@apicurio/common-ui-components 2.0.4 → 2.0.5

package/dist/main.js

@@ -1,23 +1,23 @@
-import j, { createContext as gt, useContext as ut, useState as I, useEffect as Te, memo as Ie, forwardRef as ee, useCallback as Ne, useMemo as qe } from "react";
-import { jsx as a, jsxs as f, Fragment as ae } from "react/jsx-runtime";
-import { EmptyState as te, EmptyStateVariant as _t, EmptyStateHeader as se, EmptyStateBody as ue, Spinner as X, Alert as pt, Dropdown as ft, MenuToggle as ce, DropdownList as mt, Divider as Je, DropdownItem as wt, Select as Ee, SelectOption as Ce, TextInput as _e, Button as pe, TextArea as vt, Modal as Re, Form as St, FormGroup as je, EmptyStateIcon as Be, AboutModal as bt, TextContent as yt, Text as He, TextVariants as Le, TextList as Me, TextListItem as y, Progress as kt, Pagination as Tt, PaginationVariant as It, Skeleton as Et, SearchInput as Ct, SelectList as Rt, ToolbarItem as xt, InputGroup as Ut, ToolbarToggleGroup as At, ToolbarGroup as Pt, ToolbarFilter as Ot } from "@patternfly/react-core";
-import { EllipsisVIcon as Nt, ChevronDownIcon as qt, ChevronRightIcon as jt, ErrorCircleOIcon as Ht, FilterIcon as Ve } from "@patternfly/react-icons";
-import { DateTime as de } from "luxon";
-import { Tr as ie, Td as xe, Th as Lt, Table as Mt, Thead as Ft, Tbody as Dt, ActionsColumn as $t } from "@patternfly/react-table";
-import Wt from "use-resize-observer";
-const Kt = gt({
+import H, { createContext as mt, useContext as wt, useState as y, useEffect as Re, memo as Ue, forwardRef as ie, useCallback as je, useMemo as Fe } from "react";
+import { jsx as a, jsxs as m, Fragment as ue } from "react/jsx-runtime";
+import { EmptyState as re, EmptyStateVariant as vt, EmptyStateHeader as ne, EmptyStateBody as ve, Spinner as ee, Alert as St, Dropdown as yt, MenuToggle as _e, DropdownList as bt, Divider as Ve, DropdownItem as kt, Select as xe, SelectOption as Ae, TextInput as oe, Button as ae, TextArea as Tt, AboutModal as It, TextContent as Et, Text as $e, TextVariants as He, TextList as Le, TextListItem as k, Modal as Oe, Form as Ge, FormGroup as Me, Progress as Ct, EmptyStateIcon as Qe, ChipGroup as Pt, Chip as Rt, InputGroup as Xe, ButtonVariant as Ut, Pagination as xt, PaginationVariant as At, Skeleton as Ot, SearchInput as Nt, SelectList as qt, ToolbarItem as Dt, ToolbarToggleGroup as jt, ToolbarGroup as Ft, ToolbarFilter as $t } from "@patternfly/react-core";
+import { EllipsisVIcon as Ht, ChevronDownIcon as Lt, ChevronRightIcon as Mt, ErrorCircleOIcon as Wt, SearchIcon as Jt, FilterIcon as Ye } from "@patternfly/react-icons";
+import { DateTime as fe } from "luxon";
+import { Tr as ce, Td as Ne, Th as Kt, Table as Bt, Thead as zt, Tbody as Vt, ActionsColumn as Gt } from "@patternfly/react-table";
+import Qt from "use-resize-observer";
+const Xt = mt({
   type: "none"
 });
-class V extends Error {
+class Y extends Error {
 }
-V.prototype.name = "InvalidTokenError";
-function zt(e) {
+Y.prototype.name = "InvalidTokenError";
+function Yt(e) {
   return decodeURIComponent(atob(e).replace(/(.)/g, (t, s) => {
     let i = s.charCodeAt(0).toString(16).toUpperCase();
     return i.length < 2 && (i = "0" + i), "%" + i;
   }));
 }
-function Jt(e) {
+function Zt(e) {
   let t = e.replace(/-/g, "+").replace(/_/g, "/");
   switch (t.length % 4) {
     case 0:
@@ -32,31 +32,31 @@ function Jt(e) {
       throw new Error("base64 string is not of the correct length");
   }
   try {
-    return zt(t);
+    return Yt(t);
   } catch {
     return atob(t);
   }
 }
-function Bt(e, t) {
+function es(e, t) {
   if (typeof e != "string")
-    throw new V("Invalid token specified: must be a string");
+    throw new Y("Invalid token specified: must be a string");
   t || (t = {});
   const s = t.header === !0 ? 0 : 1, i = e.split(".")[s];
   if (typeof i != "string")
-    throw new V(`Invalid token specified: missing part #${s + 1}`);
+    throw new Y(`Invalid token specified: missing part #${s + 1}`);
   let r;
   try {
-    r = Jt(i);
-  } catch (n) {
-    throw new V(`Invalid token specified: invalid base64 for part #${s + 1} (${n.message})`);
+    r = Zt(i);
+  } catch (o) {
+    throw new Y(`Invalid token specified: invalid base64 for part #${s + 1} (${o.message})`);
   }
   try {
     return JSON.parse(r);
-  } catch (n) {
-    throw new V(`Invalid token specified: invalid json for part #${s + 1} (${n.message})`);
+  } catch (o) {
+    throw new Y(`Invalid token specified: invalid json for part #${s + 1} (${o.message})`);
   }
 }
-var Vt = {
+var ts = {
   debug: () => {
   },
   info: () => {
@@ -65,39 +65,39 @@ var Vt = {
   },
   error: () => {
   }
-}, N, q, re = /* @__PURE__ */ ((e) => (e[e.NONE = 0] = "NONE", e[e.ERROR = 1] = "ERROR", e[e.WARN = 2] = "WARN", e[e.INFO = 3] = "INFO", e[e.DEBUG = 4] = "DEBUG", e))(re || {});
+}, F, $, le = /* @__PURE__ */ ((e) => (e[e.NONE = 0] = "NONE", e[e.ERROR = 1] = "ERROR", e[e.WARN = 2] = "WARN", e[e.INFO = 3] = "INFO", e[e.DEBUG = 4] = "DEBUG", e))(le || {});
 ((e) => {
   function t() {
-    N = 3, q = Vt;
+    F = 3, $ = ts;
   }
   e.reset = t;
   function s(r) {
     if (!(0 <= r && r <= 4))
       throw new Error("Invalid log level");
-    N = r;
+    F = r;
   }
   e.setLevel = s;
   function i(r) {
-    q = r;
+    $ = r;
   }
   e.setLogger = i;
-})(re || (re = {}));
-var u = class O {
+})(le || (le = {}));
+var u = class D {
   constructor(t) {
     this._name = t;
   }
   /* eslint-disable @typescript-eslint/no-unsafe-enum-comparison */
   debug(...t) {
-    N >= 4 && q.debug(O._format(this._name, this._method), ...t);
+    F >= 4 && $.debug(D._format(this._name, this._method), ...t);
   }
   info(...t) {
-    N >= 3 && q.info(O._format(this._name, this._method), ...t);
+    F >= 3 && $.info(D._format(this._name, this._method), ...t);
   }
   warn(...t) {
-    N >= 2 && q.warn(O._format(this._name, this._method), ...t);
+    F >= 2 && $.warn(D._format(this._name, this._method), ...t);
   }
   error(...t) {
-    N >= 1 && q.error(O._format(this._name, this._method), ...t);
+    F >= 1 && $.error(D._format(this._name, this._method), ...t);
   }
   /* eslint-enable @typescript-eslint/no-unsafe-enum-comparison */
   throw(t) {
@@ -108,7 +108,7 @@ var u = class O {
     return s._method = t, s.debug("begin"), s;
   }
   static createStatic(t, s) {
-    const i = new O(`${t}.${s}`);
+    const i = new D(`${t}.${s}`);
     return i.debug("begin"), i;
   }
   static _format(t, s) {
@@ -118,21 +118,41 @@ var u = class O {
   /* eslint-disable @typescript-eslint/no-unsafe-enum-comparison */
   // helpers for static class methods
   static debug(t, ...s) {
-    N >= 4 && q.debug(O._format(t), ...s);
+    F >= 4 && $.debug(D._format(t), ...s);
   }
   static info(t, ...s) {
-    N >= 3 && q.info(O._format(t), ...s);
+    F >= 3 && $.info(D._format(t), ...s);
   }
   static warn(t, ...s) {
-    N >= 2 && q.warn(O._format(t), ...s);
+    F >= 2 && $.warn(D._format(t), ...s);
   }
   static error(t, ...s) {
-    N >= 1 && q.error(O._format(t), ...s);
+    F >= 1 && $.error(D._format(t), ...s);
   }
   /* eslint-enable @typescript-eslint/no-unsafe-enum-comparison */
 };
-re.reset();
-var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8Array(e)].map((t) => String.fromCharCode(t)).join("")), z = class G {
+le.reset();
+var de = class {
+  // IMPORTANT: doesn't validate the token
+  static decode(e) {
+    try {
+      return es(e);
+    } catch (t) {
+      throw u.error("JwtUtils.decode", t), t;
+    }
+  }
+  static async generateSignedJwt(e, t, s) {
+    const i = C.encodeBase64Url(new TextEncoder().encode(JSON.stringify(e))), r = C.encodeBase64Url(new TextEncoder().encode(JSON.stringify(t))), o = `${i}.${r}`, n = await window.crypto.subtle.sign(
+      {
+        name: "ECDSA",
+        hash: { name: "SHA-256" }
+      },
+      s,
+      new TextEncoder().encode(o)
+    ), c = C.encodeBase64Url(new Uint8Array(n));
+    return `${o}.${c}`;
+  }
+}, ss = "10000000-1000-4000-8000-100000000000", Se = (e) => btoa([...new Uint8Array(e)].map((t) => String.fromCharCode(t)).join("")), Ze = class j {
   static _randomWord() {
     const t = new Uint32Array(1);
     return crypto.getRandomValues(t), t[0];
@@ -141,16 +161,16 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
    * Generates RFC4122 version 4 guid
    */
   static generateUUIDv4() {
-    return Gt.replace(
+    return ss.replace(
       /[018]/g,
-      (s) => (+s ^ G._randomWord() & 15 >> +s / 4).toString(16)
+      (s) => (+s ^ j._randomWord() & 15 >> +s / 4).toString(16)
     ).replace(/-/g, "");
   }
   /**
    * PKCE: Generate a code verifier
    */
   static generateCodeVerifier() {
-    return G.generateUUIDv4() + G.generateUUIDv4() + G.generateUUIDv4();
+    return j.generateUUIDv4() + j.generateUUIDv4() + j.generateUUIDv4();
   }
   /**
    * PKCE: Generate a code challenge
@@ -160,7 +180,7 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
       throw new Error("Crypto.subtle is available only in secure contexts (HTTPS).");
     try {
       const i = new TextEncoder().encode(t), r = await crypto.subtle.digest("SHA-256", i);
-      return Fe(r).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+      return Se(r).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
     } catch (s) {
       throw u.error("CryptoUtils.generateCodeChallenge", s), s;
     }
@@ -170,11 +190,112 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
    */
   static generateBasicAuth(t, s) {
     const r = new TextEncoder().encode([t, s].join(":"));
-    return Fe(r);
+    return Se(r);
+  }
+  /**
+   * Generates a hash of a string using a given algorithm
+   * @param alg
+   * @param message
+   */
+  static async hash(t, s) {
+    const i = new TextEncoder().encode(s), r = await crypto.subtle.digest(t, i);
+    return new Uint8Array(r);
+  }
+  /**
+   * Generates a rfc7638 compliant jwk thumbprint
+   * @param jwk
+   */
+  static async customCalculateJwkThumbprint(t) {
+    let s;
+    switch (t.kty) {
+      case "RSA":
+        s = {
+          e: t.e,
+          kty: t.kty,
+          n: t.n
+        };
+        break;
+      case "EC":
+        s = {
+          crv: t.crv,
+          kty: t.kty,
+          x: t.x,
+          y: t.y
+        };
+        break;
+      case "OKP":
+        s = {
+          crv: t.crv,
+          kty: t.kty,
+          x: t.x
+        };
+        break;
+      case "oct":
+        s = {
+          crv: t.k,
+          kty: t.kty
+        };
+        break;
+      default:
+        throw new Error("Unknown jwk type");
+    }
+    const i = await j.hash("SHA-256", JSON.stringify(s));
+    return j.encodeBase64Url(i);
+  }
+  static async generateDPoPProof({
+    url: t,
+    accessToken: s,
+    httpMethod: i,
+    keyPair: r,
+    nonce: o
+  }) {
+    let n, c;
+    const l = {
+      jti: window.crypto.randomUUID(),
+      htm: i ?? "GET",
+      htu: t,
+      iat: Math.floor(Date.now() / 1e3)
+    };
+    s && (n = await j.hash("SHA-256", s), c = j.encodeBase64Url(n), l.ath = c), o && (l.nonce = o);
+    try {
+      const d = await crypto.subtle.exportKey("jwk", r.publicKey), h = {
+        alg: "ES256",
+        typ: "dpop+jwt",
+        jwk: {
+          crv: d.crv,
+          kty: d.kty,
+          x: d.x,
+          y: d.y
+        }
+      };
+      return await de.generateSignedJwt(h, l, r.privateKey);
+    } catch (d) {
+      throw d instanceof TypeError ? new Error(`Error exporting dpop public key: ${d.message}`) : d;
+    }
+  }
+  static async generateDPoPJkt(t) {
+    try {
+      const s = await crypto.subtle.exportKey("jwk", t.publicKey);
+      return await j.customCalculateJwkThumbprint(s);
+    } catch (s) {
+      throw s instanceof TypeError ? new Error(`Could not retrieve dpop keys from storage: ${s.message}`) : s;
+    }
+  }
+  static async generateDPoPKeys() {
+    return await window.crypto.subtle.generateKey(
+      {
+        name: "ECDSA",
+        namedCurve: "P-256"
+      },
+      !1,
+      ["sign", "verify"]
+    );
   }
-}, F = class {
+};
+Ze.encodeBase64Url = (e) => Se(e).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+var C = Ze, W = class {
   constructor(e) {
-    this._name = e, this._logger = new u(`Event('${this._name}')`), this._callbacks = [];
+    this._name = e, this._callbacks = [], this._logger = new u(`Event('${this._name}')`);
   }
   addHandler(e) {
     return this._callbacks.push(e), () => this.removeHandler(e);
@@ -188,16 +309,7 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     for (const t of this._callbacks)
       await t(...e);
   }
-}, fe = class {
-  // IMPORTANT: doesn't validate the token
-  static decode(e) {
-    try {
-      return Bt(e);
-    } catch (t) {
-      throw u.error("JwtUtils.decode", t), t;
-    }
-  }
-}, De = class {
+}, We = class {
   /**
    * Populates a map of window features with a placement centered in front of
    * the current window. If no explicit width is given, a default value is
@@ -210,11 +322,11 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
   static serialize(e) {
     return Object.entries(e).filter(([, t]) => t != null).map(([t, s]) => `${t}=${typeof s != "boolean" ? s : s ? "yes" : "no"}`).join(",");
   }
-}, M = class Z extends F {
+}, M = class se extends W {
   constructor() {
     super(...arguments), this._logger = new u(`Timer('${this._name}')`), this._timerHandle = null, this._expiration = 0, this._callback = () => {
-      const t = this._expiration - Z.getEpochTime();
-      this._logger.debug("timer completes in", t), this._expiration <= Z.getEpochTime() && (this.cancel(), super.raise());
+      const t = this._expiration - se.getEpochTime();
+      this._logger.debug("timer completes in", t), this._expiration <= se.getEpochTime() && (this.cancel(), super.raise());
     };
   }
   // get the time
@@ -224,7 +336,7 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
   init(t) {
     const s = this._logger.create("init");
     t = Math.max(Math.floor(t), 1);
-    const i = Z.getEpochTime() + t;
+    const i = se.getEpochTime() + t;
     if (this.expiration === i && this._timerHandle) {
       s.debug("skipping since already initialized for expiration at", this.expiration);
       return;
@@ -239,25 +351,24 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
   cancel() {
     this._logger.create("cancel"), this._timerHandle && (clearInterval(this._timerHandle), this._timerHandle = null);
   }
-}, me = class {
+}, ye = class {
   static readParams(e, t = "query") {
-    if (!e)
-      throw new TypeError("Invalid URL");
+    if (!e) throw new TypeError("Invalid URL");
     const i = new URL(e, "http://127.0.0.1")[t === "fragment" ? "hash" : "search"];
     return new URLSearchParams(i.slice(1));
   }
-}, we = ";", W = class extends Error {
+}, be = ";", B = class extends Error {
   constructor(e, t) {
     var s, i, r;
     if (super(e.error_description || e.error || ""), this.form = t, this.name = "ErrorResponse", !e.error)
       throw u.error("ErrorResponse", "No error passed"), new Error("No error passed");
     this.error = e.error, this.error_description = (s = e.error_description) != null ? s : null, this.error_uri = (i = e.error_uri) != null ? i : null, this.state = e.userState, this.session_state = (r = e.session_state) != null ? r : null, this.url_state = e.url_state;
   }
-}, Ue = class extends Error {
+}, qe = class extends Error {
   constructor(e) {
     super(e), this.name = "ErrorTimeout";
   }
-}, Qt = class {
+}, is = class {
   constructor(e) {
     this._logger = new u("AccessTokenEvents"), this._expiringTimer = new M("Access token expiring"), this._expiredTimer = new M("Access token expired"), this._expiringNotificationTimeInSeconds = e.expiringNotificationTimeInSeconds;
   }
@@ -302,13 +413,13 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
   removeAccessTokenExpired(e) {
     this._expiredTimer.removeHandler(e);
   }
-}, Xt = class {
+}, rs = class {
   constructor(e, t, s, i, r) {
-    this._callback = e, this._client_id = t, this._intervalInSeconds = i, this._stopOnError = r, this._logger = new u("CheckSessionIFrame"), this._timer = null, this._session_state = null, this._message = (c) => {
-      c.origin === this._frame_origin && c.source === this._frame.contentWindow && (c.data === "error" ? (this._logger.error("error message from check session op iframe"), this._stopOnError && this.stop()) : c.data === "changed" ? (this._logger.debug("changed message from check session op iframe"), this.stop(), this._callback()) : this._logger.debug(c.data + " message from check session op iframe"));
+    this._callback = e, this._client_id = t, this._intervalInSeconds = i, this._stopOnError = r, this._logger = new u("CheckSessionIFrame"), this._timer = null, this._session_state = null, this._message = (n) => {
+      n.origin === this._frame_origin && n.source === this._frame.contentWindow && (n.data === "error" ? (this._logger.error("error message from check session op iframe"), this._stopOnError && this.stop()) : n.data === "changed" ? (this._logger.debug("changed message from check session op iframe"), this.stop(), this._callback()) : this._logger.debug(n.data + " message from check session op iframe"));
     };
-    const n = new URL(s);
-    this._frame_origin = n.origin, this._frame = window.document.createElement("iframe"), this._frame.style.visibility = "hidden", this._frame.style.position = "fixed", this._frame.style.left = "-1000px", this._frame.style.top = "0", this._frame.width = "0", this._frame.height = "0", this._frame.src = n.href;
+    const o = new URL(s);
+    this._frame_origin = o.origin, this._frame = window.document.createElement("iframe"), this._frame.style.visibility = "hidden", this._frame.style.position = "fixed", this._frame.style.left = "-1000px", this._frame.style.top = "0", this._frame.width = "0", this._frame.height = "0", this._frame.src = o.href;
   }
   load() {
     return new Promise((e) => {
@@ -329,7 +440,7 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
   stop() {
     this._logger.create("stop"), this._session_state = null, this._timer && (clearInterval(this._timer), this._timer = null);
   }
-}, Ge = class {
+}, et = class {
   constructor() {
     this._logger = new u("InMemoryWebStorage"), this._data = {};
   }
@@ -351,7 +462,11 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
   key(e) {
     return Object.getOwnPropertyNames(this._data)[e];
   }
-}, Ae = class {
+}, ke = class extends Error {
+  constructor(e, t) {
+    super(t), this.name = "ErrorDPoPNonce", this.nonce = e;
+  }
+}, De = class {
   constructor(e = [], t = null, s = {}) {
     this._jwtHandler = t, this._extraHeaders = s, this._logger = new u("JsonService"), this._contentTypes = [], this._contentTypes.push(...e, "application/json"), t && this._contentTypes.push("application/jwt");
   }
@@ -359,78 +474,86 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     const { timeoutInSeconds: s, ...i } = t;
     if (!s)
       return await fetch(e, i);
-    const r = new AbortController(), n = setTimeout(() => r.abort(), s * 1e3);
+    const r = new AbortController(), o = setTimeout(() => r.abort(), s * 1e3);
     try {
       return await fetch(e, {
         ...t,
         signal: r.signal
       });
-    } catch (c) {
-      throw c instanceof DOMException && c.name === "AbortError" ? new Ue("Network timed out") : c;
+    } catch (n) {
+      throw n instanceof DOMException && n.name === "AbortError" ? new qe("Network timed out") : n;
     } finally {
-      clearTimeout(n);
+      clearTimeout(o);
     }
   }
   async getJson(e, {
     token: t,
-    credentials: s
+    credentials: s,
+    timeoutInSeconds: i
   } = {}) {
-    const i = this._logger.create("getJson"), r = {
+    const r = this._logger.create("getJson"), o = {
       Accept: this._contentTypes.join(", ")
     };
-    t && (i.debug("token passed, setting Authorization header"), r.Authorization = "Bearer " + t), this.appendExtraHeaders(r);
+    t && (r.debug("token passed, setting Authorization header"), o.Authorization = "Bearer " + t), this.appendExtraHeaders(o);
     let n;
     try {
-      i.debug("url:", e), n = await this.fetchWithTimeout(e, { method: "GET", headers: r, credentials: s });
-    } catch (l) {
-      throw i.error("Network Error"), l;
+      r.debug("url:", e), n = await this.fetchWithTimeout(e, { method: "GET", headers: o, timeoutInSeconds: i, credentials: s });
+    } catch (d) {
+      throw r.error("Network Error"), d;
     }
-    i.debug("HTTP response received, status", n.status);
+    r.debug("HTTP response received, status", n.status);
     const c = n.headers.get("Content-Type");
-    if (c && !this._contentTypes.find((l) => c.startsWith(l)) && i.throw(new Error(`Invalid response Content-Type: ${c ?? "undefined"}, from URL: ${e}`)), n.ok && this._jwtHandler && (c != null && c.startsWith("application/jwt")))
+    if (c && !this._contentTypes.find((d) => c.startsWith(d)) && r.throw(new Error(`Invalid response Content-Type: ${c ?? "undefined"}, from URL: ${e}`)), n.ok && this._jwtHandler && (c != null && c.startsWith("application/jwt")))
       return await this._jwtHandler(await n.text());
-    let o;
+    let l;
     try {
-      o = await n.json();
-    } catch (l) {
-      throw i.error("Error parsing JSON response", l), n.ok ? l : new Error(`${n.statusText} (${n.status})`);
+      l = await n.json();
+    } catch (d) {
+      throw r.error("Error parsing JSON response", d), n.ok ? d : new Error(`${n.statusText} (${n.status})`);
     }
     if (!n.ok)
-      throw i.error("Error from server:", o), o.error ? new W(o) : new Error(`${n.statusText} (${n.status}): ${JSON.stringify(o)}`);
-    return o;
+      throw r.error("Error from server:", l), l.error ? new B(l) : new Error(`${n.statusText} (${n.status}): ${JSON.stringify(l)}`);
+    return l;
   }
   async postForm(e, {
     body: t,
     basicAuth: s,
     timeoutInSeconds: i,
-    initCredentials: r
+    initCredentials: r,
+    extraHeaders: o
   }) {
     const n = this._logger.create("postForm"), c = {
       Accept: this._contentTypes.join(", "),
-      "Content-Type": "application/x-www-form-urlencoded"
+      "Content-Type": "application/x-www-form-urlencoded",
+      ...o
     };
     s !== void 0 && (c.Authorization = "Basic " + s), this.appendExtraHeaders(c);
-    let o;
+    let l;
     try {
-      n.debug("url:", e), o = await this.fetchWithTimeout(e, { method: "POST", headers: c, body: t, timeoutInSeconds: i, credentials: r });
-    } catch (g) {
-      throw n.error("Network error"), g;
+      n.debug("url:", e), l = await this.fetchWithTimeout(e, { method: "POST", headers: c, body: t, timeoutInSeconds: i, credentials: r });
+    } catch (_) {
+      throw n.error("Network error"), _;
     }
-    n.debug("HTTP response received, status", o.status);
-    const l = o.headers.get("Content-Type");
-    if (l && !this._contentTypes.find((g) => l.startsWith(g)))
-      throw new Error(`Invalid response Content-Type: ${l ?? "undefined"}, from URL: ${e}`);
-    const d = await o.text();
-    let h = {};
-    if (d)
+    n.debug("HTTP response received, status", l.status);
+    const d = l.headers.get("Content-Type");
+    if (d && !this._contentTypes.find((_) => d.startsWith(_)))
+      throw new Error(`Invalid response Content-Type: ${d ?? "undefined"}, from URL: ${e}`);
+    const h = await l.text();
+    let g = {};
+    if (h)
       try {
-        h = JSON.parse(d);
-      } catch (g) {
-        throw n.error("Error parsing JSON response", g), o.ok ? g : new Error(`${o.statusText} (${o.status})`);
+        g = JSON.parse(h);
+      } catch (_) {
+        throw n.error("Error parsing JSON response", _), l.ok ? _ : new Error(`${l.statusText} (${l.status})`);
+      }
+    if (!l.ok) {
+      if (n.error("Error from server:", g), l.headers.has("dpop-nonce")) {
+        const _ = l.headers.get("dpop-nonce");
+        throw new ke(_, `${JSON.stringify(g)}`);
       }
-    if (!o.ok)
-      throw n.error("Error from server:", h), h.error ? new W(h, t) : new Error(`${o.statusText} (${o.status}): ${JSON.stringify(h)}`);
-    return h;
+      throw g.error ? new B(g, t) : new Error(`${l.statusText} (${l.status}): ${JSON.stringify(g)}`);
+    }
+    return g;
   }
   appendExtraHeaders(e) {
     const t = this._logger.create("appendExtraHeaders"), s = Object.keys(this._extraHeaders), i = [
@@ -443,13 +566,13 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
         t.warn("Protected header could not be overridden", r, i);
         return;
       }
-      const n = typeof this._extraHeaders[r] == "function" ? this._extraHeaders[r]() : this._extraHeaders[r];
-      n && n !== "" && (e[r] = n);
+      const o = typeof this._extraHeaders[r] == "function" ? this._extraHeaders[r]() : this._extraHeaders[r];
+      o && o !== "" && (e[r] = o);
     });
   }
-}, Yt = class {
+}, ns = class {
   constructor(e) {
-    this._settings = e, this._logger = new u("MetadataService"), this._signingKeys = null, this._metadata = null, this._metadataUrl = this._settings.metadataUrl, this._jsonService = new Ae(
+    this._settings = e, this._logger = new u("MetadataService"), this._signingKeys = null, this._metadata = null, this._metadataUrl = this._settings.metadataUrl, this._jsonService = new De(
       ["application/jwk-set+json"],
       null,
       this._settings.extraHeaders
@@ -465,7 +588,7 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     if (!this._metadataUrl)
       throw e.throw(new Error("No authority or metadataUrl configured on settings")), null;
     e.debug("getting metadata from", this._metadataUrl);
-    const t = await this._jsonService.getJson(this._metadataUrl, { credentials: this._fetchRequestCredentials });
+    const t = await this._jsonService.getJson(this._metadataUrl, { credentials: this._fetchRequestCredentials, timeoutInSeconds: this._settings.requestTimeoutInSeconds });
     return e.debug("merging remote JSON with seed metadata"), this._metadata = Object.assign({}, this._settings.metadataSeed, t), this._metadata;
   }
   getIssuer() {
@@ -509,12 +632,12 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
       return e.debug("returning signingKeys from cache"), this._signingKeys;
     const t = await this.getKeysEndpoint(!1);
     e.debug("got jwks_uri", t);
-    const s = await this._jsonService.getJson(t);
+    const s = await this._jsonService.getJson(t, { timeoutInSeconds: this._settings.requestTimeoutInSeconds });
     if (e.debug("got key set", s), !Array.isArray(s.keys))
       throw e.throw(new Error("Missing keys on keyset")), null;
     return this._signingKeys = s.keys, this._signingKeys;
   }
-}, Qe = class {
+}, tt = class {
   constructor({
     prefix: e = "oidc.",
     store: t = localStorage
@@ -541,7 +664,7 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     }
     return t;
   }
-}, Zt = "code", es = "openid", ts = "client_secret_post", ss = 60 * 15, ve = class {
+}, os = "code", as = "openid", cs = "client_secret_post", ls = 60 * 15, Te = class {
   constructor({
     // metadata related
     authority: e,
@@ -550,56 +673,61 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     signingKeys: i,
     metadataSeed: r,
     // client related
-    client_id: n,
-    client_secret: c,
-    response_type: o = Zt,
-    scope: l = es,
+    client_id: o,
+    client_secret: n,
+    response_type: c = os,
+    scope: l = as,
     redirect_uri: d,
     post_logout_redirect_uri: h,
-    client_authentication: g = ts,
+    client_authentication: g = cs,
     // optional protocol
-    prompt: v,
-    display: b,
-    max_age: R,
-    ui_locales: k,
-    acr_values: x,
-    resource: E,
-    response_mode: H,
+    prompt: _,
+    display: S,
+    max_age: x,
+    ui_locales: T,
+    acr_values: A,
+    resource: I,
+    response_mode: N,
     // behavior flags
-    filterProtocolClaims: T = !0,
-    loadUserInfo: w = !1,
-    staleStateAgeInSeconds: U = ss,
-    mergeClaimsStrategy: C = { array: "replace" },
-    disablePKCE: S = !1,
+    filterProtocolClaims: P = !0,
+    loadUserInfo: L = !1,
+    requestTimeoutInSeconds: R,
+    staleStateAgeInSeconds: w = ls,
+    mergeClaimsStrategy: E = { array: "replace" },
+    disablePKCE: U = !1,
     // other behavior
-    stateStore: L,
-    revokeTokenAdditionalContentTypes: B,
-    fetchRequestCredentials: Y,
-    refreshTokenAllowedScope: p,
+    stateStore: b,
+    revokeTokenAdditionalContentTypes: z,
+    fetchRequestCredentials: f,
+    refreshTokenAllowedScope: v,
     // extra
-    extraQueryParams: m = {},
-    extraTokenParams: P = {},
-    extraHeaders: D = {}
+    extraQueryParams: q = {},
+    extraTokenParams: J = {},
+    extraHeaders: K = {},
+    dpop: Q,
+    omitScopeWhenRequesting: pe = !1
   }) {
-    if (this.authority = e, t ? this.metadataUrl = t : (this.metadataUrl = e, e && (this.metadataUrl.endsWith("/") || (this.metadataUrl += "/"), this.metadataUrl += ".well-known/openid-configuration")), this.metadata = s, this.metadataSeed = r, this.signingKeys = i, this.client_id = n, this.client_secret = c, this.response_type = o, this.scope = l, this.redirect_uri = d, this.post_logout_redirect_uri = h, this.client_authentication = g, this.prompt = v, this.display = b, this.max_age = R, this.ui_locales = k, this.acr_values = x, this.resource = E, this.response_mode = H, this.filterProtocolClaims = T ?? !0, this.loadUserInfo = !!w, this.staleStateAgeInSeconds = U, this.mergeClaimsStrategy = C, this.disablePKCE = !!S, this.revokeTokenAdditionalContentTypes = B, this.fetchRequestCredentials = Y || "same-origin", L)
-      this.stateStore = L;
+    var X;
+    if (this.authority = e, t ? this.metadataUrl = t : (this.metadataUrl = e, e && (this.metadataUrl.endsWith("/") || (this.metadataUrl += "/"), this.metadataUrl += ".well-known/openid-configuration")), this.metadata = s, this.metadataSeed = r, this.signingKeys = i, this.client_id = o, this.client_secret = n, this.response_type = c, this.scope = l, this.redirect_uri = d, this.post_logout_redirect_uri = h, this.client_authentication = g, this.prompt = _, this.display = S, this.max_age = x, this.ui_locales = T, this.acr_values = A, this.resource = I, this.response_mode = N, this.filterProtocolClaims = P ?? !0, this.loadUserInfo = !!L, this.staleStateAgeInSeconds = w, this.mergeClaimsStrategy = E, this.omitScopeWhenRequesting = pe, this.disablePKCE = !!U, this.revokeTokenAdditionalContentTypes = z, this.fetchRequestCredentials = f || "same-origin", this.requestTimeoutInSeconds = R, b)
+      this.stateStore = b;
     else {
-      const $ = typeof window < "u" ? window.localStorage : new Ge();
-      this.stateStore = new Qe({ store: $ });
+      const te = typeof window < "u" ? window.localStorage : new et();
+      this.stateStore = new tt({ store: te });
     }
-    this.refreshTokenAllowedScope = p, this.extraQueryParams = m, this.extraTokenParams = P, this.extraHeaders = D;
+    if (this.refreshTokenAllowedScope = v, this.extraQueryParams = q, this.extraTokenParams = J, this.extraHeaders = K, this.dpop = Q, this.dpop && !((X = this.dpop) != null && X.store))
+      throw new Error("A DPoPStore is required when dpop is enabled");
   }
-}, is = class {
+}, ds = class {
   constructor(e, t) {
     this._settings = e, this._metadataService = t, this._logger = new u("UserInfoService"), this._getClaimsFromJwt = async (s) => {
       const i = this._logger.create("_getClaimsFromJwt");
       try {
-        const r = fe.decode(s);
+        const r = de.decode(s);
         return i.debug("JWT decoding successful"), r;
       } catch (r) {
         throw i.error("Error parsing JWT response"), r;
       }
-    }, this._jsonService = new Ae(
+    }, this._jsonService = new De(
       void 0,
       this._getClaimsFromJwt,
       this._settings.extraHeaders
@@ -612,13 +740,14 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     t.debug("got userinfo url", s);
     const i = await this._jsonService.getJson(s, {
       token: e,
-      credentials: this._settings.fetchRequestCredentials
+      credentials: this._settings.fetchRequestCredentials,
+      timeoutInSeconds: this._settings.requestTimeoutInSeconds
     });
     return t.debug("got claims", i), i;
   }
-}, Xe = class {
+}, st = class {
   constructor(e, t) {
-    this._settings = e, this._metadataService = t, this._logger = new u("TokenClient"), this._jsonService = new Ae(
+    this._settings = e, this._metadataService = t, this._logger = new u("TokenClient"), this._jsonService = new De(
       this._settings.revokeTokenAdditionalContentTypes,
       null,
       this._settings.extraHeaders
@@ -634,28 +763,35 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     redirect_uri: t = this._settings.redirect_uri,
     client_id: s = this._settings.client_id,
     client_secret: i = this._settings.client_secret,
-    ...r
+    extraHeaders: r,
+    ...o
   }) {
     const n = this._logger.create("exchangeCode");
-    s || n.throw(new Error("A client_id is required")), t || n.throw(new Error("A redirect_uri is required")), r.code || n.throw(new Error("A code is required"));
+    s || n.throw(new Error("A client_id is required")), t || n.throw(new Error("A redirect_uri is required")), o.code || n.throw(new Error("A code is required"));
     const c = new URLSearchParams({ grant_type: e, redirect_uri: t });
-    for (const [h, g] of Object.entries(r))
-      g != null && c.set(h, g);
-    let o;
+    for (const [g, _] of Object.entries(o))
+      _ != null && c.set(g, _);
+    let l;
     switch (this._settings.client_authentication) {
       case "client_secret_basic":
         if (!i)
           throw n.throw(new Error("A client_secret is required")), null;
-        o = z.generateBasicAuth(s, i);
+        l = C.generateBasicAuth(s, i);
         break;
       case "client_secret_post":
         c.append("client_id", s), i && c.append("client_secret", i);
         break;
     }
-    const l = await this._metadataService.getTokenEndpoint(!1);
+    const d = await this._metadataService.getTokenEndpoint(!1);
     n.debug("got token endpoint");
-    const d = await this._jsonService.postForm(l, { body: c, basicAuth: o, initCredentials: this._settings.fetchRequestCredentials });
-    return n.debug("got response"), d;
+    const h = await this._jsonService.postForm(d, {
+      body: c,
+      basicAuth: l,
+      timeoutInSeconds: this._settings.requestTimeoutInSeconds,
+      initCredentials: this._settings.fetchRequestCredentials,
+      extraHeaders: r
+    });
+    return n.debug("got response"), h;
   }
   /**
    * Exchange credentials.
@@ -669,26 +805,27 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     scope: i = this._settings.scope,
     ...r
   }) {
-    const n = this._logger.create("exchangeCredentials");
-    t || n.throw(new Error("A client_id is required"));
-    const c = new URLSearchParams({ grant_type: e, scope: i });
+    const o = this._logger.create("exchangeCredentials");
+    t || o.throw(new Error("A client_id is required"));
+    const n = new URLSearchParams({ grant_type: e });
+    this._settings.omitScopeWhenRequesting || n.set("scope", i);
     for (const [h, g] of Object.entries(r))
-      g != null && c.set(h, g);
-    let o;
+      g != null && n.set(h, g);
+    let c;
     switch (this._settings.client_authentication) {
       case "client_secret_basic":
         if (!s)
-          throw n.throw(new Error("A client_secret is required")), null;
-        o = z.generateBasicAuth(t, s);
+          throw o.throw(new Error("A client_secret is required")), null;
+        c = C.generateBasicAuth(t, s);
         break;
       case "client_secret_post":
-        c.append("client_id", t), s && c.append("client_secret", s);
+        n.append("client_id", t), s && n.append("client_secret", s);
         break;
     }
     const l = await this._metadataService.getTokenEndpoint(!1);
-    n.debug("got token endpoint");
-    const d = await this._jsonService.postForm(l, { body: c, basicAuth: o, initCredentials: this._settings.fetchRequestCredentials });
-    return n.debug("got response"), d;
+    o.debug("got token endpoint");
+    const d = await this._jsonService.postForm(l, { body: n, basicAuth: c, timeoutInSeconds: this._settings.requestTimeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials });
+    return o.debug("got response"), d;
   }
   /**
    * Exchange a refresh token.
@@ -700,28 +837,29 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     client_id: t = this._settings.client_id,
     client_secret: s = this._settings.client_secret,
     timeoutInSeconds: i,
-    ...r
+    extraHeaders: r,
+    ...o
   }) {
     const n = this._logger.create("exchangeRefreshToken");
-    t || n.throw(new Error("A client_id is required")), r.refresh_token || n.throw(new Error("A refresh_token is required"));
+    t || n.throw(new Error("A client_id is required")), o.refresh_token || n.throw(new Error("A refresh_token is required"));
     const c = new URLSearchParams({ grant_type: e });
-    for (const [h, g] of Object.entries(r))
-      Array.isArray(g) ? g.forEach((v) => c.append(h, v)) : g != null && c.set(h, g);
-    let o;
+    for (const [g, _] of Object.entries(o))
+      Array.isArray(_) ? _.forEach((S) => c.append(g, S)) : _ != null && c.set(g, _);
+    let l;
     switch (this._settings.client_authentication) {
       case "client_secret_basic":
         if (!s)
           throw n.throw(new Error("A client_secret is required")), null;
-        o = z.generateBasicAuth(t, s);
+        l = C.generateBasicAuth(t, s);
         break;
       case "client_secret_post":
         c.append("client_id", t), s && c.append("client_secret", s);
         break;
     }
-    const l = await this._metadataService.getTokenEndpoint(!1);
+    const d = await this._metadataService.getTokenEndpoint(!1);
     n.debug("got token endpoint");
-    const d = await this._jsonService.postForm(l, { body: c, basicAuth: o, timeoutInSeconds: i, initCredentials: this._settings.fetchRequestCredentials });
-    return n.debug("got response"), d;
+    const h = await this._jsonService.postForm(d, { body: c, basicAuth: l, timeoutInSeconds: i, initCredentials: this._settings.fetchRequestCredentials, extraHeaders: r });
+    return n.debug("got response"), h;
   }
   /**
    * Revoke an access or refresh token.
@@ -735,17 +873,17 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     const i = await this._metadataService.getRevocationEndpoint(!1);
     s.debug(`got revocation endpoint, revoking ${(t = e.token_type_hint) != null ? t : "default token type"}`);
     const r = new URLSearchParams();
-    for (const [n, c] of Object.entries(e))
-      c != null && r.set(n, c);
-    r.set("client_id", this._settings.client_id), this._settings.client_secret && r.set("client_secret", this._settings.client_secret), await this._jsonService.postForm(i, { body: r }), s.debug("got response");
+    for (const [o, n] of Object.entries(e))
+      n != null && r.set(o, n);
+    r.set("client_id", this._settings.client_id), this._settings.client_secret && r.set("client_secret", this._settings.client_secret), await this._jsonService.postForm(i, { body: r, timeoutInSeconds: this._settings.requestTimeoutInSeconds }), s.debug("got response");
   }
-}, rs = class {
+}, hs = class {
   constructor(e, t, s) {
-    this._settings = e, this._metadataService = t, this._claimsService = s, this._logger = new u("ResponseValidator"), this._userInfoService = new is(this._settings, this._metadataService), this._tokenClient = new Xe(this._settings, this._metadataService);
+    this._settings = e, this._metadataService = t, this._claimsService = s, this._logger = new u("ResponseValidator"), this._userInfoService = new ds(this._settings, this._metadataService), this._tokenClient = new st(this._settings, this._metadataService);
   }
-  async validateSigninResponse(e, t) {
-    const s = this._logger.create("validateSigninResponse");
-    this._processSigninState(e, t), s.debug("state processed"), await this._processCode(e, t), s.debug("code processed"), e.isOpenId && this._validateIdTokenAttributes(e), s.debug("tokens validated"), await this._processClaims(e, t == null ? void 0 : t.skipUserInfo, e.isOpenId), s.debug("claims processed");
+  async validateSigninResponse(e, t, s) {
+    const i = this._logger.create("validateSigninResponse");
+    this._processSigninState(e, t), i.debug("state processed"), await this._processCode(e, t, s), i.debug("code processed"), e.isOpenId && this._validateIdTokenAttributes(e), i.debug("tokens validated"), await this._processClaims(e, t == null ? void 0 : t.skipUserInfo, e.isOpenId), i.debug("claims processed");
   }
   async validateCredentialsResponse(e, t) {
     const s = this._logger.create("validateCredentialsResponse");
@@ -755,19 +893,19 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     var s, i;
     const r = this._logger.create("validateRefreshResponse");
     e.userState = t.data, (s = e.session_state) != null || (e.session_state = t.session_state), (i = e.scope) != null || (e.scope = t.scope), e.isOpenId && e.id_token && (this._validateIdTokenAttributes(e, t.id_token), r.debug("ID Token validated")), e.id_token || (e.id_token = t.id_token, e.profile = t.profile);
-    const n = e.isOpenId && !!e.id_token;
-    await this._processClaims(e, !1, n), r.debug("claims processed");
+    const o = e.isOpenId && !!e.id_token;
+    await this._processClaims(e, !1, o), r.debug("claims processed");
   }
   validateSignoutResponse(e, t) {
     const s = this._logger.create("validateSignoutResponse");
     if (t.id !== e.state && s.throw(new Error("State does not match")), s.debug("state validated"), e.userState = t.data, e.error)
-      throw s.warn("Response was error", e.error), new W(e);
+      throw s.warn("Response was error", e.error), new B(e);
   }
   _processSigninState(e, t) {
     var s;
     const i = this._logger.create("_processSigninState");
     if (t.id !== e.state && i.throw(new Error("State does not match")), t.client_id || i.throw(new Error("No client_id on state")), t.authority || i.throw(new Error("No authority on state")), this._settings.authority !== t.authority && i.throw(new Error("authority mismatch on settings vs. signin state")), this._settings.client_id && this._settings.client_id !== t.client_id && i.throw(new Error("client_id mismatch on settings vs. signin state")), i.debug("state validated"), e.userState = t.data, e.url_state = t.url_state, (s = e.scope) != null || (e.scope = t.scope), e.error)
-      throw i.warn("Response was error", e.error), new W(e);
+      throw i.warn("Response was error", e.error), new B(e);
     t.code_verifier && !e.code && i.throw(new Error("Expected code in response"));
   }
   async _processClaims(e, t = !1, s = !0) {
@@ -780,36 +918,37 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     const r = await this._userInfoService.getClaims(e.access_token);
     i.debug("user info claims received from user info endpoint"), s && r.sub !== e.profile.sub && i.throw(new Error("subject from UserInfo response does not match subject in ID Token")), e.profile = this._claimsService.mergeClaims(e.profile, this._claimsService.filterProtocolClaims(r)), i.debug("user info claims received, updated profile:", e.profile);
   }
-  async _processCode(e, t) {
-    const s = this._logger.create("_processCode");
+  async _processCode(e, t, s) {
+    const i = this._logger.create("_processCode");
     if (e.code) {
-      s.debug("Validating code");
-      const i = await this._tokenClient.exchangeCode({
+      i.debug("Validating code");
+      const r = await this._tokenClient.exchangeCode({
         client_id: t.client_id,
         client_secret: t.client_secret,
         code: e.code,
         redirect_uri: t.redirect_uri,
         code_verifier: t.code_verifier,
+        extraHeaders: s,
         ...t.extraTokenParams
       });
-      Object.assign(e, i);
+      Object.assign(e, r);
     } else
-      s.debug("No code to process");
+      i.debug("No code to process");
   }
   _validateIdTokenAttributes(e, t) {
     var s;
     const i = this._logger.create("_validateIdTokenAttributes");
     i.debug("decoding ID Token JWT");
-    const r = fe.decode((s = e.id_token) != null ? s : "");
+    const r = de.decode((s = e.id_token) != null ? s : "");
     if (r.sub || i.throw(new Error("ID Token is missing a subject claim")), t) {
-      const n = fe.decode(t);
-      r.sub !== n.sub && i.throw(new Error("sub in id_token does not match current sub")), r.auth_time && r.auth_time !== n.auth_time && i.throw(new Error("auth_time in id_token does not match original auth_time")), r.azp && r.azp !== n.azp && i.throw(new Error("azp in id_token does not match original azp")), !r.azp && n.azp && i.throw(new Error("azp not in id_token, but present in original id_token"));
+      const o = de.decode(t);
+      r.sub !== o.sub && i.throw(new Error("sub in id_token does not match current sub")), r.auth_time && r.auth_time !== o.auth_time && i.throw(new Error("auth_time in id_token does not match original auth_time")), r.azp && r.azp !== o.azp && i.throw(new Error("azp in id_token does not match original azp")), !r.azp && o.azp && i.throw(new Error("azp not in id_token, but present in original id_token"));
     }
     e.profile = r;
   }
-}, ne = class Se {
+}, he = class Ie {
   constructor(t) {
-    this.id = t.id || z.generateUUIDv4(), this.data = t.data, t.created && t.created > 0 ? this.created = t.created : this.created = M.getEpochTime(), this.request_type = t.request_type, this.url_state = t.url_state;
+    this.id = t.id || C.generateUUIDv4(), this.data = t.data, t.created && t.created > 0 ? this.created = t.created : this.created = M.getEpochTime(), this.request_type = t.request_type, this.url_state = t.url_state;
   }
   toStorageString() {
     return new u("State").create("toStorageString"), JSON.stringify({
@@ -821,33 +960,33 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     });
   }
   static fromStorageString(t) {
-    return u.createStatic("State", "fromStorageString"), Promise.resolve(new Se(JSON.parse(t)));
+    return u.createStatic("State", "fromStorageString"), Promise.resolve(new Ie(JSON.parse(t)));
   }
   static async clearStaleState(t, s) {
-    const i = u.createStatic("State", "clearStaleState"), r = M.getEpochTime() - s, n = await t.getAllKeys();
-    i.debug("got keys", n);
-    for (let c = 0; c < n.length; c++) {
-      const o = n[c], l = await t.get(o);
+    const i = u.createStatic("State", "clearStaleState"), r = M.getEpochTime() - s, o = await t.getAllKeys();
+    i.debug("got keys", o);
+    for (let n = 0; n < o.length; n++) {
+      const c = o[n], l = await t.get(c);
       let d = !1;
       if (l)
         try {
-          const h = await Se.fromStorageString(l);
-          i.debug("got item from key:", o, h.created), h.created <= r && (d = !0);
+          const h = await Ie.fromStorageString(l);
+          i.debug("got item from key:", c, h.created), h.created <= r && (d = !0);
         } catch (h) {
-          i.error("Error parsing state for key:", o, h), d = !0;
+          i.error("Error parsing state for key:", c, h), d = !0;
         }
       else
-        i.debug("no item in storage for key:", o), d = !0;
-      d && (i.debug("removed item for key:", o), t.remove(o));
+        i.debug("no item in storage for key:", c), d = !0;
+      d && (i.debug("removed item for key:", c), t.remove(c));
     }
   }
-}, Ye = class be extends ne {
+}, it = class Ee extends he {
   constructor(t) {
     super(t), this.code_verifier = t.code_verifier, this.code_challenge = t.code_challenge, this.authority = t.authority, this.client_id = t.client_id, this.redirect_uri = t.redirect_uri, this.scope = t.scope, this.client_secret = t.client_secret, this.extraTokenParams = t.extraTokenParams, this.response_mode = t.response_mode, this.skipUserInfo = t.skipUserInfo;
   }
   static async create(t) {
-    const s = t.code_verifier === !0 ? z.generateCodeVerifier() : t.code_verifier || void 0, i = s ? await z.generateCodeChallenge(s) : void 0;
-    return new be({
+    const s = t.code_verifier === !0 ? C.generateCodeVerifier() : t.code_verifier || void 0, i = s ? await C.generateCodeChallenge(s) : void 0;
+    return new Ee({
       ...t,
       code_verifier: s,
       code_challenge: i
@@ -874,9 +1013,9 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
   static fromStorageString(t) {
     u.createStatic("SigninState", "fromStorageString");
     const s = JSON.parse(t);
-    return be.create(s);
+    return Ee.create(s);
   }
-}, Ze = class et {
+}, rt = class nt {
   constructor(t) {
     this.url = t.url, this.state = t.state;
   }
@@ -886,21 +1025,23 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
     authority: s,
     client_id: i,
     redirect_uri: r,
-    response_type: n,
-    scope: c,
+    response_type: o,
+    scope: n,
     // optional
-    state_data: o,
+    state_data: c,
     response_mode: l,
     request_type: d,
     client_secret: h,
     nonce: g,
-    url_state: v,
-    resource: b,
-    skipUserInfo: R,
-    extraQueryParams: k,
-    extraTokenParams: x,
-    disablePKCE: E,
-    ...H
+    url_state: _,
+    resource: S,
+    skipUserInfo: x,
+    extraQueryParams: T,
+    extraTokenParams: A,
+    disablePKCE: I,
+    dpopJkt: N,
+    omitScopeWhenRequesting: P,
+    ...L
   }) {
     if (!t)
       throw this._logger.error("create: No url passed"), new Error("url");
@@ -908,43 +1049,43 @@ var Gt = "10000000-1000-4000-8000-100000000000", Fe = (e) => btoa([...new Uint8A
       throw this._logger.error("create: No client_id passed"), new Error("client_id");
     if (!r)
       throw this._logger.error("create: No redirect_uri passed"), new Error("redirect_uri");
-    if (!n)
+    if (!o)
       throw this._logger.error("create: No response_type passed"), new Error("response_type");
-    if (!c)
+    if (!n)
       throw this._logger.error("create: No scope passed"), new Error("scope");
     if (!s)
       throw this._logger.error("create: No authority passed"), new Error("authority");
-    const T = await Ye.create({
-      data: o,
+    const R = await it.create({
+      data: c,
       request_type: d,
-      url_state: v,
-      code_verifier: !E,
+      url_state: _,
+      code_verifier: !I,
       client_id: i,
       authority: s,
       redirect_uri: r,
       response_mode: l,
       client_secret: h,
-      scope: c,
-      extraTokenParams: x,
-      skipUserInfo: R
+      scope: n,
+      extraTokenParams: A,
+      skipUserInfo: x
     }), w = new URL(t);
-    w.searchParams.append("client_id", i), w.searchParams.append("redirect_uri", r), w.searchParams.append("response_type", n), w.searchParams.append("scope", c), g && w.searchParams.append("nonce", g);
-    let U = T.id;
-    v && (U = `${U}${we}${v}`), w.searchParams.append("state", U), T.code_challenge && (w.searchParams.append("code_challenge", T.code_challenge), w.searchParams.append("code_challenge_method", "S256")), b && (Array.isArray(b) ? b : [b]).forEach((S) => w.searchParams.append("resource", S));
-    for (const [C, S] of Object.entries({ response_mode: l, ...H, ...k }))
-      S != null && w.searchParams.append(C, S.toString());
-    return new et({
+    w.searchParams.append("client_id", i), w.searchParams.append("redirect_uri", r), w.searchParams.append("response_type", o), P || w.searchParams.append("scope", n), g && w.searchParams.append("nonce", g), N && w.searchParams.append("dpop_jkt", N);
+    let E = R.id;
+    _ && (E = `${E}${be}${_}`), w.searchParams.append("state", E), R.code_challenge && (w.searchParams.append("code_challenge", R.code_challenge), w.searchParams.append("code_challenge_method", "S256")), S && (Array.isArray(S) ? S : [S]).forEach((b) => w.searchParams.append("resource", b));
+    for (const [U, b] of Object.entries({ response_mode: l, ...L, ...T }))
+      b != null && w.searchParams.append(U, b.toString());
+    return new nt({
       url: w.href,
-      state: T
+      state: R
     });
   }
 };
-Ze._logger = new u("SigninRequest");
-var ns = Ze, os = "openid", he = class {
+rt._logger = new u("SigninRequest");
+var gs = rt, us = "openid", me = class {
   constructor(e) {
     if (this.access_token = "", this.token_type = "", this.profile = {}, this.state = e.get("state"), this.session_state = e.get("session_state"), this.state) {
-      const t = decodeURIComponent(this.state).split(we);
-      this.state = t[0], t.length > 1 && (this.url_state = t.slice(1).join(we));
+      const t = decodeURIComponent(this.state).split(be);
+      this.state = t[0], t.length > 1 && (this.url_state = t.slice(1).join(be));
     }
     this.error = e.get("error"), this.error_description = e.get("error_description"), this.error_uri = e.get("error_uri"), this.code = e.get("code");
   }
@@ -957,31 +1098,31 @@ var ns = Ze, os = "openid", he = class {
   }
   get isOpenId() {
     var e;
-    return ((e = this.scope) == null ? void 0 : e.split(" ").includes(os)) || !!this.id_token;
+    return ((e = this.scope) == null ? void 0 : e.split(" ").includes(us)) || !!this.id_token;
   }
-}, as = class {
+}, _s = class {
   constructor({
     url: e,
     state_data: t,
     id_token_hint: s,
     post_logout_redirect_uri: i,
     extraQueryParams: r,
-    request_type: n,
-    client_id: c
+    request_type: o,
+    client_id: n
   }) {
     if (this._logger = new u("SignoutRequest"), !e)
       throw this._logger.error("ctor: No url passed"), new Error("url");
-    const o = new URL(e);
-    s && o.searchParams.append("id_token_hint", s), c && o.searchParams.append("client_id", c), i && (o.searchParams.append("post_logout_redirect_uri", i), t && (this.state = new ne({ data: t, request_type: n }), o.searchParams.append("state", this.state.id)));
+    const c = new URL(e);
+    s && c.searchParams.append("id_token_hint", s), n && c.searchParams.append("client_id", n), i && (c.searchParams.append("post_logout_redirect_uri", i), t && (this.state = new he({ data: t, request_type: o }), c.searchParams.append("state", this.state.id)));
     for (const [l, d] of Object.entries({ ...r }))
-      d != null && o.searchParams.append(l, d.toString());
-    this.url = o.href;
+      d != null && c.searchParams.append(l, d.toString());
+    this.url = c.href;
   }
-}, cs = class {
+}, ps = class {
   constructor(e) {
     this.state = e.get("state"), this.error = e.get("error"), this.error_description = e.get("error_description"), this.error_uri = e.get("error_uri");
   }
-}, ls = [
+}, fs = [
   "nbf",
   "jti",
   "auth_time",
@@ -991,7 +1132,7 @@ var ns = Ze, os = "openid", he = class {
   "azp",
   "at_hash"
   // https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken
-], ds = ["sub", "iss", "aud", "exp", "iat"], hs = class {
+], ms = ["sub", "iss", "aud", "exp", "iat"], ws = class {
   constructor(e) {
     this._settings = e, this._logger = new u("ClaimsService");
   }
@@ -999,9 +1140,9 @@ var ns = Ze, os = "openid", he = class {
     const t = { ...e };
     if (this._settings.filterProtocolClaims) {
       let s;
-      Array.isArray(this._settings.filterProtocolClaims) ? s = this._settings.filterProtocolClaims : s = ls;
+      Array.isArray(this._settings.filterProtocolClaims) ? s = this._settings.filterProtocolClaims : s = fs;
       for (const i of s)
-        ds.includes(i) || delete t[i];
+        ms.includes(i) || delete t[i];
     }
     return t;
   }
@@ -1013,18 +1154,21 @@ var ns = Ze, os = "openid", he = class {
           if (this._settings.mergeClaimsStrategy.array == "replace")
             s[i] = r;
           else {
-            const n = Array.isArray(s[i]) ? s[i] : [s[i]];
-            for (const c of Array.isArray(r) ? r : [r])
-              n.includes(c) || n.push(c);
-            s[i] = n;
+            const o = Array.isArray(s[i]) ? s[i] : [s[i]];
+            for (const n of Array.isArray(r) ? r : [r])
+              o.includes(n) || o.push(n);
+            s[i] = o;
           }
-        else
-          typeof s[i] == "object" && typeof r == "object" ? s[i] = this.mergeClaims(s[i], r) : s[i] = r;
+        else typeof s[i] == "object" && typeof r == "object" ? s[i] = this.mergeClaims(s[i], r) : s[i] = r;
     return s;
   }
-}, gs = class {
+}, ot = class {
   constructor(e, t) {
-    this._logger = new u("OidcClient"), this.settings = e instanceof ve ? e : new ve(e), this.metadataService = t ?? new Yt(this.settings), this._claimsService = new hs(this.settings), this._validator = new rs(this.settings, this.metadataService, this._claimsService), this._tokenClient = new Xe(this.settings, this.metadataService);
+    this.keys = e, this.nonce = t;
+  }
+}, vs = class {
+  constructor(e, t) {
+    this._logger = new u("OidcClient"), this.settings = e instanceof Te ? e : new Te(e), this.metadataService = t ?? new ns(this.settings), this._claimsService = new ws(this.settings), this._validator = new hs(this.settings, this.metadataService, this._claimsService), this._tokenClient = new st(this.settings, this.metadataService);
   }
   async createSigninRequest({
     state: e,
@@ -1032,30 +1176,32 @@ var ns = Ze, os = "openid", he = class {
     request_uri: s,
     request_type: i,
     id_token_hint: r,
-    login_hint: n,
-    skipUserInfo: c,
-    nonce: o,
+    login_hint: o,
+    skipUserInfo: n,
+    nonce: c,
     url_state: l,
     response_type: d = this.settings.response_type,
     scope: h = this.settings.scope,
     redirect_uri: g = this.settings.redirect_uri,
-    prompt: v = this.settings.prompt,
-    display: b = this.settings.display,
-    max_age: R = this.settings.max_age,
-    ui_locales: k = this.settings.ui_locales,
-    acr_values: x = this.settings.acr_values,
-    resource: E = this.settings.resource,
-    response_mode: H = this.settings.response_mode,
-    extraQueryParams: T = this.settings.extraQueryParams,
-    extraTokenParams: w = this.settings.extraTokenParams
+    prompt: _ = this.settings.prompt,
+    display: S = this.settings.display,
+    max_age: x = this.settings.max_age,
+    ui_locales: T = this.settings.ui_locales,
+    acr_values: A = this.settings.acr_values,
+    resource: I = this.settings.resource,
+    response_mode: N = this.settings.response_mode,
+    extraQueryParams: P = this.settings.extraQueryParams,
+    extraTokenParams: L = this.settings.extraTokenParams,
+    dpopJkt: R,
+    omitScopeWhenRequesting: w = this.settings.omitScopeWhenRequesting
   }) {
-    const U = this._logger.create("createSigninRequest");
+    const E = this._logger.create("createSigninRequest");
     if (d !== "code")
       throw new Error("Only the Authorization Code flow (with PKCE) is supported");
-    const C = await this.metadataService.getAuthorizationEndpoint();
-    U.debug("Received authorization endpoint", C);
-    const S = await ns.create({
-      url: C,
+    const U = await this.metadataService.getAuthorizationEndpoint();
+    E.debug("Received authorization endpoint", U);
+    const b = await gs.create({
+      url: U,
       authority: this.settings.authority,
       client_id: this.settings.client_id,
       redirect_uri: g,
@@ -1063,41 +1209,65 @@ var ns = Ze, os = "openid", he = class {
       scope: h,
       state_data: e,
       url_state: l,
-      prompt: v,
-      display: b,
-      max_age: R,
-      ui_locales: k,
+      prompt: _,
+      display: S,
+      max_age: x,
+      ui_locales: T,
       id_token_hint: r,
-      login_hint: n,
-      acr_values: x,
-      resource: E,
+      login_hint: o,
+      acr_values: A,
+      dpopJkt: R,
+      resource: I,
       request: t,
       request_uri: s,
-      extraQueryParams: T,
-      extraTokenParams: w,
+      extraQueryParams: P,
+      extraTokenParams: L,
       request_type: i,
-      response_mode: H,
+      response_mode: N,
       client_secret: this.settings.client_secret,
-      skipUserInfo: c,
-      nonce: o,
-      disablePKCE: this.settings.disablePKCE
+      skipUserInfo: n,
+      nonce: c,
+      disablePKCE: this.settings.disablePKCE,
+      omitScopeWhenRequesting: w
     });
     await this.clearStaleState();
-    const L = S.state;
-    return await this.settings.stateStore.set(L.id, L.toStorageString()), S;
+    const z = b.state;
+    return await this.settings.stateStore.set(z.id, z.toStorageString()), b;
   }
   async readSigninResponseState(e, t = !1) {
-    const s = this._logger.create("readSigninResponseState"), i = new he(me.readParams(e, this.settings.response_mode));
+    const s = this._logger.create("readSigninResponseState"), i = new me(ye.readParams(e, this.settings.response_mode));
     if (!i.state)
       throw s.throw(new Error("No state in response")), null;
     const r = await this.settings.stateStore[t ? "remove" : "get"](i.state);
     if (!r)
       throw s.throw(new Error("No matching state found in storage")), null;
-    return { state: await Ye.fromStorageString(r), response: i };
+    return { state: await it.fromStorageString(r), response: i };
   }
-  async processSigninResponse(e) {
-    const t = this._logger.create("processSigninResponse"), { state: s, response: i } = await this.readSigninResponseState(e, !0);
-    return t.debug("received state from storage; validating response"), await this._validator.validateSigninResponse(i, s), i;
+  async processSigninResponse(e, t) {
+    const s = this._logger.create("processSigninResponse"), { state: i, response: r } = await this.readSigninResponseState(e, !0);
+    if (s.debug("received state from storage; validating response"), this.settings.dpop && this.settings.dpop.store) {
+      const o = await this.getDpopProof(this.settings.dpop.store);
+      t = { ...t, DPoP: o };
+    }
+    try {
+      await this._validator.validateSigninResponse(r, i, t);
+    } catch (o) {
+      if (o instanceof ke && this.settings.dpop) {
+        const n = await this.getDpopProof(this.settings.dpop.store, o.nonce);
+        t.DPoP = n, await this._validator.validateSigninResponse(r, i, t);
+      } else
+        throw o;
+    }
+    return r;
+  }
+  async getDpopProof(e, t) {
+    let s, i;
+    return (await e.getAllKeys()).includes(this.settings.client_id) ? (i = await e.get(this.settings.client_id), i.nonce !== t && t && (i.nonce = t, await e.set(this.settings.client_id, i))) : (s = await C.generateDPoPKeys(), i = new ot(s, t), await e.set(this.settings.client_id, i)), await C.generateDPoPProof({
+      url: await this.metadataService.getTokenEndpoint(!1),
+      httpMethod: "POST",
+      keyPair: i.keys,
+      nonce: i.nonce
+    });
   }
   async processResourceOwnerPasswordCredentials({
     username: e,
@@ -1105,40 +1275,64 @@ var ns = Ze, os = "openid", he = class {
     skipUserInfo: s = !1,
     extraTokenParams: i = {}
   }) {
-    const r = await this._tokenClient.exchangeCredentials({ username: e, password: t, ...i }), n = new he(new URLSearchParams());
-    return Object.assign(n, r), await this._validator.validateCredentialsResponse(n, s), n;
+    const r = await this._tokenClient.exchangeCredentials({ username: e, password: t, ...i }), o = new me(new URLSearchParams());
+    return Object.assign(o, r), await this._validator.validateCredentialsResponse(o, s), o;
   }
   async useRefreshToken({
     state: e,
     redirect_uri: t,
     resource: s,
     timeoutInSeconds: i,
-    extraTokenParams: r
+    extraHeaders: r,
+    extraTokenParams: o
   }) {
     var n;
     const c = this._logger.create("useRefreshToken");
-    let o;
+    let l;
     if (this.settings.refreshTokenAllowedScope === void 0)
-      o = e.scope;
+      l = e.scope;
     else {
-      const h = this.settings.refreshTokenAllowedScope.split(" ");
-      o = (((n = e.scope) == null ? void 0 : n.split(" ")) || []).filter((v) => h.includes(v)).join(" ");
+      const g = this.settings.refreshTokenAllowedScope.split(" ");
+      l = (((n = e.scope) == null ? void 0 : n.split(" ")) || []).filter((S) => g.includes(S)).join(" ");
     }
-    const l = await this._tokenClient.exchangeRefreshToken({
-      refresh_token: e.refresh_token,
-      // provide the (possible filtered) scope list
-      scope: o,
-      redirect_uri: t,
-      resource: s,
-      timeoutInSeconds: i,
-      ...r
-    }), d = new he(new URLSearchParams());
-    return Object.assign(d, l), c.debug("validating response", d), await this._validator.validateRefreshResponse(d, {
+    if (this.settings.dpop && this.settings.dpop.store) {
+      const g = await this.getDpopProof(this.settings.dpop.store);
+      r = { ...r, DPoP: g };
+    }
+    let d;
+    try {
+      d = await this._tokenClient.exchangeRefreshToken({
+        refresh_token: e.refresh_token,
+        // provide the (possible filtered) scope list
+        scope: l,
+        redirect_uri: t,
+        resource: s,
+        timeoutInSeconds: i,
+        extraHeaders: r,
+        ...o
+      });
+    } catch (g) {
+      if (g instanceof ke && this.settings.dpop)
+        r.DPoP = await this.getDpopProof(this.settings.dpop.store, g.nonce), d = await this._tokenClient.exchangeRefreshToken({
+          refresh_token: e.refresh_token,
+          // provide the (possible filtered) scope list
+          scope: l,
+          redirect_uri: t,
+          resource: s,
+          timeoutInSeconds: i,
+          extraHeaders: r,
+          ...o
+        });
+      else
+        throw g;
+    }
+    const h = new me(new URLSearchParams());
+    return Object.assign(h, d), c.debug("validating response", h), await this._validator.validateRefreshResponse(h, {
       ...e,
       // override the scope in the state handed over to the validator
       // so it can set the granted scope to the requested scope in case none is included in the response
-      scope: o
-    }), d;
+      scope: l
+    }), h;
   }
   async createSignoutRequest({
     state: e,
@@ -1146,43 +1340,43 @@ var ns = Ze, os = "openid", he = class {
     client_id: s,
     request_type: i,
     post_logout_redirect_uri: r = this.settings.post_logout_redirect_uri,
-    extraQueryParams: n = this.settings.extraQueryParams
+    extraQueryParams: o = this.settings.extraQueryParams
   } = {}) {
-    const c = this._logger.create("createSignoutRequest"), o = await this.metadataService.getEndSessionEndpoint();
-    if (!o)
-      throw c.throw(new Error("No end session endpoint")), null;
-    c.debug("Received end session endpoint", o), !s && r && !t && (s = this.settings.client_id);
-    const l = new as({
-      url: o,
+    const n = this._logger.create("createSignoutRequest"), c = await this.metadataService.getEndSessionEndpoint();
+    if (!c)
+      throw n.throw(new Error("No end session endpoint")), null;
+    n.debug("Received end session endpoint", c), !s && r && !t && (s = this.settings.client_id);
+    const l = new _s({
+      url: c,
       id_token_hint: t,
       client_id: s,
       post_logout_redirect_uri: r,
       state_data: e,
-      extraQueryParams: n,
+      extraQueryParams: o,
       request_type: i
     });
     await this.clearStaleState();
     const d = l.state;
-    return d && (c.debug("Signout request has state to persist"), await this.settings.stateStore.set(d.id, d.toStorageString())), l;
+    return d && (n.debug("Signout request has state to persist"), await this.settings.stateStore.set(d.id, d.toStorageString())), l;
   }
   async readSignoutResponseState(e, t = !1) {
-    const s = this._logger.create("readSignoutResponseState"), i = new cs(me.readParams(e, this.settings.response_mode));
+    const s = this._logger.create("readSignoutResponseState"), i = new ps(ye.readParams(e, this.settings.response_mode));
     if (!i.state) {
       if (s.debug("No state in response"), i.error)
-        throw s.warn("Response was error:", i.error), new W(i);
+        throw s.warn("Response was error:", i.error), new B(i);
       return { state: void 0, response: i };
     }
     const r = await this.settings.stateStore[t ? "remove" : "get"](i.state);
     if (!r)
       throw s.throw(new Error("No matching state found in storage")), null;
-    return { state: await ne.fromStorageString(r), response: i };
+    return { state: await he.fromStorageString(r), response: i };
   }
   async processSignoutResponse(e) {
     const t = this._logger.create("processSignoutResponse"), { state: s, response: i } = await this.readSignoutResponseState(e, !0);
     return s ? (t.debug("Received state from storage; validating response"), this._validator.validateSignoutResponse(i, s)) : t.debug("No state from storage; skipping response validation"), i;
   }
   clearStaleState() {
-    return this._logger.create("clearStaleState"), ne.clearStaleState(this.settings.stateStore, this.settings.staleStateAgeInSeconds);
+    return this._logger.create("clearStaleState"), he.clearStaleState(this.settings.stateStore, this.settings.staleStateAgeInSeconds);
   }
   async revokeToken(e, t) {
     return this._logger.create("revokeToken"), await this._tokenClient.revoke({
@@ -1190,7 +1384,7 @@ var ns = Ze, os = "openid", he = class {
       token_type_hint: t
     });
   }
-}, us = class {
+}, Ss = class {
   constructor(e) {
     this._userManager = e, this._logger = new u("SessionMonitor"), this._start = async (t) => {
       const s = t.session_state;
@@ -1205,7 +1399,7 @@ var ns = Ze, os = "openid", he = class {
         const r = await this._userManager.metadataService.getCheckSessionIframe();
         if (r) {
           i.debug("initializing check session iframe");
-          const n = this._userManager.settings.client_id, c = this._userManager.settings.checkSessionIntervalInSeconds, o = this._userManager.settings.stopCheckSessionOnError, l = new Xt(this._callback, n, r, c, o);
+          const o = this._userManager.settings.client_id, n = this._userManager.settings.checkSessionIntervalInSeconds, c = this._userManager.settings.stopCheckSessionOnError, l = new rs(this._callback, o, r, n, c);
           await l.load(), this._checkSessionIFrame = l, l.start(s);
         } else
           i.warn("no check session iframe found in the metadata");
@@ -1264,7 +1458,7 @@ var ns = Ze, os = "openid", he = class {
       }
     }
   }
-}, ge = class tt {
+}, we = class at {
   constructor(t) {
     var s;
     this.id_token = t.id_token, this.session_state = (s = t.session_state) != null ? s : null, this.access_token = t.access_token, this.refresh_token = t.refresh_token, this.token_type = t.token_type, this.scope = t.scope, this.profile = t.profile, this.expires_at = t.expires_at, this.state = t.userState, this.url_state = t.url_state;
@@ -1301,34 +1495,34 @@ var ns = Ze, os = "openid", he = class {
     });
   }
   static fromStorageString(t) {
-    return u.createStatic("User", "fromStorageString"), new tt(JSON.parse(t));
+    return u.createStatic("User", "fromStorageString"), new at(JSON.parse(t));
   }
-}, $e = "oidc-client", st = class {
+}, Je = "oidc-client", ct = class {
   constructor() {
-    this._abort = new F("Window navigation aborted"), this._disposeHandlers = /* @__PURE__ */ new Set(), this._window = null;
+    this._abort = new W("Window navigation aborted"), this._disposeHandlers = /* @__PURE__ */ new Set(), this._window = null;
   }
   async navigate(e) {
     const t = this._logger.create("navigate");
     if (!this._window)
       throw new Error("Attempted to navigate on a disposed window");
     t.debug("setting URL in window"), this._window.location.replace(e.url);
-    const { url: s, keepOpen: i } = await new Promise((r, n) => {
-      const c = (o) => {
+    const { url: s, keepOpen: i } = await new Promise((r, o) => {
+      const n = (c) => {
         var l;
-        const d = o.data, h = (l = e.scriptOrigin) != null ? l : window.location.origin;
-        if (!(o.origin !== h || (d == null ? void 0 : d.source) !== $e)) {
+        const d = c.data, h = (l = e.scriptOrigin) != null ? l : window.location.origin;
+        if (!(c.origin !== h || (d == null ? void 0 : d.source) !== Je)) {
           try {
-            const g = me.readParams(d.url, e.response_mode).get("state");
-            if (g || t.warn("no state found in response url"), o.source !== this._window && g !== e.state)
+            const g = ye.readParams(d.url, e.response_mode).get("state");
+            if (g || t.warn("no state found in response url"), c.source !== this._window && g !== e.state)
               return;
           } catch {
-            this._dispose(), n(new Error("Invalid response from window"));
+            this._dispose(), o(new Error("Invalid response from window"));
           }
           r(d);
         }
       };
-      window.addEventListener("message", c, !1), this._disposeHandlers.add(() => window.removeEventListener("message", c, !1)), this._disposeHandlers.add(this._abort.addHandler((o) => {
-        this._dispose(), n(o);
+      window.addEventListener("message", n, !1), this._disposeHandlers.add(() => window.removeEventListener("message", n, !1)), this._disposeHandlers.add(this._abort.addHandler((c) => {
+        this._dispose(), o(c);
       }));
     });
     return t.debug("got response from window"), this._dispose(), i || this.close(), { url: s };
@@ -1341,55 +1535,56 @@ var ns = Ze, os = "openid", he = class {
   }
   static _notifyParent(e, t, s = !1, i = window.location.origin) {
     e.postMessage({
-      source: $e,
+      source: Je,
       url: t,
       keepOpen: s
     }, i);
   }
-}, it = {
+}, lt = {
   location: !1,
   toolbar: !1,
   height: 640,
   closePopupWindowAfterInSeconds: -1
-}, rt = "_blank", _s = 60, ps = 2, nt = 10, fs = class extends ve {
+}, dt = "_blank", ys = 60, bs = 2, ht = 10, ks = class extends Te {
   constructor(e) {
     const {
       popup_redirect_uri: t = e.redirect_uri,
       popup_post_logout_redirect_uri: s = e.post_logout_redirect_uri,
-      popupWindowFeatures: i = it,
-      popupWindowTarget: r = rt,
-      redirectMethod: n = "assign",
-      redirectTarget: c = "self",
-      iframeNotifyParentOrigin: o = e.iframeNotifyParentOrigin,
+      popupWindowFeatures: i = lt,
+      popupWindowTarget: r = dt,
+      redirectMethod: o = "assign",
+      redirectTarget: n = "self",
+      iframeNotifyParentOrigin: c = e.iframeNotifyParentOrigin,
       iframeScriptOrigin: l = e.iframeScriptOrigin,
-      silent_redirect_uri: d = e.redirect_uri,
-      silentRequestTimeoutInSeconds: h = nt,
-      automaticSilentRenew: g = !0,
-      validateSubOnSilentRenew: v = !0,
-      includeIdTokenInSilentRenew: b = !1,
-      monitorSession: R = !1,
-      monitorAnonymousSession: k = !1,
-      checkSessionIntervalInSeconds: x = ps,
-      query_status_response_type: E = "code",
-      stopCheckSessionOnError: H = !0,
-      revokeTokenTypes: T = ["access_token", "refresh_token"],
-      revokeTokensOnSignout: w = !1,
-      includeIdTokenInSilentSignout: U = !1,
-      accessTokenExpiringNotificationTimeInSeconds: C = _s,
-      userStore: S
+      requestTimeoutInSeconds: d,
+      silent_redirect_uri: h = e.redirect_uri,
+      silentRequestTimeoutInSeconds: g,
+      automaticSilentRenew: _ = !0,
+      validateSubOnSilentRenew: S = !0,
+      includeIdTokenInSilentRenew: x = !1,
+      monitorSession: T = !1,
+      monitorAnonymousSession: A = !1,
+      checkSessionIntervalInSeconds: I = bs,
+      query_status_response_type: N = "code",
+      stopCheckSessionOnError: P = !0,
+      revokeTokenTypes: L = ["access_token", "refresh_token"],
+      revokeTokensOnSignout: R = !1,
+      includeIdTokenInSilentSignout: w = !1,
+      accessTokenExpiringNotificationTimeInSeconds: E = ys,
+      userStore: U
     } = e;
-    if (super(e), this.popup_redirect_uri = t, this.popup_post_logout_redirect_uri = s, this.popupWindowFeatures = i, this.popupWindowTarget = r, this.redirectMethod = n, this.redirectTarget = c, this.iframeNotifyParentOrigin = o, this.iframeScriptOrigin = l, this.silent_redirect_uri = d, this.silentRequestTimeoutInSeconds = h, this.automaticSilentRenew = g, this.validateSubOnSilentRenew = v, this.includeIdTokenInSilentRenew = b, this.monitorSession = R, this.monitorAnonymousSession = k, this.checkSessionIntervalInSeconds = x, this.stopCheckSessionOnError = H, this.query_status_response_type = E, this.revokeTokenTypes = T, this.revokeTokensOnSignout = w, this.includeIdTokenInSilentSignout = U, this.accessTokenExpiringNotificationTimeInSeconds = C, S)
-      this.userStore = S;
+    if (super(e), this.popup_redirect_uri = t, this.popup_post_logout_redirect_uri = s, this.popupWindowFeatures = i, this.popupWindowTarget = r, this.redirectMethod = o, this.redirectTarget = n, this.iframeNotifyParentOrigin = c, this.iframeScriptOrigin = l, this.silent_redirect_uri = h, this.silentRequestTimeoutInSeconds = g || d || ht, this.automaticSilentRenew = _, this.validateSubOnSilentRenew = S, this.includeIdTokenInSilentRenew = x, this.monitorSession = T, this.monitorAnonymousSession = A, this.checkSessionIntervalInSeconds = I, this.stopCheckSessionOnError = P, this.query_status_response_type = N, this.revokeTokenTypes = L, this.revokeTokensOnSignout = R, this.includeIdTokenInSilentSignout = w, this.accessTokenExpiringNotificationTimeInSeconds = E, U)
+      this.userStore = U;
     else {
-      const L = typeof window < "u" ? window.sessionStorage : new Ge();
-      this.userStore = new Qe({ store: L });
+      const b = typeof window < "u" ? window.sessionStorage : new et();
+      this.userStore = new tt({ store: b });
     }
   }
-}, We = class ot extends st {
+}, Ke = class gt extends ct {
   constructor({
-    silentRequestTimeoutInSeconds: t = nt
+    silentRequestTimeoutInSeconds: t = ht
   }) {
-    super(), this._logger = new u("IFrameWindow"), this._timeoutInSeconds = t, this._frame = ot.createHiddenIframe(), this._window = this._frame.contentWindow;
+    super(), this._logger = new u("IFrameWindow"), this._timeoutInSeconds = t, this._frame = gt.createHiddenIframe(), this._window = this._frame.contentWindow;
   }
   static createHiddenIframe() {
     const t = window.document.createElement("iframe");
@@ -1397,7 +1592,7 @@ var ns = Ze, os = "openid", he = class {
   }
   async navigate(t) {
     this._logger.debug("navigate: Using timeout of:", this._timeoutInSeconds);
-    const s = setTimeout(() => void this._abort.raise(new Ue("IFrame timed out without a response")), this._timeoutInSeconds * 1e3);
+    const s = setTimeout(() => void this._abort.raise(new qe("IFrame timed out without a response")), this._timeoutInSeconds * 1e3);
     return this._disposeHandlers.add(() => clearTimeout(s)), await super.navigate(t);
   }
   close() {
@@ -1411,39 +1606,43 @@ var ns = Ze, os = "openid", he = class {
   static notifyParent(t, s) {
     return super._notifyParent(window.parent, t, !1, s);
   }
-}, ms = class {
+}, Ts = class {
   constructor(e) {
     this._settings = e, this._logger = new u("IFrameNavigator");
   }
   async prepare({
     silentRequestTimeoutInSeconds: e = this._settings.silentRequestTimeoutInSeconds
   }) {
-    return new We({ silentRequestTimeoutInSeconds: e });
+    return new Ke({ silentRequestTimeoutInSeconds: e });
   }
   async callback(e) {
-    this._logger.create("callback"), We.notifyParent(e, this._settings.iframeNotifyParentOrigin);
+    this._logger.create("callback"), Ke.notifyParent(e, this._settings.iframeNotifyParentOrigin);
   }
-}, ws = 500, vs = 1e3, Ke = class extends st {
+}, Is = 500, Es = 1e3, Be = class extends ct {
   constructor({
-    popupWindowTarget: e = rt,
-    popupWindowFeatures: t = {}
+    popupWindowTarget: e = dt,
+    popupWindowFeatures: t = {},
+    popupSignal: s
   }) {
     super(), this._logger = new u("PopupWindow");
-    const s = De.center({ ...it, ...t });
-    this._window = window.open(void 0, e, De.serialize(s)), t.closePopupWindowAfterInSeconds && t.closePopupWindowAfterInSeconds > 0 && setTimeout(() => {
+    const i = We.center({ ...lt, ...t });
+    this._window = window.open(void 0, e, We.serialize(i)), s && s.addEventListener("abort", () => {
+      var r;
+      this._abort.raise(new Error((r = s.reason) != null ? r : "Popup aborted"));
+    }), t.closePopupWindowAfterInSeconds && t.closePopupWindowAfterInSeconds > 0 && setTimeout(() => {
       if (!this._window || typeof this._window.closed != "boolean" || this._window.closed) {
         this._abort.raise(new Error("Popup blocked by user"));
         return;
       }
       this.close();
-    }, t.closePopupWindowAfterInSeconds * vs);
+    }, t.closePopupWindowAfterInSeconds * Es);
   }
   async navigate(e) {
     var t;
     (t = this._window) == null || t.focus();
     const s = setInterval(() => {
       (!this._window || this._window.closed) && this._abort.raise(new Error("Popup closed by user"));
-    }, ws);
+    }, Is);
     return this._disposeHandlers.add(() => clearInterval(s)), await super.navigate(e);
   }
   close() {
@@ -1454,20 +1653,21 @@ var ns = Ze, os = "openid", he = class {
       throw new Error("No window.opener. Can't complete notification.");
     return super._notifyParent(window.opener, e, t);
   }
-}, Ss = class {
+}, Cs = class {
   constructor(e) {
     this._settings = e, this._logger = new u("PopupNavigator");
   }
   async prepare({
     popupWindowFeatures: e = this._settings.popupWindowFeatures,
-    popupWindowTarget: t = this._settings.popupWindowTarget
+    popupWindowTarget: t = this._settings.popupWindowTarget,
+    popupSignal: s
   }) {
-    return new Ke({ popupWindowFeatures: e, popupWindowTarget: t });
+    return new Be({ popupWindowFeatures: e, popupWindowTarget: t, popupSignal: s });
   }
   async callback(e, { keepOpen: t = !1 }) {
-    this._logger.create("callback"), Ke.notifyOpener(e, t);
+    this._logger.create("callback"), Be.notifyOpener(e, t);
   }
-}, bs = class {
+}, Ps = class {
   constructor(e) {
     this._settings = e, this._logger = new u("RedirectNavigator");
   }
@@ -1480,25 +1680,25 @@ var ns = Ze, os = "openid", he = class {
     let i = window.self;
     t === "top" && (i = (s = window.top) != null ? s : window.self);
     const r = i.location[e].bind(i.location);
-    let n;
+    let o;
     return {
-      navigate: async (c) => {
+      navigate: async (n) => {
         this._logger.create("navigate");
-        const o = new Promise((l, d) => {
-          n = d;
+        const c = new Promise((l, d) => {
+          o = d;
         });
-        return r(c.url), await o;
+        return r(n.url), await c;
       },
       close: () => {
-        this._logger.create("close"), n == null || n(new Error("Redirect aborted")), i.stop();
+        this._logger.create("close"), o == null || o(new Error("Redirect aborted")), i.stop();
       }
     };
   }
   async callback() {
   }
-}, ys = class extends Qt {
+}, Rs = class extends is {
   constructor(e) {
-    super({ expiringNotificationTimeInSeconds: e.accessTokenExpiringNotificationTimeInSeconds }), this._logger = new u("UserManagerEvents"), this._userLoaded = new F("User loaded"), this._userUnloaded = new F("User unloaded"), this._silentRenewError = new F("Silent renew error"), this._userSignedIn = new F("User signed in"), this._userSignedOut = new F("User signed out"), this._userSessionChanged = new F("User session changed");
+    super({ expiringNotificationTimeInSeconds: e.accessTokenExpiringNotificationTimeInSeconds }), this._logger = new u("UserManagerEvents"), this._userLoaded = new W("User loaded"), this._userUnloaded = new W("User unloaded"), this._silentRenewError = new W("Silent renew error"), this._userSignedIn = new W("User signed in"), this._userSignedOut = new W("User signed out"), this._userSessionChanged = new W("User session changed");
   }
   async load(e, t = !0) {
     super.load(e), t && await this._userLoaded.raise(e);
@@ -1605,14 +1805,14 @@ var ns = Ze, os = "openid", he = class {
   async _raiseUserSessionChanged() {
     await this._userSessionChanged.raise();
   }
-}, ks = class {
+}, Us = class {
   constructor(e) {
     this._userManager = e, this._logger = new u("SilentRenewService"), this._isStarted = !1, this._retryTimer = new M("Retry Silent Renew"), this._tokenExpiring = async () => {
       const t = this._logger.create("_tokenExpiring");
       try {
         await this._userManager.signinSilent(), t.debug("silent token renewal successful");
       } catch (s) {
-        if (s instanceof Ue) {
+        if (s instanceof qe) {
           t.warn("ErrorTimeout from signinSilent:", s, "retry in 5s"), this._retryTimer.init(5);
           return;
         }
@@ -1634,13 +1834,13 @@ var ns = Ze, os = "openid", he = class {
   stop() {
     this._isStarted && (this._retryTimer.cancel(), this._retryTimer.removeHandler(this._tokenExpiring), this._userManager.events.removeAccessTokenExpiring(this._tokenExpiring), this._isStarted = !1);
   }
-}, Ts = class {
+}, xs = class {
   constructor(e) {
     this.refresh_token = e.refresh_token, this.id_token = e.id_token, this.session_state = e.session_state, this.scope = e.scope, this.profile = e.profile, this.data = e.state;
   }
-}, Is = class {
+}, As = class {
   constructor(e, t, s, i) {
-    this._logger = new u("UserManager"), this.settings = new fs(e), this._client = new gs(e), this._redirectNavigator = t ?? new bs(this.settings), this._popupNavigator = s ?? new Ss(this.settings), this._iframeNavigator = i ?? new ms(this.settings), this._events = new ys(this.settings), this._silentRenewService = new ks(this), this.settings.automaticSilentRenew && this.startSilentRenew(), this._sessionMonitor = null, this.settings.monitorSession && (this._sessionMonitor = new us(this));
+    this._logger = new u("UserManager"), this.settings = new ks(e), this._client = new vs(e), this._redirectNavigator = t ?? new Ps(this.settings), this._popupNavigator = s ?? new Cs(this.settings), this._iframeNavigator = i ?? new Ts(this.settings), this._events = new Rs(this.settings), this._silentRenewService = new Us(this), this.settings.automaticSilentRenew && this.startSilentRenew(), this._sessionMonitor = null, this.settings.monitorSession && (this._sessionMonitor = new Ss(this));
   }
   /**
    * Get object used to register for events raised by the `UserManager`.
@@ -1680,19 +1880,24 @@ var ns = Ze, os = "openid", he = class {
    * @throws `Error` In cases of wrong authentication.
    */
   async signinRedirect(e = {}) {
+    var t;
     this._logger.create("signinRedirect");
     const {
-      redirectMethod: t,
-      ...s
-    } = e, i = await this._redirectNavigator.prepare({ redirectMethod: t });
+      redirectMethod: s,
+      ...i
+    } = e;
+    let r;
+    (t = this.settings.dpop) != null && t.bind_authorization_code && (r = await this.generateDPoPJkt(this.settings.dpop));
+    const o = await this._redirectNavigator.prepare({ redirectMethod: s });
     await this._signinStart({
       request_type: "si:r",
-      ...s
-    }, i);
+      dpopJkt: r,
+      ...i
+    }, o);
   }
   /**
    * Process the response (callback) from the authorization endpoint.
-   * It is recommend to use {@link UserManager.signinCallback} instead.
+   * It is recommended to use {@link UserManager.signinCallback} instead.
    *
    * @returns A promise containing the authenticated `User`.
    *
@@ -1713,10 +1918,15 @@ var ns = Ze, os = "openid", he = class {
     password: t,
     skipUserInfo: s = !1
   }) {
-    const i = this._logger.create("signinResourceOwnerCredential"), r = await this._client.processResourceOwnerPasswordCredentials({ username: e, password: t, skipUserInfo: s, extraTokenParams: this.settings.extraTokenParams });
+    const i = this._logger.create("signinResourceOwnerCredential"), r = await this._client.processResourceOwnerPasswordCredentials({
+      username: e,
+      password: t,
+      skipUserInfo: s,
+      extraTokenParams: this.settings.extraTokenParams
+    });
     i.debug("got signin response");
-    const n = await this._buildUser(r);
-    return n.profile && n.profile.sub ? i.info("success, signed in subject", n.profile.sub) : i.info("no subject"), n;
+    const o = await this._buildUser(r);
+    return o.profile && o.profile.sub ? i.info("success, signed in subject", o.profile.sub) : i.info("no subject"), o;
   }
   /**
    * Trigger a request (via a popup window) to the authorization endpoint.
@@ -1725,23 +1935,29 @@ var ns = Ze, os = "openid", he = class {
    * @throws `Error` In cases of wrong authentication.
    */
   async signinPopup(e = {}) {
-    const t = this._logger.create("signinPopup"), {
-      popupWindowFeatures: s,
-      popupWindowTarget: i,
-      ...r
-    } = e, n = this.settings.popup_redirect_uri;
-    n || t.throw(new Error("No popup_redirect_uri configured"));
-    const c = await this._popupNavigator.prepare({ popupWindowFeatures: s, popupWindowTarget: i }), o = await this._signin({
+    var t;
+    const s = this._logger.create("signinPopup");
+    let i;
+    (t = this.settings.dpop) != null && t.bind_authorization_code && (i = await this.generateDPoPJkt(this.settings.dpop));
+    const {
+      popupWindowFeatures: r,
+      popupWindowTarget: o,
+      popupSignal: n,
+      ...c
+    } = e, l = this.settings.popup_redirect_uri;
+    l || s.throw(new Error("No popup_redirect_uri configured"));
+    const d = await this._popupNavigator.prepare({ popupWindowFeatures: r, popupWindowTarget: o, popupSignal: n }), h = await this._signin({
       request_type: "si:p",
-      redirect_uri: n,
+      redirect_uri: l,
       display: "popup",
-      ...r
-    }, c);
-    return o && (o.profile && o.profile.sub ? t.info("success, signed in subject", o.profile.sub) : t.info("no subject")), o;
+      dpopJkt: i,
+      ...c
+    }, d);
+    return h && (h.profile && h.profile.sub ? s.info("success, signed in subject", h.profile.sub) : s.info("no subject")), h;
   }
   /**
    * Notify the opening window of response (callback) from the authorization endpoint.
-   * It is recommend to use {@link UserManager.signinCallback} instead.
+   * It is recommended to use {@link UserManager.signinCallback} instead.
    *
    * @returns A promise
    *
@@ -1757,47 +1973,50 @@ var ns = Ze, os = "openid", he = class {
    * @returns A promise that contains the authenticated `User`.
    */
   async signinSilent(e = {}) {
-    var t;
-    const s = this._logger.create("signinSilent"), {
-      silentRequestTimeoutInSeconds: i,
-      ...r
+    var t, s;
+    const i = this._logger.create("signinSilent"), {
+      silentRequestTimeoutInSeconds: r,
+      ...o
     } = e;
     let n = await this._loadUser();
     if (n != null && n.refresh_token) {
-      s.debug("using refresh token");
-      const d = new Ts(n);
+      i.debug("using refresh token");
+      const g = new xs(n);
       return await this._useRefreshToken({
-        state: d,
-        redirect_uri: r.redirect_uri,
-        resource: r.resource,
-        extraTokenParams: r.extraTokenParams,
-        timeoutInSeconds: i
+        state: g,
+        redirect_uri: o.redirect_uri,
+        resource: o.resource,
+        extraTokenParams: o.extraTokenParams,
+        timeoutInSeconds: r
       });
     }
-    const c = this.settings.silent_redirect_uri;
-    c || s.throw(new Error("No silent_redirect_uri configured"));
-    let o;
-    n && this.settings.validateSubOnSilentRenew && (s.debug("subject prior to silent renew:", n.profile.sub), o = n.profile.sub);
-    const l = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds: i });
+    let c;
+    (t = this.settings.dpop) != null && t.bind_authorization_code && (c = await this.generateDPoPJkt(this.settings.dpop));
+    const l = this.settings.silent_redirect_uri;
+    l || i.throw(new Error("No silent_redirect_uri configured"));
+    let d;
+    n && this.settings.validateSubOnSilentRenew && (i.debug("subject prior to silent renew:", n.profile.sub), d = n.profile.sub);
+    const h = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds: r });
     return n = await this._signin({
       request_type: "si:s",
-      redirect_uri: c,
+      redirect_uri: l,
       prompt: "none",
       id_token_hint: this.settings.includeIdTokenInSilentRenew ? n == null ? void 0 : n.id_token : void 0,
-      ...r
-    }, l, o), n && ((t = n.profile) != null && t.sub ? s.info("success, signed in subject", n.profile.sub) : s.info("no subject")), n;
+      dpopJkt: c,
+      ...o
+    }, h, d), n && ((s = n.profile) != null && s.sub ? i.info("success, signed in subject", n.profile.sub) : i.info("no subject")), n;
   }
   async _useRefreshToken(e) {
     const t = await this._client.useRefreshToken({
-      ...e,
-      timeoutInSeconds: this.settings.silentRequestTimeoutInSeconds
-    }), s = new ge({ ...e.state, ...t });
+      timeoutInSeconds: this.settings.silentRequestTimeoutInSeconds,
+      ...e
+    }), s = new we({ ...e.state, ...t });
     return await this.storeUser(s), await this._events.load(s), s;
   }
   /**
    *
    * Notify the parent window of response (callback) from the authorization endpoint.
-   * It is recommend to use {@link UserManager.signinCallback} instead.
+   * It is recommended to use {@link UserManager.signinCallback} instead.
    *
    * @returns A promise
    *
@@ -1814,7 +2033,7 @@ var ns = Ze, os = "openid", he = class {
    * - {@link UserManager.signinPopupCallback}
    * - {@link UserManager.signinSilentCallback}
    *
-   * @throws `Error` If request_type is unknown or signout can not processed.
+   * @throws `Error` If request_type is unknown or signin cannot be processed.
    */
   async signinCallback(e = window.location.href) {
     const { state: t } = await this._client.readSigninResponseState(e);
@@ -1822,9 +2041,11 @@ var ns = Ze, os = "openid", he = class {
       case "si:r":
         return await this.signinRedirectCallback(e);
       case "si:p":
-        return await this.signinPopupCallback(e);
+        await this.signinPopupCallback(e);
+        break;
       case "si:s":
-        return await this.signinSilentCallback(e);
+        await this.signinSilentCallback(e);
+        break;
       default:
         throw new Error("invalid response_type in state");
     }
@@ -1836,15 +2057,14 @@ var ns = Ze, os = "openid", he = class {
    * - {@link UserManager.signoutPopupCallback}
    * - {@link UserManager.signoutSilentCallback}
    *
-   * @throws `Error` If request_type is unknown or signout can not processed.
+   * @throws `Error` If request_type is unknown or signout cannot be processed.
    */
   async signoutCallback(e = window.location.href, t = !1) {
     const { state: s } = await this._client.readSignoutResponseState(e);
     if (s)
       switch (s.request_type) {
         case "so:r":
-          await this.signoutRedirectCallback(e);
-          break;
+          return await this.signoutRedirectCallback(e);
         case "so:p":
           await this.signoutPopupCallback(e, t);
           break;
@@ -1866,25 +2086,25 @@ var ns = Ze, os = "openid", he = class {
       ...i
     } = e, r = this.settings.silent_redirect_uri;
     r || t.throw(new Error("No silent_redirect_uri configured"));
-    const n = await this._loadUser(), c = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds: s }), o = await this._signinStart({
+    const o = await this._loadUser(), n = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds: s }), c = await this._signinStart({
       request_type: "si:s",
       // this acts like a signin silent
       redirect_uri: r,
       prompt: "none",
-      id_token_hint: this.settings.includeIdTokenInSilentRenew ? n == null ? void 0 : n.id_token : void 0,
+      id_token_hint: this.settings.includeIdTokenInSilentRenew ? o == null ? void 0 : o.id_token : void 0,
       response_type: this.settings.query_status_response_type,
       scope: "openid",
       skipUserInfo: !0,
       ...i
-    }, c);
+    }, n);
     try {
-      const l = await this._client.processSigninResponse(o.url);
-      return t.debug("got signin response"), l.session_state && l.profile.sub ? (t.info("success for subject", l.profile.sub), {
-        session_state: l.session_state,
-        sub: l.profile.sub
+      const l = {}, d = await this._client.processSigninResponse(c.url, l);
+      return t.debug("got signin response"), d.session_state && d.profile.sub ? (t.info("success for subject", d.profile.sub), {
+        session_state: d.session_state,
+        sub: d.profile.sub
       }) : (t.info("success, user not authenticated"), null);
     } catch (l) {
-      if (this.settings.monitorAnonymousSession && l instanceof W)
+      if (this.settings.monitorAnonymousSession && l instanceof B)
         switch (l.error) {
           case "login_required":
           case "consent_required":
@@ -1917,14 +2137,14 @@ var ns = Ze, os = "openid", he = class {
     }
   }
   async _signinEnd(e, t) {
-    const s = this._logger.create("_signinEnd"), i = await this._client.processSigninResponse(e);
-    return s.debug("got signin response"), await this._buildUser(i, t);
+    const s = this._logger.create("_signinEnd"), i = {}, r = await this._client.processSigninResponse(e, i);
+    return s.debug("got signin response"), await this._buildUser(r, t);
   }
   async _buildUser(e, t) {
-    const s = this._logger.create("_buildUser"), i = new ge(e);
+    const s = this._logger.create("_buildUser"), i = new we(e);
     if (t) {
       if (t !== i.profile.sub)
-        throw s.debug("current user does not match user returned from signin. sub from signin:", i.profile.sub), new W({ ...e, error: "login_required" });
+        throw s.debug("current user does not match user returned from signin. sub from signin:", i.profile.sub), new B({ ...e, error: "login_required" });
       s.debug("current user matches user returned from signin");
     }
     return await this.storeUser(i), s.debug("user stored"), await this._events.load(i), i;
@@ -1947,7 +2167,7 @@ var ns = Ze, os = "openid", he = class {
   }
   /**
    * Process response (callback) from the end session endpoint.
-   * It is recommend to use {@link UserManager.signoutCallback} instead.
+   * It is recommended to use {@link UserManager.signoutCallback} instead.
    *
    * @returns A promise containing signout response
    *
@@ -1958,7 +2178,7 @@ var ns = Ze, os = "openid", he = class {
     return t.info("success"), s;
   }
   /**
-   * Trigger a redirect of a popup window window to the end session endpoint.
+   * Trigger a redirect of a popup window to the end session endpoint.
    *
    * @returns A promise
    */
@@ -1966,8 +2186,9 @@ var ns = Ze, os = "openid", he = class {
     const t = this._logger.create("signoutPopup"), {
       popupWindowFeatures: s,
       popupWindowTarget: i,
-      ...r
-    } = e, n = this.settings.popup_post_logout_redirect_uri, c = await this._popupNavigator.prepare({ popupWindowFeatures: s, popupWindowTarget: i });
+      popupSignal: r,
+      ...o
+    } = e, n = this.settings.popup_post_logout_redirect_uri, c = await this._popupNavigator.prepare({ popupWindowFeatures: s, popupWindowTarget: i, popupSignal: r });
     await this._signout({
       request_type: "so:p",
       post_logout_redirect_uri: n,
@@ -1977,12 +2198,12 @@ var ns = Ze, os = "openid", he = class {
       // plan to return back to the client after signout
       // and so we can close the popup after signout
       state: n == null ? void 0 : {},
-      ...r
+      ...o
     }, c), t.info("success");
   }
   /**
    * Process response (callback) from the end session endpoint from a popup window.
-   * It is recommend to use {@link UserManager.signoutCallback} instead.
+   * It is recommended to use {@link UserManager.signoutCallback} instead.
    *
    * @returns A promise
    *
@@ -2002,12 +2223,12 @@ var ns = Ze, os = "openid", he = class {
     try {
       const r = await this._loadUser();
       i.debug("loaded current user from storage"), this.settings.revokeTokensOnSignout && await this._revokeInternal(r);
-      const n = e.id_token_hint || r && r.id_token;
-      n && (i.debug("setting id_token_hint in signout request"), e.id_token_hint = n), await this.removeUser(), i.debug("user removed, creating signout request");
-      const c = await this._client.createSignoutRequest(e);
+      const o = e.id_token_hint || r && r.id_token;
+      o && (i.debug("setting id_token_hint in signout request"), e.id_token_hint = o), await this.removeUser(), i.debug("user removed, creating signout request");
+      const n = await this._client.createSignoutRequest(e);
       return i.debug("got signout request"), await t.navigate({
-        url: c.url,
-        state: (s = c.state) == null ? void 0 : s.id,
+        url: n.url,
+        state: (s = n.state) == null ? void 0 : s.id,
         scriptOrigin: this.settings.iframeScriptOrigin
       });
     } catch (r) {
@@ -2028,17 +2249,17 @@ var ns = Ze, os = "openid", he = class {
     const s = this._logger.create("signoutSilent"), {
       silentRequestTimeoutInSeconds: i,
       ...r
-    } = e, n = this.settings.includeIdTokenInSilentSignout ? (t = await this._loadUser()) == null ? void 0 : t.id_token : void 0, c = this.settings.popup_post_logout_redirect_uri, o = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds: i });
+    } = e, o = this.settings.includeIdTokenInSilentSignout ? (t = await this._loadUser()) == null ? void 0 : t.id_token : void 0, n = this.settings.popup_post_logout_redirect_uri, c = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds: i });
     await this._signout({
       request_type: "so:s",
-      post_logout_redirect_uri: c,
-      id_token_hint: n,
+      post_logout_redirect_uri: n,
+      id_token_hint: o,
       ...r
-    }, o), s.info("success");
+    }, c), s.info("success");
   }
   /**
    * Notify the parent window of response (callback) from the end session endpoint.
-   * It is recommend to use {@link UserManager.signoutCallback} instead.
+   * It is recommended to use {@link UserManager.signoutCallback} instead.
    *
    * @returns A promise
    *
@@ -2054,8 +2275,7 @@ var ns = Ze, os = "openid", he = class {
   }
   async _revokeInternal(e, t = this.settings.revokeTokenTypes) {
     const s = this._logger.create("_revokeInternal");
-    if (!e)
-      return;
+    if (!e) return;
     const i = t.filter((r) => typeof e[r] == "string");
     if (!i.length) {
       s.debug("no need to revoke due to no token(s)");
@@ -2086,7 +2306,7 @@ var ns = Ze, os = "openid", he = class {
   }
   async _loadUser() {
     const e = this._logger.create("_loadUser"), t = await this.settings.userStore.get(this._userStoreKey);
-    return t ? (e.debug("user storageString loaded"), ge.fromStorageString(t)) : (e.debug("no user storageString"), null);
+    return t ? (e.debug("user storageString loaded"), we.fromStorageString(t)) : (e.debug("no user storageString"), null);
   }
   async storeUser(e) {
     const t = this._logger.create("storeUser");
@@ -2095,7 +2315,7 @@ var ns = Ze, os = "openid", he = class {
       const s = e.toStorageString();
       await this.settings.userStore.set(this._userStoreKey, s);
     } else
-      this._logger.debug("removing user"), await this.settings.userStore.remove(this._userStoreKey);
+      this._logger.debug("removing user"), await this.settings.userStore.remove(this._userStoreKey), this.settings.dpop && await this.settings.dpop.store.remove(this.settings.client_id);
   }
   /**
    * Removes stale state entries in storage for incomplete authorize requests.
@@ -2103,82 +2323,113 @@ var ns = Ze, os = "openid", he = class {
   async clearStaleState() {
     await this._client.clearStaleState();
   }
+  /**
+   * Dynamically generates a DPoP proof for a given user, URL and optional Http method.
+   * This method is useful when you need to make a request to a resource server
+   * with fetch or similar, and you need to include a DPoP proof in a DPoP header.
+   * @param url - The URL to generate the DPoP proof for
+   * @param user - The user to generate the DPoP proof for
+   * @param httpMethod - Optional, defaults to "GET"
+   * @param nonce - Optional nonce provided by the resource server
+   *
+   * @returns A promise containing the DPoP proof or undefined if DPoP is not enabled/no user is found.
+   */
+  async dpopProof(e, t, s, i) {
+    var r, o;
+    const n = await ((o = (r = this.settings.dpop) == null ? void 0 : r.store) == null ? void 0 : o.get(this.settings.client_id));
+    if (n)
+      return await C.generateDPoPProof({
+        url: e,
+        accessToken: t == null ? void 0 : t.access_token,
+        httpMethod: s,
+        keyPair: n.keys,
+        nonce: i
+      });
+  }
+  async generateDPoPJkt(e) {
+    let t = await e.store.get(this.settings.client_id);
+    if (!t) {
+      const s = await C.generateDPoPKeys();
+      t = new ot(s), await e.store.set(this.settings.client_id, t);
+    }
+    return await C.generateDPoPJkt(t.keys);
+  }
 };
-const Es = ["url", "clientId", "redirectUri", "scope", "logoutUrl"], Cs = "openid profile email";
-function Rs(e, t) {
+const Os = ["url", "clientId", "redirectUri", "scope", "logoutUrl"], Ns = "openid profile email";
+function qs(e, t) {
   const s = {};
   return e.forEach((i) => {
     t[i] !== void 0 && (s[i] = t[i]);
   }), s;
 }
-let _, K;
-const xs = (e) => (K = Rs(Es, e), new Is({
-  authority: K.url,
-  client_id: K.clientId,
-  redirect_uri: K.redirectUri,
+let p, V;
+const Ds = (e) => (V = qs(Os, e), new As({
+  authority: V.url,
+  client_id: V.clientId,
+  redirect_uri: V.redirectUri,
   response_type: "code",
-  scope: K.scope || Cs,
+  scope: V.scope || Ns,
   filterProtocolClaims: !0,
   includeIdTokenInSilentRenew: !0,
   includeIdTokenInSilentSignout: !0,
   loadUserInfo: !0
-})), Us = async () => {
+})), js = async () => {
   try {
     console.debug("[Auth] Logging in using OIDC");
-    const e = new URL(window.location.href), t = await (_ == null ? void 0 : _.getUser());
-    e.searchParams.get("state") || t ? await (_ == null ? void 0 : _.signinRedirectCallback()) : await (_ == null ? void 0 : _.signinRedirect().then(() => {
-      _ == null || _.startSilentRenew(), _ == null || _.signinRedirectCallback();
+    const e = new URL(window.location.href), t = await (p == null ? void 0 : p.getUser());
+    e.searchParams.get("state") || t ? await (p == null ? void 0 : p.signinRedirectCallback()) : await (p == null ? void 0 : p.signinRedirect().then(() => {
+      p == null || p.startSilentRenew(), p == null || p.signinRedirectCallback();
     }).catch((s) => {
       console.log(s);
     }));
   } catch (e) {
     console.error("[Auth] Error logging in using OIDC: ", e);
   }
-}, As = async () => _ == null ? void 0 : _.removeUser().then(() => _ == null ? void 0 : _.signoutRedirect({
-  post_logout_redirect_uri: K.logoutUrl || window.location.href
-})), Ps = async () => await (_ == null ? void 0 : _.getUser()) != null, Os = async () => {
-  const e = await (_ == null ? void 0 : _.getUser());
+}, Fs = async () => p == null ? void 0 : p.removeUser().then(() => p == null ? void 0 : p.signoutRedirect({
+  post_logout_redirect_uri: V.logoutUrl || window.location.href
+})), $s = async () => await (p == null ? void 0 : p.getUser()) != null, Hs = async () => {
+  const e = await (p == null ? void 0 : p.getUser());
   return Promise.resolve(e == null ? void 0 : e.id_token);
-}, Ns = async () => {
-  const e = await (_ == null ? void 0 : _.getUser());
+}, Ls = async () => {
+  const e = await (p == null ? void 0 : p.getUser());
   return Promise.resolve(e == null ? void 0 : e.profile.preferred_username);
 };
-let J, Q;
-const qs = async (e, t) => {
+let G, Z;
+const Ms = async (e, t) => {
   try {
-    console.debug("[Auth] Setting Username and Password for BasicAuth"), J = e, Q = t;
+    console.debug("[Auth] Setting Username and Password for BasicAuth"), G = e, Z = t;
   } catch (s) {
     console.error("[Auth] Error logging in using BasicAuth: ", s);
   }
-}, js = async () => {
-  console.debug("[Auth] Logout for BasicAuth"), J = void 0, Q = void 0, window.location.reload();
-}, Hs = async () => J !== void 0 && Q !== void 0, Ls = async () => Promise.resolve(J), Ms = () => {
-  if (J !== void 0 && Q != null)
+}, Ws = async () => {
+  console.debug("[Auth] Logout for BasicAuth"), G = void 0, Z = void 0, window.location.reload();
+}, Js = async () => G !== void 0 && Z !== void 0, Ks = async () => Promise.resolve(G), Bs = () => {
+  if (G !== void 0 && Z != null)
     return {
-      username: J,
-      password: Q
+      username: G,
+      password: Z
     };
-}, at = () => {
-  const e = ut(Kt);
-  return e.type === "oidc" ? (_ === void 0 && (console.debug("[Auth] Creating OIDC UserManager with options: ", e.options), _ = xs(e.options)), {
+}, ut = () => {
+  const e = wt(Xt);
+  return e.type === "oidc" ? (p === void 0 && (console.debug("[Auth] Creating OIDC UserManager with options: ", e.options), p = Ds(e.options)), {
     isOidcAuthEnabled: () => !0,
     isBasicAuthEnabled: () => !1,
-    isAuthenticated: Ps,
-    getToken: Os,
+    isAuthenticated: $s,
+    getToken: Hs,
     getUsernameAndPassword: () => {
     },
-    getUsername: Ns,
-    login: Us,
-    logout: As
+    getUsername: Ls,
+    login: js,
+    logout: Fs
   }) : e.type === "basic" ? {
     isOidcAuthEnabled: () => !1,
     isBasicAuthEnabled: () => !0,
-    isAuthenticated: Hs,
+    isAuthenticated: Js,
     getToken: () => Promise.resolve(void 0),
-    getUsernameAndPassword: Ms,
-    getUsername: Ls,
-    login: qs,
-    logout: js
+    getUsernameAndPassword: Bs,
+    getUsername: Ks,
+    login: Ms,
+    logout: Ws
   } : {
     isOidcAuthEnabled: () => !1,
     isBasicAuthEnabled: () => !1,
@@ -2190,95 +2441,95 @@ const qs = async (e, t) => {
     login: () => Promise.resolve(),
     logout: () => Promise.resolve()
   };
-}, ye = (e) => {
-  const [t, s] = I(null), i = e.format || "locale";
-  return Te(() => {
+}, Ce = (e) => {
+  const [t, s] = y(null), i = e.format || "locale";
+  return Re(() => {
     let r;
-    if (e.date && typeof e.date == "string" ? r = de.fromISO(e.date) : e.date && typeof e.date == "object" && (r = de.fromJSDate(e.date)), r) {
-      const n = {
+    if (e.date && typeof e.date == "string" ? r = fe.fromISO(e.date) : e.date && typeof e.date == "object" && (r = fe.fromJSDate(e.date)), r) {
+      const o = {
         locale: e.locale
       };
-      s(i === "fromNow" ? r.toRelative() : i === "locale" ? r.toLocaleString(de.DATETIME_FULL, n) : r.toFormat(i, n));
+      s(i === "fromNow" ? r.toRelative() : i === "locale" ? r.toLocaleString(fe.DATETIME_FULL, o) : r.toFormat(i, o));
     } else
       s(null);
   }, [e.date]), /* @__PURE__ */ a("span", { children: t || "" });
-}, Ys = (e) => /* @__PURE__ */ a(ye, { date: e.date, format: "fromNow" }), A = ({ condition: e, children: t }) => (typeof e == "boolean" ? e : e()) ? /* @__PURE__ */ a(j.Fragment, { children: t }) : /* @__PURE__ */ a(j.Fragment, {}), Zs = ({ collection: e, emptyState: t, emptyStateTitle: s, emptyStateMessage: i, children: r }) => {
-  const n = () => !e || e.length === 0, c = t || /* @__PURE__ */ f(te, { variant: _t.xs, children: [
-    /* @__PURE__ */ a(se, { titleText: s || "None found", headingLevel: "h4" }),
-    /* @__PURE__ */ a(ue, { children: i || "No items found." })
+}, oi = (e) => /* @__PURE__ */ a(Ce, { date: e.date, format: "fromNow" }), O = ({ condition: e, children: t }) => (typeof e == "boolean" ? e : e()) ? /* @__PURE__ */ a(H.Fragment, { children: t }) : /* @__PURE__ */ a(H.Fragment, {}), ai = ({ collection: e, emptyState: t, emptyStateTitle: s, emptyStateMessage: i, children: r }) => {
+  const o = () => !e || e.length === 0, n = t || /* @__PURE__ */ m(re, { variant: vt.xs, children: [
+    /* @__PURE__ */ a(ne, { titleText: s || "None found", headingLevel: "h4" }),
+    /* @__PURE__ */ a(ve, { children: i || "No items found." })
   ] });
-  return n() ? /* @__PURE__ */ a(j.Fragment, { children: c }) : /* @__PURE__ */ a(j.Fragment, { children: r });
-}, oe = ({ isLoading: e, loadingComponent: t, children: s }) => {
-  const i = () => typeof e == "boolean" ? e : e(), r = t || /* @__PURE__ */ a(X, {});
-  return i() ? /* @__PURE__ */ a(j.Fragment, { children: r }) : /* @__PURE__ */ a(j.Fragment, { children: s });
-}, ei = ({ toolbar: e, alwaysShowToolbar: t, emptyState: s, filteredEmptyState: i, isLoading: r, isError: n, loadingComponent: c, errorComponent: o, isEmpty: l, isFiltered: d, children: h }) => {
-  const g = t || !l || d || n;
-  return o || (o = /* @__PURE__ */ a("div", { style: { padding: "15px", backgroundColor: "white" }, children: /* @__PURE__ */ a(pt, { isInline: !0, variant: "danger", title: "Error: Something went wrong!", children: /* @__PURE__ */ a("p", { children: "Something went wrong with the action you attempted, but we're not sure what it was. Try reloading the page and hopef for a better result, or contact your admin to report the error." }) }) })), /* @__PURE__ */ f(j.Fragment, { children: [
-    /* @__PURE__ */ a(A, { condition: g, children: e }),
-    /* @__PURE__ */ f(oe, { isLoading: r, loadingComponent: c, children: [
-      /* @__PURE__ */ a(A, { condition: !l && !n, children: h }),
-      /* @__PURE__ */ a(A, { condition: l && d && !n, children: i }),
-      /* @__PURE__ */ a(A, { condition: l && !d && !n, children: s }),
-      /* @__PURE__ */ a(A, { condition: n, children: o })
+  return o() ? /* @__PURE__ */ a(H.Fragment, { children: n }) : /* @__PURE__ */ a(H.Fragment, { children: r });
+}, ge = ({ isLoading: e, loadingComponent: t, children: s }) => {
+  const i = () => typeof e == "boolean" ? e : e(), r = t || /* @__PURE__ */ a(ee, {});
+  return i() ? /* @__PURE__ */ a(H.Fragment, { children: r }) : /* @__PURE__ */ a(H.Fragment, { children: s });
+}, ci = ({ toolbar: e, alwaysShowToolbar: t, emptyState: s, filteredEmptyState: i, isLoading: r, isError: o, loadingComponent: n, errorComponent: c, isEmpty: l, isFiltered: d, children: h }) => {
+  const g = t || !l || d || o;
+  return c || (c = /* @__PURE__ */ a("div", { style: { padding: "15px", backgroundColor: "white" }, children: /* @__PURE__ */ a(St, { isInline: !0, variant: "danger", title: "Error: Something went wrong!", children: /* @__PURE__ */ a("p", { children: "Something went wrong with the action you attempted, but we're not sure what it was. Try reloading the page and hopef for a better result, or contact your admin to report the error." }) }) })), /* @__PURE__ */ m(H.Fragment, { children: [
+    /* @__PURE__ */ a(O, { condition: g, children: e }),
+    /* @__PURE__ */ m(ge, { isLoading: r, loadingComponent: n, children: [
+      /* @__PURE__ */ a(O, { condition: !l && !o, children: h }),
+      /* @__PURE__ */ a(O, { condition: l && d && !o, children: i }),
+      /* @__PURE__ */ a(O, { condition: l && !d && !o, children: s }),
+      /* @__PURE__ */ a(O, { condition: o, children: c })
     ] })
   ] });
-}, ti = (e) => {
-  const [t, s] = I(!1), i = (l, d) => {
+}, li = (e) => {
+  const [t, s] = y(!1), i = (l, d) => {
     s(!1);
     const h = d;
     h !== void 0 && h >= 0 ? e.onSelect(e.items[h]) : e.onSelect(void 0);
   }, r = () => {
     s(!t);
-  }, n = (l) => {
+  }, o = (l) => {
     let d;
     return e.itemToTestId !== void 0 && (d = e.itemToTestId(l)), d;
-  }, c = e.popperProps || {
+  }, n = e.popperProps || {
     appendTo: e.menuAppendTo
   };
-  let o = /* @__PURE__ */ a(Nt, { title: e.label });
-  return e.isKebab || (o = /* @__PURE__ */ a(j.Fragment, { children: e.label })), /* @__PURE__ */ a(
-    ft,
+  let c = /* @__PURE__ */ a(Ht, { title: e.label });
+  return e.isKebab || (c = /* @__PURE__ */ a(H.Fragment, { children: e.label })), /* @__PURE__ */ a(
+    yt,
     {
       isOpen: t,
       onSelect: i,
       onOpenChange: (l) => s(l),
       toggle: (l) => /* @__PURE__ */ a(
-        ce,
+        _e,
         {
           "data-testid": e.testId,
           ref: l,
           onClick: r,
           isExpanded: t,
           variant: e.isKebab ? "plain" : "default",
-          children: o
+          children: c
         }
       ),
       ouiaId: "ObjectDropdown",
-      popperProps: c,
+      popperProps: n,
       shouldFocusToggleOnSelect: !0,
-      children: /* @__PURE__ */ a(mt, { children: e.items.map((l, d) => e.itemIsVisible !== void 0 && !e.itemIsVisible(l) ? /* @__PURE__ */ a(ae, {}) : e.itemIsDivider && e.itemIsDivider(l) ? /* @__PURE__ */ a(Je, { component: "li" }, `divider-${d}`) : /* @__PURE__ */ a(
-        wt,
+      children: /* @__PURE__ */ a(bt, { children: e.items.map((l, d) => e.itemIsVisible !== void 0 && !e.itemIsVisible(l) ? /* @__PURE__ */ a(ue, {}) : e.itemIsDivider && e.itemIsDivider(l) ? /* @__PURE__ */ a(Ve, { component: "li" }, `divider-${d}`) : /* @__PURE__ */ a(
+        kt,
         {
           value: d,
           isDisabled: e.itemIsDisabled === void 0 ? !1 : e.itemIsDisabled(l),
-          component: (h) => /* @__PURE__ */ a("button", { ...h, "data-testid": n(l) }),
+          component: (h) => /* @__PURE__ */ a("button", { ...h, "data-testid": o(l) }),
           children: e.itemToString(l)
         },
         `action-${d}`
       )) })
     }
   );
-}, si = (e) => {
+}, zs = (e) => {
   var l;
-  const [t, s] = I(!1), i = (d, h) => {
+  const [t, s] = y(!1), i = (d, h) => {
     s(!1), e.onSelect(e.items[h]);
   }, r = () => {
     s(!t);
-  }, n = (d) => {
+  }, o = (d) => {
     let h;
     return e.itemToTestId !== void 0 && (h = e.itemToTestId(d)), h;
-  }, c = (d) => /* @__PURE__ */ a(
-    ce,
+  }, n = (d) => /* @__PURE__ */ a(
+    _e,
     {
       ref: d,
       className: e.toggleClassname || "menu-toggle",
@@ -2287,23 +2538,23 @@ const qs = async (e, t) => {
       isExpanded: t,
       children: e.value ? e.itemToString(e.value) : e.noSelectionLabel
     }
-  ), o = {
+  ), c = {
     appendTo: e.appendTo === "document" ? () => document.body : "inline"
   };
   return /* @__PURE__ */ a(
-    Ee,
+    xe,
     {
-      toggle: c,
+      toggle: n,
       id: e.toggleId,
       onSelect: i,
       onOpenChange: s,
       isOpen: t,
-      popperProps: o,
-      children: (l = e.items) == null ? void 0 : l.map((d, h) => e.itemIsDivider && e.itemIsDivider(d) ? /* @__PURE__ */ a(Je, {}, h) : /* @__PURE__ */ a(
-        Ce,
+      popperProps: c,
+      children: (l = e.items) == null ? void 0 : l.map((d, h) => e.itemIsDivider && e.itemIsDivider(d) ? /* @__PURE__ */ a(Ve, {}, h) : /* @__PURE__ */ a(
+        Ae,
         {
           isSelected: d === e.value,
-          component: (g) => /* @__PURE__ */ a("button", { ...g, "data-testid": n(d) }),
+          component: (g) => /* @__PURE__ */ a("button", { ...g, "data-testid": o(d) }),
           value: h,
           children: e.itemToString(d)
         },
@@ -2311,36 +2562,36 @@ const qs = async (e, t) => {
       ))
     }
   );
-}, ii = ({ expanded: e, onClick: t }) => e ? /* @__PURE__ */ a(qt, { onClick: t, style: { cursor: "pointer" } }) : /* @__PURE__ */ a(jt, { onClick: t, style: { cursor: "pointer" } }), ct = {
+}, di = ({ expanded: e, onClick: t }) => e ? /* @__PURE__ */ a(Lt, { onClick: t, style: { cursor: "pointer" } }) : /* @__PURE__ */ a(Mt, { onClick: t, style: { cursor: "pointer" } }), _t = {
   padding: "5px",
   minHeight: "128px",
   borderRight: 0,
   borderLeft: 0,
   borderBottom: "1px solid #666",
   backgroundColor: "rgb(240, 240, 240)"
-}, Fs = {
-  ...ct,
+}, Vs = {
+  ..._t,
   color: "red",
   overflow: "auto"
-}, ri = (e) => {
-  const [t, s] = I(""), [i, r] = I(""), [n, c] = I(!1), [o, l] = I(), d = (k, x) => {
-    s(x);
-  }, h = () => t != null && t.trim().length > 0, g = () => o != null && o.trim().length > 0, v = () => {
-    c(!0), e.onUrlFetch(t).then((k) => {
-      l(void 0), r(k), c(!1), e.onChange(k, t);
-    }).catch((k) => {
-      l(k.message), c(!1);
+}, hi = (e) => {
+  const [t, s] = y(""), [i, r] = y(""), [o, n] = y(!1), [c, l] = y(), d = (T, A) => {
+    s(A);
+  }, h = () => t != null && t.trim().length > 0, g = () => c != null && c.trim().length > 0, _ = () => {
+    n(!0), e.onUrlFetch(t).then((T) => {
+      l(void 0), r(T), n(!1), e.onChange(T, t);
+    }).catch((T) => {
+      l(T.message), n(!1);
     });
-  }, b = () => {
+  }, S = () => {
     s(""), r(""), e.onChange(void 0, void 0);
-  }, R = /* @__PURE__ */ f("div", { className: "url-upload-loading", style: ct, children: [
-    /* @__PURE__ */ a(X, { size: "md", className: "spinner", style: { marginRight: "5px" } }),
+  }, x = /* @__PURE__ */ m("div", { className: "url-upload-loading", style: _t, children: [
+    /* @__PURE__ */ a(ee, { size: "md", className: "spinner", style: { marginRight: "5px" } }),
     /* @__PURE__ */ a("span", { className: "spinner-message", children: "Loading URL content" })
   ] });
-  return /* @__PURE__ */ f("div", { className: "url-upload", "data-testid": e.testId, children: [
-    /* @__PURE__ */ f("div", { className: "url-upload-flex", style: { display: "flex" }, children: [
+  return /* @__PURE__ */ m("div", { className: "url-upload", "data-testid": e.testId, children: [
+    /* @__PURE__ */ m("div", { className: "url-upload-flex", style: { display: "flex" }, children: [
       /* @__PURE__ */ a("div", { className: "url-upload-url", style: { flexGrow: 1 }, children: /* @__PURE__ */ a(
-        _e,
+        oe,
         {
           "data-testid": `${e.testId}-input`,
           value: t,
@@ -2351,16 +2602,16 @@ const qs = async (e, t) => {
           "aria-label": "url input"
         }
       ) }),
-      /* @__PURE__ */ a("div", { className: "url-fetch-button", children: /* @__PURE__ */ a(pe, { "data-testid": `${e.testId}-fetch`, variant: "control", isDisabled: !h(), onClick: v, children: "Fetch" }) }),
-      /* @__PURE__ */ a("div", { className: "url-clear-button", children: /* @__PURE__ */ a(pe, { "data-testid": `${e.testId}-clear`, variant: "control", isDisabled: !h(), onClick: b, children: "Clear" }) })
+      /* @__PURE__ */ a("div", { className: "url-fetch-button", children: /* @__PURE__ */ a(ae, { "data-testid": `${e.testId}-fetch`, variant: "control", isDisabled: !h(), onClick: _, children: "Fetch" }) }),
+      /* @__PURE__ */ a("div", { className: "url-clear-button", children: /* @__PURE__ */ a(ae, { "data-testid": `${e.testId}-clear`, variant: "control", isDisabled: !h(), onClick: S, children: "Clear" }) })
     ] }),
-    /* @__PURE__ */ a("div", { className: "url-upload-preview", children: /* @__PURE__ */ f(oe, { isLoading: n, loadingComponent: R, children: [
-      /* @__PURE__ */ a(A, { condition: g, children: /* @__PURE__ */ f("div", { className: "url-upload-error", style: Fs, children: [
+    /* @__PURE__ */ a("div", { className: "url-upload-preview", children: /* @__PURE__ */ m(ge, { isLoading: o, loadingComponent: x, children: [
+      /* @__PURE__ */ a(O, { condition: g, children: /* @__PURE__ */ m("div", { className: "url-upload-error", style: Vs, children: [
         /* @__PURE__ */ a("div", { children: "Error getting content from URL." }),
-        /* @__PURE__ */ a("div", { children: o })
+        /* @__PURE__ */ a("div", { children: c })
       ] }) }),
-      /* @__PURE__ */ a(A, { condition: !g(), children: /* @__PURE__ */ a(
-        vt,
+      /* @__PURE__ */ a(O, { condition: !g(), children: /* @__PURE__ */ a(
+        Tt,
         {
           "data-testid": `${e.testId}-preview`,
           "aria-label": "url-content",
@@ -2371,25 +2622,65 @@ const qs = async (e, t) => {
       ) })
     ] }) })
   ] });
-}, Ds = (e) => {
-  const [t, s] = I({
+}, gi = (e) => {
+  const [t, s] = y(), [i, r] = y();
+  return Re(() => {
+    e.isOpen && (typeof e.frontendInfo == "function" ? e.frontendInfo().then(s) : s(e.frontendInfo), typeof e.backendInfo == "function" ? e.backendInfo().then(r) : r(e.backendInfo));
+  }, [e.isOpen]), /* @__PURE__ */ a(
+    It,
+    {
+      className: "app-about-modal",
+      isOpen: e.isOpen,
+      onClose: e.onClose,
+      trademark: "© 2024 Red Hat",
+      brandImageSrc: e.brandImageSrc,
+      brandImageAlt: e.brandImageAlt,
+      "aria-label": e.brandImageAlt,
+      children: /* @__PURE__ */ m(Et, { className: "app-about-modal-content", style: { marginTop: "-25px" }, children: [
+        /* @__PURE__ */ a($e, { component: He.h2, children: "Web console info" }),
+        /* @__PURE__ */ a(ge, { isLoading: t === void 0, children: /* @__PURE__ */ m(Le, { component: "dl", children: [
+          /* @__PURE__ */ a(k, { component: "dt", children: "Project" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: /* @__PURE__ */ a("a", { href: t == null ? void 0 : t.url, target: "_blank", children: t == null ? void 0 : t.name }) }),
+          /* @__PURE__ */ a(k, { component: "dt", children: "Version" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: t == null ? void 0 : t.version }),
+          /* @__PURE__ */ a(k, { component: "dt", children: "Built on" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: /* @__PURE__ */ a(Ce, { date: t == null ? void 0 : t.builtOn, format: "locale" }) }),
+          /* @__PURE__ */ a(k, { component: "dt", children: "Digest" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: t == null ? void 0 : t.digest })
+        ] }) }),
+        /* @__PURE__ */ a($e, { style: { marginTop: "40px" }, component: He.h2, children: e.backendLabel }),
+        /* @__PURE__ */ a(ge, { isLoading: i === void 0, children: /* @__PURE__ */ m(Le, { component: "dl", children: [
+          /* @__PURE__ */ a(k, { component: "dt", children: "Name" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: (i == null ? void 0 : i.name) || "" }),
+          /* @__PURE__ */ a(k, { component: "dt", children: "Description" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: (i == null ? void 0 : i.description) || "" }),
+          /* @__PURE__ */ a(k, { component: "dt", children: "Version" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: (i == null ? void 0 : i.version) || "" }),
+          /* @__PURE__ */ a(k, { component: "dt", children: "Built on" }),
+          /* @__PURE__ */ a(k, { component: "dd", children: /* @__PURE__ */ a(Ce, { date: i == null ? void 0 : i.builtOn, format: "locale" }) })
+        ] }) })
+      ] })
+    }
+  );
+}, Gs = (e) => {
+  const [t, s] = y({
     username: "",
     password: ""
   }), i = () => {
     e.onLogin(t);
-  }, r = (c, o) => {
+  }, r = (n, c) => {
     s({
       ...t,
-      username: o
+      username: c
     });
-  }, n = (c, o) => {
+  }, o = (n, c) => {
     s({
       ...t,
-      password: o
+      password: c
     });
   };
   return /* @__PURE__ */ a(
-    Re,
+    Oe,
     {
       title: "Login",
       variant: "small",
@@ -2400,16 +2691,16 @@ const qs = async (e, t) => {
       "aria-label": "please-wait-modal",
       style: { marginTop: "-15px" },
       actions: [
-        /* @__PURE__ */ a(pe, { variant: "primary", "data-testid": "modal-btn-login", onClick: i, isDisabled: (t == null ? void 0 : t.username) === "" || (t == null ? void 0 : t.password) === "", children: "Login" }, "login")
+        /* @__PURE__ */ a(ae, { variant: "primary", "data-testid": "modal-btn-login", onClick: i, isDisabled: (t == null ? void 0 : t.username) === "" || (t == null ? void 0 : t.password) === "", children: "Login" }, "login")
       ],
-      children: /* @__PURE__ */ f(St, { children: [
+      children: /* @__PURE__ */ m(Ge, { children: [
         /* @__PURE__ */ a(
-          je,
+          Me,
           {
             label: "Username",
             fieldId: "form-username",
             children: /* @__PURE__ */ a(
-              _e,
+              oe,
               {
                 isRequired: !0,
                 type: "text",
@@ -2424,12 +2715,12 @@ const qs = async (e, t) => {
           }
         ),
         /* @__PURE__ */ a(
-          je,
+          Me,
           {
             label: "Password",
             fieldId: "form-password",
             children: /* @__PURE__ */ a(
-              _e,
+              oe,
               {
                 isRequired: !0,
                 type: "text",
@@ -2438,7 +2729,7 @@ const qs = async (e, t) => {
                 name: "form-password",
                 value: t == null ? void 0 : t.password,
                 placeholder: "Password",
-                onChange: n
+                onChange: o
               }
             )
           }
@@ -2446,24 +2737,52 @@ const qs = async (e, t) => {
       ] })
     }
   );
-}, ni = (e) => {
-  const [t, s] = I(
+}, ui = (e) => /* @__PURE__ */ m(
+  Oe,
+  {
+    title: "Please Wait",
+    variant: "small",
+    isOpen: e.isOpen,
+    header: /* @__PURE__ */ a("a", { href: "#" }),
+    showClose: !1,
+    className: "please-wait pf-m-redhat-font",
+    "aria-label": "please-wait-modal",
+    style: { marginTop: "-15px" },
+    children: [
+      /* @__PURE__ */ a(ee, { size: "md", className: "spinner" }),
+      /* @__PURE__ */ a("span", { className: "message", style: { fontSize: "15px", color: "#333", marginLeft: "10px" }, children: e.message })
+    ]
+  }
+), _i = (e) => /* @__PURE__ */ a(
+  Oe,
+  {
+    title: e.title,
+    variant: "small",
+    isOpen: e.isOpen,
+    showClose: e.isCloseable,
+    onClose: e.onClose,
+    className: "progress pf-m-redhat-font",
+    "aria-label": "progress-modal",
+    children: /* @__PURE__ */ a(Ct, { title: e.message, value: e.progress })
+  }
+), pi = (e) => {
+  const [t, s] = y(
     0
     /* AUTHENTICATING */
-  ), i = at(), r = (n) => {
-    console.info("[ApplicationAuth] Using username and password."), i.login(n.username, n.password), s(
+  ), i = ut(), r = (o) => {
+    console.info("[ApplicationAuth] Using username and password."), i.login(o.username, o.password), s(
       1
       /* AUTHENTICATED */
     );
   };
-  return Te(() => {
+  return Re(() => {
     i.isOidcAuthEnabled() ? i.login("", "").then(() => {
       console.info("[ApplicationAuth] Authentication successful."), s(
         1
         /* AUTHENTICATED */
       );
-    }).catch((n) => {
-      console.error("[ApplicationAuth] Authentication failed: ", n), s(
+    }).catch((o) => {
+      console.error("[ApplicationAuth] Authentication failed: ", o), s(
         2
         /* AUTHENTICATION_FAILED */
       );
@@ -2471,345 +2790,324 @@ const qs = async (e, t) => {
       1
       /* AUTHENTICATED */
     );
-  }, []), /* @__PURE__ */ f(ae, { children: [
-    /* @__PURE__ */ a(A, { condition: t === 0 && i.isOidcAuthEnabled(), children: /* @__PURE__ */ f(te, { children: [
-      /* @__PURE__ */ a(se, { titleText: "Loading", headingLevel: "h4" }),
-      /* @__PURE__ */ a(ue, { children: /* @__PURE__ */ a(X, { size: "xl", "aria-label": "Loading spinner" }) })
+  }, []), /* @__PURE__ */ m(ue, { children: [
+    /* @__PURE__ */ a(O, { condition: t === 0 && i.isOidcAuthEnabled(), children: /* @__PURE__ */ m(re, { children: [
+      /* @__PURE__ */ a(ne, { titleText: "Loading", headingLevel: "h4" }),
+      /* @__PURE__ */ a(ve, { children: /* @__PURE__ */ a(ee, { size: "xl", "aria-label": "Loading spinner" }) })
     ] }) }),
-    /* @__PURE__ */ a(A, { condition: t === 0 && i.isBasicAuthEnabled(), children: /* @__PURE__ */ a(Ds, { onLogin: r }) }),
-    /* @__PURE__ */ a(A, { condition: t === 2, children: /* @__PURE__ */ f(te, { children: [
-      /* @__PURE__ */ a(se, { titleText: "Empty state", headingLevel: "h4", icon: /* @__PURE__ */ a(Be, { icon: Ht }) }),
-      /* @__PURE__ */ a(ue, { children: "Authentication failed." })
+    /* @__PURE__ */ a(O, { condition: t === 0 && i.isBasicAuthEnabled(), children: /* @__PURE__ */ a(Gs, { onLogin: r }) }),
+    /* @__PURE__ */ a(O, { condition: t === 2, children: /* @__PURE__ */ m(re, { children: [
+      /* @__PURE__ */ a(ne, { titleText: "Empty state", headingLevel: "h4", icon: /* @__PURE__ */ a(Qe, { icon: Wt }) }),
+      /* @__PURE__ */ a(ve, { children: "Authentication failed." })
     ] }) }),
-    /* @__PURE__ */ a(A, { condition: t === 1, children: e.children })
+    /* @__PURE__ */ a(O, { condition: t === 1, children: e.children })
   ] });
-}, oi = (e) => {
-  const t = at();
+}, fi = (e) => {
+  const t = ut();
   return (() => {
     let i = !0;
     return e.enabled !== void 0 && (i = i && (t.isOidcAuthEnabled() === e.enabled || t.isBasicAuthEnabled() === e.enabled)), i;
-  })() ? /* @__PURE__ */ a(j.Fragment, { children: e.children }) : /* @__PURE__ */ a(j.Fragment, {});
-}, ai = (e) => {
-  const [t, s] = I(), [i, r] = I();
-  return Te(() => {
-    e.isOpen && (typeof e.frontendInfo == "function" ? e.frontendInfo().then(s) : s(e.frontendInfo), typeof e.backendInfo == "function" ? e.backendInfo().then(r) : r(e.backendInfo));
-  }, [e.isOpen]), /* @__PURE__ */ a(
-    bt,
-    {
-      className: "app-about-modal",
-      isOpen: e.isOpen,
-      onClose: e.onClose,
-      trademark: "© 2024 Red Hat",
-      brandImageSrc: e.brandImageSrc,
-      brandImageAlt: e.brandImageAlt,
-      "aria-label": e.brandImageAlt,
-      children: /* @__PURE__ */ f(yt, { className: "app-about-modal-content", style: { marginTop: "-25px" }, children: [
-        /* @__PURE__ */ a(He, { component: Le.h2, children: "Web console info" }),
-        /* @__PURE__ */ a(oe, { isLoading: t === void 0, children: /* @__PURE__ */ f(Me, { component: "dl", children: [
-          /* @__PURE__ */ a(y, { component: "dt", children: "Project" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: /* @__PURE__ */ a("a", { href: t == null ? void 0 : t.url, target: "_blank", children: t == null ? void 0 : t.name }) }),
-          /* @__PURE__ */ a(y, { component: "dt", children: "Version" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: t == null ? void 0 : t.version }),
-          /* @__PURE__ */ a(y, { component: "dt", children: "Built on" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: /* @__PURE__ */ a(ye, { date: t == null ? void 0 : t.builtOn, format: "locale" }) }),
-          /* @__PURE__ */ a(y, { component: "dt", children: "Digest" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: t == null ? void 0 : t.digest })
-        ] }) }),
-        /* @__PURE__ */ a(He, { style: { marginTop: "40px" }, component: Le.h2, children: e.backendLabel }),
-        /* @__PURE__ */ a(oe, { isLoading: i === void 0, children: /* @__PURE__ */ f(Me, { component: "dl", children: [
-          /* @__PURE__ */ a(y, { component: "dt", children: "Name" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: (i == null ? void 0 : i.name) || "" }),
-          /* @__PURE__ */ a(y, { component: "dt", children: "Description" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: (i == null ? void 0 : i.description) || "" }),
-          /* @__PURE__ */ a(y, { component: "dt", children: "Version" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: (i == null ? void 0 : i.version) || "" }),
-          /* @__PURE__ */ a(y, { component: "dt", children: "Built on" }),
-          /* @__PURE__ */ a(y, { component: "dd", children: /* @__PURE__ */ a(ye, { date: i == null ? void 0 : i.builtOn, format: "locale" }) })
-        ] }) })
-      ] })
-    }
-  );
-}, ci = (e) => /* @__PURE__ */ f(
-  Re,
-  {
-    title: "Please Wait",
-    variant: "small",
-    isOpen: e.isOpen,
-    header: /* @__PURE__ */ a("a", { href: "#" }),
-    showClose: !1,
-    className: "please-wait pf-m-redhat-font",
-    "aria-label": "please-wait-modal",
-    style: { marginTop: "-15px" },
-    children: [
-      /* @__PURE__ */ a(X, { size: "md", className: "spinner" }),
-      /* @__PURE__ */ a("span", { className: "message", style: { fontSize: "15px", color: "#333", marginLeft: "10px" }, children: e.message })
-    ]
-  }
-), li = (e) => /* @__PURE__ */ a(
-  Re,
-  {
-    title: e.title,
-    variant: "small",
-    isOpen: e.isOpen,
-    showClose: e.isCloseable,
-    onClose: e.onClose,
-    className: "progress pf-m-redhat-font",
-    "aria-label": "progress-modal",
-    children: /* @__PURE__ */ a(kt, { title: e.message, value: e.progress })
-  }
-);
-function di() {
-  return /* @__PURE__ */ a(te, { children: /* @__PURE__ */ a(
-    se,
+  })() ? /* @__PURE__ */ a(H.Fragment, { children: e.children }) : /* @__PURE__ */ a(H.Fragment, {});
+}, mi = (e) => /* @__PURE__ */ a(Pt, { categoryName: e.categoryName || "Filters", isClosable: !0, onClick: e.onClearAllCriteria, children: e.criteria.map((t, s) => /* @__PURE__ */ m(Rt, { onClick: () => e.onRemoveCriteria(t), children: [
+  /* @__PURE__ */ a("b", { children: t.filterBy.label }),
+  /* @__PURE__ */ a("span", { children: ": " }),
+  /* @__PURE__ */ a("span", { children: t.filterValue })
+] }, s)) }), wi = (e) => {
+  const [t, s] = y(e.filterTypes[0]), [i, r] = y(""), o = (n) => {
+    n && n.preventDefault(), e.onAddCriteria({
+      filterBy: t,
+      filterValue: i
+    }), r("");
+  };
+  return /* @__PURE__ */ a(Ge, { onSubmit: o, children: /* @__PURE__ */ m(Xe, { children: [
+    /* @__PURE__ */ a(
+      zs,
+      {
+        value: t,
+        items: e.filterTypes,
+        testId: "chip-filter-select",
+        toggleClassname: "chip-filter-toggle",
+        onSelect: s,
+        itemToTestId: (n) => n.testId,
+        itemToString: (n) => n.label
+      }
+    ),
+    /* @__PURE__ */ a(
+      oe,
+      {
+        name: "filterValue",
+        id: "filterValue",
+        type: "search",
+        value: i,
+        onChange: (n, c) => r(c),
+        "data-testid": "chip-filter-value",
+        "aria-label": "search input"
+      }
+    ),
+    /* @__PURE__ */ a(
+      ae,
+      {
+        variant: Ut.control,
+        onClick: o,
+        "data-testid": "chip-filter-search",
+        "aria-label": "search button for search input",
+        children: /* @__PURE__ */ a(Jt, {})
+      }
+    )
+  ] }) });
+};
+function vi() {
+  return /* @__PURE__ */ a(re, { children: /* @__PURE__ */ a(
+    ne,
     {
       titleText: "Loading",
       headingLevel: "h4",
-      icon: /* @__PURE__ */ a(Be, { icon: X })
+      icon: /* @__PURE__ */ a(Qe, { icon: ee })
     }
   ) });
 }
-function hi({
+function Si({
   itemCount: e,
   page: t,
   perPage: s,
   isCompact: i = !1,
   onChange: r,
-  variant: n = It.top
+  variant: o = At.top
 }) {
   return /* @__PURE__ */ a(
-    Tt,
+    xt,
     {
       itemCount: e,
       page: t,
       perPage: s,
-      onSetPage: (c, o) => r(o, s),
-      onPerPageSelect: (c, o) => r(1, o),
-      variant: n,
+      onSetPage: (n, c) => r(c, s),
+      onPerPageSelect: (n, c) => r(1, c),
+      variant: o,
       isCompact: i
     }
   );
 }
-function $s({ columns: e, rows: t, getTd: s = () => xe }) {
-  const i = new Array(e).fill(0).map((n, c) => {
-    const o = s(c);
-    return /* @__PURE__ */ a(o, { children: /* @__PURE__ */ a(
-      Et,
+function Qs({ columns: e, rows: t, getTd: s = () => Ne }) {
+  const i = new Array(e).fill(0).map((o, n) => {
+    const c = s(n);
+    return /* @__PURE__ */ a(c, { children: /* @__PURE__ */ a(
+      Ot,
       {
-        screenreaderText: c === 0 ? "Loading data" : void 0
+        screenreaderText: n === 0 ? "Loading data" : void 0
       }
-    ) }, `cell_${c}`);
-  }), r = new Array(t).fill(0).map((n, c) => /* @__PURE__ */ a(ie, { children: i }, `row_${c}`));
-  return /* @__PURE__ */ a(ae, { children: r });
+    ) }, `cell_${n}`);
+  }), r = new Array(t).fill(0).map((o, n) => /* @__PURE__ */ a(ce, { children: i }, `row_${n}`));
+  return /* @__PURE__ */ a(ue, { children: r });
 }
-const gi = ({
+const yi = ({
   ariaLabel: e,
   minimumColumnWidth: t = 250,
   columns: s,
   data: i,
   renderHeader: r,
-  renderCell: n,
-  renderActions: c,
-  isColumnSortable: o,
+  renderCell: o,
+  renderActions: n,
+  isColumnSortable: c,
   isRowDeleted: l,
   isRowSelected: d,
   expectedLength: h = 3,
   onRowClick: g,
-  setActionCellOuiaId: v,
-  setRowOuiaId: b,
-  tableOuiaId: R,
-  children: k,
-  variant: x
+  setActionCellOuiaId: _,
+  setRowOuiaId: S,
+  tableOuiaId: x,
+  children: T,
+  variant: A
 }) => {
-  const [E, H] = I(1e3);
-  let T;
-  const w = ({ width: p }) => {
-    T && cancelAnimationFrame(T), p && (T = requestAnimationFrame(() => {
-      H(p);
+  const [I, N] = y(1e3);
+  let P;
+  const L = ({ width: f }) => {
+    P && cancelAnimationFrame(P), f && (P = requestAnimationFrame(() => {
+      N(f);
     }));
-  }, { ref: U } = Wt({ onResize: w }), C = E >= 576, S = Ne(
-    (p) => C && p !== 0 && p !== s.length - 1,
-    [s, C]
-  ), L = qe(() => s.map((p, m) => {
-    const P = ee(
-      ({ children: D, ...$ }, le) => /* @__PURE__ */ a(
-        lt,
+  }, { ref: R } = Qt({ onResize: L }), w = I >= 576, E = je(
+    (f) => w && f !== 0 && f !== s.length - 1,
+    [s, w]
+  ), U = Fe(() => s.map((f, v) => {
+    const q = ie(
+      ({ children: J, ...K }, Q) => /* @__PURE__ */ a(
+        pt,
         {
-          position: m,
-          tableWidth: E,
+          position: v,
+          tableWidth: I,
           columnWidth: t,
-          canHide: S(m),
-          sort: o ? o(p) : void 0,
-          ...$,
-          ref: le,
-          children: D
+          canHide: E(v),
+          sort: c ? c(f) : void 0,
+          ...K,
+          ref: Q,
+          children: J
         }
       )
     );
-    return P.displayName = "ResponsiveThCurried", r({
-      Th: P,
-      key: `header_${p}`,
-      column: p,
-      colIndex: m
+    return q.displayName = "ResponsiveThCurried", r({
+      Th: q,
+      key: `header_${f}`,
+      column: f,
+      colIndex: v
     });
   }), [
-    S,
+    E,
     s,
-    o,
+    c,
     t,
     r,
-    E
-  ]), B = Ne(
-    (p) => {
-      const m = ee(
-        ({ children: P, ...D }, $) => /* @__PURE__ */ a(
-          ke,
+    I
+  ]), b = je(
+    (f) => {
+      const v = ie(
+        ({ children: q, ...J }, K) => /* @__PURE__ */ a(
+          Pe,
           {
-            position: p,
-            tableWidth: E,
+            position: f,
+            tableWidth: I,
             columnWidth: t,
-            canHide: S(p),
-            ...D,
-            ref: $,
-            children: P
+            canHide: E(f),
+            ...J,
+            ref: K,
+            children: q
           }
         )
       );
-      return m.displayName = "ResponsiveTdCurried", m;
+      return v.displayName = "ResponsiveTdCurried", v;
     },
-    [S, t, E]
-  ), Y = qe(
-    () => s.map((p, m) => B(m)),
-    [s, B]
+    [E, t, I]
+  ), z = Fe(
+    () => s.map((f, v) => b(v)),
+    [s, b]
   );
-  return /* @__PURE__ */ f(
-    Mt,
+  return /* @__PURE__ */ m(
+    Bt,
     {
       "aria-label": e,
       gridBreakPoint: "",
-      ref: U,
-      className: C ? "" : "pf-m-grid",
-      ouiaId: R,
-      variant: x,
+      ref: R,
+      className: w ? "" : "pf-m-grid",
+      ouiaId: x,
+      variant: A,
       children: [
-        /* @__PURE__ */ a(Ft, { children: /* @__PURE__ */ a(ie, { children: L }) }),
-        /* @__PURE__ */ f(Dt, { children: [
+        /* @__PURE__ */ a(zt, { children: /* @__PURE__ */ a(ce, { children: U }) }),
+        /* @__PURE__ */ m(Vt, { children: [
           i === void 0 && /* @__PURE__ */ a(
-            $s,
+            Qs,
             {
               columns: s.length,
               rows: h,
-              getTd: B
+              getTd: b
             }
           ),
-          i == null ? void 0 : i.map((p, m) => {
-            const P = l !== void 0 && l({ row: p, rowIndex: m }), D = d !== void 0 && d({ row: p, rowIndex: m }), $ = !P && g ? () => g({ row: p, rowIndex: m }) : void 0, le = s.map((Pe, Oe) => n({
-              Td: Y[Oe],
-              key: `row_${m}_cell_${Pe}`,
-              column: Pe,
-              colIndex: Oe,
-              rowIndex: m,
-              row: p
-            })), ht = !P && c && /* @__PURE__ */ a(
-              ke,
+          i == null ? void 0 : i.map((f, v) => {
+            const q = l !== void 0 && l({ row: f, rowIndex: v }), J = d !== void 0 && d({ row: f, rowIndex: v }), K = !q && g ? () => g({ row: f, rowIndex: v }) : void 0, Q = s.map((X, te) => o({
+              Td: z[te],
+              key: `row_${v}_cell_${X}`,
+              column: X,
+              colIndex: te,
+              rowIndex: v,
+              row: f
+            })), pe = !q && n && /* @__PURE__ */ a(
+              Pe,
               {
                 position: s.length,
-                tableWidth: E,
+                tableWidth: I,
                 columnWidth: t,
                 canHide: !1,
                 isActionCell: !0,
-                "data-testid": v ? v({ row: p, rowIndex: m }) : `actions-for-row-${m}`,
-                children: c({ rowIndex: m, row: p, ActionsColumn: $t })
+                "data-testid": _ ? _({ row: f, rowIndex: v }) : `actions-for-row-${v}`,
+                children: n({ rowIndex: v, row: f, ActionsColumn: Gt })
               }
             );
-            return /* @__PURE__ */ f(
-              dt,
+            return /* @__PURE__ */ m(
+              ft,
               {
-                isDeleted: P,
-                isSelected: D,
-                onClick: $,
-                rowOuiaId: b == null ? void 0 : b({ row: p, rowIndex: m }),
+                isDeleted: q,
+                isSelected: J,
+                onClick: K,
+                rowOuiaId: S == null ? void 0 : S({ row: f, rowIndex: v }),
                 children: [
-                  le,
-                  ht
+                  Q,
+                  pe
                 ]
               },
-              `row_${m}`
+              `row_${v}`
             );
           }),
-          (i == null ? void 0 : i.length) === 0 && /* @__PURE__ */ a(ie, { children: /* @__PURE__ */ a(xe, { colSpan: s.length, children: k }) })
+          (i == null ? void 0 : i.length) === 0 && /* @__PURE__ */ a(ce, { children: /* @__PURE__ */ a(Ne, { colSpan: s.length, children: T }) })
         ] })
       ]
     }
   );
-}, lt = Ie(
-  ee((e, t) => {
+}, pt = Ue(
+  ie((e, t) => {
     const {
       tableWidth: s,
       columnWidth: i,
       position: r,
-      canHide: n,
-      className: c = "",
-      children: o,
+      canHide: o,
+      className: n = "",
+      children: c,
       ...l
-    } = e, d = n && s < i * (r + 1) ? "pf-m-hidden" : "pf-m-visible";
+    } = e, d = o && s < i * (r + 1) ? "pf-m-hidden" : "pf-m-visible";
     return /* @__PURE__ */ a(
-      Lt,
+      Kt,
       {
         ref: t,
-        className: `${d} ${c}`,
+        className: `${d} ${n}`,
         ...l,
-        children: o
+        children: c
       }
     );
   })
 );
-lt.displayName = "ResponsiveTh";
-const ke = Ie(
-  ee((e, t) => {
+pt.displayName = "ResponsiveTh";
+const Pe = Ue(
+  ie((e, t) => {
     const {
       tableWidth: s,
       columnWidth: i,
       position: r,
-      canHide: n,
-      className: c = "",
-      children: o,
+      canHide: o,
+      className: n = "",
+      children: c,
       ...l
-    } = e, d = n && s < i * (r + 1) ? "pf-m-hidden" : "pf-m-visible";
+    } = e, d = o && s < i * (r + 1) ? "pf-m-hidden" : "pf-m-visible";
     return /* @__PURE__ */ a(
-      xe,
+      Ne,
       {
         ref: t,
-        className: `${d} ${c}`,
+        className: `${d} ${n}`,
         ...l,
-        children: o
+        children: c
       }
     );
   })
 );
-ke.displayName = "ResponsiveTd";
-const dt = Ie(
+Pe.displayName = "ResponsiveTd";
+const ft = Ue(
   ({ isDeleted: e, isSelected: t, onClick: s, children: i, rowOuiaId: r }) => /* @__PURE__ */ a(
-    ie,
+    ce,
     {
-      onRowClick: (n) => {
-        (n == null ? void 0 : n.target) instanceof HTMLElement && (["a", "button"].includes(n.target.tagName.toLowerCase()) || s && s());
+      onRowClick: (o) => {
+        (o == null ? void 0 : o.target) instanceof HTMLElement && (["a", "button"].includes(o.target.tagName.toLowerCase()) || s && s());
       },
       ouiaId: r,
       isRowSelected: t,
       className: e ? "mas--ResponsiveTable__Tr--deleted" : void 0,
-      "data-testid": [t && "row-selected", e && "row-deleted"].filter((n) => !!n).join(" "),
+      "data-testid": [t && "row-selected", e && "row-deleted"].filter((o) => !!o).join(" "),
       role: "row",
       children: i
     }
   )
 );
-dt.displayName = "DeletableRow";
-const Ws = ({ label: e, onSearch: t }) => {
-  const s = (i, r, n) => {
+ft.displayName = "DeletableRow";
+const Xs = ({ label: e, onSearch: t }) => {
+  const s = (i, r, o) => {
     t(r);
   };
   return /* @__PURE__ */ a(
-    Ct,
+    Nt,
     {
       placeholder: `Filter by ${e}`,
       onSearch: s
@@ -2822,52 +3120,52 @@ function ze({
   onChange: s,
   ouiaId: i
 }) {
-  const [r, n] = I(!1);
+  const [r, o] = y(!1);
   return /* @__PURE__ */ a(
-    Ee,
+    xe,
     {
-      toggle: (o) => /* @__PURE__ */ a(
-        ce,
+      toggle: (c) => /* @__PURE__ */ a(
+        _e,
         {
-          ref: o,
-          onClick: () => n((l) => !l),
+          ref: c,
+          onClick: () => o((l) => !l),
           isExpanded: r,
           variant: "plain",
-          children: /* @__PURE__ */ a(Ve, {})
+          children: /* @__PURE__ */ a(Ye, {})
         }
       ),
       "aria-label": "table:select_filter",
       selected: t,
       isOpen: r,
-      onSelect: (o, l) => {
-        s(l), n(!1);
+      onSelect: (c, l) => {
+        s(l), o(!1);
       },
       ouiaId: i,
-      children: /* @__PURE__ */ a(Rt, { children: e.map((o, l) => /* @__PURE__ */ a(Ce, { value: o, children: o }, l)) })
+      children: /* @__PURE__ */ a(qt, { children: e.map((c, l) => /* @__PURE__ */ a(Ae, { value: c, children: c }, l)) })
     }
   );
 }
-function Ks({
+function Ys({
   label: e,
   chips: t,
   options: s,
   onToggle: i
 }) {
-  const [r, n] = I(!1);
+  const [r, o] = y(!1);
   return /* @__PURE__ */ a(
-    Ee,
+    xe,
     {
       "aria-label": e,
-      onSelect: (c, o) => {
-        i(o);
+      onSelect: (n, c) => {
+        i(c);
       },
       selected: t,
       isOpen: r,
-      toggle: (c) => /* @__PURE__ */ a(
-        ce,
+      toggle: (n) => /* @__PURE__ */ a(
+        _e,
         {
-          ref: c,
-          onClick: () => n((o) => !o),
+          ref: n,
+          onClick: () => o((c) => !c),
           isExpanded: r,
           style: {
             width: "200px"
@@ -2875,43 +3173,43 @@ function Ks({
           children: `Filter by ${e}`
         }
       ),
-      children: Object.entries(s).map(([c, o]) => /* @__PURE__ */ a(Ce, { value: c, hasCheckbox: !0, children: o }, c))
+      children: Object.entries(s).map(([n, c]) => /* @__PURE__ */ a(Ae, { value: n, hasCheckbox: !0, children: c }, n))
     }
   );
 }
-function ui({ filters: e, breakpoint: t = "md" }) {
-  const s = Object.keys(e), [i, r] = I(s[0]), n = (c, o) => {
-    switch (o.type) {
+function bi({ filters: e, breakpoint: t = "md" }) {
+  const s = Object.keys(e), [i, r] = y(s[0]), o = (n, c) => {
+    switch (c.type) {
       case "search":
         return /* @__PURE__ */ a(
-          Ws,
+          Xs,
           {
-            onSearch: o.onSearch,
-            label: c,
-            validate: o.validate,
-            errorMessage: o.errorMessage
+            onSearch: c.onSearch,
+            label: n,
+            validate: c.validate,
+            errorMessage: c.errorMessage
           }
         );
       case "checkbox":
         return /* @__PURE__ */ a(
-          Ks,
+          Ys,
           {
-            chips: o.chips,
-            options: o.options,
-            onToggle: o.onToggle,
-            label: c
+            chips: c.chips,
+            options: c.options,
+            onToggle: c.onToggle,
+            label: n
           }
         );
     }
   };
-  return /* @__PURE__ */ f(ae, { children: [
+  return /* @__PURE__ */ m(ue, { children: [
     /* @__PURE__ */ a(
-      xt,
+      Dt,
       {
         variant: "search-filter",
         visibility: { default: "hidden", [t]: "visible" },
         "data-testid": "large-viewport-toolbar",
-        children: /* @__PURE__ */ f(Ut, { children: [
+        children: /* @__PURE__ */ m(Xe, { children: [
           s.length > 1 && /* @__PURE__ */ a(
             ze,
             {
@@ -2921,17 +3219,17 @@ function ui({ filters: e, breakpoint: t = "md" }) {
               ouiaId: "chip-filter-selector-large-viewport"
             }
           ),
-          n(i, e[i])
+          o(i, e[i])
         ] })
       }
     ),
     /* @__PURE__ */ a(
-      At,
+      jt,
       {
-        toggleIcon: /* @__PURE__ */ a(Ve, {}),
+        toggleIcon: /* @__PURE__ */ a(Ye, {}),
         breakpoint: t,
         visibility: { default: "visible", [t]: "hidden" },
-        children: /* @__PURE__ */ f(Pt, { variant: "filter-group", children: [
+        children: /* @__PURE__ */ m(Ft, { variant: "filter-group", children: [
           s.length > 1 && /* @__PURE__ */ a(
             ze,
             {
@@ -2941,15 +3239,15 @@ function ui({ filters: e, breakpoint: t = "md" }) {
               ouiaId: "chip-filter-selector-small-viewport"
             }
           ),
-          Object.entries(e).map(([c, o], l) => /* @__PURE__ */ a(
-            Ot,
+          Object.entries(e).map(([n, c], l) => /* @__PURE__ */ a(
+            $t,
             {
-              chips: o.type === "checkbox" ? o.chips.map((d) => ({ key: d, node: o.options[d] })) : o.chips,
-              deleteChip: (d, h) => o.onRemoveChip(typeof h == "string" ? h : h.key),
-              deleteChipGroup: o.onRemoveGroup,
-              categoryName: c,
-              showToolbarItem: c === i,
-              children: c === i && n(c, o)
+              chips: c.type === "checkbox" ? c.chips.map((d) => ({ key: d, node: c.options[d] })) : c.chips,
+              deleteChip: (d, h) => c.onRemoveChip(typeof h == "string" ? h : h.key),
+              deleteChipGroup: c.onRemoveGroup,
+              categoryName: n,
+              showToolbarItem: n === i,
+              children: n === i && o(n, c)
             },
             l
           ))
@@ -2959,33 +3257,35 @@ function ui({ filters: e, breakpoint: t = "md" }) {
   ] });
 }
 export {
-  ai as AppAboutModal,
-  ni as ApplicationAuth,
-  Kt as AuthConfigContext,
-  Ds as BasicAuthModal,
-  ui as ChipFilter,
-  ye as DateTime,
-  dt as DeletableRow,
-  Ks as FilterCheckbox,
-  Ws as FilterSearch,
+  gi as AppAboutModal,
+  pi as ApplicationAuth,
+  Xt as AuthConfigContext,
+  Gs as BasicAuthModal,
+  bi as ChipFilter,
+  wi as ChipFilterInput,
+  Ce as DateTime,
+  ft as DeletableRow,
+  Ys as FilterCheckbox,
+  mi as FilterChips,
+  Xs as FilterSearch,
   ze as FilterSelector,
-  Ys as FromNow,
-  A as If,
-  oi as IfAuth,
-  Zs as IfNotEmpty,
-  oe as IfNotLoading,
-  ei as ListWithToolbar,
-  di as Loading,
-  ti as ObjectDropdown,
-  si as ObjectSelect,
-  hi as Pagination,
-  ci as PleaseWaitModal,
-  li as ProgressModal,
-  gi as ResponsiveTable,
-  ke as ResponsiveTd,
-  lt as ResponsiveTh,
-  $s as TableSkeleton,
-  ii as ToggleIcon,
-  ri as UrlUpload,
-  at as useAuth
+  oi as FromNow,
+  O as If,
+  fi as IfAuth,
+  ai as IfNotEmpty,
+  ge as IfNotLoading,
+  ci as ListWithToolbar,
+  vi as Loading,
+  li as ObjectDropdown,
+  zs as ObjectSelect,
+  Si as Pagination,
+  ui as PleaseWaitModal,
+  _i as ProgressModal,
+  yi as ResponsiveTable,
+  Pe as ResponsiveTd,
+  pt as ResponsiveTh,
+  Qs as TableSkeleton,
+  di as ToggleIcon,
+  hi as UrlUpload,
+  ut as useAuth
 };