@tidecloak/js 0.14.41 → 0.14.43-staging

package/dist/esm/lib/tidecloak.js

@@ -36,18 +36,10 @@ var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
     return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
 };
-var _TideCloak_instances, _TideCloak_refreshQueue, _TideCloak_adapter, _TideCloak_useNonce, _TideCloak_callbackStorage, _TideCloak_popupErrorCallback, _TideCloak_logInfo, _TideCloak_logWarn, _TideCloak_loginIframe, _TideCloak_dpopProvider, _TideCloak_warnedStaleBearer, _TideCloak_config, _TideCloak_loadAdapter, _TideCloak_loadDefaultAdapter, _TideCloak_loadCordovaAdapter, _TideCloak_loadCordovaNativeAdapter, _TideCloak_loadConfig, _TideCloak_setupEndpoints, _TideCloak_loadOidcConfig, _TideCloak_setupOidcEndpoints, _TideCloak_getIssuerUrl, _TideCloak_check3pCookiesSupported, _TideCloak_processInit, _TideCloak_setupCheckLoginIframe, _TideCloak_checkLoginIframe, _TideCloak_checkSsoSilently, _TideCloak_parseCallback, _TideCloak_parseCallbackUrl, _TideCloak_parseCallbackParams, _TideCloak_processCallback, _TideCloak_scheduleCheckIframe, _TideCloak_consumePostLogoutMarker, _TideCloak_fetchAccessToken, _TideCloak_fetchRefreshToken, _TideCloak_ensureRequestEnclaveOpen, _TideCloak_reloginInteractively, _TideCloak_provideDokenOrRelogin, _TideCloak_handlePopupError, _TideCloak_getVoucherUrl, _TideCloak_setToken, _TideCloak_teardownEnclaves, _TideCloak_getRealmUrl, _TideCloak_createLogger, _LocalStorage_instances, _LocalStorage_clearInvalidValues, _LocalStorage_clearAllValues, _LocalStorage_getStoredEntries, _LocalStorage_parseExpiry, _CookieStorage_instances, _CookieStorage_getCookie, _CookieStorage_setCookie, _CookieStorage_cookieExpiration;
+var _TideCloak_instances, _TideCloak_refreshQueue, _TideCloak_adapter, _TideCloak_useNonce, _TideCloak_callbackStorage, _TideCloak_popupErrorCallback, _TideCloak_logInfo, _TideCloak_logWarn, _TideCloak_loginIframe, _TideCloak_dpopProvider, _TideCloak_config, _TideCloak_loadAdapter, _TideCloak_loadDefaultAdapter, _TideCloak_loadCordovaAdapter, _TideCloak_loadCordovaNativeAdapter, _TideCloak_loadConfig, _TideCloak_setupEndpoints, _TideCloak_loadOidcConfig, _TideCloak_setupOidcEndpoints, _TideCloak_check3pCookiesSupported, _TideCloak_processInit, _TideCloak_setupCheckLoginIframe, _TideCloak_checkLoginIframe, _TideCloak_checkSsoSilently, _TideCloak_parseCallback, _TideCloak_parseCallbackUrl, _TideCloak_parseCallbackParams, _TideCloak_processCallback, _TideCloak_scheduleCheckIframe, _TideCloak_dPoPFetch, _TideCloak_delegationFetch, _TideCloak_fetchExtensionChain, _TideCloak_fetchAccessToken, _TideCloak_validateDPoPTokenType, _TideCloak_fetchWithDPoPProof, _TideCloak_fetchWithDPoPDelegationProof, _TideCloak_fetchDPoPToken, _TideCloak_fetchRefreshToken, _TideCloak_ensureRequestEnclaveOpen, _TideCloak_reloginInteractively, _TideCloak_provideDokenOrRelogin, _TideCloak_handlePopupError, _TideCloak_getVoucherUrl, _TideCloak_setToken, _TideCloak_teardownEnclaves, _TideCloak_getRealmUrl, _TideCloak_getIssuerUrl, _TideCloak_createLogger, _LocalStorage_instances, _LocalStorage_clearInvalidValues, _LocalStorage_clearAllValues, _LocalStorage_getStoredEntries, _LocalStorage_parseExpiry, _CookieStorage_instances, _CookieStorage_getCookie, _CookieStorage_setCookie, _CookieStorage_cookieExpiration;
 // MODIFIED: Added dependency to external Tide helper libraries.
-import { RequestEnclave, ApprovalEnclave, ApprovalEnclaveNew } from "heimdall-tide";
+import { RequestEnclave, ApprovalEnclaveNew } from "heimdall-tide";
 const CONTENT_TYPE_JSON = 'application/json';
-// Post-logout marker. After an explicit logout there is no session to silently
-// resume, so the immediately-following init() must skip the racy silent
-// check-sso (whose hidden iframe can net::ERR_ABORTED and wedge the app).
-// `logout()` stamps this durable localStorage marker (it survives the logout
-// redirect round-trip); init() consumes it exactly once and, on the `check-sso`
-// path, settles as not-authenticated so the app shows its logged-out state.
-const POST_LOGOUT_MARKER_KEY = 'tide-post-logout';
-const POST_LOGOUT_MARKER_TTL_MS = 60000;
 /**
  * @typedef {Object} Endpoints
  * @property {() => string} authorize
@@ -66,8 +58,6 @@ const POST_LOGOUT_MARKER_TTL_MS = 60000;
  * @property {HTMLIFrameElement=} iframe
  * @property {string=} iframeOrigin
  */
-import { shouldAttachDpopProof } from './secureFetchPolicy.js';
-export { shouldAttachDpopProof } from './secureFetchPolicy.js';
 export { RequestEnclave, ApprovalEnclave, ApprovalEnclaveNew, PolicySignRequest } from "heimdall-tide";
 export { Tools, Models } from "@tideorg/js";
 class TideCloak {
@@ -104,15 +94,6 @@ class TideCloak {
         );
         /** @type {import('./tidecloak-dpop.js').DPoPSignatureProvider=} */
         _TideCloak_dpopProvider.set(this, void 0);
-        /**
-         * The last non-matching `Authorization: Bearer …` value `secureFetch` warned
-         * about, so a consumer stuck in a stale-token state gets ONE warning per stale
-         * token rather than one per request. See `secureFetch`.
-         * @type {string|null}
-         */
-        _TideCloak_warnedStaleBearer.set(this, null
-        /** @type {TideCloakConfig} config */
-        );
         /** @type {TideCloakConfig} config */
         _TideCloak_config.set(this, void 0);
         this.didInitialize = false;
@@ -128,15 +109,6 @@ class TideCloak {
         this.timeSkew = null;
         /** @type {boolean} */
         this.silentCheckSsoFallback = true;
-        /**
-         * Max time (ms) to wait for the hidden silent-check-sso iframe to post back
-         * before treating the attempt as "not authenticated". Guards against the
-         * post-logout wedge where the check-sso (or the Tide enclave it spins up)
-         * never responds and init() would otherwise hang forever. Overridable via
-         * initOptions.silentCheckSsoTimeout.
-         * @type {number}
-         */
-        this.silentCheckSsoTimeout = 10000;
         /** @type {TideCloakPkceMethod} */
         this.pkceMethod = 'S256';
         this.enableLogging = false;
@@ -149,6 +121,7 @@ class TideCloak {
          */
         this.init = async (initOptions = {}) => {
             var _a, _b, _c;
+            var _d;
             if (this.didInitialize) {
                 throw new Error("A 'TideCloak' instance can only be initialized once.");
             }
@@ -215,9 +188,6 @@ class TideCloak {
             if (typeof initOptions.silentCheckSsoFallback === 'boolean') {
                 this.silentCheckSsoFallback = initOptions.silentCheckSsoFallback;
             }
-            if (typeof initOptions.silentCheckSsoTimeout === 'number' && initOptions.silentCheckSsoTimeout > 0) {
-                this.silentCheckSsoTimeout = initOptions.silentCheckSsoTimeout;
-            }
             if (typeof initOptions.pkceMethod !== 'undefined') {
                 if (initOptions.pkceMethod !== 'S256' && initOptions.pkceMethod !== false) {
                     throw new TypeError(`Invalid value for pkceMethod', expected 'S256' or false but got ${initOptions.pkceMethod}.`);
@@ -236,15 +206,15 @@ class TideCloak {
             if (typeof initOptions.messageReceiveTimeout === 'number' && initOptions.messageReceiveTimeout > 0) {
                 this.messageReceiveTimeout = initOptions.messageReceiveTimeout;
             }
-            if (initOptions.useDPoP) {
-                this.useDPoP = initOptions.useDPoP;
+            if (initOptions.dpopConfig) {
+                this.dpopConfig = initOptions.dpopConfig;
             }
             await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_loadConfig).call(this);
-            if (((_a = this.useDPoP) === null || _a === void 0 ? void 0 : _a.mode) === 'strict' && (!this.dpopSigningAlgValuesSupported || this.dpopSigningAlgValuesSupported.length === 0)) {
+            if (((_a = this.dpopConfig) === null || _a === void 0 ? void 0 : _a.mode) === 'strict' && (!this.dpopSigningAlgValuesSupported || this.dpopSigningAlgValuesSupported.length === 0)) {
                 throw new Error('DPoP is set to strict mode but the server does not advertise DPoP support (dpop_signing_alg_values_supported is missing or empty).');
             }
             // Initialize DPoP if enabled and server supports it
-            if (this.useDPoP && ((_b = this.dpopSigningAlgValuesSupported) === null || _b === void 0 ? void 0 : _b.length)) {
+            if (this.dpopConfig && ((_b = this.dpopSigningAlgValuesSupported) === null || _b === void 0 ? void 0 : _b.length)) {
                 const issuerUrl = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getIssuerUrl).call(this);
                 if (!issuerUrl)
                     throw new Error('Cannot initialize DPoP: issuer URL is not available. Ensure authServerUrl and realm are configured, or use OIDC provider mode with a valid issuer.');
@@ -255,7 +225,8 @@ class TideCloak {
                     issuerUrl: new URL(issuerUrl),
                     clientId: this.clientId,
                     serverSupportedAlgorithms: this.dpopSigningAlgValuesSupported,
-                    requestedAlgorithm: !this.useDPoP.alg ? BrowserSignatureAlgs.ES256 : BrowserSignatureAlgs[this.useDPoP.alg],
+                    requestedAlgorithm: !this.dpopConfig.alg ? BrowserSignatureAlgs.ES256 : BrowserSignatureAlgs[this.dpopConfig.alg],
+                    strictStorage: (_d = this.dpopConfig.strictStorage) !== null && _d !== void 0 ? _d : false,
                     getTimeSkew: () => { var _a; return (_a = this.timeSkew) !== null && _a !== void 0 ? _a : 0; }
                 }), "f");
                 await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").init();
@@ -264,30 +235,9 @@ class TideCloak {
             await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_check3pCookiesSupported).call(this);
             await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_processInit).call(this, initOptions);
             (_c = this.onReady) === null || _c === void 0 ? void 0 : _c.call(this, this.authenticated);
-            // Do NOT eagerly open the Tide RequestEnclave during init().
-            //
-            // On a post-logout silent re-auth, the doken returned by the silent
-            // check-sso can be STALE: its session key no longer matches the session the
-            // hidden enclave cached from the previous login. Opening the hidden enclave
-            // here makes it sit "waiting for doken refresh" forever - a refresh that
-            // never comes because no fresh doken exists - which is exactly the
-            // "[ENCLAVE] Received init but waiting for doken refresh" ... hang that
-            // wedges the SPA on "Signing you in..." on the second login. (The enclave
-            // silently WAITS rather than emitting an error, so heimdall's own
-            // requireReloginCallback recovery never fires.)
-            //
-            // Instead we DEFER enclave setup: it is created lazily on the first real
-            // Tide operation (encrypt / decrypt / approve / signDpopApproval - each
-            // calls initRequestEnclave()), by which point a fresh interactive login has
-            // minted a current doken and the enclave can complete its handshake. We
-            // still register the user-gesture listener so the popup fallback can open
-            // once an enclave has actually been created; #ensureRequestEnclaveOpen
-            // no-ops while there is no enclave or no doken.
+            // The RequestEnclave is created lazily on the first Tide operation. Popups
+            // need a user gesture, so reopen it on click.
             if (initOptions.setupRequestEnclave) {
-                if (this.doken) {
-                    __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDECLOAK] Deferring Tide RequestEnclave setup until first use (not opening during init to avoid a stale-doken handshake stall on silent re-auth).');
-                }
-                // to get around popups requiring user gestures
                 document.addEventListener('click', () => {
                     __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_ensureRequestEnclaveOpen).call(this);
                 });
@@ -377,8 +327,7 @@ class TideCloak {
                 }
             }
             if (__classPrivateFieldGet(this, _TideCloak_dpopProvider, "f")) {
-                const thumbprint = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").generateJWKThumbprint();
-                params.append('dpop_jkt', thumbprint);
+                params.append('dpop_jkt', await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").generateJWKThumbprint());
             }
             __classPrivateFieldGet(this, _TideCloak_callbackStorage, "f").add(callbackState);
             return `${url}?${params.toString()}`;
@@ -390,17 +339,6 @@ class TideCloak {
         this.logout = async (options) => {
             var _a;
             await ((_a = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f")) === null || _a === void 0 ? void 0 : _a.flush());
-            // Stamp the post-logout marker so the next init() skips the racy silent
-            // check-sso instead of trying to resume a session we just ended. See
-            // POST_LOGOUT_MARKER_KEY.
-            try {
-                if (typeof window !== 'undefined' && window.localStorage) {
-                    window.localStorage.setItem(POST_LOGOUT_MARKER_KEY, Date.now().toString());
-                }
-            }
-            catch (e) {
-                __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDE-POSTLOGOUT] could not set marker: ' + (e instanceof Error ? e.message : String(e)));
-            }
             return __classPrivateFieldGet(this, _TideCloak_adapter, "f").logout(options);
         };
         /**
@@ -582,59 +520,89 @@ class TideCloak {
             }
             return await promise;
         };
-        this.clearToken = () => {
-            var _a;
+        this.clearToken = async () => {
+            var _a, _b, _c;
             if (this.token) {
+                await ((_a = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f")) === null || _a === void 0 ? void 0 : _a.flush());
+                await ((_b = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f")) === null || _b === void 0 ? void 0 : _b.init());
                 __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_setToken).call(this);
-                (_a = this.onAuthLogout) === null || _a === void 0 ? void 0 : _a.call(this);
+                (_c = this.onAuthLogout) === null || _c === void 0 ? void 0 : _c.call(this);
                 if (this.loginRequired) {
-                    this.login();
+                    await this.login();
                 }
             }
         };
-        this.secureFetch = async (url, init = {}) => {
-            var _a, _b;
-            const dpopProvider = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f");
-            if (dpopProvider && this.authenticated && this.token) {
-                const existingAuth = new Headers(init.headers).get('Authorization');
-                const isOurBearerToken = shouldAttachDpopProof(existingAuth, this.token);
-                if (!isOurBearerToken) {
-                    // Quick escape - didn't put this check in first if statement as it's more expensive than other checks.
-                    //
-                    // BEHAVIOUR IS UNCHANGED: a request carrying some OTHER Bearer token is a
-                    // legitimate pass-through (a third-party API), so it goes out as a plain
-                    // fetch with no DPoP proof.
-                    //
-                    // But make it OBSERVABLE. When the caller hands us a Bearer token that is
-                    // almost-but-not-quite ours - i.e. a token this client issued them earlier
-                    // and that has since gone stale because they cached it and missed a refresh
-                    // - this silent downgrade is fatal and mute: a `dpop.bound.access.tokens`
-                    // realm rejects a DPoP-bound token presented as a plain Bearer with a bare
-                    // `401`, and nothing anywhere explains why. One warning per distinct stale
-                    // token (not per request), so a wedged consumer gets a clear signal instead
-                    // of a scrolling wall.
-                    if (typeof existingAuth === 'string' &&
-                        existingAuth.startsWith('Bearer ') &&
-                        existingAuth !== __classPrivateFieldGet(this, _TideCloak_warnedStaleBearer, "f")) {
-                        __classPrivateFieldSet(this, _TideCloak_warnedStaleBearer, existingAuth, "f");
-                        console.warn('[TIDECLOAK] secureFetch: the Authorization header carries a Bearer token that is NOT the ' +
-                            'token this client currently holds. Sending it as a PLAIN fetch with no DPoP proof. If that ' +
-                            'token came from this SDK it has gone STALE (the caller cached a copy and missed a refresh) ' +
-                            'and a DPoP-bound realm will answer 401. Read the token from the SDK at call time ' +
-                            '(IAMService.getToken()) instead of holding a copy, or omit the Authorization header entirely ' +
-                            'and let secureFetch attach it.');
+        this.fetch = async (url, init = {}) => {
+            let isRegularFetch = true;
+            let options = init; // object to hold all configurations made by extensions
+            for (let ext of __classPrivateFieldGet(this, _TideCloak_fetchExtensionChain, "f")) {
+                if (ext.use(url, options)) {
+                    isRegularFetch = false;
+                    const opts = await ext.configure(url, options);
+                    if (opts)
+                        options = opts; // only change if a change was made
+                }
+                else {
+                    // this is really important
+                    // fetchExtensionChain is a CHAIN
+                    // a request might have dPoP use, then delegation use
+                    // but it will NEVER have delegation use WIHTOUT dPoP use
+                    // in that sense, to use tide delegation you need dpop + delegation being used first
+                    break;
+                }
+            }
+            let response = await fetch(url, options);
+            if (isRegularFetch)
+                return response;
+            let safeguardCounter = __classPrivateFieldGet(this, _TideCloak_fetchExtensionChain, "f").length;
+            let handleableErrors = true;
+            while (safeguardCounter >= 0 && handleableErrors == true) {
+                handleableErrors = false;
+                for (let ext of __classPrivateFieldGet(this, _TideCloak_fetchExtensionChain, "f")) {
+                    // we loop through the full chain since the developer might require tide delegation even though they didn't specify it
+                    const updatedResponse = await ext.handleResponse(url, options, response);
+                    if (updatedResponse) {
+                        // if updated response then we want to continue the look to run all the extension handlers again
+                        response = updatedResponse;
+                        handleableErrors = true;
                     }
-                    return fetch(url, init);
                 }
-                const urlString = url instanceof URL ? url.href : url.toString();
-                const origin = new URL(urlString).origin;
+                safeguardCounter--; // in case the application somehow gets into a loop with dpop + delegation erros
+            }
+            return response;
+        };
+        _TideCloak_dPoPFetch.set(this, {
+            use: (url, init = {}) => {
+                const dpopProvider = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f");
+                if (dpopProvider && this.authenticated && this.token) {
+                    const existingAuth = new Headers(init.headers).get('Authorization');
+                    const isOurBearerToken = existingAuth === `Bearer ${this.token}`;
+                    if (isOurBearerToken)
+                        return true;
+                }
+                return false;
+            },
+            configure: async (url, init = {}) => {
+                var _a;
+                const dpopProvider = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f");
+                const requestUrl = new URL(String(url), document.baseURI);
+                const urlString = requestUrl.href;
+                const origin = requestUrl.origin;
                 const method = (_a = init.method) !== null && _a !== void 0 ? _a : 'GET';
                 const resourceNonce = dpopProvider.getResourceServerNonce(origin);
                 const proof = await dpopProvider.generateDPoPProof(urlString, method, this.token, resourceNonce);
                 const headers = new Headers(init.headers);
                 headers.set('Authorization', `DPoP ${this.token}`);
                 headers.set('DPoP', proof);
-                const resp = await fetch(url, { ...init, headers });
+                return { ...init, headers };
+            },
+            handleResponse: async (url, init, resp) => {
+                var _a, _b;
+                const dpopProvider = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f");
+                const requestUrl = new URL(String(url), document.baseURI);
+                const urlString = requestUrl.href;
+                const origin = requestUrl.origin;
+                const method = (_a = init.method) !== null && _a !== void 0 ? _a : 'GET';
                 // Check for new nonce in response
                 const newNonce = resp.headers.get('DPoP-Nonce');
                 if (newNonce) {
@@ -645,11 +613,7 @@ class TideCloak {
                 if (resp.status === 401 && newNonce) {
                     const wwwAuth = (_b = resp.headers.get('WWW-Authenticate')) !== null && _b !== void 0 ? _b : '';
                     if (wwwAuth.includes('DPoP') && wwwAuth.includes('error="use_dpop_nonce"')) {
-                        const retryProof = await dpopProvider.generateDPoPProof(urlString, method, this.token, newNonce);
-                        const retryHeaders = new Headers(init.headers);
-                        retryHeaders.set('Authorization', `DPoP ${this.token}`);
-                        retryHeaders.set('DPoP', retryProof);
-                        const retryResp = await fetch(url, { ...init, headers: retryHeaders });
+                        const retryResp = await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_fetchWithDPoPProof).call(this, url, init, urlString, method, newNonce);
                         // Capture nonce from retry response for future requests
                         const retryNonce = retryResp.headers.get('DPoP-Nonce');
                         if (retryNonce) {
@@ -658,38 +622,60 @@ class TideCloak {
                         return retryResp;
                     }
                 }
-                return resp;
+                return null; // indicate nothing was changed
             }
-            else {
-                // SAFETY INVARIANT: if a DPoP provider exists, this client's tokens are
-                // sender-constrained (`cnf.jkt`), and a DPoP-bound token presented as a
-                // plain `Bearer` is INVALID per RFC 9449 - the resource server answers a
-                // bare `401` that names none of this. The silent fallback below is what
-                // hid exactly that bug. So when we are about to drop out of the DPoP path
-                // while STILL carrying an Authorization header, say so loudly - once per
-                // distinct header value, so a wedged consumer gets a signal rather than a
-                // scrolling wall.
-                if (dpopProvider) {
-                    const existingAuth = new Headers(init.headers).get('Authorization');
-                    if (typeof existingAuth === 'string' &&
-                        existingAuth.startsWith('Bearer ') &&
-                        existingAuth !== __classPrivateFieldGet(this, _TideCloak_warnedStaleBearer, "f")) {
-                        __classPrivateFieldSet(this, _TideCloak_warnedStaleBearer, existingAuth, "f");
-                        console.error('[TIDECLOAK] secureFetch: DPoP is ENABLED on this client, but the request is going out as a ' +
-                            'plain `Authorization: Bearer …` with NO DPoP proof' +
-                            (!this.authenticated
-                                ? ' (the client is not authenticated yet)'
-                                : !this.token
-                                    ? ' (the client holds no access token yet)'
-                                    : '') +
-                            '. If that token is DPoP-bound (`cnf.jkt`), the server will reject it with a bare 401. ' +
-                            'Wait for the SDK to be authenticated and read the token from it at call time, or turn DPoP ' +
-                            'off for this flow (omit `useDPoP` from the config).');
+        });
+        _TideCloak_delegationFetch.set(this, {
+            use: (url, init = {}) => {
+                return false;
+            },
+            configure: async (url, init = {}) => undefined, // cannot configure request withotu explicit server request
+            handleResponse: async (url, init, resp) => {
+                var _a, _b;
+                const dpopProvider = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f");
+                const requestUrl = new URL(String(url), document.baseURI);
+                const urlString = requestUrl.href;
+                const method = (_a = init.method) !== null && _a !== void 0 ? _a : 'GET';
+                const delegationKey = resp.headers.get('Resource-Delegation-Key');
+                const delegationChallenge = resp.headers.get('Resource-Delegation-Challenge');
+                if (resp.status === 401 && delegationKey && delegationChallenge) {
+                    const wwwAuth = (_b = resp.headers.get('WWW-Authenticate')) !== null && _b !== void 0 ? _b : '';
+                    if (wwwAuth.includes('error="DelegationProofNotFound"')) {
+                        const tokenId = this.tokenParsed.jti;
+                        if (!tokenId) {
+                            console.warn('[KEYCLOAK] Refusing DPoP delegation, access token does not include jti claim');
+                            return;
+                        }
+                        const challengeMessage = `resource-token-id-challenge:${tokenId}`;
+                        let dpopDelegationJwt;
+                        try {
+                            dpopDelegationJwt = await dpopProvider.generateResourceDelegation(delegationKey, challengeMessage, delegationChallenge, this.token);
+                        }
+                        catch (error) {
+                            console.warn('[KEYCLOAK] Refusing DPoP delegation, returning original response:', error);
+                            return;
+                        }
+                        if (resp.headers.get('Require-Tide-Delegation') === 'true') {
+                            try {
+                                this.initRequestEnclave();
+                            }
+                            catch (error) {
+                                console.warn('[KEYCLOAK] Refusing Tide delegation, no request enclave available:', error);
+                            }
+                            // provide tide delegation
+                            const delegation = bytesToBase64(await this.requestEnclave.requestExecutorWitnessSignature(StringToUint8Array(dpopDelegationJwt.substring(0, dpopDelegationJwt.lastIndexOf('.'))))); // sign only header and payload of delegation jwt, not signature (3rd .)
+                            const headers = new Headers(init.headers);
+                            headers.set('Enclave-Resource-Delegation-Signature', delegation);
+                            init = { ...init, headers };
+                        }
+                        const retryResp = await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_fetchWithDPoPDelegationProof).call(this, url, init, urlString, method, dpopDelegationJwt);
+                        return retryResp;
                     }
                 }
-                return fetch(url, init);
+                return;
             }
-        };
+        });
+        _TideCloak_fetchExtensionChain.set(this, [__classPrivateFieldGet(this, _TideCloak_dPoPFetch, "f"), __classPrivateFieldGet(this, _TideCloak_delegationFetch, "f")]);
         if (typeof config !== 'string' && !isObject(config)) {
             throw new Error("The 'TideCloak' constructor must be provided with a configuration object, or a URL to a JSON configuration file.");
         }
@@ -744,7 +730,7 @@ class TideCloak {
                 signed_client_origin: __classPrivateFieldGet(this, _TideCloak_config, "f")['clientOriginAuth'],
                 vendorId: __classPrivateFieldGet(this, _TideCloak_config, "f").vendorId,
                 voucherURL: __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getVoucherUrl).call(this),
-                isRunningLocal: new URL(__classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getVoucherUrl).call(this)).hostname === "localhost"
+                isRunningLocal: new URL(__classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getVoucherUrl).call(this)).hostname === 'localhost'
             }).init({
                 doken: this.doken,
                 dokenRefreshCallback: async () => __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_provideDokenOrRelogin).call(this),
@@ -780,7 +766,7 @@ class TideCloak {
     /**
      * Role-based encryption via Tide RequestEnclave.
      * @param {{ data: string | Uint8Array, tags: string[] }[]} toEncrypt
-     * @param {Uint8Array} decryption_policy If you'd like the data to be protected by a decryption policy
+     * @param {Uint8Array | null} [decryption_policy] If you'd like the data to be protected by a decryption policy
      * @returns {Promise<(string | Uint8Array)[]>}
      */
     async encrypt(toEncrypt, decryption_policy = null) {
@@ -794,7 +780,7 @@ class TideCloak {
         const dataToSend = toEncrypt.map((e) => {
             if (!isObject(e))
                 throw new Error('All entries must be an object to encrypt');
-            for (const property of ['data', 'tags']) {
+            for (const property of /** @type {const} */ (['data', 'tags'])) {
                 if (!e[property]) {
                     throw new Error(`The configuration object is missing the required '${property}' property.`);
                 }
@@ -808,7 +794,7 @@ class TideCloak {
                 if (typeof tag !== 'string')
                     throw new Error('tags must be provided as an array of strings');
                 if (!decryption_policy) {
-                    // if using standard encryption, check for doken includes default self encrypt roles
+                    // Without a policy, the user needs the default self-encrypt role for the tag.
                     const tagAccess = this.hasRealmRole(`_tide_${tag}.selfencrypt`);
                     if (!tagAccess)
                         throw new Error(`User has not been given any access to '${tag}'`);
@@ -817,17 +803,17 @@ class TideCloak {
             return {
                 data: typeof e.data === 'string' ? StringToUint8Array(e.data) : e.data,
                 tags: e.tags,
-                isRaw: typeof e.data === 'string' ? false : true
+                isRaw: typeof e.data !== 'string'
             };
         });
         this.initRequestEnclave();
         const encrypted = await this.requestEnclave.encrypt(dataToSend, decryption_policy);
-        return encrypted.map((cipher, i) => (dataToSend[i].isRaw ? cipher : bytesToBase64(cipher)));
+        return encrypted.map((/** @type {Uint8Array} */ cipher, /** @type {number} */ i) => (dataToSend[i].isRaw ? cipher : bytesToBase64(cipher)));
     }
     /**
-     * Begin the process of drafting a encryption request
-     * @param {{ data: string | Uint8Array, tags: string[] }[]} toEncrypt
-     * @returns
+     * Begin drafting an encryption request.
+     * @param {{ data: Uint8Array, tags: string[] }[]} toEncrypt
+     * @returns {Promise<Uint8Array>}
      */
     async draftEncryption(toEncrypt) {
         await this.ensureTokenReady();
@@ -840,7 +826,7 @@ class TideCloak {
         const dataToSend = toEncrypt.map((e) => {
             if (!isObject(e))
                 throw new Error('All entries must be an object to encrypt');
-            for (const property of ['data', 'tags']) {
+            for (const property of /** @type {const} */ (['data', 'tags'])) {
                 if (!e[property]) {
                     throw new Error(`The configuration object is missing the required '${property}' property.`);
                 }
@@ -856,28 +842,27 @@ class TideCloak {
             }
             return {
                 data: e.data,
-                tags: e.tags,
+                tags: e.tags
             };
         });
         this.initRequestEnclave();
         return await this.requestEnclave.draftEncryption(dataToSend);
     }
     /**
-     * Commit a encryption request with a specified policy
+     * Commit an encryption request with a specified policy.
      * @param {Uint8Array} request
      * @param {Uint8Array} decryption_policy
      * @returns {Promise<Uint8Array[]>}
      */
     async commitEncryption(request, decryption_policy) {
-        // Commit the encryption request and return data similar to encrypt()
         await this.ensureTokenReady();
         this.initRequestEnclave();
         return await this.requestEnclave.commitEncryption(request, decryption_policy);
     }
     /**
-     * Begin the process of drafting a encryption request
-     * @param {{ encrypted: string | Uint8Array, tags: string[] }[]} toDecrypt
-     * @returns {Uint8Array}
+     * Begin drafting a decryption request.
+     * @param {{ encrypted: Uint8Array, tags: string[] }[]} toDecrypt
+     * @returns {Promise<Uint8Array>}
      */
     async draftDecryption(toDecrypt) {
         await this.ensureTokenReady();
@@ -890,7 +875,7 @@ class TideCloak {
         const dataToSend = toDecrypt.map((e) => {
             if (!isObject(e))
                 throw new Error('All entries must be an object to decrypt');
-            for (const property of ['encrypted', 'tags']) {
+            for (const property of /** @type {const} */ (['encrypted', 'tags'])) {
                 if (!e[property]) {
                     throw new Error(`The configuration object is missing the required '${property}' property.`);
                 }
@@ -910,17 +895,15 @@ class TideCloak {
             };
         });
         this.initRequestEnclave();
-        const decryptionRequest = await this.requestEnclave.draftDecryption(dataToSend);
-        return decryptionRequest;
+        return await this.requestEnclave.draftDecryption(dataToSend);
     }
     /**
-     * Commit a decryption request with a specified policy
+     * Commit a decryption request with a specified policy.
      * @param {Uint8Array} request
      * @param {Uint8Array} decryption_policy
      * @returns {Promise<Uint8Array[]>}
      */
     async commitDecryption(request, decryption_policy) {
-        // Commit the encryption request and return data similar to encrypt()
         await this.ensureTokenReady();
         this.initRequestEnclave();
         return await this.requestEnclave.commitDecryption(request, decryption_policy);
@@ -946,10 +929,10 @@ class TideCloak {
         return await this.approvalEnclave.approve(requests);
     }
     /**
-     * Execute a Tide Sign Request
+     * Execute a Tide Sign Request.
      * @param {Uint8Array} request
      * @param {boolean} [waitForAll=false]
-     * @returns {Promise<Array>} Array of signatures
+     * @returns {Promise<any[]>} Array of signatures
      */
     async executeSignRequest(request, waitForAll = false) {
         await this.ensureTokenReady();
@@ -959,7 +942,7 @@ class TideCloak {
     /**
      * Role-based decryption via Tide RequestEnclave.
      * @param {{ encrypted: string | Uint8Array, tags: string[] }[]} toDecrypt
-     * @param {Uint8Array} decryption_policy If the data is protected by a decryption policy
+     * @param {Uint8Array | null} [decryption_policy] If the data is protected by a decryption policy
      * @returns {Promise<(string | Uint8Array)[]>}
      */
     async decrypt(toDecrypt, decryption_policy = null) {
@@ -973,7 +956,7 @@ class TideCloak {
         const dataToSend = toDecrypt.map((e) => {
             if (!isObject(e))
                 throw new Error('All entries must be an object to decrypt');
-            for (const property of ['encrypted', 'tags']) {
+            for (const property of /** @type {const} */ (['encrypted', 'tags'])) {
                 if (!e[property]) {
                     throw new Error(`The configuration object is missing the required '${property}' property.`);
                 }
@@ -987,7 +970,7 @@ class TideCloak {
                 if (typeof tag !== 'string')
                     throw new Error('tags must be provided as an array of strings');
                 if (!decryption_policy) {
-                    // if using standard decryption, check for doken includes default self decrypt roles
+                    // Without a policy, the user needs the default self-decrypt role for the tag.
                     const tagAccess = this.hasRealmRole(`_tide_${tag}.selfdecrypt`);
                     if (!tagAccess)
                         throw new Error(`User has not been given any access to '${tag}'`);
@@ -996,15 +979,15 @@ class TideCloak {
             return {
                 encrypted: typeof e.encrypted === 'string' ? base64ToBytes(e.encrypted) : e.encrypted,
                 tags: e.tags,
-                isRaw: typeof e.encrypted === 'string' ? false : true
+                isRaw: typeof e.encrypted !== 'string'
             };
         });
         this.initRequestEnclave();
         const decrypted = await this.requestEnclave.decrypt(dataToSend, decryption_policy);
-        return decrypted.map((d, i) => (dataToSend[i].isRaw ? d : StringFromUint8Array(d)));
+        return decrypted.map((/** @type {Uint8Array} */ d, /** @type {number} */ i) => (dataToSend[i].isRaw ? d : StringFromUint8Array(d)));
     }
 }
-_TideCloak_refreshQueue = new WeakMap(), _TideCloak_adapter = new WeakMap(), _TideCloak_useNonce = new WeakMap(), _TideCloak_callbackStorage = new WeakMap(), _TideCloak_popupErrorCallback = new WeakMap(), _TideCloak_logInfo = new WeakMap(), _TideCloak_logWarn = new WeakMap(), _TideCloak_loginIframe = new WeakMap(), _TideCloak_dpopProvider = new WeakMap(), _TideCloak_warnedStaleBearer = new WeakMap(), _TideCloak_config = new WeakMap(), _TideCloak_instances = new WeakSet(), _TideCloak_loadAdapter = function _TideCloak_loadAdapter(type) {
+_TideCloak_refreshQueue = new WeakMap(), _TideCloak_adapter = new WeakMap(), _TideCloak_useNonce = new WeakMap(), _TideCloak_callbackStorage = new WeakMap(), _TideCloak_popupErrorCallback = new WeakMap(), _TideCloak_logInfo = new WeakMap(), _TideCloak_logWarn = new WeakMap(), _TideCloak_loginIframe = new WeakMap(), _TideCloak_dpopProvider = new WeakMap(), _TideCloak_config = new WeakMap(), _TideCloak_dPoPFetch = new WeakMap(), _TideCloak_delegationFetch = new WeakMap(), _TideCloak_fetchExtensionChain = new WeakMap(), _TideCloak_instances = new WeakSet(), _TideCloak_loadAdapter = function _TideCloak_loadAdapter(type) {
     if (type === 'default') {
         return __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_loadDefaultAdapter).call(this);
     }
@@ -1341,7 +1324,7 @@ async function _TideCloak_loadConfig() {
  */
 async function _TideCloak_setupEndpoints() {
     // Fetch OIDC metadata to get DPoP supported algorithms (only if DPoP is enabled)
-    if (this.useDPoP) {
+    if (this.dpopConfig) {
         const issuerUrl = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getIssuerUrl).call(this);
         if (!issuerUrl) {
             __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDECLOAK] Cannot fetch OIDC metadata: issuer URL is not available');
@@ -1427,11 +1410,6 @@ async function _TideCloak_loadOidcConfig(oidcProvider) {
             return config.userinfo_endpoint;
         }
     };
-}, _TideCloak_getIssuerUrl = function _TideCloak_getIssuerUrl() {
-    if (this.issuer)
-        return this.issuer;
-    const realmUrl = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getRealmUrl).call(this);
-    return realmUrl || undefined;
 }, _TideCloak_check3pCookiesSupported = 
 /**
  * @returns {Promise<void>}
@@ -1504,20 +1482,8 @@ async function _TideCloak_processInit(initOptions) {
         await this.login(options);
     };
     const onLoad = async () => {
-        // A fresh marker means we just came back from an explicit logout. The
-        // marker is here to skip the silent check-sso, which is racy (its hidden
-        // iframe can net::ERR_ABORTED and wedge the app) and pointless: there is
-        // no session left to resume. So `check-sso` settles as not-authenticated
-        // and the app renders its logged-out state. `login-required` still means
-        // what it says, so that path is unchanged. Consumed here either way, so
-        // the marker stays one-shot.
-        const afterLogout = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_consumePostLogoutMarker).call(this);
         switch (initOptions.onLoad) {
             case 'check-sso':
-                if (afterLogout) {
-                    __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDE-POSTLOGOUT] marker honored in init(); settling as not-authenticated, bypassing silent check-sso');
-                    return;
-                }
                 if (__classPrivateFieldGet(this, _TideCloak_loginIframe, "f").enable) {
                     await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_setupCheckLoginIframe).call(this);
                     const unchanged = await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_checkLoginIframe).call(this);
@@ -1647,38 +1613,13 @@ async function _TideCloak_checkLoginIframe() {
  */
 async function _TideCloak_checkSsoSilently() {
     const iframe = document.createElement('iframe');
-    return await new Promise((resolve) => {
-        let settled = false;
-        /** @type {ReturnType<typeof setTimeout>=} */
-        let timer;
-        /** @type {ReturnType<typeof setTimeout>=} */
-        let loadGraceTimer;
-        const cleanup = () => {
-            if (timer)
-                clearTimeout(timer);
-            if (loadGraceTimer)
-                clearTimeout(loadGraceTimer);
-            window.removeEventListener('message', messageCallback);
-            iframe.removeEventListener('error', onIframeError);
-            iframe.removeEventListener('load', onIframeLoad);
-            if (iframe.parentNode)
-                document.body.removeChild(iframe);
-        };
-        // Every NON-authenticating terminal outcome funnels through here exactly
-        // once: onerror / onabort / load-without-message / timeout /
-        // createLoginUrl-failure. Resolving (never rejecting) as NOT-authenticated
-        // lets init() complete cleanly so the app falls through to interactive
-        // login. This is what makes the silent path structurally un-hangable: no
-        // matter which DOM event (or none) the aborted iframe produces, one of
-        // these fires. `via` is logged so QA can prove which path was taken.
-        const settleNotAuthenticated = (via) => {
-            if (settled)
-                return;
-            settled = true;
-            __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDE-SILENTSSO] terminal=' + via + ' -> not-authenticated (authenticated=' + this.authenticated + ')');
-            cleanup();
-            resolve();
-        };
+    const src = await this.createLoginUrl({ prompt: 'none', redirectUri: this.silentCheckSsoRedirectUri });
+    iframe.setAttribute('src', src);
+    iframe.setAttribute('sandbox', 'allow-storage-access-by-user-activation allow-scripts allow-same-origin');
+    iframe.setAttribute('title', 'keycloak-silent-check-sso');
+    iframe.style.display = 'none';
+    document.body.appendChild(iframe);
+    return await new Promise((resolve, reject) => {
         /**
          * @param {MessageEvent} event
          */
@@ -1686,63 +1627,18 @@ async function _TideCloak_checkSsoSilently() {
             if (event.origin !== window.location.origin || iframe.contentWindow !== event.source) {
                 return;
             }
-            if (settled)
-                return;
-            settled = true;
-            cleanup();
+            const oauth = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_parseCallback).call(this, event.data);
             try {
-                const oauth = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_parseCallback).call(this, event.data);
                 await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_processCallback).call(this, oauth);
-                __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDE-SILENTSSO] terminal=message -> processed (authenticated=' + this.authenticated + ')');
                 resolve();
             }
             catch (error) {
-                // A failed silent callback must NOT reject: rejecting would surface as
-                // an init() error / AuthWall wall instead of a clean fall-through to
-                // interactive login. Resolve as not-authenticated.
-                __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDE-SILENTSSO] terminal=message-error -> not-authenticated: ' + (error instanceof Error ? error.message : String(error)));
-                resolve();
+                reject(error);
             }
+            document.body.removeChild(iframe);
+            window.removeEventListener('message', messageCallback);
         };
-        const onIframeError = () => settleNotAuthenticated('onerror');
-        const onIframeLoad = () => {
-            // The iframe finished navigating. On the happy path it landed on the
-            // real silent-check-sso.html and `messageCallback` settles first. If it
-            // loaded an error page, or a cross-origin KC page that never posts, or
-            // an aborted navigation that still fired `load`, no message arrives - so
-            // arm a short grace timer that settles NOT-authenticated well before the
-            // outer ceiling.
-            if (settled)
-                return;
-            const grace = Math.max(250, Math.min(2000, Math.floor(this.silentCheckSsoTimeout / 4)));
-            if (loadGraceTimer)
-                clearTimeout(loadGraceTimer);
-            loadGraceTimer = setTimeout(() => settleNotAuthenticated('load-no-message'), grace);
-        };
-        // Wire ALL listeners before the navigation starts so no immediate event is
-        // missed. `error` covers the browsers that surface a failed iframe
-        // navigation as an error/abort event; `load` + the grace timer cover the
-        // ones that fire load on an error document; the outer `timer` covers
-        // net::ERR_ABORTED that produces NO DOM event at all.
         window.addEventListener('message', messageCallback);
-        iframe.addEventListener('error', onIframeError);
-        iframe.addEventListener('load', onIframeLoad);
-        // Hard ceiling. Created synchronously (NOT after an awaited createLoginUrl)
-        // so it is always armed regardless of what the iframe navigation does.
-        timer = setTimeout(() => settleNotAuthenticated('timeout'), this.silentCheckSsoTimeout);
-        // Build the URL and start the navigation. Failure here must still settle
-        // (not reject) so init() stays deterministic.
-        this.createLoginUrl({ prompt: 'none', redirectUri: this.silentCheckSsoRedirectUri })
-            .then((src) => {
-            if (settled)
-                return;
-            iframe.setAttribute('src', src);
-            iframe.setAttribute('sandbox', 'allow-storage-access-by-user-activation allow-scripts allow-same-origin');
-            iframe.setAttribute('title', 'keycloak-silent-check-sso');
-            iframe.style.display = 'none';
-            document.body.appendChild(iframe);
-        })
-            .catch(() => settleNotAuthenticated('createLoginUrl-error'));
     });
 }, _TideCloak_parseCallback = function _TideCloak_parseCallback(url) {
     const oauth = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_parseCallbackUrl).call(this, url);
@@ -1877,36 +1773,17 @@ async function _TideCloak_checkSsoSilently() {
             await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_scheduleCheckIframe).call(this);
         }
     }
-}, _TideCloak_consumePostLogoutMarker = function _TideCloak_consumePostLogoutMarker() {
-    try {
-        if (typeof window === 'undefined' || !window.localStorage)
-            return false;
-        const raw = window.localStorage.getItem(POST_LOGOUT_MARKER_KEY);
-        if (!raw)
-            return false;
-        window.localStorage.removeItem(POST_LOGOUT_MARKER_KEY);
-        const ts = Number(raw);
-        const fresh = Number.isFinite(ts) && (Date.now() - ts) < POST_LOGOUT_MARKER_TTL_MS;
-        if (!fresh) {
-            __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDE-POSTLOGOUT] marker present but stale (age > ' + POST_LOGOUT_MARKER_TTL_MS + 'ms); ignoring');
-        }
-        return fresh;
-    }
-    catch (e) {
-        __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDE-POSTLOGOUT] could not read marker: ' + (e instanceof Error ? e.message : String(e)));
-        return false;
-    }
 }, _TideCloak_fetchAccessToken = 
 /**
- * @typedef {Object} AccessTokenResponse The successful token response from the authorization server, based on the {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.1 OAuth 2.0 Authorization Framework specification}.
- * @property {string} access_token The access token issued by the authorization server.
- * @property {string} token_type The type of the token issued by the authorization server.
- * @property {number} [expires_in] The lifetime in seconds of the access token.
- * @property {string} [refresh_token] The refresh token issued by the authorization server.
- * @property {string} [id_token] The ID token issued by the authorization server, if requested.
- * @property {string} [scope] The scope of the access token.
- * @property {string} [doken] The Tide doken issued by the authorization server.
- */
+* @typedef {Object} AccessTokenResponse The successful token response from the authorization server, based on the {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.1 OAuth 2.0 Authorization Framework specification}.
+* @property {string} access_token The access token issued by the authorization server.
+* @property {string} token_type The type of the token issued by the authorization server.
+* @property {number} [expires_in] The lifetime in seconds of the access token.
+* @property {string} [refresh_token] The refresh token issued by the authorization server.
+* @property {string} [id_token] The ID token issued by the authorization server, if requested.
+* @property {string} [scope] The scope of the access token.
+* @property {string} [doken] The Tide doken issued by the authorization server.
+*/
 /**
  * Fetch the access token from the given URL.
  * @param {string} url
@@ -1926,36 +1803,117 @@ async function _TideCloak_fetchAccessToken(url, code, clientId, redirectUri, pkc
     if (pkceCodeVerifier) {
         body.append('code_verifier', pkceCodeVerifier);
     }
-    /** @type {Record<string, string>} */
-    const headers = {};
     if (__classPrivateFieldGet(this, _TideCloak_dpopProvider, "f")) {
-        const nonce = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").getAuthServerNonce();
-        headers['DPoP'] = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").generateDPoPProof(url, 'POST', undefined, nonce);
+        return await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_fetchDPoPToken).call(this, url, body);
     }
-    try {
+    else {
         return await fetchJSON(url, {
             method: 'POST',
             credentials: 'include',
-            headers,
             body
         });
     }
-    catch (error) {
-        // Handle DPoP nonce retry for token endpoint
-        if (__classPrivateFieldGet(this, _TideCloak_dpopProvider, "f") && error instanceof NetworkError) {
-            const newNonce = error.response.headers.get('DPoP-Nonce');
-            if (newNonce) {
-                await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").updateAuthServerNonce(newNonce);
-                headers['DPoP'] = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").generateDPoPProof(url, 'POST', undefined, newNonce);
-                return await fetchJSON(url, {
-                    method: 'POST',
-                    credentials: 'include',
-                    headers,
-                    body
-                });
+}, _TideCloak_validateDPoPTokenType = function _TideCloak_validateDPoPTokenType(tokenResponse) {
+    var _a, _b;
+    const tokenType = (_a = tokenResponse.token_type) === null || _a === void 0 ? void 0 : _a.toLowerCase();
+    const hasDPoPProvider = !!__classPrivateFieldGet(this, _TideCloak_dpopProvider, "f");
+    if (hasDPoPProvider && tokenType !== 'dpop') {
+        // We sent a DPoP proof but server returned non-DPoP token
+        if (((_b = this.dpopConfig) === null || _b === void 0 ? void 0 : _b.mode) === 'strict') {
+            throw new Error('DPoP strict mode enabled but server returned non-DPoP token (token_type: ' + tokenResponse.token_type + ')');
+        }
+        // Auto mode: disable DPoP and fall back to Bearer
+        __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDECLOAK] Server returned token_type "' + tokenResponse.token_type + '" instead of "DPoP". Disabling DPoP for this session.');
+        __classPrivateFieldSet(this, _TideCloak_dpopProvider, undefined, "f");
+    }
+    return tokenResponse;
+}, _TideCloak_fetchWithDPoPProof = 
+/**
+ * @param {RequestInfo | URL} url
+ * @param {RequestInit} init
+ * @param {string} urlString
+ * @param {string} method
+ * @param {string} [nonce]
+ * @returns {Promise<Response>}
+ */
+async function _TideCloak_fetchWithDPoPProof(url, init, urlString, method, nonce) {
+    const dpopProvider = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f");
+    if (!dpopProvider) {
+        throw new Error('DPoP provider not initialized');
+    }
+    const proof = await dpopProvider.generateDPoPProof(urlString, method, this.token, nonce);
+    const headers = new Headers(init.headers);
+    headers.set('Authorization', `DPoP ${this.token}`);
+    headers.set('DPoP', proof);
+    return fetch(url, { ...init, headers });
+}, _TideCloak_fetchWithDPoPDelegationProof = 
+/**
+ * @param {RequestInfo | URL} url
+ * @param {RequestInit} init
+ * @param {string} urlString
+ * @param {string} method
+ * @param {string} delegationJwt
+ * @returns {Promise<Response>}
+ */
+async function _TideCloak_fetchWithDPoPDelegationProof(url, init, urlString, method, delegationJwt) {
+    const dpopProvider = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f");
+    if (!dpopProvider) {
+        throw new Error('DPoP provider not initialized');
+    }
+    const origin = new URL(urlString).origin;
+    const resourceNonce = dpopProvider.getResourceServerNonce(origin);
+    const headers = new Headers(init.headers);
+    headers.set('Resource-Delegation', delegationJwt);
+    return __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_fetchWithDPoPProof).call(this, url, { ...init, headers }, urlString, method, resourceNonce);
+}, _TideCloak_fetchDPoPToken = 
+/**
+ * Fetch tokens from the authorization server with DPoP proof attached.
+ * Handles nonce requirements per RFC 9449 Section 8.
+ * @param {string} url
+ * @param {URLSearchParams} body
+ * @returns {Promise<AccessTokenResponse>}
+ */
+async function _TideCloak_fetchDPoPToken(url, body) {
+    const dpopProvider = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f");
+    if (!dpopProvider) {
+        throw new Error('DPoP provider not initialized');
+    }
+    const fetchToken = async (nonce) => {
+        const proof = await dpopProvider.generateDPoPProof(url, 'POST', undefined, nonce);
+        const headers = new Headers();
+        headers.set('DPoP', proof);
+        headers.set('Accept', CONTENT_TYPE_JSON);
+        const resp = await fetchWithErrorHandling(url, {
+            method: 'POST',
+            credentials: 'include',
+            body,
+            headers
+        });
+        // RFC 9449 Section 8.2: new nonce values may be returned in successful responses
+        const newNonce = resp.headers.get('DPoP-Nonce');
+        if (newNonce) {
+            await dpopProvider.updateAuthServerNonce(newNonce);
+        }
+        const tokenResponse = await resp.json();
+        return __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_validateDPoPTokenType).call(this, tokenResponse);
+    };
+    try {
+        const nonce = await dpopProvider.getAuthServerNonce();
+        return await fetchToken(nonce);
+    }
+    catch (ex) {
+        // Check if this is a DPoP nonce error per RFC 9449 Section 8
+        if (ex instanceof NetworkError && ex.response.status === 400) {
+            const dpopNonce = ex.response.headers.get('DPoP-Nonce');
+            if (dpopNonce) {
+                const errorBody = await ex.response.json().catch(() => ({}));
+                if (errorBody.error === 'use_dpop_nonce') {
+                    await dpopProvider.updateAuthServerNonce(dpopNonce);
+                    return await fetchToken(dpopNonce);
+                }
             }
         }
-        throw error;
+        throw ex;
     }
 }, _TideCloak_fetchRefreshToken = 
 /**
@@ -1971,49 +1929,23 @@ async function _TideCloak_fetchRefreshToken(url, refreshToken, clientId) {
         ['refresh_token', refreshToken],
         ['client_id', clientId]
     ]);
-    /** @type {Record<string, string>} */
-    const headers = {};
     if (__classPrivateFieldGet(this, _TideCloak_dpopProvider, "f")) {
-        const nonce = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").getAuthServerNonce();
-        headers['DPoP'] = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").generateDPoPProof(url, 'POST', undefined, nonce);
+        return await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_fetchDPoPToken).call(this, url, body);
     }
-    try {
+    else {
         return await fetchJSON(url, {
             method: 'POST',
             credentials: 'include',
-            headers,
             body
         });
     }
-    catch (error) {
-        // Handle DPoP nonce retry for token endpoint
-        if (__classPrivateFieldGet(this, _TideCloak_dpopProvider, "f") && error instanceof NetworkError) {
-            const newNonce = error.response.headers.get('DPoP-Nonce');
-            if (newNonce) {
-                await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").updateAuthServerNonce(newNonce);
-                headers['DPoP'] = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").generateDPoPProof(url, 'POST', undefined, newNonce);
-                return await fetchJSON(url, {
-                    method: 'POST',
-                    credentials: 'include',
-                    headers,
-                    body
-                });
-            }
-        }
-        throw error;
-    }
 }, _TideCloak_ensureRequestEnclaveOpen = function _TideCloak_ensureRequestEnclaveOpen() {
-    // Never (re)open the enclave without a doken. Post-logout the doken is
-    // flushed; reopening a dokenless hidden enclave wedges it with
-    // "Expecting doken in request".
     if (!this.requestEnclave || !this.doken)
         return;
     this.requestEnclave.checkEnclaveOpen();
 }, _TideCloak_reloginInteractively = 
 /**
- * Trigger a full interactive login redirect. Used as the recovery leg when a
- * silent flow cannot proceed (e.g. the enclave asks for a doken refresh but
- * the doken was flushed at logout). Navigates the whole page to Keycloak.
+ * Full interactive login, used when an enclave needs a doken we don't have.
  * @returns {Promise<void>}
  */
 async function _TideCloak_reloginInteractively() {
@@ -2024,17 +1956,12 @@ async function _TideCloak_reloginInteractively() {
     });
 }, _TideCloak_provideDokenOrRelogin = 
 /**
- * Provide the current doken to the enclave, or fall through to interactive
- * login when there is none (post-logout / flushed state). Throwing a bare
- * error here would leave the enclave (and whatever awaits its doken-refresh
- * completion) hanging; instead we redirect to a full interactive login, which
- * recovers cleanly.
  * @returns {Promise<string>}
  */
 async function _TideCloak_provideDokenOrRelogin() {
     await this.ensureTokenReady();
     if (!this.doken) {
-        __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDECLOAK] Enclave requested a doken refresh but no doken is present (post-logout). Falling through to interactive login.');
+        __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDECLOAK] Enclave requested a doken refresh but no doken is present. Falling through to interactive login.');
         await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_reloginInteractively).call(this);
         throw new Error('[TIDECLOAK] No doken found - redirecting to interactive login');
     }
@@ -2053,6 +1980,7 @@ async function _TideCloak_provideDokenOrRelogin() {
         throw new Error('Unable to build voucher URL, realm URL not configured');
     return `${realmUrl}/tidevouchers/fromUserSession?sessionId=${encodeURIComponent(sid)}`;
 }, _TideCloak_setToken = function _TideCloak_setToken(token, refreshToken, idToken, timeLocal, doken) {
+    var _a, _b;
     if (this.tokenTimeoutHandle) {
         clearTimeout(this.tokenTimeoutHandle);
         this.tokenTimeoutHandle = undefined;
@@ -2084,7 +2012,7 @@ async function _TideCloak_provideDokenOrRelogin() {
         if (timeLocal) {
             this.timeSkew = Math.floor(timeLocal / 1000) - this.tokenParsed.iat;
         }
-        if (typeof this.timeSkew === 'number') {
+        if (this.timeSkew !== null) {
             __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDECLOAK] Estimated time difference between browser and server is ' + this.timeSkew + ' seconds');
             if (this.onTokenExpired) {
                 const expiresIn = (this.tokenParsed.exp - (new Date().getTime() / 1000) + this.timeSkew) * 1000;
@@ -2106,38 +2034,26 @@ async function _TideCloak_provideDokenOrRelogin() {
         delete this.resourceAccess;
         this.authenticated = false;
     }
-    // Tide doken handling
     if (doken) {
         this.doken = doken;
         this.dokenParsed = decodeToken(doken);
-        if (this.requestEnclave && typeof this.requestEnclave.updateDoken === 'function') {
-            this.requestEnclave.updateDoken(this.doken);
-        }
+        (_b = (_a = this.requestEnclave) === null || _a === void 0 ? void 0 : _a.updateDoken) === null || _b === void 0 ? void 0 : _b.call(_a, this.doken);
     }
     else {
         delete this.doken;
         delete this.dokenParsed;
-        // No doken present (e.g. post-logout / flushed state). Do NOT push a
-        // "doken refresh" into the enclave: refreshing with an undefined doken
-        // wedges the hidden enclave ("Expecting doken in request",
-        // TIDE-SWE-UNHANDLED) and blocks the silent re-auth that runs after
-        // logout. Instead tear the stale enclave(s) down so (a) no dokenless
-        // refresh is ever sent, (b) the persistent user-gesture listener can no
-        // longer reopen a dokenless hidden enclave (#ensureRequestEnclaveOpen
-        // no-ops once requestEnclave is cleared), and (c) the next authenticated
-        // flow re-creates a fresh enclave from a valid doken via
-        // initRequestEnclave(). The app is then free to fall through to an
-        // interactive login, which recovers cleanly.
+        // A dokenless enclave can't be driven, so close it; the next Tide
+        // operation creates a fresh one from a new doken.
         __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_teardownEnclaves).call(this);
     }
 }, _TideCloak_teardownEnclaves = function _TideCloak_teardownEnclaves() {
-    for (const key of ['requestEnclave', 'approvalEnclave']) {
+    var _a;
+    for (const key of /** @type {const} */ (['requestEnclave', 'approvalEnclave'])) {
         const enclave = this[key];
         if (!enclave)
             continue;
         try {
-            if (typeof enclave.close === 'function')
-                enclave.close();
+            (_a = enclave.close) === null || _a === void 0 ? void 0 : _a.call(enclave);
         }
         catch (error) {
             __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDECLOAK] Failed to close ' + key + ': ' + (error instanceof Error ? error.message : error));
@@ -2149,6 +2065,13 @@ async function _TideCloak_provideDokenOrRelogin() {
         return;
     }
     return `${stripTrailingSlash(this.authServerUrl)}/realms/${encodeURIComponent(/** @type {string} */ (this.realm))}`;
+}, _TideCloak_getIssuerUrl = function _TideCloak_getIssuerUrl() {
+    // For OIDC provider mode, use the issuer from metadata
+    if (this.issuer) {
+        return this.issuer;
+    }
+    // For TideCloak mode, use the realm URL
+    return __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getRealmUrl).call(this);
 }, _TideCloak_createLogger = function _TideCloak_createLogger(fn) {
     return (message) => {
         if (this.enableLogging) {
@@ -2447,7 +2370,7 @@ function base64ToBytes(base64) {
     const len = binString.length;
     const bytes = new Uint8Array(len);
     for (let i = 0; i < len; i++) {
-        bytes[i] = binString.codePointAt(i);
+        bytes[i] = /** @type {number} */ (binString.codePointAt(i));
     }
     return bytes;
 }