@gaballahtech/seba 0.0.0-stage → 0.2.0

package/dist/core/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/core/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,MAAM,IAAI,UAAU,EACpB,SAAS,GAEV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGjE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAU,CAAC;AAE7E,kEAAkE;AAClE,MAAM,aAAa,GAAG,oEAAoE,CAAC;AAE3F,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,wDAAwD;AACxD,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AA0B9G;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,UAAU,GAAG,EAAE;IACzC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC7B,qFAAqF;QACrF,4EAA4E;QAC5E,OAAO,aAAa,CAAC,MAAM,CAAE,IAAI,CAAC,CAAC,CAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,YAAoB;IACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7F,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAKhD;IACC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,cAAc,EAAE;QAChB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC9B,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,OAAO,GAAyB;QACpC,KAAK;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAQrC;IACC,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QAC3E,MAAM,IAAI,aAAa,CAAC,iFAAiF,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC3E,MAAM,IAAI,aAAa,CAAC,qEAAqE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC;IAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC5D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB,EAAE,OAA6B;IAC3F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,+BAA+B,WAAW,uBAAuB,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;IAEhC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACpD,MAAM,IAAI,aAAa,CACrB,6CAA6C,aAAa,GAAG;YAC3D,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CACrB,qEAAqE;YACnE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CACrB,8EAA8E;YAC5E,aAAa,OAAO,CAAC,MAAM,2EAA2E,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,aAAa,CACrB,6CAA6C,MAAM,sCAAsC,OAAO,CAAC,MAAM,KAAK;YAC1G,kFAAkF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,aAAa,CAAC,oEAAoE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAoBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAM1C;IACC,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACxB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC/C,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,KAAK,CAAC,aAAa;gBACxB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,aAAa,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,KAAK,CAAC,aAAa,EACnB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAC5E,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAC/B,CAAC;QAEF,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,SAAS,CAAU,IAAI,EAAE,oBAAoB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;YACrG,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAA+B,EAAE,QAAQ,EAAE,CAAC;QACvE,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1G,MAAM,WAAW,GAAG,OAAO,MAAM,EAAE,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhH,IAAI,KAAK,KAAK,gBAAgB,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YACtE,KAAK,GAAG,SAAS,CAAC;YAClB,SAAS;QACX,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACrD,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,iFAAiF,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAW/C;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,YAAY;KAClC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;QAChD,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,aAAa,CACrB,4DAA4D,OAAO,CAAC,KAAK,GAAG;YAC1E,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI;QACnF,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;KAC1D,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAA6B;IACzD,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;IAClE,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CACrB,qCAAqC,SAAS,0CAA0C;YACtF,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACrE,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QAC5D,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IACrC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;SAAM,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CACrB,iDAAiD,KAAK,WAAW;YAC/D,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAWrC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACpF,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACpD,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,mBAAmB;YAC/B,cAAc,EAAE,uBAAuB;YACvC,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,aAAa,CAAC,mCAAmC,KAAK,CAAC,OAAO,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,aAAa,CACrB,gDAAgD,MAAM,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,QAAQ,KAAK,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CAAC,2DAA2D,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACtF,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,aAAa,CACrB,wHAAwH,CACzH,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QAClE,MAAM,IAAI,aAAa,CAAC,+DAA+D,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,aAAa,CAAC,2CAA2C,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,IAAI,QAAQ,GAAG,UAAU,GAAG,uBAAuB,EAAE,CAAC;QACpD,MAAM,IAAI,aAAa,CAAC,gEAAgE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,aAAa,CAAC,2CAA2C,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QAC7E,MAAM,IAAI,aAAa,CAAC,yDAAyD,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACvE,MAAM,IAAI,aAAa,CACrB,+BAA+B,KAAK,gCAAgC,KAAK,CAAC,aAAa,KAAK;YAC1F,8BAA8B,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgC,EAChC,KAA4D;IAE5D,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,eAAe,GACnB,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI;QACvD,CAAC,CAAE,YAAwC,CAAC,KAAK,CAAC;QAClD,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,aAAa,CAAC,oEAAoE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACnD,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,aAAa,CACrB,oFAAoF;gBAClF,0BAA0B,CAC7B,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,aAAa,CACrB,sGAAsG;YACpG,wCAAwC,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAgC,EAAE,OAAe;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CACrB,wCAAwC,SAAS,mCAAmC;YAClF,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,aAAa,CACrB,wCAAwC,SAAS,+BAA+B;YAC9E,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,SAAmC;IACtE,MAAM,OAAO,GACX,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE;QAC5E,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3G,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAA2B;IACnD,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/core/session.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Session lifecycle: in-memory token state, durable refresh-token storage, restoration
+ * and logout.
+ *
+ * Invariants:
+ * - access tokens and ID tokens live in memory only;
+ * - the refresh token and DPoP key are the only secrets written to storage;
+ * - a rejected refresh token clears the local session and surfaces
+ *   {@link SebaSessionExpiredError};
+ * - transient failures never clear a still-valid refresh token.
+ */
+import { type Identity } from "./oidc.js";
+import type { DPoPSigner, OIDCConfiguration, PersistedKey, Session, SessionStorageAdapter, TokenSet } from "../types.js";
+/** Refresh an access token this long before it expires (milliseconds). */
+export declare const EXPIRY_SKEW_MS = 30000;
+/** A logged in session held in memory. */
+export interface SessionState {
+    /** Current tokens. Replaced on refresh; never persisted. */
+    readonly tokens: TokenSet;
+    /** Identity proven by the validated ID token. */
+    readonly identity: Identity;
+    /** DPoP signing capability for this session. */
+    readonly signer: DPoPSigner;
+    /** Stored form of the DPoP key, reused when refreshing. */
+    readonly key: PersistedKey;
+    /** Client identifier the session belongs to. */
+    readonly clientId: string;
+    /** Discovery metadata used for refresh and revocation. */
+    readonly configuration: OIDCConfiguration;
+    /** Access token expiry (epoch milliseconds), or `null` when unknown. */
+    readonly expiresAt: number | null;
+}
+/** Options for {@link SessionManager}. */
+export interface SessionManagerOptions {
+    /** Client identifier used by every request in this session. */
+    readonly clientId: string;
+    /** Durable refresh-token storage. */
+    readonly storage: SessionStorageAdapter;
+    /** Runtime fetch implementation. */
+    readonly fetchImpl: typeof fetch;
+    /** Re-discover a provider when restoring a session. */
+    readonly discover: (issuer: string) => Promise<OIDCConfiguration>;
+    /** Non-sensitive diagnostics. */
+    readonly debug?: (message: string) => void;
+}
+/**
+ * Owns the current session and its persistence.
+ *
+ * Obtained internally from `Seba`; not exported from the package entry point.
+ */
+export declare class SessionManager {
+    #private;
+    constructor(options: SessionManagerOptions);
+    /** Current session state, or `null` when logged out. */
+    get current(): SessionState | null;
+    /** Whether a session is present in memory. */
+    get isAuthenticated(): boolean;
+    /**
+     * Current session state.
+     *
+     * @throws {@link SebaAuthError} when no session exists.
+     */
+    require(): SessionState;
+    /** Public, token-free view of the current session. */
+    toPublicSession(): Session | null;
+    /**
+     * Adopt a freshly logged in session.
+     *
+     * Persists the refresh token and DPoP key when the provider issued a refresh token.
+     * Storage failures are downgraded to a debug message: the in-memory session stays
+     * usable, only reload survival is affected.
+     */
+    adopt(input: {
+        tokens: TokenSet;
+        identity: Identity;
+        signer: DPoPSigner;
+        key: PersistedKey;
+        configuration: OIDCConfiguration;
+    }): Promise<SessionState>;
+    /**
+     * Restore a stored session by refreshing its access token.
+     *
+     * @returns The session, or `null` when nothing is stored.
+     * @throws {@link SebaSessionExpiredError} when the grant was revoked (local state cleared).
+     * @throws {@link SebaNetworkError} for transport and 5xx failures (local state kept).
+     * @throws {@link SebaAuthError} for other provider rejections (local state kept).
+     */
+    restore(): Promise<Session | null>;
+    /** Access token expiry, or `null` when the provider did not advertise one. */
+    get expiresAt(): number | null;
+    /**
+     * Refresh the current session unless the access token is still fresh.
+     *
+     * @param force - Refresh even when the token has not expired (used after a 401).
+     * @throws {@link SebaAuthError} when no session exists.
+     */
+    refreshIfNeeded(force?: boolean): Promise<void>;
+    /**
+     * Sign out.
+     *
+     * Revokes the refresh token when the provider advertises a revocation endpoint, then
+     * clears local state. Revocation failures are best effort and never block logout.
+     */
+    logout(): Promise<void>;
+    /** Clear the in-memory session and the stored record. */
+    clearLocal(): Promise<void>;
+    /** Whether the current access token is expired or within the refresh skew. */
+    isExpired(): boolean;
+}
+/**
+ * Validate that a storage backend can hold the session record shape.
+ *
+ * @param kind - Requested backend.
+ */
+export declare function assertStorageKind(kind: string): asserts kind is "indexeddb" | "memory";
+//# sourceMappingURL=session.d.ts.map

package/dist/core/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/core/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EAAwD,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChG,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,YAAY,EAEZ,OAAO,EACP,qBAAqB,EACrB,QAAQ,EACT,MAAM,aAAa,CAAC;AAErB,0EAA0E;AAC1E,eAAO,MAAM,cAAc,QAAS,CAAC;AAKrC,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC;IAC1C,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC;IACjC,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClE,iCAAiC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AAED;;;;GAIG;AACH,qBAAa,cAAc;;gBAKb,OAAO,EAAE,qBAAqB;IAI1C,wDAAwD;IACxD,IAAI,OAAO,IAAI,YAAY,GAAG,IAAI,CAEjC;IAED,8CAA8C;IAC9C,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED;;;;OAIG;IACH,OAAO,IAAI,YAAY;IAOvB,sDAAsD;IACtD,eAAe,IAAI,OAAO,GAAG,IAAI;IAOjC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,QAAQ,CAAC;QACjB,QAAQ,EAAE,QAAQ,CAAC;QACnB,MAAM,EAAE,UAAU,CAAC;QACnB,GAAG,EAAE,YAAY,CAAC;QAClB,aAAa,EAAE,iBAAiB,CAAC;KAClC,GAAG,OAAO,CAAC,YAAY,CAAC;IAkCzB;;;;;;;OAOG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IA2BxC,8EAA8E;IAC9E,IAAI,SAAS,IAAI,MAAM,GAAG,IAAI,CAE7B;IAED;;;;;OAKG;IACG,eAAe,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0InD;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAqD7B,yDAAyD;IACnD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IASjC,8EAA8E;IAC9E,SAAS,IAAI,OAAO;CAerB;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,GAAG,QAAQ,CAItF"}

package/dist/core/session.js

@@ -0,0 +1,350 @@
+/**
+ * Session lifecycle: in-memory token state, durable refresh-token storage, restoration
+ * and logout.
+ *
+ * Invariants:
+ * - access tokens and ID tokens live in memory only;
+ * - the refresh token and DPoP key are the only secrets written to storage;
+ * - a rejected refresh token clears the local session and surfaces
+ *   {@link SebaSessionExpiredError};
+ * - transient failures never clear a still-valid refresh token.
+ */
+import { loadDPoPKey } from "./dpop.js";
+import { SebaAuthError, SebaConfigError, SebaNetworkError, SebaSessionExpiredError } from "./errors.js";
+import { httpFetch } from "./http.js";
+import { parseTokenSet, requestTokenResponse, validateIdToken } from "./oidc.js";
+/** Refresh an access token this long before it expires (milliseconds). */
+export const EXPIRY_SKEW_MS = 30_000;
+/** OAuth errors that mean the stored grant is permanently unusable. */
+const TERMINAL_REFRESH_ERRORS = new Set(["invalid_grant", "invalid_token", "invalid_request", "unauthorized_client"]);
+/**
+ * Owns the current session and its persistence.
+ *
+ * Obtained internally from `Seba`; not exported from the package entry point.
+ */
+export class SessionManager {
+    #options;
+    #state = null;
+    #refreshing = null;
+    constructor(options) {
+        this.#options = options;
+    }
+    /** Current session state, or `null` when logged out. */
+    get current() {
+        return this.#state;
+    }
+    /** Whether a session is present in memory. */
+    get isAuthenticated() {
+        return this.#state !== null;
+    }
+    /**
+     * Current session state.
+     *
+     * @throws {@link SebaAuthError} when no session exists.
+     */
+    require() {
+        if (this.#state === null) {
+            throw new SebaAuthError("No authenticated session. Call login() or restoreSession() first.");
+        }
+        return this.#state;
+    }
+    /** Public, token-free view of the current session. */
+    toPublicSession() {
+        if (this.#state === null) {
+            return null;
+        }
+        return { webId: this.#state.identity.webId, isLoggedIn: true, provider: this.#state.identity.issuer };
+    }
+    /**
+     * Adopt a freshly logged in session.
+     *
+     * Persists the refresh token and DPoP key when the provider issued a refresh token.
+     * Storage failures are downgraded to a debug message: the in-memory session stays
+     * usable, only reload survival is affected.
+     */
+    async adopt(input) {
+        const state = {
+            tokens: input.tokens,
+            identity: input.identity,
+            signer: input.signer,
+            key: input.key,
+            clientId: this.#options.clientId,
+            configuration: input.configuration,
+            expiresAt: expiresAtFrom(input.tokens),
+        };
+        this.#state = state;
+        if (input.tokens.refreshToken !== undefined) {
+            const record = {
+                version: 1,
+                webId: state.identity.webId,
+                provider: state.identity.issuer,
+                clientId: state.clientId,
+                refreshToken: input.tokens.refreshToken,
+                key: input.key,
+                createdAt: Date.now(),
+                ...(input.tokens.scope === undefined ? {} : { scope: input.tokens.scope }),
+            };
+            try {
+                await this.#options.storage.save(record);
+            }
+            catch (error) {
+                this.#log("session storage is unavailable; the session will not survive a reload", error);
+            }
+        }
+        else {
+            this.#log("the provider issued no refresh token; the session will not survive a reload");
+        }
+        return state;
+    }
+    /**
+     * Restore a stored session by refreshing its access token.
+     *
+     * @returns The session, or `null` when nothing is stored.
+     * @throws {@link SebaSessionExpiredError} when the grant was revoked (local state cleared).
+     * @throws {@link SebaNetworkError} for transport and 5xx failures (local state kept).
+     * @throws {@link SebaAuthError} for other provider rejections (local state kept).
+     */
+    async restore() {
+        const record = await this.#options.storage.load();
+        if (record === null) {
+            return null;
+        }
+        if (record.version !== 1 || record.clientId !== this.#options.clientId) {
+            await this.clearLocal();
+            throw new SebaAuthError("The stored session was created by a different SEBA configuration and cannot be reused.");
+        }
+        let signer;
+        try {
+            signer = await loadDPoPKey(record.key);
+        }
+        catch (error) {
+            await this.clearLocal();
+            throw new SebaSessionExpiredError("The stored DPoP key is unusable; the session was cleared.", {
+                cause: error,
+            });
+        }
+        const configuration = await this.#options.discover(record.provider);
+        await this.#refreshWith(record, signer, configuration);
+        return this.toPublicSession();
+    }
+    /** Access token expiry, or `null` when the provider did not advertise one. */
+    get expiresAt() {
+        return this.#state?.expiresAt ?? null;
+    }
+    /**
+     * Refresh the current session unless the access token is still fresh.
+     *
+     * @param force - Refresh even when the token has not expired (used after a 401).
+     * @throws {@link SebaAuthError} when no session exists.
+     */
+    async refreshIfNeeded(force = false) {
+        const state = this.require();
+        if (state.tokens.refreshToken === undefined) {
+            if (force) {
+                throw new SebaSessionExpiredError("The access token was rejected and no refresh token is available. Sign in again.");
+            }
+            return;
+        }
+        if (!force && state.expiresAt !== null && Date.now() < state.expiresAt - EXPIRY_SKEW_MS) {
+            return;
+        }
+        await this.#refreshOnce();
+    }
+    async #refreshOnce() {
+        if (this.#refreshing !== null) {
+            await this.#refreshing;
+            return;
+        }
+        const run = this.#performRefresh();
+        this.#refreshing = run;
+        try {
+            await run;
+        }
+        finally {
+            this.#refreshing = null;
+        }
+    }
+    async #performRefresh() {
+        const state = this.require();
+        const record = await this.#options.storage.load();
+        const refreshToken = state.tokens.refreshToken ?? record?.refreshToken;
+        if (refreshToken === undefined) {
+            throw new SebaSessionExpiredError("No refresh token is available. Sign in again.");
+        }
+        const stored = record ?? {
+            version: 1,
+            webId: state.identity.webId,
+            provider: state.identity.issuer,
+            clientId: state.clientId,
+            refreshToken,
+            key: state.key,
+            createdAt: Date.now(),
+        };
+        await this.#refreshWith(stored, state.signer, state.configuration);
+    }
+    async #refreshWith(record, signer, configuration) {
+        const body = new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: record.refreshToken,
+            client_id: this.#options.clientId,
+        });
+        const outcome = await requestTokenResponse({
+            tokenEndpoint: configuration.tokenEndpoint,
+            body,
+            signer,
+            fetchImpl: this.#options.fetchImpl,
+        });
+        if (!outcome.ok) {
+            if (outcome.status >= 500) {
+                throw new SebaNetworkError(`The token endpoint is unavailable (HTTP ${String(outcome.status)}). The stored session was kept; try again later.`);
+            }
+            if (TERMINAL_REFRESH_ERRORS.has(outcome.error)) {
+                await this.clearLocal();
+                throw new SebaSessionExpiredError(`The stored session is no longer valid ("${outcome.error}"). Sign in again.`);
+            }
+            throw new SebaAuthError(`The token endpoint rejected the refresh request with "${outcome.error}"` +
+                (outcome.description === undefined ? "." : `: ${outcome.description}`));
+        }
+        const tokens = parseTokenSet(outcome.body);
+        let identity;
+        try {
+            identity = await validateIdToken({
+                idToken: tokens.idToken,
+                configuration,
+                clientId: this.#options.clientId,
+                signer,
+                fetchImpl: this.#options.fetchImpl,
+                requireDpopBinding: configuration.scopesSupported?.includes("webid") === true,
+                expectedWebId: record.webId,
+            });
+        }
+        catch (error) {
+            if (error instanceof SebaAuthError) {
+                // A refresh whose ID token cannot be validated for this stored identity is
+                // terminal: retrying the same grant cannot succeed, and keeping the record would
+                // repeat the failure on every restore. Network/JWKS transport errors are not
+                // SebaAuthError and keep the record.
+                await this.clearLocal();
+                throw new SebaSessionExpiredError("The refreshed ID token does not match the stored session, so the session was cleared. Sign in again.", { cause: error });
+            }
+            throw error;
+        }
+        if (tokens.refreshToken === undefined) {
+            tokens.refreshToken = record.refreshToken;
+        }
+        this.#state = {
+            tokens,
+            identity,
+            signer,
+            key: record.key,
+            clientId: this.#options.clientId,
+            configuration,
+            expiresAt: expiresAtFrom(tokens),
+        };
+        if (tokens.refreshToken !== record.refreshToken || tokens.scope !== record.scope) {
+            try {
+                await this.#options.storage.save({
+                    ...record,
+                    refreshToken: tokens.refreshToken,
+                    ...(tokens.scope === undefined ? {} : { scope: tokens.scope }),
+                });
+            }
+            catch (error) {
+                this.#log("rotated refresh token could not be stored", error);
+            }
+        }
+    }
+    /**
+     * Sign out.
+     *
+     * Revokes the refresh token when the provider advertises a revocation endpoint, then
+     * clears local state. Revocation failures are best effort and never block logout.
+     */
+    async logout() {
+        const state = this.#state;
+        const record = await this.#options.storage.load().catch(() => null);
+        const refreshToken = state?.tokens.refreshToken ?? record?.refreshToken;
+        let configuration = state?.configuration;
+        let signer = state?.signer;
+        if (refreshToken !== undefined && record !== null && (configuration === undefined || signer === undefined)) {
+            try {
+                configuration ??= await this.#options.discover(record.provider);
+                signer ??= await loadDPoPKey(record.key);
+            }
+            catch (error) {
+                this.#log("could not prepare token revocation; clearing local state anyway", error);
+            }
+        }
+        await this.clearLocal();
+        if (refreshToken === undefined || configuration?.revocationEndpoint === undefined || signer === undefined) {
+            return;
+        }
+        try {
+            const headers = {
+                "content-type": "application/x-www-form-urlencoded",
+                accept: "application/json",
+            };
+            try {
+                headers["DPoP"] = await signer.createProof({
+                    method: "POST",
+                    url: configuration.revocationEndpoint,
+                });
+            }
+            catch (error) {
+                this.#log("could not create a DPoP proof for revocation", error);
+            }
+            await httpFetch(configuration.revocationEndpoint, {
+                method: "POST",
+                headers,
+                body: new URLSearchParams({
+                    token: refreshToken,
+                    token_type_hint: "refresh_token",
+                    client_id: this.#options.clientId,
+                }).toString(),
+                redirect: "manual",
+            }, { fetchImpl: this.#options.fetchImpl });
+        }
+        catch (error) {
+            this.#log("refresh token revocation failed; local session was still cleared", error);
+        }
+    }
+    /** Clear the in-memory session and the stored record. */
+    async clearLocal() {
+        this.#state = null;
+        try {
+            await this.#options.storage.clear();
+        }
+        catch (error) {
+            this.#log("stored session could not be removed", error);
+        }
+    }
+    /** Whether the current access token is expired or within the refresh skew. */
+    isExpired() {
+        const state = this.#state;
+        if (state === null) {
+            return true;
+        }
+        return state.expiresAt !== null && Date.now() >= state.expiresAt - EXPIRY_SKEW_MS;
+    }
+    #log(message, error) {
+        if (this.#options.debug === undefined) {
+            return;
+        }
+        const detail = error instanceof Error ? `: ${error.message}` : "";
+        this.#options.debug(`${message}${detail}`);
+    }
+}
+function expiresAtFrom(tokens) {
+    return tokens.expiresIn === undefined ? null : Date.now() + tokens.expiresIn * 1000;
+}
+/**
+ * Validate that a storage backend can hold the session record shape.
+ *
+ * @param kind - Requested backend.
+ */
+export function assertStorageKind(kind) {
+    if (kind !== "indexeddb" && kind !== "memory") {
+        throw new SebaConfigError(`Unknown storage backend "${kind}". Use "indexeddb" or "memory".`);
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/core/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/core/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACxG,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,eAAe,EAAiB,MAAM,WAAW,CAAC;AAWhG,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC,uEAAuE;AACvE,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAkCtH;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAChB,QAAQ,CAAwB;IACzC,MAAM,GAAwB,IAAI,CAAC;IACnC,WAAW,GAAyB,IAAI,CAAC;IAEzC,YAAY,OAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,8CAA8C;IAC9C,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,aAAa,CAAC,mEAAmE,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,sDAAsD;IACtD,eAAe;QACb,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxG,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,KAMX;QACC,MAAM,KAAK,GAAiB;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAChC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;SACvC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QAEpB,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAqB;gBAC/B,OAAO,EAAE,CAAC;gBACV,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;gBAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;gBACvC,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;aAC3E,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,uEAAuE,EAAE,KAAK,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,aAAa,CACrB,wFAAwF,CACzF,CAAC;QACJ,CAAC;QAED,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,2DAA2D,EAAE;gBAC7F,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED,8EAA8E;IAC9E,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,KAAK,GAAG,KAAK;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,uBAAuB,CAC/B,iFAAiF,CAClF,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;YACxF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,WAAW,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,EAAE,YAAY,CAAC;QACvE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,uBAAuB,CAAC,+CAA+C,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAqB,MAAM,IAAI;YACzC,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;YAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY;YACZ,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,MAAwB,EACxB,MAAkB,EAClB,aAAgC;QAEhC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;SAClC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;YACzC,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,IAAI;YACJ,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CACxB,2CAA2C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,kDAAkD,CACpH,CAAC;YACJ,CAAC;YACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxB,MAAM,IAAI,uBAAuB,CAC/B,2CAA2C,OAAO,CAAC,KAAK,oBAAoB,CAC7E,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,aAAa,CACrB,yDAAyD,OAAO,CAAC,KAAK,GAAG;gBACvE,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CACzE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,eAAe,CAAC;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBAChC,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;gBAClC,kBAAkB,EAAE,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI;gBAC7E,aAAa,EAAE,MAAM,CAAC,KAAK;aAC5B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;gBACnC,2EAA2E;gBAC3E,iFAAiF;gBACjF,6EAA6E;gBAC7E,qCAAqC;gBACrC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxB,MAAM,IAAI,uBAAuB,CAC/B,sGAAsG,EACtG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM;YACN,QAAQ;YACR,MAAM;YACN,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAChC,aAAa;YACb,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC;SACjC,CAAC;QAEF,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACjF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;oBAC/B,GAAG,MAAM;oBACT,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;iBAC/D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,MAAM,EAAE,YAAY,CAAC;QACxE,IAAI,aAAa,GAAG,KAAK,EAAE,aAAa,CAAC;QACzC,IAAI,MAAM,GAAG,KAAK,EAAE,MAAM,CAAC;QAE3B,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;YAC3G,IAAI,CAAC;gBACH,aAAa,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAChE,MAAM,KAAK,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,iEAAiE,EAAE,KAAK,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAExB,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,EAAE,kBAAkB,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1G,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B,CAAC;YACF,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;oBACzC,MAAM,EAAE,MAAM;oBACd,GAAG,EAAE,aAAa,CAAC,kBAAkB;iBACtC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,SAAS,CACb,aAAa,CAAC,kBAAkB,EAChC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,KAAK,EAAE,YAAY;oBACnB,eAAe,EAAE,eAAe;oBAChC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;iBAClC,CAAC,CAAC,QAAQ,EAAE;gBACb,QAAQ,EAAE,QAAQ;aACnB,EACD,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CACvC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,kEAAkE,EAAE,KAAK,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,SAAS;QACP,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,GAAG,cAAc,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,KAAe;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,aAAa,CAAC,MAAgB;IACrC,OAAO,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,eAAe,CAAC,4BAA4B,IAAI,iCAAiC,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC"}

package/dist/core/storage.d.ts

@@ -0,0 +1,22 @@
+/**
+ * In-memory storage backends.
+ *
+ * Used by Node.js by default and by every test that does not need IndexedDB. They hold
+ * data only for the lifetime of the objects, exactly like a browser tab holds
+ * `sessionStorage` state.
+ */
+import type { PendingAuthorization, PendingAuthorizationStore, PersistedSession, SessionStorageAdapter } from "../types.js";
+/**
+ * Session storage that keeps the record in this process only.
+ *
+ * Records are structured-cloned on write and read, mirroring IndexedDB semantics so the
+ * same code paths (including `CryptoKey` persistence) are exercised.
+ *
+ * @param initial - Pre-seeded record, used by tests.
+ */
+export declare function memorySessionStorage(initial?: PersistedSession | null): SessionStorageAdapter;
+/** Authorization transaction storage that keeps the record in this process only. */
+export declare function memoryPendingAuthStore(): PendingAuthorizationStore & {
+    peek(): PendingAuthorization | null;
+};
+//# sourceMappingURL=storage.d.ts.map

package/dist/core/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/core/storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,yBAAyB,EACzB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,aAAa,CAAC;AAErB;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,gBAAgB,GAAG,IAAW,GAAG,qBAAqB,CAanG;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,IAAI,yBAAyB,GAAG;IAAE,IAAI,IAAI,oBAAoB,GAAG,IAAI,CAAA;CAAE,CAgB5G"}

package/dist/core/storage.js

@@ -0,0 +1,48 @@
+/**
+ * In-memory storage backends.
+ *
+ * Used by Node.js by default and by every test that does not need IndexedDB. They hold
+ * data only for the lifetime of the objects, exactly like a browser tab holds
+ * `sessionStorage` state.
+ */
+/**
+ * Session storage that keeps the record in this process only.
+ *
+ * Records are structured-cloned on write and read, mirroring IndexedDB semantics so the
+ * same code paths (including `CryptoKey` persistence) are exercised.
+ *
+ * @param initial - Pre-seeded record, used by tests.
+ */
+export function memorySessionStorage(initial = null) {
+    let record = initial === null ? null : structuredClone(initial);
+    return {
+        async save(session) {
+            record = structuredClone(session);
+        },
+        async load() {
+            return record === null ? null : structuredClone(record);
+        },
+        async clear() {
+            record = null;
+        },
+    };
+}
+/** Authorization transaction storage that keeps the record in this process only. */
+export function memoryPendingAuthStore() {
+    let pending = null;
+    return {
+        async save(value) {
+            pending = { ...value };
+        },
+        async load() {
+            return pending;
+        },
+        async clear() {
+            pending = null;
+        },
+        peek() {
+            return pending;
+        },
+    };
+}
+//# sourceMappingURL=storage.js.map

package/dist/core/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/core/storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAmC,IAAI;IAC1E,IAAI,MAAM,GAA4B,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACzF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB;IACpC,IAAI,OAAO,GAAgC,IAAI,CAAC;IAChD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,KAAK;YACT,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Public entry point of the `seba` package.
+ *
+ * @example
+ * ```ts
+ * import { Seba } from "seba";
+ *
+ * const seba = new Seba({
+ *   clientId: "https://myapp.example/client-id.jsonld",
+ *   redirectUri: "https://myapp.example/auth/callback",
+ * });
+ * ```
+ */
+export type { DPoPProof, LoginOptions, SebaConfig, Session, StorageKind, TokenSet } from "./types.js";
+export { SebaAuthError, SebaConfigError, SebaDiscoveryError, SebaDPoPError, SebaError, SebaNetworkError, SebaNoUIError, SebaRedirectMismatchError, SebaSessionExpiredError, isSebaError, } from "./core/errors.js";
+export type { SebaErrorCode } from "./core/errors.js";
+export { Seba } from "./seba.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtG,OAAO,EACL,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { SebaAuthError, SebaConfigError, SebaDiscoveryError, SebaDPoPError, SebaError, SebaNetworkError, SebaNoUIError, SebaRedirectMismatchError, SebaSessionExpiredError, isSebaError, } from "./core/errors.js";
+export { Seba } from "./seba.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}

package/dist/node/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Node.js entry point (`seba/node`).
+ *
+ * Identical to the root entry point; Node.js resolves its platform itself. The subpath
+ * exists so server bundles never pull in browser-only modules.
+ */
+export * from "../index.js";
+export { createNodePlatform } from "./platform.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/node/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}

package/dist/node/index.js

@@ -0,0 +1,9 @@
+/**
+ * Node.js entry point (`seba/node`).
+ *
+ * Identical to the root entry point; Node.js resolves its platform itself. The subpath
+ * exists so server bundles never pull in browser-only modules.
+ */
+export * from "../index.js";
+export { createNodePlatform } from "./platform.js";
+//# sourceMappingURL=index.js.map