@mavogel/awscdk-rootmail 0.0.333 → 0.0.335

package/node_modules/nodemailer/CLAUDE.md

@@ -0,0 +1,55 @@
+# Nodemailer
+
+E-mail sending library for Node.js. Zero runtime dependencies. Entry point is `lib/nodemailer.js`, which exposes `createTransport(transporter, defaults)` and routes to one of the bundled transports based on the options object.
+
+## Layout
+
+- `lib/nodemailer.js` — public entry, transport dispatch (`createTransport`).
+- `lib/mailer/` — `Mail` class: the user-facing transport wrapper that normalizes messages, runs the DKIM signer, and hands off to the underlying transport's `.send()`.
+- `lib/mail-composer/` + `lib/mime-node/` — message → MIME tree → raw RFC822 stream.
+- `lib/smtp-connection/` — low-level SMTP/LMTP/ESMTP client. Hot path; security-sensitive. Used by `smtp-transport` and `smtp-pool`.
+- `lib/smtp-transport/` — single-shot SMTP transport.
+- `lib/smtp-pool/` — pooled SMTP transport with rate limiting.
+- `lib/sendmail-transport/`, `lib/ses-transport/`, `lib/stream-transport/`, `lib/json-transport/` — alternate transports.
+- `lib/dkim/`, `lib/addressparser/`, `lib/mime-funcs/`, `lib/base64/`, `lib/qp/`, `lib/punycode/`, `lib/well-known/`, `lib/xoauth2/`, `lib/fetch/`, `lib/shared/` — supporting modules.
+- `test/` — mirrors `lib/` structure. Most suites spin up real `smtp-server` instances on ephemeral ports; raw `net` servers are used when byte-exact reply control is needed (e.g. injecting non-ASCII or invalid UTF-8).
+
+Each transport must implement `name`, `version`, and `send(mail, callback)`. `Mail` discovers them via duck typing.
+
+## Engine target
+
+`engines.node = ">=6.0.0"`. The library is shipped as ES2017 script-mode CommonJS — no `import`, no top-level `await`, no optional chaining, no nullish coalescing, no class fields. ESLint enforces `ecmaVersion: 2017` and `sourceType: 'script'`. There is a Node 6 syntax-compat check (`npm run test:syntax`, runs `test/syntax-compat.js` inside `node:6-alpine`) that must keep passing — do not introduce syntax that breaks it. `'use strict';` directive at the top of every file.
+
+## Conventions
+
+- CommonJS only: `const x = require('...')`, `module.exports = ...`.
+- Callback-first style throughout the public API. Many internals are still callback-based — match the style of the file you are editing rather than introducing promises mid-module.
+- Prettier handles formatting; ESLint handles correctness. Run `npm run format` and `npm run lint` before sending changes. The lint config disables Prettier-overlapping rules.
+- Snake_case is not used; camelCase for variables and methods, PascalCase for classes.
+- Prefer small, surgical diffs. The codebase is mature and load-bearing — avoid drive-by refactors, comment churn, or "improvements" outside the scope of the change.
+- Every change to security-sensitive code (anything in `lib/smtp-connection/`, address parsing, header generation, DKIM) needs tests that exercise the failure mode, not just the happy path.
+
+## Testing
+
+- `npm test` — full suite via `node --test` (~150s, 480+ tests, runs serially).
+- `npm run test:coverage` — same suite under `c8`.
+- `npm run test:syntax` — Node 6 syntax compatibility check in Docker.
+- `npm run lint` / `npm run lint:fix`.
+- `npm run format` / `npm run format:check`.
+
+Always run `npm test` and `npm run lint` before considering a change done. Tests are required to pass on every commit because release-please cuts releases directly from `master`.
+
+## Releases
+
+Releases, version numbers, the `version` field in `package.json`, git tags, `CHANGELOG.md` entries, and npm publication are all managed automatically by the release-please GitHub Action (`.github/workflows/release.yaml`, configured by `.release-please-config.json`). **Never edit any of these manually and never propose manual edits to them.**
+
+Release-please derives the next version and changelog from Conventional Commit messages on `master`, opens a release PR (`chore: release X.Y.Z [skip-ci]`), and publishes to npm with provenance when that PR is merged. The only thing that should land on `master` between releases is normal commits with Conventional Commit prefixes — release-please takes care of the rest.
+
+Conventional Commit prefixes used in this repo: `fix:`, `feat:`, `chore:`, `docs:`, `refactor:`, `test:`. Use `fix:` for anything users would benefit from seeing in the changelog, including security fixes (reference the GHSA in the body).
+
+## Security
+
+This is a widely-deployed library — security-sensitive changes get extra scrutiny:
+- SMTP command injection: any user-controllable value that flows into a written SMTP command (envelope addresses, sizes, the `name`/EHLO option, headers) must be CRLF-stripped or rejected at the boundary. Sanitize at the assignment, not at every call site.
+- Server reply parsing in `lib/smtp-connection/index.js` uses a `'binary'` byte-container intermediate to reassemble multi-byte UTF-8 across socket chunks; the actual decode happens at line boundaries via `decodeServerResponse`. Don't change the chunk-buffering encoding without understanding why.
+- Reference the GHSA ID in commit messages for advisories.

package/node_modules/nodemailer/lib/smtp-connection/index.js

@@ -17,6 +17,28 @@ const GREETING_TIMEOUT = 30 * 1000; // how much to wait after connection is esta
 const DNS_TIMEOUT = 30 * 1000; // how much to wait for resolveHostname
 const TEARDOWN_NOOP = () => {}; // reusable no-op handler for absorbing errors during socket teardown
 
+/**
+ * Re-interpret a server response stored in fake 8-bit byte-container form
+ * (the result of chunk.toString('binary') in _onData) as UTF-8.
+ *
+ * Server reply text has no formally defined charset (RFC 5321 §4.2.1), but
+ * modern MTAs commonly use UTF-8. The byte-container plumbing in _onData is
+ * required to reassemble multi-byte sequences split across socket chunks;
+ * this helper performs the actual decode at the line boundary, falling back
+ * to the byte-container form when the bytes are not valid UTF-8 so that
+ * legacy 8-bit replies are still recoverable byte-for-byte.
+ */
+function decodeServerResponse(str) {
+    if (!str) {
+        return str;
+    }
+    const utf8 = Buffer.from(str, 'binary').toString('utf8');
+    // The input is a byte container (each char is in U+0000..U+00FF) so it can never
+    // already contain U+FFFD; any \uFFFD in the result was inserted by Node's UTF-8
+    // decoder for invalid bytes, which means we should return the original bytes intact.
+    return utf8.includes('\uFFFD') ? str : utf8;
+}
+
 /**
  * Generates a SMTP connection object
  *
@@ -68,7 +90,7 @@ class SMTPConnection extends EventEmitter {
             this.secureConnection = true;
         }
 
-        this.name = this.options.name || this._getHostname();
+        this.name = (this.options.name || this._getHostname()).toString().replace(/[\r\n]+/g, '');
 
         this.logger = shared.getLogger(this.options, {
             component: this.options.component || 'smtp-connection',
@@ -895,15 +917,15 @@ class SMTPConnection extends EventEmitter {
         let serverResponse = false;
 
         if (this._remainder && this._remainder.trim()) {
+            this.lastServerResponse = serverResponse = decodeServerResponse(this._remainder.trim());
             if (this.options.debug || this.options.transactionLog) {
                 this.logger.debug(
                     {
                         tnx: 'server'
                     },
-                    this._remainder.replace(/\r?\n$/, '')
+                    serverResponse
                 );
             }
-            this.lastServerResponse = serverResponse = this._remainder.trim();
         }
 
         this.logger.info(
@@ -1023,7 +1045,7 @@ class SMTPConnection extends EventEmitter {
             return false;
         }
 
-        let str = (this.lastServerResponse = (this._responseQueue.shift() || '').toString());
+        let str = (this.lastServerResponse = decodeServerResponse((this._responseQueue.shift() || '').toString()));
 
         if (/^\d+-/.test(str.split('\n').pop())) {
             // keep waiting for the final part of multiline response

package/node_modules/nodemailer/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "8.0.4",
+    "version": "8.0.5",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "main": "lib/nodemailer.js",
     "scripts": {
@@ -27,10 +27,10 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
-        "@aws-sdk/client-sesv2": "3.1011.0",
+        "@aws-sdk/client-sesv2": "3.1025.0",
         "bunyan": "1.8.15",
         "c8": "11.0.0",
-        "eslint": "10.0.3",
+        "eslint": "10.2.0",
         "eslint-config-prettier": "10.1.8",
         "globals": "17.4.0",
         "libbase64": "1.3.0",
@@ -40,7 +40,7 @@
         "prettier": "3.8.1",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",
-        "smtp-server": "3.18.1"
+        "smtp-server": "3.18.3"
     },
     "engines": {
         "node": ">=6.0.0"

package/node_modules/path-expression-matcher/README.md

@@ -4,10 +4,11 @@ Efficient path tracking and pattern matching for XML, JSON, YAML or any other pa
 
 ## 🎯 Purpose
 
-`path-expression-matcher` provides two core classes for tracking and matching paths:
+`path-expression-matcher` provides three core classes for tracking and matching paths:
 
 - **`Expression`**: Parses and stores pattern expressions (e.g., `"root.users.user[id]"`)
 - **`Matcher`**: Tracks current path during parsing and matches against expressions
+- **`MatcherView`**: A lightweight read-only view of a `Matcher`, safe to pass to callbacks
 
 Compatible with [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) and similar tools.
 
@@ -138,7 +139,7 @@ console.log(matcher.toString()); // "soap:Envelope.soap:Body.ns:UserId"
 #### Constructor
 
 ```javascript
-new Expression(pattern, options)
+new Expression(pattern, options = {}, data)
 ```
 
 **Parameters:**
@@ -149,6 +150,8 @@ new Expression(pattern, options)
 ```javascript
 const expr1 = new Expression("root.users.user");
 const expr2 = new Expression("root/users/user", { separator: '/' });
+const expr3 = new Expression("root/users/user", { separator: '/' }, { extra: "data"});
+console.log(expr3.data) // { extra: "data" }
 ```
 
 #### Methods
@@ -240,6 +243,22 @@ if (matcher.matches(expr)) {
 }
 ```
 
+#### `matchesAny(exprSet)` → `boolean`
+
+Please check `ExpressionSet` class for more details.  
+
+```javascript
+const matcher = new Matcher();
+const exprSet = new ExpressionSet();
+exprSet.add(new Expression("root.users.user"));
+exprSet.add(new Expression("root.config.*"));
+exprSet.seal();
+
+if (matcher.matchesAny(exprSet)) {
+  // Current path matches any expression in the set
+}
+```
+
 ##### `getCurrentTag()`
 
 Get current tag name.
@@ -350,51 +369,51 @@ matcher.restore(snapshot);
 
 ##### `readOnly()`
 
-Returns a **live, read-only proxy** of the matcher. All query and inspection methods work normally, but any attempt to call a state-mutating method (`push`, `pop`, `reset`, `updateCurrent`, `restore`) or to write/delete a property throws a `TypeError`.
+Returns a **`MatcherView`** — a lightweight, live read-only view of the matcher. All query and inspection methods work normally and always reflect the current state of the underlying matcher. Mutation methods (`push`, `pop`, `reset`, `updateCurrent`, `restore`) simply don't exist on `MatcherView`, so misuse is caught at **compile time** by TypeScript rather than at runtime.
 
-This is the recommended way to share the matcher with external consumers — plugins, callbacks, event handlers — that only need to inspect the current path without being able to corrupt parser state.
+The **same instance** is returned on every call — no allocation occurs per invocation. This is the recommended way to share the matcher with callbacks, plugins, or any external code that only needs to inspect the current path.
 
 ```javascript
-const ro = matcher.readOnly();
+const view = matcher.readOnly();
+// Same reference every time — safe to cache
+view === matcher.readOnly(); // true
 ```
 
-**What works on the read-only view:**
+**What works on the view:**
 
 ```javascript
-ro.matches(expr)          // ✓ pattern matching
-ro.getCurrentTag()        // ✓ current tag name
-ro.getCurrentNamespace()  // ✓ current namespace
-ro.getAttrValue("id")     // ✓ attribute value
-ro.hasAttr("id")          // ✓ attribute presence check
-ro.getPosition()          // ✓ sibling position
-ro.getCounter()           // ✓ occurrence counter
-ro.getDepth()             // ✓ path depth
-ro.toString()             // ✓ path as string
-ro.toArray()              // ✓ path as array
-ro.snapshot()             // ✓ snapshot (can be used to restore the real matcher)
+view.matches(expr)          // ✓ pattern matching
+view.getCurrentTag()        // ✓ current tag name
+view.getCurrentNamespace()  // ✓ current namespace
+view.getAttrValue("id")     // ✓ attribute value
+view.hasAttr("id")          // ✓ attribute presence check
+view.getPosition()          // ✓ sibling position
+view.getCounter()           // ✓ occurrence counter
+view.getDepth()             // ✓ path depth
+view.toString()             // ✓ path as string
+view.toArray()              // ✓ path as array
 ```
 
-**What throws a `TypeError`:**
+**What doesn't exist (compile-time error in TypeScript):**
 
 ```javascript
-ro.push("child", {})      // ✗ TypeError: Cannot call 'push' on a read-only Matcher
-ro.pop()                  // ✗ TypeError: Cannot call 'pop' on a read-only Matcher
-ro.reset()                // ✗ TypeError: Cannot call 'reset' on a read-only Matcher
-ro.updateCurrent({})      // ✗ TypeError: Cannot call 'updateCurrent' on a read-only Matcher
-ro.restore(snapshot)      // ✗ TypeError: Cannot call 'restore' on a read-only Matcher
-ro.separator = '/'        // ✗ TypeError: Cannot set property on a read-only Matcher
+view.push("child", {})      // ✗ Property 'push' does not exist on type 'MatcherView'
+view.pop()                  // ✗ Property 'pop' does not exist on type 'MatcherView'
+view.reset()                // ✗ Property 'reset' does not exist on type 'MatcherView'
+view.updateCurrent({})      // ✗ Property 'updateCurrent' does not exist on type 'MatcherView'
+view.restore(snapshot)      // ✗ Property 'restore' does not exist on type 'MatcherView'
 ```
 
-**Important:** The read-only view is **live** — it always reflects the current state of the underlying matcher. If you need a frozen-in-time copy instead, use `snapshot()`.
+**The view is live** — it always reflects the current state of the underlying matcher.
 
 ```javascript
 const matcher = new Matcher();
-const ro = matcher.readOnly();
+const view = matcher.readOnly();
 
 matcher.push("root");
-ro.getDepth();    // 1 — immediately reflects the push
+view.getDepth();    // 1 — immediately reflects the push
 matcher.push("users");
-ro.getDepth();    // 2 — still live
+view.getDepth();    // 2 — still live
 ```
 
 ## 💡 Usage Examples
@@ -532,9 +551,9 @@ const expr = new Expression("root.item:first");
 console.log(matcher.matches(expr)); // false (counter=1, not 0)
 ```
 
-### Example 8: Passing a Read-Only Matcher to External Consumers
+### Example 8: Passing a Read-Only View to External Consumers
 
-When passing the matcher into callbacks, plugins, or other code you don't control, use `readOnly()` to prevent accidental state corruption.
+When passing the matcher into callbacks, plugins, or other code you don't control, use `readOnly()` to get a `MatcherView` — it can inspect but never mutate parser state.
 
 ```javascript
 import { Expression, Matcher } from 'path-expression-matcher';
@@ -546,40 +565,26 @@ const adminExpr = new Expression("..user[type=admin]");
 function parseTag(tagName, attrs, onTag) {
   matcher.push(tagName, attrs);
 
-  // Pass a read-only view — consumer can inspect but not mutate
+  // Pass MatcherView — consumer can inspect but not mutate
   onTag(matcher.readOnly());
 
   matcher.pop();
 }
 
 // Safe consumer — can only read
-function myPlugin(ro) {
-  if (ro.matches(adminExpr)) {
-    console.log("Admin at path:", ro.toString());
-    console.log("Depth:", ro.getDepth());
-    console.log("ID:", ro.getAttrValue("id"));
+function myPlugin(view) {
+  if (view.matches(adminExpr)) {
+    console.log("Admin at path:", view.toString());
+    console.log("Depth:", view.getDepth());
+    console.log("ID:", view.getAttrValue("id"));
   }
 }
 
-// ro.push(...) or ro.reset() here would throw TypeError,
-// so the parser's state is always safe.
+// view.push(...) or view.reset() don't exist on MatcherView —
+// TypeScript catches misuse at compile time.
 parseTag("user", { id: "1", type: "admin" }, myPlugin);
 ```
 
-**Combining with `snapshot()`:** A snapshot taken via the read-only view can still be used to restore the real matcher.
-
-```javascript
-const matcher = new Matcher();
-matcher.push("root");
-matcher.push("users");
-
-const ro = matcher.readOnly();
-const snap = ro.snapshot();       // ✓ snapshot works on read-only view
-
-matcher.push("user");             // continue parsing...
-matcher.restore(snap);            // restore to "root.users" using the snapshot
-```
-
 ```javascript
 const matcher = new Matcher();
 const soapExpr = new Expression("soap::Envelope.soap::Body..ns::UserId");
@@ -674,21 +679,168 @@ for (let i = 0; i < 1000; i++) {
 }
 ```
 
-### Batch Pattern Checking
+### Batch Pattern Checking with ExpressionSet (Recommended)
+
+For checking multiple patterns on every tag, use `ExpressionSet` instead of a manual loop.
+It pre-indexes expressions at build time so each call to `matchesAny()` does an O(1) bucket
+lookup rather than a full O(N) scan:
 
 ```javascript
-// For multiple patterns, check all at once
-const patterns = [
-  new Expression("..user"),
-  new Expression("..post"),
-  new Expression("..comment"),
-];
+import { Expression, ExpressionSet, Matcher } from 'path-expression-matcher';
 
-function matchesAny(matcher, patterns) {
-  return patterns.some(expr => matcher.matches(expr));
+// Build once at config/startup time
+const stopNodes = new ExpressionSet();
+stopNodes
+  .add(new Expression('root.users.user'))
+  .add(new Expression('root.config.*'))
+  .add(new Expression('..script'))
+  .seal(); // prevent accidental mutation during parsing
+
+// Per-tag — hot path
+if (stopNodes.matchesAny(matcher)) {
+  // handle stop node
+}
+```
+
+This replaces the manual loop pattern:
+
+```javascript
+// ❌ Before — O(N) per tag
+function isStopNode(expressions, matcher) {
+  for (let i = 0; i < expressions.length; i++) {
+    if (matcher.matches(expressions[i])) return true;
+  }
+  return false;
 }
+
+// ✅ After — O(1) lookup per tag
+const stopNodes = new ExpressionSet();
+stopNodes.addAll(expressions);
+stopNodes.matchesAny(matcher);
+//or matcher.matchesAny(stopNodes)
+```
+
+---
+
+## 📦 ExpressionSet API
+
+`ExpressionSet` is an indexed collection of `Expression` objects designed for efficient
+bulk matching. Build it once from your config, then call `matchesAny()` on every tag.
+
+### Constructor
+
+```javascript
+const set = new ExpressionSet();
+```
+
+### `add(expression)` → `this`
+
+Add a single `Expression`. Duplicate patterns (same pattern string) are silently ignored.
+Returns `this` for chaining. Throws `TypeError` if the set is sealed.
+
+```javascript
+set.add(new Expression('root.users.user'));
+set.add(new Expression('..script'));
+```
+
+### `addAll(expressions)` → `this`
+
+Add an array of `Expression` objects at once. Returns `this` for chaining.
+
+```javascript
+set.addAll(config.stopNodes.map(p => new Expression(p)));
 ```
 
+### `has(expression)` → `boolean`
+
+Check whether an expression with the same pattern is already present.
+
+```javascript
+set.has(new Expression('root.users.user')); // true / false
+```
+
+### `seal()` → `this`
+
+Prevent further additions. Any subsequent call to `add()` or `addAll()` throws a `TypeError`.
+Useful to guard against accidental mutation once parsing has started.
+
+```javascript
+const stopNodes = new ExpressionSet();
+stopNodes.addAll(patterns).seal();
+
+stopNodes.add(new Expression('root.extra')); // ❌ TypeError: ExpressionSet is sealed
+```
+
+### `size` → `number`
+
+Number of distinct expressions in the set.
+
+```javascript
+set.size; // 3
+```
+
+### `isSealed` → `boolean`
+
+Whether `seal()` has been called.
+
+### `matchesAny(matcher)` → `boolean`
+
+Returns `true` if the matcher's current path matches **any** expression in the set.
+Accepts both a `Matcher` instance and a `MatcherView`.
+
+```javascript
+if (stopNodes.matchesAny(matcher)) { /* ... */ }
+if (stopNodes.matchesAny(matcher.readOnly())) { /* ... */ } // also works
+```
+
+**How indexing works:** expressions are bucketed at `add()` time, not at match time.
+
+| Expression type | Bucket | Lookup cost |
+|---|---|---|
+| Fixed path, concrete tag (`root.users.user`) | `depth:tag` map | O(1) |
+| Fixed path, wildcard tag (`root.config.*`) | `depth` map | O(1) |
+| Deep wildcard (`..script`) | flat list | O(D) — always scanned |
+
+In practice, deep-wildcard expressions are rare in configs, so the list stays small.
+
+### `findMatch(matcher)` → `Expression`
+
+Returns the Expression instance that matched the current path. Accepts both a `Matcher` instance and a `MatcherView`.
+
+```javascript
+const node = stopNodes.findMatch(matcher);
+```
+
+
+### Example 7: ExpressionSet in a real parser loop
+
+```javascript
+import { XMLParser } from 'fast-xml-parser';
+import { Expression, ExpressionSet, Matcher } from 'path-expression-matcher';
+
+// Config-time setup
+const stopNodes = new ExpressionSet();
+stopNodes
+  .addAll(['script', 'style'].map(t => new Expression(`..${t}`)))
+  .seal();
+
+const matcher = new Matcher();
+
+const parser = new XMLParser({
+  onOpenTag(tagName, attrs) {
+    matcher.push(tagName, attrs);
+    if (stopNodes.matchesAny(matcher)) {
+      // treat as stop node
+    }
+  },
+  onCloseTag() {
+    matcher.pop();
+  },
+});
+```
+
+
+
 ## 🔗 Integration with fast-xml-parser
 
 **Basic integration:**
@@ -717,4 +869,4 @@ MIT
 
 ## 🤝 Contributing
 
-Issues and PRs welcome! This package is designed to be used by XML/JSON parsers like fast-xml-parser.
+Issues and PRs welcome! This package is designed to be used by XML/JSON parsers like fast-xml-parser. But can be used with any formar parser.

package/node_modules/path-expression-matcher/lib/pem.cjs

@@ -1 +1 @@
-(()=>{"use strict";var t={d:(e,s)=>{for(var n in s)t.o(s,n)&&!t.o(e,n)&&Object.defineProperty(e,n,{enumerable:!0,get:s[n]})},o:(t,e)=>Object.prototype.hasOwnProperty.call(t,e),r:t=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})}},e={};t.r(e),t.d(e,{Expression:()=>s,Matcher:()=>i,default:()=>r});class s{constructor(t,e={}){this.pattern=t,this.separator=e.separator||".",this.segments=this._parse(t),this._hasDeepWildcard=this.segments.some(t=>"deep-wildcard"===t.type),this._hasAttributeCondition=this.segments.some(t=>void 0!==t.attrName),this._hasPositionSelector=this.segments.some(t=>void 0!==t.position)}_parse(t){const e=[];let s=0,n="";for(;s<t.length;)t[s]===this.separator?s+1<t.length&&t[s+1]===this.separator?(n.trim()&&(e.push(this._parseSegment(n.trim())),n=""),e.push({type:"deep-wildcard"}),s+=2):(n.trim()&&e.push(this._parseSegment(n.trim())),n="",s++):(n+=t[s],s++);return n.trim()&&e.push(this._parseSegment(n.trim())),e}_parseSegment(t){const e={type:"tag"};let s=null,n=t;const i=t.match(/^([^\[]+)(\[[^\]]*\])(.*)$/);if(i&&(n=i[1]+i[3],i[2])){const t=i[2].slice(1,-1);t&&(s=t)}let r,a,h=n;if(n.includes("::")){const e=n.indexOf("::");if(r=n.substring(0,e).trim(),h=n.substring(e+2).trim(),!r)throw new Error(`Invalid namespace in pattern: ${t}`)}let o=null;if(h.includes(":")){const t=h.lastIndexOf(":"),e=h.substring(0,t).trim(),s=h.substring(t+1).trim();["first","last","odd","even"].includes(s)||/^nth\(\d+\)$/.test(s)?(a=e,o=s):a=h}else a=h;if(!a)throw new Error(`Invalid segment pattern: ${t}`);if(e.tag=a,r&&(e.namespace=r),s)if(s.includes("=")){const t=s.indexOf("=");e.attrName=s.substring(0,t).trim(),e.attrValue=s.substring(t+1).trim()}else e.attrName=s.trim();if(o){const t=o.match(/^nth\((\d+)\)$/);t?(e.position="nth",e.positionValue=parseInt(t[1],10)):e.position=o}return e}get length(){return this.segments.length}hasDeepWildcard(){return this._hasDeepWildcard}hasAttributeCondition(){return this._hasAttributeCondition}hasPositionSelector(){return this._hasPositionSelector}toString(){return this.pattern}}const n=new Set(["push","pop","reset","updateCurrent","restore"]);class i{constructor(t={}){this.separator=t.separator||".",this.path=[],this.siblingStacks=[]}push(t,e=null,s=null){this.path.length>0&&(this.path[this.path.length-1].values=void 0);const n=this.path.length;this.siblingStacks[n]||(this.siblingStacks[n]=new Map);const i=this.siblingStacks[n],r=s?`${s}:${t}`:t,a=i.get(r)||0;let h=0;for(const t of i.values())h+=t;i.set(r,a+1);const o={tag:t,position:h,counter:a};null!=s&&(o.namespace=s),null!=e&&(o.values=e),this.path.push(o)}pop(){if(0===this.path.length)return;const t=this.path.pop();return this.siblingStacks.length>this.path.length+1&&(this.siblingStacks.length=this.path.length+1),t}updateCurrent(t){if(this.path.length>0){const e=this.path[this.path.length-1];null!=t&&(e.values=t)}}getCurrentTag(){return this.path.length>0?this.path[this.path.length-1].tag:void 0}getCurrentNamespace(){return this.path.length>0?this.path[this.path.length-1].namespace:void 0}getAttrValue(t){if(0===this.path.length)return;const e=this.path[this.path.length-1];return e.values?.[t]}hasAttr(t){if(0===this.path.length)return!1;const e=this.path[this.path.length-1];return void 0!==e.values&&t in e.values}getPosition(){return 0===this.path.length?-1:this.path[this.path.length-1].position??0}getCounter(){return 0===this.path.length?-1:this.path[this.path.length-1].counter??0}getIndex(){return this.getPosition()}getDepth(){return this.path.length}toString(t,e=!0){const s=t||this.separator;return this.path.map(t=>e&&t.namespace?`${t.namespace}:${t.tag}`:t.tag).join(s)}toArray(){return this.path.map(t=>t.tag)}reset(){this.path=[],this.siblingStacks=[]}matches(t){const e=t.segments;return 0!==e.length&&(t.hasDeepWildcard()?this._matchWithDeepWildcard(e):this._matchSimple(e))}_matchSimple(t){if(this.path.length!==t.length)return!1;for(let e=0;e<t.length;e++){const s=t[e],n=this.path[e],i=e===this.path.length-1;if(!this._matchSegment(s,n,i))return!1}return!0}_matchWithDeepWildcard(t){let e=this.path.length-1,s=t.length-1;for(;s>=0&&e>=0;){const n=t[s];if("deep-wildcard"===n.type){if(s--,s<0)return!0;const n=t[s];let i=!1;for(let t=e;t>=0;t--){const r=t===this.path.length-1;if(this._matchSegment(n,this.path[t],r)){e=t-1,s--,i=!0;break}}if(!i)return!1}else{const t=e===this.path.length-1;if(!this._matchSegment(n,this.path[e],t))return!1;e--,s--}}return s<0}_matchSegment(t,e,s){if("*"!==t.tag&&t.tag!==e.tag)return!1;if(void 0!==t.namespace&&"*"!==t.namespace&&t.namespace!==e.namespace)return!1;if(void 0!==t.attrName){if(!s)return!1;if(!e.values||!(t.attrName in e.values))return!1;if(void 0!==t.attrValue){const s=e.values[t.attrName];if(String(s)!==String(t.attrValue))return!1}}if(void 0!==t.position){if(!s)return!1;const n=e.counter??0;if("first"===t.position&&0!==n)return!1;if("odd"===t.position&&n%2!=1)return!1;if("even"===t.position&&n%2!=0)return!1;if("nth"===t.position&&n!==t.positionValue)return!1}return!0}snapshot(){return{path:this.path.map(t=>({...t})),siblingStacks:this.siblingStacks.map(t=>new Map(t))}}restore(t){this.path=t.path.map(t=>({...t})),this.siblingStacks=t.siblingStacks.map(t=>new Map(t))}readOnly(){return new Proxy(this,{get(t,e,s){if(n.has(e))return()=>{throw new TypeError(`Cannot call '${e}' on a read-only Matcher. Obtain a writable instance to mutate state.`)};const i=Reflect.get(t,e,s);return"path"===e||"siblingStacks"===e?Object.freeze(Array.isArray(i)?i.map(t=>t instanceof Map?Object.freeze(new Map(t)):Object.freeze({...t})):i):"function"==typeof i?i.bind(t):i},set(t,e){throw new TypeError(`Cannot set property '${String(e)}' on a read-only Matcher.`)},deleteProperty(t,e){throw new TypeError(`Cannot delete property '${String(e)}' from a read-only Matcher.`)}})}}const r={Expression:s,Matcher:i};module.exports=e})();
+(()=>{"use strict";var t={d:(e,s)=>{for(var i in s)t.o(s,i)&&!t.o(e,i)&&Object.defineProperty(e,i,{enumerable:!0,get:s[i]})},o:(t,e)=>Object.prototype.hasOwnProperty.call(t,e),r:t=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})}},e={};t.r(e),t.d(e,{Expression:()=>s,ExpressionSet:()=>n,Matcher:()=>h,default:()=>r});class s{constructor(t,e={},s){this.pattern=t,this.separator=e.separator||".",this.segments=this._parse(t),this.data=s,this._hasDeepWildcard=this.segments.some(t=>"deep-wildcard"===t.type),this._hasAttributeCondition=this.segments.some(t=>void 0!==t.attrName),this._hasPositionSelector=this.segments.some(t=>void 0!==t.position)}_parse(t){const e=[];let s=0,i="";for(;s<t.length;)t[s]===this.separator?s+1<t.length&&t[s+1]===this.separator?(i.trim()&&(e.push(this._parseSegment(i.trim())),i=""),e.push({type:"deep-wildcard"}),s+=2):(i.trim()&&e.push(this._parseSegment(i.trim())),i="",s++):(i+=t[s],s++);return i.trim()&&e.push(this._parseSegment(i.trim())),e}_parseSegment(t){const e={type:"tag"};let s=null,i=t;const h=t.match(/^([^\[]+)(\[[^\]]*\])(.*)$/);if(h&&(i=h[1]+h[3],h[2])){const t=h[2].slice(1,-1);t&&(s=t)}let n,r,a=i;if(i.includes("::")){const e=i.indexOf("::");if(n=i.substring(0,e).trim(),a=i.substring(e+2).trim(),!n)throw new Error(`Invalid namespace in pattern: ${t}`)}let p=null;if(a.includes(":")){const t=a.lastIndexOf(":"),e=a.substring(0,t).trim(),s=a.substring(t+1).trim();["first","last","odd","even"].includes(s)||/^nth\(\d+\)$/.test(s)?(r=e,p=s):r=a}else r=a;if(!r)throw new Error(`Invalid segment pattern: ${t}`);if(e.tag=r,n&&(e.namespace=n),s)if(s.includes("=")){const t=s.indexOf("=");e.attrName=s.substring(0,t).trim(),e.attrValue=s.substring(t+1).trim()}else e.attrName=s.trim();if(p){const t=p.match(/^nth\((\d+)\)$/);t?(e.position="nth",e.positionValue=parseInt(t[1],10)):e.position=p}return e}get length(){return this.segments.length}hasDeepWildcard(){return this._hasDeepWildcard}hasAttributeCondition(){return this._hasAttributeCondition}hasPositionSelector(){return this._hasPositionSelector}toString(){return this.pattern}}class i{constructor(t){this._matcher=t}get separator(){return this._matcher.separator}getCurrentTag(){const t=this._matcher.path;return t.length>0?t[t.length-1].tag:void 0}getCurrentNamespace(){const t=this._matcher.path;return t.length>0?t[t.length-1].namespace:void 0}getAttrValue(t){const e=this._matcher.path;if(0!==e.length)return e[e.length-1].values?.[t]}hasAttr(t){const e=this._matcher.path;if(0===e.length)return!1;const s=e[e.length-1];return void 0!==s.values&&t in s.values}getPosition(){const t=this._matcher.path;return 0===t.length?-1:t[t.length-1].position??0}getCounter(){const t=this._matcher.path;return 0===t.length?-1:t[t.length-1].counter??0}getIndex(){return this.getPosition()}getDepth(){return this._matcher.path.length}toString(t,e=!0){return this._matcher.toString(t,e)}toArray(){return this._matcher.path.map(t=>t.tag)}matches(t){return this._matcher.matches(t)}matchesAny(t){return t.matchesAny(this._matcher)}}class h{constructor(t={}){this.separator=t.separator||".",this.path=[],this.siblingStacks=[],this._pathStringCache=null,this._view=new i(this)}push(t,e=null,s=null){this._pathStringCache=null,this.path.length>0&&(this.path[this.path.length-1].values=void 0);const i=this.path.length;this.siblingStacks[i]||(this.siblingStacks[i]=new Map);const h=this.siblingStacks[i],n=s?`${s}:${t}`:t,r=h.get(n)||0;let a=0;for(const t of h.values())a+=t;h.set(n,r+1);const p={tag:t,position:a,counter:r};null!=s&&(p.namespace=s),null!=e&&(p.values=e),this.path.push(p)}pop(){if(0===this.path.length)return;this._pathStringCache=null;const t=this.path.pop();return this.siblingStacks.length>this.path.length+1&&(this.siblingStacks.length=this.path.length+1),t}updateCurrent(t){if(this.path.length>0){const e=this.path[this.path.length-1];null!=t&&(e.values=t)}}getCurrentTag(){return this.path.length>0?this.path[this.path.length-1].tag:void 0}getCurrentNamespace(){return this.path.length>0?this.path[this.path.length-1].namespace:void 0}getAttrValue(t){if(0!==this.path.length)return this.path[this.path.length-1].values?.[t]}hasAttr(t){if(0===this.path.length)return!1;const e=this.path[this.path.length-1];return void 0!==e.values&&t in e.values}getPosition(){return 0===this.path.length?-1:this.path[this.path.length-1].position??0}getCounter(){return 0===this.path.length?-1:this.path[this.path.length-1].counter??0}getIndex(){return this.getPosition()}getDepth(){return this.path.length}toString(t,e=!0){const s=t||this.separator;if(s===this.separator&&!0===e){if(null!==this._pathStringCache)return this._pathStringCache;const t=this.path.map(t=>t.namespace?`${t.namespace}:${t.tag}`:t.tag).join(s);return this._pathStringCache=t,t}return this.path.map(t=>e&&t.namespace?`${t.namespace}:${t.tag}`:t.tag).join(s)}toArray(){return this.path.map(t=>t.tag)}reset(){this._pathStringCache=null,this.path=[],this.siblingStacks=[]}matches(t){const e=t.segments;return 0!==e.length&&(t.hasDeepWildcard()?this._matchWithDeepWildcard(e):this._matchSimple(e))}_matchSimple(t){if(this.path.length!==t.length)return!1;for(let e=0;e<t.length;e++)if(!this._matchSegment(t[e],this.path[e],e===this.path.length-1))return!1;return!0}_matchWithDeepWildcard(t){let e=this.path.length-1,s=t.length-1;for(;s>=0&&e>=0;){const i=t[s];if("deep-wildcard"===i.type){if(s--,s<0)return!0;const i=t[s];let h=!1;for(let t=e;t>=0;t--)if(this._matchSegment(i,this.path[t],t===this.path.length-1)){e=t-1,s--,h=!0;break}if(!h)return!1}else{if(!this._matchSegment(i,this.path[e],e===this.path.length-1))return!1;e--,s--}}return s<0}_matchSegment(t,e,s){if("*"!==t.tag&&t.tag!==e.tag)return!1;if(void 0!==t.namespace&&"*"!==t.namespace&&t.namespace!==e.namespace)return!1;if(void 0!==t.attrName){if(!s)return!1;if(!e.values||!(t.attrName in e.values))return!1;if(void 0!==t.attrValue&&String(e.values[t.attrName])!==String(t.attrValue))return!1}if(void 0!==t.position){if(!s)return!1;const i=e.counter??0;if("first"===t.position&&0!==i)return!1;if("odd"===t.position&&i%2!=1)return!1;if("even"===t.position&&i%2!=0)return!1;if("nth"===t.position&&i!==t.positionValue)return!1}return!0}matchesAny(t){return t.matchesAny(this)}snapshot(){return{path:this.path.map(t=>({...t})),siblingStacks:this.siblingStacks.map(t=>new Map(t))}}restore(t){this._pathStringCache=null,this.path=t.path.map(t=>({...t})),this.siblingStacks=t.siblingStacks.map(t=>new Map(t))}readOnly(){return this._view}}class n{constructor(){this._byDepthAndTag=new Map,this._wildcardByDepth=new Map,this._deepWildcards=[],this._patterns=new Set,this._sealed=!1}add(t){if(this._sealed)throw new TypeError("ExpressionSet is sealed. Create a new ExpressionSet to add more expressions.");if(this._patterns.has(t.pattern))return this;if(this._patterns.add(t.pattern),t.hasDeepWildcard())return this._deepWildcards.push(t),this;const e=t.length,s=t.segments[t.segments.length-1],i=s?.tag;if(i&&"*"!==i){const s=`${e}:${i}`;this._byDepthAndTag.has(s)||this._byDepthAndTag.set(s,[]),this._byDepthAndTag.get(s).push(t)}else this._wildcardByDepth.has(e)||this._wildcardByDepth.set(e,[]),this._wildcardByDepth.get(e).push(t);return this}addAll(t){for(const e of t)this.add(e);return this}has(t){return this._patterns.has(t.pattern)}get size(){return this._patterns.size}seal(){return this._sealed=!0,this}get isSealed(){return this._sealed}matchesAny(t){return null!==this.findMatch(t)}findMatch(t){const e=t.getDepth(),s=`${e}:${t.getCurrentTag()}`,i=this._byDepthAndTag.get(s);if(i)for(let e=0;e<i.length;e++)if(t.matches(i[e]))return i[e];const h=this._wildcardByDepth.get(e);if(h)for(let e=0;e<h.length;e++)if(t.matches(h[e]))return h[e];for(let e=0;e<this._deepWildcards.length;e++)if(t.matches(this._deepWildcards[e]))return this._deepWildcards[e];return null}}const r={Expression:s,Matcher:h,ExpressionSet:n};module.exports=e})();