: string;
@@ -1504,6 +1532,11 @@ interface AuraClientOptions {
          * Défaut : `true` en navigateur, no-op hors navigateur (SSR/Node).
          */
         detectSessionInUrl?: boolean;
+        /**
+         * AUTH-015 — flux OAuth par défaut de `signInWithOAuth` pour ce client (`'pkce'` recommandé
+         * en navigateur). Une option `flowType` passée à l'appel reste prioritaire.
+         */
+        flowType?: 'pkce' | 'implicit';
     };
     fetch?: typeof globalThis.fetch;
     /**
@@ -1787,7 +1820,7 @@ interface AdminUpdateUserRequest {
     mfa_enabled?: boolean;
     revoke_sessions?: boolean;
 }
-type GenerateLinkType = 'magic' | 'recovery' | 'invite';
+type GenerateLinkType = 'signup' | 'magic' | 'recovery' | 'invite';
 interface GenerateLinkResult {
     link: string;
     token: string;
@@ -1820,6 +1853,19 @@ type AuthChangeCallback = (token: string | null, user: User | null) => void;
  * Check whether a JWT has expired (or will expire within `marginSec` seconds).
  */
 declare function isTokenExpired(token: string, marginSec?: number): boolean;
+interface CookieOptions {
+    path?: string;
+    domain?: string;
+    maxAge?: number;
+    secure?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    httpOnly?: boolean;
+}
+interface StoredAuth {
+    token: string | null;
+    refreshToken: string | null;
+    user: User | null;
+}
 /**
  * In-memory auth store with an event-emitter pattern.
  * Can be extended (see LocalAuthStore) for persistence.
@@ -1831,6 +1877,7 @@ declare class BaseAuthStore {
      * le flux PKCE : le `code_verifier` doit survivre au redirect OAuth.
      */
     readonly persistent: boolean;
+    protected readonly key: string;
     private _token;
     private _refreshToken;
     private _user;
@@ -1841,6 +1888,7 @@ declare class BaseAuthStore {
     /** Hook d'observabilité (LOT 3) — câblé par `AuraClient` via `setObservabilityHook`. */
     private _onEvent?;
     private _debug;
+    constructor(key?: string);
     /** Compteur incrémenté à chaque `clear()` — sert au commit-guard anti-race du refresh. */
     get removalEpoch(): number;
     get token(): string | null;
@@ -1862,6 +1910,16 @@ declare class BaseAuthStore {
     setObservabilityHook(onEvent: ((event: AuraObservabilityEvent) => void) | undefined, debug: boolean | undefined): void;
     /** Émet `{kind:'storage-blocked', op}` — ne throw jamais (voir `emitAuraEvent`). */
     protected _emitStorageBlocked(op: string): void;
+    /**
+     * Populate the store from a raw `Cookie` header string (server-side).
+     * Looks for the key matching `this.key`.
+     */
+    loadFromCookie(cookieString: string): void;
+    /**
+     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+     * `user_metadata` is already inside the access token.
+     */
+    exportToCookie(options?: CookieOptions): string;
     /**
      * Register a callback that fires whenever the auth state changes.
      * Returns an unsubscribe function.
@@ -2019,14 +2077,6 @@ declare function clientScope(baseUrl: string): string;
 /** JSON.stringify avec support des bigint (sérialisés en string). */
 declare function serializeBody(body: unknown): string;
 
-interface CookieOptions {
-    path?: string;
-    domain?: string;
-    maxAge?: number;
-    secure?: boolean;
-    sameSite?: 'strict' | 'lax' | 'none';
-    httpOnly?: boolean;
-}
 /**
  * Auth store backed by `localStorage` (browser) with cookie helpers for SSR.
  *
@@ -2043,7 +2093,6 @@ interface CookieOptions {
 declare class LocalAuthStore extends BaseAuthStore {
     /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
     readonly persistent = true;
-    private readonly key;
     /**
      * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
      *            `aura-${clientScope(baseUrl)}-auth`.
@@ -2067,10 +2116,15 @@ declare class LocalAuthStore extends BaseAuthStore {
     /**
      * Populate the store from a raw `Cookie` header string (server-side).
      * Looks for the key matching `this.key`.
+     *
+     * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
+     * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
      */
     loadFromCookie(cookieString: string): void;
     /**
-     * Serialize current auth state into a `Set-Cookie` value.
+     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+     * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
+     * (5 KB of metadata gave 4 cookies and 13 139 bytes).
      */
     exportToCookie(options?: CookieOptions): string;
     private _getStorage;
@@ -2079,4 +2133,4 @@ declare class LocalAuthStore extends BaseAuthStore {
     private _removeStorage;
 }
 
-export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CookieOptions, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaFactorType, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasskeyInfo, type PasskeyRegisterResult, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type StoredAuth, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.js

@@ -88,17 +88,21 @@ var AuraError = class _AuraError extends Error {
       this.code = canonical;
     } else if (status === 429) {
       this.code = "RATE_LIMITED";
-    } else if (status === 401 && (lowerMsg.includes("identifiants") || lowerMsg.includes("credentials") || lowerMsg.includes("mot de passe incorrect"))) {
+    } else if (status === 401 && lowerMsg.includes("credentials")) {
       this.code = "INVALID_CREDENTIALS";
-    } else if (status === 401 && (lowerMsg.includes("r\xE9voqu\xE9e") || lowerMsg.includes("revoked"))) {
+    } else if (status === 401 && lowerMsg.includes("revoked")) {
       this.code = "SESSION_REVOKED";
-    } else if (status === 401 && (lowerMsg.includes("expir\xE9") || lowerMsg.includes("expired"))) {
+    } else if (status === 401 && lowerMsg.includes("expired")) {
       this.code = "SESSION_EXPIRED";
-    } else if (status === 400 && (lowerMsg.includes("mot de passe") || lowerMsg.includes("password"))) {
+    } else if (status === 400 && (lowerMsg.includes("current password") || lowerMsg.includes("old password") || lowerMsg.includes("password") && lowerMsg.includes("required"))) {
+      this.code = lowerMsg.includes("incorrect") || lowerMsg.includes("invalid") ? "INVALID_CURRENT_PASSWORD" : "CURRENT_PASSWORD_REQUIRED";
+    } else if (status === 400 && lowerMsg.includes("password") && (lowerMsg.includes("weak") || lowerMsg.includes("length") || lowerMsg.includes("strength") || lowerMsg.includes("character") || lowerMsg.includes("digit") || lowerMsg.includes("pwned") || lowerMsg.includes("too short") || lowerMsg.includes("too common"))) {
       this.code = "WEAK_PASSWORD";
-    } else if (status === 409 && (lowerMsg.includes("d\xE9j\xE0 utilis\xE9") || lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
+    } else if (status === 400 && lowerMsg.includes("password")) {
+      this.code = "INVALID_PASSWORD";
+    } else if (status === 409 && (lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
       this.code = "EMAIL_ALREADY_IN_USE";
-    } else if (status === 404 && (lowerMsg.includes("utilisateur") || lowerMsg.includes("user not found"))) {
+    } else if (status === 404 && lowerMsg.includes("user not found")) {
       this.code = "USER_NOT_FOUND";
     } else {
       this.code = canonical ?? `HTTP_${status}`;
@@ -277,6 +281,33 @@ var AUTH_SETTINGS_WRITABLE_FIELDS = [
   "hook_secret"
 ];
 
+// src/cookie-utils.ts
+function parseCookieHeader(header) {
+  const result = {};
+  if (!header) return result;
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    const key = pair.slice(0, idx).trim();
+    const value = pair.slice(idx + 1).trim();
+    if (key) result[key] = decodeURIComponent(value);
+  }
+  return result;
+}
+function sameSiteAttribute(v) {
+  return v.charAt(0).toUpperCase() + v.slice(1);
+}
+function serializeCookieHeader(name, value, options = {}) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  if (options.path) parts.push(`Path=${options.path}`);
+  if (options.domain) parts.push(`Domain=${options.domain}`);
+  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+  if (options.secure) parts.push("Secure");
+  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+  if (options.httpOnly) parts.push("HttpOnly");
+  return parts.join("; ");
+}
+
 // src/stores/BaseAuthStore.ts
 function decodeJwtPayload(token) {
   try {
@@ -290,6 +321,24 @@ function decodeJwtPayload(token) {
     return null;
   }
 }
+function userFromAccessToken(token) {
+  const c = decodeJwtPayload(token);
+  if (!c || typeof c.sub !== "string") return null;
+  const meta = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
+  const amr = Array.isArray(c.amr) ? c.amr : [];
+  return {
+    id: c.sub,
+    email: typeof c.email === "string" ? c.email : null,
+    role: "authenticated",
+    email_verified: false,
+    is_banned: false,
+    is_anonymous: amr.some((a) => a?.method === "anonymous"),
+    mfa_enabled: c.aal === "aal2",
+    user_metadata: meta(c.user_metadata),
+    app_metadata: meta(c.app_metadata),
+    created_at: ""
+  };
+}
 function isTokenExpired(token, marginSec = 0) {
   const payload = decodeJwtPayload(token);
   if (!payload || typeof payload.exp !== "number") return true;
@@ -303,6 +352,7 @@ var BaseAuthStore = class {
    * le flux PKCE : le `code_verifier` doit survivre au redirect OAuth.
    */
   persistent = false;
+  key;
   _token = null;
   _refreshToken = null;
   _user = null;
@@ -313,6 +363,9 @@ var BaseAuthStore = class {
   /** Hook d'observabilité (LOT 3) — câblé par `AuraClient` via `setObservabilityHook`. */
   _onEvent;
   _debug = false;
+  constructor(key = "aura-auth") {
+    this.key = key;
+  }
   // -- Getters ----------------------------------------------------------------
   /** Compteur incrémenté à chaque `clear()` — sert au commit-guard anti-race du refresh. */
   get removalEpoch() {
@@ -374,6 +427,43 @@ var BaseAuthStore = class {
   _emitStorageBlocked(op) {
     emitAuraEvent(this._onEvent, this._debug, { kind: "storage-blocked", op });
   }
+  /**
+   * Populate the store from a raw `Cookie` header string (server-side).
+   * Looks for the key matching `this.key`.
+   */
+  loadFromCookie(cookieString) {
+    const prefix = `${this.key}=`;
+    const entry = cookieString.split(";").map((c) => c.trim()).find((c) => c.startsWith(prefix));
+    if (!entry) return;
+    try {
+      const raw = decodeURIComponent(entry.slice(prefix.length));
+      const parsed = JSON.parse(raw);
+      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
+      if (parsed.token && parsed.refreshToken && user) {
+        this.save(parsed.token, parsed.refreshToken, user);
+      }
+    } catch {
+    }
+  }
+  /**
+   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+   * `user_metadata` is already inside the access token.
+   */
+  exportToCookie(options = {}) {
+    const data = {
+      token: this.token,
+      refreshToken: this.refreshToken
+    };
+    const encoded = encodeURIComponent(JSON.stringify(data));
+    const parts = [`${this.key}=${encoded}`];
+    if (options.path) parts.push(`Path=${options.path}`);
+    if (options.domain) parts.push(`Domain=${options.domain}`);
+    if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+    if (options.secure) parts.push("Secure");
+    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+    if (options.httpOnly) parts.push("HttpOnly");
+    return parts.join("; ");
+  }
   // -- Event emitter ----------------------------------------------------------
   /**
    * Register a callback that fires whenever the auth state changes.
@@ -868,45 +958,16 @@ var BaseService = class {
   }
 };
 
-// src/cookie-utils.ts
-function parseCookieHeader(header) {
-  const result = {};
-  if (!header) return result;
-  for (const pair of header.split(";")) {
-    const idx = pair.indexOf("=");
-    if (idx === -1) continue;
-    const key = pair.slice(0, idx).trim();
-    const value = pair.slice(idx + 1).trim();
-    if (key) result[key] = decodeURIComponent(value);
-  }
-  return result;
-}
-function sameSiteAttribute(v) {
-  return v.charAt(0).toUpperCase() + v.slice(1);
-}
-function serializeCookieHeader(name, value, options = {}) {
-  const parts = [`${name}=${encodeURIComponent(value)}`];
-  if (options.path) parts.push(`Path=${options.path}`);
-  if (options.domain) parts.push(`Domain=${options.domain}`);
-  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-  if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
-  if (options.httpOnly) parts.push("HttpOnly");
-  return parts.join("; ");
-}
-
 // src/stores/LocalAuthStore.ts
 var LocalAuthStore = class extends BaseAuthStore {
   /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
   persistent = true;
-  key;
   /**
    * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
    *            `aura-${clientScope(baseUrl)}-auth`.
    */
   constructor(key) {
-    super();
-    this.key = key;
+    super(key);
     this._loadFromStorage();
   }
   // -- Overrides --------------------------------------------------------------
@@ -981,6 +1042,9 @@ var LocalAuthStore = class extends BaseAuthStore {
   /**
    * Populate the store from a raw `Cookie` header string (server-side).
    * Looks for the key matching `this.key`.
+   *
+   * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
+   * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
    */
   loadFromCookie(cookieString) {
     const prefix = `${this.key}=`;
@@ -989,20 +1053,22 @@ var LocalAuthStore = class extends BaseAuthStore {
     try {
       const raw = decodeURIComponent(entry.slice(prefix.length));
       const parsed = JSON.parse(raw);
-      if (parsed.token && parsed.refreshToken && parsed.user) {
-        super.save(parsed.token, parsed.refreshToken, parsed.user);
+      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
+      if (parsed.token && parsed.refreshToken && user) {
+        super.save(parsed.token, parsed.refreshToken, user);
       }
     } catch {
     }
   }
   /**
-   * Serialize current auth state into a `Set-Cookie` value.
+   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+   * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
+   * (5 KB of metadata gave 4 cookies and 13 139 bytes).
    */
   exportToCookie(options = {}) {
     const data = {
       token: this.token,
-      refreshToken: this.refreshToken,
-      user: this.user
+      refreshToken: this.refreshToken
     };
     const encoded = encodeURIComponent(JSON.stringify(data));
     const parts = [`${this.key}=${encoded}`];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/core",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "description": "Cœur du SDK Aurabase : fetch résilient, erreurs, stores auth, types de réponse (infrastructure interne)",
   "type": "module",
   "main": "dist/index.cjs",