@pod-os/core 0.16.1-rc.bdd004d.0 → 0.16.2-rc.2f9e99a.0

package/dist/index.js

@@ -10372,11 +10372,6 @@ function checkSigCryptoKey(key3, alg, ...usages) {
       }
       break;
     }
-    case "Ed25519": {
-      if (!isAlgorithm(key3.algorithm, "Ed25519"))
-        throw unusable("Ed25519");
-      break;
-    }
     case "ES256":
     case "ES384":
     case "ES512": {
@@ -10560,10 +10555,6 @@ function subtleMapping(jwk) {
     }
     case "OKP": {
       switch (jwk.alg) {
-        case "Ed25519":
-          algorithm3 = { name: "Ed25519" };
-          keyUsages = jwk.d ? ["sign"] : ["verify"];
-          break;
         case "EdDSA":
           algorithm3 = { name: jwk.crv };
           keyUsages = jwk.d ? ["sign"] : ["verify"];
@@ -10681,7 +10672,7 @@ async function importJWK(jwk, alg) {
       }
       return decode(jwk.k);
     case "RSA":
-      if ("oth" in jwk && jwk.oth !== void 0) {
+      if (jwk.oth !== void 0) {
         throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
       }
     case "EC":
@@ -10852,8 +10843,6 @@ function subtleDsa(alg, algorithm3) {
     case "ES384":
     case "ES512":
       return { hash: hash2, name: "ECDSA", namedCurve: algorithm3.namedCurve };
-    case "Ed25519":
-      return { name: "Ed25519" };
     case "EdDSA":
       return { name: algorithm3.name };
     default:
@@ -11427,6 +11416,9 @@ var LocalJWKSet = class {
       if (candidate4 && Array.isArray(jwk2.key_ops)) {
         candidate4 = jwk2.key_ops.includes("verify");
       }
+      if (candidate4 && alg === "EdDSA") {
+        candidate4 = jwk2.crv === "Ed25519" || jwk2.crv === "Ed448";
+      }
       if (candidate4) {
         switch (alg) {
           case "ES256":
@@ -11441,12 +11433,6 @@ var LocalJWKSet = class {
           case "ES512":
             candidate4 = jwk2.crv === "P-521";
             break;
-          case "Ed25519":
-            candidate4 = jwk2.crv === "Ed25519";
-            break;
-          case "EdDSA":
-            candidate4 = jwk2.crv === "Ed25519" || jwk2.crv === "Ed448";
-            break;
         }
       }
       return candidate4;
@@ -11537,7 +11523,7 @@ function isCloudflareWorkers() {
 var USER_AGENT;
 if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
   const NAME = "jose";
-  const VERSION = "v5.10.0";
+  const VERSION = "v5.9.6";
   USER_AGENT = `${NAME}/${VERSION}`;
 }
 var jwksCache = Symbol();
@@ -11710,10 +11696,6 @@ async function generateKeyPair(alg, options) {
       algorithm3 = { name: "ECDSA", namedCurve: "P-521" };
       keyUsages = ["sign", "verify"];
       break;
-    case "Ed25519":
-      algorithm3 = { name: "Ed25519" };
-      keyUsages = ["sign", "verify"];
-      break;
     case "EdDSA": {
       keyUsages = ["sign", "verify"];
       const crv = options?.crv ?? "Ed25519";
@@ -11792,17 +11774,11 @@ function v4(options, buf, offset3) {
     return native_default.randomUUID();
   }
   options = options || {};
-  const rnds = options.random ?? options.rng?.() ?? rng();
-  if (rnds.length < 16) {
-    throw new Error("Random bytes length must be >= 16");
-  }
+  const rnds = options.random || (options.rng || rng)();
   rnds[6] = rnds[6] & 15 | 64;
   rnds[8] = rnds[8] & 63 | 128;
   if (buf) {
     offset3 = offset3 || 0;
-    if (offset3 < 0 || offset3 + 16 > buf.length) {
-      throw new RangeError(`UUID byte range ${offset3}:${offset3 + 15} is out of buffer bounds`);
-    }
     for (let i = 0; i < 16; ++i) {
       buf[offset3 + i] = rnds[i];
     }
@@ -11821,8 +11797,6 @@ var EVENTS = {
   LOGIN: "login",
   LOGOUT: "logout",
   NEW_REFRESH_TOKEN: "newRefreshToken",
-  NEW_TOKENS: "newTokens",
-  AUTHORIZATION_REQUEST: "authorizationRequest",
   SESSION_EXPIRED: "sessionExpired",
   SESSION_EXTENDED: "sessionExtended",
   SESSION_RESTORED: "sessionRestore",
@@ -11834,7 +11808,6 @@ var SCOPE_OFFLINE = "offline_access";
 var SCOPE_WEBID = "webid";
 var DEFAULT_SCOPES = [SCOPE_OPENID, SCOPE_OFFLINE, SCOPE_WEBID].join(" ");
 var AggregateHandler = class {
-  handleables;
   constructor(handleables) {
     this.handleables = handleables;
     this.handleables = handleables;
@@ -11930,21 +11903,19 @@ function booleanWithFallback(value7, fallback) {
   return Boolean(fallback);
 }
 var AuthorizationCodeWithPkceOidcHandlerBase = class {
-  storageUtility;
-  redirector;
   constructor(storageUtility, redirector) {
     this.storageUtility = storageUtility;
     this.redirector = redirector;
+    this.parametersGuard = (oidcLoginOptions) => {
+      return oidcLoginOptions.issuerConfiguration.grantTypesSupported !== void 0 && oidcLoginOptions.issuerConfiguration.grantTypesSupported.indexOf("authorization_code") > -1 && oidcLoginOptions.redirectUrl !== void 0;
+    };
     this.storageUtility = storageUtility;
     this.redirector = redirector;
   }
-  parametersGuard = (oidcLoginOptions) => {
-    return oidcLoginOptions.issuerConfiguration.grantTypesSupported !== void 0 && oidcLoginOptions.issuerConfiguration.grantTypesSupported.indexOf("authorization_code") > -1 && oidcLoginOptions.redirectUrl !== void 0;
-  };
   async canHandle(oidcLoginOptions) {
     return this.parametersGuard(oidcLoginOptions);
   }
-  async setupRedirectHandler({ oidcLoginOptions, state: state2, codeVerifier, targetUrl: targetUrl3 }) {
+  async handleRedirect({ oidcLoginOptions, state: state2, codeVerifier, targetUrl: targetUrl3 }) {
     if (!this.parametersGuard(oidcLoginOptions)) {
       throw new Error("The authorization code grant requires a redirectUrl.");
     }
@@ -11981,7 +11952,6 @@ var AuthorizationCodeWithPkceOidcHandlerBase = class {
   }
 };
 var GeneralLogoutHandler = class {
-  sessionInfoManager;
   constructor(sessionInfoManager) {
     this.sessionInfoManager = sessionInfoManager;
     this.sessionInfoManager = sessionInfoManager;
@@ -11994,16 +11964,15 @@ var GeneralLogoutHandler = class {
   }
 };
 var IRpLogoutHandler = class {
-  redirector;
   constructor(redirector) {
     this.redirector = redirector;
     this.redirector = redirector;
   }
   async canHandle(userId, options) {
-    return options?.logoutType === "idp";
+    return (options === null || options === void 0 ? void 0 : options.logoutType) === "idp";
   }
   async handle(userId, options) {
-    if (options?.logoutType !== "idp") {
+    if ((options === null || options === void 0 ? void 0 : options.logoutType) !== "idp") {
       throw new Error("Attempting to call idp logout handler to perform app logout");
     }
     if (options.toLogoutUrl === void 0) {
@@ -12015,7 +11984,6 @@ var IRpLogoutHandler = class {
   }
 };
 var IWaterfallLogoutHandler = class {
-  handlers;
   constructor(sessionInfoManager, redirector) {
     this.handlers = [
       new GeneralLogoutHandler(sessionInfoManager),
@@ -12046,7 +12014,6 @@ async function clear(sessionId, storage2) {
   ]);
 }
 var SessionInfoManagerBase = class {
-  storageUtility;
   constructor(storageUtility) {
     this.storageUtility = storageUtility;
     this.storageUtility = storageUtility;
@@ -12054,9 +12021,6 @@ var SessionInfoManagerBase = class {
   update(_sessionId, _options) {
     throw new Error("Not Implemented");
   }
-  set(_sessionId, _sessionInfo) {
-    throw new Error("Not Implemented");
-  }
   get(_) {
     throw new Error("Not implemented");
   }
@@ -12067,6 +12031,7 @@ var SessionInfoManagerBase = class {
   /**
    * This function removes all session-related information from storage.
    * @param sessionId the session identifier
+   * @param storage the storage where session info is stored
    * @hidden
    */
   async clear(sessionId) {
@@ -12074,6 +12039,7 @@ var SessionInfoManagerBase = class {
   }
   /**
    * Registers a new session, so that its ID can be retrieved.
+   * @param sessionId
    */
   async register(_sessionId) {
     throw new Error("Not implemented");
@@ -12091,12 +12057,6 @@ var SessionInfoManagerBase = class {
   async clearAll() {
     throw new Error("Not implemented");
   }
-  /**
-   * Sets authorization request state in storage for a given session ID.
-   */
-  async setOidcContext(_sessionId, _authorizationRequestState) {
-    throw new Error("Not implemented");
-  }
 };
 function getEndSessionUrl({ endSessionEndpoint, idTokenHint, postLogoutRedirectUri, state: state2 }) {
   const url7 = new URL(endSessionEndpoint);
@@ -12128,14 +12088,15 @@ function isValidUrl(url7) {
   try {
     new URL(url7);
     return true;
-  } catch {
+  } catch (_a) {
     return false;
   }
 }
 function determineSigningAlg(supported, preferred2) {
-  return preferred2.find((signingAlg) => {
+  var _a;
+  return (_a = preferred2.find((signingAlg) => {
     return supported.includes(signingAlg);
-  }) ?? null;
+  })) !== null && _a !== void 0 ? _a : null;
 }
 function isStaticClient(options) {
   return options.clientId !== void 0 && !isValidUrl(options.clientId);
@@ -12183,40 +12144,33 @@ async function handleRegistration(options, issuerConfig, storageUtility, clientR
 }
 var boundFetch = (request2, init) => fetch(request2, init);
 var ClientAuthentication = class {
-  loginHandler;
-  redirectHandler;
-  logoutHandler;
-  sessionInfoManager;
-  issuerConfigFetcher;
-  boundLogout;
   constructor(loginHandler, redirectHandler, logoutHandler, sessionInfoManager, issuerConfigFetcher) {
     this.loginHandler = loginHandler;
     this.redirectHandler = redirectHandler;
     this.logoutHandler = logoutHandler;
     this.sessionInfoManager = sessionInfoManager;
     this.issuerConfigFetcher = issuerConfigFetcher;
+    this.fetch = boundFetch;
+    this.logout = async (sessionId, options) => {
+      await this.logoutHandler.handle(sessionId, (options === null || options === void 0 ? void 0 : options.logoutType) === "idp" ? {
+        ...options,
+        toLogoutUrl: this.boundLogout
+      } : options);
+      this.fetch = boundFetch;
+      delete this.boundLogout;
+    };
+    this.getSessionInfo = async (sessionId) => {
+      return this.sessionInfoManager.get(sessionId);
+    };
+    this.getAllSessionInfo = async () => {
+      return this.sessionInfoManager.getAll();
+    };
     this.loginHandler = loginHandler;
     this.redirectHandler = redirectHandler;
     this.logoutHandler = logoutHandler;
     this.sessionInfoManager = sessionInfoManager;
     this.issuerConfigFetcher = issuerConfigFetcher;
   }
-  // By default, our fetch() resolves to the environment fetch() function.
-  fetch = boundFetch;
-  logout = async (sessionId, options) => {
-    await this.logoutHandler.handle(sessionId, options?.logoutType === "idp" ? {
-      ...options,
-      toLogoutUrl: this.boundLogout
-    } : options);
-    this.fetch = boundFetch;
-    delete this.boundLogout;
-  };
-  getSessionInfo = async (sessionId) => {
-    return this.sessionInfoManager.get(sessionId);
-  };
-  getAllSessionInfo = async () => {
-    return this.sessionInfoManager.getAll();
-  };
 };
 async function loadOidcContextFromStorage(sessionId, storageUtility, configFetcher) {
   try {
@@ -12264,8 +12218,6 @@ async function saveSessionInfoToStorage(storageUtility, sessionId, webId, client
   }
 }
 var StorageUtility = class {
-  secureStorage;
-  insecureStorage;
   constructor(secureStorage, insecureStorage) {
     this.secureStorage = secureStorage;
     this.insecureStorage = insecureStorage;
@@ -12290,26 +12242,26 @@ var StorageUtility = class {
     await (secure ? this.secureStorage : this.insecureStorage).set(this.getKey(userId), JSON.stringify(data2));
   }
   async get(key3, options) {
-    const value7 = await (options?.secure ? this.secureStorage : this.insecureStorage).get(key3);
-    if (value7 === void 0 && options?.errorIfNull) {
+    const value7 = await ((options === null || options === void 0 ? void 0 : options.secure) ? this.secureStorage : this.insecureStorage).get(key3);
+    if (value7 === void 0 && (options === null || options === void 0 ? void 0 : options.errorIfNull)) {
       throw new Error(`[${key3}] is not stored`);
     }
     return value7;
   }
   async set(key3, value7, options) {
-    return (options?.secure ? this.secureStorage : this.insecureStorage).set(key3, value7);
+    return ((options === null || options === void 0 ? void 0 : options.secure) ? this.secureStorage : this.insecureStorage).set(key3, value7);
   }
   async delete(key3, options) {
-    return (options?.secure ? this.secureStorage : this.insecureStorage).delete(key3);
+    return ((options === null || options === void 0 ? void 0 : options.secure) ? this.secureStorage : this.insecureStorage).delete(key3);
   }
   async getForUser(userId, key3, options) {
-    const userData = await this.getUserData(userId, options?.secure);
+    const userData = await this.getUserData(userId, options === null || options === void 0 ? void 0 : options.secure);
     let value7;
     if (!userData || !userData[key3]) {
       value7 = void 0;
     }
     value7 = userData[key3];
-    if (value7 === void 0 && options?.errorIfNull) {
+    if (value7 === void 0 && (options === null || options === void 0 ? void 0 : options.errorIfNull)) {
       throw new Error(`Field [${key3}] for user [${userId}] is not stored`);
     }
     return value7 || void 0;
@@ -12317,23 +12269,25 @@ var StorageUtility = class {
   async setForUser(userId, values2, options) {
     let userData;
     try {
-      userData = await this.getUserData(userId, options?.secure);
-    } catch {
+      userData = await this.getUserData(userId, options === null || options === void 0 ? void 0 : options.secure);
+    } catch (_a) {
       userData = {};
     }
-    await this.setUserData(userId, { ...userData, ...values2 }, options?.secure);
+    await this.setUserData(userId, { ...userData, ...values2 }, options === null || options === void 0 ? void 0 : options.secure);
   }
   async deleteForUser(userId, key3, options) {
-    const userData = await this.getUserData(userId, options?.secure);
+    const userData = await this.getUserData(userId, options === null || options === void 0 ? void 0 : options.secure);
     delete userData[key3];
-    await this.setUserData(userId, userData, options?.secure);
+    await this.setUserData(userId, userData, options === null || options === void 0 ? void 0 : options.secure);
   }
   async deleteAllUserData(userId, options) {
-    await (options?.secure ? this.secureStorage : this.insecureStorage).delete(this.getKey(userId));
+    await ((options === null || options === void 0 ? void 0 : options.secure) ? this.secureStorage : this.insecureStorage).delete(this.getKey(userId));
   }
 };
 var InMemoryStorage = class {
-  map = {};
+  constructor() {
+    this.map = {};
+  }
   async get(key3) {
     return this.map[key3] || void 0;
   }
@@ -12351,7 +12305,6 @@ var ConfigurationError = class extends Error {
   }
 };
 var InvalidResponseError = class extends Error {
-  missingFields;
   /* istanbul ignore next */
   constructor(missingFields) {
     super(`Invalid response from OIDC provider: missing fields ${missingFields}`);
@@ -12359,8 +12312,6 @@ var InvalidResponseError = class extends Error {
   }
 };
 var OidcProviderError = class extends Error {
-  error;
-  errorDescription;
   /* istanbul ignore next */
   constructor(message5, error4, errorDescription) {
     super(message5);
@@ -12397,9 +12348,10 @@ function isExpectedAuthError(statusCode2) {
   return [401, 403].includes(statusCode2);
 }
 async function buildDpopFetchOptions(targetUrl3, authToken, dpopKey, defaultOptions) {
-  const headers = new Headers(defaultOptions?.headers);
+  var _a;
+  const headers = new Headers(defaultOptions === null || defaultOptions === void 0 ? void 0 : defaultOptions.headers);
   headers.set("Authorization", `DPoP ${authToken}`);
-  headers.set("DPoP", await createDpopHeader(targetUrl3, defaultOptions?.method ?? "get", dpopKey));
+  headers.set("DPoP", await createDpopHeader(targetUrl3, (_a = defaultOptions === null || defaultOptions === void 0 ? void 0 : defaultOptions.method) !== null && _a !== void 0 ? _a : "get", dpopKey));
   return {
     ...defaultOptions,
     headers
@@ -12409,7 +12361,7 @@ async function buildAuthenticatedHeaders(targetUrl3, authToken, dpopKey, default
   if (dpopKey !== void 0) {
     return buildDpopFetchOptions(targetUrl3, authToken, dpopKey, defaultOptions);
   }
-  const headers = new Headers(defaultOptions?.headers);
+  const headers = new Headers(defaultOptions === null || defaultOptions === void 0 ? void 0 : defaultOptions.headers);
   headers.set("Authorization", `Bearer ${authToken}`);
   return {
     ...defaultOptions,
@@ -12420,8 +12372,12 @@ async function makeAuthenticatedRequest(accessToken, url7, defaultRequestInit, d
   return fetch(url7, await buildAuthenticatedHeaders(url7.toString(), accessToken, dpopKey, defaultRequestInit));
 }
 async function refreshAccessToken(refreshOptions, dpopKey, eventEmitter) {
+  var _a;
   const tokenSet = await refreshOptions.tokenRefresher.refresh(refreshOptions.sessionId, refreshOptions.refreshToken, dpopKey);
-  eventEmitter?.emit(EVENTS.SESSION_EXTENDED, tokenSet.expiresIn ?? DEFAULT_EXPIRATION_TIME_SECONDS);
+  eventEmitter === null || eventEmitter === void 0 ? void 0 : eventEmitter.emit(EVENTS.SESSION_EXTENDED, (_a = tokenSet.expiresIn) !== null && _a !== void 0 ? _a : DEFAULT_EXPIRATION_TIME_SECONDS);
+  if (typeof tokenSet.refreshToken === "string") {
+    eventEmitter === null || eventEmitter === void 0 ? void 0 : eventEmitter.emit(EVENTS.NEW_REFRESH_TOKEN, tokenSet.refreshToken);
+  }
   return {
     accessToken: tokenSet.accessToken,
     refreshToken: tokenSet.refreshToken,
@@ -12437,12 +12393,14 @@ var computeRefreshDelay = (expiresIn) => {
   }
   return DEFAULT_EXPIRATION_TIME_SECONDS;
 };
-function buildAuthenticatedFetch(accessToken, options) {
+async function buildAuthenticatedFetch(accessToken, options) {
+  var _a;
   let currentAccessToken = accessToken;
   let latestTimeout;
-  const currentRefreshOptions = options?.refreshOptions;
+  const currentRefreshOptions = options === null || options === void 0 ? void 0 : options.refreshOptions;
   if (currentRefreshOptions !== void 0) {
     const proactivelyRefreshToken = async () => {
+      var _a2, _b, _c, _d;
       try {
         const { accessToken: refreshedAccessToken, refreshToken, expiresIn } = await refreshAccessToken(
           currentRefreshOptions,
@@ -12458,14 +12416,14 @@ function buildAuthenticatedFetch(accessToken, options) {
         }
         clearTimeout(latestTimeout);
         latestTimeout = setTimeout(proactivelyRefreshToken, computeRefreshDelay(expiresIn) * 1e3);
-        options.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
+        (_a2 = options.eventEmitter) === null || _a2 === void 0 ? void 0 : _a2.emit(EVENTS.TIMEOUT_SET, latestTimeout);
       } catch (e) {
         if (e instanceof OidcProviderError) {
-          options?.eventEmitter?.emit(EVENTS.ERROR, e.error, e.errorDescription);
-          options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
+          (_b = options === null || options === void 0 ? void 0 : options.eventEmitter) === null || _b === void 0 ? void 0 : _b.emit(EVENTS.ERROR, e.error, e.errorDescription);
+          (_c = options === null || options === void 0 ? void 0 : options.eventEmitter) === null || _c === void 0 ? void 0 : _c.emit(EVENTS.SESSION_EXPIRED);
         }
         if (e instanceof InvalidResponseError && e.missingFields.includes("access_token")) {
-          options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
+          (_d = options === null || options === void 0 ? void 0 : options.eventEmitter) === null || _d === void 0 ? void 0 : _d.emit(EVENTS.SESSION_EXPIRED);
         }
       }
     };
@@ -12475,7 +12433,7 @@ function buildAuthenticatedFetch(accessToken, options) {
       // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
       computeRefreshDelay(options.expiresIn) * 1e3
     );
-    options.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
+    (_a = options.eventEmitter) === null || _a === void 0 ? void 0 : _a.emit(EVENTS.TIMEOUT_SET, latestTimeout);
   } else if (options !== void 0 && options.eventEmitter !== void 0) {
     const expirationTimeout = setTimeout(() => {
       options.eventEmitter.emit(EVENTS.SESSION_EXPIRED);
@@ -12483,13 +12441,13 @@ function buildAuthenticatedFetch(accessToken, options) {
     options.eventEmitter.emit(EVENTS.TIMEOUT_SET, expirationTimeout);
   }
   return async (url7, requestInit) => {
-    let response6 = await makeAuthenticatedRequest(currentAccessToken, url7, requestInit, options?.dpopKey);
+    let response6 = await makeAuthenticatedRequest(currentAccessToken, url7, requestInit, options === null || options === void 0 ? void 0 : options.dpopKey);
     const failedButNotExpectedAuthError = !response6.ok && !isExpectedAuthError(response6.status);
     if (response6.ok || failedButNotExpectedAuthError) {
       return response6;
     }
     const hasBeenRedirected = response6.url !== url7;
-    if (hasBeenRedirected && options?.dpopKey !== void 0) {
+    if (hasBeenRedirected && (options === null || options === void 0 ? void 0 : options.dpopKey) !== void 0) {
       response6 = await makeAuthenticatedRequest(
         currentAccessToken,
         // Replace the original target IRI (`url`) by the redirection target
@@ -12534,17 +12492,11 @@ function v42(options, buf, offset3) {
     return native_default2.randomUUID();
   }
   options = options || {};
-  const rnds = options.random ?? options.rng?.() ?? rng2();
-  if (rnds.length < 16) {
-    throw new Error("Random bytes length must be >= 16");
-  }
+  const rnds = options.random || (options.rng || rng2)();
   rnds[6] = rnds[6] & 15 | 64;
   rnds[8] = rnds[8] & 63 | 128;
   if (buf) {
     offset3 = offset3 || 0;
-    if (offset3 < 0 || offset3 + 16 > buf.length) {
-      throw new RangeError(`UUID byte range ${offset3}:${offset3 + 15} is out of buffer bounds`);
-    }
     for (let i = 0; i < 16; ++i) {
       buf[offset3 + i] = rnds[i];
     }
@@ -12561,32 +12513,27 @@ var import_events = __toESM(require_events(), 1);
 var import_oidc_client = __toESM(require_oidc_client_min());
 var import_oidc_client2 = __toESM(require_oidc_client_min());
 function processErrorResponse(responseBody, options) {
+  var _a, _b, _c, _d;
   if (responseBody.error === "invalid_redirect_uri") {
-    throw new Error(`Dynamic client registration failed: the provided redirect uri [${options.redirectUrl?.toString()}] is invalid - ${responseBody.error_description ?? ""}`);
+    throw new Error(`Dynamic client registration failed: the provided redirect uri [${(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()}] is invalid - ${(_b = responseBody.error_description) !== null && _b !== void 0 ? _b : ""}`);
   }
   if (responseBody.error === "invalid_client_metadata") {
-    throw new Error(`Dynamic client registration failed: the provided client metadata ${JSON.stringify(options)} is invalid - ${responseBody.error_description ?? ""}`);
+    throw new Error(`Dynamic client registration failed: the provided client metadata ${JSON.stringify(options)} is invalid - ${(_c = responseBody.error_description) !== null && _c !== void 0 ? _c : ""}`);
   }
-  throw new Error(`Dynamic client registration failed: ${responseBody.error} - ${responseBody.error_description ?? ""}`);
-}
-function hasClientId(body) {
-  return typeof body.client_id === "string";
-}
-function hasRedirectUri(body) {
-  return Array.isArray(body.redirect_uris) && body.redirect_uris.every((uri6) => typeof uri6 === "string");
+  throw new Error(`Dynamic client registration failed: ${responseBody.error} - ${(_d = responseBody.error_description) !== null && _d !== void 0 ? _d : ""}`);
 }
 function validateRegistrationResponse(responseBody, options) {
-  if (!hasClientId(responseBody)) {
+  if (responseBody.client_id === void 0) {
     throw new Error(`Dynamic client registration failed: no client_id has been found on ${JSON.stringify(responseBody)}`);
   }
-  if (options.redirectUrl && hasRedirectUri(responseBody) && responseBody.redirect_uris[0] !== options.redirectUrl.toString()) {
+  if (options.redirectUrl && (responseBody.redirect_uris === void 0 || responseBody.redirect_uris[0] !== options.redirectUrl.toString())) {
     throw new Error(`Dynamic client registration failed: the returned redirect URIs ${JSON.stringify(responseBody.redirect_uris)} don't match the provided ${JSON.stringify([
       options.redirectUrl.toString()
     ])}`);
   }
-  return true;
 }
 async function registerClient(options, issuerConfig) {
+  var _a;
   if (!issuerConfig.registrationEndpoint) {
     throw new Error("Dynamic Registration could not be completed because the issuer has no registration endpoint.");
   }
@@ -12598,7 +12545,7 @@ async function registerClient(options, issuerConfig) {
     /* eslint-disable camelcase */
     client_name: options.clientName,
     application_type: "web",
-    redirect_uris: [options.redirectUrl?.toString()],
+    redirect_uris: [(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()],
     subject_type: "public",
     token_endpoint_auth_method: "client_secret_basic",
     id_token_signed_response_alg: signingAlg,
@@ -12619,7 +12566,6 @@ async function registerClient(options, issuerConfig) {
     return {
       clientId: responseBody.client_id,
       clientSecret: responseBody.client_secret,
-      expiresAt: responseBody.client_secret_expires_at,
       idTokenSignedResponseAlg: responseBody.id_token_signed_response_alg,
       clientType: "dynamic"
     };
@@ -12727,7 +12673,7 @@ var isValidUrl2 = (url7) => {
   try {
     new URL(url7);
     return true;
-  } catch {
+  } catch (_a) {
     return false;
   }
 };
@@ -12828,54 +12774,50 @@ var StorageUtilityBrowser = class extends StorageUtility {
   }
 };
 var ClientAuthentication2 = class extends ClientAuthentication {
-  // Define these functions as properties so that they don't get accidentally re-bound.
-  // Isn't Javascript fun?
-  login = async (options, eventEmitter) => {
-    if (options.prompt !== "none") {
+  constructor() {
+    super(...arguments);
+    this.login = async (options, eventEmitter) => {
+      var _a, _b;
       await this.sessionInfoManager.clear(options.sessionId);
-    }
-    const redirectUrl = options.redirectUrl ?? normalizeCallbackUrl(window.location.href);
-    if (!isValidRedirectUrl(redirectUrl)) {
-      throw new Error(`${redirectUrl} is not a valid redirect URL, it is either a malformed IRI, includes a hash fragment, or reserved query parameters ('code' or 'state').`);
-    }
-    await this.loginHandler.handle({
-      ...options,
-      redirectUrl,
-      // If no clientName is provided, the clientId may be used instead.
-      clientName: options.clientName ?? options.clientId,
-      eventEmitter
-    });
-  };
-  // Collects session information from storage, and returns them. Returns null
-  // if the expected information cannot be found.
-  // Note that the ID token is not stored, which means the session information
-  // cannot be validated at this point.
-  validateCurrentSession = async (currentSessionId) => {
-    const sessionInfo = await this.sessionInfoManager.get(currentSessionId);
-    if (sessionInfo === void 0 || sessionInfo.clientAppId === void 0 || sessionInfo.issuer === void 0) {
-      return null;
-    }
-    return sessionInfo;
-  };
-  handleIncomingRedirect = async (url7, eventEmitter) => {
-    try {
-      const redirectInfo = await this.redirectHandler.handle(url7, eventEmitter, void 0);
-      this.fetch = redirectInfo.fetch.bind(window);
-      this.boundLogout = redirectInfo.getLogoutUrl;
-      await this.cleanUrlAfterRedirect(url7);
-      return {
-        isLoggedIn: redirectInfo.isLoggedIn,
-        webId: redirectInfo.webId,
-        sessionId: redirectInfo.sessionId,
-        expirationDate: redirectInfo.expirationDate,
-        clientAppId: redirectInfo.clientAppId
-      };
-    } catch (err) {
-      await this.cleanUrlAfterRedirect(url7);
-      eventEmitter.emit(EVENTS.ERROR, "redirect", err);
-      return void 0;
-    }
-  };
+      const redirectUrl = (_a = options.redirectUrl) !== null && _a !== void 0 ? _a : normalizeCallbackUrl(window.location.href);
+      if (!isValidRedirectUrl(redirectUrl)) {
+        throw new Error(`${redirectUrl} is not a valid redirect URL, it is either a malformed IRI, includes a hash fragment, or reserved query parameters ('code' or 'state').`);
+      }
+      await this.loginHandler.handle({
+        ...options,
+        redirectUrl,
+        // If no clientName is provided, the clientId may be used instead.
+        clientName: (_b = options.clientName) !== null && _b !== void 0 ? _b : options.clientId,
+        eventEmitter
+      });
+    };
+    this.validateCurrentSession = async (currentSessionId) => {
+      const sessionInfo = await this.sessionInfoManager.get(currentSessionId);
+      if (sessionInfo === void 0 || sessionInfo.clientAppId === void 0 || sessionInfo.issuer === void 0) {
+        return null;
+      }
+      return sessionInfo;
+    };
+    this.handleIncomingRedirect = async (url7, eventEmitter) => {
+      try {
+        const redirectInfo = await this.redirectHandler.handle(url7, eventEmitter, void 0);
+        this.fetch = redirectInfo.fetch.bind(window);
+        this.boundLogout = redirectInfo.getLogoutUrl;
+        await this.cleanUrlAfterRedirect(url7);
+        return {
+          isLoggedIn: redirectInfo.isLoggedIn,
+          webId: redirectInfo.webId,
+          sessionId: redirectInfo.sessionId,
+          expirationDate: redirectInfo.expirationDate,
+          clientAppId: redirectInfo.clientAppId
+        };
+      } catch (err) {
+        await this.cleanUrlAfterRedirect(url7);
+        eventEmitter.emit(EVENTS.ERROR, "redirect", err);
+        return void 0;
+      }
+    };
+  }
   async cleanUrlAfterRedirect(url7) {
     const cleanedUpUrl = removeOpenIdParams(url7).href;
     window.history.replaceState(null, "", cleanedUpUrl);
@@ -12893,10 +12835,6 @@ function hasRedirectUrl(options) {
   return typeof options.redirectUrl === "string";
 }
 var OidcLoginHandler = class {
-  storageUtility;
-  oidcHandler;
-  issuerConfigFetcher;
-  clientRegistrar;
   constructor(storageUtility, oidcHandler, issuerConfigFetcher, clientRegistrar) {
     this.storageUtility = storageUtility;
     this.oidcHandler = oidcHandler;
@@ -12937,6 +12875,7 @@ var OidcLoginHandler = class {
 };
 var AuthorizationCodeWithPkceOidcHandler = class extends AuthorizationCodeWithPkceOidcHandlerBase {
   async handle(oidcLoginOptions) {
+    var _a;
     const oidcOptions = {
       authority: oidcLoginOptions.issuer.toString(),
       client_id: oidcLoginOptions.client.clientId,
@@ -12950,12 +12889,12 @@ var AuthorizationCodeWithPkceOidcHandler = class extends AuthorizationCodeWithPk
       // profile referenced by the WebId.
       loadUserInfo: false,
       code_verifier: true,
-      prompt: oidcLoginOptions.prompt ?? "consent"
+      prompt: (_a = oidcLoginOptions.prompt) !== null && _a !== void 0 ? _a : "consent"
     };
     const oidcClientLibrary = new import_oidc_client2.OidcClient(oidcOptions);
     try {
       const signingRequest = await oidcClientLibrary.createSigninRequest();
-      return await this.setupRedirectHandler({
+      return await this.handleRedirect({
         oidcLoginOptions,
         // eslint-disable-next-line no-underscore-dangle
         state: signingRequest.state._id,
@@ -13070,7 +13009,6 @@ function processConfig(config2) {
   return parsedConfig;
 }
 var IssuerConfigFetcher = class _IssuerConfigFetcher {
-  storageUtility;
   constructor(storageUtility) {
     this.storageUtility = storageUtility;
     this.storageUtility = storageUtility;
@@ -13153,7 +13091,7 @@ var SessionInfoManager = class extends SessionInfoManagerBase {
       clientAppId: clientId,
       clientAppSecret: clientSecret,
       // Default the token type to DPoP if unspecified.
-      tokenType: tokenType ?? "DPoP"
+      tokenType: tokenType !== null && tokenType !== void 0 ? tokenType : "DPoP"
     };
   }
   /**
@@ -13180,11 +13118,6 @@ var FallbackRedirectHandler = class {
   }
 };
 var AuthCodeRedirectHandler = class {
-  storageUtility;
-  sessionInfoManager;
-  issuerConfigFetcher;
-  clientRegistrar;
-  tokerRefresher;
   constructor(storageUtility, sessionInfoManager, issuerConfigFetcher, clientRegistrar, tokerRefresher) {
     this.storageUtility = storageUtility;
     this.sessionInfoManager = sessionInfoManager;
@@ -13244,7 +13177,7 @@ var AuthCodeRedirectHandler = class {
         tokenRefresher: this.tokerRefresher
       };
     }
-    const authFetch = buildAuthenticatedFetch(tokens.accessToken, {
+    const authFetch = await buildAuthenticatedFetch(tokens.accessToken, {
       dpopKey: tokens.dpopKey,
       refreshOptions,
       eventEmitter,
@@ -13296,22 +13229,18 @@ var Redirector = class {
   }
 };
 var ClientRegistrar = class {
-  storageUtility;
   constructor(storageUtility) {
     this.storageUtility = storageUtility;
     this.storageUtility = storageUtility;
   }
   async getClient(options, issuerConfig) {
-    const [storedClientId, storedClientSecret, expiresAt, storedClientName, storedClientType] = await Promise.all([
+    const [storedClientId, storedClientSecret, storedClientName, storedClientType] = await Promise.all([
       this.storageUtility.getForUser(options.sessionId, "clientId", {
         secure: false
       }),
       this.storageUtility.getForUser(options.sessionId, "clientSecret", {
         secure: false
       }),
-      this.storageUtility.getForUser(options.sessionId, "expiresAt", {
-        secure: false
-      }),
       this.storageUtility.getForUser(options.sessionId, "clientName", {
         secure: false
       }),
@@ -13319,22 +13248,13 @@ var ClientRegistrar = class {
         secure: false
       })
     ]);
-    const expirationDate2 = expiresAt !== void 0 ? Number.parseInt(expiresAt, 10) : -1;
-    const expired = storedClientSecret !== void 0 && Math.floor(Date.now() / 1e3) > expirationDate2;
-    if (storedClientId && isKnownClientType(storedClientType) && !expired) {
-      return storedClientSecret !== void 0 ? {
+    if (storedClientId && isKnownClientType(storedClientType)) {
+      return {
         clientId: storedClientId,
         clientSecret: storedClientSecret,
         clientName: storedClientName,
         // Note: static clients are not applicable in a browser context.
-        clientType: "dynamic",
-        expiresAt: expirationDate2
-      } : {
-        clientId: storedClientId,
-        clientName: storedClientName,
-        // Note: static clients are not applicable in a browser context.
         clientType: storedClientType
-        // The type assertion is required even though the type should match the declaration.
       };
     }
     try {
@@ -13343,9 +13263,8 @@ var ClientRegistrar = class {
         clientId: registeredClient.clientId,
         clientType: "dynamic"
       };
-      if (registeredClient.clientSecret !== void 0) {
+      if (registeredClient.clientSecret) {
         infoToSave.clientSecret = registeredClient.clientSecret;
-        infoToSave.expiresAt = String(registeredClient.expiresAt);
       }
       if (registeredClient.idTokenSignedResponseAlg) {
         infoToSave.idTokenSignedResponseAlg = registeredClient.idTokenSignedResponseAlg;
@@ -13358,7 +13277,7 @@ var ClientRegistrar = class {
       });
       return registeredClient;
     } catch (error4) {
-      throw new Error(`Client registration failed.`, { cause: error4 });
+      throw new Error(`Client registration failed: [${error4}]`);
     }
   }
 };
@@ -13381,9 +13300,6 @@ var ErrorOidcHandler = class {
   }
 };
 var TokenRefresher = class {
-  storageUtility;
-  issuerConfigFetcher;
-  clientRegistrar;
   constructor(storageUtility, issuerConfigFetcher, clientRegistrar) {
     this.storageUtility = storageUtility;
     this.issuerConfigFetcher = issuerConfigFetcher;
@@ -13403,7 +13319,7 @@ var TokenRefresher = class {
     }
     const tokenSet = await refresh(refreshToken, oidcContext.issuerConfig, clientInfo, dpopKey);
     if (tokenSet.refreshToken !== void 0) {
-      eventEmitter?.emit(EVENTS.NEW_REFRESH_TOKEN, tokenSet.refreshToken);
+      eventEmitter === null || eventEmitter === void 0 ? void 0 : eventEmitter.emit(EVENTS.NEW_REFRESH_TOKEN, tokenSet.refreshToken);
     }
     return tokenSet;
   }
@@ -13431,6 +13347,7 @@ function getClientAuthenticationWithDependencies(dependencies3) {
 var KEY_CURRENT_SESSION = `${SOLID_CLIENT_AUTHN_KEY_PREFIX}currentSession`;
 var KEY_CURRENT_URL = `${SOLID_CLIENT_AUTHN_KEY_PREFIX}currentUrl`;
 async function silentlyAuthenticate(sessionId, clientAuthn, session4) {
+  var _a;
   const storedSessionInfo = await clientAuthn.validateCurrentSession(sessionId);
   if (storedSessionInfo !== null) {
     window.localStorage.setItem(KEY_CURRENT_URL, window.location.href);
@@ -13441,28 +13358,16 @@ async function silentlyAuthenticate(sessionId, clientAuthn, session4) {
       redirectUrl: storedSessionInfo.redirectUrl,
       clientId: storedSessionInfo.clientAppId,
       clientSecret: storedSessionInfo.clientAppSecret,
-      tokenType: storedSessionInfo.tokenType ?? "DPoP"
+      tokenType: (_a = storedSessionInfo.tokenType) !== null && _a !== void 0 ? _a : "DPoP"
     }, session4.events);
     return true;
   }
   return false;
 }
 function isLoggedIn(sessionInfo) {
-  return !!sessionInfo?.isLoggedIn;
+  return !!(sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.isLoggedIn);
 }
 var Session = class {
-  /**
-   * Information regarding the current session.
-   */
-  info;
-  /**
-   * Session attribute exposing the EventEmitter interface, to listen on session
-   * events such as login, logout, etc.
-   * @since 1.15.0
-   */
-  events;
-  clientAuthentication;
-  tokenRequestInProgress = false;
   /**
    * Session object constructor. Typically called as follows:
    *
@@ -13479,6 +13384,62 @@ var Session = class {
    *
    */
   constructor(sessionOptions = {}, sessionId = void 0) {
+    this.tokenRequestInProgress = false;
+    this.login = async (options) => {
+      var _a;
+      await this.clientAuthentication.login({
+        sessionId: this.info.sessionId,
+        ...options,
+        // Defaults the token type to DPoP
+        tokenType: (_a = options.tokenType) !== null && _a !== void 0 ? _a : "DPoP"
+      }, this.events);
+      return new Promise(() => {
+      });
+    };
+    this.fetch = (url7, init) => this.clientAuthentication.fetch(url7, init);
+    this.internalLogout = async (emitSignal, options) => {
+      window.localStorage.removeItem(KEY_CURRENT_SESSION);
+      await this.clientAuthentication.logout(this.info.sessionId, options);
+      this.info.isLoggedIn = false;
+      if (emitSignal) {
+        this.events.emit(EVENTS.LOGOUT);
+      }
+    };
+    this.logout = async (options) => this.internalLogout(true, options);
+    this.handleIncomingRedirect = async (inputOptions = {}) => {
+      var _a;
+      if (this.info.isLoggedIn) {
+        return this.info;
+      }
+      if (this.tokenRequestInProgress) {
+        return void 0;
+      }
+      const options = typeof inputOptions === "string" ? { url: inputOptions } : inputOptions;
+      const url7 = (_a = options.url) !== null && _a !== void 0 ? _a : window.location.href;
+      this.tokenRequestInProgress = true;
+      const sessionInfo = await this.clientAuthentication.handleIncomingRedirect(url7, this.events);
+      if (isLoggedIn(sessionInfo)) {
+        this.setSessionInfo(sessionInfo);
+        const currentUrl = window.localStorage.getItem(KEY_CURRENT_URL);
+        if (currentUrl === null) {
+          this.events.emit(EVENTS.LOGIN);
+        } else {
+          window.localStorage.removeItem(KEY_CURRENT_URL);
+          this.events.emit(EVENTS.SESSION_RESTORED, currentUrl);
+        }
+      } else if (options.restorePreviousSession === true) {
+        const storedSessionId = window.localStorage.getItem(KEY_CURRENT_SESSION);
+        if (storedSessionId !== null) {
+          const attemptedSilentAuthentication = await silentlyAuthenticate(storedSessionId, this.clientAuthentication, this);
+          if (attemptedSilentAuthentication) {
+            return new Promise(() => {
+            });
+          }
+        }
+      }
+      this.tokenRequestInProgress = false;
+      return sessionInfo;
+    };
     this.events = new import_events.default();
     if (sessionOptions.clientAuthentication) {
       this.clientAuthentication = sessionOptions.clientAuthentication;
@@ -13499,7 +13460,7 @@ var Session = class {
       };
     } else {
       this.info = {
-        sessionId: sessionId ?? v4_default2(),
+        sessionId: sessionId !== null && sessionId !== void 0 ? sessionId : v4_default2(),
         isLoggedIn: false
       };
     }
@@ -13507,123 +13468,6 @@ var Session = class {
     this.events.on(EVENTS.SESSION_EXPIRED, () => this.internalLogout(false));
     this.events.on(EVENTS.ERROR, () => this.internalLogout(false));
   }
-  /**
-   * Triggers the login process. Note that this method will redirect the user away from your app.
-   *
-   * @param options Parameter to customize the login behaviour. In particular, two options are mandatory: `options.oidcIssuer`, the user's identity provider, and `options.redirectUrl`, the URL to which the user will be redirected after logging in their identity provider.
-   * @returns This method should redirect the user away from the app: it does not return anything. The login process is completed by {@linkcode handleIncomingRedirect}.
-   */
-  // Define these functions as properties so that they don't get accidentally re-bound.
-  // Isn't Javascript fun?
-  login = async (options) => {
-    await this.clientAuthentication.login({
-      sessionId: this.info.sessionId,
-      ...options,
-      // Defaults the token type to DPoP
-      tokenType: options.tokenType ?? "DPoP"
-    }, this.events);
-    return new Promise(() => {
-    });
-  };
-  /**
-   * Fetches data using available login information. If the user is not logged in, this will behave as a regular `fetch`. The signature of this method is identical to the [canonical `fetch`](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API).
-   *
-   * @param url The URL from which data should be fetched.
-   * @param init Optional parameters customizing the request, by specifying an HTTP method, headers, a body, etc. Follows the [WHATWG Fetch Standard](https://fetch.spec.whatwg.org/).
-   */
-  fetch = (url7, init) => this.clientAuthentication.fetch(url7, init);
-  /**
-   * An internal logout function, to control whether or not the logout signal
-   * should be sent, i.e. if the logout was user-initiated or is the result of
-   * an external event.
-   *
-   * @hidden
-   */
-  internalLogout = async (emitSignal, options) => {
-    window.localStorage.removeItem(KEY_CURRENT_SESSION);
-    await this.clientAuthentication.logout(this.info.sessionId, options);
-    this.info.isLoggedIn = false;
-    if (emitSignal) {
-      this.events.emit(EVENTS.LOGOUT);
-    }
-  };
-  /**
-   * Logs the user out of the application.
-   *
-   * There are 2 types of logout supported by this library,
-   * `app` logout and `idp` logout.
-   *
-   * App logout will log the user out within the application
-   * by clearing any session data from the browser. It does
-   * not log the user out of their Solid identity provider,
-   * and should not redirect the user away.
-   * App logout can be performed as follows:
-   * ```typescript
-   * await session.logout({ logoutType: 'app' });
-   * ```
-   *
-   * IDP logout will log the user out of their Solid identity provider,
-   * and will redirect the user away from the application to do so. In order
-   * for users to be redirected back to `postLogoutUrl` you MUST include the
-   * `postLogoutUrl` value in the `post_logout_redirect_uris` field in the
-   * [Client ID Document](https://docs.inrupt.com/ess/latest/security/authentication/#client-identifier-client-id).
-   * IDP logout can be performed as follows:
-   * ```typescript
-   * await session.logout({
-   *  logoutType: 'idp',
-   *  // An optional URL to redirect to after logout has completed;
-   *  // this MUST match a logout URL listed in the Client ID Document
-   *  // of the application that is logged in.
-   *  // If the application is logged in with a Client ID that is not
-   *  // a URI dereferencing to a Client ID Document then users will
-   *  // not be redirected back to the `postLogoutUrl` after logout.
-   *  postLogoutUrl: 'https://example.com/logout',
-   *  // An optional value to be included in the query parameters
-   *  // when the IDP provider redirects the user to the postLogoutRedirectUrl.
-   *  state: "my-state"
-   * });
-   * ```
-   */
-  logout = async (options) => this.internalLogout(true, options);
-  /**
-   * Completes the login process by processing the information provided by the
-   * Solid identity provider through redirect.
-   *
-   * @param options See {@link IHandleIncomingRedirectOptions}.
-   */
-  handleIncomingRedirect = async (inputOptions = {}) => {
-    if (this.info.isLoggedIn) {
-      return this.info;
-    }
-    if (this.tokenRequestInProgress) {
-      return void 0;
-    }
-    const options = typeof inputOptions === "string" ? { url: inputOptions } : inputOptions;
-    const url7 = options.url ?? window.location.href;
-    this.tokenRequestInProgress = true;
-    const sessionInfo = await this.clientAuthentication.handleIncomingRedirect(url7, this.events);
-    if (isLoggedIn(sessionInfo)) {
-      this.setSessionInfo(sessionInfo);
-      const currentUrl = window.localStorage.getItem(KEY_CURRENT_URL);
-      if (currentUrl === null) {
-        this.events.emit(EVENTS.LOGIN);
-      } else {
-        window.localStorage.removeItem(KEY_CURRENT_URL);
-        this.events.emit(EVENTS.SESSION_RESTORED, currentUrl);
-      }
-    } else if (options.restorePreviousSession === true) {
-      const storedSessionId = window.localStorage.getItem(KEY_CURRENT_SESSION);
-      if (storedSessionId !== null) {
-        const attemptedSilentAuthentication = await silentlyAuthenticate(storedSessionId, this.clientAuthentication, this);
-        if (attemptedSilentAuthentication) {
-          return new Promise(() => {
-          });
-        }
-      }
-    }
-    this.tokenRequestInProgress = false;
-    return sessionInfo;
-  };
   setSessionInfo(sessionInfo) {
     this.info.isLoggedIn = sessionInfo.isLoggedIn;
     this.info.webId = sessionInfo.webId;