@aurabase/core 0.7.0 → 0.7.1

package/dist/index.cjs

@@ -96,8 +96,12 @@ var AuraError = class _AuraError extends Error {
       this.code = "SESSION_REVOKED";
     } else if (status === 401 && lowerMsg.includes("expired")) {
       this.code = "SESSION_EXPIRED";
-    } else if (status === 400 && lowerMsg.includes("password")) {
+    } else if (status === 400 && (lowerMsg.includes("current password") || lowerMsg.includes("old password") || lowerMsg.includes("password") && lowerMsg.includes("required"))) {
+      this.code = lowerMsg.includes("incorrect") || lowerMsg.includes("invalid") ? "INVALID_CURRENT_PASSWORD" : "CURRENT_PASSWORD_REQUIRED";
+    } else if (status === 400 && lowerMsg.includes("password") && (lowerMsg.includes("weak") || lowerMsg.includes("length") || lowerMsg.includes("strength") || lowerMsg.includes("character") || lowerMsg.includes("digit") || lowerMsg.includes("pwned") || lowerMsg.includes("too short") || lowerMsg.includes("too common"))) {
       this.code = "WEAK_PASSWORD";
+    } else if (status === 400 && lowerMsg.includes("password")) {
+      this.code = "INVALID_PASSWORD";
     } else if (status === 409 && (lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
       this.code = "EMAIL_ALREADY_IN_USE";
     } else if (status === 404 && lowerMsg.includes("user not found")) {
@@ -279,6 +283,33 @@ var AUTH_SETTINGS_WRITABLE_FIELDS = [
   "hook_secret"
 ];
 
+// src/cookie-utils.ts
+function parseCookieHeader(header) {
+  const result = {};
+  if (!header) return result;
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    const key = pair.slice(0, idx).trim();
+    const value = pair.slice(idx + 1).trim();
+    if (key) result[key] = decodeURIComponent(value);
+  }
+  return result;
+}
+function sameSiteAttribute(v) {
+  return v.charAt(0).toUpperCase() + v.slice(1);
+}
+function serializeCookieHeader(name, value, options = {}) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  if (options.path) parts.push(`Path=${options.path}`);
+  if (options.domain) parts.push(`Domain=${options.domain}`);
+  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+  if (options.secure) parts.push("Secure");
+  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+  if (options.httpOnly) parts.push("HttpOnly");
+  return parts.join("; ");
+}
+
 // src/stores/BaseAuthStore.ts
 function decodeJwtPayload(token) {
   try {
@@ -323,6 +354,7 @@ var BaseAuthStore = class {
    * le flux PKCE : le `code_verifier` doit survivre au redirect OAuth.
    */
   persistent = false;
+  key;
   _token = null;
   _refreshToken = null;
   _user = null;
@@ -333,6 +365,9 @@ var BaseAuthStore = class {
   /** Hook d'observabilité (LOT 3) — câblé par `AuraClient` via `setObservabilityHook`. */
   _onEvent;
   _debug = false;
+  constructor(key = "aura-auth") {
+    this.key = key;
+  }
   // -- Getters ----------------------------------------------------------------
   /** Compteur incrémenté à chaque `clear()` — sert au commit-guard anti-race du refresh. */
   get removalEpoch() {
@@ -394,6 +429,43 @@ var BaseAuthStore = class {
   _emitStorageBlocked(op) {
     emitAuraEvent(this._onEvent, this._debug, { kind: "storage-blocked", op });
   }
+  /**
+   * Populate the store from a raw `Cookie` header string (server-side).
+   * Looks for the key matching `this.key`.
+   */
+  loadFromCookie(cookieString) {
+    const prefix = `${this.key}=`;
+    const entry = cookieString.split(";").map((c) => c.trim()).find((c) => c.startsWith(prefix));
+    if (!entry) return;
+    try {
+      const raw = decodeURIComponent(entry.slice(prefix.length));
+      const parsed = JSON.parse(raw);
+      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
+      if (parsed.token && parsed.refreshToken && user) {
+        this.save(parsed.token, parsed.refreshToken, user);
+      }
+    } catch {
+    }
+  }
+  /**
+   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+   * `user_metadata` is already inside the access token.
+   */
+  exportToCookie(options = {}) {
+    const data = {
+      token: this.token,
+      refreshToken: this.refreshToken
+    };
+    const encoded = encodeURIComponent(JSON.stringify(data));
+    const parts = [`${this.key}=${encoded}`];
+    if (options.path) parts.push(`Path=${options.path}`);
+    if (options.domain) parts.push(`Domain=${options.domain}`);
+    if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+    if (options.secure) parts.push("Secure");
+    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+    if (options.httpOnly) parts.push("HttpOnly");
+    return parts.join("; ");
+  }
   // -- Event emitter ----------------------------------------------------------
   /**
    * Register a callback that fires whenever the auth state changes.
@@ -888,45 +960,16 @@ var BaseService = class {
   }
 };
 
-// src/cookie-utils.ts
-function parseCookieHeader(header) {
-  const result = {};
-  if (!header) return result;
-  for (const pair of header.split(";")) {
-    const idx = pair.indexOf("=");
-    if (idx === -1) continue;
-    const key = pair.slice(0, idx).trim();
-    const value = pair.slice(idx + 1).trim();
-    if (key) result[key] = decodeURIComponent(value);
-  }
-  return result;
-}
-function sameSiteAttribute(v) {
-  return v.charAt(0).toUpperCase() + v.slice(1);
-}
-function serializeCookieHeader(name, value, options = {}) {
-  const parts = [`${name}=${encodeURIComponent(value)}`];
-  if (options.path) parts.push(`Path=${options.path}`);
-  if (options.domain) parts.push(`Domain=${options.domain}`);
-  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-  if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
-  if (options.httpOnly) parts.push("HttpOnly");
-  return parts.join("; ");
-}
-
 // src/stores/LocalAuthStore.ts
 var LocalAuthStore = class extends BaseAuthStore {
   /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
   persistent = true;
-  key;
   /**
    * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
    *            `aura-${clientScope(baseUrl)}-auth`.
    */
   constructor(key) {
-    super();
-    this.key = key;
+    super(key);
     this._loadFromStorage();
   }
   // -- Overrides --------------------------------------------------------------

package/dist/index.d.cts

@@ -203,6 +203,8 @@ interface User {
     last_sign_in_at?: string | null;
 }
 interface Session {
+    /** Identifiant unique de la session (UUID ou 'sess_...'), dérivé du claim `session_id` du JWT. */
+    id?: string;
     access_token: string;
     refresh_token: string;
     token_type: string;
@@ -267,6 +269,7 @@ interface SignUpRequest {
     options?: {
         emailRedirectTo?: string;
         data?: Record<string, unknown>;
+        preventEmailEnumeration?: boolean;
     };
 }
 interface SignInRequest {
@@ -369,14 +372,25 @@ interface MfaEnrollResponse {
  * Pour une passkey, utilisez `auth.mfa.webauthn.verify`.
  */
 type MfaVerifyRequest = {
-    mfa_token: string;
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     code: string;
 } | {
-    mfa_token: string;
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     recovery_code: string;
+    recoveryCode?: string;
 } | {
-    mfa_token: string;
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     sms_code: string;
+    smsCode?: string;
 };
 /** Facteur MFA utilisable pour relever un défi (`auth.mfa.factors`). */
 type MfaFactorType = 'totp' | 'webauthn' | 'sms';
@@ -1839,6 +1853,19 @@ type AuthChangeCallback = (token: string | null, user: User | null) => void;
  * Check whether a JWT has expired (or will expire within `marginSec` seconds).
  */
 declare function isTokenExpired(token: string, marginSec?: number): boolean;
+interface CookieOptions {
+    path?: string;
+    domain?: string;
+    maxAge?: number;
+    secure?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    httpOnly?: boolean;
+}
+interface StoredAuth {
+    token: string | null;
+    refreshToken: string | null;
+    user: User | null;
+}
 /**
  * In-memory auth store with an event-emitter pattern.
  * Can be extended (see LocalAuthStore) for persistence.
@@ -1850,6 +1877,7 @@ declare class BaseAuthStore {
      * le flux PKCE : le `code_verifier` doit survivre au redirect OAuth.
      */
     readonly persistent: boolean;
+    protected readonly key: string;
     private _token;
     private _refreshToken;
     private _user;
@@ -1860,6 +1888,7 @@ declare class BaseAuthStore {
     /** Hook d'observabilité (LOT 3) — câblé par `AuraClient` via `setObservabilityHook`. */
     private _onEvent?;
     private _debug;
+    constructor(key?: string);
     /** Compteur incrémenté à chaque `clear()` — sert au commit-guard anti-race du refresh. */
     get removalEpoch(): number;
     get token(): string | null;
@@ -1881,6 +1910,16 @@ declare class BaseAuthStore {
     setObservabilityHook(onEvent: ((event: AuraObservabilityEvent) => void) | undefined, debug: boolean | undefined): void;
     /** Émet `{kind:'storage-blocked', op}` — ne throw jamais (voir `emitAuraEvent`). */
     protected _emitStorageBlocked(op: string): void;
+    /**
+     * Populate the store from a raw `Cookie` header string (server-side).
+     * Looks for the key matching `this.key`.
+     */
+    loadFromCookie(cookieString: string): void;
+    /**
+     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+     * `user_metadata` is already inside the access token.
+     */
+    exportToCookie(options?: CookieOptions): string;
     /**
      * Register a callback that fires whenever the auth state changes.
      * Returns an unsubscribe function.
@@ -2038,14 +2077,6 @@ declare function clientScope(baseUrl: string): string;
 /** JSON.stringify avec support des bigint (sérialisés en string). */
 declare function serializeBody(body: unknown): string;
 
-interface CookieOptions {
-    path?: string;
-    domain?: string;
-    maxAge?: number;
-    secure?: boolean;
-    sameSite?: 'strict' | 'lax' | 'none';
-    httpOnly?: boolean;
-}
 /**
  * Auth store backed by `localStorage` (browser) with cookie helpers for SSR.
  *
@@ -2062,7 +2093,6 @@ interface CookieOptions {
 declare class LocalAuthStore extends BaseAuthStore {
     /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
     readonly persistent = true;
-    private readonly key;
     /**
      * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
      *            `aura-${clientScope(baseUrl)}-auth`.
@@ -2103,4 +2133,4 @@ declare class LocalAuthStore extends BaseAuthStore {
     private _removeStorage;
 }
 
-export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaFactorType, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasskeyInfo, type PasskeyRegisterResult, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CookieOptions, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaFactorType, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasskeyInfo, type PasskeyRegisterResult, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type StoredAuth, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.d.ts

@@ -203,6 +203,8 @@ interface User {
     last_sign_in_at?: string | null;
 }
 interface Session {
+    /** Identifiant unique de la session (UUID ou 'sess_...'), dérivé du claim `session_id` du JWT. */
+    id?: string;
     access_token: string;
     refresh_token: string;
     token_type: string;
@@ -267,6 +269,7 @@ interface SignUpRequest {
     options?: {
         emailRedirectTo?: string;
         data?: Record<string, unknown>;
+        preventEmailEnumeration?: boolean;
     };
 }
 interface SignInRequest {
@@ -369,14 +372,25 @@ interface MfaEnrollResponse {
  * Pour une passkey, utilisez `auth.mfa.webauthn.verify`.
  */
 type MfaVerifyRequest = {
-    mfa_token: string;
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     code: string;
 } | {
-    mfa_token: string;
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     recovery_code: string;
+    recoveryCode?: string;
 } | {
-    mfa_token: string;
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     sms_code: string;
+    smsCode?: string;
 };
 /** Facteur MFA utilisable pour relever un défi (`auth.mfa.factors`). */
 type MfaFactorType = 'totp' | 'webauthn' | 'sms';
@@ -1839,6 +1853,19 @@ type AuthChangeCallback = (token: string | null, user: User | null) => void;
  * Check whether a JWT has expired (or will expire within `marginSec` seconds).
  */
 declare function isTokenExpired(token: string, marginSec?: number): boolean;
+interface CookieOptions {
+    path?: string;
+    domain?: string;
+    maxAge?: number;
+    secure?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    httpOnly?: boolean;
+}
+interface StoredAuth {
+    token: string | null;
+    refreshToken: string | null;
+    user: User | null;
+}
 /**
  * In-memory auth store with an event-emitter pattern.
  * Can be extended (see LocalAuthStore) for persistence.
@@ -1850,6 +1877,7 @@ declare class BaseAuthStore {
      * le flux PKCE : le `code_verifier` doit survivre au redirect OAuth.
      */
     readonly persistent: boolean;
+    protected readonly key: string;
     private _token;
     private _refreshToken;
     private _user;
@@ -1860,6 +1888,7 @@ declare class BaseAuthStore {
     /** Hook d'observabilité (LOT 3) — câblé par `AuraClient` via `setObservabilityHook`. */
     private _onEvent?;
     private _debug;
+    constructor(key?: string);
     /** Compteur incrémenté à chaque `clear()` — sert au commit-guard anti-race du refresh. */
     get removalEpoch(): number;
     get token(): string | null;
@@ -1881,6 +1910,16 @@ declare class BaseAuthStore {
     setObservabilityHook(onEvent: ((event: AuraObservabilityEvent) => void) | undefined, debug: boolean | undefined): void;
     /** Émet `{kind:'storage-blocked', op}` — ne throw jamais (voir `emitAuraEvent`). */
     protected _emitStorageBlocked(op: string): void;
+    /**
+     * Populate the store from a raw `Cookie` header string (server-side).
+     * Looks for the key matching `this.key`.
+     */
+    loadFromCookie(cookieString: string): void;
+    /**
+     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+     * `user_metadata` is already inside the access token.
+     */
+    exportToCookie(options?: CookieOptions): string;
     /**
      * Register a callback that fires whenever the auth state changes.
      * Returns an unsubscribe function.
@@ -2038,14 +2077,6 @@ declare function clientScope(baseUrl: string): string;
 /** JSON.stringify avec support des bigint (sérialisés en string). */
 declare function serializeBody(body: unknown): string;
 
-interface CookieOptions {
-    path?: string;
-    domain?: string;
-    maxAge?: number;
-    secure?: boolean;
-    sameSite?: 'strict' | 'lax' | 'none';
-    httpOnly?: boolean;
-}
 /**
  * Auth store backed by `localStorage` (browser) with cookie helpers for SSR.
  *
@@ -2062,7 +2093,6 @@ interface CookieOptions {
 declare class LocalAuthStore extends BaseAuthStore {
     /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
     readonly persistent = true;
-    private readonly key;
     /**
      * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
      *            `aura-${clientScope(baseUrl)}-auth`.
@@ -2103,4 +2133,4 @@ declare class LocalAuthStore extends BaseAuthStore {
     private _removeStorage;
 }
 
-export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaFactorType, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasskeyInfo, type PasskeyRegisterResult, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CookieOptions, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaFactorType, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasskeyInfo, type PasskeyRegisterResult, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type StoredAuth, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.js

@@ -94,8 +94,12 @@ var AuraError = class _AuraError extends Error {
       this.code = "SESSION_REVOKED";
     } else if (status === 401 && lowerMsg.includes("expired")) {
       this.code = "SESSION_EXPIRED";
-    } else if (status === 400 && lowerMsg.includes("password")) {
+    } else if (status === 400 && (lowerMsg.includes("current password") || lowerMsg.includes("old password") || lowerMsg.includes("password") && lowerMsg.includes("required"))) {
+      this.code = lowerMsg.includes("incorrect") || lowerMsg.includes("invalid") ? "INVALID_CURRENT_PASSWORD" : "CURRENT_PASSWORD_REQUIRED";
+    } else if (status === 400 && lowerMsg.includes("password") && (lowerMsg.includes("weak") || lowerMsg.includes("length") || lowerMsg.includes("strength") || lowerMsg.includes("character") || lowerMsg.includes("digit") || lowerMsg.includes("pwned") || lowerMsg.includes("too short") || lowerMsg.includes("too common"))) {
       this.code = "WEAK_PASSWORD";
+    } else if (status === 400 && lowerMsg.includes("password")) {
+      this.code = "INVALID_PASSWORD";
     } else if (status === 409 && (lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
       this.code = "EMAIL_ALREADY_IN_USE";
     } else if (status === 404 && lowerMsg.includes("user not found")) {
@@ -277,6 +281,33 @@ var AUTH_SETTINGS_WRITABLE_FIELDS = [
   "hook_secret"
 ];
 
+// src/cookie-utils.ts
+function parseCookieHeader(header) {
+  const result = {};
+  if (!header) return result;
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    const key = pair.slice(0, idx).trim();
+    const value = pair.slice(idx + 1).trim();
+    if (key) result[key] = decodeURIComponent(value);
+  }
+  return result;
+}
+function sameSiteAttribute(v) {
+  return v.charAt(0).toUpperCase() + v.slice(1);
+}
+function serializeCookieHeader(name, value, options = {}) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  if (options.path) parts.push(`Path=${options.path}`);
+  if (options.domain) parts.push(`Domain=${options.domain}`);
+  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+  if (options.secure) parts.push("Secure");
+  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+  if (options.httpOnly) parts.push("HttpOnly");
+  return parts.join("; ");
+}
+
 // src/stores/BaseAuthStore.ts
 function decodeJwtPayload(token) {
   try {
@@ -321,6 +352,7 @@ var BaseAuthStore = class {
    * le flux PKCE : le `code_verifier` doit survivre au redirect OAuth.
    */
   persistent = false;
+  key;
   _token = null;
   _refreshToken = null;
   _user = null;
@@ -331,6 +363,9 @@ var BaseAuthStore = class {
   /** Hook d'observabilité (LOT 3) — câblé par `AuraClient` via `setObservabilityHook`. */
   _onEvent;
   _debug = false;
+  constructor(key = "aura-auth") {
+    this.key = key;
+  }
   // -- Getters ----------------------------------------------------------------
   /** Compteur incrémenté à chaque `clear()` — sert au commit-guard anti-race du refresh. */
   get removalEpoch() {
@@ -392,6 +427,43 @@ var BaseAuthStore = class {
   _emitStorageBlocked(op) {
     emitAuraEvent(this._onEvent, this._debug, { kind: "storage-blocked", op });
   }
+  /**
+   * Populate the store from a raw `Cookie` header string (server-side).
+   * Looks for the key matching `this.key`.
+   */
+  loadFromCookie(cookieString) {
+    const prefix = `${this.key}=`;
+    const entry = cookieString.split(";").map((c) => c.trim()).find((c) => c.startsWith(prefix));
+    if (!entry) return;
+    try {
+      const raw = decodeURIComponent(entry.slice(prefix.length));
+      const parsed = JSON.parse(raw);
+      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
+      if (parsed.token && parsed.refreshToken && user) {
+        this.save(parsed.token, parsed.refreshToken, user);
+      }
+    } catch {
+    }
+  }
+  /**
+   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
+   * `user_metadata` is already inside the access token.
+   */
+  exportToCookie(options = {}) {
+    const data = {
+      token: this.token,
+      refreshToken: this.refreshToken
+    };
+    const encoded = encodeURIComponent(JSON.stringify(data));
+    const parts = [`${this.key}=${encoded}`];
+    if (options.path) parts.push(`Path=${options.path}`);
+    if (options.domain) parts.push(`Domain=${options.domain}`);
+    if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+    if (options.secure) parts.push("Secure");
+    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+    if (options.httpOnly) parts.push("HttpOnly");
+    return parts.join("; ");
+  }
   // -- Event emitter ----------------------------------------------------------
   /**
    * Register a callback that fires whenever the auth state changes.
@@ -886,45 +958,16 @@ var BaseService = class {
   }
 };
 
-// src/cookie-utils.ts
-function parseCookieHeader(header) {
-  const result = {};
-  if (!header) return result;
-  for (const pair of header.split(";")) {
-    const idx = pair.indexOf("=");
-    if (idx === -1) continue;
-    const key = pair.slice(0, idx).trim();
-    const value = pair.slice(idx + 1).trim();
-    if (key) result[key] = decodeURIComponent(value);
-  }
-  return result;
-}
-function sameSiteAttribute(v) {
-  return v.charAt(0).toUpperCase() + v.slice(1);
-}
-function serializeCookieHeader(name, value, options = {}) {
-  const parts = [`${name}=${encodeURIComponent(value)}`];
-  if (options.path) parts.push(`Path=${options.path}`);
-  if (options.domain) parts.push(`Domain=${options.domain}`);
-  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-  if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
-  if (options.httpOnly) parts.push("HttpOnly");
-  return parts.join("; ");
-}
-
 // src/stores/LocalAuthStore.ts
 var LocalAuthStore = class extends BaseAuthStore {
   /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
   persistent = true;
-  key;
   /**
    * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
    *            `aura-${clientScope(baseUrl)}-auth`.
    */
   constructor(key) {
-    super();
-    this.key = key;
+    super(key);
     this._loadFromStorage();
   }
   // -- Overrides --------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/core",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Cœur du SDK Aurabase : fetch résilient, erreurs, stores auth, types de réponse (infrastructure interne)",
   "type": "module",
   "main": "dist/index.cjs",