@nsshunt/stsuxvue 1.0.126 → 1.0.127

package/dist/stsuxvue.cjs

@@ -6,7 +6,14 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __esmMin = (fn, res, err) => () => {
+	if (err) throw err[0];
+	try {
+		return fn && (res = fn(fn = 0)), res;
+	} catch (e) {
+		throw err = [e], e;
+	}
+};
 var __commonJSMin$1 = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __exportAll = (all, no_symbols) => {
 	let target = {};
@@ -6036,7 +6043,7 @@ var import_ansi_to_html = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin
 		return Filter;
 	}();
 })))(), 1);
-/*! @license DOMPurify 3.4.9 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.9/LICENSE */
+/*! @license DOMPurify 3.4.12 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.12/LICENSE */
 function _arrayLikeToArray(r, a) {
 	(null == a || a > r.length) && (a = r.length);
 	for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e];
@@ -6077,9 +6084,17 @@ function _unsupportedIterableToArray(r, a) {
 		return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0;
 	}
 }
-var entries = Object.entries, setPrototypeOf = Object.setPrototypeOf, isFrozen = Object.isFrozen, getPrototypeOf$1 = Object.getPrototypeOf, getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
-var freeze = Object.freeze, seal = Object.seal, create = Object.create;
-var _ref = typeof Reflect !== "undefined" && Reflect, apply = _ref.apply, construct = _ref.construct;
+var entries = Object.entries;
+var setPrototypeOf = Object.setPrototypeOf;
+var isFrozen = Object.isFrozen;
+var getPrototypeOf$1 = Object.getPrototypeOf;
+var getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
+var freeze = Object.freeze;
+var seal = Object.seal;
+var create = Object.create;
+var _ref = typeof Reflect !== "undefined" && Reflect;
+var apply = _ref.apply;
+var construct = _ref.construct;
 if (!freeze) freeze = function freeze(x) {
 	return x;
 };
@@ -6675,6 +6690,7 @@ var svg = freeze([
 	"direction",
 	"display",
 	"divisor",
+	"dominant-baseline",
 	"dur",
 	"edgemode",
 	"elevation",
@@ -6802,6 +6818,7 @@ var svg = freeze([
 	"transform-origin",
 	"text-anchor",
 	"text-decoration",
+	"text-orientation",
 	"text-rendering",
 	"textlength",
 	"type",
@@ -6904,6 +6921,10 @@ var IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
 var ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g);
 var DOCTYPE_NAME = seal(/^html$/i);
 var CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
+var ELEMENT_MARKUP_PROBE = seal(/<[/\w!]/g);
+var COMMENT_MARKUP_PROBE = seal(/<[/\w]/g);
+var FALLBACK_TAG_CLOSE = seal(/<\/no(script|embed|frames)/i);
+var SELF_CLOSING_TAG = seal(/\/>/i);
 var NODE_TYPE = {
 	element: 1,
 	attribute: 2,
@@ -6911,7 +6932,7 @@ var NODE_TYPE = {
 	cdataSection: 4,
 	entityReference: 5,
 	entityNode: 6,
-	progressingInstruction: 7,
+	processingInstruction: 7,
 	comment: 8,
 	document: 9,
 	documentType: 10,
@@ -6962,10 +6983,25 @@ var _createHooksMap = function _createHooksMap() {
 		uponSanitizeShadowNode: []
 	};
 };
+/**
+* Resolve a set-valued configuration option: a fresh set built from
+* cfg[key] when it is an own array property (seeded with a clone of
+* options.base when given, case-normalized via options.transform),
+* the fallback set otherwise.
+*
+* @param cfg the cloned, prototype-free configuration object
+* @param key the configuration property to read
+* @param fallback the set to use when the option is absent or not an array
+* @param options transform and optional base set to merge into
+* @returns the resolved set
+*/
+var _resolveSetOption = function _resolveSetOption(cfg, key, fallback, options) {
+	return objectHasOwnProperty(cfg, key) && arrayIsArray(cfg[key]) ? addToSet(options.base ? clone(options.base) : {}, cfg[key], options.transform) : fallback;
+};
 function createDOMPurify() {
 	let window = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal$1();
 	const DOMPurify = (root) => createDOMPurify(root);
-	DOMPurify.version = "3.4.9";
+	DOMPurify.version = "3.4.12";
 	DOMPurify.removed = [];
 	if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
 		DOMPurify.isSupported = false;
@@ -7098,6 +7134,8 @@ function createDOMPurify() {
 	let SAFE_FOR_XML = true;
 	let WHOLE_DOCUMENT = false;
 	let SET_CONFIG = false;
+	let SET_CONFIG_ALLOWED_TAGS = null;
+	let SET_CONFIG_ALLOWED_ATTR = null;
 	let FORCE_BODY = false;
 	let RETURN_DOM = false;
 	let RETURN_DOM_FRAGMENT = false;
@@ -7174,14 +7212,16 @@ function createDOMPurify() {
 		SVG_NAMESPACE,
 		HTML_NAMESPACE
 	], stringToString);
-	let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, [
+	const DEFAULT_MATHML_TEXT_INTEGRATION_POINTS = freeze([
 		"mi",
 		"mo",
 		"mn",
 		"ms",
 		"mtext"
 	]);
-	let HTML_INTEGRATION_POINTS = addToSet({}, ["annotation-xml"]);
+	let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS);
+	const DEFAULT_HTML_INTEGRATION_POINTS = freeze(["annotation-xml"]);
+	let HTML_INTEGRATION_POINTS = addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS);
 	const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, [
 		"title",
 		"style",
@@ -7210,14 +7250,20 @@ function createDOMPurify() {
 		cfg = clone(cfg);
 		PARSER_MEDIA_TYPE = SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
 		transformCaseFunc = PARSER_MEDIA_TYPE === "application/xhtml+xml" ? stringToString : stringToLowerCase;
-		ALLOWED_TAGS = objectHasOwnProperty(cfg, "ALLOWED_TAGS") && arrayIsArray(cfg.ALLOWED_TAGS) ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
-		ALLOWED_ATTR = objectHasOwnProperty(cfg, "ALLOWED_ATTR") && arrayIsArray(cfg.ALLOWED_ATTR) ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
-		ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, "ALLOWED_NAMESPACES") && arrayIsArray(cfg.ALLOWED_NAMESPACES) ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
-		URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, "ADD_URI_SAFE_ATTR") && arrayIsArray(cfg.ADD_URI_SAFE_ATTR) ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
-		DATA_URI_TAGS = objectHasOwnProperty(cfg, "ADD_DATA_URI_TAGS") && arrayIsArray(cfg.ADD_DATA_URI_TAGS) ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
-		FORBID_CONTENTS = objectHasOwnProperty(cfg, "FORBID_CONTENTS") && arrayIsArray(cfg.FORBID_CONTENTS) ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
-		FORBID_TAGS = objectHasOwnProperty(cfg, "FORBID_TAGS") && arrayIsArray(cfg.FORBID_TAGS) ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({});
-		FORBID_ATTR = objectHasOwnProperty(cfg, "FORBID_ATTR") && arrayIsArray(cfg.FORBID_ATTR) ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({});
+		ALLOWED_TAGS = _resolveSetOption(cfg, "ALLOWED_TAGS", DEFAULT_ALLOWED_TAGS, { transform: transformCaseFunc });
+		ALLOWED_ATTR = _resolveSetOption(cfg, "ALLOWED_ATTR", DEFAULT_ALLOWED_ATTR, { transform: transformCaseFunc });
+		ALLOWED_NAMESPACES = _resolveSetOption(cfg, "ALLOWED_NAMESPACES", DEFAULT_ALLOWED_NAMESPACES, { transform: stringToString });
+		URI_SAFE_ATTRIBUTES = _resolveSetOption(cfg, "ADD_URI_SAFE_ATTR", DEFAULT_URI_SAFE_ATTRIBUTES, {
+			transform: transformCaseFunc,
+			base: DEFAULT_URI_SAFE_ATTRIBUTES
+		});
+		DATA_URI_TAGS = _resolveSetOption(cfg, "ADD_DATA_URI_TAGS", DEFAULT_DATA_URI_TAGS, {
+			transform: transformCaseFunc,
+			base: DEFAULT_DATA_URI_TAGS
+		});
+		FORBID_CONTENTS = _resolveSetOption(cfg, "FORBID_CONTENTS", DEFAULT_FORBID_CONTENTS, { transform: transformCaseFunc });
+		FORBID_TAGS = _resolveSetOption(cfg, "FORBID_TAGS", clone({}), { transform: transformCaseFunc });
+		FORBID_ATTR = _resolveSetOption(cfg, "FORBID_ATTR", clone({}), { transform: transformCaseFunc });
 		USE_PROFILES = objectHasOwnProperty(cfg, "USE_PROFILES") ? cfg.USE_PROFILES && typeof cfg.USE_PROFILES === "object" ? clone(cfg.USE_PROFILES) : cfg.USE_PROFILES : false;
 		ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false;
 		ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false;
@@ -7236,19 +7282,14 @@ function createDOMPurify() {
 		IN_PLACE = cfg.IN_PLACE || false;
 		IS_ALLOWED_URI$1 = isRegex(cfg.ALLOWED_URI_REGEXP) ? cfg.ALLOWED_URI_REGEXP : IS_ALLOWED_URI;
 		NAMESPACE = typeof cfg.NAMESPACE === "string" ? cfg.NAMESPACE : HTML_NAMESPACE;
-		MATHML_TEXT_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "MATHML_TEXT_INTEGRATION_POINTS") && cfg.MATHML_TEXT_INTEGRATION_POINTS && typeof cfg.MATHML_TEXT_INTEGRATION_POINTS === "object" ? clone(cfg.MATHML_TEXT_INTEGRATION_POINTS) : addToSet({}, [
-			"mi",
-			"mo",
-			"mn",
-			"ms",
-			"mtext"
-		]);
-		HTML_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "HTML_INTEGRATION_POINTS") && cfg.HTML_INTEGRATION_POINTS && typeof cfg.HTML_INTEGRATION_POINTS === "object" ? clone(cfg.HTML_INTEGRATION_POINTS) : addToSet({}, ["annotation-xml"]);
+		MATHML_TEXT_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "MATHML_TEXT_INTEGRATION_POINTS") && cfg.MATHML_TEXT_INTEGRATION_POINTS && typeof cfg.MATHML_TEXT_INTEGRATION_POINTS === "object" ? clone(cfg.MATHML_TEXT_INTEGRATION_POINTS) : addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS);
+		HTML_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "HTML_INTEGRATION_POINTS") && cfg.HTML_INTEGRATION_POINTS && typeof cfg.HTML_INTEGRATION_POINTS === "object" ? clone(cfg.HTML_INTEGRATION_POINTS) : addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS);
 		const customElementHandling = objectHasOwnProperty(cfg, "CUSTOM_ELEMENT_HANDLING") && cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING === "object" ? clone(cfg.CUSTOM_ELEMENT_HANDLING) : create(null);
 		CUSTOM_ELEMENT_HANDLING = create(null);
 		if (objectHasOwnProperty(customElementHandling, "tagNameCheck") && isRegexOrFunction(customElementHandling.tagNameCheck)) CUSTOM_ELEMENT_HANDLING.tagNameCheck = customElementHandling.tagNameCheck;
 		if (objectHasOwnProperty(customElementHandling, "attributeNameCheck") && isRegexOrFunction(customElementHandling.attributeNameCheck)) CUSTOM_ELEMENT_HANDLING.attributeNameCheck = customElementHandling.attributeNameCheck;
 		if (objectHasOwnProperty(customElementHandling, "allowCustomizedBuiltInElements") && typeof customElementHandling.allowCustomizedBuiltInElements === "boolean") CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = customElementHandling.allowCustomizedBuiltInElements;
+		seal(CUSTOM_ELEMENT_HANDLING);
 		if (SAFE_FOR_TEMPLATES) ALLOW_DATA_ATTR = false;
 		if (RETURN_DOM_FRAGMENT) RETURN_DOM = true;
 		if (USE_PROFILES) {
@@ -7327,8 +7368,6 @@ function createDOMPurify() {
 			if (trustedTypesPolicy === void 0) trustedTypesPolicy = _getDefaultTrustedTypesPolicy();
 			if (trustedTypesPolicy && typeof emptyHTML === "string") emptyHTML = _createTrustedHTML("");
 		}
-		if ((hooks.uponSanitizeElement.length > 0 || hooks.uponSanitizeAttribute.length > 0) && ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) ALLOWED_TAGS = clone(ALLOWED_TAGS);
-		if (hooks.uponSanitizeAttribute.length > 0 && ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) ALLOWED_ATTR = clone(ALLOWED_ATTR);
 		if (freeze) freeze(cfg);
 		CONFIG = cfg;
 	};
@@ -7339,6 +7378,45 @@ function createDOMPurify() {
 	]);
 	const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
 	/**
+	* Namespace rules for an element in the SVG namespace.
+	*
+	* @param tagName the element's lowercase tag name
+	* @param parent the (possibly simulated) parent node
+	* @param parentTagName the parent's lowercase tag name
+	* @returns true if a spec-compliant parser could produce this element
+	*/
+	const _checkSvgNamespace = function _checkSvgNamespace(tagName, parent, parentTagName) {
+		if (parent.namespaceURI === HTML_NAMESPACE) return tagName === "svg";
+		if (parent.namespaceURI === MATHML_NAMESPACE) return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
+		return Boolean(ALL_SVG_TAGS[tagName]);
+	};
+	/**
+	* Namespace rules for an element in the MathML namespace.
+	*
+	* @param tagName the element's lowercase tag name
+	* @param parent the (possibly simulated) parent node
+	* @param parentTagName the parent's lowercase tag name
+	* @returns true if a spec-compliant parser could produce this element
+	*/
+	const _checkMathMlNamespace = function _checkMathMlNamespace(tagName, parent, parentTagName) {
+		if (parent.namespaceURI === HTML_NAMESPACE) return tagName === "math";
+		if (parent.namespaceURI === SVG_NAMESPACE) return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName];
+		return Boolean(ALL_MATHML_TAGS[tagName]);
+	};
+	/**
+	* Namespace rules for an element in the HTML namespace.
+	*
+	* @param tagName the element's lowercase tag name
+	* @param parent the (possibly simulated) parent node
+	* @param parentTagName the parent's lowercase tag name
+	* @returns true if a spec-compliant parser could produce this element
+	*/
+	const _checkHtmlNamespace = function _checkHtmlNamespace(tagName, parent, parentTagName) {
+		if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) return false;
+		if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) return false;
+		return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
+	};
+	/**
 	* @param element a DOM element whose namespace is being checked
 	* @returns Return false if the element has a
 	*  namespace that a spec-compliant parser would never
@@ -7353,21 +7431,9 @@ function createDOMPurify() {
 		const tagName = stringToLowerCase(element.tagName);
 		const parentTagName = stringToLowerCase(parent.tagName);
 		if (!ALLOWED_NAMESPACES[element.namespaceURI]) return false;
-		if (element.namespaceURI === SVG_NAMESPACE) {
-			if (parent.namespaceURI === HTML_NAMESPACE) return tagName === "svg";
-			if (parent.namespaceURI === MATHML_NAMESPACE) return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
-			return Boolean(ALL_SVG_TAGS[tagName]);
-		}
-		if (element.namespaceURI === MATHML_NAMESPACE) {
-			if (parent.namespaceURI === HTML_NAMESPACE) return tagName === "math";
-			if (parent.namespaceURI === SVG_NAMESPACE) return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName];
-			return Boolean(ALL_MATHML_TAGS[tagName]);
-		}
-		if (element.namespaceURI === HTML_NAMESPACE) {
-			if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) return false;
-			if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) return false;
-			return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
-		}
+		if (element.namespaceURI === SVG_NAMESPACE) return _checkSvgNamespace(tagName, parent, parentTagName);
+		if (element.namespaceURI === MATHML_NAMESPACE) return _checkMathMlNamespace(tagName, parent, parentTagName);
+		if (element.namespaceURI === HTML_NAMESPACE) return _checkHtmlNamespace(tagName, parent, parentTagName);
 		if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[element.namespaceURI]) return true;
 		return false;
 	};
@@ -7402,7 +7468,8 @@ function createDOMPurify() {
 	* @param root the in-place root to empty
 	*/
 	const _neutralizeRoot = function _neutralizeRoot(root) {
-		const childNodes = getChildNodes ? getChildNodes(root) : root.childNodes;
+		_neutralizeSubtree(root);
+		const childNodes = getChildNodes(root);
 		if (childNodes) {
 			const snapshot = [];
 			arrayForEach(childNodes, (child) => {
@@ -7414,7 +7481,7 @@ function createDOMPurify() {
 				} catch (_) {}
 			});
 		}
-		const attributes = getAttributes ? getAttributes(root) : null;
+		const attributes = getAttributes(root);
 		if (attributes) for (let i = attributes.length - 1; i >= 0; --i) {
 			const attribute = attributes[i];
 			const name = attribute && attribute.name;
@@ -7460,7 +7527,7 @@ function createDOMPurify() {
 	* @param element the element to strip
 	*/
 	const _stripDisallowedAttributes = function _stripDisallowedAttributes(element) {
-		const attributes = getAttributes ? getAttributes(element) : element.attributes;
+		const attributes = getAttributes(element);
 		if (!attributes) return;
 		for (let i = attributes.length - 1; i >= 0; --i) {
 			const attribute = attributes[i];
@@ -7498,7 +7565,66 @@ function createDOMPurify() {
 		while (stack.length > 0) {
 			const node = stack.pop();
 			if ((getNodeType ? getNodeType(node) : node.nodeType) === NODE_TYPE.element) _stripDisallowedAttributes(node);
-			const childNodes = getChildNodes ? getChildNodes(node) : node.childNodes;
+			const childNodes = getChildNodes(node);
+			if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push(childNodes[i]);
+		}
+	};
+	/**
+	* _neutralizePatchLinkage
+	*
+	* IN_PLACE entry pre-pass (declarative-partial-updates / streaming
+	* hardening, https://github.com/WICG/declarative-partial-updates).
+	*
+	* The main walk strips patch linkage (`for`/`patchsrc`) and removes range
+	* markers (PIs / markup comments) node-by-node, in document order, AS it
+	* reaches each node. On a live in-place root that leaves a window: from the
+	* moment the root is connected until the walk arrives at a given node, that
+	* node's linkage is live. A patch applied on connection/stream can fire as
+	* a microtask during the walk and inject or teleport an unsanitized DOM
+	* range into a region the iterator has already passed and will not revisit,
+	* so the post-return "tree is sanitized" contract is violated. Sweep the
+	* whole tree once up front and sever every linkage before the walk begins,
+	* closing that window.
+	*
+	* This CANNOT undo a patch that already fired before sanitize ran — that is
+	* the irreducible "do not IN_PLACE a live-connected attacker tree" caveat —
+	* but it closes everything from sanitize-start onward. Gated on SAFE_FOR_XML
+	* to group with the rest of the declarative-partial-updates handling and
+	* stay overridable, consistent with the codebase.
+	*
+	* Clobber-safe traversal (cached childNodes getter); per-node try/catch so a
+	* clobbered root cannot defeat the sweep of its non-clobbered descendants.
+	*
+	* NOTE (pending real-Chrome confirmation, see test/declarative-patch-probe
+	* .html Q1): this mirrors the existing policy of keeping `for` on
+	* <label>/<output>. If the shipping feature can drive a patch through a
+	* surviving `for`-on-label/output + `id` pair, this pre-pass and the
+	* attribute check at _isBasicCustomElement's caller must additionally drop
+	* that pair on the IN_PLACE path. Left as-is until the taxonomy is verified.
+	*
+	* @param root the in-place root to sweep
+	*/
+	const _neutralizePatchLinkage = function _neutralizePatchLinkage(root) {
+		if (!SAFE_FOR_XML) return;
+		const stack = [root];
+		while (stack.length > 0) {
+			const node = stack.pop();
+			const nodeType = getNodeType ? getNodeType(node) : node.nodeType;
+			if (nodeType === NODE_TYPE.processingInstruction || nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, node.data)) {
+				try {
+					remove(node);
+				} catch (_) {}
+				continue;
+			}
+			if (nodeType === NODE_TYPE.element) {
+				const element = node;
+				const lcTag = transformCaseFunc(getNodeName ? getNodeName(node) : node.nodeName);
+				try {
+					if (element.hasAttribute && element.hasAttribute("patchsrc")) element.removeAttribute("patchsrc");
+					if (element.hasAttribute && element.hasAttribute("for") && lcTag !== "label" && lcTag !== "output") element.removeAttribute("for");
+				} catch (_) {}
+			}
+			const childNodes = getChildNodes(node);
 			if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push(childNodes[i]);
 		}
 	};
@@ -7542,6 +7668,20 @@ function createDOMPurify() {
 		return createNodeIterator.call(root.ownerDocument || root, root, NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
 	};
 	/**
+	* Replace template expression syntax (mustache, ERB, template
+	* literal) with a space; shared by all SAFE_FOR_TEMPLATES scrub
+	* sites. Order matters: mustache, then ERB, then template literal.
+	*
+	* @param value the string to scrub
+	* @returns the scrubbed string
+	*/
+	const _stripTemplateExpressions = function _stripTemplateExpressions(value) {
+		value = stringReplace(value, MUSTACHE_EXPR$1, " ");
+		value = stringReplace(value, ERB_EXPR$1, " ");
+		value = stringReplace(value, TMPLIT_EXPR$1, " ");
+		return value;
+	};
+	/**
 	* Strip template-engine expressions ({{...}}, ${...}, <%...%>) from the
 	* character data of an element subtree. Used as the final safety net for
 	* SAFE_FOR_TEMPLATES on every DOM-returning code path so that expressions
@@ -7561,24 +7701,16 @@ function createDOMPurify() {
 	* @param node The root element whose character data should be scrubbed.
 	*/
 	const _scrubTemplateExpressions2 = function _scrubTemplateExpressions(node) {
-		var _node$querySelectorAl, _node$querySelectorAl2;
+		var _node$querySelectorAl;
 		node.normalize();
 		const walker = createNodeIterator.call(node.ownerDocument || node, node, NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION, null);
 		let currentNode = walker.nextNode();
 		while (currentNode) {
-			let data = currentNode.data;
-			arrayForEach([
-				MUSTACHE_EXPR$1,
-				ERB_EXPR$1,
-				TMPLIT_EXPR$1
-			], (expr) => {
-				data = stringReplace(data, expr, " ");
-			});
-			currentNode.data = data;
+			currentNode.data = _stripTemplateExpressions(currentNode.data);
 			currentNode = walker.nextNode();
 		}
-		const templates = (_node$querySelectorAl = (_node$querySelectorAl2 = node.querySelectorAll) === null || _node$querySelectorAl2 === void 0 ? void 0 : _node$querySelectorAl2.call(node, "template")) !== null && _node$querySelectorAl !== void 0 ? _node$querySelectorAl : [];
-		arrayForEach(Array.from(templates), (tmpl) => {
+		const templates = (_node$querySelectorAl = node.querySelectorAll) === null || _node$querySelectorAl === void 0 ? void 0 : _node$querySelectorAl.call(node, "template");
+		if (templates) arrayForEach(templates, (tmpl) => {
 			if (_isDocumentFragment(tmpl.content)) _scrubTemplateExpressions2(tmpl.content);
 		});
 	};
@@ -7639,11 +7771,65 @@ function createDOMPurify() {
 		}
 	};
 	function _executeHooks(hooks, currentNode, data) {
+		if (hooks.length === 0) return;
 		arrayForEach(hooks, (hook) => {
 			hook.call(DOMPurify, currentNode, data, CONFIG);
 		});
 	}
 	/**
+	* Structural-threat checks that condemn a node regardless of the
+	* allowlists: mXSS via namespace confusion, risky CSS construction,
+	* processing instructions, markup-bearing comments. Pure predicate;
+	* the caller removes. Check order is load-bearing.
+	*
+	* @param currentNode the node to inspect
+	* @param tagName the node's transformCaseFunc'd tag name
+	* @return true if the node must be removed
+	*/
+	const _isUnsafeNode = function _isUnsafeNode(currentNode, tagName) {
+		if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.innerHTML)) return true;
+		if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && tagName === "style" && _isNode(currentNode.firstElementChild)) return true;
+		if (currentNode.nodeType === NODE_TYPE.processingInstruction) return true;
+		if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, currentNode.data)) return true;
+		return false;
+	};
+	/**
+	* Handle a node whose tag is forbidden or not allowlisted: keep
+	* allowed custom elements (false return exits _sanitizeElements
+	* early - the namespace and fallback-tag removal checks are
+	* intentionally skipped for kept custom elements), else hoist
+	* content per KEEP_CONTENT and remove.
+	*
+	* A kept custom element is the ONLY case in which this function
+	* returns false, so the caller uses that return value to run the
+	* afterSanitizeElements hook on the kept element and keep the
+	* element-hook lifecycle consistent with normal allowlisted
+	* elements (GHSA-c2j3-45gr-mqc4).
+	*
+	* @param currentNode the disallowed node
+	* @param tagName the node's transformCaseFunc'd tag name
+	* @return true if the node was removed, false if kept
+	*/
+	const _sanitizeDisallowedNode = function _sanitizeDisallowedNode(currentNode, tagName) {
+		if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
+			if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
+			if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) return false;
+		}
+		if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
+			const parentNode = getParentNode(currentNode);
+			const childNodes = getChildNodes(currentNode);
+			if (childNodes && parentNode) {
+				const childCount = childNodes.length;
+				for (let i = childCount - 1; i >= 0; --i) {
+					const hoisted = IN_PLACE ? childNodes[i] : cloneNode(childNodes[i], true);
+					parentNode.insertBefore(hoisted, getNextSibling(currentNode));
+				}
+			}
+		}
+		_forceRemove(currentNode);
+		return true;
+	};
+	/**
 	* _sanitizeElements
 	*
 	* @protect nodeName
@@ -7652,9 +7838,9 @@ function createDOMPurify() {
 	* @param currentNode to check for permission to exist
 	* @return true if node was killed, false if left alive
 	*/
-	const _sanitizeElements = function _sanitizeElements(currentNode) {
-		let content = null;
+	const _sanitizeElements = function _sanitizeElements(currentNode, root) {
 		_executeHooks(hooks.beforeSanitizeElements, currentNode, null);
+		if (currentNode !== root && getParentNode(currentNode) === null) return true;
 		if (_isClobbered(currentNode)) {
 			_forceRemove(currentNode);
 			return true;
@@ -7664,58 +7850,26 @@ function createDOMPurify() {
 			tagName,
 			allowedTags: ALLOWED_TAGS
 		});
-		if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) {
-			_forceRemove(currentNode);
-			return true;
-		}
-		if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && tagName === "style" && _isNode(currentNode.firstElementChild)) {
-			_forceRemove(currentNode);
-			return true;
-		}
-		if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
-			_forceRemove(currentNode);
-			return true;
-		}
-		if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
+		if (currentNode !== root && getParentNode(currentNode) === null) return true;
+		if (_isUnsafeNode(currentNode, tagName)) {
 			_forceRemove(currentNode);
 			return true;
 		}
 		if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) {
-			if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
-				if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
-				if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) return false;
-			}
-			if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
-				const parentNode = getParentNode(currentNode);
-				const childNodes = getChildNodes(currentNode);
-				if (childNodes && parentNode) {
-					const childCount = childNodes.length;
-					for (let i = childCount - 1; i >= 0; --i) {
-						const hoisted = IN_PLACE ? childNodes[i] : cloneNode(childNodes[i], true);
-						parentNode.insertBefore(hoisted, getNextSibling(currentNode));
-					}
-				}
-			}
-			_forceRemove(currentNode);
-			return true;
+			const removed = _sanitizeDisallowedNode(currentNode, tagName);
+			if (removed === false) _executeHooks(hooks.afterSanitizeElements, currentNode, null);
+			return removed;
 		}
 		if ((getNodeType ? getNodeType(currentNode) : currentNode.nodeType) === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
 			_forceRemove(currentNode);
 			return true;
 		}
-		if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
+		if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(FALLBACK_TAG_CLOSE, currentNode.innerHTML)) {
 			_forceRemove(currentNode);
 			return true;
 		}
 		if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
-			content = currentNode.textContent;
-			arrayForEach([
-				MUSTACHE_EXPR$1,
-				ERB_EXPR$1,
-				TMPLIT_EXPR$1
-			], (expr) => {
-				content = stringReplace(content, expr, " ");
-			});
+			const content = _stripTemplateExpressions(currentNode.textContent);
 			if (currentNode.textContent !== content) {
 				arrayPush(DOMPurify.removed, { element: currentNode.cloneNode() });
 				currentNode.textContent = content;
@@ -7734,11 +7888,13 @@ function createDOMPurify() {
 	*/
 	const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
 		if (FORBID_ATTR[lcName]) return false;
+		if (SAFE_FOR_XML && lcName === "patchsrc") return false;
+		if (SAFE_FOR_XML && lcName === "for" && lcTag !== "label" && lcTag !== "output") return false;
 		if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document || value in formElement)) return false;
 		const nameIsPermitted = ALLOWED_ATTR[lcName] || EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag);
-		if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR$1, lcName));
+		if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$1, lcName));
 		else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName));
-		else if (!nameIsPermitted || FORBID_ATTR[lcName]) if (_isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName, lcTag)) || lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value)));
+		else if (!nameIsPermitted) if (_isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName, lcTag)) || lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value)));
 		else return false;
 		else if (URI_SAFE_ATTRIBUTES[lcName]);
 		else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, "")));
@@ -7769,6 +7925,48 @@ function createDOMPurify() {
 		return !RESERVED_CUSTOM_ELEMENT_NAMES[stringToLowerCase(tagName)] && regExpTest(CUSTOM_ELEMENT$1, tagName);
 	};
 	/**
+	* Wrap an attribute value in the matching Trusted Types object when
+	* the active policy requires it. Namespaced attributes pass through
+	* unchanged (no TT support yet, see
+	* https://bugs.chromium.org/p/chromium/issues/detail?id=1305293).
+	*
+	* @param lcTag lowercase tag name of the containing element
+	* @param lcName lowercase attribute name
+	* @param namespaceURI the attribute's namespace, if any
+	* @param value the attribute value to wrap
+	* @return the value, wrapped when Trusted Types demand it
+	*/
+	const _applyTrustedTypesToAttribute = function _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value) {
+		if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function" && !namespaceURI) switch (trustedTypes.getAttributeType(lcTag, lcName)) {
+			case "TrustedHTML": return _createTrustedHTML(value);
+			case "TrustedScriptURL": return _createTrustedScriptURL(value);
+		}
+		return value;
+	};
+	/**
+	* Write a modified attribute value back onto the element. On
+	* success, re-probe for clobbering introduced by the new value and
+	* remove the element when found; otherwise pop the removal entry
+	* recorded by the earlier _removeAttribute (long-standing pairing
+	* with the SANITIZE_NAMED_PROPS path - do not "fix" casually). On
+	* failure, remove the attribute instead.
+	*
+	* @param currentNode the element carrying the attribute
+	* @param name the attribute name as present on the element
+	* @param namespaceURI the attribute's namespace, if any
+	* @param value the new attribute value
+	*/
+	const _setAttributeValue = function _setAttributeValue(currentNode, name, namespaceURI, value) {
+		try {
+			if (namespaceURI) currentNode.setAttributeNS(namespaceURI, name, value);
+			else currentNode.setAttribute(name, value);
+			if (_isClobbered(currentNode)) _forceRemove(currentNode);
+			else arrayPop(DOMPurify.removed);
+		} catch (_) {
+			_removeAttribute(name, currentNode);
+		}
+	};
+	/**
 	* _sanitizeAttributes
 	*
 	* @protect attributes
@@ -7790,6 +7988,7 @@ function createDOMPurify() {
 			forceKeepAttr: void 0
 		};
 		let l = attributes.length;
+		const lcTag = transformCaseFunc(currentNode.nodeName);
 		while (l--) {
 			const attr = attributes[l];
 			const name = attr.name, namespaceURI = attr.namespaceURI, attrValue = attr.value;
@@ -7819,39 +8018,17 @@ function createDOMPurify() {
 				_removeAttribute(name, currentNode);
 				continue;
 			}
-			if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
+			if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(SELF_CLOSING_TAG, value)) {
 				_removeAttribute(name, currentNode);
 				continue;
 			}
-			if (SAFE_FOR_TEMPLATES) arrayForEach([
-				MUSTACHE_EXPR$1,
-				ERB_EXPR$1,
-				TMPLIT_EXPR$1
-			], (expr) => {
-				value = stringReplace(value, expr, " ");
-			});
-			const lcTag = transformCaseFunc(currentNode.nodeName);
+			if (SAFE_FOR_TEMPLATES) value = _stripTemplateExpressions(value);
 			if (!_isValidAttribute(lcTag, lcName, value)) {
 				_removeAttribute(name, currentNode);
 				continue;
 			}
-			if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function") if (namespaceURI);
-			else switch (trustedTypes.getAttributeType(lcTag, lcName)) {
-				case "TrustedHTML":
-					value = _createTrustedHTML(value);
-					break;
-				case "TrustedScriptURL":
-					value = _createTrustedScriptURL(value);
-					break;
-			}
-			if (value !== initValue) try {
-				if (namespaceURI) currentNode.setAttributeNS(namespaceURI, name, value);
-				else currentNode.setAttribute(name, value);
-				if (_isClobbered(currentNode)) _forceRemove(currentNode);
-				else arrayPop(DOMPurify.removed);
-			} catch (_) {
-				_removeAttribute(name, currentNode);
-			}
+			value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
+			if (value !== initValue) _setAttributeValue(currentNode, name, namespaceURI, value);
 		}
 		_executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
 	};
@@ -7866,11 +8043,11 @@ function createDOMPurify() {
 		_executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
 		while (shadowNode = shadowIterator.nextNode()) {
 			_executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
-			_sanitizeElements(shadowNode);
+			_sanitizeElements(shadowNode, fragment);
 			_sanitizeAttributes(shadowNode);
 			if (_isDocumentFragment(shadowNode.content)) _sanitizeShadowDOM2(shadowNode.content);
 			if ((getNodeType ? getNodeType(shadowNode) : shadowNode.nodeType) === NODE_TYPE.element) {
-				const innerSr = getShadowRoot ? getShadowRoot(shadowNode) : shadowNode.shadowRoot;
+				const innerSr = getShadowRoot(shadowNode);
 				if (_isDocumentFragment(innerSr)) {
 					_sanitizeAttachedShadowRoots(innerSr);
 					_sanitizeShadowDOM2(innerSr);
@@ -7911,7 +8088,7 @@ function createDOMPurify() {
 			}
 			const node = item.node;
 			const isElement = (getNodeType ? getNodeType(node) : node.nodeType) === NODE_TYPE.element;
-			const childNodes = getChildNodes ? getChildNodes(node) : node.childNodes;
+			const childNodes = getChildNodes(node);
 			if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push({
 				node: childNodes[i],
 				shadow: null
@@ -7927,7 +8104,7 @@ function createDOMPurify() {
 				}
 			}
 			if (isElement) {
-				const sr = getShadowRoot ? getShadowRoot(node) : node.shadowRoot;
+				const sr = getShadowRoot(node);
 				if (_isDocumentFragment(sr)) stack.push({
 					node: null,
 					shadow: sr
@@ -7951,16 +8128,28 @@ function createDOMPurify() {
 			if (typeof dirty !== "string") throw typeErrorCreate("dirty is not a string, aborting");
 		}
 		if (!DOMPurify.isSupported) return dirty;
-		if (!SET_CONFIG) _parseConfig(cfg);
+		if (SET_CONFIG) {
+			ALLOWED_TAGS = SET_CONFIG_ALLOWED_TAGS;
+			ALLOWED_ATTR = SET_CONFIG_ALLOWED_ATTR;
+		} else _parseConfig(cfg);
+		if (hooks.uponSanitizeElement.length > 0 || hooks.uponSanitizeAttribute.length > 0) ALLOWED_TAGS = clone(ALLOWED_TAGS);
+		if (hooks.uponSanitizeAttribute.length > 0) ALLOWED_ATTR = clone(ALLOWED_ATTR);
 		DOMPurify.removed = [];
 		const inPlace = IN_PLACE && typeof dirty !== "string" && _isNode(dirty);
 		if (inPlace) {
+			_neutralizePatchLinkage(dirty);
 			const nn = getNodeName ? getNodeName(dirty) : dirty.nodeName;
 			if (typeof nn === "string") {
 				const tagName = transformCaseFunc(nn);
-				if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
+				if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
+					_neutralizeRoot(dirty);
+					throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
+				}
+			}
+			if (_isClobbered(dirty)) {
+				_neutralizeRoot(dirty);
+				throw typeErrorCreate("root node is clobbered and cannot be sanitized in-place");
 			}
-			if (_isClobbered(dirty)) throw typeErrorCreate("root node is clobbered and cannot be sanitized in-place");
 			try {
 				_sanitizeAttachedShadowRoots(dirty);
 			} catch (error) {
@@ -7980,15 +8169,21 @@ function createDOMPurify() {
 			if (!body) return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : "";
 		}
 		if (body && FORCE_BODY) _forceRemove(body.firstChild);
-		const nodeIterator = _createNodeIterator(inPlace ? dirty : body);
+		const walkRoot = inPlace ? dirty : body;
+		const nodeIterator = _createNodeIterator(walkRoot);
 		try {
 			while (currentNode = nodeIterator.nextNode()) {
-				_sanitizeElements(currentNode);
+				_sanitizeElements(currentNode, walkRoot);
 				_sanitizeAttributes(currentNode);
 				if (_isDocumentFragment(currentNode.content)) _sanitizeShadowDOM2(currentNode.content);
 			}
 		} catch (error) {
-			if (inPlace) _neutralizeRoot(dirty);
+			if (inPlace) {
+				_neutralizeRoot(dirty);
+				arrayForEach(DOMPurify.removed, (entry) => {
+					if (entry.element) _neutralizeSubtree(entry.element);
+				});
+			}
 			throw error;
 		}
 		if (inPlace) {
@@ -8009,34 +8204,37 @@ function createDOMPurify() {
 		}
 		let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
 		if (WHOLE_DOCUMENT && ALLOWED_TAGS["!doctype"] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) serializedHTML = "<!DOCTYPE " + body.ownerDocument.doctype.name + ">\n" + serializedHTML;
-		if (SAFE_FOR_TEMPLATES) arrayForEach([
-			MUSTACHE_EXPR$1,
-			ERB_EXPR$1,
-			TMPLIT_EXPR$1
-		], (expr) => {
-			serializedHTML = stringReplace(serializedHTML, expr, " ");
-		});
+		if (SAFE_FOR_TEMPLATES) serializedHTML = _stripTemplateExpressions(serializedHTML);
 		return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(serializedHTML) : serializedHTML;
 	};
 	DOMPurify.setConfig = function() {
-		_parseConfig(arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {});
+		let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
+		_parseConfig(cfg);
 		SET_CONFIG = true;
+		SET_CONFIG_ALLOWED_TAGS = ALLOWED_TAGS;
+		SET_CONFIG_ALLOWED_ATTR = ALLOWED_ATTR;
 	};
 	DOMPurify.clearConfig = function() {
 		CONFIG = null;
 		SET_CONFIG = false;
+		SET_CONFIG_ALLOWED_TAGS = null;
+		SET_CONFIG_ALLOWED_ATTR = null;
 		trustedTypesPolicy = defaultTrustedTypesPolicy;
 		emptyHTML = "";
 	};
 	DOMPurify.isValidAttribute = function(tag, attr, value) {
 		if (!CONFIG) _parseConfig({});
-		return _isValidAttribute(transformCaseFunc(tag), transformCaseFunc(attr), value);
+		const lcTag = transformCaseFunc(tag);
+		const lcName = transformCaseFunc(attr);
+		return _isValidAttribute(lcTag, lcName, value);
 	};
 	DOMPurify.addHook = function(entryPoint, hookFunction) {
 		if (typeof hookFunction !== "function") return;
+		if (!objectHasOwnProperty(hooks, entryPoint)) return;
 		arrayPush(hooks[entryPoint], hookFunction);
 	};
 	DOMPurify.removeHook = function(entryPoint, hookFunction) {
+		if (!objectHasOwnProperty(hooks, entryPoint)) return;
 		if (hookFunction !== void 0) {
 			const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
 			return index === -1 ? void 0 : arraySplice(hooks[entryPoint], index, 1)[0];
@@ -8044,6 +8242,7 @@ function createDOMPurify() {
 		return arrayPop(hooks[entryPoint]);
 	};
 	DOMPurify.removeHooks = function(entryPoint) {
+		if (!objectHasOwnProperty(hooks, entryPoint)) return;
 		hooks[entryPoint] = [];
 	};
 	DOMPurify.removeAllHooks = function() {
@@ -9877,6 +10076,42 @@ function bind(fn, thisArg) {
 var { toString } = Object.prototype;
 var { getPrototypeOf } = Object;
 var { iterator, toStringTag } = Symbol;
+var hasOwnProperty = (({ hasOwnProperty }) => (obj, prop) => hasOwnProperty.call(obj, prop))(Object.prototype);
+/**
+* Walk the prototype chain (excluding the shared Object.prototype) looking for
+* an own `prop`. This distinguishes genuine own/inherited members — including
+* class accessors and template prototypes — from members injected via
+* Object.prototype pollution (e.g. `Object.prototype.username = '...'`), which
+* live on Object.prototype itself and are therefore never matched.
+*
+* @param {*} thing The value whose chain to inspect
+* @param {string|symbol} prop The property key to look for
+*
+* @returns {boolean} True when `prop` is owned below Object.prototype
+*/
+var hasOwnInPrototypeChain = (thing, prop) => {
+	let obj = thing;
+	const seen = [];
+	while (obj != null && obj !== Object.prototype) {
+		if (seen.indexOf(obj) !== -1) return false;
+		seen.push(obj);
+		if (hasOwnProperty(obj, prop)) return true;
+		obj = getPrototypeOf(obj);
+	}
+	return false;
+};
+/**
+* Read `obj[prop]` only when it is safe from Object.prototype pollution. Own
+* properties and members inherited from a non-Object.prototype source (a class
+* instance or template object) are honored; a value reachable only through a
+* polluted Object.prototype is ignored and `undefined` is returned.
+*
+* @param {*} obj The source object
+* @param {string|symbol} prop The property key to read
+*
+* @returns {*} The resolved value, or undefined when unsafe/absent
+*/
+var getSafeProp = (obj, prop) => obj != null && hasOwnInPrototypeChain(obj, prop) ? obj[prop] : void 0;
 var kindOf = ((cache) => (thing) => {
 	const str = toString.call(thing);
 	return cache[str] || (cache[str] = str.slice(8, -1).toLowerCase());
@@ -9979,9 +10214,9 @@ var isBoolean = (thing) => thing === true || thing === false;
 * @returns {boolean} True if value is a plain Object, otherwise false
 */
 var isPlainObject = (val) => {
-	if (kindOf(val) !== "object") return false;
+	if (!isObject(val)) return false;
 	const prototype = getPrototypeOf(val);
-	return (prototype === null || prototype === Object.prototype || Object.getPrototypeOf(prototype) === null) && !(toStringTag in val) && !(iterator in val);
+	return (prototype === null || prototype === Object.prototype || getPrototypeOf(prototype) === null) && !hasOwnInPrototypeChain(val, toStringTag) && !hasOwnInPrototypeChain(val, iterator);
 };
 /**
 * Determine if a value is an empty object (safely handles Buffers)
@@ -10387,7 +10622,6 @@ var toCamelCase = (str) => {
 		return p1.toUpperCase() + p2;
 	});
 };
-var hasOwnProperty = (({ hasOwnProperty }) => (obj, prop) => hasOwnProperty.call(obj, prop))(Object.prototype);
 var { propertyIsEnumerable } = Object.prototype;
 /**
 * Determine if a value is a RegExp object
@@ -10530,6 +10764,18 @@ var _setImmediate = ((setImmediateSupported, postMessageSupported) => {
 */
 var asap = typeof queueMicrotask !== "undefined" ? queueMicrotask.bind(_global) : typeof process !== "undefined" && process.nextTick || _setImmediate;
 var isIterable = (thing) => thing != null && isFunction$1(thing[iterator]);
+/**
+* Determine if a value is iterable via an iterator that is NOT sourced solely
+* from a polluted Object.prototype. Use this instead of `isIterable` whenever
+* the iterable comes from untrusted input (e.g. user-supplied header sources),
+* so `Object.prototype[Symbol.iterator] = ...` cannot turn an ordinary object
+* into an attacker-controlled entries iterator.
+*
+* @param {*} thing The value to test
+*
+* @returns {boolean} True if value has a non-polluted iterator
+*/
+var isSafeIterable = (thing) => thing != null && hasOwnInPrototypeChain(thing, iterator) && isIterable(thing);
 var utils_default = {
 	isArray,
 	isArrayBuffer,
@@ -10574,6 +10820,8 @@ var utils_default = {
 	isHTMLForm,
 	hasOwnProperty,
 	hasOwnProp: hasOwnProperty,
+	hasOwnInPrototypeChain,
+	getSafeProp,
 	reduceDescriptors,
 	freezeMethods,
 	toObjectSet,
@@ -10589,7 +10837,8 @@ var utils_default = {
 	isThenable,
 	setImmediate: _setImmediate,
 	asap,
-	isIterable
+	isIterable,
+	isSafeIterable
 };
 //#endregion
 //#region node_modules/axios/lib/helpers/parseHeaders.js
@@ -10735,11 +10984,15 @@ var AxiosHeaders = class {
 		const setHeaders = (headers, _rewrite) => utils_default.forEach(headers, (_value, _header) => setHeader(_value, _header, _rewrite));
 		if (utils_default.isPlainObject(header) || header instanceof this.constructor) setHeaders(header, valueOrRewrite);
 		else if (utils_default.isString(header) && (header = header.trim()) && !isValidHeaderName(header)) setHeaders(parseHeaders_default(header), valueOrRewrite);
-		else if (utils_default.isObject(header) && utils_default.isIterable(header)) {
-			let obj = {}, dest, key;
+		else if (utils_default.isObject(header) && utils_default.isSafeIterable(header)) {
+			let obj = Object.create(null), dest, key;
 			for (const entry of header) {
 				if (!utils_default.isArray(entry)) throw new TypeError("Object iterator must return a key-value pair");
-				obj[key = entry[0]] = (dest = obj[key]) ? utils_default.isArray(dest) ? [...dest, entry[1]] : [dest, entry[1]] : entry[1];
+				key = entry[0];
+				if (utils_default.hasOwnProp(obj, key)) {
+					dest = obj[key];
+					obj[key] = utils_default.isArray(dest) ? [...dest, entry[1]] : [dest, entry[1]];
+				} else obj[key] = entry[1];
 			}
 			setHeaders(obj, valueOrRewrite);
 		} else header != null && setHeader(valueOrRewrite, header, rewrite);
@@ -10923,7 +11176,13 @@ function redactConfig(config, redactKeys) {
 var AxiosError = class AxiosError extends Error {
 	static from(error, code, config, request, response, customProps) {
 		const axiosError = new AxiosError(error.message, code || error.code, config, request, response);
-		axiosError.cause = error;
+		Object.defineProperty(axiosError, "cause", {
+			__proto__: null,
+			value: error,
+			writable: true,
+			enumerable: false,
+			configurable: true
+		});
 		axiosError.name = error.name;
 		if (error.status != null && axiosError.status == null) axiosError.status = error.status;
 		customProps && Object.assign(axiosError, customProps);
@@ -10992,8 +11251,6 @@ AxiosError.ERR_CANCELED = "ERR_CANCELED";
 AxiosError.ERR_NOT_SUPPORT = "ERR_NOT_SUPPORT";
 AxiosError.ERR_INVALID_URL = "ERR_INVALID_URL";
 AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED = "ERR_FORM_DATA_DEPTH_EXCEEDED";
-//#endregion
-//#region node_modules/axios/lib/helpers/toFormData.js
 /**
 * Determines if the given thing is a array or js object.
 *
@@ -11082,15 +11339,34 @@ function toFormData(obj, formData, options) {
 	const _Blob = options.Blob || typeof Blob !== "undefined" && Blob;
 	const maxDepth = options.maxDepth === void 0 ? 100 : options.maxDepth;
 	const useBlob = _Blob && utils_default.isSpecCompliantForm(formData);
+	const stack = [];
 	if (!utils_default.isFunction(visitor)) throw new TypeError("visitor must be a function");
 	function convertValue(value) {
 		if (value === null) return "";
 		if (utils_default.isDate(value)) return value.toISOString();
 		if (utils_default.isBoolean(value)) return value.toString();
 		if (!useBlob && utils_default.isBlob(value)) throw new AxiosError("Blob is not supported. Use a Buffer instead.");
-		if (utils_default.isArrayBuffer(value) || utils_default.isTypedArray(value)) return useBlob && typeof Blob === "function" ? new Blob([value]) : Buffer.from(value);
+		if (utils_default.isArrayBuffer(value) || utils_default.isTypedArray(value)) {
+			if (useBlob && typeof _Blob === "function") return new _Blob([value]);
+			if (typeof Buffer !== "undefined") return Buffer.from(value);
+			throw new AxiosError("Blob is not supported. Use a Buffer instead.", AxiosError.ERR_NOT_SUPPORT);
+		}
 		return value;
 	}
+	function throwIfMaxDepthExceeded(depth) {
+		if (depth > maxDepth) throw new AxiosError("Object is too deeply nested (" + depth + " levels). Max depth: " + maxDepth, AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED);
+	}
+	function stringifyWithDepthLimit(value, depth) {
+		if (maxDepth === Infinity) return JSON.stringify(value);
+		const ancestors = [];
+		return JSON.stringify(value, function limitDepth(_key, currentValue) {
+			if (!utils_default.isObject(currentValue)) return currentValue;
+			while (ancestors.length && ancestors[ancestors.length - 1] !== this) ancestors.pop();
+			ancestors.push(currentValue);
+			throwIfMaxDepthExceeded(depth + ancestors.length - 1);
+			return currentValue;
+		});
+	}
 	/**
 	* Default visitor.
 	*
@@ -11110,7 +11386,7 @@ function toFormData(obj, formData, options) {
 		if (value && !path && typeof value === "object") {
 			if (utils_default.endsWith(key, "{}")) {
 				key = metaTokens ? key : key.slice(0, -2);
-				value = JSON.stringify(value);
+				value = stringifyWithDepthLimit(value, 1);
 			} else if (utils_default.isArray(value) && isFlatArray(value) || (utils_default.isFileList(value) || utils_default.endsWith(key, "[]")) && (arr = utils_default.toArray(value))) {
 				key = removeBrackets(key);
 				arr.forEach(function each(el, index) {
@@ -11123,7 +11399,6 @@ function toFormData(obj, formData, options) {
 		formData.append(renderKey(path, key, dots), convertValue(value));
 		return false;
 	}
-	const stack = [];
 	const exposedHelpers = Object.assign(predicates, {
 		defaultVisitor,
 		convertValue,
@@ -11131,7 +11406,7 @@ function toFormData(obj, formData, options) {
 	});
 	function build(value, path, depth = 0) {
 		if (utils_default.isUndefined(value)) return;
-		if (depth > maxDepth) throw new AxiosError("Object is too deeply nested (" + depth + " levels). Max depth: " + maxDepth, AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED);
+		throwIfMaxDepthExceeded(depth);
 		if (stack.indexOf(value) !== -1) throw new Error("Circular reference detected in " + path.join("."));
 		stack.push(value);
 		utils_default.forEach(value, function each(el, key) {
@@ -11183,9 +11458,7 @@ prototype.append = function append(name, value) {
 	this._pairs.push([name, value]);
 };
 prototype.toString = function toString(encoder) {
-	const _encode = encoder ? function(value) {
-		return encoder.call(this, value, encode$1);
-	} : encode$1;
+	const _encode = encoder ? (value) => encoder.call(this, value, encode$1) : encode$1;
 	return this._pairs.map(function each(pair) {
 		return _encode(pair[0]) + "=" + _encode(pair[1]);
 	}, "").join("&");
@@ -11214,9 +11487,10 @@ function encode(val) {
 */
 function buildURL(url, params, options) {
 	if (!params) return url;
-	const _encode = options && options.encode || encode;
+	url = url || "";
 	const _options = utils_default.isFunction(options) ? { serialize: options } : options;
-	const serializeFn = _options && _options.serialize;
+	const _encode = utils_default.getSafeProp(_options, "encode") || encode;
+	const serializeFn = utils_default.getSafeProp(_options, "serialize");
 	let serializedParams;
 	if (serializeFn) serializedParams = serializeFn(params, _options);
 	else serializedParams = utils_default.isURLSearchParams(params) ? params.toString() : new AxiosURLSearchParams(params, _options).toString(_encode);
@@ -11292,7 +11566,8 @@ var transitional_default = {
 	forcedJSONParsing: true,
 	clarifyTimeoutError: false,
 	legacyInterceptorReqResOrdering: true,
-	advertiseZstdAcceptEncoding: false
+	advertiseZstdAcceptEncoding: false,
+	validateStatusUndefinedResolves: true
 };
 //#endregion
 //#region node_modules/axios/lib/platform/browser/index.js
@@ -11380,6 +11655,10 @@ function toURLEncodedForm(data, options) {
 }
 //#endregion
 //#region node_modules/axios/lib/helpers/formDataToJSON.js
+var MAX_DEPTH = 100;
+function throwIfDepthExceeded(index) {
+	if (index > MAX_DEPTH) throw new AxiosError("FormData field is too deeply nested (" + index + " levels). Max depth: " + MAX_DEPTH, AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED);
+}
 /**
 * It takes a string like `foo[x][y][z]` and returns an array like `['foo', 'x', 'y', 'z']
 *
@@ -11388,9 +11667,14 @@ function toURLEncodedForm(data, options) {
 * @returns An array of strings.
 */
 function parsePropPath(name) {
-	return utils_default.matchAll(/\w+|\[(\w*)]/g, name).map((match) => {
-		return match[0] === "[]" ? "" : match[1] || match[0];
-	});
+	const path = [];
+	const pattern = /\w+|\[(\w*)]/g;
+	let match;
+	while ((match = pattern.exec(name)) !== null) {
+		throwIfDepthExceeded(path.length);
+		path.push(match[0] === "[]" ? "" : match[1] || match[0]);
+	}
+	return path;
 }
 /**
 * Convert an array to an object.
@@ -11420,6 +11704,7 @@ function arrayToObject(arr) {
 */
 function formDataToJSON(formData) {
 	function buildPath(path, value, target, index) {
+		throwIfDepthExceeded(index);
 		let name = path[index++];
 		if (name === "__proto__") return true;
 		const isNumericKey = Number.isFinite(+name);
@@ -11749,7 +12034,11 @@ var cookies_default = platform_default.hasStandardBrowserEnv ? {
 		for (let i = 0; i < cookies.length; i++) {
 			const cookie = cookies[i].replace(/^\s+/, "");
 			const eq = cookie.indexOf("=");
-			if (eq !== -1 && cookie.slice(0, eq) === name) return decodeURIComponent(cookie.slice(eq + 1));
+			if (eq !== -1 && cookie.slice(0, eq) === name) try {
+				return decodeURIComponent(cookie.slice(eq + 1));
+			} catch (e) {
+				return cookie.slice(eq + 1);
+			}
 		}
 		return null;
 	},
@@ -11791,6 +12080,19 @@ function combineURLs(baseURL, relativeURL) {
 }
 //#endregion
 //#region node_modules/axios/lib/core/buildFullPath.js
+var malformedHttpProtocol = /^https?:(?!\/\/)/i;
+var httpProtocolControlCharacters = /[\t\n\r]/g;
+function stripLeadingC0ControlOrSpace(url) {
+	let i = 0;
+	while (i < url.length && url.charCodeAt(i) <= 32) i++;
+	return url.slice(i);
+}
+function normalizeURLForProtocolCheck(url) {
+	return stripLeadingC0ControlOrSpace(url).replace(httpProtocolControlCharacters, "");
+}
+function assertValidHttpProtocolURL(url, config) {
+	if (typeof url === "string" && malformedHttpProtocol.test(normalizeURLForProtocolCheck(url))) throw new AxiosError("Invalid URL: missing \"//\" after protocol", AxiosError.ERR_INVALID_URL, config);
+}
 /**
 * Creates a new URL by combining the baseURL with the requestedURL,
 * only when the requestedURL is not already an absolute URL.
@@ -11801,9 +12103,13 @@ function combineURLs(baseURL, relativeURL) {
 *
 * @returns {string} The combined full path
 */
-function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
+function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls, config) {
+	assertValidHttpProtocolURL(requestedURL, config);
 	let isRelativeUrl = !isAbsoluteURL(requestedURL);
-	if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) return combineURLs(baseURL, requestedURL);
+	if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
+		assertValidHttpProtocolURL(baseURL, config);
+		return combineURLs(baseURL, requestedURL);
+	}
 	return requestedURL;
 }
 //#endregion
@@ -11819,6 +12125,7 @@ var headersToObject = (thing) => thing instanceof AxiosHeaders ? { ...thing } :
 * @returns {Object} New object resulting from merging config2 to config1
 */
 function mergeConfig(config1, config2) {
+	config1 = config1 || {};
 	config2 = config2 || {};
 	const config = Object.create(null);
 	Object.defineProperty(config, "hasOwnProperty", {
@@ -11845,6 +12152,14 @@ function mergeConfig(config1, config2) {
 		if (!utils_default.isUndefined(b)) return getMergedValue(void 0, b);
 		else if (!utils_default.isUndefined(a)) return getMergedValue(void 0, a);
 	}
+	function getMergedTransitionalOption(prop) {
+		const transitional2 = utils_default.hasOwnProp(config2, "transitional") ? config2.transitional : void 0;
+		if (!utils_default.isUndefined(transitional2)) if (utils_default.isPlainObject(transitional2)) {
+			if (utils_default.hasOwnProp(transitional2, prop)) return transitional2[prop];
+		} else return;
+		const transitional1 = utils_default.hasOwnProp(config1, "transitional") ? config1.transitional : void 0;
+		if (utils_default.isPlainObject(transitional1) && utils_default.hasOwnProp(transitional1, prop)) return transitional1[prop];
+	}
 	function mergeDirectKeys(a, b, prop) {
 		if (utils_default.hasOwnProp(config2, prop)) return getMergedValue(a, b);
 		else if (utils_default.hasOwnProp(config1, prop)) return getMergedValue(void 0, a);
@@ -11890,6 +12205,8 @@ function mergeConfig(config1, config2) {
 		const configValue = merge(utils_default.hasOwnProp(config1, prop) ? config1[prop] : void 0, utils_default.hasOwnProp(config2, prop) ? config2[prop] : void 0, prop);
 		utils_default.isUndefined(configValue) && merge !== mergeDirectKeys || (config[prop] = configValue);
 	});
+	if (utils_default.hasOwnProp(config2, "validateStatus") && utils_default.isUndefined(config2.validateStatus) && getMergedTransitionalOption("validateStatusUndefinedResolves") === false) if (utils_default.hasOwnProp(config1, "validateStatus")) config.validateStatus = getMergedValue(void 0, config1.validateStatus);
+	else delete config.validateStatus;
 	return config;
 }
 //#endregion
@@ -11900,7 +12217,7 @@ function setFormDataHeaders(headers, formHeaders, policy) {
 		headers.set(formHeaders);
 		return;
 	}
-	Object.entries(formHeaders).forEach(([key, val]) => {
+	Object.entries(formHeaders || {}).forEach(([key, val]) => {
 		if (FORM_DATA_CONTENT_HEADERS.includes(key.toLowerCase())) headers.set(key, val);
 	});
 }
@@ -11926,8 +12243,16 @@ function resolveConfig(config) {
 	const allowAbsoluteUrls = own("allowAbsoluteUrls");
 	const url = own("url");
 	newConfig.headers = headers = AxiosHeaders.from(headers);
-	newConfig.url = buildURL(buildFullPath(baseURL, url, allowAbsoluteUrls), own("params"), own("paramsSerializer"));
-	if (auth) headers.set("Authorization", "Basic " + btoa((auth.username || "") + ":" + (auth.password ? encodeUTF8$1(auth.password) : "")));
+	newConfig.url = buildURL(buildFullPath(baseURL, url, allowAbsoluteUrls, newConfig), own("params"), own("paramsSerializer"));
+	if (auth) {
+		const username = utils_default.getSafeProp(auth, "username") || "";
+		const password = utils_default.getSafeProp(auth, "password") || "";
+		try {
+			headers.set("Authorization", "Basic " + btoa(username + ":" + (password ? encodeUTF8$1(password) : "")));
+		} catch (e) {
+			throw AxiosError.from(e, AxiosError.ERR_BAD_OPTION_VALUE, config);
+		}
+	}
 	if (utils_default.isFormData(data)) {
 		if (platform_default.hasStandardBrowserEnv || platform_default.hasStandardBrowserWebWorkerEnv || utils_default.isReactNative(data)) headers.setContentType(void 0);
 		else if (utils_default.isFunction(data.getHeaders)) setFormDataHeaders(headers, data.getHeaders(), own("formDataHeaderPolicy"));
@@ -12034,6 +12359,7 @@ var xhr_default = typeof XMLHttpRequest !== "undefined" && function(config) {
 		const protocol = parseProtocol(_config.url);
 		if (protocol && !platform_default.protocols.includes(protocol)) {
 			reject(new AxiosError("Unsupported protocol " + protocol + ":", AxiosError.ERR_BAD_REQUEST, config));
+			done();
 			return;
 		}
 		request.send(requestData || null);
@@ -12067,7 +12393,7 @@ var composeSignals = (signals, timeout) => {
 		});
 		signals = null;
 	};
-	signals.forEach((signal) => signal.addEventListener("abort", onabort));
+	signals.forEach((signal) => signal.addEventListener("abort", onabort, { once: true }));
 	const { signal } = controller;
 	signal.unsubscribe = () => utils_default.asap(unsubscribe);
 	return signal;
@@ -12146,11 +12472,13 @@ var trackStream = (stream, chunkSize, onProgress, onFinish) => {
 * Estimate decoded byte length of a data:// URL *without* allocating large buffers.
 * - For base64: compute exact decoded size using length and padding;
 *               handle %XX at the character-count level (no string allocation).
-* - For non-base64: use UTF-8 byteLength of the encoded body as a safe upper bound.
+* - For non-base64: compute the exact percent-decoded UTF-8 byte length.
 *
 * @param {string} url
 * @returns {number}
 */
+var isHexDigit = (charCode) => charCode >= 48 && charCode <= 57 || charCode >= 65 && charCode <= 70 || charCode >= 97 && charCode <= 102;
+var isPercentEncodedByte = (str, i, len) => i + 2 < len && isHexDigit(str.charCodeAt(i + 1)) && isHexDigit(str.charCodeAt(i + 2));
 function estimateDataURLDecodedBytes(url) {
 	if (!url || typeof url !== "string") return 0;
 	if (!url.startsWith("data:")) return 0;
@@ -12164,7 +12492,7 @@ function estimateDataURLDecodedBytes(url) {
 		for (let i = 0; i < len; i++) if (body.charCodeAt(i) === 37 && i + 2 < len) {
 			const a = body.charCodeAt(i + 1);
 			const b = body.charCodeAt(i + 2);
-			if ((a >= 48 && a <= 57 || a >= 65 && a <= 70 || a >= 97 && a <= 102) && (b >= 48 && b <= 57 || b >= 65 && b <= 70 || b >= 97 && b <= 102)) {
+			if (isHexDigit(a) && isHexDigit(b)) {
 				effectiveLen -= 2;
 				i += 2;
 			}
@@ -12188,11 +12516,13 @@ function estimateDataURLDecodedBytes(url) {
 		const bytes = Math.floor(effectiveLen / 4) * 3 - (pad || 0);
 		return bytes > 0 ? bytes : 0;
 	}
-	if (typeof Buffer !== "undefined" && typeof Buffer.byteLength === "function") return Buffer.byteLength(body, "utf8");
 	let bytes = 0;
 	for (let i = 0, len = body.length; i < len; i++) {
 		const c = body.charCodeAt(i);
-		if (c < 128) bytes += 1;
+		if (c === 37 && isPercentEncodedByte(body, i, len)) {
+			bytes += 1;
+			i += 2;
+		} else if (c < 128) bytes += 1;
 		else if (c < 2048) bytes += 2;
 		else if (c >= 55296 && c <= 56319 && i + 1 < len) {
 			const next = body.charCodeAt(i + 1);
@@ -12206,7 +12536,7 @@ function estimateDataURLDecodedBytes(url) {
 }
 //#endregion
 //#region node_modules/axios/lib/env/data.js
-var VERSION = "1.17.0";
+var VERSION = "1.18.1";
 //#endregion
 //#region node_modules/axios/lib/adapters/fetch.js
 var DEFAULT_CHUNK_SIZE = 64 * 1024;
@@ -12314,12 +12644,14 @@ var factory = (env) => {
 			composedSignal.unsubscribe();
 		});
 		let requestContentLength;
+		let pendingBodyError = null;
+		const maxBodyLengthError = () => new AxiosError("Request body larger than maxBodyLength limit", AxiosError.ERR_BAD_REQUEST, config, request);
 		try {
 			let auth = void 0;
 			const configAuth = own("auth");
 			if (configAuth) auth = {
-				username: configAuth.username || "",
-				password: configAuth.password || ""
+				username: utils_default.getSafeProp(configAuth, "username") || "",
+				password: utils_default.getSafeProp(configAuth, "password") || ""
 			};
 			if (maybeWithAuthCredentials(url)) {
 				const parsedURL = new URL(url, platform_default.origin);
@@ -12341,22 +12673,34 @@ var factory = (env) => {
 				if (estimateDataURLDecodedBytes(url) > maxContentLength) throw new AxiosError("maxContentLength size of " + maxContentLength + " exceeded", AxiosError.ERR_BAD_RESPONSE, config, request);
 			}
 			if (hasMaxBodyLength && method !== "get" && method !== "head") {
-				const outboundLength = await resolveBodyLength(headers, data);
-				if (typeof outboundLength === "number" && isFinite(outboundLength) && outboundLength > maxBodyLength) throw new AxiosError("Request body larger than maxBodyLength limit", AxiosError.ERR_BAD_REQUEST, config, request);
-			}
-			if (onUploadProgress && supportsRequestStream && method !== "get" && method !== "head" && (requestContentLength = await resolveBodyLength(headers, data)) !== 0) {
-				let _request = new Request(url, {
-					method: "POST",
-					body: data,
-					duplex: "half"
-				});
-				let contentTypeHeader;
-				if (utils_default.isFormData(data) && (contentTypeHeader = _request.headers.get("content-type"))) headers.setContentType(contentTypeHeader);
-				if (_request.body) {
-					const [onProgress, flush] = progressEventDecorator(requestContentLength, progressEventReducer(asyncDecorator(onUploadProgress)));
-					data = trackStream(_request.body, DEFAULT_CHUNK_SIZE, onProgress, flush);
+				const outboundLength = await getBodyLength(data);
+				if (typeof outboundLength === "number" && isFinite(outboundLength)) {
+					requestContentLength = outboundLength;
+					if (outboundLength > maxBodyLength) throw maxBodyLengthError();
 				}
 			}
+			const mustEnforceStreamBody = hasMaxBodyLength && (utils_default.isReadableStream(data) || utils_default.isStream(data));
+			const trackRequestStream = (stream, onProgress, flush) => trackStream(stream, DEFAULT_CHUNK_SIZE, (loadedBytes) => {
+				if (hasMaxBodyLength && loadedBytes > maxBodyLength) throw pendingBodyError = maxBodyLengthError();
+				onProgress && onProgress(loadedBytes);
+			}, flush);
+			if (supportsRequestStream && method !== "get" && method !== "head" && (onUploadProgress || mustEnforceStreamBody)) {
+				requestContentLength = requestContentLength == null ? await resolveBodyLength(headers, data) : requestContentLength;
+				if (requestContentLength !== 0 || mustEnforceStreamBody) {
+					let _request = new Request(url, {
+						method: "POST",
+						body: data,
+						duplex: "half"
+					});
+					let contentTypeHeader;
+					if (utils_default.isFormData(data) && (contentTypeHeader = _request.headers.get("content-type"))) headers.setContentType(contentTypeHeader);
+					if (_request.body) {
+						const [onProgress, flush] = onUploadProgress && progressEventDecorator(requestContentLength, progressEventReducer(asyncDecorator(onUploadProgress))) || [];
+						data = trackRequestStream(_request.body, onProgress, flush);
+					}
+				}
+			} else if (mustEnforceStreamBody && !isRequestSupported && isReadableStreamSupported && method !== "get" && method !== "head") data = trackRequestStream(data);
+			else if (mustEnforceStreamBody && isRequestSupported && !supportsRequestStream && method !== "get" && method !== "head") throw new AxiosError("Stream request bodies are not supported by the current fetch implementation", AxiosError.ERR_NOT_SUPPORT, config, request);
 			if (!utils_default.isString(withCredentials)) withCredentials = withCredentials ? "include" : "omit";
 			const isCredentialsSupported = isRequestSupported && "credentials" in Request.prototype;
 			if (utils_default.isFormData(data)) {
@@ -12375,8 +12719,9 @@ var factory = (env) => {
 			};
 			request = isRequestSupported && new Request(url, resolvedOptions);
 			let response = await (isRequestSupported ? _fetch(request, fetchOptions) : _fetch(url, resolvedOptions));
+			const responseHeaders = AxiosHeaders.from(response.headers);
 			if (hasMaxContentLength) {
-				const declaredLength = utils_default.toFiniteNumber(response.headers.get("content-length"));
+				const declaredLength = utils_default.toFiniteNumber(responseHeaders.getContentLength());
 				if (declaredLength != null && declaredLength > maxContentLength) throw new AxiosError("maxContentLength size of " + maxContentLength + " exceeded", AxiosError.ERR_BAD_RESPONSE, config, request);
 			}
 			const isStreamResponse = supportsResponseStream && (responseType === "stream" || responseType === "response");
@@ -12389,7 +12734,7 @@ var factory = (env) => {
 				].forEach((prop) => {
 					options[prop] = response[prop];
 				});
-				const responseContentLength = utils_default.toFiniteNumber(response.headers.get("content-length"));
+				const responseContentLength = utils_default.toFiniteNumber(responseHeaders.getContentLength());
 				const [onProgress, flush] = onDownloadProgress && progressEventDecorator(responseContentLength, progressEventReducer(asyncDecorator(onDownloadProgress), true)) || [];
 				let bytesRead = 0;
 				const onChunkProgress = (loadedBytes) => {
@@ -12432,10 +12777,34 @@ var factory = (env) => {
 				const canceledError = composedSignal.reason;
 				canceledError.config = config;
 				request && (canceledError.request = request);
-				err !== canceledError && (canceledError.cause = err);
+				if (err !== canceledError) Object.defineProperty(canceledError, "cause", {
+					__proto__: null,
+					value: err,
+					writable: true,
+					enumerable: false,
+					configurable: true
+				});
 				throw canceledError;
 			}
-			if (err && err.name === "TypeError" && /Load failed|fetch/i.test(err.message)) throw Object.assign(new AxiosError("Network Error", AxiosError.ERR_NETWORK, config, request, err && err.response), { cause: err.cause || err });
+			if (pendingBodyError) {
+				request && !pendingBodyError.request && (pendingBodyError.request = request);
+				throw pendingBodyError;
+			}
+			if (err instanceof AxiosError) {
+				request && !err.request && (err.request = request);
+				throw err;
+			}
+			if (err && err.name === "TypeError" && /Load failed|fetch/i.test(err.message)) {
+				const networkError = new AxiosError("Network Error", AxiosError.ERR_NETWORK, config, request, err && err.response);
+				Object.defineProperty(networkError, "cause", {
+					__proto__: null,
+					value: err.cause || err,
+					writable: true,
+					enumerable: false,
+					configurable: true
+				});
+				throw networkError;
+			}
 			throw AxiosError.from(err, err && err.code, config, request, err && err.response);
 		}
 	};
@@ -12532,7 +12901,7 @@ function getAdapter(adapters, config) {
 	}
 	if (!adapter) {
 		const reasons = Object.entries(rejectedReasons).map(([id, state]) => `adapter ${id} ` + (state === false ? "is not supported by the environment" : "is not available in the build"));
-		throw new AxiosError(`There is no suitable adapter to dispatch the request ` + (length ? reasons.length > 1 ? "since :\n" + reasons.map(renderReason).join("\n") : " " + renderReason(reasons[0]) : "as no adapter specified"), "ERR_NOT_SUPPORT");
+		throw new AxiosError(`There is no suitable adapter to dispatch the request ` + (length ? reasons.length > 1 ? "since :\n" + reasons.map(renderReason).join("\n") : " " + renderReason(reasons[0]) : "as no adapter specified"), AxiosError.ERR_NOT_SUPPORT);
 	}
 	return adapter;
 }
@@ -12660,7 +13029,7 @@ validators$1.spelling = function spelling(correctSpelling) {
 * @returns {object}
 */
 function assertOptions(options, schema, allowUnknown) {
-	if (typeof options !== "object") throw new AxiosError("options must be an object", AxiosError.ERR_BAD_OPTION_VALUE);
+	if (typeof options !== "object" || options === null) throw new AxiosError("options must be an object", AxiosError.ERR_BAD_OPTION_VALUE);
 	const keys = Object.keys(options);
 	let i = keys.length;
 	while (i-- > 0) {
@@ -12742,7 +13111,8 @@ var Axios = class {
 			forcedJSONParsing: validators.transitional(validators.boolean),
 			clarifyTimeoutError: validators.transitional(validators.boolean),
 			legacyInterceptorReqResOrdering: validators.transitional(validators.boolean),
-			advertiseZstdAcceptEncoding: validators.transitional(validators.boolean)
+			advertiseZstdAcceptEncoding: validators.transitional(validators.boolean),
+			validateStatusUndefinedResolves: validators.transitional(validators.boolean)
 		}, false);
 		if (paramsSerializer != null) if (utils_default.isFunction(paramsSerializer)) config.paramsSerializer = { serialize: paramsSerializer };
 		else validator_default.assertOptions(paramsSerializer, {
@@ -12819,7 +13189,7 @@ var Axios = class {
 	}
 	getUri(config) {
 		config = mergeConfig(this.defaults, config);
-		return buildURL(buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls), config.params, config.paramsSerializer);
+		return buildURL(buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls, config), config.params, config.paramsSerializer);
 	}
 };
 utils_default.forEach([
@@ -12832,7 +13202,7 @@ utils_default.forEach([
 		return this.request(mergeConfig(config || {}, {
 			method,
 			url,
-			data: (config || {}).data
+			data: config && utils_default.hasOwnProp(config, "data") ? config.data : void 0
 		}));
 	};
 });
@@ -13724,20 +14094,20 @@ var TIMESTAMP32_MAX_SEC = 4294967295;
 var TIMESTAMP64_MAX_SEC = 17179869183;
 function encodeTimeSpecToTimestamp({ sec, nsec }) {
 	if (sec >= 0 && nsec >= 0 && sec <= TIMESTAMP64_MAX_SEC) if (nsec === 0 && sec <= TIMESTAMP32_MAX_SEC) {
-		const rv = new Uint8Array(4);
+		const rv = /* @__PURE__ */ new Uint8Array(4);
 		new DataView(rv.buffer).setUint32(0, sec);
 		return rv;
 	} else {
 		const secHigh = sec / 4294967296;
 		const secLow = sec & 4294967295;
-		const rv = new Uint8Array(8);
+		const rv = /* @__PURE__ */ new Uint8Array(8);
 		const view = new DataView(rv.buffer);
 		view.setUint32(0, nsec << 2 | secHigh & 3);
 		view.setUint32(4, secLow);
 		return rv;
 	}
 	else {
-		const rv = new Uint8Array(12);
+		const rv = /* @__PURE__ */ new Uint8Array(12);
 		const view = new DataView(rv.buffer);
 		view.setUint32(0, nsec);
 		setInt64(view, 4, sec);