@nsshunt/stsuxvue 1.0.126 → 1.0.131

package/dist/stsuxvue.cjs

@@ -6,7 +6,14 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __esmMin = (fn, res, err) => () => {
+	if (err) throw err[0];
+	try {
+		return fn && (res = fn(fn = 0)), res;
+	} catch (e) {
+		throw err = [e], e;
+	}
+};
 var __commonJSMin$1 = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __exportAll = (all, no_symbols) => {
 	let target = {};
@@ -27,7 +34,7 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
@@ -407,7 +414,7 @@ var UXRadialChart_default = /* @__PURE__ */ (0, vue.defineComponent)({
 	}
 });
 //#endregion
-//#region node_modules/ansi-to-html/node_modules/entities/lib/maps/entities.json
+//#region node_modules/entities/lib/maps/entities.json
 var entities_exports = /* @__PURE__ */ __exportAll({
 	AElig: () => "Æ",
 	AMP: () => "&",
@@ -4890,7 +4897,7 @@ var init_entities = __esmMin((() => {
 	};
 }));
 //#endregion
-//#region node_modules/ansi-to-html/node_modules/entities/lib/maps/legacy.json
+//#region node_modules/entities/lib/maps/legacy.json
 var legacy_exports = /* @__PURE__ */ __exportAll({
 	AElig: () => "Æ",
 	AMP: () => "&",
@@ -5111,7 +5118,7 @@ var init_legacy = __esmMin((() => {
 	};
 }));
 //#endregion
-//#region node_modules/ansi-to-html/node_modules/entities/lib/maps/xml.json
+//#region node_modules/entities/lib/maps/xml.json
 var xml_exports = /* @__PURE__ */ __exportAll({
 	amp: () => "&",
 	apos: () => "'",
@@ -5130,7 +5137,7 @@ var init_xml = __esmMin((() => {
 	};
 }));
 //#endregion
-//#region node_modules/ansi-to-html/node_modules/entities/lib/maps/decode.json
+//#region node_modules/entities/lib/maps/decode.json
 var decode_exports = /* @__PURE__ */ __exportAll({ default: () => decode_default });
 var decode_default;
 var init_decode = __esmMin((() => {
@@ -5166,7 +5173,7 @@ var init_decode = __esmMin((() => {
 	};
 }));
 //#endregion
-//#region node_modules/ansi-to-html/node_modules/entities/lib/decode_codepoint.js
+//#region node_modules/entities/lib/decode_codepoint.js
 var require_decode_codepoint = /* @__PURE__ */ __commonJSMin$1(((exports) => {
 	var __importDefault = exports && exports.__importDefault || function(mod) {
 		return mod && mod.__esModule ? mod : { "default": mod };
@@ -5191,7 +5198,7 @@ var require_decode_codepoint = /* @__PURE__ */ __commonJSMin$1(((exports) => {
 	exports.default = decodeCodePoint;
 }));
 //#endregion
-//#region node_modules/ansi-to-html/node_modules/entities/lib/decode.js
+//#region node_modules/entities/lib/decode.js
 var require_decode = /* @__PURE__ */ __commonJSMin$1(((exports) => {
 	var __importDefault = exports && exports.__importDefault || function(mod) {
 		return mod && mod.__esModule ? mod : { "default": mod };
@@ -5243,7 +5250,7 @@ var require_decode = /* @__PURE__ */ __commonJSMin$1(((exports) => {
 	}
 }));
 //#endregion
-//#region node_modules/ansi-to-html/node_modules/entities/lib/encode.js
+//#region node_modules/entities/lib/encode.js
 var require_encode = /* @__PURE__ */ __commonJSMin$1(((exports) => {
 	var __importDefault = exports && exports.__importDefault || function(mod) {
 		return mod && mod.__esModule ? mod : { "default": mod };
@@ -5356,7 +5363,7 @@ var require_encode = /* @__PURE__ */ __commonJSMin$1(((exports) => {
 	}
 }));
 //#endregion
-//#region node_modules/ansi-to-html/node_modules/entities/lib/index.js
+//#region node_modules/entities/lib/index.js
 var require_lib = /* @__PURE__ */ __commonJSMin$1(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.decodeXMLStrict = exports.decodeHTML5Strict = exports.decodeHTML4Strict = exports.decodeHTML5 = exports.decodeHTML4 = exports.decodeHTMLStrict = exports.decodeHTML = exports.decodeXML = exports.encodeHTML5 = exports.encodeHTML4 = exports.escapeUTF8 = exports.escape = exports.encodeNonAsciiHTML = exports.encodeHTML = exports.encodeXML = exports.encode = exports.decodeStrict = exports.decode = void 0;
@@ -6036,7 +6043,7 @@ var import_ansi_to_html = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin
 		return Filter;
 	}();
 })))(), 1);
-/*! @license DOMPurify 3.4.9 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.9/LICENSE */
+/*! @license DOMPurify 3.4.14 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.14/LICENSE */
 function _arrayLikeToArray(r, a) {
 	(null == a || a > r.length) && (a = r.length);
 	for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e];
@@ -6077,9 +6084,17 @@ function _unsupportedIterableToArray(r, a) {
 		return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0;
 	}
 }
-var entries = Object.entries, setPrototypeOf = Object.setPrototypeOf, isFrozen = Object.isFrozen, getPrototypeOf$1 = Object.getPrototypeOf, getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
-var freeze = Object.freeze, seal = Object.seal, create = Object.create;
-var _ref = typeof Reflect !== "undefined" && Reflect, apply = _ref.apply, construct = _ref.construct;
+var entries = Object.entries;
+var setPrototypeOf = Object.setPrototypeOf;
+var isFrozen = Object.isFrozen;
+var getPrototypeOf$1 = Object.getPrototypeOf;
+var getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
+var freeze = Object.freeze;
+var seal = Object.seal;
+var create = Object.create;
+var _ref = typeof Reflect !== "undefined" && Reflect;
+var apply = _ref.apply;
+var construct = _ref.construct;
 if (!freeze) freeze = function freeze(x) {
 	return x;
 };
@@ -6187,9 +6202,11 @@ function clone(object) {
 		var _ref3 = _slicedToArray(_ref2, 2);
 		const property = _ref3[0];
 		const value = _ref3[1];
-		if (objectHasOwnProperty(object, property)) if (arrayIsArray(value)) newObject[property] = cleanArray(value);
-		else if (value && typeof value === "object" && value.constructor === Object) newObject[property] = clone(value);
-		else newObject[property] = value;
+		if (objectHasOwnProperty(object, property)) {
+			if (arrayIsArray(value)) newObject[property] = cleanArray(value);
+			else if (value && typeof value === "object" && value.constructor === Object) newObject[property] = clone(value);
+			else newObject[property] = value;
+		}
 	}
 	return newObject;
 }
@@ -6675,6 +6692,7 @@ var svg = freeze([
 	"direction",
 	"display",
 	"divisor",
+	"dominant-baseline",
 	"dur",
 	"edgemode",
 	"elevation",
@@ -6756,6 +6774,7 @@ var svg = freeze([
 	"patterncontentunits",
 	"patterntransform",
 	"patternunits",
+	"pointer-events",
 	"points",
 	"preservealpha",
 	"preserveaspectratio",
@@ -6802,6 +6821,7 @@ var svg = freeze([
 	"transform-origin",
 	"text-anchor",
 	"text-decoration",
+	"text-orientation",
 	"text-rendering",
 	"textlength",
 	"type",
@@ -6809,6 +6829,7 @@ var svg = freeze([
 	"u2",
 	"unicode",
 	"values",
+	"vector-effect",
 	"viewbox",
 	"visibility",
 	"version",
@@ -6904,6 +6925,10 @@ var IS_SCRIPT_OR_DATA = seal(/^(?:\w+script|data):/i);
 var ATTR_WHITESPACE = seal(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g);
 var DOCTYPE_NAME = seal(/^html$/i);
 var CUSTOM_ELEMENT = seal(/^[a-z][.\w]*(-[.\w]+)+$/i);
+var ELEMENT_MARKUP_PROBE = seal(/<[/\w!]/g);
+var COMMENT_MARKUP_PROBE = seal(/<[/\w]/g);
+var FALLBACK_TAG_CLOSE = seal(/<\/no(script|embed|frames)/i);
+var SELF_CLOSING_TAG = seal(/\/>/i);
 var NODE_TYPE = {
 	element: 1,
 	attribute: 2,
@@ -6911,13 +6936,31 @@ var NODE_TYPE = {
 	cdataSection: 4,
 	entityReference: 5,
 	entityNode: 6,
-	progressingInstruction: 7,
+	processingInstruction: 7,
 	comment: 8,
 	document: 9,
 	documentType: 10,
 	documentFragment: 11,
 	notation: 12
 };
+var LITERAL_TEXT_ELEMENT_NAMES = [
+	"style",
+	"script",
+	"xmp",
+	"iframe",
+	"noembed",
+	"noframes",
+	"plaintext",
+	"noscript"
+];
+var LITERAL_TEXT_ELEMENTS = freeze(addToSet({}, LITERAL_TEXT_ELEMENT_NAMES));
+var LITERAL_TEXT_CLOSE = function() {
+	const map = {};
+	arrayForEach(LITERAL_TEXT_ELEMENT_NAMES, (name) => {
+		map[name] = seal(new RegExp("</" + name + "(?=[\\t\\n\\f\\r />])", "i"));
+	});
+	return freeze(map);
+}();
 var getGlobal$1 = function getGlobal() {
 	return typeof window === "undefined" ? null : window;
 };
@@ -6962,10 +7005,40 @@ var _createHooksMap = function _createHooksMap() {
 		uponSanitizeShadowNode: []
 	};
 };
+/**
+* Resolve a set-valued configuration option: a fresh set built from
+* cfg[key] when it is an own array property (seeded with a clone of
+* options.base when given, case-normalized via options.transform),
+* the fallback set otherwise.
+*
+* @param cfg the cloned, prototype-free configuration object
+* @param key the configuration property to read
+* @param fallback the set to use when the option is absent or not an array
+* @param options transform and optional base set to merge into
+* @returns the resolved set
+*/
+var _resolveSetOption = function _resolveSetOption(cfg, key, fallback, options) {
+	return objectHasOwnProperty(cfg, key) && arrayIsArray(cfg[key]) ? addToSet(options.base ? clone(options.base) : {}, cfg[key], options.transform) : fallback;
+};
+/**
+* Resolve an object-valued configuration option: a prototype-free clone
+* of cfg[key] when it is an own, truthy object property, else a fresh
+* fallback built by makeFallback (fresh on every parse, so a previous
+* parse can never leak state into the next one).
+*
+* @param cfg the cloned, prototype-free configuration object
+* @param key the configuration property to read
+* @param makeFallback builds the fallback value when the option is absent
+* @returns the resolved object
+*/
+var _resolveObjectOption = function _resolveObjectOption(cfg, key, makeFallback) {
+	const value = objectHasOwnProperty(cfg, key) ? cfg[key] : void 0;
+	return value && typeof value === "object" ? clone(value) : makeFallback();
+};
 function createDOMPurify() {
 	let window = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal$1();
 	const DOMPurify = (root) => createDOMPurify(root);
-	DOMPurify.version = "3.4.9";
+	DOMPurify.version = "3.4.14";
 	DOMPurify.removed = [];
 	if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
 		DOMPurify.isSupported = false;
@@ -6989,6 +7062,13 @@ function createDOMPurify() {
 	const getAttributes = lookupGetter(ElementPrototype, "attributes");
 	const getNodeType = Node && Node.prototype ? lookupGetter(Node.prototype, "nodeType") : null;
 	const getNodeName = Node && Node.prototype ? lookupGetter(Node.prototype, "nodeName") : null;
+	const getOwnerDocument = Node && Node.prototype ? lookupGetter(Node.prototype, "ownerDocument") : null;
+	const _readNodeType = function _readNodeType(node) {
+		return getNodeType ? getNodeType(node) : node.nodeType;
+	};
+	const _readNodeName = function _readNodeName(node) {
+		return getNodeName ? getNodeName(node) : node.nodeName;
+	};
 	if (typeof HTMLTemplateElement === "function") {
 		const template = document.createElement("template");
 		if (template.content && template.content.ownerDocument) document = template.content.ownerDocument;
@@ -7098,6 +7178,8 @@ function createDOMPurify() {
 	let SAFE_FOR_XML = true;
 	let WHOLE_DOCUMENT = false;
 	let SET_CONFIG = false;
+	let SET_CONFIG_ALLOWED_TAGS = null;
+	let SET_CONFIG_ALLOWED_ATTR = null;
 	let FORCE_BODY = false;
 	let RETURN_DOM = false;
 	let RETURN_DOM_FRAGMENT = false;
@@ -7174,14 +7256,16 @@ function createDOMPurify() {
 		SVG_NAMESPACE,
 		HTML_NAMESPACE
 	], stringToString);
-	let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, [
+	const DEFAULT_MATHML_TEXT_INTEGRATION_POINTS = freeze([
 		"mi",
 		"mo",
 		"mn",
 		"ms",
 		"mtext"
 	]);
-	let HTML_INTEGRATION_POINTS = addToSet({}, ["annotation-xml"]);
+	let MATHML_TEXT_INTEGRATION_POINTS = addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS);
+	const DEFAULT_HTML_INTEGRATION_POINTS = freeze(["annotation-xml"]);
+	let HTML_INTEGRATION_POINTS = addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS);
 	const COMMON_SVG_AND_HTML_ELEMENTS = addToSet({}, [
 		"title",
 		"style",
@@ -7210,14 +7294,20 @@ function createDOMPurify() {
 		cfg = clone(cfg);
 		PARSER_MEDIA_TYPE = SUPPORTED_PARSER_MEDIA_TYPES.indexOf(cfg.PARSER_MEDIA_TYPE) === -1 ? DEFAULT_PARSER_MEDIA_TYPE : cfg.PARSER_MEDIA_TYPE;
 		transformCaseFunc = PARSER_MEDIA_TYPE === "application/xhtml+xml" ? stringToString : stringToLowerCase;
-		ALLOWED_TAGS = objectHasOwnProperty(cfg, "ALLOWED_TAGS") && arrayIsArray(cfg.ALLOWED_TAGS) ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc) : DEFAULT_ALLOWED_TAGS;
-		ALLOWED_ATTR = objectHasOwnProperty(cfg, "ALLOWED_ATTR") && arrayIsArray(cfg.ALLOWED_ATTR) ? addToSet({}, cfg.ALLOWED_ATTR, transformCaseFunc) : DEFAULT_ALLOWED_ATTR;
-		ALLOWED_NAMESPACES = objectHasOwnProperty(cfg, "ALLOWED_NAMESPACES") && arrayIsArray(cfg.ALLOWED_NAMESPACES) ? addToSet({}, cfg.ALLOWED_NAMESPACES, stringToString) : DEFAULT_ALLOWED_NAMESPACES;
-		URI_SAFE_ATTRIBUTES = objectHasOwnProperty(cfg, "ADD_URI_SAFE_ATTR") && arrayIsArray(cfg.ADD_URI_SAFE_ATTR) ? addToSet(clone(DEFAULT_URI_SAFE_ATTRIBUTES), cfg.ADD_URI_SAFE_ATTR, transformCaseFunc) : DEFAULT_URI_SAFE_ATTRIBUTES;
-		DATA_URI_TAGS = objectHasOwnProperty(cfg, "ADD_DATA_URI_TAGS") && arrayIsArray(cfg.ADD_DATA_URI_TAGS) ? addToSet(clone(DEFAULT_DATA_URI_TAGS), cfg.ADD_DATA_URI_TAGS, transformCaseFunc) : DEFAULT_DATA_URI_TAGS;
-		FORBID_CONTENTS = objectHasOwnProperty(cfg, "FORBID_CONTENTS") && arrayIsArray(cfg.FORBID_CONTENTS) ? addToSet({}, cfg.FORBID_CONTENTS, transformCaseFunc) : DEFAULT_FORBID_CONTENTS;
-		FORBID_TAGS = objectHasOwnProperty(cfg, "FORBID_TAGS") && arrayIsArray(cfg.FORBID_TAGS) ? addToSet({}, cfg.FORBID_TAGS, transformCaseFunc) : clone({});
-		FORBID_ATTR = objectHasOwnProperty(cfg, "FORBID_ATTR") && arrayIsArray(cfg.FORBID_ATTR) ? addToSet({}, cfg.FORBID_ATTR, transformCaseFunc) : clone({});
+		ALLOWED_TAGS = _resolveSetOption(cfg, "ALLOWED_TAGS", DEFAULT_ALLOWED_TAGS, { transform: transformCaseFunc });
+		ALLOWED_ATTR = _resolveSetOption(cfg, "ALLOWED_ATTR", DEFAULT_ALLOWED_ATTR, { transform: transformCaseFunc });
+		ALLOWED_NAMESPACES = _resolveSetOption(cfg, "ALLOWED_NAMESPACES", DEFAULT_ALLOWED_NAMESPACES, { transform: stringToString });
+		URI_SAFE_ATTRIBUTES = _resolveSetOption(cfg, "ADD_URI_SAFE_ATTR", DEFAULT_URI_SAFE_ATTRIBUTES, {
+			transform: transformCaseFunc,
+			base: DEFAULT_URI_SAFE_ATTRIBUTES
+		});
+		DATA_URI_TAGS = _resolveSetOption(cfg, "ADD_DATA_URI_TAGS", DEFAULT_DATA_URI_TAGS, {
+			transform: transformCaseFunc,
+			base: DEFAULT_DATA_URI_TAGS
+		});
+		FORBID_CONTENTS = _resolveSetOption(cfg, "FORBID_CONTENTS", DEFAULT_FORBID_CONTENTS, { transform: transformCaseFunc });
+		FORBID_TAGS = _resolveSetOption(cfg, "FORBID_TAGS", clone({}), { transform: transformCaseFunc });
+		FORBID_ATTR = _resolveSetOption(cfg, "FORBID_ATTR", clone({}), { transform: transformCaseFunc });
 		USE_PROFILES = objectHasOwnProperty(cfg, "USE_PROFILES") ? cfg.USE_PROFILES && typeof cfg.USE_PROFILES === "object" ? clone(cfg.USE_PROFILES) : cfg.USE_PROFILES : false;
 		ALLOW_ARIA_ATTR = cfg.ALLOW_ARIA_ATTR !== false;
 		ALLOW_DATA_ATTR = cfg.ALLOW_DATA_ATTR !== false;
@@ -7236,19 +7326,14 @@ function createDOMPurify() {
 		IN_PLACE = cfg.IN_PLACE || false;
 		IS_ALLOWED_URI$1 = isRegex(cfg.ALLOWED_URI_REGEXP) ? cfg.ALLOWED_URI_REGEXP : IS_ALLOWED_URI;
 		NAMESPACE = typeof cfg.NAMESPACE === "string" ? cfg.NAMESPACE : HTML_NAMESPACE;
-		MATHML_TEXT_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "MATHML_TEXT_INTEGRATION_POINTS") && cfg.MATHML_TEXT_INTEGRATION_POINTS && typeof cfg.MATHML_TEXT_INTEGRATION_POINTS === "object" ? clone(cfg.MATHML_TEXT_INTEGRATION_POINTS) : addToSet({}, [
-			"mi",
-			"mo",
-			"mn",
-			"ms",
-			"mtext"
-		]);
-		HTML_INTEGRATION_POINTS = objectHasOwnProperty(cfg, "HTML_INTEGRATION_POINTS") && cfg.HTML_INTEGRATION_POINTS && typeof cfg.HTML_INTEGRATION_POINTS === "object" ? clone(cfg.HTML_INTEGRATION_POINTS) : addToSet({}, ["annotation-xml"]);
-		const customElementHandling = objectHasOwnProperty(cfg, "CUSTOM_ELEMENT_HANDLING") && cfg.CUSTOM_ELEMENT_HANDLING && typeof cfg.CUSTOM_ELEMENT_HANDLING === "object" ? clone(cfg.CUSTOM_ELEMENT_HANDLING) : create(null);
+		MATHML_TEXT_INTEGRATION_POINTS = _resolveObjectOption(cfg, "MATHML_TEXT_INTEGRATION_POINTS", () => addToSet({}, DEFAULT_MATHML_TEXT_INTEGRATION_POINTS));
+		HTML_INTEGRATION_POINTS = _resolveObjectOption(cfg, "HTML_INTEGRATION_POINTS", () => addToSet({}, DEFAULT_HTML_INTEGRATION_POINTS));
+		const customElementHandling = _resolveObjectOption(cfg, "CUSTOM_ELEMENT_HANDLING", () => create(null));
 		CUSTOM_ELEMENT_HANDLING = create(null);
 		if (objectHasOwnProperty(customElementHandling, "tagNameCheck") && isRegexOrFunction(customElementHandling.tagNameCheck)) CUSTOM_ELEMENT_HANDLING.tagNameCheck = customElementHandling.tagNameCheck;
 		if (objectHasOwnProperty(customElementHandling, "attributeNameCheck") && isRegexOrFunction(customElementHandling.attributeNameCheck)) CUSTOM_ELEMENT_HANDLING.attributeNameCheck = customElementHandling.attributeNameCheck;
 		if (objectHasOwnProperty(customElementHandling, "allowCustomizedBuiltInElements") && typeof customElementHandling.allowCustomizedBuiltInElements === "boolean") CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements = customElementHandling.allowCustomizedBuiltInElements;
+		seal(CUSTOM_ELEMENT_HANDLING);
 		if (SAFE_FOR_TEMPLATES) ALLOW_DATA_ATTR = false;
 		if (RETURN_DOM_FRAGMENT) RETURN_DOM = true;
 		if (USE_PROFILES) {
@@ -7290,11 +7375,6 @@ function createDOMPurify() {
 				addToSet(ALLOWED_ATTR, cfg.ADD_ATTR, transformCaseFunc);
 			}
 		}
-		if (objectHasOwnProperty(cfg, "ADD_URI_SAFE_ATTR") && arrayIsArray(cfg.ADD_URI_SAFE_ATTR)) addToSet(URI_SAFE_ATTRIBUTES, cfg.ADD_URI_SAFE_ATTR, transformCaseFunc);
-		if (objectHasOwnProperty(cfg, "FORBID_CONTENTS") && arrayIsArray(cfg.FORBID_CONTENTS)) {
-			if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) FORBID_CONTENTS = clone(FORBID_CONTENTS);
-			addToSet(FORBID_CONTENTS, cfg.FORBID_CONTENTS, transformCaseFunc);
-		}
 		if (objectHasOwnProperty(cfg, "ADD_FORBID_CONTENTS") && arrayIsArray(cfg.ADD_FORBID_CONTENTS)) {
 			if (FORBID_CONTENTS === DEFAULT_FORBID_CONTENTS) FORBID_CONTENTS = clone(FORBID_CONTENTS);
 			addToSet(FORBID_CONTENTS, cfg.ADD_FORBID_CONTENTS, transformCaseFunc);
@@ -7327,8 +7407,6 @@ function createDOMPurify() {
 			if (trustedTypesPolicy === void 0) trustedTypesPolicy = _getDefaultTrustedTypesPolicy();
 			if (trustedTypesPolicy && typeof emptyHTML === "string") emptyHTML = _createTrustedHTML("");
 		}
-		if ((hooks.uponSanitizeElement.length > 0 || hooks.uponSanitizeAttribute.length > 0) && ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) ALLOWED_TAGS = clone(ALLOWED_TAGS);
-		if (hooks.uponSanitizeAttribute.length > 0 && ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR) ALLOWED_ATTR = clone(ALLOWED_ATTR);
 		if (freeze) freeze(cfg);
 		CONFIG = cfg;
 	};
@@ -7339,6 +7417,45 @@ function createDOMPurify() {
 	]);
 	const ALL_MATHML_TAGS = addToSet({}, [...mathMl$1, ...mathMlDisallowed]);
 	/**
+	* Namespace rules for an element in the SVG namespace.
+	*
+	* @param tagName the element's lowercase tag name
+	* @param parent the (possibly simulated) parent node
+	* @param parentTagName the parent's lowercase tag name
+	* @returns true if a spec-compliant parser could produce this element
+	*/
+	const _checkSvgNamespace = function _checkSvgNamespace(tagName, parent, parentTagName) {
+		if (parent.namespaceURI === HTML_NAMESPACE) return tagName === "svg";
+		if (parent.namespaceURI === MATHML_NAMESPACE) return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
+		return Boolean(ALL_SVG_TAGS[tagName]);
+	};
+	/**
+	* Namespace rules for an element in the MathML namespace.
+	*
+	* @param tagName the element's lowercase tag name
+	* @param parent the (possibly simulated) parent node
+	* @param parentTagName the parent's lowercase tag name
+	* @returns true if a spec-compliant parser could produce this element
+	*/
+	const _checkMathMlNamespace = function _checkMathMlNamespace(tagName, parent, parentTagName) {
+		if (parent.namespaceURI === HTML_NAMESPACE) return tagName === "math";
+		if (parent.namespaceURI === SVG_NAMESPACE) return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName];
+		return Boolean(ALL_MATHML_TAGS[tagName]);
+	};
+	/**
+	* Namespace rules for an element in the HTML namespace.
+	*
+	* @param tagName the element's lowercase tag name
+	* @param parent the (possibly simulated) parent node
+	* @param parentTagName the parent's lowercase tag name
+	* @returns true if a spec-compliant parser could produce this element
+	*/
+	const _checkHtmlNamespace = function _checkHtmlNamespace(tagName, parent, parentTagName) {
+		if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) return false;
+		if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) return false;
+		return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
+	};
+	/**
 	* @param element a DOM element whose namespace is being checked
 	* @returns Return false if the element has a
 	*  namespace that a spec-compliant parser would never
@@ -7353,21 +7470,9 @@ function createDOMPurify() {
 		const tagName = stringToLowerCase(element.tagName);
 		const parentTagName = stringToLowerCase(parent.tagName);
 		if (!ALLOWED_NAMESPACES[element.namespaceURI]) return false;
-		if (element.namespaceURI === SVG_NAMESPACE) {
-			if (parent.namespaceURI === HTML_NAMESPACE) return tagName === "svg";
-			if (parent.namespaceURI === MATHML_NAMESPACE) return tagName === "svg" && (parentTagName === "annotation-xml" || MATHML_TEXT_INTEGRATION_POINTS[parentTagName]);
-			return Boolean(ALL_SVG_TAGS[tagName]);
-		}
-		if (element.namespaceURI === MATHML_NAMESPACE) {
-			if (parent.namespaceURI === HTML_NAMESPACE) return tagName === "math";
-			if (parent.namespaceURI === SVG_NAMESPACE) return tagName === "math" && HTML_INTEGRATION_POINTS[parentTagName];
-			return Boolean(ALL_MATHML_TAGS[tagName]);
-		}
-		if (element.namespaceURI === HTML_NAMESPACE) {
-			if (parent.namespaceURI === SVG_NAMESPACE && !HTML_INTEGRATION_POINTS[parentTagName]) return false;
-			if (parent.namespaceURI === MATHML_NAMESPACE && !MATHML_TEXT_INTEGRATION_POINTS[parentTagName]) return false;
-			return !ALL_MATHML_TAGS[tagName] && (COMMON_SVG_AND_HTML_ELEMENTS[tagName] || !ALL_SVG_TAGS[tagName]);
-		}
+		if (element.namespaceURI === SVG_NAMESPACE) return _checkSvgNamespace(tagName, parent, parentTagName);
+		if (element.namespaceURI === MATHML_NAMESPACE) return _checkMathMlNamespace(tagName, parent, parentTagName);
+		if (element.namespaceURI === HTML_NAMESPACE) return _checkHtmlNamespace(tagName, parent, parentTagName);
 		if (PARSER_MEDIA_TYPE === "application/xhtml+xml" && ALLOWED_NAMESPACES[element.namespaceURI]) return true;
 		return false;
 	};
@@ -7386,6 +7491,32 @@ function createDOMPurify() {
 		}
 	};
 	/**
+	* _stripAttributeNode
+	*
+	* Remove a single Attr node case/namespace-exactly on an attribute-teardown
+	* path. Name-based removeAttribute() ASCII-lowercases its lookup key for an
+	* HTML element in an HTML document and so silently misses a case-preserved
+	* handler (e.g. `ONERROR` off an XML/XHTML import) - the same defect
+	* _removeAttribute() was fixed for, which a name-based call would reintroduce
+	* on these IN_PLACE teardown paths. Unlike _removeAttribute this does not
+	* record into DOMPurify.removed: the neutralize passes intentionally do not
+	* book-keep. A clobbered/detached node falls back to best-effort name-based
+	* removal.
+	*
+	* @param element the element to strip the attribute from
+	* @param attribute the Attr node to remove
+	* @param name the attribute's name, for the fallback path
+	*/
+	const _stripAttributeNode = function _stripAttributeNode(element, attribute, name) {
+		try {
+			element.removeAttributeNode(attribute);
+		} catch (_) {
+			try {
+				element.removeAttribute(name);
+			} catch (_) {}
+		}
+	};
+	/**
 	* _neutralizeRoot
 	*
 	* Fail-closed teardown of an in-place root after the sanitize walk aborts
@@ -7402,7 +7533,8 @@ function createDOMPurify() {
 	* @param root the in-place root to empty
 	*/
 	const _neutralizeRoot = function _neutralizeRoot(root) {
-		const childNodes = getChildNodes ? getChildNodes(root) : root.childNodes;
+		_neutralizeSubtree(root);
+		const childNodes = getChildNodes(root);
 		if (childNodes) {
 			const snapshot = [];
 			arrayForEach(childNodes, (child) => {
@@ -7414,40 +7546,57 @@ function createDOMPurify() {
 				} catch (_) {}
 			});
 		}
-		const attributes = getAttributes ? getAttributes(root) : null;
+		const attributes = getAttributes(root);
 		if (attributes) for (let i = attributes.length - 1; i >= 0; --i) {
 			const attribute = attributes[i];
 			const name = attribute && attribute.name;
-			if (typeof name === "string") try {
-				root.removeAttribute(name);
-			} catch (_) {}
+			if (typeof name === "string") _stripAttributeNode(root, attribute, name);
 		}
 	};
 	/**
 	* _removeAttribute
 	*
+	* Name-based getAttributeNode()/removeAttribute() ASCII-lowercase their
+	* lookup key for HTML elements in an HTML document, so they silently miss an
+	* attribute whose stored qualified name still contains uppercase ASCII
+	* letters. That happens when the node came from a case-preserving source
+	* (an XML/XHTML document imported via importNode(), or createAttributeNS()),
+	* where e.g. `ONERROR` survives the walk: the policy check lowercases to
+	* `onerror` and rejects it, but `removeAttribute('ONERROR')` looks up
+	* `onerror` and finds nothing. Remove the exact Attr node instead, which is
+	* case- and namespace-exact, and fall back to name-based removal only when
+	* the caller could not supply the node.
+	*
 	* @param name an Attribute name
 	* @param element a DOM node
+	* @param attr the exact Attr node to remove, when the caller has it
 	*/
-	const _removeAttribute = function _removeAttribute(name, element) {
+	const _removeAttribute = function _removeAttribute(name, element, attr) {
+		if (!attr) try {
+			attr = element.getAttributeNode(name);
+		} catch (_) {
+			attr = null;
+		}
+		arrayPush(DOMPurify.removed, {
+			attribute: attr || null,
+			from: element
+		});
 		try {
-			arrayPush(DOMPurify.removed, {
-				attribute: element.getAttributeNode(name),
-				from: element
-			});
+			if (attr) element.removeAttributeNode(attr);
+			else element.removeAttribute(name);
 		} catch (_) {
-			arrayPush(DOMPurify.removed, {
-				attribute: null,
-				from: element
-			});
+			try {
+				element.removeAttribute(name);
+			} catch (_) {}
+		}
+		if (name === "is") {
+			if (RETURN_DOM || RETURN_DOM_FRAGMENT) try {
+				_forceRemove(element);
+			} catch (_) {}
+			else try {
+				element.setAttribute(name, "");
+			} catch (_) {}
 		}
-		element.removeAttribute(name);
-		if (name === "is") if (RETURN_DOM || RETURN_DOM_FRAGMENT) try {
-			_forceRemove(element);
-		} catch (_) {}
-		else try {
-			element.setAttribute(name, "");
-		} catch (_) {}
 	};
 	/**
 	* _stripDisallowedAttributes
@@ -7460,15 +7609,13 @@ function createDOMPurify() {
 	* @param element the element to strip
 	*/
 	const _stripDisallowedAttributes = function _stripDisallowedAttributes(element) {
-		const attributes = getAttributes ? getAttributes(element) : element.attributes;
+		const attributes = getAttributes(element);
 		if (!attributes) return;
 		for (let i = attributes.length - 1; i >= 0; --i) {
 			const attribute = attributes[i];
 			const name = attribute && attribute.name;
 			if (typeof name !== "string" || ALLOWED_ATTR[transformCaseFunc(name)]) continue;
-			try {
-				element.removeAttribute(name);
-			} catch (_) {}
+			_stripAttributeNode(element, attribute, name);
 		}
 	};
 	/**
@@ -7497,8 +7644,83 @@ function createDOMPurify() {
 		const stack = [root];
 		while (stack.length > 0) {
 			const node = stack.pop();
-			if ((getNodeType ? getNodeType(node) : node.nodeType) === NODE_TYPE.element) _stripDisallowedAttributes(node);
-			const childNodes = getChildNodes ? getChildNodes(node) : node.childNodes;
+			if (_readNodeType(node) === NODE_TYPE.element) _stripDisallowedAttributes(node);
+			const childNodes = getChildNodes(node);
+			if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push(childNodes[i]);
+		}
+	};
+	/**
+	* _neutralizePatchLinkage
+	*
+	* IN_PLACE entry pre-pass (declarative-partial-updates / streaming
+	* hardening, https://github.com/WICG/declarative-partial-updates).
+	*
+	* The main walk strips patch linkage (`for`/`patchsrc`) and removes range
+	* markers (PIs / markup comments) node-by-node, in document order, AS it
+	* reaches each node. On a live in-place root that leaves a window: from the
+	* moment the root is connected until the walk arrives at a given node, that
+	* node's linkage is live. A patch applied on connection/stream can fire as
+	* a microtask during the walk and inject or teleport an unsanitized DOM
+	* range into a region the iterator has already passed and will not revisit,
+	* so the post-return "tree is sanitized" contract is violated. Sweep the
+	* whole tree once up front and sever every linkage before the walk begins,
+	* closing that window.
+	*
+	* This CANNOT undo a patch that already fired before sanitize ran — that is
+	* the irreducible "do not IN_PLACE a live-connected attacker tree" caveat —
+	* but it closes everything from sanitize-start onward. Gated on SAFE_FOR_XML
+	* to group with the rest of the declarative-partial-updates handling and
+	* stay overridable, consistent with the codebase.
+	*
+	* Clobber-safe traversal (cached childNodes getter); per-node try/catch so a
+	* clobbered root cannot defeat the sweep of its non-clobbered descendants.
+	*
+	* NOTE (pending real-Chrome confirmation, see test/declarative-patch-probe
+	* .html Q1): this mirrors the existing policy of keeping `for` on
+	* <label>/<output>. If the shipping feature can drive a patch through a
+	* surviving `for`-on-label/output + `id` pair, this pre-pass and the
+	* attribute check at _isBasicCustomElement's caller must additionally drop
+	* that pair on the IN_PLACE path. Left as-is until the taxonomy is verified.
+	*
+	* @param root the in-place root to sweep
+	*/
+	/**
+	* Central policy for declarative-partial-updates patch-linkage attributes,
+	* shared by the _neutralizePatchLinkage pre-pass and _isValidAttribute so
+	* the two sites cannot drift: `patchsrc` always links, `for` links
+	* everywhere except on <label>/<output>, and the whole policy is gated on
+	* SAFE_FOR_XML (see the rationale block in _isValidAttribute).
+	*
+	* @param lcName the transformCaseFunc'd attribute name
+	* @param lcTag the transformCaseFunc'd tag name of the carrying element
+	* @return true if the attribute is patch linkage and must be dropped
+	*/
+	const _isPatchLinkageAttribute = function _isPatchLinkageAttribute(lcName, lcTag) {
+		if (!SAFE_FOR_XML) return false;
+		if (lcName === "patchsrc") return true;
+		return lcName === "for" && lcTag !== "label" && lcTag !== "output";
+	};
+	const _neutralizePatchLinkage = function _neutralizePatchLinkage(root) {
+		if (!SAFE_FOR_XML) return;
+		const stack = [root];
+		while (stack.length > 0) {
+			const node = stack.pop();
+			const nodeType = _readNodeType(node);
+			if (nodeType === NODE_TYPE.processingInstruction || nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, node.data)) {
+				try {
+					remove(node);
+				} catch (_) {}
+				continue;
+			}
+			if (nodeType === NODE_TYPE.element) {
+				const element = node;
+				const lcTag = transformCaseFunc(_readNodeName(node));
+				try {
+					if (element.hasAttribute && element.hasAttribute("patchsrc")) element.removeAttribute("patchsrc");
+					if (element.hasAttribute && element.hasAttribute("for") && _isPatchLinkageAttribute("for", lcTag)) element.removeAttribute("for");
+				} catch (_) {}
+			}
+			const childNodes = getChildNodes(node);
 			if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push(childNodes[i]);
 		}
 	};
@@ -7539,7 +7761,22 @@ function createDOMPurify() {
 	* @return The created NodeIterator
 	*/
 	const _createNodeIterator = function _createNodeIterator(root) {
-		return createNodeIterator.call(root.ownerDocument || root, root, NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
+		const doc = getOwnerDocument ? getOwnerDocument(root) : root.ownerDocument;
+		return createNodeIterator.call(doc || root, root, NodeFilter.SHOW_ELEMENT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_TEXT | NodeFilter.SHOW_PROCESSING_INSTRUCTION | NodeFilter.SHOW_CDATA_SECTION, null);
+	};
+	/**
+	* Replace template expression syntax (mustache, ERB, template
+	* literal) with a space; shared by all SAFE_FOR_TEMPLATES scrub
+	* sites. Order matters: mustache, then ERB, then template literal.
+	*
+	* @param value the string to scrub
+	* @returns the scrubbed string
+	*/
+	const _stripTemplateExpressions = function _stripTemplateExpressions(value) {
+		value = stringReplace(value, MUSTACHE_EXPR$1, " ");
+		value = stringReplace(value, ERB_EXPR$1, " ");
+		value = stringReplace(value, TMPLIT_EXPR$1, " ");
+		return value;
 	};
 	/**
 	* Strip template-engine expressions ({{...}}, ${...}, <%...%>) from the
@@ -7561,24 +7798,17 @@ function createDOMPurify() {
 	* @param node The root element whose character data should be scrubbed.
 	*/
 	const _scrubTemplateExpressions2 = function _scrubTemplateExpressions(node) {
-		var _node$querySelectorAl, _node$querySelectorAl2;
+		var _node$querySelectorAl;
 		node.normalize();
-		const walker = createNodeIterator.call(node.ownerDocument || node, node, NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION, null);
+		const doc = getOwnerDocument ? getOwnerDocument(node) : node.ownerDocument;
+		const walker = createNodeIterator.call(doc || node, node, NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | NodeFilter.SHOW_CDATA_SECTION | NodeFilter.SHOW_PROCESSING_INSTRUCTION, null);
 		let currentNode = walker.nextNode();
 		while (currentNode) {
-			let data = currentNode.data;
-			arrayForEach([
-				MUSTACHE_EXPR$1,
-				ERB_EXPR$1,
-				TMPLIT_EXPR$1
-			], (expr) => {
-				data = stringReplace(data, expr, " ");
-			});
-			currentNode.data = data;
+			currentNode.data = _stripTemplateExpressions(currentNode.data);
 			currentNode = walker.nextNode();
 		}
-		const templates = (_node$querySelectorAl = (_node$querySelectorAl2 = node.querySelectorAll) === null || _node$querySelectorAl2 === void 0 ? void 0 : _node$querySelectorAl2.call(node, "template")) !== null && _node$querySelectorAl !== void 0 ? _node$querySelectorAl : [];
-		arrayForEach(Array.from(templates), (tmpl) => {
+		const templates = (_node$querySelectorAl = node.querySelectorAll) === null || _node$querySelectorAl === void 0 ? void 0 : _node$querySelectorAl.call(node, "template");
+		if (templates) arrayForEach(templates, (tmpl) => {
 			if (_isDocumentFragment(tmpl.content)) _scrubTemplateExpressions2(tmpl.content);
 		});
 	};
@@ -7639,11 +7869,136 @@ function createDOMPurify() {
 		}
 	};
 	function _executeHooks(hooks, currentNode, data) {
+		if (hooks.length === 0) return;
 		arrayForEach(hooks, (hook) => {
 			hook.call(DOMPurify, currentNode, data, CONFIG);
 		});
 	}
 	/**
+	* Structural-threat checks that condemn a node regardless of the
+	* allowlists: mXSS via namespace confusion, risky CSS construction,
+	* processing instructions, markup-bearing comments. Pure predicate;
+	* the caller removes. Check order is load-bearing.
+	*
+	* @param currentNode the node to inspect
+	* @param tagName the node's transformCaseFunc'd tag name
+	* @return true if the node must be removed
+	*/
+	const _isUnsafeNode = function _isUnsafeNode(currentNode, tagName) {
+		if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.textContent) && regExpTest(ELEMENT_MARKUP_PROBE, currentNode.innerHTML)) return true;
+		if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && LITERAL_TEXT_ELEMENTS[tagName] && (_isNode(currentNode.firstElementChild) || typeof currentNode.textContent === "string" && regExpTest(LITERAL_TEXT_CLOSE[tagName], currentNode.textContent))) return true;
+		if (currentNode.nodeType === NODE_TYPE.processingInstruction) return true;
+		if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(COMMENT_MARKUP_PROBE, currentNode.data)) return true;
+		return false;
+	};
+	/**
+	* Evaluate a CUSTOM_ELEMENT_HANDLING check (a RegExp or a predicate
+	* function, per the validation in _parseConfig) against a name.
+	* Additional arguments are forwarded to predicate functions - the
+	* attributeNameCheck predicate receives the tag name as its second
+	* argument. A null/absent check never matches.
+	*
+	* @param check the configured tagNameCheck / attributeNameCheck value
+	* @param name the name to test
+	* @param args extra arguments forwarded to a predicate function
+	* @return true if the check matches the name
+	*/
+	const _matchesNameCheck = function _matchesNameCheck(check, name) {
+		if (check instanceof RegExp) return regExpTest(check, name);
+		if (check instanceof Function) {
+			for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key < _len; _key++) args[_key - 2] = arguments[_key];
+			return Boolean(check(name, ...args));
+		}
+		return false;
+	};
+	/**
+	* Handle a node whose tag is forbidden or not allowlisted: keep
+	* allowed custom elements (false return exits _sanitizeElements
+	* early - the namespace and fallback-tag removal checks are
+	* intentionally skipped for kept custom elements), else hoist
+	* content per KEEP_CONTENT and remove.
+	*
+	* A kept custom element is the ONLY case in which this function
+	* returns false, so the caller uses that return value to run the
+	* afterSanitizeElements hook on the kept element and keep the
+	* element-hook lifecycle consistent with normal allowlisted
+	* elements (GHSA-c2j3-45gr-mqc4).
+	*
+	* @param currentNode the disallowed node
+	* @param tagName the node's transformCaseFunc'd tag name
+	* @return true if the node was removed, false if kept
+	*/
+	const _sanitizeDisallowedNode = function _sanitizeDisallowedNode(currentNode, tagName, root) {
+		if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
+		if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
+			const parentNode = getParentNode(currentNode);
+			const childNodes = getChildNodes(currentNode);
+			if (childNodes && parentNode) {
+				const childCount = childNodes.length;
+				for (let i = childCount - 1; i >= 0; --i) {
+					const hoisted = currentNode === root ? cloneNode(childNodes[i], true) : childNodes[i];
+					parentNode.insertBefore(hoisted, getNextSibling(currentNode));
+				}
+			}
+		}
+		_forceRemove(currentNode);
+		return true;
+	};
+	/**
+	* Fork a hook-mutable allowlist off its shared binding the first time a
+	* (possibly lazily-installed) uponSanitize* hook is about to see it, so the
+	* hook cannot widen the per-instance default or the setConfig binding by
+	* reference and leak past the call. Returns the set unchanged once it is
+	* already call-local, so repeated calls across elements are idempotent.
+	*
+	* @param hookList the uponSanitize* hook array for this event
+	* @param set the current ALLOWED_TAGS / ALLOWED_ATTR binding
+	* @param defaultSet the per-instance DEFAULT_ALLOWED_* constant
+	* @param setConfigSet the captured setConfig() binding, or null
+	* @return a call-local clone if a hook is present and set is still shared,
+	*   else set unchanged
+	*/
+	const _forkSharedAllowlist = function _forkSharedAllowlist(hookList, set, defaultSet, setConfigSet) {
+		if (hookList.length === 0) return set;
+		return set === defaultSet || set === setConfigSet ? clone(set) : set;
+	};
+	/**
+	* Shared guard for a node that a hook has detached from the walk tree,
+	* used after each element-hook site in _sanitizeElements. Detaching is a
+	* long-standing user pattern (issue #469; draw.io-style foreignObject
+	* filtering). Per the cached, unclobberable parentNode getter the node is
+	* genuinely out of the tree, so it can reach neither the serialized
+	* output nor an IN_PLACE live tree; treat it as removed and stop
+	* processing it. Without this guard, the unsafe-node / namespace checks
+	* would call _forceRemove on a parentless node and hit the REPORT-3
+	* fail-closed throw — which exists for nodes DOMPurify wants gone but
+	* *cannot* detach (clobbered / parentless roots), the opposite of a node
+	* that is already safely gone. The walk root is exempt: a detached
+	* IN_PLACE root is legitimate input and must still be fully sanitized,
+	* and a kill-decision on it must keep hitting the REPORT-3 throw.
+	*
+	* Nodes detached by hooks stay the hook's responsibility for placement:
+	* they are not recorded in DOMPurify.removed, so the post-walk IN_PLACE
+	* pass (which iterates DOMPurify.removed) does not reach them. But a
+	* hook-detached subtree can still hold a queued resource-event handler -
+	* e.g. an <img onload> that began loading when the caller built the live
+	* tree - which fires in page scope after sanitize returns even though the
+	* handler never reached the returned tree. That is the audit-5 F1 hazard,
+	* and the documented node.remove() hook pattern walks straight into it.
+	* So on the IN_PLACE path we neutralize the detached subtree inline,
+	* stripping its non-allow-listed attributes before returning, exactly as
+	* the post-walk pass does for _forceRemove'd subtrees.
+	*
+	* @param currentNode the node a hook may have detached
+	* @param root the current walk root
+	* @return true if the node is detached and now handled, false otherwise
+	*/
+	const _handleHookDetachedNode = function _handleHookDetachedNode(currentNode, root) {
+		if (currentNode === root || getParentNode(currentNode) !== null) return false;
+		if (IN_PLACE) _neutralizeSubtree(currentNode);
+		return true;
+	};
+	/**
 	* _sanitizeElements
 	*
 	* @protect nodeName
@@ -7652,70 +8007,39 @@ function createDOMPurify() {
 	* @param currentNode to check for permission to exist
 	* @return true if node was killed, false if left alive
 	*/
-	const _sanitizeElements = function _sanitizeElements(currentNode) {
-		let content = null;
+	const _sanitizeElements = function _sanitizeElements(currentNode, root) {
 		_executeHooks(hooks.beforeSanitizeElements, currentNode, null);
+		if (_handleHookDetachedNode(currentNode, root)) return true;
 		if (_isClobbered(currentNode)) {
 			_forceRemove(currentNode);
 			return true;
 		}
-		const tagName = transformCaseFunc(getNodeName ? getNodeName(currentNode) : currentNode.nodeName);
+		const tagName = transformCaseFunc(_readNodeName(currentNode));
+		ALLOWED_TAGS = _forkSharedAllowlist(hooks.uponSanitizeElement, ALLOWED_TAGS, DEFAULT_ALLOWED_TAGS, SET_CONFIG_ALLOWED_TAGS);
 		_executeHooks(hooks.uponSanitizeElement, currentNode, {
 			tagName,
 			allowedTags: ALLOWED_TAGS
 		});
-		if (SAFE_FOR_XML && currentNode.hasChildNodes() && !_isNode(currentNode.firstElementChild) && regExpTest(/<[/\w!]/g, currentNode.innerHTML) && regExpTest(/<[/\w!]/g, currentNode.textContent)) {
-			_forceRemove(currentNode);
-			return true;
-		}
-		if (SAFE_FOR_XML && currentNode.namespaceURI === HTML_NAMESPACE && tagName === "style" && _isNode(currentNode.firstElementChild)) {
-			_forceRemove(currentNode);
-			return true;
-		}
-		if (currentNode.nodeType === NODE_TYPE.progressingInstruction) {
-			_forceRemove(currentNode);
-			return true;
-		}
-		if (SAFE_FOR_XML && currentNode.nodeType === NODE_TYPE.comment && regExpTest(/<[/\w]/g, currentNode.data)) {
+		if (_handleHookDetachedNode(currentNode, root)) return true;
+		if (_isUnsafeNode(currentNode, tagName)) {
 			_forceRemove(currentNode);
 			return true;
 		}
 		if (FORBID_TAGS[tagName] || !(EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function && EXTRA_ELEMENT_HANDLING.tagCheck(tagName)) && !ALLOWED_TAGS[tagName]) {
-			if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
-				if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)) return false;
-				if (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)) return false;
-			}
-			if (KEEP_CONTENT && !FORBID_CONTENTS[tagName]) {
-				const parentNode = getParentNode(currentNode);
-				const childNodes = getChildNodes(currentNode);
-				if (childNodes && parentNode) {
-					const childCount = childNodes.length;
-					for (let i = childCount - 1; i >= 0; --i) {
-						const hoisted = IN_PLACE ? childNodes[i] : cloneNode(childNodes[i], true);
-						parentNode.insertBefore(hoisted, getNextSibling(currentNode));
-					}
-				}
-			}
-			_forceRemove(currentNode);
-			return true;
+			const removed = _sanitizeDisallowedNode(currentNode, tagName, root);
+			if (removed === false) _executeHooks(hooks.afterSanitizeElements, currentNode, null);
+			return removed;
 		}
-		if ((getNodeType ? getNodeType(currentNode) : currentNode.nodeType) === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
+		if (_readNodeType(currentNode) === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
 			_forceRemove(currentNode);
 			return true;
 		}
-		if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(/<\/no(script|embed|frames)/i, currentNode.innerHTML)) {
+		if ((tagName === "noscript" || tagName === "noembed" || tagName === "noframes") && regExpTest(FALLBACK_TAG_CLOSE, currentNode.innerHTML)) {
 			_forceRemove(currentNode);
 			return true;
 		}
 		if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
-			content = currentNode.textContent;
-			arrayForEach([
-				MUSTACHE_EXPR$1,
-				ERB_EXPR$1,
-				TMPLIT_EXPR$1
-			], (expr) => {
-				content = stringReplace(content, expr, " ");
-			});
+			const content = _stripTemplateExpressions(currentNode.textContent);
 			if (currentNode.textContent !== content) {
 				arrayPush(DOMPurify.removed, { element: currentNode.cloneNode() });
 				currentNode.textContent = content;
@@ -7734,18 +8058,17 @@ function createDOMPurify() {
 	*/
 	const _isValidAttribute = function _isValidAttribute(lcTag, lcName, value) {
 		if (FORBID_ATTR[lcName]) return false;
+		if (_isPatchLinkageAttribute(lcName, lcTag)) return false;
 		if (SANITIZE_DOM && (lcName === "id" || lcName === "name") && (value in document || value in formElement)) return false;
 		const nameIsPermitted = ALLOWED_ATTR[lcName] || EXTRA_ELEMENT_HANDLING.attributeCheck instanceof Function && EXTRA_ELEMENT_HANDLING.attributeCheck(lcName, lcTag);
-		if (ALLOW_DATA_ATTR && !FORBID_ATTR[lcName] && regExpTest(DATA_ATTR$1, lcName));
-		else if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName));
-		else if (!nameIsPermitted || FORBID_ATTR[lcName]) if (_isBasicCustomElement(lcTag) && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(lcTag)) && (CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName) || CUSTOM_ELEMENT_HANDLING.attributeNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.attributeNameCheck(lcName, lcTag)) || lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && (CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp && regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value) || CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function && CUSTOM_ELEMENT_HANDLING.tagNameCheck(value)));
-		else return false;
-		else if (URI_SAFE_ATTRIBUTES[lcName]);
-		else if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, "")));
-		else if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]);
-		else if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, "")));
-		else if (value) return false;
-		return true;
+		if (ALLOW_DATA_ATTR && regExpTest(DATA_ATTR$1, lcName)) return true;
+		if (ALLOW_ARIA_ATTR && regExpTest(ARIA_ATTR$1, lcName)) return true;
+		if (!nameIsPermitted) return _isBasicCustomElement(lcTag) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, lcTag) && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.attributeNameCheck, lcName, lcTag) || lcName === "is" && CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements && _matchesNameCheck(CUSTOM_ELEMENT_HANDLING.tagNameCheck, value);
+		if (URI_SAFE_ATTRIBUTES[lcName]) return true;
+		if (regExpTest(IS_ALLOWED_URI$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) return true;
+		if ((lcName === "src" || lcName === "xlink:href" || lcName === "href") && lcTag !== "script" && stringIndexOf(value, "data:") === 0 && DATA_URI_TAGS[lcTag]) return true;
+		if (ALLOW_UNKNOWN_PROTOCOLS && !regExpTest(IS_SCRIPT_OR_DATA$1, stringReplace(value, ATTR_WHITESPACE$1, ""))) return true;
+		return !value;
 	};
 	const RESERVED_CUSTOM_ELEMENT_NAMES = addToSet({}, [
 		"annotation-xml",
@@ -7769,6 +8092,48 @@ function createDOMPurify() {
 		return !RESERVED_CUSTOM_ELEMENT_NAMES[stringToLowerCase(tagName)] && regExpTest(CUSTOM_ELEMENT$1, tagName);
 	};
 	/**
+	* Wrap an attribute value in the matching Trusted Types object when
+	* the active policy requires it. Namespaced attributes pass through
+	* unchanged (no TT support yet, see
+	* https://bugs.chromium.org/p/chromium/issues/detail?id=1305293).
+	*
+	* @param lcTag lowercase tag name of the containing element
+	* @param lcName lowercase attribute name
+	* @param namespaceURI the attribute's namespace, if any
+	* @param value the attribute value to wrap
+	* @return the value, wrapped when Trusted Types demand it
+	*/
+	const _applyTrustedTypesToAttribute = function _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value) {
+		if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function" && !namespaceURI) switch (trustedTypes.getAttributeType(lcTag, lcName)) {
+			case "TrustedHTML": return _createTrustedHTML(value);
+			case "TrustedScriptURL": return _createTrustedScriptURL(value);
+		}
+		return value;
+	};
+	/**
+	* Write a modified attribute value back onto the element. On
+	* success, re-probe for clobbering introduced by the new value and
+	* remove the element when found; otherwise pop the removal entry
+	* recorded by the earlier _removeAttribute (long-standing pairing
+	* with the SANITIZE_NAMED_PROPS path - do not "fix" casually). On
+	* failure, remove the attribute instead.
+	*
+	* @param currentNode the element carrying the attribute
+	* @param name the attribute name as present on the element
+	* @param namespaceURI the attribute's namespace, if any
+	* @param value the new attribute value
+	*/
+	const _setAttributeValue = function _setAttributeValue(currentNode, name, namespaceURI, value) {
+		try {
+			if (namespaceURI) currentNode.setAttributeNS(namespaceURI, name, value);
+			else currentNode.setAttribute(name, value);
+			if (_isClobbered(currentNode)) _forceRemove(currentNode);
+			else arrayPop(DOMPurify.removed);
+		} catch (_) {
+			_removeAttribute(name, currentNode);
+		}
+	};
+	/**
 	* _sanitizeAttributes
 	*
 	* @protect attributes
@@ -7782,6 +8147,7 @@ function createDOMPurify() {
 		_executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
 		const attributes = currentNode.attributes;
 		if (!attributes || _isClobbered(currentNode)) return;
+		ALLOWED_ATTR = _forkSharedAllowlist(hooks.uponSanitizeAttribute, ALLOWED_ATTR, DEFAULT_ALLOWED_ATTR, SET_CONFIG_ALLOWED_ATTR);
 		const hookEvent = {
 			attrName: "",
 			attrValue: "",
@@ -7790,6 +8156,7 @@ function createDOMPurify() {
 			forceKeepAttr: void 0
 		};
 		let l = attributes.length;
+		const lcTag = transformCaseFunc(currentNode.nodeName);
 		while (l--) {
 			const attr = attributes[l];
 			const name = attr.name, namespaceURI = attr.namespaceURI, attrValue = attr.value;
@@ -7803,55 +8170,33 @@ function createDOMPurify() {
 			_executeHooks(hooks.uponSanitizeAttribute, currentNode, hookEvent);
 			value = hookEvent.attrValue;
 			if (SANITIZE_NAMED_PROPS && (lcName === "id" || lcName === "name") && stringIndexOf(value, SANITIZE_NAMED_PROPS_PREFIX) !== 0) {
-				_removeAttribute(name, currentNode);
+				_removeAttribute(name, currentNode, attr);
 				value = SANITIZE_NAMED_PROPS_PREFIX + value;
 			}
 			if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, value)) {
-				_removeAttribute(name, currentNode);
+				_removeAttribute(name, currentNode, attr);
 				continue;
 			}
 			if (lcName === "attributename" && stringMatch(value, "href")) {
-				_removeAttribute(name, currentNode);
+				_removeAttribute(name, currentNode, attr);
 				continue;
 			}
 			if (hookEvent.forceKeepAttr) continue;
 			if (!hookEvent.keepAttr) {
-				_removeAttribute(name, currentNode);
+				_removeAttribute(name, currentNode, attr);
 				continue;
 			}
-			if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(/\/>/i, value)) {
-				_removeAttribute(name, currentNode);
+			if (!ALLOW_SELF_CLOSE_IN_ATTR && regExpTest(SELF_CLOSING_TAG, value)) {
+				_removeAttribute(name, currentNode, attr);
 				continue;
 			}
-			if (SAFE_FOR_TEMPLATES) arrayForEach([
-				MUSTACHE_EXPR$1,
-				ERB_EXPR$1,
-				TMPLIT_EXPR$1
-			], (expr) => {
-				value = stringReplace(value, expr, " ");
-			});
-			const lcTag = transformCaseFunc(currentNode.nodeName);
+			if (SAFE_FOR_TEMPLATES) value = _stripTemplateExpressions(value);
 			if (!_isValidAttribute(lcTag, lcName, value)) {
-				_removeAttribute(name, currentNode);
+				_removeAttribute(name, currentNode, attr);
 				continue;
 			}
-			if (trustedTypesPolicy && typeof trustedTypes === "object" && typeof trustedTypes.getAttributeType === "function") if (namespaceURI);
-			else switch (trustedTypes.getAttributeType(lcTag, lcName)) {
-				case "TrustedHTML":
-					value = _createTrustedHTML(value);
-					break;
-				case "TrustedScriptURL":
-					value = _createTrustedScriptURL(value);
-					break;
-			}
-			if (value !== initValue) try {
-				if (namespaceURI) currentNode.setAttributeNS(namespaceURI, name, value);
-				else currentNode.setAttribute(name, value);
-				if (_isClobbered(currentNode)) _forceRemove(currentNode);
-				else arrayPop(DOMPurify.removed);
-			} catch (_) {
-				_removeAttribute(name, currentNode);
-			}
+			value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
+			if (value !== initValue) _setAttributeValue(currentNode, name, namespaceURI, value);
 		}
 		_executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
 	};
@@ -7866,11 +8211,11 @@ function createDOMPurify() {
 		_executeHooks(hooks.beforeSanitizeShadowDOM, fragment, null);
 		while (shadowNode = shadowIterator.nextNode()) {
 			_executeHooks(hooks.uponSanitizeShadowNode, shadowNode, null);
-			_sanitizeElements(shadowNode);
+			_sanitizeElements(shadowNode, fragment);
 			_sanitizeAttributes(shadowNode);
 			if (_isDocumentFragment(shadowNode.content)) _sanitizeShadowDOM2(shadowNode.content);
-			if ((getNodeType ? getNodeType(shadowNode) : shadowNode.nodeType) === NODE_TYPE.element) {
-				const innerSr = getShadowRoot ? getShadowRoot(shadowNode) : shadowNode.shadowRoot;
+			if (_readNodeType(shadowNode) === NODE_TYPE.element) {
+				const innerSr = getShadowRoot(shadowNode);
 				if (_isDocumentFragment(innerSr)) {
 					_sanitizeAttachedShadowRoots(innerSr);
 					_sanitizeShadowDOM2(innerSr);
@@ -7910,8 +8255,8 @@ function createDOMPurify() {
 				continue;
 			}
 			const node = item.node;
-			const isElement = (getNodeType ? getNodeType(node) : node.nodeType) === NODE_TYPE.element;
-			const childNodes = getChildNodes ? getChildNodes(node) : node.childNodes;
+			const isElement = _readNodeType(node) === NODE_TYPE.element;
+			const childNodes = getChildNodes(node);
 			if (childNodes) for (let i = childNodes.length - 1; i >= 0; --i) stack.push({
 				node: childNodes[i],
 				shadow: null
@@ -7927,7 +8272,7 @@ function createDOMPurify() {
 				}
 			}
 			if (isElement) {
-				const sr = getShadowRoot ? getShadowRoot(node) : node.shadowRoot;
+				const sr = getShadowRoot(node);
 				if (_isDocumentFragment(sr)) stack.push({
 					node: null,
 					shadow: sr
@@ -7951,16 +8296,28 @@ function createDOMPurify() {
 			if (typeof dirty !== "string") throw typeErrorCreate("dirty is not a string, aborting");
 		}
 		if (!DOMPurify.isSupported) return dirty;
-		if (!SET_CONFIG) _parseConfig(cfg);
+		if (SET_CONFIG) {
+			ALLOWED_TAGS = SET_CONFIG_ALLOWED_TAGS;
+			ALLOWED_ATTR = SET_CONFIG_ALLOWED_ATTR;
+		} else _parseConfig(cfg);
+		if (hooks.uponSanitizeElement.length > 0 || hooks.uponSanitizeAttribute.length > 0) ALLOWED_TAGS = clone(ALLOWED_TAGS);
+		if (hooks.uponSanitizeAttribute.length > 0) ALLOWED_ATTR = clone(ALLOWED_ATTR);
 		DOMPurify.removed = [];
 		const inPlace = IN_PLACE && typeof dirty !== "string" && _isNode(dirty);
 		if (inPlace) {
-			const nn = getNodeName ? getNodeName(dirty) : dirty.nodeName;
+			_neutralizePatchLinkage(dirty);
+			const nn = _readNodeName(dirty);
 			if (typeof nn === "string") {
 				const tagName = transformCaseFunc(nn);
-				if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
+				if (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) {
+					_neutralizeRoot(dirty);
+					throw typeErrorCreate("root node is forbidden and cannot be sanitized in-place");
+				}
+			}
+			if (_isClobbered(dirty)) {
+				_neutralizeRoot(dirty);
+				throw typeErrorCreate("root node is clobbered and cannot be sanitized in-place");
 			}
-			if (_isClobbered(dirty)) throw typeErrorCreate("root node is clobbered and cannot be sanitized in-place");
 			try {
 				_sanitizeAttachedShadowRoots(dirty);
 			} catch (error) {
@@ -7980,15 +8337,21 @@ function createDOMPurify() {
 			if (!body) return RETURN_DOM ? null : RETURN_TRUSTED_TYPE ? emptyHTML : "";
 		}
 		if (body && FORCE_BODY) _forceRemove(body.firstChild);
-		const nodeIterator = _createNodeIterator(inPlace ? dirty : body);
+		const walkRoot = inPlace ? dirty : body;
 		try {
+			const nodeIterator = _createNodeIterator(walkRoot);
 			while (currentNode = nodeIterator.nextNode()) {
-				_sanitizeElements(currentNode);
+				_sanitizeElements(currentNode, walkRoot);
 				_sanitizeAttributes(currentNode);
 				if (_isDocumentFragment(currentNode.content)) _sanitizeShadowDOM2(currentNode.content);
 			}
 		} catch (error) {
-			if (inPlace) _neutralizeRoot(dirty);
+			if (inPlace) {
+				_neutralizeRoot(dirty);
+				arrayForEach(DOMPurify.removed, (entry) => {
+					if (entry.element) _neutralizeSubtree(entry.element);
+				});
+			}
 			throw error;
 		}
 		if (inPlace) {
@@ -8009,34 +8372,37 @@ function createDOMPurify() {
 		}
 		let serializedHTML = WHOLE_DOCUMENT ? body.outerHTML : body.innerHTML;
 		if (WHOLE_DOCUMENT && ALLOWED_TAGS["!doctype"] && body.ownerDocument && body.ownerDocument.doctype && body.ownerDocument.doctype.name && regExpTest(DOCTYPE_NAME, body.ownerDocument.doctype.name)) serializedHTML = "<!DOCTYPE " + body.ownerDocument.doctype.name + ">\n" + serializedHTML;
-		if (SAFE_FOR_TEMPLATES) arrayForEach([
-			MUSTACHE_EXPR$1,
-			ERB_EXPR$1,
-			TMPLIT_EXPR$1
-		], (expr) => {
-			serializedHTML = stringReplace(serializedHTML, expr, " ");
-		});
+		if (SAFE_FOR_TEMPLATES) serializedHTML = _stripTemplateExpressions(serializedHTML);
 		return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(serializedHTML) : serializedHTML;
 	};
 	DOMPurify.setConfig = function() {
-		_parseConfig(arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {});
+		let cfg = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : {};
+		_parseConfig(cfg);
 		SET_CONFIG = true;
+		SET_CONFIG_ALLOWED_TAGS = ALLOWED_TAGS;
+		SET_CONFIG_ALLOWED_ATTR = ALLOWED_ATTR;
 	};
 	DOMPurify.clearConfig = function() {
 		CONFIG = null;
 		SET_CONFIG = false;
+		SET_CONFIG_ALLOWED_TAGS = null;
+		SET_CONFIG_ALLOWED_ATTR = null;
 		trustedTypesPolicy = defaultTrustedTypesPolicy;
 		emptyHTML = "";
 	};
 	DOMPurify.isValidAttribute = function(tag, attr, value) {
 		if (!CONFIG) _parseConfig({});
-		return _isValidAttribute(transformCaseFunc(tag), transformCaseFunc(attr), value);
+		const lcTag = transformCaseFunc(tag);
+		const lcName = transformCaseFunc(attr);
+		return _isValidAttribute(lcTag, lcName, value);
 	};
 	DOMPurify.addHook = function(entryPoint, hookFunction) {
 		if (typeof hookFunction !== "function") return;
+		if (!objectHasOwnProperty(hooks, entryPoint)) return;
 		arrayPush(hooks[entryPoint], hookFunction);
 	};
 	DOMPurify.removeHook = function(entryPoint, hookFunction) {
+		if (!objectHasOwnProperty(hooks, entryPoint)) return;
 		if (hookFunction !== void 0) {
 			const index = arrayLastIndexOf(hooks[entryPoint], hookFunction);
 			return index === -1 ? void 0 : arraySplice(hooks[entryPoint], index, 1)[0];
@@ -8044,6 +8410,7 @@ function createDOMPurify() {
 		return arrayPop(hooks[entryPoint]);
 	};
 	DOMPurify.removeHooks = function(entryPoint) {
+		if (!objectHasOwnProperty(hooks, entryPoint)) return;
 		hooks[entryPoint] = [];
 	};
 	DOMPurify.removeAllHooks = function() {
@@ -8108,6 +8475,7 @@ var UXModelInstrumentAgentCommon_vue_vue_type_script_setup_true_lang_default = /
 	emits: ["myclick"],
 	setup(__props, { emit: __emit }) {
 		const convert = new import_ansi_to_html.default();
+		console.debug(`UXModelInstrumentAgentCommon(): ModelStore`);
 		const store = ModelStore();
 		const props = __props;
 		const LogData = (0, vue.computed)(() => {
@@ -8151,13 +8519,6 @@ var UXModelInstrumentAgentCommon_vue_vue_type_script_setup_true_lang_default = /
 			} catch (error) {
 				return "";
 			}
-			let numArray = value.map((value) => (Math.round(value[1] * 100) / 100).toFixed(2));
-			let sep = "";
-			return "[" + numArray.reduce((prev, current) => {
-				const retVal = prev += sep + current;
-				sep = ", ";
-				return retVal;
-			}, "") + "]";
 		};
 		const convertMS = function(ms) {
 			let s = Math.floor(ms / 1e3);
@@ -8183,8 +8544,10 @@ var UXModelInstrumentAgentCommon_vue_vue_type_script_setup_true_lang_default = /
 				return false;
 			},
 			set: (val) => {
-				if (store._models[props.modelId]) if (store._models[props.modelId].modelMeta[props.nodeid]) store._models[props.modelId].modelMeta[props.nodeid].detailView = val;
-				else store._models[props.modelId].modelMeta[props.nodeid] = { detailView: val };
+				if (store._models[props.modelId]) {
+					if (store._models[props.modelId].modelMeta[props.nodeid]) store._models[props.modelId].modelMeta[props.nodeid].detailView = val;
+					else store._models[props.modelId].modelMeta[props.nodeid] = { detailView: val };
+				}
 			}
 		});
 		const barChartEx = (0, vue.ref)();
@@ -8382,7 +8745,7 @@ var _plugin_vue_export_helper_default = (sfc, props) => {
 };
 //#endregion
 //#region src/components/UXModelInstrumentAgentCommon.vue
-var UXModelInstrumentAgentCommon_default = /*#__PURE__*/ _plugin_vue_export_helper_default(UXModelInstrumentAgentCommon_vue_vue_type_script_setup_true_lang_default, [["__scopeId", "data-v-6a76d4ff"]]);
+var UXModelInstrumentAgentCommon_default = /*#__PURE__*/ _plugin_vue_export_helper_default(UXModelInstrumentAgentCommon_vue_vue_type_script_setup_true_lang_default, [["__scopeId", "data-v-74180ab3"]]);
 //#endregion
 //#region node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET$1 = 10;
@@ -8795,6 +9158,7 @@ var UXModelInstrumentServiceCommon_default = /*#__PURE__*/ _plugin_vue_export_he
 			else return id;
 		};
 		const convert = new import_ansi_to_html.default();
+		console.debug(`UXModelInstrumentServiceCommon(): ModelStore`);
 		const store = ModelStore();
 		const emit = __emit;
 		const clicked = function(id) {
@@ -8872,8 +9236,10 @@ var UXModelInstrumentServiceCommon_default = /*#__PURE__*/ _plugin_vue_export_he
 				return false;
 			},
 			set: (val) => {
-				if (store._models[props.modelId]) if (store._models[props.modelId].modelMeta[props.nodeid]) store._models[props.modelId].modelMeta[props.nodeid].detailView = val;
-				else store._models[props.modelId].modelMeta[props.nodeid] = { detailView: val };
+				if (store._models[props.modelId]) {
+					if (store._models[props.modelId].modelMeta[props.nodeid]) store._models[props.modelId].modelMeta[props.nodeid].detailView = val;
+					else store._models[props.modelId].modelMeta[props.nodeid] = { detailView: val };
+				}
 			}
 		});
 		const lineChartEx = (0, vue.ref)();
@@ -9186,7 +9552,7 @@ var UXModelInstrumentServiceCommon_default = /*#__PURE__*/ _plugin_vue_export_he
 			});
 		};
 	}
-}), [["__scopeId", "data-v-d2a49147"]]);
+}), [["__scopeId", "data-v-cf987598"]]);
 //#endregion
 //#region src/components/UXModelInstrumentServiceSmall.vue?vue&type=script&setup=true&lang.ts
 var _hoisted_1$3 = { class: "ststitle" };
@@ -9276,6 +9642,7 @@ var UXModelInstrumentServiceSmall_default = /*#__PURE__*/ _plugin_vue_export_hel
 	emits: ["myclick"],
 	setup(__props, { emit: __emit }) {
 		chalk$1.level = 3;
+		console.debug(`UXModelInstrumentServiceSmall(): ModelStore`);
 		const store = ModelStore();
 		const emit = __emit;
 		const clicked = function(id) {
@@ -9563,7 +9930,7 @@ var UXModelInstrumentServiceSmall_default = /*#__PURE__*/ _plugin_vue_export_hel
 						class: "mb-3"
 					}, {
 						default: (0, vue.withCtx)(() => [(0, vue.createVNode)(_component_v_col, { cols: "6" }, {
-							default: (0, vue.withCtx)(() => [_cache[1] || (_cache[1] = (0, vue.createElementVNode)("div", { class: "stsbiginfolabel" }, " CPU ", -1)), (0, vue.createElementVNode)("div", _hoisted_3, [(0, vue.createTextVNode)((0, vue.toDisplayString)(round2Places(CPU.value)) + "% ", 1), (0, vue.createVNode)(_component_v_progress_circular, {
+							default: (0, vue.withCtx)(() => [_cache[1] || (_cache[1] = (0, vue.createElementVNode)("div", { class: "stsbiginfolabel" }, "CPU", -1)), (0, vue.createElementVNode)("div", _hoisted_3, [(0, vue.createTextVNode)((0, vue.toDisplayString)(round2Places(CPU.value)) + "% ", 1), (0, vue.createVNode)(_component_v_progress_circular, {
 								class: "mb-1",
 								rotate: 360,
 								size: 20,
@@ -9577,7 +9944,7 @@ var UXModelInstrumentServiceSmall_default = /*#__PURE__*/ _plugin_vue_export_hel
 							])])]),
 							_: 1
 						}), (0, vue.createVNode)(_component_v_col, { cols: "6" }, {
-							default: (0, vue.withCtx)(() => [_cache[2] || (_cache[2] = (0, vue.createElementVNode)("div", { class: "stsbiginfolabel" }, " Velocity ", -1)), (0, vue.createElementVNode)("div", _hoisted_4, [(0, vue.createTextVNode)((0, vue.toDisplayString)(velocityFormat(Velocity.value)) + " ", 1), (0, vue.createVNode)(_component_v_progress_circular, {
+							default: (0, vue.withCtx)(() => [_cache[2] || (_cache[2] = (0, vue.createElementVNode)("div", { class: "stsbiginfolabel" }, "Velocity", -1)), (0, vue.createElementVNode)("div", _hoisted_4, [(0, vue.createTextVNode)((0, vue.toDisplayString)(velocityFormat(Velocity.value)) + " ", 1), (0, vue.createVNode)(_component_v_progress_circular, {
 								class: "mb-1",
 								rotate: 360,
 								size: 18,
@@ -9598,7 +9965,7 @@ var UXModelInstrumentServiceSmall_default = /*#__PURE__*/ _plugin_vue_export_hel
 						class: "mb-3"
 					}, {
 						default: (0, vue.withCtx)(() => [(0, vue.createVNode)(_component_v_col, { cols: "6" }, {
-							default: (0, vue.withCtx)(() => [_cache[3] || (_cache[3] = (0, vue.createElementVNode)("div", { class: "stsbiginfolabel" }, " Active Rx Count ", -1)), (0, vue.createElementVNode)("div", _hoisted_5, [(0, vue.createTextVNode)((0, vue.toDisplayString)(ActiveRequestCount.value) + " ", 1), (0, vue.createVNode)(_component_v_progress_circular, {
+							default: (0, vue.withCtx)(() => [_cache[3] || (_cache[3] = (0, vue.createElementVNode)("div", { class: "stsbiginfolabel" }, "Active Rx Count", -1)), (0, vue.createElementVNode)("div", _hoisted_5, [(0, vue.createTextVNode)((0, vue.toDisplayString)(ActiveRequestCount.value) + " ", 1), (0, vue.createVNode)(_component_v_progress_circular, {
 								rotate: 360,
 								size: 18,
 								width: ActiveRequestWidth.value,
@@ -9611,7 +9978,7 @@ var UXModelInstrumentServiceSmall_default = /*#__PURE__*/ _plugin_vue_export_hel
 							])])]),
 							_: 1
 						}), (0, vue.createVNode)(_component_v_col, { cols: "6" }, {
-							default: (0, vue.withCtx)(() => [_cache[4] || (_cache[4] = (0, vue.createElementVNode)("div", { class: "stsbiginfolabel" }, " Connections ", -1)), (0, vue.createElementVNode)("div", _hoisted_6, [(0, vue.createTextVNode)((0, vue.toDisplayString)(ConnectionCount.value) + " ", 1), (0, vue.createVNode)(_component_v_progress_circular, {
+							default: (0, vue.withCtx)(() => [_cache[4] || (_cache[4] = (0, vue.createElementVNode)("div", { class: "stsbiginfolabel" }, "Connections", -1)), (0, vue.createElementVNode)("div", _hoisted_6, [(0, vue.createTextVNode)((0, vue.toDisplayString)(ConnectionCount.value) + " ", 1), (0, vue.createVNode)(_component_v_progress_circular, {
 								rotate: 360,
 								size: 18,
 								width: ConnectionCountWidth.value,
@@ -9647,7 +10014,7 @@ var UXModelInstrumentServiceSmall_default = /*#__PURE__*/ _plugin_vue_export_hel
 							default: (0, vue.withCtx)(() => [..._cache[6] || (_cache[6] = [(0, vue.createElementVNode)("div", { style: {
 								"white-space": "nowrap",
 								"text-align": "right"
-							} }, " Timer: ", -1)])]),
+							} }, "Timer:", -1)])]),
 							_: 1
 						}), (0, vue.createVNode)(_component_v_col, { cols: "6" }, {
 							default: (0, vue.withCtx)(() => [(0, vue.createElementVNode)("div", _hoisted_8, (0, vue.toDisplayString)(Timer.value), 1)]),
@@ -9725,7 +10092,7 @@ var UXModelInstrumentServiceSmall_default = /*#__PURE__*/ _plugin_vue_export_hel
 							default: (0, vue.withCtx)(() => [..._cache[12] || (_cache[12] = [(0, vue.createElementVNode)("div", { style: {
 								"white-space": "nowrap",
 								"text-align": "right"
-							} }, " vCPU: ", -1)])]),
+							} }, "vCPU:", -1)])]),
 							_: 1
 						}), (0, vue.createVNode)(_component_v_col, { cols: "6" }, {
 							default: (0, vue.withCtx)(() => [(0, vue.createElementVNode)("div", _hoisted_14, (0, vue.toDisplayString)(CoreCount.value), 1)]),
@@ -9751,7 +10118,7 @@ var UXModelInstrumentServiceSmall_default = /*#__PURE__*/ _plugin_vue_export_hel
 			});
 		};
 	}
-}), [["__scopeId", "data-v-40b280ab"]]);
+}), [["__scopeId", "data-v-113819e0"]]);
 //#endregion
 //#region src/components/UXModelNode.vue?vue&type=script&setup=true&lang.ts
 var _hoisted_1$2 = ["value"];
@@ -9768,6 +10135,7 @@ var UXModelNode_default = /* @__PURE__ */ (0, vue.defineComponent)({
 	emits: ["myclick"],
 	setup(__props, { emit: __emit }) {
 		chalk$1.level = 3;
+		console.debug(`UXModelNode(): ModelStore`);
 		const store = ModelStore();
 		const props = __props;
 		const emit = __emit;
@@ -9877,6 +10245,117 @@ function bind(fn, thisArg) {
 var { toString } = Object.prototype;
 var { getPrototypeOf } = Object;
 var { iterator, toStringTag } = Symbol;
+var hasOwnProperty = (({ hasOwnProperty }) => (obj, prop) => hasOwnProperty.call(obj, prop))(Object.prototype);
+var isUnsafeObjectKey = (prop) => typeof prop === "string" && (prop === "__proto__" || prop === "constructor" || prop === "prototype");
+/**
+* Determine whether an inherited object must be treated as a shared-prototype
+* boundary. Cross-realm Object.prototype objects cannot be distinguished
+* reliably from application-created null-prototype objects because their
+* properties are mutable, so all inherited terminal prototypes are excluded
+* as a fail-closed boundary. A null-prototype source still keeps its own
+* properties, as produced by mergeConfig and other safe materialization paths.
+*
+* @param {*} obj The object to inspect
+* @param {*} prototype The object's prototype
+* @param {boolean} source Whether obj is the original traversal source
+*
+* @returns {boolean} True when obj is a safe prototype traversal boundary
+*/
+var isPrototypeBoundary = (obj, prototype, source) => obj === Object.prototype || !source && prototype === null;
+/**
+* Determine whether an object can retain its identity through code paths that
+* add, replace, and remove config properties without bypassing unsafe-key
+* filtering. Immutable objects, unsafe-key-bearing objects, and objects with
+* accessor or restricted data properties must be materialized instead.
+*
+* @param {*} obj The object to inspect
+*
+* @returns {boolean} True when every own property is safe and fully mutable
+*/
+var isSafeAndFullyMutable = (obj) => {
+	if (!Object.isExtensible(obj)) return false;
+	const props = Object.getOwnPropertyNames(obj);
+	if (Object.getOwnPropertySymbols) props.push(...Object.getOwnPropertySymbols(obj));
+	return props.every((prop) => {
+		if (isUnsafeObjectKey(prop)) return false;
+		const descriptor = Object.getOwnPropertyDescriptor(obj, prop);
+		return !!descriptor && descriptor.configurable && descriptor.writable === true;
+	});
+};
+/**
+* Walk the prototype chain (excluding the source realm's Object.prototype)
+* looking for an own `prop`. This distinguishes genuine own/inherited members
+* — including class accessors and template prototypes — from members injected
+* via Object.prototype pollution (e.g. `Object.prototype.username = '...'`),
+* which live on Object.prototype itself and are therefore never matched.
+*
+* @param {*} thing The value whose chain to inspect
+* @param {string|symbol} prop The property key to look for
+*
+* @returns {boolean} True when `prop` is owned below Object.prototype
+*/
+var hasOwnInPrototypeChain = (thing, prop) => {
+	let obj = thing;
+	const seen = [];
+	while (obj != null) {
+		if (seen.indexOf(obj) !== -1) return false;
+		seen.push(obj);
+		const prototype = getPrototypeOf(obj);
+		if (isPrototypeBoundary(obj, prototype, obj === thing)) return false;
+		if (hasOwnProperty(obj, prop)) return true;
+		obj = prototype;
+	}
+	return false;
+};
+/**
+* Read `obj[prop]` only when it is safe from Object.prototype pollution. Own
+* properties and members inherited from a non-Object.prototype source (a class
+* instance or template object) are honored; a value reachable only through a
+* polluted Object.prototype is ignored and `undefined` is returned.
+*
+* @param {*} obj The source object
+* @param {string|symbol} prop The property key to read
+*
+* @returns {*} The resolved value, or undefined when unsafe/absent
+*/
+var getSafeProp = (obj, prop) => obj != null && hasOwnInPrototypeChain(obj, prop) ? obj[prop] : void 0;
+/**
+* Flatten an object and its application-defined prototype chain into a
+* null-prototype object. Members inherited only from the source realm's
+* Object.prototype are deliberately excluded, while class/template members
+* below that boundary are preserved.
+*
+* @param {*} thing The value to flatten
+*
+* @returns {*} A null-prototype copy, or the original value when it is already
+* structurally safe or is not an object
+*/
+var toSafeFlatObject = (thing) => {
+	if (thing == null || typeof thing !== "object" && typeof thing !== "function") return thing;
+	const sourcePrototype = getPrototypeOf(thing);
+	if (sourcePrototype === null && isSafeAndFullyMutable(thing)) return thing;
+	const result = Object.create(null);
+	const merged = Object.create(null);
+	const seen = [];
+	let current = thing;
+	while (current != null) {
+		if (seen.indexOf(current) !== -1) break;
+		seen.push(current);
+		const prototype = current === thing ? sourcePrototype : getPrototypeOf(current);
+		if (isPrototypeBoundary(current, prototype, current === thing)) break;
+		const props = Object.getOwnPropertyNames(current);
+		if (Object.getOwnPropertySymbols) props.push(...Object.getOwnPropertySymbols(current));
+		for (const prop of props) {
+			if (isUnsafeObjectKey(prop)) continue;
+			if (!hasOwnProperty(merged, prop)) {
+				result[prop] = thing[prop];
+				merged[prop] = true;
+			}
+		}
+		current = prototype;
+	}
+	return result;
+};
 var kindOf = ((cache) => (thing) => {
 	const str = toString.call(thing);
 	return cache[str] || (cache[str] = str.slice(8, -1).toLowerCase());
@@ -9979,9 +10458,9 @@ var isBoolean = (thing) => thing === true || thing === false;
 * @returns {boolean} True if value is a plain Object, otherwise false
 */
 var isPlainObject = (val) => {
-	if (kindOf(val) !== "object") return false;
+	if (!isObject(val)) return false;
 	const prototype = getPrototypeOf(val);
-	return (prototype === null || prototype === Object.prototype || Object.getPrototypeOf(prototype) === null) && !(toStringTag in val) && !(iterator in val);
+	return (prototype === null || prototype === Object.prototype || getPrototypeOf(prototype) === null) && !hasOwnInPrototypeChain(val, toStringTag) && !hasOwnInPrototypeChain(val, iterator);
 };
 /**
 * Determine if a value is an empty object (safely handles Buffers)
@@ -10053,6 +10532,7 @@ var isBlob = kindOfTest("Blob");
 * @returns {boolean} True if value is a FileList, otherwise false
 */
 var isFileList = kindOfTest("FileList");
+var isSet = kindOfTest("Set");
 /**
 * Determine if a value is a Stream
 *
@@ -10387,7 +10867,6 @@ var toCamelCase = (str) => {
 		return p1.toUpperCase() + p2;
 	});
 };
-var hasOwnProperty = (({ hasOwnProperty }) => (obj, prop) => hasOwnProperty.call(obj, prop))(Object.prototype);
 var { propertyIsEnumerable } = Object.prototype;
 /**
 * Determine if a value is a RegExp object
@@ -10475,11 +10954,20 @@ var toJSONObject = (obj) => {
 			if (isBuffer(source)) return source;
 			if (!("toJSON" in source)) {
 				visited.add(source);
-				const target = isArray(source) ? [] : {};
-				forEach(source, (value, key) => {
-					const reducedValue = visit(value);
-					!isUndefined(reducedValue) && (target[key] = reducedValue);
-				});
+				let target;
+				if (isSet(source)) {
+					target = [];
+					for (const value of source) {
+						const reducedValue = visit(value);
+						!isUndefined(reducedValue) && target.push(reducedValue);
+					}
+				} else {
+					target = isArray(source) ? [] : {};
+					forEach(source, (value, key) => {
+						const reducedValue = visit(value);
+						!isUndefined(reducedValue) && (target[key] = reducedValue);
+					});
+				}
 				visited.delete(source);
 				return target;
 			}
@@ -10530,6 +11018,18 @@ var _setImmediate = ((setImmediateSupported, postMessageSupported) => {
 */
 var asap = typeof queueMicrotask !== "undefined" ? queueMicrotask.bind(_global) : typeof process !== "undefined" && process.nextTick || _setImmediate;
 var isIterable = (thing) => thing != null && isFunction$1(thing[iterator]);
+/**
+* Determine if a value is iterable via an iterator that is NOT sourced solely
+* from a polluted Object.prototype. Use this instead of `isIterable` whenever
+* the iterable comes from untrusted input (e.g. user-supplied header sources),
+* so `Object.prototype[Symbol.iterator] = ...` cannot turn an ordinary object
+* into an attacker-controlled entries iterator.
+*
+* @param {*} thing The value to test
+*
+* @returns {boolean} True if value has a non-polluted iterator
+*/
+var isSafeIterable = (thing) => thing != null && hasOwnInPrototypeChain(thing, iterator) && isIterable(thing);
 var utils_default = {
 	isArray,
 	isArrayBuffer,
@@ -10574,6 +11074,9 @@ var utils_default = {
 	isHTMLForm,
 	hasOwnProperty,
 	hasOwnProp: hasOwnProperty,
+	hasOwnInPrototypeChain,
+	getSafeProp,
+	toSafeFlatObject,
 	reduceDescriptors,
 	freezeMethods,
 	toObjectSet,
@@ -10589,7 +11092,8 @@ var utils_default = {
 	isThenable,
 	setImmediate: _setImmediate,
 	asap,
-	isIterable
+	isIterable,
+	isSafeIterable
 };
 //#endregion
 //#region node_modules/axios/lib/helpers/parseHeaders.js
@@ -10635,10 +11139,12 @@ var parseHeaders_default = (rawHeaders) => {
 		i = line.indexOf(":");
 		key = line.substring(0, i).trim().toLowerCase();
 		val = line.substring(i + 1).trim();
-		if (!key || parsed[key] && ignoreDuplicateOf[key]) return;
-		if (key === "set-cookie") if (parsed[key]) parsed[key].push(val);
-		else parsed[key] = [val];
-		else parsed[key] = parsed[key] ? parsed[key] + ", " + val : val;
+		const hasKey = utils_default.hasOwnProp(parsed, key);
+		if (!key || hasKey && utils_default.hasOwnProp(ignoreDuplicateOf, key)) return;
+		if (key === "set-cookie") {
+			if (hasKey) parsed[key].push(val);
+			else parsed[key] = [val];
+		} else parsed[key] = hasKey ? parsed[key] + ", " + val : val;
 	});
 	return parsed;
 };
@@ -10676,7 +11182,7 @@ function toByteStringHeaderObject(headers) {
 }
 //#endregion
 //#region node_modules/axios/lib/core/AxiosHeaders.js
-var $internals = Symbol("internals");
+var $internals$1 = Symbol("internals");
 function normalizeHeader(header) {
 	return header && String(header).trim().toLowerCase();
 }
@@ -10691,6 +11197,69 @@ function parseTokens(str) {
 	while (match = tokensRE.exec(str)) tokens[match[1]] = match[2];
 	return tokens;
 }
+var parameterNameRE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+function trimOWS(value) {
+	let start = 0;
+	let end = value.length;
+	while (start < end) {
+		const code = value.charCodeAt(start);
+		if (code !== 9 && code !== 32) break;
+		start += 1;
+	}
+	while (end > start) {
+		const code = value.charCodeAt(end - 1);
+		if (code !== 9 && code !== 32) break;
+		end -= 1;
+	}
+	return start === 0 && end === value.length ? value : value.slice(start, end);
+}
+function decodeQuotedString(value) {
+	const last = value.length - 1;
+	if (last < 1 || value.charCodeAt(0) !== 34 || value.charCodeAt(last) !== 34) return value;
+	let decoded = "";
+	for (let i = 1; i < last; i++) {
+		const code = value.charCodeAt(i);
+		if (code === 34) return value;
+		if (code === 92) {
+			i += 1;
+			if (i >= last) return value;
+		}
+		decoded += value[i];
+	}
+	return decoded;
+}
+function parseParameters(value) {
+	const parameters = Object.create(null);
+	const str = String(value);
+	let start = 0;
+	let quoted = false;
+	let escaped = false;
+	function parseParameter(end) {
+		const part = trimOWS(str.slice(start, end));
+		const equals = part.indexOf("=");
+		if (equals < 1) return;
+		const name = trimOWS(part.slice(0, equals));
+		if (!parameterNameRE.test(name)) return;
+		const normalizedName = name.toLowerCase();
+		if (normalizedName === "__proto__" || normalizedName === "constructor" || normalizedName === "prototype") return;
+		const parameterValue = trimOWS(part.slice(equals + 1));
+		parameters[normalizedName] = decodeQuotedString(parameterValue);
+	}
+	for (let i = 0; i < str.length; i++) {
+		const code = str.charCodeAt(i);
+		if (quoted) {
+			if (escaped) escaped = false;
+			else if (code === 92) escaped = true;
+			else if (code === 34) quoted = false;
+		} else if (code === 34) quoted = true;
+		else if (code === 44 || code === 59) {
+			parseParameter(i);
+			start = i + 1;
+		}
+	}
+	parseParameter(str.length);
+	return parameters;
+}
 var isValidHeaderName = (str) => /^[-_a-zA-Z0-9^`|~,!#$%&'*+.]+$/.test(str.trim());
 function matchHeaderValue(context, value, header, filter, isHeaderNameFilter) {
 	if (utils_default.isFunction(filter)) return filter.call(this, value, header);
@@ -10735,11 +11304,15 @@ var AxiosHeaders = class {
 		const setHeaders = (headers, _rewrite) => utils_default.forEach(headers, (_value, _header) => setHeader(_value, _header, _rewrite));
 		if (utils_default.isPlainObject(header) || header instanceof this.constructor) setHeaders(header, valueOrRewrite);
 		else if (utils_default.isString(header) && (header = header.trim()) && !isValidHeaderName(header)) setHeaders(parseHeaders_default(header), valueOrRewrite);
-		else if (utils_default.isObject(header) && utils_default.isIterable(header)) {
-			let obj = {}, dest, key;
+		else if (utils_default.isObject(header) && utils_default.isSafeIterable(header)) {
+			let obj = Object.create(null), dest, key;
 			for (const entry of header) {
 				if (!utils_default.isArray(entry)) throw new TypeError("Object iterator must return a key-value pair");
-				obj[key = entry[0]] = (dest = obj[key]) ? utils_default.isArray(dest) ? [...dest, entry[1]] : [dest, entry[1]] : entry[1];
+				key = entry[0];
+				if (utils_default.hasOwnProp(obj, key)) {
+					dest = obj[key];
+					obj[key] = utils_default.isArray(dest) ? [...dest, entry[1]] : [dest, entry[1]];
+				} else obj[key] = entry[1];
 			}
 			setHeaders(obj, valueOrRewrite);
 		} else header != null && setHeader(valueOrRewrite, header, rewrite);
@@ -10831,7 +11404,8 @@ var AxiosHeaders = class {
 		return Object.entries(this.toJSON()).map(([header, value]) => header + ": " + value).join("\n");
 	}
 	getSetCookie() {
-		return this.get("set-cookie") || [];
+		const value = this.get("set-cookie");
+		return utils_default.isArray(value) ? value : value == null || value === false ? [] : [value];
 	}
 	get [Symbol.toStringTag]() {
 		return "AxiosHeaders";
@@ -10839,13 +11413,16 @@ var AxiosHeaders = class {
 	static from(thing) {
 		return thing instanceof this ? thing : new this(thing);
 	}
+	static parseParameters(value) {
+		return parseParameters(value);
+	}
 	static concat(first, ...targets) {
 		const computed = new this(first);
 		targets.forEach((target) => computed.set(target));
 		return computed;
 	}
 	static accessor(header) {
-		const accessors = (this[$internals] = this[$internals] = { accessors: {} }).accessors;
+		const accessors = (this[$internals$1] = this[$internals$1] = { accessors: {} }).accessors;
 		const prototype = this.prototype;
 		function defineAccessor(_header) {
 			const lHeader = normalizeHeader(_header);
@@ -10920,10 +11497,34 @@ function redactConfig(config, redactKeys) {
 	};
 	return visit(config);
 }
+function stringifySafely$1(value) {
+	try {
+		return String(value);
+	} catch (err) {
+		return "";
+	}
+}
+function aggregateErrorMessage(error) {
+	return error.errors.map((entry) => {
+		try {
+			return entry && entry.message ? stringifySafely$1(entry.message) : stringifySafely$1(entry);
+		} catch (err) {
+			return "";
+		}
+	}).filter(Boolean).join("; ") || error.name || "AggregateError";
+}
 var AxiosError = class AxiosError extends Error {
 	static from(error, code, config, request, response, customProps) {
-		const axiosError = new AxiosError(error.message, code || error.code, config, request, response);
-		axiosError.cause = error;
+		let message = error.message;
+		if (!message && utils_default.isArray(error.errors) && error.errors.length) message = aggregateErrorMessage(error);
+		const axiosError = new AxiosError(message, code || error.code, config, request, response);
+		Object.defineProperty(axiosError, "cause", {
+			__proto__: null,
+			value: error,
+			writable: true,
+			enumerable: false,
+			configurable: true
+		});
 		axiosError.name = error.name;
 		if (error.status != null && axiosError.status == null) axiosError.status = error.status;
 		customProps && Object.assign(axiosError, customProps);
@@ -10992,8 +11593,6 @@ AxiosError.ERR_CANCELED = "ERR_CANCELED";
 AxiosError.ERR_NOT_SUPPORT = "ERR_NOT_SUPPORT";
 AxiosError.ERR_INVALID_URL = "ERR_INVALID_URL";
 AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED = "ERR_FORM_DATA_DEPTH_EXCEEDED";
-//#endregion
-//#region node_modules/axios/lib/helpers/toFormData.js
 /**
 * Determines if the given thing is a array or js object.
 *
@@ -11068,29 +11667,44 @@ var predicates = utils_default.toFlatObject(utils_default, {}, null, function fi
 function toFormData(obj, formData, options) {
 	if (!utils_default.isObject(obj)) throw new TypeError("target must be an object");
 	formData = formData || new FormData();
-	options = utils_default.toFlatObject(options, {
-		metaTokens: true,
-		dots: false,
-		indexes: false
-	}, false, function defined(option, source) {
-		return !utils_default.isUndefined(source[option]);
-	});
-	const metaTokens = options.metaTokens;
-	const visitor = options.visitor || defaultVisitor;
-	const dots = options.dots;
-	const indexes = options.indexes;
-	const _Blob = options.Blob || typeof Blob !== "undefined" && Blob;
-	const maxDepth = options.maxDepth === void 0 ? 100 : options.maxDepth;
+	const option = (name, fallback) => {
+		const value = utils_default.getSafeProp(options, name);
+		return utils_default.isUndefined(value) ? fallback : value;
+	};
+	const metaTokens = option("metaTokens", true);
+	const visitor = option("visitor") || defaultVisitor;
+	const dots = option("dots", false);
+	const indexes = option("indexes", false);
+	const _Blob = option("Blob") || typeof Blob !== "undefined" && Blob;
+	const maxDepth = option("maxDepth", 100);
 	const useBlob = _Blob && utils_default.isSpecCompliantForm(formData);
+	const stack = [];
 	if (!utils_default.isFunction(visitor)) throw new TypeError("visitor must be a function");
 	function convertValue(value) {
 		if (value === null) return "";
 		if (utils_default.isDate(value)) return value.toISOString();
 		if (utils_default.isBoolean(value)) return value.toString();
 		if (!useBlob && utils_default.isBlob(value)) throw new AxiosError("Blob is not supported. Use a Buffer instead.");
-		if (utils_default.isArrayBuffer(value) || utils_default.isTypedArray(value)) return useBlob && typeof Blob === "function" ? new Blob([value]) : Buffer.from(value);
+		if (utils_default.isArrayBuffer(value) || utils_default.isTypedArray(value)) {
+			if (useBlob && typeof _Blob === "function") return new _Blob([value]);
+			throw new AxiosError("Blob is not supported. Use a Buffer instead.", AxiosError.ERR_NOT_SUPPORT);
+		}
 		return value;
 	}
+	function throwIfMaxDepthExceeded(depth) {
+		if (depth > maxDepth) throw new AxiosError("Object is too deeply nested (" + depth + " levels). Max depth: " + maxDepth, AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED);
+	}
+	function stringifyWithDepthLimit(value, depth) {
+		if (maxDepth === Infinity) return JSON.stringify(value);
+		const ancestors = [];
+		return JSON.stringify(value, function limitDepth(_key, currentValue) {
+			if (!utils_default.isObject(currentValue)) return currentValue;
+			while (ancestors.length && ancestors[ancestors.length - 1] !== this) ancestors.pop();
+			ancestors.push(currentValue);
+			throwIfMaxDepthExceeded(depth + ancestors.length - 1);
+			return currentValue;
+		});
+	}
 	/**
 	* Default visitor.
 	*
@@ -11110,7 +11724,7 @@ function toFormData(obj, formData, options) {
 		if (value && !path && typeof value === "object") {
 			if (utils_default.endsWith(key, "{}")) {
 				key = metaTokens ? key : key.slice(0, -2);
-				value = JSON.stringify(value);
+				value = stringifyWithDepthLimit(value, 1);
 			} else if (utils_default.isArray(value) && isFlatArray(value) || (utils_default.isFileList(value) || utils_default.endsWith(key, "[]")) && (arr = utils_default.toArray(value))) {
 				key = removeBrackets(key);
 				arr.forEach(function each(el, index) {
@@ -11123,7 +11737,6 @@ function toFormData(obj, formData, options) {
 		formData.append(renderKey(path, key, dots), convertValue(value));
 		return false;
 	}
-	const stack = [];
 	const exposedHelpers = Object.assign(predicates, {
 		defaultVisitor,
 		convertValue,
@@ -11131,7 +11744,7 @@ function toFormData(obj, formData, options) {
 	});
 	function build(value, path, depth = 0) {
 		if (utils_default.isUndefined(value)) return;
-		if (depth > maxDepth) throw new AxiosError("Object is too deeply nested (" + depth + " levels). Max depth: " + maxDepth, AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED);
+		throwIfMaxDepthExceeded(depth);
 		if (stack.indexOf(value) !== -1) throw new Error("Circular reference detected in " + path.join("."));
 		stack.push(value);
 		utils_default.forEach(value, function each(el, key) {
@@ -11183,9 +11796,7 @@ prototype.append = function append(name, value) {
 	this._pairs.push([name, value]);
 };
 prototype.toString = function toString(encoder) {
-	const _encode = encoder ? function(value) {
-		return encoder.call(this, value, encode$1);
-	} : encode$1;
+	const _encode = encoder ? (value) => encoder.call(this, value, encode$1) : encode$1;
 	return this._pairs.map(function each(pair) {
 		return _encode(pair[0]) + "=" + _encode(pair[1]);
 	}, "").join("&");
@@ -11214,9 +11825,10 @@ function encode(val) {
 */
 function buildURL(url, params, options) {
 	if (!params) return url;
-	const _encode = options && options.encode || encode;
+	url = url || "";
 	const _options = utils_default.isFunction(options) ? { serialize: options } : options;
-	const serializeFn = _options && _options.serialize;
+	const _encode = utils_default.getSafeProp(_options, "encode") || encode;
+	const serializeFn = utils_default.getSafeProp(_options, "serialize");
 	let serializedParams;
 	if (serializeFn) serializedParams = serializeFn(params, _options);
 	else serializedParams = utils_default.isURLSearchParams(params) ? params.toString() : new AxiosURLSearchParams(params, _options).toString(_encode);
@@ -11229,9 +11841,38 @@ function buildURL(url, params, options) {
 }
 //#endregion
 //#region node_modules/axios/lib/core/InterceptorManager.js
+var $internals = Symbol("internals");
+function countHandlers(handlers) {
+	return handlers ? handlers.length : 0;
+}
+function trimHandlers(handlers) {
+	if (!handlers) return;
+	while (handlers.length && handlers[handlers.length - 1] === null) handlers.pop();
+}
+function syncHandlerEntries(manager, internals) {
+	const handlers = manager.handlers;
+	const length = countHandlers(handlers);
+	if (handlers !== internals.handlersRef) {
+		internals.handlersRef = handlers;
+		internals.handlerEntries.clear();
+	} else if (length !== internals.handlersLength) {
+		if (!length) internals.handlerEntries.clear();
+		else internals.handlerEntries.forEach(function removeStaleEntry(entry, id) {
+			if (handlers[entry.index] !== entry.handler) internals.handlerEntries.delete(id);
+		});
+	}
+	internals.handlersLength = length;
+}
 var InterceptorManager = class {
 	constructor() {
 		this.handlers = [];
+		this[$internals] = {
+			handlersRef: this.handlers,
+			handlersLength: this.handlers.length,
+			handlerEntries: /* @__PURE__ */ new Map(),
+			iterationDepth: 0,
+			nextId: 0
+		};
 	}
 	/**
 	* Add a new interceptor to the stack
@@ -11243,13 +11884,23 @@ var InterceptorManager = class {
 	* @return {Number} An ID used to remove interceptor later
 	*/
 	use(fulfilled, rejected, options) {
-		this.handlers.push({
+		const handler = {
 			fulfilled,
 			rejected,
 			synchronous: options ? options.synchronous : false,
 			runWhen: options ? options.runWhen : null
+		};
+		const internals = this[$internals];
+		if (this.handlers == null) this.handlers = [];
+		syncHandlerEntries(this, internals);
+		const id = internals.nextId++;
+		this.handlers.push(handler);
+		internals.handlerEntries.set(id, {
+			handler,
+			index: this.handlers.length - 1
 		});
-		return this.handlers.length - 1;
+		internals.handlersLength = this.handlers.length;
+		return id;
 	}
 	/**
 	* Remove an interceptor from the stack
@@ -11259,7 +11910,18 @@ var InterceptorManager = class {
 	* @returns {void}
 	*/
 	eject(id) {
-		if (this.handlers[id]) this.handlers[id] = null;
+		const internals = this[$internals];
+		syncHandlerEntries(this, internals);
+		const entry = internals.handlerEntries.get(id);
+		if (entry) {
+			internals.handlerEntries.delete(id);
+			if (this.handlers[entry.index] !== entry.handler) return;
+			this.handlers[entry.index] = null;
+			if (!internals.iterationDepth) {
+				trimHandlers(this.handlers);
+				internals.handlersLength = this.handlers.length;
+			}
+		}
 	}
 	/**
 	* Clear all interceptors from the stack
@@ -11267,7 +11929,10 @@ var InterceptorManager = class {
 	* @returns {void}
 	*/
 	clear() {
-		if (this.handlers) this.handlers = [];
+		if (this.handlers) {
+			this.handlers = [];
+			syncHandlerEntries(this, this[$internals]);
+		}
 	}
 	/**
 	* Iterate over all the registered interceptors
@@ -11280,9 +11945,20 @@ var InterceptorManager = class {
 	* @returns {void}
 	*/
 	forEach(fn) {
-		utils_default.forEach(this.handlers, function forEachHandler(h) {
-			if (h !== null) fn(h);
-		});
+		const internals = this[$internals];
+		syncHandlerEntries(this, internals);
+		internals.iterationDepth++;
+		try {
+			utils_default.forEach(this.handlers, function forEachHandler(h) {
+				if (h !== null) fn(h);
+			});
+		} finally {
+			if (!--internals.iterationDepth) {
+				syncHandlerEntries(this, internals);
+				trimHandlers(this.handlers);
+				internals.handlersLength = countHandlers(this.handlers);
+			}
+		}
 	}
 };
 //#endregion
@@ -11292,7 +11968,8 @@ var transitional_default = {
 	forcedJSONParsing: true,
 	clarifyTimeoutError: false,
 	legacyInterceptorReqResOrdering: true,
-	advertiseZstdAcceptEncoding: false
+	advertiseZstdAcceptEncoding: false,
+	validateStatusUndefinedResolves: true
 };
 //#endregion
 //#region node_modules/axios/lib/platform/browser/index.js
@@ -11380,6 +12057,10 @@ function toURLEncodedForm(data, options) {
 }
 //#endregion
 //#region node_modules/axios/lib/helpers/formDataToJSON.js
+var MAX_DEPTH = 100;
+function throwIfDepthExceeded(index) {
+	if (index > MAX_DEPTH) throw new AxiosError("FormData field is too deeply nested (" + index + " levels). Max depth: " + MAX_DEPTH, AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED);
+}
 /**
 * It takes a string like `foo[x][y][z]` and returns an array like `['foo', 'x', 'y', 'z']
 *
@@ -11388,9 +12069,14 @@ function toURLEncodedForm(data, options) {
 * @returns An array of strings.
 */
 function parsePropPath(name) {
-	return utils_default.matchAll(/\w+|\[(\w*)]/g, name).map((match) => {
-		return match[0] === "[]" ? "" : match[1] || match[0];
-	});
+	const path = [];
+	const pattern = /[^.[\]]+|\[([^.[\]]*)]/g;
+	let match;
+	while ((match = pattern.exec(name)) !== null) {
+		throwIfDepthExceeded(path.length);
+		path.push(match[0] === "[]" ? "" : match[1] || match[0]);
+	}
+	return path;
 }
 /**
 * Convert an array to an object.
@@ -11420,6 +12106,7 @@ function arrayToObject(arr) {
 */
 function formDataToJSON(formData) {
 	function buildPath(path, value, target, index) {
+		throwIfDepthExceeded(index);
 		let name = path[index++];
 		if (name === "__proto__") return true;
 		const isNumericKey = Number.isFinite(+name);
@@ -11444,6 +12131,21 @@ function formDataToJSON(formData) {
 	return null;
 }
 //#endregion
+//#region node_modules/axios/lib/core/methodList.js
+var methodList = Object.freeze([
+	"get",
+	"delete",
+	"head",
+	"options",
+	"post",
+	"put",
+	"patch",
+	"purge",
+	"link",
+	"unlink",
+	"query"
+]);
+//#endregion
 //#region node_modules/axios/lib/defaults/index.js
 var own = (obj, key) => obj != null && utils_default.hasOwnProp(obj, key) ? obj[key] : void 0;
 /**
@@ -11540,15 +12242,7 @@ var defaults = {
 		"Content-Type": void 0
 	} }
 };
-utils_default.forEach([
-	"delete",
-	"get",
-	"head",
-	"post",
-	"put",
-	"patch",
-	"query"
-], (method) => {
+utils_default.forEach(methodList, (method) => {
 	defaults.headers[method] = {};
 });
 //#endregion
@@ -11612,6 +12306,22 @@ function settle(resolve, reject, response) {
 	else reject(new AxiosError("Request failed with status code " + response.status, response.status >= 400 && response.status < 500 ? AxiosError.ERR_BAD_REQUEST : AxiosError.ERR_BAD_RESPONSE, response.config, response.request, response));
 }
 //#endregion
+//#region node_modules/axios/lib/helpers/normalizeURLForProtocolCheck.js
+var urlParserControlCharacters = /[\t\n\r]/g;
+/**
+* Match WHATWG URL preprocessing before checking a URL's protocol.
+*
+* @param {string} url
+*
+* @returns {string}
+*/
+function normalizeURLForProtocolCheck(url) {
+	if (typeof url !== "string") return url;
+	let start = 0;
+	while (start < url.length && url.charCodeAt(start) <= 32) start++;
+	return url.slice(start).replace(urlParserControlCharacters, "");
+}
+//#endregion
 //#region node_modules/axios/lib/helpers/parseProtocol.js
 function parseProtocol(url) {
 	const match = /^([-+\w]{1,25}):(?:\/\/)?/.exec(url);
@@ -11658,7 +12368,7 @@ function speedometer(samplesCount, min) {
 * Throttle decorator
 * @param {Function} fn
 * @param {Number} freq
-* @return {Function}
+* @return {Array<Function>}
 */
 function throttle(fn, freq) {
 	let timestamp = 0;
@@ -11687,7 +12397,12 @@ function throttle(fn, freq) {
 		}
 	};
 	const flush = () => lastArgs && invoke(lastArgs);
-	return [throttled, flush];
+	const flushWith = (...args) => invoke(args);
+	return [
+		throttled,
+		flush,
+		flushWith
+	];
 }
 //#endregion
 //#region node_modules/axios/lib/helpers/progressEventReducer.js
@@ -11695,10 +12410,10 @@ var progressEventReducer = (listener, isDownloadStream, freq = 3) => {
 	let bytesNotified = 0;
 	const _speedometer = speedometer(50, 250);
 	return throttle((e) => {
-		if (!e || typeof e.loaded !== "number") return;
+		if (!e || !utils_default.isNumber(e.loaded)) return;
 		const rawLoaded = e.loaded;
 		const total = e.lengthComputable ? e.total : void 0;
-		const loaded = total != null ? Math.min(rawLoaded, total) : rawLoaded;
+		const loaded = Math.max(0, total != null ? Math.min(rawLoaded, total) : rawLoaded);
 		const progressBytes = Math.max(0, loaded - bytesNotified);
 		const rate = _speedometer(progressBytes);
 		bytesNotified = Math.max(bytesNotified, loaded);
@@ -11723,7 +12438,7 @@ var progressEventDecorator = (total, throttled) => {
 		loaded
 	}), throttled[1]];
 };
-var asyncDecorator = (fn) => (...args) => utils_default.asap(() => fn(...args));
+var asyncDecorator = (fn, scheduler = utils_default.asap) => (...args) => scheduler(() => fn(...args));
 //#endregion
 //#region node_modules/axios/lib/helpers/isURLSameOrigin.js
 var isURLSameOrigin_default = platform_default.hasStandardBrowserEnv ? ((origin, isMSIE) => (url) => {
@@ -11749,7 +12464,11 @@ var cookies_default = platform_default.hasStandardBrowserEnv ? {
 		for (let i = 0; i < cookies.length; i++) {
 			const cookie = cookies[i].replace(/^\s+/, "");
 			const eq = cookie.indexOf("=");
-			if (eq !== -1 && cookie.slice(0, eq) === name) return decodeURIComponent(cookie.slice(eq + 1));
+			if (eq !== -1 && cookie.slice(0, eq) === name) try {
+				return decodeURIComponent(cookie.slice(eq + 1));
+			} catch (e) {
+				return cookie.slice(eq + 1);
+			}
 		}
 		return null;
 	},
@@ -11787,10 +12506,33 @@ function isAbsoluteURL(url) {
 * @returns {string} The combined URL
 */
 function combineURLs(baseURL, relativeURL) {
-	return relativeURL ? baseURL.replace(/\/?\/$/, "") + "/" + relativeURL.replace(/^\/+/, "") : baseURL;
+	if (!relativeURL) return baseURL;
+	let end = baseURL.length;
+	while (end > 0 && baseURL.charCodeAt(end - 1) === 47) end--;
+	return baseURL.slice(0, end) + "/" + relativeURL.replace(/^\/+/, "");
 }
 //#endregion
 //#region node_modules/axios/lib/core/buildFullPath.js
+var malformedHttpProtocol = /^https?:(?!\/\/)/i;
+function redactFragment(fragment) {
+	if (!fragment) return fragment;
+	return fragment.replace(/(^|&)([^=&]*=)?[^&]+/g, (match, separator, parameterName = "") => {
+		return `${separator}${parameterName}${REDACTED}`;
+	});
+}
+function redactSensitiveURLParts(url) {
+	const redactedURL = url.replace(/^(https?:\/{0,2})[^/?#]*@/i, `$1${REDACTED}@`);
+	const fragmentIndex = redactedURL.indexOf("#");
+	const redactedURLWithoutFragment = (fragmentIndex === -1 ? redactedURL : redactedURL.slice(0, fragmentIndex)).replace(/([?&][^=&#]*=)[^&#]*/g, `$1${REDACTED}`);
+	if (fragmentIndex === -1) return redactedURLWithoutFragment;
+	return `${redactedURLWithoutFragment}#${redactFragment(redactedURL.slice(fragmentIndex + 1))}`;
+}
+function assertValidHttpProtocolURL(url, config) {
+	if (typeof url === "string") {
+		const normalizedURL = normalizeURLForProtocolCheck(url);
+		if (malformedHttpProtocol.test(normalizedURL)) throw new AxiosError(`Invalid URL ${JSON.stringify(redactSensitiveURLParts(normalizedURL))}: missing "//" after protocol`, AxiosError.ERR_INVALID_URL, config);
+	}
+}
 /**
 * Creates a new URL by combining the baseURL with the requestedURL,
 * only when the requestedURL is not already an absolute URL.
@@ -11801,14 +12543,22 @@ function combineURLs(baseURL, relativeURL) {
 *
 * @returns {string} The combined full path
 */
-function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
+function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls, config) {
+	assertValidHttpProtocolURL(requestedURL, config);
 	let isRelativeUrl = !isAbsoluteURL(requestedURL);
-	if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) return combineURLs(baseURL, requestedURL);
+	if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
+		assertValidHttpProtocolURL(baseURL, config);
+		return combineURLs(baseURL, requestedURL);
+	}
 	return requestedURL;
 }
 //#endregion
 //#region node_modules/axios/lib/core/mergeConfig.js
 var headersToObject = (thing) => thing instanceof AxiosHeaders ? { ...thing } : thing;
+var ownEnumerableKeys = (thing) => {
+	if (Object.getOwnPropertySymbols && Object.getOwnPropertyDescriptor) return Object.keys(thing).concat(Object.getOwnPropertySymbols(thing).filter((symbol) => Object.getOwnPropertyDescriptor(thing, symbol).enumerable));
+	return Object.keys(thing);
+};
 /**
 * Config-specific merge-function which creates a new config-object
 * by merging two configuration objects together.
@@ -11819,6 +12569,7 @@ var headersToObject = (thing) => thing instanceof AxiosHeaders ? { ...thing } :
 * @returns {Object} New object resulting from merging config2 to config1
 */
 function mergeConfig(config1, config2) {
+	config1 = config1 || {};
 	config2 = config2 || {};
 	const config = Object.create(null);
 	Object.defineProperty(config, "hasOwnProperty", {
@@ -11845,6 +12596,16 @@ function mergeConfig(config1, config2) {
 		if (!utils_default.isUndefined(b)) return getMergedValue(void 0, b);
 		else if (!utils_default.isUndefined(a)) return getMergedValue(void 0, a);
 	}
+	function getMergedTransitionalOption(prop) {
+		const transitional2 = utils_default.hasOwnProp(config2, "transitional") ? config2.transitional : void 0;
+		if (!utils_default.isUndefined(transitional2)) {
+			if (utils_default.isPlainObject(transitional2)) {
+				if (utils_default.hasOwnProp(transitional2, prop)) return transitional2[prop];
+			} else return;
+		}
+		const transitional1 = utils_default.hasOwnProp(config1, "transitional") ? config1.transitional : void 0;
+		if (utils_default.isPlainObject(transitional1) && utils_default.hasOwnProp(transitional1, prop)) return transitional1[prop];
+	}
 	function mergeDirectKeys(a, b, prop) {
 		if (utils_default.hasOwnProp(config2, prop)) return getMergedValue(a, b);
 		else if (utils_default.hasOwnProp(config1, prop)) return getMergedValue(void 0, a);
@@ -11858,7 +12619,7 @@ function mergeConfig(config1, config2) {
 		transformResponse: defaultToConfig2,
 		paramsSerializer: defaultToConfig2,
 		timeout: defaultToConfig2,
-		timeoutMessage: defaultToConfig2,
+		timeoutErrorMessage: defaultToConfig2,
 		withCredentials: defaultToConfig2,
 		withXSRFToken: defaultToConfig2,
 		adapter: defaultToConfig2,
@@ -11881,7 +12642,7 @@ function mergeConfig(config1, config2) {
 		validateStatus: mergeDirectKeys,
 		headers: (a, b, prop) => mergeDeepProperties(headersToObject(a), headersToObject(b), prop, true)
 	};
-	utils_default.forEach(Object.keys({
+	utils_default.forEach(ownEnumerableKeys({
 		...config1,
 		...config2
 	}), function computeConfigValue(prop) {
@@ -11890,20 +12651,37 @@ function mergeConfig(config1, config2) {
 		const configValue = merge(utils_default.hasOwnProp(config1, prop) ? config1[prop] : void 0, utils_default.hasOwnProp(config2, prop) ? config2[prop] : void 0, prop);
 		utils_default.isUndefined(configValue) && merge !== mergeDirectKeys || (config[prop] = configValue);
 	});
+	if (utils_default.hasOwnProp(config2, "validateStatus") && utils_default.isUndefined(config2.validateStatus) && getMergedTransitionalOption("validateStatusUndefinedResolves") === false) {
+		if (utils_default.hasOwnProp(config1, "validateStatus")) config.validateStatus = getMergedValue(void 0, config1.validateStatus);
+		else delete config.validateStatus;
+	}
 	return config;
 }
 //#endregion
-//#region node_modules/axios/lib/helpers/resolveConfig.js
+//#region node_modules/axios/lib/core/setFormDataHeaders.js
 var FORM_DATA_CONTENT_HEADERS = ["content-type", "content-length"];
+/**
+* Apply the headers generated by a FormData implementation to the request headers,
+* honoring the `formDataHeaderPolicy` option: with 'content-only', copy only the
+* content-* headers; otherwise merge all of them.
+*
+* @param {AxiosHeaders} headers - the request headers to mutate
+* @param {Object | null | undefined} formHeaders - headers produced by the FormData implementation
+* @param {String} [policy] - the resolved `formDataHeaderPolicy` config value
+*
+* @returns {void}
+*/
 function setFormDataHeaders(headers, formHeaders, policy) {
 	if (policy !== "content-only") {
 		headers.set(formHeaders);
 		return;
 	}
-	Object.entries(formHeaders).forEach(([key, val]) => {
+	Object.entries(formHeaders || {}).forEach(([key, val]) => {
 		if (FORM_DATA_CONTENT_HEADERS.includes(key.toLowerCase())) headers.set(key, val);
 	});
 }
+//#endregion
+//#region node_modules/axios/lib/helpers/resolveConfig.js
 /**
 * Encode a UTF-8 string to a Latin-1 byte string for use with btoa().
 * This is a modern replacement for the deprecated unescape(encodeURIComponent(str)) pattern.
@@ -11926,11 +12704,20 @@ function resolveConfig(config) {
 	const allowAbsoluteUrls = own("allowAbsoluteUrls");
 	const url = own("url");
 	newConfig.headers = headers = AxiosHeaders.from(headers);
-	newConfig.url = buildURL(buildFullPath(baseURL, url, allowAbsoluteUrls), own("params"), own("paramsSerializer"));
-	if (auth) headers.set("Authorization", "Basic " + btoa((auth.username || "") + ":" + (auth.password ? encodeUTF8$1(auth.password) : "")));
+	newConfig.url = buildURL(buildFullPath(baseURL, url, allowAbsoluteUrls, newConfig), own("params"), own("paramsSerializer"));
+	if (auth) {
+		const username = utils_default.getSafeProp(auth, "username") || "";
+		const password = utils_default.getSafeProp(auth, "password") || "";
+		try {
+			headers.set("Authorization", "Basic " + btoa(username + ":" + (password ? encodeUTF8$1(password) : "")));
+		} catch (e) {
+			throw AxiosError.from(e, AxiosError.ERR_BAD_OPTION_VALUE, config);
+		}
+	}
 	if (utils_default.isFormData(data)) {
+		const getHeaders = utils_default.getSafeProp(data, "getHeaders");
 		if (platform_default.hasStandardBrowserEnv || platform_default.hasStandardBrowserWebWorkerEnv || utils_default.isReactNative(data)) headers.setContentType(void 0);
-		else if (utils_default.isFunction(data.getHeaders)) setFormDataHeaders(headers, data.getHeaders(), own("formDataHeaderPolicy"));
+		else if (utils_default.isFunction(getHeaders)) setFormDataHeaders(headers, getHeaders.call(data), own("formDataHeaderPolicy"));
 	}
 	if (platform_default.hasStandardBrowserEnv) {
 		if (utils_default.isFunction(withXSRFToken)) withXSRFToken = withXSRFToken(newConfig);
@@ -11949,7 +12736,7 @@ var xhr_default = typeof XMLHttpRequest !== "undefined" && function(config) {
 		let { responseType, onUploadProgress, onDownloadProgress } = _config;
 		let onCanceled;
 		let uploadThrottled, downloadThrottled;
-		let flushUpload, flushDownload;
+		let flushUpload, flushDownload, flushDownloadWithEvent;
 		function done() {
 			flushUpload && flushUpload();
 			flushDownload && flushDownload();
@@ -11959,7 +12746,22 @@ var xhr_default = typeof XMLHttpRequest !== "undefined" && function(config) {
 		let request = new XMLHttpRequest();
 		request.open(_config.method.toUpperCase(), _config.url, true);
 		request.timeout = _config.timeout;
-		function onloadend() {
+		function onloadend(event) {
+			if (!request) return;
+			if (request.status === 0 && (parseProtocol(normalizeURLForProtocolCheck(_config.url)) || parseProtocol(platform_default.origin)) !== "file" && !(request.responseURL && request.responseURL.startsWith("file:"))) {
+				reject(new AxiosError("Request aborted", AxiosError.ECONNABORTED, config, request));
+				done();
+				request = null;
+				return;
+			}
+			try {
+				if (event) flushDownloadWithEvent && flushDownloadWithEvent(event);
+				else flushDownload && flushDownload();
+			} catch (err) {
+				setTimeout(() => {
+					throw err;
+				});
+			}
 			if (!request) return;
 			const responseHeaders = AxiosHeaders.from("getAllResponseHeaders" in request && request.getAllResponseHeaders());
 			settle(function _resolve(value) {
@@ -12012,7 +12814,7 @@ var xhr_default = typeof XMLHttpRequest !== "undefined" && function(config) {
 		if (!utils_default.isUndefined(_config.withCredentials)) request.withCredentials = !!_config.withCredentials;
 		if (responseType && responseType !== "json") request.responseType = _config.responseType;
 		if (onDownloadProgress) {
-			[downloadThrottled, flushDownload] = progressEventReducer(onDownloadProgress, true);
+			[downloadThrottled, flushDownload, flushDownloadWithEvent] = progressEventReducer(onDownloadProgress, true);
 			request.addEventListener("progress", downloadThrottled);
 		}
 		if (onUploadProgress && request.upload) {
@@ -12034,6 +12836,7 @@ var xhr_default = typeof XMLHttpRequest !== "undefined" && function(config) {
 		const protocol = parseProtocol(_config.url);
 		if (protocol && !platform_default.protocols.includes(protocol)) {
 			reject(new AxiosError("Unsupported protocol " + protocol + ":", AxiosError.ERR_BAD_REQUEST, config));
+			done();
 			return;
 		}
 		request.send(requestData || null);
@@ -12067,7 +12870,14 @@ var composeSignals = (signals, timeout) => {
 		});
 		signals = null;
 	};
-	signals.forEach((signal) => signal.addEventListener("abort", onabort));
+	signals.forEach((signal) => {
+		if (aborted) return;
+		if (signal.aborted) {
+			onabort.call(signal);
+			return;
+		}
+		signal.addEventListener("abort", onabort, { once: true });
+	});
 	const { signal } = controller;
 	signal.unsubscribe = () => utils_default.asap(unsubscribe);
 	return signal;
@@ -12143,56 +12953,71 @@ var trackStream = (stream, chunkSize, onProgress, onFinish) => {
 //#endregion
 //#region node_modules/axios/lib/helpers/estimateDataURLDecodedBytes.js
 /**
-* Estimate decoded byte length of a data:// URL *without* allocating large buffers.
-* - For base64: compute exact decoded size using length and padding;
-*               handle %XX at the character-count level (no string allocation).
-* - For non-base64: use UTF-8 byteLength of the encoded body as a safe upper bound.
-*
-* @param {string} url
-* @returns {number}
+* Estimate data: URL byte lengths *without* allocating large buffers.
+* - Fetch percent-decodes a base64 body before decoding it.
+* - Node's Buffer.from(body, 'base64') sizes its backing allocation from the
+*   raw body, including ignored characters and content after padding.
+* - Non-base64 data is percent-decoded and then encoded as UTF-8.
 */
-function estimateDataURLDecodedBytes(url) {
+var isHexDigit = (charCode) => charCode >= 48 && charCode <= 57 || charCode >= 65 && charCode <= 70 || charCode >= 97 && charCode <= 102;
+var isPercentEncodedByte = (str, i, len) => i + 2 < len && isHexDigit(str.charCodeAt(i + 1)) && isHexDigit(str.charCodeAt(i + 2));
+var hexValue = (charCode) => charCode <= 57 ? charCode - 48 : (charCode & 223) - 55;
+var isBase64Char = (charCode) => charCode >= 65 && charCode <= 90 || charCode >= 97 && charCode <= 122 || charCode >= 48 && charCode <= 57 || charCode === 43 || charCode === 47 || charCode === 45 || charCode === 95;
+var isBase64Whitespace = (charCode) => charCode === 9 || charCode === 10 || charCode === 12 || charCode === 13 || charCode === 32;
+var base64Bytes = (significant) => {
+	const groups = Math.floor(significant / 4);
+	const remainder = significant % 4;
+	return groups * 3 + (remainder === 2 ? 1 : remainder === 3 ? 2 : 0);
+};
+var estimateBase64BufferAllocation = (body) => {
+	const len = body.length;
+	let padding = 0;
+	if (len > 0 && body.charCodeAt(len - 1) === 61) {
+		padding++;
+		if (len > 1 && body.charCodeAt(len - 2) === 61) padding++;
+	}
+	return Math.floor((len - padding) * 3 / 4);
+};
+var estimatePercentDecodedBase64Bytes = (body) => {
+	const len = body.length;
+	let significant = 0;
+	let padding = 0;
+	let invalid = false;
+	for (let i = 0; i < len; i++) {
+		let code = body.charCodeAt(i);
+		if (code === 37 && isPercentEncodedByte(body, i, len)) {
+			code = hexValue(body.charCodeAt(i + 1)) * 16 + hexValue(body.charCodeAt(i + 2));
+			i += 2;
+		}
+		if (isBase64Whitespace(code)) continue;
+		if (code === 61) {
+			padding++;
+			continue;
+		}
+		if (!isBase64Char(code) || padding > 0) {
+			invalid = true;
+			continue;
+		}
+		significant++;
+	}
+	if (invalid || padding > 2 || padding > 0 && (significant + padding) % 4 !== 0 || significant % 4 === 1) return estimateBase64BufferAllocation(body);
+	return base64Bytes(significant);
+};
+var estimateDataURLBytes = (url, estimateBase64) => {
 	if (!url || typeof url !== "string") return 0;
 	if (!url.startsWith("data:")) return 0;
 	const comma = url.indexOf(",");
 	if (comma < 0) return 0;
 	const meta = url.slice(5, comma);
 	const body = url.slice(comma + 1);
-	if (/;base64/i.test(meta)) {
-		let effectiveLen = body.length;
-		const len = body.length;
-		for (let i = 0; i < len; i++) if (body.charCodeAt(i) === 37 && i + 2 < len) {
-			const a = body.charCodeAt(i + 1);
-			const b = body.charCodeAt(i + 2);
-			if ((a >= 48 && a <= 57 || a >= 65 && a <= 70 || a >= 97 && a <= 102) && (b >= 48 && b <= 57 || b >= 65 && b <= 70 || b >= 97 && b <= 102)) {
-				effectiveLen -= 2;
-				i += 2;
-			}
-		}
-		let pad = 0;
-		let idx = len - 1;
-		const tailIsPct3D = (j) => j >= 2 && body.charCodeAt(j - 2) === 37 && body.charCodeAt(j - 1) === 51 && (body.charCodeAt(j) === 68 || body.charCodeAt(j) === 100);
-		if (idx >= 0) {
-			if (body.charCodeAt(idx) === 61) {
-				pad++;
-				idx--;
-			} else if (tailIsPct3D(idx)) {
-				pad++;
-				idx -= 3;
-			}
-		}
-		if (pad === 1 && idx >= 0) {
-			if (body.charCodeAt(idx) === 61) pad++;
-			else if (tailIsPct3D(idx)) pad++;
-		}
-		const bytes = Math.floor(effectiveLen / 4) * 3 - (pad || 0);
-		return bytes > 0 ? bytes : 0;
-	}
-	if (typeof Buffer !== "undefined" && typeof Buffer.byteLength === "function") return Buffer.byteLength(body, "utf8");
+	if (/;base64/i.test(meta)) return estimateBase64(body);
 	let bytes = 0;
 	for (let i = 0, len = body.length; i < len; i++) {
 		const c = body.charCodeAt(i);
-		if (c < 128) bytes += 1;
+		if (c === 37 && isPercentEncodedByte(body, i, len)) {
+			bytes += 1;
+			i += 2;
+		} else if (c < 128) bytes += 1;
 		else if (c < 2048) bytes += 2;
 		else if (c >= 55296 && c <= 56319 && i + 1 < len) {
 			const next = body.charCodeAt(i + 1);
@@ -12203,13 +13028,34 @@ function estimateDataURLDecodedBytes(url) {
 		} else bytes += 3;
 	}
 	return bytes;
+};
+/**
+* Estimate the percent-decoded payload size used by Fetch data: URLs.
+*
+* @param {string} url
+* @returns {number}
+*/
+function estimateDataURLDecodedBytes(url) {
+	const fragmentIndex = typeof url === "string" ? url.indexOf("#") : -1;
+	return estimateDataURLBytes(fragmentIndex === -1 ? url : url.slice(0, fragmentIndex), estimatePercentDecodedBase64Bytes);
 }
 //#endregion
 //#region node_modules/axios/lib/env/data.js
-var VERSION = "1.17.0";
+var VERSION = "1.20.0";
 //#endregion
 //#region node_modules/axios/lib/adapters/fetch.js
-var DEFAULT_CHUNK_SIZE = 64 * 1024;
+var DEFAULT_CHUNK_SIZE = 65536;
+var DEFAULT_REQUEST_OPTIONS = {
+	cache: "default",
+	redirect: "follow",
+	referrer: "about:client",
+	referrerPolicy: "",
+	mode: "cors",
+	integrity: "",
+	keepalive: false,
+	priority: "auto",
+	window: null
+};
 var { isFunction } = utils_default;
 /**
 * Encode a UTF-8 string to a Latin-1 byte string for use with btoa().
@@ -12302,7 +13148,7 @@ var factory = (env) => {
 		return length == null ? getBodyLength(body) : length;
 	};
 	return async (config) => {
-		let { url, method, data, signal, cancelToken, timeout, onDownloadProgress, onUploadProgress, responseType, headers, withCredentials = "same-origin", fetchOptions, maxContentLength, maxBodyLength } = resolveConfig(config);
+		let { url, method, data, signal, cancelToken, timeout, onDownloadProgress, onUploadProgress, responseType, headers, withCredentials = "same-origin", fetchOptions, maxContentLength, maxBodyLength, maxRedirects } = resolveConfig(config);
 		const hasMaxContentLength = utils_default.isNumber(maxContentLength) && maxContentLength > -1;
 		const hasMaxBodyLength = utils_default.isNumber(maxBodyLength) && maxBodyLength > -1;
 		const own = (key) => utils_default.hasOwnProp(config, key) ? config[key] : void 0;
@@ -12314,12 +13160,14 @@ var factory = (env) => {
 			composedSignal.unsubscribe();
 		});
 		let requestContentLength;
+		let pendingBodyError = null;
+		const maxBodyLengthError = () => new AxiosError("Request body larger than maxBodyLength limit", AxiosError.ERR_BAD_REQUEST, config, request);
 		try {
 			let auth = void 0;
 			const configAuth = own("auth");
 			if (configAuth) auth = {
-				username: configAuth.username || "",
-				password: configAuth.password || ""
+				username: utils_default.getSafeProp(configAuth, "username") || "",
+				password: utils_default.getSafeProp(configAuth, "password") || ""
 			};
 			if (maybeWithAuthCredentials(url)) {
 				const parsedURL = new URL(url, platform_default.origin);
@@ -12341,22 +13189,34 @@ var factory = (env) => {
 				if (estimateDataURLDecodedBytes(url) > maxContentLength) throw new AxiosError("maxContentLength size of " + maxContentLength + " exceeded", AxiosError.ERR_BAD_RESPONSE, config, request);
 			}
 			if (hasMaxBodyLength && method !== "get" && method !== "head") {
-				const outboundLength = await resolveBodyLength(headers, data);
-				if (typeof outboundLength === "number" && isFinite(outboundLength) && outboundLength > maxBodyLength) throw new AxiosError("Request body larger than maxBodyLength limit", AxiosError.ERR_BAD_REQUEST, config, request);
-			}
-			if (onUploadProgress && supportsRequestStream && method !== "get" && method !== "head" && (requestContentLength = await resolveBodyLength(headers, data)) !== 0) {
-				let _request = new Request(url, {
-					method: "POST",
-					body: data,
-					duplex: "half"
-				});
-				let contentTypeHeader;
-				if (utils_default.isFormData(data) && (contentTypeHeader = _request.headers.get("content-type"))) headers.setContentType(contentTypeHeader);
-				if (_request.body) {
-					const [onProgress, flush] = progressEventDecorator(requestContentLength, progressEventReducer(asyncDecorator(onUploadProgress)));
-					data = trackStream(_request.body, DEFAULT_CHUNK_SIZE, onProgress, flush);
+				const outboundLength = await getBodyLength(data);
+				if (typeof outboundLength === "number" && isFinite(outboundLength)) {
+					requestContentLength = outboundLength;
+					if (outboundLength > maxBodyLength) throw maxBodyLengthError();
 				}
 			}
+			const mustEnforceStreamBody = hasMaxBodyLength && (utils_default.isReadableStream(data) || utils_default.isStream(data));
+			const trackRequestStream = (stream, onProgress, flush) => trackStream(stream, DEFAULT_CHUNK_SIZE, (loadedBytes) => {
+				if (hasMaxBodyLength && loadedBytes > maxBodyLength) throw pendingBodyError = maxBodyLengthError();
+				onProgress && onProgress(loadedBytes);
+			}, flush);
+			if (supportsRequestStream && method !== "get" && method !== "head" && (onUploadProgress || mustEnforceStreamBody)) {
+				requestContentLength = requestContentLength == null ? await resolveBodyLength(headers, data) : requestContentLength;
+				if (requestContentLength !== 0 || mustEnforceStreamBody) {
+					let _request = new Request(url, {
+						method: "POST",
+						body: data,
+						duplex: "half"
+					});
+					let contentTypeHeader;
+					if (utils_default.isFormData(data) && (contentTypeHeader = _request.headers.get("content-type"))) headers.setContentType(contentTypeHeader);
+					if (_request.body) {
+						const [onProgress, flush] = onUploadProgress && progressEventDecorator(requestContentLength, progressEventReducer(asyncDecorator(onUploadProgress))) || [];
+						data = trackRequestStream(_request.body, onProgress, flush);
+					}
+				}
+			} else if (mustEnforceStreamBody && !isRequestSupported && isReadableStreamSupported && method !== "get" && method !== "head") data = trackRequestStream(data);
+			else if (mustEnforceStreamBody && isRequestSupported && !supportsRequestStream && method !== "get" && method !== "head") throw new AxiosError("Stream request bodies are not supported by the current fetch implementation", AxiosError.ERR_NOT_SUPPORT, config, request);
 			if (!utils_default.isString(withCredentials)) withCredentials = withCredentials ? "include" : "omit";
 			const isCredentialsSupported = isRequestSupported && "credentials" in Request.prototype;
 			if (utils_default.isFormData(data)) {
@@ -12364,19 +13224,39 @@ var factory = (env) => {
 				if (contentType && /^multipart\/form-data/i.test(contentType) && !/boundary=/i.test(contentType)) headers.delete("content-type");
 			}
 			headers.set("User-Agent", "axios/" + VERSION, false);
-			const resolvedOptions = {
-				...fetchOptions,
+			const safeFetchOptions = fetchOptions == null ? fetchOptions : Object.assign(Object.create(null), fetchOptions);
+			if (safeFetchOptions) {
+				delete safeFetchOptions.body;
+				delete safeFetchOptions.headers;
+				delete safeFetchOptions.method;
+				delete safeFetchOptions.signal;
+				delete safeFetchOptions.duplex;
+				delete safeFetchOptions.credentials;
+			}
+			const resolvedOptions = Object.assign(Object.create(null), safeFetchOptions, {
 				signal: composedSignal,
 				method: method.toUpperCase(),
 				headers: toByteStringHeaderObject(headers.normalize()),
 				body: data,
 				duplex: "half",
 				credentials: isCredentialsSupported ? withCredentials : void 0
-			};
+			});
+			if (isRequestSupported) {
+				utils_default.forEach(DEFAULT_REQUEST_OPTIONS, (value, key) => {
+					if (resolvedOptions[key] === void 0) resolvedOptions[key] = value;
+				});
+				if (resolvedOptions.signal === void 0) resolvedOptions.signal = null;
+				if (resolvedOptions.body === void 0) resolvedOptions.body = null;
+			}
+			if (maxRedirects === 0) {
+				resolvedOptions.redirect = "manual";
+				if (safeFetchOptions) safeFetchOptions.redirect = "manual";
+			}
 			request = isRequestSupported && new Request(url, resolvedOptions);
-			let response = await (isRequestSupported ? _fetch(request, fetchOptions) : _fetch(url, resolvedOptions));
+			let response = await (isRequestSupported ? _fetch(request, safeFetchOptions) : _fetch(url, resolvedOptions));
+			const responseHeaders = AxiosHeaders.from(response.headers);
 			if (hasMaxContentLength) {
-				const declaredLength = utils_default.toFiniteNumber(response.headers.get("content-length"));
+				const declaredLength = utils_default.toFiniteNumber(responseHeaders.getContentLength());
 				if (declaredLength != null && declaredLength > maxContentLength) throw new AxiosError("maxContentLength size of " + maxContentLength + " exceeded", AxiosError.ERR_BAD_RESPONSE, config, request);
 			}
 			const isStreamResponse = supportsResponseStream && (responseType === "stream" || responseType === "response");
@@ -12389,7 +13269,7 @@ var factory = (env) => {
 				].forEach((prop) => {
 					options[prop] = response[prop];
 				});
-				const responseContentLength = utils_default.toFiniteNumber(response.headers.get("content-length"));
+				const responseContentLength = utils_default.toFiniteNumber(responseHeaders.getContentLength());
 				const [onProgress, flush] = onDownloadProgress && progressEventDecorator(responseContentLength, progressEventReducer(asyncDecorator(onDownloadProgress), true)) || [];
 				let bytesRead = 0;
 				const onChunkProgress = (loadedBytes) => {
@@ -12432,10 +13312,34 @@ var factory = (env) => {
 				const canceledError = composedSignal.reason;
 				canceledError.config = config;
 				request && (canceledError.request = request);
-				err !== canceledError && (canceledError.cause = err);
+				if (err !== canceledError) Object.defineProperty(canceledError, "cause", {
+					__proto__: null,
+					value: err,
+					writable: true,
+					enumerable: false,
+					configurable: true
+				});
 				throw canceledError;
 			}
-			if (err && err.name === "TypeError" && /Load failed|fetch/i.test(err.message)) throw Object.assign(new AxiosError("Network Error", AxiosError.ERR_NETWORK, config, request, err && err.response), { cause: err.cause || err });
+			if (pendingBodyError) {
+				request && !pendingBodyError.request && (pendingBodyError.request = request);
+				throw pendingBodyError;
+			}
+			if (err instanceof AxiosError) {
+				request && !err.request && (err.request = request);
+				throw err;
+			}
+			if (err && err.name === "TypeError" && /Load failed|fetch/i.test(err.message)) {
+				const networkError = new AxiosError("Network Error", AxiosError.ERR_NETWORK, config, request, err && err.response);
+				Object.defineProperty(networkError, "cause", {
+					__proto__: null,
+					value: err.cause || err,
+					writable: true,
+					enumerable: false,
+					configurable: true
+				});
+				throw networkError;
+			}
 			throw AxiosError.from(err, err && err.code, config, request, err && err.response);
 		}
 	};
@@ -12532,7 +13436,7 @@ function getAdapter(adapters, config) {
 	}
 	if (!adapter) {
 		const reasons = Object.entries(rejectedReasons).map(([id, state]) => `adapter ${id} ` + (state === false ? "is not supported by the environment" : "is not available in the build"));
-		throw new AxiosError(`There is no suitable adapter to dispatch the request ` + (length ? reasons.length > 1 ? "since :\n" + reasons.map(renderReason).join("\n") : " " + renderReason(reasons[0]) : "as no adapter specified"), "ERR_NOT_SUPPORT");
+		throw new AxiosError(`There is no suitable adapter to dispatch the request ` + (length ? reasons.length > 1 ? "since :\n" + reasons.map(renderReason).join("\n") : " " + renderReason(reasons[0]) : "as no adapter specified"), AxiosError.ERR_NOT_SUPPORT);
 	}
 	return adapter;
 }
@@ -12571,9 +13475,10 @@ function throwIfCancellationRequested(config) {
 *
 * @returns {Promise} The Promise to be fulfilled
 */
-function dispatchRequest(config) {
+function dispatchRequest(_config) {
+	const config = utils_default.toSafeFlatObject(_config);
 	throwIfCancellationRequested(config);
-	config.headers = AxiosHeaders.from(config.headers);
+	config.headers = AxiosHeaders.from(utils_default.getSafeProp(config, "headers"));
 	config.data = transformData.call(config, config.transformRequest);
 	if ([
 		"post",
@@ -12660,7 +13565,7 @@ validators$1.spelling = function spelling(correctSpelling) {
 * @returns {object}
 */
 function assertOptions(options, schema, allowUnknown) {
-	if (typeof options !== "object") throw new AxiosError("options must be an object", AxiosError.ERR_BAD_OPTION_VALUE);
+	if (typeof options !== "object" || options === null) throw new AxiosError("options must be an object", AxiosError.ERR_BAD_OPTION_VALUE);
 	const keys = Object.keys(options);
 	let i = keys.length;
 	while (i-- > 0) {
@@ -12709,24 +13614,23 @@ var Axios = class {
 		try {
 			return await this._request(configOrUrl, config);
 		} catch (err) {
-			if (err instanceof Error) {
+			if (err instanceof Error) try {
 				let dummy = {};
 				Error.captureStackTrace ? Error.captureStackTrace(dummy) : dummy = /* @__PURE__ */ new Error();
-				const stack = (() => {
-					if (!dummy.stack) return "";
-					const firstNewlineIndex = dummy.stack.indexOf("\n");
-					return firstNewlineIndex === -1 ? "" : dummy.stack.slice(firstNewlineIndex + 1);
-				})();
-				try {
-					if (!err.stack) err.stack = stack;
-					else if (stack) {
-						const firstNewlineIndex = stack.indexOf("\n");
-						const secondNewlineIndex = firstNewlineIndex === -1 ? -1 : stack.indexOf("\n", firstNewlineIndex + 1);
-						const stackWithoutTwoTopLines = secondNewlineIndex === -1 ? "" : stack.slice(secondNewlineIndex + 1);
-						if (!String(err.stack).endsWith(stackWithoutTwoTopLines)) err.stack += "\n" + stack;
-					}
-				} catch (e) {}
-			}
+				const dummyStack = dummy.stack;
+				let stack = "";
+				if (typeof dummyStack === "string") {
+					const firstNewlineIndex = dummyStack.indexOf("\n");
+					stack = firstNewlineIndex === -1 ? "" : dummyStack.slice(firstNewlineIndex + 1);
+				}
+				if (!err.stack) err.stack = stack;
+				else if (stack) {
+					const firstNewlineIndex = stack.indexOf("\n");
+					const secondNewlineIndex = firstNewlineIndex === -1 ? -1 : stack.indexOf("\n", firstNewlineIndex + 1);
+					const stackWithoutTwoTopLines = secondNewlineIndex === -1 ? "" : stack.slice(secondNewlineIndex + 1);
+					if (!String(err.stack).endsWith(stackWithoutTwoTopLines)) err.stack += "\n" + stack;
+				}
+			} catch (e) {}
 			throw err;
 		}
 	}
@@ -12742,31 +13646,25 @@ var Axios = class {
 			forcedJSONParsing: validators.transitional(validators.boolean),
 			clarifyTimeoutError: validators.transitional(validators.boolean),
 			legacyInterceptorReqResOrdering: validators.transitional(validators.boolean),
-			advertiseZstdAcceptEncoding: validators.transitional(validators.boolean)
+			advertiseZstdAcceptEncoding: validators.transitional(validators.boolean),
+			validateStatusUndefinedResolves: validators.transitional(validators.boolean)
 		}, false);
-		if (paramsSerializer != null) if (utils_default.isFunction(paramsSerializer)) config.paramsSerializer = { serialize: paramsSerializer };
-		else validator_default.assertOptions(paramsSerializer, {
-			encode: validators.function,
-			serialize: validators.function
-		}, true);
+		if (paramsSerializer != null) {
+			if (utils_default.isFunction(paramsSerializer)) config.paramsSerializer = { serialize: paramsSerializer };
+			else validator_default.assertOptions(paramsSerializer, {
+				encode: validators.function,
+				serialize: validators.function
+			}, true);
+		}
 		if (config.allowAbsoluteUrls !== void 0) {} else if (this.defaults.allowAbsoluteUrls !== void 0) config.allowAbsoluteUrls = this.defaults.allowAbsoluteUrls;
 		else config.allowAbsoluteUrls = true;
 		validator_default.assertOptions(config, {
 			baseUrl: validators.spelling("baseURL"),
 			withXsrfToken: validators.spelling("withXSRFToken")
 		}, true);
-		config.method = (config.method || this.defaults.method || "get").toLowerCase();
+		config.method = (utils_default.getSafeProp(config, "method") || utils_default.getSafeProp(this.defaults, "method") || "get").toLowerCase();
 		let contextHeaders = headers && utils_default.merge(headers.common, headers[config.method]);
-		headers && utils_default.forEach([
-			"delete",
-			"get",
-			"head",
-			"post",
-			"put",
-			"patch",
-			"query",
-			"common"
-		], (method) => {
+		headers && utils_default.forEach(methodList.concat("common"), (method) => {
 			delete headers[method];
 		});
 		config.headers = AxiosHeaders.concat(contextHeaders, headers);
@@ -12801,16 +13699,25 @@ var Axios = class {
 			const onFulfilled = requestInterceptorChain[i++];
 			const onRejected = requestInterceptorChain[i++];
 			try {
-				newConfig = onFulfilled(newConfig);
+				newConfig = onFulfilled ? onFulfilled(newConfig) : newConfig;
 			} catch (error) {
-				onRejected.call(this, error);
+				if (!onRejected) {
+					promise = Promise.reject(error);
+					break;
+				}
+				try {
+					const rejectedResult = onRejected.call(this, error);
+					if (utils_default.isThenable(rejectedResult)) promise = Promise.resolve(rejectedResult).then(() => dispatchRequest.call(this, newConfig));
+				} catch (rejectedError) {
+					promise = Promise.reject(rejectedError);
+				}
 				break;
 			}
 		}
-		try {
+		if (!promise) try {
 			promise = dispatchRequest.call(this, newConfig);
 		} catch (error) {
-			return Promise.reject(error);
+			promise = Promise.reject(error);
 		}
 		i = 0;
 		len = responseInterceptorChain.length;
@@ -12819,7 +13726,7 @@ var Axios = class {
 	}
 	getUri(config) {
 		config = mergeConfig(this.defaults, config);
-		return buildURL(buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls), config.params, config.paramsSerializer);
+		return buildURL(buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls, config), config.params, config.paramsSerializer);
 	}
 };
 utils_default.forEach([
@@ -12832,7 +13739,7 @@ utils_default.forEach([
 		return this.request(mergeConfig(config || {}, {
 			method,
 			url,
-			data: (config || {}).data
+			data: config && utils_default.hasOwnProp(config, "data") ? config.data : void 0
 		}));
 	};
 });
@@ -13022,14 +13929,22 @@ var HttpStatusCode = {
 	Gone: 410,
 	LengthRequired: 411,
 	PreconditionFailed: 412,
+	/**
+	* @deprecated Use `ContentTooLarge` instead.
+	*/
 	PayloadTooLarge: 413,
+	ContentTooLarge: 413,
 	UriTooLong: 414,
 	UnsupportedMediaType: 415,
 	RangeNotSatisfiable: 416,
 	ExpectationFailed: 417,
 	ImATeapot: 418,
 	MisdirectedRequest: 421,
+	/**
+	* @deprecated Use `UnprocessableContent` instead.
+	*/
 	UnprocessableEntity: 422,
+	UnprocessableContent: 422,
 	Locked: 423,
 	FailedDependency: 424,
 	TooEarly: 425,
@@ -13049,6 +13964,7 @@ var HttpStatusCode = {
 	LoopDetected: 508,
 	NotExtended: 510,
 	NetworkAuthenticationRequired: 511,
+	WebServerReturnsAnUnknownError: 520,
 	WebServerIsDown: 521,
 	ConnectionTimedOut: 522,
 	OriginIsUnreachable: 523,
@@ -13057,7 +13973,7 @@ var HttpStatusCode = {
 	InvalidSslCertificate: 526
 };
 Object.entries(HttpStatusCode).forEach(([key, value]) => {
-	HttpStatusCode[value] = key;
+	if (HttpStatusCode[value] === void 0) HttpStatusCode[value] = key;
 });
 //#endregion
 //#region node_modules/axios/lib/axios.js
@@ -13313,7 +14229,6 @@ var SocketIoClient = class extends import_tiny_emitter$1.TinyEmitter {
 					this.ResetSocket();
 					if (_nsshunt_stsutils.isNode) this.#reconnectTimeoutVal = setTimeout(() => this.#EstablishSocketConnect(), this.#reconnectTimeout).unref();
 					else this.#reconnectTimeoutVal = setTimeout(() => this.#EstablishSocketConnect(), this.#reconnectTimeout);
-					break;
 			}
 		});
 	}
@@ -13723,21 +14638,22 @@ function getInt64(view, offset) {
 var TIMESTAMP32_MAX_SEC = 4294967295;
 var TIMESTAMP64_MAX_SEC = 17179869183;
 function encodeTimeSpecToTimestamp({ sec, nsec }) {
-	if (sec >= 0 && nsec >= 0 && sec <= TIMESTAMP64_MAX_SEC) if (nsec === 0 && sec <= TIMESTAMP32_MAX_SEC) {
-		const rv = new Uint8Array(4);
-		new DataView(rv.buffer).setUint32(0, sec);
-		return rv;
+	if (sec >= 0 && nsec >= 0 && sec <= TIMESTAMP64_MAX_SEC) {
+		if (nsec === 0 && sec <= TIMESTAMP32_MAX_SEC) {
+			const rv = /* @__PURE__ */ new Uint8Array(4);
+			new DataView(rv.buffer).setUint32(0, sec);
+			return rv;
+		} else {
+			const secHigh = sec / 4294967296;
+			const secLow = sec & 4294967295;
+			const rv = /* @__PURE__ */ new Uint8Array(8);
+			const view = new DataView(rv.buffer);
+			view.setUint32(0, nsec << 2 | secHigh & 3);
+			view.setUint32(4, secLow);
+			return rv;
+		}
 	} else {
-		const secHigh = sec / 4294967296;
-		const secLow = sec & 4294967295;
-		const rv = new Uint8Array(8);
-		const view = new DataView(rv.buffer);
-		view.setUint32(0, nsec << 2 | secHigh & 3);
-		view.setUint32(4, secLow);
-		return rv;
-	}
-	else {
-		const rv = new Uint8Array(12);
+		const rv = /* @__PURE__ */ new Uint8Array(12);
 		const view = new DataView(rv.buffer);
 		view.setUint32(0, nsec);
 		setInt64(view, 4, sec);
@@ -14549,9 +15465,7 @@ var ObservabilityPayloadTransformer = class {
 			case SubscriptionTopic.AgentWorkers:
 				this.CreateModelAgentWorkers(subscriptionPayload);
 				break;
-			case SubscriptionTopic.AgentWorker:
-				this.CreateModelAgentWorker(subscriptionPayload);
-				break;
+			case SubscriptionTopic.AgentWorker: this.CreateModelAgentWorker(subscriptionPayload);
 		}
 	}
 	CreateModelAllServicesCombined(subscriptionPayload) {
@@ -14802,8 +15716,9 @@ var RESTClientSubscriber = class {
 				this.#LogDebugMessage(chalk.yellow(`RESTClientSubscriber:#InvokeRESTAPI(): axios call: endPointUrl: [${endPointUrl}]`));
 				if (_nsshunt_stsutils.isNode && this.#options.agentManager) retVal = await axios(new _nsshunt_stsutils.STSAxiosConfig(endPointUrl, "get").withDefaultHeaders().withAgentManager(this.#options.agentManager).config);
 				else retVal = await axios(new _nsshunt_stsutils.STSAxiosConfig(endPointUrl, "get").withDefaultHeaders().config);
-				if (retVal) if (retVal.data) {} else this.#LogDebugMessage(chalk.yellow(`RESTClientSubscriber:#InvokeRESTAPI(): no retVal.data`));
-				else this.#LogDebugMessage(chalk.yellow(`RESTClientSubscriber:#InvokeRESTAPI(): no retVal`));
+				if (retVal) {
+					if (retVal.data) {} else this.#LogDebugMessage(chalk.yellow(`RESTClientSubscriber:#InvokeRESTAPI(): no retVal.data`));
+				} else this.#LogDebugMessage(chalk.yellow(`RESTClientSubscriber:#InvokeRESTAPI(): no retVal`));
 				performance.now() - start;
 				if (subscriptionKey.topic.localeCompare(SubscriptionTopic.AllServicesCombined) === 0) return retVal.data["services"];
 				if (subscriptionKey.topic.localeCompare(SubscriptionTopic.AllAgentsCombined) === 0) return retVal.data["agents"];
@@ -14969,6 +15884,7 @@ var UXModelNavigator_default = /* @__PURE__ */ (0, vue.defineComponent)({
 		chalk$1.level = 3;
 		let subscriptionOptions;
 		const props = __props;
+		console.debug(`UXModelNavigator(): ModelStore`);
 		const store = ModelStore();
 		let observabilityPayloadTransformer = new ObservabilityPayloadTransformer({
 			logger: _nsshunt_stsutils.defaultLogger,
@@ -15091,9 +16007,7 @@ var UXModelNavigator_default = /* @__PURE__ */ (0, vue.defineComponent)({
 					case SubscriptionTopic.Services:
 						navigate(GetServiceInstancesSubscriptions(id));
 						break;
-					case SubscriptionTopic.ServiceInstances:
-						navigate(GetServiceInstanceSubscriptions(store._models[props.modelId].serviceModelSubscriptionKey?.key, id));
-						break;
+					case SubscriptionTopic.ServiceInstances: navigate(GetServiceInstanceSubscriptions(store._models[props.modelId].serviceModelSubscriptionKey?.key, id));
 				}
 			}
 		};
@@ -15340,7 +16254,7 @@ var UXTestForm_default = /* @__PURE__ */ (0, vue.defineComponent)({
 			return (0, vue.openBlock)(), (0, vue.createBlock)(_component_v_container, { class: "yellowgreen" }, {
 				default: (0, vue.withCtx)(() => [
 					(0, vue.createVNode)(_component_v_row, null, {
-						default: (0, vue.withCtx)(() => [_cache[0] || (_cache[0] = (0, vue.createElementVNode)("div", null, " UXTestForm ", -1)), (0, vue.createVNode)(_component_v_divider)]),
+						default: (0, vue.withCtx)(() => [_cache[0] || (_cache[0] = (0, vue.createElementVNode)("div", null, "UXTestForm", -1)), (0, vue.createVNode)(_component_v_divider)]),
 						_: 1
 					}),
 					__props.showFormValues ? ((0, vue.openBlock)(), (0, vue.createBlock)(_component_v_row, { key: 0 }, {