@verdocs/web-sdk 6.9.12 → 6.10.0

package/dist/esm/verdocs-contact-picker.entry.js

@@ -6,7 +6,7 @@ import { f as convertToE164 } from './utils-D9l-GFdv.js';
 import './index-BglCURB-.js';
 import './Types-CIxfEdV7.js';
 
-/*! Axios v1.17.0 Copyright (c) 2026 Matt Zabriskie and contributors */
+/*! Axios v1.18.1 Copyright (c) 2026 Matt Zabriskie and contributors */
 
 var axios_1;
 var hasRequiredAxios;
@@ -34,6 +34,57 @@ function requireAxios () {
 	const { getPrototypeOf } = Object;
 	const { iterator, toStringTag } = Symbol;
 
+	/* Creating a function that will check if an object has a property. */
+	const hasOwnProperty = (
+	  ({ hasOwnProperty }) =>
+	  (obj, prop) =>
+	    hasOwnProperty.call(obj, prop)
+	)(Object.prototype);
+
+	/**
+	 * Walk the prototype chain (excluding the shared Object.prototype) looking for
+	 * an own `prop`. This distinguishes genuine own/inherited members — including
+	 * class accessors and template prototypes — from members injected via
+	 * Object.prototype pollution (e.g. `Object.prototype.username = '...'`), which
+	 * live on Object.prototype itself and are therefore never matched.
+	 *
+	 * @param {*} thing The value whose chain to inspect
+	 * @param {string|symbol} prop The property key to look for
+	 *
+	 * @returns {boolean} True when `prop` is owned below Object.prototype
+	 */
+	const hasOwnInPrototypeChain = (thing, prop) => {
+	  let obj = thing;
+	  const seen = [];
+
+	  while (obj != null && obj !== Object.prototype) {
+	    if (seen.indexOf(obj) !== -1) {
+	      return false;
+	    }
+	    seen.push(obj);
+
+	    if (hasOwnProperty(obj, prop)) {
+	      return true;
+	    }
+	    obj = getPrototypeOf(obj);
+	  }
+	  return false;
+	};
+
+	/**
+	 * Read `obj[prop]` only when it is safe from Object.prototype pollution. Own
+	 * properties and members inherited from a non-Object.prototype source (a class
+	 * instance or template object) are honored; a value reachable only through a
+	 * polluted Object.prototype is ignored and `undefined` is returned.
+	 *
+	 * @param {*} obj The source object
+	 * @param {string|symbol} prop The property key to read
+	 *
+	 * @returns {*} The resolved value, or undefined when unsafe/absent
+	 */
+	const getSafeProp = (obj, prop) =>
+	  obj != null && hasOwnInPrototypeChain(obj, prop) ? obj[prop] : undefined;
+
 	const kindOf = ((cache) => (thing) => {
 	  const str = toString.call(thing);
 	  return cache[str] || (cache[str] = str.slice(8, -1).toLowerCase());
@@ -159,7 +210,7 @@ function requireAxios () {
 	 * @returns {boolean} True if value is a plain Object, otherwise false
 	 */
 	const isPlainObject = (val) => {
-	  if (kindOf(val) !== 'object') {
+	  if (!isObject(val)) {
 	    return false;
 	  }
 
@@ -167,9 +218,12 @@ function requireAxios () {
 	  return (
 	    (prototype === null ||
 	      prototype === Object.prototype ||
-	      Object.getPrototypeOf(prototype) === null) &&
-	    !(toStringTag in val) &&
-	    !(iterator in val)
+	      getPrototypeOf(prototype) === null) &&
+	    // Treat any genuine (non-Object.prototype-polluted) Symbol.toStringTag or
+	    // Symbol.iterator as evidence the value is a tagged/iterable type rather
+	    // than a plain object, while ignoring keys injected onto Object.prototype.
+	    !hasOwnInPrototypeChain(val, toStringTag) &&
+	    !hasOwnInPrototypeChain(val, iterator)
 	  );
 	};
 
@@ -696,13 +750,6 @@ function requireAxios () {
 	  });
 	};
 
-	/* Creating a function that will check if an object has a property. */
-	const hasOwnProperty = (
-	  ({ hasOwnProperty }) =>
-	  (obj, prop) =>
-	    hasOwnProperty.call(obj, prop)
-	)(Object.prototype);
-
 	const { propertyIsEnumerable } = Object.prototype;
 
 	/**
@@ -916,6 +963,20 @@ function requireAxios () {
 
 	const isIterable = (thing) => thing != null && isFunction$1(thing[iterator]);
 
+	/**
+	 * Determine if a value is iterable via an iterator that is NOT sourced solely
+	 * from a polluted Object.prototype. Use this instead of `isIterable` whenever
+	 * the iterable comes from untrusted input (e.g. user-supplied header sources),
+	 * so `Object.prototype[Symbol.iterator] = ...` cannot turn an ordinary object
+	 * into an attacker-controlled entries iterator.
+	 *
+	 * @param {*} thing The value to test
+	 *
+	 * @returns {boolean} True if value has a non-polluted iterator
+	 */
+	const isSafeIterable = (thing) =>
+	  thing != null && hasOwnInPrototypeChain(thing, iterator) && isIterable(thing);
+
 	var utils$1 = {
 	  isArray,
 	  isArrayBuffer,
@@ -960,6 +1021,8 @@ function requireAxios () {
 	  isHTMLForm,
 	  hasOwnProperty,
 	  hasOwnProp: hasOwnProperty, // an alias to avoid ESLint no-prototype-builtins detection
+	  hasOwnInPrototypeChain,
+	  getSafeProp,
 	  reduceDescriptors,
 	  freezeMethods,
 	  toObjectSet,
@@ -976,6 +1039,7 @@ function requireAxios () {
 	  setImmediate: _setImmediate,
 	  asap,
 	  isIterable,
+	  isSafeIterable,
 	};
 
 	// RawAxiosHeaders whose duplicates are ignored by node
@@ -1208,8 +1272,8 @@ function requireAxios () {
 	      setHeaders(header, valueOrRewrite);
 	    } else if (utils$1.isString(header) && (header = header.trim()) && !isValidHeaderName(header)) {
 	      setHeaders(parseHeaders(header), valueOrRewrite);
-	    } else if (utils$1.isObject(header) && utils$1.isIterable(header)) {
-	      let obj = {},
+	    } else if (utils$1.isObject(header) && utils$1.isSafeIterable(header)) {
+	      let obj = Object.create(null),
 	        dest,
 	        key;
 	      for (const entry of header) {
@@ -1217,11 +1281,14 @@ function requireAxios () {
 	          throw new TypeError('Object iterator must return a key-value pair');
 	        }
 
-	        obj[(key = entry[0])] = (dest = obj[key])
-	          ? utils$1.isArray(dest)
-	            ? [...dest, entry[1]]
-	            : [dest, entry[1]]
-	          : entry[1];
+	        key = entry[0];
+
+	        if (utils$1.hasOwnProp(obj, key)) {
+	          dest = obj[key];
+	          obj[key] = utils$1.isArray(dest) ? [...dest, entry[1]] : [dest, entry[1]];
+	        } else {
+	          obj[key] = entry[1];
+	        }
 	      }
 
 	      setHeaders(obj, valueOrRewrite);
@@ -1514,7 +1581,19 @@ function requireAxios () {
 	class AxiosError extends Error {
 	  static from(error, code, config, request, response, customProps) {
 	    const axiosError = new AxiosError(error.message, code || error.code, config, request, response);
-	    axiosError.cause = error;
+	    // Match native `Error` `cause` semantics: non-enumerable. The wrapped
+	    // error often carries circular internals (sockets, requests, agents), so
+	    // an enumerable `cause` makes structured loggers (pino/winston) and any
+	    // own-property walk throw "Converting circular structure to JSON".
+	    // Regression from #6982; see #7205. `__proto__: null` mirrors the
+	    // `message` descriptor below (prototype-pollution-safe descriptor).
+	    Object.defineProperty(axiosError, 'cause', {
+	      __proto__: null,
+	      value: error,
+	      writable: true,
+	      enumerable: false,
+	      configurable: true,
+	    });
 	    axiosError.name = error.name;
 
 	    // Preserve status from the original error if not already set from response
@@ -1615,6 +1694,10 @@ function requireAxios () {
 	// eslint-disable-next-line strict
 	var httpAdapter = null;
 
+	// Default nesting limit shared with the inverse transform (formDataToJSON) so
+	// the FormData <-> JSON round-trip stays symmetric.
+	const DEFAULT_FORM_DATA_MAX_DEPTH = 100;
+
 	/**
 	 * Determines if the given thing is a array or js object.
 	 *
@@ -1725,8 +1808,9 @@ function requireAxios () {
 	  const dots = options.dots;
 	  const indexes = options.indexes;
 	  const _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob);
-	  const maxDepth = options.maxDepth === undefined ? 100 : options.maxDepth;
+	  const maxDepth = options.maxDepth === undefined ? DEFAULT_FORM_DATA_MAX_DEPTH : options.maxDepth;
 	  const useBlob = _Blob && utils$1.isSpecCompliantForm(formData);
+	  const stack = [];
 
 	  if (!utils$1.isFunction(visitor)) {
 	    throw new TypeError('visitor must be a function');
@@ -1748,12 +1832,50 @@ function requireAxios () {
 	    }
 
 	    if (utils$1.isArrayBuffer(value) || utils$1.isTypedArray(value)) {
-	      return useBlob && typeof Blob === 'function' ? new Blob([value]) : Buffer.from(value);
+	      if (useBlob && typeof _Blob === 'function') {
+	        return new _Blob([value]);
+	      }
+	      if (typeof Buffer !== 'undefined') {
+	        return Buffer.from(value);
+	      }
+	      throw new AxiosError('Blob is not supported. Use a Buffer instead.', AxiosError.ERR_NOT_SUPPORT);
 	    }
 
 	    return value;
 	  }
 
+	  function throwIfMaxDepthExceeded(depth) {
+	    if (depth > maxDepth) {
+	      throw new AxiosError(
+	        'Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth,
+	        AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED
+	      );
+	    }
+	  }
+
+	  function stringifyWithDepthLimit(value, depth) {
+	    if (maxDepth === Infinity) {
+	      return JSON.stringify(value);
+	    }
+
+	    const ancestors = [];
+
+	    return JSON.stringify(value, function limitDepth(_key, currentValue) {
+	      if (!utils$1.isObject(currentValue)) {
+	        return currentValue;
+	      }
+
+	      while (ancestors.length && ancestors[ancestors.length - 1] !== this) {
+	        ancestors.pop();
+	      }
+
+	      ancestors.push(currentValue);
+	      throwIfMaxDepthExceeded(depth + ancestors.length - 1);
+
+	      return currentValue;
+	    });
+	  }
+
 	  /**
 	   * Default visitor.
 	   *
@@ -1777,7 +1899,7 @@ function requireAxios () {
 	        // eslint-disable-next-line no-param-reassign
 	        key = metaTokens ? key : key.slice(0, -2);
 	        // eslint-disable-next-line no-param-reassign
-	        value = JSON.stringify(value);
+	        value = stringifyWithDepthLimit(value, 1);
 	      } else if (
 	        (utils$1.isArray(value) && isFlatArray(value)) ||
 	        ((utils$1.isFileList(value) || utils$1.endsWith(key, '[]')) && (arr = utils$1.toArray(value)))
@@ -1810,8 +1932,6 @@ function requireAxios () {
 	    return false;
 	  }
 
-	  const stack = [];
-
 	  const exposedHelpers = Object.assign(predicates, {
 	    defaultVisitor,
 	    convertValue,
@@ -1821,12 +1941,7 @@ function requireAxios () {
 	  function build(value, path, depth = 0) {
 	    if (utils$1.isUndefined(value)) return;
 
-	    if (depth > maxDepth) {
-	      throw new AxiosError(
-	        'Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth,
-	        AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED
-	      );
-	    }
+	    throwIfMaxDepthExceeded(depth);
 
 	    if (stack.indexOf(value) !== -1) {
 	      throw new Error('Circular reference detected in ' + path.join('.'));
@@ -1900,9 +2015,7 @@ function requireAxios () {
 
 	prototype.toString = function toString(encoder) {
 	  const _encode = encoder
-	    ? function (value) {
-	        return encoder.call(this, value, encode$1);
-	      }
+	    ? (value) => encoder.call(this, value, encode$1)
 	    : encode$1;
 
 	  return this._pairs
@@ -1941,8 +2054,7 @@ function requireAxios () {
 	  if (!params) {
 	    return url;
 	  }
-
-	  const _encode = (options && options.encode) || encode;
+	  url = url || '';
 
 	  const _options = utils$1.isFunction(options)
 	    ? {
@@ -1950,7 +2062,11 @@ function requireAxios () {
 	      }
 	    : options;
 
-	  const serializeFn = _options && _options.serialize;
+	  // Read serializer options pollution-safely: own properties and methods on a
+	  // class/template prototype are honored, but values injected onto a polluted
+	  // Object.prototype are ignored.
+	  const _encode = utils$1.getSafeProp(_options, 'encode') || encode;
+	  const serializeFn = utils$1.getSafeProp(_options, 'serialize');
 
 	  let serializedParams;
 
@@ -2047,6 +2163,7 @@ function requireAxios () {
 	  clarifyTimeoutError: false,
 	  legacyInterceptorReqResOrdering: true,
 	  advertiseZstdAcceptEncoding: false,
+	  validateStatusUndefinedResolves: true,
 	};
 
 	var URLSearchParams$1 = typeof URLSearchParams !== 'undefined' ? URLSearchParams : AxiosURLSearchParams;
@@ -2138,6 +2255,17 @@ function requireAxios () {
 	  });
 	}
 
+	const MAX_DEPTH = DEFAULT_FORM_DATA_MAX_DEPTH;
+
+	function throwIfDepthExceeded(index) {
+	  if (index > MAX_DEPTH) {
+	    throw new AxiosError(
+	      'FormData field is too deeply nested (' + index + ' levels). Max depth: ' + MAX_DEPTH,
+	      AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED
+	    );
+	  }
+	}
+
 	/**
 	 * It takes a string like `foo[x][y][z]` and returns an array like `['foo', 'x', 'y', 'z']
 	 *
@@ -2150,9 +2278,16 @@ function requireAxios () {
 	  // foo.x.y.z
 	  // foo-x-y-z
 	  // foo x y z
-	  return utils$1.matchAll(/\w+|\[(\w*)]/g, name).map((match) => {
-	    return match[0] === '[]' ? '' : match[1] || match[0];
-	  });
+	  const path = [];
+	  const pattern = /\w+|\[(\w*)]/g;
+	  let match;
+
+	  while ((match = pattern.exec(name)) !== null) {
+	    throwIfDepthExceeded(path.length);
+	    path.push(match[0] === '[]' ? '' : match[1] || match[0]);
+	  }
+
+	  return path;
 	}
 
 	/**
@@ -2184,6 +2319,8 @@ function requireAxios () {
 	 */
 	function formDataToJSON(formData) {
 	  function buildPath(path, value, target, index) {
+	    throwIfDepthExceeded(index);
+
 	    let name = path[index++];
 
 	    if (name === '__proto__') return true;
@@ -2669,7 +2806,11 @@ function requireAxios () {
 	          const cookie = cookies[i].replace(/^\s+/, '');
 	          const eq = cookie.indexOf('=');
 	          if (eq !== -1 && cookie.slice(0, eq) === name) {
-	            return decodeURIComponent(cookie.slice(eq + 1));
+	            try {
+	              return decodeURIComponent(cookie.slice(eq + 1));
+	            } catch (e) {
+	              return cookie.slice(eq + 1);
+	            }
 	          }
 	        }
 	        return null;
@@ -2720,6 +2861,31 @@ function requireAxios () {
 	    : baseURL;
 	}
 
+	const malformedHttpProtocol = /^https?:(?!\/\/)/i;
+	const httpProtocolControlCharacters = /[\t\n\r]/g;
+
+	function stripLeadingC0ControlOrSpace(url) {
+	  let i = 0;
+	  while (i < url.length && url.charCodeAt(i) <= 0x20) {
+	    i++;
+	  }
+	  return url.slice(i);
+	}
+
+	function normalizeURLForProtocolCheck(url) {
+	  return stripLeadingC0ControlOrSpace(url).replace(httpProtocolControlCharacters, '');
+	}
+
+	function assertValidHttpProtocolURL(url, config) {
+	  if (typeof url === 'string' && malformedHttpProtocol.test(normalizeURLForProtocolCheck(url))) {
+	    throw new AxiosError(
+	      'Invalid URL: missing "//" after protocol',
+	      AxiosError.ERR_INVALID_URL,
+	      config
+	    );
+	  }
+	}
+
 	/**
 	 * Creates a new URL by combining the baseURL with the requestedURL,
 	 * only when the requestedURL is not already an absolute URL.
@@ -2730,9 +2896,11 @@ function requireAxios () {
 	 *
 	 * @returns {string} The combined full path
 	 */
-	function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
+	function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls, config) {
+	  assertValidHttpProtocolURL(requestedURL, config);
 	  let isRelativeUrl = !isAbsoluteURL(requestedURL);
 	  if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
+	    assertValidHttpProtocolURL(baseURL, config);
 	    return combineURLs(baseURL, requestedURL);
 	  }
 	  return requestedURL;
@@ -2751,6 +2919,7 @@ function requireAxios () {
 	 */
 	function mergeConfig(config1, config2) {
 	  // eslint-disable-next-line no-param-reassign
+	  config1 = config1 || {};
 	  config2 = config2 || {};
 
 	  // Use a null-prototype object so that downstream reads such as `config.auth`
@@ -2803,6 +2972,28 @@ function requireAxios () {
 	    }
 	  }
 
+	  function getMergedTransitionalOption(prop) {
+	    const transitional2 = utils$1.hasOwnProp(config2, 'transitional') ? config2.transitional : undefined;
+
+	    if (!utils$1.isUndefined(transitional2)) {
+	      if (utils$1.isPlainObject(transitional2)) {
+	        if (utils$1.hasOwnProp(transitional2, prop)) {
+	          return transitional2[prop];
+	        }
+	      } else {
+	        return undefined;
+	      }
+	    }
+
+	    const transitional1 = utils$1.hasOwnProp(config1, 'transitional') ? config1.transitional : undefined;
+
+	    if (utils$1.isPlainObject(transitional1) && utils$1.hasOwnProp(transitional1, prop)) {
+	      return transitional1[prop];
+	    }
+
+	    return undefined;
+	  }
+
 	  // eslint-disable-next-line consistent-return
 	  function mergeDirectKeys(a, b, prop) {
 	    if (utils$1.hasOwnProp(config2, prop)) {
@@ -2855,6 +3046,18 @@ function requireAxios () {
 	    (utils$1.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
 	  });
 
+	  if (
+	    utils$1.hasOwnProp(config2, 'validateStatus') &&
+	    utils$1.isUndefined(config2.validateStatus) &&
+	    getMergedTransitionalOption('validateStatusUndefinedResolves') === false
+	  ) {
+	    if (utils$1.hasOwnProp(config1, 'validateStatus')) {
+	      config.validateStatus = getMergedValue(undefined, config1.validateStatus);
+	    } else {
+	      delete config.validateStatus;
+	    }
+	  }
+
 	  return config;
 	}
 
@@ -2866,7 +3069,7 @@ function requireAxios () {
 	    return;
 	  }
 
-	  Object.entries(formHeaders).forEach(([key, val]) => {
+	  Object.entries(formHeaders || {}).forEach(([key, val]) => {
 	    if (FORM_DATA_CONTENT_HEADERS.includes(key.toLowerCase())) {
 	      headers.set(key, val);
 	    }
@@ -2906,18 +3109,24 @@ function requireAxios () {
 	  newConfig.headers = headers = AxiosHeaders.from(headers);
 
 	  newConfig.url = buildURL(
-	    buildFullPath(baseURL, url, allowAbsoluteUrls),
+	    buildFullPath(baseURL, url, allowAbsoluteUrls, newConfig),
 	    own('params'),
 	    own('paramsSerializer')
 	  );
 
 	  // HTTP basic authentication
 	  if (auth) {
-	    headers.set(
-	      'Authorization',
-	      'Basic ' +
-	        btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8$1(auth.password) : ''))
-	    );
+	    const username = utils$1.getSafeProp(auth, 'username') || '';
+	    const password = utils$1.getSafeProp(auth, 'password') || '';
+
+	    try {
+	      headers.set(
+	        'Authorization',
+	        'Basic ' + btoa(username + ':' + (password ? encodeUTF8$1(password) : ''))
+	      );
+	    } catch (e) {
+	      throw AxiosError.from(e, AxiosError.ERR_BAD_OPTION_VALUE, config);
+	    }
 	  }
 
 	  if (utils$1.isFormData(data)) {
@@ -3168,6 +3377,7 @@ function requireAxios () {
 	            config
 	          )
 	        );
+	        done();
 	        return;
 	      }
 
@@ -3219,7 +3429,7 @@ function requireAxios () {
 	    signals = null;
 	  };
 
-	  signals.forEach((signal) => signal.addEventListener('abort', onabort));
+	  signals.forEach((signal) => signal.addEventListener('abort', onabort, { once: true }));
 
 	  const { signal } = controller;
 
@@ -3322,11 +3532,19 @@ function requireAxios () {
 	 * Estimate decoded byte length of a data:// URL *without* allocating large buffers.
 	 * - For base64: compute exact decoded size using length and padding;
 	 *               handle %XX at the character-count level (no string allocation).
-	 * - For non-base64: use UTF-8 byteLength of the encoded body as a safe upper bound.
+	 * - For non-base64: compute the exact percent-decoded UTF-8 byte length.
 	 *
 	 * @param {string} url
 	 * @returns {number}
 	 */
+	const isHexDigit = (charCode) =>
+	  (charCode >= 48 && charCode <= 57) ||
+	  (charCode >= 65 && charCode <= 70) ||
+	  (charCode >= 97 && charCode <= 102);
+
+	const isPercentEncodedByte = (str, i, len) =>
+	  i + 2 < len && isHexDigit(str.charCodeAt(i + 1)) && isHexDigit(str.charCodeAt(i + 2));
+
 	function estimateDataURLDecodedBytes(url) {
 	  if (!url || typeof url !== 'string') return 0;
 	  if (!url.startsWith('data:')) return 0;
@@ -3346,9 +3564,7 @@ function requireAxios () {
 	      if (body.charCodeAt(i) === 37 /* '%' */ && i + 2 < len) {
 	        const a = body.charCodeAt(i + 1);
 	        const b = body.charCodeAt(i + 2);
-	        const isHex =
-	          ((a >= 48 && a <= 57) || (a >= 65 && a <= 70) || (a >= 97 && a <= 102)) &&
-	          ((b >= 48 && b <= 57) || (b >= 65 && b <= 70) || (b >= 97 && b <= 102));
+	        const isHex = isHexDigit(a) && isHexDigit(b);
 
 	        if (isHex) {
 	          effectiveLen -= 2;
@@ -3389,18 +3605,17 @@ function requireAxios () {
 	    return bytes > 0 ? bytes : 0;
 	  }
 
-	  if (typeof Buffer !== 'undefined' && typeof Buffer.byteLength === 'function') {
-	    return Buffer.byteLength(body, 'utf8');
-	  }
-
 	  // Compute UTF-8 byte length directly from UTF-16 code units without allocating
 	  // a byte buffer (TextEncoder.encode would defeat the DoS guard on large bodies).
-	  // Using body.length here would undercount non-ASCII (e.g. '€' is 1 code unit
-	  // but 3 UTF-8 bytes).
+	  // Valid %XX triplets count as one decoded byte; this matches the bytes that
+	  // decodeURIComponent(body) would produce before Buffer re-encodes the string.
 	  let bytes = 0;
 	  for (let i = 0, len = body.length; i < len; i++) {
 	    const c = body.charCodeAt(i);
-	    if (c < 0x80) {
+	    if (c === 37 /* '%' */ && isPercentEncodedByte(body, i, len)) {
+	      bytes += 1;
+	      i += 2;
+	    } else if (c < 0x80) {
 	      bytes += 1;
 	    } else if (c < 0x800) {
 	      bytes += 2;
@@ -3419,7 +3634,7 @@ function requireAxios () {
 	  return bytes;
 	}
 
-	const VERSION = "1.17.0";
+	const VERSION = "1.18.1";
 
 	const DEFAULT_CHUNK_SIZE = 64 * 1024;
 
@@ -3640,14 +3855,28 @@ function requireAxios () {
 
 	    let requestContentLength;
 
+	    // AxiosError we raise while the request body is being streamed. Captured
+	    // by identity so the catch block can surface it directly, regardless of
+	    // how the runtime wraps the resulting fetch rejection (undici exposes it
+	    // as `err.cause`; some browsers drop the original error entirely).
+	    let pendingBodyError = null;
+
+	    const maxBodyLengthError = () =>
+	      new AxiosError(
+	        'Request body larger than maxBodyLength limit',
+	        AxiosError.ERR_BAD_REQUEST,
+	        config,
+	        request
+	      );
+
 	    try {
 	      // HTTP basic authentication
 	      let auth = undefined;
 	      const configAuth = own('auth');
 
 	      if (configAuth) {
-	        const username = configAuth.username || '';
-	        const password = configAuth.password || '';
+	        const username = utils$1.getSafeProp(configAuth, 'username') || '';
+	        const password = utils$1.getSafeProp(configAuth, 'password') || '';
 	        auth = {
 	          username,
 	          password
@@ -3696,53 +3925,96 @@ function requireAxios () {
 	        }
 	      }
 
-	      // Enforce maxBodyLength against the outbound request body before dispatch.
-	      // Mirrors http.js behavior (ERR_BAD_REQUEST / 'Request body larger than
-	      // maxBodyLength limit'). Skip when the body length cannot be determined
-	      // (e.g. a live ReadableStream supplied by the caller).
+	      // Enforce maxBodyLength against known-size bodies before dispatch using
+	      // the body's *actual* size — never a caller-declared Content-Length,
+	      // which could under-report to slip an oversized body past the check.
+	      // Unknown-size streams return undefined here and are counted per-chunk
+	      // below as fetch consumes them.
 	      if (hasMaxBodyLength && method !== 'get' && method !== 'head') {
-	        const outboundLength = await resolveBodyLength(headers, data);
-	        if (
-	          typeof outboundLength === 'number' &&
-	          isFinite(outboundLength) &&
-	          outboundLength > maxBodyLength
-	        ) {
-	          throw new AxiosError(
-	            'Request body larger than maxBodyLength limit',
-	            AxiosError.ERR_BAD_REQUEST,
-	            config,
-	            request
-	          );
+	        const outboundLength = await getBodyLength(data);
+	        if (typeof outboundLength === 'number' && isFinite(outboundLength)) {
+	          requestContentLength = outboundLength;
+	          if (outboundLength > maxBodyLength) {
+	            throw maxBodyLengthError();
+	          }
 	        }
 	      }
 
+	      // A streamed body under maxBodyLength must be counted as fetch consumes
+	      // it; its size is never trusted from a caller-declared Content-Length.
+	      const mustEnforceStreamBody =
+	        hasMaxBodyLength && (utils$1.isReadableStream(data) || utils$1.isStream(data));
+
+	      const trackRequestStream = (stream, onProgress, flush) =>
+	        trackStream(
+	          stream,
+	          DEFAULT_CHUNK_SIZE,
+	          (loadedBytes) => {
+	            if (hasMaxBodyLength && loadedBytes > maxBodyLength) {
+	              throw (pendingBodyError = maxBodyLengthError());
+	            }
+	            onProgress && onProgress(loadedBytes);
+	          },
+	          flush
+	        );
+
 	      if (
-	        onUploadProgress &&
 	        supportsRequestStream &&
 	        method !== 'get' &&
 	        method !== 'head' &&
-	        (requestContentLength = await resolveBodyLength(headers, data)) !== 0
+	        (onUploadProgress || mustEnforceStreamBody)
 	      ) {
-	        let _request = new Request(url, {
-	          method: 'POST',
-	          body: data,
-	          duplex: 'half',
-	        });
+	        requestContentLength =
+	          requestContentLength == null ? await resolveBodyLength(headers, data) : requestContentLength;
+
+	        // A declared length of 0 is only trusted to skip the wrap when we are
+	        // not enforcing a stream limit (which must not rely on that header).
+	        if (requestContentLength !== 0 || mustEnforceStreamBody) {
+	          let _request = new Request(url, {
+	            method: 'POST',
+	            body: data,
+	            duplex: 'half',
+	          });
 
-	        let contentTypeHeader;
+	          let contentTypeHeader;
 
-	        if (utils$1.isFormData(data) && (contentTypeHeader = _request.headers.get('content-type'))) {
-	          headers.setContentType(contentTypeHeader);
-	        }
+	          if (utils$1.isFormData(data) && (contentTypeHeader = _request.headers.get('content-type'))) {
+	            headers.setContentType(contentTypeHeader);
+	          }
 
-	        if (_request.body) {
-	          const [onProgress, flush] = progressEventDecorator(
-	            requestContentLength,
-	            progressEventReducer(asyncDecorator(onUploadProgress))
-	          );
+	          if (_request.body) {
+	            const [onProgress, flush] =
+	              (onUploadProgress &&
+	                progressEventDecorator(
+	                  requestContentLength,
+	                  progressEventReducer(asyncDecorator(onUploadProgress))
+	                )) ||
+	              [];
 
-	          data = trackStream(_request.body, DEFAULT_CHUNK_SIZE, onProgress, flush);
+	            data = trackRequestStream(_request.body, onProgress, flush);
+	          }
 	        }
+	      } else if (
+	        mustEnforceStreamBody &&
+	        !isRequestSupported &&
+	        isReadableStreamSupported &&
+	        method !== 'get' &&
+	        method !== 'head'
+	      ) {
+	        data = trackRequestStream(data);
+	      } else if (
+	        mustEnforceStreamBody &&
+	        isRequestSupported &&
+	        !supportsRequestStream &&
+	        method !== 'get' &&
+	        method !== 'head'
+	      ) {
+	        throw new AxiosError(
+	          'Stream request bodies are not supported by the current fetch implementation',
+	          AxiosError.ERR_NOT_SUPPORT,
+	          config,
+	          request
+	        );
 	      }
 
 	      if (!utils$1.isString(withCredentials)) {
@@ -3785,10 +4057,12 @@ function requireAxios () {
 	        ? _fetch(request, fetchOptions)
 	        : _fetch(url, resolvedOptions));
 
+	      const responseHeaders = AxiosHeaders.from(response.headers);
+
 	      // Cheap pre-check: if the server honestly declares a content-length that
 	      // already exceeds the cap, reject before we start streaming.
 	      if (hasMaxContentLength) {
-	        const declaredLength = utils$1.toFiniteNumber(response.headers.get('content-length'));
+	        const declaredLength = utils$1.toFiniteNumber(responseHeaders.getContentLength());
 	        if (declaredLength != null && declaredLength > maxContentLength) {
 	          throw new AxiosError(
 	            'maxContentLength size of ' + maxContentLength + ' exceeded',
@@ -3813,7 +4087,7 @@ function requireAxios () {
 	          options[prop] = response[prop];
 	        });
 
-	        const responseContentLength = utils$1.toFiniteNumber(response.headers.get('content-length'));
+	        const responseContentLength = utils$1.toFiniteNumber(responseHeaders.getContentLength());
 
 	        const [onProgress, flush] =
 	          (onDownloadProgress &&
@@ -3904,23 +4178,55 @@ function requireAxios () {
 	        const canceledError = composedSignal.reason;
 	        canceledError.config = config;
 	        request && (canceledError.request = request);
-	        err !== canceledError && (canceledError.cause = err);
+	        if (err !== canceledError) {
+	          // Non-enumerable to match native Error `cause` semantics so loggers
+	          // don't recurse into circular fetch internals (see #7205).
+	          Object.defineProperty(canceledError, 'cause', {
+	            __proto__: null,
+	            value: err,
+	            writable: true,
+	            enumerable: false,
+	            configurable: true,
+	          });
+	        }
 	        throw canceledError;
 	      }
 
+	      // Surface a maxBodyLength violation we raised while the request body was
+	      // being streamed. Matching by identity (rather than reading
+	      // `err.cause.isAxiosError`) keeps the error deterministic across runtimes
+	      // and avoids both prototype-pollution reads and mis-attributing a foreign
+	      // AxiosError that merely happened to land in `err.cause`.
+	      if (pendingBodyError) {
+	        request && !pendingBodyError.request && (pendingBodyError.request = request);
+	        throw pendingBodyError;
+	      }
+
+	      // Re-throw AxiosErrors we raised synchronously (data: URL / content-length
+	      // pre-checks, response size enforcement) without re-wrapping them.
+	      if (err instanceof AxiosError) {
+	        request && !err.request && (err.request = request);
+	        throw err;
+	      }
+
 	      if (err && err.name === 'TypeError' && /Load failed|fetch/i.test(err.message)) {
-	        throw Object.assign(
-	          new AxiosError(
-	            'Network Error',
-	            AxiosError.ERR_NETWORK,
-	            config,
-	            request,
-	            err && err.response
-	          ),
-	          {
-	            cause: err.cause || err,
-	          }
+	        const networkError = new AxiosError(
+	          'Network Error',
+	          AxiosError.ERR_NETWORK,
+	          config,
+	          request,
+	          err && err.response
 	        );
+	        // Non-enumerable to match native Error `cause` semantics so loggers
+	        // don't recurse into circular fetch internals (see #7205).
+	        Object.defineProperty(networkError, 'cause', {
+	          __proto__: null,
+	          value: err.cause || err,
+	          writable: true,
+	          enumerable: false,
+	          configurable: true,
+	        });
+	        throw networkError;
 	      }
 
 	      throw AxiosError.from(err, err && err.code, config, request, err && err.response);
@@ -4058,7 +4364,7 @@ function requireAxios () {
 
 	    throw new AxiosError(
 	      `There is no suitable adapter to dispatch the request ` + s,
-	      'ERR_NOT_SUPPORT'
+	      AxiosError.ERR_NOT_SUPPORT
 	    );
 	  }
 
@@ -4239,7 +4545,7 @@ function requireAxios () {
 	 */
 
 	function assertOptions(options, schema, allowUnknown) {
-	  if (typeof options !== 'object') {
+	  if (typeof options !== 'object' || options === null) {
 	    throw new AxiosError('options must be an object', AxiosError.ERR_BAD_OPTION_VALUE);
 	  }
 	  const keys = Object.keys(options);
@@ -4363,6 +4669,7 @@ function requireAxios () {
 	          clarifyTimeoutError: validators.transitional(validators.boolean),
 	          legacyInterceptorReqResOrdering: validators.transitional(validators.boolean),
 	          advertiseZstdAcceptEncoding: validators.transitional(validators.boolean),
+	          validateStatusUndefinedResolves: validators.transitional(validators.boolean),
 	        },
 	        false
 	      );
@@ -4492,7 +4799,7 @@ function requireAxios () {
 
 	  getUri(config) {
 	    config = mergeConfig(this.defaults, config);
-	    const fullPath = buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls);
+	    const fullPath = buildFullPath(config.baseURL, config.url, config.allowAbsoluteUrls, config);
 	    return buildURL(fullPath, config.params, config.paramsSerializer);
 	  }
 	}
@@ -4505,7 +4812,7 @@ function requireAxios () {
 	      mergeConfig(config || {}, {
 	        method,
 	        url,
-	        data: (config || {}).data,
+	        data: config && utils$1.hasOwnProp(config, 'data') ? config.data : undefined,
 	      })
 	    );
 	  };