@gaballahtech/seba 0.2.1 → 0.5.0

package/dist/types.d.ts

@@ -33,8 +33,10 @@ export interface SebaConfig {
      * Session storage backend. Defaults to `"indexeddb"` in browsers and
      * `"memory"` in Node.js.
      *
-     * `"indexeddb"` persists only the refresh token, the DPoP private key and
-     * non-secret session metadata. Access tokens are never persisted.
+     * `"indexeddb"` persists the refresh token, the DPoP private key and non-secret
+     * session metadata. If the provider issues no refresh token, the access token is
+     * persisted as well (soft-persist) so a reload can resume the session until it
+     * expires; refresh-token sessions never persist an access token.
      */
     storage?: StorageKind;
     /**
@@ -52,6 +54,90 @@ export interface SebaConfig {
      * {@link Seba.login} throws a `SebaNoUIError`.
      */
     openAuthorizationUrl?: (url: string) => void | Promise<void>;
+    /**
+     * Opt-in escape hatch for non-compliant Solid providers (see Security guide).
+     *
+     * Solid-OIDC §8.1 requires `"solid"` in the ID token `aud` claim when the provider
+     * advertises the `webid` scope. Some real-world providers (e.g. `solidcommunity.net`)
+     * issue `aud` as a plain string without `"solid"`. When `true`, Seba accepts such
+     * tokens, but only the `"solid"` audience requirement is relaxed — signature
+     * verification, `iss`, `exp`/`iat`, `nonce`, `cnf.jkt` and the `client_id` audience
+     * check are all still enforced.
+     *
+     * @default false
+     * @example
+     * ```ts
+     * const seba = new Seba({
+     *   clientId: "...",
+     *   redirectUri: "...",
+     *   allowNonCompliantAudience: true, // only for known-broken providers
+     * });
+     * ```
+     */
+    allowNonCompliantAudience?: boolean;
+    /**
+     * Opt-in escape hatch for non-compliant Solid providers (see Security guide).
+     *
+     * Solid-OIDC §8.1 requires the ID token to carry a `cnf` claim with a `jkt` member
+     * binding it to the DPoP key when the provider advertises the `webid` scope. Some
+     * real-world providers (e.g. `solidcommunity.net`) omit `cnf.jkt` from the ID token
+     * while still issuing DPoP-bound access tokens. When `true`, the `cnf.jkt` presence
+     * requirement is relaxed for such ID tokens — everything else stays enforced: DPoP
+     * proofs are still signed and required on every request, an ID token that DOES carry
+     * `cnf.jkt` is still checked against the session key, and signature verification,
+     * `iss`, `exp`/`iat`, `nonce`, `azp` and the `client_id` audience check all remain on.
+     *
+     * @default false
+     */
+    allowNonCompliantCnf?: boolean;
+    /**
+     * Compliance relaxations keyed by provider issuer URL, applied only when the login
+     * targets that exact issuer (compared after normalizing an optional trailing slash).
+     * Entries override the global boolean flags for that provider, and providers NOT
+     * listed keep full strict validation — prefer this over the global flags whenever
+     * the application talks to more than one provider.
+     *
+     * @example
+     * ```ts
+     * tolerances: {
+     *   "https://solidcommunity.net/": { allowNonCompliantAudience: true, allowNonCompliantCnf: true },
+     * }
+     * ```
+     */
+    tolerances?: Record<string, ComplianceTolerances>;
+    /**
+     * How many `use_dpop_nonce` challenges the token endpoint may issue before SEBA
+     * gives up. Each retry signs a brand-new DPoP proof with the fresh nonce. The
+     * resource-fetch path applies the same count. Providers that rotate nonces on
+     * every request benefit from 2–3.
+     *
+     * @defaultValue 1
+     */
+    maxDpopNonceRetries?: number;
+    /**
+     * Storage namespace enabling more than one concurrent session in the same browser
+     * profile (multi-account). Each distinct account value gets its own IndexedDB
+     * database (`seba:<account>`) and sessionStorage transaction key, so two `Seba`
+     * instances with different accounts do not overwrite each other. Node.js sessions
+     * are already per-instance in memory.
+     *
+     * @defaultValue undefined (single unnamed session, as in earlier releases)
+     */
+    account?: string;
+}
+/** Relaxations for a single provider, used by {@link SebaConfig.tolerances}. */
+export interface ComplianceTolerances {
+    /** Relax the `"solid"` ID-token audience requirement for this provider. */
+    allowNonCompliantAudience?: boolean;
+    /** Relax the `cnf.jkt` presence requirement on this provider's ID tokens. */
+    allowNonCompliantCnf?: boolean;
+}
+/** Token-free snapshot of session state, safe to render or log. */
+export interface SessionInfo {
+    webId: string;
+    provider: string;
+    /** Access token expiry (epoch milliseconds), or `null` when unknown. */
+    accessTokenExpiresAt: number | null;
 }
 /** Optional identity hints for {@link Seba.login}. */
 export interface LoginOptions {
@@ -73,11 +159,30 @@ export interface Session {
     /** Identity provider issuer URL that was validated for this session. */
     provider: string;
 }
+/** Why a session changed. */
+export type SessionChangeReason = "login" | "logout" | "restore" | "expired";
+/**
+ * Emitted after every session transition.
+ *
+ * `expired` fires at most once per session, the first time SEBA determines that the
+ * session cannot continue (revoked grant, expired stored token with no refresh token,
+ * or an access token rejected with no way to renew it). It is also emitted with
+ * `session: null`.
+ */
+export interface SessionChangeEvent {
+    /** Transition that just happened. */
+    readonly reason: SessionChangeReason;
+    /** Session after the transition, or `null` after logout/expiry. */
+    readonly session: Session | null;
+}
+/** Listener accepted by `onSessionChange`. */
+export type SessionChangeListener = (event: SessionChangeEvent) => void;
 /**
  * A token response that passed validation.
  *
- * Access tokens are held in memory only — never persisted or exposed by the
- * public API.
+ * Access tokens are never exposed by the public API. They stay in memory, except
+ * when the provider issues no refresh token: then the access token is persisted so
+ * a reload can resume the session until it expires.
  */
 export interface TokenSet {
     /** DPoP-bound access token. In memory only. */
@@ -139,6 +244,26 @@ export interface OIDCConfiguration {
     scopesSupported?: string[];
     /** Grant types advertised by the provider, when present. */
     grantTypesSupported?: string[];
+    /**
+     * Opt-in escape hatch for non-compliant Solid providers (see SECURITY.md).
+     *
+     * When `true`, the `"solid"` requirement in the ID token `aud` claim is relaxed for
+     * providers that violate Solid-OIDC §8.1 (e.g. `solidcommunity.net`). Everything else
+     * stays enforced: signature, `iss`, `exp`/`iat`, `nonce`, `cnf.jkt`, and the
+     * `client_id` audience check. Default `false`.
+     */
+    allowNonCompliantAudience?: boolean;
+    /**
+     * Opt-in escape hatch for non-compliant Solid providers (see SECURITY.md).
+     *
+     * When `true`, the `cnf.jkt` presence requirement on the ID token is relaxed for
+     * providers whose ID tokens carry no DPoP binding while the provider still issues
+     * DPoP-bound access tokens (e.g. `solidcommunity.net`). DPoP proofs remain mandatory
+     * on every request, an ID token that DOES carry `cnf.jkt` is still checked against
+     * the session key, and signature, `iss`, `exp`/`iat`, `nonce` and the `client_id`
+     * audience check all stay enforced. Default `false`.
+     */
+    allowNonCompliantCnf?: boolean;
 }
 /** A validated Solid Client ID Document. */
 export interface ClientIDDocument {
@@ -182,8 +307,17 @@ export interface PersistedSession {
     provider: string;
     /** Client identifier the session was created for. */
     clientId: string;
-    /** Refresh token. Never an access token. */
-    refreshToken: string;
+    /** Refresh token, when the provider issued one. */
+    refreshToken?: string;
+    /**
+     * Access token, stored only when the provider issued no refresh token so that
+     * {@link Seba.restoreSession} can resume the session until it expires.
+     */
+    accessToken?: string;
+    /** Expiry of the stored access token (epoch ms), or `null` when unknown. */
+    accessTokenExpiresAt?: number | null;
+    /** `sub` claim, when known. */
+    subject?: string;
     /** DPoP private key bound to the refresh token. */
     key: PersistedKey;
     /** Granted scopes, when known. */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yCAAyC;AACzC,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,WAAW,CAAC;IAEtB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,UAAU,EAAE,IAAI,CAAC;IACjB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,iDAAiD;IACjD,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,2DAA2D;IAC3D,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,gCAAgC;AAChC,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,0CAA0C;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC;IACzC,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,4CAA4C;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0DAA0D;AAC1D,MAAM,MAAM,YAAY,GACpB;IACE,+EAA+E;IAC/E,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;IACf;;;;;;OAMG;IACH,SAAS,EAAE,UAAU,CAAC;CACvB,GACD;IACE,kFAAkF;IAClF,IAAI,EAAE,KAAK,CAAC;IACZ,GAAG,EAAE,UAAU,CAAC;CACjB,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,GAAG,EAAE,YAAY,CAAC;IAClB,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wDAAwD;AACxD,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,2DAA2D;IAC3D,IAAI,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACzC,wEAAwE;IACxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,8DAA8D;AAC9D,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;IAC7B,yEAAyE;IACzE,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAChD;;;;;OAKG;IACH,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,uEAAuE;IACvE,cAAc,CAAC,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,kEAAkE;IAClE,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,qBAAqB,CAAC;IACxD;;;OAGG;IACH,aAAa,CAAC,IAAI,IAAI,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,2CAA2C;IAC3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yCAAyC;AACzC,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,WAAW,CAAC;IAEtB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;;;;;;;;;;;;;;;;;;OAmBG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAEpC;;;;;;;;;;;;;OAaG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,UAAU,EAAE,IAAI,CAAC;IACjB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,6BAA6B;AAC7B,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAClC;AAED,8CAA8C;AAC9C,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,iDAAiD;IACjD,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,2DAA2D;IAC3D,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,gCAAgC;AAChC,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,0CAA0C;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC;IACzC,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAEpC;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,4CAA4C;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0DAA0D;AAC1D,MAAM,MAAM,YAAY,GACpB;IACE,+EAA+E;IAC/E,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,SAAS,CAAC;IACf;;;;;;OAMG;IACH,SAAS,EAAE,UAAU,CAAC;CACvB,GACD;IACE,kFAAkF;IAClF,IAAI,EAAE,KAAK,CAAC;IACZ,GAAG,EAAE,UAAU,CAAC;CACjB,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,GAAG,EAAE,YAAY,CAAC;IAClB,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wDAAwD;AACxD,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,2DAA2D;IAC3D,IAAI,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACzC,wEAAwE;IACxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,8DAA8D;AAC9D,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;IAC7B,yEAAyE;IACzE,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAChD;;;;;OAKG;IACH,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,uEAAuE;IACvE,cAAc,CAAC,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,kEAAkE;IAClE,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,qBAAqB,CAAC;IACxD;;;OAGG;IACH,aAAa,CAAC,IAAI,IAAI,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,2CAA2C;IAC3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gaballahtech/seba",
-  "version": "0.2.1",
+  "version": "0.5.0",
   "description": "Developer-friendly Solid-OIDC authentication: login, session restoration and DPoP-signed fetch in four methods.",
   "license": "MIT",
   "author": "gaballahtech",
@@ -17,26 +17,41 @@
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "sideEffects": false,
+  "browser": {
+    "./dist/node/index.js": false,
+    "./dist/node/platform.js": false
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
+      "browser": "./dist/browser/index.js",
       "default": "./dist/index.js"
     },
     "./browser": {
       "types": "./dist/browser/index.d.ts",
+      "browser": "./dist/browser/index.js",
       "default": "./dist/browser/index.js"
     },
     "./node": {
       "types": "./dist/node/index.d.ts",
+      "node": "./dist/node/index.js",
       "default": "./dist/node/index.js"
     },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "import": "./dist/react/index.js",
+      "default": "./dist/react/index.js"
+    },
+    "./assets/*": "./assets/*",
     "./package.json": "./package.json"
   },
   "files": [
     "dist",
+    "assets",
     "examples",
     "README.md",
     "CHANGELOG.md",
+    "MIGRATION.md",
     "BUILD_REPORT.md",
     "VALIDATION_REPORT.md",
     "LICENSE",
@@ -70,6 +85,14 @@
     "idb": "^8.0.3",
     "jose": "^6.1.0"
   },
+  "peerDependencies": {
+    "react": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
   "devDependencies": {
     "@types/node": "^24.7.0",
     "@types/react": "^19.3.0",
@@ -81,5 +104,8 @@
     "typescript": "^5.9.3",
     "vite": "^8.3.6",
     "vitest": "^5.1.0"
+  },
+  "bin": {
+    "seba": "./dist/cli.js"
   }
 }