@itwin/ecschema-rpcinterface-tests 5.13.0-dev.9 → 5.14.0-dev.1

package/lib/dist/bundled-tests.js

@@ -18201,31 +18201,6 @@ module.exports = {
 }));
 
 
-/***/ },
-
-/***/ "../../common/temp/node_modules/.pnpm/wms-capabilities@0.4.0/node_modules/wms-capabilities/dist/wms-capabilities.min.js"
-/*!******************************************************************************************************************************!*\
-  !*** ../../common/temp/node_modules/.pnpm/wms-capabilities@0.4.0/node_modules/wms-capabilities/dist/wms-capabilities.min.js ***!
-  \******************************************************************************************************************************/
-(module) {
-
-"use strict";
-(function(f,m){ true?module.exports=m():0})(this,function(){function f(a){return void 0!==a}function m(a,c,b){if(a.nodeType===u.CDATA_SECTION||a.nodeType===u.TEXT)c?b.push(String(a.nodeValue).replace(/(\r\n|\r|\n)/g,"")):b.push(a.nodeValue);else for(a=a.firstChild;a;a=a.nextSibling)m(a,c,b);return b}function F(a){for(a=a.nextElementSibling||a.nextSibling;a&&
-a.nodeType!==u.ELEMENT;)a=a.nextSibling;return a}function h(a,c,b){b=f(b)?b:{};var d;var n=0;for(d=a.length;n<d;++n)b[a[n]]=c;return b}function A(a,c){return function(b,d){b=a.call(f(c)?c:this,b,d);f(b)&&d[d.length-1].push(b)}}function l(a,c,b,d,e){d.push(a);for(a=b.firstElementChild||b.firstChild;a&&a.nodeType!==u.ELEMENT;)a=a.nextSibling;for(;a;a=F(a))b=c[a.namespaceURI||null],f(b)&&(b=b[a.localName],f(b)&&b.call(e,a,d));return d.pop()}function b(a,c,b){return function(d,e){var n=a.call(f(b)?b:
-this,d,e);f(n)&&(e=e[e.length-1],d=f(c)?c:d.localName,e[d]=n)}}function k(a,c,b){return function(d,e){var n=a.call(f(b)?b:this,d,e);if(f(n)){e=e[e.length-1];d=f(c)?c:d.localName;var g=[];(d in e?e[d]:e[d]=g).push(n)}}}function r(a){if(a=/^\s*(true|1)|(false|0)\s*$/.exec(a))return f(a[1])||!1}function t(a){return p(m(a,!1,[]).join(""))}function p(a){if(a=/^\s*([+\-]?\d*\.?\d+(?:e[+\-]?\d+)?)\s*$/i.exec(a))return parseFloat(a[1])}function w(a){return v(m(a,!1,[]).join(""))}function v(a){if(a=/^\s*(\d+)\s*$/.exec(a))return parseInt(a[1],
-10)}function e(a){return m(a,!1,[]).join("").replace(G,"")}function x(a){return a.getAttributeNS("http://www.w3.org/1999/xlink","href")}function B(a){return[p(a.getAttribute("minx")),p(a.getAttribute("miny")),p(a.getAttribute("maxx")),p(a.getAttribute("maxy"))]}function q(a,c){return l({},H,a,c)}function y(a,c){return l({},I,a,c)}function C(a,c){c=q(a,c);if(f(c))return a=[v(a.getAttribute("width")),v(a.getAttribute("height"))],c.size=a,c}function D(a,c){return l([],J,a,c)}var u={ELEMENT:1,ATTRIBUTE:2,
-TEXT:3,CDATA_SECTION:4,ENTITY_REFERENCE:5,ENTITY:6,PROCESSING_INSTRUCTION:7,COMMENT:8,DOCUMENT:9,DOCUMENT_TYPE:10,DOCUMENT_FRAGMENT:11,NOTATION:12},z=function(a){this._parser=new a};z.prototype.toDocument=function(a){return this._parser.parseFromString(a,"application/xml")};z.prototype.getAllTextContent=function(a,c){return m(a,c,[]).join("").join("")};var G=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,g=[null,"http://www.opengis.net/wms"],M=h(g,{Service:b(function(a,c){return l({},K,a,c)}),Capability:b(function(a,
-c){return l({},L,a,c)})}),L=h(g,{Request:b(function(a,c){return l({},N,a,c)}),Exception:b(function(a,c){return l([],O,a,c)}),Layer:b(function(a,c){var b=r(a.getAttribute("queryable"));return l({queryable:f(b)?b:!1},E,a,c)})}),K=h(g,{Name:b(e),Title:b(e),Abstract:b(e),KeywordList:b(D),OnlineResource:b(x),ContactInformation:b(function(a,c){return l({},P,a,c)}),Fees:b(e),AccessConstraints:b(e),LayerLimit:b(w),MaxWidth:b(w),MaxHeight:b(w)}),P=h(g,{ContactPersonPrimary:b(function(a,c){return l({},Q,a,
-c)}),ContactPosition:b(e),ContactAddress:b(function(a,c){return l({},R,a,c)}),ContactVoiceTelephone:b(e),ContactFacsimileTelephone:b(e),ContactElectronicMailAddress:b(e)}),Q=h(g,{ContactPerson:b(e),ContactOrganization:b(e)}),R=h(g,{AddressType:b(e),Address:b(e),City:b(e),StateOrProvince:b(e),PostCode:b(e),Country:b(e)}),O=h(g,{Format:A(e)}),E=h(g,{Name:b(e),Title:b(e),Abstract:b(e),KeywordList:b(D),CRS:k(e),SRS:k(e),EX_GeographicBoundingBox:b(function(a,c){var b=l({},S,a,c);if(f(b)){a=b.westBoundLongitude;
-c=b.southBoundLatitude;var d=b.eastBoundLongitude;b=b.northBoundLatitude;if(f(a)&&f(c)&&f(d)&&f(b))return[a,c,d,b]}}),LatLonBoundingBox:b(function(a,b){a=B(a);if(f(a[0])&&f(a[1])&&f(a[2])&&f(a[3]))return a}),BoundingBox:k(function(a,b){b=B(a);var c=[p(a.getAttribute("resx")),p(a.getAttribute("resy"))];return{crs:a.getAttribute("CRS")||a.getAttribute("SRS"),extent:b,res:c}}),Dimension:k(function(a,b){return{name:a.getAttribute("name"),units:a.getAttribute("units"),unitSymbol:a.getAttribute("unitSymbol"),
-"default":a.getAttribute("default"),multipleValues:r(a.getAttribute("multipleValues")),nearestValue:r(a.getAttribute("nearestValue")),current:r(a.getAttribute("current")),values:e(a)}}),Attribution:b(function(a,b){return l({},T,a,b)}),AuthorityURL:k(function(a,b){b=q(a,b);if(f(b))return b.name=a.getAttribute("name"),b}),Identifier:k(e),MetadataURL:k(function(a,b){b=q(a,b);if(f(b))return b.type=a.getAttribute("type"),b}),DataURL:k(q),FeatureListURL:k(q),Style:k(function(a,b){return l({},U,a,b)}),MinScaleDenominator:b(t),
-MaxScaleDenominator:b(t),ScaleHint:b(function(a,b){b=parseFloat(a.getAttribute("min"));a=parseFloat(a.getAttribute("max"));return{min:b,max:a}}),Layer:k(function(a,b){var c=b[b.length-1];b=l({},E,a,b);if(f(b)){var d=r(a.getAttribute("queryable"));f(d)||(d=c.queryable);b.queryable=f(d)?d:!1;d=v(a.getAttribute("cascaded"));f(d)||(d=c.cascaded);b.cascaded=d;d=r(a.getAttribute("opaque"));f(d)||(d=c.opaque);b.opaque=f(d)?d:!1;d=r(a.getAttribute("noSubsets"));f(d)||(d=c.noSubsets);b.noSubsets=f(d)?d:!1;
-d=p(a.getAttribute("fixedWidth"));f(d)||(d=c.fixedWidth);b.fixedWidth=d;a=p(a.getAttribute("fixedHeight"));f(a)||(a=c.fixedHeight);b.fixedHeight=a;a=["Style","CRS","AuthorityURL"];d=0;for(var e=a.length;d<e;d++){var g=a[d],h=c[g];if(f(h)){var k=[];k=g in b?b[g]:b[g]=k;k=k.concat(h);b[g]=k}}a="EX_GeographicBoundingBox BoundingBox Dimension Attribution MinScaleDenominator MaxScaleDenominator".split(" ");d=0;for(e=a.length;d<e;d++)g=a[d],f(b[g])||(b[g]=c[g]);return b}})}),T=h(g,{Title:b(e),OnlineResource:b(x),
-LogoURL:b(C)}),S=h(g,{westBoundLongitude:b(t),eastBoundLongitude:b(t),southBoundLatitude:b(t),northBoundLatitude:b(t)}),N=h(g,{GetCapabilities:b(y),GetMap:b(y),GetFeatureInfo:b(y)}),I=h(g,{Format:k(e),DCPType:k(function(a,b){return l({},V,a,b)})}),V=h(g,{HTTP:b(function(a,b){return l({},W,a,b)})}),W=h(g,{Get:b(q),Post:b(q)}),U=h(g,{Name:b(e),Title:b(e),Abstract:b(e),LegendURL:k(C),StyleSheetURL:b(q),StyleURL:b(q)}),H=h(g,{Format:b(e),OnlineResource:b(x)}),J=h(g,{Keyword:A(e)});g=function(a,b){b||
-"undefined"===typeof window||(b=window.DOMParser);this.version=void 0;this._parser=new z(b);this._data=a};g.prototype.data=function(a){this._data=a;return this};g.prototype.toJSON=function(a){a=a||this._data;return this.parse(a)};g.prototype.parse=function(a){return this._readFromDocument(this._parser.toDocument(a))};g.prototype._readFromDocument=function(a){for(a=a.firstChild;a;a=a.nextSibling)if(a.nodeType==u.ELEMENT)return this.readFromNode(a);return null};g.prototype.readFromNode=function(a){this.version=
-a.getAttribute("version");return l({version:this.version},M,a,[])||null};return g});
-
-
 /***/ },
 
 /***/ "../../core/bentley/lib/esm/AccessToken.js"
@@ -26290,6 +26265,12 @@ var BriefcaseIdValue;
     BriefcaseIdValue[BriefcaseIdValue["FirstValid"] = 2] = "FirstValid";
     /** All valid iModelHub issued BriefcaseIds will be equal or lower than this */
     BriefcaseIdValue[BriefcaseIdValue["LastValid"] = 16777205] = "LastValid";
+    /**
+     * Briefcase Id reserved for `Element` Ids allocated by SchemaSync reservations.
+     * Never assigned to a real briefcase by iModelHub.
+     * @internal
+     */
+    BriefcaseIdValue[BriefcaseIdValue["SchemaSyncElementReserved"] = 16777206] = "SchemaSyncElementReserved";
     /**
      * The briefcase has not been assigned a unique Id by iModelHub. Only briefcases that have been assigned a unique BriefcaseId may create changesets,
      * because BriefcaseId is used to create unique ElementIds for new elements.
@@ -26902,7 +26883,7 @@ class Code {
     equals(other) { return Code.equalCodes(this, other); }
     /** @internal */
     static equalCodes(c1, c2) {
-        return c1.spec === c2.spec && c1.scope === c2.scope && c1.value === c2.value;
+        return c1.spec === c2.spec && c1.scope === c2.scope && (c1.value ?? "").toLowerCase() === (c2.value ?? "").toLowerCase();
     }
     /** Determine whether this Code is valid. */
     static isValid(c) { return _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Id64.isValidId64(c.spec); }
@@ -28324,15 +28305,28 @@ class QueryBinder {
      * @param indexOrName Specify parameter index or its name used in ECSQL statement.
      * @param val @type OrderedId64Iterable value to bind to ECSQL statement.
      * @returns @type QueryBinder to allow fluent interface.
+     * @throws an [[ITwinError]] with scope `"itwin-QueryBinder"` and key `"invalid-arguments"` if any entry is not a valid [Id64String]($bentley).
      */
     bindIdSet(indexOrName, val) {
         this.verify(indexOrName);
         const name = String(indexOrName);
-        _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.OrderedId64Iterable.uniqueIterator(val);
+        const ids = [];
+        // `string` is an Iterable<string>. In that case assume caller passed a single Id64String, matching CompressedId64Set.sortAndCompress.
+        const iterable = typeof val === "string" ? [val] : val;
+        for (const id of iterable) {
+            if (!_itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Id64.isValidId64(id)) {
+                _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.ITwinError.throwError({
+                    message: `QueryBinder.bindIdSet: entry ${JSON.stringify(id)} for parameter "${name}" is not a valid Id64String`,
+                    iTwinErrorId: { scope: "itwin-QueryBinder", key: "invalid-arguments" },
+                });
+            }
+            ids.push(id);
+        }
+        _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.OrderedId64Iterable.sortArray(ids);
         Object.defineProperty(this._args, name, {
             enumerable: true, value: {
                 type: QueryParamType.IdSet,
-                value: _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.CompressedId64Set.sortAndCompress(_itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.OrderedId64Iterable.uniqueIterator(val)),
+                value: _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.CompressedId64Set.compressArray(ids),
             },
         });
         return this;
@@ -31399,7 +31393,7 @@ var ExternalSourceAttachmentRole;
     /** The attached [ExternalSource]($backend) models a part of the whole. */
     ExternalSourceAttachmentRole[ExternalSourceAttachmentRole["SpecifyPart"] = 1] = "SpecifyPart";
 })(ExternalSourceAttachmentRole || (ExternalSourceAttachmentRole = {}));
-/** The *rank* for a Category
+/** The *rank* for a [Category]($backend), [SubCategory]($backend), or [DefinitionSet]($backend).
  * @public @preview
  * @extensions
  */
@@ -35397,6 +35391,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   CloudSqliteError: () => (/* binding */ CloudSqliteError),
 /* harmony export */   EditTxnError: () => (/* binding */ EditTxnError),
 /* harmony export */   ElementError: () => (/* binding */ ElementError),
+/* harmony export */   ElementReservationError: () => (/* binding */ ElementReservationError),
 /* harmony export */   ITwinSettingsError: () => (/* binding */ ITwinSettingsError),
 /* harmony export */   ServerBasedLocksError: () => (/* binding */ ServerBasedLocksError),
 /* harmony export */   SqliteError: () => (/* binding */ SqliteError),
@@ -35558,6 +35553,22 @@ var ElementError;
     }
     ElementError.isError = isError;
 })(ElementError || (ElementError = {}));
+/** @beta */
+var ElementReservationError;
+(function (ElementReservationError) {
+    /** the ITwinError scope for `ElementReservationError`s. */
+    ElementReservationError.scope = "itwin-ElementReservation";
+    /** Instantiate and throw an ElementReservationError */
+    function throwError(key, e) {
+        _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.ITwinError.throwError({ ...e, iTwinErrorId: { scope: ElementReservationError.scope, key } });
+    }
+    ElementReservationError.throwError = throwError;
+    /** Determine whether an error object is an ElementReservationError */
+    function isError(error, key) {
+        return _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.ITwinError.isError(error, ElementReservationError.scope, key);
+    }
+    ElementReservationError.isError = isError;
+})(ElementReservationError || (ElementReservationError = {}));
 
 
 /***/ },
@@ -44856,6 +44867,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   ListMarkerEnumerator: () => (/* binding */ ListMarkerEnumerator),
 /* harmony export */   TextStyleSettings: () => (/* binding */ TextStyleSettings),
+/* harmony export */   targetPointShapes: () => (/* binding */ targetPointShapes),
 /* harmony export */   terminatorShapes: () => (/* binding */ terminatorShapes),
 /* harmony export */   textAnnotationFrameShapes: () => (/* binding */ textAnnotationFrameShapes)
 /* harmony export */ });
@@ -44894,6 +44906,11 @@ const textAnnotationFrameShapes = ["none", "line", "rectangle", "circle", "equil
  * @beta
 */
 const terminatorShapes = ["openArrow", "closedArrow", "closedArrowFilled", "circle", "circleFilled", "slash", "none"];
+/**
+ * Predefined shapes that can be used to indicate the target point of a leader in a [[TextAnnotation]].
+ * @beta
+ */
+const targetPointShapes = ["cross", "plus", "circle", "square", "rectangle"];
 ;
 ;
 function deepFreeze(obj) {
@@ -45013,6 +45030,11 @@ class TextStyleSettings {
             terminatorShape: terminatorShapes[0],
             terminatorHeightFactor: 1.0,
             terminatorWidthFactor: 1.0,
+            showLeaders: true,
+            showTerminators: true,
+            showTargetPoint: false,
+            targetPointShape: targetPointShapes[0],
+            targetPointOffsetFactor: 0,
         },
         tabInterval: 4,
         indentation: 0,
@@ -45063,6 +45085,11 @@ class TextStyleSettings {
             terminatorShape: props.leader?.terminatorShape ?? defaults.leader.terminatorShape,
             terminatorHeightFactor: props.leader?.terminatorHeightFactor ?? defaults.leader.terminatorHeightFactor,
             terminatorWidthFactor: props.leader?.terminatorWidthFactor ?? defaults.leader.terminatorWidthFactor,
+            showLeaders: props.leader?.showLeaders ?? defaults.leader.showLeaders,
+            showTerminators: props.leader?.showTerminators ?? defaults.leader.showTerminators,
+            showTargetPoint: props.leader?.showTargetPoint ?? defaults.leader.showTargetPoint,
+            targetPointShape: props.leader?.targetPointShape ?? defaults.leader.targetPointShape,
+            targetPointOffsetFactor: props.leader?.targetPointOffsetFactor ?? defaults.leader.targetPointOffsetFactor,
         };
         this.leader = Object.freeze(leader);
         this.tabInterval = props.tabInterval ?? defaults.tabInterval;
@@ -45100,9 +45127,17 @@ class TextStyleSettings {
      * @returns true if the two leader styles are equal, false otherwise.
      */
     leaderEquals(other) {
-        return this.leader.color === other.color && this.leader.wantElbow === other.wantElbow
-            && this.leader.elbowLength === other.elbowLength && this.leader.terminatorShape === other.terminatorShape && this.leader.terminatorHeightFactor === other.terminatorHeightFactor
-            && this.leader.terminatorWidthFactor === other.terminatorWidthFactor;
+        return this.leader.color === other.color
+            && this.leader.wantElbow === other.wantElbow
+            && this.leader.elbowLength === other.elbowLength
+            && this.leader.terminatorShape === other.terminatorShape
+            && this.leader.terminatorHeightFactor === other.terminatorHeightFactor
+            && this.leader.terminatorWidthFactor === other.terminatorWidthFactor
+            && this.leader.showLeaders === other.showLeaders
+            && this.leader.showTerminators === other.showTerminators
+            && this.leader.showTargetPoint === other.showTargetPoint
+            && this.leader.targetPointShape === other.targetPointShape
+            && this.leader.targetPointOffsetFactor === other.targetPointOffsetFactor;
     }
     frameEquals(other) {
         return this.frame?.shape === other.shape
@@ -45256,6 +45291,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   ElementGeometry: () => (/* reexport safe */ _geometry_ElementGeometry__WEBPACK_IMPORTED_MODULE_49__.ElementGeometry),
 /* harmony export */   ElementGeometryChange: () => (/* reexport safe */ _ModelGeometryChanges__WEBPACK_IMPORTED_MODULE_96__.ElementGeometryChange),
 /* harmony export */   ElementGeometryOpcode: () => (/* reexport safe */ _geometry_ElementGeometry__WEBPACK_IMPORTED_MODULE_49__.ElementGeometryOpcode),
+/* harmony export */   ElementReservationError: () => (/* reexport safe */ _ITwinCoreErrors__WEBPACK_IMPORTED_MODULE_73__.ElementReservationError),
 /* harmony export */   EmptyLocalization: () => (/* reexport safe */ _Localization__WEBPACK_IMPORTED_MODULE_83__.EmptyLocalization),
 /* harmony export */   EntityMetaData: () => (/* reexport safe */ _EntityProps__WEBPACK_IMPORTED_MODULE_34__.EntityMetaData),
 /* harmony export */   EntityReferenceSet: () => (/* reexport safe */ _EntityReference__WEBPACK_IMPORTED_MODULE_35__.EntityReferenceSet),
@@ -45576,6 +45612,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   resolveNavPropId: () => (/* reexport safe */ _ViewProps__WEBPACK_IMPORTED_MODULE_127__.resolveNavPropId),
 /* harmony export */   rpcOverIpcStrings: () => (/* reexport safe */ _ipc_IpcSession__WEBPACK_IMPORTED_MODULE_79__.rpcOverIpcStrings),
 /* harmony export */   serializeIpcError: () => (/* reexport safe */ _ipc_IpcErrors__WEBPACK_IMPORTED_MODULE_75__.serializeIpcError),
+/* harmony export */   targetPointShapes: () => (/* reexport safe */ _annotation_TextStyle__WEBPACK_IMPORTED_MODULE_7__.targetPointShapes),
 /* harmony export */   terminatorShapes: () => (/* reexport safe */ _annotation_TextStyle__WEBPACK_IMPORTED_MODULE_7__.terminatorShapes),
 /* harmony export */   textAnnotationFrameShapes: () => (/* reexport safe */ _annotation_TextStyle__WEBPACK_IMPORTED_MODULE_7__.textAnnotationFrameShapes),
 /* harmony export */   tileFormatFromNumber: () => (/* reexport safe */ _tile_TileIO__WEBPACK_IMPORTED_MODULE_162__.tileFormatFromNumber),
@@ -79303,7 +79340,7 @@ class ECSchemaRpcLocater {
      * @param _matchType How to match key against candidate schemas
      * @param _context The SchemaContext that will control the lifetime of the schema and holds the schema's references, if they exist.
      * @throws Error Always throws an error indicating this method is not supported.
-     * @deprecated in 5.0 - will not be removed until after 2026-08-08. Use the asynchronous `getSchema` method for schema retrieval.
+     * @deprecated in 5.0 - might be removed in next major version. Use the asynchronous `getSchema` method for schema retrieval.
     */
     getSchemaSync(_schemaKey, _matchType, _context) {
         throw new Error("getSchemaSync is not supported. Use the asynchronous getSchema method instead.");
@@ -85414,10 +85451,19 @@ class BriefcaseTxns extends BriefcaseNotificationHandler {
         return _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.ipcAppChannels.txns;
     }
     /** Event raised after Txn validation or changeset application to indicate the set of changed elements.
+     * Each [[TxnEntityChange]] exposes its class through `metadata.classFullName`. Use [[TxnEntityChanges.filter]] with `metadata.is` to match a class or one of its subclasses.
+     * @example
+     * ```ts
+     * iModel.txns.onElementsChanged.addListener((changes) => {
+     *   for (const change of changes.filter({ includeMetadata: (metadata) => metadata.is("BisCore:GeometricElement") }))
+     *     updateElement(change.id);
+     * });
+     * ```
      * @note If there are many changed elements in a single Txn, the notifications are sent in batches so this event *may be called multiple times* per Txn.
      */
     onElementsChanged = new _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.BeEvent();
     /** Event raised after Txn validation or changeset application to indicate the set of changed models.
+     * Each [[TxnEntityChange]] exposes its class through `metadata.classFullName`. Use [[TxnEntityChanges.filter]] with `metadata.is` to match a class or one of its subclasses.
      * @note If there are many changed models in a single Txn, the notifications are sent in batches so this event *may be called multiple times* per Txn.
      */
     onModelsChanged = new _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.BeEvent();
@@ -88437,11 +88483,11 @@ class EmphasizeElements {
      * @see [[Viewport.addFeatureOverrideProvider]]
      */
     addFeatureOverrides(overrides, vp) {
+        // Apply regardless of whether there are any emphasized/overridden elements for independent de-emphasis...
+        if (undefined !== this._defaultAppearance)
+            overrides.setDefaultOverrides(this._defaultAppearance);
         const emphasizedElements = this.getEmphasizedElements(vp);
         if (undefined !== emphasizedElements) {
-            if (this._defaultAppearance !== undefined) {
-                overrides.setDefaultOverrides(this._defaultAppearance);
-            }
             const appearance = this.wantEmphasis ? this._emphasizedAppearance : _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.FeatureAppearance.defaults;
             // Avoid creating a new object per-element inside the loop
             const args = { elementId: "", appearance };
@@ -88457,8 +88503,6 @@ class EmphasizeElements {
         }
         const overriddenElements = this.getOverriddenElements();
         if (undefined !== overriddenElements) {
-            if (undefined !== this._defaultAppearance)
-                overrides.setDefaultOverrides(this._defaultAppearance);
             // Avoid creating a new object per-element inside the loop
             const args = { elementId: "", appearance: _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.FeatureAppearance.defaults };
             for (const [key, ids] of overriddenElements) {
@@ -88525,7 +88569,10 @@ class EmphasizeElements {
         return { overrideType, color };
     }
     /** Establish a default appearance to apply to elements without overrides. If changing the default appearance
-     * without also calling overrideElements, an explicit refresh must be requested for the change to take effect.
+     * without also calling emphasizeElements/overrideElements, an explicit refresh must be requested for the change to take effect.
+     * @note Setting this to `undefined` to undo [[emphasizeElements]] or [[isolateElements]] leaves the always-drawn/isolated
+     * element IDs in place but invisible to [[getEmphasizedElements]], [[getEmphasizedIsolatedElements]], and [[clearEmphasizedElements]].
+     * Prefer [[clearEmphasizedElements]] or [[clearEmphasizedIsolatedElements]] to undo emphasis, which clear both together.
      * @see [[Viewport.setFeatureOverrideProviderChanged]]
      */
     get defaultAppearance() { return this._defaultAppearance; }
@@ -88884,7 +88931,9 @@ class EmphasizeElements {
         return true;
     }
     /** @return true if provider is currently overriding the display of any elements. */
-    isActive(vp) { return (undefined !== this.getNeverDrawnElements(vp) || undefined !== this.getAlwaysDrawnElements(vp) || undefined !== this.getOverriddenElements()); }
+    isActive(vp) {
+        return undefined !== this._defaultAppearance || undefined !== this.getNeverDrawnElements(vp) || undefined !== this.getAlwaysDrawnElements(vp) || undefined !== this.getOverriddenElements();
+    }
     /** Serialize to JSON representation.
      * @see [[EmphasizeElements.fromJSON]]
      */
@@ -88930,8 +88979,12 @@ class EmphasizeElements {
             changed = true;
         if (undefined !== props.alwaysDrawnExclusiveEmphasized)
             this._emphasizeIsolated = new Set(props.alwaysDrawnExclusiveEmphasized); // changed status determined by setAlwaysDrawnElements...
-        if (undefined !== props.defaultAppearance)
-            this.defaultAppearance = _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.FeatureAppearance.fromJSON(props.defaultAppearance); // changed status determined by setAlwaysDrawnElements or overrideElements...
+        if (undefined !== props.defaultAppearance) {
+            const defaultAppearance = _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.FeatureAppearance.fromJSON(props.defaultAppearance);
+            if (undefined === this._defaultAppearance || !this._defaultAppearance.equals(defaultAppearance))
+                changed = true;
+            this.defaultAppearance = defaultAppearance;
+        }
         if (props.unanimatedAppearance)
             this.unanimatedAppearance = _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.FeatureAppearance.fromJSON(props.unanimatedAppearance);
         if (undefined !== props.appearanceOverride) {
@@ -91407,6 +91460,8 @@ const COPYRIGHT_NOTICE = `Copyright © 2017-${new Date().getFullYear()} <a href=
 
 
 
+/** CSS class name applied to the notice element of a logo card created by [[IModelApp.makeLogoCard]]. */
+const logoCardNoticeClassName = "logo-cards";
 /**
  * Global singleton that connects the user interface with the iTwin.js services. There can be only one IModelApp active in a session. All
  * members of IModelApp are static, and it serves as a singleton object for gaining access to session information.
@@ -91919,10 +91974,21 @@ class IModelApp {
         }
         if (undefined !== opts.notice) {
             if (typeof opts.notice === "string")
-                IModelApp.makeHTMLElement("p", { parent: noticeCell, innerHTML: opts.notice, className: "logo-cards" });
+                IModelApp.makeHTMLElement("p", { parent: noticeCell, innerHTML: opts.notice, className: logoCardNoticeClassName });
             else
                 noticeCell.appendChild(opts.notice);
         }
+        else if (undefined !== opts.noticeLines) {
+            // A <p> cannot legally contain flow content, so use a <div> when a line is an element.
+            const containerTag = opts.noticeLines.some((line) => typeof line !== "string") ? "div" : "p";
+            const notice = IModelApp.makeHTMLElement(containerTag, { parent: noticeCell, className: logoCardNoticeClassName });
+            opts.noticeLines.forEach((line, index) => {
+                if (index > 0)
+                    notice.appendChild(IModelApp.makeHTMLElement("br"));
+                // Strings are appended as text nodes so they are never parsed as HTML.
+                notice.append(line);
+            });
+        }
         return card;
     }
     /** Make the logo card for the library itself. This card gets placed at the top of the stack.
@@ -93489,7 +93555,9 @@ let iModelJsCss = `
 
 .logo-cards {
   position:relative;
-  width:100%
+  width:100%;
+  margin-block-start:1em;
+  margin-block-end:1em
 }
 
 .imodeljs-modal-overlay {
@@ -93533,7 +93601,7 @@ let iModelJsCss = `
     max-width: calc(100% - (2 * var(--width-border))) !important;
     width: unset !important;
   }
-  .imodeljs-about .logo-card-message p {
+  .imodeljs-about .logo-card-message p, .imodeljs-about .logo-card-message .logo-cards {
     margin-block-end: 1em;
   }
   .imodeljs-about .logo-cards {
@@ -96179,9 +96247,12 @@ class Google3dTilesProvider {
             // Order by most occurances to least
             // See https://developers.google.com/maps/documentation/tile/create-renderer#display-attributions
             const sortedCopyrights = [...copyrightMap.entries()].sort((a, b) => b[1] - a[1]);
-            let copyrightMsg = "Data provided by:<br><ul>";
-            copyrightMsg += sortedCopyrights.map(([key]) => `<li>${key}</li>`).join("");
-            copyrightMsg += "</ul>";
+            const list = document.createElement("ul");
+            for (const [key] of sortedCopyrights) {
+                const item = document.createElement("li");
+                item.textContent = key;
+                list.appendChild(item);
+            }
             const iconSrc = document.createElement("img");
             iconSrc.src = `${_IModelApp__WEBPACK_IMPORTED_MODULE_8__.IModelApp.publicPath}images/GoogleMaps_Logo_Gray.svg`;
             iconSrc.style.padding = "10px 10px 5px 10px";
@@ -96189,7 +96260,7 @@ class Google3dTilesProvider {
                 iconSrc,
                 iconWidth: 98,
                 heading: "Google Photorealistic 3D Tiles",
-                notice: copyrightMsg
+                noticeLines: ["Data provided by:", list],
             }));
         }
     }
@@ -100475,6 +100546,7 @@ class ViewManager {
     cursor = "default";
     _viewports = [];
     decorators = [];
+    _selectedViewportChange = Promise.resolve();
     _selectedView;
     _invalidateScenes = false;
     _skipSceneCreation = false;
@@ -100602,9 +100674,16 @@ class ViewManager {
     }
     /** @internal */
     notifySelectedViewportChanged(previous, current) {
-        _IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.toolAdmin.onSelectedViewportChanged(previous, current); // eslint-disable-line @typescript-eslint/no-floating-promises
+        const selectedViewportChange = _IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.toolAdmin.onSelectedViewportChanged(previous, current)
+            .catch(() => undefined);
+        this._selectedViewportChange = this._selectedViewportChange.then(async () => selectedViewportChange, async () => selectedViewportChange)
+            .then(() => undefined, () => undefined);
         this.onSelectedViewportChanged.emit({ previous, current });
     }
+    /** @internal */
+    async waitForSelectedViewportChange() {
+        await this._selectedViewportChange;
+    }
     /** The "selected view" is the default for certain operations.  */
     get selectedView() { return this._selectedView; }
     /** Get the first opened view. */
@@ -104125,11 +104204,13 @@ class Viewport {
     dropModelAppearanceOverride(id) {
         this.view.displayStyle.settings.dropModelAppearanceOverride(id);
     }
-    /** Some changes may or may not require us to invalidate the scene.
+    /** Some changes do not alter the set of graphics being displayed (the "scene") but may alter the visibility of objects within those graphics.
+     * Under certain circumstances, we may want to recreate the scene after such changes.
      * Specifically, when shadows are enabled or we are displaying view attachments, the following changes may affect the visibility or transparency of elements or features:
      * - Viewed categories and subcategories;
      * - Always/never drawn elements
      * - Symbology overrides.
+     * Cached decorations will also be invalidated in case they depend on object visibility.
      */
     maybeInvalidateScene() {
         // When shadows are being displayed and the set of displayed categories changes, we must invalidate the scene so that shadows will be regenerated.
@@ -104138,7 +104219,10 @@ class Viewport {
             return;
         if (this.view.displayStyle.wantShadows || this.view.isSheetView())
             this.invalidateScene();
+        this.onSceneVisibilityChanged();
     }
+    /** @internal Invoked by [[maybeInvalidateScene]] when the visibility of objects in the scene may have changed, but the scene itself has not changed. */
+    onSceneVisibilityChanged() { }
     /** Enable or disable display of elements belonging to a set of categories specified by Id.
      * Visibility of individual subcategories belonging to a category can be controlled separately through the use of [[SubCategoryOverride]]s.
      * By default, enabling display of a category does not affect display of subcategories thereof which have been overridden to be invisible.
@@ -106177,6 +106261,13 @@ class ScreenViewport extends Viewport {
         // When the scene is invalidated, so are all cached decorations - they will be regenerated.
         this._decorationCache.clear();
     }
+    /** @internal */
+    onSceneVisibilityChanged() {
+        super.onSceneVisibilityChanged();
+        // Cached decorations may be associated with objects in the scene whose visibility has changed. Give them the opportunity to react.
+        this._decorationCache.clear();
+        this.invalidateDecorations();
+    }
     /** Forces removal of a specific decorator's cached decorations from this viewport, if they exist.
      * This will force those decorations to be regenerated.
      * @see [[ViewportDecorator.useCachedDecorations]].
@@ -116559,7 +116650,7 @@ class GoogleMapsDecorator {
         const copyrightText = sortedCopyrights.map(([key]) => ` • ${key}`).join("");
         // Create and add element, offset to leave space for i.js and Google logos
         const elem = document.createElement("div");
-        elem.innerHTML = copyrightText;
+        elem.textContent = copyrightText;
         elem.style.color = "white";
         elem.style.fontSize = "11px";
         elem.style.textWrap = "wrap";
@@ -153406,6 +153497,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   OrbitGtTileTree: () => (/* binding */ OrbitGtTileTree),
 /* harmony export */   OrbitGtTreeReference: () => (/* binding */ OrbitGtTreeReference),
+/* harmony export */   computeOrthometricVerticalShift: () => (/* binding */ computeOrthometricVerticalShift),
 /* harmony export */   createOrbitGtTileTreeReference: () => (/* binding */ createOrbitGtTileTreeReference)
 /* harmony export */ });
 /* harmony import */ var _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! @itwin/core-bentley */ "../../core/bentley/lib/esm/core-bentley.js");
@@ -153413,11 +153505,12 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(/*! @itwin/core-geometry */ "../../core/geometry/lib/esm/core-geometry.js");
 /* harmony import */ var _itwin_core_orbitgt__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(/*! @itwin/core-orbitgt */ "../../core/orbitgt/lib/esm/core-orbitgt.js");
 /* harmony import */ var _BackgroundMapGeometry__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(/*! ../../BackgroundMapGeometry */ "../../core/frontend/lib/esm/BackgroundMapGeometry.js");
-/* harmony import */ var _DisplayStyleState__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(/*! ../../DisplayStyleState */ "../../core/frontend/lib/esm/DisplayStyleState.js");
-/* harmony import */ var _IModelApp__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(/*! ../../IModelApp */ "../../core/frontend/lib/esm/IModelApp.js");
-/* harmony import */ var _RealityDataSource__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(/*! ../../RealityDataSource */ "../../core/frontend/lib/esm/RealityDataSource.js");
-/* harmony import */ var _common_internal_render_MeshPrimitives__WEBPACK_IMPORTED_MODULE_8__ = __webpack_require__(/*! ../../common/internal/render/MeshPrimitives */ "../../core/frontend/lib/esm/common/internal/render/MeshPrimitives.js");
-/* harmony import */ var _tile_internal__WEBPACK_IMPORTED_MODULE_9__ = __webpack_require__(/*! ../../tile/internal */ "../../core/frontend/lib/esm/tile/internal.js");
+/* harmony import */ var _common_FrontendLoggerCategory__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(/*! ../../common/FrontendLoggerCategory */ "../../core/frontend/lib/esm/common/FrontendLoggerCategory.js");
+/* harmony import */ var _DisplayStyleState__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(/*! ../../DisplayStyleState */ "../../core/frontend/lib/esm/DisplayStyleState.js");
+/* harmony import */ var _IModelApp__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(/*! ../../IModelApp */ "../../core/frontend/lib/esm/IModelApp.js");
+/* harmony import */ var _RealityDataSource__WEBPACK_IMPORTED_MODULE_8__ = __webpack_require__(/*! ../../RealityDataSource */ "../../core/frontend/lib/esm/RealityDataSource.js");
+/* harmony import */ var _common_internal_render_MeshPrimitives__WEBPACK_IMPORTED_MODULE_9__ = __webpack_require__(/*! ../../common/internal/render/MeshPrimitives */ "../../core/frontend/lib/esm/common/internal/render/MeshPrimitives.js");
+/* harmony import */ var _tile_internal__WEBPACK_IMPORTED_MODULE_10__ = __webpack_require__(/*! ../../tile/internal */ "../../core/frontend/lib/esm/tile/internal.js");
 /*---------------------------------------------------------------------------------------------
 * Copyright (c) Bentley Systems, Incorporated. All rights reserved.
 * See LICENSE.md in the project root for license terms and full copyright notice.
@@ -153435,6 +153528,7 @@ __webpack_require__.r(__webpack_exports__);
 
 
 
+
 const scratchRange = _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Range3d.create();
 const scratchWorldFrustum = new _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.Frustum();
 function compareSourceKeys(lhs, rhs) {
@@ -153498,7 +153592,7 @@ class OrbitGtTileTreeParams {
     id;
     modelId;
     iModel;
-    get priority() { return _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileLoadPriority.Context; }
+    get priority() { return _tile_internal__WEBPACK_IMPORTED_MODULE_10__.TileLoadPriority.Context; }
     constructor(rdSourceKey, iModel, modelId, location) {
         this.location = location;
         const key = rdSourceKey;
@@ -153507,10 +153601,10 @@ class OrbitGtTileTreeParams {
         this.iModel = iModel;
     }
 }
-class OrbitGtRootTile extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.Tile {
+class OrbitGtRootTile extends _tile_internal__WEBPACK_IMPORTED_MODULE_10__.Tile {
     _loadChildren(_resolve, _reject) { }
     async requestContent(_isCanceled) { return undefined; }
-    get channel() { return _IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.tileAdmin.channels.getForHttp("itwinjs-orbitgit"); }
+    get channel() { return _IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.tileAdmin.channels.getForHttp("itwinjs-orbitgit"); }
     async readContent(_data, _system, _isCanceled) { return {}; }
     freeMemory() { }
     constructor(params, tree) { super(params, tree); }
@@ -153580,7 +153674,7 @@ class TileSortProjector {
         coordinate.z = point.z;
     }
 }
-class OrbitGtTileGraphic extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileUsageMarker {
+class OrbitGtTileGraphic extends _tile_internal__WEBPACK_IMPORTED_MODULE_10__.TileUsageMarker {
     graphic;
     constructor(graphic, viewport, time) {
         super();
@@ -153591,7 +153685,7 @@ class OrbitGtTileGraphic extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.Til
         this.graphic[Symbol.dispose]();
     }
 }
-class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTree {
+class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_10__.TileTree {
     _dataManager;
     _centerOffset;
     _ecefTransform;
@@ -153607,7 +153701,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
         this._dataManager = _dataManager;
         this._centerOffset = _centerOffset;
         this._ecefTransform = _ecefTransform;
-        this._layerHandler = new _tile_internal__WEBPACK_IMPORTED_MODULE_9__.LayerTileTreeHandler(this);
+        this._layerHandler = new _tile_internal__WEBPACK_IMPORTED_MODULE_10__.LayerTileTreeHandler(this);
         this._tileParams = { contentId: "0", range: cloudRange, maximumSize: 256 };
         this.rootTile = new OrbitGtRootTile(this._tileParams, this);
     }
@@ -153656,7 +153750,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
         let totalPointCount = 0;
         const tileCount = frameData.tilesToRender.size();
         // Inform TileAdmin about tiles we are handling ourselves...
-        _IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.tileAdmin.addExternalTilesForUser(args.context.viewport, { requested: frameData.tilesToLoad.size() + (frameData.hasMissingData() ? 1 : 0), selected: tileCount, ready: tileCount });
+        _IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.tileAdmin.addExternalTilesForUser(args.context.viewport, { requested: frameData.tilesToLoad.size() + (frameData.hasMissingData() ? 1 : 0), selected: tileCount, ready: tileCount });
         if (debugBuilder)
             debugBuilder.setSymbology(_itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.ColorDef.red, _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.ColorDef.red, 1);
         let minLevel = 100, maxLevel = -100;
@@ -153677,8 +153771,8 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
                 range.high.addInPlace(this._centerOffset);
                 const qParams = _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.QParams3d.fromRange(range, undefined, (tile.points8 != null) ? _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.Quantization.rangeScale8 : _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.Quantization.rangeScale16);
                 const featureTable = new _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.FeatureTable(1, this.modelId, _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.BatchType.Primary);
-                const features = new _common_internal_render_MeshPrimitives__WEBPACK_IMPORTED_MODULE_8__.Mesh.Features(featureTable);
-                const system = _IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.renderSystem;
+                const features = new _common_internal_render_MeshPrimitives__WEBPACK_IMPORTED_MODULE_9__.Mesh.Features(featureTable);
+                const system = _IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.renderSystem;
                 const voxelSize = (range.high.x - range.low.x) / 64;
                 features.add(new _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.Feature(this.modelId), 1);
                 const tilePoints = (tile.points8 != null) ? tile.points8.toNativeBuffer() : tile.points16.toNativeBuffer();
@@ -153705,8 +153799,34 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
         }
         args.drawGraphics();
         if (frameData.hasMissingData()) {
-            this._dataManager.loadData(frameData).then(() => _IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.tileAdmin.onTileLoad.raiseEvent(this.rootTile)).catch((_err) => undefined);
+            this._dataManager.loadData(frameData).then(() => _IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.tileAdmin.onTileLoad.raiseEvent(this.rootTile)).catch((_err) => undefined);
+        }
+    }
+}
+/** Computes the vertical shift, in meters along geodetic up, to correctly place a point cloud whose CRS does not
+ * define a vertical datum, assuming its heights are orthometric (relative to the geoid).
+ *
+ * The shift is the difference between converting the point cloud's origin with its height treated as orthometric
+ * versus ellipsoidal (`heightAsEllipsoidalDbZ`, already computed by the caller). Returns zero if the shift cannot
+ * be computed or the iModel's converter makes no distinction between the two.
+ * Exported strictly for tests.
+ * @internal
+ */
+async function computeOrthometricVerticalShift(geoOrigin, heightAsEllipsoidalDbZ, iModel) {
+    const geoidConverter = iModel.noGcsDefined ? undefined : iModel.geoServices.getConverter({ horizontalCRS: { epsg: 4326 }, verticalCRS: { id: "GEOID" } });
+    if (undefined === geoidConverter)
+        return 0;
+    try {
+        const response = await geoidConverter.getIModelCoordinatesFromGeoCoordinates([geoOrigin]);
+        if (response.iModelCoords[0].s !== _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.GeoCoordStatus.Success) {
+            _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logWarning(_common_FrontendLoggerCategory__WEBPACK_IMPORTED_MODULE_5__.FrontendLoggerCategory.RealityData, `Failed to compute orthometric height correction for point cloud (status ${response.iModelCoords[0].s}); heights will be treated as ellipsoidal`);
+            return 0;
         }
+        return _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Point3d.fromJSON(response.iModelCoords[0].p).z - heightAsEllipsoidalDbZ;
+    }
+    catch (err) {
+        _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logError(_common_FrontendLoggerCategory__WEBPACK_IMPORTED_MODULE_5__.FrontendLoggerCategory.RealityData, err);
+        return 0;
     }
 }
 (function (OrbitGtTileTree) {
@@ -153732,7 +153852,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
         return isValidSASToken(props.sasToken);
     }
     async function createOrbitGtTileTree(rdSourceKey, iModel, modelId) {
-        const rdSource = await _RealityDataSource__WEBPACK_IMPORTED_MODULE_7__.RealityDataSource.fromKey(rdSourceKey, iModel.iTwinId);
+        const rdSource = await _RealityDataSource__WEBPACK_IMPORTED_MODULE_8__.RealityDataSource.fromKey(rdSourceKey, iModel.iTwinId);
         const isContextShare = rdSourceKey.provider === _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.RealityDataProvider.ContextShare;
         const isTilestUrl = rdSourceKey.provider === _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.RealityDataProvider.TilesetUrl;
         let blobStringUrl;
@@ -153743,7 +153863,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
             const docRootName = realityData.rootDocument;
             if (!docRootName)
                 return undefined;
-            const token = await _IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.getAccessToken();
+            const token = await _IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.getAccessToken();
             const blobUrl = await realityData.getBlobUrl(token, docRootName);
             blobStringUrl = blobUrl.toString();
         }
@@ -153751,7 +153871,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
             blobStringUrl = rdSourceKey.id;
         }
         else {
-            const orbitGtBlobProps = _RealityDataSource__WEBPACK_IMPORTED_MODULE_7__.RealityDataSource.createOrbitGtBlobPropsFromKey(rdSourceKey);
+            const orbitGtBlobProps = _RealityDataSource__WEBPACK_IMPORTED_MODULE_8__.RealityDataSource.createOrbitGtBlobPropsFromKey(rdSourceKey);
             if (orbitGtBlobProps === undefined)
                 return undefined;
             if (!isValidOrbitGtBlobProps(orbitGtBlobProps))
@@ -153786,7 +153906,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
             const wgs84CRS = "4978";
             await _itwin_core_orbitgt__WEBPACK_IMPORTED_MODULE_3__.CRSManager.ENGINE.prepareForArea(wgs84CRS, new _itwin_core_orbitgt__WEBPACK_IMPORTED_MODULE_3__.OrbitGtBounds());
             const pointCloudToEcef = transformFromOrbitGt(_itwin_core_orbitgt__WEBPACK_IMPORTED_MODULE_3__.CRSManager.createTransform(pointCloudCRS, new _itwin_core_orbitgt__WEBPACK_IMPORTED_MODULE_3__.OrbitGtCoordinate(pointCloudCenter.x, pointCloudCenter.y, pointCloudCenter.z), wgs84CRS));
-            const pointCloudCenterToEcef = pointCloudToEcef.multiplyTransformTransform(addCloudCenter);
+            let pointCloudCenterToEcef = pointCloudToEcef.multiplyTransformTransform(addCloudCenter);
             ecefTransform.setFrom(pointCloudCenterToEcef);
             let ecefToDb = iModel.getMapEcefToDb(0);
             // In initial publishing version the iModel ecef Transform was used to locate the reality model.
@@ -153806,7 +153926,21 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
                     const geoOrigin = _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Point3d.create(cartographicOrigin.longitudeDegrees, cartographicOrigin.latitudeDegrees, cartographicOrigin.height);
                     const response = await geoConverter.getIModelCoordinatesFromGeoCoordinates([geoOrigin]);
                     if (response.iModelCoords[0].s === _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.GeoCoordStatus.Success) {
-                        const ecefToDbOrigin = await (0,_BackgroundMapGeometry__WEBPACK_IMPORTED_MODULE_4__.calculateEcefToDbTransformAtLocation)(_itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Point3d.fromJSON(response.iModelCoords[0].p), iModel);
+                        const dbOriginFromGcs = _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Point3d.fromJSON(response.iModelCoords[0].p);
+                        // A projected CRS defines no vertical datum, so the point cloud's heights are conventionally orthometric -
+                        // but pointCloudToEcef above treated them as ellipsoidal. Correct the placement by the difference.
+                        // (A compound CRS also takes this path; that stays correct unless orbitgt gains a geoid model.)
+                        if (_itwin_core_orbitgt__WEBPACK_IMPORTED_MODULE_3__.CRSManager.ENGINE.isProjectedCRS(pointCloudCRS)) {
+                            const verticalShift = await computeOrthometricVerticalShift(geoOrigin, dbOriginFromGcs.z, iModel);
+                            if (0 !== verticalShift) {
+                                const upVector = _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Vector3d.createStartEnd(cartographicOrigin.toEcef(), _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.Cartographic.fromRadians({ longitude: cartographicOrigin.longitude, latitude: cartographicOrigin.latitude, height: cartographicOrigin.height + 1 }).toEcef()).normalize();
+                                if (undefined !== upVector) {
+                                    pointCloudCenterToEcef = _itwin_core_geometry__WEBPACK_IMPORTED_MODULE_2__.Transform.createTranslation(upVector.scale(verticalShift)).multiplyTransformTransform(pointCloudCenterToEcef);
+                                    ecefTransform.setFrom(pointCloudCenterToEcef);
+                                }
+                            }
+                        }
+                        const ecefToDbOrigin = await (0,_BackgroundMapGeometry__WEBPACK_IMPORTED_MODULE_4__.calculateEcefToDbTransformAtLocation)(dbOriginFromGcs, iModel);
                         if (ecefToDbOrigin)
                             ecefToDb = ecefToDbOrigin;
                     }
@@ -153826,7 +153960,7 @@ class OrbitGtTileTree extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.TileTr
 /** Supplies a reality data [[TileTree]] from a URL. May be associated with a persistent [[GeometricModelState]], or attached at run-time via a [[ContextOrbitGtState]].
  * Exported strictly for tests.
  */
-class OrbitGtTreeReference extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.RealityModelTileTree.Reference {
+class OrbitGtTreeReference extends _tile_internal__WEBPACK_IMPORTED_MODULE_10__.RealityModelTileTree.Reference {
     treeOwner;
     _rdSourceKey;
     _modelId;
@@ -153839,15 +153973,15 @@ class OrbitGtTreeReference extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.R
             this._rdSourceKey = props.rdSourceKey;
         }
         else if (props.orbitGtBlob) {
-            this._rdSourceKey = _RealityDataSource__WEBPACK_IMPORTED_MODULE_7__.RealityDataSource.createKeyFromOrbitGtBlobProps(props.orbitGtBlob);
+            this._rdSourceKey = _RealityDataSource__WEBPACK_IMPORTED_MODULE_8__.RealityDataSource.createKeyFromOrbitGtBlobProps(props.orbitGtBlob);
         }
         else {
             // TODO: Maybe we should throw an exception
-            this._rdSourceKey = _RealityDataSource__WEBPACK_IMPORTED_MODULE_7__.RealityDataSource.createKeyFromBlobUrl("", _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.RealityDataProvider.OrbitGtBlob, _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.RealityDataFormat.OPC);
+            this._rdSourceKey = _RealityDataSource__WEBPACK_IMPORTED_MODULE_8__.RealityDataSource.createKeyFromBlobUrl("", _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.RealityDataProvider.OrbitGtBlob, _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__.RealityDataFormat.OPC);
         }
         // ###TODO find compatible model Id
         let modelId = props.modelId;
-        if (undefined === modelId && this._source instanceof _DisplayStyleState__WEBPACK_IMPORTED_MODULE_5__.DisplayStyleState)
+        if (undefined === modelId && this._source instanceof _DisplayStyleState__WEBPACK_IMPORTED_MODULE_6__.DisplayStyleState)
             modelId = orbitGtTreeSupplier.findCompatibleContextRealityModelId(this._rdSourceKey, this._source);
         this._modelId = modelId ?? props.iModel.transientIds.getNext();
         const ogtTreeId = { rdSourceKey: this._rdSourceKey, modelId: this.modelId };
@@ -153862,11 +153996,15 @@ class OrbitGtTreeReference extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.R
         if (undefined === tree || hit.iModel !== tree.iModel)
             return undefined;
         const strings = [];
-        strings.push(_IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.localization.getLocalizedString("iModelJs:RealityModelTypes.OrbitGTPointCloud"));
+        strings.push(_IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.localization.getLocalizedString("iModelJs:RealityModelTypes.OrbitGTPointCloud"));
         if (this._name)
-            strings.push(`${_IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.localization.getLocalizedString("iModelJs:TooltipInfo.Name")} ${this._name}`);
+            strings.push(`${_IModelApp__WEBPACK_IMPORTED_MODULE_7__.IModelApp.localization.getLocalizedString("iModelJs:TooltipInfo.Name")} ${this._name}`);
         const div = document.createElement("div");
-        div.innerHTML = strings.join("<br>");
+        strings.forEach((str, index) => {
+            if (index > 0)
+                div.appendChild(document.createElement("br"));
+            div.appendChild(document.createTextNode(str));
+        });
         return div;
     }
 }
@@ -155630,7 +155768,11 @@ class RealityTreeReference extends RealityModelTileTree.Reference {
                 if (-1 === key.indexOf("#")) // Avoid internal cesium
                     strings.push(`${key}: ${JSON.stringify(batch[key])}`);
         const div = document.createElement("div");
-        div.innerHTML = strings.join("<br>");
+        strings.forEach((str, index) => {
+            if (index > 0)
+                div.appendChild(document.createElement("br"));
+            div.appendChild(document.createTextNode(str));
+        });
         return div;
     }
     /** @deprecated in 5.0 - might be removed in next major version. Use [addAttributions] instead. */
@@ -156818,7 +156960,21 @@ class ArcGisUtilities {
     */
     static async validateSource(args) {
         const { source, ignoreCache, capabilitiesFilter } = args;
-        const metadata = await this.getServiceJson({ url: source.url, formatId: source.formatId, userName: source.userName, password: source.password, queryParams: source.collectQueryParams(), ignoreCache });
+        let metadata;
+        try {
+            metadata = await this.getServiceJson({ url: source.url, formatId: source.formatId, userName: source.userName, password: source.password, queryParams: source.collectQueryParams(), ignoreCache });
+        }
+        catch (err) {
+            if (err instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerUntrustedOriginError) {
+                let blockedOrigin;
+                try {
+                    blockedOrigin = new URL(err.url).origin;
+                }
+                catch { /* non-hierarchical URL */ }
+                return { status: _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerSourceStatus.UntrustedOrigin, blockedOrigin };
+            }
+            throw err;
+        }
         const json = metadata?.content;
         if (json === undefined) {
             return { status: _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerSourceStatus.InvalidUrl };
@@ -156881,6 +157037,9 @@ class ArcGisUtilities {
      * @param password Password to use for legacy token based security
      * @param ignoreCache Flag to skip cache lookup (i.e. force a new server request)
      * @param requireToken Flag to indicate if a token is required
+     * @throws [[MapLayerUntrustedOriginError]] if an NTLM/Negotiate challenge could not be answered because
+     * the URL's origin is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]);
+     * all other errors are caught and reported by returning `undefined`.
      */
     static async getServiceJson(args) {
         const { url, formatId, userName, password, queryParams, ignoreCache, requireToken } = args;
@@ -156916,8 +157075,17 @@ class ArcGisUtilities {
             }
             let response = await fetch(tmpUrl, { method: "GET" });
             if (response.status === 401 && !requireToken && (0,_request_utils__WEBPACK_IMPORTED_MODULE_3__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])) {
-                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
-                response = await fetch(tmpUrl, { method: "GET", credentials: "include" });
+                // fetch follows redirects transparently, so trust decisions target the final (post-redirect) URL.
+                const challengedUrl = response.url || tmpUrl.toString();
+                if (!_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.mapLayerFormatRegistry.isSsoAllowed(challengedUrl))
+                    throw new _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerUntrustedOriginError(challengedUrl);
+                _IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.mapLayerFormatRegistry.logUntrustedOriginUse(challengedUrl);
+                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication).
+                response = await fetch(challengedUrl, {
+                    method: "GET",
+                    credentials: "include",
+                    redirect: _IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined,
+                });
             }
             // Append security token when corresponding error code is returned by ArcGIS service
             let errorCode = await ArcGisUtilities.checkForResponseErrorCode(response);
@@ -156939,8 +157107,10 @@ class ArcGisUtilities {
             ArcGisUtilities._serviceCache.set(url, (errorCode === undefined ? info : undefined));
             return info; // Always return json, even though it contains an error code.
         }
-        catch {
+        catch (err) {
             ArcGisUtilities._serviceCache.set(url, undefined);
+            if (err instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerUntrustedOriginError)
+                throw err; // propagate so callers can report the blocked origin
             return undefined;
         }
     }
@@ -157102,7 +157272,9 @@ class ArcGISImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODULE_0__.
         try {
             metadata = await _tile_internal__WEBPACK_IMPORTED_MODULE_0__.ArcGisUtilities.getServiceJson({ url: this._settings.url, formatId: this._settings.formatId, userName: this._settings.userName, password: this._settings.password, queryParams: this._settings.collectQueryParams() });
         }
-        catch {
+        catch (err) {
+            if (err instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerUntrustedOriginError)
+                this.reportBlockedOrigin(err.url);
         }
         if (metadata && metadata.accessTokenRequired) {
             const accessClient = _IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.mapLayerFormatRegistry.getAccessClient(this._settings.formatId);
@@ -157150,12 +157322,32 @@ class ArcGISImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODULE_0__.
             await this._firstRequestPromise;
         let response;
         try {
-            response = await fetch(urlObj, { ...options, credentials: this._includeUserCredentials ? "include" : undefined });
+            const requestUrl = urlObj.toString();
+            const includeCredentials = this.includeUserCredentials(requestUrl);
+            response = await fetch(urlObj, {
+                ...options,
+                credentials: includeCredentials ? "include" : undefined,
+                redirect: includeCredentials ? this.credentialedRedirect : options?.redirect,
+            });
+            if (includeCredentials)
+                this.checkCredentialedRedirect(requestUrl, response);
             if (response.status === 401 && !this._lastAccessToken && (0,_request_utils__WEBPACK_IMPORTED_MODULE_3__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])) {
-                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
-                response = await fetch(urlObj, { ...options, credentials: "include" });
-                if (response.status === 200) {
-                    this._includeUserCredentials = true; // avoid going through 401 challenges over and over
+                // fetch follows redirects transparently, so trust decisions target the final (post-redirect) URL.
+                const challengedUrl = response.url || requestUrl;
+                if (this.isSsoAllowed(challengedUrl)) {
+                    // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication).
+                    this.logUntrustedOriginUse(challengedUrl);
+                    response = await fetch(challengedUrl, {
+                        ...options,
+                        credentials: "include",
+                        redirect: _IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined,
+                    });
+                    if (response.status === 200) {
+                        this.recordSsoSucceeded(challengedUrl); // avoid going through 401 challenges over and over for this origin
+                    }
+                }
+                else {
+                    this.reportBlockedOrigin(challengedUrl);
                 }
             }
             if ((this._lastAccessToken && response.status === 400)
@@ -157368,8 +157560,12 @@ class ArcGISMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MOD
     }
     async initialize() {
         const metadata = await this.getServiceJson();
-        if (metadata?.content === undefined)
+        if (metadata?.content === undefined) {
+            // By returning (i.e., not throwing), we ensure the tile tree gets created and the current provider is preserved to report status.
+            if (this.status === _tile_internal__WEBPACK_IMPORTED_MODULE_2__.MapLayerImageryProviderStatus.UntrustedOrigin)
+                return;
             throw new _itwin_core_common__WEBPACK_IMPORTED_MODULE_0__.ServerError(_itwin_core_bentley__WEBPACK_IMPORTED_MODULE_5__.IModelStatus.ValidationFailed, "");
+        }
         const json = metadata.content;
         if (json?.error?.code === _tile_internal__WEBPACK_IMPORTED_MODULE_2__.ArcGisErrorCode.TokenRequired
             || json?.error?.code === _tile_internal__WEBPACK_IMPORTED_MODULE_2__.ArcGisErrorCode.InvalidToken
@@ -157454,7 +157650,7 @@ class ArcGISMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MOD
     addLogoCards(cards) {
         if (!cards.dataset.arcGisLogoCard) {
             cards.dataset.arcGisLogoCard = "true";
-            cards.appendChild(_IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.makeLogoCard({ heading: "ArcGIS", notice: this._copyrightText }));
+            cards.appendChild(_IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.makeLogoCard({ heading: "ArcGIS", noticeLines: [this._copyrightText] }));
         }
     }
     async addAttributions(cards, _vp) {
@@ -157495,7 +157691,7 @@ class ArcGISMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MOD
         if (json && Array.isArray(json.results)) {
             for (const result of json.results) {
                 if (result.attributes !== undefined && result.attributes[result.displayFieldName] !== undefined) {
-                    const thisString = `${result.displayFieldName}: ${result.attributes[result.displayFieldName]}`;
+                    const thisString = `${(0,_tile_internal__WEBPACK_IMPORTED_MODULE_2__.escapeHtml)(String(result.displayFieldName))}: ${(0,_tile_internal__WEBPACK_IMPORTED_MODULE_2__.escapeHtml)(String(result.attributes[result.displayFieldName]))}`;
                     if (!stringSet.has(thisString)) {
                         strings.push(thisString);
                         stringSet.add(thisString);
@@ -157811,13 +158007,7 @@ class BingMapsImageryLayerProvider extends _tile_internal__WEBPACK_IMPORTED_MODU
         const copyrights = [];
         for (const match of matchingAttributions)
             copyrights.push(match.copyrightMessage);
-        let copyrightMsg = "";
-        for (let i = 0; i < copyrights.length; ++i) {
-            if (i > 0)
-                copyrightMsg += "<br>";
-            copyrightMsg += copyrights[i];
-        }
-        cards.appendChild(_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.makeLogoCard({ iconSrc: `${_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.publicPath}images/bing.svg`, heading: "Microsoft Bing", notice: copyrightMsg }));
+        cards.appendChild(_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.makeLogoCard({ iconSrc: `${_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.publicPath}images/bing.svg`, heading: "Microsoft Bing", noticeLines: copyrights }));
     }
     async addAttributions(cards, vp) {
         // eslint-disable-next-line @typescript-eslint/no-deprecated
@@ -158426,7 +158616,10 @@ class WmsMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODULE
             // Don't throw error if unauthorized status:
             // We want the tile tree to be created, so that end-user can get feedback on which layer is missing credentials.
             // When credentials will be provided, a new provider will be created, and initialization should be fine.
-            if (error?.status === 401) {
+            if (error instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_3__.MapLayerUntrustedOriginError) {
+                this.reportBlockedOrigin(error.url);
+            }
+            else if (error?.status === 401) {
                 this.setStatus(_tile_internal__WEBPACK_IMPORTED_MODULE_3__.MapLayerImageryProviderStatus.RequireAuth);
             }
             else {
@@ -158588,7 +158781,8 @@ class WmtsMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODUL
     }
     async initialize() {
         try {
-            this._capabilities = await _tile_internal__WEBPACK_IMPORTED_MODULE_2__.WmtsCapabilities.create(this._baseUrl);
+            const credentials = (this._settings.userName && this._settings.password ? { user: this._settings.userName, password: this._settings.password } : undefined);
+            this._capabilities = await _tile_internal__WEBPACK_IMPORTED_MODULE_2__.WmtsCapabilities.create(this._baseUrl, credentials);
             this.initPreferredTileMatrixSet();
             this.initPreferredStyle();
             this.initDisplayedLayer();
@@ -158601,7 +158795,10 @@ class WmtsMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODUL
             // Don't throw error if unauthorized status:
             // We want the tile tree to be created, so that end-user can get feedback on which layer is missing credentials.
             // When credentials will be provided, a new provider will be created, and initialization should be fine.
-            if (error?.status === 401) {
+            if (error instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_2__.MapLayerUntrustedOriginError) {
+                this.reportBlockedOrigin(error.url);
+            }
+            else if (error?.status === 401) {
                 this.setStatus(_tile_internal__WEBPACK_IMPORTED_MODULE_2__.MapLayerImageryProviderStatus.RequireAuth);
             }
             else {
@@ -159176,8 +159373,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   WmsCapabilities: () => (/* binding */ WmsCapabilities),
 /* harmony export */   WmsCapability: () => (/* binding */ WmsCapability)
 /* harmony export */ });
-/* harmony import */ var wms_capabilities__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! wms-capabilities */ "../../common/temp/node_modules/.pnpm/wms-capabilities@0.4.0/node_modules/wms-capabilities/dist/wms-capabilities.min.js");
-/* harmony import */ var wms_capabilities__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(wms_capabilities__WEBPACK_IMPORTED_MODULE_0__);
+/* harmony import */ var wms_capabilities__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! wms-capabilities */ "../../common/temp/node_modules/.pnpm/wms-capabilities@0.6.0/node_modules/wms-capabilities/dist/wms-capabilities.mjs");
 /* harmony import */ var _tile_internal__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ../../../tile/internal */ "../../core/frontend/lib/esm/tile/internal.js");
 /*---------------------------------------------------------------------------------------------
 * Copyright (c) Bentley Systems, Incorporated. All rights reserved.
@@ -159329,7 +159525,7 @@ var WmsCapability;
             this.title = _json.Title;
             this.queryable = _json.queryable ? true : false;
             this.cartoRange = rangeFromJSON(_json);
-            this.ownCrs = capabilities.isVersion13 ? _json.CRS : _json.SRS;
+            this.ownCrs = initArray(capabilities.isVersion13 ? _json.CRS : _json.SRS) ?? [];
             const crs = new Set(this.ownCrs);
             if (parent) {
                 getParentCrs(parent, crs);
@@ -159359,12 +159555,32 @@ class WmsCapabilities {
     get featureInfoFormats() { return Array.isArray(this._json.Capability?.Request?.GetFeatureInfo?.Format) ? this._json.Capability?.Request?.GetFeatureInfo?.Format : undefined; }
     constructor(_json) {
         this._json = _json;
-        this.version = _json.version;
-        this.isVersion13 = _json.version !== undefined && 0 === _json.version.indexOf("1.3");
-        this.service = new WmsCapability.Service(_json.Service);
-        if (_json.Capability)
+        if (!_json || typeof _json !== "object" || (_json.Service === undefined && _json.Capability === undefined))
+            throw new Error("Invalid WMS GetCapabilities response");
+        this.version = typeof _json.version === "string" ? _json.version : undefined;
+        this.isVersion13 = this.version !== undefined && this.version.startsWith("1.3");
+        this.service = new WmsCapability.Service(_json.Service ?? {});
+        if (_json.Capability?.Layer)
             this.layer = new WmsCapability.Layer(_json.Capability.Layer, this);
     }
+    /** Parse a GetCapabilities XML response, returning undefined if it is not a valid WMS capabilities document. */
+    static tryParse(xmlCapabilities) {
+        // Validate the document is actually rooted at a WMS capabilities element before parsing:
+        // wms-capabilities happily parses any root and recognizes direct Service/Capability children.
+        // WMS 1.3.0 uses WMS_Capabilities; WMS 1.0.0-1.1.1 uses WMT_MS_Capabilities.
+        const doc = new DOMParser().parseFromString(xmlCapabilities, "text/xml");
+        const rootName = doc.documentElement?.localName;
+        if (rootName !== "WMS_Capabilities" && rootName !== "WMT_MS_Capabilities")
+            return undefined; // Not a WMS GetCapabilities document
+        if (doc.getElementsByTagName("parsererror").length > 0)
+            return undefined; // XML parse error (browsers embed a parsererror element)
+        try {
+            return new WmsCapabilities(new wms_capabilities__WEBPACK_IMPORTED_MODULE_0__["default"](undefined, DOMParser).parse(xmlCapabilities));
+        }
+        catch {
+            return undefined; // Degenerate capabilities document
+        }
+    }
     static async create(url, credentials, ignoreCache, queryParams) {
         if (!ignoreCache) {
             const cached = WmsCapabilities._capabilitiesCache.get(url);
@@ -159383,7 +159599,9 @@ class WmsCapabilities {
         const xmlCapabilities = await _tile_internal__WEBPACK_IMPORTED_MODULE_1__.WmsUtilities.fetchXml(tmpUrl.toString(), credentials);
         if (!xmlCapabilities)
             return undefined;
-        const capabilities = new WmsCapabilities(new (wms_capabilities__WEBPACK_IMPORTED_MODULE_0___default())().parse(xmlCapabilities));
+        const capabilities = WmsCapabilities.tryParse(xmlCapabilities);
+        if (capabilities === undefined)
+            return undefined;
         if (!credentials) {
             // Avoid caching protected data
             WmsCapabilities._capabilitiesCache.set(url, capabilities);
@@ -159412,14 +159630,18 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   WmsUtilities: () => (/* binding */ WmsUtilities)
 /* harmony export */ });
-/* harmony import */ var _request_Request__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! ../../../request/Request */ "../../core/frontend/lib/esm/request/Request.js");
-/* harmony import */ var _request_utils__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ../../../request/utils */ "../../core/frontend/lib/esm/request/utils.js");
+/* harmony import */ var _IModelApp__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! ../../../IModelApp */ "../../core/frontend/lib/esm/IModelApp.js");
+/* harmony import */ var _request_Request__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ../../../request/Request */ "../../core/frontend/lib/esm/request/Request.js");
+/* harmony import */ var _request_utils__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(/*! ../../../request/utils */ "../../core/frontend/lib/esm/request/utils.js");
+/* harmony import */ var _tile_internal__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(/*! ../../../tile/internal */ "../../core/frontend/lib/esm/tile/internal.js");
 /*---------------------------------------------------------------------------------------------
 * Copyright (c) Bentley Systems, Incorporated. All rights reserved.
 * See LICENSE.md in the project root for license terms and full copyright notice.
 *--------------------------------------------------------------------------------------------*/
 
 
+
+
 /** @packageDocumentation
  * @module Tiles
  */
@@ -159436,16 +159658,35 @@ class WmsUtilities {
     static async fetchXml(url, credentials) {
         let headers;
         if (credentials && credentials.user && credentials.password) {
-            headers = new Headers();
-            (0,_request_utils__WEBPACK_IMPORTED_MODULE_1__.setBasicAuthorization)(headers, credentials);
+            // Basic credentials are considered settings-derived credentials for this source. When the registry is
+            // enforcing trusted origins, the source URL itself is the only implicitly trusted origin for basic auth;
+            // opaque/custom-protocol URLs have no network origin and must therefore be treated as untrusted.
+            const allowBasicAuth = !_IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins
+                || _IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.isCredentialsSharingAllowed(url, url);
+            if (allowBasicAuth) {
+                headers = new Headers();
+                (0,_request_utils__WEBPACK_IMPORTED_MODULE_2__.setBasicAuthorization)(headers, credentials);
+            }
         }
         let response = await fetch(url, { method: "GET", headers });
-        if (!credentials && response.status === 401 && (0,_request_utils__WEBPACK_IMPORTED_MODULE_1__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])) {
-            // We got a http 401 challenge, lets try SSO (i.e. Windows Authentication)
-            response = await fetch(url, { method: "GET", credentials: "include" });
+        if (!headers && credentials && credentials.user && credentials.password && (response.status === 401 || response.status === 403)) {
+            throw new _tile_internal__WEBPACK_IMPORTED_MODULE_3__.MapLayerUntrustedOriginError(url);
+        }
+        if (!credentials && response.status === 401 && (0,_request_utils__WEBPACK_IMPORTED_MODULE_2__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])) {
+            // fetch follows redirects transparently, so trust decisions target the final (post-redirect) URL.
+            const challengedUrl = response.url || url;
+            if (!_IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.isSsoAllowed(challengedUrl))
+                throw new _tile_internal__WEBPACK_IMPORTED_MODULE_3__.MapLayerUntrustedOriginError(challengedUrl);
+            _IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.logUntrustedOriginUse(challengedUrl);
+            // We got a http 401 challenge, lets try SSO (i.e. Windows Authentication).
+            response = await fetch(challengedUrl, {
+                method: "GET",
+                credentials: "include",
+                redirect: _IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined,
+            });
         }
         if (response.status !== 200)
-            throw new _request_Request__WEBPACK_IMPORTED_MODULE_0__.HttpResponseError(response.status, await response.text());
+            throw new _request_Request__WEBPACK_IMPORTED_MODULE_1__.HttpResponseError(response.status, await response.text());
         return response.text();
     }
 }
@@ -161121,13 +161362,17 @@ class QuantityFormatter {
     }
     /** Rebuild all system entries for a single KoQ name in the registry. */
     async _rebuildRegistryForName(name, unitMap) {
-        let anySystemHadFormat = false;
         for (const system of QuantityFormatter._allUnitSystems) {
             const formatProps = await _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.formatsProvider.getFormat(name, system);
             if (formatProps) {
-                anySystemHadFormat = true;
-                for (const [persistenceUnitName] of unitMap.entries()) {
-                    await this.addFormattingSpecsToRegistry({ name, persistenceUnitName, formatProps, system });
+                for (const [persistenceUnitName, systemMap] of unitMap.entries()) {
+                    try {
+                        await this.addFormattingSpecsToRegistry({ name, persistenceUnitName, formatProps, system });
+                    }
+                    catch (err) {
+                        systemMap.delete(system);
+                        _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logWarning(`${_common_FrontendLoggerCategory__WEBPACK_IMPORTED_MODULE_2__.FrontendLoggerCategory.Package}.QuantityFormatter`, `Unable to rebuild format ${name} for persistence unit ${persistenceUnitName} and system ${system}: ${_itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.BentleyError.getErrorMessage(err)}`);
+                    }
                 }
             }
             else {
@@ -161137,9 +161382,13 @@ class QuantityFormatter {
                 }
             }
         }
-        if (!anySystemHadFormat) {
-            this._formatSpecsRegistry.delete(name);
+        // Remove persistence units that no longer have a valid entry in any system.
+        for (const [persistenceUnitName, systemMap] of unitMap.entries()) {
+            if (systemMap.size === 0)
+                unitMap.delete(persistenceUnitName);
         }
+        if (unitMap.size === 0)
+            this._formatSpecsRegistry.delete(name);
     }
     /** Return a map that serves as a registry of all standard and custom quantity types. */
     get quantityTypesRegistry() {
@@ -171851,6 +172100,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   MapLayerSourceStatus: () => (/* reexport safe */ _map_MapLayerSources__WEBPACK_IMPORTED_MODULE_86__.MapLayerSourceStatus),
 /* harmony export */   MapLayerSources: () => (/* reexport safe */ _map_MapLayerSources__WEBPACK_IMPORTED_MODULE_86__.MapLayerSources),
 /* harmony export */   MapLayerTileTreeReference: () => (/* reexport safe */ _map_MapLayerTileTreeReference__WEBPACK_IMPORTED_MODULE_64__.MapLayerTileTreeReference),
+/* harmony export */   MapLayerUntrustedOriginError: () => (/* reexport safe */ _map_MapLayerFormatRegistry__WEBPACK_IMPORTED_MODULE_42__.MapLayerUntrustedOriginError),
 /* harmony export */   MapTile: () => (/* reexport safe */ _map_MapTile__WEBPACK_IMPORTED_MODULE_70__.MapTile),
 /* harmony export */   MapTileLoader: () => (/* reexport safe */ _internal_tile_map_MapTileLoader__WEBPACK_IMPORTED_MODULE_72__.MapTileLoader),
 /* harmony export */   MapTileProjection: () => (/* reexport safe */ _map_MapTile__WEBPACK_IMPORTED_MODULE_70__.MapTileProjection),
@@ -171930,6 +172180,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   collectMaskRefs: () => (/* reexport safe */ _internal_tile_PrimaryTileTree__WEBPACK_IMPORTED_MODULE_82__.collectMaskRefs),
 /* harmony export */   compareMapLayer: () => (/* reexport safe */ _internal_render_webgl_MapLayerParams__WEBPACK_IMPORTED_MODULE_94__.compareMapLayer),
 /* harmony export */   computeCesiumTokenTimeoutInterval: () => (/* reexport safe */ _map_CesiumTerrainProvider__WEBPACK_IMPORTED_MODULE_68__.computeCesiumTokenTimeoutInterval),
+/* harmony export */   computeOrthometricVerticalShift: () => (/* reexport safe */ _internal_tile_OrbitGtTileTree__WEBPACK_IMPORTED_MODULE_84__.computeOrthometricVerticalShift),
 /* harmony export */   createClassifierTileTreeReference: () => (/* reexport safe */ _internal_tile_ClassifierTileTree__WEBPACK_IMPORTED_MODULE_83__.createClassifierTileTreeReference),
 /* harmony export */   createDefaultViewFlagOverrides: () => (/* reexport safe */ _internal_tile_ViewFlagOverrides__WEBPACK_IMPORTED_MODULE_0__.createDefaultViewFlagOverrides),
 /* harmony export */   createGraphicFromDescription: () => (/* reexport safe */ _internal_tile_ImdlGraphicsCreator__WEBPACK_IMPORTED_MODULE_37__.createGraphicFromDescription),
@@ -171946,6 +172197,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   decodeMeshoptBuffer: () => (/* reexport safe */ _internal_tile_MeshoptCompression__WEBPACK_IMPORTED_MODULE_93__.decodeMeshoptBuffer),
 /* harmony export */   deflateCoordinates: () => (/* reexport safe */ _internal_tile_map_ImageryProviders_CoordinatesUtils__WEBPACK_IMPORTED_MODULE_47__.deflateCoordinates),
 /* harmony export */   disposeTileTreesForGeometricModels: () => (/* reexport safe */ _internal_tile_PrimaryTileTree__WEBPACK_IMPORTED_MODULE_82__.disposeTileTreesForGeometricModels),
+/* harmony export */   escapeHtml: () => (/* reexport safe */ _map_MapLayerImageryProvider__WEBPACK_IMPORTED_MODULE_49__.escapeHtml),
 /* harmony export */   getCesiumAccessClient: () => (/* reexport safe */ _map_CesiumTerrainProvider__WEBPACK_IMPORTED_MODULE_68__.getCesiumAccessClient),
 /* harmony export */   getCesiumAccessTokenAndEndpointUrl: () => (/* reexport safe */ _map_CesiumTerrainProvider__WEBPACK_IMPORTED_MODULE_68__.getCesiumAccessTokenAndEndpointUrl),
 /* harmony export */   getCesiumAssetUrl: () => (/* reexport safe */ _map_CesiumTerrainProvider__WEBPACK_IMPORTED_MODULE_68__.getCesiumAssetUrl),
@@ -171965,7 +172217,8 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   readImdlContent: () => (/* reexport safe */ _ImdlReader__WEBPACK_IMPORTED_MODULE_35__.readImdlContent),
 /* harmony export */   readPntsColors: () => (/* reexport safe */ _internal_tile_PntsReader__WEBPACK_IMPORTED_MODULE_76__.readPntsColors),
 /* harmony export */   readPointCloudTileContent: () => (/* reexport safe */ _internal_tile_PntsReader__WEBPACK_IMPORTED_MODULE_76__.readPointCloudTileContent),
-/* harmony export */   tileTreeReferenceFromRenderGraphic: () => (/* reexport safe */ _RenderGraphicTileTree__WEBPACK_IMPORTED_MODULE_78__.tileTreeReferenceFromRenderGraphic)
+/* harmony export */   tileTreeReferenceFromRenderGraphic: () => (/* reexport safe */ _RenderGraphicTileTree__WEBPACK_IMPORTED_MODULE_78__.tileTreeReferenceFromRenderGraphic),
+/* harmony export */   tryGetOrigin: () => (/* reexport safe */ _map_MapLayerImageryProvider__WEBPACK_IMPORTED_MODULE_49__.tryGetOrigin)
 /* harmony export */ });
 /* harmony import */ var _internal_tile_ViewFlagOverrides__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! ../internal/tile/ViewFlagOverrides */ "../../core/frontend/lib/esm/internal/tile/ViewFlagOverrides.js");
 /* harmony import */ var _map_MapCartoRectangle__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ./map/MapCartoRectangle */ "../../core/frontend/lib/esm/tile/map/MapCartoRectangle.js");
@@ -173664,7 +173917,8 @@ __webpack_require__.r(__webpack_exports__);
 __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   MapLayerFormat: () => (/* binding */ MapLayerFormat),
-/* harmony export */   MapLayerFormatRegistry: () => (/* binding */ MapLayerFormatRegistry)
+/* harmony export */   MapLayerFormatRegistry: () => (/* binding */ MapLayerFormatRegistry),
+/* harmony export */   MapLayerUntrustedOriginError: () => (/* binding */ MapLayerUntrustedOriginError)
 /* harmony export */ });
 /* harmony import */ var _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! @itwin/core-bentley */ "../../core/bentley/lib/esm/core-bentley.js");
 /* harmony import */ var _IModelApp__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ../../IModelApp */ "../../core/frontend/lib/esm/IModelApp.js");
@@ -173679,7 +173933,7 @@ __webpack_require__.r(__webpack_exports__);
 
 
 
-const loggerCategory = "ArcGISFeatureProvider";
+const loggerCategory = "MapLayerFormatRegistry";
 /**
  * Class representing a map-layer format.
  * Each format has it's unique 'formatId' string, used to uniquely identify a format in the [[MapLayerFormatRegistry]].
@@ -173728,16 +173982,127 @@ class MapLayerFormat {
         return undefined;
     }
 }
+/** Error thrown when an NTLM or Negotiate http 401 challenge could not be answered because the request
+ * URL's origin is not listed in [[MapLayerFormatRegistry.trustedCredentialsOrigins]]
+ * (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+ * Thrown by the static map-layer utilities (e.g. capabilities / service-metadata fetches) that have no
+ * provider instance on which to report the blocked origin; callers convert it to
+ * [[MapLayerImageryProviderStatus.UntrustedOrigin]] (provider initialization) or
+ * [[MapLayerSourceStatus.UntrustedOrigin]] (source validation).
+ * @internal
+ */
+class MapLayerUntrustedOriginError extends Error {
+    /** The URL of the request whose authentication challenge was left unanswered. */
+    url;
+    constructor(url) {
+        super(`Authentication blocked: origin of '${url}' is not listed in MapLayerFormatRegistry.trustedCredentialsOrigins`);
+        this.url = url;
+    }
+}
 /**
  * A registry of MapLayerFormats identified by their unique format IDs. The registry can be accessed via [[IModelApp.mapLayerFormatRegistry]].
  * @public
  */
 class MapLayerFormatRegistry {
     _configOptions;
+    _trustedCredentialsOrigins = [];
+    /** Opt-in enforcement of origin restrictions on map-layer credentials.
+     * When enabled, map layer providers:
+     * - attach the basic-auth credentials stored in the layer settings only to requests targeting the origin
+     *   of the layer's settings URL or an origin listed in [[trustedCredentialsOrigins]];
+     * - retry a request with browser credentials included (i.e. SSO / Windows Authentication) after an NTLM
+     *   or Negotiate http 401 challenge only for origins explicitly listed in [[trustedCredentialsOrigins]]
+     *   (the settings-URL origin is NOT implicitly trusted for SSO, since map-layer URLs may originate from
+     *   untrusted user input while SSO shares the user's ambient identity).
+     * Default is false, preserving the legacy behavior of sending credentials to any request URL.
+     * @beta
+     */
+    restrictCredentialsToTrustedOrigins = false;
     constructor(opts) {
         this._configOptions = opts ?? {};
         _internal__WEBPACK_IMPORTED_MODULE_2__.internalMapLayerImageryFormats.forEach((format) => this.register(format));
     }
+    /** Origins (e.g. "https://tiles.example.com") to which map layer providers may send credentials —
+     * both the basic-auth credentials stored in the layer settings and browser credentials for
+     * SSO (i.e. Windows Authentication) retries after an NTLM or Negotiate http 401 challenge.
+     * Only enforced when [[restrictCredentialsToTrustedOrigins]] is enabled.
+     * For basic-auth, the origin of each map layer's settings URL is always implicitly trusted; for SSO,
+     * origins must be explicitly listed here.
+     * Entries are normalized to their origin (scheme + host + port); only `http:` and `https:` URLs are accepted,
+     * and any other entry is ignored and logged. Opaque schemes such as `file:`, `data:`, `about:` and custom
+     * Electron protocols are rejected because they all share the same serialized origin, so trusting one would
+     * trust every other.
+     * @beta
+     */
+    get trustedCredentialsOrigins() {
+        return this._trustedCredentialsOrigins;
+    }
+    set trustedCredentialsOrigins(origins) {
+        const normalized = [];
+        for (const entry of origins) {
+            const origin = (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(entry);
+            if (origin !== undefined)
+                normalized.push(origin);
+            else
+                _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logWarning(loggerCategory, `trustedCredentialsOrigins: ignoring '${entry}'; entries must be http or https URLs.`);
+        }
+        this._trustedCredentialsOrigins = normalized;
+    }
+    /** Returns true if a request to the given URL may be retried with browser credentials included
+     * (i.e. SSO / Windows Authentication) after an NTLM or Negotiate http 401 challenge.
+     * Always true unless [[restrictCredentialsToTrustedOrigins]] is enabled (opt-in).
+     * When enabled, the URL's origin must be explicitly listed in [[trustedCredentialsOrigins]];
+     * unlike basic-auth, the settings-URL origin is NOT implicitly trusted because SSO shares the user's
+     * ambient identity, and map-layer URLs may originate from untrusted user input.
+     * @internal
+     */
+    isSsoAllowed(url) {
+        if (!this.restrictCredentialsToTrustedOrigins)
+            return true;
+        const origin = (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(url);
+        // Entries are normalized to their origin by the [[trustedCredentialsOrigins]] setter.
+        return origin !== undefined && this._trustedCredentialsOrigins.includes(origin);
+    }
+    /** Returns true if the basic-auth credentials belonging to a map-layer source or settings URL may be
+     * attached to a request to the given URL. Always true unless [[restrictCredentialsToTrustedOrigins]]
+     * is enabled (opt-in). When enabled, the origin of `settingsUrl` is implicitly trusted (the credentials
+     * belong to that server); any other origin must be listed in [[trustedCredentialsOrigins]].
+     * @internal
+     */
+    isCredentialsSharingAllowed(url, settingsUrl) {
+        if (!this.restrictCredentialsToTrustedOrigins)
+            return true;
+        const origin = (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(url);
+        if (origin === undefined)
+            return false;
+        if (origin === (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(settingsUrl))
+            return true;
+        // Entries are normalized to their origin by the [[trustedCredentialsOrigins]] setter.
+        return this._trustedCredentialsOrigins.includes(origin);
+    }
+    /** Origins for which a "credentials sent to untrusted origin" warning was already logged;
+     * used to log the discovery warning only once per origin.
+     */
+    _untrustedUseLogged = new Set();
+    /** Logs a warning (once per origin) when credentials are sent to an origin that would be blocked
+     * if [[restrictCredentialsToTrustedOrigins]] were enabled.
+     * Helps applications discover the origins they need to whitelist before opting in to the restriction.
+     * If `settingsUrl` is supplied, requests sharing its origin are not logged, since that origin is
+     * implicitly trusted for basic-auth.
+     * @internal
+     */
+    logUntrustedOriginUse(url, settingsUrl) {
+        if (this.restrictCredentialsToTrustedOrigins)
+            return; // restriction active; nothing to preview
+        const origin = (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(url) ?? url;
+        if (settingsUrl !== undefined && origin === (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(settingsUrl))
+            return; // implicitly trusted for basic-auth
+        if (this._untrustedUseLogged.has(origin) || this._trustedCredentialsOrigins.includes(origin))
+            return;
+        this._untrustedUseLogged.add(origin);
+        _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logWarning(loggerCategory, `Credentials sent to origin '${origin}' which is not in MapLayerFormatRegistry.trustedCredentialsOrigins; `
+            + "this request would be blocked if restrictCredentialsToTrustedOrigins were enabled.");
+    }
     _formats = new Map();
     isRegistered(formatId) { return this._formats.get(formatId) !== undefined; }
     register(formatClass) {
@@ -173903,6 +174268,14 @@ class WmsMapLayerFormat extends ImageryMapLayerFormat {
             return { status: _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.Valid, subLayers };
         }
         catch (err) {
+            if (err instanceof _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerUntrustedOriginError) {
+                let blockedOrigin;
+                try {
+                    blockedOrigin = new URL(err.url).origin;
+                }
+                catch { /* non-hierarchical URL */ }
+                return { status: _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.UntrustedOrigin, blockedOrigin };
+            }
             let status = _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.InvalidUrl;
             if (err?.status === 401) {
                 status = ((userName && password) ? _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.InvalidCredentials : _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.RequireAuth);
@@ -173968,6 +174341,14 @@ class WmtsMapLayerFormat extends ImageryMapLayerFormat {
             return { status: _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.Valid, subLayers };
         }
         catch (err) {
+            if (err instanceof _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerUntrustedOriginError) {
+                let blockedOrigin;
+                try {
+                    blockedOrigin = new URL(err.url).origin;
+                }
+                catch { /* non-hierarchical URL */ }
+                return { status: _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.UntrustedOrigin, blockedOrigin };
+            }
             let status = _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.InvalidUrl;
             if (err?.status === 401) {
                 status = ((userName && password) ? _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.InvalidCredentials : _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.RequireAuth);
@@ -174032,7 +174413,9 @@ const internalMapLayerImageryFormats = [WmsMapLayerFormat, WmtsMapLayerFormat, A
 __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   MapLayerImageryProvider: () => (/* binding */ MapLayerImageryProvider),
-/* harmony export */   MapLayerImageryProviderStatus: () => (/* binding */ MapLayerImageryProviderStatus)
+/* harmony export */   MapLayerImageryProviderStatus: () => (/* binding */ MapLayerImageryProviderStatus),
+/* harmony export */   escapeHtml: () => (/* binding */ escapeHtml),
+/* harmony export */   tryGetOrigin: () => (/* binding */ tryGetOrigin)
 /* harmony export */ });
 /* harmony import */ var _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! @itwin/core-bentley */ "../../core/bentley/lib/esm/core-bentley.js");
 /* harmony import */ var _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! @itwin/core-common */ "../../core/common/lib/esm/core-common.js");
@@ -174059,6 +174442,34 @@ __webpack_require__.r(__webpack_exports__);
 const tileImageSize = 256, untiledImageSize = 256;
 const earthRadius = 6378137;
 const doDebugToolTips = false;
+/** Escapes HTML metacharacters so the text renders literally when assigned to `innerHTML`.
+ * Use for any server- or user-supplied string that ends up in the map tooltip, which is rendered
+ * as HTML by [[MapLayerTileTreeReference.getToolTip]].
+ * @internal
+ */
+function escapeHtml(text) {
+    return text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+/** Returns the origin (scheme + host + port) of the given URL, or undefined if it cannot be parsed or does
+ * not denote a distinct network origin.
+ *
+ * Only `http:` and `https:` URLs yield an origin. Every other scheme is rejected because opaque URLs
+ * — `file:`, `data:`, `about:`, `blob:null`, and the custom protocols Electron hosts commonly register —
+ * all serialize to the literal string `"null"`. Comparing those would make unrelated URLs look same-origin,
+ * so a single trusted entry could unlock all of them. Callers use this for credential-trust decisions, and
+ * returning `undefined` keeps those decisions fail-closed.
+ * @internal
+ */
+function tryGetOrigin(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+    return (parsed.protocol === "http:" || parsed.protocol === "https:") ? parsed.origin : undefined;
+}
 /** The status of the map layer imagery provider that lets you know if authentication is needed to request tiles.
  * @public
  */
@@ -174066,6 +174477,12 @@ var MapLayerImageryProviderStatus;
 (function (MapLayerImageryProviderStatus) {
     MapLayerImageryProviderStatus[MapLayerImageryProviderStatus["Valid"] = 0] = "Valid";
     MapLayerImageryProviderStatus[MapLayerImageryProviderStatus["RequireAuth"] = 1] = "RequireAuth";
+    /** A request received an authentication challenge, but credentials were withheld because the request origin
+     * is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * The blocked origins are available via [[MapLayerImageryProvider.blockedOrigins]].
+     * @beta
+     */
+    MapLayerImageryProviderStatus[MapLayerImageryProviderStatus["UntrustedOrigin"] = 2] = "UntrustedOrigin";
 })(MapLayerImageryProviderStatus || (MapLayerImageryProviderStatus = {}));
 /** Abstract class for map layer imagery providers.
  * Map layer imagery providers request and provide tile images and other data. Each map layer from a separate source needs its own imagery provider object.
@@ -174083,7 +174500,41 @@ class MapLayerImageryProvider {
     /** @internal */
     _status = MapLayerImageryProviderStatus.Valid;
     /** @internal */
-    _includeUserCredentials = false;
+    _blockedOrigins = new Set();
+    /** Origins of requests for which credentials were withheld because they are not trusted
+     * (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * Populated when [[status]] transitions to [[MapLayerImageryProviderStatus.UntrustedOrigin]];
+     * [[onStatusChanged]] is raised again each time a new origin is added. Cleared by [[resetStatus]].
+     * @beta
+     */
+    get blockedOrigins() { return [...this._blockedOrigins]; }
+    /** Origins for which a previous SSO handshake (i.e. Windows Authentication) succeeded.
+     * Browser credentials are only included for subsequent requests targeting these origins,
+     * so that a successful handshake with one host does not leak credentials to other hosts
+     * this provider may contact.
+     * @internal
+     */
+    _ssoSucceededOrigins = new Set();
+    /** Returns true if browser credentials should be included for the given URL because a previous
+     * SSO handshake succeeded for its origin AND the origin is still allowed by the current policy
+     * (see [[MapLayerFormatRegistry.isSsoAllowed]]). Re-checking the policy ensures a handshake recorded
+     * while enforcement was disabled — or before an origin was removed from
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]] — does not keep latching credentials on.
+     * @internal
+     */
+    includeUserCredentials(url) {
+        const origin = tryGetOrigin(url);
+        return origin !== undefined && this._ssoSucceededOrigins.has(origin) && this.isSsoAllowed(url);
+    }
+    /** Records that an SSO handshake succeeded for the given URL's origin, so subsequent requests
+     * to that origin include browser credentials without going through another 401 challenge.
+     * @internal
+     */
+    recordSsoSucceeded(url) {
+        const origin = tryGetOrigin(url);
+        if (origin !== undefined)
+            this._ssoSucceededOrigins.add(origin);
+    }
     /** @internal */
     onFirstRequestCompleted = new _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.BeEvent();
     /** @internal */
@@ -174099,7 +174550,17 @@ class MapLayerImageryProvider {
      * @public
      */
     get supportsMapFeatureInfo() { return false; }
-    resetStatus() { this.setStatus(MapLayerImageryProviderStatus.Valid); }
+    /** Reset the provider's status to [[MapLayerImageryProviderStatus.Valid]] and clear the list of
+     * [[blockedOrigins]] accumulated while in the [[MapLayerImageryProviderStatus.UntrustedOrigin]] state.
+     * Raises [[onStatusChanged]] if the status actually changes.
+     * Typically called after the user has provided credentials or the application has updated
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]], so that subsequent requests are re-attempted.
+     * @beta
+     */
+    resetStatus() {
+        this._blockedOrigins.clear();
+        this.setStatus(MapLayerImageryProviderStatus.Valid);
+    }
     /** @internal */
     get tileSize() { return this._usesCachedTiles ? tileImageSize : untiledImageSize; }
     /** @internal */
@@ -174273,6 +174734,32 @@ class MapLayerImageryProvider {
             (0,_request_utils__WEBPACK_IMPORTED_MODULE_6__.setBasicAuthorization)(headers, this._settings.userName, this._settings.password);
         }
     }
+    /** Returns true if the given URL has the same origin as this layer's settings URL.
+     * Used to avoid leaking credentials to third-party hosts.
+     * @internal
+     */
+    matchesSettingsUrlOrigin(url) {
+        const origin = tryGetOrigin(url);
+        return origin !== undefined && origin === tryGetOrigin(this._settings.url);
+    }
+    /** Returns true if the basic-auth credentials from the layer settings may be attached to a request to the given URL.
+     * Always true unless [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is enabled (opt-in).
+     * When enabled, the origin of this layer's settings URL is implicitly trusted (the credentials belong to that
+     * server); other origins must be listed in [[MapLayerFormatRegistry.trustedCredentialsOrigins]].
+     * See [[MapLayerFormatRegistry.isCredentialsSharingAllowed]].
+     * @internal
+     */
+    isCredentialsSharingAllowed(url) {
+        return _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.isCredentialsSharingAllowed(url, this._settings.url);
+    }
+    /** Returns true if a request to the given URL may be retried with browser credentials included
+     * (i.e. SSO / Windows Authentication) after an NTLM or Negotiate http 401 challenge.
+     * See [[MapLayerFormatRegistry.isSsoAllowed]].
+     * @internal
+     */
+    isSsoAllowed(url) {
+        return _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.isSsoAllowed(url);
+    }
     /** @internal */
     async makeTileRequest(url, timeoutMs, authorization) {
         // We want to complete the first request before letting other requests go;
@@ -174292,40 +174779,132 @@ class MapLayerImageryProvider {
             throw new Error("fetch call failed");
         return response;
     }
+    /** Records the given URL's origin and transitions the status to [[MapLayerImageryProviderStatus.UntrustedOrigin]].
+     * Called when a request received an authentication challenge that could not be answered because the origin
+     * is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * Raises [[onStatusChanged]] on the status transition, and again whenever a new origin is added.
+     * @internal
+     */
+    reportBlockedOrigin(url) {
+        const origin = tryGetOrigin(url) ?? url;
+        const isNewOrigin = !this._blockedOrigins.has(origin);
+        this._blockedOrigins.add(origin);
+        if (this._status !== MapLayerImageryProviderStatus.UntrustedOrigin)
+            this.setStatus(MapLayerImageryProviderStatus.UntrustedOrigin);
+        else if (isNewOrigin)
+            this.onStatusChanged.raiseEvent(this); // status unchanged, but a new origin was blocked
+    }
+    /** Logs a warning (once per origin, app-wide) when credentials are sent to an origin that would be blocked
+     * if [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] were enabled.
+     * Helps applications discover the origins they need to whitelist before opting in to the restriction.
+     * See [[MapLayerFormatRegistry.logUntrustedOriginUse]].
+     * @internal
+     */
+    logUntrustedOriginUse(url) {
+        _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.logUntrustedOriginUse(url);
+    }
+    /** The redirect policy to apply to a request that carries browser credentials (see [[includeUserCredentials]]).
+     *
+     * When [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is enabled, redirects are refused
+     * outright (`"error"`). `fetch` cannot be asked to follow only same-origin redirects, and by the time a
+     * followed redirect can be inspected the credentials have already been delivered to the destination — so
+     * refusing is the only way to honour the guarantee that credentials reach none but the origins listed in
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]]. Legitimate same-origin redirects fail as a result;
+     * that is the cost of the opt-in restriction.
+     *
+     * When the restriction is disabled (the default), redirects are followed as before and
+     * [[checkCredentialedRedirect]] reports the destination after the fact.
+     * @internal
+     */
+    get credentialedRedirect() {
+        return _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined;
+    }
+    /** Detects that a request carrying browser credentials (see [[includeUserCredentials]]) was transparently
+     * redirected to a different origin, and reports or logs that origin.
+     *
+     * This is a **best-effort, after-the-fact** signal used only while
+     * [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is disabled, where credentialed requests
+     * still follow redirects (see [[credentialedRedirect]]). It cannot prevent the exposure — the credentials
+     * have already been sent — and it does not fire at all when the destination denies CORS, because `fetch`
+     * then rejects instead of returning a `Response`. The destination origin is never latched as SSO-succeeded,
+     * so credentials do not keep flowing to it.
+     * @internal
+     */
+    checkCredentialedRedirect(requestedUrl, response) {
+        const finalOrigin = tryGetOrigin(response.url);
+        if (!response.url || finalOrigin === undefined || finalOrigin === tryGetOrigin(requestedUrl))
+            return;
+        if (!this.isSsoAllowed(response.url))
+            this.reportBlockedOrigin(response.url);
+        else
+            this.logUntrustedOriginUse(response.url); // no-op when the restriction is enabled
+    }
     /** @internal */
     async makeRequest(url, timeoutMs, authorization) {
         let response;
         let headers;
         let hasCreds = false;
+        // Whether this request had basic-auth credentials of its own to offer. Requests carrying a caller-supplied
+        // `authorization` are excluded: those bypass the origin policy entirely.
+        const hasSettingsCreds = !authorization && !!this._settings.userName && !!this._settings.password;
         if (authorization) {
             headers = new Headers();
             headers.set("Authorization", authorization);
         }
-        else if (this._settings.userName && this._settings.password) {
-            hasCreds = true;
-            headers = new Headers();
-            this.setRequestAuthorization(headers);
+        else if (hasSettingsCreds) {
+            if (this.isCredentialsSharingAllowed(url)) {
+                hasCreds = true;
+                headers = new Headers();
+                this.setRequestAuthorization(headers);
+                if (!this.matchesSettingsUrlOrigin(url))
+                    this.logUntrustedOriginUse(url);
+            }
         }
+        const includeCredentials = this.includeUserCredentials(url);
         const opts = {
             method: "GET",
             headers,
-            credentials: this._includeUserCredentials ? "include" : undefined,
+            credentials: includeCredentials ? "include" : undefined,
+            redirect: includeCredentials ? this.credentialedRedirect : undefined,
         };
         if (timeoutMs !== undefined)
             (0,_request_utils__WEBPACK_IMPORTED_MODULE_6__.setRequestTimeout)(opts, timeoutMs);
         response = await fetch(url, opts);
+        if (includeCredentials)
+            this.checkCredentialedRedirect(url, response);
+        // fetch follows redirects transparently, so all trust decisions below target the final
+        // (post-redirect) URL reported by the response, not the URL we asked for.
+        const challengedUrl = response.url || url;
         if (response.status === 401
             && (0,_request_utils__WEBPACK_IMPORTED_MODULE_6__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])
-            && !this._includeUserCredentials
+            && !includeCredentials
             && !hasCreds) {
-            // Removed the previous headers and make sure "include" credentials is set
-            opts.headers = undefined;
-            opts.credentials = "include";
-            // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
-            response = await fetch(url, opts);
-            if (response.status === 200) {
-                this._includeUserCredentials = true; // avoid going through 401 challenges over and over
+            if (this.isSsoAllowed(challengedUrl)) {
+                // Removed the previous headers and make sure "include" credentials is set
+                opts.headers = undefined;
+                opts.credentials = "include";
+                // A Negotiate/NTLM handshake is normally a same-URL 401 round-trip, but in legacy mode we preserve
+                // the previous behavior and allow the browser to follow redirects after the authenticated retry.
+                opts.redirect = _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined;
+                this.logUntrustedOriginUse(challengedUrl);
+                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
+                response = await fetch(challengedUrl, opts);
+                if (response.status === 200) {
+                    this.recordSsoSucceeded(challengedUrl); // avoid going through 401 challenges over and over for this origin
+                }
             }
+            else {
+                this.reportBlockedOrigin(challengedUrl);
+            }
+        }
+        else if ((response.status === 401 || response.status === 403) && hasSettingsCreds && !this.isCredentialsSharingAllowed(challengedUrl)) {
+            // Some servers answer an unauthenticated request with 403 (Forbidden) rather than a 401 challenge;
+            // since this request could not present its credentials to the challenging origin, either status most
+            // likely results from that. The permission is recomputed for the challenged URL rather than reusing the
+            // decision made for the requested one: `fetch` strips the Authorization header when it follows a
+            // cross-origin redirect, so a trusted request can still arrive unauthenticated at an untrusted origin,
+            // and conversely a request that started out untrusted may end up at an origin that is trusted.
+            this.reportBlockedOrigin(challengedUrl);
         }
         return response;
     }
@@ -174357,16 +174936,28 @@ class MapLayerImageryProvider {
     }
     /** @internal */
     async toolTipFromUrl(strings, url) {
-        const headers = new Headers();
-        this.setRequestAuthorization(headers);
+        let headers;
+        if (this.isCredentialsSharingAllowed(url)) {
+            headers = new Headers();
+            this.setRequestAuthorization(headers);
+        }
         try {
+            const includeCredentials = this.includeUserCredentials(url);
             const response = await fetch(url, {
                 method: "GET",
                 headers,
-                credentials: this._includeUserCredentials ? "include" : undefined,
+                credentials: includeCredentials ? "include" : undefined,
+                redirect: includeCredentials ? this.credentialedRedirect : undefined,
             });
-            const text = await response.text();
-            if (undefined !== text) {
+            if (includeCredentials)
+                this.checkCredentialedRedirect(url, response);
+            let text = await response.text();
+            if (text) {
+                // Tooltip content (e.g. WMS GetFeatureInfo responses) is rendered as HTML downstream and may
+                // deliberately contain markup; text from origins not trusted for credentials is escaped.
+                // fetch follows redirects transparently, so the text may come from a different origin than requested.
+                if (!this.isCredentialsSharingAllowed(response.url || url))
+                    text = escapeHtml(text);
                 strings.push(text);
             }
         }
@@ -174546,6 +175137,12 @@ var MapLayerSourceStatus;
     /** Format is not compatible with the URL provided.
      */
     MapLayerSourceStatus[MapLayerSourceStatus["IncompatibleFormat"] = 7] = "IncompatibleFormat";
+    /** Authentication could not be attempted because the source's origin is not trusted
+     * (see [MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]($frontend)). Add the origin to
+     * [MapLayerFormatRegistry.trustedCredentialsOrigins]($frontend) rather than prompting for credentials.
+     * @beta
+     */
+    MapLayerSourceStatus[MapLayerSourceStatus["UntrustedOrigin"] = 8] = "UntrustedOrigin";
 })(MapLayerSourceStatus || (MapLayerSourceStatus = {}));
 /** A source for map layers. These may be catalogued for convenient use by users or applications.
  * @public
@@ -174833,10 +175430,8 @@ class MapLayerTileTreeReference extends _internal__WEBPACK_IMPORTED_MODULE_3__.T
         const tree = this.treeOwner.tileTree;
         if (undefined === tree || hit.iModel !== tree.iModel || tree.modelId !== hit.sourceId)
             return undefined;
-        const strings = [];
-        strings.push(`Map Layer: ${this._layerSettings.name}`);
         const div = document.createElement("div");
-        div.innerHTML = strings.join("<br>");
+        div.textContent = `Map Layer: ${this._layerSettings.name}`;
         return div;
     }
     decorate(_context) {
@@ -176545,7 +177140,9 @@ class MapTileTreeReference extends _internal__WEBPACK_IMPORTED_MODULE_7__.TileTr
         let carto;
         const strings = [];
         const getTooltipFunc = async (imageryTreeRef, quadId, cartoGraphic, imageryTree) => {
-            strings.push(`${_IModelApp__WEBPACK_IMPORTED_MODULE_4__.IModelApp.localization.getLocalizedString("iModelJs:MapLayers.ImageryLayer")}: ${imageryTreeRef.layerSettings.name}`);
+            // innerHTML is used below because imageryLoader.getToolTip may deliberately supply markup.
+            const layerName = (0,_internal__WEBPACK_IMPORTED_MODULE_7__.escapeHtml)(imageryTreeRef.layerSettings.name);
+            strings.push(`${_IModelApp__WEBPACK_IMPORTED_MODULE_4__.IModelApp.localization.getLocalizedString("iModelJs:MapLayers.ImageryLayer")}: ${layerName}`);
             carto = cartoGraphic;
             await imageryTree.imageryLoader.getToolTip(strings, quadId, cartoGraphic, imageryTree);
         };
@@ -186419,7 +187016,11 @@ class InteractiveTool extends Tool {
     async onPostInstall() { }
     /** Override Call to reset tool to initial state */
     async onReinitialize() { }
-    /** Invoked when the tool becomes no longer active, to perform additional cleanup logic */
+    /** Invoked when the tool becomes no longer active, to perform additional cleanup logic.
+     * Cleanup must not assume that the EditCommand associated with the tool is still active: an immediate tool may have finished or
+     * replaced it while this tool remained active. Tools must not start an EditCommand from onCleanup; ToolAdmin owns finishing the active EditCommand during tool cleanup.
+     * @note A ViewTool should never start an EditCommand. An InputCollector may start an EditCommand only if suspending a tool that supports EditManipulators (ex. SelectionTool).
+     */
     async onCleanup() { }
     /** Notification of a ViewTool or InputCollector starting and this tool is being suspended.
      * @note Applies only to PrimitiveTool and InputCollector, a ViewTool can't be suspended.
@@ -188593,23 +189194,54 @@ class ToolAdmin {
     }
     /** @internal */
     async setPrimitiveTool(newTool) {
-        if (undefined !== this._primitiveTool) {
-            await this._primitiveTool.onCleanup();
-            if (undefined !== this._editCommandHandler)
-                await this._editCommandHandler.finishCommand();
-            this._primitiveTool = undefined;
+        return this.setPrimitiveToolInternal(newTool);
+    }
+    async setPrimitiveToolInternal(newTool, pendingFinishCommand) {
+        const oldTool = this._primitiveTool;
+        let ownsOldTool = undefined === oldTool;
+        if (undefined !== oldTool) {
+            let mainError;
+            try {
+                await oldTool.onCleanup();
+            }
+            catch (err) {
+                mainError = (err instanceof Error) ? err : new Error(_itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.BentleyError.getErrorMessage(err));
+            }
+            try {
+                if (undefined !== pendingFinishCommand)
+                    await pendingFinishCommand;
+                else if (undefined !== this._editCommandHandler)
+                    await this._editCommandHandler.finishCommand();
+            }
+            catch (err) {
+                // throw finishCommand error if onCleanup succeeded, otherwise log finishCommand failure...
+                if (undefined === mainError)
+                    mainError = (err instanceof Error) ? err : new Error(_itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.BentleyError.getErrorMessage(err));
+                else
+                    _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logError(`${_common_FrontendLoggerCategory__WEBPACK_IMPORTED_MODULE_4__.FrontendLoggerCategory.Package}.toolAdmin`, err);
+            }
+            finally {
+                // Force-clear stale tool state if either onCleanup or finishCommand failed...
+                ownsOldTool = this._primitiveTool === oldTool;
+                if (ownsOldTool)
+                    this._primitiveTool = undefined;
+            }
+            if (undefined !== mainError)
+                throw mainError;
         }
-        this._primitiveTool = newTool;
+        // Do not let a delayed transition overwrite a tool installed by a newer transition.
+        if (ownsOldTool)
+            this._primitiveTool = newTool;
     }
-    // serialize concurrent starts to avoid two tools installing simultaneously.
-    _primitiveToolStarting;
+    // Serialize primitive starts and last-viewport cleanup to avoid overlapping transitions.
+    _primitiveToolTransition;
     /** @internal */
     async startPrimitiveTool(newTool) {
         // If another start is in progress wait for it to finish before proceeding.
-        while (undefined !== this._primitiveToolStarting)
-            await this._primitiveToolStarting;
-        let resolveStarting;
-        this._primitiveToolStarting = new Promise((r) => { resolveStarting = r; });
+        while (undefined !== this._primitiveToolTransition)
+            await this._primitiveToolTransition;
+        let resolveTransition;
+        const transition = this._primitiveToolTransition = new Promise((resolve) => { resolveTransition = resolve; });
         try {
             _IModelApp__WEBPACK_IMPORTED_MODULE_5__.IModelApp.notifications.outputPrompt("");
             await this.exitViewTool();
@@ -188637,9 +189269,9 @@ class ToolAdmin {
             this.onActiveToolChanged(activeTool, StartOrResume.Start);
         }
         finally {
-            if (resolveStarting)
-                resolveStarting();
-            this._primitiveToolStarting = undefined;
+            resolveTransition?.();
+            if (this._primitiveToolTransition === transition)
+                this._primitiveToolTransition = undefined;
         }
     }
     /** Method used by interactive tools to send updated values to UI components, typically showing tool settings.
@@ -188886,10 +189518,41 @@ class ToolAdmin {
     set coordinateLockOverrides(coordLockOvr) { this.toolState.coordLockOvr = coordLockOvr; }
     /** @internal */
     async callOnCleanup() {
-        await this.exitViewTool();
-        await this.exitInputCollector();
-        if (undefined !== this._primitiveTool)
-            await this._primitiveTool.onCleanup();
+        let pendingFinishCommand;
+        const previousTransition = this._primitiveToolTransition;
+        let resolveTransition;
+        const transition = this._primitiveToolTransition = new Promise((resolve) => { resolveTransition = resolve; });
+        try {
+            // Start the edit-command cleanup before the first await. ViewManager can invoke this method
+            // without awaiting it when the last viewport is dropped.
+            if (undefined !== this._editCommandHandler) {
+                const finishCommand = this._editCommandHandler.finishCommand();
+                // Attach a rejection handler immediately: another cleanup operation may fail before this promise is awaited.
+                pendingFinishCommand = finishCommand.catch((err) => {
+                    _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logError(`${_common_FrontendLoggerCategory__WEBPACK_IMPORTED_MODULE_4__.FrontendLoggerCategory.Package}.toolAdmin`, err);
+                    return "";
+                });
+            }
+            if (undefined !== previousTransition)
+                await previousTransition;
+            if (undefined !== this._viewTool)
+                await this.exitViewTool();
+            if (undefined !== this._inputCollector)
+                await this.exitInputCollector();
+            // Keep cleanup path consistent with other primitive-tool transitions.
+            if (undefined !== this._primitiveTool)
+                await this.setPrimitiveToolInternal(undefined, pendingFinishCommand); // NOTE: ViewManager.setSelectedView will call startDefaultTool if a new view is opened...
+            else if (undefined !== pendingFinishCommand)
+                await pendingFinishCommand;
+        }
+        catch (err) {
+            _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logError(`${_common_FrontendLoggerCategory__WEBPACK_IMPORTED_MODULE_4__.FrontendLoggerCategory.Package}.toolAdmin`, err);
+        }
+        finally {
+            resolveTransition?.();
+            if (this._primitiveToolTransition === transition)
+                this._primitiveToolTransition = undefined;
+        }
     }
 }
 /**
@@ -269880,18 +270543,19 @@ class PolyfaceQuery {
      */
     static dihedralAngleSummary(source, ignoreBoundaries = false) {
         // more info can be found at geometry/internaldocs/Polyface.md
+        // visit all facets and collect normals and edges
         const edges = new _IndexedEdgeMatcher__WEBPACK_IMPORTED_MODULE_29__.IndexedEdgeMatcher();
         const vertices = source instanceof _Polyface__WEBPACK_IMPORTED_MODULE_34__.Polyface ? source.data.point : undefined;
         const visitor = source instanceof _Polyface__WEBPACK_IMPORTED_MODULE_34__.Polyface ? source.createVisitor(1) : source;
         visitor.setNumWrap(1);
-        const centroidNormal = [];
+        const facetNormals = [];
         let normalCounter = 0;
         for (visitor.reset(); visitor.moveToNextFacet();) {
             const numEdges = visitor.pointCount - 1;
             const normal = _geometry3d_PolygonOps__WEBPACK_IMPORTED_MODULE_14__.PolygonOps.centroidAreaNormal(visitor.point);
             if (normal === undefined)
                 return -2;
-            centroidNormal.push(normal);
+            facetNormals.push(normal);
             for (let i = 0; i < numEdges; i++) {
                 const edge = edges.addEdge(visitor.clientPointIndex(i), visitor.clientPointIndex(i + 1), normalCounter);
                 if (!vertices) // decorate if we don't have vertices to query later
@@ -269907,21 +270571,24 @@ class PolyfaceQuery {
         edges.sortAndCollectClusters(manifoldClusters, ignoreBoundaries ? undefined : badClusters, undefined, badClusters);
         if (badClusters.length > 0)
             return -2;
-        // find angle between facet centroid normals (dihedral angles)
+        // find angle between facet normals (dihedral angles)
         let numPositive = 0;
         let numPlanar = 0;
         let numNegative = 0;
         const edgeVector = _geometry3d_Point3dVector3d__WEBPACK_IMPORTED_MODULE_12__.Vector3d.create();
         for (const cluster of manifoldClusters) {
             if (Array.isArray(cluster) && cluster.length === 2) {
-                const sideA = cluster[0];
-                const sideB = cluster[1];
-                if (vertices)
-                    vertices.vectorIndexIndex(sideA.startVertex, sideA.endVertex, edgeVector);
-                else
+                const sideA = cluster[0]; // edge on facetA
+                const sideB = cluster[1]; // edge on facetB
+                if (vertices) {
+                    if (!vertices.vectorIndexIndex(sideA.startVertex, sideA.endVertex, edgeVector))
+                        return -2;
+                }
+                else {
                     edgeVector.setFrom(sideA.edgeVector);
-                const facetNormalA = centroidNormal[sideA.facetIndex].direction;
-                const facetNormalB = centroidNormal[sideB.facetIndex].direction;
+                }
+                const facetNormalA = facetNormals[sideA.facetIndex].direction;
+                const facetNormalB = facetNormals[sideB.facetIndex].direction;
                 const dihedralAngle = facetNormalA.signedAngleTo(facetNormalB, edgeVector);
                 if (dihedralAngle.isAlmostZero)
                     numPlanar++;
@@ -334348,6 +335015,1170 @@ var loadLanguages = instance.loadLanguages;
 
 
 
+/***/ },
+
+/***/ "../../common/temp/node_modules/.pnpm/wms-capabilities@0.6.0/node_modules/wms-capabilities/dist/wms-capabilities.mjs"
+/*!***************************************************************************************************************************!*\
+  !*** ../../common/temp/node_modules/.pnpm/wms-capabilities@0.6.0/node_modules/wms-capabilities/dist/wms-capabilities.mjs ***!
+  \***************************************************************************************************************************/
+(__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) {
+
+"use strict";
+__webpack_require__.r(__webpack_exports__);
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   "default": () => (/* binding */ WMS)
+/* harmony export */ });
+
+/**
+ * wms-capabilities @0.6.0
+ * @description WMS service Capabilities > JSON, based on openlayers 
+ * @license BSD-2-Clause
+ * @preserve
+ */
+
+/**
+ * Returns true if the specified value is not undefined.
+ *
+ * @param {?} val Variable to test.
+ * @return {Boolean} Whether variable is defined.
+ */
+var isDef = (val) => val !== void 0;
+
+/**
+ * Adds a key-value pair to the object/map/hash if it doesn't exist yet.
+ *
+ * @param {Object.<K,V>} obj The object to which to add the key-value pair.
+ * @param {String} key The key to add.
+ * @param {V} value The value to add if the key wasn't present.
+ * @return {V} The value of the entry at the end of the function.
+ * @template K,V
+ */
+var setIfUndefined = (obj, key, value) => key in obj ? obj[key] : (obj[key] = value);
+
+/**
+ * @enum {Number}
+ */
+const NODE_TYPES = {
+  ELEMENT: 1,
+  ATTRIBUTE: 2,
+  TEXT: 3,
+  CDATA_SECTION: 4,
+  ENTITY_REFERENCE: 5,
+  ENTITY: 6,
+  PROCESSING_INSTRUCTION: 7,
+  COMMENT: 8,
+  DOCUMENT: 9,
+  DOCUMENT_TYPE: 10,
+  DOCUMENT_FRAGMENT: 11,
+  NOTATION: 12
+};
+
+class XMLParser {
+  /**
+   * XML DOM parser
+   * @constructor
+   * @param {DOMParser} DOMParser
+   */
+  constructor (DOMParser) {
+    /**
+     * @type {DOMParser}
+     */
+    this._parser = new DOMParser();
+  };
+
+  /**
+   * @param  {String} xmlstring
+   * @return {Document}
+   */
+  toDocument (xmlstring) {
+    return this._parser.parseFromString(xmlstring, 'application/xml');
+  }
+
+  /**
+   * Recursively grab all text content of child nodes into a single string.
+   * @param {Node} node Node.
+   * @param {boolean} normalizeWhitespace Normalize whitespace: remove all line
+   * breaks.
+   * @return {string} All text content.
+   * @api
+   */
+  getAllTextContent (node, normalizeWhitespace) {
+    return getAllTextContent(node, normalizeWhitespace).join('');
+  }
+}
+
+
+/**
+* Recursively grab all text content of child nodes into a single string.
+* @param {Node} node Node.
+* @param {boolean} normalizeWhitespace Normalize whitespace: remove all line
+* breaks.
+* @return {string} All text content.
+* @api
+*/
+function getAllTextContent (node, normalizeWhitespace) {
+ return getAllTextContentInternal(node, normalizeWhitespace, []).join('');
+}
+
+
+/**
+ * @param {Node} node Node.
+ * @param {boolean} normalizeWhitespace Normalize whitespace: remove all line
+ * breaks.
+ * @param {Array.<String|string>} accumulator Accumulator.
+ * @private
+ * @return {Array.<String|string>} Accumulator.
+ */
+function getAllTextContentInternal (node, normalizeWhitespace, accumulator) {
+  if (node.nodeType === NODE_TYPES.CDATA_SECTION ||
+    node.nodeType === NODE_TYPES.TEXT) {
+    if (normalizeWhitespace) {
+      // FIXME understand why goog.dom.getTextContent_ uses String here
+      accumulator.push(String(node.nodeValue).replace(/(\r\n|\r|\n)/g, ''));
+    } else {
+      accumulator.push(node.nodeValue);
+    }
+  } else {
+    var n;
+    for (n = node.firstChild; n; n = n.nextSibling) {
+      getAllTextContentInternal(n, normalizeWhitespace, accumulator);
+    }
+  }
+  return accumulator;
+}
+
+/**
+ * @param {Object.<string, Object.<string, XMLParser.Parser>>} parsersNS
+ *     Parsers by namespace.
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @param {*=} bind The object to use as `this`.
+ */
+function parseNode (parsersNS, node, objectStack, bind) {
+  for (var n = firstElementChild(node); n; n = nextElementSibling(n)) {
+    var namespaceURI = n.namespaceURI || null;
+    var parsers = parsersNS[namespaceURI];
+    if (isDef(parsers)) {
+      var parser = parsers[n.localName];
+      if (isDef(parser)) {
+        parser.call(bind, n, objectStack);
+      }
+    }
+  }
+}
+
+/**
+ * Mostly for node.js
+ * @param  {Node} node
+ * @return {Node}
+ */
+function firstElementChild (node) {
+  let firstElementChild = node.firstElementChild || node.firstChild;
+  while (firstElementChild && firstElementChild.nodeType !== NODE_TYPES.ELEMENT) {
+    firstElementChild = firstElementChild.nextSibling;
+  }
+  return firstElementChild;
+}
+
+/**
+ * Mostly for node.js
+ * @param  {Node} node
+ * @return {Node}
+ */
+function nextElementSibling (node) {
+  let nextSibling = node.nextElementSibling || node.nextSibling;
+  while (nextSibling && nextSibling.nodeType !== NODE_TYPES.ELEMENT) {
+    nextSibling = nextSibling.nextSibling;
+  }
+  return nextSibling;
+}
+
+/**
+ * @param {Array.<string>} namespaceURIs Namespace URIs.
+ * @param {Object.<string, XMLParser.Parser>} parsers Parsers.
+ * @param {Object.<string, Object.<string, XMLParser.Parser>>=} opt_parsersNS
+ *     ParsersNS.
+ * @return {Object.<string, Object.<string, XMLParser.Parser>>} Parsers NS.
+ */
+function makeParsersNS (namespaceURIs, parsers, opt_parsersNS) {
+  return /** @type {Object.<string, Object.<string, XMLParser.Parser>>} */ (
+    makeStructureNS(namespaceURIs, parsers, opt_parsersNS));
+}
+
+/**
+ * Creates a namespaced structure, using the same values for each namespace.
+ * This can be used as a starting point for versioned parsers, when only a few
+ * values are version specific.
+ * @param {Array.<string>} namespaceURIs Namespace URIs.
+ * @param {T} structure Structure.
+ * @param {Object.<string, T>=} opt_structureNS Namespaced structure to add to.
+ * @return {Object.<string, T>} Namespaced structure.
+ * @template T
+ */
+function makeStructureNS (namespaceURIs, structure, opt_structureNS) {
+  /**
+   * @type {Object.<string, *>}
+   */
+  var structureNS = isDef(opt_structureNS) ? opt_structureNS : {};
+  var i, ii;
+  for (i = 0, ii = namespaceURIs.length; i < ii; ++i) {
+    structureNS[namespaceURIs[i]] = structure;
+  }
+  return structureNS;
+}
+
+
+/**
+ * @param {function(this: T, Node, Array.<*>): *} valueReader Value reader.
+ * @param {T=} opt_this The object to use as `this` in `valueReader`.
+ * @return {Function} Parser.
+ * @template T
+ */
+function makeArrayPusher (valueReader, opt_this) {
+  return (
+    /**
+     * @param {Node} node Node.
+     * @param {Array.<*>} objectStack Object stack.
+     */
+    function(node, objectStack) {
+      var value = valueReader.call(isDef(opt_this) ? opt_this : this,
+        node, objectStack);
+      if (isDef(value)) {
+        var array = objectStack[objectStack.length - 1];
+        array.push(value);
+      }
+    });
+}
+
+/**
+ * @param {Object}                                     object Object.
+ * @param {Object.<String, Object.<String, Function>>} parsersNS Parsers by namespace.
+ * @param {Node}                                       node Node.
+ * @param {Array.<*>}                                  objectStack Object stack.
+ * @param {*=}                                         bind The object to use as `this`.
+ * @return {Object|undefined} Object.
+ */
+function pushParseAndPop (object, parsersNS, node, objectStack, bind) {
+  objectStack.push(object);
+  parseNode(parsersNS, node, objectStack, bind);
+  return objectStack.pop();
+}
+
+
+/**
+ * @param {function(this: T, Node, Array.<*>): *} valueReader Value reader.
+ * @param {string=} opt_property Property.
+ * @param {T=} opt_this The object to use as `this` in `valueReader`.
+ * @return {XMLParser.Parser} Parser.
+ * @template T
+ */
+function makeObjectPropertySetter (valueReader, opt_property, opt_this) {
+  return (
+    /**
+     * @param {Node} node Node.
+     * @param {Array.<*>} objectStack Object stack.
+     */
+    function(node, objectStack) {
+      let value = valueReader.call(isDef(opt_this) ? opt_this : this,
+        node, objectStack);
+      if (isDef(value)) {
+        var object = /** @type {Object} */ (objectStack[objectStack.length - 1]);
+        var property = isDef(opt_property) ? opt_property : node.localName;
+        object[property] = value;
+      }
+    });
+}
+
+
+/**
+   * @param {function(this: T, Node, Array.<*>): *} valueReader Value reader.
+   * @param {string=} opt_property Property.
+   * @param {T=} opt_this The object to use as `this` in `valueReader`.
+   * @return {Function} Parser.
+   * @template T
+   */
+function makeObjectPropertyPusher (valueReader, opt_property, opt_this) {
+  return (
+    /**
+     * @param {Node} node Node.
+     * @param {Array.<*>} objectStack Object stack.
+     */
+    function(node, objectStack) {
+      var value = valueReader.call(isDef(opt_this) ? opt_this : this,
+        node, objectStack);
+
+      if (isDef(value)) {
+        var object = /** @type {Object} */ (objectStack[objectStack.length - 1]);
+        var property = isDef(opt_property) ? opt_property : node.localName;
+        var array = setIfUndefined(object, property, []);
+        array.push(value);
+      }
+    });
+  }
+
+/**
+ * Make sure we trim BOM and NBSP
+ * @type {RegExp}
+ */
+const TRIM_RE = /^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g;
+
+/**
+ * @param  {String} str
+ * @return {String}
+ */
+function trim (str) {
+  return str.replace(TRIM_RE, '');
+}
+
+/**
+ * @param {string} string String.
+ * @return {boolean|undefined} Boolean.
+ */
+function readBooleanString (string) {
+  const m = /^\s*(true|1)|(false|0)\s*$/.exec(string);
+  if (m) {
+    return isDef(m[1]) || false;
+  } else {
+    return undefined;
+  }
+}
+
+
+/**
+ * @param {Node} node Node.
+ * @return {number|undefined} Decimal.
+ */
+function readDecimal (node) {
+  return readDecimalString(getAllTextContent(node, false));
+}
+
+
+/**
+ * @param {string} string String.
+ * @return {number|undefined} Decimal.
+ */
+function readDecimalString (string) {
+  // FIXME check spec
+  const m = /^\s*([+\-]?\d*\.?\d+(?:e[+\-]?\d+)?)\s*$/i.exec(string);
+  if (m) {
+    return parseFloat(m[1]);
+  } else {
+    return undefined;
+  }
+}
+
+
+/**
+ * @param {Node} node Node.
+ * @return {number|undefined} Non negative integer.
+ */
+function readNonNegativeInteger (node) {
+  return readNonNegativeIntegerString(getAllTextContent(node, false));
+}
+
+
+/**
+ * @param {string} string String.
+ * @return {number|undefined} Non negative integer.
+ */
+function  readNonNegativeIntegerString (string) {
+  const m = /^\s*(\d+)\s*$/.exec(string);
+  if (m) {
+    return parseInt(m[1], 10);
+  } else {
+    return undefined;
+  }
+}
+
+
+/**
+ * @param {Node} node Node.
+ * @return {string|undefined} String.
+ */
+function readString (node) {
+  return trim(getAllTextContent(node, false));
+}
+
+/**
+ * @const
+ * @type {string}
+ */
+const NAMESPACE_URI = 'http://www.w3.org/1999/xlink';
+
+/**
+ * @param {Node} node Node.
+ * @return {Boolean|undefined} Boolean.
+ */
+function readHref (node) {
+  return node.getAttributeNS(NAMESPACE_URI, 'href');
+}
+
+/**
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object|undefined} Attribution object.
+ */
+function readAttribution(node, objectStack) {
+  return pushParseAndPop({}, ATTRIBUTION_PARSERS, node, objectStack);
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @return {ol.Extent} Bounding box object.
+ */
+function readBoundingBoxExtent (node) {
+  return [
+    readDecimalString(node.getAttribute('minx')),
+    readDecimalString(node.getAttribute('miny')),
+    readDecimalString(node.getAttribute('maxx')),
+    readDecimalString(node.getAttribute('maxy'))
+  ];
+}
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object} Bounding box object.
+ */
+function readBoundingBox (node, objectStack) {
+  const extent = readBoundingBoxExtent(node);
+  const resolutions = [
+    readDecimalString(node.getAttribute('resx')),
+    readDecimalString(node.getAttribute('resy'))
+  ];
+
+  return {
+    'crs': node.getAttribute('CRS') || node.getAttribute('SRS'),
+    extent, res: resolutions
+  };
+}
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {ol.Extent|undefined} Bounding box object.
+ */
+function readLatLonBoundingBox (node, objectStack) {
+  const extent = readBoundingBoxExtent(node);
+
+  if (!isDef(extent[0]) || !isDef(extent[1]) ||
+    !isDef(extent[2]) || !isDef(extent[3])) {
+    return undefined;
+  }
+
+  return extent;
+}
+
+
+/**
+ * @privat
+ * @param  {Node} node  Node
+ * @param  {Arra.<Object>} objectStack Object stack
+ * @return {Object}
+ */
+function readScaleHint (node, objectStack) {
+  const min = parseFloat(node.getAttribute('min'));
+  const max = parseFloat(node.getAttribute('max'));
+
+  return { min, max };
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {ol.Extent|undefined} Bounding box object.
+ */
+function readEXGeographicBoundingBox (node, objectStack) {
+  const geographicBoundingBox = pushParseAndPop({},
+    EX_GEOGRAPHIC_BOUNDING_BOX_PARSERS,
+    node, objectStack);
+  if (!isDef(geographicBoundingBox)) return undefined;
+
+  const westBoundLongitude = /** @type {number|undefined} */
+    (geographicBoundingBox['westBoundLongitude']);
+  const southBoundLatitude = /** @type {number|undefined} */
+    (geographicBoundingBox['southBoundLatitude']);
+  const eastBoundLongitude = /** @type {number|undefined} */
+    (geographicBoundingBox['eastBoundLongitude']);
+  const northBoundLatitude = /** @type {number|undefined} */
+    (geographicBoundingBox['northBoundLatitude']);
+
+  if (!isDef(westBoundLongitude) || !isDef(southBoundLatitude) ||
+    !isDef(eastBoundLongitude) || !isDef(northBoundLatitude)) {
+    return undefined;
+  }
+
+  return [
+    westBoundLongitude, southBoundLatitude,
+    eastBoundLongitude, northBoundLatitude
+  ];
+}
+
+
+/**
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @private
+ * @return {Object|undefined} Capability object.
+ */
+function readCapability (node, objectStack) {
+  return pushParseAndPop({}, CAPABILITY_PARSERS, node, objectStack);
+}
+
+
+/**
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @private
+ * @return {Object|undefined} Service object.
+ */
+function readService (node, objectStack) {
+  return pushParseAndPop({}, SERVICE_PARSERS, node, objectStack);
+}
+
+
+/**
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @private
+ * @return {Object|undefined} Contact information object.
+ */
+function readContactInformation (node, objectStack) {
+  return pushParseAndPop({}, CONTACT_INFORMATION_PARSERS,
+    node, objectStack);
+}
+
+
+/**
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @private
+ * @return {Object|undefined} Contact person object.
+ */
+function readContactPersonPrimary (node, objectStack) {
+  return pushParseAndPop({}, CONTACT_PERSON_PARSERS,
+    node, objectStack);
+}
+
+
+/**
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @private
+ * @return {Object|undefined} Contact address object.
+ */
+function readContactAddress (node, objectStack) {
+  return pushParseAndPop({}, CONTACT_ADDRESS_PARSERS,
+    node, objectStack);
+}
+
+
+/**
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @private
+ * @return {Array.<string>|undefined} Format array.
+ */
+function readException (node, objectStack) {
+  return pushParseAndPop(
+    [], EXCEPTION_PARSERS, node, objectStack);
+}
+
+
+/**
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @private
+ * @return {Object|undefined} Layer object.
+ */
+function readCapabilityLayer (node, objectStack) {
+  const queryable = readBooleanString(node.getAttribute('queryable'));  
+  return pushParseAndPop({
+    queryable: isDef(queryable) ? queryable : false }, 
+    LAYER_PARSERS, node, objectStack);
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object|undefined} Layer object.
+ */
+function readLayer (node, objectStack) {
+  var parentLayerObject = /**  @type {Object.<string,*>} */
+    (objectStack[objectStack.length - 1]);
+
+  const layerObject = /**  @type {Object.<string,*>} */
+    (pushParseAndPop({}, LAYER_PARSERS,
+      node, objectStack));
+
+  if (!isDef(layerObject)) return undefined;
+
+  let queryable = readBooleanString(node.getAttribute('queryable'));
+  if (!isDef(queryable)) {
+    queryable = parentLayerObject['queryable'];
+  }
+  layerObject['queryable'] = isDef(queryable) ? queryable : false;
+
+  let cascaded = readNonNegativeIntegerString(node.getAttribute('cascaded'));
+  if (!isDef(cascaded)) {
+    cascaded = parentLayerObject['cascaded'];
+  }
+  layerObject['cascaded'] = cascaded;
+
+  let opaque = readBooleanString(node.getAttribute('opaque'));
+  if (!isDef(opaque)) {
+    opaque = parentLayerObject['opaque'];
+  }
+  layerObject['opaque'] = isDef(opaque) ? opaque : false;
+
+  let noSubsets = readBooleanString(node.getAttribute('noSubsets'));
+  if (!isDef(noSubsets)) {
+    noSubsets = parentLayerObject['noSubsets'];
+  }
+  layerObject['noSubsets'] = isDef(noSubsets) ? noSubsets : false;
+
+  let fixedWidth = readDecimalString(node.getAttribute('fixedWidth'));
+  if (!isDef(fixedWidth)) {
+    fixedWidth = parentLayerObject['fixedWidth'];
+  }
+  layerObject['fixedWidth'] = fixedWidth;
+
+  let fixedHeight = readDecimalString(node.getAttribute('fixedHeight'));
+  if (!isDef(fixedHeight)) {
+    fixedHeight = parentLayerObject['fixedHeight'];
+  }
+  layerObject['fixedHeight'] = fixedHeight;
+
+  // See 7.2.4.8
+  const addKeys = ['Style', 'CRS', 'AuthorityURL'];
+  for (let i = 0, len = addKeys.length; i < len; i++) {
+    const key = addKeys[i];
+    const parentValue = parentLayerObject[key];
+    if (isDef(parentValue)) {
+      let childValue = setIfUndefined(layerObject, key, []);
+      childValue = childValue.concat(parentValue);
+      layerObject[key] = childValue;
+    }
+  }
+
+  const replaceKeys = ['EX_GeographicBoundingBox', 'BoundingBox', 'Dimension',
+    'Attribution', 'MinScaleDenominator', 'MaxScaleDenominator'
+  ];
+  for (let i = 0, len = replaceKeys.length; i < len; i++) {
+    const key = replaceKeys[i];
+    const childValue = layerObject[key];
+    if (!isDef(childValue)) {
+      const parentValue = parentLayerObject[key];
+      layerObject[key] = parentValue;
+    }
+  }
+
+  return layerObject;
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object} Dimension object.
+ */
+function readDimension (node, objectStack) {
+  return {
+    'name': node.getAttribute('name'),
+    'units': node.getAttribute('units'),
+    'unitSymbol': node.getAttribute('unitSymbol'),
+    'default': node.getAttribute('default'),
+    'multipleValues': readBooleanString(node.getAttribute('multipleValues')),
+    'nearestValue': readBooleanString(node.getAttribute('nearestValue')),
+    'current': readBooleanString(node.getAttribute('current')),
+    'values': readString(node)
+  };
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object|undefined} Online resource object.
+ */
+function readFormatOnlineresource (node, objectStack) {
+  return pushParseAndPop({}, FORMAT_ONLINERESOURCE_PARSERS,
+    node, objectStack);
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object|undefined} Request object.
+ */
+function readRequest (node, objectStack) {
+  return pushParseAndPop({}, REQUEST_PARSERS, node, objectStack);
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object|undefined} DCP type object.
+ */
+function readDCPType (node, objectStack) {
+  return pushParseAndPop({}, DCPTYPE_PARSERS, node, objectStack);
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object|undefined} HTTP object.
+ */
+function readHTTP (node, objectStack) {
+  return pushParseAndPop({}, HTTP_PARSERS, node, objectStack);
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object|undefined} Operation type object.
+ */
+function readOperationType (node, objectStack) {
+  return pushParseAndPop({}, OPERATIONTYPE_PARSERS, node, objectStack);
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object|undefined} Online resource object.
+ */
+function readSizedFormatOnlineresource (node, objectStack) {
+  var formatOnlineresource = readFormatOnlineresource(node, objectStack);
+  if (isDef(formatOnlineresource)) {
+    const size = [
+      readNonNegativeIntegerString(node.getAttribute('width')),
+      readNonNegativeIntegerString(node.getAttribute('height'))
+    ];
+    formatOnlineresource['size'] = size;
+    return formatOnlineresource;
+  }
+  return undefined;
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object|undefined} Authority URL object.
+ */
+function readAuthorityURL (node, objectStack) {
+  var authorityObject = readFormatOnlineresource(node, objectStack);
+  if (isDef(authorityObject)) {
+    authorityObject['name'] = node.getAttribute('name');
+    return authorityObject;
+  }
+  return undefined;
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object|undefined} Metadata URL object.
+ */
+function readMetadataURL (node, objectStack) {
+  var metadataObject = readFormatOnlineresource(node, objectStack);
+  if (isDef(metadataObject)) {
+    metadataObject['type'] = node.getAttribute('type');
+    return metadataObject;
+  }
+  return undefined;
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Object|undefined} Style object.
+ */
+function readStyle (node, objectStack) {
+  return pushParseAndPop({}, STYLE_PARSERS, node, objectStack);
+}
+
+
+/**
+ * @private
+ * @param {Node} node Node.
+ * @param {Array.<*>} objectStack Object stack.
+ * @return {Array.<string>|undefined} Keyword list.
+ */
+function readKeywordList (node, objectStack) {
+  return pushParseAndPop(
+    [], KEYWORDLIST_PARSERS, node, objectStack);
+}
+
+
+/**
+ * @const
+ * @type {Array.<string>}
+ */
+const NAMESPACE_URIS = [
+  null,
+  'http://www.opengis.net/wms'
+];
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'Service': makeObjectPropertySetter(readService),
+    'Capability': makeObjectPropertySetter(readCapability)
+  });
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const CAPABILITY_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'Request': makeObjectPropertySetter(readRequest),
+    'Exception': makeObjectPropertySetter(readException),
+    'Layer': makeObjectPropertySetter(readCapabilityLayer)
+  });
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const SERVICE_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'Name': makeObjectPropertySetter(readString),
+    'Title': makeObjectPropertySetter(readString),
+    'Abstract': makeObjectPropertySetter(readString),
+    'KeywordList': makeObjectPropertySetter(readKeywordList),
+    'OnlineResource': makeObjectPropertySetter(readHref),
+    'ContactInformation': makeObjectPropertySetter(readContactInformation),
+    'Fees': makeObjectPropertySetter(readString),
+    'AccessConstraints': makeObjectPropertySetter(readString),
+    'LayerLimit': makeObjectPropertySetter(readNonNegativeInteger),
+    'MaxWidth': makeObjectPropertySetter(readNonNegativeInteger),
+    'MaxHeight': makeObjectPropertySetter(readNonNegativeInteger)
+  });
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const CONTACT_INFORMATION_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'ContactPersonPrimary': makeObjectPropertySetter(readContactPersonPrimary),
+    'ContactPosition': makeObjectPropertySetter(readString),
+    'ContactAddress': makeObjectPropertySetter(readContactAddress),
+    'ContactVoiceTelephone': makeObjectPropertySetter(readString),
+    'ContactFacsimileTelephone': makeObjectPropertySetter(readString),
+    'ContactElectronicMailAddress': makeObjectPropertySetter(readString)
+  });
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const CONTACT_PERSON_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'ContactPerson': makeObjectPropertySetter(readString),
+    'ContactOrganization': makeObjectPropertySetter(readString)
+  });
+
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const CONTACT_ADDRESS_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'AddressType': makeObjectPropertySetter(readString),
+    'Address': makeObjectPropertySetter(readString),
+    'City': makeObjectPropertySetter(readString),
+    'StateOrProvince': makeObjectPropertySetter(readString),
+    'PostCode': makeObjectPropertySetter(readString),
+    'Country': makeObjectPropertySetter(readString)
+  });
+
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const EXCEPTION_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'Format': makeArrayPusher(readString)
+  });
+
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const LAYER_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'Name': makeObjectPropertySetter(readString),
+    'Title': makeObjectPropertySetter(readString),
+    'Abstract': makeObjectPropertySetter(readString),
+    'KeywordList': makeObjectPropertySetter(readKeywordList),
+    'CRS': makeObjectPropertyPusher(readString),
+    'SRS': makeObjectPropertyPusher(readString),
+    'EX_GeographicBoundingBox': makeObjectPropertySetter(readEXGeographicBoundingBox),
+    'LatLonBoundingBox': makeObjectPropertySetter(readLatLonBoundingBox),
+    'BoundingBox': makeObjectPropertyPusher(readBoundingBox),
+    'Dimension': makeObjectPropertyPusher(readDimension),
+    'Attribution': makeObjectPropertySetter(readAttribution),
+    'AuthorityURL': makeObjectPropertyPusher(readAuthorityURL),
+    'Identifier': makeObjectPropertyPusher(readString),
+    'MetadataURL': makeObjectPropertyPusher(readMetadataURL),
+    'DataURL': makeObjectPropertyPusher(readFormatOnlineresource),
+    'FeatureListURL': makeObjectPropertyPusher(readFormatOnlineresource),
+    'Style': makeObjectPropertyPusher(readStyle),
+    'MinScaleDenominator': makeObjectPropertySetter(readDecimal),
+    'MaxScaleDenominator': makeObjectPropertySetter(readDecimal),
+    'ScaleHint': makeObjectPropertySetter(readScaleHint),
+    'Layer': makeObjectPropertyPusher(readLayer)
+  });
+
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const ATTRIBUTION_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'Title': makeObjectPropertySetter(readString),
+    'OnlineResource': makeObjectPropertySetter(readHref),
+    'LogoURL': makeObjectPropertySetter(readSizedFormatOnlineresource)
+  });
+
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const EX_GEOGRAPHIC_BOUNDING_BOX_PARSERS =
+  makeParsersNS(NAMESPACE_URIS, {
+    'westBoundLongitude': makeObjectPropertySetter(readDecimal),
+    'eastBoundLongitude': makeObjectPropertySetter(readDecimal),
+    'southBoundLatitude': makeObjectPropertySetter(readDecimal),
+    'northBoundLatitude': makeObjectPropertySetter(readDecimal)
+  });
+
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const REQUEST_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'GetCapabilities': makeObjectPropertySetter(
+      readOperationType),
+    'GetMap': makeObjectPropertySetter(
+      readOperationType),
+    'GetFeatureInfo': makeObjectPropertySetter(
+      readOperationType)
+  });
+
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const OPERATIONTYPE_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'Format': makeObjectPropertyPusher(readString),
+    'DCPType': makeObjectPropertyPusher(
+      readDCPType)
+  });
+
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const DCPTYPE_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'HTTP': makeObjectPropertySetter(
+      readHTTP)
+  });
+
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const HTTP_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'Get': makeObjectPropertySetter(
+      readFormatOnlineresource),
+    'Post': makeObjectPropertySetter(
+      readFormatOnlineresource)
+  });
+
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const STYLE_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'Name': makeObjectPropertySetter(readString),
+    'Title': makeObjectPropertySetter(readString),
+    'Abstract': makeObjectPropertySetter(readString),
+    'LegendURL': makeObjectPropertyPusher(readSizedFormatOnlineresource),
+    'StyleSheetURL': makeObjectPropertySetter(readFormatOnlineresource),
+    'StyleURL': makeObjectPropertySetter(readFormatOnlineresource)
+  });
+
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const FORMAT_ONLINERESOURCE_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'Format': makeObjectPropertySetter(readString),
+    'OnlineResource': makeObjectPropertySetter(readHref)
+  });
+
+
+/**
+ * @const
+ * @type {Object.<string, Object.<string, XMLParser.Parser>>}
+ * @private
+ */
+const KEYWORDLIST_PARSERS = makeParsersNS(
+  NAMESPACE_URIS, {
+    'Keyword': makeArrayPusher(readString)
+  });
+
+class WMS {
+  /**
+   * WMS Capabilities parser
+   *
+   * @param {String=} xmlString
+   * @constructor
+   */
+  constructor(xmlString, DOMParser) {
+    if (!DOMParser && typeof window !== 'undefined') {
+      DOMParser = window.DOMParser;
+    }
+
+    /**
+     * @type {String}
+     */
+    this.version = undefined;
+
+    /**
+     * @type {XMLParser}
+     */
+    this._parser = new XMLParser(DOMParser);
+
+    /**
+     * @type {String=}
+     */
+    this._data = xmlString;
+  }
+
+
+  /**
+   * @param {String} xmlString
+   * @return {WMS}
+   */
+  data (xmlString) {
+    this._data = xmlString;
+    return this;
+  }
+
+  /**
+   * @param  {String=} xmlString
+   * @return {Object|null}
+   */
+  toJSON (xmlString) {
+    xmlString = xmlString || this._data;
+    return this.parse(xmlString);
+  }
+
+  /**
+   * @return {String} xml
+   * @return {Object|null}
+   */
+  parse (xmlString) {
+    return this.readFromDocument(this._parser.toDocument(xmlString));
+  }
+
+  /**
+   * @param  {Document} doc
+   * @return {Object|null}
+   */
+  readFromDocument (doc) {
+    for (let node = doc.firstChild; node; node = node.nextSibling) {
+      if (node.nodeType == NODE_TYPES.ELEMENT) {
+        return this.readFromNode(node);
+      }
+    }
+    return null;
+  }
+
+  /**
+   * @param  {DOMNode} node
+   * @return {Object}
+   */
+  readFromNode (node) {
+    this.version = node.getAttribute('version');
+    const wmsCapabilityObject = pushParseAndPop({
+      'version': this.version
+    }, PARSERS, node, []);
+
+    return wmsCapabilityObject || null;
+  }
+}
+
+
+//# sourceMappingURL=wms-capabilities.mjs.map
+
+
 /***/ },
 
 /***/ "../../core/frontend/package.json"
@@ -334357,7 +336188,7 @@ var loadLanguages = instance.loadLanguages;
 (module) {
 
 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"name":"@itwin/core-frontend","version":"5.13.0-dev.9","description":"iTwin.js frontend components","main":"lib/cjs/core-frontend.js","module":"lib/esm/core-frontend.js","typings":"lib/cjs/core-frontend","license":"MIT","scripts":{"build":"npm run -s copy:public && npm run -s build:cjs && npm run -s build:esm && npm run -s build:workers && npm run -s copy:draco","build:cjs":"npm run -s copy:js:cjs && tsc 1>&2 --outDir lib/cjs","build:esm":"npm run -s copy:js:esm && tsc 1>&2 --module ES2022 --outDir lib/esm","clean":"rimraf -g lib .rush/temp/package-deps*.json","copy:public":"cpx \\"./src/public/**/*\\" ./lib/public","copy:js:cjs":"cpx \\"./src/**/*.js\\" ./lib/cjs","copy:js:esm":"cpx \\"./src/**/*.js\\" ./lib/esm","copy:draco":"cpx \\"./node_modules/@loaders.gl/draco/dist/libs/*\\" ./lib/public/scripts","docs":"betools docs --json=../../generated-docs/core/core-frontend/file.json --tsIndexFile=./core-frontend.ts --onlyJson --excludes=webgl/**/*,**/map/*.d.ts,**/tile/*.d.ts,**/*-css.ts && npm run -s extract","extract":"betools extract --fileExt=ts --extractFrom=./src/test/example-code --recursive --out=../../generated-docs/extract","extract-api":"betools extract-api --entry=core-frontend && npm run extract-extension-api","extract-extension-api":"eslint --no-inline-config -c extraction.eslint.config.js  \\"./src/**/*.ts\\" 1>&2","lint":"eslint \\"./src/**/*.ts\\" 1>&2","lint-fix":"eslint --fix -f visualstudio \\"./src/**/*.ts\\" 1>&2","lint-deprecation":"eslint --fix -f visualstudio --no-inline-config -c ../../common/config/eslint/eslint.config.deprecation-policy.js \\"./src/**/*.ts\\"","pseudolocalize":"betools pseudolocalize --englishDir ./src/public/locales/en --out ./public/locales/en-PSEUDO","test":"npm run build:test-worker && vitest --run","cover":"npm run build:test-worker && vitest --run","build:test-worker":"vite build --config ./src/test/worker/vite.config.mts 1>&2","build:workers":"rimraf lib/workers/webpack && vite build --config ./src/workers/ImdlParser/vite.config.mts 1>&2"},"repository":{"type":"git","url":"https://github.com/iTwin/itwinjs-core.git","directory":"core/frontend"},"keywords":["Bentley","BIM","iModel","digital-twin","iTwin"],"author":{"name":"Bentley Systems, Inc.","url":"http://www.bentley.com"},"peerDependencies":{"@itwin/appui-abstract":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*"},"//devDependencies":["NOTE: All peerDependencies should also be listed as devDependencies since peerDependencies are not considered by npm install","NOTE: All tools used by scripts in this package must be listed as devDependencies"],"devDependencies":{"@bentley/aec-units-schema":"^1.0.3","@bentley/formats-schema":"^1.0.0","@bentley/units-schema":"^1.0.11","@itwin/appui-abstract":"workspace:*","@itwin/build-tools":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*","@itwin/object-storage-core":"^3.0.4","@itwin/eslint-plugin":"^6.0.0","@types/chai-as-promised":"^7","@types/draco3d":"^1.4.10","@types/node":"~20.17.0","@types/sinon":"^17.0.2","@vitest/browser-playwright":"^4.1.10","@vitest/coverage-v8":"^4.1.10","cpx2":"^8.0.0","eslint":"^9.31.0","playwright":"~1.56.1","rimraf":"^6.0.1","sinon":"^17.0.2","typescript":"~5.6.2","vite":"^6.4.3","vitest":"^4.1.10","vite-multiple-assets":"^1.3.1","vite-plugin-static-copy":"2.2.0"},"//dependencies":["NOTE: these dependencies should be only for things that DO NOT APPEAR IN THE API","NOTE: core-frontend should remain UI technology agnostic, so no react/angular dependencies are allowed"],"dependencies":{"@itwin/core-i18n":"workspace:*","@itwin/webgl-compatibility":"workspace:*","@loaders.gl/core":"~4.3.4","@loaders.gl/draco":"~4.3.4","fuse.js":"^3.3.0","wms-capabilities":"0.4.0"}}');
+module.exports = /*#__PURE__*/JSON.parse('{"name":"@itwin/core-frontend","version":"5.14.0-dev.1","description":"iTwin.js frontend components","main":"lib/cjs/core-frontend.js","module":"lib/esm/core-frontend.js","typings":"lib/cjs/core-frontend","license":"MIT","scripts":{"build":"npm run -s copy:public && npm run -s build:cjs && npm run -s build:esm && npm run -s build:workers && npm run -s copy:draco","build:cjs":"npm run -s copy:js:cjs && tsc 1>&2 --outDir lib/cjs","build:esm":"npm run -s copy:js:esm && tsc 1>&2 --module ES2022 --outDir lib/esm","clean":"rimraf -g lib .rush/temp/package-deps*.json","copy:public":"cpx \\"./src/public/**/*\\" ./lib/public","copy:js:cjs":"cpx \\"./src/**/*.js\\" ./lib/cjs","copy:js:esm":"cpx \\"./src/**/*.js\\" ./lib/esm","copy:draco":"cpx \\"./node_modules/@loaders.gl/draco/dist/libs/*\\" ./lib/public/scripts","docs":"betools docs --json=../../generated-docs/core/core-frontend/file.json --tsIndexFile=./core-frontend.ts --onlyJson --excludes=webgl/**/*,**/map/*.d.ts,**/tile/*.d.ts,**/*-css.ts && npm run -s extract","extract":"betools extract --fileExt=ts --extractFrom=./src/test/example-code --recursive --out=../../generated-docs/extract","extract-api":"betools extract-api --entry=core-frontend && npm run extract-extension-api","extract-extension-api":"eslint --no-inline-config -c extraction.eslint.config.js  \\"./src/**/*.ts\\" 1>&2","lint":"eslint \\"./src/**/*.ts\\" 1>&2","lint-fix":"eslint --fix -f visualstudio \\"./src/**/*.ts\\" 1>&2","lint-deprecation":"eslint --fix -f visualstudio --no-inline-config -c ../../common/config/eslint/eslint.config.deprecation-policy.js \\"./src/**/*.ts\\"","pseudolocalize":"betools pseudolocalize --englishDir ./src/public/locales/en --out ./public/locales/en-PSEUDO","test":"npm run build:test-worker && vitest --run","cover":"npm run build:test-worker && vitest --run","build:test-worker":"vite build --config ./src/test/worker/vite.config.mts 1>&2","build:workers":"rimraf lib/workers/webpack && vite build --config ./src/workers/ImdlParser/vite.config.mts 1>&2"},"repository":{"type":"git","url":"https://github.com/iTwin/itwinjs-core.git","directory":"core/frontend"},"keywords":["Bentley","BIM","iModel","digital-twin","iTwin"],"author":{"name":"Bentley Systems, Inc.","url":"http://www.bentley.com"},"peerDependencies":{"@itwin/appui-abstract":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*"},"//devDependencies":["NOTE: All peerDependencies should also be listed as devDependencies since peerDependencies are not considered by npm install","NOTE: All tools used by scripts in this package must be listed as devDependencies"],"devDependencies":{"@bentley/aec-units-schema":"^1.0.3","@bentley/formats-schema":"^1.0.0","@bentley/units-schema":"^1.0.11","@itwin/appui-abstract":"workspace:*","@itwin/build-tools":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*","@itwin/object-storage-core":"^3.0.4","@itwin/eslint-plugin":"^6.0.0","@types/node":"~20.17.0","@types/sinon":"^17.0.2","@vitest/browser-playwright":"^4.1.10","@vitest/coverage-v8":"^4.1.10","cpx2":"^8.0.0","eslint":"^9.31.0","playwright":"~1.56.1","rimraf":"^6.0.1","sinon":"^17.0.2","typescript":"~5.6.2","vite":"^6.4.3","vitest":"^4.1.10","vite-plugin-static-copy":"2.2.0"},"//dependencies":["NOTE: these dependencies should be only for things that DO NOT APPEAR IN THE API","NOTE: core-frontend should remain UI technology agnostic, so no react/angular dependencies are allowed"],"dependencies":{"@itwin/core-i18n":"workspace:*","@itwin/webgl-compatibility":"workspace:*","@loaders.gl/core":"~4.3.4","@loaders.gl/draco":"~4.3.4","fuse.js":"^3.3.0","wms-capabilities":"0.6.0"}}');
 
 /***/ }