@membranehq/sdk 0.29.1 → 0.29.2

package/dist/bundle.js

@@ -23601,7 +23601,7 @@
 	    }
 	}
 
-	/*! Axios v1.16.0 Copyright (c) 2026 Matt Zabriskie and contributors */
+	/*! Axios v1.19.0 Copyright (c) 2026 Matt Zabriskie and contributors */
 	/**
 	 * Create a bound version of a function with a specified `this` context
 	 *
@@ -23621,6 +23621,57 @@
 	const { getPrototypeOf } = Object;
 	const { iterator, toStringTag } = Symbol;
 
+	/* Creating a function that will check if an object has a property. */
+	const hasOwnProperty = (
+	  ({ hasOwnProperty }) =>
+	  (obj, prop) =>
+	    hasOwnProperty.call(obj, prop)
+	)(Object.prototype);
+
+	/**
+	 * Walk the prototype chain (excluding the shared Object.prototype) looking for
+	 * an own `prop`. This distinguishes genuine own/inherited members — including
+	 * class accessors and template prototypes — from members injected via
+	 * Object.prototype pollution (e.g. `Object.prototype.username = '...'`), which
+	 * live on Object.prototype itself and are therefore never matched.
+	 *
+	 * @param {*} thing The value whose chain to inspect
+	 * @param {string|symbol} prop The property key to look for
+	 *
+	 * @returns {boolean} True when `prop` is owned below Object.prototype
+	 */
+	const hasOwnInPrototypeChain = (thing, prop) => {
+	  let obj = thing;
+	  const seen = [];
+
+	  while (obj != null && obj !== Object.prototype) {
+	    if (seen.indexOf(obj) !== -1) {
+	      return false;
+	    }
+	    seen.push(obj);
+
+	    if (hasOwnProperty(obj, prop)) {
+	      return true;
+	    }
+	    obj = getPrototypeOf(obj);
+	  }
+	  return false;
+	};
+
+	/**
+	 * Read `obj[prop]` only when it is safe from Object.prototype pollution. Own
+	 * properties and members inherited from a non-Object.prototype source (a class
+	 * instance or template object) are honored; a value reachable only through a
+	 * polluted Object.prototype is ignored and `undefined` is returned.
+	 *
+	 * @param {*} obj The source object
+	 * @param {string|symbol} prop The property key to read
+	 *
+	 * @returns {*} The resolved value, or undefined when unsafe/absent
+	 */
+	const getSafeProp = (obj, prop) =>
+	  obj != null && hasOwnInPrototypeChain(obj, prop) ? obj[prop] : undefined;
+
 	const kindOf = ((cache) => (thing) => {
 	  const str = toString.call(thing);
 	  return cache[str] || (cache[str] = str.slice(8, -1).toLowerCase());
@@ -23746,7 +23797,7 @@
 	 * @returns {boolean} True if value is a plain Object, otherwise false
 	 */
 	const isPlainObject = (val) => {
-	  if (kindOf(val) !== 'object') {
+	  if (!isObject(val)) {
 	    return false;
 	  }
 
@@ -23754,9 +23805,12 @@
 	  return (
 	    (prototype === null ||
 	      prototype === Object.prototype ||
-	      Object.getPrototypeOf(prototype) === null) &&
-	    !(toStringTag in val) &&
-	    !(iterator in val)
+	      getPrototypeOf(prototype) === null) &&
+	    // Treat any genuine (non-Object.prototype-polluted) Symbol.toStringTag or
+	    // Symbol.iterator as evidence the value is a tagged/iterable type rather
+	    // than a plain object, while ignoring keys injected onto Object.prototype.
+	    !hasOwnInPrototypeChain(val, toStringTag) &&
+	    !hasOwnInPrototypeChain(val, iterator)
 	  );
 	};
 
@@ -23841,6 +23895,7 @@
 	 * @returns {boolean} True if value is a FileList, otherwise false
 	 */
 	const isFileList = kindOfTest('FileList');
+	const isSet = kindOfTest('Set');
 
 	/**
 	 * Determine if a value is a Stream
@@ -24025,7 +24080,9 @@
 	      return;
 	    }
 
-	    const targetKey = (caseless && findKey(result, key)) || key;
+	    // findKey lowercases the key, so caseless lookup only applies to strings —
+	    // symbol keys are identity-matched.
+	    const targetKey = (caseless && typeof key === 'string' && findKey(result, key)) || key;
 	    // Read via own-prop only — a bare `result[targetKey]` walks the prototype
 	    // chain, so a polluted Object.prototype value could surface here and get
 	    // copied into the merged result.
@@ -24042,7 +24099,24 @@
 	  };
 
 	  for (let i = 0, l = objs.length; i < l; i++) {
-	    objs[i] && forEach(objs[i], assignValue);
+	    const source = objs[i];
+	    if (!source || isBuffer(source)) {
+	      continue;
+	    }
+
+	    forEach(source, assignValue);
+
+	    if (typeof source !== 'object' || isArray(source)) {
+	      continue;
+	    }
+
+	    const symbols = Object.getOwnPropertySymbols(source);
+	    for (let j = 0; j < symbols.length; j++) {
+	      const symbol = symbols[j];
+	      if (propertyIsEnumerable.call(source, symbol)) {
+	        assignValue(source[symbol], symbol);
+	      }
+	    }
 	  }
 	  return result;
 	}
@@ -24264,12 +24338,7 @@
 	  });
 	};
 
-	/* Creating a function that will check if an object has a property. */
-	const hasOwnProperty = (
-	  ({ hasOwnProperty }) =>
-	  (obj, prop) =>
-	    hasOwnProperty.call(obj, prop)
-	)(Object.prototype);
+	const { propertyIsEnumerable } = Object.prototype;
 
 	/**
 	 * Determine if a value is a RegExp object
@@ -24376,11 +24445,11 @@
 	 * @returns {Object} The JSON-compatible object.
 	 */
 	const toJSONObject = (obj) => {
-	  const stack = new Array(10);
+	  const visited = new WeakSet();
 
-	  const visit = (source, i) => {
+	  const visit = (source) => {
 	    if (isObject(source)) {
-	      if (stack.indexOf(source) >= 0) {
+	      if (visited.has(source)) {
 	        return;
 	      }
 
@@ -24390,15 +24459,27 @@
 	      }
 
 	      if (!('toJSON' in source)) {
-	        stack[i] = source;
-	        const target = isArray(source) ? [] : {};
+	        // add-on descent / delete-on-ascent: preserves path semantics, so DAG nodes serialise at every occurrence (see #7230).
+	        visited.add(source);
 
-	        forEach(source, (value, key) => {
-	          const reducedValue = visit(value, i + 1);
-	          !isUndefined(reducedValue) && (target[key] = reducedValue);
-	        });
+	        let target;
+
+	        if (isSet(source)) {
+	          target = [];
+	          for (const value of source) {
+	            const reducedValue = visit(value);
+	            !isUndefined(reducedValue) && target.push(reducedValue);
+	          }
+	        } else {
+	          target = isArray(source) ? [] : {};
+
+	          forEach(source, (value, key) => {
+	            const reducedValue = visit(value);
+	            !isUndefined(reducedValue) && (target[key] = reducedValue);
+	          });
+	        }
 
-	        stack[i] = undefined;
+	        visited.delete(source);
 
 	        return target;
 	      }
@@ -24407,7 +24488,7 @@
 	    return source;
 	  };
 
-	  return visit(obj, 0);
+	  return visit(obj);
 	};
 
 	/**
@@ -24481,6 +24562,20 @@
 
 	const isIterable = (thing) => thing != null && isFunction$1(thing[iterator]);
 
+	/**
+	 * Determine if a value is iterable via an iterator that is NOT sourced solely
+	 * from a polluted Object.prototype. Use this instead of `isIterable` whenever
+	 * the iterable comes from untrusted input (e.g. user-supplied header sources),
+	 * so `Object.prototype[Symbol.iterator] = ...` cannot turn an ordinary object
+	 * into an attacker-controlled entries iterator.
+	 *
+	 * @param {*} thing The value to test
+	 *
+	 * @returns {boolean} True if value has a non-polluted iterator
+	 */
+	const isSafeIterable = (thing) =>
+	  thing != null && hasOwnInPrototypeChain(thing, iterator) && isIterable(thing);
+
 	var utils$1 = {
 	  isArray,
 	  isArrayBuffer,
@@ -24525,6 +24620,8 @@
 	  isHTMLForm,
 	  hasOwnProperty,
 	  hasOwnProp: hasOwnProperty, // an alias to avoid ESLint no-prototype-builtins detection
+	  hasOwnInPrototypeChain,
+	  getSafeProp,
 	  reduceDescriptors,
 	  freezeMethods,
 	  toObjectSet,
@@ -24541,6 +24638,7 @@
 	  setImmediate: _setImmediate,
 	  asap,
 	  isIterable,
+	  isSafeIterable,
 	};
 
 	// RawAxiosHeaders whose duplicates are ignored by node
@@ -24591,28 +24689,26 @@
 	      key = line.substring(0, i).trim().toLowerCase();
 	      val = line.substring(i + 1).trim();
 
-	      if (!key || (parsed[key] && ignoreDuplicateOf[key])) {
+	      const hasKey = utils$1.hasOwnProp(parsed, key);
+
+	      if (!key || (hasKey && utils$1.hasOwnProp(ignoreDuplicateOf, key))) {
 	        return;
 	      }
 
 	      if (key === 'set-cookie') {
-	        if (parsed[key]) {
+	        if (hasKey) {
 	          parsed[key].push(val);
 	        } else {
 	          parsed[key] = [val];
 	        }
 	      } else {
-	        parsed[key] = parsed[key] ? parsed[key] + ', ' + val : val;
+	        parsed[key] = hasKey ? parsed[key] + ', ' + val : val;
 	      }
 	    });
 
 	  return parsed;
 	};
 
-	const $internals = Symbol('internals');
-
-	const INVALID_HEADER_VALUE_CHARS_RE = /[^\x09\x20-\x7E\x80-\xFF]/g;
-
 	function trimSPorHTAB(str) {
 	  let start = 0;
 	  let end = str.length;
@@ -24640,12 +24736,40 @@
 	  return start === 0 && end === str.length ? str : str.slice(start, end);
 	}
 
-	function normalizeHeader(header) {
-	  return header && String(header).trim().toLowerCase();
+	// The control-code ranges are intentional: header sanitization strips C0/DEL bytes.
+	// eslint-disable-next-line no-control-regex
+	const INVALID_UNICODE_HEADER_VALUE_CHARS = new RegExp('[\\u0000-\\u0008\\u000a-\\u001f\\u007f]+', 'g');
+	// eslint-disable-next-line no-control-regex
+	const INVALID_BYTE_STRING_HEADER_VALUE_CHARS = new RegExp('[^\\u0009\\u0020-\\u007e\\u0080-\\u00ff]+', 'g');
+
+	function sanitizeValue(value, invalidChars) {
+	  if (utils$1.isArray(value)) {
+	    return value.map((item) => sanitizeValue(item, invalidChars));
+	  }
+
+	  return trimSPorHTAB(String(value).replace(invalidChars, ''));
+	}
+
+	const sanitizeHeaderValue = (value) =>
+	  sanitizeValue(value, INVALID_UNICODE_HEADER_VALUE_CHARS);
+
+	const sanitizeByteStringHeaderValue = (value) =>
+	  sanitizeValue(value, INVALID_BYTE_STRING_HEADER_VALUE_CHARS);
+
+	function toByteStringHeaderObject(headers) {
+	  const byteStringHeaders = Object.create(null);
+
+	  utils$1.forEach(headers.toJSON(), (value, header) => {
+	    byteStringHeaders[header] = sanitizeByteStringHeaderValue(value);
+	  });
+
+	  return byteStringHeaders;
 	}
 
-	function sanitizeHeaderValue(str) {
-	  return trimSPorHTAB(str.replace(INVALID_HEADER_VALUE_CHARS_RE, ''));
+	const $internals = Symbol('internals');
+
+	function normalizeHeader(header) {
+	  return header && String(header).trim().toLowerCase();
 	}
 
 	function normalizeValue(value) {
@@ -24668,6 +24792,124 @@
 	  return tokens;
 	}
 
+	const parameterNameRE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+
+	function trimOWS(value) {
+	  let start = 0;
+	  let end = value.length;
+
+	  while (start < end) {
+	    const code = value.charCodeAt(start);
+
+	    if (code !== 0x09 && code !== 0x20) {
+	      break;
+	    }
+
+	    start += 1;
+	  }
+
+	  while (end > start) {
+	    const code = value.charCodeAt(end - 1);
+
+	    if (code !== 0x09 && code !== 0x20) {
+	      break;
+	    }
+
+	    end -= 1;
+	  }
+
+	  return start === 0 && end === value.length ? value : value.slice(start, end);
+	}
+
+	function decodeQuotedString(value) {
+	  const last = value.length - 1;
+
+	  if (last < 1 || value.charCodeAt(0) !== 0x22 || value.charCodeAt(last) !== 0x22) {
+	    return value;
+	  }
+
+	  let decoded = '';
+
+	  for (let i = 1; i < last; i++) {
+	    const code = value.charCodeAt(i);
+
+	    if (code === 0x22) {
+	      return value;
+	    }
+
+	    if (code === 0x5c) {
+	      i += 1;
+
+	      if (i >= last) {
+	        return value;
+	      }
+	    }
+
+	    decoded += value[i];
+	  }
+
+	  return decoded;
+	}
+
+	function parseParameters(value) {
+	  const parameters = Object.create(null);
+	  const str = String(value);
+	  let start = 0;
+	  let quoted = false;
+	  let escaped = false;
+
+	  function parseParameter(end) {
+	    const part = trimOWS(str.slice(start, end));
+	    const equals = part.indexOf('=');
+
+	    if (equals < 1) {
+	      return;
+	    }
+
+	    const name = trimOWS(part.slice(0, equals));
+
+	    if (!parameterNameRE.test(name)) {
+	      return;
+	    }
+
+	    const normalizedName = name.toLowerCase();
+
+	    if (
+	      normalizedName === '__proto__' ||
+	      normalizedName === 'constructor' ||
+	      normalizedName === 'prototype'
+	    ) {
+	      return;
+	    }
+
+	    const parameterValue = trimOWS(part.slice(equals + 1));
+	    parameters[normalizedName] = decodeQuotedString(parameterValue);
+	  }
+
+	  for (let i = 0; i < str.length; i++) {
+	    const code = str.charCodeAt(i);
+
+	    if (quoted) {
+	      if (escaped) {
+	        escaped = false;
+	      } else if (code === 0x5c) {
+	        escaped = true;
+	      } else if (code === 0x22) {
+	        quoted = false;
+	      }
+	    } else if (code === 0x22) {
+	      quoted = true;
+	    } else if (code === 0x2c || code === 0x3b) {
+	      parseParameter(i);
+	      start = i + 1;
+	    }
+	  }
+
+	  parseParameter(str.length);
+
+	  return parameters;
+	}
+
 	const isValidHeaderName = (str) => /^[-_a-zA-Z0-9^`|~,!#$%&'*+.]+$/.test(str.trim());
 
 	function matchHeaderValue(context, value, header, filter, isHeaderNameFilter) {
@@ -24727,7 +24969,7 @@
 	      const lHeader = normalizeHeader(_header);
 
 	      if (!lHeader) {
-	        throw new Error('header name must be a non-empty string');
+	        return;
 	      }
 
 	      const key = utils$1.findKey(self, lHeader);
@@ -24749,20 +24991,23 @@
 	      setHeaders(header, valueOrRewrite);
 	    } else if (utils$1.isString(header) && (header = header.trim()) && !isValidHeaderName(header)) {
 	      setHeaders(parseHeaders(header), valueOrRewrite);
-	    } else if (utils$1.isObject(header) && utils$1.isIterable(header)) {
-	      let obj = {},
+	    } else if (utils$1.isObject(header) && utils$1.isSafeIterable(header)) {
+	      let obj = Object.create(null),
 	        dest,
 	        key;
 	      for (const entry of header) {
 	        if (!utils$1.isArray(entry)) {
-	          throw TypeError('Object iterator must return a key-value pair');
+	          throw new TypeError('Object iterator must return a key-value pair');
 	        }
 
-	        obj[(key = entry[0])] = (dest = obj[key])
-	          ? utils$1.isArray(dest)
-	            ? [...dest, entry[1]]
-	            : [dest, entry[1]]
-	          : entry[1];
+	        key = entry[0];
+
+	        if (utils$1.hasOwnProp(obj, key)) {
+	          dest = obj[key];
+	          obj[key] = utils$1.isArray(dest) ? [...dest, entry[1]] : [dest, entry[1]];
+	        } else {
+	          obj[key] = entry[1];
+	        }
 	      }
 
 	      setHeaders(obj, valueOrRewrite);
@@ -24916,7 +25161,8 @@
 	  }
 
 	  getSetCookie() {
-	    return this.get('set-cookie') || [];
+	    const value = this.get('set-cookie');
+	    return utils$1.isArray(value) ? value : value == null || value === false ? [] : [value];
 	  }
 
 	  get [Symbol.toStringTag]() {
@@ -24927,6 +25173,10 @@
 	    return thing instanceof this ? thing : new this(thing);
 	  }
 
+	  static parseParameters(value) {
+	    return parseParameters(value);
+	  }
+
 	  static concat(first, ...targets) {
 	    const computed = new this(first);
 
@@ -25052,10 +25302,53 @@
 	  return visit(config);
 	}
 
+	function stringifySafely$1(value) {
+	  try {
+	    return String(value);
+	  } catch (err) {
+	    return '';
+	  }
+	}
+
+	function aggregateErrorMessage(error) {
+	  const message = error.errors
+	    .map((entry) => {
+	      try {
+	        return entry && entry.message ? stringifySafely$1(entry.message) : stringifySafely$1(entry);
+	      } catch (err) {
+	        return '';
+	      }
+	    })
+	    .filter(Boolean)
+	    .join('; ');
+
+	  return message || error.name || 'AggregateError';
+	}
+
 	let AxiosError$1 = class AxiosError extends Error {
 	  static from(error, code, config, request, response, customProps) {
-	    const axiosError = new AxiosError(error.message, code || error.code, config, request, response);
-	    axiosError.cause = error;
+	    // `AggregateError` (thrown by Node on dual-stack/Happy-Eyeballs connection
+	    // failures) has an empty `message`; its detail lives in `errors[]`. Without
+	    // this, the wrapped error surfaces with a blank message (see #6721).
+	    let message = error.message;
+	    if (!message && utils$1.isArray(error.errors) && error.errors.length) {
+	      message = aggregateErrorMessage(error);
+	    }
+
+	    const axiosError = new AxiosError(message, code || error.code, config, request, response);
+	    // Match native `Error` `cause` semantics: non-enumerable. The wrapped
+	    // error often carries circular internals (sockets, requests, agents), so
+	    // an enumerable `cause` makes structured loggers (pino/winston) and any
+	    // own-property walk throw "Converting circular structure to JSON".
+	    // Regression from #6982; see #7205. `__proto__: null` mirrors the
+	    // `message` descriptor below (prototype-pollution-safe descriptor).
+	    Object.defineProperty(axiosError, 'cause', {
+	      __proto__: null,
+	      value: error,
+	      writable: true,
+	      enumerable: false,
+	      configurable: true,
+	    });
 	    axiosError.name = error.name;
 
 	    // Preserve status from the original error if not already set from response
@@ -25156,6 +25449,10 @@
 	// eslint-disable-next-line strict
 	var httpAdapter = null;
 
+	// Default nesting limit shared with the inverse transform (formDataToJSON) so
+	// the FormData <-> JSON round-trip stays symmetric.
+	const DEFAULT_FORM_DATA_MAX_DEPTH = 100;
+
 	/**
 	 * Determines if the given thing is a array or js object.
 	 *
@@ -25266,8 +25563,9 @@
 	  const dots = options.dots;
 	  const indexes = options.indexes;
 	  const _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob);
-	  const maxDepth = options.maxDepth === undefined ? 100 : options.maxDepth;
+	  const maxDepth = options.maxDepth === undefined ? DEFAULT_FORM_DATA_MAX_DEPTH : options.maxDepth;
 	  const useBlob = _Blob && utils$1.isSpecCompliantForm(formData);
+	  const stack = [];
 
 	  if (!utils$1.isFunction(visitor)) {
 	    throw new TypeError('visitor must be a function');
@@ -25289,12 +25587,47 @@
 	    }
 
 	    if (utils$1.isArrayBuffer(value) || utils$1.isTypedArray(value)) {
-	      return useBlob && typeof Blob === 'function' ? new Blob([value]) : Buffer.from(value);
+	      if (useBlob && typeof _Blob === 'function') {
+	        return new _Blob([value]);
+	      }
+	      throw new AxiosError$1('Blob is not supported. Use a Buffer instead.', AxiosError$1.ERR_NOT_SUPPORT);
 	    }
 
 	    return value;
 	  }
 
+	  function throwIfMaxDepthExceeded(depth) {
+	    if (depth > maxDepth) {
+	      throw new AxiosError$1(
+	        'Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth,
+	        AxiosError$1.ERR_FORM_DATA_DEPTH_EXCEEDED
+	      );
+	    }
+	  }
+
+	  function stringifyWithDepthLimit(value, depth) {
+	    if (maxDepth === Infinity) {
+	      return JSON.stringify(value);
+	    }
+
+	    const ancestors = [];
+
+	    return JSON.stringify(value, function limitDepth(_key, currentValue) {
+	      if (!utils$1.isObject(currentValue)) {
+	        return currentValue;
+	      }
+
+	      while (ancestors.length && ancestors[ancestors.length - 1] !== this) {
+	        ancestors.pop();
+	      }
+
+	      ancestors.push(currentValue);
+	      throwIfMaxDepthExceeded(depth + ancestors.length - 1);
+
+	      return currentValue;
+	    });
+	  }
+
 	  /**
 	   * Default visitor.
 	   *
@@ -25318,7 +25651,7 @@
 	        // eslint-disable-next-line no-param-reassign
 	        key = metaTokens ? key : key.slice(0, -2);
 	        // eslint-disable-next-line no-param-reassign
-	        value = JSON.stringify(value);
+	        value = stringifyWithDepthLimit(value, 1);
 	      } else if (
 	        (utils$1.isArray(value) && isFlatArray(value)) ||
 	        ((utils$1.isFileList(value) || utils$1.endsWith(key, '[]')) && (arr = utils$1.toArray(value)))
@@ -25351,8 +25684,6 @@
 	    return false;
 	  }
 
-	  const stack = [];
-
 	  const exposedHelpers = Object.assign(predicates, {
 	    defaultVisitor,
 	    convertValue,
@@ -25362,15 +25693,10 @@
 	  function build(value, path, depth = 0) {
 	    if (utils$1.isUndefined(value)) return;
 
-	    if (depth > maxDepth) {
-	      throw new AxiosError$1(
-	        'Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth,
-	        AxiosError$1.ERR_FORM_DATA_DEPTH_EXCEEDED
-	      );
-	    }
+	    throwIfMaxDepthExceeded(depth);
 
 	    if (stack.indexOf(value) !== -1) {
-	      throw Error('Circular reference detected in ' + path.join('.'));
+	      throw new Error('Circular reference detected in ' + path.join('.'));
 	    }
 
 	    stack.push(value);
@@ -25441,9 +25767,7 @@
 
 	prototype.toString = function toString(encoder) {
 	  const _encode = encoder
-	    ? function (value) {
-	        return encoder.call(this, value, encode$1);
-	      }
+	    ? (value) => encoder.call(this, value, encode$1)
 	    : encode$1;
 
 	  return this._pairs
@@ -25482,8 +25806,7 @@
 	  if (!params) {
 	    return url;
 	  }
-
-	  const _encode = (options && options.encode) || encode;
+	  url = url || '';
 
 	  const _options = utils$1.isFunction(options)
 	    ? {
@@ -25491,7 +25814,11 @@
 	      }
 	    : options;
 
-	  const serializeFn = _options && _options.serialize;
+	  // Read serializer options pollution-safely: own properties and methods on a
+	  // class/template prototype are honored, but values injected onto a polluted
+	  // Object.prototype are ignored.
+	  const _encode = utils$1.getSafeProp(_options, 'encode') || encode;
+	  const serializeFn = utils$1.getSafeProp(_options, 'serialize');
 
 	  let serializedParams;
 
@@ -25587,6 +25914,8 @@
 	  forcedJSONParsing: true,
 	  clarifyTimeoutError: false,
 	  legacyInterceptorReqResOrdering: true,
+	  advertiseZstdAcceptEncoding: false,
+	  validateStatusUndefinedResolves: true,
 	};
 
 	var URLSearchParams$1 = typeof URLSearchParams !== 'undefined' ? URLSearchParams : AxiosURLSearchParams;
@@ -25678,6 +26007,17 @@
 	  });
 	}
 
+	const MAX_DEPTH = DEFAULT_FORM_DATA_MAX_DEPTH;
+
+	function throwIfDepthExceeded(index) {
+	  if (index > MAX_DEPTH) {
+	    throw new AxiosError$1(
+	      'FormData field is too deeply nested (' + index + ' levels). Max depth: ' + MAX_DEPTH,
+	      AxiosError$1.ERR_FORM_DATA_DEPTH_EXCEEDED
+	    );
+	  }
+	}
+
 	/**
 	 * It takes a string like `foo[x][y][z]` and returns an array like `['foo', 'x', 'y', 'z']
 	 *
@@ -25686,13 +26026,26 @@
 	 * @returns An array of strings.
 	 */
 	function parsePropPath(name) {
-	  // foo[x][y][z]
-	  // foo.x.y.z
-	  // foo-x-y-z
-	  // foo x y z
-	  return utils$1.matchAll(/\w+|\[(\w*)]/g, name).map((match) => {
-	    return match[0] === '[]' ? '' : match[1] || match[0];
-	  });
+	  // foo[x][y][z] -> ['foo', 'x', 'y', 'z']
+	  // foo.x.y.z    -> ['foo', 'x', 'y', 'z']
+	  // A path is split on `.` and on `[...]` groups. A segment — whether written
+	  // in dot notation or captured inside brackets — may contain any character
+	  // except `.`, `[` and `]`, so a key like `user-name` or `user name` is kept
+	  // literal instead of being split (#5402). `.`, `[` and `]` keep their existing
+	  // meaning, e.g. `foo[bar.baz]` -> ['foo', 'bar', 'baz'] and `[]` is an array push.
+	  // Excluding `[` from the bracket group also makes the match fail fast at the
+	  // next `[`, so a malformed name cannot rescan to the end of the string from
+	  // every unmatched `[` — parsing stays linear in the length of the name.
+	  const path = [];
+	  const pattern = /[^.[\]]+|\[([^.[\]]*)]/g;
+	  let match;
+
+	  while ((match = pattern.exec(name)) !== null) {
+	    throwIfDepthExceeded(path.length);
+	    path.push(match[0] === '[]' ? '' : match[1] || match[0]);
+	  }
+
+	  return path;
 	}
 
 	/**
@@ -25724,6 +26077,8 @@
 	 */
 	function formDataToJSON(formData) {
 	  function buildPath(path, value, target, index) {
+	    throwIfDepthExceeded(index);
+
 	    let name = path[index++];
 
 	    if (name === '__proto__') return true;
@@ -25744,7 +26099,7 @@
 	      return !isNumericKey;
 	    }
 
-	    if (!target[name] || !utils$1.isObject(target[name])) {
+	    if (!utils$1.hasOwnProp(target, name) || !utils$1.isObject(target[name])) {
 	      target[name] = [];
 	    }
 
@@ -26109,9 +26464,12 @@
 	  const _speedometer = speedometer(50, 250);
 
 	  return throttle((e) => {
+	    if (!e || typeof e.loaded !== 'number') {
+	      return;
+	    }
 	    const rawLoaded = e.loaded;
 	    const total = e.lengthComputable ? e.total : undefined;
-	    const loaded = total != null ? Math.min(rawLoaded, total) : rawLoaded;
+	    const loaded = Math.max(0, total != null ? Math.min(rawLoaded, total) : rawLoaded);
 	    const progressBytes = Math.max(0, loaded - bytesNotified);
 	    const rate = _speedometer(progressBytes);
 
@@ -26148,9 +26506,9 @@
 	};
 
 	const asyncDecorator =
-	  (fn) =>
+	  (fn, scheduler = utils$1.asap) =>
 	  (...args) =>
-	    utils$1.asap(() => fn(...args));
+	    scheduler(() => fn(...args));
 
 	var isURLSameOrigin = platform.hasStandardBrowserEnv
 	  ? ((origin, isMSIE) => (url) => {
@@ -26206,7 +26564,11 @@
 	          const cookie = cookies[i].replace(/^\s+/, '');
 	          const eq = cookie.indexOf('=');
 	          if (eq !== -1 && cookie.slice(0, eq) === name) {
-	            return decodeURIComponent(cookie.slice(eq + 1));
+	            try {
+	              return decodeURIComponent(cookie.slice(eq + 1));
+	            } catch (e) {
+	              return cookie.slice(eq + 1);
+	            }
 	          }
 	        }
 	        return null;
@@ -26252,9 +26614,80 @@
 	 * @returns {string} The combined URL
 	 */
 	function combineURLs(baseURL, relativeURL) {
-	  return relativeURL
-	    ? baseURL.replace(/\/?\/$/, '') + '/' + relativeURL.replace(/^\/+/, '')
-	    : baseURL;
+	  if (!relativeURL) {
+	    return baseURL;
+	  }
+
+	  let end = baseURL.length;
+
+	  while (end > 0 && baseURL.charCodeAt(end - 1) === 47) {
+	    end--;
+	  }
+
+	  return baseURL.slice(0, end) + '/' + relativeURL.replace(/^\/+/, '');
+	}
+
+	const malformedHttpProtocol = /^https?:(?!\/\/)/i;
+	const httpProtocolControlCharacters = /[\t\n\r]/g;
+
+	function stripLeadingC0ControlOrSpace(url) {
+	  let i = 0;
+	  while (i < url.length && url.charCodeAt(i) <= 0x20) {
+	    i++;
+	  }
+	  return url.slice(i);
+	}
+
+	function normalizeURLForProtocolCheck(url) {
+	  return stripLeadingC0ControlOrSpace(url).replace(httpProtocolControlCharacters, '');
+	}
+
+	// Redact the parts of a URL that can carry secrets before it is embedded in an
+	// error message. AxiosError.toJSON() serializes `message` verbatim and errors
+	// are commonly logged, while the opt-in `config.redact` model only cleans
+	// config keys — it cannot reach the message. Redact only the genuinely
+	// sensitive substrings — userinfo (credentials), query parameter values and
+	// fragment contents — with the same REDACTED marker the config redaction uses,
+	// while keeping the scheme, host, path and parameter names so the offending
+	// request stays accurately identifiable.
+	function redactFragment(fragment) {
+	  if (!fragment) {
+	    return fragment;
+	  }
+
+	  return fragment.replace(/(^|&)([^=&]*=)?[^&]+/g, (match, separator, parameterName = '') => {
+	    return `${separator}${parameterName}${REDACTED}`;
+	  });
+	}
+
+	function redactSensitiveURLParts(url) {
+	  const redactedURL = url.replace(/^(https?:\/{0,2})[^/?#]*@/i, `$1${REDACTED}@`);
+	  const fragmentIndex = redactedURL.indexOf('#');
+	  const urlWithoutFragment =
+	    fragmentIndex === -1 ? redactedURL : redactedURL.slice(0, fragmentIndex);
+	  const redactedURLWithoutFragment = urlWithoutFragment.replace(
+	    /([?&][^=&#]*=)[^&#]*/g,
+	    `$1${REDACTED}`
+	  );
+
+	  if (fragmentIndex === -1) {
+	    return redactedURLWithoutFragment;
+	  }
+
+	  return `${redactedURLWithoutFragment}#${redactFragment(redactedURL.slice(fragmentIndex + 1))}`;
+	}
+
+	function assertValidHttpProtocolURL(url, config) {
+	  if (typeof url === 'string') {
+	    const normalizedURL = normalizeURLForProtocolCheck(url);
+	    if (malformedHttpProtocol.test(normalizedURL)) {
+	      throw new AxiosError$1(
+	        `Invalid URL ${JSON.stringify(redactSensitiveURLParts(normalizedURL))}: missing "//" after protocol`,
+	        AxiosError$1.ERR_INVALID_URL,
+	        config
+	      );
+	    }
+	  }
 	}
 
 	/**
@@ -26267,9 +26700,11 @@
 	 *
 	 * @returns {string} The combined full path
 	 */
-	function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
+	function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls, config) {
+	  assertValidHttpProtocolURL(requestedURL, config);
 	  let isRelativeUrl = !isAbsoluteURL(requestedURL);
 	  if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
+	    assertValidHttpProtocolURL(baseURL, config);
 	    return combineURLs(baseURL, requestedURL);
 	  }
 	  return requestedURL;
@@ -26277,6 +26712,17 @@
 
 	const headersToObject = (thing) => (thing instanceof AxiosHeaders$1 ? { ...thing } : thing);
 
+	const ownEnumerableKeys = (thing) => {
+	  if (Object.getOwnPropertySymbols && Object.getOwnPropertyDescriptor) {
+	    return Object.keys(thing).concat(
+	      Object.getOwnPropertySymbols(thing).filter(
+	        (symbol) => Object.getOwnPropertyDescriptor(thing, symbol).enumerable
+	      )
+	    );
+	  }
+	  return Object.keys(thing);
+	};
+
 	/**
 	 * Config-specific merge-function which creates a new config-object
 	 * by merging two configuration objects together.
@@ -26288,6 +26734,7 @@
 	 */
 	function mergeConfig$1(config1, config2) {
 	  // eslint-disable-next-line no-param-reassign
+	  config1 = config1 || {};
 	  config2 = config2 || {};
 
 	  // Use a null-prototype object so that downstream reads such as `config.auth`
@@ -26340,6 +26787,32 @@
 	    }
 	  }
 
+	  function getMergedTransitionalOption(prop) {
+	    const transitional2 = utils$1.hasOwnProp(config2, 'transitional')
+	      ? config2.transitional
+	      : undefined;
+
+	    if (!utils$1.isUndefined(transitional2)) {
+	      if (utils$1.isPlainObject(transitional2)) {
+	        if (utils$1.hasOwnProp(transitional2, prop)) {
+	          return transitional2[prop];
+	        }
+	      } else {
+	        return undefined;
+	      }
+	    }
+
+	    const transitional1 = utils$1.hasOwnProp(config1, 'transitional')
+	      ? config1.transitional
+	      : undefined;
+
+	    if (utils$1.isPlainObject(transitional1) && utils$1.hasOwnProp(transitional1, prop)) {
+	      return transitional1[prop];
+	    }
+
+	    return undefined;
+	  }
+
 	  // eslint-disable-next-line consistent-return
 	  function mergeDirectKeys(a, b, prop) {
 	    if (utils$1.hasOwnProp(config2, prop)) {
@@ -26383,7 +26856,7 @@
 	      mergeDeepProperties(headersToObject(a), headersToObject(b), prop, true),
 	  };
 
-	  utils$1.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
+	  utils$1.forEach(ownEnumerableKeys({ ...config1, ...config2 }), function computeConfigValue(prop) {
 	    if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') return;
 	    const merge = utils$1.hasOwnProp(mergeMap, prop) ? mergeMap[prop] : mergeDeepProperties;
 	    const a = utils$1.hasOwnProp(config1, prop) ? config1[prop] : undefined;
@@ -26392,18 +26865,41 @@
 	    (utils$1.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
 	  });
 
+	  if (
+	    utils$1.hasOwnProp(config2, 'validateStatus') &&
+	    utils$1.isUndefined(config2.validateStatus) &&
+	    getMergedTransitionalOption('validateStatusUndefinedResolves') === false
+	  ) {
+	    if (utils$1.hasOwnProp(config1, 'validateStatus')) {
+	      config.validateStatus = getMergedValue(undefined, config1.validateStatus);
+	    } else {
+	      delete config.validateStatus;
+	    }
+	  }
+
 	  return config;
 	}
 
 	const FORM_DATA_CONTENT_HEADERS = ['content-type', 'content-length'];
 
+	/**
+	 * Apply the headers generated by a FormData implementation to the request headers,
+	 * honoring the `formDataHeaderPolicy` option: with 'content-only', copy only the
+	 * content-* headers; otherwise merge all of them.
+	 *
+	 * @param {AxiosHeaders} headers - the request headers to mutate
+	 * @param {Object | null | undefined} formHeaders - headers produced by the FormData implementation
+	 * @param {String} [policy] - the resolved `formDataHeaderPolicy` config value
+	 *
+	 * @returns {void}
+	 */
 	function setFormDataHeaders(headers, formHeaders, policy) {
 	  if (policy !== 'content-only') {
 	    headers.set(formHeaders);
 	    return;
 	  }
 
-	  Object.entries(formHeaders).forEach(([key, val]) => {
+	  Object.entries(formHeaders || {}).forEach(([key, val]) => {
 	    if (FORM_DATA_CONTENT_HEADERS.includes(key.toLowerCase())) {
 	      headers.set(key, val);
 	    }
@@ -26418,12 +26914,12 @@
 	 *
 	 * @returns {string} UTF-8 bytes as a Latin-1 string
 	 */
-	const encodeUTF8 = (str) =>
+	const encodeUTF8$1 = (str) =>
 	  encodeURIComponent(str).replace(/%([0-9A-F]{2})/gi, (_, hex) =>
 	    String.fromCharCode(parseInt(hex, 16))
 	  );
 
-	var resolveConfig = (config) => {
+	function resolveConfig(config) {
 	  const newConfig = mergeConfig$1({}, config);
 
 	  // Read only own properties to prevent prototype pollution gadgets
@@ -26443,23 +26939,33 @@
 	  newConfig.headers = headers = AxiosHeaders$1.from(headers);
 
 	  newConfig.url = buildURL(
-	    buildFullPath(baseURL, url, allowAbsoluteUrls),
-	    config.params,
-	    config.paramsSerializer
+	    buildFullPath(baseURL, url, allowAbsoluteUrls, newConfig),
+	    own('params'),
+	    own('paramsSerializer')
 	  );
 
 	  // HTTP basic authentication
 	  if (auth) {
-	    headers.set(
-	      'Authorization',
-	      'Basic ' +
-	        btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))
-	    );
+	    const username = utils$1.getSafeProp(auth, 'username') || '';
+	    const password = utils$1.getSafeProp(auth, 'password') || '';
+
+	    try {
+	      headers.set(
+	        'Authorization',
+	        'Basic ' + btoa(username + ':' + (password ? encodeUTF8$1(password) : ''))
+	      );
+	    } catch (e) {
+	      throw AxiosError$1.from(e, AxiosError$1.ERR_BAD_OPTION_VALUE, config);
+	    }
 	  }
 
 	  if (utils$1.isFormData(data)) {
-	    if (platform.hasStandardBrowserEnv || platform.hasStandardBrowserWebWorkerEnv) {
-	      headers.setContentType(undefined); // browser handles it
+	    if (
+	      platform.hasStandardBrowserEnv ||
+	      platform.hasStandardBrowserWebWorkerEnv ||
+	      utils$1.isReactNative(data)
+	    ) {
+	      headers.setContentType(undefined); // browser/web worker/RN handles it
 	    } else if (utils$1.isFunction(data.getHeaders)) {
 	      // Node.js FormData (like form-data package)
 	      setFormDataHeaders(headers, data.getHeaders(), own('formDataHeaderPolicy'));
@@ -26491,7 +26997,7 @@
 	  }
 
 	  return newConfig;
-	};
+	}
 
 	const isXHRAdapterSupported = typeof XMLHttpRequest !== 'undefined';
 
@@ -26640,7 +27146,7 @@
 
 	      // Add headers to the request
 	      if ('setRequestHeader' in request) {
-	        utils$1.forEach(requestHeaders.toJSON(), function setRequestHeader(val, key) {
+	        utils$1.forEach(toByteStringHeaderObject(requestHeaders), function setRequestHeader(val, key) {
 	          request.setRequestHeader(key, val);
 	        });
 	      }
@@ -26701,6 +27207,7 @@
 	            config
 	          )
 	        );
+	        done();
 	        return;
 	      }
 
@@ -26710,54 +27217,66 @@
 	  };
 
 	const composeSignals = (signals, timeout) => {
-	  const { length } = (signals = signals ? signals.filter(Boolean) : []);
-
-	  if (timeout || length) {
-	    let controller = new AbortController();
-
-	    let aborted;
-
-	    const onabort = function (reason) {
-	      if (!aborted) {
-	        aborted = true;
-	        unsubscribe();
-	        const err = reason instanceof Error ? reason : this.reason;
-	        controller.abort(
-	          err instanceof AxiosError$1
-	            ? err
-	            : new CanceledError$1(err instanceof Error ? err.message : err)
-	        );
-	      }
-	    };
+	  signals = signals ? signals.filter(Boolean) : [];
 
-	    let timer =
-	      timeout &&
-	      setTimeout(() => {
-	        timer = null;
-	        onabort(new AxiosError$1(`timeout of ${timeout}ms exceeded`, AxiosError$1.ETIMEDOUT));
-	      }, timeout);
-
-	    const unsubscribe = () => {
-	      if (signals) {
-	        timer && clearTimeout(timer);
-	        timer = null;
-	        signals.forEach((signal) => {
-	          signal.unsubscribe
-	            ? signal.unsubscribe(onabort)
-	            : signal.removeEventListener('abort', onabort);
-	        });
-	        signals = null;
-	      }
-	    };
+	  if (!timeout && !signals.length) {
+	    return;
+	  }
 
-	    signals.forEach((signal) => signal.addEventListener('abort', onabort));
+	  const controller = new AbortController();
 
-	    const { signal } = controller;
+	  let aborted = false;
 
-	    signal.unsubscribe = () => utils$1.asap(unsubscribe);
+	  const onabort = function (reason) {
+	    if (!aborted) {
+	      aborted = true;
+	      unsubscribe();
+	      const err = reason instanceof Error ? reason : this.reason;
+	      controller.abort(
+	        err instanceof AxiosError$1
+	          ? err
+	          : new CanceledError$1(err instanceof Error ? err.message : err)
+	      );
+	    }
+	  };
 
-	    return signal;
-	  }
+	  let timer =
+	    timeout &&
+	    setTimeout(() => {
+	      timer = null;
+	      onabort(new AxiosError$1(`timeout of ${timeout}ms exceeded`, AxiosError$1.ETIMEDOUT));
+	    }, timeout);
+
+	  const unsubscribe = () => {
+	    if (!signals) { return; }
+	    timer && clearTimeout(timer);
+	    timer = null;
+	    signals.forEach((signal) => {
+	      signal.unsubscribe
+	        ? signal.unsubscribe(onabort)
+	        : signal.removeEventListener('abort', onabort);
+	    });
+	    signals = null;
+	  };
+
+	  signals.forEach((signal) => {
+	    if (aborted) {
+	      return;
+	    }
+
+	    if (signal.aborted) {
+	      onabort.call(signal);
+	      return;
+	    }
+
+	    signal.addEventListener('abort', onabort, { once: true });
+	  });
+
+	  const { signal } = controller;
+
+	  signal.unsubscribe = () => utils$1.asap(unsubscribe);
+
+	  return signal;
 	};
 
 	const streamChunk = function* (chunk, chunkSize) {
@@ -26851,88 +27370,128 @@
 	};
 
 	/**
-	 * Estimate decoded byte length of a data:// URL *without* allocating large buffers.
-	 * - For base64: compute exact decoded size using length and padding;
-	 *               handle %XX at the character-count level (no string allocation).
-	 * - For non-base64: use UTF-8 byteLength of the encoded body as a safe upper bound.
-	 *
-	 * @param {string} url
-	 * @returns {number}
+	 * Estimate data: URL byte lengths *without* allocating large buffers.
+	 * - Fetch percent-decodes a base64 body before decoding it.
+	 * - Node's Buffer.from(body, 'base64') sizes its backing allocation from the
+	 *   raw body, including ignored characters and content after padding.
+	 * - Non-base64 data is percent-decoded and then encoded as UTF-8.
 	 */
-	function estimateDataURLDecodedBytes(url) {
-	  if (!url || typeof url !== 'string') return 0;
-	  if (!url.startsWith('data:')) return 0;
+	const isHexDigit = (charCode) =>
+	  (charCode >= 48 && charCode <= 57) ||
+	  (charCode >= 65 && charCode <= 70) ||
+	  (charCode >= 97 && charCode <= 102);
 
-	  const comma = url.indexOf(',');
-	  if (comma < 0) return 0;
+	const isPercentEncodedByte = (str, i, len) =>
+	  i + 2 < len && isHexDigit(str.charCodeAt(i + 1)) && isHexDigit(str.charCodeAt(i + 2));
 
-	  const meta = url.slice(5, comma);
-	  const body = url.slice(comma + 1);
-	  const isBase64 = /;base64/i.test(meta);
+	const hexValue = (charCode) => (charCode <= 57 ? charCode - 48 : (charCode & 0xdf) - 55);
 
-	  if (isBase64) {
-	    let effectiveLen = body.length;
-	    const len = body.length; // cache length
+	const isBase64Char = (charCode) =>
+	  (charCode >= 65 && charCode <= 90) || // A-Z
+	  (charCode >= 97 && charCode <= 122) || // a-z
+	  (charCode >= 48 && charCode <= 57) || // 0-9
+	  charCode === 43 || // +
+	  charCode === 47 || // /
+	  charCode === 45 || // - (base64url)
+	  charCode === 95; // _ (base64url)
 
-	    for (let i = 0; i < len; i++) {
-	      if (body.charCodeAt(i) === 37 /* '%' */ && i + 2 < len) {
-	        const a = body.charCodeAt(i + 1);
-	        const b = body.charCodeAt(i + 2);
-	        const isHex =
-	          ((a >= 48 && a <= 57) || (a >= 65 && a <= 70) || (a >= 97 && a <= 102)) &&
-	          ((b >= 48 && b <= 57) || (b >= 65 && b <= 70) || (b >= 97 && b <= 102));
+	const isBase64Whitespace = (charCode) =>
+	  charCode === 9 || charCode === 10 || charCode === 12 || charCode === 13 || charCode === 32;
 
-	        if (isHex) {
-	          effectiveLen -= 2;
-	          i += 2;
-	        }
-	      }
+	const base64Bytes = (significant) => {
+	  const groups = Math.floor(significant / 4);
+	  const remainder = significant % 4;
+	  return groups * 3 + (remainder === 2 ? 1 : remainder === 3 ? 2 : 0);
+	};
+
+	// Buffer.byteLength(body, 'base64') uses the raw string length as an allocation
+	// upper bound even when Buffer.from later ignores characters or stops at '='.
+	const estimateBase64BufferAllocation = (body) => {
+	  const len = body.length;
+	  let padding = 0;
+
+	  if (len > 0 && body.charCodeAt(len - 1) === 61 /* '=' */) {
+	    padding++;
+
+	    if (len > 1 && body.charCodeAt(len - 2) === 61 /* '=' */) {
+	      padding++;
 	    }
+	  }
+
+	  return Math.floor(((len - padding) * 3) / 4);
+	};
 
-	    let pad = 0;
-	    let idx = len - 1;
+	const estimatePercentDecodedBase64Bytes = (body) => {
+	  const len = body.length;
+	  let significant = 0;
+	  let padding = 0;
+	  let invalid = false;
 
-	    const tailIsPct3D = (j) =>
-	      j >= 2 &&
-	      body.charCodeAt(j - 2) === 37 && // '%'
-	      body.charCodeAt(j - 1) === 51 && // '3'
-	      (body.charCodeAt(j) === 68 || body.charCodeAt(j) === 100); // 'D' or 'd'
+	  for (let i = 0; i < len; i++) {
+	    let code = body.charCodeAt(i);
 
-	    if (idx >= 0) {
-	      if (body.charCodeAt(idx) === 61 /* '=' */) {
-	        pad++;
-	        idx--;
-	      } else if (tailIsPct3D(idx)) {
-	        pad++;
-	        idx -= 3;
-	      }
+	    if (code === 37 /* '%' */ && isPercentEncodedByte(body, i, len)) {
+	      code = hexValue(body.charCodeAt(i + 1)) * 16 + hexValue(body.charCodeAt(i + 2));
+	      i += 2;
 	    }
 
-	    if (pad === 1 && idx >= 0) {
-	      if (body.charCodeAt(idx) === 61 /* '=' */) {
-	        pad++;
-	      } else if (tailIsPct3D(idx)) {
-	        pad++;
-	      }
+	    if (isBase64Whitespace(code)) {
+	      continue;
+	    }
+
+	    if (code === 61 /* '=' */) {
+	      padding++;
+	      continue;
 	    }
 
-	    const groups = Math.floor(effectiveLen / 4);
-	    const bytes = groups * 3 - (pad || 0);
-	    return bytes > 0 ? bytes : 0;
+	    if (!isBase64Char(code) || padding > 0) {
+	      invalid = true;
+	      continue;
+	    }
+
+	    significant++;
 	  }
 
-	  if (typeof Buffer !== 'undefined' && typeof Buffer.byteLength === 'function') {
-	    return Buffer.byteLength(body, 'utf8');
+	  // Fetch rejects malformed forgiving-base64 input. Returning the raw-size
+	  // allocation bound keeps that invalid input from becoming a pre-check bypass.
+	  if (
+	    invalid ||
+	    padding > 2 ||
+	    (padding > 0 && (significant + padding) % 4 !== 0) ||
+	    significant % 4 === 1
+	  ) {
+	    return estimateBase64BufferAllocation(body);
+	  }
+
+	  return base64Bytes(significant);
+	};
+
+	const estimateDataURLBytes = (url, estimateBase64) => {
+	  if (!url || typeof url !== 'string') return 0;
+	  if (!url.startsWith('data:')) return 0;
+
+	  const comma = url.indexOf(',');
+	  if (comma < 0) return 0;
+
+	  const meta = url.slice(5, comma);
+	  const body = url.slice(comma + 1);
+	  const isBase64 = /;base64/i.test(meta);
+
+	  if (isBase64) {
+	    return estimateBase64(body);
 	  }
 
 	  // Compute UTF-8 byte length directly from UTF-16 code units without allocating
 	  // a byte buffer (TextEncoder.encode would defeat the DoS guard on large bodies).
-	  // Using body.length here would undercount non-ASCII (e.g. '€' is 1 code unit
-	  // but 3 UTF-8 bytes).
+	  // Valid %XX triplets count as one decoded byte; this matches the bytes that
+	  // decodeURIComponent(body) would produce before Buffer re-encodes the string.
 	  let bytes = 0;
 	  for (let i = 0, len = body.length; i < len; i++) {
 	    const c = body.charCodeAt(i);
-	    if (c < 0x80) {
+	    if (c === 37 /* '%' */ && isPercentEncodedByte(body, i, len)) {
+	      bytes += 1;
+	      i += 2;
+	    } else if (c < 0x80) {
 	      bytes += 1;
 	    } else if (c < 0x800) {
 	      bytes += 2;
@@ -26949,14 +27508,59 @@
 	    }
 	  }
 	  return bytes;
+	};
+
+	/**
+	 * Estimate the percent-decoded payload size used by Fetch data: URLs.
+	 *
+	 * @param {string} url
+	 * @returns {number}
+	 */
+	function estimateDataURLDecodedBytes(url) {
+	  // Fetch removes URL fragments before processing a data: URL.
+	  const fragmentIndex = typeof url === 'string' ? url.indexOf('#') : -1;
+
+	  return estimateDataURLBytes(
+	    fragmentIndex === -1 ? url : url.slice(0, fragmentIndex),
+	    estimatePercentDecodedBase64Bytes
+	  );
 	}
 
-	const VERSION$1 = "1.16.0";
+	const VERSION$1 = "1.19.0";
 
 	const DEFAULT_CHUNK_SIZE = 64 * 1024;
 
 	const { isFunction } = utils$1;
 
+	/**
+	 * Encode a UTF-8 string to a Latin-1 byte string for use with btoa().
+	 * This is a modern replacement for the deprecated unescape(encodeURIComponent(str)) pattern.
+	 *
+	 * @param {string} str The string to encode
+	 *
+	 * @returns {string} UTF-8 bytes as a Latin-1 string
+	 */
+	const encodeUTF8 = (str) =>
+	  encodeURIComponent(str).replace(/%([0-9A-F]{2})/gi, (_, hex) =>
+	    String.fromCharCode(parseInt(hex, 16))
+	  );
+
+	// Node's WHATWG URL parser returns `username` and `password` percent-encoded.
+	// Decode before composing the `auth` option so credentials such as
+	// `my%40email.com:pass` are sent as `my@email.com:pass`. Falls back to the
+	// original value for malformed input so a bad encoding never throws.
+	const decodeURIComponentSafe = (value) => {
+	  if (!utils$1.isString(value)) {
+	    return value;
+	  }
+
+	  try {
+	    return decodeURIComponent(value);
+	  } catch (error) {
+	    return value;
+	  }
+	};
+
 	const test = (fn, ...args) => {
 	  try {
 	    return !!fn(...args);
@@ -26965,8 +27569,20 @@
 	  }
 	};
 
+	const maybeWithAuthCredentials = (url) => {
+	  const protocolIndex = url.indexOf('://');
+	  let urlToCheck = url;
+	  if (protocolIndex !== -1) {
+	    urlToCheck = urlToCheck.slice(protocolIndex + 3);
+	  }
+	  return urlToCheck.includes('@') || urlToCheck.includes(':');
+	};
+
 	const factory = (env) => {
-	  const globalObject = utils$1.global ?? globalThis;
+	  const globalObject =
+	    utils$1.global !== undefined && utils$1.global !== null
+	      ? utils$1.global
+	      : globalThis;
 	  const { ReadableStream, TextEncoder } = globalObject;
 
 	  env = utils$1.merge.call(
@@ -27109,6 +27725,7 @@
 
 	    const hasMaxContentLength = utils$1.isNumber(maxContentLength) && maxContentLength > -1;
 	    const hasMaxBodyLength = utils$1.isNumber(maxBodyLength) && maxBodyLength > -1;
+	    const own = (key) => (utils$1.hasOwnProp(config, key) ? config[key] : undefined);
 
 	    let _fetch = envFetch || fetch;
 
@@ -27130,7 +27747,61 @@
 
 	    let requestContentLength;
 
+	    // AxiosError we raise while the request body is being streamed. Captured
+	    // by identity so the catch block can surface it directly, regardless of
+	    // how the runtime wraps the resulting fetch rejection (undici exposes it
+	    // as `err.cause`; some browsers drop the original error entirely).
+	    let pendingBodyError = null;
+
+	    const maxBodyLengthError = () =>
+	      new AxiosError$1(
+	        'Request body larger than maxBodyLength limit',
+	        AxiosError$1.ERR_BAD_REQUEST,
+	        config,
+	        request
+	      );
+
 	    try {
+	      // HTTP basic authentication
+	      let auth = undefined;
+	      const configAuth = own('auth');
+
+	      if (configAuth) {
+	        const username = utils$1.getSafeProp(configAuth, 'username') || '';
+	        const password = utils$1.getSafeProp(configAuth, 'password') || '';
+	        auth = {
+	          username,
+	          password
+	        };
+	      }
+
+	      if (maybeWithAuthCredentials(url)) {
+	        const parsedURL = new URL(url, platform.origin);
+
+	        if (!auth && (parsedURL.username || parsedURL.password)) {
+	          const urlUsername = decodeURIComponentSafe(parsedURL.username);
+	          const urlPassword = decodeURIComponentSafe(parsedURL.password);
+	          auth = {
+	            username: urlUsername,
+	            password: urlPassword
+	          };
+	        }
+
+	        if (parsedURL.username || parsedURL.password) {
+	          parsedURL.username = '';
+	          parsedURL.password = '';
+	          url = parsedURL.href;
+	        }
+	      }
+
+	      if (auth) {
+	        headers.delete('authorization');
+	        headers.set(
+	          'Authorization',
+	          'Basic ' + btoa(encodeUTF8((auth.username || '') + ':' + (auth.password || '')))
+	        );
+	      }
+
 	      // Enforce maxContentLength for data: URLs up-front so we never materialize
 	      // an oversized payload. The HTTP adapter applies the same check (see http.js
 	      // "if (protocol === 'data:')" branch).
@@ -27146,53 +27817,96 @@
 	        }
 	      }
 
-	      // Enforce maxBodyLength against the outbound request body before dispatch.
-	      // Mirrors http.js behavior (ERR_BAD_REQUEST / 'Request body larger than
-	      // maxBodyLength limit'). Skip when the body length cannot be determined
-	      // (e.g. a live ReadableStream supplied by the caller).
+	      // Enforce maxBodyLength against known-size bodies before dispatch using
+	      // the body's *actual* size — never a caller-declared Content-Length,
+	      // which could under-report to slip an oversized body past the check.
+	      // Unknown-size streams return undefined here and are counted per-chunk
+	      // below as fetch consumes them.
 	      if (hasMaxBodyLength && method !== 'get' && method !== 'head') {
-	        const outboundLength = await resolveBodyLength(headers, data);
-	        if (
-	          typeof outboundLength === 'number' &&
-	          isFinite(outboundLength) &&
-	          outboundLength > maxBodyLength
-	        ) {
-	          throw new AxiosError$1(
-	            'Request body larger than maxBodyLength limit',
-	            AxiosError$1.ERR_BAD_REQUEST,
-	            config,
-	            request
-	          );
+	        const outboundLength = await getBodyLength(data);
+	        if (typeof outboundLength === 'number' && isFinite(outboundLength)) {
+	          requestContentLength = outboundLength;
+	          if (outboundLength > maxBodyLength) {
+	            throw maxBodyLengthError();
+	          }
 	        }
 	      }
 
+	      // A streamed body under maxBodyLength must be counted as fetch consumes
+	      // it; its size is never trusted from a caller-declared Content-Length.
+	      const mustEnforceStreamBody =
+	        hasMaxBodyLength && (utils$1.isReadableStream(data) || utils$1.isStream(data));
+
+	      const trackRequestStream = (stream, onProgress, flush) =>
+	        trackStream(
+	          stream,
+	          DEFAULT_CHUNK_SIZE,
+	          (loadedBytes) => {
+	            if (hasMaxBodyLength && loadedBytes > maxBodyLength) {
+	              throw (pendingBodyError = maxBodyLengthError());
+	            }
+	            onProgress && onProgress(loadedBytes);
+	          },
+	          flush
+	        );
+
 	      if (
-	        onUploadProgress &&
 	        supportsRequestStream &&
 	        method !== 'get' &&
 	        method !== 'head' &&
-	        (requestContentLength = await resolveBodyLength(headers, data)) !== 0
+	        (onUploadProgress || mustEnforceStreamBody)
 	      ) {
-	        let _request = new Request(url, {
-	          method: 'POST',
-	          body: data,
-	          duplex: 'half',
-	        });
+	        requestContentLength =
+	          requestContentLength == null ? await resolveBodyLength(headers, data) : requestContentLength;
+
+	        // A declared length of 0 is only trusted to skip the wrap when we are
+	        // not enforcing a stream limit (which must not rely on that header).
+	        if (requestContentLength !== 0 || mustEnforceStreamBody) {
+	          let _request = new Request(url, {
+	            method: 'POST',
+	            body: data,
+	            duplex: 'half',
+	          });
 
-	        let contentTypeHeader;
+	          let contentTypeHeader;
 
-	        if (utils$1.isFormData(data) && (contentTypeHeader = _request.headers.get('content-type'))) {
-	          headers.setContentType(contentTypeHeader);
-	        }
+	          if (utils$1.isFormData(data) && (contentTypeHeader = _request.headers.get('content-type'))) {
+	            headers.setContentType(contentTypeHeader);
+	          }
 
-	        if (_request.body) {
-	          const [onProgress, flush] = progressEventDecorator(
-	            requestContentLength,
-	            progressEventReducer(asyncDecorator(onUploadProgress))
-	          );
+	          if (_request.body) {
+	            const [onProgress, flush] =
+	              (onUploadProgress &&
+	                progressEventDecorator(
+	                  requestContentLength,
+	                  progressEventReducer(asyncDecorator(onUploadProgress))
+	                )) ||
+	              [];
 
-	          data = trackStream(_request.body, DEFAULT_CHUNK_SIZE, onProgress, flush);
+	            data = trackRequestStream(_request.body, onProgress, flush);
+	          }
 	        }
+	      } else if (
+	        mustEnforceStreamBody &&
+	        !isRequestSupported &&
+	        isReadableStreamSupported &&
+	        method !== 'get' &&
+	        method !== 'head'
+	      ) {
+	        data = trackRequestStream(data);
+	      } else if (
+	        mustEnforceStreamBody &&
+	        isRequestSupported &&
+	        !supportsRequestStream &&
+	        method !== 'get' &&
+	        method !== 'head'
+	      ) {
+	        throw new AxiosError$1(
+	          'Stream request bodies are not supported by the current fetch implementation',
+	          AxiosError$1.ERR_NOT_SUPPORT,
+	          config,
+	          request
+	        );
 	      }
 
 	      if (!utils$1.isString(withCredentials)) {
@@ -27223,7 +27937,7 @@
 	        ...fetchOptions,
 	        signal: composedSignal,
 	        method: method.toUpperCase(),
-	        headers: headers.normalize().toJSON(),
+	        headers: toByteStringHeaderObject(headers.normalize()),
 	        body: data,
 	        duplex: 'half',
 	        credentials: isCredentialsSupported ? withCredentials : undefined,
@@ -27235,10 +27949,12 @@
 	        ? _fetch(request, fetchOptions)
 	        : _fetch(url, resolvedOptions));
 
+	      const responseHeaders = AxiosHeaders$1.from(response.headers);
+
 	      // Cheap pre-check: if the server honestly declares a content-length that
 	      // already exceeds the cap, reject before we start streaming.
 	      if (hasMaxContentLength) {
-	        const declaredLength = utils$1.toFiniteNumber(response.headers.get('content-length'));
+	        const declaredLength = utils$1.toFiniteNumber(responseHeaders.getContentLength());
 	        if (declaredLength != null && declaredLength > maxContentLength) {
 	          throw new AxiosError$1(
 	            'maxContentLength size of ' + maxContentLength + ' exceeded',
@@ -27263,7 +27979,7 @@
 	          options[prop] = response[prop];
 	        });
 
-	        const responseContentLength = utils$1.toFiniteNumber(response.headers.get('content-length'));
+	        const responseContentLength = utils$1.toFiniteNumber(responseHeaders.getContentLength());
 
 	        const [onProgress, flush] =
 	          (onDownloadProgress &&
@@ -27354,23 +28070,55 @@
 	        const canceledError = composedSignal.reason;
 	        canceledError.config = config;
 	        request && (canceledError.request = request);
-	        err !== canceledError && (canceledError.cause = err);
+	        if (err !== canceledError) {
+	          // Non-enumerable to match native Error `cause` semantics so loggers
+	          // don't recurse into circular fetch internals (see #7205).
+	          Object.defineProperty(canceledError, 'cause', {
+	            __proto__: null,
+	            value: err,
+	            writable: true,
+	            enumerable: false,
+	            configurable: true,
+	          });
+	        }
 	        throw canceledError;
 	      }
 
+	      // Surface a maxBodyLength violation we raised while the request body was
+	      // being streamed. Matching by identity (rather than reading
+	      // `err.cause.isAxiosError`) keeps the error deterministic across runtimes
+	      // and avoids both prototype-pollution reads and mis-attributing a foreign
+	      // AxiosError that merely happened to land in `err.cause`.
+	      if (pendingBodyError) {
+	        request && !pendingBodyError.request && (pendingBodyError.request = request);
+	        throw pendingBodyError;
+	      }
+
+	      // Re-throw AxiosErrors we raised synchronously (data: URL / content-length
+	      // pre-checks, response size enforcement) without re-wrapping them.
+	      if (err instanceof AxiosError$1) {
+	        request && !err.request && (err.request = request);
+	        throw err;
+	      }
+
 	      if (err && err.name === 'TypeError' && /Load failed|fetch/i.test(err.message)) {
-	        throw Object.assign(
-	          new AxiosError$1(
-	            'Network Error',
-	            AxiosError$1.ERR_NETWORK,
-	            config,
-	            request,
-	            err && err.response
-	          ),
-	          {
-	            cause: err.cause || err,
-	          }
+	        const networkError = new AxiosError$1(
+	          'Network Error',
+	          AxiosError$1.ERR_NETWORK,
+	          config,
+	          request,
+	          err && err.response
 	        );
+	        // Non-enumerable to match native Error `cause` semantics so loggers
+	        // don't recurse into circular fetch internals (see #7205).
+	        Object.defineProperty(networkError, 'cause', {
+	          __proto__: null,
+	          value: err.cause || err,
+	          writable: true,
+	          enumerable: false,
+	          configurable: true,
+	        });
+	        throw networkError;
 	      }
 
 	      throw AxiosError$1.from(err, err && err.code, config, request, err && err.response);
@@ -27508,7 +28256,7 @@
 
 	    throw new AxiosError$1(
 	      `There is no suitable adapter to dispatch the request ` + s,
-	      'ERR_NOT_SUPPORT'
+	      AxiosError$1.ERR_NOT_SUPPORT
 	    );
 	  }
 
@@ -27689,7 +28437,7 @@
 	 */
 
 	function assertOptions(options, schema, allowUnknown) {
-	  if (typeof options !== 'object') {
+	  if (typeof options !== 'object' || options === null) {
 	    throw new AxiosError$1('options must be an object', AxiosError$1.ERR_BAD_OPTION_VALUE);
 	  }
 	  const keys = Object.keys(options);
@@ -27812,6 +28560,8 @@
 	          forcedJSONParsing: validators.transitional(validators.boolean),
 	          clarifyTimeoutError: validators.transitional(validators.boolean),
 	          legacyInterceptorReqResOrdering: validators.transitional(validators.boolean),
+	          advertiseZstdAcceptEncoding: validators.transitional(validators.boolean),
+	          validateStatusUndefinedResolves: validators.transitional(validators.boolean),
 	        },
 	        false
 	      );
@@ -27916,17 +28666,35 @@
 	      const onFulfilled = requestInterceptorChain[i++];
 	      const onRejected = requestInterceptorChain[i++];
 	      try {
-	        newConfig = onFulfilled(newConfig);
+	        newConfig = onFulfilled ? onFulfilled(newConfig) : newConfig;
 	      } catch (error) {
-	        onRejected.call(this, error);
+	        if (!onRejected) {
+	          promise = Promise.reject(error);
+	          break;
+	        }
+
+	        try {
+	          const rejectedResult = onRejected.call(this, error);
+
+	          if (utils$1.isThenable(rejectedResult)) {
+	            promise = Promise.resolve(rejectedResult).then(() =>
+	              dispatchRequest.call(this, newConfig)
+	            );
+	          }
+	        } catch (rejectedError) {
+	          promise = Promise.reject(rejectedError);
+	        }
+
 	        break;
 	      }
 	    }
 
-	    try {
-	      promise = dispatchRequest.call(this, newConfig);
-	    } catch (error) {
-	      return Promise.reject(error);
+	    if (!promise) {
+	      try {
+	        promise = dispatchRequest.call(this, newConfig);
+	      } catch (error) {
+	        promise = Promise.reject(error);
+	      }
 	    }
 
 	    i = 0;
@@ -27941,7 +28709,7 @@
 
 	  getUri(config) {
 	    config = mergeConfig$1(this.defaults, config);
-	    const fullPath = buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls);
+	    const fullPath = buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls, config);
 	    return buildURL(fullPath, config.params, config.paramsSerializer);
 	  }
 	};
@@ -27954,7 +28722,7 @@
 	      mergeConfig$1(config || {}, {
 	        method,
 	        url,
-	        data: (config || {}).data,
+	        data: config && utils$1.hasOwnProp(config, 'data') ? config.data : undefined,
 	      })
 	    );
 	  };
@@ -28219,6 +28987,7 @@
 	  LoopDetected: 508,
 	  NotExtended: 510,
 	  NetworkAuthenticationRequired: 511,
+	  WebServerReturnsAnUnknownError: 520,
 	  WebServerIsDown: 521,
 	  ConnectionTimedOut: 522,
 	  OriginIsUnreachable: 523,