@tidecloak/js 0.13.14 → 0.13.15

package/dist/cjs/lib/tidecloak.js

@@ -1,3 +1,6 @@
+/**
+ * @import {Acr, TideCloakAccountOptions, TideCloakAdapter, TideCloakConfig, TideCloakError, TideCloakFlow, TideCloakInitOptions, TideCloakLoginOptions, TideCloakLogoutOptions, TideCloakPkceMethod, TideCloakProfile, TideCloakRegisterOptions, TideCloakResourceAccess, TideCloakResponseMode, TideCloakResponseType, TideCloakRoles, TideCloakTokenParsed, OpenIdProviderMetadata} from "./tidecloak.js"
+ */
 /*
  * Copyright 2016 Red Hat, Inc. and/or its affiliates
  * and other contributors as indicated by the @author tags.
@@ -33,7 +36,7 @@ var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
     return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
 };
-var _TideCloak_instances, _TideCloak_refreshQueue, _TideCloak_adapter, _TideCloak_useNonce, _TideCloak_callbackStorage, _TideCloak_logInfo, _TideCloak_logWarn, _TideCloak_loginIframe, _TideCloak_config, _TideCloak_loadAdapter, _TideCloak_loadDefaultAdapter, _TideCloak_loadCordovaAdapter, _TideCloak_loadCordovaNativeAdapter, _TideCloak_loadConfig, _TideCloak_setupEndpoints, _TideCloak_loadOidcConfig, _TideCloak_setupOidcEndpoints, _TideCloak_check3pCookiesSupported, _TideCloak_processInit, _TideCloak_setupCheckLoginIframe, _TideCloak_checkLoginIframe, _TideCloak_checkSsoSilently, _TideCloak_parseCallback, _TideCloak_parseCallbackUrl, _TideCloak_parseCallbackParams, _TideCloak_processCallback, _TideCloak_scheduleCheckIframe, _TideCloak_getVoucherUrl, _TideCloak_setToken, _TideCloak_getRealmUrl, _TideCloak_createLogger, _LocalStorage_instances, _LocalStorage_clearInvalidValues, _LocalStorage_clearAllValues, _LocalStorage_getStoredEntries, _LocalStorage_parseExpiry, _CookieStorage_instances, _CookieStorage_getCookie, _CookieStorage_setCookie, _CookieStorage_cookieExpiration;
+var _TideCloak_instances, _TideCloak_refreshQueue, _TideCloak_adapter, _TideCloak_useNonce, _TideCloak_callbackStorage, _TideCloak_logInfo, _TideCloak_logWarn, _TideCloak_loginIframe, _TideCloak_dpopProvider, _TideCloak_config, _TideCloak_loadAdapter, _TideCloak_loadDefaultAdapter, _TideCloak_loadCordovaAdapter, _TideCloak_loadCordovaNativeAdapter, _TideCloak_loadConfig, _TideCloak_setupEndpoints, _TideCloak_loadOidcConfig, _TideCloak_setupOidcEndpoints, _TideCloak_getIssuerUrl, _TideCloak_check3pCookiesSupported, _TideCloak_processInit, _TideCloak_setupCheckLoginIframe, _TideCloak_checkLoginIframe, _TideCloak_checkSsoSilently, _TideCloak_parseCallback, _TideCloak_parseCallbackUrl, _TideCloak_parseCallbackParams, _TideCloak_processCallback, _TideCloak_scheduleCheckIframe, _TideCloak_fetchAccessToken, _TideCloak_fetchRefreshToken, _TideCloak_getVoucherUrl, _TideCloak_setToken, _TideCloak_getRealmUrl, _TideCloak_createLogger, _LocalStorage_instances, _LocalStorage_clearInvalidValues, _LocalStorage_clearAllValues, _LocalStorage_getStoredEntries, _LocalStorage_parseExpiry, _CookieStorage_instances, _CookieStorage_getCookie, _CookieStorage_setCookie, _CookieStorage_cookieExpiration;
 // MODIFIED: Added dependency to external Tide helper libraries.
 import { RequestEnclave, ApprovalEnclave, ApprovalEnclaveNew } from "heimdall-tide";
 const CONTENT_TYPE_JSON = 'application/json';
@@ -58,15 +61,15 @@ const CONTENT_TYPE_JSON = 'application/json';
 export { RequestEnclave, ApprovalEnclave, ApprovalEnclaveNew, TideMemory, BaseTideRequest, PolicySignRequest, Policy, PolicyParameters } from "heimdall-tide";
 class TideCloak {
     /**
-     * @param {KeycloakConfig} config
+     * @param {TideCloakConfig} config
      */
     constructor(config) {
         _TideCloak_instances.add(this);
         /** @type {Pick<PromiseWithResolvers<boolean>, 'resolve' | 'reject'>[]} */
         _TideCloak_refreshQueue.set(this, []
-        /** @type {KeycloakAdapter} */
+        /** @type {TideCloakAdapter} */
         );
-        /** @type {KeycloakAdapter} */
+        /** @type {TideCloakAdapter} */
         _TideCloak_adapter.set(this, void 0);
         /** @type {boolean} */
         _TideCloak_useNonce.set(this, true
@@ -84,40 +87,494 @@ class TideCloak {
             callbackList: [],
             interval: 5
         }
-        /** @type {KeycloakConfig} config */
+        /** @type {import('./tidecloak-dpop.js').DPoPSignatureProvider=} */
         );
-        /** @type {KeycloakConfig} config */
+        /** @type {import('./tidecloak-dpop.js').DPoPSignatureProvider=} */
+        _TideCloak_dpopProvider.set(this, void 0);
+        /** @type {TideCloakConfig} config */
         _TideCloak_config.set(this, void 0);
         this.didInitialize = false;
         this.authenticated = false;
         this.loginRequired = false;
-        /** @type {KeycloakResponseMode} */
+        /** @type {TideCloakResponseMode} */
         this.responseMode = 'fragment';
-        /** @type {KeycloakResponseType} */
+        /** @type {TideCloakResponseType} */
         this.responseType = 'code';
-        /** @type {KeycloakFlow} */
+        /** @type {TideCloakFlow} */
         this.flow = 'standard';
+        /** @type {number?} */
+        this.timeSkew = null;
         /** @type {boolean} */
         this.silentCheckSsoFallback = true;
-        /** @type {KeycloakPkceMethod} */
+        /** @type {TideCloakPkceMethod} */
         this.pkceMethod = 'S256';
         this.enableLogging = false;
         /** @type {'GET' | 'POST'} */
         this.logoutMethod = 'GET';
         this.messageReceiveTimeout = 10000;
+        /**
+         * @param {TideCloakInitOptions} initOptions
+         * @returns {Promise<boolean>}
+         */
+        this.init = async (initOptions = {}) => {
+            var _a, _b, _c;
+            if (this.didInitialize) {
+                throw new Error("A 'TideCloak' instance can only be initialized once.");
+            }
+            this.didInitialize = true;
+            __classPrivateFieldSet(this, _TideCloak_callbackStorage, createCallbackStorage(), "f");
+            const adapters = ['default', 'cordova', 'cordova-native'];
+            if (typeof initOptions.adapter === 'string' && adapters.includes(initOptions.adapter)) {
+                __classPrivateFieldSet(this, _TideCloak_adapter, __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_loadAdapter).call(this, initOptions.adapter), "f");
+            }
+            else if (typeof initOptions.adapter === 'object') {
+                __classPrivateFieldSet(this, _TideCloak_adapter, initOptions.adapter, "f");
+            }
+            else if ('Cordova' in window || 'cordova' in window) {
+                __classPrivateFieldSet(this, _TideCloak_adapter, __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_loadAdapter).call(this, 'cordova'), "f");
+            }
+            else {
+                __classPrivateFieldSet(this, _TideCloak_adapter, __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_loadAdapter).call(this, 'default'), "f");
+            }
+            if (typeof initOptions.useNonce !== 'undefined') {
+                __classPrivateFieldSet(this, _TideCloak_useNonce, initOptions.useNonce, "f");
+            }
+            if (typeof initOptions.checkLoginIframe !== 'undefined') {
+                __classPrivateFieldGet(this, _TideCloak_loginIframe, "f").enable = initOptions.checkLoginIframe;
+            }
+            if (initOptions.checkLoginIframeInterval) {
+                __classPrivateFieldGet(this, _TideCloak_loginIframe, "f").interval = initOptions.checkLoginIframeInterval;
+            }
+            if (initOptions.onLoad === 'login-required') {
+                this.loginRequired = true;
+            }
+            if (initOptions.responseMode) {
+                if (initOptions.responseMode === 'query' || initOptions.responseMode === 'fragment') {
+                    this.responseMode = initOptions.responseMode;
+                }
+                else {
+                    throw new Error('Invalid value for responseMode');
+                }
+            }
+            if (initOptions.flow) {
+                switch (initOptions.flow) {
+                    case 'standard':
+                        this.responseType = 'code';
+                        break;
+                    case 'implicit':
+                        this.responseType = 'id_token token';
+                        break;
+                    case 'hybrid':
+                        this.responseType = 'code id_token token';
+                        break;
+                    default:
+                        throw new Error('Invalid value for flow');
+                }
+                this.flow = initOptions.flow;
+            }
+            if (typeof initOptions.timeSkew === 'number') {
+                this.timeSkew = initOptions.timeSkew;
+            }
+            if (initOptions.redirectUri) {
+                this.redirectUri = initOptions.redirectUri;
+            }
+            if (initOptions.silentCheckSsoRedirectUri) {
+                this.silentCheckSsoRedirectUri = initOptions.silentCheckSsoRedirectUri;
+            }
+            if (typeof initOptions.silentCheckSsoFallback === 'boolean') {
+                this.silentCheckSsoFallback = initOptions.silentCheckSsoFallback;
+            }
+            if (typeof initOptions.pkceMethod !== 'undefined') {
+                if (initOptions.pkceMethod !== 'S256' && initOptions.pkceMethod !== false) {
+                    throw new TypeError(`Invalid value for pkceMethod', expected 'S256' or false but got ${initOptions.pkceMethod}.`);
+                }
+                this.pkceMethod = initOptions.pkceMethod;
+            }
+            if (typeof initOptions.enableLogging === 'boolean') {
+                this.enableLogging = initOptions.enableLogging;
+            }
+            if (initOptions.logoutMethod === 'POST') {
+                this.logoutMethod = 'POST';
+            }
+            if (typeof initOptions.scope === 'string') {
+                this.scope = initOptions.scope;
+            }
+            if (typeof initOptions.messageReceiveTimeout === 'number' && initOptions.messageReceiveTimeout > 0) {
+                this.messageReceiveTimeout = initOptions.messageReceiveTimeout;
+            }
+            if (initOptions.useDPoP) {
+                this.useDPoP = initOptions.useDPoP;
+            }
+            await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_loadConfig).call(this);
+            if (((_a = this.useDPoP) === null || _a === void 0 ? void 0 : _a.mode) === 'strict' && (!this.dpopSigningAlgValuesSupported || this.dpopSigningAlgValuesSupported.length === 0)) {
+                throw new Error('DPoP is set to strict mode but the server does not advertise DPoP support (dpop_signing_alg_values_supported is missing or empty).');
+            }
+            // Initialize DPoP if enabled and server supports it
+            if (this.useDPoP && ((_b = this.dpopSigningAlgValuesSupported) === null || _b === void 0 ? void 0 : _b.length)) {
+                const issuerUrl = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getIssuerUrl).call(this);
+                if (!issuerUrl)
+                    throw new Error('Cannot initialize DPoP: issuer URL is not available. Ensure authServerUrl and realm are configured, or use OIDC provider mode with a valid issuer.');
+                if (!this.clientId)
+                    throw new Error('Cannot initialize DPoP: clientId is not configured.');
+                const { DPoPSignatureProvider, BrowserSignatureAlgs } = await import('./tidecloak-dpop.js');
+                __classPrivateFieldSet(this, _TideCloak_dpopProvider, new DPoPSignatureProvider({
+                    issuerUrl: new URL(issuerUrl),
+                    clientId: this.clientId,
+                    serverSupportedAlgorithms: this.dpopSigningAlgValuesSupported,
+                    requestedAlgorithm: !this.useDPoP.alg ? BrowserSignatureAlgs.ES256 : BrowserSignatureAlgs[this.useDPoP.alg]
+                }), "f");
+                await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").init();
+                __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDECLOAK] DPoP initialized');
+            }
+            await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_check3pCookiesSupported).call(this);
+            await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_processInit).call(this, initOptions);
+            (_c = this.onReady) === null || _c === void 0 ? void 0 : _c.call(this, this.authenticated);
+            return this.authenticated;
+        };
+        /**
+         * @param {TideCloakLoginOptions} [options]
+         * @returns {Promise<void>}
+         */
+        this.login = (options) => {
+            return __classPrivateFieldGet(this, _TideCloak_adapter, "f").login(options);
+        };
+        /**
+         * @param {TideCloakLoginOptions} [options]
+         * @returns {Promise<string>}
+         */
+        this.createLoginUrl = async (options) => {
+            const state = createUUID();
+            const nonce = createUUID();
+            const redirectUri = __classPrivateFieldGet(this, _TideCloak_adapter, "f").redirectUri(options);
+            /** @type {CallbackState} */
+            const callbackState = {
+                state,
+                nonce,
+                redirectUri,
+                loginOptions: options
+            };
+            if (options === null || options === void 0 ? void 0 : options.prompt) {
+                callbackState.prompt = options.prompt;
+            }
+            const url = (options === null || options === void 0 ? void 0 : options.action) === 'register'
+                ? this.endpoints.register()
+                : this.endpoints.authorize();
+            let scope = (options === null || options === void 0 ? void 0 : options.scope) || this.scope;
+            const scopeValues = scope ? scope.split(' ') : [];
+            // Ensure the 'openid' scope is always included.
+            if (!scopeValues.includes('openid')) {
+                scopeValues.unshift('openid');
+            }
+            scope = scopeValues.join(' ');
+            const params = new URLSearchParams([
+                ['client_id', /** @type {string} */ (this.clientId)],
+                ['redirect_uri', redirectUri],
+                ['state', state],
+                ['response_mode', this.responseMode],
+                ['response_type', this.responseType],
+                ['scope', scope]
+            ]);
+            if (__classPrivateFieldGet(this, _TideCloak_useNonce, "f")) {
+                params.append('nonce', nonce);
+            }
+            if (options === null || options === void 0 ? void 0 : options.prompt) {
+                params.append('prompt', options.prompt);
+            }
+            if (typeof (options === null || options === void 0 ? void 0 : options.maxAge) === 'number') {
+                params.append('max_age', options.maxAge.toString());
+            }
+            if (options === null || options === void 0 ? void 0 : options.loginHint) {
+                params.append('login_hint', options.loginHint);
+            }
+            if (options === null || options === void 0 ? void 0 : options.idpHint) {
+                params.append('kc_idp_hint', options.idpHint);
+            }
+            if ((options === null || options === void 0 ? void 0 : options.action) && options.action !== 'register') {
+                params.append('kc_action', options.action);
+            }
+            if (options === null || options === void 0 ? void 0 : options.locale) {
+                params.append('ui_locales', options.locale);
+            }
+            if (options === null || options === void 0 ? void 0 : options.acr) {
+                params.append('claims', buildClaimsParameter(options.acr));
+            }
+            if (options === null || options === void 0 ? void 0 : options.acrValues) {
+                params.append('acr_values', options.acrValues);
+            }
+            if (this.pkceMethod) {
+                try {
+                    const codeVerifier = generateCodeVerifier(96);
+                    const pkceChallenge = await generatePkceChallenge(this.pkceMethod, codeVerifier);
+                    callbackState.pkceCodeVerifier = codeVerifier;
+                    params.append('code_challenge', pkceChallenge);
+                    params.append('code_challenge_method', this.pkceMethod);
+                }
+                catch (error) {
+                    throw new Error('Failed to generate PKCE challenge.', { cause: error });
+                }
+            }
+            __classPrivateFieldGet(this, _TideCloak_callbackStorage, "f").add(callbackState);
+            return `${url}?${params.toString()}`;
+        };
+        /**
+         * @param {TideCloakLogoutOptions} [options]
+         * @returns {Promise<void>}
+         */
+        this.logout = async (options) => {
+            var _a;
+            await ((_a = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f")) === null || _a === void 0 ? void 0 : _a.flush());
+            return __classPrivateFieldGet(this, _TideCloak_adapter, "f").logout(options);
+        };
+        /**
+         * @param {TideCloakLogoutOptions} [options]
+         * @returns {string}
+         */
+        this.createLogoutUrl = (options) => {
+            var _a;
+            const logoutMethod = (_a = options === null || options === void 0 ? void 0 : options.logoutMethod) !== null && _a !== void 0 ? _a : this.logoutMethod;
+            const url = this.endpoints.logout();
+            if (logoutMethod === 'POST') {
+                return url;
+            }
+            const params = new URLSearchParams([
+                ['client_id', /** @type {string} */ (this.clientId)],
+                ['post_logout_redirect_uri', __classPrivateFieldGet(this, _TideCloak_adapter, "f").redirectUri(options)]
+            ]);
+            if (this.idToken) {
+                params.append('id_token_hint', this.idToken);
+            }
+            return `${url}?${params.toString()}`;
+        };
+        /**
+         * @param {TideCloakRegisterOptions} [options]
+         * @returns {Promise<void>}
+         */
+        this.register = (options) => {
+            return __classPrivateFieldGet(this, _TideCloak_adapter, "f").register(options);
+        };
+        /**
+         * @param {TideCloakRegisterOptions} [options]
+         * @returns {Promise<string>}
+         */
+        this.createRegisterUrl = (options) => {
+            return this.createLoginUrl({ ...options, action: 'register' });
+        };
+        /**
+         * @param {TideCloakAccountOptions} [options]
+         * @returns {string}
+         */
+        this.createAccountUrl = (options) => {
+            const url = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getRealmUrl).call(this);
+            if (!url) {
+                throw new Error('Unable to create account URL, make sure the adapter is not configured using a generic OIDC provider.');
+            }
+            const params = new URLSearchParams([
+                ['referrer', /** @type {string} */ (this.clientId)],
+                ['referrer_uri', __classPrivateFieldGet(this, _TideCloak_adapter, "f").redirectUri(options)]
+            ]);
+            return `${url}/account?${params.toString()}`;
+        };
+        /**
+         * @returns {Promise<void>}
+         */
+        this.accountManagement = () => {
+            return __classPrivateFieldGet(this, _TideCloak_adapter, "f").accountManagement();
+        };
+        /**
+         * @param {string} role
+         * @returns {boolean}
+         */
+        this.hasRealmRole = (role) => {
+            const access = this.realmAccess;
+            return !!access && access.roles.indexOf(role) >= 0;
+        };
+        /**
+         * @param {string} role
+         * @param {string} [resource]
+         * @returns {boolean}
+         */
+        this.hasResourceRole = (role, resource) => {
+            if (!this.resourceAccess) {
+                return false;
+            }
+            const access = this.resourceAccess[resource || /** @type {string} */ (this.clientId)];
+            return !!access && access.roles.indexOf(role) >= 0;
+        };
+        /**
+         * @returns {Promise<TideCloakProfile>}
+         */
+        this.loadUserProfile = async () => {
+            const realmUrl = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getRealmUrl).call(this);
+            if (!realmUrl) {
+                throw new Error('Unable to load user profile, make sure the adapter is not configured using a generic OIDC provider.');
+            }
+            const url = `${realmUrl}/account`;
+            /** @type {TideCloakProfile} */
+            const profile = await fetchJSON(url, {
+                headers: [buildAuthorizationHeader(this.token)]
+            });
+            return (this.profile = profile);
+        };
+        /**
+         * @returns {Promise<{}>}
+         */
+        this.loadUserInfo = async () => {
+            const url = this.endpoints.userinfo();
+            /** @type {{}} */
+            const userInfo = await fetchJSON(url, {
+                headers: [buildAuthorizationHeader(this.token)]
+            });
+            return (this.userInfo = userInfo);
+        };
+        /**
+         * @param {number} [minValidity]
+         * @returns {boolean}
+         */
+        this.isTokenExpired = (minValidity) => {
+            if (!this.tokenParsed || (!this.refreshToken && this.flow !== 'implicit')) {
+                throw new Error('Not authenticated');
+            }
+            if (this.timeSkew == null) {
+                __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDECLOAK] Unable to determine if token is expired as timeskew is not set');
+                return true;
+            }
+            if (typeof this.tokenParsed.exp !== 'number') {
+                return false;
+            }
+            let expiresIn = this.tokenParsed.exp - Math.ceil(new Date().getTime() / 1000) + this.timeSkew;
+            if (minValidity) {
+                if (isNaN(minValidity)) {
+                    throw new Error('Invalid minValidity');
+                }
+                expiresIn -= minValidity;
+            }
+            return expiresIn < 0;
+        };
+        /**
+         * @param {number} minValidity
+         * @returns {Promise<boolean>}
+         */
+        this.updateToken = async (minValidity) => {
+            var _a, _b;
+            if (!this.refreshToken) {
+                throw new Error('Unable to update token, no refresh token available.');
+            }
+            minValidity = minValidity || 5;
+            if (__classPrivateFieldGet(this, _TideCloak_loginIframe, "f").enable) {
+                await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_checkLoginIframe).call(this);
+            }
+            let refreshToken = false;
+            if (minValidity === -1) {
+                refreshToken = true;
+                __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDECLOAK] Refreshing token: forced refresh');
+            }
+            else if (!this.tokenParsed || this.isTokenExpired(minValidity)) {
+                refreshToken = true;
+                __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDECLOAK] Refreshing token: token expired');
+            }
+            if (!refreshToken) {
+                return false;
+            }
+            /** @type {PromiseWithResolvers<boolean>} */
+            const { promise, resolve, reject } = Promise.withResolvers();
+            __classPrivateFieldGet(this, _TideCloak_refreshQueue, "f").push({ resolve, reject });
+            if (__classPrivateFieldGet(this, _TideCloak_refreshQueue, "f").length === 1) {
+                const url = this.endpoints.token();
+                let timeLocal = new Date().getTime();
+                try {
+                    const response = await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_fetchRefreshToken).call(this, url, this.refreshToken, /** @type {string} */ (this.clientId));
+                    __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDECLOAK] Token refreshed');
+                    timeLocal = (timeLocal + new Date().getTime()) / 2;
+                    __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_setToken).call(this, response.access_token, response.refresh_token, response.id_token, timeLocal, response.doken);
+                    (_a = this.onAuthRefreshSuccess) === null || _a === void 0 ? void 0 : _a.call(this);
+                    for (let p = __classPrivateFieldGet(this, _TideCloak_refreshQueue, "f").pop(); p != null; p = __classPrivateFieldGet(this, _TideCloak_refreshQueue, "f").pop()) {
+                        p.resolve(true);
+                    }
+                }
+                catch (error) {
+                    __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDECLOAK] Failed to refresh token');
+                    if (error instanceof NetworkError && error.response.status === 400) {
+                        this.clearToken();
+                    }
+                    (_b = this.onAuthRefreshError) === null || _b === void 0 ? void 0 : _b.call(this);
+                    for (let p = __classPrivateFieldGet(this, _TideCloak_refreshQueue, "f").pop(); p != null; p = __classPrivateFieldGet(this, _TideCloak_refreshQueue, "f").pop()) {
+                        p.reject(error);
+                    }
+                }
+            }
+            return await promise;
+        };
+        this.clearToken = () => {
+            var _a;
+            if (this.token) {
+                __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_setToken).call(this);
+                (_a = this.onAuthLogout) === null || _a === void 0 ? void 0 : _a.call(this);
+                if (this.loginRequired) {
+                    this.login();
+                }
+            }
+        };
+        this.secureFetch = async (url, init = {}) => {
+            var _a, _b;
+            const dpopProvider = __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f");
+            if (dpopProvider && this.authenticated && this.token) {
+                const existingAuth = new Headers(init.headers).get('Authorization');
+                const isOurBearerToken = existingAuth === `Bearer ${this.token}`;
+                if (!isOurBearerToken) {
+                    // Quick escape - didn't put this check in first if statement as it's more expensive than other checks
+                    return fetch(url, init);
+                }
+                const urlString = url instanceof URL ? url.href : url.toString();
+                const origin = new URL(urlString).origin;
+                const method = (_a = init.method) !== null && _a !== void 0 ? _a : 'GET';
+                const resourceNonce = dpopProvider.getResourceServerNonce(origin);
+                const proof = await dpopProvider.generateDPoPProof(urlString, method, this.token, resourceNonce);
+                const headers = new Headers(init.headers);
+                headers.set('Authorization', `DPoP ${this.token}`);
+                headers.set('DPoP', proof);
+                const resp = await fetch(url, { ...init, headers });
+                // Check for new nonce in response
+                const newNonce = resp.headers.get('DPoP-Nonce');
+                if (newNonce) {
+                    dpopProvider.updateResourceServerNonce(origin, newNonce);
+                }
+                // https://datatracker.ietf.org/doc/html/rfc9449#section-9
+                // Resource servers signal via: WWW-Authenticate: DPoP error="use_dpop_nonce"
+                if (resp.status === 401 && newNonce) {
+                    const wwwAuth = (_b = resp.headers.get('WWW-Authenticate')) !== null && _b !== void 0 ? _b : '';
+                    if (wwwAuth.includes('DPoP') && wwwAuth.includes('error="use_dpop_nonce"')) {
+                        const retryProof = await dpopProvider.generateDPoPProof(urlString, method, this.token, newNonce);
+                        const retryHeaders = new Headers(init.headers);
+                        retryHeaders.set('Authorization', `DPoP ${this.token}`);
+                        retryHeaders.set('DPoP', retryProof);
+                        const retryResp = await fetch(url, { ...init, headers: retryHeaders });
+                        // Capture nonce from retry response for future requests
+                        const retryNonce = retryResp.headers.get('DPoP-Nonce');
+                        if (retryNonce) {
+                            dpopProvider.updateResourceServerNonce(origin, retryNonce);
+                        }
+                        return retryResp;
+                    }
+                }
+                return resp;
+            }
+            else {
+                return fetch(url, init);
+            }
+        };
         if (typeof config !== 'string' && !isObject(config)) {
             throw new Error("The 'TideCloak' constructor must be provided with a configuration object, or a URL to a JSON configuration file.");
         }
-        // if (isObject(config)) {
-        //   const requiredProperties = 'oidcProvider' in config
-        //     ? ['clientId']
-        //     : ['url', 'realm', 'clientId', 'homeOrkUrl', 'vendorId', 'clientOriginAuth']
-        //   for (const property of requiredProperties) {
-        //     if (!config[property]) {
-        //       throw new Error(`The configuration object is missing the required '${property}' property.`)
-        //     }
-        //   }
-        // }
+        if (isObject(config)) {
+            const requiredProperties = 'oidcProvider' in config
+                ? ['clientId']
+                : ['url', 'realm', 'clientId'];
+            for (const property of requiredProperties) {
+                if (!(property in config)) {
+                    throw new Error(`The configuration object is missing the required '${property}' property.`);
+                }
+            }
+        }
         if (!globalThis.isSecureContext) {
             __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, "[TIDECLOAK] TideCloak JS must be used in a 'secure context' to function properly as it relies on browser APIs that are otherwise not available.\n" +
                 'Continuing to run your application insecurely will lead to unexpected behavior and breakage.\n\n' +
@@ -125,113 +582,7 @@ class TideCloak {
         }
         __classPrivateFieldSet(this, _TideCloak_config, config, "f");
     }
-    /**
-     * @param {KeycloakInitOptions} initOptions
-     * @returns {Promise<boolean>}
-     */
-    async init(initOptions = {}) {
-        var _a;
-        if (this.didInitialize) {
-            throw new Error("A 'TideCloak' instance can only be initialized once.");
-        }
-        this.didInitialize = true;
-        __classPrivateFieldSet(this, _TideCloak_callbackStorage, createCallbackStorage(), "f");
-        const adapters = ['default', 'cordova', 'cordova-native'];
-        if (typeof initOptions.adapter === 'string' && adapters.includes(initOptions.adapter)) {
-            __classPrivateFieldSet(this, _TideCloak_adapter, __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_loadAdapter).call(this, initOptions.adapter), "f");
-        }
-        else if (typeof initOptions.adapter === 'object') {
-            __classPrivateFieldSet(this, _TideCloak_adapter, initOptions.adapter, "f");
-        }
-        else if ('Cordova' in window || 'cordova' in window) {
-            __classPrivateFieldSet(this, _TideCloak_adapter, __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_loadAdapter).call(this, 'cordova'), "f");
-        }
-        else {
-            __classPrivateFieldSet(this, _TideCloak_adapter, __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_loadAdapter).call(this, 'default'), "f");
-        }
-        if (typeof initOptions.useNonce !== 'undefined') {
-            __classPrivateFieldSet(this, _TideCloak_useNonce, initOptions.useNonce, "f");
-        }
-        if (typeof initOptions.checkLoginIframe !== 'undefined') {
-            __classPrivateFieldGet(this, _TideCloak_loginIframe, "f").enable = initOptions.checkLoginIframe;
-        }
-        if (initOptions.checkLoginIframeInterval) {
-            __classPrivateFieldGet(this, _TideCloak_loginIframe, "f").interval = initOptions.checkLoginIframeInterval;
-        }
-        if (initOptions.onLoad === 'login-required') {
-            this.loginRequired = true;
-        }
-        if (initOptions.responseMode) {
-            if (initOptions.responseMode === 'query' || initOptions.responseMode === 'fragment') {
-                this.responseMode = initOptions.responseMode;
-            }
-            else {
-                throw new Error('Invalid value for responseMode');
-            }
-        }
-        if (initOptions.flow) {
-            switch (initOptions.flow) {
-                case 'standard':
-                    this.responseType = 'code';
-                    break;
-                case 'implicit':
-                    this.responseType = 'id_token token';
-                    break;
-                case 'hybrid':
-                    this.responseType = 'code id_token token';
-                    break;
-                default:
-                    throw new Error('Invalid value for flow');
-            }
-            this.flow = initOptions.flow;
-        }
-        if (typeof initOptions.timeSkew === 'number') {
-            this.timeSkew = initOptions.timeSkew;
-        }
-        if (initOptions.redirectUri) {
-            this.redirectUri = initOptions.redirectUri;
-        }
-        if (initOptions.silentCheckSsoRedirectUri) {
-            this.silentCheckSsoRedirectUri = initOptions.silentCheckSsoRedirectUri;
-        }
-        if (typeof initOptions.silentCheckSsoFallback === 'boolean') {
-            this.silentCheckSsoFallback = initOptions.silentCheckSsoFallback;
-        }
-        if (typeof initOptions.pkceMethod !== 'undefined') {
-            if (initOptions.pkceMethod !== 'S256' && initOptions.pkceMethod !== false) {
-                throw new TypeError(`Invalid value for pkceMethod', expected 'S256' or false but got ${initOptions.pkceMethod}.`);
-            }
-            this.pkceMethod = initOptions.pkceMethod;
-        }
-        if (typeof initOptions.enableLogging === 'boolean') {
-            this.enableLogging = initOptions.enableLogging;
-        }
-        if (initOptions.logoutMethod === 'POST') {
-            this.logoutMethod = 'POST';
-        }
-        if (typeof initOptions.scope === 'string') {
-            this.scope = initOptions.scope;
-        }
-        if (typeof initOptions.acrValues === 'string') {
-            this.acrValues = initOptions.acrValues;
-        }
-        if (typeof initOptions.messageReceiveTimeout === 'number' && initOptions.messageReceiveTimeout > 0) {
-            this.messageReceiveTimeout = initOptions.messageReceiveTimeout;
-        }
-        await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_loadConfig).call(this);
-        await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_check3pCookiesSupported).call(this);
-        await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_processInit).call(this, initOptions);
-        (_a = this.onReady) === null || _a === void 0 ? void 0 : _a.call(this, this.authenticated);
-        return this.authenticated;
-    }
     ;
-    /**
-     * @param {KeycloakLoginOptions} [options]
-     * @returns {Promise<void>}
-     */
-    login(options) {
-        return __classPrivateFieldGet(this, _TideCloak_adapter, "f").login(options);
-    }
     /**
      * Ensure the access token is valid, refreshing if needed.
      * @returns {Promise<void>}
@@ -243,283 +594,6 @@ class TideCloak {
             await this.updateToken(-1);
         }
     }
-    /**
-     * @param {KeycloakLoginOptions} [options]
-     * @returns {Promise<string>}
-     */
-    async createLoginUrl(options) {
-        const state = createUUID();
-        const nonce = createUUID();
-        const redirectUri = __classPrivateFieldGet(this, _TideCloak_adapter, "f").redirectUri(options);
-        /** @type {CallbackState} */
-        const callbackState = {
-            state,
-            nonce,
-            redirectUri,
-            loginOptions: options
-        };
-        if (options === null || options === void 0 ? void 0 : options.prompt) {
-            callbackState.prompt = options.prompt;
-        }
-        const url = (options === null || options === void 0 ? void 0 : options.action) === 'register'
-            ? this.endpoints.register()
-            : this.endpoints.authorize();
-        let scope = (options === null || options === void 0 ? void 0 : options.scope) || this.scope;
-        const scopeValues = scope ? scope.split(' ') : [];
-        // Ensure the 'openid' scope is always included.
-        if (!scopeValues.includes('openid')) {
-            scopeValues.unshift('openid');
-        }
-        scope = scopeValues.join(' ');
-        const params = new URLSearchParams([
-            ['client_id', /** @type {string} */ (this.clientId)],
-            // The endpoint URI MUST NOT include a fragment component.
-            // https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2
-            ['redirect_uri', stripHash(redirectUri)],
-            ['state', state],
-            ['response_mode', this.responseMode],
-            ['response_type', this.responseType],
-            ['scope', scope]
-        ]);
-        if (__classPrivateFieldGet(this, _TideCloak_useNonce, "f")) {
-            params.append('nonce', nonce);
-        }
-        if (options === null || options === void 0 ? void 0 : options.prompt) {
-            params.append('prompt', options.prompt);
-        }
-        if (typeof (options === null || options === void 0 ? void 0 : options.maxAge) === 'number') {
-            params.append('max_age', options.maxAge.toString());
-        }
-        if (options === null || options === void 0 ? void 0 : options.loginHint) {
-            params.append('login_hint', options.loginHint);
-        }
-        if (options === null || options === void 0 ? void 0 : options.idpHint) {
-            params.append('kc_idp_hint', options.idpHint);
-        }
-        if ((options === null || options === void 0 ? void 0 : options.action) && options.action !== 'register') {
-            params.append('kc_action', options.action);
-        }
-        if (options === null || options === void 0 ? void 0 : options.locale) {
-            params.append('ui_locales', options.locale);
-        }
-        if (options === null || options === void 0 ? void 0 : options.acr) {
-            params.append('claims', buildClaimsParameter(options.acr));
-        }
-        if ((options === null || options === void 0 ? void 0 : options.acrValues) || this.acrValues) {
-            params.append('acr_values', options.acrValues || this.acrValues);
-        }
-        if (this.pkceMethod) {
-            try {
-                const codeVerifier = generateCodeVerifier(96);
-                const pkceChallenge = await generatePkceChallenge(this.pkceMethod, codeVerifier);
-                callbackState.pkceCodeVerifier = codeVerifier;
-                params.append('code_challenge', pkceChallenge);
-                params.append('code_challenge_method', this.pkceMethod);
-            }
-            catch (error) {
-                throw new Error('Failed to generate PKCE challenge.', { cause: error });
-            }
-        }
-        __classPrivateFieldGet(this, _TideCloak_callbackStorage, "f").add(callbackState);
-        return `${url}?${params.toString()}`;
-    }
-    /**
-     * @param {KeycloakLogoutOptions} [options]
-     * @returns {Promise<void>}
-     */
-    logout(options) {
-        return __classPrivateFieldGet(this, _TideCloak_adapter, "f").logout(options);
-    }
-    /**
-     * @param {KeycloakLogoutOptions} [options]
-     * @returns {string}
-     */
-    createLogoutUrl(options) {
-        var _a;
-        const logoutMethod = (_a = options === null || options === void 0 ? void 0 : options.logoutMethod) !== null && _a !== void 0 ? _a : this.logoutMethod;
-        const url = this.endpoints.logout();
-        if (logoutMethod === 'POST') {
-            return url;
-        }
-        const params = new URLSearchParams([
-            ['client_id', /** @type {string} */ (this.clientId)],
-            ['post_logout_redirect_uri', __classPrivateFieldGet(this, _TideCloak_adapter, "f").redirectUri(options)]
-        ]);
-        if (this.idToken) {
-            params.append('id_token_hint', this.idToken);
-        }
-        return `${url}?${params.toString()}`;
-    }
-    /**
-     * @param {KeycloakRegisterOptions} [options]
-     * @returns {Promise<void>}
-     */
-    register(options) {
-        return __classPrivateFieldGet(this, _TideCloak_adapter, "f").register(options);
-    }
-    /**
-     * @param {KeycloakRegisterOptions} [options]
-     * @returns {Promise<string>}
-     */
-    createRegisterUrl(options) {
-        return this.createLoginUrl({ ...options, action: 'register' });
-    }
-    /**
-     * @param {KeycloakAccountOptions} [options]
-     * @returns {string}
-     */
-    createAccountUrl(options) {
-        const url = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getRealmUrl).call(this);
-        if (!url) {
-            throw new Error('Unable to create account URL, make sure the adapter is not configured using a generic OIDC provider.');
-        }
-        const params = new URLSearchParams([
-            ['referrer', /** @type {string} */ (this.clientId)],
-            ['referrer_uri', __classPrivateFieldGet(this, _TideCloak_adapter, "f").redirectUri(options)]
-        ]);
-        return `${url}/account?${params.toString()}`;
-    }
-    /**
-     * @returns {Promise<void>}
-     */
-    accountManagement() {
-        return __classPrivateFieldGet(this, _TideCloak_adapter, "f").accountManagement();
-    }
-    /**
-     * @param {string} role
-     * @returns {boolean}
-     */
-    hasRealmRole(role) {
-        const access = this.realmAccess;
-        return !!access && access.roles.indexOf(role) >= 0;
-    }
-    /**
-     * @param {string} role
-     * @param {string} [resource]
-     * @returns {boolean}
-     */
-    hasResourceRole(role, resource) {
-        if (!this.resourceAccess) {
-            return false;
-        }
-        const access = this.resourceAccess[resource || /** @type {string} */ (this.clientId)];
-        return !!access && access.roles.indexOf(role) >= 0;
-    }
-    /**
-     * @returns {Promise<KeycloakProfile>}
-     */
-    async loadUserProfile() {
-        const realmUrl = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getRealmUrl).call(this);
-        if (!realmUrl) {
-            throw new Error('Unable to load user profile, make sure the adapter is not configured using a generic OIDC provider.');
-        }
-        const url = `${realmUrl}/account`;
-        /** @type {KeycloakProfile} */
-        const profile = await fetchJSON(url, {
-            headers: [buildAuthorizationHeader(this.token)]
-        });
-        return (this.profile = profile);
-    }
-    /**
-     * @returns {Promise<KeycloakUserInfo>}
-     */
-    async loadUserInfo() {
-        const url = this.endpoints.userinfo();
-        /** @type {KeycloakUserInfo} */
-        const userInfo = await fetchJSON(url, {
-            headers: [buildAuthorizationHeader(this.token)]
-        });
-        return (this.userInfo = userInfo);
-    }
-    /**
-     * @param {number} [minValidity]
-     * @returns {boolean}
-     */
-    isTokenExpired(minValidity) {
-        if (!this.tokenParsed || (!this.refreshToken && this.flow !== 'implicit')) {
-            throw new Error('Not authenticated');
-        }
-        if (this.timeSkew == null) {
-            __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDECLOAK] Unable to determine if token is expired as timeskew is not set');
-            return true;
-        }
-        if (typeof this.tokenParsed.exp !== 'number') {
-            return false;
-        }
-        let expiresIn = this.tokenParsed.exp - Math.ceil(new Date().getTime() / 1000) + this.timeSkew;
-        if (minValidity) {
-            if (isNaN(minValidity)) {
-                throw new Error('Invalid minValidity');
-            }
-            expiresIn -= minValidity;
-        }
-        return expiresIn < 0;
-    }
-    /**
-     * Matches Keycloak: minValidity is optional.
-     * @param {number} [minValidity]
-     * @returns {Promise<boolean>}
-     */
-    async updateToken(minValidity) {
-        var _a, _b;
-        if (!this.refreshToken) {
-            throw new Error('Unable to update token, no refresh token available.');
-        }
-        minValidity = minValidity || 5;
-        if (__classPrivateFieldGet(this, _TideCloak_loginIframe, "f").enable) {
-            await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_checkLoginIframe).call(this);
-        }
-        let refreshToken = false;
-        if (minValidity === -1) {
-            refreshToken = true;
-            __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDECLOAK] Refreshing token: forced refresh');
-        }
-        else if (!this.tokenParsed || this.isTokenExpired(minValidity)) {
-            refreshToken = true;
-            __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDECLOAK] Refreshing token: token expired');
-        }
-        if (!refreshToken) {
-            return false;
-        }
-        /** @type {PromiseWithResolvers<boolean>} */
-        const { promise, resolve, reject } = Promise.withResolvers();
-        __classPrivateFieldGet(this, _TideCloak_refreshQueue, "f").push({ resolve, reject });
-        if (__classPrivateFieldGet(this, _TideCloak_refreshQueue, "f").length === 1) {
-            const url = this.endpoints.token();
-            let timeLocal = new Date().getTime();
-            try {
-                const response = await fetchRefreshToken(url, this.refreshToken, /** @type {string} */ (this.clientId));
-                __classPrivateFieldGet(this, _TideCloak_logInfo, "f").call(this, '[TIDECLOAK] Token refreshed');
-                timeLocal = (timeLocal + new Date().getTime()) / 2;
-                __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_setToken).call(this, response.access_token, response.refresh_token, response.id_token, timeLocal, response.doken);
-                (_a = this.onAuthRefreshSuccess) === null || _a === void 0 ? void 0 : _a.call(this);
-                for (let p = __classPrivateFieldGet(this, _TideCloak_refreshQueue, "f").pop(); p != null; p = __classPrivateFieldGet(this, _TideCloak_refreshQueue, "f").pop()) {
-                    p.resolve(true);
-                }
-            }
-            catch (error) {
-                __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDECLOAK] Failed to refresh token');
-                if (error instanceof NetworkError && error.response.status === 400) {
-                    this.clearToken();
-                }
-                (_b = this.onAuthRefreshError) === null || _b === void 0 ? void 0 : _b.call(this);
-                for (let p = __classPrivateFieldGet(this, _TideCloak_refreshQueue, "f").pop(); p != null; p = __classPrivateFieldGet(this, _TideCloak_refreshQueue, "f").pop()) {
-                    p.reject(error);
-                }
-            }
-        }
-        return await promise;
-    }
-    clearToken() {
-        var _a;
-        if (this.token) {
-            __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_setToken).call(this);
-            (_a = this.onAuthLogout) === null || _a === void 0 ? void 0 : _a.call(this);
-            if (this.loginRequired) {
-                this.login();
-            }
-        }
-    }
     /**
      * Initialize Tide RequestEnclave.
      */
@@ -703,7 +777,7 @@ class TideCloak {
         return decrypted.map((d, i) => (dataToSend[i].isRaw ? d : StringFromUint8Array(d)));
     }
 }
-_TideCloak_refreshQueue = new WeakMap(), _TideCloak_adapter = new WeakMap(), _TideCloak_useNonce = new WeakMap(), _TideCloak_callbackStorage = new WeakMap(), _TideCloak_logInfo = new WeakMap(), _TideCloak_logWarn = new WeakMap(), _TideCloak_loginIframe = new WeakMap(), _TideCloak_config = new WeakMap(), _TideCloak_instances = new WeakSet(), _TideCloak_loadAdapter = function _TideCloak_loadAdapter(type) {
+_TideCloak_refreshQueue = new WeakMap(), _TideCloak_adapter = new WeakMap(), _TideCloak_useNonce = new WeakMap(), _TideCloak_callbackStorage = new WeakMap(), _TideCloak_logInfo = new WeakMap(), _TideCloak_logWarn = new WeakMap(), _TideCloak_loginIframe = new WeakMap(), _TideCloak_dpopProvider = new WeakMap(), _TideCloak_config = new WeakMap(), _TideCloak_instances = new WeakSet(), _TideCloak_loadAdapter = function _TideCloak_loadAdapter(type) {
     if (type === 'default') {
         return __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_loadDefaultAdapter).call(this);
     }
@@ -717,7 +791,7 @@ _TideCloak_refreshQueue = new WeakMap(), _TideCloak_adapter = new WeakMap(), _Ti
     }
     throw new Error('invalid adapter type: ' + type);
 }, _TideCloak_loadDefaultAdapter = function _TideCloak_loadDefaultAdapter() {
-    /** @type {KeycloakAdapter['redirectUri']}{} */
+    /** @type {TideCloakAdapter['redirectUri']}{} */
     const redirectUri = (options) => {
         return (options === null || options === void 0 ? void 0 : options.redirectUri) || this.redirectUri || globalThis.location.href;
     };
@@ -1021,7 +1095,7 @@ async function _TideCloak_loadConfig() {
         this.authServerUrl = jsonConfig['auth-server-url'];
         this.realm = jsonConfig.realm;
         this.clientId = jsonConfig.resource;
-        __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_setupEndpoints).call(this);
+        await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_setupEndpoints).call(this);
     }
     else {
         this.clientId = __classPrivateFieldGet(this, _TideCloak_config, "f").clientId;
@@ -1031,10 +1105,31 @@ async function _TideCloak_loadConfig() {
         else {
             this.authServerUrl = __classPrivateFieldGet(this, _TideCloak_config, "f").url;
             this.realm = __classPrivateFieldGet(this, _TideCloak_config, "f").realm;
-            __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_setupEndpoints).call(this);
+            await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_setupEndpoints).call(this);
+        }
+    }
+}, _TideCloak_setupEndpoints = 
+/**
+ * @returns {Promise<void>}
+ */
+async function _TideCloak_setupEndpoints() {
+    // Fetch OIDC metadata to get DPoP supported algorithms (only if DPoP is enabled)
+    if (this.useDPoP) {
+        const issuerUrl = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getIssuerUrl).call(this);
+        if (!issuerUrl) {
+            __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDECLOAK] Cannot fetch OIDC metadata: issuer URL is not available');
+        }
+        else {
+            const url = `${stripTrailingSlash(issuerUrl)}/.well-known/openid-configuration`;
+            try {
+                const openIdConfig = await fetchOpenIdConfig(url);
+                this.dpopSigningAlgValuesSupported = openIdConfig.dpop_signing_alg_values_supported ? openIdConfig.dpop_signing_alg_values_supported : undefined;
+            }
+            catch (error) {
+                __classPrivateFieldGet(this, _TideCloak_logWarn, "f").call(this, '[TIDECLOAK] Failed to fetch OIDC metadata for DPoP configuration: ' + (error instanceof Error ? error.message : error));
+            }
         }
     }
-}, _TideCloak_setupEndpoints = function _TideCloak_setupEndpoints() {
     this.endpoints = {
         authorize: () => {
             return __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getRealmUrl).call(this) + '/protocol/openid-connect/auth';
@@ -1073,6 +1168,9 @@ async function _TideCloak_loadOidcConfig(oidcProvider) {
         __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_setupOidcEndpoints).call(this, oidcProvider);
     }
 }, _TideCloak_setupOidcEndpoints = function _TideCloak_setupOidcEndpoints(config) {
+    // Store DPoP supported algorithms if present
+    this.dpopSigningAlgValuesSupported = config.dpop_signing_alg_values_supported;
+    this.issuer = config.issuer;
     this.endpoints = {
         authorize() {
             return config.authorization_endpoint;
@@ -1102,6 +1200,11 @@ async function _TideCloak_loadOidcConfig(oidcProvider) {
             return config.userinfo_endpoint;
         }
     };
+}, _TideCloak_getIssuerUrl = function _TideCloak_getIssuerUrl() {
+    if (this.issuer)
+        return this.issuer;
+    const realmUrl = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_getRealmUrl).call(this);
+    return realmUrl || undefined;
 }, _TideCloak_check3pCookiesSupported = 
 /**
  * @returns {Promise<void>}
@@ -1147,14 +1250,14 @@ async function _TideCloak_check3pCookiesSupported() {
     return await applyTimeoutToPromise(promise, this.messageReceiveTimeout, 'Timeout when waiting for 3rd party check iframe message.');
 }, _TideCloak_processInit = 
 /**
- * @param {KeycloakInitOptions} initOptions
+ * @param {TideCloakInitOptions} initOptions
  * @returns {Promise<void>}
  */
 async function _TideCloak_processInit(initOptions) {
     var _a, _b, _c;
     const callback = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_parseCallback).call(this, window.location.href);
-    if (callback === null || callback === void 0 ? void 0 : callback.redirectUri) {
-        window.history.replaceState(window.history.state, '', callback.redirectUri);
+    if (callback === null || callback === void 0 ? void 0 : callback.newUrl) {
+        window.history.replaceState(window.history.state, '', callback.newUrl);
     }
     if (callback && callback.valid) {
         await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_setupCheckLoginIframe).call(this);
@@ -1163,7 +1266,7 @@ async function _TideCloak_processInit(initOptions) {
     }
     /** @param {boolean} prompt */
     const doLogin = async (prompt) => {
-        /** @type {KeycloakLoginOptions} */
+        /** @type {TideCloakLoginOptions} */
         const options = {};
         if (!prompt) {
             options.prompt = 'none';
@@ -1364,28 +1467,28 @@ async function _TideCloak_checkSsoSilently() {
     supportedParams.push('error_description');
     supportedParams.push('error_uri');
     const url = new URL(urlString);
-    let redirectUri = '';
+    let newUrl = '';
     let parsed;
     if (this.responseMode === 'query' && url.searchParams.size > 0) {
         parsed = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_parseCallbackParams).call(this, url.search, supportedParams);
         url.search = parsed.paramsString;
-        redirectUri = url.toString();
+        newUrl = url.toString();
     }
     else if (this.responseMode === 'fragment' && url.hash.length > 0) {
         parsed = __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_parseCallbackParams).call(this, url.hash.substring(1), supportedParams);
-        url.hash = '';
-        redirectUri = url.toString();
+        url.hash = parsed.paramsString;
+        newUrl = url.toString();
     }
     if (parsed === null || parsed === void 0 ? void 0 : parsed.oauthParams) {
         if (this.flow === 'standard' || this.flow === 'hybrid') {
             if ((parsed.oauthParams.code || parsed.oauthParams.error) && parsed.oauthParams.state) {
-                parsed.oauthParams.redirectUri = redirectUri;
+                parsed.oauthParams.newUrl = newUrl;
                 return parsed.oauthParams;
             }
         }
         else if (this.flow === 'implicit') {
             if ((parsed.oauthParams.access_token || parsed.oauthParams.error) && parsed.oauthParams.state) {
-                parsed.oauthParams.redirectUri = redirectUri;
+                parsed.oauthParams.newUrl = newUrl;
                 return parsed.oauthParams;
             }
         }
@@ -1445,7 +1548,7 @@ async function _TideCloak_checkSsoSilently() {
     }
     if ((this.flow !== 'implicit') && code) {
         try {
-            const response = await fetchAccessToken(this.endpoints.token(), code, /** @type {string} */ (this.clientId), oauth.redirectUri, oauth.pkceCodeVerifier);
+            const response = await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_fetchAccessToken).call(this, this.endpoints.token(), code, /** @type {string} */ (this.clientId), oauth.redirectUri, oauth.pkceCodeVerifier);
             authSuccess(response.access_token, response.refresh_token, response.id_token, response.doken);
             if (this.flow === 'standard') {
                 (_c = this.onAuthSuccess) === null || _c === void 0 ? void 0 : _c.call(this);
@@ -1465,6 +1568,112 @@ async function _TideCloak_checkSsoSilently() {
             await __classPrivateFieldGet(this, _TideCloak_instances, "m", _TideCloak_scheduleCheckIframe).call(this);
         }
     }
+}, _TideCloak_fetchAccessToken = 
+/**
+ * @typedef {Object} AccessTokenResponse The successful token response from the authorization server, based on the {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.1 OAuth 2.0 Authorization Framework specification}.
+ * @property {string} access_token The access token issued by the authorization server.
+ * @property {string} token_type The type of the token issued by the authorization server.
+ * @property {number} [expires_in] The lifetime in seconds of the access token.
+ * @property {string} [refresh_token] The refresh token issued by the authorization server.
+ * @property {string} [id_token] The ID token issued by the authorization server, if requested.
+ * @property {string} [scope] The scope of the access token.
+ * @property {string} [doken] The Tide doken issued by the authorization server.
+ */
+/**
+ * Fetch the access token from the given URL.
+ * @param {string} url
+ * @param {string} code
+ * @param {string} clientId
+ * @param {string} redirectUri
+ * @param {string} [pkceCodeVerifier]
+ * @returns {Promise<AccessTokenResponse>}
+ */
+async function _TideCloak_fetchAccessToken(url, code, clientId, redirectUri, pkceCodeVerifier) {
+    const body = new URLSearchParams([
+        ['code', code],
+        ['grant_type', 'authorization_code'],
+        ['client_id', clientId],
+        ['redirect_uri', redirectUri]
+    ]);
+    if (pkceCodeVerifier) {
+        body.append('code_verifier', pkceCodeVerifier);
+    }
+    /** @type {Record<string, string>} */
+    const headers = {};
+    if (__classPrivateFieldGet(this, _TideCloak_dpopProvider, "f")) {
+        const nonce = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").getAuthServerNonce();
+        headers['DPoP'] = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").generateDPoPProof(url, 'POST', undefined, nonce);
+    }
+    try {
+        return await fetchJSON(url, {
+            method: 'POST',
+            credentials: 'include',
+            headers,
+            body
+        });
+    }
+    catch (error) {
+        // Handle DPoP nonce retry for token endpoint
+        if (__classPrivateFieldGet(this, _TideCloak_dpopProvider, "f") && error instanceof NetworkError) {
+            const newNonce = error.response.headers.get('DPoP-Nonce');
+            if (newNonce) {
+                await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").updateAuthServerNonce(newNonce);
+                headers['DPoP'] = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").generateDPoPProof(url, 'POST', undefined, newNonce);
+                return await fetchJSON(url, {
+                    method: 'POST',
+                    credentials: 'include',
+                    headers,
+                    body
+                });
+            }
+        }
+        throw error;
+    }
+}, _TideCloak_fetchRefreshToken = 
+/**
+ * Fetch the refresh token from the given URL.
+ * @param {string} url
+ * @param {string} refreshToken
+ * @param {string} clientId
+ * @returns {Promise<AccessTokenResponse>}
+ */
+async function _TideCloak_fetchRefreshToken(url, refreshToken, clientId) {
+    const body = new URLSearchParams([
+        ['grant_type', 'refresh_token'],
+        ['refresh_token', refreshToken],
+        ['client_id', clientId]
+    ]);
+    /** @type {Record<string, string>} */
+    const headers = {};
+    if (__classPrivateFieldGet(this, _TideCloak_dpopProvider, "f")) {
+        const nonce = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").getAuthServerNonce();
+        headers['DPoP'] = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").generateDPoPProof(url, 'POST', undefined, nonce);
+    }
+    try {
+        return await fetchJSON(url, {
+            method: 'POST',
+            credentials: 'include',
+            headers,
+            body
+        });
+    }
+    catch (error) {
+        // Handle DPoP nonce retry for token endpoint
+        if (__classPrivateFieldGet(this, _TideCloak_dpopProvider, "f") && error instanceof NetworkError) {
+            const newNonce = error.response.headers.get('DPoP-Nonce');
+            if (newNonce) {
+                await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").updateAuthServerNonce(newNonce);
+                headers['DPoP'] = await __classPrivateFieldGet(this, _TideCloak_dpopProvider, "f").generateDPoPProof(url, 'POST', undefined, newNonce);
+                return await fetchJSON(url, {
+                    method: 'POST',
+                    credentials: 'include',
+                    headers,
+                    body
+                });
+            }
+        }
+        throw error;
+    }
 }, _TideCloak_getVoucherUrl = function _TideCloak_getVoucherUrl() {
     if (!this.tokenParsed)
         throw new Error('User authentication required to access voucher service');
@@ -1660,8 +1869,8 @@ const STORAGE_KEY_PREFIX = 'kc-callback-';
  * @property {string} state
  * @property {string} nonce
  * @property {string} redirectUri
- * @property {KeycloakLoginOptions} [loginOptions]
- * @property {KeycloakLoginOptions['prompt']} [prompt]
+ * @property {TideCloakLoginOptions} [loginOptions]
+ * @property {TideCloakLoginOptions['prompt']} [prompt]
  * @property {string} [pkceCodeVerifier]
  */
 /**
@@ -1849,7 +2058,7 @@ async function sha256Digest(message) {
 }
 /**
  * @param {string} token
- * @returns {KeycloakTokenParsed}
+ * @returns {TideCloakTokenParsed}
  */
 function decodeToken(token) {
     const [, payload] = token.split('.');
@@ -1937,59 +2146,6 @@ async function fetchJsonConfig(url) {
 async function fetchOpenIdConfig(url) {
     return await fetchJSON(url);
 }
-/**
- * @typedef {Object} AccessTokenResponse The successful token response from the authorization server, based on the {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.1 OAuth 2.0 Authorization Framework specification}.
- * @property {string} access_token The access token issued by the authorization server.
- * @property {string} token_type The type of the token issued by the authorization server.
- * @property {number} [expires_in] The lifetime in seconds of the access token.
- * @property {string} [refresh_token] The refresh token issued by the authorization server.
- * @property {string} [id_token] The ID token issued by the authorization server, if requested.
- * @property {string} [scope] The scope of the access token.
- */
-/**
- * Fetch the access token from the given URL.
- * @param {string} url
- * @param {string} code
- * @param {string} clientId
- * @param {string} redirectUri
- * @param {string} [pkceCodeVerifier]
- * @returns {Promise<AccessTokenResponse>}
- */
-async function fetchAccessToken(url, code, clientId, redirectUri, pkceCodeVerifier) {
-    const body = new URLSearchParams([
-        ['code', code],
-        ['grant_type', 'authorization_code'],
-        ['client_id', clientId],
-        ['redirect_uri', stripHash(redirectUri)]
-    ]);
-    if (pkceCodeVerifier) {
-        body.append('code_verifier', pkceCodeVerifier);
-    }
-    return await fetchJSON(url, {
-        method: 'POST',
-        credentials: 'include',
-        body
-    });
-}
-/**
- * Fetch the refresh token from the given URL.
- * @param {string} url
- * @param {string} refreshToken
- * @param {string} clientId
- * @returns {Promise<AccessTokenResponse>}
- */
-async function fetchRefreshToken(url, refreshToken, clientId) {
-    const body = new URLSearchParams([
-        ['grant_type', 'refresh_token'],
-        ['refresh_token', refreshToken],
-        ['client_id', clientId]
-    ]);
-    return await fetchJSON(url, {
-        method: 'POST',
-        credentials: 'include',
-        body
-    });
-}
 /**
  * @template [T=unknown]
  * @param {string} url
@@ -2034,15 +2190,6 @@ function buildAuthorizationHeader(token) {
 function stripTrailingSlash(url) {
     return url.endsWith('/') ? url.slice(0, -1) : url;
 }
-/**
- * @param {string} url
- * @returns {string}
- */
-function stripHash(url) {
-    const parsedUrl = new URL(url);
-    parsedUrl.hash = '';
-    return parsedUrl.toString();
-}
 /**
  * @typedef {Object} NetworkErrorOptionsProperties
  * @property {Response} response