@aurabase/core 0.7.1 → 0.7.3

package/dist/index.cjs

@@ -76,6 +76,12 @@ var AuraError = class _AuraError extends Error {
     const hint = body?.error?.hint;
     if (typeof hint === "string" && hint) {
       this.hint = hint;
+    } else {
+      const serverDetails = JSON.stringify(body ?? "");
+      const isJsonCastError = rawMessage.includes("invalid input syntax for type json") || serverDetails.includes("22P02") && serverDetails.includes("json");
+      if (isJsonCastError) {
+        this.hint = "To filter on a text value inside a JSON column, use the '->>' operator instead of '->' (e.g. .eq('metadata->>theme', 'dark')).";
+      }
     }
     const rawCode = typeof body?.error?.code === "string" ? body.error.code : void 0;
     const canonical = rawCode ? normalizeErrorCode(rawCode) : void 0;
@@ -431,14 +437,38 @@ var BaseAuthStore = class {
   }
   /**
    * Populate the store from a raw `Cookie` header string (server-side).
-   * Looks for the key matching `this.key`.
+   * Supports both single cookie `${this.key}=...` and numbered chunk cookies `${this.key}.0=...`, `${this.key}.1=...`
+   * automatically reassembled in order (AUTH-010).
    */
   loadFromCookie(cookieString) {
+    if (!cookieString) return;
+    const entries = cookieString.split(";").map((c) => c.trim()).filter(Boolean);
+    let encodedData = null;
     const prefix = `${this.key}=`;
-    const entry = cookieString.split(";").map((c) => c.trim()).find((c) => c.startsWith(prefix));
-    if (!entry) return;
+    const singleEntry = entries.find((c) => c.startsWith(prefix));
+    if (singleEntry) {
+      encodedData = singleEntry.slice(prefix.length);
+    } else {
+      const escapedKey = this.key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const chunkRegex = new RegExp(`^${escapedKey}\\.(\\d+)=(.*)$`);
+      const chunks = [];
+      for (const entry of entries) {
+        const match = entry.match(chunkRegex);
+        if (match) {
+          chunks.push({
+            index: parseInt(match[1], 10),
+            value: match[2]
+          });
+        }
+      }
+      if (chunks.length > 0) {
+        chunks.sort((a, b) => a.index - b.index);
+        encodedData = chunks.map((c) => c.value).join("");
+      }
+    }
+    if (!encodedData) return;
     try {
-      const raw = decodeURIComponent(entry.slice(prefix.length));
+      const raw = decodeURIComponent(encodedData);
       const parsed = JSON.parse(raw);
       const user = parsed.token ? userFromAccessToken(parsed.token) : null;
       if (parsed.token && parsed.refreshToken && user) {
@@ -448,23 +478,47 @@ var BaseAuthStore = class {
     }
   }
   /**
-   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
-   * `user_metadata` is already inside the access token.
+   * Serialize the session tokens into an array of `Set-Cookie` header strings.
+   * If the payload exceeds `maxChunkSize` (default 3500 bytes), it is automatically split into
+   * numbered chunks `${key}.0`, `${key}.1`, etc. to avoid browser cookie size limits (AUTH-010).
    */
-  exportToCookie(options = {}) {
+  exportToCookies(options = {}, maxChunkSize = 3500) {
     const data = {
       token: this.token,
       refreshToken: this.refreshToken
     };
     const encoded = encodeURIComponent(JSON.stringify(data));
-    const parts = [`${this.key}=${encoded}`];
-    if (options.path) parts.push(`Path=${options.path}`);
-    if (options.domain) parts.push(`Domain=${options.domain}`);
-    if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-    if (options.secure) parts.push("Secure");
-    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
-    if (options.httpOnly) parts.push("HttpOnly");
-    return parts.join("; ");
+    const buildCookie = (name, value) => {
+      const parts = [`${name}=${value}`];
+      if (options.path) parts.push(`Path=${options.path}`);
+      if (options.domain) parts.push(`Domain=${options.domain}`);
+      if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+      if (options.secure) parts.push("Secure");
+      if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+      if (options.httpOnly) parts.push("HttpOnly");
+      return parts.join("; ");
+    };
+    const limit = Math.max(1, maxChunkSize);
+    if (encoded.length <= limit) {
+      return [buildCookie(this.key, encoded)];
+    }
+    const cookies = [];
+    let offset = 0;
+    let index = 0;
+    while (offset < encoded.length) {
+      const chunk = encoded.slice(offset, offset + limit);
+      cookies.push(buildCookie(`${this.key}.${index}`, chunk));
+      offset += limit;
+      index++;
+    }
+    return cookies;
+  }
+  /**
+   * Serialize the session tokens into a single `Set-Cookie` value.
+   * Note: If the token payload may exceed 3.5KB, use `exportToCookies()` instead for automatic chunking (AUTH-010).
+   */
+  exportToCookie(options = {}) {
+    return this.exportToCookies(options, Infinity)[0];
   }
   // -- Event emitter ----------------------------------------------------------
   /**
@@ -509,14 +563,42 @@ function unwrapEnvelope(body) {
   }
   return body;
 }
+function parseJsonBody(raw, parseBigIntAsString) {
+  if (parseBigIntAsString) {
+    const safe = raw.replace(/([:\[,]\s*)(-?\d{16,})(?=\s*[,}\]])/g, '$1"$2"');
+    return JSON.parse(safe);
+  }
+  return JSON.parse(raw);
+}
 function parseContentRangeTotal(headerVal) {
-  if (!headerVal) return void 0;
+  return parseContentRangeDetails(headerVal).total;
+}
+function parseContentRangeDetails(headerVal) {
+  if (!headerVal) return { total: void 0, hasMore: void 0 };
   const parts = headerVal.split("/");
-  if (parts.length === 2 && parts[1] !== "*") {
-    const n = parseInt(parts[1], 10);
-    if (!Number.isNaN(n)) return n;
+  const totalStr = parts[1];
+  let total;
+  if (totalStr && totalStr !== "*") {
+    const n = parseInt(totalStr, 10);
+    if (!Number.isNaN(n)) total = n;
   }
-  return void 0;
+  let hasMore;
+  const rangePart = parts[0];
+  if (rangePart) {
+    const rangeBounds = rangePart.split("-");
+    if (rangeBounds.length === 2) {
+      const start = parseInt(rangeBounds[0], 10);
+      const end = parseInt(rangeBounds[1], 10);
+      if (!Number.isNaN(start) && !Number.isNaN(end)) {
+        if (total !== void 0) {
+          hasMore = end + 1 < total;
+        } else if (end - start + 1 >= 1e3) {
+          hasMore = true;
+        }
+      }
+    }
+  }
+  return { total, hasMore };
 }
 async function readTextBounded(res, timeoutMs) {
   const body = res.body;
@@ -909,7 +991,7 @@ async function fetchWithAuth(url, init, client) {
     }
     let body;
     try {
-      body = JSON.parse(raw);
+      body = parseJsonBody(raw, client.parseBigIntAsString === true);
     } catch {
       const ctRaw = res.headers.get("Content-Type") ?? "unknown";
       const ct = ctRaw.length > 64 ? `${ctRaw.slice(0, 64)}\u2026` : ctRaw;
@@ -925,10 +1007,21 @@ async function fetchWithAuth(url, init, client) {
     }
     const unwrapped = unwrapEnvelope(body);
     const cr = res.headers.get("content-range") ?? res.headers.get("Content-Range");
-    const totalFromCr = parseContentRangeTotal(cr);
+    const crDetails = parseContentRangeDetails(cr);
+    const totalFromCr = crDetails.total;
+    const hasMore = crDetails.hasMore;
     const rawMeta = body !== null && typeof body === "object" && "meta" in body ? body.meta : void 0;
-    const meta = rawMeta !== void 0 ? rawMeta : totalFromCr !== void 0 ? { total: totalFromCr } : void 0;
+    const meta = rawMeta !== void 0 ? { ...rawMeta, ...hasMore !== void 0 ? { has_more: hasMore } : {} } : totalFromCr !== void 0 || hasMore !== void 0 ? {
+      ...totalFromCr !== void 0 ? { total: totalFromCr } : {},
+      ...hasMore !== void 0 ? { has_more: hasMore } : {}
+    } : void 0;
     const count = meta?.total !== void 0 ? meta.total : totalFromCr ?? null;
+    const isDev = Boolean(client.debug) || typeof globalThis !== "undefined" && globalThis.process?.env?.NODE_ENV === "development";
+    if (hasMore && isDev) {
+      console.warn(
+        "[Aurabase] Query result reached pagination limit of 1,000 rows. Use .range() to paginate further results."
+      );
+    }
     if (unwrapped === null) {
       return { data: null, error: null, meta, count };
     }
@@ -1040,48 +1133,6 @@ var LocalAuthStore = class extends BaseAuthStore {
       this._emitStorageBlocked("removeItem");
     }
   }
-  // -- Cookie helpers (SSR) ---------------------------------------------------
-  /**
-   * Populate the store from a raw `Cookie` header string (server-side).
-   * Looks for the key matching `this.key`.
-   *
-   * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
-   * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
-   */
-  loadFromCookie(cookieString) {
-    const prefix = `${this.key}=`;
-    const entry = cookieString.split(";").map((c) => c.trim()).find((c) => c.startsWith(prefix));
-    if (!entry) return;
-    try {
-      const raw = decodeURIComponent(entry.slice(prefix.length));
-      const parsed = JSON.parse(raw);
-      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
-      if (parsed.token && parsed.refreshToken && user) {
-        super.save(parsed.token, parsed.refreshToken, user);
-      }
-    } catch {
-    }
-  }
-  /**
-   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
-   * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
-   * (5 KB of metadata gave 4 cookies and 13 139 bytes).
-   */
-  exportToCookie(options = {}) {
-    const data = {
-      token: this.token,
-      refreshToken: this.refreshToken
-    };
-    const encoded = encodeURIComponent(JSON.stringify(data));
-    const parts = [`${this.key}=${encoded}`];
-    if (options.path) parts.push(`Path=${options.path}`);
-    if (options.domain) parts.push(`Domain=${options.domain}`);
-    if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-    if (options.secure) parts.push("Secure");
-    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
-    if (options.httpOnly) parts.push("HttpOnly");
-    return parts.join("; ");
-  }
   // -- Private ----------------------------------------------------------------
   _getStorage() {
     if (typeof window !== "undefined" && typeof window.localStorage !== "undefined") {
@@ -1094,7 +1145,9 @@ var LocalAuthStore = class extends BaseAuthStore {
         const env = proc.env;
         const isTest = !!(env?.VITEST || env?.NODE_ENV === "test" || env?.JEST_WORKER_ID);
         const execArgv = proc.execArgv;
-        const hasFlag = Array.isArray(execArgv) && execArgv.some((a) => typeof a === "string" && a.startsWith("--localstorage-file"));
+        const hasFlag = Array.isArray(execArgv) && execArgv.some(
+          (a) => typeof a === "string" && a.startsWith("--localstorage-file")
+        );
         if (isTest || hasFlag) {
           try {
             const s = g.localStorage;

package/dist/index.d.cts

@@ -102,6 +102,10 @@ interface Meta {
      * échoue avec un 400 explicite plutôt que d'émettre ce champ.
      */
     next_cursor?: string;
+    /**
+     * DB-005 : Indique si la requête a été tronquée par le serveur (ex: limite 1 000 lignes de PostgREST).
+     */
+    has_more?: boolean;
 }
 /**
  * Réponse en SUCCÈS porteuse de contenu. `error` y est `null` par construction.
@@ -1572,6 +1576,12 @@ interface AuraClientOptions {
      * Défaut `false`.
      */
     debug?: boolean;
+    /**
+     * DB-006: Preserves 64-bit integer precision by parsing BIGINT values as strings
+     * instead of JavaScript IEEE 754 floats when exceeding Number.MAX_SAFE_INTEGER (9007199254740991).
+     * Default: false (native JSON.parse).
+     */
+    parseBigIntAsString?: boolean;
 }
 interface IdentityInfo {
     id: string;
@@ -1912,12 +1922,19 @@ declare class BaseAuthStore {
     protected _emitStorageBlocked(op: string): void;
     /**
      * Populate the store from a raw `Cookie` header string (server-side).
-     * Looks for the key matching `this.key`.
+     * Supports both single cookie `${this.key}=...` and numbered chunk cookies `${this.key}.0=...`, `${this.key}.1=...`
+     * automatically reassembled in order (AUTH-010).
      */
     loadFromCookie(cookieString: string): void;
     /**
-     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
-     * `user_metadata` is already inside the access token.
+     * Serialize the session tokens into an array of `Set-Cookie` header strings.
+     * If the payload exceeds `maxChunkSize` (default 3500 bytes), it is automatically split into
+     * numbered chunks `${key}.0`, `${key}.1`, etc. to avoid browser cookie size limits (AUTH-010).
+     */
+    exportToCookies(options?: CookieOptions, maxChunkSize?: number): string[];
+    /**
+     * Serialize the session tokens into a single `Set-Cookie` value.
+     * Note: If the token payload may exceed 3.5KB, use `exportToCookies()` instead for automatic chunking (AUTH-010).
      */
     exportToCookie(options?: CookieOptions): string;
     /**
@@ -1969,6 +1986,8 @@ interface AuraClientLike {
     readonly onEvent?: (event: AuraObservabilityEvent) => void;
     /** Si `true`, chaque `AuraObservabilityEvent` est aussi journalisé via `console.debug`. */
     readonly debug?: boolean;
+    /** DB-006: Preserves 64-bit integers as strings when true. */
+    readonly parseBigIntAsString?: boolean;
 }
 
 /**
@@ -2113,20 +2132,6 @@ declare class LocalAuthStore extends BaseAuthStore {
     setItem(key: string, value: string): void;
     getItem(key: string): string | null;
     removeItem(key: string): void;
-    /**
-     * Populate the store from a raw `Cookie` header string (server-side).
-     * Looks for the key matching `this.key`.
-     *
-     * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
-     * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
-     */
-    loadFromCookie(cookieString: string): void;
-    /**
-     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
-     * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
-     * (5 KB of metadata gave 4 cookies and 13 139 bytes).
-     */
-    exportToCookie(options?: CookieOptions): string;
     private _getStorage;
     private _loadFromStorage;
     private _persist;

package/dist/index.d.ts

@@ -102,6 +102,10 @@ interface Meta {
      * échoue avec un 400 explicite plutôt que d'émettre ce champ.
      */
     next_cursor?: string;
+    /**
+     * DB-005 : Indique si la requête a été tronquée par le serveur (ex: limite 1 000 lignes de PostgREST).
+     */
+    has_more?: boolean;
 }
 /**
  * Réponse en SUCCÈS porteuse de contenu. `error` y est `null` par construction.
@@ -1572,6 +1576,12 @@ interface AuraClientOptions {
      * Défaut `false`.
      */
     debug?: boolean;
+    /**
+     * DB-006: Preserves 64-bit integer precision by parsing BIGINT values as strings
+     * instead of JavaScript IEEE 754 floats when exceeding Number.MAX_SAFE_INTEGER (9007199254740991).
+     * Default: false (native JSON.parse).
+     */
+    parseBigIntAsString?: boolean;
 }
 interface IdentityInfo {
     id: string;
@@ -1912,12 +1922,19 @@ declare class BaseAuthStore {
     protected _emitStorageBlocked(op: string): void;
     /**
      * Populate the store from a raw `Cookie` header string (server-side).
-     * Looks for the key matching `this.key`.
+     * Supports both single cookie `${this.key}=...` and numbered chunk cookies `${this.key}.0=...`, `${this.key}.1=...`
+     * automatically reassembled in order (AUTH-010).
      */
     loadFromCookie(cookieString: string): void;
     /**
-     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
-     * `user_metadata` is already inside the access token.
+     * Serialize the session tokens into an array of `Set-Cookie` header strings.
+     * If the payload exceeds `maxChunkSize` (default 3500 bytes), it is automatically split into
+     * numbered chunks `${key}.0`, `${key}.1`, etc. to avoid browser cookie size limits (AUTH-010).
+     */
+    exportToCookies(options?: CookieOptions, maxChunkSize?: number): string[];
+    /**
+     * Serialize the session tokens into a single `Set-Cookie` value.
+     * Note: If the token payload may exceed 3.5KB, use `exportToCookies()` instead for automatic chunking (AUTH-010).
      */
     exportToCookie(options?: CookieOptions): string;
     /**
@@ -1969,6 +1986,8 @@ interface AuraClientLike {
     readonly onEvent?: (event: AuraObservabilityEvent) => void;
     /** Si `true`, chaque `AuraObservabilityEvent` est aussi journalisé via `console.debug`. */
     readonly debug?: boolean;
+    /** DB-006: Preserves 64-bit integers as strings when true. */
+    readonly parseBigIntAsString?: boolean;
 }
 
 /**
@@ -2113,20 +2132,6 @@ declare class LocalAuthStore extends BaseAuthStore {
     setItem(key: string, value: string): void;
     getItem(key: string): string | null;
     removeItem(key: string): void;
-    /**
-     * Populate the store from a raw `Cookie` header string (server-side).
-     * Looks for the key matching `this.key`.
-     *
-     * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
-     * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
-     */
-    loadFromCookie(cookieString: string): void;
-    /**
-     * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
-     * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
-     * (5 KB of metadata gave 4 cookies and 13 139 bytes).
-     */
-    exportToCookie(options?: CookieOptions): string;
     private _getStorage;
     private _loadFromStorage;
     private _persist;

package/dist/index.js

@@ -74,6 +74,12 @@ var AuraError = class _AuraError extends Error {
     const hint = body?.error?.hint;
     if (typeof hint === "string" && hint) {
       this.hint = hint;
+    } else {
+      const serverDetails = JSON.stringify(body ?? "");
+      const isJsonCastError = rawMessage.includes("invalid input syntax for type json") || serverDetails.includes("22P02") && serverDetails.includes("json");
+      if (isJsonCastError) {
+        this.hint = "To filter on a text value inside a JSON column, use the '->>' operator instead of '->' (e.g. .eq('metadata->>theme', 'dark')).";
+      }
     }
     const rawCode = typeof body?.error?.code === "string" ? body.error.code : void 0;
     const canonical = rawCode ? normalizeErrorCode(rawCode) : void 0;
@@ -429,14 +435,38 @@ var BaseAuthStore = class {
   }
   /**
    * Populate the store from a raw `Cookie` header string (server-side).
-   * Looks for the key matching `this.key`.
+   * Supports both single cookie `${this.key}=...` and numbered chunk cookies `${this.key}.0=...`, `${this.key}.1=...`
+   * automatically reassembled in order (AUTH-010).
    */
   loadFromCookie(cookieString) {
+    if (!cookieString) return;
+    const entries = cookieString.split(";").map((c) => c.trim()).filter(Boolean);
+    let encodedData = null;
     const prefix = `${this.key}=`;
-    const entry = cookieString.split(";").map((c) => c.trim()).find((c) => c.startsWith(prefix));
-    if (!entry) return;
+    const singleEntry = entries.find((c) => c.startsWith(prefix));
+    if (singleEntry) {
+      encodedData = singleEntry.slice(prefix.length);
+    } else {
+      const escapedKey = this.key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const chunkRegex = new RegExp(`^${escapedKey}\\.(\\d+)=(.*)$`);
+      const chunks = [];
+      for (const entry of entries) {
+        const match = entry.match(chunkRegex);
+        if (match) {
+          chunks.push({
+            index: parseInt(match[1], 10),
+            value: match[2]
+          });
+        }
+      }
+      if (chunks.length > 0) {
+        chunks.sort((a, b) => a.index - b.index);
+        encodedData = chunks.map((c) => c.value).join("");
+      }
+    }
+    if (!encodedData) return;
     try {
-      const raw = decodeURIComponent(entry.slice(prefix.length));
+      const raw = decodeURIComponent(encodedData);
       const parsed = JSON.parse(raw);
       const user = parsed.token ? userFromAccessToken(parsed.token) : null;
       if (parsed.token && parsed.refreshToken && user) {
@@ -446,23 +476,47 @@ var BaseAuthStore = class {
     }
   }
   /**
-   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
-   * `user_metadata` is already inside the access token.
+   * Serialize the session tokens into an array of `Set-Cookie` header strings.
+   * If the payload exceeds `maxChunkSize` (default 3500 bytes), it is automatically split into
+   * numbered chunks `${key}.0`, `${key}.1`, etc. to avoid browser cookie size limits (AUTH-010).
    */
-  exportToCookie(options = {}) {
+  exportToCookies(options = {}, maxChunkSize = 3500) {
     const data = {
       token: this.token,
       refreshToken: this.refreshToken
     };
     const encoded = encodeURIComponent(JSON.stringify(data));
-    const parts = [`${this.key}=${encoded}`];
-    if (options.path) parts.push(`Path=${options.path}`);
-    if (options.domain) parts.push(`Domain=${options.domain}`);
-    if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-    if (options.secure) parts.push("Secure");
-    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
-    if (options.httpOnly) parts.push("HttpOnly");
-    return parts.join("; ");
+    const buildCookie = (name, value) => {
+      const parts = [`${name}=${value}`];
+      if (options.path) parts.push(`Path=${options.path}`);
+      if (options.domain) parts.push(`Domain=${options.domain}`);
+      if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+      if (options.secure) parts.push("Secure");
+      if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
+      if (options.httpOnly) parts.push("HttpOnly");
+      return parts.join("; ");
+    };
+    const limit = Math.max(1, maxChunkSize);
+    if (encoded.length <= limit) {
+      return [buildCookie(this.key, encoded)];
+    }
+    const cookies = [];
+    let offset = 0;
+    let index = 0;
+    while (offset < encoded.length) {
+      const chunk = encoded.slice(offset, offset + limit);
+      cookies.push(buildCookie(`${this.key}.${index}`, chunk));
+      offset += limit;
+      index++;
+    }
+    return cookies;
+  }
+  /**
+   * Serialize the session tokens into a single `Set-Cookie` value.
+   * Note: If the token payload may exceed 3.5KB, use `exportToCookies()` instead for automatic chunking (AUTH-010).
+   */
+  exportToCookie(options = {}) {
+    return this.exportToCookies(options, Infinity)[0];
   }
   // -- Event emitter ----------------------------------------------------------
   /**
@@ -507,14 +561,42 @@ function unwrapEnvelope(body) {
   }
   return body;
 }
+function parseJsonBody(raw, parseBigIntAsString) {
+  if (parseBigIntAsString) {
+    const safe = raw.replace(/([:\[,]\s*)(-?\d{16,})(?=\s*[,}\]])/g, '$1"$2"');
+    return JSON.parse(safe);
+  }
+  return JSON.parse(raw);
+}
 function parseContentRangeTotal(headerVal) {
-  if (!headerVal) return void 0;
+  return parseContentRangeDetails(headerVal).total;
+}
+function parseContentRangeDetails(headerVal) {
+  if (!headerVal) return { total: void 0, hasMore: void 0 };
   const parts = headerVal.split("/");
-  if (parts.length === 2 && parts[1] !== "*") {
-    const n = parseInt(parts[1], 10);
-    if (!Number.isNaN(n)) return n;
+  const totalStr = parts[1];
+  let total;
+  if (totalStr && totalStr !== "*") {
+    const n = parseInt(totalStr, 10);
+    if (!Number.isNaN(n)) total = n;
   }
-  return void 0;
+  let hasMore;
+  const rangePart = parts[0];
+  if (rangePart) {
+    const rangeBounds = rangePart.split("-");
+    if (rangeBounds.length === 2) {
+      const start = parseInt(rangeBounds[0], 10);
+      const end = parseInt(rangeBounds[1], 10);
+      if (!Number.isNaN(start) && !Number.isNaN(end)) {
+        if (total !== void 0) {
+          hasMore = end + 1 < total;
+        } else if (end - start + 1 >= 1e3) {
+          hasMore = true;
+        }
+      }
+    }
+  }
+  return { total, hasMore };
 }
 async function readTextBounded(res, timeoutMs) {
   const body = res.body;
@@ -907,7 +989,7 @@ async function fetchWithAuth(url, init, client) {
     }
     let body;
     try {
-      body = JSON.parse(raw);
+      body = parseJsonBody(raw, client.parseBigIntAsString === true);
     } catch {
       const ctRaw = res.headers.get("Content-Type") ?? "unknown";
       const ct = ctRaw.length > 64 ? `${ctRaw.slice(0, 64)}\u2026` : ctRaw;
@@ -923,10 +1005,21 @@ async function fetchWithAuth(url, init, client) {
     }
     const unwrapped = unwrapEnvelope(body);
     const cr = res.headers.get("content-range") ?? res.headers.get("Content-Range");
-    const totalFromCr = parseContentRangeTotal(cr);
+    const crDetails = parseContentRangeDetails(cr);
+    const totalFromCr = crDetails.total;
+    const hasMore = crDetails.hasMore;
     const rawMeta = body !== null && typeof body === "object" && "meta" in body ? body.meta : void 0;
-    const meta = rawMeta !== void 0 ? rawMeta : totalFromCr !== void 0 ? { total: totalFromCr } : void 0;
+    const meta = rawMeta !== void 0 ? { ...rawMeta, ...hasMore !== void 0 ? { has_more: hasMore } : {} } : totalFromCr !== void 0 || hasMore !== void 0 ? {
+      ...totalFromCr !== void 0 ? { total: totalFromCr } : {},
+      ...hasMore !== void 0 ? { has_more: hasMore } : {}
+    } : void 0;
     const count = meta?.total !== void 0 ? meta.total : totalFromCr ?? null;
+    const isDev = Boolean(client.debug) || typeof globalThis !== "undefined" && globalThis.process?.env?.NODE_ENV === "development";
+    if (hasMore && isDev) {
+      console.warn(
+        "[Aurabase] Query result reached pagination limit of 1,000 rows. Use .range() to paginate further results."
+      );
+    }
     if (unwrapped === null) {
       return { data: null, error: null, meta, count };
     }
@@ -1038,48 +1131,6 @@ var LocalAuthStore = class extends BaseAuthStore {
       this._emitStorageBlocked("removeItem");
     }
   }
-  // -- Cookie helpers (SSR) ---------------------------------------------------
-  /**
-   * Populate the store from a raw `Cookie` header string (server-side).
-   * Looks for the key matching `this.key`.
-   *
-   * Le cookie ne porte que `{ token, refreshToken }` (AUTH-036) : l'utilisateur est reconstruit à partir des
-   * claims du jeton (non vérifié — `auth.getUser()` le fait vérifier par le serveur).
-   */
-  loadFromCookie(cookieString) {
-    const prefix = `${this.key}=`;
-    const entry = cookieString.split(";").map((c) => c.trim()).find((c) => c.startsWith(prefix));
-    if (!entry) return;
-    try {
-      const raw = decodeURIComponent(entry.slice(prefix.length));
-      const parsed = JSON.parse(raw);
-      const user = parsed.token ? userFromAccessToken(parsed.token) : null;
-      if (parsed.token && parsed.refreshToken && user) {
-        super.save(parsed.token, parsed.refreshToken, user);
-      }
-    } catch {
-    }
-  }
-  /**
-   * Serialize the session tokens into a `Set-Cookie` value. The `user` object is NOT included: its
-   * `user_metadata` is already inside the access token, and sending it twice doubled the cookie
-   * (5 KB of metadata gave 4 cookies and 13 139 bytes).
-   */
-  exportToCookie(options = {}) {
-    const data = {
-      token: this.token,
-      refreshToken: this.refreshToken
-    };
-    const encoded = encodeURIComponent(JSON.stringify(data));
-    const parts = [`${this.key}=${encoded}`];
-    if (options.path) parts.push(`Path=${options.path}`);
-    if (options.domain) parts.push(`Domain=${options.domain}`);
-    if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-    if (options.secure) parts.push("Secure");
-    if (options.sameSite) parts.push(`SameSite=${sameSiteAttribute(options.sameSite)}`);
-    if (options.httpOnly) parts.push("HttpOnly");
-    return parts.join("; ");
-  }
   // -- Private ----------------------------------------------------------------
   _getStorage() {
     if (typeof window !== "undefined" && typeof window.localStorage !== "undefined") {
@@ -1092,7 +1143,9 @@ var LocalAuthStore = class extends BaseAuthStore {
         const env = proc.env;
         const isTest = !!(env?.VITEST || env?.NODE_ENV === "test" || env?.JEST_WORKER_ID);
         const execArgv = proc.execArgv;
-        const hasFlag = Array.isArray(execArgv) && execArgv.some((a) => typeof a === "string" && a.startsWith("--localstorage-file"));
+        const hasFlag = Array.isArray(execArgv) && execArgv.some(
+          (a) => typeof a === "string" && a.startsWith("--localstorage-file")
+        );
         if (isTest || hasFlag) {
           try {
             const s = g.localStorage;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/core",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "Cœur du SDK Aurabase : fetch résilient, erreurs, stores auth, types de réponse (infrastructure interne)",
   "type": "module",
   "main": "dist/index.cjs",