@gaballahtech/seba 0.3.0 → 0.5.0

package/ARCHITECTURE.md

@@ -168,8 +168,10 @@ login(options)
 
 The persisted record (`PersistedSession`) is the only durable state:
 `version`, `webId`, `provider`, `clientId`, `refreshToken`, `key`
-(`CryptoKey` + public JWK, or exported JWK), optional `scope`, `createdAt`.
-**No access token field exists in the type**, so it cannot be persisted by accident.
+(`CryptoKey` + public JWK, or exported JWK), optional `scope`, `createdAt`, plus
+`accessToken`/`accessTokenExpiresAt` **only** for providers that issue no refresh token
+(soft-persist, so a reload can resume until the token expires). Refresh-token sessions
+never persist an access token.
 
 Refresh is serialized through a single in-flight promise in `core/session.ts`, so ten
 concurrent `fetch()` calls that all see an expired token perform one refresh, not ten

package/CHANGELOG.md

@@ -1,5 +1,135 @@
 # Changelog
 
+## [0.5.0] — 2026-11-06
+
+Additive release: a drop-in sign-in component, session events, Pod helpers and React
+bindings. No behaviour change to login, refresh, storage or validation.
+
+### Added
+
+- **`<seba-login>`** — a zero-dependency custom element with shadow DOM. It starts the login,
+  completes the callback on the redirect route, exposes `login()`/`logout()`/`session`, and
+  switches between "Sign in" and "Sign out". Attributes: `client-id`, `redirect-uri`,
+  `issuer`, `web-id`, `config` (JSON `SebaConfig` overrides), `label`, `theme`
+  (`auto`/`light`/`dark`), `logo`, `account`. `redirect-uri` is optional (defaults to the
+  current page URL), `issuer-url` is accepted as a SolidOS-style alias, and `providers`
+  renders an issuer picker. The element also emits `login-success` alongside `seba:login`.
+  Register it with `defineSebaLogin()`; importing the package stays side-effect free.
+- **Session events** — `onSessionChange`, `offSessionChange`, `onSessionExpired` and
+  `getSession()` on the facade, plus `SessionChangeEvent`/`SessionChangeReason` types.
+  Reasons: `login`, `restore`, `logout`, `expired`; `expired` fires at most once per session.
+  Listener exceptions are swallowed so application callbacks cannot break session handling.
+- **`Seba.pod`** — `parseSubjectTriples`, `objectify` and `toTurtle`, also exported from the
+  package root zero-dependency helpers for the Turtle subset used by Solid pods.
+- **`seba client-id` CLI** — a zero-dependency generator for the Solid-OIDC Client ID
+  Document. It validates HTTPS/loopback URLs, emits `scope`, `grant_types` and
+  `response_types`, supports repeated `--redirect-uri`, and can write the file with `--out`
+  (or print it to stdout for build scripts).
+- **React bindings** — `@gaballahtech/seba/react` exports `SebaLoginButton` and `useSession`.
+  `react` is an optional peer dependency; the core entry point never imports it. The button
+  accepts `config` and `providers` props, and `redirectUri` is optional.
+- **PNG brand assets** — five 512×512 PNGs in `assets/` (primary, inverse, monochrome, solid,
+  favicon) served through the `./assets/*` export, plus 48×48 PNG data URIs embedded for the
+  component. No SVG is used or shipped. The source PNGs were re-encoded losslessly (pixel
+  comparison unchanged) and now total ~24 kB instead of ~64 kB.
+
+### Notes
+
+- This release has **not yet been tested against a provider** in its component/React form.
+  The underlying login, refresh and DPoP paths are unchanged from 0.4.0.
+
+## [0.4.0] — 2026-11-05
+
+Completeness release driven by the first public full-cycle validation
+(solidcommunity.net login → fetch → Pod write; see the validating app's TEST_REPORT.md).
+
+### Fixed (2026-11-06, same release, second validation round)
+
+- **All resource fetches and token requests now use `cache: "no-cache"`.** Community
+  Solid Server emits no `Cache-Control` on resource GETs, so browsers apply heuristic
+  freshness — a burst of rapid writes reads a heuristically stale pre-PUT ETag and every
+  conditional `PUT` with `If-Match` fails with `412` (reproduced and diagnosed live via
+  instrumented saves: fresh GET → correct `If-Match` → `412`, deterministically, while
+  the server never saw a race). `seba.fetch` no longer trusts local caches.
+- **Sessions are persisted even when the provider issues no refresh token** (soft-persist).
+  The record then contains the access token + DPoP key + expiry, and
+  `restoreSession()` resumes the session until the access token expires. Only refresh-token
+  sessions never store the access token (unchanged principle: refresh token or nothing).
+  Expiry on restore clears the record with an explicit `SebaSessionExpiredError`
+  ("…the provider issued no refresh token…"). This keeps reload working against providers
+  like solidcommunity.net, which advertise `offline_access` yet issue no refresh token
+  (verified from a real token exchange).
+
+### Added
+
+- **Per-issuer compliance tolerances** (`tolerances?: Record<string, ComplianceTolerances>`).
+  Relax `allowNonCompliantAudience` / the new `allowNonCompliantCnf` for one provider
+  only while every other provider stays fully strict. Entries match the issuer exactly
+  or modulo a trailing slash, and override the global boolean flags. Applications that
+  talk to more than one provider should switch from the global flags to this.
+- **`allowNonCompliantCnf`** (`SebaConfig` and `OIDCConfiguration`): escape hatch (same
+  warn-once pattern) for providers whose ID tokens omit `cnf.jkt` while still issuing
+  DPoP-bound access tokens (solidcommunity.net does exactly this). DPoP proofs remain
+  mandatory on every request; a present `cnf.jkt` is still verified against the session
+  key; signature, `iss`, `exp`/`iat`, `nonce`, `azp` and `client_id` audience checks stay on.
+- **`error.stage`** — stable step identifier on every `SebaError` (`token-exchange`,
+  `id-token-signature`, `id-token-audience`, `id-token-cnf-binding`,
+  `authorization-response-*`, `network`, …) so applications/support can pinpoint where a
+  login failed without parsing messages.
+- **`maxDpopNonceRetries`** (default 1, previously hard-coded) for both the token-endpoint
+  and the resource-fetch `use_dpop_nonce` challenge loops; providers rotating nonces on
+  every request benefit from 2–3.
+- **`account`** config option: per-account storage namespace (`seba:<account>` IndexedDB
+  database plus a namespaced sessionStorage transaction key) enabling more than one
+  concurrent session in the same browser profile.
+- **`Seba.getSessionInfo()`** returns a token-free `{ webId, provider, accessTokenExpiresAt }`
+  snapshot so applications can warn before the access token expires.
+- **`Seba.completeLogin()`** completes a pending callback without falling back to starting
+  a login — pairs with `Seba.isCallbackResponse(url?)` for the explicit
+  "login() on click, completeLogin() on the callback route" pattern that avoids the
+  never-settling redirect promise. `login()` itself still handles both roles.
+- **MIGRATION.md** with a `@inrupt/solid-client-authn-browser` mapping.
+
+### Fixed
+
+- **`allowNonCompliantAudience` was dead code.** Declared on `SebaConfig` and read from the
+  provider configuration during token validation, but never copied between the two: it is
+  now carried through `resolveConfig` and stamped onto every discovered configuration at all
+  three paths (login start, login completion, `SessionManager.discover`) via
+  `applyComplianceTolerances`.
+- **`SebaNetworkError` message** now names CORS as the first browser-side suspect, instead of
+  only mentioning Node.js proxies.
+- **logout without a provider revocation endpoint** now logs that the refresh token remains
+  valid server-side until expiry, instead of silently returning.
+
+## [0.3.1] — 2026-11-05
+
+Fixes found during the first real-world login attempt against `solidcommunity.net`
+(manual browser flow, tunnel-published Client ID Document;see the app's TEST_REPORT.md).
+
+### Fixed
+
+- **`allowNonCompliantAudience` was dead code.** The flag was declared on `SebaConfig`
+  (types.d.ts:75) and documented as the opt-in for providers such as `solidcommunity.net`,
+  and `checkIdTokenAudience` read it from the provider configuration object — but nothing
+  ever copied it from the user's `Seba` config into that object. `resolveConfig` dropped
+  the unknown key, and `discoverProvider` builds the configuration purely from the
+  discovery document, so setting the flag had zero effect and the 0.2.1 hard-throw still
+  fired. It is now carried through `resolveConfig` (`ResolvedConfig`) and stamped onto
+  every discovered provider configuration at all three paths — login start (`#beginLogin`),
+  login completion (`#completeLogin`) and the `SessionManager` `discover` callback that
+  backs restore/refresh — via a new `applyComplianceTolerances` helper.
+
+### Added
+
+- **`allowNonCompliantCnf`** (`SebaConfig` and `OIDCConfiguration`), the same escape-hatch
+  pattern as `allowNonCompliantAudience`, for providers whose ID tokens omit `cnf.jkt`
+  while still issuing DPoP-bound access tokens (solidcommunity.net does exactly this:
+  its ID token has no `cnf` claim). DPoP proofs remain mandatory on every request, an
+  ID token that DOES carry `cnf.jkt` is still checked against the session key, and
+  signature, `iss`, `exp`/`iat`, `nonce`, `azp` and the `client_id` audience checks all
+  stay enforced. Warns once via `console.warn` when it suppresses the requirement.
+
 ## [0.2.1] — 2026-11-05
 
 Documentation-only patch. No runtime behaviour changed; the only functional difference is

package/MIGRATION.md

@@ -0,0 +1,60 @@
+# Migrating to SEBA from `@inrupt/solid-client-authn-browser`
+
+This guide maps the common operations of `@inrupt/solid-client-authn-browser` (v3) to
+`@gaballahtech/seba`. It is written from a real migration (a Google-Tasks-style todo app
+validated against solidcommunity.net).
+
+| Inrupt | SEBA | Notes |
+|---|---|---|
+| `handleIncomingRedirect()` on page load | `await seba.login()` **or** the explicit pair `seba.isCallbackResponse() && await seba.completeLogin()` | Both work. `login()` on a callback URL completes it; elsewhere it *navigates away* (document never unloads the promise). Use the explicit pair when that pattern is confusing. |
+| `login({ oidcIssuer, redirectUrl, clientName })` | `seba.login({ issuer })` (redirect URL + client id come from one `new Seba({...})`) | |
+| `fetchDefaultSession()` / `fetch(session)` | `seba.fetch(url, init)` | Always DPoP-signed with a fresh proof; cross-origin redirects are returned, never followed with credentials. |
+| `getDefaultSession().info.webId` | `(await seba.getSessionInfo())?.webId` | SessionInfo is token-free and also carries `accessTokenExpiresAt`. |
+| `getDefaultSession().info.isLoggedIn` | `(await seba.getSessionInfo()) !== null` | |
+| `logout()` | `await seba.logout()` | SEBA also revokes the refresh token when the provider advertises revocation. |
+| dynamic client registration | **none by design** — publish a Client ID Document; its URL is the `client_id` | See the README section "Publish a Client ID Document". Host a JSON-LD file at a stable HTTPS URL; no registration call is ever made. |
+| `session.events.sessionRestore` / expiry events | poll `getSessionInfo()` → `accessTokenExpiresAt` | SEBA refreshes automatically; tell users *before* the access token lapses. |
+
+## Conceptual differences worth knowing
+
+1. **Tokens are not exposed.** Inrupt hands you the access token; SEBA never does. Access
+   tokens live in memory only, and the refresh token + DPoP key are the only persisted
+   secrets. If you think you need the raw token, re-check the design: `seba.fetch` covers it.
+2. **A brand-new DPoP proof per attempt.** No proof cache, no sharing; replays are structurally
+   impossible. Cross-origin redirects are returned to you instead of followed with credentials.
+3. **Provider conformance gaps are opt-in per provider.** Real-world providers (solidcommunity.net,
+   any recent CSS) violate Solid-OIDC §8.1 (`aud` without `"solid"`, missing `cnf.jkt`). Pass
+   `tolerances` for exactly those issuers — everything else stays fully strict:
+
+   ```ts
+   const seba = new Seba({
+     clientId: location.origin + "/client-id.jsonld",
+     redirectUri: location.origin + "/callback",
+     tolerances: {
+       "https://solidcommunity.net/": { allowNonCompliantAudience: true, allowNonCompliantCnf: true },
+     },
+   });
+   ```
+
+4. **Errors carry `code` and `stage`.** Branch on `error.code`
+   (`SEBA_ERR_SESSION_EXPIRED` → re-login; `SEBA_ERR_NETWORK` → transport/CORS) and
+   `error.stage` (`token-exchange`, `id-token-*`, `authorization-response-*`) for triage.
+
+## Minimal app skeleton
+
+```ts
+import { Seba } from "@gaballahtech/seba";
+
+const seba = new Seba({
+  clientId: window.location.origin + "/client-id.jsonld",
+  redirectUri: window.location.origin + "/callback",
+});
+
+// On mount:
+const info = await seba.getSessionInfo();
+if (seba.isCallbackResponse()) {
+  await seba.completeLogin();
+} else if (info === null) {
+  // render a login button; call `seba.login()` inside onClick (it navigates away)
+}
+```

package/README.md

@@ -18,6 +18,8 @@ the same in both.
 ## Requirements
 
 - Node.js 20 or newer, or any browser with Web Crypto (ES256), `fetch` and IndexedDB.
+  Chrome/Edge and Firefox are the tested browsers; Safari 17 or newer is expected to work
+  (older Safari versions fall back to an extractable-JWK DPoP key — see `SECURITY.md`).
 - A publicly dereferenceable **Solid Client ID Document** served over HTTPS.
 
 ## Install
@@ -31,6 +33,23 @@ npm install @gaballahtech/seba
 Host a JSON-LD document and use its URL as `clientId`. The `client_id` member must equal the
 document URL, and every callback you use must be listed verbatim.
 
+The package ships a zero-dependency generator, so the document does not have to be written by
+hand:
+
+```bash
+npx @gaballahtech/seba client-id \
+  --client-id https://app.example/client-id.jsonld \
+  --redirect-uri https://app.example/auth/callback \
+  --client-name "My Solid App" \
+  --out public/client-id.jsonld
+```
+
+It validates the URLs (HTTPS, or loopback HTTP for local development), writes spec-shaped
+metadata (`scope`, `grant_types`, `response_types`), and reminds you to serve the file as
+`application/ld+json` at the `client_id` URL. Repeat `--redirect-uri` for additional
+callbacks; run `npx @gaballahtech/seba client-id --help` for all options. Printing to stdout
+(without `--out`) keeps it usable in CI or a build script.
+
 ```json
 {
   "@context": ["https://www.w3.org/ns/solid/oidc-context.jsonld"],
@@ -80,9 +99,76 @@ const session = (await seba.restoreSession()) ?? (await seba.login());
 `login()` with no arguments opens a small built-in dialog asking for a WebID or an identity
 provider URL. Pass `{ webId }` or `{ issuer }` to skip it.
 
-### React
+### Sign-in button
+
+`<seba-login>` is a dependency-free custom element. Importing the package has no side
+effects; register the element once with `defineSebaLogin()`.
+
+```html
+<script type="module">
+  import { defineSebaLogin } from "@gaballahtech/seba";
+
+  defineSebaLogin();
+</script>
+
+<seba-login
+  client-id="https://app.example/client-id.jsonld"
+  redirect-uri="https://app.example/auth/callback"
+  issuer="https://idp.example"
+  theme="auto"
+  label="Sign in with Solid"
+></seba-login>
+
+<script type="module">
+  const button = document.querySelector("seba-login");
+  button.addEventListener("seba:login", (event) => {
+    console.log("signed in as", event.detail.session.webId);
+  });
+  button.addEventListener("seba:error", (event) => {
+    console.error(event.detail.error);
+  });
+</script>
+```
+
+The element starts the login on click, completes the callback when it is loaded on the
+redirect route, restores the stored session on a normal page load, and switches to "Sign
+out" once a session exists. Attributes: `client-id` is the only required one; `redirect-uri`
+defaults to the current page URL (fragment removed). Also available: `issuer` (or the
+SolidOS-style alias `issuer-url`), `providers` (space/comma separated issuer URLs rendered as
+a picker when there are two or more), `web-id`, `config` (JSON `SebaConfig` overrides such as
+per-provider `tolerances`), `label`, `theme` (`auto` | `light` | `dark`), `logo`, and
+`account`. The element also emits `login-success` as an alias of `seba:login` for apps
+written against `solid-ui`.
+
+React (`react` is an optional peer dependency):
+
+```tsx
+import { SebaLoginButton, useSession } from "@gaballahtech/seba/react";
+import type { Seba } from "@gaballahtech/seba";
+
+export function App({ seba }: { seba: Seba }) {
+  const session = useSession(seba); // null while signed out
+
+  return (
+    <>
+      <SebaLoginButton
+        clientId="https://app.example/client-id.jsonld"
+        redirectUri="https://app.example/auth/callback"
+        issuer="https://idp.example"
+        onLogin={(session) => console.log(session.webId)}
+      />
+      <p>{session ? session.webId : "Signed out"}</p>
+    </>
+  );
+}
+```
+
+The component registers `<seba-login>` on mount. `useSession` follows the session of an
+existing `Seba` instance (the one you use for `fetch`), while the button owns its own.
+`SebaLoginButton` also accepts `providers` (issuer URLs), `config` (JSON-serialized
+`SebaConfig` overrides) and an optional `redirectUri`.
 
-See [`examples/react/App.tsx`](examples/react/App.tsx).
+See also [`examples/react/App.tsx`](examples/react/App.tsx).
 
 ## Node.js
 
@@ -169,6 +255,10 @@ logout(): Promise<void>
 Clears memory and storage first, then revokes the refresh token if the provider advertises a
 revocation endpoint. Revocation failures never block logout.
 
+> ⚠️ When the provider advertises no `revocation_endpoint` (e.g. solidweb.org), logout only
+> clears the local state — the refresh token remains valid on the server until it expires.
+> Revoke it out-of-band or let it lapse.
+
 ### `Session`
 
 ```ts
@@ -181,6 +271,76 @@ interface Session {
 
 No tokens, no keys, no expiry bookkeeping.
 
+### `onSessionChange(listener)` / `onSessionExpired(listener)`
+
+```ts
+onSessionChange(listener: (event: SessionChangeEvent) => void): () => void
+onSessionExpired(listener: (event: SessionChangeEvent) => void): () => void
+offSessionChange(listener: (event: SessionChangeEvent) => void): void
+getSession(): Promise<Session | null>
+```
+
+Subscribe before calling `login()`/`restoreSession()` so no transition is missed. Both
+subscribe methods return an unsubscribe function. Listener exceptions are swallowed and
+never interrupt the session flow.
+
+| Surface | Event | `detail` | Emitted when |
+|---|---|---|---|
+| Facade | `reason: "login"` | `{ reason, session }` | An interactive login finished and the session was stored. |
+| Facade | `reason: "restore"` | `{ reason, session }` | `restoreSession()` resumed a stored session. |
+| Facade | `reason: "logout"` | `{ reason, session: null }` | `logout()` cleared the local session. |
+| Facade | `reason: "expired"` | `{ reason, session: null }` | The session cannot continue; at most once per session. |
+| Element | `seba:login` | `{ session }` | Same as the `login` reason. |
+| Element | `seba:restore` | `{ session }` | Same as the `restore` reason. |
+| Element | `seba:logout` | `{ session: null }` | Same as the `logout` reason. |
+| Element | `seba:session-expired` | `{ session: null }` | Same as the `expired` reason. |
+| Element | `login-success` | `{ session }` | Compatibility alias of `seba:login` (SolidOS naming). |
+| Element | `seba:error` | `{ error }` | A login, logout or configuration error in the component. |
+
+```ts
+const unsubscribe = seba.onSessionExpired(() => {
+  showSignInDialog();
+});
+```
+
+### `Seba.pod`
+
+Zero-dependency helpers for the Turtle subset used by Solid pods: `parseSubjectTriples`,
+`objectify` and `toTurtle` are also exported from the package root. They handle absolute
+IRIs, blank nodes, string/number/boolean literals, `@lang` and `^^<datatype>` suffixes, and
+ignore `@prefix`/`PREFIX`/`BASE` directives (prefix expansion is not performed).
+
+## Brand & logo usage
+
+All artwork is PNG. The five 512×512 files in [`assets/`](assets) are shipped through the
+`./assets/*` export and are also embedded as 48×48 PNG data URIs, so the sign-in button paints
+without a network request. No SVG is generated, fetched or required.
+
+| Variant | File | Use |
+|---|---|---|
+| `primary` | `assets/seba-logo-primary.png` | Accent-coloured logo on light backgrounds. |
+| `inverse` | `assets/seba-logo-inverse.png` | White logo on dark backgrounds. |
+| `monochrome` | `assets/seba-logo-monochrome.png` | Single-colour contexts, print, embossing. |
+| `solid` | `assets/seba-icon-solid.png` | Filled app icon. |
+| `favicon` | `assets/seba-icon-favicon.png` | Browser favicon and small avatars. |
+
+```html
+<link rel="icon" href="/node_modules/@gaballahtech/seba/assets/seba-icon-favicon.png" />
+<seba-login ... logo="inverse"></seba-login>
+<seba-login ... logo="none"></seba-login>
+```
+
+```ts
+import { sebaLogo, sebaLogoImage } from "@gaballahtech/seba";
+
+sebaLogo.primary.png;      // "assets/seba-logo-primary.png"
+sebaLogoImage("favicon");  // "data:image/png;base64,..."
+```
+
+Keep clear space of at least half the mark's height around the logo, do not recolour or
+distort it, and do not place the accent mark on a low-contrast accent background — use the
+`inverse` or `monochrome` treatment instead.
+
 ## Errors
 
 All errors extend `SebaError` and carry a stable `code`:
@@ -204,8 +364,9 @@ All errors extend `SebaError` and carry a stable `code`:
 - ID token signatures are verified against the discovered JWKS; `aud` must contain the
   client ID and `"solid"` when the provider advertises `webid`; `cnf.jkt` must match the
   session key (and is required for `webid`).
-- The refresh token and DPoP key are the only persisted secrets; access tokens are held in
-  a private field.
+- The refresh token and DPoP key are persisted. When a provider issues **no** refresh token,
+  the access token is stored too (soft-persist) so a reload can resume the session until it
+  expires; refresh-token sessions never store an access token.
 - Non-extractable `CryptoKey` storage is used when the engine supports structured cloning;
   otherwise an exported JWK fallback is used (documented in `SECURITY.md`).
 - Refresh-token rotation is atomic, and concurrent refreshes are collapsed into one.
@@ -222,14 +383,19 @@ restore → logout cycle was executed against that provider. If it was not, it s
 |---|---|---|---|
 | Hand-written fake provider (`tests/integration`) | Solid-OIDC-shaped: array `aud` with `"solid"`, `azp`, `cnf.jkt` | Full cycle in CI (`npm test`) | — |
 | Community Solid Server 7.3.0 | **Not conformant** with Solid-OIDC §8.1: ID token has a string `aud` without `"solid"`, no `cnf` | Discovery, Client ID Document, PKCE/state/nonce, consent, callback, DPoP token exchange all pass; login rejected at ID token validation | No |
-| solidcommunity.net | Discovery and issuer handling verified; issuer is `https://solidcommunity.net/` | Discovery only | **No** — no account was available |
+| solidcommunity.net (CSS-based) | **Not conformant** with Solid-OIDC §8.1: ID token `aud` lacks `"solid"`, no `cnf.jkt` (same issue family as CSS #2295). Also: advertises `offline_access` but the token response carries **no refresh token** (verified 2026-11-06; requested scope was `openid webid offline_access`) | Partial cycle with a real account (2026-11-05): login + consent + DPoP **Pod write/read** verified — the written file `seba-todos.ttl` was independently fetched and matched the app's input verbatim. Uses per-issuer `tolerances` for the two conformance gaps. Reload works inside the access-token lifetime via soft-persisted sessions | **No** — partial cycle only |
 | solidweb.org | Discovery verified; issuer is `https://solidweb.org` (no trailing slash); no revocation endpoint advertised | Discovery only | **No** — no account was available |
 | solidweb.me | Discovery verified; issuer is `https://solidweb.me/` | Discovery only | **No** — no account was available |
 
 > **⚠️ Community Solid Server 7.3.0**: CSS issues `id_token.aud` as a string instead of `["solid", client_id]` and omits `cnf.jkt`, violating Solid-OIDC §8.1. Seba correctly rejects this token. Track the upstream issue at https://github.com/CommunitySolidServer/CommunitySolidServer/issues/2295. Do not weaken Seba's validation to work around this.
-
-No public provider has completed the full cycle in this release. See
-[`VALIDATION_REPORT.md`](VALIDATION_REPORT.md) for transcripts and blockers, and
+>
+> **solidcommunity.net** runs a CSS build from the same conformance family. Login completes only with the two documented opt-ins for that provider (`tolerances: { "https://solidcommunity.net/": { allowNonCompliantAudience: true, allowNonCompliantCnf: true } }`); everything else — signature, `client_id` audience, `iss`, PKCE, DPoP proofs on every request — is fully enforced.
+
+Full-cycle validation against a **real public provider** (solidcommunity.net, 2026-11-05:
+login → consent → callback → token exchange → ID-token checks → DPoP fetch → Turtle write/read on
+the Pod) is documented in the validating application's TEST_REPORT.md. Remaining unvalidated steps on
+public providers: `restoreSession()` across a reload and `logout()` revocation. See
+[`VALIDATION_REPORT.md`](VALIDATION_REPORT.md) for the earlier transcripts and blockers, and
 [`CHANGELOG.md`](CHANGELOG.md) for what changed.
 
 SEBA does not support dynamic client registration. The Client ID Document URL is the

package/SECURITY.md

@@ -7,7 +7,7 @@
 | Authorization code interception / mix-up | Access + refresh tokens | PKCE S256, random `state`, RFC 9207 `iss` checked against the issuer the request was built for. |
 | ID token forgery or substitution | User identity (`WebID`) | Signature verified with the provider's JWKS; `iss`, `aud`, `azp`, `exp`, `iat`, `nonce` validated; algorithm taken from the key metadata, not the token's preference. |
 | DPoP proof replay | Pod access | A new proof (new `jti`, new signature) for every attempt; no proof cache, no TTL, no reuse option. |
-| Token theft from the browser profile | Refresh token, DPoP key | Only the refresh token and key are persisted (IndexedDB); access token stays in memory; no `localStorage`; no cookies set by the library. |
+| Token theft from the browser profile | Refresh token, DPoP key, soft-persisted access token | The refresh token and key are persisted (IndexedDB). When a provider issues no refresh token, the access token is persisted too so a reload can resume the session until it expires; refresh-token sessions never store an access token. No `localStorage`; no cookies set by the library. |
 | XSS on the application origin | Everything the origin can reach | Out of scope to *prevent*; the library minimises the window (no tokens in DOM, no globals, no logging) and documents the residual risk. |
 | Credential leak via redirects | Access token, DPoP proof | `redirect: "manual"`; cross-origin redirect responses are returned to the caller, never re-issued with credentials. |
 | Duplicate side effects from retries | Application state | Automatic replay is limited to replayable requests (`GET`/`HEAD`/`OPTIONS`, or a re-readable body), at most one nonce retry and one refresh retry. |

package/dist/assets/icons.d.ts

@@ -0,0 +1,32 @@
+/**
+ * SEBA brand assets (PNG only).
+ *
+ * The 512x512 PNGs in `assets/` are shipped with the package through the `./assets/*`
+ * export. A 48x48 PNG rendering of each treatment is inlined as a data URI so the
+ * sign-in button paints without a network request and the core keeps zero runtime
+ * dependencies.
+ */
+/** Supported logo treatments. */
+export type SebaLogoVariant = "primary" | "inverse" | "monochrome" | "solid" | "favicon";
+/** One brand asset. */
+export interface SebaLogoAsset {
+    /** Treatment name. */
+    readonly variant: SebaLogoVariant;
+    /** Human readable description. */
+    readonly label: string;
+    /** Packaged 512x512 PNG file, relative to the package root. */
+    readonly png: string;
+    /** Inline `data:image/png;base64,...` rendering for runtime use. */
+    readonly dataUri: string;
+    /** Intrinsic width of the inlined PNG. */
+    readonly width: 48;
+    /** Intrinsic height of the inlined PNG. */
+    readonly height: 48;
+}
+/** Manifest of every brand asset. */
+export declare const sebaLogo: Readonly<Record<SebaLogoVariant, SebaLogoAsset>>;
+/** Inline PNG data URI for a logo treatment, ready for an `<img src>`. */
+export declare function sebaLogoImage(variant?: SebaLogoVariant): string;
+/** Whether a string names a known logo treatment. */
+export declare function isSebaLogoVariant(value: string): value is SebaLogoVariant;
+//# sourceMappingURL=icons.d.ts.map

package/dist/assets/icons.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"icons.d.ts","sourceRoot":"","sources":["../../src/assets/icons.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,iCAAiC;AACjC,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAEzF,uBAAuB;AACvB,MAAM,WAAW,aAAa;IAC5B,sBAAsB;IACtB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IACnB,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;CACrB;AAkBD,qCAAqC;AACrC,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,CAAU,CAAC;AAEjF,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,OAAO,GAAE,eAA2B,GAAG,MAAM,CAE1E;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,eAAe,CAEzE"}

package/dist/assets/icons.js

@@ -0,0 +1,30 @@
+/**
+ * SEBA brand assets (PNG only).
+ *
+ * The 512x512 PNGs in `assets/` are shipped with the package through the `./assets/*`
+ * export. A 48x48 PNG rendering of each treatment is inlined as a data URI so the
+ * sign-in button paints without a network request and the core keeps zero runtime
+ * dependencies.
+ */
+import { SEBA_PNG_DATA } from "./png-data.js";
+function asset(variant, label, png) {
+    return { variant, label, png, dataUri: SEBA_PNG_DATA[variant], width: 48, height: 48 };
+}
+const ASSETS = {
+    primary: asset("primary", "SEBA logo", "assets/seba-logo-primary.png"),
+    inverse: asset("inverse", "SEBA logo (inverse)", "assets/seba-logo-inverse.png"),
+    monochrome: asset("monochrome", "SEBA logo (monochrome)", "assets/seba-logo-monochrome.png"),
+    solid: asset("solid", "SEBA icon", "assets/seba-icon-solid.png"),
+    favicon: asset("favicon", "SEBA favicon", "assets/seba-icon-favicon.png"),
+};
+/** Manifest of every brand asset. */
+export const sebaLogo = ASSETS;
+/** Inline PNG data URI for a logo treatment, ready for an `<img src>`. */
+export function sebaLogoImage(variant = "primary") {
+    return ASSETS[variant].dataUri;
+}
+/** Whether a string names a known logo treatment. */
+export function isSebaLogoVariant(value) {
+    return Object.prototype.hasOwnProperty.call(ASSETS, value);
+}
+//# sourceMappingURL=icons.js.map

package/dist/assets/icons.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"icons.js","sourceRoot":"","sources":["../../src/assets/icons.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAqB9C,SAAS,KAAK,CACZ,OAAwB,EACxB,KAAa,EACb,GAAW;IAEX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,MAAM,GAA2C;IACrD,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,8BAA8B,CAAC;IACtE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,qBAAqB,EAAE,8BAA8B,CAAC;IAChF,UAAU,EAAE,KAAK,CAAC,YAAY,EAAE,wBAAwB,EAAE,iCAAiC,CAAC;IAC5F,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,4BAA4B,CAAC;IAChE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,cAAc,EAAE,8BAA8B,CAAC;CAC1E,CAAC;AAEF,qCAAqC;AACrC,MAAM,CAAC,MAAM,QAAQ,GAAqD,MAAM,CAAC;AAEjF,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,UAA2B,SAAS;IAChE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;AACjC,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC"}

package/dist/assets/png-data.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Generated 48x48 PNG renderings of the brand artwork, inlined as data URIs.
+ *
+ * Generated from the 512x512 files in `assets/` (lossless downscale, same PNG format)
+ */
+import type { SebaLogoVariant } from "./icons.js";
+export declare const SEBA_PNG_DATA: Readonly<Record<SebaLogoVariant, string>>;
+//# sourceMappingURL=png-data.d.ts.map

package/dist/assets/png-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"png-data.d.ts","sourceRoot":"","sources":["../../src/assets/png-data.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAMnE,CAAC"}

package/dist/assets/png-data.js

@@ -0,0 +1,13 @@
+/**
+ * Generated 48x48 PNG renderings of the brand artwork, inlined as data URIs.
+ *
+ * Generated from the 512x512 files in `assets/` (lossless downscale, same PNG format)
+ */
+export const SEBA_PNG_DATA = {
+    primary: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAABQVBMVEUAAAB8Tf99T/98Tv97TP98TP99Tv+AUP97S/9+T/99Tf9+Tv98T/97Tf98Tf98Tf98Tf98Tf98Tv98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf99Tv98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf99Tv9+Tv98Tf98Tf98Tf98Tf98Tf98Tf98Tf99Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tv98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf99T/98Tv98Tf/B0+kdAAAAanRSTlMAAAAAAAAAAAAAAAAAABsOZNIERrn7LZvxGXvh5oYLXMz0ozMCP7H5/cBOBieT7dhsEhVz3OqMIwhUxf73qzoBAQM4qfbHVgkDTOnddRZvavCVKLCvaaEDFxwe35ZoD02i+L0HiqVEBAECSK4URgAAAn5JREFUSMetVuda4lAQzSESNVixd8ESS+wdVLB3RMECCFmpet7/Afa7UXbDkqDs5/xL7pzM3DMzZyJJP2JwAS58210G0NYGQP62e3tHZ2dH+/cgkOHt6u4he7q7vJC/yktugLu3r5+m9ff1utFQK4gCYGBwiOTwyMgwyaHBAQCKg3sjgNGxcZI+/0RT04TfR3J8bBRAo0Pyk1PTGjkzOzcPAPNzszOkNj01CQW22egLiySXllcANDcDWFleIrm4oFfxJdxX19ZJbmxuiVNVVVXB79bmBsn1tdXKqwDY3gkEyd29/ZAZ3xMOeyQJCkL7e7tkMLCzDfzNCweHR8dk8OT0DIAqIuq6+KIK4Oz0JEgeHx2eWwAXlySvrm/KuboRicBdrvvN9RXJywsL4JaM3t3DNNF08MbiXnw0obD7uyh5awE8kI9Pog/wnBBRkEylkhBfTzxDEP70SD5UAl7M8iDhT2cAGJpmAMikfyVglvTFDiBJUgvSr1kjhzyZR87IvqbhMml0AsjIZOkrFANkoFjwMZsxWXAGSIDhI6MaqUVJn1F+6wiQkSvwjxVyHzQ7AZRWwWExWvaPFsVzq+IEUIBS0sgHtDJAC+SNZMk8sAOoIT0ST2msMC0Vj+gh1R4Q1iOxakAsoofVn0kJkuy2u7RbrkWr8i+tivSzhau7NVx1NZ9de/sd27vWAClVA2Qd0RZZklCKxUuQJLnFYUQtIuCqFAGXvQhUyIxHkKXrgh6PVWYOLACLkL1VCtmbrZBVSaUipFJxlspPwbKKsUepKcafcv9uL/fvDpur3oVS/8oy86peil/tUQCl8totVVDpZPUu9vp/Hcy8FNhtzv+y36MAAZmg32CuAAAAAElFTkSuQmCC",
+    inverse: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAABRFBMVEULCw8JCQ0KCg4ICAwlJSkYGBxra23U1NQPDxNOTlG8vL37+/v///82Njmfn6Hy8vIjIyeBgYPj4+Pn5+eLi40jIyYVFRljY2XOzs/19fWnp6k8PD8NDRFHR0u1tbb5+fn9/f3Dw8RVVVgRERVWVli0tLZHR0owMDSXl5nu7u/a2tpzc3UcHCDu7u4fHyJ5eXve3t7r6+yRkZMsLDAICA0TExdbW17IyMn+/v739/evr7BCQkUMDBAODhJBQUStra/JycpdXWAwMDOtra5UVFfq6urf3997e30gICMHBwt1dXhUVFZxcXPx8fGZmZsyMjUJCQ6zs7Rvb3KlpachISUoKCvg4OEmJimampynp6hubnEaGh76+vqmpqibm5z4+PjAwMFVVVcGBgqPj5GPj5BubnCpqapMTE/IyMipqasxMTV2dnikVltMAAACNklEQVRIx61W6T/jUBR9SxEcjGUQOkJiMPal1JIaaizpCIoWbYcu2jL+/+/zS9J12qRJf+7Hl3vuPffl3nMfIZ9klHpyZ9zn48y9P+/o7Orq7OBu3YXunl6gt6dbcAOhrK9/AKYN9PexVqUw/mVwCMDwyMgwgKHBr86l8NGxcQDixCRjkxMigPGxUXte1P9tSgKmZ2SFE8KV2ZlpQPo+52/Oi9H5hR8AFpeWLRqMLy8tAlhZmKeNvBhfXVsHsLG5FWDVGFubGwDW11b/L4Vv7wR3gb39A9XKr6oWS/Vgfw/YDe5s15USOvxpHB8dl49pOEzLoY6PjFAnh6Ga+L9OAZydX1QSa5GIViF7cX4G4PR3NYd2CehX1/SGEGZBhGhUsNwZITf0+koHLrUq4Ba4CwWM7/dm09FYPB6jRvSHeyNCIHQH3NYDHk3OzPeUSHKmyamUrDGeTPzxmSnpYwPg2eLCEy/pjJLNAa9ZRU6/5C3i7NkOwJJpiIViEHgrvotIJ1kLAOEZEdAlQNIBMVO6GQcAU95RsYLCWgGoli3qZX+9mNWoE4BqQkzOBaUyQArm5JhgYJoD1HAkGk+hzlLxaCSsfhagkdLbqyMl70W3c62ef1xtaxTctEZd82Wcmq/U3g9P+dr2ztu3t80A+ZoPkDmif92PaBMR+PhwEgESOjzxJDPehcxOKgO2UlkS4xX3Ymzm989Zcj9bK/dTdnJPvC+UNlaW96VIvK9d4n2xt/F08P44cbB/hbqdaSuT7DQAAAAASUVORK5CYII=",
+    monochrome: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAQAAAD9CzEMAAADKElEQVRYw+XYQUhVaRQH8J9pz+RBQlCRSZtgchMONDDhQxqGkFlkQjiB0MZoUREoRIuhxdDGNi2iMAZaSARFNDQjzmIKEUHetHGRrWooopAHBoEPNHma3Vm8q17nvtfT8sLA/N/mnXPP+Z97zvd95/u+y/8Nu+1OjnyrU5566pStG09eo81DCwKBBQ+1qdlI+v1uygsiv7yb9m8M+S4XvQ5pc/r0yYXSaxft+jLytBPGQ7oZtx0AB9w2E2rHnZD+PPJNDhlUEAgsGnVUavlZylGjFgUCBYMO2bRe+n2uexe+5TPnbItZbHPOs9Dinev2rZ18u/NehK5vXbG3rOVeV7wNLV84b3tl8i06ZX0UCMy5r0XVqudVMbnFfXMCgY+yOm0pT17toHveh8aPHVdXonTxUtQ57nH4Uu/dc1B16QBHTIXpvnTBjpI2PXpK6ne44GXoPeVI6QBnBQLT+jWVybHG734ru4ab9JsWCJwtbXBGIHBrVYI7NUakPV55ZU9E02jnqiLfEgicWVHF5++sxYi02WWn1YdSswYNmkOp3ml9NkesF83+m67SApmUddUD7WrRKiWlFbXaPXDVXyY/TVC5J971o+99a9CADMg4rFuHtBF3K/rHxuBGTN8edp7psHEUwqGc0R6zvVF5DOJ4ZDCsebEbpcIxGfSosvNaAhQMyMe0eQMKlZ1rKjxt0KxVpsSarnNJmzETcj6sP0CVr/zgO19riLTpKFJatOiR88SoP/0tWH+JqqwFn7Qql0Hguef6l0v0TSyPeeOyn1+iIj54440hh/0aCzDnZ8OV01vLLKrVvdwsVlCvW+3GBGjTAfLmw+IUJ22Hto0IUK9X2qw7Oo2DcZ3umJXWWyKzdQfokjGiy0nDsiBr2EldRmR0fWmARhm9jhlSwJh588ZQMOSYXplV+0UJxGdRWnVkR1jwU6QhT8hhIpTyfvGHhYhvdfwQFs2guGA6XItsmVOr+n3OhCdyEc2kqeX/Ta6F06HM0kt800/82CLpg9cSEj06rpQiwcNvEQkf34tI9AKyhESvUEtI9BJYRMLX2CISvYgvIdFPCf9N/APu8294oVkmtwAAAABJRU5ErkJggg==",
+    solid: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAABAlBMVEUAAAB8Tv98Tf97TP98TP99Tv+AUP9/Uv+AUv97S/9/U/98Tv98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf99Tv98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf9+T/98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf98Tf99T/98Tv98Tf97S/+QaP96Sv+1m/97TP9+UP/WyP/Wx/+IXf+KYP96S/+LYv/u6f/u6P/Pvv+xlf+EWP+kg//8+//7+v/d0f9/Uv95Sf/Drf/////59//RwP+ffP/h1//39f/39P+jg/+iTbl8AAAANXRSTlMAAAAAAAAAAAAAAAREBC2b8Rl74QtczAI/sfknk+0Vc9wIVMX+ATip9iGK6Q25E9LRIuoBAmJSODcAAAHNSURBVEjH1ZXZVsIwEIbpICqKuAuILIKK4i5MCWUpoG0jSygV3/9VPMWCLdLScOPxv8nJ6XzNTJZ/AoH/IQEmEvzGgwDbkcgOCODv90FYi+7u7e1G1yC4fJEQAOwfHCIiHh7sA0DIM3wdAI6OT9DSyfERAKx7Jh+LJ05xptNEPAYht1LMbJJnKXQodZZ02S8zPJ3J4i9lM+kFpZg7f57LX+ACXeRz5/OrwAZcXhWuf4LESkX8mV0Xri5h014KhG+Kt/a/kmqV2Oe3xZuwA7i7t75I0mSo1Rs1+xzx/s4BPDxa8U25JSFK7c5r2xxbctMiHh+cwJMFyG+KSpBolGoEiaq8yRbwtBjAlvLe1Xr9AWODfk/rvist9AYktcuG+shgzBjpQ9ZVpSUAEm3I2AdljI4ZG37O9soVwJ7OZtJ7uAyQSH/0MY0fj/rEMyWR1NrawKBTgBoDrV0joitQqTY6lDlEO41qxQOo/wbqHgB3StxFr7Kt3wc39n9w3FfDvHyfHJfP//XmfUC8T1QIPxdflpmA3WeELSh520wJthzGxGtk/FY5XYXDjAPfdl+et/uyu92v0FD4W9YkL3tT9NdHAWDHbLvgL3yFxv7H+gL4b+/cCTQELQAAAABJRU5ErkJggg==",
+    favicon: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAAAzFBMVEX////9/P/c0P/o4P+vk/+DV//y7v/Aqf+LYv96S/97TP/59//Qv/+Wcf98Tf/+/f/f0/+kg/9/Uf/r5P+0mf+FWf/08f/Er/+OZf97S//7+f/UxP+adf99Tv/i2P+oif+AU/+QaP/u6P+4nv+HXP98TP96Sv+1m//49v+gfv9+UP/WyP/Wx//18v+TbP+IXf+KYP/u6f+Ubf/Pvv+xlf+EWP/8+//7+v/d0f9/Uv95Sf/Drf/RwP+ffP/h1//39f/39P+jg////v+0mP8Z39bnAAABg0lEQVRIx92VaXOCMBCG15sEXY033mdUvFABTzza//+fOhYtZVQkfGv3SyY778O8JJtdgH8boXA4JKKPRGOxaMS3PJ6QCKVESsR9yeVkCikiIsVUUn4rT2dYluAtSJZl0t76XL7wI/9GCvmch7xYKisUXUGVcqn4Ql6p1uoKPoRSr1Urz/SNZstxo7TbDktazcaDvNPtkb7zWT4YcGfXJ71ux60fjrhtntqLOp6ov/eUj4YuYDqz7dC5RigilRYd6boSbW4TZDZ1A0vbMtVWusGRM9NkHLmhrzQbUJbPAST6esO2uz3Afrdlm7V+O4iXADU2IB+sI8DROsiwMegbADmTAU4mgHkGkC/3s3oN4PbgpA9bfAdQvrNO9+zZ2nFPSwpXJbY/mvesedwzSeXKS6A9mCxMVx7MxWTQ9gDGj8DYAxC2JPzTQY7Vvriz/4sTLo1r8V0Eis9/eYs+IOEnKtwEAD4E20yARibeKq+R+xRqxgHavfhAAfGRBeJDMcDY/VvxBc2dXnlb2TJpAAAAAElFTkSuQmCC",
+};
+//# sourceMappingURL=png-data.js.map

package/dist/assets/png-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"png-data.js","sourceRoot":"","sources":["../../src/assets/png-data.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,MAAM,aAAa,GAA8C;IACtE,OAAO,EAAE,ghDAAghD;IACzhD,OAAO,EAAE,wxCAAwxC;IACjyC,UAAU,EAAE,4pCAA4pC;IACxqC,KAAK,EAAE,4oCAA4oC;IACnpC,OAAO,EAAE,w4BAAw4B;CACl5B,CAAC"}

package/dist/browser/platform.d.ts

@@ -9,6 +9,12 @@ import type { LoginOptions, Platform } from "../types.js";
  * @throws {@link SebaConfigError} when no browser `window`/`document` exists.
  */
 export declare function createBrowserPlatform(): Platform;
+/**
+ * Derive a namespaced platform for multi-account support: each account gets its own
+ * IndexedDB database and sessionStorage transaction key so parallel `Seba` instances
+ * never overwrite each other's session.
+ */
+export declare function namespaceBrowserPlatform(platform: Platform, account: string): Platform;
 /** Re-exported for {@link Seba} type inference in browser-only builds. */
 export type { LoginOptions };
 //# sourceMappingURL=platform.d.ts.map

package/dist/browser/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/browser/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAA2B,YAAY,EAAE,QAAQ,EAAsC,MAAM,aAAa,CAAC;AAUvH;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,QAAQ,CAqDhD;AAED,0EAA0E;AAC1E,YAAY,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/browser/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAA2B,YAAY,EAAE,QAAQ,EAAsC,MAAM,aAAa,CAAC;AAUvH;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,QAAQ,CAqDhD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,CAWtF;AAED,0EAA0E;AAC1E,YAAY,EAAE,YAAY,EAAE,CAAC"}

package/dist/browser/platform.js

@@ -57,4 +57,21 @@ export function createBrowserPlatform() {
         },
     };
 }
+/**
+ * Derive a namespaced platform for multi-account support: each account gets its own
+ * IndexedDB database and sessionStorage transaction key so parallel `Seba` instances
+ * never overwrite each other's session.
+ */
+export function namespaceBrowserPlatform(platform, account) {
+    return {
+        ...platform,
+        pendingAuth: createSessionStoragePendingAuthStore(account),
+        createStorage(kind) {
+            if (kind === "memory") {
+                return memorySessionStorage();
+            }
+            return createIndexedDbStorage(account);
+        },
+    };
+}
 //# sourceMappingURL=platform.js.map