@aurabase/core 0.7.0 → 0.7.2

package/dist/index.cjs

@@ -76,6 +76,12 @@ var AuraError = class _AuraError extends Error {
     const hint = body?.error?.hint;
     if (typeof hint === "string" && hint) {
       this.hint = hint;
+    } else {
+      const serverDetails = JSON.stringify(body ?? "");
+      const isJsonCastError = rawMessage.includes("invalid input syntax for type json") || serverDetails.includes("22P02") && serverDetails.includes("json");
+      if (isJsonCastError) {
+        this.hint = "To filter on a text value inside a JSON column, use the '->>' operator instead of '->' (e.g. .eq('metadata->>theme', 'dark')).";
+      }
     }
     const rawCode = typeof body?.error?.code === "string" ? body.error.code : void 0;
     const canonical = rawCode ? normalizeErrorCode(rawCode) : void 0;
@@ -96,8 +102,12 @@ var AuraError = class _AuraError extends Error {
       this.code = "SESSION_REVOKED";
     } else if (status === 401 && lowerMsg.includes("expired")) {
       this.code = "SESSION_EXPIRED";
-    } else if (status === 400 && lowerMsg.includes("password")) {
+    } else if (status === 400 && (lowerMsg.includes("current password") || lowerMsg.includes("old password") || lowerMsg.includes("password") && lowerMsg.includes("required"))) {
+      this.code = lowerMsg.includes("incorrect") || lowerMsg.includes("invalid") ? "INVALID_CURRENT_PASSWORD" : "CURRENT_PASSWORD_REQUIRED";
+    } else if (status === 400 && lowerMsg.includes("password") && (lowerMsg.includes("weak") || lowerMsg.includes("length") || lowerMsg.includes("strength") || lowerMsg.includes("character") || lowerMsg.includes("digit") || lowerMsg.includes("pwned") || lowerMsg.includes("too short") || lowerMsg.includes("too common"))) {
       this.code = "WEAK_PASSWORD";
+    } else if (status === 400 && lowerMsg.includes("password")) {
+      this.code = "INVALID_PASSWORD";
     } else if (status === 409 && (lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
       this.code = "EMAIL_ALREADY_IN_USE";
     } else if (status === 404 && lowerMsg.includes("user not found")) {
@@ -279,6 +289,33 @@ var AUTH_SETTINGS_WRITABLE_FIELDS = [
   "hook_secret"
 ];
 
+// src/cookie-utils.ts
+function parseCookieHeader(header) {
+  const result = {};
+  if (!header) return result;
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    const key = pair.slice(0, idx).trim();
+    const value = pair.slice(idx + 1).trim();
+    if (key) result[key] = decodeURIComponent(value);
+  }
+  return result;
+}
+function sameSiteAttribute(v) {
+  return v.charAt(0).toUpperCase() + v.slice(1);
+}
+function serializeCookieHeader(name, value, options = {}) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  if (options.path) parts.push(`Path=${options.path}`);
+  if (options.domain) parts.push(`Domain=${options.domain}`);
+  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+  if (options.secure) parts.push("Secure");
+  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+  if (options.httpOnly) parts.push("HttpOnly");
+  return parts.join("; ");
+}
+
 // src/stores/BaseAuthStore.ts
 function decodeJwtPayload(token) {
   try {
@@ -323,6 +360,7 @@ var BaseAuthStore = class {
    * le flux PKCE : le `code_verifier` doit survivre au redirect OAuth.
    */
   persistent = false;
+  key;
   _token = null;
   _refreshToken = null;
   _user = null;
@@ -333,6 +371,9 @@ var BaseAuthStore = class {
   /** Hook d'observabilité (LOT 3) — câblé par `AuraClient` via `setObservabilityHook`. */
   _onEvent;
   _debug = false;
+  constructor(key = "aura-auth") {
+    this.key = key;
+  }
   // -- Getters ----------------------------------------------------------------
   /** Compteur incrémenté à chaque `clear()` — sert au commit-guard anti-race du refresh. */
   get removalEpoch() {
@@ -394,6 +435,91 @@ var BaseAuthStore = class {
   _emitStorageBlocked(op) {
     emitAuraEvent(this._onEvent, this._debug, { kind: "storage-blocked", op });
   }
+  /**
+   * Populate the store from a raw `Cookie` header string (server-side).
+   * Supports both single cookie `${this.key}=...` and numbered chunk cookies `${this.key}.0=...`, `${this.key}.1=...`
+   * automatically reassembled in order (AUTH-010).
+   */
+  loadFromCookie(cookieString) {
+    if (!cookieString) return;
+    const entries = cookieString.split(";").map((c) => c.trim()).filter(Boolean);
+    let encodedData = null;
+    const prefix = `${this.key}=`;
+    const singleEntry = entries.find((c) => c.startsWith(prefix));
+    if (singleEntry) {
+      encodedData = singleEntry.slice(prefix.length);
+    } else {
+      const escapedKey = this.key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const chunkRegex = new RegExp(`^${escapedKey}\\.(\\d+)=(.*)$`);
+      const chunks = [];
+      for (const entry of entries) {
+        const match = entry.match(chunkRegex);
+        if (match) {
+          chunks.push({
+            index: parseInt(match[1], 10),
+            value: match[2]
+          });
+        }
+      }
+      if (chunks.length > 0) {
+        chunks.sort((a, b) => a.index - b.index);
+        encodedData = chunks.map((c) => c.value).join("");
+      }
+    }
+    if (!encodedData) return;
+    try {
+      const raw = decodeURIComponent(encodedData);
+      const parsed = JSON.parse(raw);
+      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
+      if (parsed.token && parsed.refreshToken && user) {
+        this.save(parsed.token, parsed.refreshToken, user);
+      }
+    } catch {
+    }
+  }
+  /**
+   * Serialize the session tokens into an array of `Set-Cookie` header strings.
+   * If the payload exceeds `maxChunkSize` (default 3500 bytes), it is automatically split into
+   * numbered chunks `${key}.0`, `${key}.1`, etc. to avoid browser cookie size limits (AUTH-010).
+   */
+  exportToCookies(options = {}, maxChunkSize = 3500) {
+    const data = {
+      token: this.token,
+      refreshToken: this.refreshToken
+    };
+    const encoded = encodeURIComponent(JSON.stringify(data));
+    const buildCookie = (name, value) => {
+      const parts = [`${name}=${value}`];
+      if (options.path) parts.push(`Path=${options.path}`);
+      if (options.domain) parts.push(`Domain=${options.domain}`);
+      if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+      if (options.secure) parts.push("Secure");
+      if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+      if (options.httpOnly) parts.push("HttpOnly");
+      return parts.join("; ");
+    };
+    const limit = Math.max(1, maxChunkSize);
+    if (encoded.length <= limit) {
+      return [buildCookie(this.key, encoded)];
+    }
+    const cookies = [];
+    let offset = 0;
+    let index = 0;
+    while (offset < encoded.length) {
+      const chunk = encoded.slice(offset, offset + limit);
+      cookies.push(buildCookie(`${this.key}.${index}`, chunk));
+      offset += limit;
+      index++;
+    }
+    return cookies;
+  }
+  /**
+   * Serialize the session tokens into a single `Set-Cookie` value.
+   * Note: If the token payload may exceed 3.5KB, use `exportToCookies()` instead for automatic chunking (AUTH-010).
+   */
+  exportToCookie(options = {}) {
+    return this.exportToCookies(options, Infinity)[0];
+  }
   // -- Event emitter ----------------------------------------------------------
   /**
    * Register a callback that fires whenever the auth state changes.
@@ -437,14 +563,42 @@ function unwrapEnvelope(body) {
   }
   return body;
 }
+function parseJsonBody(raw, parseBigIntAsString) {
+  if (parseBigIntAsString) {
+    const safe = raw.replace(/([:\[,]\s*)(-?\d{16,})(?=\s*[,}\]])/g, '$1"$2"');
+    return JSON.parse(safe);
+  }
+  return JSON.parse(raw);
+}
 function parseContentRangeTotal(headerVal) {
-  if (!headerVal) return void 0;
+  return parseContentRangeDetails(headerVal).total;
+}
+function parseContentRangeDetails(headerVal) {
+  if (!headerVal) return { total: void 0, hasMore: void 0 };
   const parts = headerVal.split("/");
-  if (parts.length === 2 && parts[1] !== "*") {
-    const n = parseInt(parts[1], 10);
-    if (!Number.isNaN(n)) return n;
+  const totalStr = parts[1];
+  let total;
+  if (totalStr && totalStr !== "*") {
+    const n = parseInt(totalStr, 10);
+    if (!Number.isNaN(n)) total = n;
+  }
+  let hasMore;
+  const rangePart = parts[0];
+  if (rangePart) {
+    const rangeBounds = rangePart.split("-");
+    if (rangeBounds.length === 2) {
+      const start = parseInt(rangeBounds[0], 10);
+      const end = parseInt(rangeBounds[1], 10);
+      if (!Number.isNaN(start) && !Number.isNaN(end)) {
+        if (total !== void 0) {
+          hasMore = end + 1 < total;
+        } else if (end - start + 1 >= 1e3) {
+          hasMore = true;
+        }
+      }
+    }
   }
-  return void 0;
+  return { total, hasMore };
 }
 async function readTextBounded(res, timeoutMs) {
   const body = res.body;
@@ -837,7 +991,7 @@ async function fetchWithAuth(url, init, client) {
     }
     let body;
     try {
-      body = JSON.parse(raw);
+      body = parseJsonBody(raw, client.parseBigIntAsString === true);
     } catch {
       const ctRaw = res.headers.get("Content-Type") ?? "unknown";
       const ct = ctRaw.length > 64 ? `${ctRaw.slice(0, 64)}\u2026` : ctRaw;
@@ -853,10 +1007,21 @@ async function fetchWithAuth(url, init, client) {
     }
     const unwrapped = unwrapEnvelope(body);
     const cr = res.headers.get("content-range") ?? res.headers.get("Content-Range");
-    const totalFromCr = parseContentRangeTotal(cr);
+    const crDetails = parseContentRangeDetails(cr);
+    const totalFromCr = crDetails.total;
+    const hasMore = crDetails.hasMore;
     const rawMeta = body !== null && typeof body === "object" && "meta" in body ? body.meta : void 0;
-    const meta = rawMeta !== void 0 ? rawMeta : totalFromCr !== void 0 ? { total: totalFromCr } : void 0;
+    const meta = rawMeta !== void 0 ? { ...rawMeta, ...hasMore !== void 0 ? { has_more: hasMore } : {} } : totalFromCr !== void 0 || hasMore !== void 0 ? {
+      ...totalFromCr !== void 0 ? { total: totalFromCr } : {},
+      ...hasMore !== void 0 ? { has_more: hasMore } : {}
+    } : void 0;
     const count = meta?.total !== void 0 ? meta.total : totalFromCr ?? null;
+    const isDev = Boolean(client.debug) || typeof globalThis !== "undefined" && globalThis.process?.env?.NODE_ENV === "development";
+    if (hasMore && isDev) {
+      console.warn(
+        "[Aurabase] Query result reached pagination limit of 1,000 rows. Use .range() to paginate further results."
+      );
+    }
     if (unwrapped === null) {
       return { data: null, error: null, meta, count };
     }
@@ -888,45 +1053,16 @@ var BaseService = class {
   }
 };
 
-// src/cookie-utils.ts
-function parseCookieHeader(header) {
-  const result = {};
-  if (!header) return result;
-  for (const pair of header.split(";")) {
-    const idx = pair.indexOf("=");
-    if (idx === -1) continue;
-    const key = pair.slice(0, idx).trim();
-    const value = pair.slice(idx + 1).trim();
-    if (key) result[key] = decodeURIComponent(value);
-  }
-  return result;
-}
-function sameSiteAttribute(v) {
-  return v.charAt(0).toUpperCase() + v.slice(1);
-}
-function serializeCookieHeader(name, value, options = {}) {
-  const parts = [`${name}=${encodeURIComponent(value)}`];
-  if (options.path) parts.push(`Path=${options.path}`);
-  if (options.domain) parts.push(`Domain=${options.domain}`);
-  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-  if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
-  if (options.httpOnly) parts.push("HttpOnly");
-  return parts.join("; ");
-}
-
 // src/stores/LocalAuthStore.ts
 var LocalAuthStore = class extends BaseAuthStore {
   /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
   persistent = true;
-  key;
   /**
    * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
    *            `aura-${clientScope(baseUrl)}-auth`.
    */
   constructor(key) {
-    super();
-    this.key = key;
+    super(key);
     this._loadFromStorage();
   }
   // -- Overrides --------------------------------------------------------------
@@ -997,48 +1133,6 @@ var LocalAuthStore = class extends BaseAuthStore {
       this._emitStorageBlocked("removeItem");
     }
   }
-  // -- Cookie helpers (SSR) ---------------------------------------------------
-  /**
-   * Populate the store from a raw `Cookie` header string (server-side).
-   * Looks for the key matching `this.key`.
-   *
-   * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
-   * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
-   */
-  loadFromCookie(cookieString) {
-    const prefix = `${this.key}=`;
-    const entry = cookieString.split(";").map((c) => c.trim()).find((c) => c.startsWith(prefix));
-    if (!entry) return;
-    try {
-      const raw = decodeURIComponent(entry.slice(prefix.length));
-      const parsed = JSON.parse(raw);
-      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
-      if (parsed.token && parsed.refreshToken && user) {
-        super.save(parsed.token, parsed.refreshToken, user);
-      }
-    } catch {
-    }
-  }
-  /**
-   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
-   * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
-   * (5 KB of metadata gave 4 cookies and 13 139 bytes).
-   */
-  exportToCookie(options = {}) {
-    const data = {
-      token: this.token,
-      refreshToken: this.refreshToken
-    };
-    const encoded = encodeURIComponent(JSON.stringify(data));
-    const parts = [`${this.key}=${encoded}`];
-    if (options.path) parts.push(`Path=${options.path}`);
-    if (options.domain) parts.push(`Domain=${options.domain}`);
-    if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-    if (options.secure) parts.push("Secure");
-    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
-    if (options.httpOnly) parts.push("HttpOnly");
-    return parts.join("; ");
-  }
   // -- Private ----------------------------------------------------------------
   _getStorage() {
     if (typeof window !== "undefined" && typeof window.localStorage !== "undefined") {
@@ -1051,7 +1145,9 @@ var LocalAuthStore = class extends BaseAuthStore {
         const env = proc.env;
         const isTest = !!(env?.VITEST || env?.NODE_ENV === "test" || env?.JEST_WORKER_ID);
         const execArgv = proc.execArgv;
-        const hasFlag = Array.isArray(execArgv) && execArgv.some((a) => typeof a === "string" && a.startsWith("--localstorage-file"));
+        const hasFlag = Array.isArray(execArgv) && execArgv.some(
+          (a) => typeof a === "string" && a.startsWith("--localstorage-file")
+        );
         if (isTest || hasFlag) {
           try {
             const s = g.localStorage;

package/dist/index.d.cts

@@ -102,6 +102,10 @@ interface Meta {
      * échoue avec un 400 explicite plutôt que d'émettre ce champ.
      */
     next_cursor?: string;
+    /**
+     * DB-005 : Indique si la requête a été tronquée par le serveur (ex: limite 1 000 lignes de PostgREST).
+     */
+    has_more?: boolean;
 }
 /**
  * Réponse en SUCCÈS porteuse de contenu. `error` y est `null` par construction.
@@ -203,6 +207,8 @@ interface User {
     last_sign_in_at?: string | null;
 }
 interface Session {
+    /** Identifiant unique de la session (UUID ou 'sess_...'), dérivé du claim `session_id` du JWT. */
+    id?: string;
     access_token: string;
     refresh_token: string;
     token_type: string;
@@ -267,6 +273,7 @@ interface SignUpRequest {
     options?: {
         emailRedirectTo?: string;
         data?: Record<string, unknown>;
+        preventEmailEnumeration?: boolean;
     };
 }
 interface SignInRequest {
@@ -369,14 +376,25 @@ interface MfaEnrollResponse {
  * Pour une passkey, utilisez `auth.mfa.webauthn.verify`.
  */
 type MfaVerifyRequest = {
-    mfa_token: string;
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     code: string;
 } | {
-    mfa_token: string;
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     recovery_code: string;
+    recoveryCode?: string;
 } | {
-    mfa_token: string;
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     sms_code: string;
+    smsCode?: string;
 };
 /** Facteur MFA utilisable pour relever un défi (`auth.mfa.factors`). */
 type MfaFactorType = 'totp' | 'webauthn' | 'sms';
@@ -1558,6 +1576,12 @@ interface AuraClientOptions {
      * Défaut `false`.
      */
     debug?: boolean;
+    /**
+     * DB-006: Preserves 64-bit integer precision by parsing BIGINT values as strings
+     * instead of JavaScript IEEE 754 floats when exceeding Number.MAX_SAFE_INTEGER (9007199254740991).
+     * Default: false (native JSON.parse).
+     */
+    parseBigIntAsString?: boolean;
 }
 interface IdentityInfo {
     id: string;
@@ -1839,6 +1863,19 @@ type AuthChangeCallback = (token: string | null, user: User | null) => void;
  * Check whether a JWT has expired (or will expire within `marginSec` seconds).
  */
 declare function isTokenExpired(token: string, marginSec?: number): boolean;
+interface CookieOptions {
+    path?: string;
+    domain?: string;
+    maxAge?: number;
+    secure?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    httpOnly?: boolean;
+}
+interface StoredAuth {
+    token: string | null;
+    refreshToken: string | null;
+    user: User | null;
+}
 /**
  * In-memory auth store with an event-emitter pattern.
  * Can be extended (see LocalAuthStore) for persistence.
@@ -1850,6 +1887,7 @@ declare class BaseAuthStore {
      * le flux PKCE : le `code_verifier` doit survivre au redirect OAuth.
      */
     readonly persistent: boolean;
+    protected readonly key: string;
     private _token;
     private _refreshToken;
     private _user;
@@ -1860,6 +1898,7 @@ declare class BaseAuthStore {
     /** Hook d'observabilité (LOT 3) — câblé par `AuraClient` via `setObservabilityHook`. */
     private _onEvent?;
     private _debug;
+    constructor(key?: string);
     /** Compteur incrémenté à chaque `clear()` — sert au commit-guard anti-race du refresh. */
     get removalEpoch(): number;
     get token(): string | null;
@@ -1881,6 +1920,23 @@ declare class BaseAuthStore {
     setObservabilityHook(onEvent: ((event: AuraObservabilityEvent) => void) | undefined, debug: boolean | undefined): void;
     /** Émet `{kind:'storage-blocked', op}` — ne throw jamais (voir `emitAuraEvent`). */
     protected _emitStorageBlocked(op: string): void;
+    /**
+     * Populate the store from a raw `Cookie` header string (server-side).
+     * Supports both single cookie `${this.key}=...` and numbered chunk cookies `${this.key}.0=...`, `${this.key}.1=...`
+     * automatically reassembled in order (AUTH-010).
+     */
+    loadFromCookie(cookieString: string): void;
+    /**
+     * Serialize the session tokens into an array of `Set-Cookie` header strings.
+     * If the payload exceeds `maxChunkSize` (default 3500 bytes), it is automatically split into
+     * numbered chunks `${key}.0`, `${key}.1`, etc. to avoid browser cookie size limits (AUTH-010).
+     */
+    exportToCookies(options?: CookieOptions, maxChunkSize?: number): string[];
+    /**
+     * Serialize the session tokens into a single `Set-Cookie` value.
+     * Note: If the token payload may exceed 3.5KB, use `exportToCookies()` instead for automatic chunking (AUTH-010).
+     */
+    exportToCookie(options?: CookieOptions): string;
     /**
      * Register a callback that fires whenever the auth state changes.
      * Returns an unsubscribe function.
@@ -1930,6 +1986,8 @@ interface AuraClientLike {
     readonly onEvent?: (event: AuraObservabilityEvent) => void;
     /** Si `true`, chaque `AuraObservabilityEvent` est aussi journalisé via `console.debug`. */
     readonly debug?: boolean;
+    /** DB-006: Preserves 64-bit integers as strings when true. */
+    readonly parseBigIntAsString?: boolean;
 }
 
 /**
@@ -2038,14 +2096,6 @@ declare function clientScope(baseUrl: string): string;
 /** JSON.stringify avec support des bigint (sérialisés en string). */
 declare function serializeBody(body: unknown): string;
 
-interface CookieOptions {
-    path?: string;
-    domain?: string;
-    maxAge?: number;
-    secure?: boolean;
-    sameSite?: 'strict' | 'lax' | 'none';
-    httpOnly?: boolean;
-}
 /**
  * Auth store backed by `localStorage` (browser) with cookie helpers for SSR.
  *
@@ -2062,7 +2112,6 @@ interface CookieOptions {
 declare class LocalAuthStore extends BaseAuthStore {
     /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
     readonly persistent = true;
-    private readonly key;
     /**
      * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
      *            `aura-${clientScope(baseUrl)}-auth`.
@@ -2083,24 +2132,10 @@ declare class LocalAuthStore extends BaseAuthStore {
     setItem(key: string, value: string): void;
     getItem(key: string): string | null;
     removeItem(key: string): void;
-    /**
-     * Populate the store from a raw `Cookie` header string (server-side).
-     * Looks for the key matching `this.key`.
-     *
-     * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
-     * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
-     */
-    loadFromCookie(cookieString: string): void;
-    /**
-     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
-     * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
-     * (5 KB of metadata gave 4 cookies and 13 139 bytes).
-     */
-    exportToCookie(options?: CookieOptions): string;
     private _getStorage;
     private _loadFromStorage;
     private _persist;
     private _removeStorage;
 }
 
-export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaFactorType, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasskeyInfo, type PasskeyRegisterResult, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CookieOptions, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaFactorType, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasskeyInfo, type PasskeyRegisterResult, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type StoredAuth, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.d.ts

@@ -102,6 +102,10 @@ interface Meta {
      * échoue avec un 400 explicite plutôt que d'émettre ce champ.
      */
     next_cursor?: string;
+    /**
+     * DB-005 : Indique si la requête a été tronquée par le serveur (ex: limite 1 000 lignes de PostgREST).
+     */
+    has_more?: boolean;
 }
 /**
  * Réponse en SUCCÈS porteuse de contenu. `error` y est `null` par construction.
@@ -203,6 +207,8 @@ interface User {
     last_sign_in_at?: string | null;
 }
 interface Session {
+    /** Identifiant unique de la session (UUID ou 'sess_...'), dérivé du claim `session_id` du JWT. */
+    id?: string;
     access_token: string;
     refresh_token: string;
     token_type: string;
@@ -267,6 +273,7 @@ interface SignUpRequest {
     options?: {
         emailRedirectTo?: string;
         data?: Record<string, unknown>;
+        preventEmailEnumeration?: boolean;
     };
 }
 interface SignInRequest {
@@ -369,14 +376,25 @@ interface MfaEnrollResponse {
  * Pour une passkey, utilisez `auth.mfa.webauthn.verify`.
  */
 type MfaVerifyRequest = {
-    mfa_token: string;
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     code: string;
 } | {
-    mfa_token: string;
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     recovery_code: string;
+    recoveryCode?: string;
 } | {
-    mfa_token: string;
+    mfa_token?: string;
+    mfaToken?: string;
+    challenge_id?: string;
+    challengeId?: string;
     sms_code: string;
+    smsCode?: string;
 };
 /** Facteur MFA utilisable pour relever un défi (`auth.mfa.factors`). */
 type MfaFactorType = 'totp' | 'webauthn' | 'sms';
@@ -1558,6 +1576,12 @@ interface AuraClientOptions {
      * Défaut `false`.
      */
     debug?: boolean;
+    /**
+     * DB-006: Preserves 64-bit integer precision by parsing BIGINT values as strings
+     * instead of JavaScript IEEE 754 floats when exceeding Number.MAX_SAFE_INTEGER (9007199254740991).
+     * Default: false (native JSON.parse).
+     */
+    parseBigIntAsString?: boolean;
 }
 interface IdentityInfo {
     id: string;
@@ -1839,6 +1863,19 @@ type AuthChangeCallback = (token: string | null, user: User | null) => void;
  * Check whether a JWT has expired (or will expire within `marginSec` seconds).
  */
 declare function isTokenExpired(token: string, marginSec?: number): boolean;
+interface CookieOptions {
+    path?: string;
+    domain?: string;
+    maxAge?: number;
+    secure?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    httpOnly?: boolean;
+}
+interface StoredAuth {
+    token: string | null;
+    refreshToken: string | null;
+    user: User | null;
+}
 /**
  * In-memory auth store with an event-emitter pattern.
  * Can be extended (see LocalAuthStore) for persistence.
@@ -1850,6 +1887,7 @@ declare class BaseAuthStore {
      * le flux PKCE : le `code_verifier` doit survivre au redirect OAuth.
      */
     readonly persistent: boolean;
+    protected readonly key: string;
     private _token;
     private _refreshToken;
     private _user;
@@ -1860,6 +1898,7 @@ declare class BaseAuthStore {
     /** Hook d'observabilité (LOT 3) — câblé par `AuraClient` via `setObservabilityHook`. */
     private _onEvent?;
     private _debug;
+    constructor(key?: string);
     /** Compteur incrémenté à chaque `clear()` — sert au commit-guard anti-race du refresh. */
     get removalEpoch(): number;
     get token(): string | null;
@@ -1881,6 +1920,23 @@ declare class BaseAuthStore {
     setObservabilityHook(onEvent: ((event: AuraObservabilityEvent) => void) | undefined, debug: boolean | undefined): void;
     /** Émet `{kind:'storage-blocked', op}` — ne throw jamais (voir `emitAuraEvent`). */
     protected _emitStorageBlocked(op: string): void;
+    /**
+     * Populate the store from a raw `Cookie` header string (server-side).
+     * Supports both single cookie `${this.key}=...` and numbered chunk cookies `${this.key}.0=...`, `${this.key}.1=...`
+     * automatically reassembled in order (AUTH-010).
+     */
+    loadFromCookie(cookieString: string): void;
+    /**
+     * Serialize the session tokens into an array of `Set-Cookie` header strings.
+     * If the payload exceeds `maxChunkSize` (default 3500 bytes), it is automatically split into
+     * numbered chunks `${key}.0`, `${key}.1`, etc. to avoid browser cookie size limits (AUTH-010).
+     */
+    exportToCookies(options?: CookieOptions, maxChunkSize?: number): string[];
+    /**
+     * Serialize the session tokens into a single `Set-Cookie` value.
+     * Note: If the token payload may exceed 3.5KB, use `exportToCookies()` instead for automatic chunking (AUTH-010).
+     */
+    exportToCookie(options?: CookieOptions): string;
     /**
      * Register a callback that fires whenever the auth state changes.
      * Returns an unsubscribe function.
@@ -1930,6 +1986,8 @@ interface AuraClientLike {
     readonly onEvent?: (event: AuraObservabilityEvent) => void;
     /** Si `true`, chaque `AuraObservabilityEvent` est aussi journalisé via `console.debug`. */
     readonly debug?: boolean;
+    /** DB-006: Preserves 64-bit integers as strings when true. */
+    readonly parseBigIntAsString?: boolean;
 }
 
 /**
@@ -2038,14 +2096,6 @@ declare function clientScope(baseUrl: string): string;
 /** JSON.stringify avec support des bigint (sérialisés en string). */
 declare function serializeBody(body: unknown): string;
 
-interface CookieOptions {
-    path?: string;
-    domain?: string;
-    maxAge?: number;
-    secure?: boolean;
-    sameSite?: 'strict' | 'lax' | 'none';
-    httpOnly?: boolean;
-}
 /**
  * Auth store backed by `localStorage` (browser) with cookie helpers for SSR.
  *
@@ -2062,7 +2112,6 @@ interface CookieOptions {
 declare class LocalAuthStore extends BaseAuthStore {
     /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
     readonly persistent = true;
-    private readonly key;
     /**
      * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
      *            `aura-${clientScope(baseUrl)}-auth`.
@@ -2083,24 +2132,10 @@ declare class LocalAuthStore extends BaseAuthStore {
     setItem(key: string, value: string): void;
     getItem(key: string): string | null;
     removeItem(key: string): void;
-    /**
-     * Populate the store from a raw `Cookie` header string (server-side).
-     * Looks for the key matching `this.key`.
-     *
-     * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
-     * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
-     */
-    loadFromCookie(cookieString: string): void;
-    /**
-     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
-     * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
-     * (5 KB of metadata gave 4 cookies and 13 139 bytes).
-     */
-    exportToCookie(options?: CookieOptions): string;
     private _getStorage;
     private _loadFromStorage;
     private _persist;
     private _removeStorage;
 }
 
-export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaFactorType, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasskeyInfo, type PasskeyRegisterResult, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };
+export { AUTH_SETTINGS_WRITABLE_FIELDS, type AdminCreateUserRequest, type AdminSessionInfo, type AdminUpdateUserRequest, type AdminUser, type ApnsPublicSettings, type ApnsSettingsPatch, type AuditLogEntry, type AuraClientLike, type AuraClientOptions, AuraError, type AuraErrorCode, type AuraFailure, type AuraNoContent, type AuraObservabilityEvent, type AuraResponse, type AuraSuccess, type AuthChangePayload, type AuthEvent, type AuthSettings, type AuthSettingsUpdate, BaseAuthStore, BaseService, type BatchSendItemResult, type BatchSendResponse, type BroadcastAckMessage, type BroadcastFilter, type BroadcastPayload, type BroadcastSendStatus, type CdcPayload, type ChannelConfig, type ChatMessage, type ChatResponse, type CookieOptions, type CountMode, type CreateNotificationRuleRequest, type CreatePgFunctionRequest, type CreatePgTriggerRequest, type CronJob, DEFAULT_MAX_RETRIES, DEFAULT_REQUEST_TIMEOUT_MS, type EmailTemplateUpdate, type EmbedRequest, type EmbedResponse, type FcmPublicSettings, type FcmSettingsPatch, type FetchInit, type FileEntry, type FilterOp, type FunctionDef, type FunctionPermissions, type GenerateLinkResult, type GenerateLinkType, type GetClaimsResult, type IdentityInfo, type ImageTransform, type Job, type JwtClaims, LocalAuthStore, type LoginResponse, type MagicLinkRequest, type Meta, type MfaChallenge, type MfaEnrollResponse, type MfaFactorType, type MfaVerifyRequest, type Notification, type NotificationAttempt, type NotificationAttemptStatus, type NotificationChannel, type NotificationChannelStats, type NotificationDeadLetter, type NotificationEvent, type NotificationProviderLog, type NotificationQueueStats, type NotificationRule, type NotificationSettings, type NotificationSettingsPatch, type NotificationSettingsPublic, type NotificationStats, type NotificationStatsWindow, type NotificationStatus, type NotificationTemplate, type NotificationTemplatePreview, type OAuthProviderSetting, type OAuthSignInObjectOptions, type OAuthSignInOptions, type ObjectMeta, type PasskeyInfo, type PasskeyRegisterResult, type PasswordResetRequest, type PgExecutableRole, type PgFunctionInfo, type PgTriggerInfo, type PostgresChangesFilter, type PresenceFilter, type PresenceInfo, type PresenceState, type QueryFilter, type QueryOptions, type QuotaPublicSettings, type QuotaSettingsPatch, RETRYABLE_METHODS, RETRYABLE_STATUS, type RagIngestRequest, type RagIngestResponse, type RagRequest, type RagResponse, type RealtimeBroadcastEvent, type RealtimeEvent, type RealtimeListenType, type RealtimePostgresChangesBasePayload, type RealtimePostgresChangesPayload, type RealtimePostgresDeletePayload, type RealtimePostgresInsertPayload, type RealtimePostgresUpdatePayload, type RealtimeSubscribeStatus, type SchemaColumn, type SchemaEnum, type SchemaFunction, type SchemaFunctionArg, type SchemaIndex, type SchemaTable, type SemanticSearchResult, type SendNotificationItem, type SendNotificationOptions, type SendNotificationRequest, type SerializeCookieOptions, type ServerChannelRecoveredMsg, type ServerErrorMsg, type ServerEventMsg, type ServerMessage, type ServerPongMsg, type ServerPresenceStateMsg, type ServerSubscribedMsg, type ServerTokenRefreshedMsg, type Session, type SessionInfo, type SettingsSource, type SignInRequest, type SignUpRequest, type SmtpPublicSettings, type SmtpSettingsPatch, type StorageBucket, type StoredAuth, type SubscribeCallback, type TokenPair, type TwilioPublicSettings, type TwilioSettingsPatch, type UpdateNotificationRuleRequest, type UpdateUserRequest, type UploadResult, type User, type UserStats, type WebhookPublicSettings, type WebhookSettingsPatch, abortableSleep, clientScope, computeBackoff, emitAuraEvent, fetchWithAuth, isAbortError, isAuraError, isRetryableMethod, isRetryableStatus, isTokenExpired, parseCookieHeader, parseRetryAfter, refreshOnce, serializeBody, serializeCookieHeader };

package/dist/index.js

@@ -74,6 +74,12 @@ var AuraError = class _AuraError extends Error {
     const hint = body?.error?.hint;
     if (typeof hint === "string" && hint) {
       this.hint = hint;
+    } else {
+      const serverDetails = JSON.stringify(body ?? "");
+      const isJsonCastError = rawMessage.includes("invalid input syntax for type json") || serverDetails.includes("22P02") && serverDetails.includes("json");
+      if (isJsonCastError) {
+        this.hint = "To filter on a text value inside a JSON column, use the '->>' operator instead of '->' (e.g. .eq('metadata->>theme', 'dark')).";
+      }
     }
     const rawCode = typeof body?.error?.code === "string" ? body.error.code : void 0;
     const canonical = rawCode ? normalizeErrorCode(rawCode) : void 0;
@@ -94,8 +100,12 @@ var AuraError = class _AuraError extends Error {
       this.code = "SESSION_REVOKED";
     } else if (status === 401 && lowerMsg.includes("expired")) {
       this.code = "SESSION_EXPIRED";
-    } else if (status === 400 && lowerMsg.includes("password")) {
+    } else if (status === 400 && (lowerMsg.includes("current password") || lowerMsg.includes("old password") || lowerMsg.includes("password") && lowerMsg.includes("required"))) {
+      this.code = lowerMsg.includes("incorrect") || lowerMsg.includes("invalid") ? "INVALID_CURRENT_PASSWORD" : "CURRENT_PASSWORD_REQUIRED";
+    } else if (status === 400 && lowerMsg.includes("password") && (lowerMsg.includes("weak") || lowerMsg.includes("length") || lowerMsg.includes("strength") || lowerMsg.includes("character") || lowerMsg.includes("digit") || lowerMsg.includes("pwned") || lowerMsg.includes("too short") || lowerMsg.includes("too common"))) {
       this.code = "WEAK_PASSWORD";
+    } else if (status === 400 && lowerMsg.includes("password")) {
+      this.code = "INVALID_PASSWORD";
     } else if (status === 409 && (lowerMsg.includes("already exists") || lowerMsg.includes("already in use") || lowerMsg.includes("email"))) {
       this.code = "EMAIL_ALREADY_IN_USE";
     } else if (status === 404 && lowerMsg.includes("user not found")) {
@@ -277,6 +287,33 @@ var AUTH_SETTINGS_WRITABLE_FIELDS = [
   "hook_secret"
 ];
 
+// src/cookie-utils.ts
+function parseCookieHeader(header) {
+  const result = {};
+  if (!header) return result;
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    const key = pair.slice(0, idx).trim();
+    const value = pair.slice(idx + 1).trim();
+    if (key) result[key] = decodeURIComponent(value);
+  }
+  return result;
+}
+function sameSiteAttribute(v) {
+  return v.charAt(0).toUpperCase() + v.slice(1);
+}
+function serializeCookieHeader(name, value, options = {}) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  if (options.path) parts.push(`Path=${options.path}`);
+  if (options.domain) parts.push(`Domain=${options.domain}`);
+  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+  if (options.secure) parts.push("Secure");
+  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+  if (options.httpOnly) parts.push("HttpOnly");
+  return parts.join("; ");
+}
+
 // src/stores/BaseAuthStore.ts
 function decodeJwtPayload(token) {
   try {
@@ -321,6 +358,7 @@ var BaseAuthStore = class {
    * le flux PKCE : le `code_verifier` doit survivre au redirect OAuth.
    */
   persistent = false;
+  key;
   _token = null;
   _refreshToken = null;
   _user = null;
@@ -331,6 +369,9 @@ var BaseAuthStore = class {
   /** Hook d'observabilité (LOT 3) — câblé par `AuraClient` via `setObservabilityHook`. */
   _onEvent;
   _debug = false;
+  constructor(key = "aura-auth") {
+    this.key = key;
+  }
   // -- Getters ----------------------------------------------------------------
   /** Compteur incrémenté à chaque `clear()` — sert au commit-guard anti-race du refresh. */
   get removalEpoch() {
@@ -392,6 +433,91 @@ var BaseAuthStore = class {
   _emitStorageBlocked(op) {
     emitAuraEvent(this._onEvent, this._debug, { kind: "storage-blocked", op });
   }
+  /**
+   * Populate the store from a raw `Cookie` header string (server-side).
+   * Supports both single cookie `${this.key}=...` and numbered chunk cookies `${this.key}.0=...`, `${this.key}.1=...`
+   * automatically reassembled in order (AUTH-010).
+   */
+  loadFromCookie(cookieString) {
+    if (!cookieString) return;
+    const entries = cookieString.split(";").map((c) => c.trim()).filter(Boolean);
+    let encodedData = null;
+    const prefix = `${this.key}=`;
+    const singleEntry = entries.find((c) => c.startsWith(prefix));
+    if (singleEntry) {
+      encodedData = singleEntry.slice(prefix.length);
+    } else {
+      const escapedKey = this.key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const chunkRegex = new RegExp(`^${escapedKey}\\.(\\d+)=(.*)$`);
+      const chunks = [];
+      for (const entry of entries) {
+        const match = entry.match(chunkRegex);
+        if (match) {
+          chunks.push({
+            index: parseInt(match[1], 10),
+            value: match[2]
+          });
+        }
+      }
+      if (chunks.length > 0) {
+        chunks.sort((a, b) => a.index - b.index);
+        encodedData = chunks.map((c) => c.value).join("");
+      }
+    }
+    if (!encodedData) return;
+    try {
+      const raw = decodeURIComponent(encodedData);
+      const parsed = JSON.parse(raw);
+      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
+      if (parsed.token && parsed.refreshToken && user) {
+        this.save(parsed.token, parsed.refreshToken, user);
+      }
+    } catch {
+    }
+  }
+  /**
+   * Serialize the session tokens into an array of `Set-Cookie` header strings.
+   * If the payload exceeds `maxChunkSize` (default 3500 bytes), it is automatically split into
+   * numbered chunks `${key}.0`, `${key}.1`, etc. to avoid browser cookie size limits (AUTH-010).
+   */
+  exportToCookies(options = {}, maxChunkSize = 3500) {
+    const data = {
+      token: this.token,
+      refreshToken: this.refreshToken
+    };
+    const encoded = encodeURIComponent(JSON.stringify(data));
+    const buildCookie = (name, value) => {
+      const parts = [`${name}=${value}`];
+      if (options.path) parts.push(`Path=${options.path}`);
+      if (options.domain) parts.push(`Domain=${options.domain}`);
+      if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+      if (options.secure) parts.push("Secure");
+      if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+      if (options.httpOnly) parts.push("HttpOnly");
+      return parts.join("; ");
+    };
+    const limit = Math.max(1, maxChunkSize);
+    if (encoded.length <= limit) {
+      return [buildCookie(this.key, encoded)];
+    }
+    const cookies = [];
+    let offset = 0;
+    let index = 0;
+    while (offset < encoded.length) {
+      const chunk = encoded.slice(offset, offset + limit);
+      cookies.push(buildCookie(`${this.key}.${index}`, chunk));
+      offset += limit;
+      index++;
+    }
+    return cookies;
+  }
+  /**
+   * Serialize the session tokens into a single `Set-Cookie` value.
+   * Note: If the token payload may exceed 3.5KB, use `exportToCookies()` instead for automatic chunking (AUTH-010).
+   */
+  exportToCookie(options = {}) {
+    return this.exportToCookies(options, Infinity)[0];
+  }
   // -- Event emitter ----------------------------------------------------------
   /**
    * Register a callback that fires whenever the auth state changes.
@@ -435,14 +561,42 @@ function unwrapEnvelope(body) {
   }
   return body;
 }
+function parseJsonBody(raw, parseBigIntAsString) {
+  if (parseBigIntAsString) {
+    const safe = raw.replace(/([:\[,]\s*)(-?\d{16,})(?=\s*[,}\]])/g, '$1"$2"');
+    return JSON.parse(safe);
+  }
+  return JSON.parse(raw);
+}
 function parseContentRangeTotal(headerVal) {
-  if (!headerVal) return void 0;
+  return parseContentRangeDetails(headerVal).total;
+}
+function parseContentRangeDetails(headerVal) {
+  if (!headerVal) return { total: void 0, hasMore: void 0 };
   const parts = headerVal.split("/");
-  if (parts.length === 2 && parts[1] !== "*") {
-    const n = parseInt(parts[1], 10);
-    if (!Number.isNaN(n)) return n;
+  const totalStr = parts[1];
+  let total;
+  if (totalStr && totalStr !== "*") {
+    const n = parseInt(totalStr, 10);
+    if (!Number.isNaN(n)) total = n;
+  }
+  let hasMore;
+  const rangePart = parts[0];
+  if (rangePart) {
+    const rangeBounds = rangePart.split("-");
+    if (rangeBounds.length === 2) {
+      const start = parseInt(rangeBounds[0], 10);
+      const end = parseInt(rangeBounds[1], 10);
+      if (!Number.isNaN(start) && !Number.isNaN(end)) {
+        if (total !== void 0) {
+          hasMore = end + 1 < total;
+        } else if (end - start + 1 >= 1e3) {
+          hasMore = true;
+        }
+      }
+    }
   }
-  return void 0;
+  return { total, hasMore };
 }
 async function readTextBounded(res, timeoutMs) {
   const body = res.body;
@@ -835,7 +989,7 @@ async function fetchWithAuth(url, init, client) {
     }
     let body;
     try {
-      body = JSON.parse(raw);
+      body = parseJsonBody(raw, client.parseBigIntAsString === true);
     } catch {
       const ctRaw = res.headers.get("Content-Type") ?? "unknown";
       const ct = ctRaw.length > 64 ? `${ctRaw.slice(0, 64)}\u2026` : ctRaw;
@@ -851,10 +1005,21 @@ async function fetchWithAuth(url, init, client) {
     }
     const unwrapped = unwrapEnvelope(body);
     const cr = res.headers.get("content-range") ?? res.headers.get("Content-Range");
-    const totalFromCr = parseContentRangeTotal(cr);
+    const crDetails = parseContentRangeDetails(cr);
+    const totalFromCr = crDetails.total;
+    const hasMore = crDetails.hasMore;
     const rawMeta = body !== null && typeof body === "object" && "meta" in body ? body.meta : void 0;
-    const meta = rawMeta !== void 0 ? rawMeta : totalFromCr !== void 0 ? { total: totalFromCr } : void 0;
+    const meta = rawMeta !== void 0 ? { ...rawMeta, ...hasMore !== void 0 ? { has_more: hasMore } : {} } : totalFromCr !== void 0 || hasMore !== void 0 ? {
+      ...totalFromCr !== void 0 ? { total: totalFromCr } : {},
+      ...hasMore !== void 0 ? { has_more: hasMore } : {}
+    } : void 0;
     const count = meta?.total !== void 0 ? meta.total : totalFromCr ?? null;
+    const isDev = Boolean(client.debug) || typeof globalThis !== "undefined" && globalThis.process?.env?.NODE_ENV === "development";
+    if (hasMore && isDev) {
+      console.warn(
+        "[Aurabase] Query result reached pagination limit of 1,000 rows. Use .range() to paginate further results."
+      );
+    }
     if (unwrapped === null) {
       return { data: null, error: null, meta, count };
     }
@@ -886,45 +1051,16 @@ var BaseService = class {
   }
 };
 
-// src/cookie-utils.ts
-function parseCookieHeader(header) {
-  const result = {};
-  if (!header) return result;
-  for (const pair of header.split(";")) {
-    const idx = pair.indexOf("=");
-    if (idx === -1) continue;
-    const key = pair.slice(0, idx).trim();
-    const value = pair.slice(idx + 1).trim();
-    if (key) result[key] = decodeURIComponent(value);
-  }
-  return result;
-}
-function sameSiteAttribute(v) {
-  return v.charAt(0).toUpperCase() + v.slice(1);
-}
-function serializeCookieHeader(name, value, options = {}) {
-  const parts = [`${name}=${encodeURIComponent(value)}`];
-  if (options.path) parts.push(`Path=${options.path}`);
-  if (options.domain) parts.push(`Domain=${options.domain}`);
-  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-  if (options.secure) parts.push("Secure");
-  if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
-  if (options.httpOnly) parts.push("HttpOnly");
-  return parts.join("; ");
-}
-
 // src/stores/LocalAuthStore.ts
 var LocalAuthStore = class extends BaseAuthStore {
   /** Persiste en localStorage → survit au redirect pleine page (cf. PKCE). */
   persistent = true;
-  key;
   /**
    * @param key Nom de l'entrée `localStorage` (et du cookie SSR). Scopez-le par projet :
    *            `aura-${clientScope(baseUrl)}-auth`.
    */
   constructor(key) {
-    super();
-    this.key = key;
+    super(key);
     this._loadFromStorage();
   }
   // -- Overrides --------------------------------------------------------------
@@ -995,48 +1131,6 @@ var LocalAuthStore = class extends BaseAuthStore {
       this._emitStorageBlocked("removeItem");
     }
   }
-  // -- Cookie helpers (SSR) ---------------------------------------------------
-  /**
-   * Populate the store from a raw `Cookie` header string (server-side).
-   * Looks for the key matching `this.key`.
-   *
-   * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
-   * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
-   */
-  loadFromCookie(cookieString) {
-    const prefix = `${this.key}=`;
-    const entry = cookieString.split(";").map((c) => c.trim()).find((c) => c.startsWith(prefix));
-    if (!entry) return;
-    try {
-      const raw = decodeURIComponent(entry.slice(prefix.length));
-      const parsed = JSON.parse(raw);
-      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
-      if (parsed.token && parsed.refreshToken && user) {
-        super.save(parsed.token, parsed.refreshToken, user);
-      }
-    } catch {
-    }
-  }
-  /**
-   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
-   * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
-   * (5 KB of metadata gave 4 cookies and 13 139 bytes).
-   */
-  exportToCookie(options = {}) {
-    const data = {
-      token: this.token,
-      refreshToken: this.refreshToken
-    };
-    const encoded = encodeURIComponent(JSON.stringify(data));
-    const parts = [`${this.key}=${encoded}`];
-    if (options.path) parts.push(`Path=${options.path}`);
-    if (options.domain) parts.push(`Domain=${options.domain}`);
-    if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-    if (options.secure) parts.push("Secure");
-    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
-    if (options.httpOnly) parts.push("HttpOnly");
-    return parts.join("; ");
-  }
   // -- Private ----------------------------------------------------------------
   _getStorage() {
     if (typeof window !== "undefined" && typeof window.localStorage !== "undefined") {
@@ -1049,7 +1143,9 @@ var LocalAuthStore = class extends BaseAuthStore {
         const env = proc.env;
         const isTest = !!(env?.VITEST || env?.NODE_ENV === "test" || env?.JEST_WORKER_ID);
         const execArgv = proc.execArgv;
-        const hasFlag = Array.isArray(execArgv) && execArgv.some((a) => typeof a === "string" && a.startsWith("--localstorage-file"));
+        const hasFlag = Array.isArray(execArgv) && execArgv.some(
+          (a) => typeof a === "string" && a.startsWith("--localstorage-file")
+        );
         if (isTest || hasFlag) {
           try {
             const s = g.localStorage;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/core",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Cœur du SDK Aurabase : fetch résilient, erreurs, stores auth, types de réponse (infrastructure interne)",
   "type": "module",
   "main": "dist/index.cjs",