@apicurio/common-ui-components 2.0.3 → 2.0.5

package/dist/main.js

@@ -1,23 +1,23 @@
-import j, { createContext as ht, useContext as gt, useState as I, useEffect as ke, memo as Te, forwardRef as Z, useCallback as Oe, useMemo as Ne } from "react";
-import { jsx as a, jsxs as f, Fragment as oe } from "react/jsx-runtime";
-import { EmptyState as ee, EmptyStateVariant as ut, EmptyStateHeader as te, EmptyStateBody as ge, Spinner as Q, Alert as _t, Dropdown as pt, MenuToggle as ae, DropdownList as ft, Divider as ze, DropdownItem as mt, Select as Ie, SelectOption as Ee, TextInput as ue, Button as _e, TextArea as wt, Modal as Ce, Form as vt, FormGroup as qe, EmptyStateIcon as Je, AboutModal as St, TextContent as bt, Text as je, TextVariants as He, TextList as Le, TextListItem as y, Progress as yt, Pagination as kt, PaginationVariant as Tt, Skeleton as It, SearchInput as Et, SelectList as Ct, ToolbarItem as Rt, InputGroup as xt, ToolbarToggleGroup as Ut, ToolbarGroup as At, ToolbarFilter as Pt } from "@patternfly/react-core";
-import { EllipsisVIcon as Ot, ChevronDownIcon as Nt, ChevronRightIcon as qt, ErrorCircleOIcon as jt, FilterIcon as Be } from "@patternfly/react-icons";
-import { DateTime as le } from "luxon";
-import { Tr as se, Td as Re, Th as Ht, Table as Lt, Thead as Mt, Tbody as Ft, ActionsColumn as Dt } from "@patternfly/react-table";
-import $t from "use-resize-observer";
-const Wt = ht({
+import H, { createContext as mt, useContext as wt, useState as y, useEffect as Re, memo as Ue, forwardRef as ie, useCallback as je, useMemo as Fe } from "react";
+import { jsx as a, jsxs as m, Fragment as ue } from "react/jsx-runtime";
+import { EmptyState as re, EmptyStateVariant as vt, EmptyStateHeader as ne, EmptyStateBody as ve, Spinner as ee, Alert as St, Dropdown as yt, MenuToggle as _e, DropdownList as bt, Divider as Ve, DropdownItem as kt, Select as xe, SelectOption as Ae, TextInput as oe, Button as ae, TextArea as Tt, AboutModal as It, TextContent as Et, Text as $e, TextVariants as He, TextList as Le, TextListItem as k, Modal as Oe, Form as Ge, FormGroup as Me, Progress as Ct, EmptyStateIcon as Qe, ChipGroup as Pt, Chip as Rt, InputGroup as Xe, ButtonVariant as Ut, Pagination as xt, PaginationVariant as At, Skeleton as Ot, SearchInput as Nt, SelectList as qt, ToolbarItem as Dt, ToolbarToggleGroup as jt, ToolbarGroup as Ft, ToolbarFilter as $t } from "@patternfly/react-core";
+import { EllipsisVIcon as Ht, ChevronDownIcon as Lt, ChevronRightIcon as Mt, ErrorCircleOIcon as Wt, SearchIcon as Jt, FilterIcon as Ye } from "@patternfly/react-icons";
+import { DateTime as fe } from "luxon";
+import { Tr as ce, Td as Ne, Th as Kt, Table as Bt, Thead as zt, Tbody as Vt, ActionsColumn as Gt } from "@patternfly/react-table";
+import Qt from "use-resize-observer";
+const Xt = mt({
   type: "none"
 });
-class B extends Error {
+class Y extends Error {
 }
-B.prototype.name = "InvalidTokenError";
-function Kt(e) {
+Y.prototype.name = "InvalidTokenError";
+function Yt(e) {
   return decodeURIComponent(atob(e).replace(/(.)/g, (t, s) => {
     let i = s.charCodeAt(0).toString(16).toUpperCase();
     return i.length < 2 && (i = "0" + i), "%" + i;
   }));
 }
-function zt(e) {
+function Zt(e) {
   let t = e.replace(/-/g, "+").replace(/_/g, "/");
   switch (t.length % 4) {
     case 0:
@@ -32,31 +32,31 @@ function zt(e) {
       throw new Error("base64 string is not of the correct length");
   }
   try {
-    return Kt(t);
+    return Yt(t);
   } catch {
     return atob(t);
   }
 }
-function Jt(e, t) {
+function es(e, t) {
   if (typeof e != "string")
-    throw new B("Invalid token specified: must be a string");
+    throw new Y("Invalid token specified: must be a string");
   t || (t = {});
   const s = t.header === !0 ? 0 : 1, i = e.split(".")[s];
   if (typeof i != "string")
-    throw new B(`Invalid token specified: missing part #${s + 1}`);
+    throw new Y(`Invalid token specified: missing part #${s + 1}`);
   let r;
   try {
-    r = zt(i);
-  } catch (n) {
-    throw new B(`Invalid token specified: invalid base64 for part #${s + 1} (${n.message})`);
+    r = Zt(i);
+  } catch (o) {
+    throw new Y(`Invalid token specified: invalid base64 for part #${s + 1} (${o.message})`);
   }
   try {
     return JSON.parse(r);
-  } catch (n) {
-    throw new B(`Invalid token specified: invalid json for part #${s + 1} (${n.message})`);
+  } catch (o) {
+    throw new Y(`Invalid token specified: invalid json for part #${s + 1} (${o.message})`);
   }
 }
-var Bt = {
+var ts = {
   debug: () => {
   },
   info: () => {
@@ -65,39 +65,39 @@ var Bt = {
   },
   error: () => {
   }
-}, N, q, ie = /* @__PURE__ */ ((e) => (e[e.NONE = 0] = "NONE", e[e.ERROR = 1] = "ERROR", e[e.WARN = 2] = "WARN", e[e.INFO = 3] = "INFO", e[e.DEBUG = 4] = "DEBUG", e))(ie || {});
+}, F, $, le = /* @__PURE__ */ ((e) => (e[e.NONE = 0] = "NONE", e[e.ERROR = 1] = "ERROR", e[e.WARN = 2] = "WARN", e[e.INFO = 3] = "INFO", e[e.DEBUG = 4] = "DEBUG", e))(le || {});
 ((e) => {
   function t() {
-    N = 3, q = Bt;
+    F = 3, $ = ts;
   }
   e.reset = t;
   function s(r) {
     if (!(0 <= r && r <= 4))
       throw new Error("Invalid log level");
-    N = r;
+    F = r;
   }
   e.setLevel = s;
   function i(r) {
-    q = r;
+    $ = r;
   }
   e.setLogger = i;
-})(ie || (ie = {}));
-var u = class O {
+})(le || (le = {}));
+var u = class D {
   constructor(t) {
     this._name = t;
   }
   /* eslint-disable @typescript-eslint/no-unsafe-enum-comparison */
   debug(...t) {
-    N >= 4 && q.debug(O._format(this._name, this._method), ...t);
+    F >= 4 && $.debug(D._format(this._name, this._method), ...t);
   }
   info(...t) {
-    N >= 3 && q.info(O._format(this._name, this._method), ...t);
+    F >= 3 && $.info(D._format(this._name, this._method), ...t);
   }
   warn(...t) {
-    N >= 2 && q.warn(O._format(this._name, this._method), ...t);
+    F >= 2 && $.warn(D._format(this._name, this._method), ...t);
   }
   error(...t) {
-    N >= 1 && q.error(O._format(this._name, this._method), ...t);
+    F >= 1 && $.error(D._format(this._name, this._method), ...t);
   }
   /* eslint-enable @typescript-eslint/no-unsafe-enum-comparison */
   throw(t) {
@@ -108,7 +108,7 @@ var u = class O {
     return s._method = t, s.debug("begin"), s;
   }
   static createStatic(t, s) {
-    const i = new O(`${t}.${s}`);
+    const i = new D(`${t}.${s}`);
     return i.debug("begin"), i;
   }
   static _format(t, s) {
@@ -118,21 +118,41 @@ var u = class O {
   /* eslint-disable @typescript-eslint/no-unsafe-enum-comparison */
   // helpers for static class methods
   static debug(t, ...s) {
-    N >= 4 && q.debug(O._format(t), ...s);
+    F >= 4 && $.debug(D._format(t), ...s);
   }
   static info(t, ...s) {
-    N >= 3 && q.info(O._format(t), ...s);
+    F >= 3 && $.info(D._format(t), ...s);
   }
   static warn(t, ...s) {
-    N >= 2 && q.warn(O._format(t), ...s);
+    F >= 2 && $.warn(D._format(t), ...s);
   }
   static error(t, ...s) {
-    N >= 1 && q.error(O._format(t), ...s);
+    F >= 1 && $.error(D._format(t), ...s);
   }
   /* eslint-enable @typescript-eslint/no-unsafe-enum-comparison */
 };
-ie.reset();
-var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8Array(e)].map((t) => String.fromCharCode(t)).join("")), K = class V {
+le.reset();
+var de = class {
+  // IMPORTANT: doesn't validate the token
+  static decode(e) {
+    try {
+      return es(e);
+    } catch (t) {
+      throw u.error("JwtUtils.decode", t), t;
+    }
+  }
+  static async generateSignedJwt(e, t, s) {
+    const i = C.encodeBase64Url(new TextEncoder().encode(JSON.stringify(e))), r = C.encodeBase64Url(new TextEncoder().encode(JSON.stringify(t))), o = `${i}.${r}`, n = await window.crypto.subtle.sign(
+      {
+        name: "ECDSA",
+        hash: { name: "SHA-256" }
+      },
+      s,
+      new TextEncoder().encode(o)
+    ), c = C.encodeBase64Url(new Uint8Array(n));
+    return `${o}.${c}`;
+  }
+}, ss = "10000000-1000-4000-8000-100000000000", Se = (e) => btoa([...new Uint8Array(e)].map((t) => String.fromCharCode(t)).join("")), Ze = class j {
   static _randomWord() {
     const t = new Uint32Array(1);
     return crypto.getRandomValues(t), t[0];
@@ -141,16 +161,16 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
    * Generates RFC4122 version 4 guid
    */
   static generateUUIDv4() {
-    return Vt.replace(
+    return ss.replace(
       /[018]/g,
-      (s) => (+s ^ V._randomWord() & 15 >> +s / 4).toString(16)
+      (s) => (+s ^ j._randomWord() & 15 >> +s / 4).toString(16)
     ).replace(/-/g, "");
   }
   /**
    * PKCE: Generate a code verifier
    */
   static generateCodeVerifier() {
-    return V.generateUUIDv4() + V.generateUUIDv4() + V.generateUUIDv4();
+    return j.generateUUIDv4() + j.generateUUIDv4() + j.generateUUIDv4();
   }
   /**
    * PKCE: Generate a code challenge
@@ -160,7 +180,7 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
       throw new Error("Crypto.subtle is available only in secure contexts (HTTPS).");
     try {
       const i = new TextEncoder().encode(t), r = await crypto.subtle.digest("SHA-256", i);
-      return Me(r).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+      return Se(r).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
     } catch (s) {
       throw u.error("CryptoUtils.generateCodeChallenge", s), s;
     }
@@ -170,11 +190,112 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
    */
   static generateBasicAuth(t, s) {
     const r = new TextEncoder().encode([t, s].join(":"));
-    return Me(r);
+    return Se(r);
+  }
+  /**
+   * Generates a hash of a string using a given algorithm
+   * @param alg
+   * @param message
+   */
+  static async hash(t, s) {
+    const i = new TextEncoder().encode(s), r = await crypto.subtle.digest(t, i);
+    return new Uint8Array(r);
+  }
+  /**
+   * Generates a rfc7638 compliant jwk thumbprint
+   * @param jwk
+   */
+  static async customCalculateJwkThumbprint(t) {
+    let s;
+    switch (t.kty) {
+      case "RSA":
+        s = {
+          e: t.e,
+          kty: t.kty,
+          n: t.n
+        };
+        break;
+      case "EC":
+        s = {
+          crv: t.crv,
+          kty: t.kty,
+          x: t.x,
+          y: t.y
+        };
+        break;
+      case "OKP":
+        s = {
+          crv: t.crv,
+          kty: t.kty,
+          x: t.x
+        };
+        break;
+      case "oct":
+        s = {
+          crv: t.k,
+          kty: t.kty
+        };
+        break;
+      default:
+        throw new Error("Unknown jwk type");
+    }
+    const i = await j.hash("SHA-256", JSON.stringify(s));
+    return j.encodeBase64Url(i);
+  }
+  static async generateDPoPProof({
+    url: t,
+    accessToken: s,
+    httpMethod: i,
+    keyPair: r,
+    nonce: o
+  }) {
+    let n, c;
+    const l = {
+      jti: window.crypto.randomUUID(),
+      htm: i ?? "GET",
+      htu: t,
+      iat: Math.floor(Date.now() / 1e3)
+    };
+    s && (n = await j.hash("SHA-256", s), c = j.encodeBase64Url(n), l.ath = c), o && (l.nonce = o);
+    try {
+      const d = await crypto.subtle.exportKey("jwk", r.publicKey), h = {
+        alg: "ES256",
+        typ: "dpop+jwt",
+        jwk: {
+          crv: d.crv,
+          kty: d.kty,
+          x: d.x,
+          y: d.y
+        }
+      };
+      return await de.generateSignedJwt(h, l, r.privateKey);
+    } catch (d) {
+      throw d instanceof TypeError ? new Error(`Error exporting dpop public key: ${d.message}`) : d;
+    }
+  }
+  static async generateDPoPJkt(t) {
+    try {
+      const s = await crypto.subtle.exportKey("jwk", t.publicKey);
+      return await j.customCalculateJwkThumbprint(s);
+    } catch (s) {
+      throw s instanceof TypeError ? new Error(`Could not retrieve dpop keys from storage: ${s.message}`) : s;
+    }
   }
-}, F = class {
+  static async generateDPoPKeys() {
+    return await window.crypto.subtle.generateKey(
+      {
+        name: "ECDSA",
+        namedCurve: "P-256"
+      },
+      !1,
+      ["sign", "verify"]
+    );
+  }
+};
+Ze.encodeBase64Url = (e) => Se(e).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+var C = Ze, W = class {
   constructor(e) {
-    this._name = e, this._logger = new u(`Event('${this._name}')`), this._callbacks = [];
+    this._name = e, this._callbacks = [], this._logger = new u(`Event('${this._name}')`);
   }
   addHandler(e) {
     return this._callbacks.push(e), () => this.removeHandler(e);
@@ -188,16 +309,7 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     for (const t of this._callbacks)
       await t(...e);
   }
-}, pe = class {
-  // IMPORTANT: doesn't validate the token
-  static decode(e) {
-    try {
-      return Jt(e);
-    } catch (t) {
-      throw u.error("JwtUtils.decode", t), t;
-    }
-  }
-}, Fe = class {
+}, We = class {
   /**
    * Populates a map of window features with a placement centered in front of
    * the current window. If no explicit width is given, a default value is
@@ -210,11 +322,11 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
   static serialize(e) {
     return Object.entries(e).filter(([, t]) => t != null).map(([t, s]) => `${t}=${typeof s != "boolean" ? s : s ? "yes" : "no"}`).join(",");
   }
-}, M = class Y extends F {
+}, M = class se extends W {
   constructor() {
     super(...arguments), this._logger = new u(`Timer('${this._name}')`), this._timerHandle = null, this._expiration = 0, this._callback = () => {
-      const t = this._expiration - Y.getEpochTime();
-      this._logger.debug("timer completes in", t), this._expiration <= Y.getEpochTime() && (this.cancel(), super.raise());
+      const t = this._expiration - se.getEpochTime();
+      this._logger.debug("timer completes in", t), this._expiration <= se.getEpochTime() && (this.cancel(), super.raise());
     };
   }
   // get the time
@@ -224,7 +336,7 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
   init(t) {
     const s = this._logger.create("init");
     t = Math.max(Math.floor(t), 1);
-    const i = Y.getEpochTime() + t;
+    const i = se.getEpochTime() + t;
     if (this.expiration === i && this._timerHandle) {
       s.debug("skipping since already initialized for expiration at", this.expiration);
       return;
@@ -239,25 +351,24 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
   cancel() {
     this._logger.create("cancel"), this._timerHandle && (clearInterval(this._timerHandle), this._timerHandle = null);
   }
-}, fe = class {
+}, ye = class {
   static readParams(e, t = "query") {
-    if (!e)
-      throw new TypeError("Invalid URL");
+    if (!e) throw new TypeError("Invalid URL");
     const i = new URL(e, "http://127.0.0.1")[t === "fragment" ? "hash" : "search"];
     return new URLSearchParams(i.slice(1));
   }
-}, me = ";", W = class extends Error {
+}, be = ";", B = class extends Error {
   constructor(e, t) {
     var s, i, r;
     if (super(e.error_description || e.error || ""), this.form = t, this.name = "ErrorResponse", !e.error)
       throw u.error("ErrorResponse", "No error passed"), new Error("No error passed");
     this.error = e.error, this.error_description = (s = e.error_description) != null ? s : null, this.error_uri = (i = e.error_uri) != null ? i : null, this.state = e.userState, this.session_state = (r = e.session_state) != null ? r : null, this.url_state = e.url_state;
   }
-}, xe = class extends Error {
+}, qe = class extends Error {
   constructor(e) {
     super(e), this.name = "ErrorTimeout";
   }
-}, Gt = class {
+}, is = class {
   constructor(e) {
     this._logger = new u("AccessTokenEvents"), this._expiringTimer = new M("Access token expiring"), this._expiredTimer = new M("Access token expired"), this._expiringNotificationTimeInSeconds = e.expiringNotificationTimeInSeconds;
   }
@@ -302,13 +413,13 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
   removeAccessTokenExpired(e) {
     this._expiredTimer.removeHandler(e);
   }
-}, Qt = class {
+}, rs = class {
   constructor(e, t, s, i, r) {
-    this._callback = e, this._client_id = t, this._intervalInSeconds = i, this._stopOnError = r, this._logger = new u("CheckSessionIFrame"), this._timer = null, this._session_state = null, this._message = (c) => {
-      c.origin === this._frame_origin && c.source === this._frame.contentWindow && (c.data === "error" ? (this._logger.error("error message from check session op iframe"), this._stopOnError && this.stop()) : c.data === "changed" ? (this._logger.debug("changed message from check session op iframe"), this.stop(), this._callback()) : this._logger.debug(c.data + " message from check session op iframe"));
+    this._callback = e, this._client_id = t, this._intervalInSeconds = i, this._stopOnError = r, this._logger = new u("CheckSessionIFrame"), this._timer = null, this._session_state = null, this._message = (n) => {
+      n.origin === this._frame_origin && n.source === this._frame.contentWindow && (n.data === "error" ? (this._logger.error("error message from check session op iframe"), this._stopOnError && this.stop()) : n.data === "changed" ? (this._logger.debug("changed message from check session op iframe"), this.stop(), this._callback()) : this._logger.debug(n.data + " message from check session op iframe"));
     };
-    const n = new URL(s);
-    this._frame_origin = n.origin, this._frame = window.document.createElement("iframe"), this._frame.style.visibility = "hidden", this._frame.style.position = "fixed", this._frame.style.left = "-1000px", this._frame.style.top = "0", this._frame.width = "0", this._frame.height = "0", this._frame.src = n.href;
+    const o = new URL(s);
+    this._frame_origin = o.origin, this._frame = window.document.createElement("iframe"), this._frame.style.visibility = "hidden", this._frame.style.position = "fixed", this._frame.style.left = "-1000px", this._frame.style.top = "0", this._frame.width = "0", this._frame.height = "0", this._frame.src = o.href;
   }
   load() {
     return new Promise((e) => {
@@ -329,7 +440,7 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
   stop() {
     this._logger.create("stop"), this._session_state = null, this._timer && (clearInterval(this._timer), this._timer = null);
   }
-}, Ve = class {
+}, et = class {
   constructor() {
     this._logger = new u("InMemoryWebStorage"), this._data = {};
   }
@@ -351,7 +462,11 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
   key(e) {
     return Object.getOwnPropertyNames(this._data)[e];
   }
-}, Ue = class {
+}, ke = class extends Error {
+  constructor(e, t) {
+    super(t), this.name = "ErrorDPoPNonce", this.nonce = e;
+  }
+}, De = class {
   constructor(e = [], t = null, s = {}) {
     this._jwtHandler = t, this._extraHeaders = s, this._logger = new u("JsonService"), this._contentTypes = [], this._contentTypes.push(...e, "application/json"), t && this._contentTypes.push("application/jwt");
   }
@@ -359,78 +474,86 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     const { timeoutInSeconds: s, ...i } = t;
     if (!s)
       return await fetch(e, i);
-    const r = new AbortController(), n = setTimeout(() => r.abort(), s * 1e3);
+    const r = new AbortController(), o = setTimeout(() => r.abort(), s * 1e3);
     try {
       return await fetch(e, {
         ...t,
         signal: r.signal
       });
-    } catch (c) {
-      throw c instanceof DOMException && c.name === "AbortError" ? new xe("Network timed out") : c;
+    } catch (n) {
+      throw n instanceof DOMException && n.name === "AbortError" ? new qe("Network timed out") : n;
     } finally {
-      clearTimeout(n);
+      clearTimeout(o);
     }
   }
   async getJson(e, {
     token: t,
-    credentials: s
+    credentials: s,
+    timeoutInSeconds: i
   } = {}) {
-    const i = this._logger.create("getJson"), r = {
+    const r = this._logger.create("getJson"), o = {
       Accept: this._contentTypes.join(", ")
     };
-    t && (i.debug("token passed, setting Authorization header"), r.Authorization = "Bearer " + t), this.appendExtraHeaders(r);
+    t && (r.debug("token passed, setting Authorization header"), o.Authorization = "Bearer " + t), this.appendExtraHeaders(o);
     let n;
     try {
-      i.debug("url:", e), n = await this.fetchWithTimeout(e, { method: "GET", headers: r, credentials: s });
-    } catch (l) {
-      throw i.error("Network Error"), l;
+      r.debug("url:", e), n = await this.fetchWithTimeout(e, { method: "GET", headers: o, timeoutInSeconds: i, credentials: s });
+    } catch (d) {
+      throw r.error("Network Error"), d;
     }
-    i.debug("HTTP response received, status", n.status);
+    r.debug("HTTP response received, status", n.status);
     const c = n.headers.get("Content-Type");
-    if (c && !this._contentTypes.find((l) => c.startsWith(l)) && i.throw(new Error(`Invalid response Content-Type: ${c ?? "undefined"}, from URL: ${e}`)), n.ok && this._jwtHandler && (c != null && c.startsWith("application/jwt")))
+    if (c && !this._contentTypes.find((d) => c.startsWith(d)) && r.throw(new Error(`Invalid response Content-Type: ${c ?? "undefined"}, from URL: ${e}`)), n.ok && this._jwtHandler && (c != null && c.startsWith("application/jwt")))
       return await this._jwtHandler(await n.text());
-    let o;
+    let l;
     try {
-      o = await n.json();
-    } catch (l) {
-      throw i.error("Error parsing JSON response", l), n.ok ? l : new Error(`${n.statusText} (${n.status})`);
+      l = await n.json();
+    } catch (d) {
+      throw r.error("Error parsing JSON response", d), n.ok ? d : new Error(`${n.statusText} (${n.status})`);
     }
     if (!n.ok)
-      throw i.error("Error from server:", o), o.error ? new W(o) : new Error(`${n.statusText} (${n.status}): ${JSON.stringify(o)}`);
-    return o;
+      throw r.error("Error from server:", l), l.error ? new B(l) : new Error(`${n.statusText} (${n.status}): ${JSON.stringify(l)}`);
+    return l;
   }
   async postForm(e, {
     body: t,
     basicAuth: s,
     timeoutInSeconds: i,
-    initCredentials: r
+    initCredentials: r,
+    extraHeaders: o
   }) {
     const n = this._logger.create("postForm"), c = {
       Accept: this._contentTypes.join(", "),
-      "Content-Type": "application/x-www-form-urlencoded"
+      "Content-Type": "application/x-www-form-urlencoded",
+      ...o
     };
     s !== void 0 && (c.Authorization = "Basic " + s), this.appendExtraHeaders(c);
-    let o;
+    let l;
     try {
-      n.debug("url:", e), o = await this.fetchWithTimeout(e, { method: "POST", headers: c, body: t, timeoutInSeconds: i, credentials: r });
-    } catch (g) {
-      throw n.error("Network error"), g;
+      n.debug("url:", e), l = await this.fetchWithTimeout(e, { method: "POST", headers: c, body: t, timeoutInSeconds: i, credentials: r });
+    } catch (_) {
+      throw n.error("Network error"), _;
     }
-    n.debug("HTTP response received, status", o.status);
-    const l = o.headers.get("Content-Type");
-    if (l && !this._contentTypes.find((g) => l.startsWith(g)))
-      throw new Error(`Invalid response Content-Type: ${l ?? "undefined"}, from URL: ${e}`);
-    const d = await o.text();
-    let h = {};
-    if (d)
+    n.debug("HTTP response received, status", l.status);
+    const d = l.headers.get("Content-Type");
+    if (d && !this._contentTypes.find((_) => d.startsWith(_)))
+      throw new Error(`Invalid response Content-Type: ${d ?? "undefined"}, from URL: ${e}`);
+    const h = await l.text();
+    let g = {};
+    if (h)
       try {
-        h = JSON.parse(d);
-      } catch (g) {
-        throw n.error("Error parsing JSON response", g), o.ok ? g : new Error(`${o.statusText} (${o.status})`);
+        g = JSON.parse(h);
+      } catch (_) {
+        throw n.error("Error parsing JSON response", _), l.ok ? _ : new Error(`${l.statusText} (${l.status})`);
+      }
+    if (!l.ok) {
+      if (n.error("Error from server:", g), l.headers.has("dpop-nonce")) {
+        const _ = l.headers.get("dpop-nonce");
+        throw new ke(_, `${JSON.stringify(g)}`);
       }
-    if (!o.ok)
-      throw n.error("Error from server:", h), h.error ? new W(h, t) : new Error(`${o.statusText} (${o.status}): ${JSON.stringify(h)}`);
-    return h;
+      throw g.error ? new B(g, t) : new Error(`${l.statusText} (${l.status}): ${JSON.stringify(g)}`);
+    }
+    return g;
   }
   appendExtraHeaders(e) {
     const t = this._logger.create("appendExtraHeaders"), s = Object.keys(this._extraHeaders), i = [
@@ -443,13 +566,13 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
         t.warn("Protected header could not be overridden", r, i);
         return;
       }
-      const n = typeof this._extraHeaders[r] == "function" ? this._extraHeaders[r]() : this._extraHeaders[r];
-      n && n !== "" && (e[r] = n);
+      const o = typeof this._extraHeaders[r] == "function" ? this._extraHeaders[r]() : this._extraHeaders[r];
+      o && o !== "" && (e[r] = o);
     });
   }
-}, Xt = class {
+}, ns = class {
   constructor(e) {
-    this._settings = e, this._logger = new u("MetadataService"), this._signingKeys = null, this._metadata = null, this._metadataUrl = this._settings.metadataUrl, this._jsonService = new Ue(
+    this._settings = e, this._logger = new u("MetadataService"), this._signingKeys = null, this._metadata = null, this._metadataUrl = this._settings.metadataUrl, this._jsonService = new De(
       ["application/jwk-set+json"],
       null,
       this._settings.extraHeaders
@@ -465,7 +588,7 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     if (!this._metadataUrl)
       throw e.throw(new Error("No authority or metadataUrl configured on settings")), null;
     e.debug("getting metadata from", this._metadataUrl);
-    const t = await this._jsonService.getJson(this._metadataUrl, { credentials: this._fetchRequestCredentials });
+    const t = await this._jsonService.getJson(this._metadataUrl, { credentials: this._fetchRequestCredentials, timeoutInSeconds: this._settings.requestTimeoutInSeconds });
     return e.debug("merging remote JSON with seed metadata"), this._metadata = Object.assign({}, this._settings.metadataSeed, t), this._metadata;
   }
   getIssuer() {
@@ -509,12 +632,12 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
       return e.debug("returning signingKeys from cache"), this._signingKeys;
     const t = await this.getKeysEndpoint(!1);
     e.debug("got jwks_uri", t);
-    const s = await this._jsonService.getJson(t);
+    const s = await this._jsonService.getJson(t, { timeoutInSeconds: this._settings.requestTimeoutInSeconds });
     if (e.debug("got key set", s), !Array.isArray(s.keys))
       throw e.throw(new Error("Missing keys on keyset")), null;
     return this._signingKeys = s.keys, this._signingKeys;
   }
-}, Ge = class {
+}, tt = class {
   constructor({
     prefix: e = "oidc.",
     store: t = localStorage
@@ -541,7 +664,7 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     }
     return t;
   }
-}, Yt = "code", Zt = "openid", es = "client_secret_post", ts = 60 * 15, we = class {
+}, os = "code", as = "openid", cs = "client_secret_post", ls = 60 * 15, Te = class {
   constructor({
     // metadata related
     authority: e,
@@ -550,56 +673,61 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     signingKeys: i,
     metadataSeed: r,
     // client related
-    client_id: n,
-    client_secret: c,
-    response_type: o = Yt,
-    scope: l = Zt,
+    client_id: o,
+    client_secret: n,
+    response_type: c = os,
+    scope: l = as,
     redirect_uri: d,
     post_logout_redirect_uri: h,
-    client_authentication: g = es,
+    client_authentication: g = cs,
     // optional protocol
-    prompt: v,
-    display: b,
-    max_age: R,
-    ui_locales: k,
-    acr_values: x,
-    resource: E,
-    response_mode: H,
+    prompt: _,
+    display: S,
+    max_age: x,
+    ui_locales: T,
+    acr_values: A,
+    resource: I,
+    response_mode: N,
     // behavior flags
-    filterProtocolClaims: T = !0,
-    loadUserInfo: w = !1,
-    staleStateAgeInSeconds: U = ts,
-    mergeClaimsStrategy: C = { array: "replace" },
-    disablePKCE: S = !1,
+    filterProtocolClaims: P = !0,
+    loadUserInfo: L = !1,
+    requestTimeoutInSeconds: R,
+    staleStateAgeInSeconds: w = ls,
+    mergeClaimsStrategy: E = { array: "replace" },
+    disablePKCE: U = !1,
     // other behavior
-    stateStore: L,
-    revokeTokenAdditionalContentTypes: J,
-    fetchRequestCredentials: X,
-    refreshTokenAllowedScope: p,
+    stateStore: b,
+    revokeTokenAdditionalContentTypes: z,
+    fetchRequestCredentials: f,
+    refreshTokenAllowedScope: v,
     // extra
-    extraQueryParams: m = {},
-    extraTokenParams: P = {},
-    extraHeaders: D = {}
+    extraQueryParams: q = {},
+    extraTokenParams: J = {},
+    extraHeaders: K = {},
+    dpop: Q,
+    omitScopeWhenRequesting: pe = !1
   }) {
-    if (this.authority = e, t ? this.metadataUrl = t : (this.metadataUrl = e, e && (this.metadataUrl.endsWith("/") || (this.metadataUrl += "/"), this.metadataUrl += ".well-known/openid-configuration")), this.metadata = s, this.metadataSeed = r, this.signingKeys = i, this.client_id = n, this.client_secret = c, this.response_type = o, this.scope = l, this.redirect_uri = d, this.post_logout_redirect_uri = h, this.client_authentication = g, this.prompt = v, this.display = b, this.max_age = R, this.ui_locales = k, this.acr_values = x, this.resource = E, this.response_mode = H, this.filterProtocolClaims = T ?? !0, this.loadUserInfo = !!w, this.staleStateAgeInSeconds = U, this.mergeClaimsStrategy = C, this.disablePKCE = !!S, this.revokeTokenAdditionalContentTypes = J, this.fetchRequestCredentials = X || "same-origin", L)
-      this.stateStore = L;
+    var X;
+    if (this.authority = e, t ? this.metadataUrl = t : (this.metadataUrl = e, e && (this.metadataUrl.endsWith("/") || (this.metadataUrl += "/"), this.metadataUrl += ".well-known/openid-configuration")), this.metadata = s, this.metadataSeed = r, this.signingKeys = i, this.client_id = o, this.client_secret = n, this.response_type = c, this.scope = l, this.redirect_uri = d, this.post_logout_redirect_uri = h, this.client_authentication = g, this.prompt = _, this.display = S, this.max_age = x, this.ui_locales = T, this.acr_values = A, this.resource = I, this.response_mode = N, this.filterProtocolClaims = P ?? !0, this.loadUserInfo = !!L, this.staleStateAgeInSeconds = w, this.mergeClaimsStrategy = E, this.omitScopeWhenRequesting = pe, this.disablePKCE = !!U, this.revokeTokenAdditionalContentTypes = z, this.fetchRequestCredentials = f || "same-origin", this.requestTimeoutInSeconds = R, b)
+      this.stateStore = b;
     else {
-      const $ = typeof window < "u" ? window.localStorage : new Ve();
-      this.stateStore = new Ge({ store: $ });
+      const te = typeof window < "u" ? window.localStorage : new et();
+      this.stateStore = new tt({ store: te });
     }
-    this.refreshTokenAllowedScope = p, this.extraQueryParams = m, this.extraTokenParams = P, this.extraHeaders = D;
+    if (this.refreshTokenAllowedScope = v, this.extraQueryParams = q, this.extraTokenParams = J, this.extraHeaders = K, this.dpop = Q, this.dpop && !((X = this.dpop) != null && X.store))
+      throw new Error("A DPoPStore is required when dpop is enabled");
   }
-}, ss = class {
+}, ds = class {
   constructor(e, t) {
     this._settings = e, this._metadataService = t, this._logger = new u("UserInfoService"), this._getClaimsFromJwt = async (s) => {
       const i = this._logger.create("_getClaimsFromJwt");
       try {
-        const r = pe.decode(s);
+        const r = de.decode(s);
         return i.debug("JWT decoding successful"), r;
       } catch (r) {
         throw i.error("Error parsing JWT response"), r;
       }
-    }, this._jsonService = new Ue(
+    }, this._jsonService = new De(
       void 0,
       this._getClaimsFromJwt,
       this._settings.extraHeaders
@@ -612,13 +740,14 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     t.debug("got userinfo url", s);
     const i = await this._jsonService.getJson(s, {
       token: e,
-      credentials: this._settings.fetchRequestCredentials
+      credentials: this._settings.fetchRequestCredentials,
+      timeoutInSeconds: this._settings.requestTimeoutInSeconds
     });
     return t.debug("got claims", i), i;
   }
-}, Qe = class {
+}, st = class {
   constructor(e, t) {
-    this._settings = e, this._metadataService = t, this._logger = new u("TokenClient"), this._jsonService = new Ue(
+    this._settings = e, this._metadataService = t, this._logger = new u("TokenClient"), this._jsonService = new De(
       this._settings.revokeTokenAdditionalContentTypes,
       null,
       this._settings.extraHeaders
@@ -634,28 +763,35 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     redirect_uri: t = this._settings.redirect_uri,
     client_id: s = this._settings.client_id,
     client_secret: i = this._settings.client_secret,
-    ...r
+    extraHeaders: r,
+    ...o
   }) {
     const n = this._logger.create("exchangeCode");
-    s || n.throw(new Error("A client_id is required")), t || n.throw(new Error("A redirect_uri is required")), r.code || n.throw(new Error("A code is required"));
+    s || n.throw(new Error("A client_id is required")), t || n.throw(new Error("A redirect_uri is required")), o.code || n.throw(new Error("A code is required"));
     const c = new URLSearchParams({ grant_type: e, redirect_uri: t });
-    for (const [h, g] of Object.entries(r))
-      g != null && c.set(h, g);
-    let o;
+    for (const [g, _] of Object.entries(o))
+      _ != null && c.set(g, _);
+    let l;
     switch (this._settings.client_authentication) {
       case "client_secret_basic":
         if (!i)
           throw n.throw(new Error("A client_secret is required")), null;
-        o = K.generateBasicAuth(s, i);
+        l = C.generateBasicAuth(s, i);
         break;
       case "client_secret_post":
         c.append("client_id", s), i && c.append("client_secret", i);
         break;
     }
-    const l = await this._metadataService.getTokenEndpoint(!1);
+    const d = await this._metadataService.getTokenEndpoint(!1);
     n.debug("got token endpoint");
-    const d = await this._jsonService.postForm(l, { body: c, basicAuth: o, initCredentials: this._settings.fetchRequestCredentials });
-    return n.debug("got response"), d;
+    const h = await this._jsonService.postForm(d, {
+      body: c,
+      basicAuth: l,
+      timeoutInSeconds: this._settings.requestTimeoutInSeconds,
+      initCredentials: this._settings.fetchRequestCredentials,
+      extraHeaders: r
+    });
+    return n.debug("got response"), h;
   }
   /**
    * Exchange credentials.
@@ -669,26 +805,27 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     scope: i = this._settings.scope,
     ...r
   }) {
-    const n = this._logger.create("exchangeCredentials");
-    t || n.throw(new Error("A client_id is required"));
-    const c = new URLSearchParams({ grant_type: e, scope: i });
+    const o = this._logger.create("exchangeCredentials");
+    t || o.throw(new Error("A client_id is required"));
+    const n = new URLSearchParams({ grant_type: e });
+    this._settings.omitScopeWhenRequesting || n.set("scope", i);
     for (const [h, g] of Object.entries(r))
-      g != null && c.set(h, g);
-    let o;
+      g != null && n.set(h, g);
+    let c;
     switch (this._settings.client_authentication) {
       case "client_secret_basic":
         if (!s)
-          throw n.throw(new Error("A client_secret is required")), null;
-        o = K.generateBasicAuth(t, s);
+          throw o.throw(new Error("A client_secret is required")), null;
+        c = C.generateBasicAuth(t, s);
         break;
       case "client_secret_post":
-        c.append("client_id", t), s && c.append("client_secret", s);
+        n.append("client_id", t), s && n.append("client_secret", s);
         break;
     }
     const l = await this._metadataService.getTokenEndpoint(!1);
-    n.debug("got token endpoint");
-    const d = await this._jsonService.postForm(l, { body: c, basicAuth: o, initCredentials: this._settings.fetchRequestCredentials });
-    return n.debug("got response"), d;
+    o.debug("got token endpoint");
+    const d = await this._jsonService.postForm(l, { body: n, basicAuth: c, timeoutInSeconds: this._settings.requestTimeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials });
+    return o.debug("got response"), d;
   }
   /**
    * Exchange a refresh token.
@@ -700,28 +837,29 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     client_id: t = this._settings.client_id,
     client_secret: s = this._settings.client_secret,
     timeoutInSeconds: i,
-    ...r
+    extraHeaders: r,
+    ...o
   }) {
     const n = this._logger.create("exchangeRefreshToken");
-    t || n.throw(new Error("A client_id is required")), r.refresh_token || n.throw(new Error("A refresh_token is required"));
+    t || n.throw(new Error("A client_id is required")), o.refresh_token || n.throw(new Error("A refresh_token is required"));
     const c = new URLSearchParams({ grant_type: e });
-    for (const [h, g] of Object.entries(r))
-      Array.isArray(g) ? g.forEach((v) => c.append(h, v)) : g != null && c.set(h, g);
-    let o;
+    for (const [g, _] of Object.entries(o))
+      Array.isArray(_) ? _.forEach((S) => c.append(g, S)) : _ != null && c.set(g, _);
+    let l;
     switch (this._settings.client_authentication) {
       case "client_secret_basic":
         if (!s)
           throw n.throw(new Error("A client_secret is required")), null;
-        o = K.generateBasicAuth(t, s);
+        l = C.generateBasicAuth(t, s);
         break;
       case "client_secret_post":
         c.append("client_id", t), s && c.append("client_secret", s);
         break;
     }
-    const l = await this._metadataService.getTokenEndpoint(!1);
+    const d = await this._metadataService.getTokenEndpoint(!1);
     n.debug("got token endpoint");
-    const d = await this._jsonService.postForm(l, { body: c, basicAuth: o, timeoutInSeconds: i, initCredentials: this._settings.fetchRequestCredentials });
-    return n.debug("got response"), d;
+    const h = await this._jsonService.postForm(d, { body: c, basicAuth: l, timeoutInSeconds: i, initCredentials: this._settings.fetchRequestCredentials, extraHeaders: r });
+    return n.debug("got response"), h;
   }
   /**
    * Revoke an access or refresh token.
@@ -735,17 +873,17 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     const i = await this._metadataService.getRevocationEndpoint(!1);
     s.debug(`got revocation endpoint, revoking ${(t = e.token_type_hint) != null ? t : "default token type"}`);
     const r = new URLSearchParams();
-    for (const [n, c] of Object.entries(e))
-      c != null && r.set(n, c);
-    r.set("client_id", this._settings.client_id), this._settings.client_secret && r.set("client_secret", this._settings.client_secret), await this._jsonService.postForm(i, { body: r }), s.debug("got response");
+    for (const [o, n] of Object.entries(e))
+      n != null && r.set(o, n);
+    r.set("client_id", this._settings.client_id), this._settings.client_secret && r.set("client_secret", this._settings.client_secret), await this._jsonService.postForm(i, { body: r, timeoutInSeconds: this._settings.requestTimeoutInSeconds }), s.debug("got response");
   }
-}, is = class {
+}, hs = class {
   constructor(e, t, s) {
-    this._settings = e, this._metadataService = t, this._claimsService = s, this._logger = new u("ResponseValidator"), this._userInfoService = new ss(this._settings, this._metadataService), this._tokenClient = new Qe(this._settings, this._metadataService);
+    this._settings = e, this._metadataService = t, this._claimsService = s, this._logger = new u("ResponseValidator"), this._userInfoService = new ds(this._settings, this._metadataService), this._tokenClient = new st(this._settings, this._metadataService);
   }
-  async validateSigninResponse(e, t) {
-    const s = this._logger.create("validateSigninResponse");
-    this._processSigninState(e, t), s.debug("state processed"), await this._processCode(e, t), s.debug("code processed"), e.isOpenId && this._validateIdTokenAttributes(e), s.debug("tokens validated"), await this._processClaims(e, t == null ? void 0 : t.skipUserInfo, e.isOpenId), s.debug("claims processed");
+  async validateSigninResponse(e, t, s) {
+    const i = this._logger.create("validateSigninResponse");
+    this._processSigninState(e, t), i.debug("state processed"), await this._processCode(e, t, s), i.debug("code processed"), e.isOpenId && this._validateIdTokenAttributes(e), i.debug("tokens validated"), await this._processClaims(e, t == null ? void 0 : t.skipUserInfo, e.isOpenId), i.debug("claims processed");
   }
   async validateCredentialsResponse(e, t) {
     const s = this._logger.create("validateCredentialsResponse");
@@ -755,19 +893,19 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     var s, i;
     const r = this._logger.create("validateRefreshResponse");
     e.userState = t.data, (s = e.session_state) != null || (e.session_state = t.session_state), (i = e.scope) != null || (e.scope = t.scope), e.isOpenId && e.id_token && (this._validateIdTokenAttributes(e, t.id_token), r.debug("ID Token validated")), e.id_token || (e.id_token = t.id_token, e.profile = t.profile);
-    const n = e.isOpenId && !!e.id_token;
-    await this._processClaims(e, !1, n), r.debug("claims processed");
+    const o = e.isOpenId && !!e.id_token;
+    await this._processClaims(e, !1, o), r.debug("claims processed");
   }
   validateSignoutResponse(e, t) {
     const s = this._logger.create("validateSignoutResponse");
     if (t.id !== e.state && s.throw(new Error("State does not match")), s.debug("state validated"), e.userState = t.data, e.error)
-      throw s.warn("Response was error", e.error), new W(e);
+      throw s.warn("Response was error", e.error), new B(e);
   }
   _processSigninState(e, t) {
     var s;
     const i = this._logger.create("_processSigninState");
     if (t.id !== e.state && i.throw(new Error("State does not match")), t.client_id || i.throw(new Error("No client_id on state")), t.authority || i.throw(new Error("No authority on state")), this._settings.authority !== t.authority && i.throw(new Error("authority mismatch on settings vs. signin state")), this._settings.client_id && this._settings.client_id !== t.client_id && i.throw(new Error("client_id mismatch on settings vs. signin state")), i.debug("state validated"), e.userState = t.data, e.url_state = t.url_state, (s = e.scope) != null || (e.scope = t.scope), e.error)
-      throw i.warn("Response was error", e.error), new W(e);
+      throw i.warn("Response was error", e.error), new B(e);
     t.code_verifier && !e.code && i.throw(new Error("Expected code in response"));
   }
   async _processClaims(e, t = !1, s = !0) {
@@ -780,36 +918,37 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     const r = await this._userInfoService.getClaims(e.access_token);
     i.debug("user info claims received from user info endpoint"), s && r.sub !== e.profile.sub && i.throw(new Error("subject from UserInfo response does not match subject in ID Token")), e.profile = this._claimsService.mergeClaims(e.profile, this._claimsService.filterProtocolClaims(r)), i.debug("user info claims received, updated profile:", e.profile);
   }
-  async _processCode(e, t) {
-    const s = this._logger.create("_processCode");
+  async _processCode(e, t, s) {
+    const i = this._logger.create("_processCode");
     if (e.code) {
-      s.debug("Validating code");
-      const i = await this._tokenClient.exchangeCode({
+      i.debug("Validating code");
+      const r = await this._tokenClient.exchangeCode({
         client_id: t.client_id,
         client_secret: t.client_secret,
         code: e.code,
         redirect_uri: t.redirect_uri,
         code_verifier: t.code_verifier,
+        extraHeaders: s,
         ...t.extraTokenParams
       });
-      Object.assign(e, i);
+      Object.assign(e, r);
     } else
-      s.debug("No code to process");
+      i.debug("No code to process");
   }
   _validateIdTokenAttributes(e, t) {
     var s;
     const i = this._logger.create("_validateIdTokenAttributes");
     i.debug("decoding ID Token JWT");
-    const r = pe.decode((s = e.id_token) != null ? s : "");
+    const r = de.decode((s = e.id_token) != null ? s : "");
     if (r.sub || i.throw(new Error("ID Token is missing a subject claim")), t) {
-      const n = pe.decode(t);
-      r.sub !== n.sub && i.throw(new Error("sub in id_token does not match current sub")), r.auth_time && r.auth_time !== n.auth_time && i.throw(new Error("auth_time in id_token does not match original auth_time")), r.azp && r.azp !== n.azp && i.throw(new Error("azp in id_token does not match original azp")), !r.azp && n.azp && i.throw(new Error("azp not in id_token, but present in original id_token"));
+      const o = de.decode(t);
+      r.sub !== o.sub && i.throw(new Error("sub in id_token does not match current sub")), r.auth_time && r.auth_time !== o.auth_time && i.throw(new Error("auth_time in id_token does not match original auth_time")), r.azp && r.azp !== o.azp && i.throw(new Error("azp in id_token does not match original azp")), !r.azp && o.azp && i.throw(new Error("azp not in id_token, but present in original id_token"));
     }
     e.profile = r;
   }
-}, re = class ve {
+}, he = class Ie {
   constructor(t) {
-    this.id = t.id || K.generateUUIDv4(), this.data = t.data, t.created && t.created > 0 ? this.created = t.created : this.created = M.getEpochTime(), this.request_type = t.request_type, this.url_state = t.url_state;
+    this.id = t.id || C.generateUUIDv4(), this.data = t.data, t.created && t.created > 0 ? this.created = t.created : this.created = M.getEpochTime(), this.request_type = t.request_type, this.url_state = t.url_state;
   }
   toStorageString() {
     return new u("State").create("toStorageString"), JSON.stringify({
@@ -821,33 +960,33 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     });
   }
   static fromStorageString(t) {
-    return u.createStatic("State", "fromStorageString"), Promise.resolve(new ve(JSON.parse(t)));
+    return u.createStatic("State", "fromStorageString"), Promise.resolve(new Ie(JSON.parse(t)));
   }
   static async clearStaleState(t, s) {
-    const i = u.createStatic("State", "clearStaleState"), r = M.getEpochTime() - s, n = await t.getAllKeys();
-    i.debug("got keys", n);
-    for (let c = 0; c < n.length; c++) {
-      const o = n[c], l = await t.get(o);
+    const i = u.createStatic("State", "clearStaleState"), r = M.getEpochTime() - s, o = await t.getAllKeys();
+    i.debug("got keys", o);
+    for (let n = 0; n < o.length; n++) {
+      const c = o[n], l = await t.get(c);
       let d = !1;
       if (l)
         try {
-          const h = await ve.fromStorageString(l);
-          i.debug("got item from key:", o, h.created), h.created <= r && (d = !0);
+          const h = await Ie.fromStorageString(l);
+          i.debug("got item from key:", c, h.created), h.created <= r && (d = !0);
         } catch (h) {
-          i.error("Error parsing state for key:", o, h), d = !0;
+          i.error("Error parsing state for key:", c, h), d = !0;
         }
       else
-        i.debug("no item in storage for key:", o), d = !0;
-      d && (i.debug("removed item for key:", o), t.remove(o));
+        i.debug("no item in storage for key:", c), d = !0;
+      d && (i.debug("removed item for key:", c), t.remove(c));
     }
   }
-}, Xe = class Se extends re {
+}, it = class Ee extends he {
   constructor(t) {
     super(t), this.code_verifier = t.code_verifier, this.code_challenge = t.code_challenge, this.authority = t.authority, this.client_id = t.client_id, this.redirect_uri = t.redirect_uri, this.scope = t.scope, this.client_secret = t.client_secret, this.extraTokenParams = t.extraTokenParams, this.response_mode = t.response_mode, this.skipUserInfo = t.skipUserInfo;
   }
   static async create(t) {
-    const s = t.code_verifier === !0 ? K.generateCodeVerifier() : t.code_verifier || void 0, i = s ? await K.generateCodeChallenge(s) : void 0;
-    return new Se({
+    const s = t.code_verifier === !0 ? C.generateCodeVerifier() : t.code_verifier || void 0, i = s ? await C.generateCodeChallenge(s) : void 0;
+    return new Ee({
       ...t,
       code_verifier: s,
       code_challenge: i
@@ -874,9 +1013,9 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
   static fromStorageString(t) {
     u.createStatic("SigninState", "fromStorageString");
     const s = JSON.parse(t);
-    return Se.create(s);
+    return Ee.create(s);
   }
-}, Ye = class Ze {
+}, rt = class nt {
   constructor(t) {
     this.url = t.url, this.state = t.state;
   }
@@ -886,21 +1025,23 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
     authority: s,
     client_id: i,
     redirect_uri: r,
-    response_type: n,
-    scope: c,
+    response_type: o,
+    scope: n,
     // optional
-    state_data: o,
+    state_data: c,
     response_mode: l,
     request_type: d,
     client_secret: h,
     nonce: g,
-    url_state: v,
-    resource: b,
-    skipUserInfo: R,
-    extraQueryParams: k,
-    extraTokenParams: x,
-    disablePKCE: E,
-    ...H
+    url_state: _,
+    resource: S,
+    skipUserInfo: x,
+    extraQueryParams: T,
+    extraTokenParams: A,
+    disablePKCE: I,
+    dpopJkt: N,
+    omitScopeWhenRequesting: P,
+    ...L
   }) {
     if (!t)
       throw this._logger.error("create: No url passed"), new Error("url");
@@ -908,43 +1049,43 @@ var Vt = "10000000-1000-4000-8000-100000000000", Me = (e) => btoa([...new Uint8A
       throw this._logger.error("create: No client_id passed"), new Error("client_id");
     if (!r)
       throw this._logger.error("create: No redirect_uri passed"), new Error("redirect_uri");
-    if (!n)
+    if (!o)
       throw this._logger.error("create: No response_type passed"), new Error("response_type");
-    if (!c)
+    if (!n)
       throw this._logger.error("create: No scope passed"), new Error("scope");
     if (!s)
       throw this._logger.error("create: No authority passed"), new Error("authority");
-    const T = await Xe.create({
-      data: o,
+    const R = await it.create({
+      data: c,
       request_type: d,
-      url_state: v,
-      code_verifier: !E,
+      url_state: _,
+      code_verifier: !I,
       client_id: i,
       authority: s,
       redirect_uri: r,
       response_mode: l,
       client_secret: h,
-      scope: c,
-      extraTokenParams: x,
-      skipUserInfo: R
+      scope: n,
+      extraTokenParams: A,
+      skipUserInfo: x
     }), w = new URL(t);
-    w.searchParams.append("client_id", i), w.searchParams.append("redirect_uri", r), w.searchParams.append("response_type", n), w.searchParams.append("scope", c), g && w.searchParams.append("nonce", g);
-    let U = T.id;
-    v && (U = `${U}${me}${v}`), w.searchParams.append("state", U), T.code_challenge && (w.searchParams.append("code_challenge", T.code_challenge), w.searchParams.append("code_challenge_method", "S256")), b && (Array.isArray(b) ? b : [b]).forEach((S) => w.searchParams.append("resource", S));
-    for (const [C, S] of Object.entries({ response_mode: l, ...H, ...k }))
-      S != null && w.searchParams.append(C, S.toString());
-    return new Ze({
+    w.searchParams.append("client_id", i), w.searchParams.append("redirect_uri", r), w.searchParams.append("response_type", o), P || w.searchParams.append("scope", n), g && w.searchParams.append("nonce", g), N && w.searchParams.append("dpop_jkt", N);
+    let E = R.id;
+    _ && (E = `${E}${be}${_}`), w.searchParams.append("state", E), R.code_challenge && (w.searchParams.append("code_challenge", R.code_challenge), w.searchParams.append("code_challenge_method", "S256")), S && (Array.isArray(S) ? S : [S]).forEach((b) => w.searchParams.append("resource", b));
+    for (const [U, b] of Object.entries({ response_mode: l, ...L, ...T }))
+      b != null && w.searchParams.append(U, b.toString());
+    return new nt({
       url: w.href,
-      state: T
+      state: R
     });
   }
 };
-Ye._logger = new u("SigninRequest");
-var rs = Ye, ns = "openid", de = class {
+rt._logger = new u("SigninRequest");
+var gs = rt, us = "openid", me = class {
   constructor(e) {
     if (this.access_token = "", this.token_type = "", this.profile = {}, this.state = e.get("state"), this.session_state = e.get("session_state"), this.state) {
-      const t = decodeURIComponent(this.state).split(me);
-      this.state = t[0], t.length > 1 && (this.url_state = t.slice(1).join(me));
+      const t = decodeURIComponent(this.state).split(be);
+      this.state = t[0], t.length > 1 && (this.url_state = t.slice(1).join(be));
     }
     this.error = e.get("error"), this.error_description = e.get("error_description"), this.error_uri = e.get("error_uri"), this.code = e.get("code");
   }
@@ -957,31 +1098,31 @@ var rs = Ye, ns = "openid", de = class {
   }
   get isOpenId() {
     var e;
-    return ((e = this.scope) == null ? void 0 : e.split(" ").includes(ns)) || !!this.id_token;
+    return ((e = this.scope) == null ? void 0 : e.split(" ").includes(us)) || !!this.id_token;
   }
-}, os = class {
+}, _s = class {
   constructor({
     url: e,
     state_data: t,
     id_token_hint: s,
     post_logout_redirect_uri: i,
     extraQueryParams: r,
-    request_type: n,
-    client_id: c
+    request_type: o,
+    client_id: n
   }) {
     if (this._logger = new u("SignoutRequest"), !e)
       throw this._logger.error("ctor: No url passed"), new Error("url");
-    const o = new URL(e);
-    s && o.searchParams.append("id_token_hint", s), c && o.searchParams.append("client_id", c), i && (o.searchParams.append("post_logout_redirect_uri", i), t && (this.state = new re({ data: t, request_type: n }), o.searchParams.append("state", this.state.id)));
+    const c = new URL(e);
+    s && c.searchParams.append("id_token_hint", s), n && c.searchParams.append("client_id", n), i && (c.searchParams.append("post_logout_redirect_uri", i), t && (this.state = new he({ data: t, request_type: o }), c.searchParams.append("state", this.state.id)));
     for (const [l, d] of Object.entries({ ...r }))
-      d != null && o.searchParams.append(l, d.toString());
-    this.url = o.href;
+      d != null && c.searchParams.append(l, d.toString());
+    this.url = c.href;
   }
-}, as = class {
+}, ps = class {
   constructor(e) {
     this.state = e.get("state"), this.error = e.get("error"), this.error_description = e.get("error_description"), this.error_uri = e.get("error_uri");
   }
-}, cs = [
+}, fs = [
   "nbf",
   "jti",
   "auth_time",
@@ -991,7 +1132,7 @@ var rs = Ye, ns = "openid", de = class {
   "azp",
   "at_hash"
   // https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken
-], ls = ["sub", "iss", "aud", "exp", "iat"], ds = class {
+], ms = ["sub", "iss", "aud", "exp", "iat"], ws = class {
   constructor(e) {
     this._settings = e, this._logger = new u("ClaimsService");
   }
@@ -999,9 +1140,9 @@ var rs = Ye, ns = "openid", de = class {
     const t = { ...e };
     if (this._settings.filterProtocolClaims) {
       let s;
-      Array.isArray(this._settings.filterProtocolClaims) ? s = this._settings.filterProtocolClaims : s = cs;
+      Array.isArray(this._settings.filterProtocolClaims) ? s = this._settings.filterProtocolClaims : s = fs;
       for (const i of s)
-        ls.includes(i) || delete t[i];
+        ms.includes(i) || delete t[i];
     }
     return t;
   }
@@ -1013,18 +1154,21 @@ var rs = Ye, ns = "openid", de = class {
           if (this._settings.mergeClaimsStrategy.array == "replace")
             s[i] = r;
           else {
-            const n = Array.isArray(s[i]) ? s[i] : [s[i]];
-            for (const c of Array.isArray(r) ? r : [r])
-              n.includes(c) || n.push(c);
-            s[i] = n;
+            const o = Array.isArray(s[i]) ? s[i] : [s[i]];
+            for (const n of Array.isArray(r) ? r : [r])
+              o.includes(n) || o.push(n);
+            s[i] = o;
           }
-        else
-          typeof s[i] == "object" && typeof r == "object" ? s[i] = this.mergeClaims(s[i], r) : s[i] = r;
+        else typeof s[i] == "object" && typeof r == "object" ? s[i] = this.mergeClaims(s[i], r) : s[i] = r;
     return s;
   }
-}, hs = class {
+}, ot = class {
+  constructor(e, t) {
+    this.keys = e, this.nonce = t;
+  }
+}, vs = class {
   constructor(e, t) {
-    this._logger = new u("OidcClient"), this.settings = e instanceof we ? e : new we(e), this.metadataService = t ?? new Xt(this.settings), this._claimsService = new ds(this.settings), this._validator = new is(this.settings, this.metadataService, this._claimsService), this._tokenClient = new Qe(this.settings, this.metadataService);
+    this._logger = new u("OidcClient"), this.settings = e instanceof Te ? e : new Te(e), this.metadataService = t ?? new ns(this.settings), this._claimsService = new ws(this.settings), this._validator = new hs(this.settings, this.metadataService, this._claimsService), this._tokenClient = new st(this.settings, this.metadataService);
   }
   async createSigninRequest({
     state: e,
@@ -1032,30 +1176,32 @@ var rs = Ye, ns = "openid", de = class {
     request_uri: s,
     request_type: i,
     id_token_hint: r,
-    login_hint: n,
-    skipUserInfo: c,
-    nonce: o,
+    login_hint: o,
+    skipUserInfo: n,
+    nonce: c,
     url_state: l,
     response_type: d = this.settings.response_type,
     scope: h = this.settings.scope,
     redirect_uri: g = this.settings.redirect_uri,
-    prompt: v = this.settings.prompt,
-    display: b = this.settings.display,
-    max_age: R = this.settings.max_age,
-    ui_locales: k = this.settings.ui_locales,
-    acr_values: x = this.settings.acr_values,
-    resource: E = this.settings.resource,
-    response_mode: H = this.settings.response_mode,
-    extraQueryParams: T = this.settings.extraQueryParams,
-    extraTokenParams: w = this.settings.extraTokenParams
+    prompt: _ = this.settings.prompt,
+    display: S = this.settings.display,
+    max_age: x = this.settings.max_age,
+    ui_locales: T = this.settings.ui_locales,
+    acr_values: A = this.settings.acr_values,
+    resource: I = this.settings.resource,
+    response_mode: N = this.settings.response_mode,
+    extraQueryParams: P = this.settings.extraQueryParams,
+    extraTokenParams: L = this.settings.extraTokenParams,
+    dpopJkt: R,
+    omitScopeWhenRequesting: w = this.settings.omitScopeWhenRequesting
   }) {
-    const U = this._logger.create("createSigninRequest");
+    const E = this._logger.create("createSigninRequest");
     if (d !== "code")
       throw new Error("Only the Authorization Code flow (with PKCE) is supported");
-    const C = await this.metadataService.getAuthorizationEndpoint();
-    U.debug("Received authorization endpoint", C);
-    const S = await rs.create({
-      url: C,
+    const U = await this.metadataService.getAuthorizationEndpoint();
+    E.debug("Received authorization endpoint", U);
+    const b = await gs.create({
+      url: U,
       authority: this.settings.authority,
       client_id: this.settings.client_id,
       redirect_uri: g,
@@ -1063,41 +1209,65 @@ var rs = Ye, ns = "openid", de = class {
       scope: h,
       state_data: e,
       url_state: l,
-      prompt: v,
-      display: b,
-      max_age: R,
-      ui_locales: k,
+      prompt: _,
+      display: S,
+      max_age: x,
+      ui_locales: T,
       id_token_hint: r,
-      login_hint: n,
-      acr_values: x,
-      resource: E,
+      login_hint: o,
+      acr_values: A,
+      dpopJkt: R,
+      resource: I,
       request: t,
       request_uri: s,
-      extraQueryParams: T,
-      extraTokenParams: w,
+      extraQueryParams: P,
+      extraTokenParams: L,
       request_type: i,
-      response_mode: H,
+      response_mode: N,
       client_secret: this.settings.client_secret,
-      skipUserInfo: c,
-      nonce: o,
-      disablePKCE: this.settings.disablePKCE
+      skipUserInfo: n,
+      nonce: c,
+      disablePKCE: this.settings.disablePKCE,
+      omitScopeWhenRequesting: w
     });
     await this.clearStaleState();
-    const L = S.state;
-    return await this.settings.stateStore.set(L.id, L.toStorageString()), S;
+    const z = b.state;
+    return await this.settings.stateStore.set(z.id, z.toStorageString()), b;
   }
   async readSigninResponseState(e, t = !1) {
-    const s = this._logger.create("readSigninResponseState"), i = new de(fe.readParams(e, this.settings.response_mode));
+    const s = this._logger.create("readSigninResponseState"), i = new me(ye.readParams(e, this.settings.response_mode));
     if (!i.state)
       throw s.throw(new Error("No state in response")), null;
     const r = await this.settings.stateStore[t ? "remove" : "get"](i.state);
     if (!r)
       throw s.throw(new Error("No matching state found in storage")), null;
-    return { state: await Xe.fromStorageString(r), response: i };
+    return { state: await it.fromStorageString(r), response: i };
   }
-  async processSigninResponse(e) {
-    const t = this._logger.create("processSigninResponse"), { state: s, response: i } = await this.readSigninResponseState(e, !0);
-    return t.debug("received state from storage; validating response"), await this._validator.validateSigninResponse(i, s), i;
+  async processSigninResponse(e, t) {
+    const s = this._logger.create("processSigninResponse"), { state: i, response: r } = await this.readSigninResponseState(e, !0);
+    if (s.debug("received state from storage; validating response"), this.settings.dpop && this.settings.dpop.store) {
+      const o = await this.getDpopProof(this.settings.dpop.store);
+      t = { ...t, DPoP: o };
+    }
+    try {
+      await this._validator.validateSigninResponse(r, i, t);
+    } catch (o) {
+      if (o instanceof ke && this.settings.dpop) {
+        const n = await this.getDpopProof(this.settings.dpop.store, o.nonce);
+        t.DPoP = n, await this._validator.validateSigninResponse(r, i, t);
+      } else
+        throw o;
+    }
+    return r;
+  }
+  async getDpopProof(e, t) {
+    let s, i;
+    return (await e.getAllKeys()).includes(this.settings.client_id) ? (i = await e.get(this.settings.client_id), i.nonce !== t && t && (i.nonce = t, await e.set(this.settings.client_id, i))) : (s = await C.generateDPoPKeys(), i = new ot(s, t), await e.set(this.settings.client_id, i)), await C.generateDPoPProof({
+      url: await this.metadataService.getTokenEndpoint(!1),
+      httpMethod: "POST",
+      keyPair: i.keys,
+      nonce: i.nonce
+    });
   }
   async processResourceOwnerPasswordCredentials({
     username: e,
@@ -1105,40 +1275,64 @@ var rs = Ye, ns = "openid", de = class {
     skipUserInfo: s = !1,
     extraTokenParams: i = {}
   }) {
-    const r = await this._tokenClient.exchangeCredentials({ username: e, password: t, ...i }), n = new de(new URLSearchParams());
-    return Object.assign(n, r), await this._validator.validateCredentialsResponse(n, s), n;
+    const r = await this._tokenClient.exchangeCredentials({ username: e, password: t, ...i }), o = new me(new URLSearchParams());
+    return Object.assign(o, r), await this._validator.validateCredentialsResponse(o, s), o;
   }
   async useRefreshToken({
     state: e,
     redirect_uri: t,
     resource: s,
     timeoutInSeconds: i,
-    extraTokenParams: r
+    extraHeaders: r,
+    extraTokenParams: o
   }) {
     var n;
     const c = this._logger.create("useRefreshToken");
-    let o;
+    let l;
     if (this.settings.refreshTokenAllowedScope === void 0)
-      o = e.scope;
+      l = e.scope;
     else {
-      const h = this.settings.refreshTokenAllowedScope.split(" ");
-      o = (((n = e.scope) == null ? void 0 : n.split(" ")) || []).filter((v) => h.includes(v)).join(" ");
+      const g = this.settings.refreshTokenAllowedScope.split(" ");
+      l = (((n = e.scope) == null ? void 0 : n.split(" ")) || []).filter((S) => g.includes(S)).join(" ");
     }
-    const l = await this._tokenClient.exchangeRefreshToken({
-      refresh_token: e.refresh_token,
-      // provide the (possible filtered) scope list
-      scope: o,
-      redirect_uri: t,
-      resource: s,
-      timeoutInSeconds: i,
-      ...r
-    }), d = new de(new URLSearchParams());
-    return Object.assign(d, l), c.debug("validating response", d), await this._validator.validateRefreshResponse(d, {
+    if (this.settings.dpop && this.settings.dpop.store) {
+      const g = await this.getDpopProof(this.settings.dpop.store);
+      r = { ...r, DPoP: g };
+    }
+    let d;
+    try {
+      d = await this._tokenClient.exchangeRefreshToken({
+        refresh_token: e.refresh_token,
+        // provide the (possible filtered) scope list
+        scope: l,
+        redirect_uri: t,
+        resource: s,
+        timeoutInSeconds: i,
+        extraHeaders: r,
+        ...o
+      });
+    } catch (g) {
+      if (g instanceof ke && this.settings.dpop)
+        r.DPoP = await this.getDpopProof(this.settings.dpop.store, g.nonce), d = await this._tokenClient.exchangeRefreshToken({
+          refresh_token: e.refresh_token,
+          // provide the (possible filtered) scope list
+          scope: l,
+          redirect_uri: t,
+          resource: s,
+          timeoutInSeconds: i,
+          extraHeaders: r,
+          ...o
+        });
+      else
+        throw g;
+    }
+    const h = new me(new URLSearchParams());
+    return Object.assign(h, d), c.debug("validating response", h), await this._validator.validateRefreshResponse(h, {
       ...e,
       // override the scope in the state handed over to the validator
       // so it can set the granted scope to the requested scope in case none is included in the response
-      scope: o
-    }), d;
+      scope: l
+    }), h;
   }
   async createSignoutRequest({
     state: e,
@@ -1146,43 +1340,43 @@ var rs = Ye, ns = "openid", de = class {
     client_id: s,
     request_type: i,
     post_logout_redirect_uri: r = this.settings.post_logout_redirect_uri,
-    extraQueryParams: n = this.settings.extraQueryParams
+    extraQueryParams: o = this.settings.extraQueryParams
   } = {}) {
-    const c = this._logger.create("createSignoutRequest"), o = await this.metadataService.getEndSessionEndpoint();
-    if (!o)
-      throw c.throw(new Error("No end session endpoint")), null;
-    c.debug("Received end session endpoint", o), !s && r && !t && (s = this.settings.client_id);
-    const l = new os({
-      url: o,
+    const n = this._logger.create("createSignoutRequest"), c = await this.metadataService.getEndSessionEndpoint();
+    if (!c)
+      throw n.throw(new Error("No end session endpoint")), null;
+    n.debug("Received end session endpoint", c), !s && r && !t && (s = this.settings.client_id);
+    const l = new _s({
+      url: c,
       id_token_hint: t,
       client_id: s,
       post_logout_redirect_uri: r,
       state_data: e,
-      extraQueryParams: n,
+      extraQueryParams: o,
       request_type: i
     });
     await this.clearStaleState();
     const d = l.state;
-    return d && (c.debug("Signout request has state to persist"), await this.settings.stateStore.set(d.id, d.toStorageString())), l;
+    return d && (n.debug("Signout request has state to persist"), await this.settings.stateStore.set(d.id, d.toStorageString())), l;
   }
   async readSignoutResponseState(e, t = !1) {
-    const s = this._logger.create("readSignoutResponseState"), i = new as(fe.readParams(e, this.settings.response_mode));
+    const s = this._logger.create("readSignoutResponseState"), i = new ps(ye.readParams(e, this.settings.response_mode));
     if (!i.state) {
       if (s.debug("No state in response"), i.error)
-        throw s.warn("Response was error:", i.error), new W(i);
+        throw s.warn("Response was error:", i.error), new B(i);
       return { state: void 0, response: i };
     }
     const r = await this.settings.stateStore[t ? "remove" : "get"](i.state);
     if (!r)
       throw s.throw(new Error("No matching state found in storage")), null;
-    return { state: await re.fromStorageString(r), response: i };
+    return { state: await he.fromStorageString(r), response: i };
   }
   async processSignoutResponse(e) {
     const t = this._logger.create("processSignoutResponse"), { state: s, response: i } = await this.readSignoutResponseState(e, !0);
     return s ? (t.debug("Received state from storage; validating response"), this._validator.validateSignoutResponse(i, s)) : t.debug("No state from storage; skipping response validation"), i;
   }
   clearStaleState() {
-    return this._logger.create("clearStaleState"), re.clearStaleState(this.settings.stateStore, this.settings.staleStateAgeInSeconds);
+    return this._logger.create("clearStaleState"), he.clearStaleState(this.settings.stateStore, this.settings.staleStateAgeInSeconds);
   }
   async revokeToken(e, t) {
     return this._logger.create("revokeToken"), await this._tokenClient.revoke({
@@ -1190,7 +1384,7 @@ var rs = Ye, ns = "openid", de = class {
       token_type_hint: t
     });
   }
-}, gs = class {
+}, Ss = class {
   constructor(e) {
     this._userManager = e, this._logger = new u("SessionMonitor"), this._start = async (t) => {
       const s = t.session_state;
@@ -1205,7 +1399,7 @@ var rs = Ye, ns = "openid", de = class {
         const r = await this._userManager.metadataService.getCheckSessionIframe();
         if (r) {
           i.debug("initializing check session iframe");
-          const n = this._userManager.settings.client_id, c = this._userManager.settings.checkSessionIntervalInSeconds, o = this._userManager.settings.stopCheckSessionOnError, l = new Qt(this._callback, n, r, c, o);
+          const o = this._userManager.settings.client_id, n = this._userManager.settings.checkSessionIntervalInSeconds, c = this._userManager.settings.stopCheckSessionOnError, l = new rs(this._callback, o, r, n, c);
           await l.load(), this._checkSessionIFrame = l, l.start(s);
         } else
           i.warn("no check session iframe found in the metadata");
@@ -1264,7 +1458,7 @@ var rs = Ye, ns = "openid", de = class {
       }
     }
   }
-}, he = class et {
+}, we = class at {
   constructor(t) {
     var s;
     this.id_token = t.id_token, this.session_state = (s = t.session_state) != null ? s : null, this.access_token = t.access_token, this.refresh_token = t.refresh_token, this.token_type = t.token_type, this.scope = t.scope, this.profile = t.profile, this.expires_at = t.expires_at, this.state = t.userState, this.url_state = t.url_state;
@@ -1301,34 +1495,34 @@ var rs = Ye, ns = "openid", de = class {
     });
   }
   static fromStorageString(t) {
-    return u.createStatic("User", "fromStorageString"), new et(JSON.parse(t));
+    return u.createStatic("User", "fromStorageString"), new at(JSON.parse(t));
   }
-}, De = "oidc-client", tt = class {
+}, Je = "oidc-client", ct = class {
   constructor() {
-    this._abort = new F("Window navigation aborted"), this._disposeHandlers = /* @__PURE__ */ new Set(), this._window = null;
+    this._abort = new W("Window navigation aborted"), this._disposeHandlers = /* @__PURE__ */ new Set(), this._window = null;
   }
   async navigate(e) {
     const t = this._logger.create("navigate");
     if (!this._window)
       throw new Error("Attempted to navigate on a disposed window");
     t.debug("setting URL in window"), this._window.location.replace(e.url);
-    const { url: s, keepOpen: i } = await new Promise((r, n) => {
-      const c = (o) => {
+    const { url: s, keepOpen: i } = await new Promise((r, o) => {
+      const n = (c) => {
         var l;
-        const d = o.data, h = (l = e.scriptOrigin) != null ? l : window.location.origin;
-        if (!(o.origin !== h || (d == null ? void 0 : d.source) !== De)) {
+        const d = c.data, h = (l = e.scriptOrigin) != null ? l : window.location.origin;
+        if (!(c.origin !== h || (d == null ? void 0 : d.source) !== Je)) {
           try {
-            const g = fe.readParams(d.url, e.response_mode).get("state");
-            if (g || t.warn("no state found in response url"), o.source !== this._window && g !== e.state)
+            const g = ye.readParams(d.url, e.response_mode).get("state");
+            if (g || t.warn("no state found in response url"), c.source !== this._window && g !== e.state)
               return;
           } catch {
-            this._dispose(), n(new Error("Invalid response from window"));
+            this._dispose(), o(new Error("Invalid response from window"));
           }
           r(d);
         }
       };
-      window.addEventListener("message", c, !1), this._disposeHandlers.add(() => window.removeEventListener("message", c, !1)), this._disposeHandlers.add(this._abort.addHandler((o) => {
-        this._dispose(), n(o);
+      window.addEventListener("message", n, !1), this._disposeHandlers.add(() => window.removeEventListener("message", n, !1)), this._disposeHandlers.add(this._abort.addHandler((c) => {
+        this._dispose(), o(c);
       }));
     });
     return t.debug("got response from window"), this._dispose(), i || this.close(), { url: s };
@@ -1341,55 +1535,56 @@ var rs = Ye, ns = "openid", de = class {
   }
   static _notifyParent(e, t, s = !1, i = window.location.origin) {
     e.postMessage({
-      source: De,
+      source: Je,
       url: t,
       keepOpen: s
     }, i);
   }
-}, st = {
+}, lt = {
   location: !1,
   toolbar: !1,
   height: 640,
   closePopupWindowAfterInSeconds: -1
-}, it = "_blank", us = 60, _s = 2, rt = 10, ps = class extends we {
+}, dt = "_blank", ys = 60, bs = 2, ht = 10, ks = class extends Te {
   constructor(e) {
     const {
       popup_redirect_uri: t = e.redirect_uri,
       popup_post_logout_redirect_uri: s = e.post_logout_redirect_uri,
-      popupWindowFeatures: i = st,
-      popupWindowTarget: r = it,
-      redirectMethod: n = "assign",
-      redirectTarget: c = "self",
-      iframeNotifyParentOrigin: o = e.iframeNotifyParentOrigin,
+      popupWindowFeatures: i = lt,
+      popupWindowTarget: r = dt,
+      redirectMethod: o = "assign",
+      redirectTarget: n = "self",
+      iframeNotifyParentOrigin: c = e.iframeNotifyParentOrigin,
       iframeScriptOrigin: l = e.iframeScriptOrigin,
-      silent_redirect_uri: d = e.redirect_uri,
-      silentRequestTimeoutInSeconds: h = rt,
-      automaticSilentRenew: g = !0,
-      validateSubOnSilentRenew: v = !0,
-      includeIdTokenInSilentRenew: b = !1,
-      monitorSession: R = !1,
-      monitorAnonymousSession: k = !1,
-      checkSessionIntervalInSeconds: x = _s,
-      query_status_response_type: E = "code",
-      stopCheckSessionOnError: H = !0,
-      revokeTokenTypes: T = ["access_token", "refresh_token"],
-      revokeTokensOnSignout: w = !1,
-      includeIdTokenInSilentSignout: U = !1,
-      accessTokenExpiringNotificationTimeInSeconds: C = us,
-      userStore: S
+      requestTimeoutInSeconds: d,
+      silent_redirect_uri: h = e.redirect_uri,
+      silentRequestTimeoutInSeconds: g,
+      automaticSilentRenew: _ = !0,
+      validateSubOnSilentRenew: S = !0,
+      includeIdTokenInSilentRenew: x = !1,
+      monitorSession: T = !1,
+      monitorAnonymousSession: A = !1,
+      checkSessionIntervalInSeconds: I = bs,
+      query_status_response_type: N = "code",
+      stopCheckSessionOnError: P = !0,
+      revokeTokenTypes: L = ["access_token", "refresh_token"],
+      revokeTokensOnSignout: R = !1,
+      includeIdTokenInSilentSignout: w = !1,
+      accessTokenExpiringNotificationTimeInSeconds: E = ys,
+      userStore: U
     } = e;
-    if (super(e), this.popup_redirect_uri = t, this.popup_post_logout_redirect_uri = s, this.popupWindowFeatures = i, this.popupWindowTarget = r, this.redirectMethod = n, this.redirectTarget = c, this.iframeNotifyParentOrigin = o, this.iframeScriptOrigin = l, this.silent_redirect_uri = d, this.silentRequestTimeoutInSeconds = h, this.automaticSilentRenew = g, this.validateSubOnSilentRenew = v, this.includeIdTokenInSilentRenew = b, this.monitorSession = R, this.monitorAnonymousSession = k, this.checkSessionIntervalInSeconds = x, this.stopCheckSessionOnError = H, this.query_status_response_type = E, this.revokeTokenTypes = T, this.revokeTokensOnSignout = w, this.includeIdTokenInSilentSignout = U, this.accessTokenExpiringNotificationTimeInSeconds = C, S)
-      this.userStore = S;
+    if (super(e), this.popup_redirect_uri = t, this.popup_post_logout_redirect_uri = s, this.popupWindowFeatures = i, this.popupWindowTarget = r, this.redirectMethod = o, this.redirectTarget = n, this.iframeNotifyParentOrigin = c, this.iframeScriptOrigin = l, this.silent_redirect_uri = h, this.silentRequestTimeoutInSeconds = g || d || ht, this.automaticSilentRenew = _, this.validateSubOnSilentRenew = S, this.includeIdTokenInSilentRenew = x, this.monitorSession = T, this.monitorAnonymousSession = A, this.checkSessionIntervalInSeconds = I, this.stopCheckSessionOnError = P, this.query_status_response_type = N, this.revokeTokenTypes = L, this.revokeTokensOnSignout = R, this.includeIdTokenInSilentSignout = w, this.accessTokenExpiringNotificationTimeInSeconds = E, U)
+      this.userStore = U;
     else {
-      const L = typeof window < "u" ? window.sessionStorage : new Ve();
-      this.userStore = new Ge({ store: L });
+      const b = typeof window < "u" ? window.sessionStorage : new et();
+      this.userStore = new tt({ store: b });
     }
   }
-}, $e = class nt extends tt {
+}, Ke = class gt extends ct {
   constructor({
-    silentRequestTimeoutInSeconds: t = rt
+    silentRequestTimeoutInSeconds: t = ht
   }) {
-    super(), this._logger = new u("IFrameWindow"), this._timeoutInSeconds = t, this._frame = nt.createHiddenIframe(), this._window = this._frame.contentWindow;
+    super(), this._logger = new u("IFrameWindow"), this._timeoutInSeconds = t, this._frame = gt.createHiddenIframe(), this._window = this._frame.contentWindow;
   }
   static createHiddenIframe() {
     const t = window.document.createElement("iframe");
@@ -1397,7 +1592,7 @@ var rs = Ye, ns = "openid", de = class {
   }
   async navigate(t) {
     this._logger.debug("navigate: Using timeout of:", this._timeoutInSeconds);
-    const s = setTimeout(() => void this._abort.raise(new xe("IFrame timed out without a response")), this._timeoutInSeconds * 1e3);
+    const s = setTimeout(() => void this._abort.raise(new qe("IFrame timed out without a response")), this._timeoutInSeconds * 1e3);
     return this._disposeHandlers.add(() => clearTimeout(s)), await super.navigate(t);
   }
   close() {
@@ -1411,39 +1606,43 @@ var rs = Ye, ns = "openid", de = class {
   static notifyParent(t, s) {
     return super._notifyParent(window.parent, t, !1, s);
   }
-}, fs = class {
+}, Ts = class {
   constructor(e) {
     this._settings = e, this._logger = new u("IFrameNavigator");
   }
   async prepare({
     silentRequestTimeoutInSeconds: e = this._settings.silentRequestTimeoutInSeconds
   }) {
-    return new $e({ silentRequestTimeoutInSeconds: e });
+    return new Ke({ silentRequestTimeoutInSeconds: e });
   }
   async callback(e) {
-    this._logger.create("callback"), $e.notifyParent(e, this._settings.iframeNotifyParentOrigin);
+    this._logger.create("callback"), Ke.notifyParent(e, this._settings.iframeNotifyParentOrigin);
   }
-}, ms = 500, ws = 1e3, We = class extends tt {
+}, Is = 500, Es = 1e3, Be = class extends ct {
   constructor({
-    popupWindowTarget: e = it,
-    popupWindowFeatures: t = {}
+    popupWindowTarget: e = dt,
+    popupWindowFeatures: t = {},
+    popupSignal: s
   }) {
     super(), this._logger = new u("PopupWindow");
-    const s = Fe.center({ ...st, ...t });
-    this._window = window.open(void 0, e, Fe.serialize(s)), t.closePopupWindowAfterInSeconds && t.closePopupWindowAfterInSeconds > 0 && setTimeout(() => {
+    const i = We.center({ ...lt, ...t });
+    this._window = window.open(void 0, e, We.serialize(i)), s && s.addEventListener("abort", () => {
+      var r;
+      this._abort.raise(new Error((r = s.reason) != null ? r : "Popup aborted"));
+    }), t.closePopupWindowAfterInSeconds && t.closePopupWindowAfterInSeconds > 0 && setTimeout(() => {
       if (!this._window || typeof this._window.closed != "boolean" || this._window.closed) {
         this._abort.raise(new Error("Popup blocked by user"));
         return;
       }
       this.close();
-    }, t.closePopupWindowAfterInSeconds * ws);
+    }, t.closePopupWindowAfterInSeconds * Es);
   }
   async navigate(e) {
     var t;
     (t = this._window) == null || t.focus();
     const s = setInterval(() => {
       (!this._window || this._window.closed) && this._abort.raise(new Error("Popup closed by user"));
-    }, ms);
+    }, Is);
     return this._disposeHandlers.add(() => clearInterval(s)), await super.navigate(e);
   }
   close() {
@@ -1454,20 +1653,21 @@ var rs = Ye, ns = "openid", de = class {
       throw new Error("No window.opener. Can't complete notification.");
     return super._notifyParent(window.opener, e, t);
   }
-}, vs = class {
+}, Cs = class {
   constructor(e) {
     this._settings = e, this._logger = new u("PopupNavigator");
   }
   async prepare({
     popupWindowFeatures: e = this._settings.popupWindowFeatures,
-    popupWindowTarget: t = this._settings.popupWindowTarget
+    popupWindowTarget: t = this._settings.popupWindowTarget,
+    popupSignal: s
   }) {
-    return new We({ popupWindowFeatures: e, popupWindowTarget: t });
+    return new Be({ popupWindowFeatures: e, popupWindowTarget: t, popupSignal: s });
   }
   async callback(e, { keepOpen: t = !1 }) {
-    this._logger.create("callback"), We.notifyOpener(e, t);
+    this._logger.create("callback"), Be.notifyOpener(e, t);
   }
-}, Ss = class {
+}, Ps = class {
   constructor(e) {
     this._settings = e, this._logger = new u("RedirectNavigator");
   }
@@ -1480,25 +1680,25 @@ var rs = Ye, ns = "openid", de = class {
     let i = window.self;
     t === "top" && (i = (s = window.top) != null ? s : window.self);
     const r = i.location[e].bind(i.location);
-    let n;
+    let o;
     return {
-      navigate: async (c) => {
+      navigate: async (n) => {
         this._logger.create("navigate");
-        const o = new Promise((l, d) => {
-          n = d;
+        const c = new Promise((l, d) => {
+          o = d;
         });
-        return r(c.url), await o;
+        return r(n.url), await c;
       },
       close: () => {
-        this._logger.create("close"), n == null || n(new Error("Redirect aborted")), i.stop();
+        this._logger.create("close"), o == null || o(new Error("Redirect aborted")), i.stop();
       }
     };
   }
   async callback() {
   }
-}, bs = class extends Gt {
+}, Rs = class extends is {
   constructor(e) {
-    super({ expiringNotificationTimeInSeconds: e.accessTokenExpiringNotificationTimeInSeconds }), this._logger = new u("UserManagerEvents"), this._userLoaded = new F("User loaded"), this._userUnloaded = new F("User unloaded"), this._silentRenewError = new F("Silent renew error"), this._userSignedIn = new F("User signed in"), this._userSignedOut = new F("User signed out"), this._userSessionChanged = new F("User session changed");
+    super({ expiringNotificationTimeInSeconds: e.accessTokenExpiringNotificationTimeInSeconds }), this._logger = new u("UserManagerEvents"), this._userLoaded = new W("User loaded"), this._userUnloaded = new W("User unloaded"), this._silentRenewError = new W("Silent renew error"), this._userSignedIn = new W("User signed in"), this._userSignedOut = new W("User signed out"), this._userSessionChanged = new W("User session changed");
   }
   async load(e, t = !0) {
     super.load(e), t && await this._userLoaded.raise(e);
@@ -1605,14 +1805,14 @@ var rs = Ye, ns = "openid", de = class {
   async _raiseUserSessionChanged() {
     await this._userSessionChanged.raise();
   }
-}, ys = class {
+}, Us = class {
   constructor(e) {
     this._userManager = e, this._logger = new u("SilentRenewService"), this._isStarted = !1, this._retryTimer = new M("Retry Silent Renew"), this._tokenExpiring = async () => {
       const t = this._logger.create("_tokenExpiring");
       try {
         await this._userManager.signinSilent(), t.debug("silent token renewal successful");
       } catch (s) {
-        if (s instanceof xe) {
+        if (s instanceof qe) {
           t.warn("ErrorTimeout from signinSilent:", s, "retry in 5s"), this._retryTimer.init(5);
           return;
         }
@@ -1634,13 +1834,13 @@ var rs = Ye, ns = "openid", de = class {
   stop() {
     this._isStarted && (this._retryTimer.cancel(), this._retryTimer.removeHandler(this._tokenExpiring), this._userManager.events.removeAccessTokenExpiring(this._tokenExpiring), this._isStarted = !1);
   }
-}, ks = class {
+}, xs = class {
   constructor(e) {
     this.refresh_token = e.refresh_token, this.id_token = e.id_token, this.session_state = e.session_state, this.scope = e.scope, this.profile = e.profile, this.data = e.state;
   }
-}, Ts = class {
+}, As = class {
   constructor(e, t, s, i) {
-    this._logger = new u("UserManager"), this.settings = new ps(e), this._client = new hs(e), this._redirectNavigator = t ?? new Ss(this.settings), this._popupNavigator = s ?? new vs(this.settings), this._iframeNavigator = i ?? new fs(this.settings), this._events = new bs(this.settings), this._silentRenewService = new ys(this), this.settings.automaticSilentRenew && this.startSilentRenew(), this._sessionMonitor = null, this.settings.monitorSession && (this._sessionMonitor = new gs(this));
+    this._logger = new u("UserManager"), this.settings = new ks(e), this._client = new vs(e), this._redirectNavigator = t ?? new Ps(this.settings), this._popupNavigator = s ?? new Cs(this.settings), this._iframeNavigator = i ?? new Ts(this.settings), this._events = new Rs(this.settings), this._silentRenewService = new Us(this), this.settings.automaticSilentRenew && this.startSilentRenew(), this._sessionMonitor = null, this.settings.monitorSession && (this._sessionMonitor = new Ss(this));
   }
   /**
    * Get object used to register for events raised by the `UserManager`.
@@ -1680,19 +1880,24 @@ var rs = Ye, ns = "openid", de = class {
    * @throws `Error` In cases of wrong authentication.
    */
   async signinRedirect(e = {}) {
+    var t;
     this._logger.create("signinRedirect");
     const {
-      redirectMethod: t,
-      ...s
-    } = e, i = await this._redirectNavigator.prepare({ redirectMethod: t });
+      redirectMethod: s,
+      ...i
+    } = e;
+    let r;
+    (t = this.settings.dpop) != null && t.bind_authorization_code && (r = await this.generateDPoPJkt(this.settings.dpop));
+    const o = await this._redirectNavigator.prepare({ redirectMethod: s });
     await this._signinStart({
       request_type: "si:r",
-      ...s
-    }, i);
+      dpopJkt: r,
+      ...i
+    }, o);
   }
   /**
    * Process the response (callback) from the authorization endpoint.
-   * It is recommend to use {@link UserManager.signinCallback} instead.
+   * It is recommended to use {@link UserManager.signinCallback} instead.
    *
    * @returns A promise containing the authenticated `User`.
    *
@@ -1713,10 +1918,15 @@ var rs = Ye, ns = "openid", de = class {
     password: t,
     skipUserInfo: s = !1
   }) {
-    const i = this._logger.create("signinResourceOwnerCredential"), r = await this._client.processResourceOwnerPasswordCredentials({ username: e, password: t, skipUserInfo: s, extraTokenParams: this.settings.extraTokenParams });
+    const i = this._logger.create("signinResourceOwnerCredential"), r = await this._client.processResourceOwnerPasswordCredentials({
+      username: e,
+      password: t,
+      skipUserInfo: s,
+      extraTokenParams: this.settings.extraTokenParams
+    });
     i.debug("got signin response");
-    const n = await this._buildUser(r);
-    return n.profile && n.profile.sub ? i.info("success, signed in subject", n.profile.sub) : i.info("no subject"), n;
+    const o = await this._buildUser(r);
+    return o.profile && o.profile.sub ? i.info("success, signed in subject", o.profile.sub) : i.info("no subject"), o;
   }
   /**
    * Trigger a request (via a popup window) to the authorization endpoint.
@@ -1725,23 +1935,29 @@ var rs = Ye, ns = "openid", de = class {
    * @throws `Error` In cases of wrong authentication.
    */
   async signinPopup(e = {}) {
-    const t = this._logger.create("signinPopup"), {
-      popupWindowFeatures: s,
-      popupWindowTarget: i,
-      ...r
-    } = e, n = this.settings.popup_redirect_uri;
-    n || t.throw(new Error("No popup_redirect_uri configured"));
-    const c = await this._popupNavigator.prepare({ popupWindowFeatures: s, popupWindowTarget: i }), o = await this._signin({
+    var t;
+    const s = this._logger.create("signinPopup");
+    let i;
+    (t = this.settings.dpop) != null && t.bind_authorization_code && (i = await this.generateDPoPJkt(this.settings.dpop));
+    const {
+      popupWindowFeatures: r,
+      popupWindowTarget: o,
+      popupSignal: n,
+      ...c
+    } = e, l = this.settings.popup_redirect_uri;
+    l || s.throw(new Error("No popup_redirect_uri configured"));
+    const d = await this._popupNavigator.prepare({ popupWindowFeatures: r, popupWindowTarget: o, popupSignal: n }), h = await this._signin({
       request_type: "si:p",
-      redirect_uri: n,
+      redirect_uri: l,
       display: "popup",
-      ...r
-    }, c);
-    return o && (o.profile && o.profile.sub ? t.info("success, signed in subject", o.profile.sub) : t.info("no subject")), o;
+      dpopJkt: i,
+      ...c
+    }, d);
+    return h && (h.profile && h.profile.sub ? s.info("success, signed in subject", h.profile.sub) : s.info("no subject")), h;
   }
   /**
    * Notify the opening window of response (callback) from the authorization endpoint.
-   * It is recommend to use {@link UserManager.signinCallback} instead.
+   * It is recommended to use {@link UserManager.signinCallback} instead.
    *
    * @returns A promise
    *
@@ -1757,47 +1973,50 @@ var rs = Ye, ns = "openid", de = class {
    * @returns A promise that contains the authenticated `User`.
    */
   async signinSilent(e = {}) {
-    var t;
-    const s = this._logger.create("signinSilent"), {
-      silentRequestTimeoutInSeconds: i,
-      ...r
+    var t, s;
+    const i = this._logger.create("signinSilent"), {
+      silentRequestTimeoutInSeconds: r,
+      ...o
     } = e;
     let n = await this._loadUser();
     if (n != null && n.refresh_token) {
-      s.debug("using refresh token");
-      const d = new ks(n);
+      i.debug("using refresh token");
+      const g = new xs(n);
       return await this._useRefreshToken({
-        state: d,
-        redirect_uri: r.redirect_uri,
-        resource: r.resource,
-        extraTokenParams: r.extraTokenParams,
-        timeoutInSeconds: i
+        state: g,
+        redirect_uri: o.redirect_uri,
+        resource: o.resource,
+        extraTokenParams: o.extraTokenParams,
+        timeoutInSeconds: r
       });
     }
-    const c = this.settings.silent_redirect_uri;
-    c || s.throw(new Error("No silent_redirect_uri configured"));
-    let o;
-    n && this.settings.validateSubOnSilentRenew && (s.debug("subject prior to silent renew:", n.profile.sub), o = n.profile.sub);
-    const l = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds: i });
+    let c;
+    (t = this.settings.dpop) != null && t.bind_authorization_code && (c = await this.generateDPoPJkt(this.settings.dpop));
+    const l = this.settings.silent_redirect_uri;
+    l || i.throw(new Error("No silent_redirect_uri configured"));
+    let d;
+    n && this.settings.validateSubOnSilentRenew && (i.debug("subject prior to silent renew:", n.profile.sub), d = n.profile.sub);
+    const h = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds: r });
     return n = await this._signin({
       request_type: "si:s",
-      redirect_uri: c,
+      redirect_uri: l,
       prompt: "none",
       id_token_hint: this.settings.includeIdTokenInSilentRenew ? n == null ? void 0 : n.id_token : void 0,
-      ...r
-    }, l, o), n && ((t = n.profile) != null && t.sub ? s.info("success, signed in subject", n.profile.sub) : s.info("no subject")), n;
+      dpopJkt: c,
+      ...o
+    }, h, d), n && ((s = n.profile) != null && s.sub ? i.info("success, signed in subject", n.profile.sub) : i.info("no subject")), n;
   }
   async _useRefreshToken(e) {
     const t = await this._client.useRefreshToken({
-      ...e,
-      timeoutInSeconds: this.settings.silentRequestTimeoutInSeconds
-    }), s = new he({ ...e.state, ...t });
+      timeoutInSeconds: this.settings.silentRequestTimeoutInSeconds,
+      ...e
+    }), s = new we({ ...e.state, ...t });
     return await this.storeUser(s), await this._events.load(s), s;
   }
   /**
    *
    * Notify the parent window of response (callback) from the authorization endpoint.
-   * It is recommend to use {@link UserManager.signinCallback} instead.
+   * It is recommended to use {@link UserManager.signinCallback} instead.
    *
    * @returns A promise
    *
@@ -1814,7 +2033,7 @@ var rs = Ye, ns = "openid", de = class {
    * - {@link UserManager.signinPopupCallback}
    * - {@link UserManager.signinSilentCallback}
    *
-   * @throws `Error` If request_type is unknown or signout can not processed.
+   * @throws `Error` If request_type is unknown or signin cannot be processed.
    */
   async signinCallback(e = window.location.href) {
     const { state: t } = await this._client.readSigninResponseState(e);
@@ -1822,9 +2041,11 @@ var rs = Ye, ns = "openid", de = class {
       case "si:r":
         return await this.signinRedirectCallback(e);
       case "si:p":
-        return await this.signinPopupCallback(e);
+        await this.signinPopupCallback(e);
+        break;
       case "si:s":
-        return await this.signinSilentCallback(e);
+        await this.signinSilentCallback(e);
+        break;
       default:
         throw new Error("invalid response_type in state");
     }
@@ -1836,15 +2057,14 @@ var rs = Ye, ns = "openid", de = class {
    * - {@link UserManager.signoutPopupCallback}
    * - {@link UserManager.signoutSilentCallback}
    *
-   * @throws `Error` If request_type is unknown or signout can not processed.
+   * @throws `Error` If request_type is unknown or signout cannot be processed.
    */
   async signoutCallback(e = window.location.href, t = !1) {
     const { state: s } = await this._client.readSignoutResponseState(e);
     if (s)
       switch (s.request_type) {
         case "so:r":
-          await this.signoutRedirectCallback(e);
-          break;
+          return await this.signoutRedirectCallback(e);
         case "so:p":
           await this.signoutPopupCallback(e, t);
           break;
@@ -1866,25 +2086,25 @@ var rs = Ye, ns = "openid", de = class {
       ...i
     } = e, r = this.settings.silent_redirect_uri;
     r || t.throw(new Error("No silent_redirect_uri configured"));
-    const n = await this._loadUser(), c = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds: s }), o = await this._signinStart({
+    const o = await this._loadUser(), n = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds: s }), c = await this._signinStart({
       request_type: "si:s",
       // this acts like a signin silent
       redirect_uri: r,
       prompt: "none",
-      id_token_hint: this.settings.includeIdTokenInSilentRenew ? n == null ? void 0 : n.id_token : void 0,
+      id_token_hint: this.settings.includeIdTokenInSilentRenew ? o == null ? void 0 : o.id_token : void 0,
       response_type: this.settings.query_status_response_type,
       scope: "openid",
       skipUserInfo: !0,
       ...i
-    }, c);
+    }, n);
     try {
-      const l = await this._client.processSigninResponse(o.url);
-      return t.debug("got signin response"), l.session_state && l.profile.sub ? (t.info("success for subject", l.profile.sub), {
-        session_state: l.session_state,
-        sub: l.profile.sub
+      const l = {}, d = await this._client.processSigninResponse(c.url, l);
+      return t.debug("got signin response"), d.session_state && d.profile.sub ? (t.info("success for subject", d.profile.sub), {
+        session_state: d.session_state,
+        sub: d.profile.sub
       }) : (t.info("success, user not authenticated"), null);
     } catch (l) {
-      if (this.settings.monitorAnonymousSession && l instanceof W)
+      if (this.settings.monitorAnonymousSession && l instanceof B)
         switch (l.error) {
           case "login_required":
           case "consent_required":
@@ -1917,14 +2137,14 @@ var rs = Ye, ns = "openid", de = class {
     }
   }
   async _signinEnd(e, t) {
-    const s = this._logger.create("_signinEnd"), i = await this._client.processSigninResponse(e);
-    return s.debug("got signin response"), await this._buildUser(i, t);
+    const s = this._logger.create("_signinEnd"), i = {}, r = await this._client.processSigninResponse(e, i);
+    return s.debug("got signin response"), await this._buildUser(r, t);
   }
   async _buildUser(e, t) {
-    const s = this._logger.create("_buildUser"), i = new he(e);
+    const s = this._logger.create("_buildUser"), i = new we(e);
     if (t) {
       if (t !== i.profile.sub)
-        throw s.debug("current user does not match user returned from signin. sub from signin:", i.profile.sub), new W({ ...e, error: "login_required" });
+        throw s.debug("current user does not match user returned from signin. sub from signin:", i.profile.sub), new B({ ...e, error: "login_required" });
       s.debug("current user matches user returned from signin");
     }
     return await this.storeUser(i), s.debug("user stored"), await this._events.load(i), i;
@@ -1947,7 +2167,7 @@ var rs = Ye, ns = "openid", de = class {
   }
   /**
    * Process response (callback) from the end session endpoint.
-   * It is recommend to use {@link UserManager.signoutCallback} instead.
+   * It is recommended to use {@link UserManager.signoutCallback} instead.
    *
    * @returns A promise containing signout response
    *
@@ -1958,7 +2178,7 @@ var rs = Ye, ns = "openid", de = class {
     return t.info("success"), s;
   }
   /**
-   * Trigger a redirect of a popup window window to the end session endpoint.
+   * Trigger a redirect of a popup window to the end session endpoint.
    *
    * @returns A promise
    */
@@ -1966,8 +2186,9 @@ var rs = Ye, ns = "openid", de = class {
     const t = this._logger.create("signoutPopup"), {
       popupWindowFeatures: s,
       popupWindowTarget: i,
-      ...r
-    } = e, n = this.settings.popup_post_logout_redirect_uri, c = await this._popupNavigator.prepare({ popupWindowFeatures: s, popupWindowTarget: i });
+      popupSignal: r,
+      ...o
+    } = e, n = this.settings.popup_post_logout_redirect_uri, c = await this._popupNavigator.prepare({ popupWindowFeatures: s, popupWindowTarget: i, popupSignal: r });
     await this._signout({
       request_type: "so:p",
       post_logout_redirect_uri: n,
@@ -1977,12 +2198,12 @@ var rs = Ye, ns = "openid", de = class {
       // plan to return back to the client after signout
       // and so we can close the popup after signout
       state: n == null ? void 0 : {},
-      ...r
+      ...o
     }, c), t.info("success");
   }
   /**
    * Process response (callback) from the end session endpoint from a popup window.
-   * It is recommend to use {@link UserManager.signoutCallback} instead.
+   * It is recommended to use {@link UserManager.signoutCallback} instead.
    *
    * @returns A promise
    *
@@ -2002,12 +2223,12 @@ var rs = Ye, ns = "openid", de = class {
     try {
       const r = await this._loadUser();
       i.debug("loaded current user from storage"), this.settings.revokeTokensOnSignout && await this._revokeInternal(r);
-      const n = e.id_token_hint || r && r.id_token;
-      n && (i.debug("setting id_token_hint in signout request"), e.id_token_hint = n), await this.removeUser(), i.debug("user removed, creating signout request");
-      const c = await this._client.createSignoutRequest(e);
+      const o = e.id_token_hint || r && r.id_token;
+      o && (i.debug("setting id_token_hint in signout request"), e.id_token_hint = o), await this.removeUser(), i.debug("user removed, creating signout request");
+      const n = await this._client.createSignoutRequest(e);
       return i.debug("got signout request"), await t.navigate({
-        url: c.url,
-        state: (s = c.state) == null ? void 0 : s.id,
+        url: n.url,
+        state: (s = n.state) == null ? void 0 : s.id,
         scriptOrigin: this.settings.iframeScriptOrigin
       });
     } catch (r) {
@@ -2028,17 +2249,17 @@ var rs = Ye, ns = "openid", de = class {
     const s = this._logger.create("signoutSilent"), {
       silentRequestTimeoutInSeconds: i,
       ...r
-    } = e, n = this.settings.includeIdTokenInSilentSignout ? (t = await this._loadUser()) == null ? void 0 : t.id_token : void 0, c = this.settings.popup_post_logout_redirect_uri, o = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds: i });
+    } = e, o = this.settings.includeIdTokenInSilentSignout ? (t = await this._loadUser()) == null ? void 0 : t.id_token : void 0, n = this.settings.popup_post_logout_redirect_uri, c = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds: i });
     await this._signout({
       request_type: "so:s",
-      post_logout_redirect_uri: c,
-      id_token_hint: n,
+      post_logout_redirect_uri: n,
+      id_token_hint: o,
       ...r
-    }, o), s.info("success");
+    }, c), s.info("success");
   }
   /**
    * Notify the parent window of response (callback) from the end session endpoint.
-   * It is recommend to use {@link UserManager.signoutCallback} instead.
+   * It is recommended to use {@link UserManager.signoutCallback} instead.
    *
    * @returns A promise
    *
@@ -2054,8 +2275,7 @@ var rs = Ye, ns = "openid", de = class {
   }
   async _revokeInternal(e, t = this.settings.revokeTokenTypes) {
     const s = this._logger.create("_revokeInternal");
-    if (!e)
-      return;
+    if (!e) return;
     const i = t.filter((r) => typeof e[r] == "string");
     if (!i.length) {
       s.debug("no need to revoke due to no token(s)");
@@ -2086,7 +2306,7 @@ var rs = Ye, ns = "openid", de = class {
   }
   async _loadUser() {
     const e = this._logger.create("_loadUser"), t = await this.settings.userStore.get(this._userStoreKey);
-    return t ? (e.debug("user storageString loaded"), he.fromStorageString(t)) : (e.debug("no user storageString"), null);
+    return t ? (e.debug("user storageString loaded"), we.fromStorageString(t)) : (e.debug("no user storageString"), null);
   }
   async storeUser(e) {
     const t = this._logger.create("storeUser");
@@ -2095,7 +2315,7 @@ var rs = Ye, ns = "openid", de = class {
       const s = e.toStorageString();
       await this.settings.userStore.set(this._userStoreKey, s);
     } else
-      this._logger.debug("removing user"), await this.settings.userStore.remove(this._userStoreKey);
+      this._logger.debug("removing user"), await this.settings.userStore.remove(this._userStoreKey), this.settings.dpop && await this.settings.dpop.store.remove(this.settings.client_id);
   }
   /**
    * Removes stale state entries in storage for incomplete authorize requests.
@@ -2103,83 +2323,113 @@ var rs = Ye, ns = "openid", de = class {
   async clearStaleState() {
     await this._client.clearStaleState();
   }
+  /**
+   * Dynamically generates a DPoP proof for a given user, URL and optional Http method.
+   * This method is useful when you need to make a request to a resource server
+   * with fetch or similar, and you need to include a DPoP proof in a DPoP header.
+   * @param url - The URL to generate the DPoP proof for
+   * @param user - The user to generate the DPoP proof for
+   * @param httpMethod - Optional, defaults to "GET"
+   * @param nonce - Optional nonce provided by the resource server
+   *
+   * @returns A promise containing the DPoP proof or undefined if DPoP is not enabled/no user is found.
+   */
+  async dpopProof(e, t, s, i) {
+    var r, o;
+    const n = await ((o = (r = this.settings.dpop) == null ? void 0 : r.store) == null ? void 0 : o.get(this.settings.client_id));
+    if (n)
+      return await C.generateDPoPProof({
+        url: e,
+        accessToken: t == null ? void 0 : t.access_token,
+        httpMethod: s,
+        keyPair: n.keys,
+        nonce: i
+      });
+  }
+  async generateDPoPJkt(e) {
+    let t = await e.store.get(this.settings.client_id);
+    if (!t) {
+      const s = await C.generateDPoPKeys();
+      t = new ot(s), await e.store.set(this.settings.client_id, t);
+    }
+    return await C.generateDPoPJkt(t.keys);
+  }
 };
-const Is = ["url", "clientId", "redirectUri", "scope"], Es = "openid profile email";
-function Cs(e, t) {
+const Os = ["url", "clientId", "redirectUri", "scope", "logoutUrl"], Ns = "openid profile email";
+function qs(e, t) {
   const s = {};
   return e.forEach((i) => {
     t[i] !== void 0 && (s[i] = t[i]);
   }), s;
 }
-let _;
-const Rs = (e) => {
-  const t = Cs(Is, e);
-  return new Ts({
-    authority: t.url,
-    client_id: t.clientId,
-    redirect_uri: t.redirectUri,
-    response_type: "code",
-    scope: t.scope || Es,
-    filterProtocolClaims: !0,
-    includeIdTokenInSilentRenew: !0,
-    includeIdTokenInSilentSignout: !0,
-    loadUserInfo: !0
-  });
-}, xs = async () => {
+let p, V;
+const Ds = (e) => (V = qs(Os, e), new As({
+  authority: V.url,
+  client_id: V.clientId,
+  redirect_uri: V.redirectUri,
+  response_type: "code",
+  scope: V.scope || Ns,
+  filterProtocolClaims: !0,
+  includeIdTokenInSilentRenew: !0,
+  includeIdTokenInSilentSignout: !0,
+  loadUserInfo: !0
+})), js = async () => {
   try {
     console.debug("[Auth] Logging in using OIDC");
-    const e = new URL(window.location.href), t = await (_ == null ? void 0 : _.getUser());
-    e.searchParams.get("state") || t ? await (_ == null ? void 0 : _.signinRedirectCallback()) : await (_ == null ? void 0 : _.signinRedirect().then(() => {
-      _ == null || _.startSilentRenew(), _ == null || _.signinRedirectCallback();
+    const e = new URL(window.location.href), t = await (p == null ? void 0 : p.getUser());
+    e.searchParams.get("state") || t ? await (p == null ? void 0 : p.signinRedirectCallback()) : await (p == null ? void 0 : p.signinRedirect().then(() => {
+      p == null || p.startSilentRenew(), p == null || p.signinRedirectCallback();
     }).catch((s) => {
       console.log(s);
     }));
   } catch (e) {
     console.error("[Auth] Error logging in using OIDC: ", e);
   }
-}, Us = async () => _ == null ? void 0 : _.removeUser().then(() => _ == null ? void 0 : _.signoutRedirect({ post_logout_redirect_uri: window.location.href })), As = async () => await (_ == null ? void 0 : _.getUser()) != null, Ps = async () => {
-  const e = await (_ == null ? void 0 : _.getUser());
+}, Fs = async () => p == null ? void 0 : p.removeUser().then(() => p == null ? void 0 : p.signoutRedirect({
+  post_logout_redirect_uri: V.logoutUrl || window.location.href
+})), $s = async () => await (p == null ? void 0 : p.getUser()) != null, Hs = async () => {
+  const e = await (p == null ? void 0 : p.getUser());
   return Promise.resolve(e == null ? void 0 : e.id_token);
-}, Os = async () => {
-  const e = await (_ == null ? void 0 : _.getUser());
+}, Ls = async () => {
+  const e = await (p == null ? void 0 : p.getUser());
   return Promise.resolve(e == null ? void 0 : e.profile.preferred_username);
 };
-let z, G;
-const Ns = async (e, t) => {
+let G, Z;
+const Ms = async (e, t) => {
   try {
-    console.debug("[Auth] Setting Username and Password for BasicAuth"), z = e, G = t;
+    console.debug("[Auth] Setting Username and Password for BasicAuth"), G = e, Z = t;
   } catch (s) {
     console.error("[Auth] Error logging in using BasicAuth: ", s);
   }
-}, qs = async () => {
-  console.debug("[Auth] Logout for BasicAuth"), z = void 0, G = void 0, window.location.reload();
-}, js = async () => z !== void 0 && G !== void 0, Hs = async () => Promise.resolve(z), Ls = () => {
-  if (z !== void 0 && G != null)
+}, Ws = async () => {
+  console.debug("[Auth] Logout for BasicAuth"), G = void 0, Z = void 0, window.location.reload();
+}, Js = async () => G !== void 0 && Z !== void 0, Ks = async () => Promise.resolve(G), Bs = () => {
+  if (G !== void 0 && Z != null)
     return {
-      username: z,
-      password: G
+      username: G,
+      password: Z
     };
-}, ot = () => {
-  const e = gt(Wt);
-  return e.type === "oidc" ? (_ === void 0 && (console.debug("[Auth] Creating OIDC UserManager with options: ", e.options), _ = Rs(e.options)), {
+}, ut = () => {
+  const e = wt(Xt);
+  return e.type === "oidc" ? (p === void 0 && (console.debug("[Auth] Creating OIDC UserManager with options: ", e.options), p = Ds(e.options)), {
     isOidcAuthEnabled: () => !0,
     isBasicAuthEnabled: () => !1,
-    isAuthenticated: As,
-    getToken: Ps,
+    isAuthenticated: $s,
+    getToken: Hs,
     getUsernameAndPassword: () => {
     },
-    getUsername: Os,
-    login: xs,
-    logout: Us
+    getUsername: Ls,
+    login: js,
+    logout: Fs
   }) : e.type === "basic" ? {
     isOidcAuthEnabled: () => !1,
     isBasicAuthEnabled: () => !0,
-    isAuthenticated: js,
+    isAuthenticated: Js,
     getToken: () => Promise.resolve(void 0),
-    getUsernameAndPassword: Ls,
-    getUsername: Hs,
-    login: Ns,
-    logout: qs
+    getUsernameAndPassword: Bs,
+    getUsername: Ks,
+    login: Ms,
+    logout: Ws
   } : {
     isOidcAuthEnabled: () => !1,
     isBasicAuthEnabled: () => !1,
@@ -2191,95 +2441,95 @@ const Ns = async (e, t) => {
     login: () => Promise.resolve(),
     logout: () => Promise.resolve()
   };
-}, be = (e) => {
-  const [t, s] = I(null), i = e.format || "locale";
-  return ke(() => {
+}, Ce = (e) => {
+  const [t, s] = y(null), i = e.format || "locale";
+  return Re(() => {
     let r;
-    if (e.date && typeof e.date == "string" ? r = le.fromISO(e.date) : e.date && typeof e.date == "object" && (r = le.fromJSDate(e.date)), r) {
-      const n = {
+    if (e.date && typeof e.date == "string" ? r = fe.fromISO(e.date) : e.date && typeof e.date == "object" && (r = fe.fromJSDate(e.date)), r) {
+      const o = {
         locale: e.locale
       };
-      s(i === "fromNow" ? r.toRelative() : i === "locale" ? r.toLocaleString(le.DATETIME_FULL, n) : r.toFormat(i, n));
+      s(i === "fromNow" ? r.toRelative() : i === "locale" ? r.toLocaleString(fe.DATETIME_FULL, o) : r.toFormat(i, o));
     } else
       s(null);
   }, [e.date]), /* @__PURE__ */ a("span", { children: t || "" });
-}, Xs = (e) => /* @__PURE__ */ a(be, { date: e.date, format: "fromNow" }), A = ({ condition: e, children: t }) => (typeof e == "boolean" ? e : e()) ? /* @__PURE__ */ a(j.Fragment, { children: t }) : /* @__PURE__ */ a(j.Fragment, {}), Ys = ({ collection: e, emptyState: t, emptyStateTitle: s, emptyStateMessage: i, children: r }) => {
-  const n = () => !e || e.length === 0, c = t || /* @__PURE__ */ f(ee, { variant: ut.xs, children: [
-    /* @__PURE__ */ a(te, { titleText: s || "None found", headingLevel: "h4" }),
-    /* @__PURE__ */ a(ge, { children: i || "No items found." })
+}, oi = (e) => /* @__PURE__ */ a(Ce, { date: e.date, format: "fromNow" }), O = ({ condition: e, children: t }) => (typeof e == "boolean" ? e : e()) ? /* @__PURE__ */ a(H.Fragment, { children: t }) : /* @__PURE__ */ a(H.Fragment, {}), ai = ({ collection: e, emptyState: t, emptyStateTitle: s, emptyStateMessage: i, children: r }) => {
+  const o = () => !e || e.length === 0, n = t || /* @__PURE__ */ m(re, { variant: vt.xs, children: [
+    /* @__PURE__ */ a(ne, { titleText: s || "None found", headingLevel: "h4" }),
+    /* @__PURE__ */ a(ve, { children: i || "No items found." })
   ] });
-  return n() ? /* @__PURE__ */ a(j.Fragment, { children: c }) : /* @__PURE__ */ a(j.Fragment, { children: r });
-}, ne = ({ isLoading: e, loadingComponent: t, children: s }) => {
-  const i = () => typeof e == "boolean" ? e : e(), r = t || /* @__PURE__ */ a(Q, {});
-  return i() ? /* @__PURE__ */ a(j.Fragment, { children: r }) : /* @__PURE__ */ a(j.Fragment, { children: s });
-}, Zs = ({ toolbar: e, alwaysShowToolbar: t, emptyState: s, filteredEmptyState: i, isLoading: r, isError: n, loadingComponent: c, errorComponent: o, isEmpty: l, isFiltered: d, children: h }) => {
-  const g = t || !l || d || n;
-  return o || (o = /* @__PURE__ */ a("div", { style: { padding: "15px", backgroundColor: "white" }, children: /* @__PURE__ */ a(_t, { isInline: !0, variant: "danger", title: "Error: Something went wrong!", children: /* @__PURE__ */ a("p", { children: "Something went wrong with the action you attempted, but we're not sure what it was. Try reloading the page and hopef for a better result, or contact your admin to report the error." }) }) })), /* @__PURE__ */ f(j.Fragment, { children: [
-    /* @__PURE__ */ a(A, { condition: g, children: e }),
-    /* @__PURE__ */ f(ne, { isLoading: r, loadingComponent: c, children: [
-      /* @__PURE__ */ a(A, { condition: !l && !n, children: h }),
-      /* @__PURE__ */ a(A, { condition: l && d && !n, children: i }),
-      /* @__PURE__ */ a(A, { condition: l && !d && !n, children: s }),
-      /* @__PURE__ */ a(A, { condition: n, children: o })
+  return o() ? /* @__PURE__ */ a(H.Fragment, { children: n }) : /* @__PURE__ */ a(H.Fragment, { children: r });
+}, ge = ({ isLoading: e, loadingComponent: t, children: s }) => {
+  const i = () => typeof e == "boolean" ? e : e(), r = t || /* @__PURE__ */ a(ee, {});
+  return i() ? /* @__PURE__ */ a(H.Fragment, { children: r }) : /* @__PURE__ */ a(H.Fragment, { children: s });
+}, ci = ({ toolbar: e, alwaysShowToolbar: t, emptyState: s, filteredEmptyState: i, isLoading: r, isError: o, loadingComponent: n, errorComponent: c, isEmpty: l, isFiltered: d, children: h }) => {
+  const g = t || !l || d || o;
+  return c || (c = /* @__PURE__ */ a("div", { style: { padding: "15px", backgroundColor: "white" }, children: /* @__PURE__ */ a(St, { isInline: !0, variant: "danger", title: "Error: Something went wrong!", children: /* @__PURE__ */ a("p", { children: "Something went wrong with the action you attempted, but we're not sure what it was. Try reloading the page and hopef for a better result, or contact your admin to report the error." }) }) })), /* @__PURE__ */ m(H.Fragment, { children: [
+    /* @__PURE__ */ a(O, { condition: g, children: e }),
+    /* @__PURE__ */ m(ge, { isLoading: r, loadingComponent: n, children: [
+      /* @__PURE__ */ a(O, { condition: !l && !o, children: h }),
+      /* @__PURE__ */ a(O, { condition: l && d && !o, children: i }),
+      /* @__PURE__ */ a(O, { condition: l && !d && !o, children: s }),
+      /* @__PURE__ */ a(O, { condition: o, children: c })
     ] })
   ] });
-}, ei = (e) => {
-  const [t, s] = I(!1), i = (l, d) => {
+}, li = (e) => {
+  const [t, s] = y(!1), i = (l, d) => {
     s(!1);
     const h = d;
     h !== void 0 && h >= 0 ? e.onSelect(e.items[h]) : e.onSelect(void 0);
   }, r = () => {
     s(!t);
-  }, n = (l) => {
+  }, o = (l) => {
     let d;
     return e.itemToTestId !== void 0 && (d = e.itemToTestId(l)), d;
-  }, c = e.popperProps || {
+  }, n = e.popperProps || {
     appendTo: e.menuAppendTo
   };
-  let o = /* @__PURE__ */ a(Ot, { title: e.label });
-  return e.isKebab || (o = /* @__PURE__ */ a(j.Fragment, { children: e.label })), /* @__PURE__ */ a(
-    pt,
+  let c = /* @__PURE__ */ a(Ht, { title: e.label });
+  return e.isKebab || (c = /* @__PURE__ */ a(H.Fragment, { children: e.label })), /* @__PURE__ */ a(
+    yt,
     {
       isOpen: t,
       onSelect: i,
       onOpenChange: (l) => s(l),
       toggle: (l) => /* @__PURE__ */ a(
-        ae,
+        _e,
         {
           "data-testid": e.testId,
           ref: l,
           onClick: r,
           isExpanded: t,
           variant: e.isKebab ? "plain" : "default",
-          children: o
+          children: c
         }
       ),
       ouiaId: "ObjectDropdown",
-      popperProps: c,
+      popperProps: n,
       shouldFocusToggleOnSelect: !0,
-      children: /* @__PURE__ */ a(ft, { children: e.items.map((l, d) => e.itemIsVisible !== void 0 && !e.itemIsVisible(l) ? /* @__PURE__ */ a(oe, {}) : e.itemIsDivider && e.itemIsDivider(l) ? /* @__PURE__ */ a(ze, { component: "li" }, `divider-${d}`) : /* @__PURE__ */ a(
-        mt,
+      children: /* @__PURE__ */ a(bt, { children: e.items.map((l, d) => e.itemIsVisible !== void 0 && !e.itemIsVisible(l) ? /* @__PURE__ */ a(ue, {}) : e.itemIsDivider && e.itemIsDivider(l) ? /* @__PURE__ */ a(Ve, { component: "li" }, `divider-${d}`) : /* @__PURE__ */ a(
+        kt,
         {
           value: d,
           isDisabled: e.itemIsDisabled === void 0 ? !1 : e.itemIsDisabled(l),
-          component: (h) => /* @__PURE__ */ a("button", { ...h, "data-testid": n(l) }),
+          component: (h) => /* @__PURE__ */ a("button", { ...h, "data-testid": o(l) }),
           children: e.itemToString(l)
         },
         `action-${d}`
       )) })
     }
   );
-}, ti = (e) => {
+}, zs = (e) => {
   var l;
-  const [t, s] = I(!1), i = (d, h) => {
+  const [t, s] = y(!1), i = (d, h) => {
     s(!1), e.onSelect(e.items[h]);
   }, r = () => {
     s(!t);
-  }, n = (d) => {
+  }, o = (d) => {
     let h;
     return e.itemToTestId !== void 0 && (h = e.itemToTestId(d)), h;
-  }, c = (d) => /* @__PURE__ */ a(
-    ae,
+  }, n = (d) => /* @__PURE__ */ a(
+    _e,
     {
       ref: d,
       className: e.toggleClassname || "menu-toggle",
@@ -2288,23 +2538,23 @@ const Ns = async (e, t) => {
       isExpanded: t,
       children: e.value ? e.itemToString(e.value) : e.noSelectionLabel
     }
-  ), o = {
+  ), c = {
     appendTo: e.appendTo === "document" ? () => document.body : "inline"
   };
   return /* @__PURE__ */ a(
-    Ie,
+    xe,
     {
-      toggle: c,
+      toggle: n,
       id: e.toggleId,
       onSelect: i,
       onOpenChange: s,
       isOpen: t,
-      popperProps: o,
-      children: (l = e.items) == null ? void 0 : l.map((d, h) => e.itemIsDivider && e.itemIsDivider(d) ? /* @__PURE__ */ a(ze, {}, h) : /* @__PURE__ */ a(
-        Ee,
+      popperProps: c,
+      children: (l = e.items) == null ? void 0 : l.map((d, h) => e.itemIsDivider && e.itemIsDivider(d) ? /* @__PURE__ */ a(Ve, {}, h) : /* @__PURE__ */ a(
+        Ae,
         {
           isSelected: d === e.value,
-          component: (g) => /* @__PURE__ */ a("button", { ...g, "data-testid": n(d) }),
+          component: (g) => /* @__PURE__ */ a("button", { ...g, "data-testid": o(d) }),
           value: h,
           children: e.itemToString(d)
         },
@@ -2312,36 +2562,36 @@ const Ns = async (e, t) => {
       ))
     }
   );
-}, si = ({ expanded: e, onClick: t }) => e ? /* @__PURE__ */ a(Nt, { onClick: t, style: { cursor: "pointer" } }) : /* @__PURE__ */ a(qt, { onClick: t, style: { cursor: "pointer" } }), at = {
+}, di = ({ expanded: e, onClick: t }) => e ? /* @__PURE__ */ a(Lt, { onClick: t, style: { cursor: "pointer" } }) : /* @__PURE__ */ a(Mt, { onClick: t, style: { cursor: "pointer" } }), _t = {
   padding: "5px",
   minHeight: "128px",
   borderRight: 0,
   borderLeft: 0,
   borderBottom: "1px solid #666",
   backgroundColor: "rgb(240, 240, 240)"
-}, Ms = {
-  ...at,
+}, Vs = {
+  ..._t,
   color: "red",
   overflow: "auto"
-}, ii = (e) => {
-  const [t, s] = I(""), [i, r] = I(""), [n, c] = I(!1), [o, l] = I(), d = (k, x) => {
-    s(x);
-  }, h = () => t != null && t.trim().length > 0, g = () => o != null && o.trim().length > 0, v = () => {
-    c(!0), e.onUrlFetch(t).then((k) => {
-      l(void 0), r(k), c(!1), e.onChange(k, t);
-    }).catch((k) => {
-      l(k.message), c(!1);
+}, hi = (e) => {
+  const [t, s] = y(""), [i, r] = y(""), [o, n] = y(!1), [c, l] = y(), d = (T, A) => {
+    s(A);
+  }, h = () => t != null && t.trim().length > 0, g = () => c != null && c.trim().length > 0, _ = () => {
+    n(!0), e.onUrlFetch(t).then((T) => {
+      l(void 0), r(T), n(!1), e.onChange(T, t);
+    }).catch((T) => {
+      l(T.message), n(!1);
     });
-  }, b = () => {
+  }, S = () => {
     s(""), r(""), e.onChange(void 0, void 0);
-  }, R = /* @__PURE__ */ f("div", { className: "url-upload-loading", style: at, children: [
-    /* @__PURE__ */ a(Q, { size: "md", className: "spinner", style: { marginRight: "5px" } }),
+  }, x = /* @__PURE__ */ m("div", { className: "url-upload-loading", style: _t, children: [
+    /* @__PURE__ */ a(ee, { size: "md", className: "spinner", style: { marginRight: "5px" } }),
     /* @__PURE__ */ a("span", { className: "spinner-message", children: "Loading URL content" })
   ] });
-  return /* @__PURE__ */ f("div", { className: "url-upload", "data-testid": e.testId, children: [
-    /* @__PURE__ */ f("div", { className: "url-upload-flex", style: { display: "flex" }, children: [
+  return /* @__PURE__ */ m("div", { className: "url-upload", "data-testid": e.testId, children: [
+    /* @__PURE__ */ m("div", { className: "url-upload-flex", style: { display: "flex" }, children: [
       /* @__PURE__ */ a("div", { className: "url-upload-url", style: { flexGrow: 1 }, children: /* @__PURE__ */ a(
-        ue,
+        oe,
         {
           "data-testid": `${e.testId}-input`,
           value: t,
@@ -2352,16 +2602,16 @@ const Ns = async (e, t) => {
           "aria-label": "url input"
         }
       ) }),
-      /* @__PURE__ */ a("div", { className: "url-fetch-button", children: /* @__PURE__ */ a(_e, { "data-testid": `${e.testId}-fetch`, variant: "control", isDisabled: !h(), onClick: v, children: "Fetch" }) }),
-      /* @__PURE__ */ a("div", { className: "url-clear-button", children: /* @__PURE__ */ a(_e, { "data-testid": `${e.testId}-clear`, variant: "control", isDisabled: !h(), onClick: b, children: "Clear" }) })
+      /* @__PURE__ */ a("div", { className: "url-fetch-button", children: /* @__PURE__ */ a(ae, { "data-testid": `${e.testId}-fetch`, variant: "control", isDisabled: !h(), onClick: _, children: "Fetch" }) }),
+      /* @__PURE__ */ a("div", { className: "url-clear-button", children: /* @__PURE__ */ a(ae, { "data-testid": `${e.testId}-clear`, variant: "control", isDisabled: !h(), onClick: S, children: "Clear" }) })
     ] }),
-    /* @__PURE__ */ a("div", { className: "url-upload-preview", children: /* @__PURE__ */ f(ne, { isLoading: n, loadingComponent: R, children: [
-      /* @__PURE__ */ a(A, { condition: g, children: /* @__PURE__ */ f("div", { className: "url-upload-error", style: Ms, children: [
+    /* @__PURE__ */ a("div", { className: "url-upload-preview", children: /* @__PURE__ */ m(ge, { isLoading: o, loadingComponent: x, children: [
+      /* @__PURE__ */ a(O, { condition: g, children: /* @__PURE__ */ m("div", { className: "url-upload-error", style: Vs, children: [
         /* @__PURE__ */ a("div", { children: "Error getting content from URL." }),
-        /* @__PURE__ */ a("div", { children: o })
+        /* @__PURE__ */ a("div", { children: c })
       ] }) }),
-      /* @__PURE__ */ a(A, { condition: !g(), children: /* @__PURE__ */ a(
-        wt,
+      /* @__PURE__ */ a(O, { condition: !g(), children: /* @__PURE__ */ a(
+        Tt,
         {
           "data-testid": `${e.testId}-preview`,
           "aria-label": "url-content",
@@ -2372,25 +2622,65 @@ const Ns = async (e, t) => {
       ) })
     ] }) })
   ] });
-}, Fs = (e) => {
-  const [t, s] = I({
+}, gi = (e) => {
+  const [t, s] = y(), [i, r] = y();
+  return Re(() => {
+    e.isOpen && (typeof e.frontendInfo == "function" ? e.frontendInfo().then(s) : s(e.frontendInfo), typeof e.backendInfo == "function" ? e.backendInfo().then(r) : r(e.backendInfo));
+  }, [e.isOpen]), /* @__PURE__ */ a(
+    It,
+    {
+      className: "app-about-modal",
+      isOpen: e.isOpen,
+      onClose: e.onClose,
+      trademark: "© 2024 Red Hat",
+      brandImageSrc: e.brandImageSrc,
+      brandImageAlt: e.brandImageAlt,
+      "aria-label": e.brandImageAlt,
+      children: /* @__PURE__ */ m(Et, { className: "app-about-modal-content", style: { marginTop: "-25px" }, children: [
+        /* @__PURE__ */ a($e, { component: He.h2, children: "Web console info" }),
+        /* @__PURE__ */ a(ge, { isLoading: t === void 0, children: /* @__PURE__ */ m(Le, { component: "dl", children: [
+          /* @__PURE__ */ a(k, { component: "dt", children: "Project" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: /* @__PURE__ */ a("a", { href: t == null ? void 0 : t.url, target: "_blank", children: t == null ? void 0 : t.name }) }),
+          /* @__PURE__ */ a(k, { component: "dt", children: "Version" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: t == null ? void 0 : t.version }),
+          /* @__PURE__ */ a(k, { component: "dt", children: "Built on" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: /* @__PURE__ */ a(Ce, { date: t == null ? void 0 : t.builtOn, format: "locale" }) }),
+          /* @__PURE__ */ a(k, { component: "dt", children: "Digest" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: t == null ? void 0 : t.digest })
+        ] }) }),
+        /* @__PURE__ */ a($e, { style: { marginTop: "40px" }, component: He.h2, children: e.backendLabel }),
+        /* @__PURE__ */ a(ge, { isLoading: i === void 0, children: /* @__PURE__ */ m(Le, { component: "dl", children: [
+          /* @__PURE__ */ a(k, { component: "dt", children: "Name" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: (i == null ? void 0 : i.name) || "" }),
+          /* @__PURE__ */ a(k, { component: "dt", children: "Description" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: (i == null ? void 0 : i.description) || "" }),
+          /* @__PURE__ */ a(k, { component: "dt", children: "Version" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: (i == null ? void 0 : i.version) || "" }),
+          /* @__PURE__ */ a(k, { component: "dt", children: "Built on" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: /* @__PURE__ */ a(Ce, { date: i == null ? void 0 : i.builtOn, format: "locale" }) })
+        ] }) })
+      ] })
+    }
+  );
+}, Gs = (e) => {
+  const [t, s] = y({
     username: "",
     password: ""
   }), i = () => {
     e.onLogin(t);
-  }, r = (c, o) => {
+  }, r = (n, c) => {
     s({
       ...t,
-      username: o
+      username: c
     });
-  }, n = (c, o) => {
+  }, o = (n, c) => {
     s({
       ...t,
-      password: o
+      password: c
     });
   };
   return /* @__PURE__ */ a(
-    Ce,
+    Oe,
     {
       title: "Login",
       variant: "small",
@@ -2401,16 +2691,16 @@ const Ns = async (e, t) => {
       "aria-label": "please-wait-modal",
       style: { marginTop: "-15px" },
       actions: [
-        /* @__PURE__ */ a(_e, { variant: "primary", "data-testid": "modal-btn-login", onClick: i, isDisabled: (t == null ? void 0 : t.username) === "" || (t == null ? void 0 : t.password) === "", children: "Login" }, "login")
+        /* @__PURE__ */ a(ae, { variant: "primary", "data-testid": "modal-btn-login", onClick: i, isDisabled: (t == null ? void 0 : t.username) === "" || (t == null ? void 0 : t.password) === "", children: "Login" }, "login")
       ],
-      children: /* @__PURE__ */ f(vt, { children: [
+      children: /* @__PURE__ */ m(Ge, { children: [
         /* @__PURE__ */ a(
-          qe,
+          Me,
           {
             label: "Username",
             fieldId: "form-username",
             children: /* @__PURE__ */ a(
-              ue,
+              oe,
               {
                 isRequired: !0,
                 type: "text",
@@ -2425,12 +2715,12 @@ const Ns = async (e, t) => {
           }
         ),
         /* @__PURE__ */ a(
-          qe,
+          Me,
           {
             label: "Password",
             fieldId: "form-password",
             children: /* @__PURE__ */ a(
-              ue,
+              oe,
               {
                 isRequired: !0,
                 type: "text",
@@ -2439,7 +2729,7 @@ const Ns = async (e, t) => {
                 name: "form-password",
                 value: t == null ? void 0 : t.password,
                 placeholder: "Password",
-                onChange: n
+                onChange: o
               }
             )
           }
@@ -2447,24 +2737,52 @@ const Ns = async (e, t) => {
       ] })
     }
   );
-}, ri = (e) => {
-  const [t, s] = I(
+}, ui = (e) => /* @__PURE__ */ m(
+  Oe,
+  {
+    title: "Please Wait",
+    variant: "small",
+    isOpen: e.isOpen,
+    header: /* @__PURE__ */ a("a", { href: "#" }),
+    showClose: !1,
+    className: "please-wait pf-m-redhat-font",
+    "aria-label": "please-wait-modal",
+    style: { marginTop: "-15px" },
+    children: [
+      /* @__PURE__ */ a(ee, { size: "md", className: "spinner" }),
+      /* @__PURE__ */ a("span", { className: "message", style: { fontSize: "15px", color: "#333", marginLeft: "10px" }, children: e.message })
+    ]
+  }
+), _i = (e) => /* @__PURE__ */ a(
+  Oe,
+  {
+    title: e.title,
+    variant: "small",
+    isOpen: e.isOpen,
+    showClose: e.isCloseable,
+    onClose: e.onClose,
+    className: "progress pf-m-redhat-font",
+    "aria-label": "progress-modal",
+    children: /* @__PURE__ */ a(Ct, { title: e.message, value: e.progress })
+  }
+), pi = (e) => {
+  const [t, s] = y(
     0
     /* AUTHENTICATING */
-  ), i = ot(), r = (n) => {
-    console.info("[ApplicationAuth] Using username and password."), i.login(n.username, n.password), s(
+  ), i = ut(), r = (o) => {
+    console.info("[ApplicationAuth] Using username and password."), i.login(o.username, o.password), s(
       1
       /* AUTHENTICATED */
     );
   };
-  return ke(() => {
+  return Re(() => {
     i.isOidcAuthEnabled() ? i.login("", "").then(() => {
       console.info("[ApplicationAuth] Authentication successful."), s(
         1
         /* AUTHENTICATED */
       );
-    }).catch((n) => {
-      console.error("[ApplicationAuth] Authentication failed: ", n), s(
+    }).catch((o) => {
+      console.error("[ApplicationAuth] Authentication failed: ", o), s(
         2
         /* AUTHENTICATION_FAILED */
       );
@@ -2472,403 +2790,382 @@ const Ns = async (e, t) => {
       1
       /* AUTHENTICATED */
     );
-  }, []), /* @__PURE__ */ f(oe, { children: [
-    /* @__PURE__ */ a(A, { condition: t === 0 && i.isOidcAuthEnabled(), children: /* @__PURE__ */ f(ee, { children: [
-      /* @__PURE__ */ a(te, { titleText: "Loading", headingLevel: "h4" }),
-      /* @__PURE__ */ a(ge, { children: /* @__PURE__ */ a(Q, { size: "xl", "aria-label": "Loading spinner" }) })
+  }, []), /* @__PURE__ */ m(ue, { children: [
+    /* @__PURE__ */ a(O, { condition: t === 0 && i.isOidcAuthEnabled(), children: /* @__PURE__ */ m(re, { children: [
+      /* @__PURE__ */ a(ne, { titleText: "Loading", headingLevel: "h4" }),
+      /* @__PURE__ */ a(ve, { children: /* @__PURE__ */ a(ee, { size: "xl", "aria-label": "Loading spinner" }) })
     ] }) }),
-    /* @__PURE__ */ a(A, { condition: t === 0 && i.isBasicAuthEnabled(), children: /* @__PURE__ */ a(Fs, { onLogin: r }) }),
-    /* @__PURE__ */ a(A, { condition: t === 2, children: /* @__PURE__ */ f(ee, { children: [
-      /* @__PURE__ */ a(te, { titleText: "Empty state", headingLevel: "h4", icon: /* @__PURE__ */ a(Je, { icon: jt }) }),
-      /* @__PURE__ */ a(ge, { children: "Authentication failed." })
+    /* @__PURE__ */ a(O, { condition: t === 0 && i.isBasicAuthEnabled(), children: /* @__PURE__ */ a(Gs, { onLogin: r }) }),
+    /* @__PURE__ */ a(O, { condition: t === 2, children: /* @__PURE__ */ m(re, { children: [
+      /* @__PURE__ */ a(ne, { titleText: "Empty state", headingLevel: "h4", icon: /* @__PURE__ */ a(Qe, { icon: Wt }) }),
+      /* @__PURE__ */ a(ve, { children: "Authentication failed." })
     ] }) }),
-    /* @__PURE__ */ a(A, { condition: t === 1, children: e.children })
+    /* @__PURE__ */ a(O, { condition: t === 1, children: e.children })
   ] });
-}, ni = (e) => {
-  const t = ot();
+}, fi = (e) => {
+  const t = ut();
   return (() => {
     let i = !0;
     return e.enabled !== void 0 && (i = i && (t.isOidcAuthEnabled() === e.enabled || t.isBasicAuthEnabled() === e.enabled)), i;
-  })() ? /* @__PURE__ */ a(j.Fragment, { children: e.children }) : /* @__PURE__ */ a(j.Fragment, {});
-}, oi = (e) => {
-  const [t, s] = I(), [i, r] = I();
-  return ke(() => {
-    e.isOpen && (typeof e.frontendInfo == "function" ? e.frontendInfo().then(s) : s(e.frontendInfo), typeof e.backendInfo == "function" ? e.backendInfo().then(r) : r(e.backendInfo));
-  }, [e.isOpen]), /* @__PURE__ */ a(
-    St,
-    {
-      className: "app-about-modal",
-      isOpen: e.isOpen,
-      onClose: e.onClose,
-      trademark: "© 2024 Red Hat",
-      brandImageSrc: e.brandImageSrc,
-      brandImageAlt: e.brandImageAlt,
-      "aria-label": e.brandImageAlt,
-      children: /* @__PURE__ */ f(bt, { className: "app-about-modal-content", style: { marginTop: "-25px" }, children: [
-        /* @__PURE__ */ a(je, { component: He.h2, children: "Web console info" }),
-        /* @__PURE__ */ a(ne, { isLoading: t === void 0, children: /* @__PURE__ */ f(Le, { component: "dl", children: [
-          /* @__PURE__ */ a(y, { component: "dt", children: "Project" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: /* @__PURE__ */ a("a", { href: t == null ? void 0 : t.url, target: "_blank", children: t == null ? void 0 : t.name }) }),
-          /* @__PURE__ */ a(y, { component: "dt", children: "Version" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: t == null ? void 0 : t.version }),
-          /* @__PURE__ */ a(y, { component: "dt", children: "Built on" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: /* @__PURE__ */ a(be, { date: t == null ? void 0 : t.builtOn, format: "locale" }) }),
-          /* @__PURE__ */ a(y, { component: "dt", children: "Digest" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: t == null ? void 0 : t.digest })
-        ] }) }),
-        /* @__PURE__ */ a(je, { style: { marginTop: "40px" }, component: He.h2, children: e.backendLabel }),
-        /* @__PURE__ */ a(ne, { isLoading: i === void 0, children: /* @__PURE__ */ f(Le, { component: "dl", children: [
-          /* @__PURE__ */ a(y, { component: "dt", children: "Name" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: (i == null ? void 0 : i.name) || "" }),
-          /* @__PURE__ */ a(y, { component: "dt", children: "Description" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: (i == null ? void 0 : i.description) || "" }),
-          /* @__PURE__ */ a(y, { component: "dt", children: "Version" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: (i == null ? void 0 : i.version) || "" }),
-          /* @__PURE__ */ a(y, { component: "dt", children: "Built on" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: /* @__PURE__ */ a(be, { date: i == null ? void 0 : i.builtOn, format: "locale" }) })
-        ] }) })
-      ] })
-    }
-  );
-}, ai = (e) => /* @__PURE__ */ f(
-  Ce,
-  {
-    title: "Please Wait",
-    variant: "small",
-    isOpen: e.isOpen,
-    header: /* @__PURE__ */ a("a", { href: "#" }),
-    showClose: !1,
-    className: "please-wait pf-m-redhat-font",
-    "aria-label": "please-wait-modal",
-    style: { marginTop: "-15px" },
-    children: [
-      /* @__PURE__ */ a(Q, { size: "md", className: "spinner" }),
-      /* @__PURE__ */ a("span", { className: "message", style: { fontSize: "15px", color: "#333", marginLeft: "10px" }, children: e.message })
-    ]
-  }
-), ci = (e) => /* @__PURE__ */ a(
-  Ce,
-  {
-    title: e.title,
-    variant: "small",
-    isOpen: e.isOpen,
-    showClose: e.isCloseable,
-    onClose: e.onClose,
-    className: "progress pf-m-redhat-font",
-    "aria-label": "progress-modal",
-    children: /* @__PURE__ */ a(yt, { title: e.message, value: e.progress })
-  }
-);
-function li() {
-  return /* @__PURE__ */ a(ee, { children: /* @__PURE__ */ a(
-    te,
+  })() ? /* @__PURE__ */ a(H.Fragment, { children: e.children }) : /* @__PURE__ */ a(H.Fragment, {});
+}, mi = (e) => /* @__PURE__ */ a(Pt, { categoryName: e.categoryName || "Filters", isClosable: !0, onClick: e.onClearAllCriteria, children: e.criteria.map((t, s) => /* @__PURE__ */ m(Rt, { onClick: () => e.onRemoveCriteria(t), children: [
+  /* @__PURE__ */ a("b", { children: t.filterBy.label }),
+  /* @__PURE__ */ a("span", { children: ": " }),
+  /* @__PURE__ */ a("span", { children: t.filterValue })
+] }, s)) }), wi = (e) => {
+  const [t, s] = y(e.filterTypes[0]), [i, r] = y(""), o = (n) => {
+    n && n.preventDefault(), e.onAddCriteria({
+      filterBy: t,
+      filterValue: i
+    }), r("");
+  };
+  return /* @__PURE__ */ a(Ge, { onSubmit: o, children: /* @__PURE__ */ m(Xe, { children: [
+    /* @__PURE__ */ a(
+      zs,
+      {
+        value: t,
+        items: e.filterTypes,
+        testId: "chip-filter-select",
+        toggleClassname: "chip-filter-toggle",
+        onSelect: s,
+        itemToTestId: (n) => n.testId,
+        itemToString: (n) => n.label
+      }
+    ),
+    /* @__PURE__ */ a(
+      oe,
+      {
+        name: "filterValue",
+        id: "filterValue",
+        type: "search",
+        value: i,
+        onChange: (n, c) => r(c),
+        "data-testid": "chip-filter-value",
+        "aria-label": "search input"
+      }
+    ),
+    /* @__PURE__ */ a(
+      ae,
+      {
+        variant: Ut.control,
+        onClick: o,
+        "data-testid": "chip-filter-search",
+        "aria-label": "search button for search input",
+        children: /* @__PURE__ */ a(Jt, {})
+      }
+    )
+  ] }) });
+};
+function vi() {
+  return /* @__PURE__ */ a(re, { children: /* @__PURE__ */ a(
+    ne,
     {
       titleText: "Loading",
       headingLevel: "h4",
-      icon: /* @__PURE__ */ a(Je, { icon: Q })
+      icon: /* @__PURE__ */ a(Qe, { icon: ee })
     }
   ) });
 }
-function di({
+function Si({
   itemCount: e,
   page: t,
   perPage: s,
   isCompact: i = !1,
   onChange: r,
-  variant: n = Tt.top
+  variant: o = At.top
 }) {
   return /* @__PURE__ */ a(
-    kt,
+    xt,
     {
       itemCount: e,
       page: t,
       perPage: s,
-      onSetPage: (c, o) => r(o, s),
-      onPerPageSelect: (c, o) => r(1, o),
-      variant: n,
+      onSetPage: (n, c) => r(c, s),
+      onPerPageSelect: (n, c) => r(1, c),
+      variant: o,
       isCompact: i
     }
   );
 }
-function Ds({ columns: e, rows: t, getTd: s = () => Re }) {
-  const i = new Array(e).fill(0).map((n, c) => {
-    const o = s(c);
-    return /* @__PURE__ */ a(o, { children: /* @__PURE__ */ a(
-      It,
+function Qs({ columns: e, rows: t, getTd: s = () => Ne }) {
+  const i = new Array(e).fill(0).map((o, n) => {
+    const c = s(n);
+    return /* @__PURE__ */ a(c, { children: /* @__PURE__ */ a(
+      Ot,
       {
-        screenreaderText: c === 0 ? "Loading data" : void 0
+        screenreaderText: n === 0 ? "Loading data" : void 0
       }
-    ) }, `cell_${c}`);
-  }), r = new Array(t).fill(0).map((n, c) => /* @__PURE__ */ a(se, { children: i }, `row_${c}`));
-  return /* @__PURE__ */ a(oe, { children: r });
+    ) }, `cell_${n}`);
+  }), r = new Array(t).fill(0).map((o, n) => /* @__PURE__ */ a(ce, { children: i }, `row_${n}`));
+  return /* @__PURE__ */ a(ue, { children: r });
 }
-const hi = ({
+const yi = ({
   ariaLabel: e,
   minimumColumnWidth: t = 250,
   columns: s,
   data: i,
   renderHeader: r,
-  renderCell: n,
-  renderActions: c,
-  isColumnSortable: o,
+  renderCell: o,
+  renderActions: n,
+  isColumnSortable: c,
   isRowDeleted: l,
   isRowSelected: d,
   expectedLength: h = 3,
   onRowClick: g,
-  setActionCellOuiaId: v,
-  setRowOuiaId: b,
-  tableOuiaId: R,
-  children: k,
-  variant: x
+  setActionCellOuiaId: _,
+  setRowOuiaId: S,
+  tableOuiaId: x,
+  children: T,
+  variant: A
 }) => {
-  const [E, H] = I(1e3);
-  let T;
-  const w = ({ width: p }) => {
-    T && cancelAnimationFrame(T), p && (T = requestAnimationFrame(() => {
-      H(p);
+  const [I, N] = y(1e3);
+  let P;
+  const L = ({ width: f }) => {
+    P && cancelAnimationFrame(P), f && (P = requestAnimationFrame(() => {
+      N(f);
     }));
-  }, { ref: U } = $t({ onResize: w }), C = E >= 576, S = Oe(
-    (p) => C && p !== 0 && p !== s.length - 1,
-    [s, C]
-  ), L = Ne(() => s.map((p, m) => {
-    const P = Z(
-      ({ children: D, ...$ }, ce) => /* @__PURE__ */ a(
-        ct,
+  }, { ref: R } = Qt({ onResize: L }), w = I >= 576, E = je(
+    (f) => w && f !== 0 && f !== s.length - 1,
+    [s, w]
+  ), U = Fe(() => s.map((f, v) => {
+    const q = ie(
+      ({ children: J, ...K }, Q) => /* @__PURE__ */ a(
+        pt,
         {
-          position: m,
-          tableWidth: E,
+          position: v,
+          tableWidth: I,
           columnWidth: t,
-          canHide: S(m),
-          sort: o ? o(p) : void 0,
-          ...$,
-          ref: ce,
-          children: D
+          canHide: E(v),
+          sort: c ? c(f) : void 0,
+          ...K,
+          ref: Q,
+          children: J
         }
       )
     );
-    return P.displayName = "ResponsiveThCurried", r({
-      Th: P,
-      key: `header_${p}`,
-      column: p,
-      colIndex: m
+    return q.displayName = "ResponsiveThCurried", r({
+      Th: q,
+      key: `header_${f}`,
+      column: f,
+      colIndex: v
     });
   }), [
-    S,
+    E,
     s,
-    o,
+    c,
     t,
     r,
-    E
-  ]), J = Oe(
-    (p) => {
-      const m = Z(
-        ({ children: P, ...D }, $) => /* @__PURE__ */ a(
-          ye,
+    I
+  ]), b = je(
+    (f) => {
+      const v = ie(
+        ({ children: q, ...J }, K) => /* @__PURE__ */ a(
+          Pe,
           {
-            position: p,
-            tableWidth: E,
+            position: f,
+            tableWidth: I,
             columnWidth: t,
-            canHide: S(p),
-            ...D,
-            ref: $,
-            children: P
+            canHide: E(f),
+            ...J,
+            ref: K,
+            children: q
           }
         )
       );
-      return m.displayName = "ResponsiveTdCurried", m;
+      return v.displayName = "ResponsiveTdCurried", v;
     },
-    [S, t, E]
-  ), X = Ne(
-    () => s.map((p, m) => J(m)),
-    [s, J]
+    [E, t, I]
+  ), z = Fe(
+    () => s.map((f, v) => b(v)),
+    [s, b]
   );
-  return /* @__PURE__ */ f(
-    Lt,
+  return /* @__PURE__ */ m(
+    Bt,
     {
       "aria-label": e,
       gridBreakPoint: "",
-      ref: U,
-      className: C ? "" : "pf-m-grid",
-      ouiaId: R,
-      variant: x,
+      ref: R,
+      className: w ? "" : "pf-m-grid",
+      ouiaId: x,
+      variant: A,
       children: [
-        /* @__PURE__ */ a(Mt, { children: /* @__PURE__ */ a(se, { children: L }) }),
-        /* @__PURE__ */ f(Ft, { children: [
+        /* @__PURE__ */ a(zt, { children: /* @__PURE__ */ a(ce, { children: U }) }),
+        /* @__PURE__ */ m(Vt, { children: [
           i === void 0 && /* @__PURE__ */ a(
-            Ds,
+            Qs,
             {
               columns: s.length,
               rows: h,
-              getTd: J
+              getTd: b
             }
           ),
-          i == null ? void 0 : i.map((p, m) => {
-            const P = l !== void 0 && l({ row: p, rowIndex: m }), D = d !== void 0 && d({ row: p, rowIndex: m }), $ = !P && g ? () => g({ row: p, rowIndex: m }) : void 0, ce = s.map((Ae, Pe) => n({
-              Td: X[Pe],
-              key: `row_${m}_cell_${Ae}`,
-              column: Ae,
-              colIndex: Pe,
-              rowIndex: m,
-              row: p
-            })), dt = !P && c && /* @__PURE__ */ a(
-              ye,
+          i == null ? void 0 : i.map((f, v) => {
+            const q = l !== void 0 && l({ row: f, rowIndex: v }), J = d !== void 0 && d({ row: f, rowIndex: v }), K = !q && g ? () => g({ row: f, rowIndex: v }) : void 0, Q = s.map((X, te) => o({
+              Td: z[te],
+              key: `row_${v}_cell_${X}`,
+              column: X,
+              colIndex: te,
+              rowIndex: v,
+              row: f
+            })), pe = !q && n && /* @__PURE__ */ a(
+              Pe,
               {
                 position: s.length,
-                tableWidth: E,
+                tableWidth: I,
                 columnWidth: t,
                 canHide: !1,
                 isActionCell: !0,
-                "data-testid": v ? v({ row: p, rowIndex: m }) : `actions-for-row-${m}`,
-                children: c({ rowIndex: m, row: p, ActionsColumn: Dt })
+                "data-testid": _ ? _({ row: f, rowIndex: v }) : `actions-for-row-${v}`,
+                children: n({ rowIndex: v, row: f, ActionsColumn: Gt })
               }
             );
-            return /* @__PURE__ */ f(
-              lt,
+            return /* @__PURE__ */ m(
+              ft,
               {
-                isDeleted: P,
-                isSelected: D,
-                onClick: $,
-                rowOuiaId: b == null ? void 0 : b({ row: p, rowIndex: m }),
+                isDeleted: q,
+                isSelected: J,
+                onClick: K,
+                rowOuiaId: S == null ? void 0 : S({ row: f, rowIndex: v }),
                 children: [
-                  ce,
-                  dt
+                  Q,
+                  pe
                 ]
               },
-              `row_${m}`
+              `row_${v}`
             );
           }),
-          (i == null ? void 0 : i.length) === 0 && /* @__PURE__ */ a(se, { children: /* @__PURE__ */ a(Re, { colSpan: s.length, children: k }) })
+          (i == null ? void 0 : i.length) === 0 && /* @__PURE__ */ a(ce, { children: /* @__PURE__ */ a(Ne, { colSpan: s.length, children: T }) })
         ] })
       ]
     }
   );
-}, ct = Te(
-  Z((e, t) => {
+}, pt = Ue(
+  ie((e, t) => {
     const {
       tableWidth: s,
       columnWidth: i,
       position: r,
-      canHide: n,
-      className: c = "",
-      children: o,
+      canHide: o,
+      className: n = "",
+      children: c,
       ...l
-    } = e, d = n && s < i * (r + 1) ? "pf-m-hidden" : "pf-m-visible";
+    } = e, d = o && s < i * (r + 1) ? "pf-m-hidden" : "pf-m-visible";
     return /* @__PURE__ */ a(
-      Ht,
+      Kt,
       {
         ref: t,
-        className: `${d} ${c}`,
+        className: `${d} ${n}`,
         ...l,
-        children: o
+        children: c
       }
     );
   })
 );
-ct.displayName = "ResponsiveTh";
-const ye = Te(
-  Z((e, t) => {
+pt.displayName = "ResponsiveTh";
+const Pe = Ue(
+  ie((e, t) => {
     const {
       tableWidth: s,
       columnWidth: i,
       position: r,
-      canHide: n,
-      className: c = "",
-      children: o,
+      canHide: o,
+      className: n = "",
+      children: c,
       ...l
-    } = e, d = n && s < i * (r + 1) ? "pf-m-hidden" : "pf-m-visible";
+    } = e, d = o && s < i * (r + 1) ? "pf-m-hidden" : "pf-m-visible";
     return /* @__PURE__ */ a(
-      Re,
+      Ne,
       {
         ref: t,
-        className: `${d} ${c}`,
+        className: `${d} ${n}`,
         ...l,
-        children: o
+        children: c
       }
     );
   })
 );
-ye.displayName = "ResponsiveTd";
-const lt = Te(
+Pe.displayName = "ResponsiveTd";
+const ft = Ue(
   ({ isDeleted: e, isSelected: t, onClick: s, children: i, rowOuiaId: r }) => /* @__PURE__ */ a(
-    se,
+    ce,
     {
-      onRowClick: (n) => {
-        (n == null ? void 0 : n.target) instanceof HTMLElement && (["a", "button"].includes(n.target.tagName.toLowerCase()) || s && s());
+      onRowClick: (o) => {
+        (o == null ? void 0 : o.target) instanceof HTMLElement && (["a", "button"].includes(o.target.tagName.toLowerCase()) || s && s());
       },
       ouiaId: r,
       isRowSelected: t,
       className: e ? "mas--ResponsiveTable__Tr--deleted" : void 0,
-      "data-testid": [t && "row-selected", e && "row-deleted"].filter((n) => !!n).join(" "),
+      "data-testid": [t && "row-selected", e && "row-deleted"].filter((o) => !!o).join(" "),
       role: "row",
       children: i
     }
   )
 );
-lt.displayName = "DeletableRow";
-const $s = ({ label: e, onSearch: t }) => {
-  const s = (i, r, n) => {
+ft.displayName = "DeletableRow";
+const Xs = ({ label: e, onSearch: t }) => {
+  const s = (i, r, o) => {
     t(r);
   };
   return /* @__PURE__ */ a(
-    Et,
+    Nt,
     {
       placeholder: `Filter by ${e}`,
       onSearch: s
     }
   );
 };
-function Ke({
+function ze({
   options: e,
   value: t,
   onChange: s,
   ouiaId: i
 }) {
-  const [r, n] = I(!1);
+  const [r, o] = y(!1);
   return /* @__PURE__ */ a(
-    Ie,
+    xe,
     {
-      toggle: (o) => /* @__PURE__ */ a(
-        ae,
+      toggle: (c) => /* @__PURE__ */ a(
+        _e,
         {
-          ref: o,
-          onClick: () => n((l) => !l),
+          ref: c,
+          onClick: () => o((l) => !l),
           isExpanded: r,
           variant: "plain",
-          children: /* @__PURE__ */ a(Be, {})
+          children: /* @__PURE__ */ a(Ye, {})
         }
       ),
       "aria-label": "table:select_filter",
       selected: t,
       isOpen: r,
-      onSelect: (o, l) => {
-        s(l), n(!1);
+      onSelect: (c, l) => {
+        s(l), o(!1);
       },
       ouiaId: i,
-      children: /* @__PURE__ */ a(Ct, { children: e.map((o, l) => /* @__PURE__ */ a(Ee, { value: o, children: o }, l)) })
+      children: /* @__PURE__ */ a(qt, { children: e.map((c, l) => /* @__PURE__ */ a(Ae, { value: c, children: c }, l)) })
     }
   );
 }
-function Ws({
+function Ys({
   label: e,
   chips: t,
   options: s,
   onToggle: i
 }) {
-  const [r, n] = I(!1);
+  const [r, o] = y(!1);
   return /* @__PURE__ */ a(
-    Ie,
+    xe,
     {
       "aria-label": e,
-      onSelect: (c, o) => {
-        i(o);
+      onSelect: (n, c) => {
+        i(c);
       },
       selected: t,
       isOpen: r,
-      toggle: (c) => /* @__PURE__ */ a(
-        ae,
+      toggle: (n) => /* @__PURE__ */ a(
+        _e,
         {
-          ref: c,
-          onClick: () => n((o) => !o),
+          ref: n,
+          onClick: () => o((c) => !c),
           isExpanded: r,
           style: {
             width: "200px"
@@ -2876,45 +3173,45 @@ function Ws({
           children: `Filter by ${e}`
         }
       ),
-      children: Object.entries(s).map(([c, o]) => /* @__PURE__ */ a(Ee, { value: c, hasCheckbox: !0, children: o }, c))
+      children: Object.entries(s).map(([n, c]) => /* @__PURE__ */ a(Ae, { value: n, hasCheckbox: !0, children: c }, n))
     }
   );
 }
-function gi({ filters: e, breakpoint: t = "md" }) {
-  const s = Object.keys(e), [i, r] = I(s[0]), n = (c, o) => {
-    switch (o.type) {
+function bi({ filters: e, breakpoint: t = "md" }) {
+  const s = Object.keys(e), [i, r] = y(s[0]), o = (n, c) => {
+    switch (c.type) {
       case "search":
         return /* @__PURE__ */ a(
-          $s,
+          Xs,
           {
-            onSearch: o.onSearch,
-            label: c,
-            validate: o.validate,
-            errorMessage: o.errorMessage
+            onSearch: c.onSearch,
+            label: n,
+            validate: c.validate,
+            errorMessage: c.errorMessage
           }
         );
       case "checkbox":
         return /* @__PURE__ */ a(
-          Ws,
+          Ys,
           {
-            chips: o.chips,
-            options: o.options,
-            onToggle: o.onToggle,
-            label: c
+            chips: c.chips,
+            options: c.options,
+            onToggle: c.onToggle,
+            label: n
           }
         );
     }
   };
-  return /* @__PURE__ */ f(oe, { children: [
+  return /* @__PURE__ */ m(ue, { children: [
     /* @__PURE__ */ a(
-      Rt,
+      Dt,
       {
         variant: "search-filter",
         visibility: { default: "hidden", [t]: "visible" },
         "data-testid": "large-viewport-toolbar",
-        children: /* @__PURE__ */ f(xt, { children: [
+        children: /* @__PURE__ */ m(Xe, { children: [
           s.length > 1 && /* @__PURE__ */ a(
-            Ke,
+            ze,
             {
               options: s,
               value: i,
@@ -2922,19 +3219,19 @@ function gi({ filters: e, breakpoint: t = "md" }) {
               ouiaId: "chip-filter-selector-large-viewport"
             }
           ),
-          n(i, e[i])
+          o(i, e[i])
         ] })
       }
     ),
     /* @__PURE__ */ a(
-      Ut,
+      jt,
       {
-        toggleIcon: /* @__PURE__ */ a(Be, {}),
+        toggleIcon: /* @__PURE__ */ a(Ye, {}),
         breakpoint: t,
         visibility: { default: "visible", [t]: "hidden" },
-        children: /* @__PURE__ */ f(At, { variant: "filter-group", children: [
+        children: /* @__PURE__ */ m(Ft, { variant: "filter-group", children: [
           s.length > 1 && /* @__PURE__ */ a(
-            Ke,
+            ze,
             {
               options: s,
               value: i,
@@ -2942,15 +3239,15 @@ function gi({ filters: e, breakpoint: t = "md" }) {
               ouiaId: "chip-filter-selector-small-viewport"
             }
           ),
-          Object.entries(e).map(([c, o], l) => /* @__PURE__ */ a(
-            Pt,
+          Object.entries(e).map(([n, c], l) => /* @__PURE__ */ a(
+            $t,
             {
-              chips: o.type === "checkbox" ? o.chips.map((d) => ({ key: d, node: o.options[d] })) : o.chips,
-              deleteChip: (d, h) => o.onRemoveChip(typeof h == "string" ? h : h.key),
-              deleteChipGroup: o.onRemoveGroup,
-              categoryName: c,
-              showToolbarItem: c === i,
-              children: c === i && n(c, o)
+              chips: c.type === "checkbox" ? c.chips.map((d) => ({ key: d, node: c.options[d] })) : c.chips,
+              deleteChip: (d, h) => c.onRemoveChip(typeof h == "string" ? h : h.key),
+              deleteChipGroup: c.onRemoveGroup,
+              categoryName: n,
+              showToolbarItem: n === i,
+              children: n === i && o(n, c)
             },
             l
           ))
@@ -2960,33 +3257,35 @@ function gi({ filters: e, breakpoint: t = "md" }) {
   ] });
 }
 export {
-  oi as AppAboutModal,
-  ri as ApplicationAuth,
-  Wt as AuthConfigContext,
-  Fs as BasicAuthModal,
-  gi as ChipFilter,
-  be as DateTime,
-  lt as DeletableRow,
-  Ws as FilterCheckbox,
-  $s as FilterSearch,
-  Ke as FilterSelector,
-  Xs as FromNow,
-  A as If,
-  ni as IfAuth,
-  Ys as IfNotEmpty,
-  ne as IfNotLoading,
-  Zs as ListWithToolbar,
-  li as Loading,
-  ei as ObjectDropdown,
-  ti as ObjectSelect,
-  di as Pagination,
-  ai as PleaseWaitModal,
-  ci as ProgressModal,
-  hi as ResponsiveTable,
-  ye as ResponsiveTd,
-  ct as ResponsiveTh,
-  Ds as TableSkeleton,
-  si as ToggleIcon,
-  ii as UrlUpload,
-  ot as useAuth
+  gi as AppAboutModal,
+  pi as ApplicationAuth,
+  Xt as AuthConfigContext,
+  Gs as BasicAuthModal,
+  bi as ChipFilter,
+  wi as ChipFilterInput,
+  Ce as DateTime,
+  ft as DeletableRow,
+  Ys as FilterCheckbox,
+  mi as FilterChips,
+  Xs as FilterSearch,
+  ze as FilterSelector,
+  oi as FromNow,
+  O as If,
+  fi as IfAuth,
+  ai as IfNotEmpty,
+  ge as IfNotLoading,
+  ci as ListWithToolbar,
+  vi as Loading,
+  li as ObjectDropdown,
+  zs as ObjectSelect,
+  Si as Pagination,
+  ui as PleaseWaitModal,
+  _i as ProgressModal,
+  yi as ResponsiveTable,
+  Pe as ResponsiveTd,
+  pt as ResponsiveTh,
+  Qs as TableSkeleton,
+  di as ToggleIcon,
+  hi as UrlUpload,
+  ut as useAuth
 };