@gaballahtech/seba 0.0.0-stage → 0.2.0

package/dist/core/errors.js

@@ -0,0 +1,104 @@
+/**
+ * Base class of every error thrown by SEBA.
+ *
+ * @example
+ * ```ts
+ * try {
+ *   await seba.login();
+ * } catch (error) {
+ *   if (error instanceof SebaError) console.error(error.code, error.message);
+ * }
+ * ```
+ */
+export class SebaError extends Error {
+    /** Stable, machine-readable error code. */
+    code;
+    constructor(code, message, options) {
+        super(message, options?.cause === undefined ? undefined : { cause: options.cause });
+        this.name = new.target.name;
+        this.code = code;
+    }
+}
+/** Invalid, missing or contradictory library configuration. */
+export class SebaConfigError extends SebaError {
+    constructor(message, options) {
+        super("SEBA_ERR_CONFIG", message, options);
+    }
+}
+/** WebID, Client ID Document or OpenID Provider discovery failed. */
+export class SebaDiscoveryError extends SebaError {
+    constructor(message, options) {
+        super("SEBA_ERR_DISCOVERY", message, options);
+    }
+}
+/**
+ * The configured redirect URI is not published by the Client ID Document.
+ *
+ * The message lists both the requested URI and the published URIs so the
+ * mismatch can be fixed without inspecting network traffic.
+ */
+export class SebaRedirectMismatchError extends SebaError {
+    /** Redirect URI requested by the application. */
+    requestedRedirectUri;
+    /** Redirect URIs published in the Client ID Document. */
+    publishedRedirectUris;
+    constructor(requestedRedirectUri, publishedRedirectUris, options) {
+        super("SEBA_ERR_REDIRECT_MISMATCH", `Redirect URI "${requestedRedirectUri}" is not published by the Client ID Document. ` +
+            `Published redirect_uris: ${formatList(publishedRedirectUris)}. ` +
+            `Add the exact string "${requestedRedirectUri}" to the document's redirect_uris array. ` +
+            "No dynamic client registration is performed by SEBA.", options);
+        this.requestedRedirectUri = requestedRedirectUri;
+        this.publishedRedirectUris = [...publishedRedirectUris];
+    }
+}
+/**
+ * The authorization response, token response or identity token was rejected.
+ *
+ * Always indicates a security validation failure (state, `iss`, nonce, PKCE,
+ * issuer, audience, signature or expiration), never a transient failure.
+ */
+export class SebaAuthError extends SebaError {
+    constructor(message, options) {
+        super("SEBA_ERR_AUTH", message, options);
+    }
+}
+/**
+ * The stored session can no longer be used (refresh token revoked, expired or rejected).
+ *
+ * The local session state has already been cleared when this is thrown.
+ */
+export class SebaSessionExpiredError extends SebaError {
+    constructor(message, options) {
+        super("SEBA_ERR_SESSION_EXPIRED", message, options);
+    }
+}
+/** A DPoP proof could not be created, or the provider rejected the DPoP key binding. */
+export class SebaDPoPError extends SebaError {
+    constructor(message, options) {
+        super("SEBA_ERR_DPOP", message, options);
+    }
+}
+/** A network request failed (offline, DNS, TLS, connection reset, non-HTTP response). */
+export class SebaNetworkError extends SebaError {
+    constructor(message, options) {
+        super("SEBA_ERR_NETWORK", message, options);
+    }
+}
+/** Interactive login is impossible in the current environment. */
+export class SebaNoUIError extends SebaError {
+    constructor(message, options) {
+        super("SEBA_ERR_NO_UI", message, options);
+    }
+}
+/**
+ * Type guard for {@link SebaError}.
+ *
+ * @param value - Any caught value.
+ */
+export function isSebaError(value) {
+    return value instanceof SebaError;
+}
+function formatList(values) {
+    return values.length === 0 ? "(none)" : values.map((value) => `"${value}"`).join(", ");
+}
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAsBA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,2CAA2C;IAClC,IAAI,CAAgB;IAE7B,YAAY,IAAmB,EAAE,OAAe,EAAE,OAA0B;QAC1E,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,+DAA+D;AAC/D,MAAM,OAAO,eAAgB,SAAQ,SAAS;IAC5C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;CACF;AAED,qEAAqE;AACrE,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,SAAS;IACtD,iDAAiD;IACxC,oBAAoB,CAAS;IACtC,yDAAyD;IAChD,qBAAqB,CAAoB;IAElD,YAAY,oBAA4B,EAAE,qBAAwC,EAAE,OAA0B;QAC5G,KAAK,CACH,4BAA4B,EAC5B,iBAAiB,oBAAoB,gDAAgD;YACnF,4BAA4B,UAAU,CAAC,qBAAqB,CAAC,IAAI;YACjE,yBAAyB,oBAAoB,2CAA2C;YACxF,sDAAsD,EACxD,OAAO,CACR,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,qBAAqB,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAC;IAC1D,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,aAAc,SAAQ,SAAS;IAC1C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,SAAS;IACpD,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,0BAA0B,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;CACF;AAED,wFAAwF;AACxF,MAAM,OAAO,aAAc,SAAQ,SAAS;IAC1C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IAC7C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,kBAAkB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,OAAO,aAAc,SAAQ,SAAS;IAC1C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,gBAAgB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,SAAS,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,MAAyB;IAC3C,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzF,CAAC"}

package/dist/core/http.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Internal HTTP helpers shared by discovery, token and revocation requests.
+ *
+ * This module owns the single implementation of "make a request, turn transport
+ * failures into `SebaNetworkError`, and decode a JSON body safely". It never adds
+ * credentials: callers attach `Authorization`/`DPoP` themselves.
+ */
+import { SebaError } from "./errors.js";
+/** Default timeout for provider and resource requests, in milliseconds. */
+export declare const DEFAULT_TIMEOUT_MS = 10000;
+/** Request options accepted by {@link httpFetch}. */
+export interface HttpOptions {
+    /** `fetch` implementation supplied by the runtime platform. */
+    readonly fetchImpl: typeof fetch;
+    /** Abort the request after this many milliseconds. Defaults to 10 seconds. */
+    readonly timeoutMs?: number;
+    /** Caller cancellation signal, if any. */
+    readonly signal?: AbortSignal | null;
+}
+/** JSON content types accepted from SEBA providers. */
+export declare const JSON_ACCEPT = "application/json";
+/**
+ * Perform a single attempt of an HTTP request.
+ *
+ * Transport failures (offline, DNS, TLS, connection reset, unsupported scheme) become
+ * {@link SebaNetworkError}; HTTP status handling is left to the caller because a 400 is
+ * meaningful to a token endpoint and meaningless to a JWKS fetch.
+ *
+ * @param url - Absolute request URL.
+ * @param init - Standard fetch options; `signal` is replaced with an internal one.
+ * @param options - Runtime fetch implementation and timeout.
+ */
+export declare function httpFetch(url: string | URL, init: RequestInit, options: HttpOptions): Promise<Response>;
+/**
+ * Parse a JSON response body.
+ *
+ * @param text - Raw response body.
+ * @param context - Human-readable description used in the error message.
+ * @param createError - Error constructor for the calling module (`SebaDiscoveryError`,
+ *   `SebaAuthError`, …) so the failure carries the right code.
+ */
+export declare function parseJson<T>(text: string, context: string, createError?: (message: string) => SebaError): T;
+/**
+ * Read a response body as text, mapping a broken stream to a network error.
+ *
+ * @param response - Response whose body should be read.
+ * @param context - Human-readable description used in the error message.
+ */
+export declare function readText(response: Response, context: string): Promise<string>;
+/**
+ * Check whether a response is a successful HTTP status.
+ *
+ * @param response - Response to inspect.
+ */
+export declare function isOk(response: Response): boolean;
+/**
+ * Strip query and fragment from a URL for safe inclusion in error messages and logs.
+ *
+ * @param value - Absolute URL, possibly unparseable.
+ */
+export declare function describeUrl(value: string): string;
+/**
+ * Join `fetch`-style input into a string URL without losing the base for `URL` objects.
+ *
+ * @param input - Request or string/URL input.
+ */
+export declare function inputToString(input: RequestInfo | URL): string;
+//# sourceMappingURL=http.d.ts.map

package/dist/core/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/core/http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAsB,SAAS,EAAoB,MAAM,aAAa,CAAC;AAE9E,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC,qDAAqD;AACrD,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACtC;AAED,uDAAuD;AACvD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuC7G;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,CAAC,EACzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,WAAW,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAwD,GACzF,CAAC,CAMH;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMnF;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,GAAG,MAAM,CAQ9D"}

package/dist/core/http.js

@@ -0,0 +1,128 @@
+/**
+ * Internal HTTP helpers shared by discovery, token and revocation requests.
+ *
+ * This module owns the single implementation of "make a request, turn transport
+ * failures into `SebaNetworkError`, and decode a JSON body safely". It never adds
+ * credentials: callers attach `Authorization`/`DPoP` themselves.
+ */
+import { SebaDiscoveryError, SebaError, SebaNetworkError } from "./errors.js";
+/** Default timeout for provider and resource requests, in milliseconds. */
+export const DEFAULT_TIMEOUT_MS = 10_000;
+/** JSON content types accepted from SEBA providers. */
+export const JSON_ACCEPT = "application/json";
+/**
+ * Perform a single attempt of an HTTP request.
+ *
+ * Transport failures (offline, DNS, TLS, connection reset, unsupported scheme) become
+ * {@link SebaNetworkError}; HTTP status handling is left to the caller because a 400 is
+ * meaningful to a token endpoint and meaningless to a JWKS fetch.
+ *
+ * @param url - Absolute request URL.
+ * @param init - Standard fetch options; `signal` is replaced with an internal one.
+ * @param options - Runtime fetch implementation and timeout.
+ */
+export async function httpFetch(url, init, options) {
+    const target = typeof url === "string" ? url : url.href;
+    const controller = new AbortController();
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    let timedOut = false;
+    const timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, timeoutMs);
+    const external = options.signal ?? null;
+    const onAbort = () => {
+        controller.abort();
+    };
+    if (external !== null) {
+        if (external.aborted) {
+            clearTimeout(timer);
+            throw new SebaNetworkError(`The request to ${describeUrl(target)} was aborted before it started.`, {
+                cause: external.reason,
+            });
+        }
+        external.addEventListener("abort", onAbort, { once: true });
+    }
+    try {
+        return await options.fetchImpl(url, { ...init, signal: controller.signal });
+    }
+    catch (error) {
+        if (external?.aborted === true) {
+            throw new SebaNetworkError(`The request to ${describeUrl(target)} was aborted.`, { cause: error });
+        }
+        const reason = timedOut ? `did not complete within ${String(timeoutMs)} ms` : "could not be completed";
+        throw new SebaNetworkError(`Network request to ${describeUrl(target)} ${reason}. ` +
+            "Check the network connection, the provider URL and (in Node.js) any proxy configuration.", { cause: error });
+    }
+    finally {
+        clearTimeout(timer);
+        external?.removeEventListener("abort", onAbort);
+    }
+}
+/**
+ * Parse a JSON response body.
+ *
+ * @param text - Raw response body.
+ * @param context - Human-readable description used in the error message.
+ * @param createError - Error constructor for the calling module (`SebaDiscoveryError`,
+ *   `SebaAuthError`, …) so the failure carries the right code.
+ */
+export function parseJson(text, context, createError = (message) => new SebaDiscoveryError(message)) {
+    try {
+        return JSON.parse(text);
+    }
+    catch (error) {
+        throw createError(`${context} is not valid JSON. The provider returned a non-JSON response body.`);
+    }
+}
+/**
+ * Read a response body as text, mapping a broken stream to a network error.
+ *
+ * @param response - Response whose body should be read.
+ * @param context - Human-readable description used in the error message.
+ */
+export async function readText(response, context) {
+    try {
+        return await response.text();
+    }
+    catch (error) {
+        throw new SebaNetworkError(`Unable to read the ${context} response body.`, { cause: error });
+    }
+}
+/**
+ * Check whether a response is a successful HTTP status.
+ *
+ * @param response - Response to inspect.
+ */
+export function isOk(response) {
+    return response.status >= 200 && response.status < 300;
+}
+/**
+ * Strip query and fragment from a URL for safe inclusion in error messages and logs.
+ *
+ * @param value - Absolute URL, possibly unparseable.
+ */
+export function describeUrl(value) {
+    try {
+        const url = new URL(value);
+        return `${url.origin}${url.pathname}`;
+    }
+    catch {
+        return "the configured URL";
+    }
+}
+/**
+ * Join `fetch`-style input into a string URL without losing the base for `URL` objects.
+ *
+ * @param input - Request or string/URL input.
+ */
+export function inputToString(input) {
+    if (typeof input === "string") {
+        return input;
+    }
+    if (input instanceof URL) {
+        return input.href;
+    }
+    return input.url;
+}
+//# sourceMappingURL=http.js.map

package/dist/core/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/core/http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE9E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAYzC,uDAAuD;AACvD,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAiB,EAAE,IAAiB,EAAE,OAAoB;IACxF,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,KAAK,GAAkC,UAAU,CAAC,GAAG,EAAE;QAC3D,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,EAAE,SAAS,CAAC,CAAC;IACd,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,WAAW,CAAC,MAAM,CAAC,iCAAiC,EAAE;gBACjG,KAAK,EAAE,QAAQ,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,2BAA2B,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC;QACvG,MAAM,IAAI,gBAAgB,CACxB,sBAAsB,WAAW,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI;YACrD,0FAA0F,EAC5F,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,QAAQ,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,OAAe,EACf,cAA8C,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC;IAE1F,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,GAAG,OAAO,qEAAqE,CAAU,CAAC;IAC9G,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,OAAe;IAChE,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,OAAO,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,QAAkB;IACrC,OAAO,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAwB;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC"}

package/dist/core/identity.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Client identification and WebID-based issuer discovery.
+ *
+ * SEBA uses a static Solid Client ID Document as its `client_id`: the URL of the
+ * document *is* the client identifier. No dynamic client registration is performed and
+ * `registration_endpoint` is never called.
+ *
+ * WebID profiles are read as Turtle (documented subset), JSON-LD or, as a last resort,
+ * an HTML `Link` header. The parsed issuer is then validated as an issuer URL before it
+ * is trusted.
+ */
+import type { ClientIDDocument } from "../types.js";
+/** JSON-LD context every Solid Client ID Document must declare. */
+export declare const SOLID_OIDC_CONTEXT = "https://www.w3.org/ns/solid/oidc-context.jsonld";
+/** Fully expanded predicate of `solid:oidcIssuer`. */
+export declare const OIDC_ISSUER_PREDICATE = "http://www.w3.org/ns/solid/terms#oidcIssuer";
+/** Result of validating a WebID: the normalized WebID and its profile URL. */
+export interface WebIdLocation {
+    /** Normalized WebID (absolute IRI, fragment preserved). */
+    readonly webId: string;
+    /** Profile document URL (the WebID without its fragment). */
+    readonly documentUrl: string;
+}
+/** A `(subject, solid:oidcIssuer, issuer)` statement extracted from a profile. */
+export interface IssuerStatement {
+    readonly subject: string;
+    readonly issuer: string;
+}
+/** An RDF term parsed from Turtle. */
+type Term = {
+    readonly type: "iri";
+    readonly value: string;
+} | {
+    readonly type: "literal";
+    readonly value: string;
+} | {
+    readonly type: "bnode";
+    readonly id: string;
+};
+/** A parsed Turtle triple. */
+export interface Triple {
+    readonly subject: string;
+    readonly predicate: string;
+    readonly object: Term;
+}
+/**
+ * Validate and normalize a WebID.
+ *
+ * @param webId - WebID supplied by the application or the user.
+ * @throws {@link SebaConfigError} when the value is not an absolute https (or loopback
+ *   http) IRI without embedded credentials.
+ */
+export declare function validateWebId(webId: string): WebIdLocation;
+/**
+ * Validate a Client ID Document URL taken from configuration.
+ *
+ * @param clientId - Configured `client_id`.
+ * @throws {@link SebaConfigError} when the value cannot be a Client ID Document URL.
+ */
+export declare function validateClientIdUrl(clientId: string): string;
+/**
+ * Parse and validate a Solid Client ID Document.
+ *
+ * @param raw - Parsed JSON body.
+ * @param documentUrl - URL the document was fetched from; `client_id` must equal it.
+ * @throws {@link SebaDiscoveryError} when the document is not a valid Client ID Document.
+ */
+export declare function parseClientIdDocument(raw: unknown, documentUrl: string): ClientIDDocument;
+/**
+ * Fetch and validate the Client ID Document.
+ *
+ * @param clientId - Configured Client ID Document URL.
+ * @param fetchImpl - Runtime `fetch` implementation.
+ */
+export declare function loadClientIdDocument(clientId: string, fetchImpl: typeof fetch): Promise<ClientIDDocument>;
+/**
+ * Assert that a redirect URI is published verbatim by the Client ID Document.
+ *
+ * Membership is compared as exact strings: no normalization is applied to either side.
+ *
+ * @param document - Validated Client ID Document.
+ * @param redirectUri - Configured redirect URI.
+ * @throws {@link SebaRedirectMismatchError} when the URI is not published.
+ */
+export declare function assertRedirectUriPublished(document: ClientIDDocument, redirectUri: string): void;
+/**
+ * Parse a Turtle document and return its triples.
+ *
+ * Supported subset: `@prefix`/`PREFIX`, `@base`/`BASE`, IRIs (relative IRIs resolve
+ * against the base), prefixed names, `a` as `rdf:type`, subject/predicate/object lists
+ * with `;` and `,`, comments, blank node labels, empty `[]` blank nodes, and literals with
+ * language tags or datatypes. Collections `( … )` and property lists `[ … ]` are rejected
+ * with a descriptive error instead of being mis-parsed.
+ *
+ * @param text - Turtle source.
+ * @param baseUrl - Base IRI for relative references (the document URL).
+ */
+export declare function parseTurtle(text: string, baseUrl: string): Triple[];
+/**
+ * Extract `solid:oidcIssuer` statements from parsed triples.
+ *
+ * @param triples - Parsed triples.
+ */
+export declare function extractIssuerStatements(triples: readonly Triple[]): IssuerStatement[];
+/**
+ * Extract `solid:oidcIssuer` statements from a JSON-LD document.
+ *
+ * Accepts the expanded predicate and the compacted `solid:oidcIssuer` form, string or
+ * `{ "@id": … }` values, and nested `@graph` containers.
+ *
+ * @param raw - Parsed JSON-LD document.
+ * @param documentUrl - Base URL for relative `@id` values.
+ */
+export declare function extractJsonLdIssuers(raw: unknown, documentUrl: string): IssuerStatement[];
+/**
+ * Resolve an IRI against a base while preserving already-absolute IRIs byte for byte.
+ *
+ * `new URL("https://idp.example").href` appends a trailing slash, which would silently
+ * change an issuer identifier. Responding issuer identifiers are compared exactly, so
+ * absolute IRIs are returned unchanged.
+ *
+ * @param value - IRI reference from the document.
+ * @param base - Base IRI for relative references.
+ */
+export declare function resolveAbsoluteIri(value: string, base: string): string | null;
+/**
+ * Parse an HTTP `Link` header and return the targets with the requested relation.
+ *
+ * @param header - Raw `Link` header value, when present.
+ * @param relation - Relation URI to match.
+ */
+export declare function parseLinkHeader(header: string | null, relation: string): string[];
+/**
+ * Resolve the OpenID Provider issuer for a WebID by reading its profile.
+ *
+ * Order: `solid:oidcIssuer` triple for the exact WebID (Turtle or JSON-LD), then a
+ * `rel="http://www.w3.org/ns/solid/terms#oidcIssuer"` `Link` header. Failures are
+ * discovered errors with actionable messages.
+ *
+ * @param webId - WebID supplied by the application or the user.
+ * @param fetchImpl - Runtime `fetch` implementation.
+ */
+export declare function discoverIssuerForWebId(webId: string, fetchImpl: typeof fetch): Promise<string>;
+export {};
+//# sourceMappingURL=identity.d.ts.map

package/dist/core/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,mEAAmE;AACnE,eAAO,MAAM,kBAAkB,oDAAoD,CAAC;AAKpF,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,gDAA6B,CAAC;AAKhE,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sCAAsC;AACtC,KAAK,IAAI,GACL;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,8BAA8B;AAC9B,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAqB1D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAoB5D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,CA+DzF;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgB/G;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAIhG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnE;AAoZD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,EAAE,CAQrF;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,eAAe,EAAE,CA6CzF;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc7E;AAMD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BjF;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CA4DpG"}