@gaballahtech/seba 0.0.0-stage → 0.2.1

package/dist/browser/provider-modal.js

@@ -0,0 +1,126 @@
+/**
+ * Minimal, dependency-free identity prompt for browsers.
+ *
+ * The dialog asks for a WebID by default and offers an identity-provider URL instead.
+ * It is only a hint: whatever the user enters is validated and discovered by the core.
+ */
+import { SebaAuthError } from "../core/errors.js";
+/**
+ * Ask the user which WebID or identity provider to use.
+ *
+ * @returns Login options collected from the dialog.
+ * @throws {@link SebaAuthError} when the user cancels or the dialog cannot be shown.
+ */
+export function askForIdentity() {
+    return new Promise((resolve, reject) => {
+        if (typeof document === "undefined" || document.body === null) {
+            reject(new SebaAuthError("Cannot ask for a WebID outside a browser document."));
+            return;
+        }
+        const overlay = document.createElement("div");
+        overlay.setAttribute("role", "dialog");
+        overlay.setAttribute("aria-modal", "true");
+        overlay.setAttribute("aria-labelledby", "seba-dialog-title");
+        overlay.style.cssText = [
+            "position:fixed",
+            "inset:0",
+            "z-index:2147483647",
+            "display:flex",
+            "align-items:center",
+            "justify-content:center",
+            "background:rgba(15,23,42,0.55)",
+            "font-family:system-ui,sans-serif",
+            "padding:16px",
+        ].join(";");
+        const card = document.createElement("div");
+        card.style.cssText = [
+            "background:#fff",
+            "color:#0f172a",
+            "border-radius:12px",
+            "box-shadow:0 20px 50px rgba(0,0,0,0.25)",
+            "max-width:440px",
+            "width:100%",
+            "padding:24px",
+            "display:flex",
+            "flex-direction:column",
+            "gap:12px",
+        ].join(";");
+        const title = document.createElement("h2");
+        title.id = "seba-dialog-title";
+        title.textContent = "Sign in to Solid";
+        title.style.cssText = "margin:0;font-size:18px;";
+        const description = document.createElement("p");
+        description.textContent = "Enter your WebID, or the URL of the identity provider that issues your WebID.";
+        description.style.cssText = "margin:0;font-size:14px;line-height:1.5;color:#334155;";
+        const input = document.createElement("input");
+        input.type = "url";
+        input.required = true;
+        input.placeholder = "https://alice.example/profile/card#me";
+        input.setAttribute("aria-label", "WebID or identity provider URL");
+        input.style.cssText = "padding:10px 12px;border:1px solid #cbd5e1;border-radius:8px;font-size:14px;";
+        const error = document.createElement("p");
+        error.setAttribute("role", "alert");
+        error.style.cssText = "margin:0;font-size:13px;color:#b91c1c;display:none;";
+        const buttons = document.createElement("div");
+        buttons.style.cssText = "display:flex;justify-content:flex-end;gap:8px;margin-top:4px;";
+        const cancel = document.createElement("button");
+        cancel.type = "button";
+        cancel.textContent = "Cancel";
+        cancel.style.cssText = "padding:8px 14px;border:1px solid #cbd5e1;background:#fff;border-radius:8px;cursor:pointer;";
+        const submit = document.createElement("button");
+        submit.type = "submit";
+        submit.textContent = "Continue";
+        submit.style.cssText =
+            "padding:8px 14px;border:0;background:#0f172a;color:#fff;border-radius:8px;cursor:pointer;font-weight:600;";
+        const form = document.createElement("form");
+        form.style.cssText = "display:flex;flex-direction:column;gap:12px;";
+        form.append(input, error, buttons);
+        buttons.append(cancel, submit);
+        card.append(title, description, form);
+        overlay.append(card);
+        document.body.append(overlay);
+        input.focus();
+        const close = () => {
+            overlay.remove();
+        };
+        cancel.addEventListener("click", () => {
+            close();
+            reject(new SebaAuthError("The sign-in prompt was cancelled."));
+        });
+        overlay.addEventListener("keydown", (event) => {
+            if (event.key === "Escape") {
+                event.preventDefault();
+                close();
+                reject(new SebaAuthError("The sign-in prompt was cancelled."));
+            }
+        });
+        form.addEventListener("submit", (event) => {
+            event.preventDefault();
+            const value = input.value.trim();
+            if (value === "") {
+                error.textContent = "Enter a WebID or identity provider URL.";
+                error.style.display = "block";
+                return;
+            }
+            let parsed;
+            try {
+                parsed = new URL(value);
+            }
+            catch {
+                error.textContent = "That is not an absolute URL. It must start with https://";
+                error.style.display = "block";
+                return;
+            }
+            if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+                error.textContent = "Only https URLs are accepted (http for localhost).";
+                error.style.display = "block";
+                return;
+            }
+            close();
+            // A WebID usually has a path or fragment; a bare origin is an issuer.
+            const looksLikeIssuer = parsed.pathname === "/" && parsed.search === "" && parsed.hash === "";
+            resolve(looksLikeIssuer ? { issuer: value } : { webId: value });
+        });
+    });
+}
+//# sourceMappingURL=provider-modal.js.map

package/dist/browser/provider-modal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-modal.js","sourceRoot":"","sources":["../../src/browser/provider-modal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGlD;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,aAAa,CAAC,oDAAoD,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,CAAC,YAAY,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG;YACtB,gBAAgB;YAChB,SAAS;YACT,oBAAoB;YACpB,cAAc;YACd,oBAAoB;YACpB,wBAAwB;YACxB,gCAAgC;YAChC,kCAAkC;YAClC,cAAc;SACf,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG;YACnB,iBAAiB;YACjB,eAAe;YACf,oBAAoB;YACpB,yCAAyC;YACzC,iBAAiB;YACjB,YAAY;YACZ,cAAc;YACd,cAAc;YACd,uBAAuB;YACvB,UAAU;SACX,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,KAAK,CAAC,EAAE,GAAG,mBAAmB,CAAC;QAC/B,KAAK,CAAC,WAAW,GAAG,kBAAkB,CAAC;QACvC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,0BAA0B,CAAC;QAEjD,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAChD,WAAW,CAAC,WAAW,GAAG,+EAA+E,CAAC;QAC1G,WAAW,CAAC,KAAK,CAAC,OAAO,GAAG,wDAAwD,CAAC;QAErF,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;QACnB,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtB,KAAK,CAAC,WAAW,GAAG,uCAAuC,CAAC;QAC5D,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,gCAAgC,CAAC,CAAC;QACnE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,8EAA8E,CAAC;QAErG,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC1C,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,qDAAqD,CAAC;QAE5E,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,+DAA+D,CAAC;QAExF,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC;QACvB,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,6FAA6F,CAAC;QAErH,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC;QACvB,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,OAAO;YAClB,2GAA2G,CAAC;QAE9G,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,8CAA8C,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,CAAC,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;YACpC,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,aAAa,CAAC,mCAAmC,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5C,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC3B,KAAK,CAAC,cAAc,EAAE,CAAC;gBACvB,KAAK,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,aAAa,CAAC,mCAAmC,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YACxC,KAAK,CAAC,cAAc,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,KAAK,CAAC,WAAW,GAAG,yCAAyC,CAAC;gBAC9D,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,CAAC,WAAW,GAAG,0DAA0D,CAAC;gBAC/E,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAChE,KAAK,CAAC,WAAW,GAAG,oDAAoD,CAAC;gBACzE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,KAAK,EAAE,CAAC;YACR,sEAAsE;YACtE,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YAC9F,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/browser/storage.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Browser storage: IndexedDB for the session, `sessionStorage` for the short-lived
+ * authorization transaction.
+ *
+ * IndexedDB is used for the session because it can store a non-extractable `CryptoKey`
+ * through structured clone; `sessionStorage` is used for the PKCE verifier so it dies
+ * with the tab and is never shared between tabs.
+ */
+import type { PendingAuthorizationStore, SessionStorageAdapter } from "../types.js";
+/** IndexedDB database name. */
+export declare const DB_NAME = "seba";
+/** Object store holding exactly one session record. */
+export declare const STORE_NAME = "session";
+/** Key of the single session record. */
+export declare const SESSION_KEY = "current";
+/** `sessionStorage` key for the pending authorization transaction. */
+export declare const PENDING_AUTH_KEY = "seba.pending-authorization";
+/** Maximum age of an authorization transaction (10 minutes). */
+export declare const PENDING_AUTH_TTL_MS: number;
+/**
+ * Create the IndexedDB-backed session store.
+ *
+ * Only {@link PersistedSession} is written; access tokens never reach this code.
+ */
+export declare function createIndexedDbStorage(): SessionStorageAdapter;
+/**
+ * Create the `sessionStorage`-backed authorization transaction store.
+ *
+ * Expired transactions are discarded on read instead of being resumed.
+ */
+export declare function createSessionStoragePendingAuthStore(): PendingAuthorizationStore;
+//# sourceMappingURL=storage.d.ts.map

package/dist/browser/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/browser/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAEV,yBAAyB,EAEzB,qBAAqB,EACtB,MAAM,aAAa,CAAC;AAErB,+BAA+B;AAC/B,eAAO,MAAM,OAAO,SAAS,CAAC;AAE9B,uDAAuD;AACvD,eAAO,MAAM,UAAU,YAAY,CAAC;AAEpC,wCAAwC;AACxC,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,gEAAgE;AAChE,eAAO,MAAM,mBAAmB,QAAiB,CAAC;AAwBlD;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,qBAAqB,CAgB9D;AAED;;;;GAIG;AACH,wBAAgB,oCAAoC,IAAI,yBAAyB,CAmChF"}

package/dist/browser/storage.js

@@ -0,0 +1,121 @@
+/**
+ * Browser storage: IndexedDB for the session, `sessionStorage` for the short-lived
+ * authorization transaction.
+ *
+ * IndexedDB is used for the session because it can store a non-extractable `CryptoKey`
+ * through structured clone; `sessionStorage` is used for the PKCE verifier so it dies
+ * with the tab and is never shared between tabs.
+ */
+import { openDB } from "idb";
+import { SebaAuthError, SebaConfigError } from "../core/errors.js";
+/** IndexedDB database name. */
+export const DB_NAME = "seba";
+/** Object store holding exactly one session record. */
+export const STORE_NAME = "session";
+/** Key of the single session record. */
+export const SESSION_KEY = "current";
+/** `sessionStorage` key for the pending authorization transaction. */
+export const PENDING_AUTH_KEY = "seba.pending-authorization";
+/** Maximum age of an authorization transaction (10 minutes). */
+export const PENDING_AUTH_TTL_MS = 10 * 60 * 1000;
+let database = null;
+function open() {
+    if (typeof indexedDB === "undefined") {
+        throw new SebaConfigError("IndexedDB is not available in this environment. Use storage: \"memory\" or run in a browser.");
+    }
+    database ??= openDB(DB_NAME, 1, {
+        upgrade(db) {
+            if (!db.objectStoreNames.contains(STORE_NAME)) {
+                db.createObjectStore(STORE_NAME);
+            }
+        },
+    });
+    return database;
+}
+/**
+ * Create the IndexedDB-backed session store.
+ *
+ * Only {@link PersistedSession} is written; access tokens never reach this code.
+ */
+export function createIndexedDbStorage() {
+    return {
+        async save(session) {
+            const db = await open();
+            await db.put(STORE_NAME, structuredClone(session), SESSION_KEY);
+        },
+        async load() {
+            const db = await open();
+            const value = await db.get(STORE_NAME, SESSION_KEY);
+            return value ?? null;
+        },
+        async clear() {
+            const db = await open();
+            await db.delete(STORE_NAME, SESSION_KEY);
+        },
+    };
+}
+/**
+ * Create the `sessionStorage`-backed authorization transaction store.
+ *
+ * Expired transactions are discarded on read instead of being resumed.
+ */
+export function createSessionStoragePendingAuthStore() {
+    return {
+        async save(pending) {
+            const storage = sessionStorageOrThrow();
+            storage.setItem(PENDING_AUTH_KEY, JSON.stringify(pending));
+        },
+        async load() {
+            const storage = sessionStorageOrThrow();
+            const raw = storage.getItem(PENDING_AUTH_KEY);
+            if (raw === null) {
+                return null;
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                storage.removeItem(PENDING_AUTH_KEY);
+                return null;
+            }
+            if (!isPendingAuthorization(parsed)) {
+                storage.removeItem(PENDING_AUTH_KEY);
+                return null;
+            }
+            if (Date.now() - parsed.createdAt > PENDING_AUTH_TTL_MS) {
+                storage.removeItem(PENDING_AUTH_KEY);
+                throw new SebaAuthError("The pending login expired after 10 minutes. Start the login again from the application.");
+            }
+            return parsed;
+        },
+        async clear() {
+            sessionStorageOrThrow().removeItem(PENDING_AUTH_KEY);
+        },
+    };
+}
+function sessionStorageOrThrow() {
+    try {
+        if (typeof sessionStorage === "undefined") {
+            throw new Error("sessionStorage is undefined");
+        }
+        return sessionStorage;
+    }
+    catch (error) {
+        throw new SebaConfigError("sessionStorage is unavailable, so an interactive login cannot be started safely.", { cause: error });
+    }
+}
+function isPendingAuthorization(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const record = value;
+    return (typeof record["state"] === "string" &&
+        typeof record["codeVerifier"] === "string" &&
+        typeof record["nonce"] === "string" &&
+        typeof record["issuer"] === "string" &&
+        typeof record["clientId"] === "string" &&
+        typeof record["redirectUri"] === "string" &&
+        typeof record["createdAt"] === "number");
+}
+//# sourceMappingURL=storage.js.map

package/dist/browser/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/browser/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAoC,MAAM,KAAK,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAQnE,+BAA+B;AAC/B,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC;AAE9B,uDAAuD;AACvD,MAAM,CAAC,MAAM,UAAU,GAAG,SAAS,CAAC;AAEpC,wCAAwC;AACxC,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AAErC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAMlD,IAAI,QAAQ,GAAyC,IAAI,CAAC;AAE1D,SAAS,IAAI;IACX,IAAI,OAAO,SAAS,KAAK,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,eAAe,CACvB,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,QAAQ,KAAK,MAAM,CAAS,OAAO,EAAE,CAAC,EAAE;QACtC,OAAO,CAAC,EAAE;YACR,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;QAClE,CAAC;QACD,KAAK,CAAC,IAAI;YACR,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACpD,OAAO,KAAK,IAAI,IAAI,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oCAAoC;IAClD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;YACxC,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,CAAC,IAAI;YACR,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC9C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;gBACrC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;gBACrC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,mBAAmB,EAAE,CAAC;gBACxD,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;gBACrC,MAAM,IAAI,aAAa,CACrB,yFAAyF,CAC1F,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,KAAK;YACT,qBAAqB,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACvD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,CAAC;QACH,IAAI,OAAO,cAAc,KAAK,WAAW,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,kFAAkF,EAClF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,CACL,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;QACnC,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,QAAQ;QAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;QACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ;QACtC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ;QACzC,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,QAAQ,CACxC,CAAC;AACJ,CAAC"}

package/dist/core/client.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Runtime-independent implementation of the four public operations.
+ *
+ * The platform object supplies storage, navigation, callback capture and `fetch`; this
+ * class owns the protocol flow and the security decisions that must be identical in
+ * every runtime.
+ */
+import type { LoginOptions, Platform, SebaConfig, Session } from "../types.js";
+/**
+ * The protocol engine behind {@link Seba}.
+ *
+ * Obtained through `Seba`, which resolves the platform first. Not exported from the
+ * package entry point.
+ */
+export declare class SebaClient {
+    #private;
+    constructor(config: SebaConfig, platform: Platform);
+    /** Current session, if any (token-free). */
+    get session(): Session | null;
+    /**
+     * Sign in, or finish a sign-in that the provider redirected back to this application.
+     *
+     * When the current URL carries an authorization response, the stored transaction is
+     * validated and the code is exchanged. Otherwise a new authorization request is
+     * started: the returned promise resolves after the redirect in Node.js and never
+     * settles in the browser (the page navigates away).
+     */
+    login(options?: LoginOptions): Promise<Session>;
+    /**
+     * Restore a previous session from storage.
+     *
+     * @returns The session, or `null` when nothing is stored.
+     * @throws SebaSessionExpiredError when the stored grant was revoked (state cleared).
+     */
+    restoreSession(): Promise<Session | null>;
+    /**
+     * Perform a DPoP-authenticated request.
+     *
+     * A fresh proof is created for every attempt. Same-origin redirects are followed with a
+     * new proof per hop; cross-origin redirects are returned to the caller unchanged, so
+     * credentials are never forwarded to another origin. One retry is allowed for a DPoP
+     * nonce challenge and one for an expired access token; non-replayable bodies are never
+     * resent.
+     */
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    /** Sign out, revoking the refresh token when the provider supports revocation. */
+    logout(): Promise<void>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/core/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/core/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAsBH,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAe,MAAM,aAAa,CAAC;AAyB5F;;;;;GAKG;AACH,qBAAa,UAAU;;gBAMT,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ;IAclD,4CAA4C;IAC5C,IAAI,OAAO,IAAI,OAAO,GAAG,IAAI,CAE5B;IAED;;;;;;;OAOG;IACG,KAAK,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAYzD;;;;;OAKG;IACG,cAAc,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAI/C;;;;;;;;OAQG;IACG,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IA6E5E,kFAAkF;IAC5E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAmK9B"}