Switch to a more sensible error reporting system

1 files changed, 807 insertions, 602 deletions

diff --git a/po/disfluid.pot b/po/disfluid.pot
index df099d6..3c77ced 100644
--- a/po/disfluid.pot
+++ b/po/disfluid.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: disfluid SNAPSHOT\n"
 "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n"
-"POT-Creation-Date: 2021-08-12 18:50+0200\n"
+"POT-Creation-Date: 2021-08-12 18:55+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -122,1081 +122,1087 @@ msgstr ""
 msgid "Usage: generate-key [NUMBER OF BITS | CURVE]\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1081
-msgid "that’s how it is"
+#: src/scm/webid-oidc/access-token.scm:72
+#, scheme-format
+msgid "this is not an access token, because it is not even a JWS: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1086
-#, scheme-format
-msgid "the value ~s is not a base64 string (because ~a)"
+#: src/scm/webid-oidc/access-token.scm:74
+msgid "this is not an access token, because it is not even a JWS"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1089
+#: src/scm/webid-oidc/access-token.scm:77 src/scm/webid-oidc/dpop-proof.scm:96
 #, scheme-format
-msgid "the value ~s is not JSON (because ~a)"
+msgid "this is not an access token: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1092
-#, scheme-format
-msgid "the value ~s is not Turtle (because ~a)"
+#: src/scm/webid-oidc/access-token.scm:79 src/scm/webid-oidc/dpop-proof.scm:98
+msgid "this is not an access token"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1095
+#: src/scm/webid-oidc/access-token.scm:101
+#: src/scm/webid-oidc/authorization-code.scm:88
+#: src/scm/webid-oidc/oidc-id-token.scm:96
 #, scheme-format
-msgid "the value ~s does not identify an elleptic curve"
+msgid "the payload is missing ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1100
+#: src/scm/webid-oidc/access-token.scm:123
+#: src/scm/webid-oidc/authorization-code.scm:104
+#: src/scm/webid-oidc/oidc-id-token.scm:117
 #, scheme-format
-msgid "the value ~s does not identify a JWK (because ~a)"
+msgid "the \"webid\" field should be an URI, ~s is given"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1102
+#: src/scm/webid-oidc/access-token.scm:130
+#: src/scm/webid-oidc/oidc-id-token.scm:124
 #, scheme-format
-msgid "the value ~s does not identify a JWK"
+msgid "the \"iss\" field should be an URI, ~s is given"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1107
+#: src/scm/webid-oidc/access-token.scm:135
 #, scheme-format
-msgid "the value ~s does not identify a public JWK (because ~a)"
+msgid "the \"aud\" field should be set to \"solid\", ~s is given"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1109
+#: src/scm/webid-oidc/access-token.scm:142
+#: src/scm/webid-oidc/oidc-id-token.scm:152
 #, scheme-format
-msgid "the value ~s does not identify a public JWK"
+msgid "the \"iat\" field should be a timestamp, ~s is given"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1114
+#: src/scm/webid-oidc/access-token.scm:149
+#: src/scm/webid-oidc/authorization-code.scm:125
+#: src/scm/webid-oidc/oidc-id-token.scm:159
 #, scheme-format
-msgid "the value ~s does not identify a private JWK (because ~a)"
+msgid "the \"exp\" field should be a timestamp, ~s is given"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1116
-#, scheme-format
-msgid "the value ~s does not identify a private JWK"
+#: src/scm/webid-oidc/access-token.scm:158
+msgid "the \"cnf\" / \"jkt\" field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1121
+#: src/scm/webid-oidc/access-token.scm:166
 #, scheme-format
-msgid "the value ~s does not identify a JWKS (because ~a)"
+msgid "the \"cnf\" / \"jkt\" field should be a string, ~s is given"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1123
+#: src/scm/webid-oidc/access-token.scm:171
 #, scheme-format
-msgid "the value ~s does not identify a JWKS"
+msgid "the \"cnf\" field should be an object, ~s is given"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1126
+#: src/scm/webid-oidc/access-token.scm:178
+#: src/scm/webid-oidc/authorization-code.scm:111
 #, scheme-format
-msgid "the value ~s does not identify a hash algorithm"
+msgid "the \"client_id\" field should be an URI, ~s is given"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1129
+#: src/scm/webid-oidc/access-token.scm:238
 #, scheme-format
-msgid "the value ~s is not an alist or misses key ~s"
+msgid "the access token is invalid: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1132
-#, scheme-format
-msgid "the value ~s is not a JWS header (because ~a)"
+#: src/scm/webid-oidc/access-token.scm:240
+msgid "the access token is invalid"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1135
+#: src/scm/webid-oidc/access-token.scm:256
+#: src/scm/webid-oidc/oidc-id-token.scm:236
 #, scheme-format
-msgid "the value ~s is not a JWS payload (because ~a)"
+msgid "I cannot query the identity provider configuration: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1138
-#, scheme-format
-msgid "the value ~s is not a JWS (because ~a)"
+#: src/scm/webid-oidc/access-token.scm:258
+#: src/scm/webid-oidc/oidc-id-token.scm:238
+msgid "I cannot query the identity provider configuratioon"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1141
+#: src/scm/webid-oidc/access-token.scm:275
 #, scheme-format
-msgid "the string ~s cannot be split in 3 parts with ~s"
+msgid "I cannot query the identity provider public keys: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1144
-#, scheme-format
-msgid ""
-"all key candidates failed to verify signature ~s with algorithm ~s and "
-"payload ~a (there were ~a: ~s)"
+#: src/scm/webid-oidc/access-token.scm:277
+msgid "I cannot query the identity provider public keys"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1147
+#: src/scm/webid-oidc/access-token.scm:293
 #, scheme-format
-msgid "I cannot decode JWS ~a (because ~a)"
+msgid "the access token is signed in the future, ~a, relative to current ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1150
+#: src/scm/webid-oidc/access-token.scm:302
 #, scheme-format
-msgid "I cannot encode JWS ~a (because ~a)"
+msgid "the access token expired ~a, which is in the past (from ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1153
+#: src/scm/webid-oidc/access-token.scm:316
 #, scheme-format
-msgid ""
-"the server request unexpectedly failed with code ~a and reason phrase ~s"
+msgid "cannot encode the access token: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1158
-#, scheme-format
-msgid "the header ~a should not have the value ~s"
+#: src/scm/webid-oidc/access-token.scm:318
+msgid "cannot encode the access token"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1160
+#: src/scm/webid-oidc/authorization-code.scm:63
 #, scheme-format
-msgid "the header ~a should be present"
+msgid "this is not an authorization code, because it is not even a JWS: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1163
+#: src/scm/webid-oidc/authorization-code.scm:65
+msgid "this is not an authorization code, because it is not even a JWS"
+msgstr ""
+
+#: src/scm/webid-oidc/authorization-code.scm:68
 #, scheme-format
-msgid "the server response wasn't expected: ~s (because ~a)"
+msgid "this is not an authorization code: ~a"
+msgstr ""
+
+#: src/scm/webid-oidc/authorization-code.scm:70
+msgid "this is not an authorization code"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1169
+#: src/scm/webid-oidc/authorization-code.scm:118
 #, scheme-format
-msgid "the value ~s is not an OIDC configuration (because ~a)"
+msgid "the \"jti\" field should be a string, ~s is given"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1174
+#: src/scm/webid-oidc/authorization-code.scm:169
 #, scheme-format
-msgid "the webid field is incorrect: ~s"
+msgid "the authorization code is invalid: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1175
-msgid "the webid field is missing"
+#: src/scm/webid-oidc/authorization-code.scm:171
+msgid "the authorization code is invalid"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1179
+#: src/scm/webid-oidc/authorization-code.scm:185
 #, scheme-format
-msgid "the sub field is incorrect: ~s"
+msgid "the authorization expired ~a, which is in the past (from ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1180
-msgid "the sub field is missing"
+#: src/scm/webid-oidc/authorization-code.scm:201
+#, scheme-format
+msgid "cannot encode the authorization code: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1184
-#, scheme-format
-msgid "the iss field is incorrect: ~s"
+#: src/scm/webid-oidc/authorization-code.scm:203
+msgid "cannot encode the authorization code"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1185
-msgid "the iss field is missing"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:52
+#: src/scm/webid-oidc/hello-world.scm:40 src/scm/webid-oidc/hello-world.scm:164
+#: src/scm/webid-oidc/hello-world.scm:184
+msgid "xml-lang|en"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1189
-#, scheme-format
-msgid "the aud field is incorrect: ~s"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:67
+msgid "page-title|Authorization"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1190
-msgid "the aud field is missing"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:72
+msgid "Authorize this anonymous application?"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1194
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:73
 #, scheme-format
-msgid "the iat field is incorrect: ~s"
+msgid "Authorize <a href=~s>~a</a>?"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1195
-msgid "the iat field is missing"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:75
+msgid "Do you want to authorize this application to represent you?"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1199
-#, scheme-format
-msgid "the exp field is incorrect: ~s"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:85
+msgid "Please retry your password:"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1200
-msgid "the exp field is missing"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:86
+msgid "Please enter your password:"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1204
-#, scheme-format
-msgid "the cnf/jkt field is incorrect: ~s"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:91
+msgid "Allow"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1205
-msgid "the cnf/jkt field is missing"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:97
+msgid "Bad request"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1209
-#, scheme-format
-msgid "the client-id field is incorrect: ~s"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:102
+msgid "The application did not set the <emph>client_id</emph> parameter."
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1210
-msgid "the client-id field is missing"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:107
+msgid "The application did not set the <emph>redirect_uri</emph> parameter."
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1214
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:149
-#, scheme-format
-msgid "the redirect_uris field is incorrect: ~s"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:112
+msgid "Sorry, no more information is available."
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1215
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:150
-msgid "the redirect_uris field is missing"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:117
+msgid "The application you are trying to authorize behaved unexpectedly."
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1219
-#, scheme-format
-msgid "the typ field is incorrect: ~s"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:130
+msgid "Redirecting..."
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1220
-msgid "the typ field is missing"
+#: src/scm/webid-oidc/authorization-page-unsafe.scm:135
+#, scheme-format
+msgid ""
+"<p><a href=~s>~a</a> can now log in on your behalf. You still need to adjust "
+"permissions.</p>"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1224
+#: src/scm/webid-oidc/cache.scm:94
 #, scheme-format
-msgid "the jwk field is incorrect: ~s (because ~a)"
+msgid "Dropping cache item ~a.~%"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1226
-msgid "the jwk field is missing"
+#: src/scm/webid-oidc/cache.scm:100
+#, scheme-format
+msgid "Could not clean file ~a.~%"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1230
+#: src/scm/webid-oidc/cache.scm:106
 #, scheme-format
-msgid "the jti field is incorrect: ~s"
+msgid "While cleaning the cache: ~a: ~a~%"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1231
-msgid "the jti field is missing"
+#: src/scm/webid-oidc/cache.scm:166
+#, scheme-format
+msgid "Cache miss for ~a: ~s~%"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1235
+#: src/scm/webid-oidc/cache.scm:261
 #, scheme-format
-msgid "the nonce field is incorrect: ~s"
+msgid "Cache entry for ~a varies.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1236
-msgid "the nonce field is missing"
+#: src/scm/webid-oidc/catalog.scm:166
+msgid "invalid relative URI"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1240
+#: src/scm/webid-oidc/catalog.scm:245
 #, scheme-format
-msgid "the htm field is incorrect: ~s"
+msgid "Unsupported delegate catalog URI scheme: ~s\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1241
-msgid "the htm field is missing"
+#: src/scm/webid-oidc/client/accounts.scm:418
+msgid "The refresh token has expired."
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1245
-#, scheme-format
-msgid "the htu field is incorrect: ~s"
+#: src/scm/webid-oidc/client/accounts.scm:434
+msgid "The token response did not set the content type."
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1246
-msgid "the htu field is missing"
+#: src/scm/webid-oidc/client/accounts.scm:442
+msgid "The token endpoint did not respond in UTF-8."
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1250
+#: src/scm/webid-oidc/client/accounts.scm:454
 #, scheme-format
-msgid "the ath field is incorrect: ~s"
+msgid "The token response has content-type ~s, not application/json."
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1251
-msgid "the ath field is missing"
+#: src/scm/webid-oidc/client/accounts.scm:464
+msgid "The token response is not valid JSON."
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1253
+#: src/scm/webid-oidc/client/accounts.scm:477
 #, scheme-format
-msgid "~s is not an access token (because ~a)"
+msgid "The token response did not include an ID token: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1256
+#: src/scm/webid-oidc/client/accounts.scm:485
 #, scheme-format
-msgid "~s is not an access token header (because ~a)"
+msgid "The token response did not include an access token: ~s\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1259
+#: src/scm/webid-oidc/client/accounts.scm:496
 #, scheme-format
-msgid "~s is not an access token payload (because ~a)"
+msgid "the ID token signature is invalid: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1262
-#, scheme-format
-msgid "~s is not a DPoP proof (because ~a)"
+#: src/scm/webid-oidc/client/accounts.scm:498
+msgid "the ID token signature is invalid"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1265
+#: src/scm/webid-oidc/client/accounts.scm:513
 #, scheme-format
-msgid "~s is not a DPoP proof header (because ~a)"
+msgid "the ID token delivered by the identity provider for ~s has ~s as webid"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1268
+#: src/scm/webid-oidc/client/accounts.scm:522
 #, scheme-format
-msgid "~s is not a DPoP proof payload (because ~a)"
+msgid "The ID token delivered by the identity provider ~s is for issuer ~s."
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1271
+#: src/scm/webid-oidc/client-manifest.scm:111
 #, scheme-format
-msgid "I cannot fetch the issuer configuration of ~a (because ~a)"
+msgid "this is not a client manifest: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1278
-#, scheme-format
-msgid "I cannot fetch the JWKS of ~a at ~a (because ~a)"
+#: src/scm/webid-oidc/client-manifest.scm:113
+msgid "this is not a client manifest"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1289
-#, scheme-format
-msgid "the HTTP method is signed for ~s, but ~s was requested"
+#: src/scm/webid-oidc/client-manifest.scm:117
+msgid ""
+"<p>The client manifest could\n"
+"not be queried. It can be because the client application is down, or\n"
+"it is incomplete, or unusable for other reasons.</p>"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1292
+#: src/scm/webid-oidc/client-manifest.scm:144
 #, scheme-format
-msgid "the HTTP uri is signed for ~a, but ~a was requested"
+msgid "the client manifest is missing ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1295
+#: src/scm/webid-oidc/client-manifest.scm:155
 #, scheme-format
-msgid "the date is ~a, but the DPoP proof is signed in the future at ~a"
+msgid "~s is an invalid \"client_id\" value, because it is not an URI"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1299
-#, scheme-format
-msgid "the date is ~a, but the DPoP proof was signed too long ago at ~a"
+#: src/scm/webid-oidc/client-manifest.scm:160
+msgid "at least one of the redirect URIs is not a proper URI"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1308
-#, scheme-format
-msgid "the key ~s does not hash to ~a"
+#: src/scm/webid-oidc/client-manifest.scm:162
+msgid "the \"redirect_uris\" field should be a vector of URIs"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1310
-#, scheme-format
-msgid "the key confirmation of ~s failed (because ~a)"
+#: src/scm/webid-oidc/client-manifest.scm:167
+msgid "the client manifest should be a JSON object"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1312
+#: src/scm/webid-oidc/client-manifest.scm:189
 #, scheme-format
-msgid "the key confirmation of ~s failed"
+msgid "the client manifest does not allow ~s as a redirection uri"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1317
+#: src/scm/webid-oidc/client-manifest.scm:193
 #, scheme-format
-msgid "the DPoP proof is bound to an access token with hash ~s, not ~s"
+msgid ""
+"<p>The application wants to get your\n"
+"authorization through <strong>~s</strong>, which is not\n"
+"approved.</p>"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1319
-#, scheme-format
-msgid "the DPoP proof should be bound to the access token ~s"
+#: src/scm/webid-oidc/client-manifest.scm:221
+msgid "cannot serve the public manifest"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1322
+#: src/scm/webid-oidc/client-manifest.scm:242
 #, scheme-format
-msgid "the jti ~s has already been found (because ~a)"
+msgid "cannot fetch the client manifest ~s: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1325
+#: src/scm/webid-oidc/client-manifest.scm:245
 #, scheme-format
-msgid "I cannot decode ~s as an access token (because ~a)"
+msgid "cannot fetch the client manifest ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1328
+#: src/scm/webid-oidc/client-manifest.scm:264
 #, scheme-format
-msgid "I cannot encode ~s as an access token with key ~s (because ~a)"
+msgid "the client manifest is dereferenced from ~s, but it pretends to be ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1331
+#: src/scm/webid-oidc/dpop-proof.scm:91
 #, scheme-format
-msgid "I cannot decode ~s as a DPoP proof (because ~a)"
+msgid "this is not a DPoP proof, because it is not even a JWS: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1334
-#, scheme-format
-msgid "I cannot encode ~s as a DPoP proof (because ~a)"
+#: src/scm/webid-oidc/dpop-proof.scm:93
+msgid "this is not a DPoP proof, because it is not even a JWS"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1337
+#: src/scm/webid-oidc/dpop-proof.scm:124
 #, scheme-format
-msgid "I could not fetch a RDF graph at ~a (because ~a)"
+msgid "the DPoP proof is missing ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1340
+#: src/scm/webid-oidc/dpop-proof.scm:147
 #, scheme-format
-msgid "~s is not a client manifest (because ~a)"
+msgid "the \"jti\" field should be a string, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1343
+#: src/scm/webid-oidc/dpop-proof.scm:154
 #, scheme-format
-msgid "~s does not authorize redirection URI ~a"
+msgid "the \"htm\" field should be a string, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1346
-msgid "I cannot serve a public manifest"
+#: src/scm/webid-oidc/dpop-proof.scm:161
+#, scheme-format
+msgid "the \"htu\" field should be an URI, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1348
+#: src/scm/webid-oidc/dpop-proof.scm:168
 #, scheme-format
-msgid "~a does not have a client manifest registration triple"
+msgid "the \"iat\" field should be a timestamp, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1351
+#: src/scm/webid-oidc/dpop-proof.scm:175
 #, scheme-format
-msgid "the client manifest at ~a is advertised for ~a"
+msgid "the \"ath\" field should be an encoded JWT, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1354
+#: src/scm/webid-oidc/dpop-proof.scm:184
 #, scheme-format
-msgid "I could not fetch the client manifest of ~a (because ~a)"
+msgid "the \"alg\" field should be a string, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1357
+#: src/scm/webid-oidc/dpop-proof.scm:189
 #, scheme-format
-msgid "~s is not an authorization code (because ~a)"
+msgid "the \"typ\" field should be \"dpop+jwt\", not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1360
+#: src/scm/webid-oidc/dpop-proof.scm:195
 #, scheme-format
-msgid "~s is not an authorization code header (because ~a)"
+msgid "the \"jwk\" field should be a valid public key, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1363
+#: src/scm/webid-oidc/dpop-proof.scm:274
 #, scheme-format
-msgid "~s is not an authorization code payload (because ~a)"
+msgid "the DPoP proof is signed for ~s, but it is issued to ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1366
+#: src/scm/webid-oidc/dpop-proof.scm:305
 #, scheme-format
-msgid "the current time is ~a, and the authorization code expired at ~a"
+msgid "the DPoP proof cannot be decoded: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1370
+#: src/scm/webid-oidc/dpop-proof.scm:307
+msgid "the DPoP proof cannot be decoded"
+msgstr ""
+
+#: src/scm/webid-oidc/dpop-proof.scm:317
 #, scheme-format
-msgid "I cannot decode ~s as an authorization code (because ~a)"
+msgid "the DPoP proof is signed for access through ~s, but it is used with ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1373
+#: src/scm/webid-oidc/dpop-proof.scm:331
 #, scheme-format
-msgid "I cannot encode ~s as an authorization code (because ~a)"
+msgid ""
+"the DPoP proof is signed in the future, ~a, relative to the current date, ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1376
+#: src/scm/webid-oidc/dpop-proof.scm:340
 #, scheme-format
-msgid "there is no such refresh token as ~s"
+msgid "the DPoP proof is too old, it was signed ~a and now it is ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1379
+#: src/scm/webid-oidc/dpop-proof.scm:352
 #, scheme-format
 msgid ""
-"the refresh token is bound to a key confirmed as ~s, but it is used with key "
-"~s"
+"the DPoP proof should go along with an access token hashed to ~s, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1382
-#, scheme-format
-msgid "I cannot decode ~s as an ID token (because ~a)"
+#: src/scm/webid-oidc/dpop-proof.scm:361 src/scm/webid-oidc/dpop-proof.scm:372
+msgid "the DPoP proof is signed with the wrong key"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1385
+#: src/scm/webid-oidc/dpop-proof.scm:370
 #, scheme-format
-msgid "I cannot encode ~s as an ID token (because ~a)"
+msgid "the DPoP proof is signed with the wrong key: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1388
+#: src/scm/webid-oidc/dpop-proof.scm:381
+msgid "the cnf/check function returned #f"
+msgstr ""
+
+#: src/scm/webid-oidc/dpop-proof.scm:392
 #, scheme-format
-msgid "the grant type ~s is not supported"
+msgid "cannot encode a DPoP proof: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1391
-msgid "there is no authorization code in the request"
+#: src/scm/webid-oidc/dpop-proof.scm:394
+msgid "cannot encode a DPoP proof"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1393
-msgid "there is no refresh token in the request"
+#: src/scm/webid-oidc/example-app.scm:56
+msgid "Main menu:\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1395
+#: src/scm/webid-oidc/example-app.scm:59
 #, scheme-format
-msgid "~s is not an ID token (because ~a)"
+msgid "~a. Log in with ~a (issued by ~a): ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1398
-#, scheme-format
-msgid "~s is not an ID token header (because ~a)"
+#: src/scm/webid-oidc/example-app.scm:64
+msgid "a new user"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1401
-#, scheme-format
-msgid "~s is not an ID token payload (because ~a)"
+#: src/scm/webid-oidc/example-app.scm:68
+msgid "status|currently logged in"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1404
-#, scheme-format
-msgid ""
-"I couldn’t set the locale to ~s as an approximation of the client locale ~s"
+#: src/scm/webid-oidc/example-app.scm:70
+msgid "status|offline (but accessible)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1407
-#, scheme-format
-msgid "~s does not admit ~s as an identity provider"
+#: src/scm/webid-oidc/example-app.scm:71
+msgid "status|offline (inaccessible)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1410
-#, scheme-format
+#: src/scm/webid-oidc/example-app.scm:72
+msgid "status|not initialized yet"
+msgstr ""
+
+#: src/scm/webid-oidc/example-app.scm:74
 msgid ""
-"~a is neither an identity provider (because ~a) nor a webid (because ~a)"
+"Type a number to log in, prefix it with '-' to delete the account, or type + "
+"to create a new account.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1415
+#: src/scm/webid-oidc/example-app.scm:91
 #, scheme-format
-msgid "you don’t have a refresh token for identity ~a certified by ~a in ~s"
+msgid "Please visit: ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1420
-#, scheme-format
-msgid "all identity provider candidates for ~a failed: ~a"
+#: src/scm/webid-oidc/example-app.scm:92
+msgid "Then, paste the authorization code you get:\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1424
+#: src/scm/webid-oidc/example-app.scm:98
 #, scheme-format
-msgid "~s failed (because ~a)"
+msgid "I could not negociate an access token.  ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1427
-msgid ", "
+#: src/scm/webid-oidc/example-app.scm:102
+msgid ""
+"The refresh token has expired, it is not possible to use that account "
+"offline.\n"
+msgstr ""
+
+#: src/scm/webid-oidc/example-app.scm:107
+msgid "Please enter an URI to GET:\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1429
+#: src/scm/webid-oidc/fetch.scm:58
 #, scheme-format
-msgid "no resource has been found to serve URI path ~s"
+msgid "cannot fetch ~s as linked data: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1432
+#: src/scm/webid-oidc/fetch.scm:60
 #, scheme-format
-msgid "the resource kind ~s is absent for the resource at ~s"
+msgid "cannot fetch ~s as linked data"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1435
+#: src/scm/webid-oidc/fetch.scm:74
 #, scheme-format
-msgid "no resource has been found to serve URI path ~s, but ~s exists"
+msgid "unexpected response from the server: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1438
-msgid "the root storage cannot be deleted"
+#: src/scm/webid-oidc/fetch.scm:76
+msgid "unexpected response from the server"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1440
+#: src/scm/webid-oidc/fetch.scm:83
 #, scheme-format
-msgid "the container ~s should be emptied before being deleted"
+msgid "the request failed unexpectedly with ~s ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1443
+#: src/scm/webid-oidc/fetch.scm:111
 #, scheme-format
-msgid "the group ~s cannot be fetched (because ~a)"
+msgid "cannot negociate a recognized RFD content type, got ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1447
-#, scheme-format
-msgid "the containment triples in the request to update ~s are not up to date"
+#: src/scm/webid-oidc/hello-world.scm:61 src/scm/webid-oidc/program.scm:225
+msgid "command-line|version"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1450
-#, scheme-format
-msgid "the server cannot process resources with the ~s content-type"
+#: src/scm/webid-oidc/hello-world.scm:63 src/scm/webid-oidc/program.scm:229
+msgid "command-line|complete-corresponding-source"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1453
-#, scheme-format
-msgid ""
-"the client wants to create a resource at ~s, which is reserved for an "
-"auxiliary resource"
+#: src/scm/webid-oidc/hello-world.scm:65 src/scm/webid-oidc/program.scm:231
+msgid "command-line|help"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1456
-#, scheme-format
-msgid ""
-"the operation on ~s by ~a is refused, because it’s not by ~s and the access "
-"control forbids the following mode of operation: ~s"
+#: src/scm/webid-oidc/hello-world.scm:67
+msgid "command-line|port"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1460
-msgid "an anonymous user"
+#: src/scm/webid-oidc/hello-world.scm:69 src/scm/webid-oidc/program.scm:263
+msgid "command-line|log-file"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1465
-#, scheme-format
-msgid ""
-"the client precondition failed for ~s: it allows for ~s, forbids ~s, but the "
-"resource has a representation of ~s"
+#: src/scm/webid-oidc/hello-world.scm:71 src/scm/webid-oidc/program.scm:265
+msgid "command-line|error-file"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1467
+#: src/scm/webid-oidc/hello-world.scm:83
 #, scheme-format
 msgid ""
-"the client precondition failed for ~s: it allows for ~s, forbids ~s, but the "
-"resource has no representation"
+"~a [OPTIONS]...\n"
+"\n"
+"Display your identity contained in the XXX-Agent header.\n"
+"\n"
+"This program is covered by the GNU Affero GPL, version 3 or\n"
+"later. This license requires you to provide a way for any user over\n"
+"the network to download the complete corresponding source code (with\n"
+"your modifications) at no cost. The server adds a \"Source:\" header\n"
+"to all responses.\n"
+"\n"
+"Options:\n"
+"  -S MEANS, --~a=MEANS:\n"
+"      specify a way to download the complete corresponding source\n"
+"      code. For instance, this would be an URI pointing to a tarball.\n"
+"  -h, --~a:\n"
+"      display this help message and exit.\n"
+"  -v, --~a:\n"
+"      display the version information (~a) and exit.\n"
+"  -p PORT, --~a=PORT:\n"
+"      set the port to bind.\n"
+"  -l FILE.log, --~a=FILE.log:\n"
+"    redirect the program standard output to FILE.log.\n"
+"  -e FILE.err, --~a=FILE.err:\n"
+"    redirect the program errors to FILE.err.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1470
+#: src/scm/webid-oidc/hello-world.scm:116
 #, scheme-format
+msgid "~a version ~a\n"
+msgstr ""
+
+#: src/scm/webid-oidc/hello-world.scm:125 src/scm/webid-oidc/program.scm:624
 msgid ""
-"the client wanted a response with a content type among ~s, but the resource "
-"at ~s has content-type ~s which cannot be converted to one of them"
+"You are legally required to link to the complete corresponding source code.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1477
-msgid "that’s it"
+#: src/scm/webid-oidc/hello-world.scm:135
+msgid "The port should be a number between 0 and 65535.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1481
-#, scheme-format
-msgid "~a and ~a"
+#: src/scm/webid-oidc/hello-world.scm:156
+#: src/scm/webid-oidc/resource-server.scm:320
+msgid "reason-phrase|Unauthorized"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1484
-#, scheme-format
-msgid "~a, ~a"
+#: src/scm/webid-oidc/hello-world.scm:176
+#: src/scm/webid-oidc/resource-server.scm:328
+msgid "reason-phrase|Method Not Allowed"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1488
-#, scheme-format
-msgid "the signature ~a does not match key ~s with payload ~a"
+#: src/scm/webid-oidc/identity-provider.scm:72
+msgid "Warning: generating a new key pair."
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1491
-#, scheme-format
-msgid "the request failed unexpectedly with code ~a: ~s"
+#: src/scm/webid-oidc/identity-provider.scm:132
+msgid "reason-phrase|Not Found"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1495
-msgid "there is an undefined variable"
+#: src/scm/webid-oidc/identity-provider.scm:139
+#: src/scm/webid-oidc/token-endpoint.scm:111
+#: src/scm/webid-oidc/token-endpoint.scm:137
+#: src/scm/webid-oidc/token-endpoint.scm:164
+msgid "xml-langlen"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1497
+#: src/scm/webid-oidc/jti.scm:59
 #, scheme-format
-msgid "the origin is ~a"
+msgid "a replay has been detected with JTI ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1500
+#: src/scm/webid-oidc/jwk.scm:76
 #, scheme-format
-msgid "a message is attached: ~a"
+msgid "the JWK is invalid: ~a"
+msgstr ""
+
+#: src/scm/webid-oidc/jwk.scm:78
+msgid "the JWK is invalid"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1503
+#: src/scm/webid-oidc/jwk.scm:87
 #, scheme-format
-msgid "the values ~s are problematic"
+msgid "unknown key type ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1506
+#: src/scm/webid-oidc/jwk.scm:103
 #, scheme-format
-msgid "there is a kind (~s) and args ~s"
+msgid "the public JWK is invalid: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1509
-msgid "there is an assertion failure"
+#: src/scm/webid-oidc/jwk.scm:105
+msgid "the public JWK is invalid"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1511
+#: src/scm/webid-oidc/jwk.scm:136
 #, scheme-format
-msgid "the program quits with code ~a"
+msgid "cannot extract the public part of the key: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1514
-msgid "the program cannot recover from this exception"
+#: src/scm/webid-oidc/jwk.scm:138
+msgid "cannot extract the public part of the key"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1516
-msgid "there is an external error"
+#: src/scm/webid-oidc/jwk.scm:188
+msgid "the JWKS is invalid, because it does not have keys"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1518
-msgid "there is an error"
+#: src/scm/webid-oidc/jwk.scm:197
+#, scheme-format
+msgid "the JWKS is invalid: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:1520
-#, scheme-format
-msgid "there is an unknown exception of kind ~s"
+#: src/scm/webid-oidc/jwk.scm:199
+msgid "the JWKS is invalid"
 msgstr ""
 
-#: src/scm/webid-oidc/identity-provider.scm:68
-msgid "Warning: generating a new key pair."
+#: src/scm/webid-oidc/jws.scm:72
+#, scheme-format
+msgid "the JWS is invalid: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:45
-msgid "xml-lang|en"
+#: src/scm/webid-oidc/jws.scm:74
+msgid "the JWS is invalid"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:61
-msgid "page-title|Authorization"
+#: src/scm/webid-oidc/jws.scm:93
+msgid "the JWS header does not have an \"alg\" field"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:66
-msgid "Authorize this anonymous application?"
+#: src/scm/webid-oidc/jws.scm:101
+msgid "invalid JSON object as payload"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:67
+#: src/scm/webid-oidc/jws.scm:110
 #, scheme-format
-msgid "Authorize <a href=~s>~a</a>?"
+msgid "invalid signature algorithm: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:69
-msgid "Do you want to authorize this application to represent you?"
+#: src/scm/webid-oidc/jws.scm:114
+#, scheme-format
+msgid "invalid \"alg\" value: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:79
-msgid "Please retry your password:"
+#: src/scm/webid-oidc/jws.scm:119
+msgid "invalid JSON object as header"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:80
-msgid "Please enter your password:"
+#: src/scm/webid-oidc/jws.scm:121
+msgid "this is not a pair"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:85
-msgid "Allow"
+#: src/scm/webid-oidc/jws.scm:138
+msgid "the encoded JWS is not in 3 parts"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:91
-msgid "Bad request"
+#: src/scm/webid-oidc/jws.scm:149
+#, scheme-format
+msgid ""
+"the encoded JWS header or payload is not a JSON object encoded in base64: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:96
-msgid "The application did not set the <emph>client_id</emph> parameter."
+#: src/scm/webid-oidc/jws.scm:151
+msgid ""
+"the encoded JWS header or payload is not a JSON object encoded in base64"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:101
-msgid "The application did not set the <emph>redirect_uri</emph> parameter."
+#: src/scm/webid-oidc/jws.scm:210
+msgid "the JWS is not signed by any of the expected set of public keys"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:114
+#: src/scm/webid-oidc/jws.scm:221
 #, scheme-format
-msgid "the value ~s is not a base64 string."
+msgid "while verifying the JWS signature: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:117
-msgid "the following value is not JSON:"
+#: src/scm/webid-oidc/jws.scm:223
+msgid "an unexpected error happened while verifying a JWS"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:120
-msgid "the following value is not Turtle:"
-msgstr ""
-
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:123
+#: src/scm/webid-oidc/jws.scm:240
 #, scheme-format
-msgid ""
-"the server request unexpectedly failed with code ~a and reason phrase ~s."
+msgid "cannot decode a JWS: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:128
-#, scheme-format
-msgid "the header ~a should not have the value ~s.\n"
+#: src/scm/webid-oidc/jws.scm:242
+msgid "cannot decode a JWS"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:130
+#: src/scm/webid-oidc/jws.scm:262
 #, scheme-format
-msgid "the header ~a should be present."
+msgid "cannot encode a JWS: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:134
-msgid "the server response wasn’t expected:"
+#: src/scm/webid-oidc/jws.scm:264
+msgid "cannot encode a JWS"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:143
+#: src/scm/webid-oidc/oidc-configuration.scm:59
 #, scheme-format
-msgid "the client_id field is incorrect: ~s"
+msgid "the OIDC configuration is invalid: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:144
-msgid "the client_id field is missing"
+#: src/scm/webid-oidc/oidc-configuration.scm:61
+msgid "the OIDC configuration is invalid"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:153
+#: src/scm/webid-oidc/oidc-configuration.scm:77
 #, scheme-format
-msgid "I could not fetch a RDF graph at ~a;"
+msgid "the OIDC configuration does not have: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:157
-msgid "this is not a client manifest:"
+#: src/scm/webid-oidc/oidc-configuration.scm:92
+#, scheme-format
+msgid "invalid JWKS URI: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:162
+#: src/scm/webid-oidc/oidc-configuration.scm:99
 #, scheme-format
-msgid "the manifest does not authorize redirection URI ~a:"
+msgid "invalid token endpoint: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:167
+#: src/scm/webid-oidc/oidc-configuration.scm:108
 #, scheme-format
-msgid "the client manifest at ~a is advertised for ~a;"
+msgid "invalid authorization endpoint: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:172
+#: src/scm/webid-oidc/oidc-configuration.scm:116
 #, scheme-format
-msgid "I could not fetch the client manifest of ~a;"
+msgid "\"solid_oidc_supported\" should be set to ~s, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:177
-msgid "I could not issue an authorization code for you;"
+#: src/scm/webid-oidc/oidc-configuration.scm:124
+msgid "invalid JSON object"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:185
-msgid ""
-"The application you are trying to authorize behaved unexpectedly. Here is "
-"the explanation of the error:"
+#: src/scm/webid-oidc/oidc-configuration.scm:174
+#, scheme-format
+msgid "cannot fetch the OIDC configuration: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:194
-msgid "Redirecting..."
+#: src/scm/webid-oidc/oidc-configuration.scm:176
+msgid "cannot fetch the OIDC configuration"
 msgstr ""
 
-#: src/scm/webid-oidc/authorization-page-unsafe.scm:199
+#: src/scm/webid-oidc/oidc-configuration.scm:184
 #, scheme-format
-msgid ""
-"<a href=~s>~a</a> can now log in on your behalf. You still need to adjust "
-"permissions."
+msgid "the server responded with ~s ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/resource-server.scm:86
-#, scheme-format
-msgid "~a: authentication failure: ~a\n"
+#: src/scm/webid-oidc/oidc-configuration.scm:189
+msgid "there is no content-type"
 msgstr ""
 
-#: src/scm/webid-oidc/resource-server.scm:279
+#: src/scm/webid-oidc/oidc-configuration.scm:194
 #, scheme-format
-msgid "Warning: ~a\n"
+msgid "unexpected content-type: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:47 src/scm/webid-oidc/program.scm:233
-msgid "command-line|version"
-msgstr ""
-
-#: src/scm/webid-oidc/hello-world.scm:49 src/scm/webid-oidc/program.scm:237
-msgid "command-line|complete-corresponding-source"
+#: src/scm/webid-oidc/oidc-id-token.scm:67
+#, scheme-format
+msgid "this is not an ID token, because it is not even a JWS: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:51 src/scm/webid-oidc/program.scm:239
-msgid "command-line|help"
+#: src/scm/webid-oidc/oidc-id-token.scm:70
+msgid "this is not an ID token, because it is not even a JWS"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:53
-msgid "command-line|port"
+#: src/scm/webid-oidc/oidc-id-token.scm:72
+#, scheme-format
+msgid "this is not an ID token: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:55 src/scm/webid-oidc/program.scm:271
-msgid "command-line|log-file"
+#: src/scm/webid-oidc/oidc-id-token.scm:75
+msgid "this is not an ID token"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:57 src/scm/webid-oidc/program.scm:273
-msgid "command-line|error-file"
+#: src/scm/webid-oidc/oidc-id-token.scm:131
+#, scheme-format
+msgid "the \"sub\" field should be a string, ~s is given"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:69
+#: src/scm/webid-oidc/oidc-id-token.scm:138
 #, scheme-format
-msgid ""
-"~a [OPTIONS]...\n"
-"\n"
-"Display your identity contained in the XXX-Agent header.\n"
-"\n"
-"This program is covered by the GNU Affero GPL, version 3 or\n"
-"later. This license requires you to provide a way for any user over\n"
-"the network to download the complete corresponding source code (with\n"
-"your modifications) at no cost. The server adds a \"Source:\" header\n"
-"to all responses.\n"
-"\n"
-"Options:\n"
-"  -S MEANS, --~a=MEANS:\n"
-"      specify a way to download the complete corresponding source\n"
-"      code. For instance, this would be an URI pointing to a tarball.\n"
-"  -h, --~a:\n"
-"      display this help message and exit.\n"
-"  -v, --~a:\n"
-"      display the version information (~a) and exit.\n"
-"  -p PORT, --~a=PORT:\n"
-"      set the port to bind.\n"
-"  -l FILE.log, --~a=FILE.log:\n"
-"    redirect the program standard output to FILE.log.\n"
-"  -e FILE.err, --~a=FILE.err:\n"
-"    redirect the program errors to FILE.err.\n"
+msgid "the \"aud\" field should be an URI, ~s is given"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:102
+#: src/scm/webid-oidc/oidc-id-token.scm:145
 #, scheme-format
-msgid "~a version ~a\n"
+msgid "the \"nonce\" field should be a string, ~s is given"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:111 src/scm/webid-oidc/program.scm:632
-msgid ""
-"You are legally required to link to the complete corresponding source code.\n"
+#: src/scm/webid-oidc/oidc-id-token.scm:165
+msgid "the payload should be a JSON object"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:121
-msgid "The port should be a number between 0 and 65535.\n"
+#: src/scm/webid-oidc/oidc-id-token.scm:218
+#, scheme-format
+msgid "the ID token is invalid: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:63
-msgid "Main menu:\n"
+#: src/scm/webid-oidc/oidc-id-token.scm:220
+msgid "the ID token is invalid"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:66
+#: src/scm/webid-oidc/oidc-id-token.scm:258
 #, scheme-format
-msgid "~a. Log in with ~a (issued by ~a): ~a\n"
-msgstr ""
-
-#: src/scm/webid-oidc/example-app.scm:71
-msgid "a new user"
+msgid "I cannot query the JWKS URI of the identity provider: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:75
-msgid "status|currently logged in"
+#: src/scm/webid-oidc/oidc-id-token.scm:260
+msgid "I cannot query the JWKS URI of the identity provider"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:77
-msgid "status|offline (but accessible)"
+#: src/scm/webid-oidc/oidc-id-token.scm:271
+#, scheme-format
+msgid "the ID token is signed in the future, ~a, relative to current ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:78
-msgid "status|offline (inaccessible)"
+#: src/scm/webid-oidc/oidc-id-token.scm:280
+#, scheme-format
+msgid "the ID token expired ~a, which is in the past (from ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:79
-msgid "status|not initialized yet"
+#: src/scm/webid-oidc/oidc-id-token.scm:294
+#, scheme-format
+msgid "cannot encode the ID token: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:81
-msgid ""
-"Type a number to log in, prefix it with '-' to delete the account, or type + "
-"to create a new account.\n"
+#: src/scm/webid-oidc/oidc-id-token.scm:296
+msgid "cannot encode the ID token"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:98
+#: src/scm/webid-oidc/program.scm:56
 #, scheme-format
-msgid "Please visit: ~a\n"
+msgid "~a: Warning: XML_CATALOG_FILES is set to ~s.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:99
-msgid "Then, paste the authorization code you get:\n"
+#: src/scm/webid-oidc/program.scm:59
+#, scheme-format
+msgid "~a: GET ~a ~s...\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:105
+#: src/scm/webid-oidc/program.scm:66
 #, scheme-format
-msgid "I could not negociate an access token.  ~a"
+msgid "~a: Warning: loading XML catalog from the web, ~s.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:109
-msgid ""
-"The refresh token has expired, it is not possible to use that account "
-"offline.\n"
+#: src/scm/webid-oidc/program.scm:74
+#, scheme-format
+msgid "~a: GET ~a ~s: ~s ~a bytes\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:114
-msgid "Please enter an URI to GET:\n"
+#: src/scm/webid-oidc/program.scm:121
+msgid "really bad internal server error"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:125
+#: src/scm/webid-oidc/program.scm:128
 #, scheme-format
 msgid "~a: ~a: Internal server error: ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:140
-#, scheme-format
-msgid ""
-"The client locale ~s can’t be approximated by system locale ~s (because ~a), "
-"using C.\n"
+#: src/scm/webid-oidc/program.scm:134
+msgid "Internal Server Error"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:164
+#: src/scm/webid-oidc/program.scm:137
+msgid "Sorry, there was an error."
+msgstr ""
+
+#: src/scm/webid-oidc/program.scm:158
 #, scheme-format
 msgid "~a: ~s ~a ~s ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:166
+#: src/scm/webid-oidc/program.scm:160
 #, scheme-format
 msgid "~a: ~a (~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:170
+#: src/scm/webid-oidc/program.scm:164
 #, scheme-format
 msgid "~a: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:180
+#: src/scm/webid-oidc/program.scm:174
 #, scheme-format
 msgid "(there was an error: ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:235
+#: src/scm/webid-oidc/program.scm:227
 msgid "command-line|describe-project"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:241
+#: src/scm/webid-oidc/program.scm:233
 msgid "command-line|server|port"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:243
+#: src/scm/webid-oidc/program.scm:235
 msgid "command-line|server|server-name"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:245
+#: src/scm/webid-oidc/program.scm:237
 msgid "command-line|server|reverse-proxy|backend-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:247
+#: src/scm/webid-oidc/program.scm:239
 msgid "command-line|server|reverse-proxy|header"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:249
+#: src/scm/webid-oidc/program.scm:241
 msgid "command-line|server|issuer|key-file"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:251
+#: src/scm/webid-oidc/program.scm:243
 msgid "command-line|server|issuer|subject"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:253
+#: src/scm/webid-oidc/program.scm:245
 msgid "command-line|server|issuer|encrypted-password"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:255
+#: src/scm/webid-oidc/program.scm:247
 msgid "command-line|server|issuer|encrypted-password-from-file"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:257
+#: src/scm/webid-oidc/program.scm:249
 msgid "command-line|server|issuer|jwks-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:259
+#: src/scm/webid-oidc/program.scm:251
 msgid "command-line|server|issuer|authorization-endpoint-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:261
+#: src/scm/webid-oidc/program.scm:253
 msgid "command-line|server|issuer|token-endpoint-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:263
+#: src/scm/webid-oidc/program.scm:255
 msgid "command-line|server|client-id"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:265
+#: src/scm/webid-oidc/program.scm:257
 msgid "command-line|server|redirect-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:267
+#: src/scm/webid-oidc/program.scm:259
 msgid "command-line|server|client-name"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:269
+#: src/scm/webid-oidc/program.scm:261
 msgid "command-line|server|client-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:303
+#: src/scm/webid-oidc/program.scm:295
 #, scheme-format
 msgid "Usage: ~a COMMAND [OPTIONS]...\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:307
+#: src/scm/webid-oidc/program.scm:299
 msgid ""
 "\n"
 "Run the disfluid COMMAND."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:310
+#: src/scm/webid-oidc/program.scm:302
 msgid ""
 "\n"
 "This program is covered by the GNU Affero GPL, version 3 or\n"
@@ -1206,13 +1212,13 @@ msgid ""
 "to all responses."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:317
+#: src/scm/webid-oidc/program.scm:309
 msgid ""
 "\n"
 "Available commands:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:319
+#: src/scm/webid-oidc/program.scm:311
 #, scheme-format
 msgid ""
 "\n"
@@ -1220,12 +1226,12 @@ msgid ""
 "      run an authenticating reverse proxy."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:322 src/scm/webid-oidc/program.scm:514
-#: src/scm/webid-oidc/program.scm:715
+#: src/scm/webid-oidc/program.scm:314 src/scm/webid-oidc/program.scm:506
+#: src/scm/webid-oidc/program.scm:707
 msgid "command-line|command|reverse-proxy"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:323
+#: src/scm/webid-oidc/program.scm:315
 #, scheme-format
 msgid ""
 "\n"
@@ -1233,12 +1239,12 @@ msgid ""
 "      run an identity provider."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:326 src/scm/webid-oidc/program.scm:539
-#: src/scm/webid-oidc/program.scm:737
+#: src/scm/webid-oidc/program.scm:318 src/scm/webid-oidc/program.scm:531
+#: src/scm/webid-oidc/program.scm:729
 msgid "command-line|command|identity-provider"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:327
+#: src/scm/webid-oidc/program.scm:319
 #, scheme-format
 msgid ""
 "\n"
@@ -1246,12 +1252,12 @@ msgid ""
 "      serve the pages for a public application."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:330 src/scm/webid-oidc/program.scm:560
-#: src/scm/webid-oidc/program.scm:779
+#: src/scm/webid-oidc/program.scm:322 src/scm/webid-oidc/program.scm:552
+#: src/scm/webid-oidc/program.scm:771
 msgid "command-line|command|client-service"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:331
+#: src/scm/webid-oidc/program.scm:323
 #, scheme-format
 msgid ""
 "\n"
@@ -1260,18 +1266,18 @@ msgid ""
 "      facility."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:335 src/scm/webid-oidc/program.scm:586
-#: src/scm/webid-oidc/program.scm:808
+#: src/scm/webid-oidc/program.scm:327 src/scm/webid-oidc/program.scm:578
+#: src/scm/webid-oidc/program.scm:800
 msgid "command-line|command|server"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:337
+#: src/scm/webid-oidc/program.scm:329
 msgid ""
 "\n"
 "General options:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:339
+#: src/scm/webid-oidc/program.scm:331
 #, scheme-format
 msgid ""
 "\n"
@@ -1280,7 +1286,7 @@ msgid ""
 "      code. For instance, this would be an URI pointing to a tarball."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:344
+#: src/scm/webid-oidc/program.scm:336
 #, scheme-format
 msgid ""
 "\n"
@@ -1288,7 +1294,7 @@ msgid ""
 "      display a short help message and exit."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:348
+#: src/scm/webid-oidc/program.scm:340
 #, scheme-format
 msgid ""
 "\n"
@@ -1296,7 +1302,7 @@ msgid ""
 "      display the version information (~a, released ~a) and exit."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:354
+#: src/scm/webid-oidc/program.scm:346
 #, scheme-format
 msgid ""
 "\n"
@@ -1304,7 +1310,7 @@ msgid ""
 "      describe the project in the DOAP vocabulary and exit."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:358
+#: src/scm/webid-oidc/program.scm:350
 #, scheme-format
 msgid ""
 "\n"
@@ -1312,7 +1318,7 @@ msgid ""
 "      redirect the program standard output to FILE.log."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:362
+#: src/scm/webid-oidc/program.scm:354
 #, scheme-format
 msgid ""
 "\n"
@@ -1320,13 +1326,13 @@ msgid ""
 "      redirect the program errors to FILE.err."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:367
+#: src/scm/webid-oidc/program.scm:359
 msgid ""
 "\n"
 "General server-side options:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:369
+#: src/scm/webid-oidc/program.scm:361
 #, scheme-format
 msgid ""
 "\n"
@@ -1334,7 +1340,7 @@ msgid ""
 "      set the server port to bind, 8080 by default."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:373
+#: src/scm/webid-oidc/program.scm:365
 #, scheme-format
 msgid ""
 "\n"
@@ -1342,13 +1348,13 @@ msgid ""
 "      set the public server URI (scheme, userinfo, host, and port)."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:378
+#: src/scm/webid-oidc/program.scm:370
 msgid ""
 "\n"
 "Options for the resource server:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:380
+#: src/scm/webid-oidc/program.scm:372
 #, scheme-format
 msgid ""
 "\n"
@@ -1358,7 +1364,7 @@ msgid ""
 "      authentication."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:386
+#: src/scm/webid-oidc/program.scm:378
 #, scheme-format
 msgid ""
 "\n"
@@ -1367,13 +1373,13 @@ msgid ""
 "      reverse-proxy command."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:392
+#: src/scm/webid-oidc/program.scm:384
 msgid ""
 "\n"
 "Options for the identity provider:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:394
+#: src/scm/webid-oidc/program.scm:386
 #, scheme-format
 msgid ""
 "\n"
@@ -1382,7 +1388,7 @@ msgid ""
 "      key is generated. The server does not offer an HTTPS service."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:399
+#: src/scm/webid-oidc/program.scm:391
 #, scheme-format
 msgid ""
 "\n"
@@ -1390,7 +1396,7 @@ msgid ""
 "      set the identity of the subject."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:403
+#: src/scm/webid-oidc/program.scm:395
 #, scheme-format
 msgid ""
 "\n"
@@ -1398,7 +1404,7 @@ msgid ""
 "      set the encrypted password to recognize the user."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:407
+#: src/scm/webid-oidc/program.scm:399
 #, scheme-format
 msgid ""
 "\n"
@@ -1406,7 +1412,7 @@ msgid ""
 "      load the user’s encrypted password from ENCRYPTED_PASSWORD_FILE."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:411
+#: src/scm/webid-oidc/program.scm:403
 #, scheme-format
 msgid ""
 "\n"
@@ -1414,7 +1420,7 @@ msgid ""
 "      set the URI to query the key of the server."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:415
+#: src/scm/webid-oidc/program.scm:407
 #, scheme-format
 msgid ""
 "\n"
@@ -1422,7 +1428,7 @@ msgid ""
 "      set the authorization endpoint of the issuer."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:419
+#: src/scm/webid-oidc/program.scm:411
 #, scheme-format
 msgid ""
 "\n"
@@ -1430,13 +1436,13 @@ msgid ""
 "      set the token endpoint of the issuer."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:424
+#: src/scm/webid-oidc/program.scm:416
 msgid ""
 "\n"
 "Options for the client service:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:426
+#: src/scm/webid-oidc/program.scm:418
 #, scheme-format
 msgid ""
 "\n"
@@ -1445,7 +1451,7 @@ msgid ""
 "      dereferenced to a semantic resource."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:431
+#: src/scm/webid-oidc/program.scm:423
 #, scheme-format
 msgid ""
 "\n"
@@ -1454,7 +1460,7 @@ msgid ""
 "      page is presented with the code to paste in the application."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:436
+#: src/scm/webid-oidc/program.scm:428
 #, scheme-format
 msgid ""
 "\n"
@@ -1462,7 +1468,7 @@ msgid ""
 "      set the user-visible application name (may be misleading...)."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:440
+#: src/scm/webid-oidc/program.scm:432
 #, scheme-format
 msgid ""
 "\n"
@@ -1471,13 +1477,13 @@ msgid ""
 "      application (again, may be misleading)."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:446
+#: src/scm/webid-oidc/program.scm:438
 msgid ""
 "\n"
 "Environment variables:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:448
+#: src/scm/webid-oidc/program.scm:440
 msgid ""
 "\n"
 "  XML_CATALOG_FILES: the server will fetch resources on the web. By\n"
@@ -1488,23 +1494,23 @@ msgid ""
 "      content-type."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:456 src/scm/webid-oidc/program.scm:463
-#: src/scm/webid-oidc/program.scm:472 src/scm/webid-oidc/program.scm:480
-#: src/scm/webid-oidc/program.scm:488
+#: src/scm/webid-oidc/program.scm:448 src/scm/webid-oidc/program.scm:455
+#: src/scm/webid-oidc/program.scm:464 src/scm/webid-oidc/program.scm:472
+#: src/scm/webid-oidc/program.scm:480
 #, scheme-format
 msgid ""
 "the-environment-variable|\n"
 "      It is currently set to ~s."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:459
+#: src/scm/webid-oidc/program.scm:451
 msgid ""
 "\n"
 "  LANG: set the locale of the user interface (for the server commands,\n"
 "      the user is the system administrator)."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:466
+#: src/scm/webid-oidc/program.scm:458
 msgid ""
 "\n"
 "  XDG_DATA_HOME: where the program stores persistent data. The\n"
@@ -1513,7 +1519,7 @@ msgid ""
 "      recommended to set it to /var/lib."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:475
+#: src/scm/webid-oidc/program.scm:467
 msgid ""
 "\n"
 "  XDG_CACHE_HOME: where the program stores and updates the seed file,\n"
@@ -1521,7 +1527,7 @@ msgid ""
 "      time. The seed file will be initialized from /dev/random."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:483
+#: src/scm/webid-oidc/program.scm:475
 msgid ""
 "\n"
 "  HOME: if XDG_DATA_HOME or XDG_CACHE_HOME is not set, they are\n"
@@ -1529,13 +1535,13 @@ msgid ""
 "      not used otherwise."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:492
+#: src/scm/webid-oidc/program.scm:484
 msgid ""
 "\n"
 "Running a reverse proxy"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:494
+#: src/scm/webid-oidc/program.scm:486
 msgid ""
 "\n"
 "Suppose that you operate data.provider.com. You want to run an\n"
@@ -1548,7 +1554,7 @@ msgid ""
 "from this reverse proxy."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:504
+#: src/scm/webid-oidc/program.scm:496
 #, scheme-format
 msgid ""
 "\n"
@@ -1562,20 +1568,20 @@ msgid ""
 "      --~a '/var/log/proxy.err'"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:519
+#: src/scm/webid-oidc/program.scm:511
 msgid ""
 "\n"
 "Running an identity provider"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:521
+#: src/scm/webid-oidc/program.scm:513
 msgid ""
 "\n"
 "The identity provider running at webid-oidc-demo.planete-kraus.eu is\n"
 "invoked with the following options:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:525
+#: src/scm/webid-oidc/program.scm:517
 #, scheme-format
 msgid ""
 "\n"
@@ -1594,20 +1600,20 @@ msgid ""
 "      --~a $PORT"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:545
+#: src/scm/webid-oidc/program.scm:537
 msgid ""
 "\n"
 "Running the public pages for an application"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:547
+#: src/scm/webid-oidc/program.scm:539
 msgid ""
 "\n"
 "The example client application pages for\n"
 "webid-oidc-demo.planete-kraus.eu are served this way:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:551
+#: src/scm/webid-oidc/program.scm:543
 #, scheme-format
 msgid ""
 "\n"
@@ -1623,13 +1629,13 @@ msgid ""
 "      --~a $PORT"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:565
+#: src/scm/webid-oidc/program.scm:557
 msgid ""
 "\n"
 "Running a full server"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:568
+#: src/scm/webid-oidc/program.scm:560
 msgid ""
 "\n"
 "To run the server with identity provider and\n"
@@ -1637,7 +1643,7 @@ msgid ""
 "options for the parts."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:572
+#: src/scm/webid-oidc/program.scm:564
 #, scheme-format
 msgid ""
 "\n"
@@ -1656,14 +1662,14 @@ msgid ""
 "      --~a '...port...'"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:597
+#: src/scm/webid-oidc/program.scm:589
 #, scheme-format
 msgid ""
 "\n"
 "If you find a bug, then please send a report to ~a."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:602
+#: src/scm/webid-oidc/program.scm:594
 #, scheme-format
 msgid ""
 "~a version ~a\n"
@@ -1671,108 +1677,307 @@ msgid ""
 "Rreleased ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:639
+#: src/scm/webid-oidc/program.scm:631
 #, scheme-format
 msgid "The --~a argument must be a number, not ~s.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:645
+#: src/scm/webid-oidc/program.scm:637
 #, scheme-format
 msgid "The --~a argument must be an integer, not ~s.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:651
+#: src/scm/webid-oidc/program.scm:643
 #, scheme-format
 msgid "The --~a argument must be positive, ~s is invalid.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:656
+#: src/scm/webid-oidc/program.scm:648
 #, scheme-format
 msgid "The --~a argument must be less than 65536, ~s is invalid.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:684
+#: src/scm/webid-oidc/program.scm:676
 msgid ""
 "You specified two different passwords: one directly, and one from a file. "
 "Please set only one password.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:708
+#: src/scm/webid-oidc/program.scm:700
 #, scheme-format
 msgid ""
 "Usage: ~a COMMAND [OPTIONS]...\n"
 "See --~a (-h).\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:718 src/scm/webid-oidc/program.scm:740
-#: src/scm/webid-oidc/program.scm:810
+#: src/scm/webid-oidc/program.scm:710 src/scm/webid-oidc/program.scm:732
+#: src/scm/webid-oidc/program.scm:802
 #, scheme-format
 msgid "You must pass --~a to set the server name.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:722
+#: src/scm/webid-oidc/program.scm:714
 #, scheme-format
 msgid "You must pass --~a to set the backend URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:744 src/scm/webid-oidc/program.scm:814
+#: src/scm/webid-oidc/program.scm:736 src/scm/webid-oidc/program.scm:806
 #, scheme-format
 msgid ""
 "You must pass --~a to set the file where to store the identity provider "
 "key.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:748 src/scm/webid-oidc/program.scm:818
+#: src/scm/webid-oidc/program.scm:740 src/scm/webid-oidc/program.scm:810
 #, scheme-format
 msgid "You must pass --~a to set the subject of the identity provider.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:752
+#: src/scm/webid-oidc/program.scm:744
 #, scheme-format
 msgid "You must pass --~a or --~a to set the subject’s encrypted password.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:756 src/scm/webid-oidc/program.scm:826
+#: src/scm/webid-oidc/program.scm:748 src/scm/webid-oidc/program.scm:818
 #, scheme-format
 msgid "You must pass --~a to set the JWKS URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:760 src/scm/webid-oidc/program.scm:830
+#: src/scm/webid-oidc/program.scm:752 src/scm/webid-oidc/program.scm:822
 #, scheme-format
 msgid "You must pass --~a to set the authorization endpoint URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:764 src/scm/webid-oidc/program.scm:834
+#: src/scm/webid-oidc/program.scm:756 src/scm/webid-oidc/program.scm:826
 #, scheme-format
 msgid "You must pass --~a to set the token endpoint URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:782
+#: src/scm/webid-oidc/program.scm:774
 #, scheme-format
 msgid "You must pass --~a to set the application web ID.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:786
+#: src/scm/webid-oidc/program.scm:778
 #, scheme-format
 msgid "You must pass --~a to set the redirection URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:790
+#: src/scm/webid-oidc/program.scm:782
 #, scheme-format
 msgid "You must pass --~a to set the informative client name.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:794
+#: src/scm/webid-oidc/program.scm:786
 #, scheme-format
 msgid "You must pass --~a to set the informative client URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:822
+#: src/scm/webid-oidc/program.scm:814
 #, scheme-format
 msgid "You must pass --~a to set the subject’s encrypted password.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:877
+#: src/scm/webid-oidc/program.scm:869
 #, scheme-format
 msgid "Unknown command ~s\n"
 msgstr ""
+
+#: src/scm/webid-oidc/refresh-token.scm:171
+msgid "the refresh token does not exist"
+msgstr ""
+
+#: src/scm/webid-oidc/refresh-token.scm:182
+#, scheme-format
+msgid "the refresh token is bound to key ~s, which is not that one"
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:62
+msgid ""
+"You need to pass #:server-uri URI where URI is the public URI of the server, "
+"as a (web uri)."
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:89
+#, scheme-format
+msgid "~a: authentication failure: ~a\n"
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:93
+#, scheme-format
+msgid "~a: authentication failure\n"
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:160
+#: src/scm/webid-oidc/resource-server.scm:351
+msgid "reason-phrase|Precondition Failed"
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:175
+msgid "reason-phrase|Not Modified"
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:191
+msgid "The owner is not defined."
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:263
+msgid "reason-phrase|Created"
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:288
+#, scheme-format
+msgid "~a: ignoring a group that cannot be fetched: ~a\n"
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:292
+#, scheme-format
+msgid "~a: ignoring a group that cannot be fetched\n"
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:299
+msgid "reason-phrase|Found"
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:316
+#: src/scm/webid-oidc/token-endpoint.scm:103
+msgid "reason-phrase|Forbidden"
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:337
+msgid "reason-phrase|Conflict"
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:344
+msgid "reason-phrase|Unsupported Media Type"
+msgstr ""
+
+#: src/scm/webid-oidc/resource-server.scm:358
+msgid "reason-phrase|Not Acceptable"
+msgstr ""
+
+#: src/scm/webid-oidc/reverse-proxy.scm:60
+msgid "#:endpoint argument is not present or not an URI."
+msgstr ""
+
+#: src/scm/webid-oidc/server/create.scm:85
+#, scheme-format
+msgid "only text/turtle is allowed for the target of a POST request, not ~s"
+msgstr ""
+
+#: src/scm/webid-oidc/server/create.scm:105
+msgid "the created resource cannot have containment triples"
+msgstr ""
+
+#: src/scm/webid-oidc/server/create.scm:147
+#, scheme-format
+msgid "cannot POST to an auxiliary resource path, ~s"
+msgstr ""
+
+#: src/scm/webid-oidc/server/read.scm:105
+#, scheme-format
+msgid "the auxiliary resource of type ~s at ~s is absent"
+msgstr ""
+
+#: src/scm/webid-oidc/serve.scm:76
+msgid "content negociation failed while serving a request"
+msgstr ""
+
+#: src/scm/webid-oidc/simulation.scm:130
+#, scheme-format
+msgid "invalid credentials: response ~s ~s"
+msgstr ""
+
+#: src/scm/webid-oidc/stubs.scm:110
+#, scheme-format
+msgid "invalid base64 data: ~a"
+msgstr ""
+
+#: src/scm/webid-oidc/stubs.scm:127
+#, scheme-format
+msgid "~s is not a recognized elliptic curve"
+msgstr ""
+
+#: src/scm/webid-oidc/stubs.scm:155
+#, scheme-format
+msgid "~s is not a supported signature algorithm"
+msgstr ""
+
+#: src/scm/webid-oidc/stubs.scm:158
+#, scheme-format
+msgid "~s is not a supported hash algorithm"
+msgstr ""
+
+#: src/scm/webid-oidc/stubs.scm:196
+msgid "the signature is invalid"
+msgstr ""
+
+#: src/scm/webid-oidc/stubs.scm:248
+#, scheme-format
+msgid "invalid JSON data: ~a"
+msgstr ""
+
+#: src/scm/webid-oidc/stubs.scm:263
+msgid "invalid JSON data in input port"
+msgstr ""
+
+#: src/scm/webid-oidc/stubs.scm:323
+#, scheme-format
+msgid "while updating file ~s: ~a"
+msgstr ""
+
+#: src/scm/webid-oidc/stubs.scm:325
+#, scheme-format
+msgid "an error happened while updating file ~s"
+msgstr ""
+
+#: src/scm/webid-oidc/token-endpoint.scm:91
+#, scheme-format
+msgid "while handling web failure for the token endpoint: ~a"
+msgstr ""
+
+#: src/scm/webid-oidc/token-endpoint.scm:93
+msgid "an error happened during the token endpoint failure handling"
+msgstr ""
+
+#: src/scm/webid-oidc/token-endpoint.scm:129
+#: src/scm/webid-oidc/token-endpoint.scm:156
+msgid "reason-phrase|Bad Request"
+msgstr ""
+
+#: src/scm/webid-oidc/token-endpoint.scm:222
+msgid "missing grant type"
+msgstr ""
+
+#: src/scm/webid-oidc/token-endpoint.scm:226
+msgid "<p>You did not specify a grant_type for this request.</p>"
+msgstr ""
+
+#: src/scm/webid-oidc/token-endpoint.scm:240
+msgid "missing authorization code"
+msgstr ""
+
+#: src/scm/webid-oidc/token-endpoint.scm:244
+msgid ""
+"<p>You want to grant an authorization code, but you did not set one.</p>"
+msgstr ""
+
+#: src/scm/webid-oidc/token-endpoint.scm:258
+msgid "missing refresh token"
+msgstr ""
+
+#: src/scm/webid-oidc/token-endpoint.scm:262
+msgid "<p>You want to grant a refresh token, but you did not set one.</p>"
+msgstr ""
+
+#: src/scm/webid-oidc/token-endpoint.scm:275
+#, scheme-format
+msgid "unsupported grant type: ~s"
+msgstr ""
+
+#: src/scm/webid-oidc/token-endpoint.scm:280
+#, scheme-format
+msgid ""
+"<p>You want to use <pre>~s</pre> as a grant type, but this is not supported."
+"</p>"
+msgstr ""