@gaballahtech/seba 0.0.0-stage → 0.2.0

package/dist/node/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}

package/dist/node/platform.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Node.js platform: a temporary loopback HTTP server captures the authorization response.
+ *
+ * The server binds only the loopback interface from the configured redirect URI, accepts a
+ * single matching `GET`, and shuts down as soon as the response is delivered.
+ */
+import type { InteractiveLoginRequest, Platform } from "../types.js";
+/**
+ * Create the platform used by `Seba` in Node.js.
+ *
+ * Sessions are stored in process memory; IndexedDB is rejected with a configuration error
+ * so a missing browser API never turns into a silent login failure.
+ */
+export declare function createNodePlatform(): Platform;
+/**
+ * Listen on the loopback interface, open the authorization URL, and resolve with the
+ * callback URL once the provider redirects back.
+ *
+ * @param request - Authorization URL, redirect URI and expected state.
+ * @throws {@link SebaNoUIError} when no `openAuthorizationUrl` hook was configured.
+ * @throws {@link SebaConfigError} when the redirect URI cannot be served locally.
+ * @throws {@link SebaAuthError} when no valid callback arrives within five minutes.
+ */
+export declare function startLoopbackCallbackServer(request: InteractiveLoginRequest): Promise<URL>;
+//# sourceMappingURL=platform.d.ts.map

package/dist/node/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/node/platform.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAsC,MAAM,aAAa,CAAC;AAuBzG;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,QAAQ,CAiB7C;AAED;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,CAmHhG"}

package/dist/node/platform.js

@@ -0,0 +1,161 @@
+/**
+ * Node.js platform: a temporary loopback HTTP server captures the authorization response.
+ *
+ * The server binds only the loopback interface from the configured redirect URI, accepts a
+ * single matching `GET`, and shuts down as soon as the response is delivered.
+ */
+import { createServer } from "node:http";
+import { isLoopbackHost } from "../core/discovery.js";
+import { SebaAuthError, SebaConfigError, SebaNoUIError } from "../core/errors.js";
+import { memoryPendingAuthStore, memorySessionStorage } from "../core/storage.js";
+/** How long an interactive login may wait for the browser (5 minutes). */
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+const SUCCESS_HTML = [
+    "<!doctype html>",
+    '<html lang="en"><head><meta charset="utf-8"><title>Signed in</title></head>',
+    '<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem">',
+    "<h1>Signed in</h1>",
+    "<p>You can close this window and return to the terminal.</p>",
+    "</body></html>",
+].join("");
+const FAILURE_HTML = [
+    "<!doctype html>",
+    '<html lang="en"><head><meta charset="utf-8"><title>Sign-in failed</title></head>',
+    '<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem">',
+    "<h1>Sign-in could not be completed</h1>",
+    "<p>Return to the terminal for details and start the login again.</p>",
+    "</body></html>",
+].join("");
+/**
+ * Create the platform used by `Seba` in Node.js.
+ *
+ * Sessions are stored in process memory; IndexedDB is rejected with a configuration error
+ * so a missing browser API never turns into a silent login failure.
+ */
+export function createNodePlatform() {
+    return {
+        kind: "node",
+        defaultStorage: "memory",
+        fetch: (input, init) => globalThis.fetch(input, init),
+        currentUrl: () => null,
+        pendingAuth: memoryPendingAuthStore(),
+        createStorage(kind) {
+            if (kind === "indexeddb") {
+                throw new SebaConfigError('IndexedDB is not available in Node.js. Remove storage or use storage: "memory".');
+            }
+            return memorySessionStorage();
+        },
+        beginInteractiveLogin: startLoopbackCallbackServer,
+    };
+}
+/**
+ * Listen on the loopback interface, open the authorization URL, and resolve with the
+ * callback URL once the provider redirects back.
+ *
+ * @param request - Authorization URL, redirect URI and expected state.
+ * @throws {@link SebaNoUIError} when no `openAuthorizationUrl` hook was configured.
+ * @throws {@link SebaConfigError} when the redirect URI cannot be served locally.
+ * @throws {@link SebaAuthError} when no valid callback arrives within five minutes.
+ */
+export async function startLoopbackCallbackServer(request) {
+    if (request.openAuthorizationUrl === undefined) {
+        throw new SebaNoUIError("Node.js cannot open a browser by itself. Pass openAuthorizationUrl in the Seba config, " +
+            "for example a function that prints the URL or calls the platform's browser opener.");
+    }
+    let target;
+    try {
+        target = new URL(request.redirectUri);
+    }
+    catch {
+        throw new SebaConfigError(`The redirectUri "${request.redirectUri}" is not an absolute URL.`);
+    }
+    if (target.protocol !== "http:") {
+        throw new SebaConfigError(`Node.js serves the login callback over plain http on loopback, but the redirectUri uses "${target.protocol}". ` +
+            'Configure something like "http://127.0.0.1:3000/auth/callback" and publish it in the Client ID Document.');
+    }
+    if (!isLoopbackHost(target.hostname)) {
+        throw new SebaConfigError(`The redirectUri "${request.redirectUri}" does not point at a loopback host. ` +
+            "SEBA only listens on 127.0.0.1, ::1 or localhost.");
+    }
+    const hostname = target.hostname.replace(/^\[|\]$/g, "");
+    const port = target.port === "" ? 80 : Number(target.port);
+    const callbackPath = target.pathname;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const server = createServer();
+        const timer = setTimeout(() => {
+            finish(new SebaAuthError("The interactive login timed out after five minutes without a callback. Start the login again."));
+        }, LOGIN_TIMEOUT_MS);
+        timer.unref();
+        server.on("request", (req, res) => {
+            const url = new URL(req.url ?? "/", "http://placeholder");
+            if (req.method !== "GET" || url.pathname !== callbackPath) {
+                respond(res, 404, FAILURE_HTML);
+                return;
+            }
+            if (url.searchParams.get("state") !== request.state) {
+                respond(res, 400, FAILURE_HTML);
+                return;
+            }
+            const hasResponse = url.searchParams.has("code") || url.searchParams.has("error");
+            if (!hasResponse) {
+                respond(res, 400, FAILURE_HTML);
+                return;
+            }
+            respond(res, 200, SUCCESS_HTML);
+            const callback = new URL(`${callbackPath}${url.search}`, target.origin);
+            finish(null, callback);
+        });
+        server.on("error", (error) => {
+            if (error.code === "EADDRINUSE") {
+                finish(new SebaConfigError(`Port ${String(port)} on ${hostname} is already in use, so the login callback cannot be received. ` +
+                    "Choose a different port in redirectUri and in the Client ID Document.", { cause: error }));
+                return;
+            }
+            finish(new SebaConfigError(`The loopback callback server could not start: ${error.message}`, {
+                cause: error,
+            }));
+        });
+        server.listen(port, hostname, () => {
+            Promise.resolve()
+                .then(() => request.openAuthorizationUrl?.(request.authorizationUrl))
+                .catch((error) => {
+                finish(new SebaAuthError("openAuthorizationUrl failed, so the login could not be started.", {
+                    cause: error,
+                }));
+            });
+        });
+        function finish(error, callback) {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(timer);
+            server.closeAllConnections();
+            // Settle only once the listening socket is closed, so the port is free for the next
+            // login and no request can be delivered to this server after the promise resolves.
+            server.close(() => {
+                if (error !== null) {
+                    reject(error);
+                    return;
+                }
+                if (callback === undefined) {
+                    reject(new SebaAuthError("The loopback server finished without a callback URL."));
+                    return;
+                }
+                resolve(callback);
+            });
+        }
+    });
+}
+function respond(res, status, html) {
+    res.writeHead(status, {
+        "content-type": "text/html; charset=utf-8",
+        "cache-control": "no-store",
+        "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'",
+        "referrer-policy": "no-referrer",
+        connection: "close",
+    });
+    res.end(html);
+}
+//# sourceMappingURL=platform.js.map

package/dist/node/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/node/platform.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAGlF,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC,MAAM,YAAY,GAAG;IACnB,iBAAiB;IACjB,6EAA6E;IAC7E,iGAAiG;IACjG,oBAAoB;IACpB,8DAA8D;IAC9D,gBAAgB;CACjB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEX,MAAM,YAAY,GAAG;IACnB,iBAAiB;IACjB,kFAAkF;IAClF,iGAAiG;IACjG,yCAAyC;IACzC,sEAAsE;IACtE,gBAAgB;CACjB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,cAAc,EAAE,QAAQ;QACxB,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC;QACrD,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,WAAW,EAAE,sBAAsB,EAAE;QACrC,aAAa,CAAC,IAAiB;YAC7B,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACzB,MAAM,IAAI,eAAe,CACvB,iFAAiF,CAClF,CAAC;YACJ,CAAC;YACD,OAAO,oBAAoB,EAAE,CAAC;QAChC,CAAC;QACD,qBAAqB,EAAE,2BAA2B;KAChC,CAAC;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAgC;IAChF,IAAI,OAAO,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,aAAa,CACrB,yFAAyF;YACvF,oFAAoF,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,oBAAoB,OAAO,CAAC,WAAW,2BAA2B,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CACvB,4FAA4F,MAAM,CAAC,QAAQ,KAAK;YAC9G,0GAA0G,CAC7G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,eAAe,CACvB,oBAAoB,OAAO,CAAC,WAAW,uCAAuC;YAC5E,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;IAErC,OAAO,IAAI,OAAO,CAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CACJ,IAAI,aAAa,CACf,+FAA+F,CAChG,CACF,CAAC;QACJ,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBAC1D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACxE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YAClD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,CACJ,IAAI,eAAe,CACjB,QAAQ,MAAM,CAAC,IAAI,CAAC,OAAO,QAAQ,gEAAgE;oBACjG,uEAAuE,EACzE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,CACJ,IAAI,eAAe,CAAC,iDAAiD,KAAK,CAAC,OAAO,EAAE,EAAE;gBACpF,KAAK,EAAE,KAAK;aACb,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;YACjC,OAAO,CAAC,OAAO,EAAE;iBACd,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;iBACpE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,MAAM,CACJ,IAAI,aAAa,CAAC,iEAAiE,EAAE;oBACnF,KAAK,EAAE,KAAK;iBACb,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,SAAS,MAAM,CAAC,KAA6C,EAAE,QAAc;YAC3E,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,oFAAoF;YACpF,mFAAmF;YACnF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACnB,MAAM,CAAC,KAAK,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,aAAa,CAAC,sDAAsD,CAAC,CAAC,CAAC;oBAClF,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY;IAChE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,0BAA0B;QAC1C,eAAe,EAAE,UAAU;QAC3B,yBAAyB,EAAE,+CAA+C;QAC1E,iBAAiB,EAAE,aAAa;QAChC,UAAU,EAAE,OAAO;KACpB,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/seba.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The `Seba` facade: resolves the runtime platform, then forwards to the protocol engine.
+ *
+ * The platform module is imported dynamically so a browser bundle never includes the
+ * Node.js HTTP server and vice versa.
+ */
+import type { LoginOptions, SebaConfig, Session } from "./types.js";
+/**
+ * Solid-OIDC client with four operations: {@link Seba.login}, {@link Seba.restoreSession},
+ * {@link Seba.fetch} and {@link Seba.logout}.
+ *
+ * @example
+ * ```ts
+ * const seba = new Seba({
+ *   clientId: "https://app.example/client-id.jsonld",
+ *   redirectUri: "https://app.example/auth/callback",
+ * });
+ *
+ * const session = await seba.restoreSession() ?? await seba.login({ webId });
+ * const response = await seba.fetch(session.webId);
+ * ```
+ */
+export declare class Seba {
+    #private;
+    /**
+     * @param config - Client ID Document URL, redirect URI and optional storage settings.
+     *   Configuration is validated when the first operation runs.
+     */
+    constructor(config: SebaConfig);
+    /** Start or finish an interactive login. See {@link SebaClient.login}. */
+    login(options?: LoginOptions): Promise<Session>;
+    /** Restore a stored session, or `null` when none exists. */
+    restoreSession(): Promise<Session | null>;
+    /** DPoP-authenticated `fetch`. Never forwards credentials to another origin. */
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    /** Sign out and revoke the refresh token when the provider supports it. */
+    logout(): Promise<void>;
+}
+//# sourceMappingURL=seba.d.ts.map

package/dist/seba.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seba.d.ts","sourceRoot":"","sources":["../src/seba.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAY,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAY9E;;;;;;;;;;;;;;GAcG;AACH,qBAAa,IAAI;;IAGf;;;OAGG;gBACS,MAAM,EAAE,UAAU;IAI9B,0EAA0E;IACpE,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAIzD,4DAA4D;IACtD,cAAc,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAI/C,gFAAgF;IAC1E,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI5E,2EAA2E;IACrE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAG9B"}

package/dist/seba.js

@@ -0,0 +1,58 @@
+/**
+ * The `Seba` facade: resolves the runtime platform, then forwards to the protocol engine.
+ *
+ * The platform module is imported dynamically so a browser bundle never includes the
+ * Node.js HTTP server and vice versa.
+ */
+import { SebaClient } from "./core/client.js";
+async function loadPlatform() {
+    const isBrowser = typeof window !== "undefined" && typeof document !== "undefined";
+    if (isBrowser) {
+        const { createBrowserPlatform } = await import("./browser/platform.js");
+        return createBrowserPlatform();
+    }
+    const { createNodePlatform } = await import("./node/platform.js");
+    return createNodePlatform();
+}
+/**
+ * Solid-OIDC client with four operations: {@link Seba.login}, {@link Seba.restoreSession},
+ * {@link Seba.fetch} and {@link Seba.logout}.
+ *
+ * @example
+ * ```ts
+ * const seba = new Seba({
+ *   clientId: "https://app.example/client-id.jsonld",
+ *   redirectUri: "https://app.example/auth/callback",
+ * });
+ *
+ * const session = await seba.restoreSession() ?? await seba.login({ webId });
+ * const response = await seba.fetch(session.webId);
+ * ```
+ */
+export class Seba {
+    #client;
+    /**
+     * @param config - Client ID Document URL, redirect URI and optional storage settings.
+     *   Configuration is validated when the first operation runs.
+     */
+    constructor(config) {
+        this.#client = loadPlatform().then((platform) => new SebaClient(config, platform));
+    }
+    /** Start or finish an interactive login. See {@link SebaClient.login}. */
+    async login(options = {}) {
+        return (await this.#client).login(options);
+    }
+    /** Restore a stored session, or `null` when none exists. */
+    async restoreSession() {
+        return (await this.#client).restoreSession();
+    }
+    /** DPoP-authenticated `fetch`. Never forwards credentials to another origin. */
+    async fetch(input, init) {
+        return (await this.#client).fetch(input, init);
+    }
+    /** Sign out and revoke the refresh token when the provider supports it. */
+    async logout() {
+        return (await this.#client).logout();
+    }
+}
+//# sourceMappingURL=seba.js.map

package/dist/seba.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seba.js","sourceRoot":"","sources":["../src/seba.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,KAAK,UAAU,YAAY;IACzB,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,QAAQ,KAAK,WAAW,CAAC;IACnF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACxE,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAClE,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,IAAI;IACN,OAAO,CAAsB;IAEtC;;;OAGG;IACH,YAAY,MAAkB;QAC5B,IAAI,CAAC,OAAO,GAAG,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,KAAK,CAAC,UAAwB,EAAE;QACpC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,cAAc;QAClB,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;IAC/C,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,KAAK,CAAC,KAAwB,EAAE,IAAkB;QACtD,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,MAAM;QACV,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACvC,CAAC;CACF"}

package/dist/types.d.ts

@@ -0,0 +1,279 @@
+/**
+ * Public and internal types used across SEBA.
+ *
+ * The public surface is intentionally small: {@link SebaConfig}, {@link LoginOptions},
+ * {@link Session}, and the value types below that appear in the API documentation.
+ */
+/** Where SEBA stores session secrets. */
+export type StorageKind = "indexeddb" | "memory";
+/**
+ * Configuration for the {@link Seba} class.
+ *
+ * @example
+ * ```ts
+ * const config: SebaConfig = {
+ *   clientId: "https://myapp.example/client-id.jsonld",
+ *   redirectUri: "https://myapp.example/auth/callback",
+ * };
+ * ```
+ */
+export interface SebaConfig {
+    /**
+     * Absolute HTTPS URL of the application's published Solid Client ID Document.
+     * This URL is sent to the identity provider as the OAuth `client_id`.
+     */
+    clientId: string;
+    /**
+     * Absolute URL the identity provider redirects back to. Must appear verbatim in
+     * the Client ID Document's `redirect_uris`. In Node.js it must point at a loopback
+     * interface (`http://127.0.0.1:<port>/<path>` or `http://localhost:<port>/<path>`).
+     */
+    redirectUri: string;
+    /**
+     * Session storage backend. Defaults to `"indexeddb"` in browsers and
+     * `"memory"` in Node.js.
+     *
+     * `"indexeddb"` persists only the refresh token, the DPoP private key and
+     * non-secret session metadata. Access tokens are never persisted.
+     */
+    storage?: StorageKind;
+    /**
+     * Emit non-sensitive diagnostics through `console.debug`. Tokens, keys,
+     * authorization codes and PKCE verifiers are never logged.
+     *
+     * @defaultValue `false`
+     */
+    debug?: boolean;
+    /**
+     * Node.js only. Receives the authorization URL during an interactive login so
+     * the application can open it in a browser or print it for the user.
+     *
+     * Without this hook Node.js cannot complete an interactive login and
+     * {@link Seba.login} throws a `SebaNoUIError`.
+     */
+    openAuthorizationUrl?: (url: string) => void | Promise<void>;
+}
+/** Optional identity hints for {@link Seba.login}. */
+export interface LoginOptions {
+    /** WebID whose profile lists the trusted identity provider. */
+    webId?: string;
+    /** Identity provider issuer URL, used instead of WebID discovery. */
+    issuer?: string;
+}
+/**
+ * A validated, authenticated Solid session.
+ *
+ * The session object contains no tokens; `Seba.fetch` uses them internally.
+ */
+export interface Session {
+    /** WebID proven by the validated ID token. */
+    webId: string;
+    /** Discriminant that is always `true` for an authenticated session. */
+    isLoggedIn: true;
+    /** Identity provider issuer URL that was validated for this session. */
+    provider: string;
+}
+/**
+ * A token response that passed validation.
+ *
+ * Access tokens are held in memory only — never persisted or exposed by the
+ * public API.
+ */
+export interface TokenSet {
+    /** DPoP-bound access token. In memory only. */
+    accessToken: string;
+    /** Token type. SEBA fails closed unless the provider returns `DPoP`. */
+    tokenType: "DPoP";
+    /** Validated OIDC ID token. */
+    idToken: string;
+    /** Refresh token, when the provider issued one (`offline_access`). */
+    refreshToken?: string;
+    /** Access token lifetime in seconds, when advertised. */
+    expiresIn?: number;
+    /** Granted scopes, when advertised. */
+    scope?: string;
+}
+/** A freshly generated DPoP proof. One proof is created per HTTP request. */
+export interface DPoPProof {
+    /** Compact-serialized, ES256-signed `dpop+jwt`. */
+    jwt: string;
+}
+/**
+ * DPoP signing capability used by the protocol modules.
+ *
+ * Implemented by `core/dpop.ts`. Every call to {@link DPoPSigner.createProof} must sign a
+ * brand-new proof: implementations are forbidden from caching or reusing proofs.
+ */
+export interface DPoPSigner {
+    /** Create a fresh proof for one HTTP attempt. */
+    createProof(input: ProofInput): Promise<string>;
+    /** Base64url JWK SHA-256 thumbprint of the signing key. */
+    thumbprint(): Promise<string>;
+}
+/** Input for one DPoP proof. */
+export interface ProofInput {
+    /** HTTP method of the request being made, in uppercase. */
+    readonly method: string;
+    /** Absolute target URL; query and fragment are removed before signing. */
+    readonly url: string;
+    /** Access token being presented (protected-resource requests only). */
+    readonly accessToken?: string;
+    /** Server-provided `DPoP-Nonce`, when one is known. */
+    readonly nonce?: string;
+}
+/** The subset of OpenID Provider metadata SEBA relies on. */
+export interface OIDCConfiguration {
+    /** Validated issuer identifier (matches the requested issuer). */
+    issuer: string;
+    /** Authorization endpoint, absolute HTTPS URL. */
+    authorizationEndpoint: string;
+    /** Token endpoint, absolute HTTPS URL. */
+    tokenEndpoint: string;
+    /** JWKS endpoint, absolute HTTPS URL. */
+    jwksUri: string;
+    /** Token revocation endpoint, when advertised. */
+    revocationEndpoint?: string;
+    /** DPoP signing algorithms advertised by the provider, when present. */
+    dpopSigningAlgValuesSupported?: string[];
+    /** Scopes advertised by the provider, when present. */
+    scopesSupported?: string[];
+    /** Grant types advertised by the provider, when present. */
+    grantTypesSupported?: string[];
+}
+/** A validated Solid Client ID Document. */
+export interface ClientIDDocument {
+    /** The `client_id` member; must equal the document URL. */
+    clientId: string;
+    /** Published redirect URIs. Membership is compared exactly. */
+    redirectUris: string[];
+    /** Human readable client name, when published. */
+    clientName?: string;
+}
+/** DPoP private key as stored for session restoration. */
+export type PersistedKey = {
+    /** Non-extractable `CryptoKey` stored through structured clone (preferred). */
+    kind: "crypto-key";
+    key: CryptoKey;
+    /**
+     * Public half of the stored key.
+     *
+     * A non-extractable private `CryptoKey` cannot reproduce its public key through
+     * Web Crypto, so the public JWK (which contains no private material) is stored
+     * alongside it for the DPoP proof header and the JWK thumbprint.
+     */
+    publicJwk: JsonWebKey;
+} | {
+    /** Exported JWK fallback for runtimes that cannot structured-clone CryptoKeys. */
+    kind: "jwk";
+    jwk: JsonWebKey;
+};
+/**
+ * Non-secret session metadata plus the two secrets that must survive a reload:
+ * the refresh token and the DPoP private key.
+ *
+ * Access tokens are deliberately absent from this record.
+ */
+export interface PersistedSession {
+    /** Storage schema version. */
+    version: 1;
+    /** Validated WebID. */
+    webId: string;
+    /** Validated identity provider issuer. */
+    provider: string;
+    /** Client identifier the session was created for. */
+    clientId: string;
+    /** Refresh token. Never an access token. */
+    refreshToken: string;
+    /** DPoP private key bound to the refresh token. */
+    key: PersistedKey;
+    /** Granted scopes, when known. */
+    scope?: string;
+    /** Creation time (epoch milliseconds) for diagnostics. */
+    createdAt: number;
+}
+/** Persistence backend for {@link PersistedSession}. */
+export interface SessionStorageAdapter {
+    /** Durably write the session record. */
+    save(session: PersistedSession): Promise<void>;
+    /** Read the session record, or `null` when none exists. */
+    load(): Promise<PersistedSession | null>;
+    /** Remove the session record. Must not throw when nothing is stored. */
+    clear(): Promise<void>;
+}
+/**
+ * Short-lived authorization transaction state.
+ *
+ * Contains the PKCE verifier and expected nonce, so it is kept in
+ * `sessionStorage` (browser) or process memory (Node.js) — never in
+ * `localStorage` and never in a URL.
+ */
+export interface PendingAuthorization {
+    /** OAuth `state` sent with the authorization request. */
+    state: string;
+    /** PKCE `code_verifier`. */
+    codeVerifier: string;
+    /** Expected OIDC `nonce`. */
+    nonce: string;
+    /** Issuer the user is being sent to (RFC 9207 `iss` validation target). */
+    issuer: string;
+    /** Client identifier used for the request. */
+    clientId: string;
+    /** Redirect URI used for the request. */
+    redirectUri: string;
+    /** WebID the user asked to sign in with, when known. */
+    webId?: string;
+    /** Creation time (epoch milliseconds); stale transactions are discarded. */
+    createdAt: number;
+}
+/** Persistence for {@link PendingAuthorization}. */
+export interface PendingAuthorizationStore {
+    save(pending: PendingAuthorization): Promise<void>;
+    load(): Promise<PendingAuthorization | null>;
+    clear(): Promise<void>;
+}
+/** Runtime capabilities the core code needs from its host. */
+export interface Platform {
+    /** Runtime name, used for defaults and error messages. */
+    readonly kind: "browser" | "node";
+    /** Storage backend used when the configuration does not force one. */
+    readonly defaultStorage: StorageKind;
+    /**
+     * Runtime-specific `fetch` implementation used for provider and resource requests.
+     *
+     * Injected so Node.js can apply its own timeout/error mapping without touching DOM
+     * globals, and so tests can supply a deterministic implementation.
+     */
+    readonly fetch: typeof fetch;
+    /** Current document URL, or `null` when there is no document context. */
+    currentUrl(): URL | null;
+    /** Short-lived authorization transaction storage. */
+    readonly pendingAuth: PendingAuthorizationStore;
+    /**
+     * Perform the interactive step and resolve with the authorization response URL.
+     *
+     * Browsers navigate away, so the returned promise intentionally never settles.
+     * Node.js resolves it from the temporary loopback callback server.
+     */
+    beginInteractiveLogin(request: InteractiveLoginRequest): Promise<URL>;
+    /** Ask the user for a WebID or issuer. Missing outside the browser. */
+    selectIdentity?(): Promise<LoginOptions>;
+    /** Create a session storage adapter for the requested backend. */
+    createStorage(kind: StorageKind): SessionStorageAdapter;
+    /**
+     * Remove authorization response parameters from the visible URL after they have been
+     * consumed. Browsers implement this with `history.replaceState`; Node.js has no URL.
+     */
+    clearCallback?(): void;
+}
+/** Input for {@link Platform.beginInteractiveLogin}. */
+export interface InteractiveLoginRequest {
+    /** Fully constructed authorization URL. */
+    authorizationUrl: string;
+    /** Redirect URI registered with the provider. */
+    redirectUri: string;
+    /** Expected OAuth state, used by the loopback server to ignore stray requests. */
+    state: string;
+    /** Open the authorization URL in a browser. Node.js only. */
+    openAuthorizationUrl?: (url: string) => void | Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yCAAyC;AACzC,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,WAAW,CAAC;IAEtB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,UAAU,EAAE,IAAI,CAAC;IACjB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,iDAAiD;IACjD,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,2DAA2D;IAC3D,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,gCAAgC;AAChC,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,0CAA0C;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC;IACzC,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,4CAA4C;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0DAA0D;AAC1D,MAAM,MAAM,YAAY,GACpB;IACE,+EAA+E;IAC/E,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;IACf;;;;;;OAMG;IACH,SAAS,EAAE,UAAU,CAAC;CACvB,GACD;IACE,kFAAkF;IAClF,IAAI,EAAE,KAAK,CAAC;IACZ,GAAG,EAAE,UAAU,CAAC;CACjB,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,GAAG,EAAE,YAAY,CAAC;IAClB,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wDAAwD;AACxD,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,2DAA2D;IAC3D,IAAI,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACzC,wEAAwE;IACxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,8DAA8D;AAC9D,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;IAC7B,yEAAyE;IACzE,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAChD;;;;;OAKG;IACH,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,uEAAuE;IACvE,cAAc,CAAC,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,kEAAkE;IAClE,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,qBAAqB,CAAC;IACxD;;;OAGG;IACH,aAAa,CAAC,IAAI,IAAI,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,2CAA2C;IAC3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D"}

package/dist/types.js

@@ -0,0 +1,8 @@
+/**
+ * Public and internal types used across SEBA.
+ *
+ * The public surface is intentionally small: {@link SebaConfig}, {@link LoginOptions},
+ * {@link Session}, and the value types below that appear in the API documentation.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}